/*
 * Copyright 2026, Jaime Terrats.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
const BASE_ALLOW = [
    { pattern: 'ls', description: 'List directory contents' },
    { pattern: 'pwd', description: 'Print working directory' },
    { pattern: 'echo', description: 'Print text' },
    { pattern: 'cat', description: 'Read file contents' },
    { pattern: 'head', description: 'Read file head' },
    { pattern: 'tail', description: 'Read file tail' },
    { pattern: 'wc', description: 'Count lines/words/bytes' },
    { pattern: 'find', description: 'Find files' },
    { pattern: 'grep', description: 'Search file contents' },
    { pattern: 'rg', description: 'Ripgrep search' },
    { pattern: 'mkdir', description: 'Create directories' },
    { pattern: 'touch', description: 'Create empty files' },
    { pattern: 'cp', description: 'Copy files' },
    { pattern: 'mv', description: 'Move/rename files' },
    { pattern: 'git status', description: 'Show working tree status' },
    { pattern: 'git diff*', description: 'Show changes' },
    { pattern: 'git log*', description: 'Show commit history' },
    { pattern: 'git show*', description: 'Show commit details' },
    { pattern: 'git add*', description: 'Stage changes' },
    { pattern: 'git commit*', description: 'Create commits' },
    { pattern: 'git stash*', description: 'Stash changes' },
    { pattern: 'git branch*', description: 'List/create branches' },
    { pattern: 'git checkout*', description: 'Switch branches/restore files' },
    { pattern: 'git fetch*', description: 'Download remote refs' },
    { pattern: 'git pull*', description: 'Fetch and merge' },
    { pattern: 'git restore*', description: 'Restore working tree files' },
    { pattern: 'git rev-parse*', description: 'Parse git references' },
    { pattern: 'git ls-files*', description: 'List tracked files' },
    { pattern: 'git config --get*', description: 'Read git config' },
    { pattern: 'git reset HEAD*', description: 'Unstage files' },
    { pattern: 'git reset --soft*', description: 'Soft reset (keep changes)' },
    { pattern: 'git reset --mixed*', description: 'Mixed reset (unstage)' },
    { pattern: 'git mv*', description: 'Move tracked files' },
    { pattern: 'git rm*', description: 'Remove tracked files' },
    { pattern: 'node*', description: 'Run Node.js' },
    { pattern: 'npm run*', description: 'Run npm scripts' },
    { pattern: 'npm install*', description: 'Install dependencies' },
    { pattern: 'npm ci*', description: 'Clean install' },
    { pattern: 'npx*', description: 'Run npx commands' },
    { pattern: 'yarn*', description: 'Yarn package manager' },
    { pattern: 'python*', description: 'Run Python' },
    { pattern: 'python3*', description: 'Run Python 3' },
    { pattern: 'pip install*', description: 'Install Python packages' },
    { pattern: 'pip3 install*', description: 'Install Python 3 packages' },
    { pattern: 'prettier*', description: 'Format code' },
    { pattern: 'eslint*', description: 'Lint code' },
    { pattern: 'jq*', description: 'Process JSON' },
    { pattern: 'curl*', description: 'HTTP requests' },
    { pattern: 'openssl*', description: 'Certificate/crypto utilities' },
];
const BASE_DENY = [
    { pattern: 'git push*', description: 'Push to remote (requires human approval)' },
    { pattern: 'git reset --hard*', description: 'Destructive: discards all local changes' },
    { pattern: 'git clean -f*', description: 'Destructive: removes untracked files' },
    { pattern: 'git clean -d*', description: 'Destructive: removes untracked directories' },
    { pattern: 'git clean -fd*', description: 'Destructive: removes untracked files and dirs' },
    { pattern: 'git rebase -i*', description: 'Interactive rebase (requires TTY)' },
    { pattern: 'rm -rf*', description: 'Destructive: recursive force delete' },
    { pattern: 'rm -fr*', description: 'Destructive: recursive force delete (alt)' },
    { pattern: 'sudo*', description: 'Privilege escalation not allowed' },
];
const CAPABILITY_ALLOW = {
    deploy: [
        { pattern: 'sf project deploy*', description: 'Deploy Salesforce metadata' },
        { pattern: 'sf project retrieve*', description: 'Retrieve Salesforce metadata' },
        { pattern: 'sf org list*', description: 'List connected orgs' },
        { pattern: 'sf org display*', description: 'Display org details' },
        { pattern: 'sf apex run*', description: 'Execute anonymous Apex' },
        { pattern: 'sf data*', description: 'Query/manipulate org data' },
    ],
    'code-analysis': [
        { pattern: 'sf scanner*', description: 'Run Salesforce Code Analyzer' },
        { pattern: 'sf code-analyzer*', description: 'Run Code Analyzer (v4)' },
    ],
    'story-mapping': [{ pattern: 'mmdc*', description: 'Mermaid CLI diagram rendering' }],
    'backlog-sync': [
        { pattern: 'gh issue*', description: 'GitHub issue management' },
        { pattern: 'gh pr*', description: 'GitHub PR management' },
    ],
    'elements-sync': [{ pattern: 'sf elements*', description: 'Elements.cloud CLI' }],
};
const CAPABILITY_DENY = {
    deploy: [
        { pattern: 'sf org delete*', description: 'Destructive: deletes Salesforce org' },
        { pattern: 'sf package version delete*', description: 'Destructive: deletes package version' },
        { pattern: 'npm publish*', description: 'Publish to npm (requires human approval)' },
        { pattern: 'npm unpublish*', description: 'Unpublish from npm (requires human approval)' },
    ],
};
export function generatePermissionsContent(capabilities, version) {
    const allow = [...BASE_ALLOW];
    const deny = [...BASE_DENY];
    for (const cap of capabilities) {
        const capAllow = CAPABILITY_ALLOW[cap];
        if (capAllow)
            allow.push(...capAllow);
        const capDeny = CAPABILITY_DENY[cap];
        if (capDeny)
            deny.push(...capDeny);
    }
    const lines = [
        `<!-- setup-agents: ${version} -->`,
        '',
        '# Command Permissions',
        '',
        'This file defines which shell commands agents may execute without human approval',
        'and which are NEVER allowed. Commands not listed require explicit user confirmation.',
        '',
        '## Allow (auto-approved)',
        '',
        '| Pattern | Purpose |',
        '|---------|---------|',
        ...allow.map((e) => `| \`${e.pattern}\` | ${e.description} |`),
        '',
        '## Deny (NEVER execute)',
        '',
        'These commands are **destructive or irreversible**. Never execute them autonomously.',
        'If the task requires one of these, stop and ask the user for explicit approval.',
        '',
        '| Pattern | Reason |',
        '|---------|--------|',
        ...deny.map((e) => `| \`${e.pattern}\` | ${e.description} |`),
        '',
        '## Unlisted Commands',
        '',
        'Any command not in Allow or Deny requires user confirmation before execution.',
        '',
    ];
    return lines.join('\n');
}
//# sourceMappingURL=permissions-content.js.map