#!/bin/sh
# Generated automatically by polyharness — DO NOT EDIT DIRECTLY
# Enforces deterministic protection for sensitive repository paths

PROTECTED_PATTERN="\.env|\.git|secrets/"

if [ -z "$PROTECTED_PATTERN" ]; then
  exit 0
fi

STAGED_FILES=$(git diff --cached --name-only)

for file in $STAGED_FILES; do
  if echo "$file" | grep -E -q "($PROTECTED_PATTERN)"; then
    echo "❌ [polyharness-guard] Commit blocked: staging protected path '$file' is forbidden by safety policy."
    exit 1
  fi
done

exit 0
