#!/usr/bin/env bash
# Stop hook (EDEN, Master Prompt §2.2/§3.4). Advisory only — never blocks.
# If the project is under git, scans the working tree diff (staged+unstaged)
# for obvious secret patterns and for critical TODO/FIXME markers introduced
# without a tracking reference. Silent (no output) when there's nothing to
# flag or when git/the repo isn't set up yet (expected in Fase 0).
set -uo pipefail

PROJECT_ROOT="/opt/eden"
cd "$PROJECT_ROOT" 2>/dev/null || exit 0

if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
  exit 0
fi

DIFF="$(git diff HEAD 2>/dev/null; git diff --cached 2>/dev/null)"
[ -z "$DIFF" ] && exit 0

SECRET_HITS="$(echo "$DIFF" | grep -E -i '^\+.*(AKIA[0-9A-Z]{16}|BEGIN (RSA|EC|OPENSSH|PRIVATE) KEY|password\s*=\s*["'"'"'][^"'"'"']+|api[_-]?key\s*=\s*["'"'"'][^"'"'"']+|secret\s*=\s*["'"'"'][^"'"'"']+)' || true)"
TODO_HITS="$(echo "$DIFF" | grep -E -i '^\+.*(TODO|FIXME).*(CRITICAL|SECURITY|URGENT)' || true)"

if [ -z "$SECRET_HITS" ] && [ -z "$TODO_HITS" ]; then
  exit 0
fi

MSG="[eden-hook] Verificação de fim de etapa (Master Prompt DoD):"
if [ -n "$SECRET_HITS" ]; then
  MSG="$MSG Possível segredo em claro no diff (revisar antes de commitar)."
fi
if [ -n "$TODO_HITS" ]; then
  MSG="$MSG TODO/FIXME crítico introduzido sem rastreamento (issue/ADR)."
fi

python3 -c "import json,sys; print(json.dumps({'systemMessage': sys.argv[1]}))" "$MSG"
exit 0