fix(hooks): sync after rebase and diagnose disabled git hooks

docs/usage-guide.md

@@ -175,7 +175,8 @@ chosen or opened in this project.
 
 A new worktree does not wait for that first session. In project scope, `teamai init`
 and `teamai pull` install a git hook in the repository's local git config, shared by
-every worktree: `hook.teamai-post-checkout` and `hook.teamai-post-merge` (Git 2.54 or
+every worktree: `hook.teamai-post-checkout`, `hook.teamai-post-merge` and
+`hook.teamai-post-rewrite` (Git 2.54 or
 later). Git runs it beside any `core.hooksPath` hook
 manager and any `.git/hooks` script. When `git worktree add`, or an app that runs
 the same checkout hooks, makes a new checkout, the hook creates the project roots of
@@ -189,10 +190,13 @@ Hosts that skip checkout hooks need a setup step that finishes `teamai pull` bef
 the AI tool starts. For Codex CLI 0.160.0, create the checkout with `git worktree add`, run
 `teamai pull` there, then launch `codex exec -C <worktree>`; its native
 `codex exec --worktree` path skips `post-checkout`.
-After `git pull` (`post-merge`), the hook fetches the team repo, waiting at most 5 seconds,
+After `git pull` (`post-merge`, or `post-rewrite` for a completed rebase, including
+`pull.rebase=true`; on Git 2.32 and older, a fast-forward rebase with autostash runs
+only `post-checkout`, which syncs the same way), the hook fetches the team repo, waiting at most 5 seconds,
 and delivers its changes before `git pull` returns; past 5 seconds, and for sources,
 learnings and reports, the same background pull takes over. In single-repo mode it
-delivers the knowledge `git pull` just brought, with no network. The hook prints nothing and always exits 0, so a failed pull never
+delivers the knowledge `git pull` just brought, with no network. A conflicting rebase
+syncs only when completed; `git commit --amend` does not sync. The hook prints nothing and always exits 0, so a failed pull never
 fails the git command. A failure inside it (the team repo fetch failed, or stopped at the
 5-second cap and the background pull did not finish it; another teamai process held the
 project's sync lock longer than the hook waits, 5 seconds after `git pull` (including
@@ -201,22 +205,27 @@ delivery) is written to `~/.teamai/debug.log` and recorded: `teamai doctor`
 names it with its fix, and each interactive `teamai pull` mentions it until one completes. The
 background pull retries, and a hook or interactive pull clears the record only after all startup delivery
 stages succeed. `teamai doctor`
-also reports whether the hook is installed and, when it is not, why. It follows the scope rules below: no project config, or one
+also reports whether the hooks are installed and enabled. Git 2.54+ can disable a
+named hook (`hook.teamai-<event>.enabled=false`); Git 2.55+ can also disable the
+whole event (`hook.<event>.enabled=false`). Both settings can be global, local or per-worktree. Doctor checks the effective
+Git setting and gives the reactivation command for its scope (a local override, or unsetting a worktree setting, which a local one cannot override); `teamai pull` preserves an explicit
+disablement. After enabling it, run `teamai pull` to sync. It follows the scope rules below: no project config, or one
 that cannot be read, means no sync; an unreadable config's reason is kept in
 `~/.teamai/debug.log`. The command is one `sh` line that runs
 `teamai hook-dispatch <event> --tool git` with Git's arguments, finding `teamai`
 through `~/.teamai/bin` as the agent hooks do.
 
 With Git older than 2.54 and no `core.hooksPath`, teamai instead adds a block between
 `# >>> teamai git hook` and `# <<< teamai git hook <<<` markers to `.git/hooks/post-checkout`
-and `.git/hooks/post-merge`, right after the shebang, creating the script when there is
+along with `.git/hooks/post-merge` and `.git/hooks/post-rewrite`, right after the
+shebang, creating the script when there is
 none; the script's other lines are kept. The block runs the same command, silently, and
 does not change the script's exit status. With `core.hooksPath` set (a hook manager), or
 a hook script that is a symlink or not an executable shell script, teamai writes nothing, and `teamai doctor`
 advises: upgrade Git to 2.54 or later; or, if the team agrees to commit it, run
 `command -v teamai >/dev/null 2>&1 && teamai hook-dispatch <event> --tool git "$@" >/dev/null 2>&1 || true`
-from the post-checkout and post-merge hooks your manager defines (with `post-checkout` or
-`post-merge` as `<event>`), wrapped in `sh -c '...'` when its config is not a shell script.
+from the post-checkout, post-merge and post-rewrite hooks your manager defines (with the
+corresponding event as `<event>`), wrapped in `sh -c '...'` when its config is not a shell script.
 That line does nothing on a machine without teamai.
 Existing hook contents and permissions are preserved. Reading or writing a hook can
 fail: `init` and `hooks inject` propagate that error; a Git-started pull records it
@@ -225,7 +234,7 @@ and the next `teamai pull` retries.
 Once Git is 2.54 or later, the next `teamai pull` installs the config hook and takes the
 block out, so the hook does not run twice. `teamai pull --dry-run` says when it would
 install or update the hook and writes nothing. `teamai uninstall` in the project removes
-the `hook.teamai-post-checkout` and `hook.teamai-post-merge` entries and the marked
+the `hook.teamai-post-checkout`, `hook.teamai-post-merge` and `hook.teamai-post-rewrite` entries and the marked
 blocks; other hooks and script lines stay. A script left with only its shebang is the
 one teamai created, and is deleted.
 
@@ -2990,7 +2999,7 @@ What gets removed:
 - Team-synced rules, including the copies older releases left in `.codex/rules/`, a project's `.workbuddy/rules/` and `.pi/rules/`, `.openclaw/rules/`, `~/.pi/agent/rules/` and `~/.joycode/rules/`, also of rules the team has since removed. A copy in a project's `.codebuddy/rules/` stays while the other of CodeBuddy and WorkBuddy is still installed. Cleanup follows the recorded `toolRoots` location and the publisher's local filenames. A copy there you edited is kept and named in a warning. A removed rule's copy is deleted only if it matches its recorded delivery hash; without that record, it is kept and named too. Codex's `*.rules` files are kept
 - Team-synced custom agents and CLI built-in agents (your own agents are preserved)
 - The env block in your shell profile — every candidate file (`.zshrc`, `.bashrc`, `.bash_profile`, `.bash_login`, `.profile`) carrying a block that sources this scope's own `env.sh` is cleaned, not only the one file `pull` would choose today; a block sourcing a different scope's `env.sh` is left alone
-- In a project, teamai's git hook: the `hook.teamai-post-checkout` and `hook.teamai-post-merge` entries in the repository's git config, and the marked block in `.git/hooks/post-checkout` and `post-merge` (a script left with only its shebang, the one teamai created, is deleted). Other hooks are kept
+- In a project, teamai's git hook: the `hook.teamai-post-checkout`, `hook.teamai-post-merge` and `hook.teamai-post-rewrite` entries in the repository's git config, and the marked block in `.git/hooks/post-checkout`, `post-merge` and `post-rewrite` (a script left with only its shebang, the one teamai created, is deleted). Other hooks are kept
 - The `~/.teamai/` directory
 
 ### Uninstall a single tool (`--agent <tool>`)

docs/usage-guide.zh-CN.md

@@ -165,8 +165,8 @@ teamai init https://github.com/yourorg/yourrepo
 `--agent` 的 `init`，仍会跳过项目里还不存在根目录的工具，因此不会给尚未在本项目选择或打开过的 Agent 凭空建目录。
 
 新 worktree 不必等到第一次会话。在项目 scope 下，`teamai init` 与 `teamai pull` 会在仓库的本地
-git 配置中安装一个 git hook，所有 worktree 共用：`hook.teamai-post-checkout` 与
-`hook.teamai-post-merge`（需要 Git 2.54 或更高版本）。Git 会在任何
+git 配置中安装一个 git hook，所有 worktree 共用：`hook.teamai-post-checkout`、
+`hook.teamai-post-merge` 与 `hook.teamai-post-rewrite`（需要 Git 2.54 或更高版本）。Git 会在任何
 `core.hooksPath` hook 管理器和 `.git/hooks` 脚本之外一并运行它。当 `git worktree add`，或运行相同
 checkout hook 的应用，新建一个检出时，该 hook 会创建 `enabledAgents` 的项目根目录（为空时，取主检出已有的根目录），
 并在命令返回前向该 worktree 执行 pull，因此其中的第一次会话就已具备团队的 skill、rule 与 MCP 服务器。
@@ -175,32 +175,37 @@ checkout hook 的应用，新建一个检出时，该 hook 会创建 `enabledAge
 切换分支不会触发任何操作。跳过 checkout hook 的宿主需要在 AI 工具启动前完成 `teamai pull` 的准备步骤。
 Codex CLI 0.160.0 请先用 `git worktree add` 创建检出，在其中执行 `teamai pull`，再用
 `codex exec -C <worktree>` 启动；原生 `codex exec --worktree` 路径会跳过 `post-checkout`。
-`git pull` 之后（`post-merge`），该 hook 会 fetch 团队仓库（最多等待 5 秒），
+`git pull` 之后（`post-merge`，或 rebase 完成后的 `post-rewrite`，包括 `pull.rebase=true`；Git 2.32 及更早版本中，开启 autostash 的快进 rebase 只运行 `post-checkout`，同样会同步），该 hook 会 fetch 团队仓库（最多等待 5 秒），
 并在 `git pull` 返回前交付其变更；超过 5 秒时，以及 source、learnings 与 reports，交给同样的后台 pull。
-单仓库模式下，它交付 `git pull` 刚带来的知识，不访问网络。该 hook 不输出任何内容且始终以 0 退出，
+单仓库模式下，它交付 `git pull` 刚带来的知识，不访问网络。有冲突的 rebase 仅在完成后同步；
+`git commit --amend` 不触发同步。该 hook 不输出任何内容且始终以 0 退出，
 因此 pull 失败也不会让 git 命令失败。hook 内的失败（团队仓库 fetch 失败，或在 5 秒上限处被中止而后台 pull
 也未完成；另一个 teamai 进程持有项目的同步锁，超过 hook 的等待时间：`git pull` 之后 5 秒（包括单仓库模式），新 worktree 60 秒；资源、hook 或 MCP 未完整交付）
 会写入 `~/.teamai/debug.log` 并被记录：`teamai doctor` 会指出它及其修复方法，每次交互式 `teamai pull`
 都会提示，直到某次完成为止。后台 pull 会重试，只有所有启动交付阶段都成功后，hook pull 或交互式 pull 才会清除该记录。`teamai doctor` 还会报告 hook
-是否已安装，未安装时说明原因。它遵循下文的 scope 规则：没有项目配置，或项目配置无法读取，
+是否已安装并启用。Git 2.54+ 可禁用指定 hook
+（`hook.teamai-<event>.enabled=false`）；Git 2.55+ 还可禁用整个事件
+（`hook.<event>.enabled=false`）。两种设置均可写在全局、本地或 worktree 配置中。
+doctor 检查 Git 的实际生效配置，并按其作用域给出重新启用命令（本地覆盖，或删除本地配置无法覆盖的 worktree 设置）；`teamai pull` 保留显式禁用设置。
+启用后运行 `teamai pull` 完成同步。它遵循下文的 scope 规则：没有项目配置，或项目配置无法读取，
 都不会同步；无法读取配置的原因保留在 `~/.teamai/debug.log` 中。其命令是一行 `sh`，带着 Git 传入的参数运行 `teamai hook-dispatch <event> --tool git`，
 与 Agent hook 一样通过 `~/.teamai/bin` 找到 `teamai`。
 
-Git 低于 2.54 且未设置 `core.hooksPath` 时，teamai 改为在 `.git/hooks/post-checkout` 与
-`.git/hooks/post-merge` 的 shebang 之后插入一段位于 `# >>> teamai git hook` 与 `# <<< teamai git hook <<<`
+Git 低于 2.54 且未设置 `core.hooksPath` 时，teamai 改为在 `.git/hooks/post-checkout`、
+`.git/hooks/post-merge` 与 `.git/hooks/post-rewrite` 的 shebang 之后插入一段位于 `# >>> teamai git hook` 与 `# <<< teamai git hook <<<`
 标记之间的代码块（脚本不存在时会创建），脚本的其他行保持不变。该代码块运行同一条命令，不输出任何内容，
 也不改变脚本的退出码。设置了 `core.hooksPath`（hook 管理器），或 hook 脚本是符号链接或不是可执行的 shell 脚本时，teamai
 不写入任何内容，`teamai doctor` 会建议：将 Git 升级到 2.54 或更高版本；或者，如果团队同意提交它，在管理器定义的
-post-checkout 与 post-merge hook 中运行
+post-checkout、post-merge 与 post-rewrite hook 中运行
 `command -v teamai >/dev/null 2>&1 && teamai hook-dispatch <event> --tool git "$@" >/dev/null 2>&1 || true`
-（`<event>` 分别为 `post-checkout` 与 `post-merge`），管理器的配置不是 shell 脚本时用 `sh -c '...'` 包裹。
+（`<event>` 为对应的事件名），管理器的配置不是 shell 脚本时用 `sh -c '...'` 包裹。
 在没有 teamai 的机器上，这一行什么也不做。
 已有 hook 的内容和权限保持不变。读取或写入 hook 失败时，`init` 与 `hooks inject` 会传播该错误；
 由 Git 启动的 pull 会记录错误，下一次 `teamai pull` 会重试。
 
 Git 升级到 2.54 或更高版本后，下一次 `teamai pull` 会安装配置 hook 并移除该代码块，避免 hook 运行两次。
 `teamai pull --dry-run` 会说明是否将安装或更新该 hook，但不写入任何内容。在项目中运行 `teamai uninstall`
-会移除 `hook.teamai-post-checkout` 与 `hook.teamai-post-merge` 条目以及带标记的代码块；其他 hook 和脚本行保持不变。
+会移除 `hook.teamai-post-checkout`、`hook.teamai-post-merge` 与 `hook.teamai-post-rewrite` 条目以及带标记的代码块；其他 hook 和脚本行保持不变。
 移除后只剩 shebang 的脚本是 teamai 创建的，会被删除。
 
 > **从旧版 teamai 升级？** 升级后首次执行 `teamai init` / `pull` / `push` / `contribute`
@@ -2781,7 +2786,7 @@ teamai uninstall --agent claude
 - 团队同步的 rules，包括旧版本留在 `.codex/rules/`、项目的 `.workbuddy/rules/` 与 `.pi/rules/`、`.openclaw/rules/`、`~/.pi/agent/rules/` 和 `~/.joycode/rules/` 中的副本，团队此后已删除的 rule 的副本也包括在内。项目 `.codebuddy/rules/` 中的副本，只要 CodeBuddy 与 WorkBuddy 中的另一个仍已安装就会保留。清理使用记录的 `toolRoots` 位置和发布者本地的文件名。其中你改过的副本会保留，并在警告中点名。已删除 rule 的副本只有与记录的投递哈希一致时才会删除；没有该记录时也会保留并点名。Codex 的 `*.rules` 文件保留
 - 团队同步的自定义 agents 和 CLI 内置 agents（保留用户自建 agents）
 - Shell profile 中的 env 块——会清理每一个候选文件（`.zshrc`、`.bashrc`、`.bash_profile`、`.bash_login`、`.profile`）中、代码块指向本作用域自身 `env.sh` 的那些，而不仅仅是当前 `pull` 会选中的那一个；指向其他作用域 `env.sh` 的代码块不受影响
-- 项目中 teamai 的 git hook：仓库 git 配置中的 `hook.teamai-post-checkout` 与 `hook.teamai-post-merge` 条目，以及 `.git/hooks/post-checkout` 与 `post-merge` 中带标记的代码块（移除后只剩 shebang 的脚本是 teamai 创建的，会被删除）。其他 hook 保留
+- 项目中 teamai 的 git hook：仓库 git 配置中的 `hook.teamai-post-checkout`、`hook.teamai-post-merge` 与 `hook.teamai-post-rewrite` 条目，以及 `.git/hooks/post-checkout`、`post-merge` 与 `post-rewrite` 中带标记的代码块（移除后只剩 shebang 的脚本是 teamai 创建的，会被删除）。其他 hook 保留
 - `~/.teamai/` 目录
 
 ### 只卸载单个工具（`--agent <tool>`）

skill-data/core/SKILL.md

@@ -128,18 +128,20 @@ the copy and run `teamai pull --force`. The first pull after upgrading, and a
 new worktree's first pull, still overwrite: nothing is recorded yet.
 
 In project scope, `init` and `pull` also install a git hook in the repository's
-local git config (`hook.teamai-post-checkout`, `hook.teamai-post-merge`; Git
+local git config (`hook.teamai-post-checkout`, `hook.teamai-post-merge`, `hook.teamai-post-rewrite`; Git
 2.54+; older Git without `core.hooksPath` gets a marked block in `.git/hooks/`
 scripts, and with it `teamai doctor` advises), beside any `core.hooksPath` manager or `.git/hooks` script. When a
 worktree is created by `git worktree add` or an app that runs checkout hooks, it creates the project roots
 of `enabledAgents` (else the ones the main checkout has) and pulls into it before
 the command returns, from the team clone as last fetched when that was within
 24 h; a full pull then runs in the background. A branch switch does nothing.
-After `git pull` it fetches the team repo (5 s cap, then the background pull) and
+After `git pull` (merge or a completed rebase) it fetches the team repo (5 s cap, then the background pull) and
 delivers; in single-repo mode it delivers what `git pull` brought, offline. It prints nothing and always
 exits 0; a failure inside it is recorded, and `teamai doctor` names it (`Last git
 hook run failed: ...`) with its fix, as does the next interactive `teamai pull`, once.
-`teamai doctor` also reports whether the hook is installed, and why not.
+`teamai doctor` also reports whether the hooks are installed and enabled, with a
+reactivation command when Git disables a hook or event. Pull preserves explicit
+disablement. A conflicting rebase syncs only on completion; commit amend does not sync.
 `pull --dry-run` says when it would install or update the hook, writing nothing;
 `teamai uninstall` removes only teamai's hook entries and blocks. For hosts that
 skip checkout hooks, prepare the worktree before launch; see the new-worktree

skill-data/core/references/troubleshooting.md

@@ -85,9 +85,12 @@ This is the #1 onboarding issue. In order:
 ## "Last git hook run failed: ..." / a new worktree lacks team resources
 
 In project scope, teamai's git hook syncs on `git worktree add` and `git pull`
+through merge or a completed rebase (`post-rewrite`, including `pull.rebase=true`; on Git 2.32
+and older, a fast-forward rebase with autostash syncs on `post-checkout`).
+A conflicting rebase syncs only on completion; `git commit --amend` does not sync. It runs
 silently and always exits 0, so its failures surface only here: `teamai doctor`
 names the last one with its fix, and the next interactive `teamai pull` says it
-once. The causes are a team repo fetch that failed or hit the 5 s post-merge
+once. The causes are a team repo fetch that failed or hit the 5 s git-pull hook
 cap without the background pull finishing it, and another teamai process
 holding the project's sync lock longer than the hook waits, or incomplete resource,
 hook or MCP delivery. Only a complete startup sync clears the recorded failure.
@@ -96,10 +99,14 @@ in the checkout (after a stuck pull ends, or once the team repo is reachable);
 `~/.teamai/debug.log` has the details. If doctor reports `Git hook syncs new
 worktrees and git pull` as failing, follow its fix: `teamai pull` installs it.
 Git older than 2.54 has no config hooks: teamai then adds a marked block to
-`.git/hooks/post-checkout` and `post-merge`, unless `core.hooksPath` is set (or a
+`.git/hooks/post-checkout`, `post-merge` and `post-rewrite`, unless `core.hooksPath` is set (or a
 hook there is a symlink or not an executable shell script), in which case doctor's fix says to upgrade Git
 or, if the team agrees, to commit its guarded `command -v teamai ... || true`
-line into the manager's post-checkout and post-merge hooks.
+line into the manager's post-checkout, post-merge and post-rewrite hooks.
+Doctor also detects hooks disabled by name (Git 2.54+) or event (Git 2.55+)
+in effective global, local or worktree config. Follow its command (`git config --local <key> true`,
+or `git config --worktree --unset <key>` for a worktree setting) to enable the named hook or event, then run `teamai pull` to sync. Pull preserves
+explicit disable settings, so reinstalling alone does not enable a disabled hook.
 Existing hook contents and permissions stay unchanged; read/write errors propagate
 from `init` and `hooks inject`, and Git-started pulls record them. An unreadable
 project config prevents sync and keeps its reason in `~/.teamai/debug.log`.