"""Skills dashboard routes.

Two routers because global route order matters: ``hub_router`` (skills-hub
install/search/scan) was registered before the profiles router include in
web_server, the plain skills CRUD ``router`` after it — each is mounted at its
original registration point.  web_server-owned helpers are reached via the
late-binding seam so ``monkeypatch.setattr(web_server, ...)`` keeps working.
"""

import asyncio
from typing import Optional

from fastapi import APIRouter, HTTPException

from hermes_cli.web_deps import late
from hermes_cli.web_models import (
    SkillContentUpdate,
    SkillCreate,
    SkillInstallRequest,
    SkillToggle,
    SkillUninstallRequest,
    SkillsUpdateRequest,
)
from hermes_cli.web_routers._common import (
    _profile_scope,
    config_write_scope,
    http_failure,
    log as _log,
    require,
    scoped_to_thread,
    spawn_profile_action,
)

hub_router = APIRouter()
router = APIRouter()

_config_profile_scope = late("_config_profile_scope")
_hub_action_name = late("_hub_action_name")
_installed_hub_identifiers = late("_installed_hub_identifiers")
load_config = late("load_config")


# Human-readable labels for each hub source id (matches `hermes skills search`
# provenance).  Keep in sync with create_source_router()'s source list.
_SKILL_HUB_SOURCE_LABELS = {
    "official": "Official (Nous)",
    "hermes-index": "Hermes Index",
    "skills-sh": "skills.sh",
    "well-known": "Well-Known",
    "url": "Direct URL",
    "github": "GitHub",
    "clawhub": "ClawHub",
    "lobehub": "LobeHub",
    "browse-sh": "browse.sh",
}


def _skill_meta_to_payload(m) -> dict:
    return {
        "name": m.name,
        "description": m.description,
        "source": m.source,
        "identifier": m.identifier,
        "trust_level": m.trust_level,
        "repo": m.repo,
        "tags": list(m.tags or []),
    }


def _clear_skills_prompt_cache() -> None:
    """Best-effort: invalidate the skills system-prompt snapshot after a write.

    Mirrors what ``skill_manage`` does so a dashboard-authored skill is picked
    up by the next session without a manual cache reset.
    """
    try:
        from agent.prompt_builder import clear_skills_system_prompt_cache
        clear_skills_system_prompt_cache(clear_snapshot=True)
    except Exception:
        pass


@hub_router.post("/api/skills/hub/install")
async def install_skill_hub(body: SkillInstallRequest, profile: Optional[str] = None):
    identifier = require(body.identifier, "identifier is required")
    return spawn_profile_action(
        body.profile or profile,
        ["skills", "install", identifier, "--yes"],
        _hub_action_name("install", identifier),
        log_msg="Failed to spawn skills install",
        prefix="Failed to install skill",
    )


@hub_router.post("/api/skills/hub/uninstall")
async def uninstall_skill_hub(body: SkillUninstallRequest, profile: Optional[str] = None):
    name = require(body.name, "name is required")
    return spawn_profile_action(
        body.profile or profile,
        ["skills", "uninstall", name, "--yes"],
        _hub_action_name("uninstall", name),
        log_msg="Failed to spawn skills uninstall",
        prefix="Failed to uninstall skill",
    )


@hub_router.post("/api/skills/hub/update")
async def update_skills_hub(
    body: Optional[SkillsUpdateRequest] = None, profile: Optional[str] = None
):
    return spawn_profile_action(
        (body.profile if body else None) or profile,
        ["skills", "update"],
        "skills-update",
        log_msg="Failed to spawn skills update",
        prefix="Failed to update skills",
    )


@hub_router.get("/api/skills/hub/official")
async def list_official_skills(profile: Optional[str] = None):
    """The ENTIRE built-in optional-skills catalog (local scan, no network),
    each row marked installed-or-not for ``profile``."""

    def _run():
        from tools.skills_hub import OptionalSkillSource

        installed = _installed_hub_identifiers(profile)
        out = []
        for m in OptionalSkillSource().list_local():
            payload = _skill_meta_to_payload(m)
            ident = payload.get("identifier") or ""
            # identifier format: official/<category>/<skill> — surface the
            # category for row subtitles.
            rel = ident.split("/", 1)[-1] if "/" in ident else ident
            payload["category"] = rel.split("/", 1)[0] if "/" in rel else "general"
            payload["installed"] = ident in installed
            out.append(payload)
        return {"skills": out}

    with http_failure("official skills catalog listing failed", 502, "Official catalog failed"):
        return await asyncio.to_thread(_run)


@hub_router.get("/api/skills/hub/sources")
async def list_skills_hub_sources(profile: Optional[str] = None):
    """Configured skill-hub sources + installed-skill provenance, so the
    Browse-hub tab has something to show before a search runs.  ``profile``
    scopes the installed-skill provenance."""

    def _run():
        from tools.skills_hub import create_source_router

        with _config_profile_scope(profile):
            sources = create_source_router()
        out = []
        index_available = False
        featured = []
        for src in sources:
            sid = src.source_id()
            entry = {
                "id": sid,
                "label": _SKILL_HUB_SOURCE_LABELS.get(sid, sid),
            }
            # GitHub exposes a rate-limit flag; the index an availability flag.
            if sid == "github":
                try:
                    entry["rate_limited"] = bool(getattr(src, "is_rate_limited", False))
                except Exception:
                    entry["rate_limited"] = False
            if sid == "hermes-index":
                try:
                    index_available = bool(getattr(src, "is_available", False))
                except Exception:
                    index_available = False
                entry["available"] = index_available
                # Empty-query search on the index returns featured/popular skills.
                if index_available:
                    try:
                        featured = [
                            _skill_meta_to_payload(m) for m in src.search("", limit=12)
                        ]
                    except Exception:
                        featured = []
            out.append(entry)
        # Which sources are worth searching individually (progressive per-source
        # fan-out).  Mirrors parallel_search_sources: an available index already
        # subsumes the external API sources, so skipping them saves ~70 GitHub
        # calls per keystroke.  Keep in sync with that function's _api_source_ids.
        _api_source_ids = frozenset(
            {"github", "skills-sh", "clawhub", "lobehub", "well-known"}
        )
        for entry in out:
            entry["searchable"] = not (index_available and entry["id"] in _api_source_ids)
        return {
            "sources": out,
            "index_available": index_available,
            "featured": featured,
            "installed": _installed_hub_identifiers(profile),
        }

    with http_failure("skills hub sources listing failed", 502, "Hub sources failed"):
        return await asyncio.to_thread(_run)


@hub_router.get("/api/skills/hub/search")
async def search_skills_hub(
    q: str = "", source: str = "all", limit: int = 20, profile: Optional[str] = None
):
    """Search the skill hub across all configured sources (network-bound,
    runs in a thread).  Results install by identifier via /hub/install."""
    query = (q or "").strip()
    if not query:
        return {"results": [], "source_counts": {}, "timed_out": [], "installed": {}}

    def _run():
        from tools.skills_hub import create_source_router, parallel_search_sources

        with _config_profile_scope(profile):
            sources = create_source_router()
        capped = min(max(limit, 1), 50)
        all_results, source_counts, timed_out = parallel_search_sources(
            sources, query=query, source_filter=source or "all", overall_timeout=30
        )

        # Dedupe by identifier, preferring higher trust (mirrors unified_search).
        _rank = {"builtin": 2, "trusted": 1, "community": 0}
        seen = {}
        for r in all_results:
            if r.identifier not in seen:
                seen[r.identifier] = r
            elif _rank.get(r.trust_level, 0) > _rank.get(seen[r.identifier].trust_level, 0):
                seen[r.identifier] = r
        deduped = list(seen.values())[:capped]

        return {
            "results": [_skill_meta_to_payload(m) for m in deduped],
            "source_counts": source_counts,
            "timed_out": timed_out,
            "installed": _installed_hub_identifiers(profile),
        }

    with http_failure("skills hub search failed", 502, "Hub search failed"):
        return await asyncio.to_thread(_run)


@hub_router.get("/api/skills/hub/preview")
async def preview_skill_hub(identifier: str = "", profile: Optional[str] = None):
    """A hub skill's SKILL.md + file manifest WITHOUT installing it.  Scoped to
    ``profile`` so a profile with different hub taps resolves against ITS
    source router."""
    ident = require(identifier, "identifier is required")

    def _run():
        from hermes_cli.skills_hub import _resolve_source_meta_and_bundle
        from tools.skills_hub import create_source_router

        with _config_profile_scope(profile):
            sources = create_source_router()
            meta, bundle, _src = _resolve_source_meta_and_bundle(ident, sources)
        if not bundle and not meta:
            return None

        files = {}
        skill_md = ""
        if bundle:
            for rel, content in (bundle.files or {}).items():
                if isinstance(content, bytes):
                    # Some sources store every file as bytes; decode text so
                    # SKILL.md renders, placeholder only for genuinely-binary data.
                    try:
                        files[rel] = content.decode("utf-8")
                    except UnicodeDecodeError:
                        files[rel] = "(binary file)"
                else:
                    files[rel] = content
            skill_md = files.get("SKILL.md", "") or ""

        m = meta or bundle
        return {
            "name": getattr(m, "name", ident),
            "description": getattr(m, "description", "") or "",
            "source": getattr(m, "source", "") or "",
            "identifier": getattr(m, "identifier", ident) or ident,
            "trust_level": getattr(m, "trust_level", "community") or "community",
            "repo": getattr(m, "repo", None),
            "tags": list(getattr(m, "tags", None) or []),
            "skill_md": skill_md,
            "files": sorted(files.keys()),
        }

    try:
        result = await asyncio.to_thread(_run)
    except Exception as exc:
        _log.exception("skills hub preview failed")
        raise HTTPException(status_code=502, detail=f"Hub preview failed: {exc}")
    if result is None:
        raise HTTPException(status_code=404, detail=f"Skill not found: {ident}")
    return result


@hub_router.get("/api/skills/hub/scan")
async def scan_skill_hub(identifier: str = "", profile: Optional[str] = None):
    """Run the install-time security scan on a hub skill WITHOUT installing it
    (same ``scan_skill`` / ``should_allow_install`` pipeline as the CLI, on a
    quarantined bundle that is cleaned up afterwards).  Scoped to ``profile``
    so the bundle resolves where an install would pull it from."""
    ident = require(identifier, "identifier is required")

    def _run():
        import shutil as _shutil

        from hermes_cli.skills_hub import _resolve_source_meta_and_bundle
        from tools.skills_hub import create_source_router, quarantine_bundle
        from tools.skills_guard import scan_skill, should_allow_install

        with _config_profile_scope(profile):
            sources = create_source_router()
            meta, bundle, _src = _resolve_source_meta_and_bundle(ident, sources)
        if not bundle:
            return None

        if bundle.source == "official":
            scan_source = "official"
        else:
            scan_source = (
                getattr(bundle, "identifier", "")
                or getattr(meta, "identifier", "")
                or ident
            )

        q_path = None
        tier1 = None
        try:
            q_path = quarantine_bundle(bundle)
            result = scan_skill(q_path, source=scan_source)
            # Advisory SkillEvaluator Tier 1 second opinion: optional binary,
            # never blocks, errors degrade to no data (same as the CLI installer).
            try:
                from tools.skillevaluator_scan import (
                    run_tier1_scan, tier1_advisory_enabled,
                )
                if tier1_advisory_enabled():
                    t1 = run_tier1_scan(q_path)
                    if t1.available:
                        tier1 = {
                            "passed": t1.passed,
                            "incomplete_checks": t1.incomplete_checks,
                            "findings": [
                                {
                                    "check": f.check,
                                    "validator": f.validator,
                                    "severity": f.severity,
                                    "message": f.message,
                                    "file": f.file,
                                    "line": f.line,
                                    "secrets_class": f.is_secrets_class,
                                }
                                for f in t1.findings
                            ],
                        }
            except Exception:
                _log.debug("Tier 1 advisory scan skipped", exc_info=True)
        finally:
            if q_path is not None:
                _shutil.rmtree(q_path, ignore_errors=True)

        # `allowed` may be None ("ask") for agent-created/dangerous gates.
        allowed, reason = should_allow_install(result, force=False)
        findings = [
            {
                "severity": f.severity,
                "category": f.category,
                "file": f.file,
                "line": f.line,
                "description": f.description,
            }
            for f in result.findings
        ]
        counts = {"critical": 0, "high": 0, "medium": 0, "low": 0}
        for f in result.findings:
            if f.severity in counts:
                counts[f.severity] += 1

        return {
            "name": result.skill_name,
            "identifier": ident,
            "source": result.source,
            "trust_level": result.trust_level,
            "verdict": result.verdict,
            "summary": result.summary,
            "policy": "allow" if allowed is True else "ask" if allowed is None else "block",
            "policy_reason": reason,
            "findings": findings,
            "severity_counts": counts,
            "tier1": tier1,  # None when the optional scanner isn't installed/enabled
        }

    try:
        result = await asyncio.to_thread(_run)
    except Exception as exc:
        _log.exception("skills hub scan failed")
        raise HTTPException(status_code=502, detail=f"Hub scan failed: {exc}")
    if result is None:
        raise HTTPException(status_code=404, detail=f"Skill not found: {ident}")
    return result


@router.get("/api/skills")
async def get_skills(profile: Optional[str] = None):
    from tools.skills_tool import _find_all_skills
    from hermes_cli.skills_config import get_disabled_skills
    from tools.skill_usage import (
        _read_bundled_manifest_names,
        _read_hub_installed_names,
        activity_count,
        load_usage,
    )
    def _run():
        with _profile_scope(profile):
            config = load_config()
            disabled = get_disabled_skills(config)
            skills = _find_all_skills(skip_disabled=True)
            usage = load_usage()
            # Set-based provenance (same classification as skill_usage.provenance,
            # without a per-skill manifest read): hub > bundled > agent, where
            # "agent" covers agent-authored AND local hand-made skills — the ones
            # the user may edit/delete from the UI.
            bundled_names = _read_bundled_manifest_names()
            hub_names = _read_hub_installed_names()
        for s in skills:
            s["enabled"] = s["name"] not in disabled
            s["usage"] = activity_count(usage.get(s["name"], {}))
            s["provenance"] = (
                "hub" if s["name"] in hub_names
                else "bundled" if s["name"] in bundled_names
                else "agent"
            )
        return skills

    return await asyncio.to_thread(_run)


@router.put("/api/skills/toggle")
async def toggle_skill(body: SkillToggle, profile: Optional[str] = None):
    from hermes_cli.skills_config import get_disabled_skills, save_disabled_skills

    def _run():
        with config_write_scope(body.profile or profile):
            config = load_config()
            disabled = get_disabled_skills(config)
            if body.enabled:
                disabled.discard(body.name)
            else:
                disabled.add(body.name)
            save_disabled_skills(config, disabled)
        return {"ok": True, "name": body.name, "enabled": body.enabled}

    return await asyncio.to_thread(_run)


@router.get("/api/skills/content")
async def get_skill_content(name: str, profile: Optional[str] = None):
    """Raw SKILL.md text for the dashboard editor."""
    from tools.skill_manager_tool import _find_skill

    def _read():
        found = _find_skill(name)
        if not found:
            raise HTTPException(status_code=404, detail=f"Skill '{name}' not found.")
        skill_md = found["path"] / "SKILL.md"
        if not skill_md.exists():
            raise HTTPException(status_code=404, detail=f"Skill '{name}' has no SKILL.md.")
        try:
            content = skill_md.read_text(encoding="utf-8")
        except OSError as exc:
            raise HTTPException(status_code=500, detail=str(exc)) from exc
        return {"name": name, "content": content, "path": str(skill_md)}

    return await scoped_to_thread(profile, _read)


@router.post("/api/skills")
async def create_skill(body: SkillCreate):
    """Create a custom skill via the same validated write path as the agent's
    ``skill_manage`` tool, minus the agent write-approval gate — a write from
    the authenticated dashboard IS the user acting directly."""
    from tools.skill_manager_tool import _create_skill

    result = await scoped_to_thread(
        body.profile, lambda: _create_skill(body.name, body.content, body.category or None)
    )
    if not result.get("success"):
        raise HTTPException(status_code=400, detail=result.get("error", "Failed to create skill."))
    _clear_skills_prompt_cache()
    return result


@router.put("/api/skills/content")
async def update_skill_content(body: SkillContentUpdate):
    """Replace the SKILL.md of an existing skill (full rewrite) from the editor."""
    from tools.skill_manager_tool import _edit_skill

    result = await scoped_to_thread(body.profile, lambda: _edit_skill(body.name, body.content))
    if not result.get("success"):
        err = result.get("error", "Failed to update skill.")
        status = 404 if "not found" in str(err).lower() else 400
        raise HTTPException(status_code=status, detail=err)
    _clear_skills_prompt_cache()
    return result