#!/usr/bin/env bash
# PreToolUse(Bash) — route UNBOUNDED multi-file reads into the quietcontext sandbox.
# Bounded pipelines (wc / head -N / tail -N / grep -c) already keep raw bytes out of
# context and are left alone. Bypass with a trailing "# raw-ok".
set -uo pipefail

INPUT=$(cat)
CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null) || exit 0
[[ -z "$CMD" ]] && exit 0

grep -Eq '#[[:space:]]*raw-ok' <<<"$CMD" && exit 0

# Multi-file read: recursive/glob-wide source.
grep -Eq '(\bfind\b|\bgrep\b[^|]*-[a-zA-Z]*[rR]|\bgit ls-files\b|\bls\b[^|]*-[a-zA-Z]*R|\*\*/\*|\*\.[a-z]+)' <<<"$CMD" || exit 0

# Mutation or side-effecting: not our business.
grep -Eq '(\brm\b|\bmv\b|\bcp\b|-exec\b|-delete\b|\bsed -i\b|\bxargs\b[^|]*\b(rm|mv|sed)\b)' <<<"$CMD" && exit 0

# Bounded output: the raw bytes never reach context. Leave alone.
grep -Eq '(\|[^|]*\bwc\b|\|[^|]*\b(head|tail)\b[^|]*(-n[[:space:]]*)?-?[0-9]{1,2}\b|\|[^|]*\b(head|tail)\b[^|0-9]*$|\|[^|]*\bsed\b[^|]*[0-9]+[[:space:]]*p|\|[^|]*\bawk\b[^|]*NR[[:space:]]*<|\bgrep\b[^|]*(-[a-zA-Z]*c\b|--count)|\bwc -l[[:space:]]*<)' <<<"$CMD" && exit 0

jq -nc '{
  hookSpecificOutput: {
    hookEventName: "PreToolUse",
    permissionDecision: "deny",
    permissionDecisionReason: "quietcontext-gate: this reads many files with no bound — the raw output would land in context. Either bound it (pipe to wc / head -N), or do the work in the sandbox: ToolSearch(query:\"select:mcp__plugin_quietcontext_quietcontext__execute\") then mcp__plugin_quietcontext_quietcontext__execute with an equivalent script that prints only the derived answer. Deliberate raw run? append \" # raw-ok\"."
  }
}'
exit 0