#!/usr/bin/env bash
set -euo pipefail
blocked=0
while read -r local_ref local_sha remote_ref remote_sha; do
  base="${remote_sha:-0000000000000000000000000000000000000000}"
  if [ "$base" = "0000000000000000000000000000000000000000" ]; then
    files=$(git ls-tree -r --name-only "$local_sha")
  else
    files=$(git diff --name-only "$base..$local_sha")
  fi
  if echo "$files" | grep -E '^__INTERNAL__/' >/dev/null; then
    echo "ERROR: Push contains __INTERNAL__/ paths. Aborting." >&2
    blocked=1
  fi
done
[ "$blocked" -eq 0 ] || exit 1
exit 0
