Node / meshtastic / Meshtastic-Android / files / scripts / ai-guardrail.sh

Displaying Raw • Download

T8b949e#!/bin/bash

T8b949e# Meshtastic AI Guardrail - Prevent binary/log leaks in commits

T8b949e#

T8b949e# INSTALLATION

T8b949e# ------------

T8b949e# Option 1 (recommended): set core.hooksPath so all devs share it automatically:

T8b949e# git config core.hooksPath scripts/hooks

T8b949e# mkdir -p scripts/hooks

T8b949e# ln -sf ../../ai-guardrail.sh scripts/hooks/pre-commit

T8b949e#

T8b949e# Option 2: copy/symlink directly into the local .git directory:

T8b949e# ln -sf ../../scripts/ai-guardrail.sh .git/hooks/pre-commit

T8b949e# chmod +x .git/hooks/pre-commit

T8b949e#

T8b949e# To run manually: bash scripts/ai-guardrail.sh

T8b949e# List of patterns that should NEVER be committed by an AI Agent

Te6edf3FORBIDDEN_PATTERNSTff7b72=Tff7b72(

Ta5d6ff"Ta5d6ff\.log$Ta5d6ff"

Ta5d6ff"Ta5d6ff\.png$Ta5d6ff"

Ta5d6ff"Ta5d6ff\.jpg$Ta5d6ff"

Ta5d6ff"Ta5d6ff\.jpeg$Ta5d6ff"

Ta5d6ff"Ta5d6ff\.webp$Ta5d6ff"

Ta5d6ff"Ta5d6ff\.mp3$Ta5d6ff"

Ta5d6ff"tmp/"

Ta5d6ff"\.agent_artifacts/"

Ta5d6ff"build/"

Ta5d6ff"Ta5d6ffgoogle-services\.json$Ta5d6ff"

Ta5d6ff"Ta5d6fflocal\.properties$Ta5d6ff"

Ta5d6ff"Ta5d6ffsecrets\.properties$Ta5d6ff"

Tff7b72)

Te6edf3VIOLATIONSTff7b72=Tff7b72(Tff7b72)

Tff7b72while Te6edf3IFSTff7b72= Tffa657read -r -d Ta5d6ff'' fileTb4b4b4; Tff7b72do

Tff7b72for pattern Tff7b72in Ta5d6ff"Tffd700${Te6edf3FORBIDDEN_PATTERNSTb4b4b4[@]Tffd700}Ta5d6ff"Tb4b4b4; Tff7b72do

Tff7b72if Tff7b72[Tff7b72[ Te6edf3$file Tff7b72=~ Te6edf3$pattern Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

Te6edf3VIOLATIONSTff7b72+=Tff7b72(Ta5d6ff"Te6edf3$fileTa5d6ff (matched Te6edf3$patternTa5d6ff)Ta5d6ff"Tff7b72)

Tff7b72fi

Tff7b72done

Tff7b72done < <Tff7b72(git diff --cached --name-only -zTff7b72)

Tff7b72if Tff7b72[ Tffd700${#Te6edf3VIOLATIONSTb4b4b4[@]Tffd700} -ne T79c0ff0 Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"❌ AI GUARDRAIL VIOLATION: Staged files contain high-token or sensitive artifacts:"

Tff7b72for violation Tff7b72in Ta5d6ff"Tffd700${Te6edf3VIOLATIONSTb4b4b4[@]Tffd700}Ta5d6ff"Tb4b4b4; Tff7b72do

Tffa657echo Ta5d6ff"Ta5d6ff - Te6edf3$violationTa5d6ff"

Tff7b72done

Tffa657echo Ta5d6ff""

Tffa657echo Ta5d6ff"Please unstage these files before committing. Use .copilotignore to prevent this in the future."

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657exit T79c0ff0