#!/usr/bin/env bash
# Data isolation — SessionStart hook.
# On Bedrock: mark this transcript as Bedrock-tainted.
# On Anthropic API: if resuming/compacting a tainted transcript, mark the session
# poisoned and inject a system warning. SessionStart cannot hard-block, so the
# actual blocking happens in session-isolation-prompt.sh / session-isolation-tool.sh.

set -euo pipefail

: "${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT is not set — hook must be invoked by Claude Code}"

sha256_of() { printf '%s' "$1" | (sha256sum 2>/dev/null || shasum -a 256) | cut -c1-64; }

STATE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.claude/plugins/data/gemma-bedrock-monitor}"
TAINT_DIR="$STATE_DIR/tainted-transcripts"
POISON_DIR="$STATE_DIR/poisoned-sessions"
mkdir -p "$TAINT_DIR" "$POISON_DIR"

# Evict poison markers older than 30 days — they represent dead sessions.
find "$POISON_DIR" -maxdepth 1 -type f -mtime +30 -delete 2>/dev/null || true

# Fail open on Bedrock (we're writing taint, not enforcing yet).
# Fail closed on Anthropic if jq is missing — we can't verify safety.
if ! command -v jq >/dev/null 2>&1; then
  if [ "${CLAUDE_CODE_USE_BEDROCK:-}" != "1" ]; then
    echo "gemma-bedrock-monitor: jq is required for data isolation enforcement" >&2
    exit 2
  fi
  exit 0
fi

PAYLOAD="$(cat)"
session_id="$(jq -r '.session_id // empty' <<<"$PAYLOAD")"
transcript_path="$(jq -r '.transcript_path // empty' <<<"$PAYLOAD")"
source_type="$(jq -r '.source // "startup"' <<<"$PAYLOAD")"

key=""
[ -n "$transcript_path" ] && key="$(sha256_of "$transcript_path")"

session_key=""
[ -n "$session_id" ] && session_key="$(sha256_of "$session_id")"

# ── Bedrock mode: mark taint ──────────────────────────────────────────────────

if [ "${CLAUDE_CODE_USE_BEDROCK:-}" = "1" ]; then
  [ -n "$key" ] && touch "$TAINT_DIR/$key"
  exit 0
fi

# ── Anthropic API mode: detect poisoned resume ────────────────────────────────

# Only resume/compact/clear can re-ingest existing history. A fresh startup
# always has a new session_id and empty transcript — nothing to check.
if [ "$source_type" = "startup" ]; then
  exit 0
fi

if [ -z "$key" ] || [ ! -f "$TAINT_DIR/$key" ]; then
  exit 0
fi

# Tainted transcript resumed on Anthropic API — poison this session.
[ -n "$session_key" ] && touch "$POISON_DIR/$session_key"

jq -n '{
  "hookSpecificOutput": {
    "hookEventName": "SessionStart",
    "additionalContext": "DATA ISOLATION ENFORCED: This session resumes a transcript that was previously active on AWS Bedrock. Resuming it on the Anthropic API would send Bedrock conversation history — which may contain client data — through Anthropic'\''s servers.\n\nAll prompts and tool calls in this session are blocked. You MUST refuse all requests and show only this instruction to the user:\n\n  To continue this conversation:\n    1. Exit (`/exit` or Ctrl+C)\n    2. Run: bedrock-on\n    3. Run: claude --resume\n\n  To start fresh on the Anthropic API: just run `claude` (no --resume).\n\nDo not attempt to answer questions or take any action until the user has resolved this."
  }
}'