# Agent-safe: refuse to proceed if secret-looking paths are staged or untracked.

$ErrorActionPreference = 'Stop'
. (Join-Path $PSScriptRoot 'common.ps1')

$inside = (Invoke-GitSkillsNative -FilePath git -ArgumentList @('rev-parse', '--is-inside-work-tree') | Out-String).Trim()
if ($LASTEXITCODE -ne 0 -or $inside -ne 'true') {
    Write-StatusLine -Key 'status' -Value 'failed'
    Write-StatusLine -Key 'reason' -Value 'not_a_git_repo'
    exit 1
}

$patterns = @(
    '\.dpapi$',
    '(^|/)token\.txt$',
    '(^|/)\.env$',
    '(^|/)\.env\.',
    '\.pem$',
    '(^|/)id_rsa$',
    '(^|/)id_ed25519$',
    '(^|/)id_ecdsa$',
    '(^|/)\.git-skills/'
)

$blocked = New-Object System.Collections.Generic.List[string]
$lines = Invoke-GitSkillsNative -FilePath git -ArgumentList @('status', '--porcelain', '-uall')
foreach ($line in $lines) {
    if ([string]::IsNullOrWhiteSpace($line) -or $line.Length -lt 4) { continue }
    $path = $line.Substring(3).Trim().Trim('"')
    $path = $path -replace ' -> .+$', ''
    $norm = $path.Replace('\', '/')
    foreach ($re in $patterns) {
        if ($norm -match $re) {
            $blocked.Add($norm) | Out-Null
            break
        }
    }
}

if ($blocked.Count -gt 0) {
    Write-StatusLine -Key 'status' -Value 'blocked'
    Write-StatusLine -Key 'reason' -Value 'secret_paths'
    foreach ($p in $blocked) {
        Write-StatusLine -Key 'path' -Value $p
    }
    exit 1
}

Write-StatusLine -Key 'status' -Value 'ok'
exit 0