#!/bin/sh
# TAS Kit — pre-commit security hook
#
# Invoked by either:
#   - husky (.husky/pre-commit sources this file), or
#   - native git hook (.git/hooks/pre-commit is a copy of this file)
#
# Delegates to .tas/hooks/security-scan.js. Exits 0 if ok, 1 to block commit.

if ! command -v node >/dev/null 2>&1; then
  echo "[TAS Security] node not found on PATH — skipping scan" >&2
  exit 0
fi

REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"
if [ -z "$REPO_ROOT" ]; then
  exit 0
fi

SCANNER="$REPO_ROOT/.tas/hooks/security-scan.js"
if [ ! -f "$SCANNER" ]; then
  echo "[TAS Security] Scanner not found at $SCANNER — did you run 'npx @torus-engineering/tas-kit install'?" >&2
  exit 0
fi

exec node "$SCANNER"