@codebakers/cli 3.9.39 → 3.9.40

package/src/commands/install-precommit.ts

@@ -3,7 +3,7 @@ import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync } from 'f
 import { join } from 'path';
 
 const PRE_COMMIT_SCRIPT = `#!/bin/sh
-# CodeBakers Pre-Commit Hook - Real Code Validation
+# CodeBakers Pre-Commit Hook - Comprehensive Code Validation
 # Actually scans code for pattern violations
 
 # Run the validation script
@@ -13,8 +13,8 @@ exit $?
 
 const VALIDATE_CODE_SCRIPT = `#!/usr/bin/env node
 /**
- * CodeBakers Pre-Commit Code Validator
- * Actually validates code against patterns - not just honor system
+ * CodeBakers Pre-Commit Code Validator v2.0
+ * Comprehensive code validation - 40+ checks
  */
 
 const { execSync } = require('child_process');
@@ -36,16 +36,161 @@ function log(color, message) {
 function getStagedFiles() {
   try {
     const output = execSync('git diff --cached --name-only --diff-filter=ACM', { encoding: 'utf-8' });
-    return output.split('\\n').filter(f => f.trim() && (f.endsWith('.ts') || f.endsWith('.tsx') || f.endsWith('.js') || f.endsWith('.jsx')));
+    return output.split('\\n').filter(f => f.trim());
   } catch {
     return [];
   }
 }
 
-// Pattern violations to check
+// Get code files only
+function getCodeFiles(files) {
+  return files.filter(f =>
+    f.endsWith('.ts') || f.endsWith('.tsx') ||
+    f.endsWith('.js') || f.endsWith('.jsx')
+  );
+}
+
+// ============================================
+// ALL CHECKS - Organized by Category
+// ============================================
+
 const CHECKS = [
+  // ==========================================
+  // SECURITY CHECKS
+  // ==========================================
+  {
+    name: 'Debugger Statement',
+    category: 'security',
+    test: (content, file) => {
+      if (content.includes('debugger;') || content.includes('debugger ')) {
+        return 'debugger statement left in code - remove before commit';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Hardcoded Secrets',
+    category: 'security',
+    test: (content, file) => {
+      if (file.includes('.env') || file.includes('config')) return null;
+      const patterns = [
+        /api[_-]?key\\s*[:=]\\s*['"][a-zA-Z0-9]{20,}['"]/i,
+        /secret\\s*[:=]\\s*['"][a-zA-Z0-9]{20,}['"]/i,
+        /password\\s*[:=]\\s*['"][^'"]{8,}['"]/i,
+        /sk_live_[a-zA-Z0-9]+/,
+        /sk_test_[a-zA-Z0-9]+/,
+        /ghp_[a-zA-Z0-9]+/,  // GitHub token
+        /xox[baprs]-[a-zA-Z0-9]+/,  // Slack token
+        /AKIA[0-9A-Z]{16}/,  // AWS access key
+      ];
+      for (const pattern of patterns) {
+        if (pattern.test(content)) {
+          return 'Possible hardcoded secret - use environment variables';
+        }
+      }
+      return null;
+    }
+  },
+  {
+    name: 'XSS Vulnerability',
+    category: 'security',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      if (content.includes('dangerouslySetInnerHTML') &&
+          !content.includes('DOMPurify') &&
+          !content.includes('sanitize')) {
+        return 'dangerouslySetInnerHTML without sanitization - XSS risk';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Merge Conflict Markers',
+    category: 'security',
+    test: (content, file) => {
+      if (content.includes('<<<<<<<') || content.includes('>>>>>>>') || content.includes('=======\\n')) {
+        return 'Merge conflict markers found - resolve conflicts first';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Private Key in Code',
+    category: 'security',
+    test: (content, file) => {
+      if (content.includes('-----BEGIN RSA PRIVATE KEY-----') ||
+          content.includes('-----BEGIN PRIVATE KEY-----') ||
+          content.includes('-----BEGIN EC PRIVATE KEY-----')) {
+        return 'Private key detected in code - NEVER commit private keys';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Env File Commit',
+    category: 'security',
+    test: (content, file) => {
+      if (file === '.env' || file === '.env.local' || file === '.env.production') {
+        return '.env file should not be committed - add to .gitignore';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'SQL Injection Risk',
+    category: 'security',
+    test: (content, file) => {
+      const sqlPatterns = [
+        /\\$\\{.*\\}.*(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)/i,
+        /['"]\\s*\\+\\s*.*\\+\\s*['"].*(?:SELECT|INSERT|UPDATE|DELETE)/i,
+        /sql\\s*\\(\\s*\`[^\\)]*\\$\\{/,
+      ];
+      for (const pattern of sqlPatterns) {
+        if (pattern.test(content)) {
+          return 'Possible SQL injection - use parameterized queries';
+        }
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Eval Usage',
+    category: 'security',
+    test: (content, file) => {
+      if (/\\beval\\s*\\(/.test(content) || /new\\s+Function\\s*\\(/.test(content)) {
+        return 'eval() or new Function() detected - security risk';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Sensitive Data in Logs',
+    category: 'security',
+    test: (content, file) => {
+      const sensitivePatterns = [
+        /console\\.log.*password/i,
+        /console\\.log.*token/i,
+        /console\\.log.*secret/i,
+        /console\\.log.*apiKey/i,
+        /console\\.log.*creditCard/i,
+        /console\\.log.*ssn/i,
+        /console\\.log.*authorization/i,
+      ];
+      for (const pattern of sensitivePatterns) {
+        if (pattern.test(content)) {
+          return 'Possible sensitive data being logged';
+        }
+      }
+      return null;
+    }
+  },
+
+  // ==========================================
+  // ERROR HANDLING CHECKS
+  // ==========================================
   {
     name: 'API Error Handling',
+    category: 'errors',
     test: (content, file) => {
       if (!file.includes('/api/') && !file.includes('route.ts')) return null;
       if (!content.includes('try {') && !content.includes('try{')) {
@@ -54,145 +199,233 @@ const CHECKS = [
       return null;
     }
   },
+  {
+    name: 'Empty Catch Block',
+    category: 'errors',
+    test: (content, file) => {
+      if (/catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}/.test(content)) {
+        return 'Empty catch block - handle or rethrow errors';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Catch Without Logging',
+    category: 'errors',
+    test: (content, file) => {
+      const catchBlocks = content.match(/catch\\s*\\([^)]*\\)\\s*\\{[^}]{1,50}\\}/g) || [];
+      for (const block of catchBlocks) {
+        if (!block.includes('console') && !block.includes('log') &&
+            !block.includes('throw') && !block.includes('error') &&
+            !block.includes('report') && !block.includes('track')) {
+          return 'Catch block may be swallowing errors - log or rethrow';
+        }
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Unsafe JSON Parse',
+    category: 'errors',
+    test: (content, file) => {
+      if (content.includes('JSON.parse(') &&
+          !content.includes('try') && !content.includes('catch')) {
+        return 'JSON.parse without try/catch - can throw on invalid JSON';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Unhandled Promise',
+    category: 'errors',
+    test: (content, file) => {
+      const lines = content.split('\\n');
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i].trim();
+        if (line.match(/(?:fetch|axios|db\\.|prisma\\.).*\\(/) &&
+            !line.includes('await') &&
+            !line.includes('.then') &&
+            !line.includes('.catch') &&
+            !line.includes('return') &&
+            !line.includes('=')) {
+          return \`Unhandled promise at line \${i + 1}\`;
+        }
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Missing Async Error Handling',
+    category: 'errors',
+    test: (content, file) => {
+      if (!file.includes('/api/') && !file.includes('route.ts')) return null;
+      if (content.includes('async') && content.includes('await') &&
+          !content.includes('try') && !content.includes('.catch')) {
+        return 'Async function with await but no error handling';
+      }
+      return null;
+    }
+  },
+
+  // ==========================================
+  // VALIDATION CHECKS
+  // ==========================================
   {
     name: 'Zod Validation',
+    category: 'validation',
     test: (content, file) => {
       if (!file.includes('/api/') && !file.includes('route.ts')) return null;
-      // Check if it's a POST/PUT/PATCH that should have validation
       if ((content.includes('POST') || content.includes('PUT') || content.includes('PATCH')) &&
           content.includes('req.json()') &&
           !content.includes('z.object') &&
           !content.includes('schema.parse') &&
-          !content.includes('Schema.parse')) {
+          !content.includes('Schema.parse') &&
+          !content.includes('validate')) {
         return 'API route accepts body but missing Zod validation';
       }
       return null;
     }
   },
+  {
+    name: 'Missing Auth Check',
+    category: 'validation',
+    test: (content, file) => {
+      if (!file.includes('/api/') && !file.includes('route.ts')) return null;
+      if (file.includes('/public/') || file.includes('/auth/') || file.includes('/webhook')) return null;
+      if ((content.includes('userId') || content.includes('user.id') || content.includes('session')) &&
+          !content.includes('getServerSession') &&
+          !content.includes('auth(') &&
+          !content.includes('requireAuth') &&
+          !content.includes('verifyToken') &&
+          !content.includes('validateSession') &&
+          !content.includes('getSession')) {
+        return 'Route accesses user data but may be missing auth check';
+      }
+      return null;
+    }
+  },
+
+  // ==========================================
+  // CODE QUALITY CHECKS
+  // ==========================================
   {
     name: 'Console Statements',
+    category: 'quality',
     test: (content, file) => {
-      // Allow in test files and scripts
       if (file.includes('.test.') || file.includes('/tests/') || file.includes('/scripts/')) return null;
       const lines = content.split('\\n');
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
-        // Skip commented lines
         if (line.trim().startsWith('//') || line.trim().startsWith('*')) continue;
-        if (line.includes('console.log(') || line.includes('console.error(') || line.includes('console.warn(')) {
-          return \`Console statement found at line \${i + 1} - use proper logging\`;
+        if (line.includes('console.log(')) {
+          return \`console.log at line \${i + 1} - use proper logging\`;
         }
       }
       return null;
     }
   },
   {
-    name: 'Hardcoded Secrets',
+    name: 'TODO/FIXME Comments',
+    category: 'quality',
     test: (content, file) => {
-      // Skip env files and configs
-      if (file.includes('.env') || file.includes('config')) return null;
-      const patterns = [
-        /api[_-]?key\\s*[:=]\\s*['"][a-zA-Z0-9]{20,}['"]/i,
-        /secret\\s*[:=]\\s*['"][a-zA-Z0-9]{20,}['"]/i,
-        /password\\s*[:=]\\s*['"][^'"]{8,}['"]/i,
-        /sk_live_[a-zA-Z0-9]+/,
-        /sk_test_[a-zA-Z0-9]+/,
-      ];
-      for (const pattern of patterns) {
-        if (pattern.test(content)) {
-          return 'Possible hardcoded secret detected - use environment variables';
-        }
+      const match = content.match(/\\/\\/\\s*(TODO|FIXME|XXX|HACK):/i);
+      if (match) {
+        return \`Unresolved \${match[1]} comment - address before commit\`;
       }
       return null;
     }
   },
   {
     name: 'Hardcoded URLs',
+    category: 'quality',
     test: (content, file) => {
-      // Skip test files
       if (file.includes('.test.') || file.includes('/tests/')) return null;
-      if (content.includes('localhost:') && !content.includes('process.env') && !content.includes('|| \\'http://localhost')) {
+      if (content.includes('localhost:') &&
+          !content.includes('process.env') &&
+          !content.includes("|| 'http://localhost") &&
+          !content.includes('|| "http://localhost')) {
         return 'Hardcoded localhost URL - use environment variable with fallback';
       }
       return null;
     }
   },
   {
-    name: 'SQL Injection Risk',
+    name: 'Large File',
+    category: 'quality',
     test: (content, file) => {
-      // Check for string concatenation in SQL
-      const sqlPatterns = [
-        /\\$\\{.*\\}.*(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)/i,
-        /['"]\\s*\\+\\s*.*\\+\\s*['"].*(?:SELECT|INSERT|UPDATE|DELETE)/i,
-        /sql\\s*\\(\\s*\`[^\\)]*\\$\\{/,
-      ];
-      for (const pattern of sqlPatterns) {
-        if (pattern.test(content)) {
-          return 'Possible SQL injection - use parameterized queries';
-        }
+      const lines = content.split('\\n').length;
+      if (lines > 500) {
+        return \`File has \${lines} lines - consider splitting into smaller modules\`;
       }
       return null;
     }
   },
   {
-    name: 'Untyped Function Parameters',
+    name: 'Magic Numbers',
+    category: 'quality',
     test: (content, file) => {
-      if (!file.endsWith('.ts') && !file.endsWith('.tsx')) return null;
-      // Check for functions with 'any' type
-      if (content.includes(': any)') || content.includes(': any,') || content.includes(': any =')) {
-        return 'Using "any" type - provide proper TypeScript types';
+      // Look for unexplained numbers in conditions
+      const magicPattern = /(?:if|while|for)\\s*\\([^)]*[^0-9.](\\d{3,})[^0-9.]/;
+      const match = content.match(magicPattern);
+      if (match && !content.includes('const') && !content.includes('let')) {
+        return 'Magic number detected - use named constants';
       }
       return null;
     }
   },
   {
-    name: 'Missing Async Error Handling',
+    name: 'Commented Out Code',
+    category: 'quality',
     test: (content, file) => {
-      // Check for await without try/catch in the same function scope
-      const asyncFunctions = content.match(/async\\s+(?:function\\s+)?\\w*\\s*\\([^)]*\\)\\s*(?::\\s*[^{]+)?\\s*\\{[^}]+\\}/g) || [];
-      for (const func of asyncFunctions) {
-        if (func.includes('await') && !func.includes('try') && !func.includes('catch')) {
-          // Check if it's wrapped in a try/catch at a higher level
-          if (!content.includes('.catch(') && !content.includes('try {')) {
-            return 'Async function with await but no error handling';
-          }
+      const lines = content.split('\\n');
+      let commentedCodeCount = 0;
+      for (const line of lines) {
+        if (line.trim().match(/^\\/\\/\\s*(const|let|var|function|if|for|while|return|import|export)\\s/)) {
+          commentedCodeCount++;
         }
       }
+      if (commentedCodeCount > 5) {
+        return \`\${commentedCodeCount} lines of commented code - remove dead code\`;
+      }
       return null;
     }
   },
+
+  // ==========================================
+  // TYPESCRIPT CHECKS
+  // ==========================================
   {
-    name: 'Empty Catch Block',
+    name: 'Any Type Usage',
+    category: 'typescript',
     test: (content, file) => {
-      if (/catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}/.test(content)) {
-        return 'Empty catch block - handle or rethrow errors';
-      }
-      if (/catch\\s*\\([^)]*\\)\\s*\\{\\s*\\/\\//.test(content)) {
-        return 'Catch block with only comment - properly handle errors';
+      if (!file.endsWith('.ts') && !file.endsWith('.tsx')) return null;
+      if (content.includes(': any)') || content.includes(': any,') ||
+          content.includes(': any;') || content.includes(': any =') ||
+          content.includes('<any>') || content.includes('as any')) {
+        return 'Using "any" type - provide proper TypeScript types';
       }
       return null;
     }
   },
   {
-    name: 'Direct DOM Manipulation in React',
+    name: 'Type Assertion Override',
+    category: 'typescript',
     test: (content, file) => {
-      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
-      if (content.includes('document.getElementById') ||
-          content.includes('document.querySelector') ||
-          content.includes('document.createElement')) {
-        return 'Direct DOM manipulation in React - use refs or state instead';
+      if (!file.endsWith('.ts') && !file.endsWith('.tsx')) return null;
+      if (content.includes('as unknown as') || content.includes('!.') && content.match(/!\\.[a-zA-Z]/)) {
+        return 'Unsafe type assertion - validate types properly';
       }
       return null;
     }
   },
   {
     name: 'Missing Return Type',
+    category: 'typescript',
     test: (content, file) => {
       if (!file.endsWith('.ts') && !file.endsWith('.tsx')) return null;
-      // Check exported functions without return types
       const exportedFunctions = content.match(/export\\s+(?:async\\s+)?function\\s+\\w+\\s*\\([^)]*\\)\\s*\\{/g) || [];
       for (const func of exportedFunctions) {
-        if (!func.includes(':') || func.match(/\\)\\s*\\{$/)) {
+        if (!func.includes(':')) {
           return 'Exported function missing return type annotation';
         }
       }
@@ -200,71 +433,356 @@ const CHECKS = [
     }
   },
   {
-    name: 'Unsafe JSON Parse',
+    name: 'Non-null Assertion',
+    category: 'typescript',
     test: (content, file) => {
-      if (content.includes('JSON.parse(') && !content.includes('try') && !content.includes('catch')) {
-        return 'JSON.parse without try/catch - can throw on invalid JSON';
+      if (!file.endsWith('.ts') && !file.endsWith('.tsx')) return null;
+      const assertions = (content.match(/\\w+!/g) || []).filter(m => !m.includes('!='));
+      if (assertions.length > 3) {
+        return \`\${assertions.length} non-null assertions (!) - handle null cases properly\`;
       }
       return null;
     }
   },
+
+  // ==========================================
+  // REACT CHECKS
+  // ==========================================
   {
-    name: 'Missing Auth Check',
+    name: 'Direct DOM Manipulation',
+    category: 'react',
     test: (content, file) => {
-      if (!file.includes('/api/') && !file.includes('route.ts')) return null;
-      // Skip public routes
-      if (file.includes('/public/') || file.includes('/auth/') || file.includes('/webhook')) return null;
-      // Check if it's accessing user data without auth
-      if ((content.includes('userId') || content.includes('user.id') || content.includes('session')) &&
-          !content.includes('getServerSession') &&
-          !content.includes('auth(') &&
-          !content.includes('requireAuth') &&
-          !content.includes('verifyToken') &&
-          !content.includes('validateSession')) {
-        return 'Route accesses user data but may be missing auth check';
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      if (content.includes('document.getElementById') ||
+          content.includes('document.querySelector') ||
+          content.includes('document.createElement') ||
+          content.includes('document.body')) {
+        return 'Direct DOM manipulation in React - use refs or state';
       }
       return null;
     }
   },
   {
-    name: 'Unhandled Promise',
+    name: 'Missing useEffect Cleanup',
+    category: 'react',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      // Check for useEffect with subscriptions but no cleanup
+      if (content.includes('useEffect') &&
+          (content.includes('addEventListener') ||
+           content.includes('subscribe') ||
+           content.includes('setInterval') ||
+           content.includes('setTimeout')) &&
+          !content.includes('removeEventListener') &&
+          !content.includes('unsubscribe') &&
+          !content.includes('clearInterval') &&
+          !content.includes('clearTimeout') &&
+          !content.includes('return () =>')) {
+        return 'useEffect with subscription but no cleanup - memory leak risk';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Conditional Hook',
+    category: 'react',
     test: (content, file) => {
-      // Check for promises without await or .then/.catch
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
       const lines = content.split('\\n');
+      let inCondition = false;
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
-        // Skip if line ends with await, .then, .catch, or is assigned
-        if (line.match(/(?:fetch|axios|db\\.|prisma\\.).*\\(/) &&
-            !line.includes('await') &&
-            !line.includes('.then') &&
-            !line.includes('.catch') &&
-            !line.includes('return') &&
-            !line.includes('=')) {
-          return \`Unhandled promise at line \${i + 1}\`;
+        if (line.startsWith('if ') || line.startsWith('if(')) inCondition = true;
+        if (line.includes('}')) inCondition = false;
+        if (inCondition && (line.includes('useState') || line.includes('useEffect') ||
+            line.includes('useCallback') || line.includes('useMemo'))) {
+          return \`Hook called conditionally at line \${i + 1} - violates Rules of Hooks\`;
         }
       }
       return null;
     }
   },
   {
-    name: 'Sensitive Data in Logs',
+    name: 'Missing Key Prop',
+    category: 'react',
     test: (content, file) => {
-      const sensitivePatterns = [
-        /console\\.log.*password/i,
-        /console\\.log.*token/i,
-        /console\\.log.*secret/i,
-        /console\\.log.*apiKey/i,
-        /console\\.log.*creditCard/i,
-        /console\\.log.*ssn/i,
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      if ((content.includes('.map(') || content.includes('.map (')) &&
+          content.includes('return') &&
+          content.includes('<') &&
+          !content.includes('key=') &&
+          !content.includes('key:')) {
+        return 'Array .map() rendering JSX without key prop';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Index as Key',
+    category: 'react',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      if (content.includes('key={i}') || content.includes('key={index}') ||
+          content.includes('key={idx}')) {
+        return 'Using array index as key - use unique identifier instead';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Inline Function in JSX',
+    category: 'react',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      // Check for arrow functions in onClick, onChange, etc.
+      const inlinePatterns = [
+        /onClick=\\{\\s*\\(\\)\\s*=>/,
+        /onChange=\\{\\s*\\(e?\\)\\s*=>/,
+        /onSubmit=\\{\\s*\\(e?\\)\\s*=>/,
       ];
-      for (const pattern of sensitivePatterns) {
+      for (const pattern of inlinePatterns) {
         if (pattern.test(content)) {
-          return 'Possible sensitive data being logged';
+          return 'Inline function in JSX - use useCallback for performance';
         }
       }
       return null;
     }
-  }
+  },
+  {
+    name: 'Missing Error Boundary',
+    category: 'react',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      // Check if it's a page component without error handling
+      if ((file.includes('/app/') || file.includes('/pages/')) &&
+          file.includes('page.') &&
+          !content.includes('ErrorBoundary') &&
+          !content.includes('error.') &&
+          content.includes('async')) {
+        return 'Page component may need error boundary for async operations';
+      }
+      return null;
+    }
+  },
+
+  // ==========================================
+  // ACCESSIBILITY CHECKS
+  // ==========================================
+  {
+    name: 'Image Without Alt',
+    category: 'a11y',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      if ((content.includes('<img') || content.includes('<Image')) &&
+          !content.includes('alt=') && !content.includes('alt:')) {
+        return 'Image without alt attribute - add alt text for accessibility';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Button Without Type',
+    category: 'a11y',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      // Check for buttons without type attribute
+      if (content.includes('<button') &&
+          !content.includes('type="button"') &&
+          !content.includes('type="submit"') &&
+          !content.includes("type='button'") &&
+          !content.includes("type='submit'") &&
+          !content.includes('type={"button"}') &&
+          !content.includes('type={"submit"}')) {
+        return 'Button without type attribute - specify type="button" or type="submit"';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Missing Form Label',
+    category: 'a11y',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      if ((content.includes('<input') || content.includes('<select') || content.includes('<textarea')) &&
+          !content.includes('<label') &&
+          !content.includes('aria-label') &&
+          !content.includes('aria-labelledby') &&
+          !content.includes('Label')) {
+        return 'Form input without label - add label for accessibility';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Click Handler Without Keyboard',
+    category: 'a11y',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      // Check for divs/spans with onClick but no keyboard handler
+      if ((content.includes('<div') || content.includes('<span')) &&
+          content.includes('onClick') &&
+          !content.includes('onKeyDown') &&
+          !content.includes('onKeyPress') &&
+          !content.includes('onKeyUp') &&
+          !content.includes('role=') &&
+          !content.includes('tabIndex')) {
+        return 'Clickable element without keyboard support - add onKeyDown and role';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Missing ARIA Role',
+    category: 'a11y',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      // Custom interactive elements should have roles
+      if (content.includes('onClick') &&
+          (content.includes('<div') || content.includes('<span')) &&
+          !content.includes('role=') &&
+          !content.includes('<button') &&
+          !content.includes('<a ')) {
+        return 'Interactive element without ARIA role - add appropriate role';
+      }
+      return null;
+    }
+  },
+
+  // ==========================================
+  // PERFORMANCE CHECKS
+  // ==========================================
+  {
+    name: 'Large Import',
+    category: 'performance',
+    test: (content, file) => {
+      // Check for importing entire libraries
+      const largeImports = [
+        /import\\s+\\*\\s+as\\s+\\w+\\s+from\\s+['"]lodash['"]/,
+        /import\\s+\\{[^}]{100,}\\}\\s+from/,  // Very large destructured import
+        /import\\s+moment\\s+from/,  // moment.js is large
+      ];
+      for (const pattern of largeImports) {
+        if (pattern.test(content)) {
+          return 'Large library import - use specific imports for smaller bundle';
+        }
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Sync File Operation',
+    category: 'performance',
+    test: (content, file) => {
+      if (file.includes('.test.') || file.includes('/scripts/')) return null;
+      if (content.includes('readFileSync') || content.includes('writeFileSync') ||
+          content.includes('existsSync') || content.includes('readdirSync')) {
+        if (file.includes('/api/') || file.includes('route.ts')) {
+          return 'Synchronous file operation in API route - use async version';
+        }
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Missing Memoization',
+    category: 'performance',
+    test: (content, file) => {
+      if (!file.endsWith('.tsx') && !file.endsWith('.jsx')) return null;
+      // Large computations in render without useMemo
+      if ((content.includes('.filter(') || content.includes('.reduce(') || content.includes('.sort(')) &&
+          content.includes('return') &&
+          content.includes('<') &&
+          !content.includes('useMemo') &&
+          content.split('.filter(').length > 2) {
+        return 'Multiple array operations in render - consider useMemo';
+      }
+      return null;
+    }
+  },
+
+  // ==========================================
+  // API/DATABASE CHECKS
+  // ==========================================
+  {
+    name: 'Missing Rate Limit',
+    category: 'api',
+    test: (content, file) => {
+      if (!file.includes('/api/') && !file.includes('route.ts')) return null;
+      if (file.includes('/public/')) return null;
+      if (!content.includes('rateLimit') &&
+          !content.includes('rateLimiter') &&
+          !content.includes('autoRateLimit') &&
+          !content.includes('throttle')) {
+        return 'API route without rate limiting - add protection against abuse';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'N+1 Query Pattern',
+    category: 'api',
+    test: (content, file) => {
+      // Check for await in loop with database calls
+      if ((content.includes('for (') || content.includes('forEach') || content.includes('.map(')) &&
+          content.includes('await') &&
+          (content.includes('db.') || content.includes('prisma.') || content.includes('findOne') || content.includes('findById'))) {
+        return 'Possible N+1 query - fetch data in batch instead of loop';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Missing CORS Config',
+    category: 'api',
+    test: (content, file) => {
+      if (!file.includes('/api/') && !file.includes('route.ts')) return null;
+      if (content.includes("'*'") &&
+          (content.includes('Access-Control-Allow-Origin') || content.includes('cors'))) {
+        return 'Overly permissive CORS (*) - restrict to specific origins';
+      }
+      return null;
+    }
+  },
+
+  // ==========================================
+  // IMPORT CHECKS
+  // ==========================================
+  {
+    name: 'Circular Import Risk',
+    category: 'imports',
+    test: (content, file) => {
+      // Check for importing from parent directory and exporting to child
+      const parentImports = (content.match(/from\\s+['"]\\.\\.\\/[^'"]+['"]/g) || []).length;
+      const hasExport = content.includes('export ');
+      if (parentImports > 3 && hasExport) {
+        return 'Multiple parent imports - potential circular dependency risk';
+      }
+      return null;
+    }
+  },
+  {
+    name: 'Unused Import',
+    category: 'imports',
+    test: (content, file) => {
+      // Simple check for imported names not used
+      const imports = content.match(/import\\s+\\{([^}]+)\\}/g) || [];
+      for (const imp of imports) {
+        const names = imp.replace(/import\\s+\\{/, '').replace(/\\}/, '').split(',');
+        for (const name of names) {
+          const cleanName = name.trim().split(' as ')[0].trim();
+          if (cleanName && cleanName.length > 1) {
+            // Count occurrences (should be > 1 to include the import itself)
+            const regex = new RegExp('\\\\b' + cleanName + '\\\\b', 'g');
+            const occurrences = (content.match(regex) || []).length;
+            if (occurrences === 1) {
+              return \`Possibly unused import: \${cleanName}\`;
+            }
+          }
+        }
+      }
+      return null;
+    }
+  },
 ];
 
 async function validateCode() {
@@ -272,22 +790,35 @@ async function validateCode() {
   const violations = [];
   const warnings = [];
 
-  // Get staged files
-  const stagedFiles = getStagedFiles();
-
-  if (stagedFiles.length === 0) {
-    return { valid: true, message: 'No code files staged' };
-  }
+  const allStagedFiles = getStagedFiles();
+  const codeFiles = getCodeFiles(allStagedFiles);
 
   log(CYAN, '\\n🍪 CodeBakers Pre-Commit Checks');
   log(CYAN, '================================\\n');
 
-  log(DIM, \`📋 Step 1/2: Checking pattern compliance...\\n\`);
-  log(DIM, \`🔍 Validating CodeBakers pattern compliance...\\n\`);
+  // Check for .env files being committed
+  for (const file of allStagedFiles) {
+    if (file.startsWith('.env')) {
+      violations.push({
+        check: 'Env File Commit',
+        category: 'security',
+        message: '.env file should not be committed',
+        file: file
+      });
+    }
+  }
+
+  if (codeFiles.length === 0 && violations.length === 0) {
+    log(DIM, 'No code files staged.\\n');
+    log(GREEN, '================================');
+    log(GREEN, '✅ All pre-commit checks passed!');
+    log(GREEN, '================================\\n');
+    return { valid: true };
+  }
 
-  let filesChecked = 0;
+  log(DIM, '📋 Checking \${codeFiles.length} code file(s)...\\n');
 
-  for (const file of stagedFiles) {
+  for (const file of codeFiles) {
     const filePath = path.join(cwd, file);
     if (!fs.existsSync(filePath)) continue;
 
@@ -298,63 +829,75 @@ async function validateCode() {
       continue;
     }
 
-    filesChecked++;
-    const fileViolations = [];
-
     for (const check of CHECKS) {
-      const result = check.test(content, file);
-      if (result) {
-        fileViolations.push({
-          check: check.name,
-          message: result,
-          file: file
-        });
+      try {
+        const result = check.test(content, file);
+        if (result) {
+          violations.push({
+            check: check.name,
+            category: check.category,
+            message: result,
+            file: file
+          });
+        }
+      } catch (err) {
+        // Skip check on error
       }
     }
-
-    if (fileViolations.length > 0) {
-      violations.push(...fileViolations);
-    }
-  }
-
-  if (filesChecked === 0) {
-    log(DIM, 'No files to validate.\\n');
   }
 
   // Report results
   if (violations.length > 0) {
-    log(RED, \`\\n❌ Found \${violations.length} violation(s):\\n\`);
-
-    const byFile = {};
+    // Group by category
+    const byCategory = {};
     for (const v of violations) {
-      if (!byFile[v.file]) byFile[v.file] = [];
-      byFile[v.file].push(v);
+      if (!byCategory[v.category]) byCategory[v.category] = [];
+      byCategory[v.category].push(v);
     }
 
-    for (const [file, fileViolations] of Object.entries(byFile)) {
-      log(YELLOW, \`  \${file}:\`);
-      for (const v of fileViolations) {
-        log(RED, \`    ✗ [\${v.check}] \${v.message}\`);
+    const categoryNames = {
+      security: '🔒 Security',
+      errors: '⚠️ Error Handling',
+      validation: '✅ Validation',
+      quality: '📝 Code Quality',
+      typescript: '📘 TypeScript',
+      react: '⚛️ React',
+      a11y: '♿ Accessibility',
+      performance: '⚡ Performance',
+      api: '🌐 API',
+      imports: '📦 Imports',
+    };
+
+    log(RED, \`\\n❌ Found \${violations.length} issue(s):\\n\`);
+
+    for (const [category, items] of Object.entries(byCategory)) {
+      log(YELLOW, \`\\n\${categoryNames[category] || category}:\`);
+      const byFile = {};
+      for (const v of items) {
+        if (!byFile[v.file]) byFile[v.file] = [];
+        byFile[v.file].push(v);
+      }
+      for (const [file, fileViolations] of Object.entries(byFile)) {
+        log(DIM, \`  \${file}:\`);
+        for (const v of fileViolations) {
+          log(RED, \`    ✗ \${v.message}\`);
+        }
       }
-      console.log('');
     }
 
-    log(CYAN, '\\nHow to fix:');
-    log(RESET, '  1. Address each violation listed above');
-    log(RESET, '  2. Re-stage your changes: git add <files>');
-    log(RESET, '  3. Try committing again\\n');
+    console.log('');
+    log(CYAN, 'Fix these issues and try again.');
     log(YELLOW, 'To bypass (not recommended): git commit --no-verify\\n');
 
     return { valid: false, violations };
   }
 
-  log(GREEN, '✅ Pattern compliance passed!\\n');
+  log(GREEN, '✅ All \${CHECKS.length} checks passed!\\n');
 
-  // Step 2: Run tests if available
-  log(DIM, '🧪 Step 2/2: Running tests...\\n');
+  // Run tests if available
+  log(DIM, '🧪 Running tests...\\n');
 
   try {
-    // Check if there's a test script
     const pkgPath = path.join(cwd, 'package.json');
     if (fs.existsSync(pkgPath)) {
       const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
@@ -367,7 +910,6 @@ async function validateCode() {
     }
   } catch (error) {
     log(RED, '❌ Tests failed!\\n');
-    log(YELLOW, 'Fix failing tests before committing.\\n');
     return { valid: false, reason: 'tests-failed' };
   }
 
@@ -380,12 +922,7 @@ async function validateCode() {
 
 async function main() {
   const result = await validateCode();
-
-  if (result.valid) {
-    process.exit(0);
-  } else {
-    process.exit(1);
-  }
+  process.exit(result.valid ? 0 : 1);
 }
 
 main().catch(error => {
@@ -417,7 +954,7 @@ export async function installPrecommit(): Promise<void> {
   const preCommitPath = join(hooksDir, 'pre-commit');
   writeFileSync(preCommitPath, PRE_COMMIT_SCRIPT);
 
-  // Make it executable (Unix only, Windows ignores this)
+  // Make it executable
   try {
     chmodSync(preCommitPath, '755');
   } catch {
@@ -430,12 +967,11 @@ export async function installPrecommit(): Promise<void> {
   const validatePath = join(hooksDir, 'validate-code.js');
   writeFileSync(validatePath, VALIDATE_CODE_SCRIPT);
 
-  console.log(chalk.green('  ✓ Created code validation script'));
+  console.log(chalk.green('  ✓ Created code validation script (40+ checks)'));
 
   // Check if husky is being used
   const huskyDir = join(cwd, '.husky');
   if (existsSync(huskyDir)) {
-    // Also install in husky
     const huskyPreCommit = join(huskyDir, 'pre-commit');
     let huskyContent = '';
 
@@ -445,33 +981,44 @@ export async function installPrecommit(): Promise<void> {
         huskyContent += '\n# CodeBakers code validation\nnode .git/hooks/validate-code.js\n';
         writeFileSync(huskyPreCommit, huskyContent);
         console.log(chalk.green('  ✓ Added to existing husky pre-commit'));
-      } else {
-        console.log(chalk.gray('  ✓ Husky hook already configured'));
       }
     } else {
       huskyContent = '#!/usr/bin/env sh\n. "$(dirname -- "$0")/_/husky.sh"\n\n# CodeBakers code validation\nnode .git/hooks/validate-code.js\n';
       writeFileSync(huskyPreCommit, huskyContent);
       try {
         chmodSync(huskyPreCommit, '755');
-      } catch {
-        // Windows
-      }
+      } catch {}
       console.log(chalk.green('  ✓ Created husky pre-commit hook'));
     }
   }
 
-  console.log(chalk.green('\n  ✅ Pre-commit hook installed!\n'));
-  console.log(chalk.cyan('  What this validates:'));
-  console.log(chalk.gray('  - API routes have error handling'));
-  console.log(chalk.gray('  - Request bodies are validated with Zod'));
-  console.log(chalk.gray('  - No console.log statements in production code'));
-  console.log(chalk.gray('  - No hardcoded secrets or URLs'));
-  console.log(chalk.gray('  - No SQL injection vulnerabilities'));
-  console.log(chalk.gray('  - Proper TypeScript types (no "any")'));
-  console.log(chalk.gray('  - Async functions have error handling'));
-  console.log(chalk.gray('  - No empty catch blocks'));
-  console.log(chalk.gray('  - Auth checks on protected routes'));
-  console.log(chalk.gray('  - Runs tests before commit\n'));
-  console.log(chalk.yellow('  To bypass (not recommended):'));
-  console.log(chalk.gray('  git commit --no-verify\n'));
+  console.log(chalk.green('\n  ✅ Pre-commit hook installed with 40+ checks!\n'));
+
+  console.log(chalk.cyan('  🔒 Security (9 checks):'));
+  console.log(chalk.gray('     Debugger statements, hardcoded secrets, XSS, SQL injection,'));
+  console.log(chalk.gray('     merge conflicts, private keys, .env files, eval(), sensitive logs\n'));
+
+  console.log(chalk.cyan('  ⚠️  Error Handling (6 checks):'));
+  console.log(chalk.gray('     API try/catch, empty catch, unhandled promises, JSON.parse safety\n'));
+
+  console.log(chalk.cyan('  📘 TypeScript (4 checks):'));
+  console.log(chalk.gray('     No "any" types, unsafe assertions, return types, non-null assertions\n'));
+
+  console.log(chalk.cyan('  ⚛️  React (7 checks):'));
+  console.log(chalk.gray('     DOM manipulation, useEffect cleanup, conditional hooks, keys,'));
+  console.log(chalk.gray('     inline functions, error boundaries\n'));
+
+  console.log(chalk.cyan('  ♿ Accessibility (5 checks):'));
+  console.log(chalk.gray('     Image alt text, button types, form labels, keyboard support, ARIA roles\n'));
+
+  console.log(chalk.cyan('  ⚡ Performance (3 checks):'));
+  console.log(chalk.gray('     Large imports, sync file operations, missing memoization\n'));
+
+  console.log(chalk.cyan('  🌐 API (3 checks):'));
+  console.log(chalk.gray('     Rate limiting, N+1 queries, CORS config\n'));
+
+  console.log(chalk.cyan('  📝 Code Quality (6 checks):'));
+  console.log(chalk.gray('     Console.log, TODO/FIXME, hardcoded URLs, file size, magic numbers\n'));
+
+  console.log(chalk.yellow('  To bypass (not recommended): git commit --no-verify\n'));
 }