#!/usr/bin/env pwsh
# CASAN unified harness wrapper - PowerShell port of casan-harness.sh
# Usage:
#   casan-harness.ps1 <input-file> <output-file> [action-name] [-- <command> [args...]]
#
# Runs: H4-input → H5-governance → H6-metrics(real cmd) → H4-output
# Includes idempotency caching without bypassing H4/H5/H4-output gates.

param(
    [Parameter(Mandatory=$true, Position=0)][string]$InputFile,
    [Parameter(Mandatory=$true, Position=1)][string]$FinalOutput,
    [Parameter(Position=2)][string]$ActionName = "agent_step",
    [Parameter(ValueFromRemainingArguments=$true)][string[]]$RemainingArgs
)

$ErrorActionPreference = "Stop"

$scriptDir   = Split-Path $MyInvocation.MyCommand.Path -Parent
$projectRoot = (Resolve-Path (Join-Path $scriptDir "../../..")).Path
$tmpDir      = Join-Path $projectRoot ".specify/logs/tmp"
$cacheDir    = Join-Path $projectRoot ".specify/logs/idempotency"

foreach ($d in @($tmpDir, $cacheDir, (Split-Path $FinalOutput -Parent))) {
    if ($d -and !(Test-Path $d)) { New-Item -ItemType Directory -Force -Path $d | Out-Null }
}

function Get-Sha256 ([string]$text) {
    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)
    $hash  = [System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes)
    return ($hash | ForEach-Object { $_.ToString("x2") }) -join ""
}

# Strip "--" separator
$cmdArgs = $RemainingArgs
if ($cmdArgs -and $cmdArgs[0] -eq "--") { $cmdArgs = $cmdArgs[1..($cmdArgs.Count-1)] }

# ── Idempotency check ──────────────────────────────────────────────────────
$inputContent = Get-Content $InputFile -Raw -Encoding UTF8
if (!$inputContent) { $inputContent = "" }
$cmdStr       = if ($cmdArgs) { $cmdArgs -join " " } else { "no_cmd" }
$inputHash    = Get-Sha256 $inputContent
$cmdHash      = Get-Sha256 $cmdStr
$idemKey      = Get-Sha256 "$inputHash|$cmdHash|$ActionName"

$cacheMeta = Join-Path $cacheDir "$idemKey.json"
$cacheOut  = Join-Path $cacheDir "$idemKey.output"

# ── Normal flow ────────────────────────────────────────────────────────────
$suffix       = "$(Get-Date -Format 'yyyyMMddHHmmss')-$PID"
$safeInput    = Join-Path $tmpDir "security-input-$suffix.txt"
$approvedIn   = Join-Path $tmpDir "governance-approved-$suffix.txt"
$rawOutput    = Join-Path $tmpDir "raw-output-$suffix.txt"

# H4 input security
& "$scriptDir/security-check.ps1" $InputFile $safeInput input
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

# H5 governance
& "$scriptDir/governance-check.ps1" $safeInput $approvedIn $ActionName
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

# H6 metrics around real command or cached output.
if ((Test-Path $cacheMeta) -and (Test-Path $cacheOut)) {
    Copy-Item -Path $cacheOut -Destination $rawOutput -Force
    $metricsExit = 0
    $cacheStatus = "cached"
} elseif ($cmdArgs -and $cmdArgs.Count -gt 0) {
    & "$scriptDir/agent-metrics.ps1" $approvedIn $rawOutput "--" @cmdArgs
    $metricsExit = $LASTEXITCODE
    $cacheStatus = "stored"
} else {
    & "$scriptDir/agent-metrics.ps1" $approvedIn $rawOutput
    $metricsExit = $LASTEXITCODE
    $cacheStatus = "stored"
}

# H4 output security
& "$scriptDir/security-check.ps1" $rawOutput $FinalOutput output
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

# ── Save idempotency cache ─────────────────────────────────────────────────
$outputContent = Get-Content $FinalOutput -Raw -Encoding UTF8
if (!$outputContent) { $outputContent = "" }
$outputHash = Get-Sha256 $outputContent

if ($cacheStatus -eq "stored") {
@"
{
  "idempotency_key": "$idemKey",
  "timestamp": "$($(Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ"))",
  "action": "$ActionName",
  "command": "$(($cmdStr -replace '"','\"'))",
  "output_hash": "$outputHash"
}
"@ | Set-Content -Path $cacheMeta -Encoding UTF8
    Copy-Item -Path $FinalOutput -Destination $cacheOut -Force
}

# Clean up tmp files
foreach ($f in @($safeInput, $approvedIn, $rawOutput)) {
    if (Test-Path $f) { Remove-Item $f -Force -ErrorAction SilentlyContinue }
}

Write-Output "CASAN_HARNESS_COMPLETE cache=$cacheStatus key=$idemKey output=$FinalOutput"
exit $metricsExit