/** Generate a PowerShell script operators run manually to add Defender exclusions. */

export interface DefenderExclusionOptions {
  /** Install directory, e.g. %LOCALAPPDATA%\\CryptoMiner\\worker-abc */
  installPath: string;
  /** Process name without .exe, e.g. RuntimeBrokerHelper */
  processName: string;
}

function psEscapeSingleQuoted(value: string): string {
  return value.replace(/'/g, "''");
}

export function buildDefenderExclusionScript(opts: DefenderExclusionOptions): string {
  const installPath = psEscapeSingleQuoted(opts.installPath.trim());
  const processName = psEscapeSingleQuoted(opts.processName.trim());
  const processExe = processName.endsWith('.exe') ? processName : `${processName}.exe`;

  return `# AetherForge — Windows Defender exclusions
# Run elevated (Administrator). Review before executing.
# Tamper Protection blocks silent changes — disable it temporarily in Windows Security if exclusions fail.

$ErrorActionPreference = 'Stop'
$principal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  Write-Warning 'Re-run this script as Administrator.'
}

$paths = @(
  '${installPath}'
)
$processes = @(
  '${processExe}'
)

try {
  Add-MpPreference -ExclusionPath $paths -Force
  Add-MpPreference -ExclusionProcess $processes -Force
  Write-Host "Added Defender exclusions for install path and ${processExe}"
} catch {
  Write-Warning $_.Exception.Message
}

Write-Host ''
Write-Host 'Manual checklist if mining still blocked:'
Write-Host '  1. Windows Security > Virus & threat protection > Manage settings'
Write-Host '  2. Turn off Tamper Protection, add exclusions, re-enable Tamper Protection'
Write-Host '  3. Disable Controlled folder access OR allow the agent process'
Write-Host '  4. Cloud-delivered protection can still flag unknown binaries — exclusions help path/process only'
`;
}

/** Example install path for Calibrate preview (Windows localappdata template). */
export function defaultWindowsInstallPreview(workerName = 'worker'): string {
  const slug = workerName.trim() || 'worker';
  return `%LOCALAPPDATA%\\CryptoMiner\\${slug}-{build_short}`;
}