#!/usr/bin/env node
// pre-edit-secrets.mjs — Block secrets in files
import { readFileSync } from 'node:fs';
const input = JSON.parse(readFileSync('/dev/stdin', 'utf-8'));
const content = input.tool_input?.content || input.tool_input?.new_string || '';
const SECRET_RE = /(?:sk-[a-zA-Z0-9]{20,}|Bearer\s+[a-zA-Z0-9._-]{20,}|password\s*=\s*["'][^"']+["'])/;
if (SECRET_RE.test(content)) {
  process.stdout.write(JSON.stringify({ decision: 'block', reason: 'Secret detected in content' }));
  process.exit(0);
}
process.stdout.write(JSON.stringify({ decision: 'allow' }));