"""Default dangerous shell pattern registry."""

from __future__ import annotations

from cleveragents.tui.shell_safety.danger_level import ShellDangerLevel
from cleveragents.tui.shell_safety.dangerous_pattern import DangerousPattern

# ---------------------------------------------------------------------------
# Default pattern definitions
# ---------------------------------------------------------------------------

#: Built-in dangerous patterns shipped with CleverAgents.
#: Callers may extend or replace this list via
#: :class:`~cleveragents.tui.shell_safety.pattern_detector.DangerousPatternDetector`.
DEFAULT_PATTERNS: tuple[DangerousPattern, ...] = (
    # ── CRITICAL ────────────────────────────────────────────────────────────
    DangerousPattern(
        name="rm_rf_root",
        pattern=r"rm\s+(-\w*r\w*f|-\w*f\w*r)\s+/\s*$",
        level=ShellDangerLevel.CRITICAL,
        description=(
            "rm -rf / recursively deletes the entire filesystem root. "
            "This will destroy the operating system and all data."
        ),
    ),
    DangerousPattern(
        name="rm_rf_wildcard",
        pattern=r"rm\s+(-\w*r\w*f|-\w*f\w*r)\s+[/*]",
        level=ShellDangerLevel.CRITICAL,
        description=(
            "rm -rf with a root or wildcard path can delete large portions "
            "of the filesystem irreversibly."
        ),
    ),
    DangerousPattern(
        name="fork_bomb",
        pattern=r":\s*\(\s*\)\s*\{.*:\s*\|.*:.*&.*\}",
        level=ShellDangerLevel.CRITICAL,
        description=(
            "Fork bomb pattern :(){ :|:& };: exhausts system process table, "
            "causing a denial-of-service that requires a hard reboot."
        ),
    ),
    # ── HIGH ────────────────────────────────────────────────────────────────
    DangerousPattern(
        name="dd_if_device",
        pattern=r"\bdd\b.*\bif\s*=",
        level=ShellDangerLevel.HIGH,
        description=(
            "dd if= can overwrite disk devices or produce large files that "
            "fill storage, potentially causing data loss."
        ),
    ),
    DangerousPattern(
        name="mkfs",
        pattern=r"\bmkfs\b",
        level=ShellDangerLevel.HIGH,
        description=(
            "mkfs formats a filesystem, permanently erasing all data on the "
            "target partition or device."
        ),
    ),
    DangerousPattern(
        name="shred_device",
        pattern=r"\bshred\b.*(/dev/|--remove)",
        level=ShellDangerLevel.HIGH,
        description=(
            "shred on a device or with --remove overwrites data in a way "
            "that makes recovery impossible."
        ),
    ),
    # ── MEDIUM ──────────────────────────────────────────────────────────────
    DangerousPattern(
        name="chmod_777",
        pattern=r"\bchmod\b.*\b777\b",
        level=ShellDangerLevel.MEDIUM,
        description=(
            "chmod 777 grants world-readable, world-writable, and "
            "world-executable permissions, creating a security vulnerability."
        ),
    ),
    DangerousPattern(
        name="sudo_rm",
        pattern=r"\bsudo\b.*\brm\b",
        level=ShellDangerLevel.MEDIUM,
        description=(
            "sudo rm runs rm with elevated privileges, bypassing normal "
            "permission checks and increasing the risk of accidental deletion."
        ),
    ),
    DangerousPattern(
        name="wget_pipe_sh",
        pattern=r"\bwget\b.*\|\s*(ba)?sh\b",
        level=ShellDangerLevel.MEDIUM,
        description=(
            "Piping wget output directly to sh executes arbitrary remote "
            "code without inspection, a common supply-chain attack vector."
        ),
    ),
    DangerousPattern(
        name="curl_pipe_sh",
        pattern=r"\bcurl\b.*\|\s*(ba)?sh\b",
        level=ShellDangerLevel.MEDIUM,
        description=(
            "Piping curl output directly to sh executes arbitrary remote "
            "code without inspection, a common supply-chain attack vector."
        ),
    ),
    DangerousPattern(
        name="wget_pipe_bash",
        pattern=r"\bwget\b.*\|\s*bash\b",
        level=ShellDangerLevel.MEDIUM,
        description=(
            "Piping wget output directly to bash executes arbitrary remote "
            "code without inspection."
        ),
    ),
    DangerousPattern(
        name="curl_pipe_bash",
        pattern=r"\bcurl\b.*\|\s*bash\b",
        level=ShellDangerLevel.MEDIUM,
        description=(
            "Piping curl output directly to bash executes arbitrary remote "
            "code without inspection."
        ),
    ),
    # ── LOW ─────────────────────────────────────────────────────────────────
    DangerousPattern(
        name="git_push_force",
        pattern=r"\bgit\b.*\bpush\b.*--force\b",
        level=ShellDangerLevel.LOW,
        description=(
            "git push --force overwrites remote history, which can cause "
            "permanent data loss for collaborators."
        ),
    ),
    DangerousPattern(
        name="chmod_recursive_permissive",
        pattern=r"\bchmod\b.*-R.*\b[67][0-7][0-7]\b",
        level=ShellDangerLevel.LOW,
        description=(
            "Recursive chmod with permissive modes can expose sensitive "
            "files to unintended access."
        ),
    ),
)
