diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100644
index 0000000..090d420
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Format staged Go files.
+STAGED_GO=$(git diff --cached --name-only --diff-filter=ACM | grep '\.go$' || true)
+if [ -n "$STAGED_GO" ]; then
+  echo "$STAGED_GO" | while IFS= read -r f; do
+    gofmt -w "$f"
+    git add "$f"
+  done
+fi
+
+# Lint and format staged web source files. Paths are repo-root relative; we
+# strip the leading "web/" so tooling runs inside the web workspace.
+cd web
+
+STAGED_WEB_SRC=$(git diff --cached --name-only --diff-filter=ACM | grep -E '^web/src/.*\.(ts|tsx|vue|js|jsx|mjs)$' || true)
+if [ -n "$STAGED_WEB_SRC" ]; then
+  echo "$STAGED_WEB_SRC" | sed 's|^web/||' | while IFS= read -r f; do
+    pnpm exec eslint --fix "$f"
+    pnpm exec prettier --write "$f"
+    git add "../web/$f"
+  done
+fi
+
+STAGED_WEB_FMT=$(git diff --cached --name-only --diff-filter=ACM | grep -E '^web/.*\.(css|scss|json|md|yaml|yml)$' || true)
+if [ -n "$STAGED_WEB_FMT" ]; then
+  echo "$STAGED_WEB_FMT" | sed 's|^web/||' | while IFS= read -r f; do
+    pnpm exec prettier --write "$f"
+    git add "../web/$f"
+  done
+fi
diff --git a/Dockerfile b/Dockerfile
index f82c499..f3cae86 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,7 +22,7 @@ COPY --from=web /web/dist/. ./cmd/server/web/dist/
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/server ./cmd/server
 
 # ─── Stage 3: runtime ───
-FROM registry.jerryyan.top/library/alpine:3.20
+FROM registry.jerryyan.top/library/alpine:3.24
 # nodejs/npm 供安装 ACP agent CLI（claude-code-acp / codex / gemini-cli 等，
 # 均为 npm 包）。npm 全局 prefix 指到 /data/npm-global（持久卷），容器内
 # `npm i -g xxx` 一次安装，重建镜像后无需重装；binary_path 填