"""
CyberBrain26 - execution policy pro SAFE/FULL
Konzervativní klasifikace akcí.
"""

import re
from typing import Tuple, List

ActionCategory = str

READ_ONLY_COMMANDS = {
    "pwd", "ls", "dir", "find", "locate", "which", "whereis",
    "cat", "head", "tail", "less", "more", "stat", "file",
    "grep", "egrep", "fgrep", "zgrep",
    "wc", "sort", "uniq", "cut", "paste", "tr", "awk", "sed",
    "git status", "git diff", "git log", "git show", "git branch",
    "ps", "top", "htop", "uptime", "free", "df", "du",
    "env", "printenv", "echo", "printf",
    "python -m py_compile", "python -c",
}

WRITE_COMMANDS = {
    "touch", "mkdir", "cp", "mv", "rename",
    "echo >", "cat >", "tee",
    "git add", "git commit", "git checkout", "git merge", "git rebase",
    "pip install", "pip uninstall", "pipx install",
    "apt install", "apt remove", "apt upgrade",
    "npm install", "npm uninstall",
    "curl -o", "curl -O", "wget", "git clone",
}

DELETE_COMMANDS = {
    "rm", "rmdir", "shred",
    "git reset --hard", "git clean",
}

SUDO_COMMANDS = {"sudo", "su"}

def classify_shell(command: str) -> ActionCategory:
    cmd = command.strip()
    if not cmd:
        return "empty"
    cmd_lower = cmd.lower()
    for kw in SUDO_COMMANDS:
        if cmd_lower.startswith(kw + " "):
            return "privileged"
    for kw in DELETE_COMMANDS:
        if kw in cmd_lower:
            return "delete"
    for kw in WRITE_COMMANDS:
        if kw in cmd_lower:
            return "write"
    for kw in READ_ONLY_COMMANDS:
        if cmd_lower.startswith(kw + " ") or cmd_lower == kw:
            return "read"
    return "unknown"

def classify_python(code: str) -> ActionCategory:
    c = code
    if re.search(r"open\s*\([^)]*[\'\"]w", c):
        return "write"
    if re.search(r"Path\s*\([^)]*\)\.write", c):
        return "write"
    if re.search(r"shutil\.rmtree|os\.rmdir|os\.remove|os\.unlink", c):
        return "delete"
    if re.search(r"subprocess\.|os\.system|os\.popen", c):
        return "shell"
    if re.search(r"requests\.|urllib\.|httpx\.", c):
        return "network"
    if re.search(r"import\s+computer", c):
        return "computer_api"
    return "unknown"

def classify_action(code: str, language: str) -> Tuple[ActionCategory, List[str]]:
    lang = (language or "").strip().lower()
    if lang in ("python", "py"):
        cat = classify_python(code)
    elif lang in ("javascript", "js", "typescript", "ts"):
        cat = "unknown"
    elif lang in ("shell", "bash", "sh"):
        cat = classify_shell(code)
    else:
        cat = "unknown"
    reasons = []
    if cat == "privileged":
        reasons.append("sudo nebo su")
    elif cat == "delete":
        reasons.append("mazání souborů nebo složek")
    elif cat == "write":
        reasons.append("zápis nebo změna souborů")
    elif cat == "network":
        reasons.append("síťová komunikace")
    elif cat == "shell":
        reasons.append("spouštění shell příkazů")
    elif cat == "computer_api":
        reasons.append("použití computer API")
    elif cat == "read":
        reasons.append("pouze čtení")
    else:
        reasons.append("neznámá akce")
    return cat, reasons