ship18ion 1.0.0 → 1.1.3

package/dist/cli/index.js

@@ -10,25 +10,45 @@ const config_1 = require("../engine/config");
 const runner_1 = require("../engine/runner");
 const console_1 = require("../reporters/console");
 const program = new commander_1.Command();
-program
-    .name('ship18ion')
-    .description('Production Readiness Inspector')
-    .version('0.1.0');
+const figlet_1 = __importDefault(require("figlet"));
+const gradient_string_1 = __importDefault(require("gradient-string"));
+const ora_1 = __importDefault(require("ora"));
+const detector_1 = require("../engine/detector");
 program
     .command('check', { isDefault: true })
     .description('Run production readiness checks')
     .option('--ci', 'Run in CI mode (minimal output, exit codes)')
     .action(async (options) => {
-    // console.log(chalk.blue('Starting ship18ion checks...'));
+    if (!options.ci) {
+        console.log(gradient_string_1.default.pastel.multiline(figlet_1.default.textSync('SHIP18ION')));
+        console.log(chalk_1.default.dim('Production Readiness Inspector\n'));
+    }
     const cwd = process.cwd();
     const config = await (0, config_1.loadConfig)(cwd);
+    const spinner = (0, ora_1.default)('Initializing...').start();
     try {
-        const results = await (0, runner_1.runChecks)(config, cwd);
+        let framework = 'unknown';
+        if (!options.ci) {
+            framework = await (0, detector_1.detectFramework)(cwd);
+            spinner.text = `Detected Framework: ${chalk_1.default.cyan(framework.toUpperCase())}`;
+            await new Promise(r => setTimeout(r, 800)); // Brief pause to show framework
+        }
+        else {
+            // Even in CI, simple detection is useful for reporting if needed, or we just skip
+            framework = await (0, detector_1.detectFramework)(cwd);
+        }
+        const results = await (0, runner_1.runChecks)(config, cwd, (stage) => {
+            if (!options.ci)
+                spinner.text = stage;
+        });
+        spinner.succeed(chalk_1.default.green('Checks completed!'));
+        console.log('');
         // Uses console reporter for both normal and CI for now (it handles exit codes)
-        (0, console_1.reportConsole)(results, cwd);
+        (0, console_1.reportConsole)(results, cwd, framework);
     }
     catch (e) {
-        console.error(chalk_1.default.red('Error running checks:'), e);
+        spinner.fail(chalk_1.default.red('Error running checks'));
+        console.error(e);
         process.exit(1);
     }
 });

package/dist/engine/detector.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectFramework = detectFramework;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+async function detectFramework(cwd) {
+    const pkgPath = path_1.default.join(cwd, 'package.json');
+    if (!fs_1.default.existsSync(pkgPath)) {
+        return 'unknown';
+    }
+    try {
+        const pkg = JSON.parse(fs_1.default.readFileSync(pkgPath, 'utf-8'));
+        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+        if (deps['next'])
+            return 'nextjs';
+        if (deps['@remix-run/react'])
+            return 'remix';
+        if (deps['vite'])
+            return 'vite';
+        if (deps['@nestjs/core'])
+            return 'nestjs';
+        if (deps['express'])
+            return 'express';
+        if (deps['fastify'])
+            return 'fastify';
+        return 'Node.js / Generic';
+    }
+    catch (e) {
+        return 'unknown';
+    }
+}

package/dist/engine/runner.js

@@ -8,17 +8,39 @@ const security_1 = require("../rules/security");
 const build_1 = require("../rules/build");
 const nextjs_1 = require("../rules/frameworks/nextjs");
 const git_1 = require("../rules/git");
-async function runChecks(config, cwd) {
+const detector_1 = require("./detector");
+async function runChecks(config, cwd, onProgress) {
+    if (onProgress)
+        onProgress('Scanning files...');
     const files = await (0, scanner_1.scanFiles)(cwd, config.ignore);
-    const ctx = { config, files, cwd };
+    // Framework detection
+    const framework = await (0, detector_1.detectFramework)(cwd);
+    const ctx = { config, files, cwd, framework };
     const results = [];
     // Run all checks
+    if (onProgress)
+        onProgress('Checking environment variables...');
     results.push(...await (0, env_1.checkEnvVars)(ctx));
+    if (onProgress)
+        onProgress('Scanning for secrets...');
     results.push(...await (0, secrets_1.checkSecrets)(ctx));
+    if (onProgress)
+        onProgress('Analyzing security configurations...');
     results.push(...await (0, security_1.checkSecurity)(ctx));
+    if (onProgress)
+        onProgress('Verifying dependencies...');
     results.push(...await (0, build_1.checkDependencies)(ctx));
+    if (onProgress)
+        onProgress('Inspecting build artifacts...');
     results.push(...await (0, build_1.checkBuild)(ctx));
-    results.push(...await (0, nextjs_1.checkNextJs)(ctx));
+    // Framework specific checks
+    if (framework === 'nextjs') {
+        if (onProgress)
+            onProgress('Running Next.js specific checks...');
+        results.push(...await (0, nextjs_1.checkNextJs)(ctx));
+    }
+    if (onProgress)
+        onProgress('Checking git status...');
     results.push(...await (0, git_1.checkGit)(ctx));
     return results;
 }

package/dist/engine/scanner.js

@@ -3,7 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanFiles = scanFiles;
 const glob_1 = require("glob");
 async function scanFiles(cwd, ignore = []) {
-    const defaultIgnore = ['**/node_modules/**', '**/dist/**', '**/.git/**'];
+    // Ignore build artifacts, node_modules, and git
+    const defaultIgnore = [
+        '**/node_modules/**',
+        '**/.git/**',
+        '**/dist/**',
+        '**/build/**',
+        '**/.next/**',
+        '**/.turbo/**',
+        '**/coverage/**'
+    ];
     // Scan for relevant files: JS/TS code, Configs (JSON/YAML), Env files
     return (0, glob_1.glob)('**/*.{js,ts,jsx,tsx,json,yaml,yml,env,env.*}', {
         cwd,

package/dist/reporters/console.js

@@ -17,7 +17,10 @@ function getCategory(ruleId) {
     const prefix = ruleId.split('-')[0];
     return CATEGORIES[prefix] || { icon: '❓', label: 'Other' };
 }
-function reportConsole(results, cwd) {
+function reportConsole(results, cwd, framework) {
+    if (framework) {
+        console.log(chalk_1.default.blue(`ℹ️  Framework: ${framework.toUpperCase()}`));
+    }
     if (results.length === 0) {
         console.log(chalk_1.default.green('\n✅  Production Readiness Check Passed!\n'));
         return;

package/dist/rules/build.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkDependencies = checkDependencies;
 exports.checkBuild = checkBuild;
 const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
 async function checkDependencies(ctx) {
     const results = [];
     const packageJsons = ctx.files.filter(f => f.endsWith('package.json') && !f.includes('node_modules'));
@@ -31,36 +32,39 @@ async function checkDependencies(ctx) {
     }
     return results;
 }
+const glob_1 = require("glob");
 async function checkBuild(ctx) {
     const results = [];
-    // Check for source maps in potential build dirs (dist, build, out, .next)
-    // Scanner ignores dist by default, but if we want to check build artifacts we might need to scan explicitly OR assumes user runs this in root.
-    // If the scanner ignores 'dist', we won't see them.
-    // So this check is effective only if scanner INCLUDES build dirs or we explicitly look for them.
-    // Let's explicitly check common build folders in CWD if they exist, ignoring scanner's ignore list for this specific check?
-    // Or just warn if we find .map files in the file list (meaning they were NOT ignored/cleaned).
-    const mapFiles = ctx.files.filter(f => f.endsWith('.map'));
-    for (const file of mapFiles) {
-        // Only if it looks like a build artifact
-        if (file.includes('/dist/') || file.includes('/build/') || file.includes('/.next/')) {
+    // Explicitly scan build folders (dist, build, .next, .output) for dangerous files
+    // The main scanner ignores these, so we check them separately here.
+    const buildDirs = ['dist', 'build', '.next', '.output'];
+    const foundBuildDirs = buildDirs.filter(d => fs_1.default.existsSync(path_1.default.join(ctx.cwd, d)));
+    if (foundBuildDirs.length === 0) {
+        return results;
+    }
+    // 1. Check for Source Maps (.map)
+    // We search inside the found build directories
+    for (const dir of foundBuildDirs) {
+        const mapFiles = await (0, glob_1.glob)(`${dir}/**/*.map`, { cwd: ctx.cwd, absolute: true });
+        if (mapFiles.length > 0) {
             results.push({
                 status: 'warn',
-                message: 'Source map found in build output (information leak)',
+                message: `Found ${mapFiles.length} source map files in '${dir}' (e.g. ${path_1.default.basename(mapFiles[0])}). Ensure these are not exposed publicly.`,
                 ruleId: 'build-source-map',
+                file: dir // Point to the directory itself
+            });
+        }
+        // 2. Check for .env files in build output
+        // We look for .env* files inside the build dir
+        const envFiles = await (0, glob_1.glob)(`${dir}/**/*.env*`, { cwd: ctx.cwd, absolute: true });
+        for (const file of envFiles) {
+            results.push({
+                status: 'fail',
+                message: `Environment file found in build output (${dir})!`,
+                ruleId: 'build-env-leak',
                 file
             });
         }
     }
-    // Check for .env in build folders
-    const envInBuild = ctx.files.filter(f => (f.endsWith('.env') || f.includes('.env.')) &&
-        (f.includes('/dist/') || f.includes('/build/') || f.includes('/.next/')));
-    for (const file of envInBuild) {
-        results.push({
-            status: 'fail',
-            message: 'Environment file found in build output!',
-            ruleId: 'build-env-leak',
-            file
-        });
-    }
     return results;
 }

package/dist/rules/git.js

@@ -1,10 +1,16 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkGit = checkGit;
 const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
 async function checkGit(ctx) {
     const results = [];
     try {
+        // ... (Existing git checks) ...
         // Check for uncommitted changes
         const status = (0, child_process_1.execSync)('git status --porcelain', { cwd: ctx.cwd, encoding: 'utf-8' });
         if (status.trim().length > 0) {
@@ -18,17 +24,67 @@ async function checkGit(ctx) {
         const branch = (0, child_process_1.execSync)('git rev-parse --abbrev-ref HEAD', { cwd: ctx.cwd, encoding: 'utf-8' }).trim();
         const allowedBranches = ['main', 'master', 'staging', 'production', 'prod'];
         if (!allowedBranches.includes(branch)) {
+            // Warn, but maybe less aggressively? Keeping as warn.
             results.push({
                 status: 'warn',
                 message: `You are on branch '${branch}'. Production builds typically come from main/master.`,
                 ruleId: 'git-branch',
             });
         }
+        // --- New: .gitignore Check ---
+        const gitignorePath = path_1.default.join(ctx.cwd, '.gitignore');
+        if (fs_1.default.existsSync(gitignorePath)) {
+            const content = fs_1.default.readFileSync(gitignorePath, 'utf-8');
+            const lines = content.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'));
+            // Helper to check if item is ignored (naive grep)
+            const isIgnored = (item) => lines.some(l => l.includes(item));
+            const requiredIgnores = ['node_modules', '.env'];
+            if (ctx.framework === 'nextjs') {
+                requiredIgnores.push('.next');
+            }
+            else if (ctx.framework !== 'unknown') {
+                // For other frameworks, maybe 'dist' or 'build'
+                if (!isIgnored('dist') && !isIgnored('build')) {
+                    // We can't strictly require one, but warn if NEITHER is found? 
+                    // Let's stick to safe defaults.
+                }
+            }
+            for (const item of requiredIgnores) {
+                if (!isIgnored(item)) {
+                    results.push({
+                        status: 'warn',
+                        message: `.gitignore is missing '${item}'. This is critical for security and repo size.`,
+                        ruleId: 'git-ignore-missing',
+                        file: gitignorePath
+                    });
+                }
+            }
+            // Check for specific dangerous files not being ignored
+            const dangerousPatterns = ['firebase.json', 'serviceAccountKey.json', '*.pem', '*.key'];
+            // This is tricky because firebase.json CAN be committed. serviceAccountKey.json should NOT.
+            if (!isIgnored('serviceAccountKey.json')) {
+                // Only warn if the FILE actually exists? Or just warn generic?
+                // Best to warn if the file exists AND isn't ignored.
+                if (fs_1.default.existsSync(path_1.default.join(ctx.cwd, 'serviceAccountKey.json'))) {
+                    results.push({
+                        status: 'fail',
+                        message: 'serviceAccountKey.json exists but is NOT in .gitignore!',
+                        ruleId: 'git-ignore-auth',
+                        file: gitignorePath
+                    });
+                }
+            }
+        }
+        else {
+            results.push({
+                status: 'warn',
+                message: 'No .gitignore file found! node_modules and secrets might be committed.',
+                ruleId: 'git-no-ignore',
+            });
+        }
     }
     catch (e) {
         // Not a git repo or git not found
-        // Silently fail or warn?
-        // results.push({ status: 'warn', message: 'Not a git repository or git command failed.', ruleId: 'git-error' });
     }
     return results;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ship18ion",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "description": "",
   "main": "dist/cli/index.js",
   "bin": {
@@ -27,11 +27,16 @@
     "@babel/parser": "^7.28.5",
     "@babel/traverse": "^7.28.5",
     "@types/babel__traverse": "^7.28.0",
+    "@types/figlet": "^1.7.0",
+    "@types/gradient-string": "^1.1.6",
     "@types/node": "^25.0.3",
     "chalk": "^4.1.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",
+    "figlet": "^1.9.4",
     "glob": "^13.0.0",
+    "gradient-string": "^3.0.0",
+    "ora": "^9.0.0",
     "typescript": "^5.9.3"
   }
 }

package/src/cli/index.ts

@@ -7,26 +7,48 @@ import { reportConsole } from '../reporters/console';
 
 const program = new Command();
 
-program
-    .name('ship18ion')
-    .description('Production Readiness Inspector')
-    .version('0.1.0');
+import figlet from 'figlet';
+import gradient from 'gradient-string';
+import ora from 'ora';
+import { detectFramework } from '../engine/detector';
 
 program
     .command('check', { isDefault: true })
     .description('Run production readiness checks')
     .option('--ci', 'Run in CI mode (minimal output, exit codes)')
     .action(async (options) => {
-        // console.log(chalk.blue('Starting ship18ion checks...'));
+        if (!options.ci) {
+            console.log(gradient.pastel.multiline(figlet.textSync('SHIP18ION')));
+            console.log(chalk.dim('Production Readiness Inspector\n'));
+        }
+
         const cwd = process.cwd();
         const config = await loadConfig(cwd);
+        const spinner = ora('Initializing...').start();
 
         try {
-            const results = await runChecks(config, cwd);
+            let framework: string = 'unknown';
+            if (!options.ci) {
+                framework = await detectFramework(cwd);
+                spinner.text = `Detected Framework: ${chalk.cyan(framework.toUpperCase())}`;
+                await new Promise(r => setTimeout(r, 800)); // Brief pause to show framework
+            } else {
+                // Even in CI, simple detection is useful for reporting if needed, or we just skip
+                framework = await detectFramework(cwd);
+            }
+
+            const results = await runChecks(config, cwd, (stage) => {
+                if (!options.ci) spinner.text = stage;
+            });
+
+            spinner.succeed(chalk.green('Checks completed!'));
+            console.log('');
+
             // Uses console reporter for both normal and CI for now (it handles exit codes)
-            reportConsole(results, cwd);
+            reportConsole(results, cwd, framework);
         } catch (e) {
-            console.error(chalk.red('Error running checks:'), e);
+            spinner.fail(chalk.red('Error running checks'));
+            console.error(e);
             process.exit(1);
         }
     });

package/src/engine/detector.ts

@@ -0,0 +1,27 @@
+import fs from 'fs';
+import path from 'path';
+
+export type FrameworkType = 'nextjs' | 'remix' | 'vite' | 'nestjs' | 'express' | 'fastify' | 'Node.js / Generic' | 'unknown';
+
+export async function detectFramework(cwd: string): Promise<FrameworkType> {
+    const pkgPath = path.join(cwd, 'package.json');
+    if (!fs.existsSync(pkgPath)) {
+        return 'unknown';
+    }
+
+    try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+
+        if (deps['next']) return 'nextjs';
+        if (deps['@remix-run/react']) return 'remix';
+        if (deps['vite']) return 'vite';
+        if (deps['@nestjs/core']) return 'nestjs';
+        if (deps['express']) return 'express';
+        if (deps['fastify']) return 'fastify';
+
+        return 'Node.js / Generic';
+    } catch (e) {
+        return 'unknown';
+    }
+}

package/src/engine/runner.ts

@@ -8,19 +8,45 @@ import { checkDependencies, checkBuild } from '../rules/build';
 import { checkNextJs } from '../rules/frameworks/nextjs';
 import { checkGit } from '../rules/git';
 
-export async function runChecks(config: Ship18ionConfig, cwd: string): Promise<RuleResult[]> {
+import { detectFramework } from './detector';
+
+export async function runChecks(
+    config: Ship18ionConfig,
+    cwd: string,
+    onProgress?: (stage: string) => void
+): Promise<RuleResult[]> {
+    if (onProgress) onProgress('Scanning files...');
     const files = await scanFiles(cwd, config.ignore);
-    const ctx: RuleContext = { config, files, cwd };
+    // Framework detection
+    const framework = await detectFramework(cwd);
+
+    const ctx: RuleContext = { config, files, cwd, framework };
 
     const results: RuleResult[] = [];
 
     // Run all checks
+    if (onProgress) onProgress('Checking environment variables...');
     results.push(...await checkEnvVars(ctx));
+
+    if (onProgress) onProgress('Scanning for secrets...');
     results.push(...await checkSecrets(ctx));
+
+    if (onProgress) onProgress('Analyzing security configurations...');
     results.push(...await checkSecurity(ctx));
+
+    if (onProgress) onProgress('Verifying dependencies...');
     results.push(...await checkDependencies(ctx));
+
+    if (onProgress) onProgress('Inspecting build artifacts...');
     results.push(...await checkBuild(ctx));
-    results.push(...await checkNextJs(ctx));
+
+    // Framework specific checks
+    if (framework === 'nextjs') {
+        if (onProgress) onProgress('Running Next.js specific checks...');
+        results.push(...await checkNextJs(ctx));
+    }
+
+    if (onProgress) onProgress('Checking git status...');
     results.push(...await checkGit(ctx));
 
     return results;

package/src/engine/scanner.ts

@@ -2,7 +2,16 @@ import { glob } from 'glob';
 import path from 'path';
 
 export async function scanFiles(cwd: string, ignore: string[] = []): Promise<string[]> {
-    const defaultIgnore = ['**/node_modules/**', '**/dist/**', '**/.git/**'];
+    // Ignore build artifacts, node_modules, and git
+    const defaultIgnore = [
+        '**/node_modules/**',
+        '**/.git/**',
+        '**/dist/**',
+        '**/build/**',
+        '**/.next/**',
+        '**/.turbo/**',
+        '**/coverage/**'
+    ];
     // Scan for relevant files: JS/TS code, Configs (JSON/YAML), Env files
     return glob('**/*.{js,ts,jsx,tsx,json,yaml,yml,env,env.*}', {
         cwd,

package/src/engine/types.ts

@@ -1,4 +1,5 @@
 import { Ship18ionConfig } from './config';
+import { FrameworkType } from './detector';
 
 export interface RuleResult {
     status: 'pass' | 'fail' | 'warn';
@@ -12,4 +13,5 @@ export interface RuleContext {
     config: Ship18ionConfig;
     files: string[];
     cwd: string;
+    framework: FrameworkType;
 }

package/src/reporters/console.ts

@@ -15,7 +15,11 @@ function getCategory(ruleId: string) {
     return CATEGORIES[prefix] || { icon: '❓', label: 'Other' };
 }
 
-export function reportConsole(results: RuleResult[], cwd: string) {
+export function reportConsole(results: RuleResult[], cwd: string, framework?: string) {
+    if (framework) {
+        console.log(chalk.blue(`ℹ️  Framework: ${framework.toUpperCase()}`));
+    }
+
     if (results.length === 0) {
         console.log(chalk.green('\n✅  Production Readiness Check Passed!\n'));
         return;

package/src/rules/build.ts

@@ -31,43 +31,46 @@ export async function checkDependencies(ctx: RuleContext): Promise<RuleResult[]>
     return results;
 }
 
+import { glob } from 'glob';
+
 export async function checkBuild(ctx: RuleContext): Promise<RuleResult[]> {
     const results: RuleResult[] = [];
 
-    // Check for source maps in potential build dirs (dist, build, out, .next)
-    // Scanner ignores dist by default, but if we want to check build artifacts we might need to scan explicitly OR assumes user runs this in root.
-    // If the scanner ignores 'dist', we won't see them.
-    // So this check is effective only if scanner INCLUDES build dirs or we explicitly look for them.
+    // Explicitly scan build folders (dist, build, .next, .output) for dangerous files
+    // The main scanner ignores these, so we check them separately here.
+
+    const buildDirs = ['dist', 'build', '.next', '.output'];
+    const foundBuildDirs = buildDirs.filter(d => fs.existsSync(path.join(ctx.cwd, d)));
+
+    if (foundBuildDirs.length === 0) {
+        return results;
+    }
 
-    // Let's explicitly check common build folders in CWD if they exist, ignoring scanner's ignore list for this specific check?
-    // Or just warn if we find .map files in the file list (meaning they were NOT ignored/cleaned).
+    // 1. Check for Source Maps (.map)
+    // We search inside the found build directories
+    for (const dir of foundBuildDirs) {
+        const mapFiles = await glob(`${dir}/**/*.map`, { cwd: ctx.cwd, absolute: true });
 
-    const mapFiles = ctx.files.filter(f => f.endsWith('.map'));
-    for (const file of mapFiles) {
-        // Only if it looks like a build artifact
-        if (file.includes('/dist/') || file.includes('/build/') || file.includes('/.next/')) {
+        if (mapFiles.length > 0) {
             results.push({
                 status: 'warn',
-                message: 'Source map found in build output (information leak)',
+                message: `Found ${mapFiles.length} source map files in '${dir}' (e.g. ${path.basename(mapFiles[0])}). Ensure these are not exposed publicly.`,
                 ruleId: 'build-source-map',
-                file
+                file: dir // Point to the directory itself
             });
         }
-    }
 
-    // Check for .env in build folders
-    const envInBuild = ctx.files.filter(f =>
-        (f.endsWith('.env') || f.includes('.env.')) &&
-        (f.includes('/dist/') || f.includes('/build/') || f.includes('/.next/'))
-    );
-
-    for (const file of envInBuild) {
-        results.push({
-            status: 'fail',
-            message: 'Environment file found in build output!',
-            ruleId: 'build-env-leak',
-            file
-        });
+        // 2. Check for .env files in build output
+        // We look for .env* files inside the build dir
+        const envFiles = await glob(`${dir}/**/*.env*`, { cwd: ctx.cwd, absolute: true });
+        for (const file of envFiles) {
+            results.push({
+                status: 'fail',
+                message: `Environment file found in build output (${dir})!`,
+                ruleId: 'build-env-leak',
+                file
+            });
+        }
     }
 
     return results;

package/src/rules/git.ts

@@ -1,10 +1,14 @@
 import { execSync } from 'child_process';
 import { RuleContext, RuleResult } from '../engine/types';
 
+import fs from 'fs';
+import path from 'path';
+
 export async function checkGit(ctx: RuleContext): Promise<RuleResult[]> {
     const results: RuleResult[] = [];
 
     try {
+        // ... (Existing git checks) ...
         // Check for uncommitted changes
         const status = execSync('git status --porcelain', { cwd: ctx.cwd, encoding: 'utf-8' });
         if (status.trim().length > 0) {
@@ -19,6 +23,7 @@ export async function checkGit(ctx: RuleContext): Promise<RuleResult[]> {
         const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: ctx.cwd, encoding: 'utf-8' }).trim();
         const allowedBranches = ['main', 'master', 'staging', 'production', 'prod'];
         if (!allowedBranches.includes(branch)) {
+            // Warn, but maybe less aggressively? Keeping as warn.
             results.push({
                 status: 'warn',
                 message: `You are on branch '${branch}'. Production builds typically come from main/master.`,
@@ -26,10 +31,64 @@ export async function checkGit(ctx: RuleContext): Promise<RuleResult[]> {
             });
         }
 
+        // --- New: .gitignore Check ---
+        const gitignorePath = path.join(ctx.cwd, '.gitignore');
+        if (fs.existsSync(gitignorePath)) {
+            const content = fs.readFileSync(gitignorePath, 'utf-8');
+            const lines = content.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'));
+
+            // Helper to check if item is ignored (naive grep)
+            const isIgnored = (item: string) => lines.some(l => l.includes(item));
+
+            const requiredIgnores = ['node_modules', '.env'];
+            if (ctx.framework === 'nextjs') {
+                requiredIgnores.push('.next');
+            } else if (ctx.framework !== 'unknown') {
+                // For other frameworks, maybe 'dist' or 'build'
+                if (!isIgnored('dist') && !isIgnored('build')) {
+                    // We can't strictly require one, but warn if NEITHER is found? 
+                    // Let's stick to safe defaults.
+                }
+            }
+
+            for (const item of requiredIgnores) {
+                if (!isIgnored(item)) {
+                    results.push({
+                        status: 'warn',
+                        message: `.gitignore is missing '${item}'. This is critical for security and repo size.`,
+                        ruleId: 'git-ignore-missing',
+                        file: gitignorePath
+                    });
+                }
+            }
+
+            // Check for specific dangerous files not being ignored
+            const dangerousPatterns = ['firebase.json', 'serviceAccountKey.json', '*.pem', '*.key'];
+            // This is tricky because firebase.json CAN be committed. serviceAccountKey.json should NOT.
+
+            if (!isIgnored('serviceAccountKey.json')) {
+                // Only warn if the FILE actually exists? Or just warn generic?
+                // Best to warn if the file exists AND isn't ignored.
+                if (fs.existsSync(path.join(ctx.cwd, 'serviceAccountKey.json'))) {
+                    results.push({
+                        status: 'fail',
+                        message: 'serviceAccountKey.json exists but is NOT in .gitignore!',
+                        ruleId: 'git-ignore-auth',
+                        file: gitignorePath
+                    });
+                }
+            }
+
+        } else {
+            results.push({
+                status: 'warn',
+                message: 'No .gitignore file found! node_modules and secrets might be committed.',
+                ruleId: 'git-no-ignore',
+            });
+        }
+
     } catch (e) {
         // Not a git repo or git not found
-        // Silently fail or warn?
-        // results.push({ status: 'warn', message: 'Not a git repository or git command failed.', ruleId: 'git-error' });
     }
 
     return results;