learningcircuit--local-deep-research/.pre-commit-hooks/check-raw-console.py

#!/usr/bin/env python3
"""
Pre-commit hook to detect raw console.* calls in JavaScript files.

All JS logging should use SafeLogger (from security/safe-logger.js) which
sanitises output and prevents accidental leakage of sensitive data.

Allowed exceptions:
  - safe-logger.js itself (it wraps console.*)
  - Comment lines (// or *)
  - Test files (excluded via pre-commit config)
"""

import re
import sys
from pathlib import Path

RAW_CONSOLE_RE = re.compile(r"\bconsole\.(log|error|warn|info|debug)\b")

# Files where raw console.* is legitimate
ALLOWED_FILES = {"safe-logger.js"}


def check_file(file_path):
    """Return list of (line_number, line_text) for violations."""
    if Path(file_path).name in ALLOWED_FILES:
        return []

    violations = []
    with open(file_path, "r", encoding="utf-8") as f:
        for lineno, line in enumerate(f, start=1):
            stripped = line.lstrip()
            # Skip comment lines
            if stripped.startswith("//") or stripped.startswith("*"):
                continue
            if RAW_CONSOLE_RE.search(line):
                violations.append((lineno, line.rstrip()))
    return violations


def main():
    exit_code = 0
    for file_path in sys.argv[1:]:
        violations = check_file(file_path)
        for lineno, line in violations:
            print(
                f"{file_path}:{lineno}: Use SafeLogger instead of raw console.*"
            )
            print(f"  {line}")
            exit_code = 1

    if exit_code:
        print()
        print(
            "Hint: import SafeLogger and use SafeLogger.log/error/warn/info/debug"
        )

    return exit_code


if __name__ == "__main__":
    sys.exit(main())