chore: setup husky and pre-commit secret scanning for stellar keys an…

.husky/pre-commit

@@ -0,0 +1,22 @@
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
+# 1. Run gitleaks for generic high-entropy strings and AWS keys
+if command -v gitleaks >/dev/null 2>&1; then
+  echo "Running gitleaks..."
+  gitleaks protect --staged --redact --verbose || {
+    echo "Error: gitleaks detected secrets! Please remove them and try again."
+    exit 1
+  }
+else
+  echo "Notice: gitleaks is not installed locally. Skipping advanced secret scanning."
+fi
+
+# 2. Check explicitly for Stellar secret keys (starts with S, 56 characters, base32)
+if git diff --cached | grep -qE '\bS[A-Z2-7]{55}\b'; then
+  echo "Error: Stellar secret key detected in staged files. Commit blocked."
+  exit 1
+fi
+
+exit 0
+

CONTRIBUTING.md

@@ -45,6 +45,7 @@ You need:
 - Node.js 22 or later
 - npm
 - Git
+- [gitleaks](https://github.com/gitleaks/gitleaks) (for pre-commit secret scanning, e.g., `brew install gitleaks`)
 
 Clone and install:
 

package.json

@@ -22,6 +22,7 @@
     "sorokeep-mcp": "dist/mcp/index.js"
   },
   "scripts": {
+    "prepare": "husky",
     "build": "tsc && node -e \"const fs = require('fs'); fs.copyFileSync('src/db/schema.sql', 'dist/db/schema.sql'); const srcDir = 'src/db/migrations'; const destDir = 'dist/db/migrations'; if (fs.existsSync(srcDir)) { fs.mkdirSync(destDir, { recursive: true }); fs.readdirSync(srcDir).forEach(f => fs.copyFileSync(srcDir + '/' + f, destDir + '/' + f)); }\" && npm run build:man",
     "build:man": "tsx scripts/generate-man.ts",
     "dev": "tsx src/index.ts",
@@ -85,6 +86,7 @@
     "@vitest/coverage-v8": "^3.0.7",
     "eslint": "^10.3.0",
     "fast-check": "^4.9.0",
+    "husky": "^9.0.11",
     "parse-prometheus-text-format": "^1.1.1",
     "pino-pretty": "^13.1.3",
     "strip-ansi": "^7.2.0",