import type { Tool, ToolAnnotations } from '@modelcontextprotocol/server';

export const POD_EXEC_TOOL_NAME = 'kube_pod_exec';
export const PORT_FORWARD_TOOL_NAME = 'kube_port_forward';

export const PERMANENT_CODE_MODE_DENIALS = [POD_EXEC_TOOL_NAME] as const;
export const DEFAULT_CODE_MODE_DISABLED_TOOLS = [PORT_FORWARD_TOOL_NAME] as const;

export interface DisabledToolInfo {
  name: string;
  reason: string;
  configurable: boolean;
}

export function normalizeToolName(toolName: string): string {
  const segments = toolName.split('__');
  return segments[segments.length - 1] ?? toolName;
}

export function readOnlyAnnotations(title: string, openWorldHint = false): ToolAnnotations {
  return {
    title,
    readOnlyHint: true,
    destructiveHint: false,
    idempotentHint: true,
    openWorldHint,
  };
}

export function annotateReadOnlyTool(tool: Tool, title?: string): Tool {
  return {
    ...tool,
    title: title ?? tool.title,
    annotations: {
      ...readOnlyAnnotations(title ?? tool.title ?? tool.name),
      ...tool.annotations,
    },
  };
}

export function disabledToolDetails(configurable: Iterable<string>): DisabledToolInfo[] {
  const details: DisabledToolInfo[] = [
    {
      name: POD_EXEC_TOOL_NAME,
      reason: 'Pod exec is permanently excluded from run_code and requires per-call approval.',
      configurable: false,
    },
  ];

  for (const name of configurable) {
    if (normalizeToolName(name) === POD_EXEC_TOOL_NAME) continue;
    details.push({
      name: normalizeToolName(name),
      reason: 'Disabled by the code-mode tool policy.',
      configurable: true,
    });
  }

  return details;
}