import { Koreshield } from "koreshield-sdk";

const koreshield = new Koreshield({
  apiKey: process.env.KORESHIELD_API_KEY,
  sensitivity: "high",
});

async function guardToolCall(agentId: string, tool: string, args: string) {
  const scan = await koreshield.scan({
    content: args,
    userId: agentId,
    metadata: {
      tool,
      environment: "prod",
      risk: "elevated",
    },
  });

  if (scan.threat_detected) {
    return { allowed: false, reason: scan.threat_type };
  }

  if (tool === "runShell" || tool === "deployService") {
    return { allowed: false, reason: "Requires approval" };
  }

  return { allowed: true };
}