#!/usr/bin/env bash
# Bash wrapper for the Ralph guard (PreToolUse / PostToolUse / Stop / SubagentStop).
#
# hooks.json calls this as `bash scripts/ralph/hooks/ralph-guard` (NOT the .py by
# its `#!/usr/bin/env python3` shebang) so the guard runs through a *probed*
# Python interpreter. On Windows the shebang is not honored and `python3` may be
# the Microsoft Store App Execution Alias stub — a 0-byte reparse point that
# prints "Python was not found" and exits 9009 while still satisfying `command -v`.
# The shared resolver's functionality probe skips it and falls through to a
# working interpreter (`py -3` / `python`).
#
# Ralph's harness (ralph.sh) is itself bash, so **Ralph mode requires Git Bash on
# Windows**; a native cmd.exe/PowerShell guard is intentionally not provided (the
# harness could not use one anyway). See docs/ralph.md.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Resolve pick-python.sh in BOTH layouts (single `..` each):
#   installed   scripts/ralph/hooks/ -> scripts/ralph/pick-python.sh  ($SCRIPT_DIR/../pick-python.sh)
#   source-tree scripts/hooks/       -> scripts/lib/pick-python.sh     ($SCRIPT_DIR/../lib/pick-python.sh)
if [ -f "$SCRIPT_DIR/../pick-python.sh" ]; then
  # shellcheck source=/dev/null
  . "$SCRIPT_DIR/../pick-python.sh"
else
  # shellcheck source=/dev/null
  . "$SCRIPT_DIR/../lib/pick-python.sh"
fi
pick_python || { echo "ralph-guard: no working Python interpreter found" >&2; exit 1; }

# The guard reads the hook JSON payload on stdin (inherited across exec) and
# gates itself on FLOW_RALPH — a no-op for non-Ralph users.
exec "${FLOW_PY[@]}" "$SCRIPT_DIR/ralph-guard.py" "$@"
