#!/usr/bin/env python3
# .claude/hooks/protect_secrets.py
import json, sys

BLOCKED = [".env", ".session", ".session-journal", "config.py"]

data = json.load(sys.stdin)
tool  = data.get("tool_name", "")
inp   = data.get("tool_input", {})

# Get the file path depending on which tool fired
path = inp.get("file_path") or inp.get("path") or ""

if any(path.endswith(b) for b in BLOCKED):
    print(f"Blocked: {tool} on {path}", file=sys.stderr)
    sys.exit(2)

sys.exit(0)