main.go

package main

import (
	"errors"
	"fmt"
	"os"
	"strings"
	"syscall"

	"github.com/spf13/cobra"
	"golang.org/x/term"

	_ "embed"
)

//go:embed assets/skills/opub/SKILL.md
var opubSkill string

//go:embed assets/copilot-plugin/plugin.json
var copilotPluginJSON string

//go:embed assets/copilot-plugin/.mcp.json
var copilotPluginMCPJSON string

//go:embed assets/copilot-plugin/skills/opub-funded-work/SKILL.md
var copilotPluginSkill string

const version = "0.1.0"

func main() {
	root := rootCommand()
	if err := root.Execute(); err != nil {
		os.Exit(1)
	}
}

func rootCommand() *cobra.Command {
	root := &cobra.Command{
		Use:     "opub",
		Short:   "Use donated opub compute from local tools",
		Version: version,
	}
	root.AddCommand(
		setupCmd(),
		runCmd(),
		doctorCmd(),
		mcpCmd(),
		pathsCmd(),
	)
	return root
}

// setup

func setupCmd() *cobra.Command {
	var (
		project          string
		projectID        string
		computeKeyID     string
		provider         string
		apiKeyHash       string
		insecureStorage  bool
		providerKeyStdin bool
	)

	cmd := &cobra.Command{
		Use:   "setup <agent>",
		Short: "Configure opub for an agent in the current repository",
		Args:  cobra.ExactArgs(1),
		RunE: func(cmd *cobra.Command, args []string) error {
			cmd.SilenceUsage = true

			t, err := parseTarget(args[0])
			if err != nil {
				return err
			}
			if err := validateProjectName(project); err != nil {
				return err
			}
			if computeKeyID == "" {
				return errors.New("pass --compute-key-id from the browser setup output")
			}

			paths, err := discoverRepoPaths(t.name())
			if err != nil {
				return err
			}
			if err := verifyProjectMatchesOrigin(paths, project); err != nil {
				return err
			}

			mode := StorageModeSystem
			if insecureStorage {
				mode = StorageModeInsecure
			}

			var projectIDPtr *string
			if projectID != "" {
				projectIDPtr = &projectID
			}
			var apiKeyHashPtr *string
			if apiKeyHash != "" {
				apiKeyHashPtr = &apiKeyHash
			}

			cfg := &LocalConfig{
				Version:    1,
				Project:    ProjectConfig{FullName: project, ID: projectIDPtr},
				ComputeKey: ComputeKeyConfig{ID: computeKeyID},
				Provider: ProviderConfig{
					Name:              provider,
					KeyHash:           apiKeyHashPtr,
					CredentialStorage: storageModeLabel(mode),
				},
				Target: TargetConfig{Name: t.name()},
			}

			secret, err := readProviderKey(providerKeyStdin)
			if err != nil {
				return err
			}

			ref := t.credentialRef(cfg)
			store := CredentialStore{mode: mode}
			if err := store.Set(ref, secret); err != nil {
				return err
			}
			if err := writeConfig(paths, cfg); err != nil {
				return err
			}

			fmt.Printf("Configured opub for %s\n", cfg.Project.FullName)
			fmt.Printf("Compute key: %s\n", cfg.ComputeKey.ID)
			fmt.Printf("Agent: %s\n", t.name())
			fmt.Printf("Credentials: %s\n", store.LocationLabel())
			fmt.Printf("Config: %s\n", paths.Config)
			fmt.Printf("State: %s\n", paths.StateDir)
			fmt.Printf("Daily use: opub run %s\n", t.name())
			return nil
		},
	}

	cmd.Flags().StringVar(&project, "project", "", "GitHub project in owner/repo format (required)")
	cmd.Flags().StringVar(&projectID, "project-id", "", "opub project ID")
	cmd.Flags().StringVar(&computeKeyID, "compute-key-id", "", "Compute key ID from the browser setup output (required)")
	cmd.Flags().StringVar(&provider, "provider", "openrouter", "Provider name")
	cmd.Flags().StringVar(&apiKeyHash, "api-key-hash", "", "Optional provider API key hash diagnostic metadata")
	cmd.Flags().BoolVar(&insecureStorage, "insecure-storage", false, "Store credentials in a plain file instead of the system keyring")
	cmd.Flags().BoolVar(&providerKeyStdin, "provider-key-stdin", false, "Read provider key from stdin")
	cmd.Flags().MarkHidden("provider-key-stdin")
	cmd.MarkFlagRequired("project")
	cmd.MarkFlagRequired("compute-key-id")

	return cmd
}

// run

func runCmd() *cobra.Command {
	cmd := &cobra.Command{
		Use:                "run <agent> [args...]",
		Short:              "Launch an agent with opub compute credentials",
		Args:               cobra.MinimumNArgs(1),
		DisableFlagParsing: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			// With DisableFlagParsing, cobra doesn't intercept -h/--help
			if len(args) == 0 || args[0] == "-h" || args[0] == "--help" {
				return cmd.Help()
			}
			// args[0] is the agent, rest are forwarded
			t, err := parseTarget(args[0])
			if err != nil {
				return err
			}
			forwardArgs := stripRunDelimiter(args[1:])

			paths, err := discoverRepoPaths(t.name())
			if err != nil {
				return err
			}
			cfg, err := readConfig(paths)
			if err != nil {
				return err
			}
			if cfg.Target.Name != t.name() {
				return fmt.Errorf("configured target is %q, but requested %q", cfg.Target.Name, t.name())
			}

			execPath := findExecutable(t.executable())
			if execPath == "" {
				return fmt.Errorf("target executable %q was not found on PATH", t.executable())
			}

			mode, err := storageModeFromString(cfg.Provider.CredentialStorage)
			if err != nil {
				return err
			}
			store := CredentialStore{mode: mode}
			secret, err := store.Get(t.credentialRef(cfg))
			if err != nil {
				return err
			}

			session, err := writeSession(paths, cfg)
			if err != nil {
				return err
			}

			assets := embeddedLaunchAssets()
			if err := t.refresh(forwardArgs, paths, assets); err != nil {
				fmt.Fprintf(os.Stderr, "warning: could not refresh %s launch assets: %v\n", t.name(), err)
			}

			execCmd := t.buildCommand(forwardArgs, paths, assets)
			envPairs := t.env(cfg, session, secret, paths)

			// Build final env: inherit current env, then apply overrides
			environ := os.Environ()
			environ = applyEnvPairs(environ, envPairs)

			return execProcess(execPath, execCmd.Args, environ)
		},
	}
	return cmd
}

func embeddedLaunchAssets() launchAssets {
	return launchAssets{
		opubSkill:        opubSkill,
		copilotPlugin:    copilotPluginJSON,
		copilotPluginMCP: copilotPluginMCPJSON,
		copilotSkill:     copilotPluginSkill,
	}
}

func stripRunDelimiter(args []string) []string {
	if len(args) > 0 && args[0] == "--" {
		return args[1:]
	}
	return args
}

func applyEnvPairs(environ []string, pairs []string) []string {
	overrides := make(map[string]string, len(pairs))
	for _, p := range pairs {
		k, v, _ := strings.Cut(p, "=")
		overrides[k] = v
	}

	var result []string
	for _, e := range environ {
		k, _, _ := strings.Cut(e, "=")
		if _, override := overrides[k]; !override {
			result = append(result, e)
		}
	}
	for _, p := range pairs {
		result = append(result, p)
	}
	return result
}

func execProcess(path string, args []string, env []string) error {
	return syscall.Exec(path, args, env)
}

func stripFrontmatter(s string) string {
	if !strings.HasPrefix(s, "---") {
		return s
	}
	rest := s[3:]
	idx := strings.Index(rest, "\n---")
	if idx < 0 {
		return s
	}
	return strings.TrimLeft(rest[idx+4:], "\n")
}

// doctor

func doctorCmd() *cobra.Command {
	return &cobra.Command{
		Use:   "doctor <agent>",
		Short: "Check opub configuration and credentials for an agent",
		Args:  cobra.ExactArgs(1),
		RunE: func(cmd *cobra.Command, args []string) error {
			t, err := parseTarget(args[0])
			if err != nil {
				return err
			}

			paths, err := discoverRepoPaths(t.name())
			if err != nil {
				return err
			}

			fmt.Printf("repo root: %s\n", paths.Root)
			fmt.Printf("state dir: %s\n", paths.StateDir)
			fmt.Printf("config: %s\n", paths.Config)
			fmt.Printf("session: %s\n", paths.Session)

			cfg, err := readConfig(paths)
			if err != nil {
				return err
			}
			if cfg.Target.Name != t.name() {
				return fmt.Errorf("configured target is %q, but requested %q", cfg.Target.Name, t.name())
			}

			fmt.Printf("project: %s\n", cfg.Project.FullName)
			fmt.Printf("compute key: %s\n", cfg.ComputeKey.ID)
			fmt.Printf("provider: %s\n", cfg.Provider.Name)

			mode, err := storageModeFromString(cfg.Provider.CredentialStorage)
			if err != nil {
				return err
			}
			store := CredentialStore{mode: mode}
			fmt.Printf("credential storage: %s\n", store.LocationLabel())

			ref := t.credentialRef(cfg)
			exists, err := store.Exists(ref)
			if err != nil {
				return err
			}
			if !exists {
				return fmt.Errorf("credential is missing for target %q", t.name())
			}
			fmt.Println("credential: present")

			execPath := findExecutable(t.executable())
			if execPath == "" {
				return fmt.Errorf("target executable %q was not found on PATH", t.executable())
			}
			fmt.Printf("agent executable: %s\n", execPath)
			fmt.Printf("session state: %s\n", sessionStatus(paths))
			fmt.Printf("skill: %s\n", skillStatus(t))
			fmt.Printf("mcp: %s\n", mcpStatus(t))
			fmt.Println("status: ok")
			return nil
		},
	}
}

// mcp

func mcpCmd() *cobra.Command {
	cmd := &cobra.Command{
		Use:   "mcp",
		Short: "MCP server commands",
	}
	cmd.AddCommand(mcpStdioCmd())
	return cmd
}

func mcpStdioCmd() *cobra.Command {
	var (
		repoRoot string
		target   string
	)

	cmd := &cobra.Command{
		Use:   "stdio",
		Short: "Run the opub MCP server on stdin/stdout",
		RunE: func(cmd *cobra.Command, args []string) error {
			state, err := loadSecretlessState(repoRoot, target)
			if err != nil {
				return err
			}
			return runMCPStdio(state, os.Stdin, os.Stdout)
		},
	}

	cmd.Flags().StringVar(&repoRoot, "repo-root", "", "Repository root path")
	cmd.Flags().StringVar(&target, "target", "", "Agent name")
	cmd.MarkFlagRequired("target")

	return cmd
}

// paths

func pathsCmd() *cobra.Command {
	return &cobra.Command{
		Use:   "paths",
		Short: "Show opub state and config paths for the current repository",
		RunE: func(cmd *cobra.Command, args []string) error {
			paths, err := discoverRepoPathsConfigured("")
			if err != nil {
				return err
			}

			stateRoot, err := userStateRoot()
			if err != nil {
				return err
			}

			fmt.Printf("repo root: %s\n", paths.Root)
			fmt.Printf("state root: %s\n", stateRoot)
			fmt.Printf("state dir: %s\n", paths.StateDir)
			fmt.Printf("config: %s\n", paths.Config)
			fmt.Printf("session: %s\n", paths.Session)

			if cfg, err := readConfig(paths); err == nil {
				t, err := parseTarget(cfg.Target.Name)
				if err == nil {
					ref := t.credentialRef(cfg)
					mode, err := storageModeFromString(cfg.Provider.CredentialStorage)
					if err == nil {
						store := CredentialStore{mode: mode}
						fmt.Printf("credential storage: %s\n", store.LocationLabel())
						fmt.Printf("credential service: %s\n", ref.Service)
						fmt.Printf("credential account: %s\n", ref.Account)
					}
				}
			}
			return nil
		},
	}
}

// helpers

func readProviderKey(fromStdin bool) (string, error) {
	var secret string
	var err error

	if fromStdin {
		var buf strings.Builder
		b := make([]byte, 4096)
		for {
			n, readErr := os.Stdin.Read(b)
			buf.Write(b[:n])
			if readErr != nil {
				break
			}
		}
		secret = buf.String()
	} else {
		fmt.Fprint(os.Stderr, "One-time provider key: ")
		var raw []byte
		raw, err = term.ReadPassword(int(os.Stdin.Fd()))
		if err != nil {
			return "", fmt.Errorf("read one-time provider key: %w", err)
		}
		fmt.Fprintln(os.Stderr)
		secret = string(raw)
	}

	secret = strings.TrimSpace(secret)
	if secret == "" {
		return "", errors.New("one-time provider key cannot be empty")
	}
	return secret, nil
}