import * as crypto from "node:crypto";
import * as fs from "node:fs";
import * as path from "node:path";
import { DEFAULT_PATHS } from "../config/defaults.ts";
import { type ConflictReport, detectImportConflicts } from "../runtime/delta-conflict.ts";
import { atomicWriteFile } from "../state/atomic-write.ts";
import { logInternalError } from "../utils/internal-error.ts";
import { projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
import { assertSafePathId, resolveContainedRelativePath, resolveRealContainedPath } from "../utils/safe-paths.ts";
import { assertRunBundle } from "./run-bundle-schema.ts";

export interface ImportedRunBundleInfo {
	runId: string;
	importedAt: string;
	bundlePath: string;
	summaryPath: string;
	conflictReport?: ConflictReport;
}

// DI-1: DoS guard — cap the size of an import bundle. Exported run bundles are
// bounded in practice (JSON manifest + tasks + events for one run); an oversized
// file is either corrupted or a hostile DoS attempt (memory exhaustion from
// reading + JSON.parse). Stat BEFORE reading so we never buffer a huge file.
export const MAX_IMPORT_BUNDLE_BYTES = 50 * 1024 * 1024;

/**
 * W7B (imported-manifest-goal-raw-render): output-encoding seam for untrusted
 * strings imported from run bundles (manifest.goal/team/workflow/status,
 * exportedAt, task.error/id/role/agent) before they are rendered into the
 * parent-LLM team-tool listing (lifecycle-actions.ts handleImports) or the
 * durable import README. Bundle files are repo-authored / plant-able content —
 * assertRunBundle validates types only, not content — so every rendered field
 * is forced into inert single-line data:
 *  1. strip well-formed ANSI CSI escape sequences (colors / cursor moves),
 *  2. collapse remaining C0/C1 controls + DEL to spaces (kills forged
 *     multi-line listing entries and injected directive lines),
 *  3. strip angle brackets (kills fake <dependency-context> fences and
 *     <script> tags),
 *  4. collapse whitespace runs and hard-cap the length.
 * Mirrors the sanitizeFencedBody seam applied to worker output entering parent
 * context (task-output-context.ts).
 */
export function sanitizeImportedText(value: string | undefined, max = 200): string {
	const stripped = String(value ?? "")
		.replace(/\u001b\[[0-9;?]*[0-9A-Za-z]/g, "")
		.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ")
		.replace(/[<>]/g, "")
		.replace(/\s+/g, " ")
		.trim();
	return stripped.length > max ? stripped.slice(0, max) : stripped;
}

function importRoot(cwd: string, scope: "project" | "user"): string {
	const base = scope === "project" ? projectCrewRoot(cwd) : userCrewRoot();
	// SECURITY NOTE: `DEFAULT_PATHS.state.importsSubdir` is a constant (not user-controlled).
	// If this constant ever becomes user-influenced, this function could become a path
	// traversal risk. Always keep `importsSubdir` as a hardcoded constant. Do NOT accept
	// `importsSubdir` as a parameter or from config.
	return path.join(base, DEFAULT_PATHS.state.importsSubdir);
}

export function importRunBundle(cwd: string, bundlePath: string, scope: "project" | "user" = "project"): ImportedRunBundleInfo {
	const resolvedPath = path.isAbsolute(bundlePath) ? bundlePath : path.resolve(cwd, bundlePath);
	// Path containment: use resolveRealContainedPath for canonical real-path check
	// to prevent symlink/../ bypass of the startsWith string comparison.
	const allowedBases: string[] = [];
	try {
		allowedBases.push(userCrewRoot());
	} catch {
		/* ignore */
	}
	try {
		allowedBases.push(projectCrewRoot(cwd));
	} catch {
		/* ignore */
	}
	allowedBases.push(cwd); // always include cwd last (highest priority)
	let isContained = false;
	for (const base of allowedBases) {
		try {
			resolveRealContainedPath(base, resolvedPath);
			isContained = true;
			break;
		} catch {
			/* not contained — try next base */
		}
	}
	if (!isContained) throw new Error(`Import path must be within project directory or crew root: ${resolvedPath}`);
	// DI-1: DoS guard — check size BEFORE reading/parsing. Without this cap a
	// hostile (or corrupted) multi-GB file would be fully buffered + parsed
	// twice, exhausting memory.
	const bundleStat = fs.statSync(resolvedPath);
	if (bundleStat.size > MAX_IMPORT_BUNDLE_BYTES) {
		throw new Error(`Import bundle exceeds size limit: ${bundleStat.size} bytes > ${MAX_IMPORT_BUNDLE_BYTES} bytes (${resolvedPath})`);
	}
	// DI-1: read the file ONCE and parse the same string twice (raw + hash).
	// Previously the file was read twice (double I/O); a large bundle could be
	// swapped between the two reads (TOCTOU on content). Single read also keeps
	// the parsed content consistent between the validation and hash steps.
	const bundleJson = fs.readFileSync(resolvedPath, "utf-8");
	const raw = JSON.parse(bundleJson) as unknown;
	assertRunBundle(raw);

	// Integrity check: verify SHA-256 hash if present in manifest.
	// SECURITY NOTE: This SHA-256 is a CORRUPTION-DETECTION hash only — it
	// detects accidental bit-rot or truncation during transfer. It is NOT an
	// authenticity or tamper-resistance guarantee: the hash is stored INSIDE the
	// bundle (self-referential), so an attacker who can modify the bundle file
	// can also recompute and embed a matching hash. For tamper-evidence, an
	// external HMAC or detached signature would be needed (out of scope).
	// Blast radius is bounded: imports write to imports/<runId>/ only, execute
	// no code, and are validated by isContained + assertSafePathId.
	const parsedForHash = JSON.parse(bundleJson) as {
		manifest?: { sha256?: string };
	};
	if (parsedForHash.manifest?.sha256) {
		const expectedHash = parsedForHash.manifest.sha256;
		// Recompute hash by stringifying the bundle without the sha256 field
		const { sha256: _sha256, ...manifestWithoutHash } = parsedForHash.manifest as Record<string, unknown> & {
			sha256?: string;
		};
		const bundleForHash = {
			...parsedForHash,
			manifest: manifestWithoutHash,
		};
		const recomputedHash = crypto.createHash("sha256").update(JSON.stringify(bundleForHash)).digest("hex");
		if (recomputedHash !== expectedHash) {
			throw new Error(`Integrity check failed: SHA-256 mismatch. Expected ${expectedHash}, got ${recomputedHash}`);
		}
	}

	const runId = assertSafePathId("runId", raw.manifest.runId);
	const importedAt = new Date().toISOString();

	// FIND-11: audit the import for security traceability. The SHA-256 check
	// above is corruption-detection only (NOT authenticity/tamper-resistance) —
	// a tampered bundle carries a matching/absent hash. Use "warn" severity so
	// this ALWAYS emits ("debug" is gated behind PI_TEAMS_DEBUG → no-op in prod).
	logInternalError(
		"security.bundle_imported",
		new Error("bundle imported"),
		`runId="${runId}" source="${resolvedPath}" scope="${scope}"`,
		"warn",
	);

	// Non-blocking conflict detection: compare incoming bundle against any existing state.
	let conflictReport: ConflictReport | undefined;
	try {
		const existingManifestPath = path.join(importRoot(cwd, scope), runId, "run-export.json");
		if (fs.existsSync(existingManifestPath)) {
			const existingRaw = JSON.parse(fs.readFileSync(existingManifestPath, "utf-8")) as {
				manifest?: Record<string, unknown>;
				tasks?: unknown[];
			};
			conflictReport = detectImportConflicts(
				{
					manifest: raw.manifest as unknown as Record<string, unknown>,
					tasks: raw.tasks as unknown[],
				},
				{ manifest: existingRaw.manifest, tasks: existingRaw.tasks },
			);
		}
	} catch {
		// Conflict detection is best-effort; do not block import on failure.
	}

	const importsRoot = importRoot(cwd, scope);
	fs.mkdirSync(importsRoot, { recursive: true });
	if (fs.lstatSync(importsRoot).isSymbolicLink()) throw new Error(`Invalid import root: ${importsRoot}`);
	resolveRealContainedPath(path.dirname(importsRoot), path.basename(importsRoot));
	const root = resolveContainedRelativePath(importsRoot, runId, "runId");
	fs.mkdirSync(root, { recursive: true });
	// TOCTOU note: mkdirSync would throw EEXIST if a symlink already existed.
	// The lstatSync check catches a symlink swapped in between mkdirSync and the check
	// (theoretically possible but requires local attacker with exact timing).
	// resolveRealContainedPath provides an additional real-path containment barrier.
	if (fs.lstatSync(root).isSymbolicLink()) throw new Error(`Invalid import directory: ${root}`);
	resolveRealContainedPath(importsRoot, runId);
	const targetJson = path.join(root, "run-export.json");
	const targetSummary = path.join(root, "README.md");
	for (const target of [targetJson, targetSummary]) {
		if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) throw new Error(`Invalid import target: ${target}`);
	}
	atomicWriteFile(targetJson, `${JSON.stringify({ ...raw, importedAt, importedFrom: resolvedPath }, null, 2)}\n`);
	atomicWriteFile(
		targetSummary,
		// W7B: every bundle-authored string below is untrusted (repo/plant
		// content) — render through the sanitizeImportedText seam so control
		// chars, ANSI escapes and angle-bracket fence tokens can never break out
		// of this README into forged headings/directives.
		[
			`# Imported pi-crew run ${runId}`,
			"",
			`Imported: ${importedAt}`,
			`Source: ${resolvedPath}`,
			`Original export: ${sanitizeImportedText(raw.exportedAt, 64)}`,
			`Status: ${sanitizeImportedText(raw.manifest.status, 64)}`,
			`Team: ${sanitizeImportedText(raw.manifest.team, 64)}`,
			`Workflow: ${raw.manifest.workflow === undefined ? "(none)" : sanitizeImportedText(raw.manifest.workflow, 64)}`,
			`Goal: ${sanitizeImportedText(raw.manifest.goal)}`,
			"",
			"## Tasks",
			...raw.tasks.map(
				(task) =>
					`- ${sanitizeImportedText(task.id, 120)}: ${task.status} (${sanitizeImportedText(task.role, 64)} -> ${sanitizeImportedText(task.agent, 64)})${
						typeof task.error === "string" ? ` - ${sanitizeImportedText(task.error)}` : ""
					}`,
			),
			"",
		].join("\n"),
	);
	return {
		runId,
		importedAt,
		bundlePath: targetJson,
		summaryPath: targetSummary,
		...(conflictReport?.hasConflicts ? { conflictReport } : {}),
	};
}