// Canonical guard-rule constants for Pi extensions.
// Mirrors hooks/guard-rules.mjs with Pi-specific tool naming where needed.

export const PI_MUTATING_FILE_TOOLS = [
	"write",
	"edit",
	"replace_content",
	"replace_lines",
	"delete_lines",
	"insert_at_line",
	"create_text_file",
	"rename_symbol",
	"replace_symbol_body",
	"insert_after_symbol",
	"insert_before_symbol",
];

export const SAFE_BASH_PREFIXES = [
	// Git read-only
	"git status",
	"git log",
	"git diff",
	"git show",
	"git blame",
	"git branch",
	"git fetch",
	"git remote",
	"git config",
	"git pull",
	"git stash",
	"git worktree",
	"git checkout -b",
	"git switch -c",
	// Tools
	"gh",
	"bd",
	"npx gitnexus",
	"xtrm finish",
	// Read-only filesystem
	"cat",
	"ls",
	"head",
	"tail",
	"pwd",
	"which",
	"type",
	"env",
	"printenv",
	"find",
	"grep",
	"rg",
	"fd",
	"wc",
	"sort",
	"uniq",
	"cut",
	"awk",
	"jq",
	"yq",
	"bat",
	"less",
	"more",
	"file",
	"stat",
	"du",
	"tree",
];

export const DANGEROUS_BASH_PATTERNS = [
	"sed\\s+-i",
	"echo\\s+[^\\n]*>",
	"printf\\s+[^\\n]*>",
	"cat\\s+[^\\n]*>",
	"tee\\b",
	"(?:^|\\s)(?:vim|nano|vi)\\b",
	"(?:^|\\s)mv\\b",
	"(?:^|\\s)cp\\b",
	"(?:^|\\s)rm\\b",
	"(?:^|\\s)mkdir\\b",
	"(?:^|\\s)touch\\b",
	"(?:^|\\s)chmod\\b",
	"(?:^|\\s)chown\\b",
	">>",
	"(?:^|\\s)git\\s+add\\b",
	"(?:^|\\s)git\\s+commit\\b",
	"(?:^|\\s)git\\s+merge\\b",
	"(?:^|\\s)git\\s+push\\b",
	"(?:^|\\s)git\\s+reset\\b",
	"(?:^|\\s)git\\s+checkout\\b",
	"(?:^|\\s)git\\s+rebase\\b",
	"(?:^|\\s)git\\s+stash\\b",
	"(?:^|\\s)npm\\s+install\\b",
	"(?:^|\\s)bun\\s+install\\b",
	"(?:^|\\s)bun\\s+add\\b",
	"(?:^|\\s)node\\s+(?:-e|--eval)\\b",
	"(?:^|\\s)bun\\s+(?:-e|--eval)\\b",
	"(?:^|\\s)python\\s+-c\\b",
	"(?:^|\\s)perl\\s+-e\\b",
	"(?:^|\\s)ruby\\s+-e\\b",
];