#!/usr/bin/env bash
# The shim grok runs. The verdict is JSON on stdout (grok's Claude-shaped
# reply). Exit 2 is grok's own deny, used only when no gate can be consulted:
# a JSON reply plus exit 2 would let the status override the reply.
set -uo pipefail

if [[ -n "${AI_HATS_GATE_BROKEN_ACK:-}" ]]; then
    printf '%s\n' "ai-hats: gate SKIPPED (hatch) — AI_HATS_GATE_BROKEN_ACK set" >&2
    exit 0
fi

if [[ -z "${AI_HATS_PYTHON:-}" ]]; then
    printf '%s\n' "ai-hats-grok-hook: AI_HATS_PYTHON is unset, so no gate can be consulted; restart the session" >&2
    printf '%s\n' "ai-hats: this gate could not run — set AI_HATS_GATE_BROKEN_ACK=1 to proceed past it" >&2
    exit 2
fi

exec "$AI_HATS_PYTHON" -m ai_hats.surfaces.grok.hook_dispatcher PreToolUse
