"""代码安全审计"""

from __future__ import annotations

import logging
import re
from pathlib import Path

logger = logging.getLogger(__name__)

# 禁止的危险模式
DANGEROUS_PATTERNS = [
    r"os\.system\s*\(",
    r"subprocess\.call\s*\(.*shell\s*=\s*True",
    r"rm\s+-rf",
    r"eval\s*\(",
    r"exec\s*\(",
    r"__import__\s*\(",
]


class Auditor:
    """对 Agent 生成的代码进行安全检查"""

    def audit(self, tool_dir: Path) -> list[str]:
        """扫描目录下所有 .py 文件，返回安全问题列表"""
        issues: list[str] = []
        for py_file in tool_dir.rglob("*.py"):
            content = py_file.read_text(encoding="utf-8")
            for pattern in DANGEROUS_PATTERNS:
                matches = re.findall(pattern, content)
                if matches:
                    issues.append(f"{py_file.name}: found dangerous pattern '{pattern}'")
        return issues
