#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

scan_files=(
  "$ROOT_DIR/internal/axinput"
  "$ROOT_DIR/internal/textoutput"
  "$ROOT_DIR/services/text_output_service.go"
  "$ROOT_DIR/app.go"
  "$ROOT_DIR/frontend/src/components/settings/GeneralPage.svelte"
)

matches="$(rg -n 'InputMethod|InputMethodKit|TIS|CGEventPost|NSEvent\.addGlobalMonitor|addGlobalMonitorForEvents|CGRequestListenEventAccess|CGPreflightListenEventAccess|NSAppleEventDescriptor|AEDesc|NSAppleScript|/Library/Input Methods|~/Library/Input Methods|TISEnableInputSource|TISSelectInputSource|TestFlight|notarytool|altool|git tag|codebase-memory|release manifest' "${scan_files[@]}" || true)"
forbidden="$(printf '%s\n' "$matches" | grep -v 'AX10DT_EXPERIMENT_ALLOW_CGEVENTPOST' || true)"
if [ -n "$forbidden" ]; then
  printf '%s\n' "$forbidden"
  echo "FAIL: AX output boundary scan found a forbidden route or release action" >&2
  exit 1
fi

echo "PASS: AX output boundary scan found no IMK/TIS, non-experiment event injection, global monitor, input-monitoring, automation, system input-method install, or release action in AX output files"