fix(ci): ensure node is available in agent sandbox

Signed-off-by: Cory Rylan <crylan@nvidia.com>

Author: coryrylan

.agents/hooks/lib/node-env.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+get_hook_pnpm_spec() {
+  local project_root package_manager
+
+  project_root="$1"
+  package_manager=""
+
+  if [[ -f "$project_root/package.json" ]] && command -v node >/dev/null 2>&1; then
+    package_manager=$(node -e "const { readFileSync } = require('node:fs'); const { packageManager } = JSON.parse(readFileSync(process.argv[1], 'utf8')); if (typeof packageManager === 'string' && packageManager.startsWith('pnpm@')) process.stdout.write(packageManager);" "$project_root/package.json")
+  fi
+
+  printf '%s\n' "${package_manager:-pnpm@latest}"
+}
+
+setup_hook_node_env() {
+  local project_root node_version nvm_dir pnpm_spec
+
+  project_root="$1"
+  nvm_dir="${NVM_DIR:-$HOME/.nvm}"
+
+  if [[ -s "$nvm_dir/nvm.sh" ]]; then
+    source "$nvm_dir/nvm.sh"
+
+    if [[ -f "$project_root/.nvmrc" ]]; then
+      node_version=$(<"$project_root/.nvmrc")
+      nvm use --silent "$node_version" >/dev/null 2>&1 || true
+    else
+      nvm use --silent >/dev/null 2>&1 || true
+    fi
+  fi
+
+  if ! command -v pnpm >/dev/null 2>&1 && command -v corepack >/dev/null 2>&1; then
+    pnpm_spec=$(get_hook_pnpm_spec "$project_root")
+    (
+      cd "$project_root"
+      corepack enable
+      corepack prepare "$pnpm_spec" --activate
+    )
+  fi
+}

.agents/hooks/post-tool-use-edit-write.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 INPUT=$(cat)
 HOOK_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$HOOK_DIR/lib/project-root.sh"
+source "$HOOK_DIR/lib/node-env.sh"
 PROJECT_ROOT=$(resolve_project_root "$INPUT" "$HOOK_DIR") || exit 0
 FILE_PATHS=$(hook_file_paths_from_input "$INPUT")
 
@@ -13,6 +14,13 @@ fi
 
 FAILED=0
 
+setup_hook_node_env "$PROJECT_ROOT"
+
+if ! command -v pnpm >/dev/null 2>&1; then
+  echo "pnpm not found after loading the project Node environment." >&2
+  exit 2
+fi
+
 mark_failed() {
   FAILED=1
 }

.agents/hooks/pre-tool-use-bash.sh

@@ -5,9 +5,10 @@ INPUT=$(cat)
 HOOK_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$HOOK_DIR/lib/project-root.sh"
 COMMAND=$(hook_command_from_input "$INPUT" || true)
+GIT_PREFIX='(^|[;&|][[:space:]]*)git([[:space:]]+(-C[[:space:]]+[^[:space:];&|]+|--no-pager|-c[[:space:]]+[^[:space:];&|]+|--work-tree(=|[[:space:]]+)[^[:space:];&|]+))*[[:space:]]+'
 
 # Exit early if not a git command
-if [[ -z "$COMMAND" ]] || ! echo "$COMMAND" | grep -qE '^\s*git\s'; then
+if [[ -z "$COMMAND" ]] || ! echo "$COMMAND" | grep -qE '(^|[;&|][[:space:]]*)git([[:space:]]|$)'; then
   exit 0
 fi
 
@@ -28,4 +29,12 @@ echo "$COMMAND" | grep -qF "clean -f"        && block "git clean -f permanently
 echo "$COMMAND" | grep -qF "checkout -- ."   && block "git checkout -- . discards all unstaged changes irreversibly"
 echo "$COMMAND" | grep -qF "branch -D"       && block "git branch -D force-deletes a branch without merge checks"
 
+echo "$COMMAND" | grep -qE "${GIT_PREFIX}(add|stage)([[:space:]]|$)" && block "git add/stage modifies the index"
+echo "$COMMAND" | grep -qE "${GIT_PREFIX}restore([[:space:]][^;&|]*)?[[:space:]]--staged([[:space:]]|$)" && block "git restore --staged removes files from the index"
+echo "$COMMAND" | grep -qE "${GIT_PREFIX}reset([[:space:]]|$)" && block "git reset modifies the index or moves HEAD"
+echo "$COMMAND" | grep -qE "${GIT_PREFIX}rm([[:space:]][^;&|]*)?[[:space:]]--cached([[:space:]]|$)" && block "git rm --cached removes files from the index"
+echo "$COMMAND" | grep -qE "${GIT_PREFIX}rm([[:space:]]|$)" && block "git rm stages file removals"
+echo "$COMMAND" | grep -qE "${GIT_PREFIX}mv([[:space:]]|$)" && block "git mv stages file renames"
+echo "$COMMAND" | grep -qE "${GIT_PREFIX}update-index([[:space:]]|$)" && block "git update-index modifies the index"
+
 exit 0

.agents/hooks/session-start.sh

@@ -4,24 +4,24 @@ set -euo pipefail
 INPUT=$(cat)
 HOOK_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$HOOK_DIR/lib/project-root.sh"
+source "$HOOK_DIR/lib/node-env.sh"
 PROJECT_ROOT=$(resolve_project_root "$INPUT" "$HOOK_DIR") || {
   echo "Could not resolve project root." >&2
   exit 0
 }
 
 NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
-if [[ ! -s "$NVM_DIR/nvm.sh" ]]; then
-  echo "nvm not found at $NVM_DIR/nvm.sh" >&2
-  exit 0
+if [[ -s "$NVM_DIR/nvm.sh" ]]; then
+  source "$NVM_DIR/nvm.sh"
 fi
 
-source "$NVM_DIR/nvm.sh"
-
 cd "$PROJECT_ROOT"
 
-nvm install 2>&1 >/dev/null
-corepack enable 2>&1 >/dev/null
-corepack prepare --activate 2>&1 >/dev/null
+if command -v nvm >/dev/null 2>&1; then
+  nvm install 2>&1 >/dev/null
+fi
+
+setup_hook_node_env "$PROJECT_ROOT"
 
 INSTALL_OUTPUT=$(pnpm i --frozen-lockfile --prefer-offline 2>&1) || {
   echo "pnpm install failed:" >&2

.agents/hooks/stop.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 INPUT=$(cat)
 HOOK_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$HOOK_DIR/lib/project-root.sh"
+source "$HOOK_DIR/lib/node-env.sh"
 PROJECT_ROOT=$(resolve_project_root "$INPUT" "$HOOK_DIR") || {
   echo "Could not resolve project root." >&2
   exit 1
@@ -23,6 +24,13 @@ if [[ -z "$CHANGED" ]]; then
   exit 0
 fi
 
+setup_hook_node_env "$PROJECT_ROOT"
+
+if ! command -v pnpm >/dev/null 2>&1; then
+  echo "pnpm not found after loading the project Node environment." >&2
+  exit 2
+fi
+
 PROJECTS=(code cli core forms lint markdown media monaco)
 FAILED=()