<?php
// Read-only endpoint: return full content of any script in SCRIPTS_DIR.
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/config.php';

$id = trim($_GET['id'] ?? '');

// Must be relative path within SCRIPTS_DIR, no traversal, must end in .sh or .md
if (!$id || str_contains($id, '..') || !preg_match('/^[A-Za-z0-9_.\-\/]+\.(sh|md)$/', $id)) {
    echo json_encode(['ok' => false, 'error' => 'Invalid id']);
    exit;
}

$path = SCRIPTS_DIR . '/' . $id;
if (!file_exists($path)) {
    echo json_encode(['ok' => false, 'error' => 'Not found']);
    exit;
}

echo json_encode(['ok' => true, 'content' => file_get_contents($path)]);