main.go

package main

import (
	"context"
	"fmt"
	"os"

	"github.com/AxeForging/aigate/actions"
	"github.com/AxeForging/aigate/helpers"
	"github.com/AxeForging/aigate/internal/web"
	"github.com/AxeForging/aigate/services"

	"github.com/urfave/cli"
)

// Version information - set during build
var (
	Version   = "dev"
	BuildTime = "unknown"
	GitCommit = "unknown"
)

func main() {
	helpers.SetupLogger("info")

	platform := services.DetectPlatform()
	configSvc := services.NewConfigService()
	auditSvc := services.NewAuditService(configSvc)
	ruleSvc := services.NewRuleService()
	runnerSvc := services.NewRunnerServiceWithAudit(platform, auditSvc)

	initAction := actions.NewInitAction(configSvc)
	setupAction := actions.NewSetupAction(platform, configSvc)
	helpAIAction := actions.NewHelpAIAction()
	doctorAction := actions.NewDoctorAction(configSvc, platform)
	denyAction := actions.NewDenyAction(ruleSvc, configSvc, platform)
	allowAction := actions.NewAllowAction(ruleSvc, configSvc, platform)
	runAction := actions.NewRunAction(runnerSvc, configSvc, platform)
	statusAction := actions.NewStatusAction(configSvc, platform)
	resetAction := actions.NewResetAction(platform, configSvc)

	app := cli.NewApp()
	app.Name = "aigate"
	app.Usage = "OS-level sandbox for AI coding agents"
	app.Version = Version

	app.Commands = []cli.Command{
		{
			Name:    "init",
			Aliases: []string{"i"},
			Usage:   "Create default config (~/.aigate/config.yaml)",
			Flags:   []cli.Flag{verboseFlag, forceFlag},
			Action:  initAction.Execute,
		},
		{
			Name:   "setup",
			Usage:  "Create OS group and user for sandbox (requires sudo)",
			Flags:  []cli.Flag{groupFlag, userFlag, verboseFlag},
			Action: setupAction.Execute,
		},
		{
			Name:  "deny",
			Usage: "Add deny rules for AI agent isolation",
			Subcommands: []cli.Command{
				{
					Name:        "read",
					Usage:       "Deny AI agent read access to files/directories",
					Description: "Examples:\n   aigate deny read .env secrets/ '*.pem'\n   aigate deny read ~/.aws/ terraform.tfstate",
					Flags:       []cli.Flag{verboseFlag, dryRunFlag},
					Action:      denyAction.ExecuteRead,
				},
				{
					Name:        "exec",
					Usage:       "Deny AI agent from executing specific commands",
					Description: "Examples:\n   aigate deny exec curl wget ssh\n   aigate deny exec 'kubectl delete'   # block a single subcommand",
					Flags:       []cli.Flag{verboseFlag, dryRunFlag},
					Action:      denyAction.ExecuteExec,
				},
				{
					Name:        "net",
					Usage:       "Restrict AI agent network access (allow only --except domains)",
					Description: "Examples:\n   aigate deny net --except api.anthropic.com --except api.github.com",
					Flags:       []cli.Flag{exceptFlag, verboseFlag, dryRunFlag},
					Action:      denyAction.ExecuteNet,
				},
				{
					Name:        "path",
					Usage:       "Remove a path from the allowed_paths scope (narrows sandbox access)",
					Description: "Examples:\n   aigate deny path ~/.npm\n\nRemoving the last entry turns scope mode off ($HOME fully accessible again).",
					Flags:       []cli.Flag{verboseFlag},
					Action:      denyAction.ExecutePath,
				},
			},
		},
		{
			Name:  "allow",
			Usage: "Remove deny rules / widen the sandbox scope",
			Subcommands: []cli.Command{
				{
					Name:   "read",
					Usage:  "Remove file read deny rules",
					Flags:  []cli.Flag{verboseFlag},
					Action: allowAction.ExecuteRead,
				},
				{
					Name:   "exec",
					Usage:  "Remove command execution deny rules",
					Flags:  []cli.Flag{verboseFlag},
					Action: allowAction.ExecuteExec,
				},
				{
					Name:   "net",
					Usage:  "Remove network deny rules (add allowed domains)",
					Flags:  []cli.Flag{verboseFlag},
					Action: allowAction.ExecuteNet,
				},
				{
					Name:        "path",
					Usage:       "Add a path to the allowed_paths scope (activates scope mode)",
					Description: "With scope mode active, only the working directory and allowed paths are\naccessible inside the sandbox — the rest of $HOME is hidden (reads AND writes).\n\nExamples:\n   aigate allow path ~/.cache ~/.config\n   aigate allow path ../shared-lib",
					Flags:       []cli.Flag{verboseFlag},
					Action:      allowAction.ExecutePath,
				},
			},
		},
		{
			Name:        "run",
			Aliases:     []string{"r"},
			Usage:       "Run a command inside the AI sandbox (use -- before command)",
			Description: "Examples:\n   aigate run -- claude\n   aigate run -- bash -c \"npm test\"\n   aigate run --allow-path ~/notes -- claude   # extra scope path, this session only",
			Flags:       []cli.Flag{verboseFlag, configFlag, allowPathFlag},
			Action:      runAction.Execute,
		},
		{
			Name:    "status",
			Aliases: []string{"s"},
			Usage:   "Show current sandbox configuration and state",
			Flags:   []cli.Flag{verboseFlag},
			Action:  statusAction.Execute,
		},
		{
			Name:   "reset",
			Usage:  "Remove sandbox group, user, and all rules",
			Flags:  []cli.Flag{forceFlag, verboseFlag},
			Action: resetAction.Execute,
		},
		{
			Name:        "doctor",
			Usage:       "Check sandbox prerequisites and show active isolation mode",
			Description: "Checks your config, OS accounts, and sandbox tooling, then prints a verdict\n(READY / DEGRADED / BLOCKED) with copy-pasteable next steps.\nExits non-zero when the sandbox cannot run, so scripts can gate on it.",
			Action:      doctorAction.Execute,
		},
		{
			Name:  "serve",
			Usage: "Run the local web dashboard",
			Flags: []cli.Flag{
				cli.StringFlag{
					Name:   "addr",
					Value:  "127.0.0.1:8080",
					Usage:  "Address to listen on (host:port)",
					EnvVar: "AIGATE_ADDR",
				},
			},
			Action: func(c *cli.Context) error {
				srv, err := web.New(web.Options{
					Addr:      c.String("addr"),
					ConfigSvc: configSvc,
					AuditSvc:  auditSvc,
				})
				if err != nil {
					return fmt.Errorf("init web server: %w", err)
				}
				fmt.Printf("\n  Open http://%s in your browser.\n\n", srv.Addr())
				return srv.ListenAndServe(context.Background())
			},
		},
		{
			Name:   "help-ai",
			Usage:  "Show AI-friendly usage examples",
			Action: helpAIAction.Execute,
		},
		{
			Name:  "version",
			Usage: "Show version information",
			Action: func(c *cli.Context) error {
				fmt.Printf("aigate version %s\n", Version)
				fmt.Printf("Build time: %s\n", BuildTime)
				fmt.Printf("Git commit: %s\n", GitCommit)
				return nil
			},
		},
	}

	err := app.Run(os.Args)
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
}