diff --git a/git/hooks/pre-commit b/git/hooks/pre-commit
index c42d64b..745b7ef 100755
--- a/git/hooks/pre-commit
+++ b/git/hooks/pre-commit
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 # Global pre-commit hook
 # Runs checks before allowing a commit
+#
+# Scans the staged DIFF (added lines only), not whole files, so that
+# pre-existing content in modified files does not trigger false positives.
 
 set -euo pipefail
 
@@ -12,18 +15,30 @@ NC='\033[0m'
 
 echo "Running pre-commit checks..."
 
-# Check for debugging keywords
-if git diff --cached --name-only | xargs grep -E "(console\.log|debugger|binding\.pry|TODO:|FIXME:|XXX:)" 2>/dev/null; then
-    echo -e "${YELLOW}Warning: Found debugging keywords or TODOs${NC}"
-    echo "Continue anyway? (y/n)"
-    read -n 1 -r
+# Collect added lines from the staged diff, once, for subsequent content checks.
+# -U0: zero context lines (only the +/- lines)
+# ^\+       : lines that start with + (added)
+# ^\+\+\+   : excluded (these are file headers like "+++ b/foo.txt")
+added_lines="$(git diff --cached -U0 | grep -E '^\+' | grep -vE '^\+\+\+' || true)"
+
+# Check for debugging keywords or TODOs in ADDED lines only
+if echo "$added_lines" | grep -qE "(console\.log|debugger|binding\.pry|TODO:|FIXME:|XXX:)"; then
+    echo -e "${YELLOW}Warning: Found debugging keywords or TODOs in added lines:${NC}"
+    echo "$added_lines" | grep -nE "(console\.log|debugger|binding\.pry|TODO:|FIXME:|XXX:)" || true
     echo
-    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-        exit 1
+    if [ -t 0 ] || [ -e /dev/tty ]; then
+        printf "Continue anyway? (y/n) "
+        read -n 1 -r REPLY < /dev/tty
+        echo
+        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+            exit 1
+        fi
+    else
+        echo -e "${YELLOW}(non-interactive; proceeding — rerun in a TTY to enforce)${NC}"
     fi
 fi
 
-# Check for large files (>5MB)
+# Check for large files (>5MB) — operates on file size, not diff content
 for file in $(git diff --cached --name-only); do
     if [ -f "$file" ]; then
         size=$(wc -c < "$file")
@@ -35,16 +50,23 @@ for file in $(git diff --cached --name-only); do
     fi
 done
 
-# Check for secrets (basic check)
-if git diff --cached --name-only | xargs grep -E "(password|secret|token|api_key)\s*=\s*[\"'][^\"']+[\"']" 2>/dev/null; then
-    echo -e "${RED}Warning: Possible secrets detected!${NC}"
+# Check for secrets in ADDED lines only (basic check)
+if echo "$added_lines" | grep -qE "(password|secret|token|api_key)[[:space:]]*=[[:space:]]*[\"'][^\"']+[\"']"; then
+    echo -e "${RED}Warning: Possible secrets detected in added lines:${NC}"
+    echo "$added_lines" | grep -nE "(password|secret|token|api_key)[[:space:]]*=[[:space:]]*[\"'][^\"']+[\"']" || true
     echo "Please review your changes carefully."
-    echo "Continue anyway? (y/n)"
-    read -n 1 -r
     echo
-    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    if [ -t 0 ] || [ -e /dev/tty ]; then
+        printf "Continue anyway? (y/n) "
+        read -n 1 -r REPLY < /dev/tty
+        echo
+        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+            exit 1
+        fi
+    else
+        echo -e "${RED}(non-interactive; blocking — rerun in a TTY to confirm or use --no-verify with explicit justification)${NC}"
         exit 1
     fi
 fi
 
-echo -e "${GREEN}Pre-commit checks passed!${NC}"
\ No newline at end of file
+echo -e "${GREEN}Pre-commit checks passed!${NC}"