koda-cli 0.6.2

//! CLI argument parsing and application entry point.
//!
//! Consumed by [`crate::run()`] which is the single `pub` surface
//! the binary calls into.

use crate::*;

use anyhow::{Context, Result};
use clap::{Parser, Subcommand};
use koda_core::persistence::Persistence;
use std::path::{Path, PathBuf};

const LONG_ABOUT: &str = "Koda runs in two modes:

  INTERACTIVE   Run `koda` (no arguments) to open the full TUI.
                Type your question and press Enter.
                Type /help inside for keybindings and all commands.

  HEADLESS      Pass a prompt to get a single answer and exit.
                Great for scripts, pipes, and CI pipelines.
                  koda \"explain this codebase\"
                  git diff | koda
                  koda -p - < prompt.txt

Configuration precedence (highest wins):
  1. CLI flags     --model, --provider, --base-url
  2. Env vars      KODA_MODEL, KODA_PROVIDER, KODA_BASE_URL
  3. Saved config  set interactively with /model, /provider, /key
                   (a --base-url used in the TUI is remembered too)
  4. Built-in defaults

API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, …)
follow the same order. Keys saved with /key are loaded from the
local keystore at startup and injected as env vars — shell env
vars always win over stored keys.";

const AFTER_HELP: &str = "Examples:
  koda                                # interactive TUI (type /help inside)
  koda \"explain this codebase\"       # one-shot question, then exit
  koda -p \"fix the failing tests\"    # same, explicit flag form
  koda -p -                           # read prompt from stdin
  git diff | koda                     # pipe diff as the prompt
  koda \"refactor\" --model o3         # one-shot with a specific model
  KODA_MODEL=gemini-flash-latest koda \"...\" # env-var model override
  koda -s abc123 \"continue\"          # resume a saved session";

/// Koda 🐻 - A high-performance AI coding agent built in Rust
#[derive(Parser, Debug)]
#[command(
    name = "koda",
    version,
    about,
    long_about = LONG_ABOUT,
    after_help = AFTER_HELP,
)]
struct Cli {
    #[command(subcommand)]
    command: Option<Command>,

    /// Run a single prompt and exit (headless mode).
    /// Use "-" to read from stdin.
    #[arg(short, long, value_name = "PROMPT")]
    prompt: Option<String>,

    /// Positional prompt (alternative to -p).
    /// `koda "fix the bug"` is equivalent to `koda -p "fix the bug"`.
    #[arg(value_name = "PROMPT", conflicts_with = "prompt")]
    positional_prompt: Option<String>,

    /// Output format for headless mode
    #[arg(long, value_enum, default_value_t = headless::OutputFormat::Text)]
    output_format: headless::OutputFormat,

    /// Agent to use (matches a JSON file in agents/)
    #[arg(short, long, default_value = "default")]
    agent: String,

    /// Session ID to resume (omit to start a new session)
    #[arg(short, long = "resume", alias = "session")]
    session: Option<String>,

    /// Project root directory (defaults to current directory)
    #[arg(long)]
    project_root: Option<PathBuf>,

    /// LLM provider base URL override
    #[arg(long, env = "KODA_BASE_URL")]
    base_url: Option<String>,

    /// Model name override
    #[arg(long, env = "KODA_MODEL")]
    model: Option<String>,

    /// LLM provider (openai, anthropic, lmstudio, llama-cpp, gemini, groq, grok, ollama)
    #[arg(long, env = "KODA_PROVIDER")]
    provider: Option<String>,

    /// Maximum output tokens
    #[arg(long)]
    max_tokens: Option<u32>,

    /// Context window in tokens, for servers that don't report theirs.
    /// Beats the agent config, the server's answer and the model table.
    #[arg(
        long,
        env = "KODA_MAX_CONTEXT_TOKENS",
        value_name = "TOKENS",
        value_parser = koda_core::config::parse_max_context_tokens
    )]
    max_context_tokens: Option<usize>,

    /// Sampling temperature (0.0 - 2.0)
    #[arg(long)]
    temperature: Option<f64>,

    /// Anthropic thinking budget in tokens, for Claude models that still take
    /// one (Haiku 4.5 and older). Current Claude models take --effort instead.
    #[arg(long)]
    thinking_budget: Option<u32>,

    /// Reasoning effort. Claude: low, medium, high, xhigh or max; by default
    /// the level Claude Code uses for the model. OpenAI-compatible servers:
    /// passed through as `reasoning_effort`.
    #[arg(
        long,
        alias = "effort",
        env = "KODA_REASONING_EFFORT",
        value_name = "LEVEL"
    )]
    reasoning_effort: Option<String>,

    /// Trust mode: auto (default) or safe.
    /// "auto" auto-approves mutating actions; the kernel sandbox
    /// contains them. Destructive ops (rm -rf, git reset --hard,
    /// git push --force, Delete) and outside-project writes still
    /// confirm. Auto requires the kernel sandbox; on unsandboxed
    /// platforms koda refuses to start with an actionable error
    /// (use --mode safe or install the platform sandbox backend).
    /// "safe" confirms every mutation before executing — use this
    /// in CI, locked-down workstations, or any context where you
    /// want a human in every approval loop.
    /// Sandbox with credential protection is always active.
    #[arg(long, env = "KODA_MODE", default_value = "auto",
          value_parser = ["safe", "auto"])]
    mode: String,
}

#[derive(Subcommand, Debug)]
enum Command {
    // Without this, `server` would be read as a prompt and sent to the model.
    /// Removed: Koda no longer has a server mode
    #[command(hide = true)]
    Server {
        #[arg(hide = true, trailing_var_arg = true, allow_hyphen_values = true)]
        args: Vec<String>,
    },
}

const SERVER_REMOVED: &str = "`koda server` has been removed. Koda no longer speaks ACP, \
so editors can't connect to it.
Run `koda` in a terminal, or `koda -p <prompt> --output-format stream-json` from a script.
See https://lijunzh.github.io/koda/acp.html";

pub(crate) async fn run() -> Result<()> {
    // Intercept --version / -V before clap so we can append the
    // platform sandbox state to the version line. clap's derive
    // version handling only supports a static string, but we want
    // bug filers to see whether their kernel sandbox is available
    // (the most common variable affecting trust-mode behavior).
    // This replaces the dedicated `koda doctor` subcommand removed
    // in #1259-followup — same bug-report-aid value, no extra
    // command for users to remember.
    //
    // Only matches the bare flag: `koda --version` / `koda -V`. We
    // don't scan all positions to avoid colliding with prompts that
    // happen to contain the literal token (e.g. `koda "what is the
    // --version flag?"`).
    let raw: Vec<String> = std::env::args().collect();
    if raw.len() == 2 && (raw[1] == "--version" || raw[1] == "-V") {
        let report = koda_core::sandbox::dependency_report();
        let sandbox = if report.available {
            format!("sandbox: available [{}]", report.backend)
        } else {
            format!("sandbox: UNAVAILABLE [{}]", report.backend)
        };
        println!("koda {} ({sandbox})", env!("CARGO_PKG_VERSION"));
        return Ok(());
    }

    let mut cli = Cli::parse();

    if matches!(cli.command, Some(Command::Server { .. })) {
        eprintln!("{SERVER_REMOVED}");
        std::process::exit(1);
    }

    // Resolve headless prompt: -p flag, positional arg, or stdin
    let headless_prompt = resolve_headless_prompt(&cli)?;

    // Resolve project root
    let project_root = cli
        .project_root
        .unwrap_or_else(|| std::env::current_dir().expect("Failed to get current directory"));
    let project_root = std::fs::canonicalize(&project_root)?;

    // Initialize logging to a per-process file (invisible to user).
    //
    // Each koda invocation gets its own log file named koda-<PID>.log.
    // A 'latest' symlink is updated to point to it so users can always
    // tail the current session without knowing the filename:
    //   tail -f ~/.config/koda/logs/latest
    // A first run is one with no config directory yet. Ask before anything
    // below creates it: the log directory and the database both live there,
    // so asking after them (as Koda did since #693) never found a first run
    // and onboarding never opened.
    let first_run = onboarding::is_first_run();
    let log_dir = koda_core::db::config_dir()?.join("logs");
    std::fs::create_dir_all(&log_dir)?;
    prune_old_logs(&log_dir, 50);
    let log_filename = format!("koda-{}.log", std::process::id());
    let file_appender = tracing_appender::rolling::never(&log_dir, &log_filename);
    let (non_blocking, log_guard) = tracing_appender::non_blocking(file_appender);
    // Best-effort symlink — silently skip on non-unix or permission errors.
    #[cfg(unix)]
    {
        let latest = log_dir.join("latest");
        let _ = std::fs::remove_file(&latest);
        let _ = std::os::unix::fs::symlink(log_dir.join(&log_filename), &latest);
    }
    tracing_subscriber::fmt()
        .with_writer(non_blocking)
        .with_ansi(false)
        .with_env_filter(
            tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| {
                tracing_subscriber::EnvFilter::new("koda_core=info,koda_cli=info")
            }),
        )
        .with_span_events(tracing_subscriber::fmt::format::FmtSpan::CLOSE)
        .init();

    tracing::info!("Koda starting. Project root: {:?}", project_root);

    // Initialize database early — keys and last-provider recall live here (#693)
    let db = koda_core::db::Database::init(&koda_core::db::config_dir()?).await?;

    // Load and inject stored API keys (env vars take precedence)
    if let Err(e) = koda_core::keystore::inject_into_env(&db).await {
        tracing::warn!("Failed to load keystore: {e}");
    }

    // `--model claude-haiku` names an alias, as `/model` lists them. Taken
    // after the keystore so a Claude alias can ask for the newest id.
    let alias = match cli.model.as_deref() {
        Some(name) => {
            koda_core::model_alias::resolve_for_flag(
                name,
                cli.provider.as_deref(),
                cli.base_url.as_deref(),
            )
            .await
        }
        None => None,
    };
    if alias.is_some() {
        cli.model = None;
    }
    let with_alias = |config: koda_core::config::KodaConfig| match &alias {
        Some(a) => config.with_alias(a),
        None => config,
    };

    // Headless mode: skip onboarding, banner, version check
    if let Some(prompt) = headless_prompt {
        let config = koda_core::config::KodaConfig::load(&project_root, &cli.agent)?;
        let typed = (cli.reasoning_effort.clone(), cli.thinking_budget);
        let config = with_alias(config.with_overrides(cli.base_url, cli.model, cli.provider))
            .with_model_overrides(
                cli.max_tokens,
                cli.temperature,
                cli.thinking_budget,
                cli.reasoning_effort,
            )
            .with_context_override(cli.max_context_tokens)
            .with_trust(parse_top_level_trust_mode(&cli.mode));
        check_typed_reasoning(typed.0.as_deref(), typed.1, &config)?;
        let session_id = match cli.session {
            Some(id) => db.resolve_session_id(&id).await?,
            None => db.create_session(&config.agent_name, &project_root).await?,
        };
        let exit_code = headless::run_headless(
            project_root,
            config,
            db,
            session_id,
            prompt,
            cli.output_format,
        )
        .await?;
        // `exit` runs no destructors, and the guard's drop is what writes out
        // the buffered lines, the last of which say how the run ended.
        drop(log_guard);
        std::process::exit(exit_code);
    }

    // Interactive mode: full REPL experience
    let version_check = koda_core::version::spawn_version_check();

    // Load configuration. The TUI also restores the last-used provider from
    // the DB, but only for the fields these flags leave unset.
    // An alias picks the provider as well as the model.
    let overrides = tui_context::ProviderOverrides {
        provider: cli.provider.is_some() || alias.is_some(),
        base_url: cli.base_url.is_some(),
        model: cli.model.is_some() || alias.is_some(),
    };
    let config = koda_core::config::KodaConfig::load(&project_root, &cli.agent)?;
    let typed = (cli.reasoning_effort.clone(), cli.thinking_budget);
    let config = with_alias(config.with_overrides(cli.base_url, cli.model, cli.provider))
        .with_model_overrides(
            cli.max_tokens,
            cli.temperature,
            cli.thinking_budget,
            cli.reasoning_effort,
        )
        .with_context_override(cli.max_context_tokens)
        .with_trust(parse_top_level_trust_mode(&cli.mode));
    check_typed_reasoning(typed.0.as_deref(), typed.1, &config)?;

    // Initialize database is already done above

    // Load or create session
    // A mistyped id (once, a llama-server pid) used to run a session that
    // didn't exist: nothing could be saved, and the model got no messages.
    let session_id = match cli.session {
        Some(id) => db.resolve_session_id(&id).await?,
        None => db.create_session(&config.agent_name, &project_root).await?,
    };

    // Run the main event loop
    tui_app::run(
        project_root,
        config,
        overrides,
        db,
        session_id,
        version_check,
        first_run,
    )
    .await
}

/// Refuse an effort or thinking budget typed for this run that the Claude
/// model doesn't take. A person can fix the command; a setting from an agent
/// config is corrected at request time instead (`koda_core::model_effort`).
fn check_typed_reasoning(
    effort: Option<&str>,
    thinking_budget: Option<u32>,
    config: &koda_core::config::KodaConfig,
) -> Result<()> {
    if config.provider_type != koda_core::config::ProviderType::Anthropic {
        return Ok(());
    }
    let model = &config.model_settings.model;
    if let Some(level) = effort {
        koda_core::model_effort::check_typed(model, level).map_err(anyhow::Error::msg)?;
    }
    if thinking_budget.is_some() && koda_core::model_effort::rejects_thinking_budget(model) {
        anyhow::bail!(
            "{model} takes no --thinking-budget. Use --effort with one of: {}.",
            koda_core::model_effort::LEVELS.join(", ")
        );
    }
    Ok(())
}

/// Parse the `--mode` CLI flag and coerce to a top-level-valid trust
/// mode, emitting a warning to stderr if Plan was requested.
///
/// **#1244**: this is the single CLI-side coercion point. The
/// `with_trust(...)` call sites in this file used to call
/// `TrustMode::parse(&cli.mode).unwrap_or_default()` directly, which
/// silently let `--mode plan` through to the top-level session —
/// where Plan is sub-agent-only and just makes every write tool fail.
/// Funneling them through here ensures the rule lives in one
/// place (DRY) and the warning is consistent across headless and
/// TUI launch modes.
///
/// **#860 / Auto-requires-sandbox**: after the Plan coercion, also
/// validate that Auto isn't requested on a system without kernel
/// sandbox support. The check is a hard fail (process exits 1)
/// rather than a silent coerce because:
///   - Headless: `koda --mode auto -p "..."` silently becoming Safe
///     would `RejectAuto` every mutation and abort the task halfway.
///   - Interactive: explicit user intent should never be silently
///     reinterpreted (Zen of Python: errors should never pass
///     silently). The error message is enriched with a
///     platform-specific install hint via
///     [`koda_core::sandbox::setup_hint`] so users see the exact fix
///     (e.g. `apt install bubblewrap`) right at the failure site —
///     no extra subcommand to remember (#1259 follow-up).
fn parse_top_level_trust_mode(cli_mode: &str) -> koda_core::trust::TrustMode {
    let parsed = koda_core::trust::TrustMode::parse(cli_mode).unwrap_or_default();
    let (mode, warning) = koda_core::trust::coerce_for_top_level(parsed);
    if let Some(w) = warning {
        eprintln!("warning: {w}");
    }
    let report = koda_core::sandbox::dependency_report();
    match koda_core::trust::require_sandbox_for_auto(mode, report.available) {
        Ok(m) => m,
        Err(msg) => {
            eprintln!("error: {msg}");
            // Inline the platform-specific install hint so the user
            // doesn't need a second command (the old `koda doctor`)
            // to learn what to type next. Hint comes from
            // `koda-core::sandbox::setup_hint` so it stays DRY with
            // the docs and the bug-report template guidance.
            eprintln!(
                "\nSetup:\n{}",
                koda_core::sandbox::setup_hint(report.backend)
            );
            std::process::exit(1);
        }
    }
}

/// Resolve the headless prompt from -p flag, positional arg, or stdin pipe.
fn resolve_headless_prompt(cli: &Cli) -> Result<Option<String>> {
    // Explicit -p flag
    if let Some(ref p) = cli.prompt {
        if p == "-" {
            // Read from stdin
            use std::io::Read;
            let mut input = String::new();
            std::io::stdin()
                .read_to_string(&mut input)
                .context("Failed to read from stdin")?;
            return Ok(Some(input.trim().to_string()));
        }
        return Ok(Some(p.clone()));
    }

    // Positional prompt
    if let Some(ref p) = cli.positional_prompt {
        return Ok(Some(p.clone()));
    }

    // Check if stdin is piped (not a TTY) — auto-headless
    if !atty_is_terminal() {
        use std::io::Read;
        let mut input = String::new();
        std::io::stdin()
            .read_to_string(&mut input)
            .context("Failed to read from stdin")?;
        let trimmed = input.trim().to_string();
        if !trimmed.is_empty() {
            return Ok(Some(trimmed));
        }
    }

    Ok(None)
}

/// Prune old `koda-<PID>.log` files, keeping only the `keep` most recent by mtime.
///
/// Called on startup before the new log file is created. Prevents unbounded
/// file-count accumulation (e.g. 18 000+ files after a year of heavy use).
/// All errors are silently discarded — a prune failure is never fatal.
fn prune_old_logs(log_dir: &Path, keep: usize) {
    let Ok(entries) = std::fs::read_dir(log_dir) else {
        return;
    };
    let mut files: Vec<_> = entries
        .filter_map(|e| e.ok())
        .filter(|e| {
            let name = e.file_name();
            let s = name.to_string_lossy();
            s.starts_with("koda-") && s.ends_with(".log")
        })
        .filter_map(|e| {
            e.metadata()
                .ok()
                .and_then(|m| m.modified().ok())
                .map(|t| (t, e.path()))
        })
        .collect();
    files.sort_by_key(|e| std::cmp::Reverse(e.0)); // newest first
    for (_, path) in files.into_iter().skip(keep) {
        let _ = std::fs::remove_file(path);
    }
}

/// Check if stdin is a terminal (not piped).
fn atty_is_terminal() -> bool {
    use std::io::IsTerminal;
    std::io::stdin().is_terminal()
}