#!/usr/bin/env bash
set -euo pipefail

input="$(cat)"
cmd="$(echo "$input" | jq -r '.tool_input.command // empty')"

[ -z "$cmd" ] && exit 0

block() {
  echo "Bash command blocked: $1. $2." >&2
  exit 2
}

# git reset --hard
if echo "$cmd" | grep -Eq 'git[[:space:]]+reset[[:space:]]+--hard'; then
  block "git reset --hard destroys local work" "Use 'git stash' to set work aside, or branch off the current state before resetting"
fi

# git push --force / -f
if echo "$cmd" | grep -Eq 'git[[:space:]]+push[[:space:]]+(--force([[:space:]]|=|$)|-f([[:space:]]|$))'; then
  block "force push rewrites history" "Crewli uses --no-ff merges; never force-push. If the remote diverged, pull/rebase locally and resolve"
fi

# rm -rf on absolute paths outside /tmp and /home/<user>/
if echo "$cmd" | grep -Eq '\brm[[:space:]]+-rf?[[:space:]]+/' && ! echo "$cmd" | grep -Eq '\brm[[:space:]]+-rf?[[:space:]]+/(tmp|var/folders|home/[^/[:space:]]+/[^[:space:]]|Users/[^/[:space:]]+/[^[:space:]])'; then
  block "rm -rf on an absolute path outside /tmp" "Verify the path is project-relative; if you really need it, run it manually outside Claude Code"
fi

# php artisan migrate:fresh — only with --env=testing
if echo "$cmd" | grep -Eq 'php[[:space:]]+artisan[[:space:]]+migrate:fresh\b'; then
  if ! echo "$cmd" | grep -Eq -- '--env=testing\b'; then
    block "migrate:fresh wipes the database" "Add --env=testing to scope this to the test database, or run a non-destructive 'migrate' / 'migrate:rollback'"
  fi
fi

# php artisan db:wipe — only with --env=testing
if echo "$cmd" | grep -Eq 'php[[:space:]]+artisan[[:space:]]+db:wipe\b'; then
  if ! echo "$cmd" | grep -Eq -- '--env=testing\b'; then
    block "db:wipe destroys the database" "Add --env=testing to scope this to the test database"
  fi
fi

# composer/pnpm/npm update
if echo "$cmd" | grep -Eq '\b(composer|pnpm|npm)[[:space:]]+update\b'; then
  block "blanket dependency update bumps everything without review" "Use targeted 'composer require <pkg>' or 'pnpm add <pkg>' to bump one package at a time"
fi

exit 0