[Reliability] `init --install-hook` silently installs a post-commit hook in addition to prepare-commit-msg

[404-Page-Found]

Description

installPrepareCommitMsgHook() always installs two hooks — post-commit and prepare-commit-msg — but the CLI surface (init --install-hook, and the completion script) describes only a prepare-commit-msg hook. Users get an unexpected second executable hook in .git/hooks/ that runs commit-echo hook post-commit on every commit, with no documented way to uninstall either hook.

Location

src/git/hook.ts lines 142–149

Code

export async function installPrepareCommitMsgHook(cliPath = process.argv[1] ?? 'dist/index.js'): Promise<string> {
  ...
  checkGitRepo();
  await installManagedHook(POST_COMMIT_HOOK_NAME, resolvedCliPath);   // silent side effect
  return installManagedHook(PREPARE_COMMIT_MSG_HOOK_NAME, resolvedCliPath);
}

Suggested fix

• Rename the option/help text to "Install commit-echo hooks (prepare-commit-msg + post-commit)" or make the post-commit install opt-in/visible.
• Print the full list of installed hook paths on success (both are already returned/known).
• Add an uninstall path that restores the .commit-echo.bak backups, so installing is reversible.

Impact

Users auditing their .git/hooks/ see an undocumented hook; those who reject "hidden" executable hooks in repos may avoid the feature entirely, and there is currently no clean removal.