refactor(hooks): convert git hooks from .sh to .mts (Node 25+)

[John-David Dalton (jdalton)]

Converts the four shell-based git-hook files into TypeScript-first .mts modules running on Node 25+ (stable type stripping, no flag needed).

Files:

• .git-hooks/_helpers.mts (was _helpers.sh) — exports filterAllowedApiKeys + scanners for personal paths, AWS keys, GitHub tokens, private keys, AI attribution.
• .git-hooks/commit-msg.mts
• .git-hooks/pre-commit.mts
• .git-hooks/pre-push.mts

_helpers.mts hard-fails at module load if Node < 25.

Husky shims invoke node directly.

Companion: socket-btm #120/#121 (merged), socket-repo-template@f415207.

---

Note

Medium Risk
Touches mandatory pre-push/commit-msg enforcement and introduces a hard Node >=25 requirement, which can block commits/pushes if environments or regex/skip rules behave unexpectedly.

Overview
Migrates the repo’s git hook security enforcement from shell scripts to Node .mts modules, centralizing shared logic in .git-hooks/_helpers.mts (API-key allowlist, secret/path scanners, git wrappers) and hard-failing on Node < 25.

Updates commit-msg, pre-commit, and pre-push to use the new scanners (including Linear reference blocking and AI-attribution stripping) and tightens/standardizes file skipping and .env allowlists, while Husky wrappers now invoke the hooks via node.

^{Reviewed by Cursor Bugbot for commit f504816. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Linear issue reference check dropped during refactor
  • Added scanLinearReferences to _helpers.mts (matching the old shell hook's LINEAR_TEAM_KEYS and linear.app URL patterns) and wired it into commit-msg.mts to block commits containing Linear issue references.

Or push these changes by commenting:

@cursor push dfdc208492

Preview (dfdc208492)

diff --git a/.git-hooks/_helpers.mts b/.git-hooks/_helpers.mts
--- a/.git-hooks/_helpers.mts
+++ b/.git-hooks/_helpers.mts
@@ -198,6 +198,34 @@
   return hits
 }
 
+// ── Linear issue reference scanner ─────────────────────────────────
+// CLAUDE.md "ABSOLUTE RULES": NEVER reference Linear issues in commits.
+// Team keys enumerated from the Socket workspace. PATCH listed before
+// PAT so the alternation matches the longer prefix first.
+
+const LINEAR_TEAM_KEYS =
+  'ASK|AUTO|BOT|CE|CORE|DAT|DES|DEV|ENG|INFRA|LAB|MAR|MET|OPS|PAR|PATCH|PAT|PLAT|REA|SALES|SBOM|SEC|SMO|SUP|TES|TI|WEB'
+
+const LINEAR_ISSUE_RE = new RegExp(
+  `(?:^|[^A-Za-z0-9_])((?:${LINEAR_TEAM_KEYS})-[0-9]+)(?:$|[^A-Za-z0-9_])`,
+  'gm',
+)
+
+const LINEAR_URL_RE = /linear\.app\/[A-Za-z0-9/_-]+/g
+
+export const scanLinearReferences = (commitMsg: string): string[] => {
+  const hits: string[] = []
+  const lines = commitMsg.split('\n').filter(l => !l.startsWith('#'))
+  const body = lines.join('\n')
+  for (const m of body.matchAll(LINEAR_ISSUE_RE)) {
+    hits.push(m[1]!)
+  }
+  for (const m of body.matchAll(LINEAR_URL_RE)) {
+    hits.push(m[0]!)
+  }
+  return hits.slice(0, 5)
+}
+
 // ── AI attribution scanner ─────────────────────────────────────────
 
 const AI_ATTRIBUTION_RE =

diff --git a/.git-hooks/commit-msg.mts b/.git-hooks/commit-msg.mts
--- a/.git-hooks/commit-msg.mts
+++ b/.git-hooks/commit-msg.mts
@@ -23,6 +23,7 @@
   out,
   red,
   readFileForScan,
+  scanLinearReferences,
   scanSocketApiKeys,
   shouldSkipFile,
   stripAiAttribution,
@@ -67,10 +68,26 @@
     }
   }
 
-  // Auto-strip AI attribution lines from the commit message.
   const commitMsgFile = process.argv[2]
   if (commitMsgFile && existsSync(commitMsgFile)) {
     const original = readFileSync(commitMsgFile, 'utf8')
+
+    // Block Linear issue references in the commit message.
+    const linearHits = scanLinearReferences(original)
+    if (linearHits.length) {
+      out(red('✗ Commit message references Linear issue(s):'))
+      for (const hit of linearHits) {
+        out(`  ${hit}`)
+      }
+      out(
+        red(
+          'Linear tracking lives in Linear. Remove the reference from the commit message.',
+        ),
+      )
+      errors++
+    }
+
+    // Auto-strip AI attribution lines from the commit message.
     const { cleaned, removed } = stripAiAttribution(original)
     if (removed > 0) {
       writeFileSync(commitMsgFile, cleaned)

_{You can send follow-ups to the cloud agent here.}

[John-David Dalton (jdalton)]

bugbot run

[John-David Dalton (jdalton)]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f504816. Configure here.}

[cursor]

Pre-commit .env check misses subdirectory files

Medium Severity

The .env file check in pre-commit.mts applies the regex /^\.env(\.[^/]+)?$/ directly against the full relative path f, so only root-level .env files match. A staged file like packages/app/.env.local won't match because ^\.env fails against a path starting with packages/. In contrast, commit-msg.mts correctly uses basename(file) before the same regex test, catching .env files at any depth. The comment on line 66 explicitly says "Match commit-msg.mts allowlist", confirming the intent for parity.

Additional Locations (1)

• .git-hooks/commit-msg.mts#L61-L65

 

^{Reviewed by Cursor Bugbot for commit f504816. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Missing set -e lets security check failures pass silently
  • Added set -e after the shebang so any non-zero exit (including the security check) immediately aborts the hook.

Or push these changes by commenting:

@cursor push aeee0e4362

Preview (aeee0e4362)

diff --git a/.husky/pre-commit b/.husky/pre-commit
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 # Optional checks - can be bypassed with --no-verify for fast local commits.
 # Mandatory security checks ALSO run in pre-push hook.
 #

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f504816. Configure here.}

[cursor]

Missing set -e lets security check failures pass silently

High Severity

The new node .git-hooks/pre-commit.mts security check is added to a shell script that lacks set -e. If the security check exits with code 1 (e.g. detecting an API key or .DS_Store), the shell script continues executing pnpm lint and pnpm test. If those subsequent commands succeed, the overall hook exit code is 0 and the commit goes through despite the security failure. This silently defeats the purpose of the pre-commit security gate.

 

^{Reviewed by Cursor Bugbot for commit f504816. Configure here.}

[John-David Dalton (jdalton)]

Superseded by #1279 (consolidated). All commits, tests, and Bugbot fixes from this branch are now in #1279.