Setup React Rules

What This Sets Up

PostToolUse hooks on Edit/Write (auto-detects and excludes component library directories):

• Ban raw HTML elements — suggest shadcn/ui components from @/components/ui/
• Ban TypeScript escape hatches — block as any, as Record<string, any>, as Record<string, unknown>, @ts-ignore, @ts-expect-error
• Ban barrel imports — flag re-exports from index files, suggest direct path imports
• Ban missing passive event listeners — flag addEventListener('scroll'|'touchstart'|'wheel') without { passive: true }
• Ban static imports of heavy deps — flag top-level imports of chart.js, d3, three.js, pdf-lib (suggest dynamic import() or React.lazy())
• Ban dangerouslySetInnerHTML — XSS risk, escape hatch: // allow-dangerouslySetInnerHTML: [reason]
• Ban eval() and new Function() — code injection risk (OWASP A03)
• Ban .innerHTML assignment — XSS risk, use textContent or React rendering
• Ban inline style={{}} — use Tailwind utility classes
• Ban raw hex/rgb in className and CSS — use design tokens (text-destructive, not text-[#ff0000])
• Ban !important in TSX/JSX/CSS/SCSS/SASS/LESS — breaks Tailwind cascade
• Ban visual style overrides on registry components (use variant prop, layout classes are fine)
• Ban onClick + navigate() — use <Button asChild><Link> instead