"""

Cyclops v2 - Pillar 2, the novelty brain.

Pipeline on a target source tree:

  1. (cache) skip if this commit already analyzed for this phase.

  2. semgrep fast-pass  -> candidate high-severity sinks (cheap, broad).

  3. joern dataflow      -> which candidate sinks are REACHABLE from untrusted

                            sources (source->sink taint). Reachable path = a

                            HYPOTHESIS written to the graph. NOT a finding.

  4. hand hypotheses to the oracle (Pillar 3) for execution proof.

A reachable dataflow path is a hypothesis. Only oracle.py can turn it into a

finding, and only memory.promote_to_finding (which requires a Proof) records it.

"""

import os, sys, json, subprocess, glob

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "memory"))

from memory import Memory

CYCLOPS_HOME = os.environ.get("CYCLOPS_HOME", "/opt/cyclops-v2")

VENV_PY      = os.environ.get("CYCLOPS_PY", "/opt/cyclops-venv/bin/python")

SEMGREP      = os.environ.get("CYCLOPS_SEMGREP", "/opt/cyclops-venv/bin/semgrep")

JOERN        = os.environ.get("CYCLOPS_JOERN", "/opt/joern/joern-cli/joern")

QUERY_DIR    = os.path.join(CYCLOPS_HOME, "brain", "joern-queries")

RULE_DIR     = os.path.join(CYCLOPS_HOME, "brain", "semgrep-rules")

QUERY_SINKCLASS = {

    "c-memory-corruption.sc":  ("memory-corruption", "RCE via Memory Corruption"),

    "deserialization-rce.sc":  ("deserialization",   "RCE via Deserialization"),

    "command-injection.sc":    ("command-injection", "RCE via Command Injection"),

    "path-traversal.sc":       ("path-traversal",    "Arbitrary File Read/Write"),

    "ssrf.sc":                 ("ssrf",              "SSRF chains to Critical"),

    "template-injection.sc":   ("template-injection","RCE via Template Injection"),

    "js-electron-rce.sc":      ("electron-rce",      "One-Click/Zero-Click RCE"),

}

def semgrep_pass(src):

    """Fast broad pass. Returns list of candidate sink dicts."""

    if not os.path.isdir(RULE_DIR) or not os.listdir(RULE_DIR):

        return []

    try:

        out = subprocess.run(

            [SEMGREP, "--quiet", "--json", "--config", RULE_DIR, src],

            capture_output=True, text=True, timeout=1200)

        data = json.loads(out.stdout or "{}")

    except Exception as e:

        print(f"[brain] semgrep error: {e}")

        return []

    cands = []

    for r in data.get("results", []):

        cands.append({

            "file": r.get("path"),

            "line": r.get("start", {}).get("line", 0),

            "rule": r.get("check_id"),

            "msg": r.get("extra", {}).get("message", ""),

        })

    print(f"[brain] semgrep: {len(cands)} candidate sinks")

    return cands

def joern_query(src, script, project):

    """Run one joern dataflow script. Returns parsed FINDING lines."""

    path = os.path.join(QUERY_DIR, script)

    if not os.path.exists(path):

        return []

    try:

        out = subprocess.run(

            [JOERN, "--script", path, "--param", f"inputPath={src}",

             "--param", f"projectName={project}"],

            capture_output=True, text=True, timeout=3600)

    except subprocess.TimeoutExpired:

        print(f"[brain] joern timeout on {script}")

        return []

    findings = []

    for ln in (out.stdout or "").splitlines():

        if ln.startswith("FINDING:"):

            try:

                body = ln[len("FINDING:"):].strip()

                locpart, rest = body.split(" ", 1)

                fp, _, lno = locpart.rpartition(":")

                kv = {}

                for tok in ("class", "source", "sink"):

                    if tok + "=" in rest:

                        seg = rest.split(tok + "=", 1)[1]

                        for nxt in (" class=", " source=", " sink="):

                            if nxt.strip(" =") != tok and nxt in seg:

                                seg = seg.split(nxt)[0]

                        kv[tok] = seg.strip()

                findings.append({"file": fp, "line": int(lno) if lno.isdigit() else 0,

                                 "cls": kv.get("class", ""), "source": kv.get("source", ""),

                                 "sink": kv.get("sink", "")})

            except Exception:

                continue

    return findings

def analyze(repo, archetype, src, lang="", commit="", released_at=""):

    m = Memory()

    tid = m.upsert_target(repo, archetype, lang=lang, commit=commit,

                          released_at=released_at, status="ANALYZING")

    if m.analysis_done(tid, "brain"):

        print(f"[brain] {repo}@{commit} already analyzed (cache hit) - skipping")

        return tid, []

    semgrep_pass(src)

    hyps = []

    for script, (sink_class, impact) in QUERY_SINKCLASS.items():

        fs = joern_query(src, script, f"cyc_{archetype}")

        for f in fs:

            hid = m.add_hypothesis(tid, sink_class, f["file"], f["line"],

                                   f["source"], f["sink"], "joern")

            hyps.append({"hid": hid, "sink_class": sink_class, "impact": impact,

                         "file": f["file"], "line": f["line"],

                         "source": f["source"], "sink": f["sink"]})

        if fs:

            print(f"[brain] {script}: {len(fs)} reachable source->sink paths")

    m.mark_analysis_done(tid, "brain")

    m.enqueue("oracle", {"target": tid, "repo": repo, "src": src,

                         "archetype": archetype, "hypotheses": hyps})

    print(f"[brain] {repo}: {len(hyps)} HYPOTHESES queued for oracle proof")

    return tid, hyps

if __name__ == "__main__":

    if len(sys.argv) < 4:

        print("usage: brain.py <repo> <archetype> <src_path> [lang] [commit]")

        sys.exit(1)

    analyze(sys.argv[1], sys.argv[2], sys.argv[3],

            lang=sys.argv[4] if len(sys.argv) > 4 else "",

            commit=sys.argv[5] if len(sys.argv) > 5 else "")