#!/usr/bin/env node
/**
 * T3MP3ST as OBSIDIVM agent — :8889 PLINY CODE protocol shim.
 *
 * OBSIDIVM's warroom + evolve.py expect an external agent server at :8889
 * with this contract:
 *   POST /api/launch       { prompt }            → { id, session_id }
 *   GET  /api/sessions                            → { sessions: [...] }
 *   GET  /api/session/log?id=<sid>                → { id, status, lines: [...] }
 *   GET  /api/events                              → SSE stream
 *   POST /api/stop-all                            → { ok }
 *
 * This shim translates each of those into t3mp3st operations:
 *   - /api/launch    → POST t3mp3st /api/general/auto with the prompt as
 *                       objective + extracted target URL as scope hint.
 *                       Auto-clears approval gates. Maps t3mp3st missionName
 *                       (codename) to an internal session_id.
 *   - /api/sessions  → returns the in-memory session map, augmented with
 *                       live status from t3mp3st findings/sitreps ledgers.
 *   - /api/session/log → fetches t3mp3st findings + sitreps + evidence for
 *                       the mapped mission and returns them as a transcript
 *                       OBSIDIVM's scorer can consume.
 *   - /api/events    → bridges t3mp3st's SSE feed (best-effort) and emits
 *                       periodic heartbeats.
 *   - /api/stop-all  → marks all sessions stopped (t3mp3st doesn't expose
 *                       a kill API; the mission flag is local).
 *
 * Usage:
 *   node scripts/obsidivm-agent.mjs                       # default ports
 *   node scripts/obsidivm-agent.mjs --port 8889 \
 *                                   --t3mp3st http://127.0.0.1:3333
 *   node scripts/obsidivm-agent.mjs --verbose
 *
 * Env:
 *   T3MP3ST_API_URL   default http://127.0.0.1:3333
 *   AGENT_PORT        default 8889
 *   OPENROUTER_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY
 *     (auto-detected from env, .env at repo root, or macOS Keychain)
 */

import http from 'node:http';
import fs   from 'node:fs';
import path from 'node:path';
import { execFileSync } from 'node:child_process';
import { fileURLToPath } from 'node:url';
import { randomUUID } from 'node:crypto';

const __filename = fileURLToPath(import.meta.url);
const __dirname  = path.dirname(__filename);
const REPO       = path.resolve(__dirname, '..');

// ----- key loading (same surface as cve-hunt-bench) ----------------------

try {
  const envPath = path.join(REPO, '.env');
  if (fs.existsSync(envPath)) {
    for (const line of fs.readFileSync(envPath, 'utf8').split('\n')) {
      const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);
      if (!m || line.trim().startsWith('#')) continue;
      let v = m[2];
      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) v = v.slice(1, -1);
      if (!process.env[m[1]]) process.env[m[1]] = v;
    }
  }
} catch {}
if (process.platform === 'darwin') {
  for (const name of ['OPENROUTER_API_KEY', 'ANTHROPIC_API_KEY', 'OPENAI_API_KEY']) {
    if (process.env[name]) continue;
    try {
      const v = execFileSync('security', ['find-generic-password', '-a', name, '-s', 't3mp3st-bench-keys', '-w'],
        { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
      if (v) process.env[name] = v;
    } catch {}
  }
}

function detectProvider() {
  if (process.env.OPENROUTER_API_KEY) return { provider: 'openrouter', apiKey: process.env.OPENROUTER_API_KEY };
  if (process.env.ANTHROPIC_API_KEY)  return { provider: 'anthropic',  apiKey: process.env.ANTHROPIC_API_KEY  };
  if (process.env.OPENAI_API_KEY)     return { provider: 'openai',     apiKey: process.env.OPENAI_API_KEY     };
  return null;
}

// ----- args ----------------------------------------------------------------

function parseArgs(argv) {
  const a = {
    port: parseInt(process.env.AGENT_PORT || '8889', 10),
    t3mp3st: process.env.T3MP3ST_API_URL || 'http://127.0.0.1:3333',
    model: 'claude-opus-4-7',
    verbose: false,
  };
  for (let i = 0; i < argv.length; i++) {
    const k = argv[i];
    if      (k === '--port')    a.port = parseInt(argv[++i], 10);
    else if (k === '--t3mp3st') a.t3mp3st = argv[++i];
    else if (k === '--model')   a.model = argv[++i];
    else if (k === '-v' || k === '--verbose') a.verbose = true;
    else if (k === '-h' || k === '--help')    { help(); process.exit(0); }
  }
  return a;
}

function help() {
  console.log(`t3mp3st-as-OBSIDIVM-agent (:8889 shim)

  --port <n>          Listen port (default 8889; what warroom expects)
  --t3mp3st <url>     t3mp3st base URL (default http://127.0.0.1:3333)
  --model <name>      LLM model (default claude-opus-4-7)
  -v, --verbose
`);
}

// ----- session state -------------------------------------------------------

const sessions = new Map();
// sessions: id → {
//   id, prompt, target_url, target_id, cmd,
//   missionId, plan, status, started_at, ended_at,
//   log_lines: string[],
// }

const sseClients = new Set();
function broadcastSSE(eventName, data) {
  const payload = `event: ${eventName}\ndata: ${JSON.stringify(data)}\n\n`;
  for (const res of sseClients) {
    try { res.write(payload); } catch {}
  }
}

// ----- prompt parsing ------------------------------------------------------

function extractTargetUrl(prompt) {
  if (!prompt) return null;
  const m = prompt.match(/https?:\/\/[^\s'"<>]+/i);
  return m ? m[0] : null;
}

function extractCommand(prompt) {
  if (!prompt) return null;
  const m = prompt.match(/^\s*\/(\w[-\w:]*)/);
  return m ? '/' + m[1] : null;
}

// ----- t3mp3st client ------------------------------------------------------

function normalizeModel(model, provider) {
  if (provider === 'openrouter') {
    if (model.includes('/')) return model;
    if (/^claude/i.test(model)) return `anthropic/${model}`;
    if (/^gpt|^o[1-9]/i.test(model)) return `openai/${model}`;
    return `anthropic/${model}`;
  }
  if (provider === 'anthropic') return model.replace(/^anthropic\//i, '');
  if (provider === 'openai')    return model.replace(/^openai\//i, '');
  return model;
}

async function dispatchT3mp3stMission(prompt, opts) {
  const provider = detectProvider();
  if (!provider) throw new Error('no LLM key in env/Keychain/.env');

  const targetUrl = extractTargetUrl(prompt);
  const command = extractCommand(prompt);
  const objective = `Authorized OBSIDIVM-range pentest dispatched by warroom.

Operator command: ${command || '(none)'}
Target: ${targetUrl || '(no URL extracted)'}

Full prompt:
${prompt}

Produce a structured transcript covering every distinct vulnerability you confirm: payloads, paths, observed responses, severity. The output will be auto-scored against OBSIDIVM's canonical expected-findings list.`;

  const body = {
    objective,
    apiKey: provider.apiKey,
    provider: provider.provider,
    model: normalizeModel(opts.model, provider.provider),
    urgency: 'normal',
    opsecPreference: 'standard',
    scopeHints: targetUrl ? [targetUrl] : undefined,
  };

  const url = `${opts.t3mp3st}/api/general/auto`;
  const call = async () => {
    const r = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
    return { status: r.status, ok: r.ok, body: await r.text() };
  };

  let attempt = await call();
  for (let i = 0; i < 4 && !attempt.ok; i++) {
    let approvalId = null;
    try { approvalId = JSON.parse(attempt.body)?.approval?.id; } catch {}
    if (!approvalId) break;
    const ar = await fetch(`${opts.t3mp3st}/api/approvals/${approvalId}/approve`, {
      method: 'POST', headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ approvedBy: 'obsidivm-agent', ttlMinutes: 30 }),
    });
    if (!ar.ok) break;
    body.approvalId = approvalId;
    attempt = await call();
  }
  if (!attempt.ok) throw new Error(`t3mp3st auto failed ${attempt.status}: ${attempt.body.slice(0, 200)}`);
  return { data: JSON.parse(attempt.body), targetUrl, command };
}

async function fetchT3mp3stMissionState(opts, missionId) {
  const [findings, evidence, sitreps] = await Promise.all([
    fetch(`${opts.t3mp3st}/api/findings`).then(r => r.json()).catch(() => ({ findings: [] })),
    fetch(`${opts.t3mp3st}/api/evidence`).then(r => r.json()).catch(() => ({ evidence: [] })),
    fetch(`${opts.t3mp3st}/api/general/sitreps`).then(r => r.json()).catch(() => ({ sitreps: [] })),
  ]);
  return {
    findings: (findings.findings || []).filter(f => !missionId || f.missionId === missionId),
    evidence: (evidence.evidence || []).filter(e => !missionId || e.missionId === missionId),
    sitreps:  (sitreps.sitreps  || []),
  };
}

function buildTranscript(session, state) {
  const lines = [];
  lines.push(`# T3MP3ST mission ${session.missionId || ''}`);
  lines.push(`Target: ${session.target_url || '(none)'}`);
  lines.push(`Command: ${session.cmd || '(none)'}`);
  lines.push(`Status: ${session.status}`);
  lines.push('');
  if (session.plan) {
    lines.push('## Plan');
    lines.push(JSON.stringify(session.plan, null, 2).slice(0, 1500));
    lines.push('');
  }
  lines.push('## Findings');
  if (!state.findings.length) lines.push('_(none yet)_');
  for (const f of state.findings) {
    lines.push(`- [${(f.severity || 'info').toUpperCase()}] ${f.title}`);
    if (f.claim)  lines.push(`  ${f.claim}`);
    if (f.impact) lines.push(`  Impact: ${f.impact}`);
  }
  lines.push('');
  lines.push('## Evidence');
  if (!state.evidence.length) lines.push('_(none yet)_');
  for (const e of state.evidence) {
    lines.push(`- ${e.title || ''}: ${e.summary || ''}`);
    if (e.command) lines.push(`  cmd: ${e.command}`);
  }
  lines.push('');
  lines.push('## Sitreps');
  for (const s of state.sitreps.slice(-10)) {
    lines.push(`- ${s.timestamp || ''}: ${s.summary || JSON.stringify(s).slice(0, 200)}`);
  }
  lines.push('');
  // Also include any synthetic log lines the agent has recorded.
  if (session.log_lines.length) {
    lines.push('## Agent log');
    lines.push(...session.log_lines);
  }
  return lines.join('\n');
}

// ----- HTTP routing --------------------------------------------------------

function sendJSON(res, code, obj) {
  const body = JSON.stringify(obj);
  res.writeHead(code, {
    'content-type': 'application/json',
    'access-control-allow-origin': '*',
    'access-control-allow-headers': 'content-type',
    'access-control-allow-methods': 'GET,POST,OPTIONS',
  });
  res.end(body);
}

function readBody(req) {
  return new Promise((resolve, reject) => {
    let data = '';
    req.on('data', c => { data += c; });
    req.on('end', () => resolve(data));
    req.on('error', reject);
  });
}

function makeServer(opts) {
  return http.createServer(async (req, res) => {
    const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
    const path = url.pathname;

    // CORS preflight
    if (req.method === 'OPTIONS') {
      res.writeHead(204, {
        'access-control-allow-origin': '*',
        'access-control-allow-headers': 'content-type',
        'access-control-allow-methods': 'GET,POST,OPTIONS',
      });
      res.end();
      return;
    }

    try {
      // -------- /api/launch -------------------------------------------------
      if (req.method === 'POST' && path === '/api/launch') {
        const raw = await readBody(req);
        const body = raw ? JSON.parse(raw) : {};
        const prompt = String(body.prompt || body.command || '');

        const id = `s-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
        const session = {
          id,
          prompt,
          target_url: extractTargetUrl(prompt),
          target_id: body.target_id || null,
          cmd: extractCommand(prompt),
          missionId: null,
          plan: null,
          status: 'launching',
          started_at: Date.now(),
          ended_at: null,
          log_lines: [],
        };
        sessions.set(id, session);
        broadcastSSE('session_started', { id, prompt, target: session.target_url });

        // Async: dispatch the t3mp3st mission, update session as it progresses.
        (async () => {
          try {
            const { data, targetUrl, command } = await dispatchT3mp3stMission(prompt, opts);
            session.target_url = session.target_url || targetUrl;
            session.cmd = session.cmd || command;
            session.missionId = data?.execution?.missionName || data?.plan?.codename || null;
            session.plan = data?.plan || null;
            session.status = 'running';
            session.log_lines.push(`[${new Date().toISOString()}] t3mp3st mission dispatched: ${session.missionId}`);
            broadcastSSE('session_dispatched', { id, missionId: session.missionId });
          } catch (e) {
            session.status = 'failed';
            session.ended_at = Date.now();
            session.log_lines.push(`[${new Date().toISOString()}] ERROR: ${e.message}`);
            broadcastSSE('session_failed', { id, error: e.message });
            if (opts.verbose) console.error(`launch ${id}: ${e.message}`);
          }
        })();

        sendJSON(res, 200, { id, session_id: id, status: 'launching' });
        return;
      }

      // -------- /api/sessions ----------------------------------------------
      if (req.method === 'GET' && path === '/api/sessions') {
        const list = [...sessions.values()].map(s => ({
          id: s.id,
          status: s.status,
          target: s.target_url,
          target_id: s.target_id,
          command: s.cmd,
          mission_id: s.missionId,
          started_at: s.started_at,
          ended_at: s.ended_at,
          log_line_count: s.log_lines.length,
        }));
        sendJSON(res, 200, { sessions: list });
        return;
      }

      // -------- /api/session/log -------------------------------------------
      if (req.method === 'GET' && path === '/api/session/log') {
        const id = url.searchParams.get('id');
        if (!id || !sessions.has(id)) return sendJSON(res, 404, { error: 'session not found' });
        const session = sessions.get(id);
        const state = await fetchT3mp3stMissionState(opts, session.missionId);
        const transcript = buildTranscript(session, state);
        sendJSON(res, 200, {
          id,
          status: session.status,
          mission_id: session.missionId,
          target: session.target_url,
          lines: transcript.split('\n'),
          text: transcript,
        });
        return;
      }

      // -------- /api/events (SSE) ------------------------------------------
      if (req.method === 'GET' && path === '/api/events') {
        res.writeHead(200, {
          'content-type': 'text/event-stream',
          'cache-control': 'no-cache',
          'connection': 'keep-alive',
          'access-control-allow-origin': '*',
        });
        res.write('event: ready\ndata: {"ok":true}\n\n');
        sseClients.add(res);
        const hb = setInterval(() => {
          try { res.write(`event: heartbeat\ndata: {"ts":${Date.now()},"sessions":${sessions.size}}\n\n`); }
          catch { clearInterval(hb); }
        }, 15000);
        req.on('close', () => { sseClients.delete(res); clearInterval(hb); });
        return;
      }

      // -------- /api/stop-all ----------------------------------------------
      if (req.method === 'POST' && path === '/api/stop-all') {
        for (const s of sessions.values()) {
          if (s.status === 'running' || s.status === 'launching') {
            s.status = 'stopped';
            s.ended_at = Date.now();
            s.log_lines.push(`[${new Date().toISOString()}] stopped by /api/stop-all`);
          }
        }
        broadcastSSE('stopped_all', { count: sessions.size });
        sendJSON(res, 200, { ok: true, stopped: sessions.size });
        return;
      }

      // -------- /health ----------------------------------------------------
      if (req.method === 'GET' && (path === '/health' || path === '/api/health')) {
        sendJSON(res, 200, {
          ok: true,
          shim: 't3mp3st-as-obsidivm-agent',
          t3mp3st: opts.t3mp3st,
          sessions: sessions.size,
          provider: detectProvider()?.provider || null,
        });
        return;
      }

      sendJSON(res, 404, { error: 'not found', path });
    } catch (e) {
      if (opts.verbose) console.error(`${req.method} ${path}: ${e.message}`);
      sendJSON(res, 500, { error: e.message });
    }
  });
}

async function main() {
  const opts = parseArgs(process.argv.slice(2));
  const provider = detectProvider();
  console.log(`t3mp3st-as-OBSIDIVM-agent`);
  console.log(`  listen   :${opts.port}  (OBSIDIVM warroom + evolve.py expect this)`);
  console.log(`  t3mp3st  ${opts.t3mp3st}`);
  console.log(`  provider ${provider ? provider.provider : '(none — launches will fail until you set OPENROUTER/ANTHROPIC/OPENAI key)'}`);
  console.log(`  model    ${opts.model}`);
  const server = makeServer(opts);
  server.listen(opts.port, () => {
    console.log(`ready — point OBSIDIVM warroom at http://localhost:${opts.port}`);
  });
}

main().catch(e => { console.error('FATAL:', e); process.exit(1); });