import type { Prompter } from './prompts.js';
import type { ConfigBuilder } from './config.js';

const TOOL_PROFILES = [
  { label: 'messaging (recommended)', value: 'messaging' },
  { label: 'minimal (status only)', value: 'minimal' },
  { label: 'coding (fs + runtime)', value: 'coding' },
  { label: 'full (unrestricted)', value: 'full' },
];

export async function setupSecurity(p: Prompter, builder: ConfigBuilder): Promise<void> {
  p.println('  Docker sandboxing runs tool commands in isolated containers.');
  p.println('  Requires Docker installed and running.');
  const sandbox = await p.confirm('Enable Docker sandboxing?', true);
  if (sandbox) {
    builder.setSandboxEnabled(true);
    p.println('✓ Docker sandboxing enabled');
  }

  p.println();
  p.println('  DM pairing requires unknown senders to enter a code before chatting.');
  p.println('  Generate codes via the gateway or TUI /pair command.');
  const pairing = await p.confirm('Enable DM pairing for unknown senders?', true);
  if (pairing) {
    builder.setPairingEnabled(true);
    p.println('✓ DM pairing enabled');
  }

  p.println();
  p.println('  Tool profiles control which tools the agent can use:');
  p.println('    full        — all tools available (file, shell, web, memory, messaging)');
  p.println('    coding      — file system + shell + sessions + memory');
  p.println('    messaging   — read-only + web/memory + connected services (no file writes/shell)');
  p.println('    minimal     — status checks only (read-only, safest)');
  const profile = await p.choose('Tool policy profile:', TOOL_PROFILES);
  builder.setToolProfile(profile);
}
