Install the gate

#!/usr/bin/env bash
# InvisableOS — last gate before git
# Install:  cp invisable-pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
# Fail-closed: missing tools or a dead detector refuse the commit.

set -euo pipefail

if ! command -v git >/dev/null 2>&1; then
  echo "InvisableOS  FAIL-CLOSED  git not found"
  exit 1
fi
if ! command -v perl >/dev/null 2>&1; then
  echo "InvisableOS  FAIL-CLOSED  perl not found — cannot scan, refusing commit"
  exit 1
fi

# Canary: detector must fire on an injected zero-width space (UTF-8 E2 80 8B).
set +e
printf 'x\xe2\x80\x8bx' | perl -CSD -ne 'exit 10 if /[\x{200B}]/'
canary_status=$?
set -e
if [ "$canary_status" -ne 10 ]; then
  echo "InvisableOS  FAIL-CLOSED  canary was not detected (status $canary_status)"
  exit 1
fi

fail=0
# NUL-safe staged file list, skip binaries via git's attr
while IFS= read -r -d '' file; do
  [ -z "$file" ] && continue
  [ -f "$file" ] || continue

  # Skip obvious binaries
  case "$file" in
    *.png|*.jpg|*.jpeg|*.gif|*.webp|*.ico|*.pdf|*.woff|*.woff2|*.zip|*.gz) continue ;;
  esac

  if grep -n $'\xEF\xBB\xBF' -- "$file" >/dev/null 2>&1; then
    echo "InvisableOS  BLOCK  $file  (UTF-8 BOM)"
    fail=1
  fi

  # Zero-width / bidi / variation / tag plane (UTF-8 encodings)
  if perl -CSD -ne '
      if (/[\x{00AD}\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{206F}\x{FE00}-\x{FE0F}\x{FEFF}\x{E0001}\x{E0020}-\x{E007F}]/) {
        print "InvisableOS  BLOCK  $ARGV  line $.  (invisible / bidi / tag)\n";
        exit 10;
      }
    ' -- "$file" 2>/dev/null
  then
    :
  else
    status=$?
    if [ "$status" -eq 10 ]; then
      fail=1
    else
      echo "InvisableOS  FAIL-CLOSED  scan error $status on $file"
      exit 1
    fi
  fi
done < <(git diff --cached --name-only -z --diff-filter=ACMR)

if [ "$fail" -ne 0 ]; then
  echo
  echo "InvisableOS refused this commit. Open the intercept, rewrite, then restage."
  exit 1
fi

echo "InvisableOS  PASS  staging is clean"