"""Run with python3; command payloads are inspected, never executed."""

import json
import os
from pathlib import Path
import subprocess


hook = Path(__file__).with_name("block-dangerous-git.sh")


def check(payload, expected, env=None):
    result = subprocess.run(
        ["/bin/bash", str(hook)], input=payload, text=True, capture_output=True, env=env
    )
    assert result.returncode == expected, (payload, result.returncode, result.stderr)
    if expected == 2:
        assert result.stderr.startswith("BLOCKED:"), result.stderr


for command in (
    "git push origin main",
    "git push --force-with-lease origin main",
    "git -C /tmp/example push origin main",
    "git -c core.pager=cat --no-pager push",
    "git --git-dir=/tmp/example push",
    "git  push",
    "git status;git push",
    "git status\ngit push",
    "git \\\npush origin main",
    "git pu\\\nsh origin main",
    "git reset --ha\\\nrd HEAD",
    "git reset --hard HEAD",
    "git clean -xdf",
    "git clean --force",
    "git branch -D topic",
    "git branch -df topic",
    "git branch -vD topic",
    "git branch --delete --force topic",
    "git checkout -- .",
    "git restore .",
):
    check(json.dumps({"tool_input": {"command": command}}), 2)

for command in (
    "git status",
    "git diff",
    "git -C /tmp/example status",
    "git branch -d merged-topic",
    "git reset --soft HEAD~1",
    "echo 'git push origin main'",
    'echo ""',
    "git reset --soft HEAD; echo --hard",
):
    check(json.dumps({"tool_input": {"command": command}}), 0)

for payload in ("", "{", "{}", "[]", '{"tool_input":{"command":null}}'):
    check(payload, 2)
check('{"tool_input":{"command":"git status"}}', 2, {**os.environ, "PATH": ""})
check('{"tool_input":{"command":"git \\\""}}', 2)
print("Guardrail checks passed")