#!/usr/bin/env node
// pre-bash-destructive.mjs — Block destructive commands
// v5.0: normalizeBashExpansion applied before pattern matching
import { readFileSync } from 'node:fs';
const input = JSON.parse(readFileSync('/dev/stdin', 'utf-8'));
const cmd = input.tool_input?.command || '';

// Bash expansion normalization (v5.0)
function normalizeBashExpansion(s) {
  return s.replace(/\$\{[^}]*\}/g, '').replace(/''/g, '').replace(/""/g, '').replace(/\\\n/g, '');
}

const normalized = normalizeBashExpansion(cmd);
const PATTERNS = [
  /rm\s+-(r|f|rf|fr)/i,
  /git\s+push\s+--force/i,
  /DROP\s+TABLE/i,
  /DELETE\s+FROM\s+\S+\s*(?:;|$)/i,
  /mkfs/i,
  /format\s+/i,
  /curl\s+.*\|\s*(?:ba)?sh/i,
  /wget\s+.*\|\s*(?:ba)?sh/i,
];
for (const re of PATTERNS) {
  if (re.test(normalized)) {
    process.stdout.write(JSON.stringify({ decision: 'block', reason: 'Destructive command: ' + re }));
    process.exit(0);
  }
}
process.stdout.write(JSON.stringify({ decision: 'allow' }));