/**
 * Layer 2 — pre-flight interactive-command classification (R-BASH-6/7/8).
 *
 * Pure, no I/O, so the false-positive surface is unit-testable. This is the part
 * of BashGuard most likely to be wrong, and R-BASH-8 is explicit about the cost:
 * "false positives get the guard disabled".
 *
 * Two invariants throughout:
 *  - Quoted text is invisible. `echo "run npm run dev"` is not a dev server.
 *  - Every segment of `;`, `&&`, `||` and every stage of a pipeline is judged on
 *    its own leading command. `cat x | less` is interactive even though `cat`
 *    is not.
 *
 * The verdict is a block, never a warning (R-BASH-7), and every block names the
 * working form. A block that does not teach the correct command just costs a
 * turn and teaches nothing.
 */

/** Why a command was refused, and what to run instead. */
export interface InteractiveVerdict {
	/** Coarse class from the R-BASH-6 table, for logging and tests. */
	kind: "always" | "flag" | "prompts" | "long-running";
	/** The matched command form, e.g. "git commit" or "npm run dev". */
	pattern: string;
	/** Model-facing message. Always names the non-interactive alternative. */
	message: string;
}

/**
 * Placeholder standing in for a quoted span.
 *
 * Blanking quoted spans is lossy in a way that matters here:
 * `ssh host 'ls /tmp'` and `ssh host` both reduce to `ssh host`, and the first is
 * the *recommended* non-interactive form. Blanking would make the recommended
 * form the blocked one — a false positive of exactly the kind R-BASH-8 warns
 * about. This placeholder keeps the operator-blindness R-BASH-8 requires while
 * preserving the fact that an argument was there.
 */
const QUOTED = "\u0000q";

/** Split shell chains so every command and pipeline stage is classified. */
function splitSegments(command: string): string[] {
	return command
		.split(/(?:\|\||&&|[;|&\n])/g)
		.map((segment) => segment.trim())
		.filter((segment) => segment.length > 0);
}

/** Like `stripQuoted`, but each quoted span leaves one opaque, operator-free token. */
export function maskQuoted(command: string): string {
	let out = "";
	let quote: '"' | "'" | undefined;
	let escaped = false;
	for (const ch of command) {
		if (escaped) {
			escaped = false;
			out += "x";
			continue;
		}
		if (ch === "\\") {
			escaped = true;
			continue;
		}
		if (quote !== undefined) {
			if (ch === quote) quote = undefined;
			continue;
		}
		if (ch === '"' || ch === "'") {
			quote = ch;
			// Emitted once at the opening quote, so an empty '' still yields a token.
			out += QUOTED;
			continue;
		}
		out += ch;
	}
	return out;
}

/** Segments with quoted spans masked rather than blanked. Splits on the same operators as bash-gate. */
function maskedSegmentsOf(command: string): string[] {
	return splitSegments(maskQuoted(command));
}

/**
 * Transparent wrappers whose own name is never the interesting command.
 *
 * `command less f` and `env less f` were trivial layer-2 bypasses (BUG-7); the
 * real command is the next word. `sudo` is deliberately NOT in this set — it is
 * itself a signal and is matched separately, on the leading position only.
 *
 * `nohup` is deliberately NOT here either: `nohup npm run dev > log 2>&1 &` is
 * the detached recipe this very classifier tells the model to use. Looking
 * through `nohup` would block the recommended form — the exact false positive
 * R-BASH-8 warns about.
 *
 * `timeout` and `nice` take a leading numeric argument, so their skip rule needs
 * the argument-consuming logic in `words()` rather than a bare name match.
 */
const WRAPPERS = new Set(["command", "env", "setsid", "stdbuf", "time", "ionice"]);

/** Wrappers that consume a leading value argument before the real command. */
const VALUE_WRAPPERS = new Set(["timeout", "nice"]);

/**
 * Words of a segment with leading env assignments, group punctuation and
 * transparent wrappers stripped, so the returned array starts at the command
 * that actually runs.
 *
 * `sudo` is kept when it leads, because `sudo` itself is the verdict.
 */
function words(segment: string): string[] {
	const all = segment
		.split(/\s+/)
		.filter((w) => w.length > 0)
		// `( vim f )` and `{ vim f; }` reduce to `vim f`: a group or subshell does
		// not change which program runs, and both were bypasses (BUG-7). The
		// separators were already consumed by splitSegments, so only the bare
		// punctuation tokens remain.
		.filter((w) => w !== "(" && w !== ")" && w !== "{" && w !== "}");
	let i = 0;
	while (i < all.length) {
		const w = all[i];
		if (w === undefined) break;
		if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w)) {
			i += 1;
			continue;
		}
		const base = baseOf(w);
		// `sudo` must stay visible, but only in the leading slot: see the note on
		// WRAPPERS. Skipping a wrapper cannot expose a later `sudo` as leading,
		// because a wrapper's own arguments are the command it runs.
		if (WRAPPERS.has(base)) {
			// `command -v vim` / `command -V vim` do not RUN vim, they print where it
			// is — exactly like `which vim`. Looking through them would block a pure
			// lookup, so this wrapper stops being transparent when asked to describe.
			if (base === "command" && all.slice(i + 1).some((x) => x === "-v" || x === "-V")) {
				return [];
			}
			i += 1;
			// The wrapper's own flags are not the command's: `stdbuf -o0 less f` runs
			// `less`. Attached values (`-o0`) and separate ones are both covered,
			// because a bare non-flag word is where the real command starts.
			while (i < all.length) {
				const next = all[i];
				if (next === undefined || !next.startsWith("-")) break;
				i += 1;
			}
			continue;
		}
		if (VALUE_WRAPPERS.has(base)) {
			i += 1;
			// `timeout 5 cmd`, `timeout -k 2 5 cmd`, `nice -n 10 cmd`: skip the
			// wrapper's flags and any bare numeric values (timeout takes two when
			// `-k` is used), then stop at the first non-numeric word — the command.
			while (i < all.length) {
				const next = all[i];
				if (next === undefined) break;
				if (next.startsWith("-")) {
					i += 1;
					continue;
				}
				// A duration is numeric, optionally with an s/m/h/d suffix; anything
				// else is already the command.
				if (/^\d+(\.\d+)?[smhd]?$/.test(next)) {
					i += 1;
					continue;
				}
				break;
			}
			continue;
		}
		break;
	}
	return all.slice(i);
}

/** Basename of the command word, so `/usr/bin/less` matches `less`. */
function baseOf(word: string): string {
	return word.split("/").pop() ?? word;
}

/** Non-flag arguments after the command word. */
function argsOf(w: string[]): string[] {
	return w.slice(1).filter((x) => !x.startsWith("-"));
}

function hasFlag(w: string[], ...flags: string[]): boolean {
	return w.some((x) => flags.includes(x));
}

/** True when any word starts with one of the given short-flag letters, e.g. `-im` contains `-i`. */
function hasShortFlag(w: string[], letter: string): boolean {
	return w.some((x) => /^-[A-Za-z]+$/.test(x) && x.slice(1).includes(letter));
}

/**
 * True when the command is only asking a binary to describe itself.
 *
 * `less --version`, `man --help` and `vim --version` all print to stdout and
 * exit 0 — they never open a TTY. Blocking them was BUG-4, and the block message
 * ("use cat/head/rg") did not even name a working alternative, so it violated
 * R-BASH-7 as well. Applied to every always-interactive family, not just REPLs.
 *
 * `-v`/`-V` are excluded deliberately: for a pager or editor they are not
 * version flags (`less -V` is, but `vim -v` is ex-mode and `grep -v` is invert),
 * so honouring them would trade a false positive for a false negative on the
 * ambiguous letter. `--version`/`--help` are unambiguous across every tool here.
 */
function isSelfDescribing(w: string[]): boolean {
	return w.slice(1).some((x) => x === "--version" || x === "--help");
}

/**
 * Commands where a short `-w` genuinely means `--watch`.
 *
 * BUG-1: `hasFlag(w, "--watch", "-w")` blocked `grep -w` (word-regexp),
 * `wc -w` (word count), `chmod -w` (remove write), `sort -w`, `curl -w`
 * (write-out format), `xargs -w`, `man -w` (show path), and critically
 * `npm test -w pkg` / `pnpm -w install`, where `-w` selects a workspace.
 *
 * Verified by reading each tool's own `--help`: `tsc -w` and `rollup -w` are
 * watch; `jest`, `vite` and `esbuild` have no short `-w` at all. So short `-w`
 * is allowlisted per tool rather than assumed, and `--watch` alone is generic.
 */
const SHORT_W_IS_WATCH = new Set(["tsc", "rollup"]);

const DETACH_RECIPE = (command: string, log: string): string =>
	`To run it in the background:\n  nohup ${command} > ${log} 2>&1 &\n  sleep 5 && tail -20 ${log}\nThen poll ${log}. Remember to kill the process when done.`;

/** Editors and pagers: block unconditionally, there is no non-interactive form. */
const EDITORS = new Map<string, string>([
	["vim", "read the file with the read tool, or edit it with the edit tool"],
	["vi", "read the file with the read tool, or edit it with the edit tool"],
	["nvim", "read the file with the read tool, or edit it with the edit tool"],
	["nano", "read the file with the read tool, or edit it with the edit tool"],
	["pico", "read the file with the read tool, or edit it with the edit tool"],
	["emacs", "read the file with the read tool, or edit it with the edit tool"],
	["ed", "read the file with the read tool, or edit it with the edit tool"],
]);

const PAGERS = new Map<string, string>([
	["less", "drop the pager and use `cat`, `head -n`, or `rg`"],
	["more", "drop the pager and use `cat`, `head -n`, or `rg`"],
	["most", "drop the pager and use `cat`, `head -n`, or `rg`"],
	["man", "use `<cmd> --help`, or `man <page> | cat`"],
]);

/** Full-screen monitors. No useful captured output even if they did exit. */
const TUI_MONITORS = new Map<string, string>([
	["top", "use `ps aux --sort=-%cpu | head -20`"],
	["htop", "use `ps aux --sort=-%cpu | head -20`"],
	["btop", "use `ps aux --sort=-%cpu | head -20`"],
	["atop", "use `ps aux --sort=-%cpu | head -20`"],
	["lazygit", "use plain `git` subcommands"],
	["tig", "use `git log --oneline` (GIT_PAGER is already cat)"],
	["gitui", "use plain `git` subcommands"],
]);

/** REPLs: interactive only when given no script and no eval flag. */
const REPLS = new Map<string, string[]>([
	["python", ["-c", "-m"]],
	["python3", ["-c", "-m"]],
	["node", ["-e", "-p", "--eval", "--print"]],
	["irb", ["-e"]],
	["ruby", ["-e"]],
	["php", ["-r"]],
	["ghci", []],
	["sqlite3", []],
	["bc", []],
	["R", ["-e"]],
]);

/** Long-running by nature: named script/binary -> a log path for the recipe. */
const WATCHERS = new Map<string, string>([
	["nodemon", "/tmp/nodemon.log"],
	["vite", "/tmp/vite.log"],
	["webpack", "/tmp/webpack.log"],
	["rollup", "/tmp/rollup.log"],
	["esbuild", "/tmp/esbuild.log"],
	["tsc-watch", "/tmp/tsc-watch.log"],
	["watchexec", "/tmp/watchexec.log"],
	["watch", "/tmp/watch.log"],
	["serve", "/tmp/serve.log"],
	["http-server", "/tmp/http-server.log"],
	["ng", "/tmp/ng.log"],
	["nuxt", "/tmp/nuxt.log"],
	["next", "/tmp/next.log"],
	["gatsby", "/tmp/gatsby.log"],
	["remix", "/tmp/remix.log"],
	["jekyll", "/tmp/jekyll.log"],
	["hugo", "/tmp/hugo.log"],
]);

/** Script names that keep running until killed, for `npm run <script>` and friends. */
const DEV_SCRIPTS = new Set(["dev", "start", "serve", "watch", "storybook", "preview", "dev:server"]);

const RUNNERS = new Set(["npm", "pnpm", "yarn", "bun", "npx", "pnpx", "bunx", "deno"]);

/** Package-manager subcommands that authenticate or publish and therefore prompt. */
const PROMPTING_PKG_SUBCOMMANDS = new Set(["login", "adduser", "publish", "logout", "token"]);

/**
 * The git subcommand, skipping the pre-subcommand options that take a value.
 *
 * BUG-7: `argsOf` drops flags but keeps their values, so `git -C /repo commit`
 * reported `/repo` as the subcommand and every git rule silently missed. Only
 * git's own pre-command options are consumed; anything after the subcommand is
 * left alone, because `git commit -C <commit>` is a different `-C`.
 */
const GIT_VALUE_OPTIONS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--super-prefix"]);

function gitSubcommandOf(w: string[]): string | undefined {
	for (let i = 1; i < w.length; i++) {
		const x = w[i];
		if (x === undefined) continue;
		if (x.startsWith("-")) {
			// `--git-dir=/x` carries its own value; bare `--git-dir /x` consumes one.
			if (GIT_VALUE_OPTIONS.has(x)) i += 1;
			continue;
		}
		return x;
	}
	return undefined;
}


function classifySegment(segment: string, display: string): InteractiveVerdict | undefined {
	const w = words(segment);
	const first = w[0];
	if (first === undefined) return undefined;
	const cmd = baseOf(first);

	// `sudo` needs a human at a TTY for the password. Matched on the **leading**
	// command word only (BUG-2): `w.some(...)` blocked `grep -rn sudo notes.txt`
	// and `rg sudo`, i.e. searching for the string "sudo" — a false positive on
	// pure inspection, which is the R-BASH-8 disable risk. `words()` has already
	// stripped env assignments and `command`/`env` prefixes, mirroring
	// bash-gate.ts's `leadingCommand()`, so `sudo apt install -y x` still blocks.
	if (cmd === "sudo") {
		return {
			kind: "prompts",
			pattern: "sudo",
			message:
				"Blocked: `sudo` prompts for a password on a terminal this tool does not have, and will hang.\n" +
				"Ask the user to run this command themselves, or find a way to do it without root.",
		};
	}

	// BUG-4: `--version`/`--help` print and exit on every family below, so the
	// check is hoisted once here rather than repeated per family. Nothing after
	// this point can be a TTY-opening invocation of a self-describing binary.
	const selfDescribing = isSelfDescribing(w);

	const editor = EDITORS.get(cmd);
	if (editor !== undefined && !selfDescribing) {
		return {
			kind: "always",
			pattern: cmd,
			message: `Blocked: \`${cmd}\` is an interactive editor and will wait forever for a terminal.\nUse: ${editor}.`,
		};
	}

	const pager = PAGERS.get(cmd);
	if (pager !== undefined && !selfDescribing) {
		// `man -w git` / `man --where git` prints the manpage path and exits without
		// paging (BUG-1 listed it among the `-w` false positives). Same for `-k`
		// (apropos) and `-f` (whatis), which are plain stdout lookups.
		const manNonPaging =
			cmd === "man" && (hasFlag(w, "-w", "--where", "--path", "--location", "-k", "--apropos", "-f", "--whatis"));
		if (!manNonPaging) {
			return {
				kind: "always",
				pattern: cmd,
				message: `Blocked: \`${cmd}\` is an interactive pager and will wait forever for a terminal.\nUse: ${pager}.`,
			};
		}
	}

	const monitor = TUI_MONITORS.get(cmd);
	if (monitor !== undefined && !selfDescribing) {
		return {
			kind: "always",
			pattern: cmd,
			message: `Blocked: \`${cmd}\` is a full-screen interactive program and will not exit on its own.\nUse: ${monitor}.`,
		};
	}

	// `tail -f` follows forever. Plain `tail` is fine and very common.
	if (cmd === "tail" && (hasShortFlag(w, "f") || hasFlag(w, "--follow", "-F") || hasShortFlag(w, "F"))) {
		return {
			kind: "long-running",
			pattern: "tail -f",
			message:
				"Blocked: `tail -f` follows the file forever and will hang this tool.\n" +
				"Use: tail -n 200 <file>   (run it again later to see new lines)",
		};
	}

	const watcherLog = WATCHERS.get(cmd);
	if (watcherLog !== undefined && !selfDescribing) {
		// A watcher invoked for a one-shot build is fine: `vite build`, `next build`.
		const sub = argsOf(w)[0];
		const oneShot = sub === "build" || sub === "generate" || sub === "export" || sub === "lint";
		if (!oneShot) {
			return {
				kind: "long-running",
				pattern: cmd,
				message: `Blocked: \`${cmd}\` runs until killed and will hang this tool.\n${DETACH_RECIPE(display.trim(), watcherLog)}`,
			};
		}
	}

	// `--watch` on anything turns a finite command into an infinite one. Short `-w`
	// only counts for tools where it actually means watch (BUG-1): see
	// SHORT_W_IS_WATCH. `git` is excluded because `git -w` is a diff whitespace
	// option, not a watch.
	if ((hasFlag(w, "--watch") || (SHORT_W_IS_WATCH.has(cmd) && hasFlag(w, "-w"))) && cmd !== "git") {
		return {
			kind: "long-running",
			pattern: `${cmd} --watch`,
			message:
				`Blocked: \`${cmd}\` with --watch runs until killed and will hang this tool.\n` +
				`Drop --watch for a single run, or run it detached:\n` +
				DETACH_RECIPE(display.trim(), `/tmp/${cmd}-watch.log`),
		};
	}

	const repl = REPLS.get(cmd);
	if (repl !== undefined) {
		const rest = w.slice(1);
		const hasEval = rest.some((x) => repl.includes(x));
		// A script path, a `-` (read program from stdin, which our /dev/null
		// redirect turns into a clean EOF), or an eval flag all make it finite.
		const hasScript = rest.some((x) => !x.startsWith("-"));
		// `-v`/`-V` are kept here (unlike isSelfDescribing) because for a REPL they
		// are unambiguously version flags: `node -v`, `python -V`.
		const isVersionQuery = selfDescribing || rest.some((x) => x === "-v" || x === "-V");
		if (!hasEval && !hasScript && !isVersionQuery && !rest.includes("-")) {
			return {
				kind: "always",
				pattern: cmd,
				message:
					`Blocked: \`${cmd}\` with no script starts an interactive REPL and will wait forever for input.\n` +
					`Use: ${cmd} <script-file>, or ${cmd} ${repl[0] ?? "-c"} '<code>' for a one-liner.`,
			};
		}
	}

	if (cmd === "ssh" && !selfDescribing) {
		// `ssh host` with no remote command opens a login shell. `ssh host uname -a`
		// is finite. Walk the args so a flag that takes a separate value does not
		// make that value look like the host, and so an attached value (`-o Key=v`
		// vs `-oKey=v`) is not double-counted.
		const valueFlags = new Set([
			"-p", "-i", "-l", "-o", "-F", "-L", "-R", "-D", "-J", "-b", "-c",
			"-E", "-e", "-I", "-m", "-Q", "-S", "-W", "-w", "-B",
		]);
		const rest = w.slice(1);
		const positional: string[] = [];
		for (let i = 0; i < rest.length; i++) {
			const x = rest[i];
			if (x === undefined) continue;
			if (x.startsWith("-")) {
				// Exactly `-o` consumes the next word; `-oKey=v` carries its own value.
				if (valueFlags.has(x)) i += 1;
				continue;
			}
			positional.push(x);
		}
		// One positional is the host alone; two or more means a remote command.
		if (positional.length <= 1) {
			return {
				kind: "always",
				pattern: "ssh",
				message:
					"Blocked: `ssh` without a remote command opens an interactive login shell and will hang.\n" +
					"Use: ssh -o BatchMode=yes <host> '<command>'   (BatchMode also fails fast instead of prompting for a password)",
			};
		}
	}

	if ((cmd === "mysql" || cmd === "psql" || cmd === "sqlplus" || cmd === "mongosh" || cmd === "redis-cli") && !selfDescribing) {
		const hasQuery = hasFlag(w, "-c", "-e", "--command", "--execute", "--eval") || w.some((x) => x.startsWith("-c=") || x.startsWith("-e="));
		const hasFile = hasFlag(w, "-f", "--file") || w.some((x) => x.startsWith("<"));
		if (!hasQuery && !hasFile) {
			const flag = cmd === "psql" ? "-c" : cmd === "mysql" ? "-e" : "--eval";
			return {
				kind: "always",
				pattern: cmd,
				message:
					`Blocked: \`${cmd}\` without a query starts an interactive shell and will hang.\n` +
					`Use: ${cmd} ${flag} '<statement>'   (or -f <file> for a script)`,
			};
		}
	}

	if (cmd === "git") {
		const sub = gitSubcommandOf(w);
		// Flags belonging to the subcommand, not to git itself. `git -C /repo commit`
		// must not read git's global `-C <path>` as `git commit -C <commit>`
		// (reuse-message) and conclude the commit is non-interactive (BUG-7).
		const subArgs = sub === undefined ? [] : w.slice(w.indexOf(sub));
		if (sub === "commit") {
			// -m, -F, --amend --no-edit, -C/--reuse-message, --file=, --message=,
			// and --no-edit all avoid the editor. Everything else opens one.
			const nonInteractive =
				hasFlag(subArgs, "-m", "-F", "--no-edit", "-C", "--reuse-message", "--reedit-message") ||
				subArgs.some((x) => x.startsWith("--message=") || x.startsWith("--file=") || x.startsWith("--reuse-message=")) ||
				hasShortFlag(subArgs, "m") ||
				hasShortFlag(subArgs, "F");
			if (!nonInteractive) {
				return {
					kind: "flag",
					pattern: "git commit",
					message:
						"Blocked: `git commit` without -m or -F waits for an editor and will hang.\n" +
						'Use: git commit -m "message"   (or -F <file> for a multi-line message)',
				};
			}
		}
		if (sub === "tag") {
			const annotated = hasFlag(w, "-a", "--annotate", "-s", "--sign") || hasShortFlag(w, "a") || hasShortFlag(w, "s");
			const hasMessage = hasFlag(w, "-m", "-F") || hasShortFlag(w, "m") || w.some((x) => x.startsWith("--message="));
			if (annotated && !hasMessage) {
				return {
					kind: "flag",
					pattern: "git tag -a",
					message:
						"Blocked: `git tag -a` without -m waits for an editor and will hang.\n" +
						'Use: git tag -a <name> -m "message"',
				};
			}
		}
		if (sub === "rebase" && (hasFlag(w, "-i", "--interactive") || hasShortFlag(w, "i"))) {
			return {
				kind: "flag",
				pattern: "git rebase -i",
				message:
					"Blocked: `git rebase -i` opens an editor for the todo list and will hang.\n" +
					"Use a non-interactive equivalent (`git rebase <base>`, `git reset --soft`, `git commit --amend -m ...`),\n" +
					"or ask the user to do the interactive rebase themselves.",
			};
		}
		if ((sub === "add" || sub === "checkout" || sub === "reset" || sub === "stash" || sub === "restore") && (hasFlag(w, "-p", "--patch") || hasShortFlag(w, "p"))) {
			return {
				kind: "flag",
				pattern: `git ${sub} -p`,
				message:
					`Blocked: \`git ${sub} -p\` is an interactive hunk-picker and will hang.\n` +
					`Use explicit paths (\`git ${sub} <path>\`), or ask the user to stage hunks themselves.`,
			};
		}
		if (sub === "mergetool" || sub === "difftool") {
			return {
				kind: "always",
				pattern: `git ${sub}`,
				message:
					`Blocked: \`git ${sub}\` launches an interactive tool and will hang.\n` +
					`Use: git diff / git status to inspect, and the edit tool to resolve conflicts by hand.`,
			};
		}
		return undefined;
	}

	if (cmd === "apt" || cmd === "apt-get" || cmd === "dnf" || cmd === "yum" || cmd === "zypper" || cmd === "pacman") {
		const sub = argsOf(w)[0];
		const changesPackages = sub === "install" || sub === "remove" || sub === "upgrade" || sub === "purge" || sub === "dist-upgrade" || sub === "-S" || sub === "-Syu";
		const assumeYes = hasFlag(w, "-y", "--yes", "--assumeyes", "--noconfirm") || hasShortFlag(w, "y");
		if (changesPackages && !assumeYes) {
			const form = `${cmd} ${sub ?? ""}`.trim();
			return {
				kind: "prompts",
				pattern: form,
				message:
					`Blocked: \`${form}\` prompts for confirmation and will hang. It also usually needs root.\n` +
					`Add -y for the non-interactive form, and ask the user to run it if root is required.`,
			};
		}
	}

	if (cmd === "gpg" && !hasFlag(w, "--batch")) {
		return {
			kind: "prompts",
			pattern: "gpg",
			message:
				"Blocked: `gpg` prompts for a passphrase on a terminal this tool does not have.\n" +
				"Use: gpg --batch --yes ... with a passphrase source, or ask the user to run it.",
		};
	}

	if (cmd === "gh" || cmd === "glab") {
		const sub = argsOf(w).slice(0, 2).join(" ");
		if (sub.startsWith("auth login") || sub.startsWith("auth refresh")) {
			return {
				kind: "prompts",
				pattern: `${cmd} auth login`,
				message:
					`Blocked: \`${cmd} auth login\` is an interactive browser/token flow and will hang.\n` +
					`Ask the user to authenticate, or use a token: \`${cmd} auth login --with-token < token-file\`.`,
			};
		}
	}

	if (RUNNERS.has(cmd)) {
		const positional = argsOf(w);
		const sub = positional[0];

		if (sub !== undefined && PROMPTING_PKG_SUBCOMMANDS.has(sub)) {
			return {
				kind: "prompts",
				pattern: `${cmd} ${sub}`,
				message:
					`Blocked: \`${cmd} ${sub}\` prompts for credentials or confirmation and needs a human.\n` +
					"Ask the user to run it themselves.",
			};
		}

		// `npm run dev`, `pnpm dev`, `yarn start`, `bun run watch`.
		const script = sub === "run" || sub === "run-script" || sub === "exec" ? positional[1] : sub;
		if (script !== undefined && DEV_SCRIPTS.has(script)) {
			return {
				kind: "long-running",
				pattern: `${cmd} ${sub === "run" || sub === "run-script" || sub === "exec" ? `${sub} ${script}` : script}`,
				message:
					`Blocked: \`${display.trim()}\` runs until killed and will hang this tool.\n` +
					DETACH_RECIPE(display.trim(), "/tmp/dev.log"),
			};
		}

		// `npx vite`, `bunx nodemon` — the watcher is the argument, not the command.
		if (sub !== undefined) {
			const inner = baseOf(sub);
			const innerLog = WATCHERS.get(inner);
			const nested = positional[1];
			const oneShot = nested === "build" || nested === "generate" || nested === "export";
			if (innerLog !== undefined && !oneShot) {
				return {
					kind: "long-running",
					pattern: `${cmd} ${inner}`,
					message:
						`Blocked: \`${display.trim()}\` runs until killed and will hang this tool.\n` +
						DETACH_RECIPE(display.trim(), innerLog),
				};
			}
		}
	}

	if (cmd === "docker" || cmd === "podman") {
		const positional = argsOf(w);
		if (positional[0] === "compose" && positional[1] === "up" && !hasFlag(w, "-d", "--detach") && !hasShortFlag(w, "d")) {
			return {
				kind: "long-running",
				pattern: "docker compose up",
				message:
					"Blocked: `docker compose up` runs in the foreground until killed and will hang this tool.\n" +
					"Use: docker compose up -d   then `docker compose logs --tail 50` to inspect.",
			};
		}
		if (positional[0] === "run" && (hasFlag(w, "-it", "-ti") || (hasShortFlag(w, "i") && hasShortFlag(w, "t")))) {
			return {
				kind: "always",
				pattern: "docker run -it",
				message:
					"Blocked: `docker run -it` allocates a TTY and waits for input, so it will hang.\n" +
					"Drop -it and pass the command directly: docker run --rm <image> <command>",
			};
		}
		if (positional[0] === "attach" || positional[0] === "exec") {
			if (hasFlag(w, "-it", "-ti") || (hasShortFlag(w, "i") && hasShortFlag(w, "t"))) {
				return {
					kind: "always",
					pattern: `docker ${positional[0]} -it`,
					message:
						`Blocked: \`docker ${positional[0]}\` with -it waits for input and will hang.\n` +
						`Drop -it: docker exec <container> <command>`,
				};
			}
		}
	}

	if (cmd === "docker-compose") {
		const positional = argsOf(w);
		if (positional[0] === "up" && !hasFlag(w, "-d", "--detach") && !hasShortFlag(w, "d")) {
			return {
				kind: "long-running",
				pattern: "docker-compose up",
				message:
					"Blocked: `docker-compose up` runs in the foreground until killed and will hang this tool.\n" +
					"Use: docker-compose up -d   then `docker-compose logs --tail 50` to inspect.",
			};
		}
	}

	// Bare `read` blocks on stdin. Harmless with the /dev/null redirect, but the
	// model almost never means it, and the resulting empty variable is confusing.
	if (cmd === "read" && !hasFlag(w, "-t") && !hasShortFlag(w, "t")) {
		return {
			kind: "always",
			pattern: "read",
			message:
				"Blocked: `read` waits for input on stdin, which is closed for this tool.\n" +
				"Pass the value directly instead of reading it interactively.",
		};
	}

	return undefined;
}

/**
 * Classify a command, returning a verdict when it must be blocked (R-BASH-6).
 *
 * Returns undefined for the "otherwise" row of the R-BASH-6 table: allow,
 * hardened. Ambiguity resolves toward allowing, because a false block is a
 * functional regression while a missed block only costs the timeout that layer 1
 * now guarantees exists.
 */
export function classifyInteractive(command: string): InteractiveVerdict | undefined {
	// Masked, not blanked: see maskQuoted. Operators inside quotes are still
	// invisible (the placeholder contains none), so R-BASH-8's quote-awareness
	// holds, but argument arity survives.
	const masked = maskedSegmentsOf(command);
	// Raw segments for display only. Split on the same operators, but without
	// quote handling the counts can diverge (an operator inside quotes splits a
	// raw segment but not a masked one), so fall back to the masked text rather
	// than risk pairing a message with the wrong command.
	const raw = command.split(/(?:\|\||&&|[;|&\n])/g).map((s) => s.trim()).filter((s) => s.length > 0);
	const aligned = raw.length === masked.length;
	for (let i = 0; i < masked.length; i++) {
		const segment = masked[i];
		if (segment === undefined) continue;
		const display = (aligned ? raw[i] : undefined) ?? segment;
		const verdict = classifySegment(segment, display);
		if (verdict !== undefined) return verdict;
	}
	return undefined;
}