Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354#!/bin/bash# Refuse a commit that stages credentials or session state. The .gitignore is an# allowlist and should already prevent this; this hook is the check that runs# every time rather than a rule someone has to remember.set -ustaged=$(git diff --cached --name-only)[ -z "$staged" ] && exit 0# .gitattributes routes settings.json through the drop-model filter; a clone# without it would commit whichever model was last picked.if [ -z "$(git config filter.drop-model.clean)" ]; then echo "pre-commit: this clone has no drop-model filter, which keeps /model out of settings.json. Run once:" >&2 echo " git config filter.drop-model.clean \"jq --indent 2 'del(.model)'\"" >&2 echo " git config filter.drop-model.smudge cat" >&2 exit 1fiblocked=$(printf '%s\n' "$staged" | grep -E '(^|/)(\.credentials\.json|history\.jsonl|settings\.local\.json)$|^(projects|sessions|session-env|tasks|file-history|shell-snapshots|paste-cache|cache|backups|downloads|statsig)/' || true)if [ -n "$blocked" ]; then echo "pre-commit: refusing to commit session state or credentials:" >&2 printf ' %s\n' $blocked >&2 exit 1fihits=$(git diff --cached -U0 | grep -E 'BEGIN [A-Z ]*PRIVATE KEY|sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|xox[abps]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}' || true)if [ -n "$hits" ]; then echo "pre-commit: possible credential in staged content:" >&2 printf ' %s\n' "$hits" >&2 echo "Remove it, or commit with --no-verify if this is a false positive." >&2 exit 1fi# Reject added lines carrying an absolute home-directory path that embeds a real# account name. A macOS home path is always someone's real username, no# exception. This repository is now shared between two machines with different# home directories, so a literal one is wrong even where it is not personal:# chook expands $HOME in file_path_regex, and settings.json hook commands run# through a shell. /home/dev, this box's generic account, stays allowed only so# that prose about the box does not have to be contorted -- no path that has to# resolve should use it. A bracketed placeholder is what the rule asks for and# never matches, because the account segment must start with a name character.# Added lines only: deleting such a path must not block the commit.home_hits=$(git diff --cached -U0 | grep -E '^\+' | grep -Ev '^\+\+\+ ' \ | grep -oE '/(Users|home)/[A-Za-z0-9._-]+' | grep -Ev '^/home/dev$' | sort -u || true)if [ -n "$home_hits" ]; then echo "pre-commit: possible absolute home directory path in staged content:" >&2 printf ' %s\n' "$home_hits" >&2 echo "Use \$HOME or a path relative to the repo instead, or commit with --no-verify if this is a false positive." >&2 exit 1fiexit 0