"use strict";

const { CAPABILITY_STATUS } = require("../constants.cjs");

/**
 * Inspection domain capabilities — for AI agents (RCA + natural-language ops).
 * All read-only except runNow. write=true tools go through confirm gate.
 *
 * rule_id naming:
 *   - deviceId   — host id from Vault
 *   - alertId    — alert record id (alert_xxx)
 *   - limit      — max records to return
 */
const INSPECTION_CAPABILITIES = [
  {
    id: "inspection.alertDetail",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get full details of a single alert record by id.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionAlertDetail" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.hostAlerts",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List active alerts for a single device.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionHostAlerts" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.hostMetrics",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get the latest inspection metrics for a device (CPU, memory, disk, online status).",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionHostMetrics" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.hostRecentResults",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get recent inspection result history for a device.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionHostRecentResults" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.hostTopology",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get topology context for a device: online/offline peers and connected links.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionHostTopology" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.hostInfo",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get Vault host record for a device (hostname, platform, catalog, tier, labels).",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionHostInfo" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.runNow",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Run an immediate inspection on a device (synchronous, waits for result). Returns metrics.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: true,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionRunNow" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.runCommand",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Execute a single shell command on a device via SSH and return stdout/stderr. Used by RCA agent.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionRunCommand" },
      public: null,
      cli: null,
    },
  },
  {
    id: "inspection.allActiveAlerts",
    domain: "inspection",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get all currently active alerts (summary + counts by level).",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      builtin: { rpcMethod: "netcatty/inspectionAllActiveAlerts" },
      public: null,
      cli: null,
    },
  },
];

module.exports = { INSPECTION_CAPABILITIES };