#[arg(long, help = "Deprecated alias for the positional trace argument")]

        file: Option<String>,

    },

    /// Upload one ATIF document to openagents.com

    ///

    /// Stored at `dark` — nothing public — unless --visibility names a higher

    /// rung. Redact the trace first: what is uploaded is the file as it stands.

    Upload {

        #[arg(help = "A trace file path, or a file name inside ~/.openagents/exports")]

        trace: String,

        #[arg(

            long,

            default_value = crate::trace_client::DEFAULT_TRACE_VISIBILITY,

            help = "Transparency rung: dark (nothing public), pulse (metadata only), ledger (content and metadata), or glass (full access)"

        )]

        visibility: String,

        #[arg(long, help = "Bind the trace to the forge attempt with this id")]

        assignment: Option<String>,

    },

}

/// The completion script for one shell.

        Commands::Memory(mem) => run_memory(mem.action, &api_base, token, cli.json).await,

        Commands::Api(api) => crate::api_passthrough::run(api, &endpoint, cli.json).await,

        Commands::Plugin(plugin) => crate::plugins::run(plugin, cli.json).await,

        Commands::Trace(trace) => run_trace(trace.action),

        Commands::Trace(trace) => run_trace(trace.action, &api_base, token, cli.json).await,

        Commands::Update(update) => {

            crate::update::run(update.channel, update.version, update.check, update.force).await?;

        }

                (None, true) => None,

            };

            let target = target_or_fail(repo);

            let value = or_fail(tracker.set_issue_milestone(&target, number, milestone).await);

            let value = or_fail(

                tracker

                    .set_issue_milestone(&target, number, milestone)

                    .await,

            );

            // Report what came BACK, not what was asked for. A server that

            // accepted the request and stored something else is the case a

            // printed echo of the argument would hide.

            let stored = value.get("milestone").and_then(|m| {

                if m.is_null() {

                    None

                } else {

                    Some(m)

                }

            });

            let stored = value

                .get("milestone")

                .filter(|milestone| !milestone.is_null());

            let human = match stored {

                Some(m) => format!(

                    "Issue #{} is on milestone #{} {}",

/// `create` and `delete` existed on the client and were wired to nothing, so a

/// milestone could only be opened or removed in a browser -- which made

/// milestones useless to agents, and agents file most of the issues here.

async fn run_milestone(

    action: MilestoneAction,

    api_base: &str,

    token: Option<String>,

    json: bool,

) {

async fn run_milestone(action: MilestoneAction, api_base: &str, token: Option<String>, json: bool) {

    let tracker = crate::tracker::TrackerClient::new(api_base, token);

    match action {

        MilestoneAction::List { repo } => {

            let target = target_or_fail(repo);

            let value = or_fail(

                tracker

                    .create_milestone(

                        &target,

                        &title,

                        description.as_deref(),

                        due_on.as_deref(),

                    )

                    .create_milestone(&target, &title, description.as_deref(), due_on.as_deref())

                    .await,

            );

            // The server assigns the number. Printing the one it returned is

// trace

// ---------------------------------------------------------------------------

fn run_trace(action: TraceAction) {

async fn run_trace(action: TraceAction, api_base: &str, token: Option<String>, json: bool) {

    use crate::trace;

    let home = home_directory();

                );

            }

        }

        TraceAction::Upload {

            trace: argument,

            visibility,

            assignment,

        } => {

            // Everything checkable against the file is checked before anything

            // leaves this machine, so a refusal names the file rather than

            // arriving as a status the caller then has to interpret.

            let visibility = or_fail(crate::trace_client::read_visibility(&visibility));

            let path = trace::resolve_trace_argument(&argument, &home)

                .unwrap_or_else(|message| fail(&message));

            let size = std::fs::metadata(&path)

                .map(|meta| meta.len())

                .unwrap_or_else(|error| {

                    fail(&format!(

                        "The trace file at {} could not be read: {}",

                        path.display(),

                        error

                    ))

                });

            if size > crate::trace_client::MAXIMUM_TRACE_BYTES {

                fail(&format!(

                    "{} is {} bytes; the ingest route accepts at most {}. Upload a redacted or trimmed copy instead.",

                    path.display(),

                    size,

                    crate::trace_client::MAXIMUM_TRACE_BYTES

                ));

            }

            let text = std::fs::read_to_string(&path).unwrap_or_else(|error| {

                fail(&format!(

                    "The trace file at {} could not be read: {}",

                    path.display(),

                    error

                ))

            });

            let document: serde_json::Value = serde_json::from_str(&text).unwrap_or_else(|_| {

                fail(&format!(

                    "{} is not JSON. The ingest route takes one ATIF document; a line-delimited session log has to be converted first.",

                    path.display()

                ))

            });

            if !document.is_object() {

                fail(&format!(

                    "{} is JSON but not an object, so it is not an ATIF document.",

                    path.display()

                ));

            }

            // The server decides which schema versions it accepts. This only

            // catches a file that names none at all, which it can say something

            // more useful about the file than a 422 can.

            if document.get("schema_version").and_then(|v| v.as_str()).is_none() {

                fail(&format!(

                    "{} carries no schema_version, so it is not an ATIF document. `oa trace show {}` reports what it is.",

                    path.display(),

                    argument

                ));

            }

            let client = crate::trace_client::TraceClient::new(api_base, token);

            let stored = or_fail(

                client

                    .upload(&document, visibility, assignment.as_deref())

                    .await,

            );

            let value = serde_json::json!({

                "schema": "openagents.trace_upload.v1",

                "input": path,

                "id": stored.id,

                "digest": stored.digest,

                "byte_size": stored.byte_size,

                "visibility": stored.visibility,

                "inserted_at": stored.inserted_at,

                "created": stored.created,

            });

            let human = vec![

                // A 200 means the server already held this digest. Calling that

                // an upload would report a write that did not happen.

                if stored.created {

                    format!("Uploaded {}", path.display())

                } else {

                    "Already stored: the server holds this trace under the same digest.".to_string()

                },

                format!("Trace: {}", stored.id),

                format!("Digest: {}", stored.digest),

                format!(

                    "Stored: {} bytes at visibility {}",

                    stored.byte_size, stored.visibility

                ),

                // No link. The response carries a url pointing at

                // GET /api/v1/traces/:id, and that route does not exist, so

                // printing it would hand the reader a 404 dressed as a receipt.

            ];

            emit(json, &value, &human);

        }

    }

}

pub mod signals;

pub mod tools;

pub mod trace;

pub mod trace_client;

pub mod tracker;

pub mod tui;

pub mod update;

//! The trace ingest client: `POST /api/v1/traces`.

//!

//! The Rust half of what `packages/openagents-cli/src/trace-client.ts` does. The

//! route takes an ATIF v1 document as the whole request body, stores it against the

//! calling account, and answers 201 for a document it did not hold or 200 for one it

//! already has under the same digest.

//!

//! Three things this client will not do:

//!

//! - It does not invent a visibility. The server's vocabulary is the forge

//!   transparency ladder, and `dark` — nothing public — is the default there and

//!   here. A caller who wants more has to say which rung.

//! - It does not call an existing trace a new one. The status is the only thing that

//!   tells them apart, so it is kept rather than discarded.

//! - It does not report a stored trace by a link. The response carries a `url`

//!   pointing at `GET /api/v1/traces/:id`, and that route does not exist, so

//!   printing it would hand someone a 404 dressed as a receipt. The id and the

//!   digest are real, and they are what get reported.

use reqwest::header::{HeaderMap, HeaderValue, ACCEPT, AUTHORIZATION, CONTENT_TYPE};

use serde::{Deserialize, Serialize};

use serde_json::Value;

use crate::tracker::{error_sentence, urlencode, ApiError};

/// The transparency ladder the server stores a trace under.

///

/// `dark` is nothing public, `pulse` is metadata only, `ledger` is content and

/// metadata, `glass` is full access. The database enforces this exact set with a

/// CHECK constraint, so a name outside it is refused here with the list rather than

/// sent on to earn a 422 that does not say what the choices were.

pub const TRACE_VISIBILITIES: [&str; 4] = ["dark", "pulse", "ledger", "glass"];

/// What the server defaults to when no visibility is named: nothing public.

pub const DEFAULT_TRACE_VISIBILITY: &str = "dark";

/// The largest body the ingest route accepts, in bytes.

pub const MAXIMUM_TRACE_BYTES: u64 = 10_485_760;

/// Read a visibility name, or refuse with the set the server actually has.

pub fn read_visibility(raw: &str) -> Result<&'static str, ApiError> {

    let trimmed = raw.trim().to_lowercase();

    TRACE_VISIBILITIES

        .iter()

        .copied()

        .find(|name| *name == trimmed)

        .ok_or_else(|| {

            ApiError::Input(format!(

                "--visibility must be one of {}; got \"{}\".",

                TRACE_VISIBILITIES.join(", "),

                raw

            ))

        })

}

/// What the server said it stored. Every field is the server's, not a guess.

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]

pub struct StoredTrace {

    pub id: String,

    pub digest: String,

    pub byte_size: u64,

    pub visibility: String,

    pub inserted_at: String,

    /// 201: the server did not hold this document. 200: it already did.

    pub created: bool,

}

pub struct TraceClient {

    pub api_base: String,

    pub token: Option<String>,

    pub http: reqwest::Client,

}

impl TraceClient {

    pub fn new(api_base: &str, token: Option<String>) -> Self {

        Self {

            api_base: api_base.trim_end_matches('/').to_string(),

            token,

            http: reqwest::Client::new(),

        }

    }

    fn headers(&self) -> HeaderMap {

        let mut map = HeaderMap::new();

        map.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));

        map.insert(ACCEPT, HeaderValue::from_static("application/json"));

        if let Some(token) = &self.token {

            if let Ok(value) = HeaderValue::from_str(&format!("Bearer {}", token)) {

                map.insert(AUTHORIZATION, value);

            }

        }

        map

    }

    /// Send one ATIF document. `visibility` must already have passed

    /// [`read_visibility`]; `assignment_id` names the forge attempt the trajectory

    /// belongs to, when there is one.

    pub async fn upload(

        &self,

        document: &Value,

        visibility: &str,

        assignment_id: Option<&str>,

    ) -> Result<StoredTrace, ApiError> {

        let mut url = format!(

            "{}/traces?visibility={}",

            self.api_base,

            urlencode(visibility)

        );

        if let Some(assignment) = assignment_id {

            url.push_str(&format!("&assignment_id={}", urlencode(assignment)));

        }

        crate::diag::request("POST", &url);

        let response = self

            .http

            .post(&url)

            .headers(self.headers())

            .json(document)

            .send()

            .await

            .map_err(|error| {

                crate::diag::transport(&url, &error.to_string());

                ApiError::Transport {

                    operation: "upload a trace".to_string(),

                    why: error.to_string(),

                }

            })?;

        let status = response.status().as_u16();

        crate::diag::response(status, &url);

        let text = response.text().await.map_err(|error| ApiError::Transport {

            operation: "upload a trace".to_string(),

            why: error.to_string(),

        })?;

        if status != 200 && status != 201 {

            let message = error_sentence(&text, status);

            crate::diag::refused(status, &message);

            return Err(ApiError::Refused {

                operation: "upload a trace".to_string(),

                status,

                message,

            });

        }

        let stored: Value = serde_json::from_str(&text).map_err(|error| ApiError::Malformed {

            operation: "upload a trace".to_string(),

            why: error.to_string(),

        })?;

        let field = |key: &str| stored.get(key).and_then(Value::as_str).map(String::from);

        // An accepted status with no id is not a stored trace. Reporting one anyway

        // is how a caller comes to believe a trace exists server-side that nothing

        // can ever be found by.

        let (Some(id), Some(digest)) = (field("id"), field("digest")) else {

            return Err(ApiError::Malformed {

                operation: "upload a trace".to_string(),

                why: "the server accepted the trace but named no id or digest".to_string(),

            });

        };

        Ok(StoredTrace {

            id,

            digest,

            byte_size: stored

                .get("byte_size")

                .and_then(Value::as_u64)

                .unwrap_or_default(),

            visibility: field("visibility").unwrap_or_else(|| visibility.to_string()),

            inserted_at: field("inserted_at").unwrap_or_default(),

            created: status == 201,

        })

    }

}

//! `oa trace upload` against the ingest route.

//!

//! The command used to be absent from this CLI and to refuse with exit 16 in the

//! TypeScript one, on the grounds that `POST /api/v1/traces` did not exist. It does

//! exist. So the thing worth asserting is no longer "does it refuse" but what it

//! actually puts on the wire, and — more importantly — what it refuses to say when

//! the server's answer does not support saying it.

//!

//! These run against a stub server on localhost. Uploading a trace is a write, and a

//! test that proves upload works by writing to the real store is not one anyone can

//! run twice.

use openagents_cli::trace_client::{read_visibility, TraceClient, TRACE_VISIBILITIES};

use std::io::{BufRead, BufReader, Read, Write};

use std::net::TcpListener;

use std::sync::mpsc::{channel, Receiver};

#[derive(Debug, Clone)]

struct SeenRequest {

    method: String,

    path: String,

    authorization: Option<String>,

    body: serde_json::Value,

}

struct StubApi {

    base: String,

    seen: Receiver<SeenRequest>,

}

/// Serve one request with `status` and `body`, and report what was asked.

fn start_stub_api(status: u16, body: serde_json::Value) -> StubApi {

    let listener = TcpListener::bind("127.0.0.1:0").unwrap();

    let port = listener.local_addr().unwrap().port();

    let (sender, seen) = channel();

    std::thread::spawn(move || {

        let Ok((stream, _)) = listener.accept() else {

            return;

        };

        let mut reader = BufReader::new(stream);

        let mut request_line = String::new();

        if reader.read_line(&mut request_line).is_err() {

            return;

        }

        let mut parts = request_line.split_whitespace();

        let method = parts.next().unwrap_or_default().to_string();

        let path = parts.next().unwrap_or_default().to_string();

        let mut content_length = 0usize;

        let mut authorization = None;

        loop {

            let mut header = String::new();

            match reader.read_line(&mut header) {

                Ok(0) => break,

                Ok(_) => {}

                Err(_) => return,

            }

            let trimmed = header.trim_end();

            if trimmed.is_empty() {

                break;

            }

            if let Some((name, value)) = trimmed.split_once(':') {

                if name.eq_ignore_ascii_case("content-length") {

                    content_length = value.trim().parse().unwrap_or(0);

                }

                if name.eq_ignore_ascii_case("authorization") {

                    authorization = Some(value.trim().to_string());

                }

            }

        }

        let mut raw = vec![0u8; content_length];

        if content_length > 0 && reader.read_exact(&mut raw).is_err() {

            return;

        }

        let parsed = if raw.is_empty() {

            serde_json::Value::Null

        } else {

            serde_json::from_slice(&raw).unwrap_or(serde_json::Value::Null)

        };

        let _ = sender.send(SeenRequest {

            method,

            path,

            authorization,

            body: parsed,

        });

        let payload = if body.is_null() {

            String::new()

        } else {

            body.to_string()

        };

        let response = format!(

            "HTTP/1.1 {status} X\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{payload}",

            payload.len()

        );

        let stream = reader.get_mut();

        let _ = stream.write_all(response.as_bytes());

        let _ = stream.flush();

    });

    StubApi {

        base: format!("http://127.0.0.1:{port}/api/v1"),

        seen,

    }

}

fn seen(stub: &StubApi) -> SeenRequest {

    stub.seen

        .recv_timeout(std::time::Duration::from_secs(10))

        .expect("the client never sent a request")

}

fn atif_document() -> serde_json::Value {

    serde_json::json!({

        "schema_version": "ATIF-v1.7",

        "session_id": "probe",

        "steps": [{ "step_id": 1, "source": "user", "message": "hello" }]

    })

}

fn stored_body(visibility: &str) -> serde_json::Value {

    serde_json::json!({

        "id": "trace-1",

        // The route the server points at here does not exist. The client must

        // not carry it through to the caller as a place to look.

        "url": "https://openagents.com/api/v1/traces/trace-1",

        "digest": format!("sha256:{}", "a".repeat(64)),

        "byte_size": 412,

        "visibility": visibility,

        "inserted_at": "2026-08-26T03:00:00Z"

    })

}

#[test]

fn a_visibility_outside_the_servers_set_is_refused_with_the_set() {

    for name in TRACE_VISIBILITIES {

        assert_eq!(read_visibility(name).unwrap(), name);

    }

    // The names the old flags spoke. They were never the server's vocabulary.

    for wrong in ["public", "unlisted", "owner_only", ""] {

        let refusal = read_visibility(wrong)

            .expect_err(&format!("{wrong} is not a rung the server stores at"));

        let text = refusal.to_string();

        assert!(

            text.contains("dark, pulse, ledger, glass"),

            "the refusal must name the choices; got {text}"

        );

    }

}

#[tokio::test]

async fn upload_posts_the_document_itself_with_the_visibility_named() {

    let stub = start_stub_api(201, stored_body("dark"));

    let client = TraceClient::new(&stub.base, Some("oa_pat_test".to_string()));

    let stored = client

        .upload(&atif_document(), "dark", None)

        .await

        .expect("the stub answered 201");

    let request = seen(&stub);

    assert_eq!(request.method, "POST");

    assert_eq!(request.path, "/api/v1/traces?visibility=dark");

    assert_eq!(

        request.authorization.as_deref(),

        Some("Bearer oa_pat_test"),

        "the ingest route is account-scoped"

    );

    // The body is the document, with nothing wrapped around it.

    assert_eq!(request.body, atif_document());

    assert_eq!(stored.id, "trace-1");

    assert!(

        stored.created,

        "201 means the server did not hold it before"

    );

    assert_eq!(stored.byte_size, 412);

    assert_eq!(stored.visibility, "dark");

}

#[tokio::test]

async fn an_existing_digest_is_reported_as_existing_not_as_an_upload() {

    let stub = start_stub_api(200, stored_body("dark"));

    let client = TraceClient::new(&stub.base, None);

    let stored = client.upload(&atif_document(), "dark", None).await.unwrap();

    let _ = seen(&stub);

    // The status is the only thing that tells the two apart. Discarding it is

    // how a caller comes to believe a write happened that did not.

    assert!(

        !stored.created,

        "a 200 means the server already held this digest"

    );

}

#[tokio::test]

async fn the_attempt_binding_and_a_higher_rung_reach_the_route() {

    let stub = start_stub_api(201, stored_body("ledger"));

    let client = TraceClient::new(&stub.base, None);

    client

        .upload(&atif_document(), "ledger", Some("asg-9"))

        .await

        .unwrap();

    let request = seen(&stub);

    assert!(

        request.path.contains("visibility=ledger"),

        "path was {}",

        request.path

    );

    assert!(

        request.path.contains("assignment_id=asg-9"),

        "path was {}",

        request.path

    );

}

#[tokio::test]

async fn nothing_the_client_returns_carries_the_dead_url_the_server_sends() {

    let stub = start_stub_api(201, stored_body("dark"));

    let client = TraceClient::new(&stub.base, None);

    let stored = client.upload(&atif_document(), "dark", None).await.unwrap();

    let _ = seen(&stub);

    // `GET /api/v1/traces/:id` is not a route. Reporting the url the server

    // builds would hand the reader a 404 dressed as a receipt.

    let rendered = serde_json::to_string(&stored).unwrap();

    assert!(

        !rendered.contains("openagents.com/api/v1/traces/"),

        "the client carried the server's unreachable url through: {rendered}"

    );

}

#[tokio::test]

async fn an_accepted_status_that_names_nothing_stored_is_an_error() {

    // 201 with an empty body: the server said yes and said nothing. Reporting a

    // stored trace here is how a caller comes to believe in one that has no id.

    let stub = start_stub_api(201, serde_json::json!({}));

    let client = TraceClient::new(&stub.base, None);

    let refused = client.upload(&atif_document(), "dark", None).await;

    let _ = seen(&stub);

    let error = refused.expect_err("an id-less 201 is not a stored trace");

    let text = error.to_string();

    assert!(

        text.contains("no id or digest"),

        "the error must say what was missing; got {text}"

    );

}

#[tokio::test]

async fn a_refusal_is_an_error_carrying_what_the_server_said() {

    let stub = start_stub_api(

        422,

        serde_json::json!({

            "message": "Validation Failed",

            "errors": { "document": ["The document is not a valid ATIF v1 object."] }

        }),

    );

    let client = TraceClient::new(&stub.base, None);

    let refused = client.upload(&atif_document(), "dark", None).await;

    let _ = seen(&stub);

    let text = refused

        .expect_err("a 422 is not a stored trace")

        .to_string();

    assert!(

        text.contains("not a valid ATIF v1 object"),

        "the refusal must carry the server's own words; got {text}"

    );

}

  { message: Schema.String },

) {}

export class TraceUploadUnsupported extends Schema.TaggedErrorClass<TraceUploadUnsupported>()(

  "OpenAgentsCli.TraceUploadUnsupported",

  { message: Schema.String },

) {}

/** A fleet promotion target reached `failed` or `reverted`. */

export class DeploymentFailed extends Schema.TaggedErrorClass<DeploymentFailed>()(

  "OpenAgentsCli.DeploymentFailed",

  | ComputerMachineUnavailable

  | ComputerMachineMismatch

  | ComputerReconnectExhausted

  | TraceUploadUnsupported

  | DeploymentFailed

  | DeploymentWaitTimeout

  | DeploymentRollingReplaceRequired;

      return 14;

    case "OpenAgentsCli.ComputerReconnectExhausted":

      return 15;

    case "OpenAgentsCli.TraceUploadUnsupported":

      return 16;

    // 16 was TraceUploadUnsupported, the refusal `trace upload` returned while

    // POST /api/v1/traces did not exist. The route exists and the command

    // uploads, so the code is retired rather than reassigned: a script that

    // still checks for 16 should stop seeing it, not start seeing it mean

    // something else.

    // Deployment outcomes stay apart from each other and from transport

    // failures, so release automation can tell "the fleet rejected these

    // bytes" from "the CLI stopped watching" without parsing prose.

  "OpenAgentsCli.ComputerMachineUnavailable",

  "OpenAgentsCli.ComputerMachineMismatch",

  "OpenAgentsCli.ComputerReconnectExhausted",

  "OpenAgentsCli.TraceUploadUnsupported",

  "OpenAgentsCli.DeploymentFailed",

  "OpenAgentsCli.DeploymentWaitTimeout",

  "OpenAgentsCli.DeploymentRollingReplaceRequired",

import { persistedConfigurationLayer } from "./persisted-configuration.js";

import { projectClientLayer } from "./project-client.js";

import { repositoryClientLayer } from "./repository-client.js";

import { traceClientLayer } from "./trace-client.js";

import { requestBodyInputLayer } from "./request-body-input.js";

import { secretInputLayer } from "./secret-input.js";

import { terminalSessionNodeLayer } from "./terminal-session.js";

const issueLayer = issueClientLayer.pipe(Layer.provide(transportLayer));

const projectLayer = projectClientLayer.pipe(Layer.provide(transportLayer));

const memoryLayer = memoryClientLayer.pipe(Layer.provide(transportLayer));

const traceLayer = traceClientLayer.pipe(Layer.provide(transportLayer));

const boxClient = boxClientLayer.pipe(Layer.provide(transportLayer));

const computerClient = computerClientLayer.pipe(Layer.provide(transportLayer));

const credentialsLayer = credentialStoreOsLayer.pipe(Layer.provide(NodeServices.layer));

  issueLayer,

  projectLayer,

  memoryLayer,

  traceLayer,

  deviceLayer,

  boxClient,

  computerClient,

/**

 * The trace ingest client: `POST /api/v1/traces`.

 *

 * This is the server half `trace upload` used to refuse for. The route exists

 * -- it takes an ATIF v1 document as the whole request body, stores it against

 * the calling account, and answers 201 for a document it did not hold or 200

 * for one it already has under the same digest.

 *

 * Three things this client will not do:

 *

 * - It does not invent a visibility. The server's vocabulary is the forge

 *   transparency ladder, and `dark` -- nothing public -- is the default there

 *   and here. A caller who wants more has to say which rung.

 * - It does not call an existing trace a new one. The status is the only thing

 *   that distinguishes them, so it is read rather than discarded, and a 200 is

 *   reported as "already held" rather than as an upload that wrote something.

 * - It does not report a stored trace by a link. The response carries a `url`

 *   pointing at `GET /api/v1/traces/:id`, and that route does not exist, so

 *   printing it would hand someone a 404 dressed as a receipt. The id and the

 *   digest are real, and they are what get reported.

 */

import { Effect, Layer } from "effect";

import * as Context from "effect/Context";

import { ApiTransport } from "./api-transport.js";

import { API_VERSION_PATH } from "./constants.js";

import { ApiError, type CliError } from "./errors.js";

import type { AuthenticatedApi } from "./repository-client.js";

import { asNumber, asRecord, asText, trackerErrorDetails } from "./tracker-request.js";

/**

 * The transparency ladder the server stores a trace under.

 *

 * `dark` is nothing public, `pulse` is metadata only, `ledger` is content and

 * metadata, and `glass` is full access. The database enforces this exact set

 * with a CHECK constraint, so a name outside it is refused here with the list

 * rather than sent on to earn a 422 that does not say what the choices were.

 */

export const TRACE_VISIBILITIES = ["dark", "pulse", "ledger", "glass"] as const;

export type TraceVisibility = (typeof TRACE_VISIBILITIES)[number];

/** What the server defaults to when no visibility is named: nothing public. */

export const DEFAULT_TRACE_VISIBILITY: TraceVisibility = "dark";

/** The largest body the ingest route accepts, in bytes. */

export const MAXIMUM_TRACE_BYTES = 10_485_760;

export const isTraceVisibility = (value: string): value is TraceVisibility =>

  (TRACE_VISIBILITIES as ReadonlyArray<string>).includes(value);

export interface TraceUploadInput extends AuthenticatedApi {

  /** The ATIF document, parsed. It is sent as the whole request body. */

  readonly document: unknown;

  readonly visibility: TraceVisibility;

  /** The forge attempt this trajectory belongs to, when there is one. */

  readonly assignmentId?: string;

}

/** What the server said it stored. Every field is the server's, not a guess. */

export interface TraceUploadResult {

  readonly id: string;

  readonly digest: string;

  readonly byte_size: number;

  readonly visibility: string;

  readonly inserted_at: string;

  /** 201: the server did not hold this document. 200: it already did. */

  readonly created: boolean;

}

interface TraceClientInterface {

  readonly upload: (input: TraceUploadInput) => Effect.Effect<TraceUploadResult, CliError>;

}

export class TraceClient extends Context.Service<TraceClient, TraceClientInterface>()(

  "@openagentsinc/cli/TraceClient",

) {}

export const traceClientLayer = Layer.effect(

  TraceClient,

  Effect.gen(function* () {

    const transport = yield* ApiTransport;

    return TraceClient.of({

      upload: Effect.fn("TraceClient.upload")(function* (input: TraceUploadInput) {

        // Visibility and the attempt binding are query parameters; the body is

        // the document itself, with nothing wrapped around it.

        const parameters = new URLSearchParams({ visibility: input.visibility });

        if (input.assignmentId !== undefined) {

          parameters.set("assignment_id", input.assignmentId);

        }

        const response = yield* transport.request({

          origin: input.origin,

          token: input.token,

          method: "POST",

          path: `${API_VERSION_PATH}/traces?${parameters.toString()}`,

          body: input.document,

        });

        if (response.status !== 200 && response.status !== 201) {

          const details = trackerErrorDetails(response.body, response.status);

          return yield* new ApiError({

            operation: "upload a trace",

            status: response.status,

            ...(details.code === undefined ? {} : { code: details.code }),

            message: details.message,

            ...(response.requestId === undefined && details.requestId === undefined

              ? {}

              : { requestId: response.requestId ?? details.requestId }),

          });

        }

        const stored = asRecord(response.body);

        const id = asText(stored["id"]);

        const digest = asText(stored["digest"]);

        if (id === undefined || digest === undefined) {

          // An accepted status with no id is not a stored trace. Reporting one

          // anyway is how a caller comes to believe a trace exists server-side

          // that nothing can ever be found by.

          return yield* new ApiError({

            operation: "upload a trace",

            status: response.status,

            message:

              "The server accepted the trace but did not say what it stored: the response carries no id or digest.",

            ...(response.requestId === undefined ? {} : { requestId: response.requestId }),

          });

        }

        return {

          id,

          digest,

          byte_size: asNumber(stored["byte_size"]) ?? 0,

          visibility: asText(stored["visibility"]) ?? input.visibility,

          inserted_at: asText(stored["inserted_at"]) ?? "",

          created: response.status === 201,

        } satisfies TraceUploadResult;

      }),

    });

  }),

);

/**

 * The `openagents trace` command family.

 *

 * This is the LOCAL half of the trace pipeline: list what session exports

 * exist on this machine, summarize one, and produce a redacted sibling copy.

 * The upload half needs a forge ingest route that does not exist yet, so

 * `trace upload` refuses with a typed error that names the missing route

 * instead of pretending.

 * `list`, `show`, and `redact` are the local half: what session exports exist

 * on this machine, what one holds, and a redacted sibling copy of it. `upload`

 * is the remote half, and it now sends the document to `POST /api/v1/traces`

 * rather than refusing -- that route exists.

 *

 * The family is defined through a factory taking the root command, so the

 * registration hunk in `cli.ts` stays a single import and a single list entry.

 */

import { existsSync } from "node:fs";

import { existsSync, readFileSync, statSync } from "node:fs";

import { homedir } from "node:os";

import { isAbsolute, join, resolve } from "node:path";

import { Effect } from "effect";

import { Effect, Option } from "effect";

import { Argument, Command, Flag } from "effect/unstable/cli";

import { InputError, TraceUploadUnsupported } from "./errors.js";

import { API_VERSION_PATH } from "./constants.js";

import { type EndpointOverrides, type Profile } from "./endpoint.js";

import { InputError } from "./errors.js";

import { Output, type OutputMode } from "./output.js";

import { resolveApiSession } from "./session.js";

import {

  DEFAULT_TRACE_VISIBILITY,

  MAXIMUM_TRACE_BYTES,

  TRACE_VISIBILITIES,

  TraceClient,

  isTraceVisibility,

} from "./trace-client.js";

import {

  defaultDiscoveryBounds,

  defaultTraceStores,

/** The shared flags a trace handler reads back off the root command. */

interface SharedFlags {

  readonly profile: Option.Option<Profile>;

  readonly apiUrl: Option.Option<string>;

  readonly json: boolean;

}

const outputMode = (json: boolean): OutputMode => (json ? "json" : "human");

/** The server half `trace upload` is waiting for. One place, one sentence. */

export const TRACE_INGEST_ROUTE_GAP =

  "openagents.com has no trace ingest route yet. Upload needs the server half first: " +

  `POST ${API_VERSION_PATH}/traces accepting an ATIF v1.7 document with owner_only default visibility. ` +

  "Until that route exists, this command refuses rather than pretending to upload.";

const endpointOverrides = (flags: SharedFlags): EndpointOverrides => ({

  profile: flags.profile,

  apiUrl: flags.apiUrl,

});

const listPathFlag = Flag.string("path").pipe(

  Flag.atLeast(0),

    ),

  );

  const uploadPublicFlag = Flag.boolean("public").pipe(

    Flag.withDescription("Ask for public visibility instead of the owner_only default"),

  const uploadVisibilityFlag = Flag.string("visibility").pipe(

    Flag.withDefault(DEFAULT_TRACE_VISIBILITY as string),

    Flag.withDescription(

      `Transparency rung to store the trace at: ${TRACE_VISIBILITIES.join(", ")}. ` +

        "dark is nothing public, pulse is metadata only, ledger is content and metadata, glass is full access.",

    ),

  );

  const uploadUnlistedFlag = Flag.boolean("unlisted").pipe(

    Flag.withDescription("Ask for unlisted visibility instead of the owner_only default"),

  const uploadAssignmentFlag = Flag.string("assignment").pipe(

    Flag.optional,

    Flag.withDescription("Bind the trace to the forge attempt with this id"),

  );

  const traceUploadCommand = Command.make(

    "upload",

    { trace: traceArgument, public: uploadPublicFlag, unlisted: uploadUnlistedFlag },

    ({ public: isPublic, trace, unlisted }) =>

    {

      trace: traceArgument,

      visibility: uploadVisibilityFlag,

      assignment: uploadAssignmentFlag,

    },

    ({ assignment, trace, visibility }) =>

      Effect.gen(function* () {

        if (isPublic && unlisted) {

          return yield* new InputError({ message: "Use either --public or --unlisted, not both." });

        if (!isTraceVisibility(visibility)) {

          return yield* new InputError({

            message: `--visibility must be one of ${TRACE_VISIBILITIES.join(", ")}; got ${visibility}.`,

          });

        }

        const flags = yield* root;

        const output = yield* Output;

        const path = yield* resolveTraceArgument(trace);

        // Everything that can be checked against the file is checked before

        // anything leaves this machine, so a refusal names the file rather than

        // arriving as a status from a server the caller then has to interpret.

        const size = yield* Effect.try({

          try: () => statSync(path).size,

          catch: () => new InputError({ message: `The trace file at ${path} could not be read.` }),

        });

        if (size > MAXIMUM_TRACE_BYTES) {

          return yield* new InputError({

            message: `${path} is ${size} bytes; the ingest route accepts at most ${MAXIMUM_TRACE_BYTES}. Upload a redacted or trimmed copy instead.`,