#!/bin/sh
# Blocks a commit MESSAGE that would publish private data.
#
# The message is published as loudly as the code, and it is where a path, a
# hostname or an assistant session URL gets pasted without thinking. It also
# enforces the "no AI-assistant trailers in the public log" rule: a
# Claude-Session: trailer additionally links a private transcript of this
# machine.
#
# Same regexes as the file scan — scrub_check.py owns them, so there is exactly
# one deny-list to keep current.
set -e
cd "$(git rev-parse --show-toplevel)"
exec python3 scripts/scrub_check.py --message "$1"
