#!/bin/sh
#
# KeyHog pre-commit hook.
#
# Keep this wrapper aligned with `keyhog hook install` and
# `.pre-commit-hooks.yaml`: all three must call the same canonical scanner
# command so staged-file semantics, exit codes, and backend selection stay owned
# by the keyhog binary.

set -eu

if ! command -v keyhog >/dev/null 2>&1; then
    echo "keyhog: not found on PATH - blocking commit because the pre-commit secret scan did not run." >&2
    echo "  Install keyhog (https://github.com/santhreal/keyhog), fix PATH," >&2
    echo "  or remove .git/hooks/pre-commit if this repository should not be protected." >&2
    exit 127
fi

exec keyhog scan --fast --git-staged --backend cpu
