cli.js

#!/usr/bin/env node
const { program } = require('commander');
const fs = require('fs');
const path = require('path');
const os = require('os');
const crypto = require('crypto');
const readline = require('readline');
const notifier = require('node-notifier');
const express = require('express');
const nacl = require('tweetnacl');
const { ClinchCore, NegotiationState } = require('clinch-core');

const CONFIG_DIR = path.join(os.homedir(), '.clinch');
const VAULT_FILE = path.join(CONFIG_DIR, 'vault.enc');
const STATE_FILE = path.join(CONFIG_DIR, 'state.json');
const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

// ============================================================================
// SECURE VAULT
// ============================================================================
class SecureVault {
    static _deriveKey(passphrase) {
        return crypto.scryptSync(passphrase, 'clinch-protocol-salt-v1', 32, { N: 16384, r: 8, p: 1 });
    }

    static async getPassphrase(isDirect) {
        if (process.env.CLINCH_PASSPHRASE) return process.env.CLINCH_PASSPHRASE;
        if (isDirect) throw new Error("Running in --direct mode requires CLINCH_PASSPHRASE env var.");

        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
        return new Promise(resolve => {
            rl.question('\n🔒 Enter Clinch Vault Passphrase: ', ans => {
                rl.close(); resolve(ans.trim());
            });
        });
    }

    static async unlock(isDirect = false) {
        if (!fs.existsSync(VAULT_FILE)) return null;
        const pass = await this.getPassphrase(isDirect);
        const key = this._deriveKey(pass);
        try {
            const enc = JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8'));
            const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(enc.iv, 'hex'));
            decipher.setAuthTag(Buffer.from(enc.tag, 'hex'));
            let dec = decipher.update(enc.data, 'hex', 'utf8');
            dec += decipher.final('utf8');
            const parsed = JSON.parse(dec);
            if (!parsed.blindKeys) parsed.blindKeys = {};
            return { parsed, pass };
        } catch (e) {
            console.error(isDirect ? JSON.stringify({ error: "Invalid passphrase" }) : "❌ Decryption failed.");
            process.exit(1);
        }
    }

    static async save(passphrase, keysData) {
        const key = this._deriveKey(passphrase);
        const iv = crypto.randomBytes(12);
        const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
        let data = cipher.update(JSON.stringify(keysData), 'utf8', 'hex');
        data += cipher.final('hex');
        const tag = cipher.getAuthTag().toString('hex');
        fs.mkdirSync(CONFIG_DIR, { recursive: true });
        fs.writeFileSync(VAULT_FILE, JSON.stringify({ iv: iv.toString('hex'), data, tag: tag }), { mode: 0o600 });
    }
}

// ============================================================================
// UTILS & SETUP
// ============================================================================
function loadConfig() {
    return fs.existsSync(CONFIG_FILE) ? JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8')) : { mode: 'buyer' };
}

function saveConfig(cfg) {
    fs.mkdirSync(CONFIG_DIR, { recursive: true });
    fs.writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2));
}

function getRawSessions() {
    if (!fs.existsSync(STATE_FILE)) return {};
    return JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'));
}

function syncState(core, shouldWatch = false) {
    let isWriting = false;
    const load = () => {
        if (!isWriting && fs.existsSync(STATE_FILE)) {
            core.importSessions(getRawSessions());
        }
    };
    
    load(); // Initial load

    // 🔒 Watch only if explicitly told to (daemon mode), preventing short-lived CLI tools from hanging the event loop
    if (shouldWatch) {
        fs.watchFile(STATE_FILE, { interval: 1000 }, (curr, prev) => {
            if (curr.mtimeMs !== prev.mtimeMs) {
                load();
            }
        });
    }

    const save = () => {
        isWriting = true;
        fs.writeFileSync(STATE_FILE, JSON.stringify(core.exportSessions(), null, 2));
        setTimeout(() => { isWriting = false; }, 1500);
    };

    core.on('counter_received', save);
    core.on('approval_required', save);
    core.on('deal_signed', save);
    core.on('session_cancelled', save);
    return save;
}

async function getInitializedCore(vaultData, isDirect) {
    const cfg = loadConfig();
    const core = new ClinchCore({
        privateKeyHex: vaultData.privateKeyHex,
        blindKeys: vaultData.blindKeys
    });

    if (!isDirect) console.log("⏳ Connecting to Registry...");
    await core.initialize(cfg.token);

    if (core.jwtToken && core.jwtToken !== cfg.token) {
        cfg.token = core.jwtToken;
        saveConfig(cfg);
    }
    return core;
}

async function extractConstraints(intentText, isDirect) {
    if (intentText.trim().startsWith('{')) return JSON.parse(intentText);
    if (!isDirect) console.log("🧠 Analyzing constraint intent...");
    const prompt = `Output ONLY valid JSON matching exactly:\n{"intent": "purchase|schedule|service", "item": "string", "max_budget": number | null, "terms": {"key": "value"}}\nExtract from: "${intentText}"`;
    try {
        const res = await fetch('http://127.0.0.1:11434/api/generate', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ model: 'llama3', prompt, stream: false, format: 'json' }) });
        const data = await res.json();
        return JSON.parse(data.response);
    } catch(e) { return { intent: "purchase", item: intentText, max_budget: null, terms: {} }; }
}

// ============================================================================
// CLI COMMANDS
// ============================================================================

program.name('clinch').description('Clinch Protocol Command Line').version('0.2.1');

program.command('config').description('Set CLI configuration')
    .option('--mode <mode>', 'buyer | seller | both')
    .option('--webhook <url>', 'OpenClaw webhook URL')
    .action((opts) => {
        const cfg = loadConfig();
        if (opts.mode) cfg.mode = opts.mode;
        if (opts.webhook) cfg.openClawWebhook = opts.webhook;
        saveConfig(cfg);
        console.log(`✓ Config updated.`);
    });

program.command('init').description('Initialize cryptographic identity')
    .option('--key <hex>', 'Import an official private key')
    .action(async (opts) => {
        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
        const pass = await new Promise(resolve => rl.question('Enter strong vault passphrase: ', ans => { rl.close(); resolve(ans); }));
        
        let secretKeyHex;
        if (opts.key) {
            secretKeyHex = opts.key.trim();
            console.log(`\n📥 Importing official dashboard private key...`);
        } else {
            const seed = crypto.randomBytes(32);
            const keyPair = nacl.sign.keyPair.fromSeed(seed);
            secretKeyHex = Buffer.from(keyPair.secretKey).toString('hex');
            console.log(`\n💡 Note: Generated generic buyer identity.`);
        }

        await SecureVault.save(pass, { privateKeyHex: secretKeyHex, blindKeys: {} });
        console.log(`🎉 Identity configured and vault locked.`);
    });

program.command('key').description('Manage third-party API credentials')
    .option('--set <domain>', 'Set a new key for a domain')
    .option('--value <key>', 'The actual secret key value')
    .option('--list', 'List registered domains')
    .option('--remove <domain>', 'Delete a credential')
    .action(async (opts) => {
        const vaultRes = await SecureVault.unlock(false);
        if (!vaultRes) return console.log("Run 'clinch init' first.");

        if (opts.list) {
            console.log("\n🔑 Registered Blind Keys:");
            Object.keys(vaultRes.parsed.blindKeys).forEach(d => console.log(`  - ${d}`));
            console.log("");
        } else if (opts.remove) {
            delete vaultRes.parsed.blindKeys[opts.remove];
            await SecureVault.save(vaultRes.pass, vaultRes.parsed);
            console.log(`✓ Removed blind key for ${opts.remove}`);
        } else if (opts.set && opts.value) {
            vaultRes.parsed.blindKeys[opts.set] = opts.value;
            await SecureVault.save(vaultRes.pass, vaultRes.parsed);
            console.log(`✓ Key registered!`);
        } else {
            console.log("Provide --list, or --set <domain> --value <key>");
        }
    });

program.command('start').description('Start the listener daemon')
    .action(async () => {
        const cfg = loadConfig();
        const vaultRes = await SecureVault.unlock(false);
        if (!vaultRes) return console.log("Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, false);
        syncState(core, true); // <--- Watch enabled for background daemon
        console.log("🟢 Clinch Daemon active. Listening for events...");

        core.on('approval_required', async (s) => {
            const msg = `Approval Required: ${s.targetId} agreed to $${s.lastPrice} for ${s.constraints.item}`;
            console.log(`\n⚠️  ${msg}\n   Run: clinch approve ${s.sessionId}`);
            notifier.notify({ title: 'Clinch Protocol', message: msg });
            if (cfg.openClawWebhook) {
                await fetch(cfg.openClawWebhook, { 
                    method: 'POST', 
                    headers: { 'Content-Type': 'application/json' }, 
                    body: JSON.stringify({ event: 'approval_required', session: s }) 
                }).catch(()=>{});
            }
        });

        core.on('counter_received', async (s) => {
            console.log(`\n💬 Counter from ${s.targetId}: $${s.lastPrice}`);
            if (s.lastMessage) console.log(`   [Message]: ${s.lastMessage}`);
            if (cfg.openClawWebhook) {
                await fetch(cfg.openClawWebhook, { 
                    method: 'POST', 
                    headers: { 'Content-Type': 'application/json' }, 
                    body: JSON.stringify({ event: 'counter_received', session: s }) 
                }).catch(()=>{});
            }
        });

        core.connectDaemonStream();
        process.on('SIGINT', () => { console.log('\n👋 Shutting down daemon...'); process.exit(0); });
        process.on('SIGTERM', () => { console.log('\n👋 Shutting down daemon...'); process.exit(0); });
    });

program.command('discover <category>').description('Browse registered sellers')
    .option('--direct', 'JSON output mode')
    .action(async (category, opts) => {
        const vaultRes = await SecureVault.unlock(opts.direct);
        if (!vaultRes) return console.log(opts.direct ? JSON.stringify({ error: "Vault Locked" }) : "❌ Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, opts.direct);
        const results = await core.discover(category);

        if (opts.direct) return console.log(JSON.stringify(results));

        if (!results.length) {
            console.log(`\n🔍 No sellers found for "${category}".`);
            return;
        }

        console.log(`\n🔍 Sellers for "${category}" (${results.length} found):\n`);
        results.forEach((r, i) => {
            const name = r.display_name || `${r.agent_id}`;
            const official = r.official_node ? ' ✓ Official' : '';
            console.log(`  [${i + 1}] ${name}${official}`);
            console.log(`       Domain ID    : ${r.agent_id}`);
            console.log(`       Capabilities : ${(r.capabilities || []).join(', ')}`);
            console.log('');
        });
    });

program.command('status').description('List active negotiations')
    .option('--direct', 'JSON output mode')
    .action((opts) => {
        const data = getRawSessions();
        const sessions = Object.values(data).filter(s => s.state !== 'SIGNED' && s.state !== 'CANCELLED');
        if (opts.direct) return console.log(JSON.stringify(sessions));
        console.log("\n📊 Active Negotiations:");
        if (!sessions.length) console.log("  None.");
        sessions.forEach(s => console.log(`  [${s.state}] ID: ${s.sessionId} | Target: ${s.targetId} | Last Price: $${s.lastPrice}`));
        console.log("");
    });

program.command('deals').description('List signed deals')
    .option('--direct', 'JSON output mode')
    .action((opts) => {
        const data = getRawSessions();
        const deals = Object.values(data).filter(s => s.state === 'SIGNED' && s.artifact !== null).map(s => s.artifact);
        if (opts.direct) return console.log(JSON.stringify(deals));
        console.log("\n🔐 Signed Deals:");
        if (!deals.length) console.log("  None.");
        deals.forEach(d => console.log(`  ID: ${d.sessionId} | Item: ${d.item} | Price: $${d.price}`));
        console.log("");
    });

program.command('negotiate <intent>').description('Initialize a negotiation')
    .option('--target <domain>', 'Target seller domain')
    .option('--direct', 'JSON output mode')
    .action(async (intent, opts) => {
        const vaultRes = await SecureVault.unlock(opts.direct);
        if (!vaultRes) return console.log(opts.direct ? JSON.stringify({ error: "Vault Locked" }) : "❌ Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, opts.direct);
        const save = syncState(core, false); // <--- No watch for short-lived run

        const constraints = await extractConstraints(intent, opts.direct);
        let target = opts.target || (await core.discover(constraints.item))[0]?.agent_id;
        if (!target) return console.log(opts.direct ? JSON.stringify({ error: "No sellers found" }) : "❌ No sellers found.");

        const session = await core.proposeDeal(target, constraints);
        save();

        if (session.state === NegotiationState.CANCELLED) {
            if (opts.direct) console.log(JSON.stringify({ status: "CANCELLED", session }));
            else console.log(`\n❌ Seller rejected the proposal.\nSession ID: ${session.sessionId}\n`);
        } else {
            if (opts.direct) console.log(JSON.stringify({ status: "SUCCESS", session }));
            else console.log(`\n✓ Proposal sent to ${target}.\nSession ID: ${session.sessionId}\n`);
        }
    });

program.command('counter <sessionId> <price>').description('Counter an offer')
    .option('--reason <msg>', 'Reason for counter', 'Counter offer')
    .option('--direct', 'JSON output mode')
    .action(async (sessionId, price, opts) => {
        const vaultRes = await SecureVault.unlock(opts.direct);
        if (!vaultRes) return console.log(opts.direct ? JSON.stringify({ error: "Vault Locked" }) : "❌ Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, opts.direct);
        const save = syncState(core, false); // <--- No watch for short-lived run

        try {
            const session = await core.counter(sessionId, parseFloat(price), opts.reason);
            save();
            if (session.state === NegotiationState.CANCELLED) {
                if (opts.direct) console.log(JSON.stringify({ status: "CANCELLED", session }));
                else console.log(`\n❌ Seller cancelled the negotiation.\nSession ID: ${session.sessionId}\n`);
            } else {
                if (opts.direct) console.log(JSON.stringify({ status: "COUNTERED", session }));
                else console.log(`✓ Counter of $${price} sent for ${sessionId}`);
            }
        } catch (e) { console.log(opts.direct ? JSON.stringify({ error: e.message }) : `❌ Error: ${e.message}`); }
    });

program.command('cancel <sessionId>').description('Cleanly exit a negotiation')
    .option('--direct', 'JSON output mode')
    .action(async (sessionId, opts) => {
        const vaultRes = await SecureVault.unlock(opts.direct);
        if (!vaultRes) return console.log(opts.direct ? JSON.stringify({ error: "Vault Locked" }) : "❌ Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, opts.direct);
        const save = syncState(core, false); // <--- No watch for short-lived run

        try {
            const session = await core.cancelSession(sessionId);
            save();
            if (opts.direct) console.log(JSON.stringify({ status: "CANCELLED", session }));
            else console.log(`✓ Session ${sessionId} cleanly cancelled.`);
        } catch (e) { console.log(opts.direct ? JSON.stringify({ error: e.message }) : `❌ Error: ${e.message}`); }
    });

program.command('approve <sessionId>').description('Cryptographically sign a CONFIRMED deal')
    .option('--direct', 'JSON output mode')
    .action(async (sessionId, opts) => {
        const vaultRes = await SecureVault.unlock(opts.direct);
        if (!vaultRes) return console.log(opts.direct ? JSON.stringify({ error: "Vault Locked" }) : "❌ Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, opts.direct);
        const save = syncState(core, false); // <--- No watch for short-lived run

        try {
            const artifact = await core.approveAndSign(sessionId);
            save();
            if (opts.direct) console.log(JSON.stringify({ status: "SIGNED", artifact }));
            else console.log(`\n🔐 DEAL SIGNED AND COMMITTED!\nArtifact ID: ${artifact.sessionId}\n`);
        } catch (e) { console.log(opts.direct ? JSON.stringify({ error: e.message }) : `\n❌ Approval Failed: ${e.message}\n`); }
    });

const nodeCmd = program.command('node').description('Node management commands');

nodeCmd.command('register <agentId> <endpoint>').description('Bind your dashboard .anp domain to your server endpoint')
    .option('--categories <list>', 'Comma separated categories', 'general')
    .option('--capabilities <list>', 'Comma separated capabilities', 'http-webhook')
    .option('--modes <list>', 'Supported protocol modes', 'ANP/C')
    .action(async (agentId, endpoint, opts) => {
        const vaultRes = await SecureVault.unlock(false);
        if (!vaultRes) return console.log("Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, false);
        const categories = opts.categories ? opts.categories.split(',').map(c => c.trim()) : ['general'];
        const capabilities = opts.capabilities ? opts.capabilities.split(',').map(c => c.trim()) : ['http-webhook'];
        const modes = opts.modes ? opts.modes.split(',').map(m => m.trim()) : ['ANP/C'];

        try {
            await core.registerNode(agentId, endpoint, categories, capabilities, { supported_modes: modes });
            console.log(`\n✓ Endpoint successfully bound!`);
        } catch (e) {
            console.log(`\n❌ Registration Failed: ${e.message}\n`);
        }
    });

program.command('serve').description('Start Seller HTTP server')
    .option('--port <p>', 'Port to listen on', 8080)
    .option('--config <file>', 'Path to seller config JSON')
    .option('--direct', 'JSON output mode for background agent handling')
    .action(async (opts) => {
        const vaultRes = await SecureVault.unlock(opts.direct);
        if (!vaultRes) return console.log(opts.direct ? JSON.stringify({ error: "Vault Locked" }) : "❌ Run 'clinch init' first.");

        const core = await getInitializedCore(vaultRes.parsed, opts.direct);
        const save = syncState(core, true); // <--- Server needs watching

        const sellerCfg = opts.config && fs.existsSync(opts.config)
            ? JSON.parse(fs.readFileSync(opts.config))
            : { defaultFloor: 45, defaultApprove: 100, maxTurns: 5 };

        const app = express();
        app.use(express.json());

        app.post('/handshake', async (req, res) => {
            const { session_id, constraints, buyer_pub_key } = req.body;
            core.registerIncomingSession(session_id, buyer_pub_key, constraints);

            const categoryCfg = sellerCfg;
            if (constraints.max_budget !== null && constraints.max_budget >= categoryCfg.defaultApprove) {
                core.updateSessionStateLocally(session_id, NegotiationState.CONFIRMED, categoryCfg.defaultApprove, 1);
                res.json({ type: 'CONFIRM', price: categoryCfg.defaultApprove });
            } else {
                const counter = Math.max(categoryCfg.defaultFloor, (categoryCfg.defaultFloor + categoryCfg.defaultApprove) / 2);
                core.updateSessionStateLocally(session_id, NegotiationState.COUNTERED, counter, 2);
                res.json({ type: 'COUNTER', price: counter, turn: 2 });
            }
            save();
        });

        app.post('/counter', async (req, res) => {
            const { session_id, price, turn } = req.body;
            const categoryCfg = sellerCfg;
            const currentTurn = turn || 2;
            const nextTurn = currentTurn + 1;
            const maxTurns = categoryCfg.maxTurns || 5;

            if (price >= categoryCfg.defaultApprove) {
                core.updateSessionStateLocally(session_id, NegotiationState.CONFIRMED, price, currentTurn);
                res.json({ type: 'CONFIRM', price });
            } else if (currentTurn >= maxTurns) {
                if (price >= categoryCfg.defaultFloor) {
                    core.updateSessionStateLocally(session_id, NegotiationState.CONFIRMED, price, currentTurn);
                    res.json({ type: 'CONFIRM', price });
                } else {
                    core.updateSessionStateLocally(session_id, NegotiationState.CANCELLED, price, currentTurn);
                    res.json({ type: 'CANCEL', reason: "Max turns reached without meeting floor." });
                }
            } else {
                const counter = Math.max(categoryCfg.defaultFloor, (categoryCfg.defaultFloor + categoryCfg.defaultApprove) / 2);
                core.updateSessionStateLocally(session_id, NegotiationState.COUNTERED, counter, nextTurn);
                res.json({ type: 'COUNTER', price: counter, turn: nextTurn });
            }
            save();
        });

        app.post('/sign_request', (req, res) => {
            try { res.json({ sellerSignature: core.signAsSeller(req.body.artifact) }); }
            catch (e) { res.status(400).json({ error: e.message }); }
        });

        app.listen(opts.port, () => { if (!opts.direct) console.log(`\n🛒 Seller Node active on port ${opts.port}`); });
        process.on('SIGINT', () => { console.log('\n👋 Shutting down seller node...'); process.exit(0); });
        process.on('SIGTERM', () => { console.log('\n👋 Shutting down seller node...'); process.exit(0); });
    });

program.parse();