jdx/hk v1.39.0

v1.39.0: New builtins, corporate proxy support, and critical stash fixes

on GitHub

This release adds four new builtin linter/formatter configurations, introduces corporate proxy support for Pkl config loading, and fixes several important correctness issues -- most notably binary file corruption during the stash/unstash cycle and broken hooks in git worktrees.

Highlights

• Binary file preservation in stash: Binary files (images, compiled assets, etc.) were silently corrupted to 0 bytes when hk stashed and unstashed changes during pre-commit hooks with partial staging. This is now fixed with binary-safe blob handling.
• Git worktree support: The commit-msg and prepare-commit-msg hooks now resolve file paths correctly in git worktrees, where .git is a file pointing to the main repo rather than a directory.
• Four new builtins: just_format, knip, knip_strict, and contextlint join the growing library of built-in linter configurations.
• Corporate proxy support: The new HK_PKL_CA_CERTIFICATES env var lets hk work behind SSL-intercepting proxies without manual workarounds.

Added

• just_format builtin: Format Justfiles using just --fmt. Matches **/justfile and **/*.just globs. (@matdibu) #729

• knip and knip_strict builtins: Find unused files, dependencies, and exports in JavaScript/TypeScript projects using Knip. The knip_strict variant enables --strict (implies --production) for stricter analysis. (@hituzi-no-sippo) #713

• contextlint builtin: Rule-based linting for structured Markdown documents using contextlint. Automatically detected via contextlint.config.json. (@hituzi-no-sippo) #747

• HK_PKL_CA_CERTIFICATES env var: Pass a custom CA certificates file to Pkl via --ca-certificates, enabling hk to work in corporate environments with SSL-intercepting proxies. (@jdx) #760

  export HK_PKL_CA_CERTIFICATES=/path/to/ca-bundle.pem

Fixed

• Binary files preserved during stash/unstash: Binary files (PNG, JPG, etc.) were silently corrupted to 0 bytes during the stash/unstash cycle when committing with partial staged changes. The root cause was that git_read_raw() converted blob output to a UTF-8 string, which fails silently for binary content. Binary files are now detected and restored directly from raw bytes, bypassing the text merge path. (@jdx) #759

• Commit message hooks work in git worktrees: In git worktrees, .git is a file (not a directory), so the .git/COMMIT_EDITMSG path passed by git to commit-msg and prepare-commit-msg hooks would fail with "Not a directory". hk now resolves these paths through the actual git directory. (@jdx) #761

• Batch splitting honored in workspace jobs: When both workspace_indicator and batch = true were set, the batch splitting logic was bypassed entirely, producing one large job per workspace. Files are now properly chunked into parallel jobs within each workspace. (@jdx) #757

• trailing-whitespace --fix handles CRLF correctly: The fix and check modes used BufReader::lines() which silently strips \r from CRLF line endings, making carriage returns invisible to detection. This is now consistent with --diff mode, which already handled CRLF correctly. (@jdx) #758

• Regex patterns no longer break config cache: Regex() file patterns caused "failed to parse cache file" warnings on subsequent runs because the serde discriminator field was skipped during serialization. (@jdx) #740

• nixfmt gracefully skips on Windows: Since nixfmt doesn't support Windows, the builtin now cleanly no-ops on that platform instead of failing. (@azais-corentin) #741

New Contributors

• @azais-corentin made their first contribution in #741

Full Changelog: v1.38.0...v1.39.0