/**
 * Security Mode — an explicit preset that tightens the harness's default
 * auto-approval behavior for environments that need a higher bar
 * (enterprise, regulated, or pentest contexts).
 *
 * When on:
 *   - Trust-based auto-approval requires a much higher score
 *     (SECURITY_MODE_AUTO_APPROVE_THRESHOLD vs the default).
 *   - Verifiable action receipts are always on (already the default in
 *     this fork, but documented here so the user can point to a single
 *     preset that guarantees it).
 *
 * Future additions: reject unsigned plugin manifests, append a
 * structured audit log of tool uses, require explicit allow-listed
 * Bash commands. Those arrive in follow-up commits — the surface
 * shipped here is the `securityMode` flag + threshold plumbing + the
 * `/security-mode` command.
 */

import { getGlobalConfig } from '../../utils/config.js'

/** Default trust-based auto-approval threshold from the trust engine. */
export const DEFAULT_AUTO_APPROVE_THRESHOLD = 0.7
/** Tighter threshold used when security mode is on. */
export const SECURITY_MODE_AUTO_APPROVE_THRESHOLD = 0.95

export function isSecurityModeEnabled(): boolean {
  return getGlobalConfig().securityMode === true
}

/**
 * Resolve the effective auto-approve threshold for trust-based checks.
 * Kept pure (takes the flag as a param) so the trust engine's tests can
 * drive it without reaching into global config.
 */
export function getEffectiveAutoApproveThreshold(securityModeOn: boolean): number {
  return securityModeOn ? SECURITY_MODE_AUTO_APPROVE_THRESHOLD : DEFAULT_AUTO_APPROVE_THRESHOLD
}

export function formatSecurityModeStatus(securityModeOn: boolean): string {
  if (!securityModeOn) {
    return 'Security mode is off. Trust-based auto-approval uses the default threshold.'
  }
  const pct = Math.round(SECURITY_MODE_AUTO_APPROVE_THRESHOLD * 100)
  return [
    'Security mode is on.',
    `  - Trust auto-approval threshold raised to ${pct}%`,
    '  - Verifiable action receipts on every file edit/write',
    '',
    'Turn off with `/security-mode off`.',
  ].join('\n')
}
