#!/usr/bin/env bash
# Hook: enforce-bash (PreToolUse, matcher: ^bash$)
# Intercepts every bash tool call and blocks two classes of violation:
#   1. Banned host-mutating / network commands (per AGENTS.md policy).
#   2. Host-level language toolchains — they must run inside Docker so the
#      host stays clean.
set -euo pipefail

CMD="${CRUSH_TOOL_INPUT_COMMAND:-}"

# --- 1. Banned commands -----------------------------------------------------
# Extend PROJECT_BANNED_COMMANDS (space-separated) via env to add project-specific bans.
BANNED_COMMANDS="${PROJECT_BANNED_COMMANDS:-sudo su doas apt apt-get dnf emerge pacman yum zypper apk opkg curl wget ssh scp telnet nc firefox chrome safari httpie}"
for bc in $BANNED_COMMANDS; do
    if printf '%s' "$CMD" | grep -qE "(^|[[:space:]])${bc}([[:space:]]|$)"; then
        echo "BLOCKED: AGENTS.md — '$bc' is a banned command. This project is Docker-only; do host work through containers or approved wrappers." >&2
        exit 2
    fi
done

# --- 2. Host-level language tools ------------------------------------------
# python3/go/node/npm/cargo/etc. must appear inside a `docker run|exec|build`.
if printf '%s' "$CMD" | grep -qE '(^|[[:space:]])(python3?|go test|go vet|gofmt|go run|node|npm|npx|yarn|pnpm|ruby|java|javac|rustc|cargo)([[:space:]]|$)'; then
    if ! printf '%s' "$CMD" | grep -qE 'docker (run|exec|build)'; then
        echo "BLOCKED: AGENTS.md — language tools must run inside Docker, not on the host. Use: scripts/docker-run.sh <pinned-image> <command>" >&2
        exit 2
    fi
fi

echo '{}'