fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

* fix(hooks,lib): fix hook detection and parsing edge cases

- auto-tmux-dev: dev\b -> dev(?![\w-]) so one-shot dev-build/dev-docs scripts
  are not detached into tmux; align command shapes (yarn run dev, bun dev) with
  pre-bash-dev-server-block.js DEV_PATTERN.
- pre-bash-commit-quality: skip obvious non-secret placeholders (env refs,
  ${...}, <...>, whitelisted tokens) in the api-key rule without suppressing
  real high-entropy secrets; make -m message extraction quote- and
  escaped-quote-aware so `-m "fix: \"x\""` / apostrophes are not truncated.
- pre-compact: annotate the CURRENT worktree's session (match **Worktree:** /
  legacy **Project:**) instead of the newest *-session.tmp across all projects,
  layered onto the LLM-summary flow from #2388; a present-but-blank Worktree
  header is treated as non-legacy (no foreign project fallback).
- shell-substitution: stop double-appending a trailing backslash in an
  unterminated backtick span.
- utils readStdinJson: on overflow, settle and resolve {} immediately (clear
  timer + listeners) instead of waiting for end/timeout and parsing a partial
  prefix; surface the overflow on stderr.

Regression tests added/extended (new tests/hooks/pre-compact.test.js).

Addresses review feedback on #2405. The earlier block-no-verify change was
dropped: its message-value skip on merge/cherry-pick/am/rebase would let
`git rebase -m --no-verify` bypass the hook (rebase's -m is the boolean
--merge), a false-negative worse than the contrived false-positive it fixed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ci): align hook fixtures and drain oversized stdin

---------

Co-authored-by: djpjronline-netizen <276112803+djpjronline-netizen@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>

tests/hooks/pre-bash-commit-quality.test.js

@@ -235,6 +235,40 @@ if (test('blocks commits with staged secret patterns across checkable files', ()
   });
 })) passed++; else failed++;
 
+if (test('blocks commits with an unquoted API key assignment', () => {
+  inTempRepo(repoDir => {
+    writeAndStage(repoDir, 'config.py', [
+      'API_KEY=sk_live_1234567890abcdef',
+      ''
+    ].join('\n'));
+
+    const input = JSON.stringify({ tool_input: { command: 'git commit -m "fix: unquoted key"' } });
+    const { result, stderr } = captureConsoleError(() => hook.evaluate(input));
+
+    assert.strictEqual(result.output, input);
+    assert.strictEqual(result.exitCode, 2);
+    assert.ok(stderr.includes('Potential API key'), `expected unquoted API key warning, got: ${stderr}`);
+  });
+})) passed++; else failed++;
+
+if (test('does not flag ordinary unquoted apiKey code references', () => {
+  inTempRepo(repoDir => {
+    writeAndStage(repoDir, 'index.js', [
+      'const apiKey = getApiKeyFromVault();',
+      'this.apiKey = options.apiKey;',
+      'const apiKey2 = process.env.API_KEY;',
+      ''
+    ].join('\n'));
+
+    const input = JSON.stringify({ tool_input: { command: 'git commit -m "fix: no secret here"' } });
+    const { result, stderr } = captureConsoleError(() => hook.evaluate(input));
+
+    assert.strictEqual(result.output, input);
+    assert.strictEqual(result.exitCode, 0, `expected exit 0 (no secrets), got ${result.exitCode}: ${stderr}`);
+    assert.ok(!stderr.includes('Potential API key'), `should not flag ordinary code as a secret, got: ${stderr}`);
+  });
+})) passed++; else failed++;
+
 if (test('reports eslint pylint and golint failures from staged files', () => {
   inTempRepo(repoDir => {
     writeAndStage(repoDir, 'index.js', 'const lint = true;\n');
@@ -291,5 +325,52 @@ if (test('stdin entry point truncates oversized input and preserves pass-through
   assert.ok(result.stderr.includes('[Hook] Error:'), 'truncated JSON should be logged and allowed');
 })) passed++; else failed++;
 
+// --- Secret-scanner placeholder exclusion (false-positive fix, no false-negative) ---
+
+if (test('isPlaceholderSecret suppresses obvious non-secret placeholders', () => {
+  for (const v of ['process.env.API_KEY', '${API_KEY}', '<YOUR_KEY>', 'REPLACE_ME', 'CHANGEME', 'YOUR_API_KEY', '']) {
+    assert.strictEqual(hook.isPlaceholderSecret(v), true, `should suppress placeholder: ${JSON.stringify(v)}`);
+  }
+})) passed++; else failed++;
+
+if (test('isPlaceholderSecret does NOT suppress real high-entropy secrets', () => {
+  for (const v of [
+    'sk-live-abcdef0123456789ABCDEF',          // prefixed
+    '9F8A7B6C5D4E3F2A1B0C9D8E7F6A5B4C',          // uppercase hex
+    'JBSWY3DPEHPK3PXP',                           // base32 TOTP/HMAC seed
+    '1234567890123456',                          // digit-only token
+    'PROD_7F3A9C2E_LIVE_8821',                    // uppercase-with-underscore token
+    'AbCd1234EfGh5678'                            // mixed token
+  ]) {
+    assert.strictEqual(hook.isPlaceholderSecret(v), false, `must NOT suppress real secret: ${v}`);
+  }
+})) passed++; else failed++;
+
+// --- Quote-aware commit-message extraction (truncation fix) ---
+
+if (test('captures full double-quoted -m message containing an apostrophe', () => {
+  const res = hook.validateCommitMessage(`git commit -m "fix: don't crash on empty input"`);
+  assert.ok(res, 'expected a validation result');
+  assert.strictEqual(res.message, "fix: don't crash on empty input");
+})) passed++; else failed++;
+
+if (test('captures full single-quoted -m message containing a double quote', () => {
+  const res = hook.validateCommitMessage(`git commit -m 'fix: handle the "edge" case'`);
+  assert.strictEqual(res.message, 'fix: handle the "edge" case');
+})) passed++; else failed++;
+
+if (test('captures full double-quoted -m message with escaped inner quotes (not truncated)', () => {
+  const res = hook.validateCommitMessage('git commit -m "fix: say \\"hello\\" to the user"');
+  assert.ok(res, 'expected a validation result');
+  assert.strictEqual(res.message, 'fix: say \\"hello\\" to the user');
+})) passed++; else failed++;
+
+if (test('measures length of the full message past an apostrophe (not the truncated prefix)', () => {
+  const subject = "fix: it's a deliberately long commit subject that comfortably exceeds seventy-two chars";
+  const res = hook.validateCommitMessage(`git commit -m "${subject}"`);
+  assert.strictEqual(res.message, subject);
+  assert.ok(res.issues.some(i => i.type === 'length'), 'full (>72) message should trigger a length issue');
+})) passed++; else failed++;
+
 console.log(`\nResults: Passed: ${passed}, Failed: ${failed}`);
 process.exit(failed > 0 ? 1 : 0);