.pre-commit-config.yaml

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: end-of-file-fixer
      - id: trailing-whitespace
        args: ['--markdown-linebreak-ext=md']
      - id: check-yaml
        args: ['--allow-multiple-documents', '--unsafe']
        exclude: ^helm/
      - id: check-json
        exclude: ^src/frontend/src/i18n/
      - id: check-merge-conflict

  # ── Crash-recovery guard ───────────────────────────────────────────────
  # Refuses commits from a worktree nested under .claude/worktrees/. Sessions
  # run from there have no resumable top-level transcript, so a crash strands
  # the work (see CLAUDE.md §"Crash recovery"). Use `task worktree:add` instead.
  - repo: local
    hooks:
      - id: guard-nested-worktree
        name: no commits from .claude/worktrees/ (not resumable)
        entry: scripts/guard_nested_worktree.sh
        language: system
        always_run: true
        pass_filenames: false

  # ── Backend (Python) ──────────────────────────────────────────────────
  # Uses ruff via pip (not the pre-commit mirror) to support py314 target-version.
  - repo: local
    hooks:
      - id: ruff-lint
        name: ruff check (backend)
        entry: bash -c 'cd src/backend && ruff check --fix "${@/#src\/backend\//}"' --
        language: python
        additional_dependencies: ['ruff>=0.15.0']
        files: ^src/backend/.*\.py$
        types: [python]
      - id: ruff-format
        name: ruff format (backend)
        entry: bash -c 'cd src/backend && ruff format "${@/#src\/backend\//}"' --
        language: python
        additional_dependencies: ['ruff>=0.15.0']
        files: ^src/backend/.*\.py$
        types: [python]

  # ── Frontend (TypeScript/React) ────────────────────────────────────────
  # These hooks require node_modules — run locally only.
  # In CI, frontend linting runs via .github/workflows/frontend.yml (npm ci + eslint + tsc).
  - repo: local
    hooks:
      - id: frontend-eslint
        name: ESLint (frontend)
        entry: bash -c 'test -d src/frontend/node_modules || exit 0; cd src/frontend && npx eslint --no-error-on-unmatched-pattern "${@/#src\/frontend\//}"' --
        language: system
        files: ^src/frontend/src/.*\.(ts|tsx)$
        types_or: [ts, tsx]
      - id: frontend-tsc
        name: TypeScript check (frontend)
        entry: bash -c 'test -d src/frontend/node_modules || exit 0; cd src/frontend && npx tsc --noEmit'
        language: system
        files: ^src/frontend/src/.*\.(ts|tsx)$
        pass_filenames: false

  # ── Security (Nuclei templates) ─────────────────────────────────────────
  # Validates project-specific Nuclei templates (NFR-014 §3.2). Skips when
  # nuclei is not installed locally so the hook does not block contributors
  # who never touch security templates. The CI security-nuclei workflow
  # (Phase 2B) is the authoritative gate.
  - repo: local
    hooks:
      - id: nuclei-validate
        name: Nuclei template validate
        entry: bash -c 'command -v nuclei >/dev/null 2>&1 || { echo "nuclei not in PATH — skipping local validate."; exit 0; }; nuclei -validate -t tests/security/nuclei-templates/'
        language: system
        files: ^tests/security/nuclei-templates/.*\.yaml$
        pass_filenames: false