# Default destructive command pattern catalogue (issue #36).
#
# Format: <name>\t<severity>\t<regex>
# Fields are TAB-separated. Lines starting with # and blank lines are ignored.
# Regexes compile with Pattern.CASE_INSENSITIVE.
#
# Severities (drive default ToolCallAction mapping):
#   CRITICAL → block()  — catastrophic / system-wide damage
#   HIGH     → block()  — likely permanent local damage
#   MEDIUM   → guide()  — significant but recoverable; needs confirmation
#   LOW      → allow()  — nuisance only; logged
#
# Operators add custom patterns by passing additional resources to
# DestructiveCommandDetector.Builder.additionalPatternsResource(...).

# ── rm family ──────────────────────────────────────────────────────────
rm_rf_root	CRITICAL	\brm\s+(-[rfRF]+\s+)+(/|/\*|/\s|~/?\s?$)
rm_rf_force	HIGH	\brm\s+(-[rfRF]+\s+)+(?!/)\S

# ── git destructive ────────────────────────────────────────────────────
git_reset_hard	HIGH	\bgit\s+reset\s+--hard\b
git_clean_force	HIGH	\bgit\s+clean\s+(-[fdxFDX]+|--force)\b
git_push_force	HIGH	\bgit\s+push\s+(--force\b|-f\b)
git_branch_delete_force	MEDIUM	\bgit\s+branch\s+(-D|--delete\s+--force)\b

# ── filesystem device-level ────────────────────────────────────────────
dd_to_device	CRITICAL	\bdd\s+(if|of)=.*?(/dev/|of=/dev/)
mkfs_any	CRITICAL	\bmkfs(\.\w+)?\s+/dev/

# ── permissions ────────────────────────────────────────────────────────
chmod_world	MEDIUM	\bchmod\s+(-R\s+)?[0-7]?777\b
chmod_zero	HIGH	\bchmod\s+(-R\s+)?[0-7]?000\b

# ── kill broadcasts ────────────────────────────────────────────────────
kill_dash_nine	MEDIUM	\b(killall\s+-9|kill\s+-9\s+-1\b)
killall_force	MEDIUM	\bkillall\s+-9\s+\S+

# ── system file overwrite redirects ────────────────────────────────────
overwrite_etc	CRITICAL	(>|>>)\s*/etc/[\w.-]+
overwrite_ssh	CRITICAL	(>|>>)\s*~/\.ssh/[\w.-]+
overwrite_root_home	HIGH	(>|>>)\s*/root/\.[\w.-]+

# ── package manager / system mutations ─────────────────────────────────
sudo_rm	HIGH	\bsudo\s+rm\b
sudo_dd	CRITICAL	\bsudo\s+dd\b
shutdown_now	MEDIUM	\bshutdown\s+(-h\s+)?(now\b|0\b)
reboot_now	MEDIUM	\b(reboot|halt|poweroff)\s+(-f\b|--force\b|now\b)?

# ── cryptographic erasure ──────────────────────────────────────────────
shred_recursive	HIGH	\bshred\s+(-[rfu]+\s+)*-?[rRfFuU]+\s
wipefs_force	HIGH	\bwipefs\s+(-[afA]+|--force|--all)
