// @hover-dev/pentest widget contribution — registers with the Hover widget
// host when RED pentest mode is engaged. Its whole job is to surface the
// "Findings report" entry in the Result card's Save-as menu; the report is
// written server-side by the plugin's `save:pentest:report` handler from the
// checks recorded in this session.
//
// Deliberately ships NO css: the red engaged theme (#dc2626) is driven by the
// core widget's `--mode-accent` plumbing (the mode declares `accent` in its
// manifest), so unlike @hover-dev/security this plugin doesn't hardcode its
// colour. Runs inside the widget's Shadow DOM as a <script type="module">.
//
// Fail-silent contract — every callback runs inside the host's try/catch.

const host = window.__HOVER_WIDGET__;
if (host) {
  host.registerPlugin({
    apiVersion: 1,
    name: '@hover-dev/pentest',
    modeId: 'pentest',

    // No css — core `--mode-accent` (#dc2626) themes the engaged chrome.
    // No toolbarButtons / overlays yet — the chat + Save dropdown are the
    // whole surface for v1 (a captured-probe panel is a follow-up).

    saveEntries: [{
      type: 'save:pentest:report',
      label: 'Findings report',
      sub: '__vibe_tests__/<slug>.security-report.md · findings + severity + PoC + what was NOT tested',
      title: 'Save findings report',
      fields: [
        { id: 'name', label: 'Report name', placeholder: 'checkout-scan', required: true },
      ],
      confirmLabel: 'Save report',
      successMsgTemplate: '✓ saved findings report "{name}" → {path}',
    }],

    onMessage: {
      // Each recordable probe the agent runs broadcasts a check. Track them so
      // a future badge can show "agent recorded N probes" before saving.
      'pentest:check:recorded': (payload, api) => {
        if (!payload || typeof payload !== 'object' || typeof payload.id !== 'number') return;
        const checks = api.getState()['@hover-dev/pentest']?.checks ?? [];
        api.setState({ checks: [...checks, payload] });
      },
    },

    onDeactivate: (api) => {
      // Clean slate on leaving pentest mode.
      api.setState({ checks: [] });
    },
  });
}
