const DANGEROUS_BASH_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
  { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f|\brm\s+-[a-zA-Z]*f[a-zA-Z]*r|\brm\s+--force|\brm\s+--recursive/i, reason: '包含强制/递归删除命令' },
  { pattern: /\brm\s+-rf\b/i, reason: '包含 rm -rf 命令' },
  { pattern: /\brm\s+/i, reason: '包含文件删除命令' },
  { pattern: /\brmdir\b/i, reason: '包含目录删除命令' },
  { pattern: /\bdel\s+/i, reason: '包含文件删除命令' },
  { pattern: /\brd\s+/i, reason: '包含目录删除命令' },
  { pattern: /\bdrop\s+(table|database|schema)\b/i, reason: '包含数据库删除命令' },
  { pattern: /\btruncate\s+table\b/i, reason: '包含数据库清空命令' },
  { pattern: /\bgit\s+(reset\s+--hard|clean\s+-[a-zA-Z]*f|push\s+--force|push\s+-f)\b/i, reason: '包含危险 git 命令' },
  { pattern: /\bformat\b.*\b[a-zA-Z]:\\/i, reason: '包含磁盘格式化命令' },
];

export function detectToolRisk(toolName: string, args: Record<string, unknown>): string | null {
  if (toolName !== 'bash') return null;
  const command = typeof args.command === 'string' ? args.command : '';
  if (!command) return null;
  for (const { pattern, reason } of DANGEROUS_BASH_PATTERNS) {
    if (pattern.test(command)) return reason;
  }
  return null;
}
