51 lines
1.4 KiB
PowerShell
51 lines
1.4 KiB
PowerShell
# Agent-safe: refuse to proceed if secret-looking paths are staged or untracked.
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
. (Join-Path $PSScriptRoot 'common.ps1')
|
|
|
|
$inside = (Invoke-GitSkillsNative -FilePath git -ArgumentList @('rev-parse', '--is-inside-work-tree') | Out-String).Trim()
|
|
if ($LASTEXITCODE -ne 0 -or $inside -ne 'true') {
|
|
Write-StatusLine -Key 'status' -Value 'failed'
|
|
Write-StatusLine -Key 'reason' -Value 'not_a_git_repo'
|
|
exit 1
|
|
}
|
|
|
|
$patterns = @(
|
|
'\.dpapi$',
|
|
'(^|/)token\.txt$',
|
|
'(^|/)\.env$',
|
|
'(^|/)\.env\.',
|
|
'\.pem$',
|
|
'(^|/)id_rsa$',
|
|
'(^|/)id_ed25519$',
|
|
'(^|/)id_ecdsa$',
|
|
'(^|/)\.git-skills/'
|
|
)
|
|
|
|
$blocked = New-Object System.Collections.Generic.List[string]
|
|
$lines = Invoke-GitSkillsNative -FilePath git -ArgumentList @('status', '--porcelain', '-uall')
|
|
foreach ($line in $lines) {
|
|
if ([string]::IsNullOrWhiteSpace($line) -or $line.Length -lt 4) { continue }
|
|
$path = $line.Substring(3).Trim().Trim('"')
|
|
$path = $path -replace ' -> .+$', ''
|
|
$norm = $path.Replace('\', '/')
|
|
foreach ($re in $patterns) {
|
|
if ($norm -match $re) {
|
|
$blocked.Add($norm) | Out-Null
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($blocked.Count -gt 0) {
|
|
Write-StatusLine -Key 'status' -Value 'blocked'
|
|
Write-StatusLine -Key 'reason' -Value 'secret_paths'
|
|
foreach ($p in $blocked) {
|
|
Write-StatusLine -Key 'path' -Value $p
|
|
}
|
|
exit 1
|
|
}
|
|
|
|
Write-StatusLine -Key 'status' -Value 'ok'
|
|
exit 0
|