#!/bin/sh
# Reject AI attribution trailers and require DCO sign-off on every local commit.
#
# Enable this hook once per clone with: just install-hooks
# (sets core.hooksPath to this directory).

msg_file="$1"

if ! trailers=$(git interpret-trailers --parse --no-divider "$msg_file"); then
    echo "commit-msg hook: could not inspect commit trailers." >&2
    echo "  Commit rejected because AI attribution could not be checked." >&2
    echo "  Update Git or, after verifying DCO sign-off, re-run with '--no-verify'." >&2
    exit 1
fi

if printf '%s\n' "$trailers" |
    grep -Eiq '^(assisted-by|co-developed-by|generated-by|ai-assisted-by|ai-generated-by|model|model-used|llm|tool):'
then
    echo "commit-msg hook: AI attribution trailer key is not allowed." >&2
    echo "  Remove the trailer and disclose AI use in the PR description." >&2
    exit 1
fi

if printf '%s\n' "$trailers" |
    grep -Eiq '(^|[^[:alnum:]_])(anthropic|chatgpt|claude|cline|codex|copilot|cursor|deepseek|devin|gemini|gpt-?[0-9]*|grok|llama|mistral|openai|perplexity|qwen|windsurf)([^[:alnum:]_]|$)'
then
    echo "commit-msg hook: trailer contains a known AI identifier." >&2
    echo "  Remove AI attribution and disclose AI use in the PR description." >&2
    echo "  If this identifies a human or file, verify DCO sign-off and re-run with '--no-verify'." >&2
    exit 1
fi

if ! printf '%s\n' "$trailers" | grep -qE '^Signed-off-by: .+ <.+@.+>$'; then
    echo "commit-msg hook: missing DCO sign-off." >&2
    echo "  Re-run with 'git commit -s' to add a Signed-off-by trailer." >&2
    exit 1
fi
