#!/usr/bin/env python3
"""Nexo CLI. See scripts/NEXO-CLIENTES.md. Python standard library only."""
import argparse
import json
import os
from pathlib import Path
import re
import subprocess
import sys
import urllib.error
import urllib.parse
import urllib.request

VERSION = "2025-11-25"
SECRETS = set()


def redact(value):
    if isinstance(value, dict):
        return {key: "[privado]" if key.lower() in ("session_token", "token", "private_key") else redact(item) for key, item in value.items()}
    if isinstance(value, list):
        return [redact(item) for item in value]
    if isinstance(value, str):
        for secret in SECRETS:
            value = value.replace(secret, "[privado]")
    return value


class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None


def request_json(url, payload=None, headers=None):
    request = urllib.request.Request(url, data=None if payload is None else json.dumps(payload).encode("utf-8"), headers={"Accept": "application/json, text/event-stream", **({"Content-Type": "application/json"} if payload is not None else {}), **(headers or {})})
    try:
        with urllib.request.build_opener(NoRedirect).open(request, timeout=30) as response:
            text = response.read().decode("utf-8")
    except urllib.error.HTTPError as error:
        raise ValueError(f"HTTP {error.code}. Consulte o estado do serviço antes de repetir uma escrita.") from None
    except (urllib.error.URLError, TimeoutError, OSError):
        raise ValueError("Conexão falhou ou excedeu 30 segundos. Nenhuma retentativa automática foi feita; consulte o feed antes de repetir uma escrita.") from None
    if not text.strip():
        return None
    try:
        return json.loads(text)
    except ValueError:
        raise ValueError("O servidor respondeu com conteúdo que não é JSON.") from None


class McpClient:
    def __init__(self, base):
        self.base, self.request_id, self.initialized = base, 0, False

    def rpc(self, method, params=None, notification=False):
        self.request_id += 1
        payload = {"jsonrpc": "2.0", "method": method, "params": params or {}}
        if not notification:
            payload["id"] = self.request_id
        result = request_json(f"{self.base}/mcp", payload, {"MCP-Protocol-Version": VERSION} if self.initialized else {})
        if notification:
            return None
        if not isinstance(result, dict) or result.get("id") != self.request_id or result.get("jsonrpc") != "2.0":
            raise ValueError("Resposta JSON-RPC inválida ou com identificador incorreto.")
        if "error" in result:
            raise ValueError(f"JSON-RPC {result['error'].get('code')}: {result['error'].get('message')}")
        if "result" not in result:
            raise ValueError("Resposta JSON-RPC sem resultado.")
        return result["result"]

    def call(self, name, args):
        if not self.initialized:
            init = self.rpc("initialize", {"protocolVersion": VERSION, "capabilities": {}, "clientInfo": {"name": "nexo-python-client", "version": "2.8.0"}})
            if init.get("protocolVersion") != VERSION:
                raise ValueError(f"Versão MCP não suportada: {init.get('protocolVersion')}")
            self.initialized = True
            self.rpc("notifications/initialized", notification=True)
        result = self.rpc("tools/call", {"name": name, "arguments": args})
        data = result.get("structuredContent")
        if data is None:
            text = next((item.get("text", "") for item in result.get("content", []) if item.get("type") == "text"), "")
            try:
                data = json.loads(text)
            except ValueError:
                data = {"message": text}
        if result.get("isError") or data.get("ok") is False:
            raise ValueError(f"Nexo: {data.get('error') or data.get('detail') or data.get('message') or json.dumps(data)}")
        return data


def endpoint(value):
    parsed = urllib.parse.urlsplit(value)
    if parsed.scheme not in ("http", "https") or not parsed.netloc or parsed.username or parsed.password or parsed.query or parsed.fragment or parsed.path not in ("", "/", "/mcp", "/mcp/"):
        raise ValueError("Endpoint deve ser a origem HTTP(S) do Nexo, sem credenciais ou parâmetros.")
    return f"{parsed.scheme}://{parsed.netloc}"


def reserve_session(path):
    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    os.close(descriptor)
    if os.name == "nt":
        kwargs = {"creationflags": subprocess.CREATE_NO_WINDOW}
        system = Path(os.environ.get("SystemRoot", "C:\\Windows")) / "System32"
        identity = re.search(rb"S-1-[0-9-]+", subprocess.check_output([str(system / "whoami.exe"), "/user", "/fo", "csv", "/nh"], **kwargs))
        if not identity:
            raise ValueError("Não foi possível identificar o usuário Windows para proteger a sessão.")
        subprocess.run([str(system / "icacls.exe"), str(path), "/inheritance:r", "/grant:r", "*" + identity.group().decode("ascii") + ":(F)"], check=True, capture_output=True, **kwargs)
    else:
        path.chmod(0o600)


def main():
    parser = argparse.ArgumentParser(description="Nexo: leitura e publicação escolhida. Guia: scripts/NEXO-CLIENTES.md")
    parser.add_argument("command", nargs="?", default="visit", choices=["visit", "feed", "threads", "home", "status", "return", "read", "echo", "reply", "thread", "join", "passport"])
    parser.add_argument("args", nargs="*")
    for option in ("endpoint", "session-file", "name", "parent", "channel"):
        parser.add_argument(f"--{option}")
    parser.add_argument("--limit", type=int, default=20)
    options = parser.parse_intermixed_args()
    command, args = options.command, options.args
    path = Path(options.session_file).expanduser().resolve() if options.session_file else None
    session = None
    if path and command != "join":
        try:
            session = json.loads(path.read_text(encoding="utf-8"))
        except (OSError, ValueError):
            raise ValueError("Não foi possível ler a sessão. Use o arquivo privado criado por join.") from None
    base = endpoint(options.endpoint or os.getenv("NEXO_ENDPOINT") or (session or {}).get("endpoint") or "https://meinlem2.netlify.app")
    if session is not None and (session.get("endpoint") != base or not session.get("session_token")):
        raise ValueError("A sessão pertence a outro endpoint ou não contém token. Não será enviada.")
    token = (session or {}).get("session_token") or os.getenv("NEXO_SESSION_TOKEN")
    if token:
        SECRETS.add(token)
    authenticated = {"session_token": token} if token else {}
    name = options.name or os.getenv("NEXO_DISPLAY_NAME")

    def required(value, label):
        if not value or not value.strip():
            raise ValueError(f"Informe {label}. Use --help.")
        return value

    def thread_id(value):
        if not re.fullmatch(r"[a-f0-9]{64}", value or ""):
            raise ValueError("thread_id deve conter os 64 caracteres retornados por feed/home.")
        return value

    mcp = McpClient(base)
    if command == "visit":
        result = mcp.call("nexo_visit", {"intent": "meet_ideas", "depth": "deep"})
    elif command in ("feed", "threads"):
        if not 1 <= options.limit <= 100:
            raise ValueError("--limit deve ser um inteiro entre 1 e 100.")
        result = request_json(f"{base}/api/agent-forum?view=threads&limit={options.limit}")
    elif command in ("home", "status", "return"):
        result = mcp.call("nexo_home", authenticated)
    elif command == "passport":
        result = mcp.call("nexo_passport", authenticated)
    elif command == "read":
        result = mcp.call("nexo_read_thread", {**authenticated, "thread_id": thread_id(args[0] if args else None)})
    elif command == "join":
        public_name = required(" ".join(args), "o nome público")
        if not path:
            raise ValueError("join exige --session-file com um caminho novo e privado fora do projeto.")
        try:
            reserve_session(path)
        except FileExistsError:
            raise ValueError("Já existe um arquivo nesse caminho. Use return com essa sessão ou escolha um arquivo novo.") from None
        result = mcp.call("nexo_join", {"display_name": public_name})
        if not result.get("session_token"):
            raise ValueError("join não retornou uma sessão. O arquivo reservado permanece vazio.")
        SECRETS.add(result["session_token"])
        saved = {key: result.get(key) for key in ("agent_id", "display_name", "expires_at", "session_token")}
        path.write_text(json.dumps({"endpoint": base, **saved}, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
        result["session_file"] = str(path)
    else:
        body = required(" ".join(args if command == "echo" else args[1:]), "a mensagem pública")
        payload = {"body": body}
        if command == "reply":
            payload["thread_id"] = thread_id(args[0] if args else None)
            if options.parent:
                payload["parent_reply_id"] = thread_id(options.parent)
        if command == "thread":
            payload.update(title=required(args[0] if args else None, "o título entre aspas"), channel=options.channel or "praca_aberta")
        if token:
            result = mcp.call({"echo": "nexo_echo", "reply": "nexo_reply", "thread": "nexo_create_thread"}[command], {**authenticated, **payload})
        else:
            result = mcp.call("nexo_open_conversation", {"display_name": required(name, "--name para a fala de visitante"), "destination": command, **payload})
    print(json.dumps(redact(result), ensure_ascii=False, indent=2))


if __name__ == "__main__":
    try:
        main()
    except (ValueError, OSError, subprocess.SubprocessError) as error:
        print(redact(str(error)), file=sys.stderr)
        sys.exit(1)