UNRELEASED DEVELOPMENT SNAPSHOT · READ-ONLY EXCERPT
hooks/shared/no-customer-data-in-message/run.sh
This is the cited technical source at local revision 275a354, inspected on 22 September 2026. It differs from the public release. This reference publishes only the cited sections, not an installable release or the development branch.
Line numbers refer to the complete recorded file. Uncited lines are omitted. Full-file SHA-256: db64cea3ef98c507e988fe7b272b8dbe2f290afcdae6cc28e3f213e0ec919c60.
1
#!/usr/bin/env bash2
# no-customer-data-in-message — Lintel warn-only hook3
# Scans operator prompt for customer-data tells.4
# Reads prompt content from $1 (Claude Code passes prompt as first arg).6
set -euo pipefail8
source "$(dirname "${BASH_SOURCE[0]}")/../_input.sh"9
PROMPT="$(hook_input prompt "${1:-}")"10
[ -z "$PROMPT" ] && exit 012
LINTEL_HOME="${LINTEL_HOME:-$HOME/.lintel}"13
mkdir -p "$LINTEL_HOME/audit"15
# Unified audit writer (hooks/shared/<name>/ → repo-root → bin/). Idempotent source.16
command -v audit_log >/dev/null 2>&1 || source "$(dirname "${BASH_SOURCE[0]}")/../../../bin/_audit.sh"17
# Shared customer-PII patterns (defined once in _patterns.sh).18
source "$(dirname "${BASH_SOURCE[0]}")/../_patterns.sh"20
joined="$(scan_customer "$PROMPT")"22
if [ -n "$joined" ]; then23
audit_log "hooks" "no_customer_data_in_message" "hook=no-customer-data-in-message" "tier=warn" "patterns_matched=$joined"24
echo "WARN [Lintel hook]: customer-data tell detected in prompt — patterns: $joined"25
echo "WARN: Sanitize before continuing if this is sensitive. (warn-only; not blocking.)"