'use strict';

// Shell execution policy shared by the local tool runner and static analyzer.
// Keep this module dependency-free so shell analysis never imports local-tools.

const SHELL_ALLOWLIST = new Set([
  // File ops
  'ls', 'cat', 'head', 'tail', 'wc', 'find', 'file', 'stat', 'du', 'df',
  'mkdir', 'cp', 'mv', 'touch', 'tee', 'readlink', 'realpath',
  // Path utilities
  'cd', 'pwd', 'basename', 'dirname', 'which', 'type', 'command',
  // Search
  'grep', 'rg', 'ag', 'fzf',
  // Text processing
  'sort', 'uniq', 'cut', 'tr', 'awk', 'sed', 'jq', 'yq', 'diff', 'comm',
  'xargs', 'tee', 'fmt', 'column',
  // Network
  'curl', 'wget', 'ping', 'dig', 'host', 'nslookup',
  // Dev tools
  'git', 'node', 'npm', 'npx', 'python', 'python3', 'pip', 'pip3', 'pytest', 'bun', 'deno',
  'make', 'cargo', 'go', 'ruby', 'perl', 'tsc',
  // Cloud / infra
  'fly', 'docker', 'kubectl',
  // System info
  'date', 'echo', 'env', 'whoami', 'hostname', 'uname', 'uptime', 'ps', 'top',
  'id', 'groups', 'printenv', 'locale', 'lsof',
  // macOS specific
  'open', 'pbcopy', 'pbpaste', 'say', 'defaults', 'mdfind', 'mdls',
  'osascript', 'screencapture', 'sw_vers', 'system_profiler',
  // Archive
  'tar', 'zip', 'unzip', 'gzip', 'gunzip', 'xz', 'bzip2',
  // Misc utilities
  'less', 'more', 'true', 'false', 'yes', 'test', 'expr', 'seq', 'sleep',
  'md5', 'shasum', 'base64', 'xxd',
]);

// Commands that are NEVER allowed regardless of context.
const SHELL_DENYLIST = new Set([
  'rm', 'rmdir', 'kill', 'killall', 'shutdown', 'reboot',
  'sudo', 'su', 'chmod', 'chown', 'chgrp',
  'dd', 'mkfs', 'fdisk', 'diskutil',
]);

module.exports = {
  SHELL_ALLOWLIST,
  SHELL_DENYLIST,
};
