/**
 * @license
 * Copyright 2025 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import fsPromises from 'node:fs/promises';
import fs from 'node:fs';
import path from 'node:path';
import os from 'node:os';
import crypto from 'node:crypto';
import { debugLogger } from '../index.js';
import { ToolErrorType } from './tool-error.js';
import { BaseDeclarativeTool, BaseToolInvocation, ToolConfirmationOutcome, Kind, } from './tools.js';
import { getErrorMessage } from '../utils/errors.js';
import { summarizeToolOutput } from '../utils/summarizer.js';
import { ShellExecutionService, } from '../services/shellExecutionService.js';
import { formatBytes } from '../utils/formatters.js';
import { getCommandRoots, initializeShellParsers, stripShellWrapper, parseCommandDetails, hasRedirection, } from '../utils/shell-utils.js';
import { SHELL_TOOL_NAME } from './tool-names.js';
import { PARAM_ADDITIONAL_PERMISSIONS } from './definitions/base-declarations.js';
import { getShellDefinition } from './definitions/coreTools.js';
import { resolveToolDeclaration } from './definitions/resolver.js';
export const OUTPUT_UPDATE_INTERVAL_MS = 1000;
// Delay so user does not see the output of the process before the process is moved to the background.
const BACKGROUND_DELAY_MS = 200;
export class ShellToolInvocation extends BaseToolInvocation {
    context;
    constructor(context, params, messageBus, _toolName, _toolDisplayName) {
        super(params, messageBus, _toolName, _toolDisplayName);
        this.context = context;
    }
    getContextualDetails() {
        let details = '';
        // append optional [in directory]
        // note explanation is needed even if validation fails due to absolute path
        if (this.params.dir_path) {
            details += `[in ${this.params.dir_path}]`;
        }
        else {
            details += `[current working directory ${process.cwd()}]`;
        }
        // append optional (description), replacing any line breaks with spaces
        if (this.params.description) {
            details += ` (${this.params.description.replace(/\n/g, ' ')})`;
        }
        if (this.params.is_background) {
            details += ' [background]';
        }
        return details;
    }
    getDescription() {
        return `${this.params.command} ${this.getContextualDetails()}`;
    }
    getDisplayTitle() {
        return this.params.command;
    }
    getExplanation() {
        return this.getContextualDetails().trim();
    }
    getPolicyUpdateOptions(outcome) {
        if (outcome === ToolConfirmationOutcome.ProceedAlwaysAndSave ||
            outcome === ToolConfirmationOutcome.ProceedAlways) {
            const command = stripShellWrapper(this.params.command);
            const rootCommands = [...new Set(getCommandRoots(command))];
            const allowRedirection = hasRedirection(command) ? true : undefined;
            if (rootCommands.length > 0) {
                return { commandPrefix: rootCommands, allowRedirection };
            }
            return { commandPrefix: this.params.command, allowRedirection };
        }
        return undefined;
    }
    async shouldConfirmExecute(abortSignal) {
        if (this.params[PARAM_ADDITIONAL_PERMISSIONS]) {
            return this.getConfirmationDetails(abortSignal);
        }
        return super.shouldConfirmExecute(abortSignal);
    }
    async getConfirmationDetails(_abortSignal) {
        const command = stripShellWrapper(this.params.command);
        const parsed = parseCommandDetails(command);
        let rootCommandDisplay = '';
        if (!parsed || parsed.hasError || parsed.details.length === 0) {
            // Fallback if parser fails
            const fallback = command.trim().split(/\s+/)[0];
            rootCommandDisplay = fallback || 'shell command';
            if (hasRedirection(command)) {
                rootCommandDisplay += ', redirection';
            }
        }
        else {
            rootCommandDisplay = parsed.details
                .map((detail) => detail.name)
                .join(', ');
        }
        const rootCommands = [...new Set(getCommandRoots(command))];
        // Rely entirely on PolicyEngine for interactive confirmation.
        // If we are here, it means PolicyEngine returned ASK_USER (or no message bus),
        // so we must provide confirmation details.
        // If additional_permissions are provided, it's an expansion request
        if (this.params[PARAM_ADDITIONAL_PERMISSIONS]) {
            return {
                type: 'sandbox_expansion',
                title: 'Sandbox Expansion Request',
                command: this.params.command,
                rootCommand: rootCommandDisplay,
                additionalPermissions: this.params[PARAM_ADDITIONAL_PERMISSIONS],
                onConfirm: async (outcome) => {
                    if (outcome === ToolConfirmationOutcome.ProceedAlwaysAndSave) {
                        const commandName = rootCommands[0] || 'shell';
                        this.context.config.sandboxPolicyManager.addPersistentApproval(commandName, this.params[PARAM_ADDITIONAL_PERMISSIONS]);
                    }
                    else if (outcome === ToolConfirmationOutcome.ProceedAlways) {
                        const commandName = rootCommands[0] || 'shell';
                        this.context.config.sandboxPolicyManager.addSessionApproval(commandName, this.params[PARAM_ADDITIONAL_PERMISSIONS]);
                    }
                },
            };
        }
        const confirmationDetails = {
            type: 'exec',
            title: 'Confirm Shell Command',
            command: this.params.command,
            rootCommand: rootCommandDisplay,
            rootCommands,
            onConfirm: async (_outcome) => {
                // Policy updates are now handled centrally by the scheduler
            },
        };
        return confirmationDetails;
    }
    async execute(signal, updateOutput, options) {
        const { shellExecutionConfig, setExecutionIdCallback } = options ?? {};
        const strippedCommand = stripShellWrapper(this.params.command);
        if (signal.aborted) {
            return {
                llmContent: 'Command was cancelled by user before it could start.',
                returnDisplay: 'Command cancelled by user.',
            };
        }
        const isWindows = os.platform() === 'win32';
        const tempFileName = `shell_pgrep_${crypto
            .randomBytes(6)
            .toString('hex')}.tmp`;
        const tempFilePath = path.join(os.tmpdir(), tempFileName);
        const timeoutMs = this.context.config.getShellToolInactivityTimeout();
        const timeoutController = new AbortController();
        let timeoutTimer;
        // Handle signal combination manually to avoid TS issues or runtime missing features
        const combinedController = new AbortController();
        const onAbort = () => combinedController.abort();
        try {
            // pgrep is not available on Windows, so we can't get background PIDs
            const commandToExecute = isWindows
                ? strippedCommand
                : (() => {
                    // wrap command to append subprocess pids (via pgrep) to temporary file
                    let command = strippedCommand.trim();
                    if (!command.endsWith('&'))
                        command += ';';
                    return `{ ${command} }; __code=$?; pgrep -g 0 >${tempFilePath} 2>&1; exit $__code;`;
                })();
            const cwd = this.params.dir_path
                ? path.resolve(this.context.config.getTargetDir(), this.params.dir_path)
                : this.context.config.getTargetDir();
            const validationError = this.context.config.validatePathAccess(cwd);
            if (validationError) {
                return {
                    llmContent: validationError,
                    returnDisplay: 'Path not in workspace.',
                    error: {
                        message: validationError,
                        type: ToolErrorType.PATH_NOT_IN_WORKSPACE,
                    },
                };
            }
            let cumulativeOutput = '';
            let lastUpdateTime = Date.now();
            let isBinaryStream = false;
            const resetTimeout = () => {
                if (timeoutMs <= 0) {
                    return;
                }
                if (timeoutTimer)
                    clearTimeout(timeoutTimer);
                timeoutTimer = setTimeout(() => {
                    timeoutController.abort();
                }, timeoutMs);
            };
            signal.addEventListener('abort', onAbort, { once: true });
            timeoutController.signal.addEventListener('abort', onAbort, {
                once: true,
            });
            // Start timeout
            resetTimeout();
            const { result: resultPromise, pid } = await ShellExecutionService.execute(commandToExecute, cwd, (event) => {
                resetTimeout(); // Reset timeout on any event
                if (!updateOutput) {
                    return;
                }
                let shouldUpdate = false;
                switch (event.type) {
                    case 'data':
                        if (isBinaryStream)
                            break;
                        cumulativeOutput = event.chunk;
                        shouldUpdate = true;
                        break;
                    case 'binary_detected':
                        isBinaryStream = true;
                        cumulativeOutput =
                            '[Binary output detected. Halting stream...]';
                        shouldUpdate = true;
                        break;
                    case 'binary_progress':
                        isBinaryStream = true;
                        cumulativeOutput = `[Receiving binary output... ${formatBytes(event.bytesReceived)} received]`;
                        if (Date.now() - lastUpdateTime > OUTPUT_UPDATE_INTERVAL_MS) {
                            shouldUpdate = true;
                        }
                        break;
                    case 'exit':
                        break;
                    default: {
                        throw new Error('An unhandled ShellOutputEvent was found.');
                    }
                }
                if (shouldUpdate && !this.params.is_background) {
                    updateOutput(cumulativeOutput);
                    lastUpdateTime = Date.now();
                }
            }, combinedController.signal, this.context.config.getEnableInteractiveShell(), {
                ...shellExecutionConfig,
                pager: 'cat',
                sanitizationConfig: shellExecutionConfig?.sanitizationConfig ??
                    this.context.config.sanitizationConfig,
                sandboxManager: this.context.config.sandboxManager,
                additionalPermissions: this.params[PARAM_ADDITIONAL_PERMISSIONS],
            });
            if (pid) {
                if (setExecutionIdCallback) {
                    setExecutionIdCallback(pid);
                }
                // If the model requested to run in the background, do so after a short delay.
                if (this.params.is_background) {
                    setTimeout(() => {
                        ShellExecutionService.background(pid);
                    }, BACKGROUND_DELAY_MS);
                }
            }
            const result = await resultPromise;
            const backgroundPIDs = [];
            if (os.platform() !== 'win32') {
                let tempFileExists = false;
                try {
                    await fsPromises.access(tempFilePath);
                    tempFileExists = true;
                }
                catch {
                    tempFileExists = false;
                }
                if (tempFileExists) {
                    const pgrepContent = await fsPromises.readFile(tempFilePath, 'utf8');
                    const pgrepLines = pgrepContent.split(os.EOL).filter(Boolean);
                    for (const line of pgrepLines) {
                        if (!/^\d+$/.test(line)) {
                            if (line.includes('sysmond service not found') ||
                                line.includes('Cannot get process list') ||
                                line.includes('sysmon request failed')) {
                                continue;
                            }
                            debugLogger.error(`pgrep: ${line}`);
                        }
                        const pid = Number(line);
                        if (pid !== result.pid) {
                            backgroundPIDs.push(pid);
                        }
                    }
                }
                else {
                    if (!signal.aborted && !result.backgrounded) {
                        debugLogger.error('missing pgrep output');
                    }
                }
            }
            let data;
            let llmContent = '';
            let timeoutMessage = '';
            if (result.aborted) {
                if (timeoutController.signal.aborted) {
                    timeoutMessage = `Command was automatically cancelled because it exceeded the timeout of ${(timeoutMs / 60000).toFixed(1)} minutes without output.`;
                    llmContent = timeoutMessage;
                }
                else {
                    llmContent =
                        'Command was cancelled by user before it could complete.';
                }
                if (result.output.trim()) {
                    llmContent += ` Below is the output before it was cancelled:\n${result.output}`;
                }
                else {
                    llmContent += ' There was no output before it was cancelled.';
                }
            }
            else if (this.params.is_background || result.backgrounded) {
                llmContent = `Command moved to background (PID: ${result.pid}). Output hidden. Press Ctrl+B to view.`;
                data = {
                    pid: result.pid,
                    command: this.params.command,
                    initialOutput: result.output,
                };
            }
            else {
                // Create a formatted error string for display, replacing the wrapper command
                // with the user-facing command.
                const llmContentParts = [`Output: ${result.output || '(empty)'}`];
                if (result.error) {
                    const finalError = result.error.message.replaceAll(commandToExecute, this.params.command);
                    llmContentParts.push(`Error: ${finalError}`);
                }
                if (result.exitCode !== null && result.exitCode !== 0) {
                    llmContentParts.push(`Exit Code: ${result.exitCode}`);
                    data = {
                        exitCode: result.exitCode,
                        isError: true,
                    };
                }
                if (result.signal) {
                    llmContentParts.push(`Signal: ${result.signal}`);
                }
                if (backgroundPIDs.length) {
                    llmContentParts.push(`Background PIDs: ${backgroundPIDs.join(', ')}`);
                }
                if (result.pid) {
                    llmContentParts.push(`Process Group PGID: ${result.pid}`);
                }
                llmContent = llmContentParts.join('\n');
            }
            let returnDisplayMessage = '';
            if (this.context.config.getDebugMode()) {
                returnDisplayMessage = llmContent;
            }
            else {
                if (this.params.is_background || result.backgrounded) {
                    returnDisplayMessage = `Command moved to background (PID: ${result.pid}). Output hidden. Press Ctrl+B to view.`;
                }
                else if (result.aborted) {
                    const cancelMsg = timeoutMessage || 'Command cancelled by user.';
                    if (result.output.trim()) {
                        returnDisplayMessage = `${cancelMsg}\n\nOutput before cancellation:\n${result.output}`;
                    }
                    else {
                        returnDisplayMessage = cancelMsg;
                    }
                }
                else if (result.output.trim()) {
                    returnDisplayMessage = result.output;
                }
                else {
                    if (result.signal) {
                        returnDisplayMessage = `Command terminated by signal: ${result.signal}`;
                    }
                    else if (result.error) {
                        returnDisplayMessage = `Command failed: ${getErrorMessage(result.error)}`;
                    }
                    else if (result.exitCode !== null && result.exitCode !== 0) {
                        returnDisplayMessage = `Command exited with code: ${result.exitCode}`;
                    }
                    // If output is empty and command succeeded (code 0, no error/signal/abort),
                    // returnDisplayMessage will remain empty, which is fine.
                }
            }
            // Heuristic Sandbox Denial Detection
            const lowerOutput = ((result.output || '') +
                ' ' +
                (result.error?.message || '')).toLowerCase();
            const isFileDenial = [
                'operation not permitted',
                'vim:e303',
                'should be read/write',
                'sandbox_apply',
                'sandbox: ',
            ].some((keyword) => lowerOutput.includes(keyword));
            const isNetworkDenial = [
                'error connecting to',
                'network is unreachable',
                'could not resolve host',
                'connection refused',
                'no address associated with hostname',
            ].some((keyword) => lowerOutput.includes(keyword));
            // Only trigger heuristic if the command actually failed (exit code != 0 or aborted)
            const failed = !!result.error ||
                !!result.signal ||
                (result.exitCode !== undefined && result.exitCode !== 0) ||
                result.aborted;
            if (failed && (isFileDenial || isNetworkDenial)) {
                const strippedCommand = stripShellWrapper(this.params.command);
                const rootCommands = getCommandRoots(strippedCommand).filter((r) => r !== 'shopt');
                const rootCommandDisplay = rootCommands.length > 0 ? rootCommands[0] : 'shell';
                // Extract denied paths
                const deniedPaths = new Set();
                const regex = /(?:^|\s)['"]?(\/[\w.-/]+)['"]?:\s*[Oo]peration not permitted/gi;
                let match;
                while ((match = regex.exec(result.output || '')) !== null) {
                    deniedPaths.add(match[1]);
                }
                while ((match = regex.exec(result.error?.message || '')) !== null) {
                    deniedPaths.add(match[1]);
                }
                if (isFileDenial && deniedPaths.size === 0) {
                    // Fallback heuristic: look for any absolute path in the output
                    // Avoid matching simple commands like /bin/sh
                    const fallbackRegex = /(?:^|[\s"'[\]])(\/[a-zA-Z0-9_.-]+(?:\/[a-zA-Z0-9_.-]+)+)(?:$|[\s"'[\]:])/gi;
                    let m;
                    while ((m = fallbackRegex.exec(result.output || '')) !== null) {
                        const p = m[1];
                        if (p && !p.startsWith('/bin/') && !p.startsWith('/usr/bin/')) {
                            deniedPaths.add(p);
                        }
                    }
                    while ((m = fallbackRegex.exec(result.error?.message || '')) !== null) {
                        const p = m[1];
                        if (p && !p.startsWith('/bin/') && !p.startsWith('/usr/bin/')) {
                            deniedPaths.add(p);
                        }
                    }
                }
                const readPaths = new Set(this.params[PARAM_ADDITIONAL_PERMISSIONS]?.fileSystem?.read || []);
                const writePaths = new Set(this.params[PARAM_ADDITIONAL_PERMISSIONS]?.fileSystem?.write || []);
                for (const p of deniedPaths) {
                    try {
                        // Find an existing parent directory to add instead of a non-existent file
                        let currentPath = p;
                        try {
                            if (fs.existsSync(currentPath) &&
                                fs.statSync(currentPath).isFile()) {
                                currentPath = path.dirname(currentPath);
                            }
                        }
                        catch (_e) {
                            /* ignore */
                        }
                        while (currentPath.length > 1) {
                            if (fs.existsSync(currentPath)) {
                                writePaths.add(currentPath);
                                readPaths.add(currentPath);
                                break;
                            }
                            currentPath = path.dirname(currentPath);
                        }
                    }
                    catch (_e) {
                        // ignore
                    }
                }
                const additionalPermissions = {
                    network: isNetworkDenial ||
                        this.params[PARAM_ADDITIONAL_PERMISSIONS]?.network ||
                        undefined,
                    fileSystem: isFileDenial || writePaths.size > 0
                        ? {
                            read: Array.from(readPaths),
                            write: Array.from(writePaths),
                        }
                        : undefined,
                };
                const originalReadSize = this.params[PARAM_ADDITIONAL_PERMISSIONS]?.fileSystem?.read?.length ||
                    0;
                const originalWriteSize = this.params[PARAM_ADDITIONAL_PERMISSIONS]?.fileSystem?.write
                    ?.length || 0;
                const originalNetwork = !!this.params[PARAM_ADDITIONAL_PERMISSIONS]?.network;
                const newReadSize = additionalPermissions.fileSystem?.read?.length || 0;
                const newWriteSize = additionalPermissions.fileSystem?.write?.length || 0;
                const newNetwork = !!additionalPermissions.network;
                const hasNewPermissions = newReadSize > originalReadSize ||
                    newWriteSize > originalWriteSize ||
                    (!originalNetwork && newNetwork);
                if (hasNewPermissions) {
                    const confirmationDetails = {
                        type: 'sandbox_expansion',
                        title: 'Sandbox Expansion Request',
                        command: this.params.command,
                        rootCommand: rootCommandDisplay,
                        additionalPermissions,
                    };
                    return {
                        llmContent: 'Sandbox expansion required',
                        returnDisplay: returnDisplayMessage,
                        error: {
                            type: ToolErrorType.SANDBOX_EXPANSION_REQUIRED,
                            message: JSON.stringify(confirmationDetails),
                        },
                    };
                }
                // If no new permissions were found by heuristic, do not intercept.
                // Just return the normal execution error so the LLM can try providing explicit paths itself.
            }
            const summarizeConfig = this.context.config.getSummarizeToolOutputConfig();
            const executionError = result.error
                ? {
                    error: {
                        message: result.error.message,
                        type: ToolErrorType.SHELL_EXECUTE_ERROR,
                    },
                }
                : {};
            if (summarizeConfig && summarizeConfig[SHELL_TOOL_NAME]) {
                const summary = await summarizeToolOutput(this.context.config, { model: 'summarizer-shell' }, llmContent, this.context.geminiClient, signal);
                return {
                    llmContent: summary,
                    returnDisplay: returnDisplayMessage,
                    ...executionError,
                };
            }
            return {
                llmContent,
                returnDisplay: returnDisplayMessage,
                data,
                ...executionError,
            };
        }
        finally {
            if (timeoutTimer)
                clearTimeout(timeoutTimer);
            signal.removeEventListener('abort', onAbort);
            timeoutController.signal.removeEventListener('abort', onAbort);
            try {
                await fsPromises.unlink(tempFilePath);
            }
            catch {
                // Ignore errors during unlink
            }
        }
    }
}
export class ShellTool extends BaseDeclarativeTool {
    context;
    static Name = SHELL_TOOL_NAME;
    constructor(context, messageBus) {
        void initializeShellParsers().catch(() => {
            // Errors are surfaced when parsing commands.
        });
        const definition = getShellDefinition(context.config.getEnableInteractiveShell(), context.config.getEnableShellOutputEfficiency(), context.config.getSandboxEnabled());
        super(ShellTool.Name, 'Shell', definition.base.description, Kind.Execute, definition.base.parametersJsonSchema, messageBus, false, // output is not markdown
        true);
        this.context = context;
    }
    validateToolParamValues(params) {
        if (!params.command.trim()) {
            return 'Command cannot be empty.';
        }
        if (params.dir_path) {
            const resolvedPath = path.resolve(this.context.config.getTargetDir(), params.dir_path);
            return this.context.config.validatePathAccess(resolvedPath);
        }
        return null;
    }
    createInvocation(params, messageBus, _toolName, _toolDisplayName) {
        return new ShellToolInvocation(this.context.config, params, messageBus, _toolName, _toolDisplayName);
    }
    getSchema(modelId) {
        const definition = getShellDefinition(this.context.config.getEnableInteractiveShell(), this.context.config.getEnableShellOutputEfficiency(), this.context.config.getSandboxEnabled());
        return resolveToolDeclaration(definition, modelId);
    }
}
//# sourceMappingURL=shell.js.map