/**
 * Bash security pattern definitions — ported from Claude Code bashSecurity.ts
 * All pattern constants and helper functions for command validation.
 */

// Commands that should never be allowed (exact match)
export const BLOCKED_COMMANDS = new Set([
  "dd",
  "shred",
  "wipefs",
  // Privilege escalation
  "sudo",
  "su",
  "pkexec",
  "gksudo",
  "kdesudo",
  "sudoedit",
  // Credential theft
  "keylogger",
  // Kernel manipulation
  "insmod",
  "rmmod",
  "modprobe",
])

// Prefixes that should be blocked (e.g., "mkfs.ext4" matches "mkfs")
export const BLOCKED_PREFIXES = ["mkfs"]

// Commands that require extra caution
export const DANGEROUS_COMMANDS = new Set([
  "rm", "rmdir", "format", "del", "erase", "remove-item", "rd",
  // Process manipulation
  "kill", "killall", "pkill", "taskkill",
  // Network
  "curl", "wget", "nc", "ncat", "socat",
  // Package managers
  "npm", "npx", "pip", "pip3", "gem", "cargo", "go",
  // Docker
  "docker",
  // Cloud CLI
  "aws", "gcloud", "az",
])

// Command injection patterns
export const INJECTION_PATTERNS = [
  /;\s*(rm|sudo|mkfs|dd|shred|format|del)\b/i,
  /&&\s*(rm|sudo|mkfs|dd|shred|format|del)\b/i,
  /\|\s*(rm|sudo|mkfs|dd|shred|format|del)\b/i,
  /\$\([^)]*\)/,
  /`[^`]*`/,
  />\s*\/dev\//i,
  /chmod\s+777/i,
  /chmod\s+[+-].*s/i,
  /chown\s+.*root/i,
  /\\x[0-9a-f]{2}/i,
  /\\u[0-9a-f]{4}/i,
  /\\[0-7]{3}/,
  /\$'\x/,
  />\s*\/etc\/passwd/i,
  />\s*\/etc\/shadow/i,
  /cat\s+\/etc\/shadow/i,
  /cat\s+\/etc\/passwd.*>/i,
]

// Path traversal patterns
export const PATH_TRAVERSAL_PATTERNS = [
  /\.\.[\\/]/,
  /\.\.[\\/]|\.\.$/,
]

// Credential exfiltration patterns
export const EXFILTRATION_PATTERNS = [
  /curl.*\$\{?HOME/i,
  /curl.*\$HOME/i,
  /wget.*\$HOME/i,
  /curl.*\$\{?AWS/i,
  /curl.*\$\{?API_KEY/i,
  /curl.*\$\{?SECRET/i,
  /curl.*\$\{?TOKEN/i,
  /curl.*\$\{?PASSWORD/i,
  /echo.*\$.*\|.*nc/i,
  /echo.*\$.*\|.*curl/i,
]

// Shell-specific attack vectors
export const SHELL_ATTACK_PATTERNS = [
  /exec\s+rm/i,
  /eval\s+.*rm/i,
  /\bsource\s+\/dev\//i,
  /\.\s+\/dev\//i,
  /unset\s+PATH/i,
  /PATH\s*=\s*""/i,
  /export\s+PATH\s*=\s*""/i,
  /\bsudoedit\b/i,
]

export function getBaseCommand(command: string): string {
  const trimmed = command.trim()
  const match = trimmed.match(/^([A-Za-z_.\-/][A-Za-z0-9_.\-/]*)/)
  if (!match) return trimmed.split(/\s+/)[0]?.toLowerCase() ?? ""
  const parts = match[1].split("/")
  return parts[parts.length - 1].toLowerCase()
}

export function isPipedDestructive(command: string): boolean {
  const parts = command.split(/[|;&]/)
  return parts.some(p => {
    const base = getBaseCommand(p)
    if (BLOCKED_COMMANDS.has(base)) return true
    return BLOCKED_PREFIXES.some(prefix => base.startsWith(prefix + ".") || base === prefix)
  })
}

export function isSensitivePath(target: string): boolean {
  const sensitive = [
    "/etc/passwd", "/etc/shadow", "/etc/ssh", "/root/.ssh", "/.ssh",
    "\\ssh", "/boot/", "\\boot\\", "/efi/", "\\efi\\",
    "/proc/sys/", "/sys/", "\\sys\\", "/dev/", "\\dev\\",
    "C:\\Windows\\System32", "C:\\Windows\\SysWOW64",
  ]
  const lower = target.toLowerCase()
  return sensitive.some(s => lower.includes(s.toLowerCase()))
}
