chore(hooks): sync .claude/hooks fleet — mts conversion + new guards

[John-David Dalton (jdalton)]

Summary

• Replaces .sh husky / git-hooks scaffolding with TypeScript .mts
  implementations (single-language toolchain).
• Adds the new fleet-canonical guard hooks: auth-rotation-reminder,
  logger-guard, path-guard, private-name-guard, release-workflow-guard,
  setup-security-tools, stale-process-sweeper, token-guard.
• Updates existing hooks: check-new-deps, public-surface-reminder.
• Re-registers hooks under PreToolUse / Stop in .claude/settings.json.
• Enables oxfmt JSDoc formatting in .oxfmtrc.json.

Scope

This is the hooks + harness-config slice split out of #1286. Companion
splits in flight:

• (this PR) hooks + harness-config — .claude/hooks/, .git-hooks/,
  .husky/, .claude/settings.json, .oxfmtrc.json
• skills + CLAUDE.md (separate PR, TBD) — CLAUDE.md, docs/references/,
  .claude/skills/*, .socket-repo-template.json,
  scripts/socket-repo-template-*
• deps + drift (folds into chore(ci): cascade socket-registry pin to 85a2fc0d #1285 SHA cascade per scope direction) —
  package.json, pnpm-lock.yaml, pnpm-workspace.yaml, packages/* drift,
  scripts/check.mts, scripts/power-state.mts

After all three splits land, #1286 closes.

Test plan

• Pre-commit hook: token-guard blocks raw secrets in commit messages
• PreToolUse: release-workflow-guard blocks gh workflow run (post-fix)
• Stop hook: stale-process-sweeper reaps orphaned vitest workers
• CI: hook subdirectories (tsconfig.json per hook) typecheck cleanly

---

Note

High Risk
High risk because it introduces multiple blocking PreToolUse/git hook enforcement paths (including token/path/workflow dispatch guards) and adds an automated Stop hook that logs users out of CLIs, which can disrupt developer workflows if misconfigured or overly broad.

Overview
Adds new Claude Code hooks that block or warn on risky actions: token-guard (replacing token-hygiene) to prevent secret-leaking Bash shapes, path-guard to prevent inline multi-stage build-path construction, logger-guard to block direct console.*/stream writes in source, release-workflow-guard to block GitHub Actions workflow dispatch commands, and private-name-guard to remind on public-surface commands.

Introduces new Stop hooks: auth-rotation-reminder to periodically revoke CLI logins with snooze/skip-list/throttling, and stale-process-sweeper to kill orphaned test/build worker processes. Registers these under PreToolUse/Stop in .claude/settings.json and updates check-new-deps (improved Cargo.toml extraction and safer module entrypoint ordering).

Migrates Husky/git hooks from shell to .mts (commit-msg, pre-commit, pre-push) with a shared _helpers.mts, expanding scanners (AI attribution stripping, secret/personal-path detection, npx/dlx and logger-leak checks, submodule pristine check) and updates setup-security-tools to install AgentShield via the dlx cache with a schema switch to TypeBox. Also enables JSDoc formatting options in .oxfmtrc.json.

^{Reviewed by Cursor Bugbot for commit f5e6d06. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Commit-msg hook drops Linear issue reference blocking
  • Added scanLinearReferences() to _helpers.mts with the same team-key regex and linear.app URL detection from the old bash script, and invoked it from commit-msg.mts to block commits containing Linear issue references.

Or push these changes by commenting:

@cursor push 73335fc0fb

Preview (73335fc0fb)

diff --git a/.git-hooks/_helpers.mts b/.git-hooks/_helpers.mts
--- a/.git-hooks/_helpers.mts
+++ b/.git-hooks/_helpers.mts
@@ -382,6 +382,41 @@
   return hits
 }
 
+// ── Linear issue reference scanner ──────────────────────────────────
+//
+// Linear tracking lives in Linear; keep commit history tool-agnostic.
+// Team keys enumerated from the Socket workspace. PATCH listed before
+// PAT so the engine matches the longer prefix first.
+
+const LINEAR_TEAM_KEYS =
+  'ASK|AUTO|BOT|CE|CORE|DAT|DES|DEV|ENG|INFRA|LAB|MAR|MET|OPS|PAR|PATCH|PAT|PLAT|REA|SALES|SBOM|SEC|SMO|SUP|TES|TI|WEB'
+
+const LINEAR_ISSUE_RE = new RegExp(
+  `(?:^|[^A-Za-z0-9_])((?:${LINEAR_TEAM_KEYS})-[0-9]+)(?:$|[^A-Za-z0-9_])`,
+)
+const LINEAR_URL_RE = /linear\.app\/[A-Za-z0-9/_-]+/
+
+// Scans commit-message text for Linear issue references (team-key
+// patterns like SMO-590 and linear.app URLs). Ignores git comment
+// lines (lines starting with `#`).
+export const scanLinearReferences = (text: string): string[] => {
+  const hits: string[] = []
+  for (const line of text.split('\n')) {
+    if (line.startsWith('#')) {
+      continue
+    }
+    const issueMatch = line.match(LINEAR_ISSUE_RE)
+    if (issueMatch) {
+      hits.push(issueMatch[1]!)
+    }
+    const urlMatch = line.match(LINEAR_URL_RE)
+    if (urlMatch) {
+      hits.push(urlMatch[0])
+    }
+  }
+  return hits.slice(0, 5)
+}
+
 // ── AI attribution scanner ─────────────────────────────────────────
 
 const AI_ATTRIBUTION_RE =

diff --git a/.git-hooks/commit-msg.mts b/.git-hooks/commit-msg.mts
--- a/.git-hooks/commit-msg.mts
+++ b/.git-hooks/commit-msg.mts
@@ -1,11 +1,13 @@
 #!/usr/bin/env node
 // Socket Security Commit-msg Hook
 //
-// Two responsibilities:
+// Three responsibilities:
 //   1. Block commits that introduce API keys / .env files (security
 //      layer that runs even when pre-commit is bypassed via
 //      `--no-verify`).
-//   2. Auto-strip AI attribution lines from the commit message before
+//   2. Block commits whose message references Linear issues (keep
+//      commit history tool-agnostic).
+//   3. Auto-strip AI attribution lines from the commit message before
 //      git records the commit.
 //
 // Wired via .husky/commit-msg, which invokes this with the path to the
@@ -23,6 +25,7 @@
   out,
   red,
   readFileForScan,
+  scanLinearReferences,
   scanSocketApiKeys,
   shouldSkipFile,
   stripAiAttribution,
@@ -67,9 +70,27 @@
     }
   }
 
-  // Auto-strip AI attribution lines from the commit message.
+  // Block Linear issue references in the commit message.
   const commitMsgFile = process.argv[2]
   if (commitMsgFile && existsSync(commitMsgFile)) {
+    const msgText = readFileSync(commitMsgFile, 'utf8')
+    const linearHits = scanLinearReferences(msgText)
+    if (linearHits.length > 0) {
+      out(red('✗ Commit message references Linear issue(s):'))
+      for (const hit of linearHits) {
+        out(`  ${hit}`)
+      }
+      out(
+        red(
+          'Linear tracking lives in Linear. Remove the reference from the commit message.',
+        ),
+      )
+      errors++
+    }
+  }
+
+  // Auto-strip AI attribution lines from the commit message.
+  if (commitMsgFile && existsSync(commitMsgFile)) {
     const original = readFileSync(commitMsgFile, 'utf8')
     const { cleaned, removed } = stripAiAttribution(original)
     if (removed > 0) {

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f5e6d06. Configure here.}