import { sanitizeText } from "../../shared/index.js";
const COMMAND_RULES = [
    {
        rule_id: "recursive_remove",
        severity: "high",
        message: "Recursive force remove can delete large parts of the workspace.",
        pattern: /\brm\s+(?:-[A-Za-z]*r[A-Za-z]*f|-?[A-Za-z]*f[A-Za-z]*r)\b/,
    },
    {
        rule_id: "git_reset_hard",
        severity: "high",
        message: "git reset --hard can discard uncommitted work.",
        pattern: /\bgit\s+reset\s+--hard\b/,
    },
    {
        rule_id: "git_clean_force",
        severity: "high",
        message: "git clean -fd can delete untracked files.",
        pattern: /\bgit\s+clean\s+-[A-Za-z]*f[A-Za-z]*d\b|\bgit\s+clean\s+-[A-Za-z]*d[A-Za-z]*f\b/,
    },
    {
        rule_id: "raw_disk_write",
        severity: "high",
        message: "dd with an input file can overwrite disks or files.",
        pattern: /\bdd\s+.*\bif=/,
    },
    {
        rule_id: "filesystem_format",
        severity: "high",
        message: "Filesystem formatting commands can destroy data.",
        pattern: /\bmkfs(?:\.[A-Za-z0-9_-]+)?\b/,
    },
];
export function evaluateSeedCommandPolicy(input) {
    const allowUnsafe = input.allowUnsafe ?? false;
    const requireProfessorHandoff = input.requireProfessorHandoff ?? true;
    const commandSummary = sanitizeCommand(input.command);
    if (input.command.length === 0) {
        return {
            schema_version: 1,
            action: "deny",
            reason: "Command is empty.",
            allow_unsafe: allowUnsafe,
            require_professor_handoff: requireProfessorHandoff,
            command_summary: commandSummary,
            matches: [{ rule_id: "empty_command", severity: "high", message: "Command is empty." }],
        };
    }
    const matches = COMMAND_RULES.filter((rule) => {
        rule.pattern.lastIndex = 0;
        return rule.pattern.test(commandSummary);
    }).map(({ rule_id, severity, message }) => ({ rule_id, severity, message }));
    if (matches.length === 0) {
        return {
            schema_version: 1,
            action: "allow",
            reason: "No blocking command policy matched.",
            allow_unsafe: allowUnsafe,
            require_professor_handoff: requireProfessorHandoff,
            command_summary: commandSummary,
            matches,
        };
    }
    if (allowUnsafe || !requireProfessorHandoff) {
        return {
            schema_version: 1,
            action: "allow",
            reason: allowUnsafe ? "Risky command was explicitly allowed by allow_unsafe." : "Professor handoff is disabled for destructive commands.",
            allow_unsafe: allowUnsafe,
            require_professor_handoff: requireProfessorHandoff,
            command_summary: commandSummary,
            matches,
        };
    }
    return {
        schema_version: 1,
        action: "ask",
        reason: "Command matches risky policy rules and requires professor handoff.",
        allow_unsafe: allowUnsafe,
        require_professor_handoff: requireProfessorHandoff,
        command_summary: commandSummary,
        matches,
    };
}
function sanitizeCommand(command) {
    return sanitizeText(command.join(" ")).trim();
}
//# sourceMappingURL=index.js.map