#!/usr/bin/env bash
# Hook: audit-before-git (PreToolUse, matcher: ^bash$)
# Fires on any bash call containing "git commit" or "git push" and blocks it
# unless the fast rule audit passes. This makes the git hooks redundant-safe:
# even if hooks are bypassed or missing, the agent cannot commit/push a
# rule-violating state.
set -euo pipefail

CMD="${CRUSH_TOOL_INPUT_COMMAND:-}"

if ! printf '%s' "$CMD" | grep -qE 'git[[:space:]]+(commit|push)'; then
    echo '{}'
    exit 0
fi

# Emergency bypass.
if printf '%s' "$CMD" | grep -q -- '--no-verify'; then
    echo '{"context": "Skipping rule audit (--no-verify). Use this ONLY in genuine emergencies."}'
    exit 0
fi

REPO_ROOT="${CRUSH_PROJECT_DIR:-$(pwd)}"

if bash "$REPO_ROOT/scripts/check-rules.sh" --fast >/dev/null 2>&1; then
    echo '{"context": "Rule audit passed."}'
    exit 0
fi

# Re-run with output so the violation is visible, then block.
bash "$REPO_ROOT/scripts/check-rules.sh" --fast >&2 || true
echo "BLOCKED: rule audit failed. Fix the violations above before committing or pushing." >&2
exit 2