#!/usr/bin/env node
// pre-write-pathguard.mjs — Block writes to sensitive paths
import { readFileSync } from 'node:fs';
const input = JSON.parse(readFileSync('/dev/stdin', 'utf-8'));
const filePath = input.tool_input?.file_path || '';
const BLOCKED = ['.env', '.ssh', '.aws', 'credentials', '.key', '.pem', 'hooks/scripts/'];
for (const pattern of BLOCKED) {
  if (filePath.includes(pattern)) {
    process.stdout.write(JSON.stringify({ decision: 'block', reason: 'Write to ' + pattern + ' blocked' }));
    process.exit(0);
  }
}
process.stdout.write(JSON.stringify({ decision: 'allow' }));