perf(hooks): use direct require() instead of spawning child process

Invoke hook scripts directly via require() when they export a
run(rawInput) function, eliminating one Node.js process spawn per
hook invocation (~50-100ms).

Includes path traversal guard, timeouts, error logging, PR review
feedback, legacy hooks guard, normalized filePath, and restored
findProjectRoot config detection with package manager support.

scripts/hooks/post-edit-format.js

@@ -20,11 +20,7 @@
 const { execFileSync } = require('child_process');
 const path = require('path');
 
-const {
-  findProjectRoot,
-  detectFormatter,
-  resolveFormatterBin,
-} = require('../lib/resolve-formatter');
+const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../lib/resolve-formatter');
 
 const MAX_STDIN = 1024 * 1024; // 1MB limit
 
@@ -42,23 +38,22 @@ function run(rawInput) {
 
     if (filePath && /\.(ts|tsx|js|jsx)$/.test(filePath)) {
       try {
-        const projectRoot = findProjectRoot(path.dirname(path.resolve(filePath)));
+        const resolvedFilePath = path.resolve(filePath);
+        const projectRoot = findProjectRoot(path.dirname(resolvedFilePath));
         const formatter = detectFormatter(projectRoot);
         if (!formatter) return rawInput;
 
         const resolved = resolveFormatterBin(projectRoot, formatter);
+        if (!resolved) return rawInput;
 
         // Biome: `check --write` = format + lint in one pass
         // Prettier: `--write` = format only
-        const args =
-          formatter === 'biome'
-            ? [...resolved.prefix, 'check', '--write', filePath]
-            : [...resolved.prefix, '--write', filePath];
+        const args = formatter === 'biome' ? [...resolved.prefix, 'check', '--write', resolvedFilePath] : [...resolved.prefix, '--write', resolvedFilePath];
 
         execFileSync(resolved.bin, args, {
           cwd: projectRoot,
           stdio: ['pipe', 'pipe', 'pipe'],
-          timeout: 15000,
+          timeout: 15000
         });
       } catch {
         // Formatter not installed, file missing, or failed — non-blocking
@@ -76,7 +71,7 @@ if (require.main === module) {
   let data = '';
   process.stdin.setEncoding('utf8');
 
-  process.stdin.on('data', (chunk) => {
+  process.stdin.on('data', chunk => {
     if (data.length < MAX_STDIN) {
       const remaining = MAX_STDIN - data.length;
       data += chunk.substring(0, remaining);
@@ -84,8 +79,8 @@ if (require.main === module) {
   });
 
   process.stdin.on('end', () => {
-    const result = run(data);
-    process.stdout.write(result);
+    data = run(data);
+    process.stdout.write(data);
     process.exit(0);
   });
 }

scripts/hooks/quality-gate.js

@@ -18,31 +18,50 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-const {
-  findProjectRoot,
-  detectFormatter,
-  resolveFormatterBin,
-} = require('../lib/resolve-formatter');
+const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../lib/resolve-formatter');
 
 const MAX_STDIN = 1024 * 1024;
 
+/**
+ * Execute a command synchronously, returning the spawnSync result.
+ *
+ * @param {string} command - Executable path or name
+ * @param {string[]} args - Arguments to pass
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ * @returns {import('child_process').SpawnSyncReturns<string>}
+ */
 function exec(command, args, cwd = process.cwd()) {
   return spawnSync(command, args, {
     cwd,
     encoding: 'utf8',
     env: process.env,
+    timeout: 15000
   });
 }
 
+/**
+ * Write a message to stderr for logging.
+ *
+ * @param {string} msg - Message to log
+ */
 function log(msg) {
   process.stderr.write(`${msg}\n`);
 }
 
+/**
+ * Run quality-gate checks for a single file based on its extension.
+ * Skips JS/TS files when Biome is configured (handled by post-edit-format).
+ *
+ * @param {string} filePath - Path to the edited file
+ */
 function maybeRunQualityGate(filePath) {
   if (!filePath || !fs.existsSync(filePath)) {
     return;
   }
 
+  // Resolve to absolute path so projectRoot-relative comparisons work
+  filePath = path.resolve(filePath);
+
   const ext = path.extname(filePath).toLowerCase();
   const fix = String(process.env.ECC_QUALITY_GATE_FIX || '').toLowerCase() === 'true';
   const strict = String(process.env.ECC_QUALITY_GATE_STRICT || '').toLowerCase() === 'true';
@@ -59,6 +78,7 @@ function maybeRunQualityGate(filePath) {
 
       // .json / .md — still need quality gate
       const resolved = resolveFormatterBin(projectRoot, 'biome');
+      if (!resolved) return;
       const args = [...resolved.prefix, 'check', filePath];
       if (fix) args.push('--write');
       const result = exec(resolved.bin, args, projectRoot);
@@ -70,6 +90,7 @@ function maybeRunQualityGate(filePath) {
 
     if (formatter === 'prettier') {
       const resolved = resolveFormatterBin(projectRoot, 'prettier');
+      if (!resolved) return;
       const args = [...resolved.prefix, fix ? '--write' : '--check', filePath];
       const result = exec(resolved.bin, args, projectRoot);
       if (result.status !== 0 && strict) {
@@ -82,8 +103,20 @@ function maybeRunQualityGate(filePath) {
     return;
   }
 
-  if (ext === '.go' && fix) {
-    exec('gofmt', ['-w', filePath]);
+  if (ext === '.go') {
+    if (fix) {
+      const r = exec('gofmt', ['-w', filePath]);
+      if (r.status !== 0 && strict) {
+        log(`[QualityGate] gofmt failed for ${filePath}`);
+      }
+    } else if (strict) {
+      const r = exec('gofmt', ['-l', filePath]);
+      if (r.status !== 0) {
+        log(`[QualityGate] gofmt failed for ${filePath}`);
+      } else if (r.stdout && r.stdout.trim()) {
+        log(`[QualityGate] gofmt check failed for ${filePath}`);
+      }
+    }
     return;
   }
 
@@ -119,7 +152,7 @@ function run(rawInput) {
 if (require.main === module) {
   let raw = '';
   process.stdin.setEncoding('utf8');
-  process.stdin.on('data', (chunk) => {
+  process.stdin.on('data', chunk => {
     if (raw.length < MAX_STDIN) {
       const remaining = MAX_STDIN - raw.length;
       raw += chunk.substring(0, remaining);

scripts/hooks/run-with-flags.js

@@ -52,7 +52,15 @@ async function main() {
   }
 
   const pluginRoot = getPluginRoot();
-  const scriptPath = path.join(pluginRoot, relScriptPath);
+  const resolvedRoot = path.resolve(pluginRoot);
+  const scriptPath = path.resolve(pluginRoot, relScriptPath);
+
+  // Prevent path traversal outside the plugin root
+  if (!scriptPath.startsWith(resolvedRoot + path.sep)) {
+    process.stderr.write(`[Hook] Path traversal rejected for ${hookId}: ${scriptPath}\n`);
+    process.stdout.write(raw);
+    process.exit(0);
+  }
 
   if (!fs.existsSync(scriptPath)) {
     process.stderr.write(`[Hook] Script not found for ${hookId}: ${scriptPath}\n`);
@@ -60,11 +68,43 @@ async function main() {
     process.exit(0);
   }
 
+  // Prefer direct require() when the hook exports a run(rawInput) function.
+  // This eliminates one Node.js process spawn (~50-100ms savings per hook).
+  //
+  // SAFETY: Only require() hooks that export run(). Legacy hooks execute
+  // side effects at module scope (stdin listeners, process.exit, main() calls)
+  // which would interfere with the parent process or cause double execution.
+  let hookModule;
+  const src = fs.readFileSync(scriptPath, 'utf8');
+  const hasRunExport = /\bmodule\.exports\b/.test(src) && /\brun\b/.test(src);
+
+  if (hasRunExport) {
+    try {
+      hookModule = require(scriptPath);
+    } catch (requireErr) {
+      process.stderr.write(`[Hook] require() failed for ${hookId}: ${requireErr.message}\n`);
+      // Fall through to legacy spawnSync path
+    }
+  }
+
+  if (hookModule && typeof hookModule.run === 'function') {
+    try {
+      const output = hookModule.run(raw);
+      if (output != null) process.stdout.write(output);
+    } catch (runErr) {
+      process.stderr.write(`[Hook] run() error for ${hookId}: ${runErr.message}\n`);
+      process.stdout.write(raw);
+    }
+    process.exit(0);
+  }
+
+  // Legacy path: spawn a child Node process for hooks without run() export
   const result = spawnSync('node', [scriptPath], {
     input: raw,
     encoding: 'utf8',
     env: process.env,
     cwd: process.cwd(),
+    timeout: 30000
   });
 
   if (result.stdout) process.stdout.write(result.stdout);