#!/usr/bin/env bash
# PreToolUse(Bash) deny-gate: block raw `gh pr merge`.
# Delivery controller owns publication per GIT_FATIGUE.md §12.
# Exit 2 blocks the tool call and feeds stderr back to the agent.
set -euo pipefail

input="$(cat)"
cmd="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(String(JSON.parse(s).tool_input?.command??""))}catch{process.stdout.write("")}})')"

if printf '%s' "$cmd" | grep -qE '(^|[^[:alnum:]_-])gh[[:space:]]+pr[[:space:]]+merge'; then
  echo 'Raw `gh pr merge` is blocked. Submit candidate + valid receipt to delivery controller.' >&2
  exit 2
fi
exit 0