hooks:
  - event: file.changed
    filter:
      matchesCodeFiles: ["**/*"]
    action: bash
    command: |
      gitleaks detect --no-git --source="$PI_FILE_PATH" || true
  - event: tool.before.*
    filter:
      tool: [bash]
    action: bash
    command: |
      if echo "$PI_TOOL_ARGS" | grep -E "(git push --force|rm -rf /|drop database)"; then
        echo "Dangerous command blocked by appsec-engineer hook." >&2
        exit 2
      fi
  - event: user.prompt.submit
    action: bash
    command: |
      echo "[context-injection] Specialist 'appsec-engineer' active. Working directory: $(pwd)"