clawdie-ai/src/config.ts

import os from 'os';
import path from 'path';
import fs from 'fs';

import {
  defaultMemoryDbName,
  defaultMemoryDbUser,
  defaultSkillsDbName,
  defaultSkillsDbUser,
  usableEnvValue,
} from './db-identifiers.js';
import { readEnvFile } from './env.js';
import {
  normalizeLocaleTag,
  normalizeSystemLocale,
  normalizeTimeZone,
} from './locale-profile.js';
import { deriveStripeStatus, getStripeKeyMode } from './stripe-config.js';

// Read config values from .env (falls back to process.env).
// Most secrets stay on disk and are loaded only where needed, but a small
// bootstrap subset is read here for provider auth and derived DB URLs.
const envConfig = readEnvFile([
  'AGENT_NAME',
  'ASSISTANT_NAME',
  'AGENT_DOMAIN',
  'AGENT_INTERNAL_DOMAIN',
  'CODE_HOSTING_MODE',
  'REMOTE_GIT_URL',
  'FEATURE_GIT',
  'FEATURE_GITEA',
  'GIT_DEFAULT_REPO_NAME',
  'GIT_STORAGE_ROOT',
  'SETUP_LOCALE',
  'DISPLAY_LOCALE',
  'ASSISTANT_LOCALE',
  'SYSTEM_LOCALE',
  'TZ',
  'TELEGRAM_BOT_TOKEN',
  'STRIPE_SECRET_KEY',
  'AGENT_ENGINE',
  'PI_TUI_BIN',
  'PI_TUI_PROVIDER',
  'PI_TUI_MODEL',
  'AGENT_TMP_DIR',
  'AGENT_SUBNET_BASE',
  'WARDEN_GIT_IP',
  'WARDEN_OLLAMA_IP',
  'WARDEN_DB_IP',
  'SKILLS_DB_USER',
  'SKILLS_DB_NAME',
  'MEMORY_DB_USER',
  'MEMORY_DB_NAME',
  'SKILLS_DB_PASSWORD',
  'MEMORY_DB_PASSWORD',
  'SKILLS_DB_URL',
  'MEMORY_DB_URL',
  'STRIPE_ENABLE_REFUNDS',
  'ZFS_PREFIX',
  // Backward compat (deprecated)
  'WARDEN_SUBNET_BASE',
  'CLAWDIE_TMP_DIR',
  'CLAWDIE_DOMAIN',
  'CLAWDIE_DB_URL',
]);

// ── Agent identity (single source — everything derives from this) ──

export const AGENT_NAME = (
  process.env.AGENT_NAME || envConfig.AGENT_NAME || 'clawdie'
).toLowerCase();
export const ASSISTANT_NAME =
  process.env.ASSISTANT_NAME || envConfig.ASSISTANT_NAME || AGENT_NAME;

// ── Derived system identifiers ──

export const AGENT_CP_PREFIX = `${AGENT_NAME}-cp`;
export const AGENT_CONFIG_DIR = `${AGENT_NAME}-cp`;
export const AGENT_DOMAIN =
  process.env.AGENT_DOMAIN || envConfig.AGENT_DOMAIN ||
  process.env.CLAWDIE_DOMAIN || envConfig.CLAWDIE_DOMAIN ||
  `${AGENT_NAME}.invalid`;
export const AGENT_INTERNAL_DOMAIN =
  process.env.AGENT_INTERNAL_DOMAIN ||
  envConfig.AGENT_INTERNAL_DOMAIN ||
  `${AGENT_NAME}.home.arpa`;
export const CODE_HOSTING_MODE =
  process.env.CODE_HOSTING_MODE ||
  envConfig.CODE_HOSTING_MODE ||
  'git';
export const REMOTE_GIT_URL =
  process.env.REMOTE_GIT_URL ||
  envConfig.REMOTE_GIT_URL ||
  'https://codeberg.org/Clawdie/Clawdie-AI.git';
export const FEATURE_GIT = /^(YES|yes|true|TRUE|1)$/u.test(
  process.env.FEATURE_GIT || envConfig.FEATURE_GIT || (CODE_HOSTING_MODE !== 'external' ? 'YES' : ''),
);
export const FEATURE_GITEA = /^(YES|yes|true|TRUE|1)$/u.test(
  process.env.FEATURE_GITEA || envConfig.FEATURE_GITEA || '',
);
export const SETUP_LOCALE = normalizeLocaleTag(
  process.env.SETUP_LOCALE || envConfig.SETUP_LOCALE,
);
export const DISPLAY_LOCALE = normalizeLocaleTag(
  process.env.DISPLAY_LOCALE || envConfig.DISPLAY_LOCALE || SETUP_LOCALE,
  SETUP_LOCALE,
);
export const ASSISTANT_LOCALE = normalizeLocaleTag(
  process.env.ASSISTANT_LOCALE || envConfig.ASSISTANT_LOCALE || DISPLAY_LOCALE,
  DISPLAY_LOCALE,
);
export const SYSTEM_LOCALE = normalizeSystemLocale(
  process.env.SYSTEM_LOCALE || envConfig.SYSTEM_LOCALE || DISPLAY_LOCALE,
);

// ── Service naming ──

export const AGENT_PID_FILE = `${AGENT_NAME}.pid`;
export const AGENT_LOG_FILE = `${AGENT_NAME}.log`;
export const AGENT_ERROR_LOG = `${AGENT_NAME}.error.log`;

// ── Engine & provider ──

export const TELEGRAM_BOT_TOKEN =
  process.env.TELEGRAM_BOT_TOKEN || envConfig.TELEGRAM_BOT_TOKEN || '';
export const STRIPE_SECRET_KEY =
  process.env.STRIPE_SECRET_KEY || envConfig.STRIPE_SECRET_KEY || '';
export const STRIPE_KEY_MODE = getStripeKeyMode(STRIPE_SECRET_KEY);
export const STRIPE_REFUNDS_ENABLED = /^(YES|yes|true|TRUE|1)$/u.test(
  process.env.STRIPE_ENABLE_REFUNDS || envConfig.STRIPE_ENABLE_REFUNDS || '',
);
export const AGENT_ENGINE =
  process.env.AGENT_ENGINE || envConfig.AGENT_ENGINE || 'pi-tui';
export const PI_TUI_BIN = process.env.PI_TUI_BIN || envConfig.PI_TUI_BIN || 'pi';
export const PI_TUI_PROVIDER =
  process.env.PI_TUI_PROVIDER || envConfig.PI_TUI_PROVIDER || 'zai';
export const PI_TUI_MODEL =
  process.env.PI_TUI_MODEL ||
  envConfig.PI_TUI_MODEL ||
  'glm-5';
export const POLL_INTERVAL = 2000;
export const SCHEDULER_POLL_INTERVAL = 60000;

// ── Paths ──

export const PROJECT_ROOT = process.cwd();
export const PROJECT_NAME = path.basename(PROJECT_ROOT);  // e.g., "mevy-ai", "clawdie-ai"
export const AGENT_HOME = process.env.AGENT_HOME || process.env.HOME || os.homedir();
export const STRIPE_RUNTIME_PRESENT = fs.existsSync(
  path.join(PROJECT_ROOT, 'jail', 'agent-runner', 'src', 'stripe-tools.ts'),
);
export const STRIPE_STATUS = deriveStripeStatus(
  STRIPE_KEY_MODE,
  STRIPE_RUNTIME_PRESENT,
);

// ZFS prefix: project name (name-agnostic, supports multiple installations)
// Override via ZFS_PREFIX in .env for existing installations
// e.g., zroot/mevy-ai/jails/, zroot/clawdie-runtime/jails/
export const ZFS_PREFIX = process.env.ZFS_PREFIX || envConfig.ZFS_PREFIX || PROJECT_NAME;

// Temp directory - project-relative by default
export const TMP_DIR =
  process.env.AGENT_TMP_DIR || envConfig.AGENT_TMP_DIR ||
  process.env.CLAWDIE_TMP_DIR || envConfig.CLAWDIE_TMP_DIR ||
  path.join(PROJECT_ROOT, 'tmp');
export const TMP_IPC_DIR = path.join(TMP_DIR, 'ipc');
export const TMP_TESTS_DIR = path.join(TMP_DIR, 'tests');
export const TMP_SKILLS_DIR = path.join(TMP_DIR, 'skills');

// Encrypted storage - for sensitive screenshots (API keys, passwords)
// ZFS dataset: zroot/${PROJECT_NAME}/encrypted
// Mounted at: ${PROJECT_ROOT}/encrypted/
export const ENCRYPTED_DIR = path.join(PROJECT_ROOT, 'encrypted');
export const ENCRYPTED_SCREENSHOTS_DIR = path.join(ENCRYPTED_DIR, 'screenshots');

// Screenshot directories
export const SCREENSHOTS_DIR = path.join(TMP_DIR, 'screenshots');

// Mount security: allowlist stored OUTSIDE project root, never mounted into jails
export const MOUNT_ALLOWLIST_PATH = path.join(
  AGENT_HOME,
  '.config',
  AGENT_CONFIG_DIR,
  'mount-allowlist.json',
);
export const STORE_DIR = path.resolve(PROJECT_ROOT, 'store');
export const GROUPS_DIR = path.resolve(PROJECT_ROOT, 'groups');
export const DATA_DIR = path.resolve(PROJECT_ROOT, 'data');
export const MAIN_GROUP_FOLDER = 'main';

// ── Database (split-brain architecture) ──

export const SUBNET_BASE =
  process.env.AGENT_SUBNET_BASE ||
  envConfig.AGENT_SUBNET_BASE ||
  process.env.WARDEN_SUBNET_BASE ||
  envConfig.WARDEN_SUBNET_BASE ||
  '10.0.0';

export const SKILLS_DB_USER =
  process.env.SKILLS_DB_USER ||
  envConfig.SKILLS_DB_USER ||
  defaultSkillsDbUser(AGENT_NAME);
export const SKILLS_DB_NAME =
  process.env.SKILLS_DB_NAME ||
  envConfig.SKILLS_DB_NAME ||
  defaultSkillsDbName(AGENT_NAME);
export const MEMORY_DB_USER =
  process.env.MEMORY_DB_USER ||
  envConfig.MEMORY_DB_USER ||
  defaultMemoryDbUser(AGENT_NAME);
export const MEMORY_DB_NAME =
  process.env.MEMORY_DB_NAME ||
  envConfig.MEMORY_DB_NAME ||
  defaultMemoryDbName(AGENT_NAME);

function buildPostgresUrl(
  user: string,
  password: string | undefined,
  host: string,
  database: string,
): string {
  const auth = password
    ? `${encodeURIComponent(user)}:${encodeURIComponent(password)}`
    : encodeURIComponent(user);
  return `postgresql://${auth}@${host}:5432/${encodeURIComponent(database)}`;
}

const SKILLS_DB_PASSWORD =
  process.env.SKILLS_DB_PASSWORD || envConfig.SKILLS_DB_PASSWORD || undefined;
const MEMORY_DB_PASSWORD =
  process.env.MEMORY_DB_PASSWORD || envConfig.MEMORY_DB_PASSWORD || undefined;
const DB_HOST =
  process.env.WARDEN_DB_IP ||
  envConfig.WARDEN_DB_IP ||
  `${SUBNET_BASE}.3`;
export const GIT_JAIL_IP =
  process.env.WARDEN_GIT_IP ||
  envConfig.WARDEN_GIT_IP ||
  `${SUBNET_BASE}.4`;
export const GIT_STORAGE_ROOT =
  process.env.GIT_STORAGE_ROOT ||
  envConfig.GIT_STORAGE_ROOT ||
  '/srv/git';
export const GIT_DEFAULT_REPO_NAME =
  process.env.GIT_DEFAULT_REPO_NAME ||
  envConfig.GIT_DEFAULT_REPO_NAME ||
  'Clawdie-AI.git';
const CONFIGURED_SKILLS_DB_URL = usableEnvValue(
  process.env.SKILLS_DB_URL || envConfig.SKILLS_DB_URL,
);
const CONFIGURED_MEMORY_DB_URL = usableEnvValue(
  process.env.MEMORY_DB_URL || envConfig.MEMORY_DB_URL ||
  process.env.CLAWDIE_DB_URL || envConfig.CLAWDIE_DB_URL,
);

export const SKILLS_DB_URL = CONFIGURED_SKILLS_DB_URL ||
  buildPostgresUrl(SKILLS_DB_USER, SKILLS_DB_PASSWORD, DB_HOST, SKILLS_DB_NAME);
export const MEMORY_DB_URL =
  CONFIGURED_MEMORY_DB_URL ||
  buildPostgresUrl(MEMORY_DB_USER, MEMORY_DB_PASSWORD, DB_HOST, MEMORY_DB_NAME);

export const JAIL_TIMEOUT = parseInt(
  process.env.JAIL_TIMEOUT || '1800000',
  10,
);
export const JAIL_MAX_OUTPUT_SIZE = parseInt(
  process.env.JAIL_MAX_OUTPUT_SIZE || '10485760',
  10,
); // 10MB default
export const IPC_POLL_INTERVAL = 1000;
export const IDLE_TIMEOUT = parseInt(process.env.IDLE_TIMEOUT || '1800000', 10); // 30min default — how long to keep jail alive after last result
export const MAX_CONCURRENT_JAILS = Math.max(
  1,
  parseInt(process.env.MAX_CONCURRENT_JAILS || '5', 10) || 5,
);
export const WATCHDOG_MODE = (process.env.WATCHDOG_MODE || 'auto') as
  | 'auto'
  | 'slow'
  | 'fast'
  | 'permanent';

function escapeRegex(str: string): string {
  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

export const TRIGGER_PATTERN = new RegExp(
  `^@${escapeRegex(ASSISTANT_NAME)}\\b`,
  'i',
);

// Timezone for scheduled tasks (cron expressions, etc.)
// Uses system timezone by default
export const TIMEZONE =
  normalizeTimeZone(
    process.env.TZ || envConfig.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone,
  );