UNRELEASED DEVELOPMENT SNAPSHOT · READ-ONLY EXCERPT
hooks/shared/no-secrets-in-edit/run.sh
This is the cited technical source at local revision 275a354, inspected on 22 September 2026. It differs from the public release. This reference publishes only the cited sections, not an installable release or the development branch.
Line numbers refer to the complete recorded file. Uncited lines are omitted. Full-file SHA-256: 0eab8784736fd1e43848923ea421a953e3a39cfe895c55ca82d3d0aa55b7ba2c.
1
#!/usr/bin/env bash2
# no-secrets-in-edit — Lintel warn-only hook3
# Scans Edit/Write tool payload for secret patterns.5
set -euo pipefail7
source "$(dirname "${BASH_SOURCE[0]}")/../_input.sh"8
PAYLOAD="$(hook_input payload "${1:-}")"9
[ -z "$PAYLOAD" ] && exit 011
LINTEL_HOME="${LINTEL_HOME:-$HOME/.lintel}"12
mkdir -p "$LINTEL_HOME/audit"14
# Unified audit writer (hooks/shared/<name>/ → repo-root → bin/). Idempotent source.15
command -v audit_log >/dev/null 2>&1 || source "$(dirname "${BASH_SOURCE[0]}")/../../../bin/_audit.sh"16
# Shared detection patterns (defined once). Warn hook → broad `all` tier (includes heuristics).17
source "$(dirname "${BASH_SOURCE[0]}")/../_patterns.sh"19
joined="$(scan_secrets all "$PAYLOAD")"21
if [ -n "$joined" ]; then22
audit_log "hooks" "no_secrets_in_edit" "hook=no-secrets-in-edit" "tier=warn" "patterns_matched=$joined"23
echo "WARN [Lintel hook]: secret pattern detected in payload — $joined"24
echo "WARN: If this is a real secret, abort + use env var or secret manager. (warn-only; secret-scan-block fires at commit.)"