.pre-commit-config.yaml

# Pre-commit hooks configuration for AutoBot
# Automatically enforces code quality standards before commits
# Install: pip install pre-commit && pre-commit install

repos:
  # Record branch name BEFORE stash cycle for post-stash verification (Issue #1670)
  # Must be the FIRST hook so the branch is captured before any stash/pop occurs.
  - repo: local
    hooks:
      - id: record-branch
        name: Record Branch for Branch Guard (Issue #1670)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-record-branch
        language: script
        pass_filenames: false
        always_run: true
        stages: [pre-commit]
        description: "Records current branch to detect silent branch switches from stash/pop"

  # Python code formatting with Black
  - repo: https://github.com/psf/black
    rev: 26.3.1
    hooks:
      - id: black
        args: [--line-length=120]
        language_version: python3
        exclude: ^autobot-infrastructure/

  # Python import sorting with isort
  - repo: https://github.com/pycqa/isort
    rev: 8.0.1
    hooks:
      - id: isort
        args: [--profile=black, --line-length=120]
        exclude: ^autobot-infrastructure/

  # Python linting with flake8
  # Uses .flake8 config file for consistent settings across local dev and CI
  - repo: https://github.com/pycqa/flake8
    rev: 7.3.0
    hooks:
      - id: flake8
        # Uses .flake8 config file in repo root via args
        args: [--config=.flake8]
        # Exclude tests, infrastructure, and code analysis tools (non-production code)
        exclude: ^(tests/|autobot-infrastructure/|autobot-backend/code_analysis/)

  # Remove unused imports and variables with autoflake
  - repo: https://github.com/PyCQA/autoflake
    rev: v2.3.3
    hooks:
      - id: autoflake
        args: [
          --in-place,
          --remove-all-unused-imports,
          --remove-unused-variables,
          --expand-star-imports,
          --ignore-init-module-imports
        ]
        exclude: ^autobot-infrastructure/

  # Trailing whitespace removal
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]
      - id: end-of-file-fixer
      - id: check-yaml
        args: [--unsafe]  # Allow custom YAML tags
      - id: check-json
        exclude: (tsconfig\.json|\.eslintrc\.json|api_test_results_.*\.json)$
      - id: check-added-large-files
        args: [--maxkb=1000]
      - id: check-merge-conflict
      - id: check-case-conflict
      - id: mixed-line-ending
        args: [--fix=lf]

  # Python-specific checks
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: check-ast  # Check Python syntax
      - id: debug-statements  # Check for debugger imports
      - id: name-tests-test  # Ensure test files are named correctly
        args: [--pytest-test-first]
        # Exclude colocated tests (*_test.py convention) and special test files
        exclude: (_test\.py$|^(tests/|autobot-infrastructure/.*/tests/|autobot-.*/tests/).*(results/|benchmarks/|fixtures/|conftest\.py|mock_llm_interface\.py|ci_cd_integration\.py|integration_test_infrastructure\.py|security_port_audit\.py|frontend_comprehensive_corrected\.py|phase9_comprehensive_test_suite\.py|benchmark_base\.py|api_benchmarks\.py|rag_benchmarks\.py|mocks\.py|system_assessment_report\.py))

  # Security checks with bandit
  - repo: https://github.com/PyCQA/bandit
    rev: 1.9.4
    hooks:
      - id: bandit
        args: [-c, .bandit]
        files: ^(autobot-backend/|autobot-slm-backend/|autobot_shared/)
        exclude: (code_analysis/|_test\.py|\.e2e_test\.py|\.integration_test\.py|\.performance_test\.py|conftest\.py)$
        additional_dependencies: ["bandit[toml]"]

  # Block commits when branch is shared with a worktree (Issue #1654)
  # Must run BEFORE the stash/restore cycle to prevent branch corruption.
  - repo: local
    hooks:
      - id: worktree-branch-guard
        name: Worktree Branch Guard (Issue #1654)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-worktree-branch-guard
        language: script
        pass_filenames: false
        always_run: true
        stages: [pre-commit]
        description: "Blocks commits when current branch is also checked out in another worktree"

  # Hardcoded value detection (Issue #694)
  - repo: local
    hooks:
      - id: detect-hardcoded-values
        name: Detect Hardcoded Values (Strict)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-hardcoded-values
        language: script
        types: [python, ts, vue]
        pass_filenames: false
        stages: [pre-commit]
        description: "Blocks commits with hardcoded IPs, ports, magic numbers, role strings, AutoBot file paths, and model name literals (#3397)"

  # Function length enforcement (Issue #620)
  - repo: local
    hooks:
      - id: function-length-check
        name: Function Length Check (Issue #620)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-function-length
        language: script
        types: [python]
        pass_filenames: false
        stages: [pre-commit]
        description: "Blocks commits with functions >65 lines, warns for 51-65 lines"

  # No direct redis.Redis() in production code (Issue #1086)
  - repo: local
    hooks:
      - id: no-direct-redis
        name: No Direct Redis Connections in Production Code (Issue #1086)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-no-direct-redis
        language: script
        types: [python]
        pass_filenames: false
        stages: [pre-commit]
        description: "Blocks commits with direct redis.Redis() — use get_redis_client() instead"

  # No print()/console.* in production code (Issue #1082)
  - repo: local
    hooks:
      - id: no-print-console
        name: No print()/console.* in Production Code (Issue #1082)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-no-print-console
        language: script
        pass_filenames: false
        stages: [pre-commit]
        description: Blocks commits with print() in Python or console.* in TypeScript/Vue production code

  # Branch guard — abort commit if stash/pop silently switched branches (Issue #1670)
  # Runs at prepare-commit-msg stage (AFTER stash/pop) to compare the current
  # branch against the branch recorded by record-branch (BEFORE stash/pop).
  # Exits non-zero to ABORT the commit if they differ.
  - repo: local
    hooks:
      - id: branch-guard
        name: Branch Guard — Abort on Silent Branch Switch (Issue #1670)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-branch-guard
        language: script
        pass_filenames: false
        always_run: true
        stages: [prepare-commit-msg]
        description: "Aborts commit if pre-commit stash/pop silently switched the active branch"

  # Warn when untracked source files exist at commit time (Issue #1503)
  # Runs at prepare-commit-msg stage — AFTER the pre-commit stash/restore cycle —
  # so it can detect untracked files that survived or were restored by the stash pop.
  - repo: local
    hooks:
      - id: warn-untracked-files
        name: Warn on Untracked Source Files (Issue #1503)
        entry: autobot-infrastructure/shared/scripts/hooks/pre-commit-warn-untracked
        language: script
        pass_filenames: false
        stages: [prepare-commit-msg]
        description: >
          Warns when untracked non-gitignored source files coexist with a commit.
          pre-commit stash/restore can accidentally stage these files from other branches.
          Fix: use git worktree add .worktrees/feat-XXXX for parallel branch work.

  # Bootstrap: install post-checkout hook from tracked source (Issue #1692)
  # The post-checkout hook cannot bootstrap itself (chicken-and-egg).
  # This pre-commit hook copies the canonical source into .git/hooks/
  # on every commit, ensuring new clones and worktrees get the hook.
  - repo: local
    hooks:
      - id: install-post-checkout
        name: Install post-checkout hook (Issue #1692)
        entry: bash -c 'SRC="scripts/hooks/post-checkout"; DST="$(git rev-parse --git-common-dir)/hooks/post-checkout"; [ -f "$SRC" ] && { [ ! -f "$DST" ] || ! diff -q "$SRC" "$DST" >/dev/null 2>&1; } && cp "$SRC" "$DST" && chmod +x "$DST" && echo "post-checkout hook installed" || true'
        language: system
        pass_filenames: false
        always_run: true
        stages: [pre-commit]
        description: "Copies tracked post-checkout hook into .git/hooks/ so it runs on checkout and worktree creation"

  # Bootstrap: install post-commit hook from tracked source (Issue #2416)
  # Mirrors the install-post-checkout pattern above. The post-commit hook
  # auto-heals working tree files corrupted by pre-commit's stash/pop cycle.
  - repo: local
    hooks:
      - id: install-post-commit
        name: Install post-commit hook (Issue #2416)
        entry: bash -c 'SRC="scripts/hooks/post-commit"; DST="$(git rev-parse --git-common-dir)/hooks/post-commit"; [ -f "$SRC" ] && { [ ! -f "$DST" ] || ! diff -q "$SRC" "$DST" >/dev/null 2>&1; } && cp "$SRC" "$DST" && chmod +x "$DST" && echo "post-commit hook installed" || true'
        language: system
        pass_filenames: false
        always_run: true
        stages: [pre-commit]
        description: "Copies tracked post-commit hook into .git/hooks/ so it heals stash-pop conflicts"

# Configuration for specific file types
default_language_version:
  python: python3

exclude: |
  (?x)^(
      node_modules/.*|
      \.venv/.*|
      venv/.*|
      __pycache__/.*|
      \.git/.*|
      temp/.*|
      logs/.*|
      reports/.*|
      archive/.*|
      .*\.log|
      .*\.pyc|
      .*\.pyo
  )$