AnyBot/src/tools.rs

// What a bot may do on this computer: list, search, read and edit files, run commands
// (long ones move to the background), and the rules that decide when to ask first.
//
// Limits come from the original's local tool runner (dist/local-exec-daemon/main.cjs):
//   search: MAIN_TIMEOUT_MS=25e3, HARD_MAX_OUTPUT_LINES=1e4 (@2983388), client limit Jut=2e3 (@2966784)
//   read:   at most 8388608 bytes (gut, @2951190)
//   shell:  on timeout a background-able command keeps running and is handed off (Mye, @3010873/@3016213)
// Permission order follows the neighbouring investigation's design notes (fnd_8):
//   deny > ignore > allow > ask, with chained shell commands split into parts first.

use serde_json::{json, Value};
use std::collections::HashMap;
use std::io::Read;
use std::path::{Path, PathBuf};
use std::process::{Command, Stdio};
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::{Arc, Mutex, OnceLock};
use std::time::{Duration, Instant};

pub const SEARCH_TIMEOUT_MS: u64 = 25_000;
pub const SEARCH_HARD_MAX_LINES: usize = 10_000;
pub const SEARCH_CLIENT_LIMIT_LINES: usize = 2_000;
pub const READ_MAX_BYTES: u64 = 8_388_608;
/// Lines returned by one read_file call when the model gives no limit (estimated).
pub const READ_DEFAULT_LINES: usize = 2_000;
/// Foreground time before a command is moved to the background (estimated; the original's comes per call).
pub const SHELL_DEFAULT_TIMEOUT_MS: u64 = 30_000;
pub const SHELL_MAX_TIMEOUT_MS: u64 = 600_000;
/// Output kept from a command: its start and its end, with the middle left out (sizes estimated;
/// the original reports output_head / output_tail / elided_chars).
pub const OUTPUT_HEAD_CHARS: usize = 6_000;
pub const OUTPUT_TAIL_CHARS: usize = 6_000;

/// Names the model sees, with JSON-schema parameters.
pub fn specs() -> Vec<Value> {
    vec![
        json!({"name": "list_dir", "description": "List the files and folders in a folder (relative to the work folder unless absolute).",
            "parameters": {"type": "object", "properties": {"path": {"type": "string", "description": "Folder to list; empty means the work folder."}}, "required": []}}),
        json!({"name": "search", "description": "Find text in files under a folder. Returns matching lines as path:line:text.",
            "parameters": {"type": "object", "properties": {
                "pattern": {"type": "string", "description": "Text to look for (regular expression when ripgrep is installed)."},
                "path": {"type": "string", "description": "Folder or file to search; empty means the work folder."},
                "files_only": {"type": "boolean", "description": "Only list the files that match."}}, "required": ["pattern"]}}),
        json!({"name": "read_file", "description": "Read a text file. Lines come back numbered.",
            "parameters": {"type": "object", "properties": {
                "path": {"type": "string"},
                "offset": {"type": "integer", "description": "First line to read (1-based)."},
                "limit": {"type": "integer", "description": "How many lines to read."}}, "required": ["path"]}}),
        json!({"name": "edit_file", "description": "Change a file. Replaces old_text (which must appear exactly once) with new_text. With empty old_text the file is created or overwritten with new_text.",
            "parameters": {"type": "object", "properties": {
                "path": {"type": "string"}, "old_text": {"type": "string"}, "new_text": {"type": "string"}}, "required": ["path", "new_text"]}}),
        json!({"name": "shell", "description": "Run a shell command in the work folder. If it runs longer than timeout_ms it keeps running in the background and you get a terminal id to check with read_terminal.",
            "parameters": {"type": "object", "properties": {
                "command": {"type": "string"},
                "timeout_ms": {"type": "integer", "description": "How long to wait before moving it to the background (default 30000)."}}, "required": ["command"]}}),
        json!({"name": "read_terminal", "description": "Read the latest output of a command that was moved to the background.",
            "parameters": {"type": "object", "properties": {"id": {"type": "integer"}}, "required": ["id"]}}),
        json!({"name": "write_terminal", "description": "Send input to a command running in the background, as if typed into its terminal (e.g. answer a prompt: \"y\\n\"). close=true ends its input (like Ctrl-D).",
            "parameters": {"type": "object", "properties": {"id": {"type": "integer"}, "input": {"type": "string", "description": "Text to send; include \\n to press return."}, "close": {"type": "boolean"}}, "required": ["id"]}}),
    ]
}

pub fn label(name: &str) -> &'static str {
    match name {
        "list_dir" => "查看資料夾",
        "search" => "搜尋檔案",
        "read_file" => "讀取檔案",
        "edit_file" => "修改檔案",
        "shell" => "執行指令",
        "read_terminal" => "查看背景指令",
        "write_terminal" => "輸入到背景指令",
        "open_for_person" => "打開給你看",
        "publish_site" => "發布網站",
        "place_call" => "打電話",
        "send_sms" => "傳簡訊",
        "post_to_x" => "在 X 發文",
        "show_card" => "顯示卡片",
        "vault_list" => "查看保險庫",
        "browser_fill_login" => "用保險庫登入",
        "browser_fill_card" => "填入卡片",
        "browser_fill_contact" => "填入聯絡資訊",
        _ => "工具",
    }
}

pub fn args_of(args: &str) -> Value {
    serde_json::from_str(args).unwrap_or(Value::Null)
}

fn arg_str(v: &Value, k: &str) -> String {
    v.get(k).and_then(Value::as_str).unwrap_or("").to_string()
}

/// One short line describing a call, for the chat and the approval card.
pub fn describe(name: &str, args: &str) -> String {
    let v = args_of(args);
    match name {
        "shell" => arg_str(&v, "command"),
        "search" => format!("「{}」 {}", arg_str(&v, "pattern"), arg_str(&v, "path")).trim().to_string(),
        "read_terminal" => format!("背景指令 #{}", v.get("id").and_then(Value::as_u64).unwrap_or(0)),
        "write_terminal" => {
            let input: String = arg_str(&v, "input").chars().take(40).collect();
            format!("背景指令 #{}：{}{}", v.get("id").and_then(Value::as_u64).unwrap_or(0), input.escape_debug(), if v.get("close").and_then(Value::as_bool).unwrap_or(false) { "（結束輸入）" } else { "" })
        }
        "vault_list" => match arg_str(&v, "kind").as_str() {
            "login" => "登入資訊".into(),
            "card" => "卡片".into(),
            "contact" => "聯絡資訊".into(),
            _ => "全部項目".into(),
        },
        "browser_fill_login" => {
            let site = arg_str(&v, "site");
            if site.is_empty() { "目前的網站".into() } else { site }
        }
        "browser_fill_card" | "browser_fill_contact" => "目前的網頁".into(),
        _ => {
            let p = arg_str(&v, "path");
            if p.is_empty() { "工作資料夾".into() } else { p }
        }
    }
}

// ---------- paths ----------

pub fn expand_home(p: &str) -> PathBuf {
    if let Some(rest) = p.strip_prefix("~/") {
        if let Some(h) = dirs::home_dir() {
            return h.join(rest);
        }
    } else if p == "~" {
        if let Some(h) = dirs::home_dir() {
            return h;
        }
    }
    PathBuf::from(p)
}

/// Make a path absolute and tidy (no `.` or `..`) without touching the disk.
pub fn resolve(workdir: &Path, p: &str) -> PathBuf {
    let raw = if p.trim().is_empty() { workdir.to_path_buf() } else {
        let e = expand_home(p.trim());
        if e.is_absolute() { e } else { workdir.join(e) }
    };
    let mut out = PathBuf::new();
    for c in raw.components() {
        match c {
            std::path::Component::ParentDir => {
                out.pop();
            }
            std::path::Component::CurDir => {}
            other => out.push(other),
        }
    }
    out
}

fn inside(workdir: &Path, p: &Path) -> bool {
    p.starts_with(workdir)
}

/// Files a bot never reads or writes: secrets and version-control internals
/// (the original blocks reads/writes by ignore files and repo-block globs),
/// plus this app's own data folder, where API keys are saved.
pub fn is_ignored(p: &Path) -> bool {
    if let Some(d) = crate::model::State::path().parent() {
        if p.starts_with(d) {
            return true;
        }
    }
    let s = p.to_string_lossy().replace('\\', "/");
    let name = p.file_name().map(|n| n.to_string_lossy().to_lowercase()).unwrap_or_default();
    s.contains("/.git/") || s.ends_with("/.git") || s.contains("/.ssh/") || s.contains("/.gnupg/") || s.contains("/Library/Keychains")
        || name == ".env" || name.starts_with(".env.") || name.ends_with(".pem") || name.ends_with(".key") || name.starts_with("id_rsa") || name.starts_with("id_ed25519")
        || name == ".netrc" || name == "credentials"
}

// ---------- permissions ----------

#[derive(Debug, PartialEq, Clone)]
pub enum Decision {
    Allow,
    Ask { reason: String, grant: String },
    Deny(String),
}

/// Commands that only look at things; chains made only of these run without asking.
const READ_ONLY_COMMANDS: [&str; 24] = [
    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "rg", "grep", "find", "file", "stat", "du", "df", "date", "which", "tree", "sort", "uniq", "diff",
    "git status", "git diff", "git log", "git show",
];

/// Always refused.
const DENIED_COMMANDS: [&str; 10] = ["sudo", "su", "rm -rf /", "rm -rf ~", "mkfs", "dd", "shutdown", "reboot", "diskutil erase", "chmod -R 777 /"];

/// Split `a && b | c; d` into its commands, keeping quoted text together.
/// Returns None when the command hides other commands ($(), backticks, eval).
pub fn split_commands(cmd: &str) -> Option<Vec<String>> {
    let mut parts = vec![];
    let mut cur = String::new();
    let (mut sq, mut dq) = (false, false);
    let chars: Vec<char> = cmd.chars().collect();
    let mut i = 0;
    while i < chars.len() {
        let c = chars[i];
        let next = chars.get(i + 1).copied();
        if c == '\'' && !dq {
            sq = !sq;
        } else if c == '"' && !sq {
            dq = !dq;
        } else if !sq && (c == '`' || (c == '$' && next == Some('('))) {
            return None;
        } else if !sq && !dq && (c == ';' || c == '\n' || c == '|' || c == '&') {
            if !cur.trim().is_empty() {
                parts.push(cur.trim().to_string());
            }
            cur.clear();
            if (c == '|' || c == '&') && next == Some(c) {
                i += 1;
            }
            i += 1;
            continue;
        }
        cur.push(c);
        i += 1;
    }
    if sq || dq {
        return None;
    }
    if !cur.trim().is_empty() {
        parts.push(cur.trim().to_string());
    }
    if parts.iter().any(|p| { let w = p.split_whitespace().next().unwrap_or(""); w == "eval" || w == "exec" || w == "source" || w == "." }) {
        return None;
    }
    Some(parts)
}

fn words(cmd: &str) -> Vec<&str> {
    cmd.split_whitespace().collect()
}

fn starts_with_words(cmd: &str, prefix: &str) -> bool {
    let (c, p) = (words(cmd), words(prefix));
    !p.is_empty() && c.len() >= p.len() && c[..p.len()] == p[..]
}

/// The "always allow" grant for a command: its first word, or first two for git/npm/cargo-style tools.
pub fn shell_grant(part: &str) -> String {
    let w = words(part);
    let two = ["git", "npm", "pnpm", "yarn", "cargo", "brew", "pip", "pip3", "python3", "docker", "go"];
    let key = if w.len() >= 2 && two.contains(&w[0]) { format!("{} {}", w[0], w[1]) } else { w.first().map(|s| s.to_string()).unwrap_or_default() };
    format!("shell:{key}")
}

fn writes_files(part: &str) -> bool {
    part.contains('>')
}

pub fn decide(name: &str, args: &str, workdir: &Path, grants: &[String]) -> Decision {
    let v = args_of(args);
    let granted = |g: &str| grants.iter().any(|x| x == g);
    match name {
        "list_dir" | "search" | "read_file" => {
            let p = resolve(workdir, &arg_str(&v, "path"));
            if is_ignored(&p) {
                return Decision::Deny(format!("「{}」是私密或系統檔案，Bot 不能讀取。", p.display()));
            }
            if inside(workdir, &p) || granted("read:anywhere") {
                Decision::Allow
            } else {
                Decision::Ask { reason: format!("讀取工作資料夾以外的地方：{}", p.display()), grant: "read:anywhere".into() }
            }
        }
        "read_terminal" | "write_terminal" => Decision::Allow,
        "edit_file" => {
            let p = resolve(workdir, &arg_str(&v, "path"));
            if is_ignored(&p) {
                return Decision::Deny(format!("「{}」是私密或系統檔案，Bot 不能修改。", p.display()));
            }
            if !inside(workdir, &p) {
                return Decision::Ask { reason: format!("修改工作資料夾以外的檔案：{}", p.display()), grant: String::new() };
            }
            if granted("edit_file") {
                Decision::Allow
            } else {
                Decision::Ask { reason: format!("修改檔案：{}", p.display()), grant: "edit_file".into() }
            }
        }
        "shell" => {
            let cmd = arg_str(&v, "command");
            if cmd.trim().is_empty() {
                return Decision::Deny("沒有指令".into());
            }
            let Some(parts) = split_commands(&cmd) else {
                return Decision::Ask { reason: format!("執行指令（含有隱藏的子指令，無法自動判斷）：{cmd}"), grant: String::new() };
            };
            // deny
            for part in &parts {
                if let Some(d) = DENIED_COMMANDS.iter().find(|d| starts_with_words(part, d)) {
                    return Decision::Deny(format!("「{d}」這類指令一律不允許。"));
                }
            }
            // ignore: commands that point at secret files
            for part in &parts {
                for w in words(part).iter().skip(1) {
                    if is_ignored(&resolve(workdir, w.trim_matches(['"', '\'']))) {
                        return Decision::Deny(format!("指令碰到私密或系統檔案：{w}"));
                    }
                }
            }
            // allow: every part is read-only or already granted
            let ok = |part: &String| !writes_files(part) && (READ_ONLY_COMMANDS.iter().any(|r| starts_with_words(part, r)) || granted(&shell_grant(part)));
            let unapproved: Vec<&String> = parts.iter().filter(|p| !ok(p)).collect();
            if unapproved.is_empty() {
                return Decision::Allow;
            }
            let grant = if unapproved.len() == 1 && !writes_files(unapproved[0]) { shell_grant(unapproved[0]) } else { String::new() };
            Decision::Ask { reason: format!("執行指令：{cmd}"), grant }
        }
        other => Decision::Deny(format!("沒有「{other}」這個工具")),
    }
}

// ---------- process trees ----------
// From cursor_proclist.node (the original's native process scanner):
//   getDescendantPids @0x6748: breadth-first over children by parent pid (proc_listpids PROC_PPID_ONLY),
//     de-duplicated, stops once 0xfff (4095) pids are collected → at most 4096 processes.
//   ProclistScanWorker::Execute @0x3d00: scans the roots plus all descendants.
//   getProcessInformation @0x5234: memoryMB = resident bytes >> 20 (lsr #0x14);
//     cpuTimeMs = (user + system time, in Mach ticks × timebase) / 1 000 000;
//     each process is tied to its agent by CONVERSATION_ID= / REQUEST_ID= in its environment.

pub const MAX_TRACKED_PROCESSES: usize = 4096;
/// Our own names for the tags the original reads (it uses its vendor prefix).
pub const ENV_CONVERSATION_ID: &str = "ANYBOT_CONVERSATION_ID";
pub const ENV_REQUEST_ID: &str = "ANYBOT_REQUEST_ID";

#[derive(Clone, Copy, Debug)]
pub struct ProcRow {
    pub pid: u32,
    pub ppid: u32,
    pub rss_kb: u64,
    pub cpu_ms: u64,
}

/// `[[dd-]hh:]mm:ss[.cc]` as printed by ps, in milliseconds.
pub fn parse_cpu_time(s: &str) -> u64 {
    let (days, rest) = match s.split_once('-') {
        Some((d, r)) => (d.parse::<u64>().unwrap_or(0), r),
        None => (0, s),
    };
    let mut secs = 0f64;
    for part in rest.split(':') {
        secs = secs * 60.0 + part.parse::<f64>().unwrap_or(0.0);
    }
    days * 86_400_000 + (secs * 1000.0).round() as u64
}

pub fn proc_table() -> Vec<ProcRow> {
    let Ok(out) = Command::new("ps").args(["-A", "-o", "pid=,ppid=,rss=,time="]).output() else { return vec![] };
    String::from_utf8_lossy(&out.stdout)
        .lines()
        .filter_map(|l| {
            let f: Vec<&str> = l.split_whitespace().collect();
            (f.len() >= 4).then(|| ProcRow { pid: f[0].parse().unwrap_or(0), ppid: f[1].parse().unwrap_or(0), rss_kb: f[2].parse().unwrap_or(0), cpu_ms: parse_cpu_time(f[3]) })
        })
        .filter(|r| r.pid > 0)
        .collect()
}

/// The roots and everything they started, breadth-first, without repeats, at most 4096.
pub fn descendants(table: &[ProcRow], roots: &[u32]) -> Vec<u32> {
    let mut seen = std::collections::HashSet::new();
    let mut out = vec![];
    let mut queue: std::collections::VecDeque<u32> = roots.iter().copied().filter(|p| *p > 0).collect();
    while let Some(p) = queue.pop_front() {
        if !seen.insert(p) {
            continue;
        }
        out.push(p);
        if out.len() >= MAX_TRACKED_PROCESSES {
            break;
        }
        queue.extend(table.iter().filter(|r| r.ppid == p).map(|r| r.pid));
    }
    out
}

/// (processes, cpu ms, memory MB) for a command and everything it started.
pub fn tree_stats(root: u32) -> (usize, u64, u64) {
    let table = proc_table();
    let pids = descendants(&table, &[root]);
    let rows: Vec<&ProcRow> = table.iter().filter(|r| pids.contains(&r.pid)).collect();
    (rows.len(), rows.iter().map(|r| r.cpu_ms).sum(), rows.iter().map(|r| (r.rss_kb * 1024) >> 20).sum())
}

/// Stop a command and everything it started (newest first), not just the shell.
pub fn kill_tree(root: u32) {
    let table = proc_table();
    let mut pids = descendants(&table, &[root]);
    pids.reverse();
    if pids.is_empty() {
        return;
    }
    let _ = Command::new("kill").arg("-TERM").args(pids.iter().map(|p| p.to_string())).stderr(Stdio::null()).status();
}

// ---------- sandbox ----------
// From sand-op-launcher `_main`: before exec it applies a sandbox profile
// "(version 1)(allow default)(deny file-read* (with no-report) (subpath (param …))))" that hides
// one private folder, builds a fresh environment, and refuses invocations outside an exact list.
// Here: commands can't read or write the app's own data (where API keys are saved) or the
// usual secret folders, and API keys are removed from their environment.

const KEY_ENV_VARS: [&str; 6] = ["XAI_API_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "GEMINI_API_KEY", "OPENROUTER_API_KEY", "ANTHROPIC_AUTH_TOKEN"];

pub fn protected_dirs() -> Vec<PathBuf> {
    let mut v = vec![];
    if let Some(d) = crate::model::State::path().parent() {
        v.push(d.to_path_buf());
    }
    if let Some(h) = dirs::home_dir() {
        for s in [".ssh", ".gnupg", "Library/Keychains", ".aws", ".config/gcloud"] {
            v.push(h.join(s));
        }
    }
    v
}

fn sandbox_exec() -> Option<&'static str> {
    let p = "/usr/bin/sandbox-exec";
    (cfg!(target_os = "macos") && Path::new(p).exists()).then_some(p)
}

fn real(p: &Path) -> String {
    // The sandbox matches real paths, so resolve links like /var → /private/var.
    std::fs::canonicalize(p).unwrap_or_else(|_| p.to_path_buf()).display().to_string()
}

/// The shell command, wrapped in the sandbox when the system has one.
#[cfg(test)]
pub fn build_command(cmd: &str, workdir: &Path, protected: &[PathBuf], conversation: &str, request: &str) -> Command {
    build_command_sealed(cmd, workdir, protected, None, conversation, request)
}

/// `seal = Some(home)`: the bot's own computer. Nothing under the person's home folder is
/// visible or writable except the bot's folder (`workdir`), like a separate machine.
pub fn build_command_sealed(cmd: &str, workdir: &Path, protected: &[PathBuf], seal: Option<&Path>, conversation: &str, request: &str) -> Command {
    let mut c = match sandbox_exec() {
        Some(se) if !protected.is_empty() || seal.is_some() => {
            let rules: String = (0..protected.len()).map(|i| format!(" (subpath (param \"P{i}\"))")).collect();
            let mut profile = format!("(version 1)(allow default)(deny file-read* file-write* (with no-report){rules})");
            if seal.is_some() {
                profile.push_str("(deny file-read* file-write* (with no-report) (require-all (subpath (param \"HOME\")) (require-not (subpath (param \"ROOT\")))))");
            }
            let mut c = Command::new(se);
            for (i, p) in protected.iter().enumerate() {
                c.arg("-D").arg(format!("P{i}={}", real(p)));
            }
            if let Some(home) = seal {
                c.arg("-D").arg(format!("HOME={}", real(home))).arg("-D").arg(format!("ROOT={}", real(workdir)));
            }
            c.arg("-p").arg(profile).arg("/bin/sh").arg("-c").arg(cmd);
            c
        }
        _ => {
            let mut c = Command::new("/bin/sh");
            c.arg("-c").arg(cmd);
            c
        }
    };
    for k in KEY_ENV_VARS {
        c.env_remove(k);
    }
    c.env(ENV_CONVERSATION_ID, conversation).env(ENV_REQUEST_ID, request);
    #[cfg(unix)]
    {
        use std::os::unix::process::CommandExt;
        c.process_group(0);
    }
    c.current_dir(workdir).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped());
    c
}

/// A command AnyBot itself wraps around the bot's (ssh / docker exec): no sandbox, because the
/// wrapper needs the person's SSH keys and Docker settings; the bot's part runs on the other machine.
pub fn build_wrapper_command(cmd: &str, conversation: &str, request: &str) -> Command {
    let mut c = Command::new("/bin/sh");
    c.arg("-c").arg(cmd);
    for k in KEY_ENV_VARS {
        c.env_remove(k);
    }
    c.env(ENV_CONVERSATION_ID, conversation).env(ENV_REQUEST_ID, request).env("PATH", crate::cloudbox::tool_path());
    #[cfg(unix)]
    {
        use std::os::unix::process::CommandExt;
        c.process_group(0);
    }
    c.current_dir(std::env::temp_dir()).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped());
    c
}

// ---------- running tools ----------

/// Which chat and which tool call a command belongs to.
#[derive(Clone, Default)]
pub struct RunIds {
    pub conversation: String,
    pub request: String,
}

struct Terminal {
    command: String,
    stdin: Arc<Mutex<Option<std::process::ChildStdin>>>,
    output: Arc<Mutex<String>>,
    child: Arc<Mutex<std::process::Child>>,
    exit: Arc<Mutex<Option<i32>>>,
    root: u32,
    /// The bot it belongs to (the ANYBOT_CONVERSATION_ID tag).
    conversation: String,
}

fn terminals() -> &'static Mutex<HashMap<u64, Terminal>> {
    static T: OnceLock<Mutex<HashMap<u64, Terminal>>> = OnceLock::new();
    T.get_or_init(|| Mutex::new(HashMap::new()))
}

fn next_terminal_id() -> u64 {
    static N: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
    N.fetch_add(1, Ordering::Relaxed)
}

/// Keep the start and the end of long output (the original's output_head / output_tail).
pub fn head_tail(s: &str) -> String {
    let n = s.chars().count();
    if n <= OUTPUT_HEAD_CHARS + OUTPUT_TAIL_CHARS {
        return s.to_string();
    }
    let head: String = s.chars().take(OUTPUT_HEAD_CHARS).collect();
    let tail: String = s.chars().skip(n - OUTPUT_TAIL_CHARS).collect();
    format!("{head}\n…（中間省略 {} 個字）…\n{tail}", n - OUTPUT_HEAD_CHARS - OUTPUT_TAIL_CHARS)
}

fn timeout_of(v: &Value) -> u64 {
    v.get("timeout_ms").and_then(Value::as_u64).unwrap_or(SHELL_DEFAULT_TIMEOUT_MS).min(SHELL_MAX_TIMEOUT_MS)
}

// ---------- computers ----------
// The original runs a bot's work on "Bot 的電腦" (its own cloud box) and only runs on this Mac when
// the person turns on 在這台電腦上執行 (setting `local-execution`, ids fuUvu2 / Hd1KB+). Permission
// questions name the machine ("允許 Grok Bot 在 {targetMachineDisplay} 上使用 {app} 嗎？", eQViQE).
// Here the bot's own computer is a sealed folder, this Mac is the person's computer, and other
// computers are reached over SSH.

#[derive(Clone, Debug)]
pub enum Place {
    /// The bot's own computer when Docker isn't there: everything outside `root` in the home
    /// folder is invisible.
    Sealed { root: PathBuf },
    /// The bot's own computer: AnyBot's Linux box (Docker), starting in `dir` inside it.
    Box { dir: String },
    /// The person's computer, starting in `workdir`.
    Local { workdir: PathBuf },
    /// Another computer: `ssh target`, starting in `dir` (empty = its home).
    Ssh { target: String, dir: String },
    /// 裝置連結: another AnyBot of the same account (through the relay), by its host id.
    Device { host: String },
}

#[derive(Clone, Debug)]
pub struct Target {
    pub name: String,
    pub place: Place,
}

/// The tools with a `computer` choice added to each, listing the computers this bot can use.
pub fn specs_for(computers: &[String], default: &str) -> Vec<Value> {
    let mut v = specs();
    for t in v.iter_mut() {
        if t["name"] == "read_terminal" || t["name"] == "write_terminal" {
            continue;
        }
        t["parameters"]["properties"]["computer"] = json!({
            "type": "string",
            "enum": computers,
            "description": format!("Which computer to work on. Default: {default}. Use the one the person names (\"在我的 Mac 上\" = {}).", crate::model::THIS_COMPUTER_NAME)
        });
    }
    v
}

pub fn sh_quote(s: &str) -> String {
    format!("'{}'", s.replace('\'', "'\\''"))
}

fn ssh_command(target: &str, dir: &str, cmd: &str) -> String {
    let inner = if dir.trim().is_empty() { cmd.to_string() } else { format!("cd {} && {}", sh_quote(dir), cmd) };
    format!("ssh -o BatchMode=yes -o ConnectTimeout=15 {} {}", sh_quote(target), sh_quote(&inner))
}

/// The local wrapper that runs `cmd` on a remote computer (an SSH host or the bot's box).
fn wrapper_for(place: &Place, cmd: &str, interactive: bool) -> Option<String> {
    match place {
        Place::Ssh { target, dir } => Some(ssh_command(target, dir, cmd)),
        Place::Box { dir } => Some(crate::cloudbox::exec_wrapper(dir, cmd, interactive)),
        _ => None,
    }
}

pub fn decide_on(name: &str, args: &str, target: &Target, grants: &[String]) -> Decision {
    let v = args_of(args);
    let denied = |cmd: &str| -> Option<Decision> {
        for part in split_commands(cmd)? {
            if let Some(d) = DENIED_COMMANDS.iter().find(|d| starts_with_words(&part, d)) {
                return Some(Decision::Deny(format!("「{d}」這類指令一律不允許。")));
            }
        }
        None
    };
    match &target.place {
        Place::Local { workdir } => decide(name, args, workdir, grants),
        Place::Sealed { root } => {
            if name == "shell" {
                // Its own computer: the sandbox keeps it inside its folder.
                return denied(&arg_str(&v, "command")).unwrap_or(Decision::Allow);
            }
            if name == "read_terminal" || name == "write_terminal" {
                return Decision::Allow;
            }
            let p = resolve(root, &arg_str(&v, "path"));
            if !inside(root, &p) {
                return Decision::Deny(format!("{} 看不到這台電腦上的其他檔案（{}）。要處理你的檔案，請用「{}」。", target.name, p.display(), crate::model::THIS_COMPUTER_NAME));
            }
            Decision::Allow
        }
        // Its own computer: everything is allowed (it can be rebuilt), like the original's box.
        Place::Box { .. } => {
            if name == "shell" {
                if let Some(d) = denied(&arg_str(&v, "command")) {
                    return d;
                }
            }
            Decision::Allow
        }
        Place::Ssh { .. } | Place::Device { .. } => match name {
            "list_dir" | "read_file" | "search" | "read_terminal" | "write_terminal" => Decision::Allow,
            "edit_file" => {
                if grants.iter().any(|g| g == "edit_file") {
                    Decision::Allow
                } else {
                    Decision::Ask { reason: format!("修改 {} 上的檔案：{}", target.name, arg_str(&v, "path")), grant: "edit_file".into() }
                }
            }
            _ => {
                let cmd = arg_str(&v, "command");
                match decide("shell", args, Path::new("/nonexistent-remote"), grants) {
                    Decision::Ask { grant, .. } => Decision::Ask { reason: format!("在 {} 上執行指令：{cmd}", target.name), grant },
                    other => other,
                }
            }
        },
    }
}

/// Run a remote command and give back its output (no background hand-off).
fn remote_capture(place: &Place, cmd: &str, stdin: Option<&[u8]>) -> Result<String, String> {
    use std::io::Write;
    let w = wrapper_for(place, cmd, stdin.is_some()).ok_or("不是遠端電腦")?;
    let mut c = build_wrapper_command(&w, "", "");
    let mut child = c.spawn().map_err(|e| format!("無法執行：{e}"))?;
    if let Some(data) = stdin {
        if let Some(mut si) = child.stdin.take() {
            si.write_all(data).map_err(|e| format!("寫入失敗：{e}"))?;
        }
    } else {
        drop(child.stdin.take());
    }
    let out = child.wait_with_output().map_err(|e| e.to_string())?;
    let text = String::from_utf8_lossy(&out.stdout).to_string();
    if out.status.success() {
        Ok(text)
    } else {
        Err(format!("{}{}", String::from_utf8_lossy(&out.stderr).trim(), if text.trim().is_empty() { String::new() } else { format!("\n{}", text.trim()) }))
    }
}

/// Run an allowed tool on a computer.
pub fn run_on(name: &str, args: &str, target: &Target, cancel: &AtomicBool, ids: &RunIds) -> (String, bool) {
    let v = args_of(args);
    let done = |r: Result<String, String>| match r {
        Ok(s) => (s, true),
        Err(e) => (e, false),
    };
    match &target.place {
        Place::Local { workdir } => run(name, args, workdir, cancel, ids),
        Place::Device { host } => match crate::remote::run_on_device(host, name, args, "") {
            Ok(v) => (v["text"].as_str().unwrap_or("").to_string(), v["ok"].as_bool().unwrap_or(false)),
            Err(e) => (e, false),
        },
        Place::Sealed { root } => {
            let _ = std::fs::create_dir_all(root);
            if name == "shell" {
                let home = dirs::home_dir().unwrap_or_else(|| PathBuf::from("/Users"));
                return done(shell(&arg_str(&v, "command"), root, timeout_of(&v), cancel, ids, Some(&home)));
            }
            run(name, args, root, cancel, ids)
        }
        place @ (Place::Ssh { .. } | Place::Box { .. }) => {
            if let Place::Box { .. } = place {
                if let Err(e) = crate::cloudbox::ensure_running() {
                    return (e, false);
                }
            }
            let _busy = crate::cloudbox::Busy::new(matches!(place, Place::Box { .. }));
            let path = arg_str(&v, "path");
            let p = if path.is_empty() { ".".to_string() } else { path.clone() };
            if v.is_null() && !args.trim().is_empty() {
                return ("參數不是有效的 JSON".into(), false);
            }
            let remote = match name {
                "shell" if arg_str(&v, "command").trim().is_empty() => return ("請給要執行的指令".into(), false),
                "shell" => arg_str(&v, "command"),
                "list_dir" => format!("ls -la {}", sh_quote(&p)),
                "read_file" => {
                    let from = v.get("offset").and_then(Value::as_u64).unwrap_or(1).max(1);
                    let n = v.get("limit").and_then(Value::as_u64).unwrap_or(READ_DEFAULT_LINES as u64);
                    format!("test -f {q} || {{ echo '找不到檔案：'{q} >&2; exit 1; }}; sed -n '{from},{}p' {q} | cat -n", from + n - 1, q = sh_quote(&p))
                }
                "search" => {
                    let flag = if v.get("files_only").and_then(Value::as_bool).unwrap_or(false) { "l" } else { "n" };
                    format!("(command -v rg >/dev/null && rg -{flag} --no-heading -- {pat} {p} || grep -rI{flag} -- {pat} {p}) | head -n {SEARCH_CLIENT_LIMIT_LINES}", pat = sh_quote(&arg_str(&v, "pattern")), p = sh_quote(&p))
                }
                "edit_file" => {
                    if path.is_empty() {
                        return ("請給檔案路徑".into(), false);
                    }
                    let old = arg_str(&v, "old_text");
                    let new = arg_str(&v, "new_text");
                    let q = sh_quote(&path);
                    let content = if old.is_empty() {
                        new
                    } else {
                        let cur = match remote_capture(place, &format!("cat {q}"), None) {
                            Ok(c) => c,
                            Err(e) => return (format!("讀不到 {path}：{e}"), false),
                        };
                        match cur.matches(old.as_str()).count() {
                            0 => return ("找不到 old_text，檔案沒有改。請先讀檔確認原文。".into(), false),
                            1 => cur.replacen(old.as_str(), &new, 1),
                            n => return (format!("old_text 出現了 {n} 次，請多給一點前後文讓它只出現一次。"), false),
                        }
                    };
                    let write = format!("mkdir -p \"$(dirname {q})\" && cat > {q}");
                    return match remote_capture(place, &write, Some(content.as_bytes())) {
                        Ok(_) => (format!("已寫入 {path}（{} 行）。", content.lines().count()), true),
                        Err(e) => (format!("寫不進 {path}：{e}"), false),
                    };
                }
                "read_terminal" | "write_terminal" => return run(name, args, Path::new("/"), cancel, ids),
                other => return (format!("沒有「{other}」這個工具"), false),
            };
            let wrapper = wrapper_for(place, &remote, name == "shell").unwrap_or_default();
            done(shell_wrapped(&wrapper, &remote, timeout_of(&v), cancel, ids))
        }
    }
}

/// Run a tool that the rules already allowed. Returns (output, ok).
pub fn run(name: &str, args: &str, workdir: &Path, cancel: &AtomicBool, ids: &RunIds) -> (String, bool) {
    let v = args_of(args);
    if v.is_null() && !args.trim().is_empty() {
        return ("參數不是有效的 JSON".into(), false);
    }
    let _ = std::fs::create_dir_all(workdir);
    let r = match name {
        "list_dir" => list_dir(&resolve(workdir, &arg_str(&v, "path"))),
        "search" => search(&arg_str(&v, "pattern"), &resolve(workdir, &arg_str(&v, "path")), v.get("files_only").and_then(Value::as_bool).unwrap_or(false)),
        "read_file" => read_file(
            &resolve(workdir, &arg_str(&v, "path")),
            v.get("offset").and_then(Value::as_u64).unwrap_or(1).max(1) as usize,
            v.get("limit").and_then(Value::as_u64).map(|l| l as usize).unwrap_or(READ_DEFAULT_LINES),
        ),
        "edit_file" => edit_file(&resolve(workdir, &arg_str(&v, "path")), &arg_str(&v, "old_text"), &arg_str(&v, "new_text")),
        "shell" => shell(&arg_str(&v, "command"), workdir, timeout_of(&v), cancel, ids, None),
        "read_terminal" => read_terminal(v.get("id").and_then(Value::as_u64).unwrap_or(0)),
        "write_terminal" => write_terminal(v.get("id").and_then(Value::as_u64).unwrap_or(0), &arg_str(&v, "input"), v.get("close").and_then(Value::as_bool).unwrap_or(false)),
        other => Err(format!("沒有「{other}」這個工具")),
    };
    match r {
        Ok(s) => (s, true),
        Err(e) => (e, false),
    }
}

fn list_dir(p: &Path) -> Result<String, String> {
    let rd = std::fs::read_dir(p).map_err(|e| format!("無法開啟資料夾 {}：{e}", p.display()))?;
    let mut rows: Vec<(bool, String, u64)> = rd
        .filter_map(|e| e.ok())
        .filter(|e| !is_ignored(&e.path()))
        .map(|e| {
            let md = e.metadata().ok();
            (md.as_ref().map(|m| m.is_dir()).unwrap_or(false), e.file_name().to_string_lossy().to_string(), md.map(|m| m.len()).unwrap_or(0))
        })
        .collect();
    rows.sort_by(|a, b| b.0.cmp(&a.0).then(a.1.to_lowercase().cmp(&b.1.to_lowercase())));
    let total = rows.len();
    let mut out: Vec<String> = rows.into_iter().take(SEARCH_CLIENT_LIMIT_LINES).map(|(d, n, s)| if d { format!("{n}/") } else { format!("{n}  {}", human_size(s)) }).collect();
    if total > SEARCH_CLIENT_LIMIT_LINES {
        out.push(format!("…還有 {} 項", total - SEARCH_CLIENT_LIMIT_LINES));
    }
    if out.is_empty() {
        out.push("（空資料夾）".into());
    }
    Ok(format!("{}\n{}", p.display(), out.join("\n")))
}

fn human_size(b: u64) -> String {
    match b {
        0..=1023 => format!("{b} B"),
        1024..=1_048_575 => format!("{:.1} KB", b as f64 / 1024.0),
        _ => format!("{:.1} MB", b as f64 / 1_048_576.0),
    }
}

fn search(pattern: &str, root: &Path, files_only: bool) -> Result<String, String> {
    if pattern.is_empty() {
        return Err("請給要搜尋的文字".into());
    }
    let deadline = Instant::now() + Duration::from_millis(SEARCH_TIMEOUT_MS);
    let mut lines: Vec<String> = vec![];
    let mut timed_out = false;
    // Prefer ripgrep when it's installed; fall back to a plain walk with substring matching.
    let rg = Command::new("rg")
        .args(["--no-heading", "--line-number", "--color", "never", "--max-columns", "300", "-g", "!.git", "-g", "!.env*", "-g", "!*.pem", "-g", "!*.key"])
        .args(if files_only { vec!["-l"] } else { vec![] })
        .arg("--")
        .arg(pattern)
        .arg(root)
        .stdout(Stdio::piped())
        .stderr(Stdio::null())
        .spawn();
    if let Ok(mut child) = rg {
        let mut out = child.stdout.take().unwrap();
        let buf = Arc::new(Mutex::new(Vec::new()));
        let b2 = buf.clone();
        let reader = std::thread::spawn(move || {
            let mut chunk = [0u8; 8192];
            while let Ok(n) = out.read(&mut chunk) {
                if n == 0 {
                    break;
                }
                let mut b = b2.lock().unwrap();
                b.extend_from_slice(&chunk[..n]);
                if b.iter().filter(|c| **c == b'\n').count() > SEARCH_HARD_MAX_LINES {
                    break;
                }
            }
        });
        loop {
            if child.try_wait().ok().flatten().is_some() || reader.is_finished() {
                break;
            }
            if Instant::now() > deadline {
                timed_out = true;
                let _ = child.kill();
                break;
            }
            std::thread::sleep(Duration::from_millis(20));
        }
        let _ = child.kill();
        let _ = reader.join();
        let text = String::from_utf8_lossy(&buf.lock().unwrap()).to_string();
        lines = text.lines().map(|l| l.to_string()).collect();
    } else {
        let needle = pattern.to_lowercase();
        let mut stack = vec![root.to_path_buf()];
        'walk: while let Some(p) = stack.pop() {
            if Instant::now() > deadline {
                timed_out = true;
                break;
            }
            if is_ignored(&p) {
                continue;
            }
            if p.is_dir() {
                if let Ok(rd) = std::fs::read_dir(&p) {
                    stack.extend(rd.filter_map(|e| e.ok()).map(|e| e.path()).filter(|q| q.file_name().map(|n| n != "node_modules" && n != "target").unwrap_or(true)));
                }
                continue;
            }
            let Ok(text) = std::fs::read_to_string(&p) else { continue };
            for (i, l) in text.lines().enumerate() {
                if l.to_lowercase().contains(&needle) {
                    lines.push(if files_only { p.display().to_string() } else { format!("{}:{}:{}", p.display(), i + 1, l.chars().take(300).collect::<String>()) });
                    if files_only {
                        break;
                    }
                    if lines.len() >= SEARCH_HARD_MAX_LINES {
                        break 'walk;
                    }
                }
            }
        }
    }
    let total = lines.len();
    let mut out: Vec<String> = lines.into_iter().take(SEARCH_CLIENT_LIMIT_LINES).collect();
    if total > SEARCH_CLIENT_LIMIT_LINES {
        out.push(format!("…結果太多，只列出前 {SEARCH_CLIENT_LIMIT_LINES} 行（共 {total} 行以上）"));
    }
    if timed_out {
        out.push(format!("…搜尋超過 {} 秒，結果可能不完整", SEARCH_TIMEOUT_MS / 1000));
    }
    if out.is_empty() {
        out.push("沒有找到".into());
    }
    Ok(out.join("\n"))
}

fn read_file(p: &Path, offset: usize, limit: usize) -> Result<String, String> {
    let md = std::fs::metadata(p).map_err(|e| format!("找不到 {}：{e}", p.display()))?;
    if md.is_dir() {
        return Err(format!("{} 是資料夾，請用 list_dir", p.display()));
    }
    if md.len() > READ_MAX_BYTES {
        return Err(format!("{} 太大了（{}），最多讀 8 MB", p.display(), human_size(md.len())));
    }
    let bytes = std::fs::read(p).map_err(|e| format!("無法讀取 {}：{e}", p.display()))?;
    if bytes.iter().take(8000).any(|b| *b == 0) {
        return Err(format!("{} 不是文字檔（{}）", p.display(), human_size(md.len())));
    }
    let text = String::from_utf8_lossy(&bytes);
    let all: Vec<&str> = text.lines().collect();
    let end = (offset - 1 + limit).min(all.len());
    let mut out: Vec<String> = all.iter().enumerate().skip(offset - 1).take(end.saturating_sub(offset - 1)).map(|(i, l)| format!("{:>5}  {l}", i + 1)).collect();
    if end < all.len() {
        out.push(format!("…還有 {} 行（用 offset={} 繼續讀）", all.len() - end, end + 1));
    }
    if out.is_empty() {
        out.push("（空檔案）".into());
    }
    Ok(out.join("\n"))
}

fn edit_file(p: &Path, old: &str, new: &str) -> Result<String, String> {
    if old.is_empty() {
        if let Some(dir) = p.parent() {
            std::fs::create_dir_all(dir).map_err(|e| format!("無法建立資料夾：{e}"))?;
        }
        let existed = p.exists();
        std::fs::write(p, new).map_err(|e| format!("無法寫入 {}：{e}", p.display()))?;
        return Ok(format!("{} {}（{} 行）", if existed { "已覆寫" } else { "已建立" }, p.display(), new.lines().count()));
    }
    let text = std::fs::read_to_string(p).map_err(|e| format!("無法讀取 {}：{e}", p.display()))?;
    match text.matches(old).count() {
        0 => Err(format!("在 {} 裡找不到要替換的文字", p.display())),
        1 => {
            std::fs::write(p, text.replacen(old, new, 1)).map_err(|e| format!("無法寫入 {}：{e}", p.display()))?;
            Ok(format!("已修改 {}", p.display()))
        }
        n => Err(format!("要替換的文字在 {} 出現了 {n} 次，請多給一些前後文讓它只出現一次", p.display())),
    }
}

fn shell(cmd: &str, workdir: &Path, timeout_ms: u64, cancel: &AtomicBool, ids: &RunIds, seal: Option<&Path>) -> Result<String, String> {
    run_command(build_command_sealed(cmd, workdir, &protected_dirs(), seal, &ids.conversation, &ids.request), cmd, timeout_ms, cancel, ids)
}

/// Run a wrapper command (ssh / docker exec) the same way: background hand-off, stop, output.
pub fn shell_wrapped(wrapper: &str, shown: &str, timeout_ms: u64, cancel: &AtomicBool, ids: &RunIds) -> Result<String, String> {
    run_command(build_wrapper_command(wrapper, &ids.conversation, &ids.request), shown, timeout_ms, cancel, ids)
}

fn run_command(mut command: Command, cmd: &str, timeout_ms: u64, cancel: &AtomicBool, ids: &RunIds) -> Result<String, String> {
    let mut child = command.spawn().map_err(|e| format!("無法執行：{e}"))?;
    let stdin = Arc::new(Mutex::new(child.stdin.take()));
    let root = child.id();
    let output = Arc::new(Mutex::new(String::new()));
    for stream in [child.stdout.take().map(|s| Box::new(s) as Box<dyn Read + Send>), child.stderr.take().map(|s| Box::new(s) as Box<dyn Read + Send>)].into_iter().flatten() {
        let out = output.clone();
        std::thread::spawn(move || {
            let mut stream = stream;
            let mut chunk = [0u8; 4096];
            while let Ok(n) = stream.read(&mut chunk) {
                if n == 0 {
                    break;
                }
                out.lock().unwrap().push_str(&String::from_utf8_lossy(&chunk[..n]));
            }
        });
    }
    let start = Instant::now();
    loop {
        if let Ok(Some(status)) = child.try_wait() {
            std::thread::sleep(Duration::from_millis(30));
            let out = head_tail(&output.lock().unwrap());
            let code = status.code().unwrap_or(-1);
            return if code == 0 { Ok(if out.trim().is_empty() { "（完成，沒有輸出）".into() } else { out }) } else { Err(format!("結束代碼 {code}\n{out}")) };
        }
        if cancel.load(Ordering::Relaxed) {
            kill_tree(root);
            let _ = child.kill();
            return Err("已停止（連同它啟動的程式）".into());
        }
        if start.elapsed() >= Duration::from_millis(timeout_ms) {
            // Hand off to the background instead of killing it.
            let id = next_terminal_id();
            let child = Arc::new(Mutex::new(child));
            let exit = Arc::new(Mutex::new(None));
            let (c2, e2) = (child.clone(), exit.clone());
            std::thread::spawn(move || loop {
                if let Ok(Some(st)) = c2.lock().unwrap().try_wait() {
                    *e2.lock().unwrap() = Some(st.code().unwrap_or(-1));
                    break;
                }
                std::thread::sleep(Duration::from_millis(200));
            });
            let so_far = head_tail(&output.lock().unwrap());
            terminals().lock().unwrap().insert(id, Terminal { command: cmd.to_string(), stdin, output, child, exit, root, conversation: ids.conversation.clone() });
            return Ok(format!("指令跑了超過 {} 秒，已移到背景繼續執行（背景指令 #{id}）。用 read_terminal 查看進度。\n目前的輸出：\n{so_far}", timeout_ms / 1000));
        }
        std::thread::sleep(Duration::from_millis(20));
    }
}

fn read_terminal(id: u64) -> Result<String, String> {
    let t = terminals().lock().unwrap();
    let term = t.get(&id).ok_or_else(|| format!("沒有背景指令 #{id}"))?;
    let out = head_tail(&term.output.lock().unwrap());
    let state = match *term.exit.lock().unwrap() {
        Some(c) => format!("已結束（代碼 {c}）"),
        None => {
            let (n, cpu, mem) = tree_stats(term.root);
            format!("還在執行：{n} 個程式，CPU 時間 {:.1} 秒，記憶體 {mem} MB", cpu as f64 / 1000.0)
        }
    };
    Ok(format!("背景指令 #{id}：{}\n狀態：{state}\n{out}", term.command))
}

/// Send input to a background command (like typing into its terminal). `close` ends its input.
fn write_terminal(id: u64, input: &str, close: bool) -> Result<String, String> {
    use std::io::Write;
    let t = terminals().lock().unwrap();
    let term = t.get(&id).ok_or_else(|| format!("沒有背景指令 #{id}"))?;
    if term.exit.lock().unwrap().is_some() {
        return Err(format!("背景指令 #{id} 已經結束了"));
    }
    let mut slot = term.stdin.lock().unwrap();
    if !input.is_empty() {
        let w = slot.as_mut().ok_or("這個指令的輸入已經關閉了")?;
        w.write_all(input.as_bytes()).and_then(|_| w.flush()).map_err(|e| format!("送不進去：{e}"))?;
    }
    if close {
        *slot = None;
    }
    drop(slot);
    drop(t);
    std::thread::sleep(Duration::from_millis(400));
    let out = read_terminal(id)?;
    Ok(format!("已送出{}{}。\n{out}", if input.is_empty() { String::new() } else { format!(" {} 個字", input.chars().count()) }, if close { "，並結束輸入" } else { "" }))
}

/// Stop every background command and what it started (when the app quits).
pub fn stop_all() {
    for t in terminals().lock().unwrap().values() {
        if t.exit.lock().unwrap().is_none() {
            kill_tree(t.root);
            let _ = t.child.lock().unwrap().kill();
        }
    }
}

/// Stop one bot's background commands (and what they started). Returns how many were running.
pub fn stop_for(conversation: &str) -> usize {
    let mut n = 0;
    for t in terminals().lock().unwrap().values().filter(|t| t.conversation == conversation) {
        if t.exit.lock().unwrap().is_none() {
            kill_tree(t.root);
            let _ = t.child.lock().unwrap().kill();
            n += 1;
        }
    }
    n
}

#[cfg(test)]
mod tests {
    use super::*;

    fn wd() -> PathBuf {
        let d = std::env::temp_dir().join(format!("anybot-test-{}", std::process::id()));
        std::fs::create_dir_all(&d).unwrap();
        d
    }

    #[test]
    fn splits_chains() {
        assert_eq!(split_commands("ls -la && git status | head; echo 'a;b'").unwrap(), vec!["ls -la", "git status", "head", "echo 'a;b'"]);
        assert!(split_commands("echo $(whoami)").is_none());
        assert!(split_commands("eval ls").is_none());
    }

    #[test]
    fn layered_rules() {
        let w = wd();
        assert_eq!(decide("shell", r#"{"command":"ls && git status"}"#, &w, &[]), Decision::Allow);
        assert!(matches!(decide("shell", r#"{"command":"ls && sudo rm x"}"#, &w, &[]), Decision::Deny(_)));
        assert!(matches!(decide("shell", r#"{"command":"cat .env"}"#, &w, &[]), Decision::Deny(_)));
        assert!(matches!(decide("shell", r#"{"command":"npm install"}"#, &w, &[]), Decision::Ask { ref grant, .. } if grant == "shell:npm install"));
        assert_eq!(decide("shell", r#"{"command":"npm install && ls"}"#, &w, &["shell:npm install".into()]), Decision::Allow);
        assert!(matches!(decide("shell", r#"{"command":"echo hi > out.txt"}"#, &w, &[]), Decision::Ask { .. }));
        assert_eq!(decide("read_file", r#"{"path":"a.txt"}"#, &w, &[]), Decision::Allow);
        assert!(matches!(decide("read_file", r#"{"path":"/etc/hosts"}"#, &w, &[]), Decision::Ask { .. }));
        assert!(matches!(decide("read_file", r#"{"path":"../../.ssh/id_rsa"}"#, &w, &[]), Decision::Deny(_) | Decision::Ask { .. }));
        assert!(matches!(decide("edit_file", r#"{"path":"a.txt","new_text":"x"}"#, &w, &[]), Decision::Ask { .. }));
        assert_eq!(decide("edit_file", r#"{"path":"a.txt","new_text":"x"}"#, &w, &["edit_file".into()]), Decision::Allow);
    }

    #[test]
    fn edit_read_search() {
        let w = wd();
        let c = AtomicBool::new(false);
        assert!(run("edit_file", r#"{"path":"n/a.txt","new_text":"hello\nworld\n"}"#, &w, &c, &RunIds::default()).1);
        assert!(run("edit_file", r#"{"path":"n/a.txt","old_text":"world","new_text":"there"}"#, &w, &c, &RunIds::default()).1);
        let (r, ok) = run("read_file", r#"{"path":"n/a.txt"}"#, &w, &c, &RunIds::default());
        assert!(ok && r.contains("there"), "{r}");
        let (s, ok) = run("search", r#"{"pattern":"there"}"#, &w, &c, &RunIds::default());
        assert!(ok && s.contains("a.txt"), "{s}");
        assert!(!run("edit_file", r#"{"path":"n/a.txt","old_text":"missing","new_text":"x"}"#, &w, &c, &RunIds::default()).1);
    }

    #[test]
    fn shell_moves_to_background() {
        let w = wd();
        let c = AtomicBool::new(false);
        let (r, ok) = run("shell", r#"{"command":"echo start; sleep 1; echo end","timeout_ms":200}"#, &w, &c, &RunIds::default());
        assert!(ok && r.contains("背景指令 #"), "{r}");
        let id: u64 = r.split("背景指令 #").nth(1).unwrap().split('）').next().unwrap().parse().unwrap();
        std::thread::sleep(Duration::from_millis(1500));
        let (t, _) = run("read_terminal", &format!(r#"{{"id":{id}}}"#), &w, &c, &RunIds::default());
        assert!(t.contains("end") && t.contains("已結束"), "{t}");
        let (q, ok) = run("shell", r#"{"command":"echo quick"}"#, &w, &c, &RunIds::default());
        assert!(ok && q.contains("quick"));
    }

    #[test]
    fn head_tail_trims_middle() {
        let s = "a".repeat(OUTPUT_HEAD_CHARS) + &"b".repeat(5000) + &"c".repeat(OUTPUT_TAIL_CHARS);
        let t = head_tail(&s);
        assert!(t.contains("中間省略 5000 個字"));
    }

    #[test]
    fn cpu_time_and_tree_walk() {
        assert_eq!(parse_cpu_time("0:01.50"), 1500);
        assert_eq!(parse_cpu_time("01:02:03"), 3_723_000);
        assert_eq!(parse_cpu_time("1-00:00:00"), 86_400_000);
        let t = [
            ProcRow { pid: 10, ppid: 1, rss_kb: 2048, cpu_ms: 5 },
            ProcRow { pid: 11, ppid: 10, rss_kb: 1024, cpu_ms: 7 },
            ProcRow { pid: 12, ppid: 11, rss_kb: 0, cpu_ms: 0 },
            ProcRow { pid: 13, ppid: 1, rss_kb: 0, cpu_ms: 0 },
        ];
        assert_eq!(descendants(&t, &[10]), vec![10, 11, 12]);
        assert_eq!(descendants(&t, &[10, 11]), vec![10, 11, 12]);
    }

    #[test]
    fn commands_are_tagged_and_keys_hidden() {
        let w = wd();
        let ids = RunIds { conversation: "7".into(), request: "call_x".into() };
        let (r, ok) = run("shell", r#"{"command":"echo $ANYBOT_CONVERSATION_ID/$ANYBOT_REQUEST_ID/${OPENAI_API_KEY:-none}"}"#, &w, &AtomicBool::new(false), &ids);
        assert!(ok && r.contains("7/call_x/none"), "{r}");
    }

    #[test]
    fn sandbox_blocks_protected_folders() {
        if sandbox_exec().is_none() {
            return;
        }
        let w = wd();
        let secret = std::env::temp_dir().join(format!("anybot-secret-{}", std::process::id()));
        std::fs::create_dir_all(&secret).unwrap();
        std::fs::write(secret.join("k.txt"), "top-secret").unwrap();
        let out = build_command(&format!("cat '{}/k.txt'", secret.display()), &w, &[secret.clone()], "1", "r").output().unwrap();
        assert!(!String::from_utf8_lossy(&out.stdout).contains("top-secret"));
        let out = build_command(&format!("cat '{}/k.txt'", secret.display()), &w, &[], "1", "r").output().unwrap();
        assert!(String::from_utf8_lossy(&out.stdout).contains("top-secret"));
    }

    #[test]
    fn bot_computer_is_sealed() {
        if sandbox_exec().is_none() {
            return;
        }
        let Some(home) = dirs::home_dir() else { return };
        let root = home.join("AnyBot 工作區").join(format!("test-seal-{}", std::process::id()));
        std::fs::create_dir_all(&root).unwrap();
        let t = Target { name: crate::model::BOT_COMPUTER_NAME.into(), place: Place::Sealed { root: root.clone() } };
        let c = AtomicBool::new(false);
        let (r, ok) = run_on("shell", r#"{"command":"echo hi > mine.txt && cat mine.txt"}"#, &t, &c, &RunIds::default());
        assert!(ok && r.contains("hi"), "{r}");
        let (r, _) = run_on("shell", r#"{"command":"ls ~/Documents >/dev/null 2>&1 && echo SEEN || echo HIDDEN"}"#, &t, &c, &RunIds::default());
        assert!(r.contains("HIDDEN"), "{r}");
        assert!(matches!(decide_on("read_file", r#"{"path":"~/Documents/x.txt"}"#, &t, &[]), Decision::Deny(_)));
        assert_eq!(decide_on("edit_file", r#"{"path":"a.txt","new_text":"x"}"#, &t, &[]), Decision::Allow);
        let _ = std::fs::remove_dir_all(&root);
    }

    #[test]
    fn ssh_commands_are_quoted() {
        assert_eq!(ssh_command("me@box", "/srv/app", "echo 'hi'"), "ssh -o BatchMode=yes -o ConnectTimeout=15 'me@box' 'cd '\\''/srv/app'\\'' && echo '\\''hi'\\'''");
        let t = Target { name: "工作站".into(), place: Place::Ssh { target: "me@box".into(), dir: String::new() } };
        assert!(matches!(decide_on("shell", r#"{"command":"npm test"}"#, &t, &[]), Decision::Ask { ref reason, .. } if reason.contains("工作站")));
        assert_eq!(decide_on("shell", r#"{"command":"ls"}"#, &t, &[]), Decision::Allow);
        let s = specs_for(&["A".into(), "B".into()], "A");
        assert_eq!(s[0]["parameters"]["properties"]["computer"]["enum"][1], "B");
    }

    #[test]
    fn stop_ends_the_whole_tree() {
        let w = wd();
        let cancel = Arc::new(AtomicBool::new(false));
        let c2 = cancel.clone();
        let marker = format!("anybot-sleep-{}", std::process::id());
        let cmd = format!(r#"{{"command":"sh -c 'exec -a {marker} sleep 30' & sleep 30","timeout_ms":20000}}"#);
        let h = std::thread::spawn(move || run("shell", &cmd, &wd(), &c2, &RunIds::default()));
        std::thread::sleep(Duration::from_millis(800));
        cancel.store(true, Ordering::Relaxed);
        let (r, ok) = h.join().unwrap();
        assert!(!ok && r.contains("已停止"), "{r}");
        std::thread::sleep(Duration::from_millis(300));
        let ps = Command::new("ps").args(["-A", "-o", "command="]).output().unwrap();
        assert!(!String::from_utf8_lossy(&ps.stdout).contains(&marker), "child still running");
        let _ = w;
    }
}