#!/bin/bash
# .claude/hooks/pre-bash-guard-no-table.sh
# KBDB-graph PreToolUse guard for Bash
#
# 鐵律：任何人都不准動表。擋命令列層的動表（wrangler d1 execute CREATE TABLE 等）。
# 退出 code：0 = 允許 / 2 = 擋下
# 依賴：jq

set -o pipefail
INPUT=$(cat)
CMD=$(echo "$INPUT" | jq -r '.tool_input.command // ""')

block() {
  cat >&2 <<EOF
❌ BLOCKED by KBDB 鐵律：任何人都不准動表
指令：${CMD}
違反：${1}
正確做法：${2}
參考：InkStoneCo/.agents/specs/matrix-rearrange/DECISION-kbdb-v3-baseplane.md
EOF
  exit 2
}

# ── wrangler d1 / sqlite 執行含 CREATE/ALTER/DROP TABLE ─────────────────
if echo "$CMD" | grep -iqE '(wrangler[[:space:]]+d1|sqlite3|d1[[:space:]]+execute)' \
   && echo "$CMD" | grep -iqE '(CREATE|ALTER|DROP)[[:space:]]+TABLE'; then
  block "命令列動表（wrangler d1 / sqlite）" \
        "新資料類型=建 template（調基本盤 API）；schema 由基本盤維護者管，插件不碰。"
fi

# ── 套用 .sql migration 檔（插件不該有 migration）──────────────────────
if echo "$CMD" | grep -iqE 'wrangler[[:space:]]+d1[[:space:]]+(migrations[[:space:]]+apply|execute[[:space:]]+--file)'; then
  block "套用 migration（插件不建表、不該有 migration）" \
        "插件零 migration。DB schema 屬基本盤 arcrun/kbdb，插件透過 API 存取。"
fi

exit 0