forge-guard 0.1.2

//! CLI argument parsing and command dispatch.

mod audit;
mod benchmark;
mod chain;
mod ci;
mod deploy;
mod deploy_safe;
mod doctor;
mod fuzz;
mod gas;
mod invariant;
mod plugins;
mod report;
mod scan;
mod security;
mod simulate;
mod upgrade_check;
mod verify;
mod watch;

use clap::{Parser, Subcommand};
use std::path::PathBuf;

/// Forge Guard — pre-deployment smart contract auditing for Foundry.
#[derive(Parser, Debug)]
#[command(
    name = "forge-guard",
    version,
    about = "Pre-deployment smart contract auditing framework for Foundry",
    long_about = "The most comprehensive pre-deployment smart contract auditing framework for Foundry.\n\nTransforms security auditing from an optional step into a mandatory pre-deployment process.\nBlocks unsafe deployments by default while providing detailed vulnerability reports.",
    author
)]
pub struct Cli {
    #[command(subcommand)]
    pub command: Commands,
}

impl Cli {
    /// Create a CLI instance from environment arguments.
    pub fn from_env() -> Self {
        Self::parse()
    }

    /// Run the selected command.
    pub fn run(&self) -> anyhow::Result<()> {
        use anyhow::Context;
        match &self.command {
            Commands::Audit(args) => audit::run(args).context("Audit failed"),
            Commands::Deploy(args) => deploy::run(args).context("Deploy failed"),
            Commands::DeploySafe(args) => deploy_safe::run(args).context("Safe deploy failed"),
            Commands::Fuzz(args) => fuzz::run(args).context("Fuzzing failed"),
            Commands::Invariant(args) => invariant::run(args).context("Invariant test failed"),
            Commands::Simulate(args) => simulate::run(args).context("Simulation failed"),
            Commands::Gas(args) => gas::run(args).context("Gas analysis failed"),
            Commands::Report(args) => report::run(args).context("Report generation failed"),
            Commands::Verify(args) => verify::run(args).context("Verification failed"),
            Commands::Doctor(args) => doctor::run(args).context("Doctor analysis failed"),
            Commands::Watch(args) => watch::run(args).context("Watch failed"),
            Commands::Ci(args) => ci::run(args).context("CI generation failed"),
            Commands::Benchmark(args) => benchmark::run(args).context("Benchmark failed"),
            Commands::Scan(args) => scan::run(args).context("Scan failed"),
            Commands::UpgradeCheck(args) => {
                upgrade_check::run(args).context("Upgrade check failed")
            }
            Commands::Plugins(args) => plugins::run(args).context("Plugin operation failed"),
            Commands::Chain(args) => chain::run(args).context("Chain operation failed"),
            Commands::Security(args) => security::run(args).context("Security operation failed"),
        }
    }
}

/// All available subcommands.
#[derive(Subcommand, Debug)]
pub enum Commands {
    /// Run a comprehensive security audit
    Audit(AuditArgs),
    /// Deploy contracts with automatic security checks
    Deploy(DeployArgs),
    /// Deploy with mandatory security pass requirement
    #[command(name = "deploy-safe")]
    DeploySafe(DeploySafeArgs),
    /// Run fuzzing campaigns
    Fuzz(FuzzArgs),
    /// Run invariant tests
    Invariant(InvariantArgs),
    /// Run deployment simulations
    Simulate(SimulateArgs),
    /// Analyze gas usage
    Gas(GasArgs),
    /// Generate audit reports from existing results
    Report(ReportArgs),
    /// Verify contract deployments
    Verify(VerifyArgs),
    /// Analyze project health and configuration
    Doctor(DoctorArgs),
    /// Watch files for changes and re-audit
    Watch(WatchArgs),
    /// Generate CI/CD pipeline configurations
    Ci(CiArgs),
    /// Run performance benchmarks
    Benchmark(BenchmarkArgs),
    /// Scan dependencies for vulnerabilities
    Scan(ScanArgs),
    /// Analyze upgrade paths and proxy safety
    #[command(name = "upgrade-check")]
    UpgradeCheck(UpgradeCheckArgs),
    /// Manage audit plugins
    Plugins(PluginArgs),
    /// Configure chain settings
    Chain(ChainArgs),
    /// Configure security settings
    Security(SecurityArgs),
}

// ── Shared CLI Flags ─────────────────────────────────────────────

/// Common flags shared across many commands.
#[derive(Debug, clap::Args)]
pub struct SharedFlags {
    /// Target chain to audit for
    #[arg(long, global = true, default_value = "ethereum")]
    pub chain: String,

    /// Path to Foundry project root
    #[arg(long, global = true, default_value = ".")]
    pub project: PathBuf,

    /// Output as JSON
    #[arg(long, global = true)]
    pub json: bool,

    /// Output as Markdown
    #[arg(long, global = true)]
    pub markdown: bool,

    /// Strict mode: fail on any finding
    #[arg(long, global = true)]
    pub strict: bool,

    /// Offline mode: skip RPC calls
    #[arg(long, global = true)]
    pub offline: bool,

    /// Production mode: extra checks
    #[arg(long, global = true)]
    pub production: bool,

    /// Generate report file
    #[arg(long, global = true)]
    pub report: bool,

    /// Number of parallel workers
    #[arg(long, global = true, default_value = "4")]
    pub parallelism: usize,
}

// ── Per-command args ─────────────────────────────────────────────

#[derive(Debug, clap::Args)]
pub struct AuditArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Run all available checks
    #[arg(long, short)]
    pub full: bool,

    /// Quick mode — skip parser-heavy and expensive checks for fast results
    #[arg(long)]
    pub quick: bool,

    /// Show executive summary instead of full terminal report
    #[arg(long)]
    pub summary: bool,

    /// Enable AI-powered auditing (uses configured LLM provider)
    #[arg(long)]
    pub ai: bool,

    /// AI provider: openai, claude, or ollama
    #[arg(long, default_value = "openai")]
    pub ai_provider: String,

    /// AI model identifier (e.g. gpt-4, claude-sonnet-4-20250514)
    #[arg(long, default_value = "gpt-4")]
    pub ai_model: String,

    /// AI API key (reads OPENAI_API_KEY or ANTHROPIC_API_KEY env var when empty)
    #[arg(long)]
    pub ai_api_key: Option<String>,

    /// Ollama endpoint URL (default: http://localhost:11434)
    #[arg(long)]
    pub ollama_endpoint: Option<String>,

    /// Run a full AI audit (security + gas + logic auditors)
    #[arg(long)]
    pub ai_full: bool,

    /// Include exploit path analysis
    #[arg(long)]
    pub exploit: bool,

    /// Include gas analysis
    #[arg(long)]
    pub gas: bool,

    /// Audit all supported chains
    #[arg(long)]
    pub all_chains: bool,

    /// Source directories to audit (comma-separated)
    #[arg(long, default_value = "src")]
    pub sources: String,

    /// Exclude patterns (comma-separated)
    #[arg(long)]
    pub exclude: Option<String>,
}

#[derive(Debug, clap::Args)]
pub struct DeployArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Contract name to deploy
    pub contract: Option<String>,

    /// Bypass deployment guard (warnings still shown)
    #[arg(long)]
    pub force: bool,

    /// Constructor arguments (comma-separated)
    #[arg(long)]
    pub args: Option<String>,

    /// Create2 salt
    #[arg(long)]
    pub salt: Option<String>,

    /// Verify contract after deployment
    #[arg(long)]
    pub verify: bool,
}

#[derive(Debug, clap::Args)]
pub struct DeploySafeArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Contract name to deploy
    pub contract: Option<String>,

    /// Constructor arguments (comma-separated)
    #[arg(long)]
    pub args: Option<String>,

    /// Verify contract after deployment
    #[arg(long)]
    pub verify: bool,
}

#[derive(Debug, clap::Args)]
pub struct FuzzArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Number of fuzz runs
    #[arg(long, default_value = "10000")]
    pub runs: u32,

    /// Fuzz seed
    #[arg(long)]
    pub seed: Option<u64>,

    /// Test function filter
    #[arg(long)]
    pub test: Option<String>,

    /// Fuzz contract
    pub contract: Option<String>,
}

#[derive(Debug, clap::Args)]
pub struct InvariantArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Number of runs
    #[arg(long, default_value = "1000")]
    pub runs: u32,

    /// Depth of calls per run
    #[arg(long, default_value = "100")]
    pub depth: u32,

    /// Invariant contract
    pub contract: Option<String>,

    /// Fail on revert
    #[arg(long)]
    pub fail_on_revert: bool,
}

#[derive(Debug, clap::Args)]
pub struct SimulateArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Number of simulation blocks
    #[arg(long, default_value = "100")]
    pub blocks: u32,

    /// Simulate with specific deployer address
    #[arg(long)]
    pub deployer: Option<String>,

    /// Include MEV analysis
    #[arg(long)]
    pub mev: bool,

    /// Contract to simulate deployment for
    pub contract: Option<String>,
}

#[derive(Debug, clap::Args)]
pub struct GasArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Check specific contract
    pub contract: Option<String>,

    /// Compare with previous report
    #[arg(long)]
    pub diff: Option<String>,

    /// Report gas for all functions
    #[arg(long)]
    pub all: bool,

    /// Minimum gas threshold for warnings
    #[arg(long, default_value = "50000")]
    pub warn_threshold: u64,
}

#[derive(Debug, clap::Args)]
pub struct ReportArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Path to audit result JSON
    pub input: Option<PathBuf>,

    /// Output report format
    #[arg(long, default_value = "markdown")]
    pub format: String,

    /// Output file path
    #[arg(long)]
    pub output: Option<PathBuf>,

    /// Include exploit paths
    #[arg(long)]
    pub exploit_paths: bool,

    /// Summary only
    #[arg(long)]
    pub summary: bool,
}

#[derive(Debug, clap::Args)]
pub struct VerifyArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Contract address to verify
    pub address: Option<String>,

    /// Contract name
    pub name: Option<String>,

    /// Explorer API key
    #[arg(long)]
    pub api_key: Option<String>,

    /// Constructor arguments ABI-encoded
    #[arg(long)]
    pub constructor_args: Option<String>,

    /// Check all deployments
    #[arg(long)]
    pub all: bool,
}

#[derive(Debug, clap::Args)]
pub struct DoctorArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Fix issues automatically where possible
    #[arg(long)]
    pub fix: bool,

    /// Verbose output
    #[arg(long, short)]
    pub verbose: bool,

    /// Check only specific category
    #[arg(long)]
    pub check: Option<String>,
}

#[derive(Debug, clap::Args)]
pub struct WatchArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Watch specific directories
    #[arg(long, default_value = "src")]
    pub dirs: String,

    /// Debounce interval in ms
    #[arg(long, default_value = "500")]
    pub debounce_ms: u64,

    /// Exclude patterns
    #[arg(long)]
    pub exclude: Option<String>,

    /// Run full audit on change
    #[arg(long)]
    pub full: bool,
}

#[derive(Debug, clap::Args)]
pub struct CiArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// CI platform to generate for
    #[arg(long, default_value = "github")]
    pub platform: String,

    /// Output directory for CI configs
    #[arg(long, default_value = ".github/workflows")]
    pub output: PathBuf,

    /// Include deployment pipeline
    #[arg(long)]
    pub include_deploy: bool,

    /// Overwrite existing files
    #[arg(long)]
    pub overwrite: bool,
}

#[derive(Debug, clap::Args)]
pub struct BenchmarkArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Number of benchmark iterations
    #[arg(long, default_value = "10")]
    pub iterations: u32,

    /// Compare with baseline
    #[arg(long)]
    pub compare: Option<PathBuf>,

    /// Save benchmark results
    #[arg(long)]
    pub save: Option<PathBuf>,

    /// Benchmark specific module
    #[arg(long)]
    pub module: Option<String>,

    /// Warmup iterations
    #[arg(long, default_value = "3")]
    pub warmup: u32,
}

#[derive(Debug, clap::Args)]
pub struct ScanArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Scan depth (0=direct, 1=direct+indirect, etc.)
    #[arg(long, default_value = "1")]
    pub depth: u32,

    /// Update vulnerability database
    #[arg(long)]
    pub update: bool,

    /// Output only vulnerable packages
    #[arg(long)]
    pub vulnerable_only: bool,

    /// Fail on any vulnerability
    #[arg(long)]
    pub fail_fast: bool,
}

#[derive(Debug, clap::Args)]
pub struct UpgradeCheckArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Proxy contract address
    pub proxy: Option<String>,

    /// Implementation contract address
    pub implementation: Option<String>,

    /// Check all proxies
    #[arg(long)]
    pub all: bool,

    /// Check storage collision
    #[arg(long)]
    pub storage_collision: bool,

    /// Check UUPS upgrade path
    #[arg(long)]
    pub uups: bool,
}

#[derive(Debug, clap::Args)]
pub struct PluginArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Plugin subcommand
    #[command(subcommand)]
    pub action: Option<PluginAction>,
}

#[derive(Debug, Subcommand)]
pub enum PluginAction {
    /// List installed plugins
    List,
    /// Install a plugin
    Install {
        name: String,
        source: Option<String>,
    },
    /// Remove a plugin
    Remove { name: String },
    /// Enable a plugin
    Enable { name: String },
    /// Disable a plugin
    Disable { name: String },
    /// Create a new plugin scaffold
    New { name: String },
}

#[derive(Debug, clap::Args)]
pub struct ChainArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Chain subcommand
    #[command(subcommand)]
    pub action: Option<ChainAction>,
}

#[derive(Debug, Subcommand)]
pub enum ChainAction {
    /// List supported chains
    List,
    /// Show chain information
    Info { chain: String },
    /// Add a custom chain
    Add {
        name: String,
        rpc_url: Option<String>,
        chain_id: Option<u64>,
    },
    /// Remove a custom chain
    Remove { name: String },
    /// Test chain RPC connectivity
    Test {
        chain: String,
        rpc_url: Option<String>,
    },
}

#[derive(Debug, clap::Args)]
pub struct SecurityArgs {
    #[command(flatten)]
    pub shared: SharedFlags,

    /// Security subcommand
    #[command(subcommand)]
    pub action: Option<SecurityAction>,
}

#[derive(Debug, Subcommand)]
pub enum SecurityAction {
    /// Show security configuration
    Config,
    /// Set security threshold
    Threshold { score: u8 },
    /// Enable a specific check
    Enable { check: String },
    /// Disable a specific check
    Disable { check: String },
    /// List all security checks
    List,
    /// Show security check details
    Info { check: String },
}