/**
 * Iron Dome CLI Commands
 *
 * Usage:
 *   shieldcortex iron-dome activate [--profile school|enterprise|personal|paranoid]
 *   shieldcortex iron-dome status
 *   shieldcortex iron-dome deactivate
 *   shieldcortex iron-dome scan --text "..."
 *   shieldcortex iron-dome scan --file <path>
 *   shieldcortex iron-dome audit [--tail] [--search <term>] [--date <date>]
 */
import fs from 'fs';
import path from 'path';
import os from 'os';
import { initDatabase } from '../database/init.js';
import { activateIronDome, deactivateIronDome, getIronDomeStatus, scanForInjection, getEffectiveConfirmationProtocol, getConfirmationOverrides, moveConfirmationAction, removeConfirmationOverride, } from '../defence/iron-dome/index.js';
import { queryAuditLogs } from '../defence/audit/index.js';
const bold = '\x1b[1m';
const reset = '\x1b[0m';
const green = '\x1b[32m';
const red = '\x1b[31m';
const yellow = '\x1b[33m';
const cyan = '\x1b[36m';
const dim = '\x1b[2m';
/**
 * Ensure database is initialised for CLI commands.
 */
function ensureDb() {
    const dbPath = process.env.CLAUDE_MEMORY_DB || path.join(os.homedir(), '.shieldcortex', 'memories.db');
    initDatabase(dbPath);
}
/**
 * Handle the `iron-dome` subcommand.
 */
export async function handleIronDomeCommand(args) {
    const subcommand = args[0];
    if (!subcommand || subcommand === '--help' || subcommand === '-h') {
        printUsage();
        return;
    }
    ensureDb();
    switch (subcommand) {
        case 'activate':
            handleActivate(args.slice(1));
            break;
        case 'status':
            handleStatus();
            break;
        case 'deactivate':
            handleDeactivate();
            break;
        case 'scan':
            handleScan(args.slice(1));
            break;
        case 'audit':
            handleAudit(args.slice(1));
            break;
        case 'confirmation':
            handleConfirmation(args.slice(1));
            break;
        default:
            console.error(`Unknown iron-dome command: ${subcommand}`);
            printUsage();
            process.exit(1);
    }
}
function printUsage() {
    console.log(`
${bold}Iron Dome — Behaviour Protection Layer${reset}

${bold}Usage:${reset}
  shieldcortex iron-dome activate [--profile <profile>]
  shieldcortex iron-dome status
  shieldcortex iron-dome deactivate
  shieldcortex iron-dome scan --text "..." | --file <path>
  shieldcortex iron-dome audit [--tail] [--search <term>]
  shieldcortex iron-dome confirmation list
  shieldcortex iron-dome confirmation move <action> <red|amber|green>
  shieldcortex iron-dome confirmation add <action> <red|amber|green>
  shieldcortex iron-dome confirmation remove <action>

${bold}Profiles:${reset}
  school       GDPR strict, pupil data locked
  enterprise   Financial protection, compliance
  personal     Lighter touch for personal use
  paranoid     Everything requires approval

${bold}Trusted local channels:${reset}
  terminal, cli, dashboard
`);
}
function handleActivate(args) {
    let profile;
    const profileIdx = args.indexOf('--profile');
    if (profileIdx !== -1 && args[profileIdx + 1]) {
        const p = args[profileIdx + 1];
        if (!['school', 'enterprise', 'personal', 'paranoid'].includes(p)) {
            console.error(`${red}Unknown profile: ${p}${reset}`);
            console.error(`Available: school, enterprise, personal, paranoid`);
            process.exit(1);
        }
        profile = p;
    }
    const config = activateIronDome(profile);
    console.log(`
${bold}${green}Iron Dome Activated${reset}

  Profile:          ${config.profile ?? 'default'}
  Trusted channels: ${config.trustedChannels.join(', ')}
  Kill phrase:      "${config.killPhrase}"
  Require approval: ${config.requireApproval.length} action type(s)
  Auto-approve:     ${config.autoApprove.length} action type(s)
  PII never output: ${config.piiRules.neverOutput.length} categories
  PII aggregates:   ${config.piiRules.aggregatesOnly.length} categories
`);
}
function handleStatus() {
    const status = getIronDomeStatus();
    if (!status.enabled) {
        console.log(`
${bold}Iron Dome Status${reset}
${'─'.repeat(40)}
  Status: ${dim}INACTIVE${reset}

  Run ${cyan}shieldcortex iron-dome activate${reset} to enable.
`);
        return;
    }
    const c = status.config;
    console.log(`
${bold}Iron Dome Status${reset}
${'─'.repeat(40)}
  Status:           ${green}ACTIVE${reset}
  Profile:          ${c.profile ?? 'custom'}
  Trusted channels: ${c.trustedChannels.join(', ')}
  Kill phrase:      "${c.killPhrase}"
  Require approval: ${c.requireApproval.join(', ')}
  Auto-approve:     ${c.autoApprove.join(', ')}
  PII never output: ${c.piiRules.neverOutput.length > 0 ? c.piiRules.neverOutput.join(', ') : '(none)'}
  PII aggregates:   ${c.piiRules.aggregatesOnly.length > 0 ? c.piiRules.aggregatesOnly.join(', ') : '(none)'}
  Sub-agent blocks: ${c.subAgentRestrictions.blockedOperations.length > 0 ? c.subAgentRestrictions.blockedOperations.join(', ') : '(none)'}
  Sanitise context: ${c.subAgentRestrictions.sanitiseContext ? 'yes' : 'no'}
`);
}
function handleDeactivate() {
    deactivateIronDome();
    console.log(`${bold}Iron Dome deactivated.${reset}`);
}
function handleScan(args) {
    let text;
    const textIdx = args.indexOf('--text');
    const fileIdx = args.indexOf('--file');
    if (textIdx !== -1 && args[textIdx + 1]) {
        text = args[textIdx + 1];
    }
    else if (fileIdx !== -1 && args[fileIdx + 1]) {
        const filePath = args[fileIdx + 1];
        try {
            text = fs.readFileSync(filePath, 'utf-8');
        }
        catch (err) {
            console.error(`${red}Error reading file: ${err.message}${reset}`);
            process.exit(2);
        }
    }
    if (!text) {
        console.error('Usage: shieldcortex iron-dome scan --text "..." | --file <path>');
        process.exit(1);
    }
    const result = scanForInjection(text);
    if (result.clean) {
        console.log(`${green}CLEAN${reset} — No injection patterns detected (${result.textLength} chars scanned)`);
        process.exit(0);
    }
    console.log(`\n${'!'.repeat(3)}  ${red}${bold}INJECTION DETECTED${reset}  ${'!'.repeat(3)}`);
    console.log(`Risk level: ${result.riskLevel}`);
    console.log(`Detections: ${result.detections.length}`);
    console.log(`Scanned:    ${result.textLength} chars`);
    console.log();
    // Group by category
    const byCat = {};
    for (const d of result.detections) {
        (byCat[d.category] ??= []).push(d);
    }
    for (const [cat, dets] of Object.entries(byCat).sort(([a], [b]) => a.localeCompare(b))) {
        console.log(`  ${bold}[${cat}]${reset}`);
        for (const d of dets) {
            const sColor = d.severity === 'critical' ? red : d.severity === 'high' ? red : d.severity === 'medium' ? yellow : cyan;
            console.log(`    ${sColor}[${d.severity.toUpperCase()}]${reset} ${d.pattern}: ${d.description}`);
            const preview = d.match.slice(0, 120);
            const suffix = d.match.length > 120 ? '...' : '';
            console.log(`           ${dim}matched: "${preview}${suffix}"${reset}`);
        }
        console.log();
    }
    process.exit(1);
}
function handleAudit(args) {
    const searchIdx = args.indexOf('--search');
    const search = searchIdx !== -1 ? args[searchIdx + 1] : undefined;
    const tail = args.includes('--tail');
    const logs = queryAuditLogs({
        firewallResult: undefined,
        limit: tail ? 20 : 50,
    });
    // Filter to iron-dome entries
    const ironDomeLogs = logs.filter((log) => log.reason?.startsWith('[iron-dome:'));
    if (search) {
        const filtered = ironDomeLogs.filter((log) => log.reason?.toLowerCase().includes(search.toLowerCase()));
        printAuditLogs(filtered);
    }
    else {
        printAuditLogs(ironDomeLogs);
    }
}
function printAuditLogs(logs) {
    if (logs.length === 0) {
        console.log(`${dim}No Iron Dome audit entries found.${reset}`);
        return;
    }
    console.log(`\n${bold}Iron Dome Audit Log${reset} (${logs.length} entries)`);
    console.log('─'.repeat(60));
    for (const log of logs) {
        const resultColor = log.firewall_result === 'ALLOW' ? green : red;
        console.log(`  ${dim}${log.timestamp}${reset} ${resultColor}${log.firewall_result}${reset} ${log.reason ?? ''}`);
    }
    console.log();
}
function handleConfirmation(args) {
    const sub = args[0];
    if (!sub || sub === 'list') {
        const protocol = getEffectiveConfirmationProtocol();
        const overrides = getConfirmationOverrides();
        console.log(`\n${bold}Destructive Action Confirmation Protocol${reset}\n`);
        const printTier = (label, color, actions, overrideList) => {
            console.log(`${color}${bold}${label}${reset}`);
            if (actions.length === 0) {
                console.log(`  ${dim}(none)${reset}`);
            }
            else {
                for (const a of actions.sort()) {
                    const isOverride = overrideList?.some(o => o.toLowerCase() === a.toLowerCase());
                    const suffix = isOverride ? ` ${dim}(user override)${reset}` : '';
                    console.log(`  ${a}${suffix}`);
                }
            }
            console.log();
        };
        printTier('🔴 RED — Always confirm', red, protocol.red, [
            ...(overrides.red ?? []),
        ]);
        printTier('🟡 AMBER — Announce', '\x1b[33m', protocol.amber, [
            ...(overrides.amber ?? []),
        ]);
        printTier('🟢 GREEN — Free', green, protocol.green, [
            ...(overrides.green ?? []),
        ]);
        return;
    }
    if (sub === 'move' || sub === 'add') {
        const action = args[1];
        const tier = args[2];
        if (!action || !tier || !['red', 'amber', 'green'].includes(tier)) {
            console.error(`${red}Usage: shieldcortex iron-dome confirmation ${sub} <action> <red|amber|green>${reset}`);
            process.exit(1);
        }
        moveConfirmationAction(action, tier);
        console.log(`${green}✓${reset} ${sub === 'move' ? 'Moved' : 'Added'} "${action}" to ${tier.toUpperCase()} tier`);
        return;
    }
    if (sub === 'remove') {
        const action = args[1];
        if (!action) {
            console.error(`${red}Usage: shieldcortex iron-dome confirmation remove <action>${reset}`);
            process.exit(1);
        }
        const found = removeConfirmationOverride(action);
        if (found) {
            console.log(`${green}✓${reset} Removed override for "${action}" (reverted to profile default)`);
        }
        else {
            console.log(`${dim}No override found for "${action}"${reset}`);
        }
        return;
    }
    console.error(`${red}Unknown confirmation command: ${sub}${reset}`);
    console.error('Available: list, move, add, remove');
    process.exit(1);
}
