#!/bin/sh
# Agent loop guard (Grok side, Windows; runs under Git for Windows' sh).
# Installed per process through GIT_CONFIG_KEY_0=core.hooksPath.
# Grok may only create or update branches named codex/*; never delete.
zero=0000000000000000000000000000000000000000
status=0
while read -r local_ref local_sha remote_ref remote_sha; do
  case "$remote_ref" in
    refs/heads/codex/*) ;;
    *)
      echo "agent-loop pre-push: Grok may only push refs/heads/codex/*, refused $remote_ref" >&2
      status=1 ;;
  esac
  if [ "$local_sha" = "$zero" ]; then
    echo "agent-loop pre-push: deleting $remote_ref is not allowed" >&2
    status=1
  fi
done
exit $status