// src/tools/BashTool/BashTool.tsx
const fullInputSchema = lazySchema(() =>
  z.strictObject({
    command: z.string().describe("The command to execute"),
    timeout: semanticNumber(z.number().optional()).describe(`Optional timeout in milliseconds (max ${getMaxTimeoutMs()})`),
    description: z.string().optional().describe("Clear, concise description of what this command does in active voice..."),
    run_in_background: semanticBoolean(z.boolean().optional()).describe("Set to true to run this command in the background."),
    dangerouslyDisableSandbox: semanticBoolean(z.boolean().optional()).describe("Set this to true to dangerously override sandbox mode..."),
    _simulatedSedEdit: z
      .object({
        filePath: z.string(),
        newContent: z.string(),
      })
      .optional()
      .describe("Internal: pre-computed sed edit result from preview"),
  })
);

/**
 * Processes an individual subcommand and applies prefix checks & suggestions
 */
export async function checkCommandAndSuggestRules(
  input: z.infer<typeof BashTool.inputSchema>,
  toolPermissionContext: ToolPermissionContext,
  commandPrefixResult: CommandPrefixResult | null | undefined,
  compoundCommandHasCd?: boolean,
  astParseSucceeded?: boolean
): Promise<PermissionResult> {
  // 1. Check exact match first
  const exactMatchResult = bashToolCheckExactMatchPermission(input, toolPermissionContext);
  if (exactMatchResult.behavior !== "passthrough") {
    return exactMatchResult;
  }

  // 2. Check the command prefix
  const permissionResult = bashToolCheckPermission(input, toolPermissionContext, compoundCommandHasCd);
  // 2a. Deny/ask if command was explictly denied/asked
  if (permissionResult.behavior === "deny" || permissionResult.behavior === "ask") {
    return permissionResult;
  }

  // 3. Ask for permission if command injection is detected. Skip when the
  // AST parse already succeeded — tree-sitter has verified there are no
  // hidden substitutions or structural tricks, so the legacy regex-based
  // validators (backslash-escaped operators, etc.) would only add FPs.
  if (!astParseSucceeded && !isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK)) {
    const safetyResult = await bashCommandIsSafeAsync(input.command);

    if (safetyResult.behavior !== "passthrough") {
      const decisionReason: PermissionDecisionReason = {
        type: "other" as const,
        reason:
          safetyResult.behavior === "ask" && safetyResult.message
            ? safetyResult.message
            : "This command contains patterns that could pose security risks and requires approval",
      };

      return {
        behavior: "ask",
        message: createPermissionRequestMessage(BashTool.name, decisionReason),
        decisionReason,
        suggestions: [], // Don't suggest saving a potentially dangerous command
      };
    }
  }

  // 4. Allow if command was allowed
  if (permissionResult.behavior === "allow") {
    return permissionResult;
  }

  // 5. Suggest prefix if available, otherwise exact command
  const suggestedUpdates = commandPrefixResult?.commandPrefix
    ? suggestionForPrefix(commandPrefixResult.commandPrefix)
    : suggestionForExactCommand(input.command);

  return {
    ...permissionResult,
    suggestions: suggestedUpdates,
  };
}

export const bashToolCheckPermission = (
  input: z.infer<typeof BashTool.inputSchema>,
  toolPermissionContext: ToolPermissionContext,
  compoundCommandHasCd?: boolean,
  astCommand?: SimpleCommand
): PermissionResult => {
  const command = input.command.trim();

  // 1. Check exact match first
  const exactMatchResult = bashToolCheckExactMatchPermission(input, toolPermissionContext);

  // 1a. Deny/ask if exact command has a rule
  if (exactMatchResult.behavior === "deny" || exactMatchResult.behavior === "ask") {
    return exactMatchResult;
  }

  // 2. Find all matching rules (prefix or exact)
  // SECURITY FIX: Check Bash deny/ask rules BEFORE path constraints to prevent bypass
  // via absolute paths outside the project directory (HackerOne report)
  // When AST-parsed, the subcommand is already atomic — skip the legacy
  // splitCommand re-check that misparses mid-word # as compound.
  const { matchingDenyRules, matchingAskRules, matchingAllowRules } = matchingRulesForInput(input, toolPermissionContext, "prefix", {
    skipCompoundCheck: astCommand !== undefined,
  });

  // 2a. Deny if command has a deny rule
  if (matchingDenyRules[0] !== undefined) {
    return {
      behavior: "deny",
      message: `Permission to use ${BashTool.name} with command ${command} has been denied.`,
      decisionReason: {
        type: "rule",
        rule: matchingDenyRules[0],
      },
    };
  }

  // 2b. Ask if command has an ask rule
  if (matchingAskRules[0] !== undefined) {
    return {
      behavior: "ask",
      message: createPermissionRequestMessage(BashTool.name),
      decisionReason: {
        type: "rule",
        rule: matchingAskRules[0],
      },
    };
  }

  // 3. Check path constraints
  // This check comes after deny/ask rules so explicit rules take precedence.
  // SECURITY: When AST-derived argv is available for this subcommand, pass
  // it through so checkPathConstraints uses it directly instead of re-parsing
  // with shell-quote (which has a single-quote backslash bug that causes
  // parseCommandArguments to return [] and silently skip path validation).
  const pathResult = checkPathConstraints(
    input,
    getCwd(),
    toolPermissionContext,
    compoundCommandHasCd,
    astCommand?.redirects,
    astCommand ? [astCommand] : undefined
  );
  if (pathResult.behavior !== "passthrough") {
    return pathResult;
  }

  // 4. Allow if command had an exact match allow
  if (exactMatchResult.behavior === "allow") {
    return exactMatchResult;
  }

  // 5. Allow if command has an allow rule
  if (matchingAllowRules[0] !== undefined) {
    return {
      behavior: "allow",
      updatedInput: input,
      decisionReason: {
        type: "rule",
        rule: matchingAllowRules[0],
      },
    };
  }

  // 5b. Check sed constraints (blocks dangerous sed operations before mode auto-allow)
  const sedConstraintResult = checkSedConstraints(input, toolPermissionContext);
  if (sedConstraintResult.behavior !== "passthrough") {
    return sedConstraintResult;
  }

  // 6. Check for mode-specific permission handling
  const modeResult = checkPermissionMode(input, toolPermissionContext);
  if (modeResult.behavior !== "passthrough") {
    return modeResult;
  }

  // 7. Check read-only rules
  if (BashTool.isReadOnly(input)) {
    return {
      behavior: "allow",
      updatedInput: input,
      decisionReason: {
        type: "other",
        reason: "Read-only command is allowed",
      },
    };
  }

  // 8. Passthrough since no rules match, will trigger permission prompt
  const decisionReason = {
    type: "other" as const,
    reason: "This command requires approval",
  };
  return {
    behavior: "passthrough",
    message: createPermissionRequestMessage(BashTool.name, decisionReason),
    decisionReason,
    // Suggest exact match rule to user
    // this may be overridden by prefix suggestions in `checkCommandAndSuggestRules()`
    suggestions: suggestionForExactCommand(command),
  };
};

// CC-643: On complex compound commands, splitCommand_DEPRECATED can produce a
// very large subcommands array (possible exponential growth; #21405's ReDoS fix
// may have been incomplete). Each subcommand then runs tree-sitter parse +
// ~20 validators + logEvent (bashSecurity.ts), and with memoized metadata the
// resulting microtask chain starves the event loop — REPL freeze at 100% CPU,
// strace showed /proc/self/stat reads at ~127Hz with no epoll_wait. Fifty is
// generous: legitimate user commands don't split that wide. Above the cap we
// fall back to 'ask' (safe default — we can't prove safety, so we prompt).
export const MAX_SUBCOMMANDS_FOR_SECURITY_CHECK = 50;

// CC-643: Cap subcommand fanout. Only the legacy splitCommand path can
// explode — the AST path returns a bounded list (astSubcommands !== null)
// or short-circuits to 'too-complex' for structures it can't represent.
if (astSubcommands === null && subcommands.length > MAX_SUBCOMMANDS_FOR_SECURITY_CHECK) {
  logForDebugging(`bashPermissions: ${subcommands.length} subcommands exceeds cap (${MAX_SUBCOMMANDS_FOR_SECURITY_CHECK}) — returning ask`, {
    level: "debug",
  });
  const decisionReason = {
    type: "other" as const,
    reason: `Command splits into ${subcommands.length} subcommands, too many to safety-check individually`,
  };
  return {
    behavior: "ask",
    message: createPermissionRequestMessage(BashTool.name, decisionReason),
    decisionReason,
  };
}