chore(hooks): replace test pre-commit with Claude PII guard

[Martin Torp (mtorp)]

Summary

• Drops the local pnpm test invocation from .husky/pre-commit (and the matching test-pre-commit script and .env.precommit); local commits no longer block on the full test suite.
• Adds a commit-msg hook (.husky/commit-msg → scripts/check-commit-pii.js) that asks Claude Sonnet to scan the commit message and staged diff for customer-identifying references and refuses the commit when it finds one.
• Adds a strict Customer Confidentiality section to CLAUDE.md, plus reinforcing bullets in Git Commit Guidelines and ABSOLUTE RULES, so the rule overrides anything a future prompt asks for.

Why commit-msg and not pre-commit?

It is the only hook stage where both the commit message and the staged diff are accessible together. Functionally it still runs before the commit is finalized.

How the guard works

scripts/check-commit-pii.js calls:

claude --print --model sonnet --tools "" --disable-slash-commands \
       --max-budget-usd 0.10 --no-session-persistence

• --tools "" disables every tool, so the model can only emit text — no permission prompts, safe to run unattended from git.
• --max-budget-usd 0.10 caps spend per call.
• Diff is truncated at 200 KB before sending.
• The script accepts only the first non-empty line of the response; OK lets the commit through, BLOCK: … rejects it.

Escape hatches

• DISABLE_PRECOMMIT_PII_CHECK=1 git commit … — bypass once. Use only for genuine false positives.
• If claude is not on PATH, the script falls open with a warning rather than blocking commits for developers without Claude Code installed.

Test plan

• Stage a file containing customer-shaped references and a commit message naming a person → guard rejects with a BLOCK: … reason.
• Commit this very PR's changes → guard reports [pii-check] No customer references detected. (visible in the commit output).
• Reviewer: confirm pnpm install in a fresh clone wires up .husky/_/commit-msg correctly via the prepare script.
• Reviewer: verify the CLAUDE.md Customer Confidentiality wording covers the cases you have in mind.

Notes for reviewers

• The guard depends on Claude Code being installed on every developer's machine. It falls open (commit allowed, warning printed) when it is not — this is intentional so commits do not break for anyone without it set up, but it means the guard is best-effort, not a hard control.
• The hook authenticates via whatever auth your interactive claude session uses (OAuth via keychain or ANTHROPIC_API_KEY). --bare was deliberately removed because it ignores keychain OAuth.

---

Note

Medium Risk
Medium risk because it changes local commit workflow and introduces a new git hook that sends commit messages and staged diffs to the external claude CLI for classification; misconfiguration or false positives can block commits or leak sensitive diff content.

Overview
This PR removes running the full test suite during local pre-commit (dropping .env.precommit and the test-pre-commit script) so commits only run lint-staged by default.

It adds a new commit-msg Husky hook that runs scripts/check-commit-pii.js, which calls the claude CLI (Sonnet) to scan the commit message and staged diff for customer-identifying references and blocks the commit on a BLOCK verdict (with opt-out via DISABLE_PRECOMMIT_PII_CHECK).

CLAUDE.md is updated to explicitly forbid customer-identifying info in repo artifacts and to document the new PII guard as an enforced commit guideline.

^{Reviewed by Cursor Bugbot for commit 9515537. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Non-OK Claude responses allow commit
  • The PII guard now blocks successful Claude runs unless the first non-empty response line is exactly OK.

Or push these changes by commenting:

@cursor push 9f742df172

Preview (9f742df172)

diff --git a/scripts/check-commit-pii.js b/scripts/check-commit-pii.js
--- a/scripts/check-commit-pii.js
+++ b/scripts/check-commit-pii.js
@@ -168,6 +168,18 @@
     console.error('')
     return 1
   }
+  if (firstLine !== 'OK') {
+    console.error('')
+    console.error('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')
+    console.error('[pii-check] Commit blocked: invalid Claude response.')
+    console.error('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')
+    console.error(result.output || '(empty response)')
+    console.error('')
+    console.error('Expected Claude to return exactly: OK')
+    console.error('or: BLOCK: <one short sentence describing what was found>')
+    console.error('')
+    return 1
+  }
   console.log('[pii-check] No customer references detected.')
   return 0
 }

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9515537. Configure here.}