chore(hooks): add husky pre-push type-check gate

The local dev build (tsup/esbuild) only transpiles and skips type-checking,
so type errors stayed invisible locally and surfaced only in CI. Add a husky
pre-push hook that runs the same tsc --noEmit as CI's lint step, failing the
push locally for the same reason CI would.

- husky devDependency + prepare script (installs hooks on npm install)
- .husky/pre-push: tsc --noEmit gate, then an optional gitignored local
  scanner hook if present
- .husky/pre-commit: optional local staged-scan hook only (kept light)
- gitignore scripts/local/ for maintainer-only scripts

Author: EvanZhang008

.gitignore

@@ -66,3 +66,6 @@ tools/
 
 # Local demo assets (4K video, clips, thumbnails, launch kit) — large + local-only, never committed
 demo/
+
+# Local-only maintainer scripts (sensitive-content scanners — contain private grep patterns, never commit)
+scripts/local/

.husky/pre-commit

@@ -0,0 +1,13 @@
+# Pre-commit gate (committed). Intentionally light — the heavy checks
+# (type-check, full scan) run at push time in .husky/pre-push.
+#
+# Runs an OPTIONAL local-only scanner (scripts/local/scan-sensitive-staged.sh,
+# gitignored) if present — the maintainer uses it to catch private content in
+# staged changes before it ever lands in a commit. Absent for everyone else,
+# so this hook is a no-op for them.
+#
+# Bypass with `git commit --no-verify`.
+
+if [ -x scripts/local/scan-sensitive-staged.sh ]; then
+  scripts/local/scan-sensitive-staged.sh || exit 1
+fi

.husky/pre-push

@@ -0,0 +1,28 @@
+# Pre-push gate (committed; runs for everyone who installs deps).
+#
+# 1. TypeScript type-check — matches CI's `npm run lint` (tsc --noEmit).
+#    The local dev build uses tsup/esbuild, which ONLY transpiles and SKIPS
+#    type-checking, so type errors stay invisible locally and surface only in
+#    CI. This makes a local push fail for the same reason CI would, before the
+#    error reaches the remote.
+#
+# 2. An OPTIONAL local-only scanner (scripts/local/scan-sensitive.sh, gitignored)
+#    runs afterwards if present — used by this repo's maintainer to scan for
+#    private content before pushing to the public mirror. Absent for everyone
+#    else, so this hook degrades to just the type-check.
+#
+# Bypass everything with `git push --no-verify` (not recommended).
+
+echo "Type-checking before push (tsc --noEmit)…"
+if ! npm run --silent lint; then
+  echo ""
+  echo "Push blocked: TypeScript errors above (CI would fail too)."
+  echo "Fix them, or bypass with: git push --no-verify"
+  exit 1
+fi
+echo "✓ Type-check passed."
+
+# Optional local sensitive-content scanner — forward stdin (the pre-push refs).
+if [ -x scripts/local/scan-sensitive.sh ]; then
+  scripts/local/scan-sensitive.sh || exit 1
+fi

package-lock.json

@@ -54,7 +54,8 @@
     "web:build": "bash scripts/build-daemon.sh && tsup && cp -r src/data dist/ && for d in src/integrations/*/manifest.json; do cp \"$d\" \"dist/integrations/$(basename $(dirname $d))/\"; done && cd web && npx vite build",
     "dev:ephemeral": "npm run web:build && node dist/cli.js web --ephemeral",
     "dev:demo": "npm run web:build && (lsof -ti:3457 -sTCP:LISTEN | xargs kill -15 2>/dev/null || true); (cat /tmp/open-walnut-demo/daemon.pid 2>/dev/null | xargs kill -15 2>/dev/null || true); sleep 1; echo \"Demo server: http://localhost:3457  (data: $HOME/.open-walnut-demo, daemon: /tmp/open-walnut-demo — fully isolated from prod)\"; OPEN_WALNUT_HOME=\"$HOME/.open-walnut-demo\" WALNUT_DAEMON_DIR=/tmp/open-walnut-demo node dist/cli.js web --port 3457",
-    "dev:prod": "npm run web:build && lsof -ti:3456 -sTCP:LISTEN | xargs kill -15 2>/dev/null; for i in 1 2 3 4 5 6 7 8 9 10; do lsof -ti:3456 -sTCP:LISTEN >/dev/null 2>&1 || break; sleep 0.5; done; node dist/cli.js web --port 3456 & PID=$!; for i in 1 2 3 4 5 6 7 8 9 10; do curl -sf http://localhost:3456/api/config >/dev/null 2>&1 && break || sleep 0.5; done; echo \"Server ready (PID: $PID)\""
+    "dev:prod": "npm run web:build && lsof -ti:3456 -sTCP:LISTEN | xargs kill -15 2>/dev/null; for i in 1 2 3 4 5 6 7 8 9 10; do lsof -ti:3456 -sTCP:LISTEN >/dev/null 2>&1 || break; sleep 0.5; done; node dist/cli.js web --port 3456 & PID=$!; for i in 1 2 3 4 5 6 7 8 9 10; do curl -sf http://localhost:3456/api/config >/dev/null 2>&1 && break || sleep 0.5; done; echo \"Server ready (PID: $PID)\"",
+    "prepare": "husky"
   },
   "dependencies": {
     "@anthropic-ai/bedrock-sdk": "^0.26.3",
@@ -101,6 +102,7 @@
     "@types/ws": "^8.18.1",
     "@vitest/coverage-v8": "^3.1.0",
     "concurrently": "^9.2.1",
+    "husky": "^9.1.7",
     "patch-package": "^8.0.1",
     "supertest": "^7.2.2",
     "tsup": "^8.5.0",