feat: auto-strip AI attribution from commit messages

Author: jdalton

.git-hooks/commit-msg

@@ -0,0 +1,73 @@
+#!/bin/bash
+# Socket Security Commit-msg Hook
+# Additional security layer - validates commit even if pre-commit was bypassed.
+
+set -e
+
+# Colors for output.
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+# Allowed public API key (used in socket-lib).
+ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
+
+ERRORS=0
+
+# Get files in this commit (for security checks).
+COMMITTED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || echo "")
+
+# Quick checks for critical issues in committed files.
+if [ -n "$COMMITTED_FILES" ]; then
+  for file in $COMMITTED_FILES; do
+    if [ -f "$file" ]; then
+      # Check for Socket API keys (except allowed).
+      if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'fake-token' | grep -v 'test-token' | grep -v '\.example' | grep -q .; then
+        echo "${RED}✗ SECURITY: Potential API key detected in commit!${NC}"
+        echo "File: $file"
+        ERRORS=$((ERRORS + 1))
+      fi
+
+      # Check for .env files.
+      if echo "$file" | grep -qE '^\.env(\.local)?$'; then
+        echo "${RED}✗ SECURITY: .env file in commit!${NC}"
+        ERRORS=$((ERRORS + 1))
+      fi
+    fi
+  done
+fi
+
+# Auto-strip AI attribution from commit message.
+COMMIT_MSG_FILE="$1"
+if [ -f "$COMMIT_MSG_FILE" ]; then
+  # Create a temporary file to store the cleaned message.
+  TEMP_FILE=$(mktemp)
+  REMOVED_LINES=0
+
+  # Read the commit message line by line and filter out AI attribution.
+  while IFS= read -r line || [ -n "$line" ]; do
+    # Check if this line contains AI attribution patterns.
+    if echo "$line" | grep -qiE "(Generated with|Co-Authored-By: Claude|Co-Authored-By: AI|🤖 Generated|AI generated|Claude Code|@anthropic|Assistant:|Generated by Claude|Machine generated)"; then
+      REMOVED_LINES=$((REMOVED_LINES + 1))
+    else
+      # Line doesn't contain AI attribution, keep it.
+      printf '%s\n' "$line" >> "$TEMP_FILE"
+    fi
+  done < "$COMMIT_MSG_FILE"
+
+  # Replace the original commit message with the cleaned version.
+  if [ $REMOVED_LINES -gt 0 ]; then
+    mv "$TEMP_FILE" "$COMMIT_MSG_FILE"
+    echo "${GREEN}✓ Auto-stripped${NC} $REMOVED_LINES AI attribution line(s) from commit message"
+  else
+    # No lines were removed, just clean up the temp file.
+    rm -f "$TEMP_FILE"
+  fi
+fi
+
+if [ $ERRORS -gt 0 ]; then
+  echo "${RED}✗ Commit blocked by security validation${NC}"
+  exit 1
+fi
+
+exit 0