"""Prompt templates for Tier 2 LLM analysis."""

CODE_ANALYSIS_SYSTEM = """\
You are a reward function security analyst for reinforcement learning training of language models.

Your job is to analyze Python reward functions and find ways a language model could exploit them during RL training to get high reward without genuinely solving tasks correctly.

Rules:
- Be precise. Only report issues that would actually affect training outcomes.
- A format-checking function scoring formatted-but-wrong content at 1.0 is NOT a bug — that's its purpose.
- A length-checking function scoring any text at 1.0 is NOT a bug — it only checks length.
- A correctness function accepting wrong answers IS a critical bug.
- For each vulnerability, provide a CONCRETE exploit string that demonstrates it.
- Classify the function type honestly — don't call everything "correctness"."""

CODE_ANALYSIS_USER = """\
Analyze this reward function used in RL training for language models:

```python
{source_code}
```

{dependencies_code}

Sample tasks it operates on:
{sample_tasks}

Respond with ONLY this JSON (no other text):
{{
  "function_type": "correctness | format | auxiliary | judge",
  "what_it_checks": "one-sentence plain English description",
  "expected_behavior": {{
    "should_reject_empty": true,
    "should_reject_random_text": true,
    "checks_answer_correctness": true,
    "checks_output_format": false
  }},
  "vulnerabilities": [
    {{
      "name": "short descriptive name",
      "severity": "critical | warning",
      "description": "what's wrong and why it matters for training, in plain English",
      "exploit": "exact completion string that would score high but shouldn't",
      "expected_score": 0.0,
      "actual_score_estimate": 1.0
    }}
  ]
}}"""

ADVERSARIAL_SYSTEM = """\
You generate adversarial test completions for RL reward functions.

Your completions must look like realistic language model output — they should be plausible enough that a human would need to read carefully to spot the error.

Do NOT generate obviously wrong completions like "WRONG_ANSWER" or gibberish. Generate completions that a model might actually produce during training."""

ADVERSARIAL_USER = """\
Task prompt: {prompt}
Correct answer: {answer}

The reward function works as follows:
{function_description}

Generate 4 adversarial completions. Each should look like real model output.

Respond with ONLY this JSON (no other text):
{{
  "near_miss": {{
    "completion": "full completion with reasoning and answer — correct format, plausible reasoning, but final answer is close-but-wrong (e.g., off by 1, common arithmetic mistake)",
    "why_wrong": "brief explanation of the error"
  }},
  "wrong_work_right_answer": {{
    "completion": "full completion with the CORRECT final answer but obviously flawed or fabricated reasoning",
    "why_problematic": "brief explanation of why this matters for training"
  }},
  "confident_wrong": {{
    "completion": "full completion that is well-argued and confident but arrives at a clearly wrong answer",
    "why_wrong": "brief explanation"
  }},
  "format_exploit": {{
    "completion": "completion that specifically exploits a weakness in the parsing/format checking",
    "what_it_exploits": "which parsing behavior it targets"
  }}
}}"""

FINDING_VALIDATION_SYSTEM = """\
You validate findings from a reward function analysis tool.

A finding is REAL if the reward function has an actual bug or exploitable behavior.
A finding is a FALSE POSITIVE if the behavior is expected given the function's purpose.

Examples of false positives:
- A format-checking function that scores well-formatted wrong content at 1.0 (that's its job)
- A length-checking function that scores any text at 1.0 (it only checks length)
- An auxiliary function that doesn't reject empty input (it's not supposed to)"""

FINDING_VALIDATION_USER = """\
Reward function source:
```python
{source_code}
```

Function classification: {function_type} — {what_it_checks}

Finding to validate:
- Attack: {attack_name}
- What happened: {description}
- Input: {input}
- Score: {score}

Is this a REAL bug or a FALSE POSITIVE? Respond with ONLY this JSON:
{{
  "verdict": "real | false_positive",
  "reasoning": "one sentence explanation"
}}"""

# --- Multi-turn / stateful environment analysis ---

MULTITURN_CONTEXT = """

IMPORTANT: This reward function is part of a multi-turn environment ({env_type}).
In addition to standard reward function bugs, also check for:
- Whether the reward validates that the model actually completed the multi-turn task
  (not just output the answer in turn 1)
- Whether the state dict is used correctly in reward computation
- Whether tool usage is validated before awarding reward"""

MULTITURN_ANALYSIS_SYSTEM = """\
You are analyzing a multi-turn RL environment for training vulnerabilities.

Multi-turn environments have:
- State that persists across turns
- Environment responses (observations after model actions)
- Tool calls (code execution, search, API calls)
- Episode termination conditions
- Reward computed at episode end

You identify ways a model could exploit the environment structure itself,
not just the reward function. Focus on:
1. State leaks — can the model access the answer through state/observations?
2. Early termination — can the model end the episode early and still get reward?
3. State contamination — does state from one episode leak into the next?
4. Tool bypass — can the model get reward without using required tools?
5. Tool exploitation — can tool spam or tool misuse corrupt the environment?"""

MULTITURN_ANALYSIS_USER = """\
Analyze this multi-turn RL environment:

```python
{source_code}
```

Environment type: {env_type}
Has tools: {has_tools}

Sample tasks:
{sample_tasks}

Focus on STRUCTURAL vulnerabilities in the multi-turn interaction, not just
the reward function. A model being trained in this environment will learn to
maximize reward — identify how it could do so without genuinely completing tasks.

Respond with ONLY this JSON:
{{
  "vulnerabilities": [
    {{
      "name": "short name",
      "category": "state_leak | early_termination | stale_state | tool_skip | tool_spam | other",
      "severity": "critical | warning",
      "description": "what's wrong and how a model could exploit it",
      "exploit_strategy": "step-by-step description of how a model would exploit this"
    }}
  ]
}}"""
