#!/bin/sh
# gh pr merge を止めるPreToolUseフック（改良版）
cmd=$(jq -r '.tool_input.command // empty')
flat=$(printf '%s' "$cmd" | tr -d "'\"\\\\")
deny() {
  jq -n --arg r "$1" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}'
  exit 0
}
if printf '%s' "$flat" | grep -Eq '(^|[^[:alnum:]_])gh[[:space:]].*pr[[:space:]]+(.*[[:space:]])?merge([[:space:]]|$)'; then
  deny "gh pr merge is blocked by hook"
fi
# 変数やコマンド置換の中身は読めない。mergeの文字が見えたら止める
if printf '%s' "$flat" | grep -Eq '(^|[[:space:]])merge([[:space:]]|$)' && printf '%s' "$flat" | grep -Eq '\$|`|eval'; then
  deny "merge with shell expansion is blocked by hook"
fi
exit 0