{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "file=$(jq -r '.tool_input.file_path // empty'); case \"$file\" in *-sealed.yaml) echo \"Blocked: $file is generated by kubeseal. Don't hand-edit sealed output -- update the source (.env / the raw secret) and rerun the matching manifests/**/*-secret.sh script instead.\" >&2; exit 2 ;; esac; exit 0"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "file=$(jq -r '.tool_input.file_path // empty'); case \"$file\" in */values/pihole.yaml) echo \"Reminder: home.arpa has no wildcard DNS -- mirror this hostname change in values/pihole-debian.yaml too.\" >&2; exit 2 ;; */values/pihole-debian.yaml) echo \"Reminder: home.arpa has no wildcard DNS -- mirror this hostname change in values/pihole.yaml too.\" >&2; exit 2 ;; esac; exit 0"
          }
        ]
      }
    ]
  }
}