//! The `spectra` command line (spec §19). Output is modern: colour and

//! glyphs on a UTF-8 terminal, plain when piped, with `--plain` or with

//! `NO_COLOR`; `--json` prints one document on stdout and nothing else.

pub mod admin;

pub mod agent;

pub mod connect;

pub mod format;

pub mod human;

pub mod identity;

pub mod marks;

pub mod mcp;

pub mod open;

pub mod project;

pub mod serve;

pub mod ui;

use anyhow::{bail, Context, Result};

use clap::{Parser, Subcommand};

use std::path::PathBuf;

#[derive(Parser)]

#[command(name = "spectra", version = env!("SPECTRA_VERSION_LONG"), about = "A control plane for AI coding agents")]

pub struct Cli {

    /// Plain output: no colour or glyphs (also NO_COLOR, or when not a terminal)

    #[arg(long, global = true)]

    pub plain: bool,

    /// The data directory (default: $XDG_DATA_HOME/spectra, else ~/.local/share/spectra)

    #[arg(long, global = true, env = "SPECTRA_DATA")]

    pub data: Option<PathBuf>,

    #[command(subcommand)]

    pub command: Command,

}

#[derive(Subcommand)]

pub enum Command {

    /// The version and build of this binary

    Version {

        /// Machine-readable output

        #[arg(long)]

        json: bool,

    },

    /// Make this machine's Spectra: record the owner's identity (read from

    /// their OXY_HOME and proven by signing) and make the instance key

    Init {

        /// The owner's identity home (default: $SPECTRA_HOME, else ~/.config/spectra)

        #[arg(long)]

        owner_home: Option<PathBuf>,

        /// This instance's name (default: the host name)

        #[arg(long)]

        name: Option<String>,

        /// Set up a server without the owner's secret key: name the owner's

        /// KeyId, and they claim it from their machine with `spectra

        /// connect` (spec §8.6)

        #[arg(long, value_name = "KEYID", conflicts_with = "owner_home")]

        owner: Option<String>,

    },

    /// Use a Spectra on another machine: trust it through your delegation to

    /// its instance key, pin its certificate, and claim it if it is new

    Connect {

        /// The server, https://HOST[:PORT]

        url: String,

        /// Trust the server if its instance key starts with this, without asking

        #[arg(long, value_name = "KEYID-PREFIX")]

        expect: Option<String>,

        /// Trust it without asking (for scripts)

        #[arg(long, short = 'y')]

        yes: bool,

        /// The owner's identity home (default: $SPECTRA_HOME, else ~/.config/spectra)

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// The owner's and the instance's identities: show, refresh

    Identity {

        #[command(subcommand)]

        command: IdentityCmd,

    },

    /// Run the daemon: the ledger, Tuner on the Unix socket and a loopback port

    Serve {

        /// The address and port for browsers and HTTP clients (default:

        /// `[server] bind`, else 127.0.0.1:7350); beyond loopback, other

        /// machines connect over TLS (spec §8.6)

        #[arg(long)]

        bind: Option<String>,

        /// TLS on the TCP port: auto (beyond loopback only), on, or off

        /// (default: `[server] tls`, else auto)

        #[arg(long)]

        tls: Option<String>,

        /// Allow a non-loopback address in plain HTTP

        #[arg(long)]

        insecure: bool,

        /// Open Radar in the browser once serving (signs a link as the owner)

        #[arg(long)]

        open: bool,

    },

    /// Sign in to Radar: a one-time link signed with the owner's key

    Open {

        #[arg(long)]

        owner_home: Option<PathBuf>,

        /// Print the link without opening a browser

        #[arg(long)]

        no_browser: bool,

        /// With Spectra on another machine: the loopback port of the proxy

        /// Radar is served through (spec §8.6)

        #[arg(long, default_value_t = 7350)]

        port: u16,

    },

    /// The stdio MCP server for one agent: signs with its key and forwards to the daemon

    Mcp {

        /// The agent it speaks for

        #[arg(long)]

        agent: String,

        /// The agent's home (default: the one recorded when it was added)

        #[arg(long)]

        home: Option<PathBuf>,

    },

    /// Post a message as yourself

    Say {

        /// What to say (Markdown; @name mentions)

        body: String,

        /// The channel (default: #general)

        #[arg(short, long)]

        channel: Option<String>,

        /// Reply in the thread of this message

        #[arg(long)]

        reply_to: Option<String>,

        #[arg(long)]

        json: bool,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// Your unread mentions and direct messages; --follow waits for more

    Inbox {

        #[arg(long)]

        follow: bool,

        #[arg(long)]

        json: bool,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// Search what was said: words, "phrases", prefix*, AND/OR/NOT

    Search {

        query: String,

        #[arg(long)]

        channel: Option<String>,

        #[arg(long)]

        author: Option<String>,

        /// 7d, 3h, 30m

        #[arg(long)]

        since: Option<String>,

        #[arg(long, default_value_t = 20)]

        limit: u32,

        #[arg(long)]

        json: bool,

    },

    /// Any API call, signed as the owner: JSON out

    Api {

        method: String,

        path: String,

        /// The request body (JSON)

        #[arg(short = 'd', long = "body")]

        body: Option<String>,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// The checkouts agents work in: add, list

    Project {

        #[command(subcommand)]

        command: ProjectCmd,

    },

    /// Agents, each its owner's delegate: add, list, disable

    Agent {

        #[command(subcommand)]

        command: AgentCmd,

    },

    /// The ledger's own checks: verify, check, rebuild

    Admin {

        #[command(subcommand)]

        command: Admin,

    },

}

#[derive(Subcommand)]

pub enum IdentityCmd {

    /// Make your own identity: a key pair that signs as you (spec §8.0)

    Create {

        /// Your name, as agents and Radar show it

        #[arg(long)]

        name: String,

        /// An email or URL, if you want one shown

        #[arg(long, default_value = "")]

        contact: String,

        /// Where to keep it (default: $SPECTRA_HOME, else ~/.config/spectra)

        #[arg(long)]

        home: Option<PathBuf>,

    },

    /// The owner and the instance as the ledger knows them

    Show {

        #[arg(long)]

        json: bool,

    },

    /// Record the owner's current identity if the ledger has missed a successor

    Refresh {

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

}

#[derive(Subcommand)]

pub enum ProjectCmd {

    /// Add a project: any kind of work, with a folder if it has one

    Add {

        /// A folder (its name becomes the project's), or just a name

        target: String,

        /// Its name, when TARGET is a folder

        #[arg(long)]

        name: Option<String>,

        /// The work's folder, when TARGET is a name; Spectra never reads it

        #[arg(long)]

        path: Option<PathBuf>,

        /// What the work is, for agents and Radar

        #[arg(long, short = 'd', default_value = "")]

        description: String,

        /// A link to it, if any

        #[arg(long)]

        url: Option<String>,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// Say that one project depends on another (`delegate to: downstream` follows links)

    Link {

        project: String,

        #[arg(long)]

        depends_on: String,

        /// Remove the link instead

        #[arg(long)]

        remove: bool,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// Every project with its links and agents

    List {

        #[arg(long)]

        json: bool,

    },

}

#[derive(Subcommand)]

pub enum AgentCmd {

    /// Make an agent's key in its own home, delegate to it, and record it

    Add {

        /// Lower-case letters, digits and dashes

        name: String,

        /// claude-code, antigravity, kimi-code, codex or other

        #[arg(long)]

        kind: String,

        /// The project it works in

        #[arg(long)]

        project: String,

        /// The agent's own identity home, where its key is made and kept

        #[arg(long)]

        home: PathBuf,

        /// Bind the key to this Unix user: a request from another is refused

        #[arg(long)]

        uid: Option<u32>,

        /// Bind the key to the Unix user of its first signed connection

        #[arg(long, conflicts_with = "uid")]

        learn_uid: bool,

        /// How long the agent may act for you: 30m, 8h, 7d (default: until disabled)

        #[arg(long)]

        expires: Option<String>,

        /// Delegate without asking (for scripts)

        #[arg(long, short = 'y')]

        yes: bool,

        /// The owner's identity home

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// Give an agent more time: delegate to its key again with a new expiry

    Renew {

        name: String,

        /// 30m, 8h, 7d, or `never`

        #[arg(long)]

        expires: String,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

    /// Every agent with its owner, key, delegation and state

    List {

        #[arg(long)]

        json: bool,

    },

    /// Refuse an agent's key from now on

    Disable {

        name: String,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

}

#[derive(Subcommand)]

pub enum Admin {

    /// Recompute the hash chain and check every checkpoint and proof (exit 1 on any finding)

    Verify {

        /// Machine-readable output

        #[arg(long)]

        json: bool,

    },

    /// Whether the projections equal a rebuild from the ledger

    Check,

    /// Replay the ledger into every projection

    Rebuild,

}

/// What every command needs: where the data lives.

pub struct Ctx {

    pub data: PathBuf,

}

impl Ctx {

    /// The ledger's database, which must exist.

    pub fn db(&self) -> Result<PathBuf> {

        let db = self.data.join("spectra.db");

        if !db.exists() {

            bail!("no Spectra in {} (run `spectra init`, or pass --data)", self.data.display());

        }

        Ok(db)

    }

    /// The ledger, for writing: the instance key signs its checkpoints, and

    /// the lock keeps any other writer out.

    pub async fn writer(&self) -> Result<spectra_core::ledger::Ledger> {

        let db = self.db()?;

        let instance = spectra_core::keys::KeyPair::instance(&self.data, "spectra")?;

        spectra_core::ledger::Ledger::open(&db, Some(instance)).await

    }

    /// The daemon's Unix socket.

    pub fn socket(&self) -> PathBuf {

        self.data.join("spectra.sock")

    }

    /// The Spectra on another machine this one uses, if any (spec §8.6).

    pub fn remote(&self) -> Result<Option<connect::ClientCfg>> {

        connect::load()

    }

    /// Where the daemon is: the configured server, else the local socket.

    pub fn endpoint(&self) -> Result<spectra_mcp::client::Endpoint> {

        Ok(match self.remote()? {

            Some(c) => c.endpoint()?,

            None => spectra_mcp::client::Endpoint::Unix(self.socket()),

        })

    }

    /// A client signing as the owner: to the configured server (spec §8.6),

    /// or to the local daemon when it is serving; none when neither. It

    /// signs with the owner identity the ledger records, since the daemon

    /// may not know a newer one yet.

    pub async fn owner_client(&self, owner_home: &std::path::Path) -> Result<Option<spectra_mcp::client::Client>> {

        use spectra_mcp::client::Client;

        if let Some(cfg) = self.remote()? {

            let ep = cfg.endpoint()?;

            let pair = remote_owner(&ep, owner_home).await?;

            return Ok(Some(Client::at(ep, Some(pair))));

        }

        if !self.data.join("spectra.db").exists() || !Client::alive(&self.socket()).await {

            return Ok(None);

        }

        let ledger = spectra_core::ledger::Ledger::open_read_only(&self.db()?).await?;

        Ok(Some(Client::new(&self.socket(), Some(identity::recorded_owner(&ledger, owner_home).await?))))

    }

    /// Somewhere to append the owner's signed events: the configured server,

    /// the local daemon when it is serving, else straight to the ledger

    /// (spec §8.5, §8.6).

    pub async fn owner_writer(&self, owner_home: &std::path::Path) -> Result<Writer> {

        if let Some(cfg) = self.remote()? {

            let ep = cfg.endpoint()?;

            let pair = remote_owner(&ep, owner_home).await?;

            let recorded = pair.identity.clone();

            return Ok(Writer::Remote { client: Box::new(spectra_mcp::client::Client::at(ep, Some(pair))), recorded });

        }

        let db = self.db()?;

        if spectra_mcp::client::Client::alive(&self.socket()).await {

            let ledger = spectra_core::ledger::Ledger::open_read_only(&db).await?;

            let transport = identity::recorded_owner(&ledger, owner_home).await?;

            return Ok(Writer::Daemon { ledger, client: Box::new(spectra_mcp::client::Client::new(&self.socket(), Some(transport))) });

        }

        Ok(Writer::Direct(self.writer().await?))

    }

    /// Refuse a command that needs the ledger file on this machine.

    pub fn local_only(&self, what: &str) -> Result<()> {

        if self.remote()?.is_some() {

            bail!("{what} runs on the server, which holds the ledger (this machine uses {})", connect::path().display());

        }

        Ok(())

    }

    /// `[owner] home` from spectra.toml.

    pub fn config_owner_home(&self) -> Option<PathBuf> {

        let text = std::fs::read_to_string(self.data.join("spectra.toml")).ok()?;

        let t: toml::Table = text.parse().ok()?;

        t.get("owner")?.get("home")?.as_str().map(PathBuf::from)

    }

}

/// Where the owner's events go.

pub enum Writer {

    Direct(spectra_core::ledger::Ledger),

    Daemon {

        ledger: spectra_core::ledger::Ledger,

        client: Box<spectra_mcp::client::Client>,

    },

    /// A Spectra on another machine; `recorded` is the owner identity it knows.

    Remote {

        client: Box<spectra_mcp::client::Client>,

        recorded: spectra_core::identity::Identity,

    },

}

impl Writer {

    /// The ledger on this machine, for reading, if there is one.

    pub fn ledger(&self) -> Option<&spectra_core::ledger::Ledger> {

        match self {

            Writer::Direct(l) | Writer::Daemon { ledger: l, .. } => Some(l),

            Writer::Remote { .. } => None,

        }

    }

    /// A client of the daemon, when one is serving.

    pub fn client(&self) -> Option<&spectra_mcp::client::Client> {

        match self {

            Writer::Daemon { client, .. } | Writer::Remote { client, .. } => Some(client),

            Writer::Direct(_) => None,

        }

    }

    /// The rotation that brings the recorded owner to the current identity

    /// in `home`, if it has moved.

    pub async fn refresh_event(&self, home: &std::path::Path) -> Result<Option<spectra_core::event::NewEvent>> {

        match self {

            Writer::Direct(l) | Writer::Daemon { ledger: l, .. } => identity::refresh_event(l, home).await,

            Writer::Remote { recorded, .. } => identity::rotation(recorded, home),

        }

    }

    /// Append events signed over their payload, then checkpoint.

    pub async fn append(&self, events: Vec<spectra_core::event::NewEvent>) -> Result<()> {

        match self {

            Writer::Direct(l) => {

                l.append(events).await?;

                l.checkpoint().await?;

            }

            Writer::Daemon { client, .. } | Writer::Remote { client, .. } => {

                let wire: Vec<_> = events.iter().map(spectra_core::daemon::WireEvent::from_new).collect();

                let r = client.send("POST", "/api/v1/ledger/events", &[], serde_json::to_vec(&wire)?).await?;

                if r.status != 200 {

                    let why = r

                        .json()

                        .ok()

                        .and_then(|v| v.get("title").and_then(|t| t.as_str()).map(String::from))

                        .unwrap_or_else(|| String::from_utf8_lossy(&r.body).into());

                    bail!("the daemon refused: {why}");

                }

            }

        }

        Ok(())

    }

}

/// The owner identity a server records, as a key pair from the owner's

/// home: what requests to it are signed with.

async fn remote_owner(ep: &spectra_mcp::client::Endpoint, home: &std::path::Path) -> Result<spectra_core::keys::KeyPair> {

    let r = spectra_mcp::client::Client::at(ep.clone(), None).send("GET", "/api/v1/instance", &[], vec![]).await?;

    let info = r.json()?;

    let key = info.get("owner").and_then(|o| o.as_str()).context("the server has no owner yet: spectra connect claims it")?;

    let keys = home.join("keys");

    spectra_core::keys::KeyPair::load(&keys.join(format!("{key}.secret")), &keys.join(format!("{key}.identity")))

        .with_context(|| format!("the server's owner {} is not an identity in {}", &key[..12.min(key.len())], home.display()))

}

/// An API call; a refusal becomes an error that says why.

pub async fn call(c: &spectra_mcp::client::Client, method: &str, path: &str, body: Option<serde_json::Value>) -> Result<serde_json::Value> {

    let r = c.send(method, path, &[], body.map(|b| serde_json::to_vec(&b)).transpose()?.unwrap_or_default()).await?;

    let v: serde_json::Value = r.json().unwrap_or(serde_json::Value::Null);

    if r.status >= 400 {

        let why = v

            .get("detail")

            .or(v.get("title"))

            .and_then(serde_json::Value::as_str)

            .map(String::from)

            .unwrap_or_else(|| String::from_utf8_lossy(&r.body).into());

        bail!("{why}");