'use strict';

const fs = require('fs');
const path = require('path');
const { execFileSync } = require('child_process');

const root = path.resolve(__dirname, '..');
const forbiddenPath = /(^|[\\/])(outputs?|messages|sessions?|logs?|knowledge-base[\\/]property-data)([\\/]|$)|(^|[\\/])(?:\.env\.local|.*\.db(?:-(?:shm|wal))?|.*\.log)$/i;
const verticalLeak = /小牛看房|xnfang|宋军/;
const sourceScan = /^(?:mcp[\\/]src[\\/]core|knowledge|scripts|runtime)[\\/]/i;
const skipScan = /(?:^|[\\/])validate-reusable-boundary\.js$/i;

const tracked = execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' }).split(/\r?\n/).filter(Boolean);
const pathIssues = tracked.filter(rel => forbiddenPath.test(rel));
const textIssues = [];
for (const rel of tracked) {
  if (!sourceScan.test(rel) || skipScan.test(rel) || !/\.(?:js|mjs|md)$/i.test(rel)) continue;
  const content = fs.readFileSync(path.join(root, rel), 'utf8');
  if (verticalLeak.test(content)) textIssues.push(`vertical leak: ${rel}`);
}

const issues = [...pathIssues.map(rel => `forbidden tracked path: ${rel}`), ...textIssues];
if (issues.length) {
  console.error(issues.join('\n'));
  process.exit(1);
}
console.log(`[ok] reusable boundary is clean (${tracked.length} tracked files checked)`);