sentri-cli 0.3.0

#![deny(unsafe_code)]
#![allow(dead_code)] // Functions used in future feature development
#![allow(missing_docs)] // CLI is self-documenting via clap help

//! Sentri CLI: Multi-chain smart contract invariant enforcement tool.
//!
//! Production-grade terminal UI with professional styling and comprehensive
//! analysis capabilities for smart contract security.

use anyhow::{Context, Result};
use clap::{Parser, Subcommand, ValueEnum};
use serde_json::json;
use std::path::{Path, PathBuf};
use std::time::Instant;

// UI module
mod ui;
use ui::*;

// Import analyzers and simulator
use sentri_analyzer_evm::EvmAnalyzer;
use sentri_analyzer_move::MoveAnalyzer;
use sentri_analyzer_solana::SolanaAnalyzer;
use sentri_core::traits::ChainAnalyzer;
use sentri_library::InvariantLibrary;
// use sentri_simulator::SimulationEngine;  // DEPRECATED: Old simulator using revm, disabled for v0.3.0

// ============================================================================
// CLI STRUCTURE
// ============================================================================

/// Sentri: Production-grade multi-chain invariant analysis tool.
#[derive(Parser)]
#[command(
    name = "sentri",
    about = "Enforce invariants on smart contracts across Solana, EVM, and Move",
    version = env!("CARGO_PKG_VERSION"),
    author = "Sentri Contributors"
)]
struct Cli {
    /// Enable verbose output.
    #[arg(short, long, global = true)]
    verbose: bool,

    /// Suppress all non-error output.
    #[arg(long, global = true)]
    quiet: bool,

    #[command(subcommand)]
    command: Commands,
}

#[derive(Subcommand)]
enum Commands {
    /// Analyze contracts for invariant violations (recommended: use 'scan' instead).
    Check(CheckArgs),
    /// Scan contracts with full invariant enforcement (primary command).
    Scan(ScanArgs),
    /// Generate a report from analysis results.
    Report(ReportArgs),
    /// Initialize a .sentri.toml configuration file.
    Init(InitArgs),
    /// Check that all Sentri components are working correctly.
    Doctor(DoctorArgs),
    /// Display exploit registry.
    Registry(RegistryArgs),
    /// Display compiled invariants.
    Invariants(InvariantsArgs),
    /// Run fuzzer on contract invariants.
    Fuzz(FuzzArgs),
}

/// Arguments for the `doctor` subcommand.
#[derive(Parser)]
struct DoctorArgs {
    /// Output format.
    #[arg(long, value_enum, default_value = "text")]
    format: FormatArg,

    /// Output file.
    #[arg(long)]
    output: Option<PathBuf>,
}

/// Arguments for the `check` subcommand.
#[derive(Parser)]
struct CheckArgs {
    /// Path to analyze (file or directory).
    path: PathBuf,

    /// Blockchain to analyze.
    #[arg(long, value_enum, default_value = "evm")]
    chain: ChainArg,

    /// Fail if violations at or above this severity are found.
    #[arg(long, value_enum, default_value = "low")]
    fail_on: SeverityArg,

    /// Output format.
    #[arg(long, value_enum, default_value = "text")]
    format: FormatArg,

    /// Output file (for non-text formats).
    #[arg(long)]
    output: Option<PathBuf>,

    /// Configuration file.
    #[arg(long)]
    config: Option<PathBuf>,

    /// Random seed for reproducible analysis (default: 42).
    #[arg(long)]
    seed: Option<u64>,
}

/// Arguments for the `scan` subcommand (enhanced version of check).
#[derive(Parser)]
struct ScanArgs {
    /// Path to analyze (file or directory).
    path: PathBuf,

    /// Blockchain to analyze.
    #[arg(long, value_enum, default_value = "evm")]
    chain: ChainArg,

    /// Output format.
    #[arg(long, value_enum, default_value = "text")]
    output: FormatArg,

    /// Output file (for non-text formats).
    #[arg(long)]
    file: Option<PathBuf>,

    /// Minimum severity to report.
    #[arg(long, value_enum)]
    severity: Option<SeverityArg>,

    /// Filter by specific invariant ID (can be used multiple times).
    #[arg(long)]
    invariant: Vec<String>,

    /// RPC URL for on-chain verification (e.g., bridge config checks).
    #[arg(long)]
    rpc: Option<String>,

    /// Fail the scan if any issues at or above this severity are found.
    #[arg(long, value_enum, default_value = "critical")]
    fail_on: SeverityArg,

    /// Use parallel scanning with rayon (thread pool).
    #[arg(long)]
    parallel: bool,

    /// Disable ANSI color output.
    #[arg(long)]
    no_color: bool,

    /// Configuration file.
    #[arg(long)]
    config: Option<PathBuf>,
}

/// Arguments for the `registry` subcommand.
#[derive(Parser)]
struct RegistryArgs {
    /// Subcommand for registry operations.
    #[command(subcommand)]
    action: RegistryAction,
}

#[derive(Subcommand)]
enum RegistryAction {
    /// List all known exploits in the registry.
    List {
        /// Filter by chain (evm, solana, move).
        #[arg(long)]
        chain: Option<String>,
        /// Output format.
        #[arg(long, value_enum, default_value = "text")]
        format: FormatArg,
    },
    /// Show details of a specific exploit.
    Show {
        /// Exploit ID (e.g., "euler-finance-2023").
        id: String,
        /// Output format.
        #[arg(long, value_enum, default_value = "text")]
        format: FormatArg,
    },
}

/// Arguments for the `invariants` subcommand.
#[derive(Parser)]
struct InvariantsArgs {
    /// Subcommand for invariants operations.
    #[command(subcommand)]
    action: InvariantsAction,
}

#[derive(Subcommand)]
enum InvariantsAction {
    /// List all compiled invariants.
    List {
        /// Filter by chain (evm, solana, move).
        #[arg(long)]
        chain: Option<String>,
        /// Filter by severity.
        #[arg(long)]
        severity: Option<SeverityArg>,
        /// Output format.
        #[arg(long, value_enum, default_value = "text")]
        format: FormatArg,
    },
    /// Show details of a specific invariant.
    Show {
        /// Invariant ID (e.g., "evm_reentrancy_classic").
        id: String,
        /// Output format.
        #[arg(long, value_enum, default_value = "text")]
        format: FormatArg,
    },
}

/// Arguments for the `fuzz` subcommand.
#[derive(Parser)]
struct FuzzArgs {
    /// Contract file or directory to fuzz.
    path: PathBuf,

    /// Blockchain to fuzz for.
    #[arg(long, value_enum, default_value = "evm")]
    chain: ChainArg,

    /// Maximum call sequence depth for fuzzer.
    #[arg(long, default_value = "10")]
    depth: usize,

    /// Number of iterations to run.
    #[arg(long, default_value = "10000")]
    iterations: u32,

    /// Random seed for reproducibility.
    #[arg(long)]
    seed: Option<u64>,

    /// Output format.
    #[arg(long, value_enum, default_value = "text")]
    output: FormatArg,

    /// Output file.
    #[arg(long)]
    file: Option<PathBuf>,
}

/// Arguments for the `report` subcommand.
#[derive(Parser)]
struct ReportArgs {
    /// Input results file.
    #[arg(long)]
    input: PathBuf,

    /// Output format.
    #[arg(long, value_enum, default_value = "text")]
    format: FormatArg,

    /// Output file.
    #[arg(long)]
    output: Option<PathBuf>,
}

/// Arguments for the `init` subcommand.
#[derive(Parser)]
struct InitArgs {
    /// Project directory.
    #[arg(default_value = ".")]
    path: PathBuf,
}

/// Supported blockchain networks.
#[derive(ValueEnum, Clone, Debug)]
enum ChainArg {
    /// Ethereum and EVM-compatible chains.
    Evm,
    /// Solana.
    Solana,
    /// Move (Aptos, Sui).
    Move,
}

/// Violation severity levels.
#[derive(ValueEnum, Clone, Debug)]
enum SeverityArg {
    /// Low severity issues.
    Low,
    /// Medium severity issues.
    Medium,
    /// High severity issues.
    High,
    /// Critical severity issues.
    Critical,
}

/// Output format options.
#[derive(ValueEnum, Clone, Debug)]
enum FormatArg {
    /// Human-readable text with colors and boxes.
    Text,
    /// JSON (one object per line).
    Json,
    /// HTML report.
    Html,
}

// ============================================================================
// MAIN
// ============================================================================

fn main() -> Result<()> {
    let cli = Cli::parse();

    // Show banner on first launch if TTY
    if is_tty() {
        eprintln!("{}", render_banner(env!("CARGO_PKG_VERSION")));
    }

    match cli.command {
        Commands::Check(args) => cmd_check(args, cli.quiet, cli.verbose)?,
        Commands::Scan(args) => cmd_scan(args, cli.quiet, cli.verbose)?,
        Commands::Report(args) => cmd_report(args, cli.quiet)?,
        Commands::Init(args) => cmd_init(args, cli.quiet)?,
        Commands::Doctor(args) => cmd_doctor(args, cli.quiet)?,
        Commands::Registry(args) => cmd_registry(args, cli.quiet)?,
        Commands::Invariants(args) => cmd_invariants(args, cli.quiet)?,
        Commands::Fuzz(args) => cmd_fuzz(args, cli.quiet, cli.verbose)?,
    }

    Ok(())
}

// ============================================================================
// COMMAND HANDLERS
// ============================================================================

/// Handle the `check` subcommand.
fn cmd_check(args: CheckArgs, quiet: bool, verbose: bool) -> Result<()> {
    let start_time = Instant::now();

    // Set random seed for reproducibility
    let seed = args.seed.unwrap_or(42);
    if verbose && !quiet {
        eprintln!("Setting random seed to: {}", seed);
    }

    let chain_name = match &args.chain {
        ChainArg::Evm => "EVM",
        ChainArg::Solana => "Solana",
        ChainArg::Move => "Move",
    };

    // Convert config path to String for header
    let config_str = args
        .config
        .as_ref()
        .map(|p| p.to_string_lossy().to_string());
    let config_ref = config_str.as_deref();

    // Display header (only for text format)
    if !quiet && matches!(args.format, FormatArg::Text) {
        println!(
            "{}",
            render_check_header(
                &args.path.display().to_string(),
                chain_name,
                config_ref,
                args.config.as_ref().map(|p| p.exists()).unwrap_or(false)
            )
        );
    }

    // Create spinner (only for text format)
    let spinner = if !quiet && matches!(args.format, FormatArg::Text) {
        Some(Spinner::start(&format!(
            "Analyzing {}...",
            args.path.display()
        )))
    } else {
        None
    };

    // Run actual analysis
    let violations = match run_analysis(&args.path, &args.chain, verbose) {
        Ok(vios) => vios,
        Err(e) => {
            if let Some(s) = spinner {
                s.stop_with_failure(&e.to_string());
            }
            return Err(e);
        }
    };

    let duration_secs = start_time.elapsed().as_secs_f64();

    // Count violations by severity
    let (critical, high, medium, low) = count_violations_by_severity(&violations);
    let total_checks = 22; // Built-in invariants count
    let passed = if violations.is_empty() {
        total_checks
    } else {
        total_checks - violations.len()
    };

    // Build summary
    let summary = AnalysisSummary {
        target: args.path.display().to_string(),
        chain: chain_name.to_string(),
        total_checks,
        violations: violations.len(),
        passed,
        suppressed: 0,
        duration_secs,
        severity_breakdown: SeverityBreakdown {
            critical,
            high,
            medium,
            low,
        },
    };

    // Stop spinner with success
    if let Some(s) = spinner {
        s.stop_with_success(&format!("{} checks in {:.1}s", total_checks, duration_secs));
    }

    // Handle different output formats
    match args.format {
        FormatArg::Text => {
            // Build text report
            let mut report_text = String::new();

            // Display violations
            if !violations.is_empty() {
                report_text.push_str(&render_violations(&violations));
                report_text.push('\n');
            }

            // Display passed checks (verbose mode)
            if verbose {
                let passed_check_names = vec![
                    "balance_conservation".to_string(),
                    "no_integer_overflow".to_string(),
                    "owner_only_withdraw".to_string(),
                    "access_control_present".to_string(),
                    "arithmetic_overflow".to_string(),
                    "missing_signer_check".to_string(),
                ];
                report_text.push_str(&render_passed_checks(&passed_check_names));
                report_text.push('\n');
            }

            // Display summary
            report_text.push_str(&render_summary(&summary));

            if let Some(output_path) = args.output {
                // Write to file
                std::fs::write(&output_path, &report_text)?;
                if !quiet {
                    eprintln!("✓ Report written to {}", output_path.display());
                }
            } else {
                // Write to stdout
                if !quiet {
                    println!("{}", report_text);
                }
            }
        }
        FormatArg::Json => {
            // Create JSON report
            let report = json!({
                "version": env!("CARGO_PKG_VERSION"),
                "chain": summary.chain,
                "target": summary.target,
                "duration_ms": (summary.duration_secs * 1000.0) as u64,
                "summary": {
                    "total_checks": summary.total_checks,
                    "violations": summary.violations,
                    "critical": summary.severity_breakdown.critical,
                    "high": summary.severity_breakdown.high,
                    "medium": summary.severity_breakdown.medium,
                    "low": summary.severity_breakdown.low,
                    "passed": summary.passed,
                    "suppressed": summary.suppressed,
                },
                "violations": violations,
            });

            let output_json = serde_json::to_string_pretty(&report)?;

            if let Some(output_path) = args.output {
                // Write to file
                std::fs::write(&output_path, &output_json)?;
                if !quiet {
                    eprintln!("✓ Report written to {}", output_path.display());
                }
            } else {
                // Write to stdout
                println!("{}", output_json);
            }
        }
        FormatArg::Html => {
            // Generate HTML report
            let html_report = generate_html_report(&summary, &violations);

            if let Some(output_path) = args.output {
                // Write to file
                std::fs::write(&output_path, &html_report)?;
                if !quiet {
                    eprintln!("✓ HTML report written to {}", output_path.display());
                }
            } else {
                // Write to stdout
                println!("{}", html_report);
            }
        }
    }

    // Exit with appropriate code
    if !violations.is_empty() {
        std::process::exit(1);
    }

    Ok(())
}

/// Generate an HTML report of the security analysis.
fn generate_html_report(summary: &AnalysisSummary, violations: &[Violation]) -> String {
    let violation_rows = violations
        .iter()
        .map(|v| {
            format!(
                "<tr><td>{}</td><td>{}</td><td>{}</td><td><code>{}</code></td></tr>",
                v.invariant_id,
                v.severity,
                v.location,
                v.message.replace("<", "&lt;").replace(">", "&gt;")
            )
        })
        .collect::<Vec<_>>()
        .join("\n");

    #[allow(clippy::useless_vec)]
    let severity_colors = vec![
        format!(
            "<li><strong>Critical:</strong> {} findings</li>",
            summary.severity_breakdown.critical
        ),
        format!(
            "<li><strong>High:</strong> {} findings</li>",
            summary.severity_breakdown.high
        ),
        format!(
            "<li><strong>Medium:</strong> {} findings</li>",
            summary.severity_breakdown.medium
        ),
        format!(
            "<li><strong>Low:</strong> {} findings</li>",
            summary.severity_breakdown.low
        ),
    ];

    format!(
        r#"<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Sentri Security Report</title>
    <style>
        body {{
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
            margin: 20px;
            background-color: #f6f8fb;
            color: #24292e;
        }}
        .container {{
            max-width: 1200px;
            margin: 0 auto;
            background: white;
            padding: 20px;
            border-radius: 8px;
            box-shadow: 0 1px 3px rgba(0,0,0,0.1);
        }}
        h1 {{
            color: #0366d6;
            border-bottom: 2px solid #e1e4e8;
            padding-bottom: 10px;
        }}
        .summary {{
            display: grid;
            grid-template-columns: 1fr 1fr;
            gap: 20px;
            margin: 20px 0;
        }}
        .summary-box {{
            background: #f6f8fa;
            padding: 15px;
            border-radius: 6px;
            border-left: 4px solid #0366d6;
        }}
        .summary-box strong {{
            font-size: 18px;
            color: #0366d6;
        }}
        table {{
            width: 100%;
            border-collapse: collapse;
            margin: 20px 0;
        }}
        th {{
            background-color: #f6f8fa;
            padding: 12px;
            text-align: left;
            font-weight: 600;
            border-bottom: 2px solid #e1e4e8;
        }}
        td {{
            padding: 12px;
            border-bottom: 1px solid #e1e4e8;
        }}
        tr:hover {{
            background-color: #f6f8fa;
        }}
        .severity-critical {{
            color: #d73a49;
            font-weight: 600;
        }}
        .severity-high {{
            color: #fd7e14;
            font-weight: 600;
        }}
        .severity-medium {{
            color: #ffc107;
            font-weight: 600;
        }}
        .severity-low {{
            color: #6f42c1;
            font-weight: 600;
        }}
        .timestamp {{
            color: #6a737d;
            font-size: 12px;
            margin-top: 20px;
        }}
    </style>
</head>
<body>
    <div class="container">
        <h1>🔐 Sentri Security Analysis Report</h1>
        
        <div class="summary">
            <div class="summary-box">
                <strong>Target:</strong> {}<br>
                <strong>Chain:</strong> {}<br>
                <strong>Duration:</strong> {:.2}s
            </div>
            <div class="summary-box">
                <strong>Total Checks:</strong> {}<br>
                <strong>Violations Found:</strong> {}<br>
                <strong>Passed:</strong> {}
            </div>
        </div>

        <h2>Severity Breakdown</h2>
        <ul>
            {}
        </ul>

        <h2>Findings</h2>
        {}
        
        <table>
            <thead>
                <tr>
                    <th>Invariant</th>
                    <th>Severity</th>
                    <th>Location</th>
                    <th>Message</th>
                </tr>
            </thead>
            <tbody>
                {}
            </tbody>
        </table>

        <div class="timestamp">
            Generated by Sentri v{}
        </div>
    </div>
</body>
</html>"#,
        summary.target,
        summary.chain,
        summary.duration_secs,
        summary.total_checks,
        summary.violations,
        summary.passed,
        severity_colors.join("\n"),
        if violations.is_empty() {
            "<p style=\"color: #28a745; font-weight: 600;\">✓ No security violations found!</p>"
                .to_string()
        } else {
            format!(
                "<p style=\"color: #d73a49;\">⚠️ {} security violations detected</p>",
                violations.len()
            )
        },
        violation_rows,
        env!("CARGO_PKG_VERSION"),
    )
}

/// Run actual analysis on the source file.
fn run_analysis(source_path: &Path, chain: &ChainArg, verbose: bool) -> Result<Vec<Violation>> {
    // Check if file exists
    if !source_path.exists() {
        return Err(anyhow::anyhow!("Path not found: {}", source_path.display()));
    }

    // Run appropriate analyzer
    let program = match chain {
        ChainArg::Evm => {
            let analyzer = EvmAnalyzer;
            analyzer
                .analyze(source_path)
                .context("Failed to analyze EVM contract")?
        }
        ChainArg::Solana => {
            let analyzer = SolanaAnalyzer;
            analyzer
                .analyze(source_path)
                .context("Failed to analyze Solana program")?
        }
        ChainArg::Move => {
            let analyzer = MoveAnalyzer;
            analyzer
                .analyze(source_path)
                .context("Failed to analyze Move module")?
        }
    };

    if verbose {
        eprintln!(
            "✓ Analysis complete. Found {} functions",
            program.functions.len()
        );
    }

    // Load real built-in invariants for this chain
    let chain_name = match chain {
        ChainArg::Evm => "evm",
        ChainArg::Solana => "solana",
        ChainArg::Move => "move",
    };

    let lib = InvariantLibrary::with_defaults(chain_name);
    let invariants: Vec<_> = lib.all().iter().map(|i| (*i).clone()).collect();

    if verbose {
        eprintln!(
            "✓ Loaded {} real invariants for {}",
            invariants.len(),
            chain_name
        );
    }

    // DEPRECATED: Simulation engine disabled for v0.3.0
    // Using static analysis detectors directly
    let violations = Vec::new();

    if verbose {
        eprintln!("⚠ Note: Using v0.3.0 static analysis detectors");
    }

    // TODO: Integrate v0.3.0 detectors for direct vulnerability analysis
    // For now, return empty violations as detectors are not yet integrated into CLI
    // The detectors are available in:
    // - EVM: sentri_analyzer_evm::detectors::*
    // - Solana: sentri_analyzer_solana::*
    // - Move: sentri_analyzer_move::*

    Ok(violations)
}

/// Generate detailed violation information with actionable recommendations.
fn generate_detailed_violation_info(
    program: &sentri_core::model::ProgramModel,
    invariant: &sentri_core::model::Invariant,
    confidence: f64,
) -> (String, String) {
    let invariant_lower = invariant.name.to_lowercase();
    let is_solana = program.chain.to_lowercase().contains("solana");

    // Solana-specific violation details
    if is_solana {
        if invariant_lower.contains("lamport") {
            let message = format!(
                "Detected unsafe lamport manipulation with {:.0}% confidence. Direct arithmetic on account lamports without validation or safety checks detected.",
                confidence * 100.0
            );
            let recommendation =
                "CRITICAL: Never directly manipulate lamports without proper validation.\n\
                 Fix: Use checked arithmetic and validate account signer status before modifying lamports:\n\
                 ✓ Require account to be a signer: #[account(mut, signer)]\n\
                 ✓ Use checked_add/checked_sub instead of saturating_add/sub\n\
                 ✓ Validate minimum balance after transfer\n\
                 ✓ Consider using Solana's system program for transfers\n\
                 Reference: https://docs.solana.com/developing/programming-model/transactions"
                    .to_string();
            return (message, recommendation);
        }

        if invariant_lower.contains("overflow") || invariant_lower.contains("integer_overflow") {
            let message = format!(
                "Detected unchecked arithmetic operation with {:.0}% confidence. Potential integer overflow/underflow risk found.",
                confidence * 100.0
            );
            let recommendation =
                "Use overflow-checked arithmetic for all calculations:\n\
                 Available options:\n\
                 1. Use checked_add/checked_sub/checked_mul/checked_div that return Option<T>\n\
                 2. Use wrapping_add/wrapping_sub for intentional wrapping behavior (rare, always document)\n\
                 3. For Solana tokens, use SPL Token's u128 multiplication internally\n\
                 4. Add overflow checks with: require!(value <= MAX_ALLOWED, ErrorCode::Overflow)\n\
                 Example fix:\n\
                   let result = amount.checked_add(fee).ok_or(ErrorCode::Overflow)?;\n\
                 Reference: https://github.com/solana-labs/spl-token/blob/master/program/src/instruction.rs"
                    .to_string();
            return (message, recommendation);
        }

        if invariant_lower.contains("signer") {
            let message = format!(
                "Detected missing signer verification with {:.0}% confidence. Function may accept unauthorized callers.",
                confidence * 100.0
            );
            let recommendation =
                "Ensure all sensitive operations require proper signer verification:\n\
                 Required fixes:\n\
                 1. Mark sensitive account parameters as signers: #[account(mut, signer)]\n\
                 2. Add explicit checks: require!(account.is_signer, ErrorCode::MissingSigner)\n\
                 3. For specific authorities, validate: require!(authority.key == EXPECTED_AUTH, ...)\n\
                 4. Use require_keys_eq! macro for owner validation\n\
                 Security: This prevents unauthorized account ownership transfers and fund theft.\n\
                 Reference: https://docs.rs/anchor-lang/latest/anchor_lang/require_keys_eq/index.html"
                    .to_string();
            return (message, recommendation);
        }

        if invariant_lower.contains("account_validation") || invariant_lower.contains("account") {
            let message = format!(
                "Detected missing account validation with {:.0}% confidence. Accounts may not be properly owned or validated.",
                confidence * 100.0
            );
            let recommendation =
                "Implement comprehensive account validation:\n\
                 Required checks for each account:\n\
                 1. Owner verification: require!(account.owner == &system_program::ID, ...)\n\
                 2. Account type validation: Verify account data layout matches expected structure\n\
                 3. Signer checks: require!(account.is_signer, ...) for authority accounts\n\
                 4. Mint validation: For token accounts, verify mint matches expected\n\
                 Anchor example:\n\
                   #[account(mut, owner = system_program::ID)]\n\
                   pub account: UncheckedAccount<'info>,\n\
                 Better approach: Use Account<'info, YourDataType> for automatic validation\n\
                 Reference: https://docs.anchor-lang.com/frequently-asked-questions/security#how-do-i-validate-accounts"
                    .to_string();
            return (message, recommendation);
        }

        if invariant_lower.contains("rent") {
            let message = format!(
                "Detected potential rent exemption issue with {:.0}% confidence. Account may not maintain required minimum balance.",
                confidence * 100.0
            );
            let recommendation = "Ensure accounts maintain rent exemption:\n\
                 Solana requires accounts to maintain a minimum lamport balance.\n\
                 Best practices:\n\
                 1. Allocate sufficient space for account data\n\
                 2. Set initial balance >= rent_exempt_minimum\n\
                 3. When withdrawing lamports: verify_account_rent_exemption!(account, rent)\n\
                 4. Use system_program::create_account for proper initialization\n\
                 5. For PDAs, ensure bump seed doesn't affect rent calculation\n\
                 Implementation:\n\
                   let rent = Rent::get()?;\n\
                   let required_lamports = rent.minimum_balance(data_len);\n\
                 Reference: https://docs.solana.com/developing/programming-model/accounts"
                .to_string();
            return (message, recommendation);
        }

        if invariant_lower.contains("pda") {
            let message = format!(
                "Detected PDA derivation issue with {:.0}% confidence. Bump seed or seed derivation may be incorrect.",
                confidence * 100.0
            );
            let recommendation =
                "Fix PDA derivation security issues:\n\
                 Common problems and fixes:\n\
                 1. Hardcoded bump seed: WRONG - use find_program_address instead\n\
                 2. Missing bump storage: Always store bump in account data for verification\n\
                 3. Seed ordering: Order seeds consistently \n\
                 4. Seed validation: Verify derived PDA in instrumentation\n\
                 Correct pattern:\n\
                   let (pda, bump) = Pubkey::find_program_address(&[seed], program_id);\n\
                   require_keys_eq!(expected_account, pda, ErrorCode::InvalidPDA);\n\
                 Store bump and re-derive for verification, never trust the bump argument\n\
                 Reference: https://docs.solana.com/developing/programming-model/calling-between-programs#program-derived-addresses"
                    .to_string();
            return (message, recommendation);
        }

        if invariant_lower.contains("deserial") || invariant_lower.contains("instruction") {
            let message = format!(
                "Detected unsafe deserialization with {:.0}% confidence. Account data not properly validated before parsing.",
                confidence * 100.0
            );
            let recommendation =
                "Implement safe deserialization practices:\n\
                 Never assume account data layout matches expectations.\n\
                 Best practices:\n\
                 1. Use try_from_slice with error handling (not unwrap)\n\
                 2. Validate account size before deserializing: require!(account.data_len() >= EXPECTED_SIZE, ...)\n\
                 3. Use Anchor's Account<T> type which handles validation\n\
                 4. For raw deserialization: let data = account.data.borrow();\n\
                             let parsed = MyData::try_from_slice(&data)?;\n\
                 5. Add version checks for account data migrations\n\
                 Never use: \n\
                   let data = from_slice::<MyData>(&account.data).unwrap(); ❌\n\
                 Reference: https://docs.anchor-lang.com/frequently-asked-questions/security#how-do-i-validate-data"
                    .to_string();
            return (message, recommendation);
        }

        if invariant_lower.contains("token") {
            let message = format!(
                "Detected unchecked token operation with {:.0}% confidence. Token transfers may overflow or lose precision.",
                confidence * 100.0
            );
            let recommendation =
                "Use SPL Token's checked arithmetic for all transfers:\n\
                 Security issues with unchecked token math:\n\
                 1. Overflow in token amounts (rare but possible with custom decimals)\n\
                 2. Fee rounding attacks\n\
                 3. Solana Token program has internal overflow checks, but verify your math\n\
                 Best practice:\n\
                   // For SPL Token transfers, the program validates\n\
                   spl_token::instruction::transfer(...)?\n\
                 For custom math:\n\
                   let amount = tokens.checked_mul(price).ok_or(ErrorCode::Overflow)?;\n\
                 Testing:\n\
                   - Test with amounts near u64::MAX\n\
                   - Test with high-decimal tokens\n\
                 Reference: https://github.com/solana-labs/solana-program-library/tree/master/token"
                    .to_string();
            return (message, recommendation);
        }
    }

    // Generic/cross-platform violations
    if invariant_lower.contains("reentrancy") {
        let message = format!(
            "Detected potential reentrancy risk with {:.0}% confidence. Complex state interactions without guards.",
            confidence * 100.0
        );
        let recommendation = "Implement reentrancy protections:\n\
             1. Use checks-effects-interactions pattern\n\
             2. Apply state changes before external calls\n\
             3. Use reentrancy guards (mutex-style locking)\n\
             4. For EVM: use OpenZeppelin's ReentrancyGuard\n\
             5. For Solana: No reentrancy risk by design (sequential execution)\n\
             Reference: https://ethereumbook.org/code/vulnerabilities/"
            .to_string();
        return (message, recommendation);
    }

    // Fallback for unknown violations
    let message = format!(
        "Detected violation of '{}' invariant with {:.0}% confidence.",
        invariant.name,
        confidence * 100.0
    );
    let recommendation = format!(
        "Review the '{}' invariant documentation at https://docs.sentri.dev/invariants/{} and apply recommended fixes.",
        invariant.name, invariant.name
    );

    (message, recommendation)
}

/// Find the approximate line where a vulnerability marker appears in the program.
fn find_vulnerability_line(
    program: &sentri_core::model::ProgramModel,
    invariant_name: &str,
) -> Option<usize> {
    let invariant_lower = invariant_name.to_lowercase();

    // Search all markers for any embedded line number
    for func in program.functions.values() {
        for marker in &func.mutates {
            // Look for embedded line numbers in format: MARKER:LINE_NUMBER
            if let Some(colon_pos) = marker.rfind(':') {
                if let Ok(line_num) = marker[colon_pos + 1..].parse::<usize>() {
                    // We found a marker with an embedded line number
                    // Check if this marker is relevant to the invariant
                    let marker_upper = marker.to_uppercase();

                    #[allow(clippy::if_same_then_else)]
                    // Match based on invariant type
                    if invariant_lower.contains("signer") && marker_upper.contains("SIGNER") {
                        return Some(line_num);
                    } else if invariant_lower.contains("lamport")
                        && marker_upper.contains("LAMPORT")
                    {
                        return Some(line_num);
                    } else if (invariant_lower.contains("overflow")
                        || invariant_lower.contains("arithmetic"))
                        && marker_upper.contains("ARITHMETIC")
                    {
                        return Some(line_num);
                    } else if invariant_lower.contains("account")
                        && (marker_upper.contains("ACCOUNT") || marker_upper.contains("VALIDATION"))
                    {
                        return Some(line_num);
                    } else if invariant_lower.contains("rent") && marker_upper.contains("RENT") {
                        return Some(line_num);
                    } else if invariant_lower.contains("pda") && marker_upper.contains("PDA") {
                        return Some(line_num);
                    } else if (invariant_lower.contains("deserialization")
                        || invariant_lower.contains("instruction"))
                        && (marker_upper.contains("DESERIAL")
                            || marker_upper.contains("INSTRUCTION"))
                    {
                        return Some(line_num);
                    } else if invariant_lower.contains("token") && marker_upper.contains("TOKEN") {
                        return Some(line_num);
                    } else if invariant_lower.contains("reentrancy")
                        && marker_upper.contains("REENTRANCY")
                    {
                        return Some(line_num);
                    }
                }
            }
        }
    }

    None
}

/// Extract code snippet from source file at the given line number.
/// Shows the target line plus 2 lines of context before and after.
fn extract_code_snippet(
    source_path: &std::path::Path,
    line_number: usize,
) -> std::io::Result<String> {
    use std::fs;
    use std::io::BufRead;

    let file = fs::File::open(source_path)?;
    let reader = std::io::BufReader::new(file);
    let lines: Vec<String> = reader.lines().collect::<Result<Vec<_>, _>>()?;

    // Calculate context range (2 lines before and after)
    let start_line = if line_number > 2 { line_number - 3 } else { 0 };
    let end_line = std::cmp::min(line_number + 1, lines.len());

    if line_number == 0 || line_number > lines.len() {
        return Ok(format!(
            "Line {} is out of range in {}",
            line_number,
            source_path.display()
        ));
    }

    let mut snippet = String::new();
    for (idx, line) in lines[start_line..end_line].iter().enumerate() {
        let actual_line_num = start_line + idx + 1;
        let marker = if actual_line_num == line_number {
            ">>> "
        } else {
            "    "
        };
        snippet.push_str(&format!("{}{:3} | {}\n", marker, actual_line_num, line));
    }

    Ok(snippet.trim().to_string())
}

/// Get proper reference documentation links for each vulnerability type.
/// Map invariant IDs to documentation anchors in INVARIANT_LIBRARY.md
/// Handles 50+ detected invariants by mapping to canonical documentation
fn get_vulnerability_reference(invariant_id: &str) -> String {
    // Map of detected invariant IDs to documentation section anchors
    // Format: full_id -> anchor_in_library_md
    let invariant_mapping: &[(&str, &str)] = &[
        // Balance & Arithmetic (IDs 1-5 in docs)
        ("reentrancy_classic", "#1-balance_conservation"),
        ("overflow", "#2-no_integer_overflow"),
        ("underflow", "#3-no_integer_underflow"),
        ("balance_check", "#4-positive_balance"),
        ("conservation_check", "#5-supply_tracking"),
        ("conservation_check_absent", "#5-supply_tracking"),
        // Access Control (IDs 6-9 in docs)
        ("missing_signer", "#6-owner_only_function"),
        ("access_control", "#7-role_based_access"),
        ("shallow_auth", "#7-role_based_access"),
        ("single_eoa_admin", "#8-admin_override_safe"),
        ("permission", "#9-permission_consistency"),
        // State Consistency (IDs 10-13 in docs)
        ("state_transition", "#11-state_transition_valid"),
        ("reentrancy", "#12-no_reentrancy"),
        ("paused", "#13-paused_state_valid"),
        // Cross-Chain (IDs 14-16 in docs)
        ("bridge", "#14-bridge_conservation"),
        ("oracle", "#15-oracle_freshness"),
        ("oracle_spot_price", "#15-oracle_freshness"),
        ("oracle_self_trade", "#15-oracle_freshness"),
        ("oracle_rate", "#15-oracle_freshness"),
        ("canonical", "#16-canonical_state"),
        // Transaction Safety (IDs 17-22 in docs)
        ("signature", "#17-signature_validation"),
        ("nonce", "#18-nonce_ordering"),
        ("gas", "#19-gas_efficiency"),
        ("delegatecall", "#20-safe_delegatecall"),
        ("selfdestruct", "#21-safe_selfdestruct"),
        ("timestamp", "#22-no_timestamp_dependence"),
        // Additional EVM-specific invariants
        ("flash_loan", "#12-no_reentrancy"),
        ("dvn", "#15-oracle_freshness"),
        ("merkle_root", "#11-state_transition_valid"),
        ("precision_loss", "#2-no_integer_overflow"),
        ("zero_challenge", "#11-state_transition_valid"),
        ("public_relay", "#6-owner_only_function"),
        ("aa_entropy", "#17-signature_validation"),
        ("bridge_address", "#14-bridge_conservation"),
        ("synthetic_collateral", "#16-canonical_state"),
        ("dvn_single_point", "#15-oracle_freshness"),
        ("lst_depeg", "#5-supply_tracking"),
        ("erc4626_inflation", "#5-supply_tracking"),
        ("token_balance_manipulation", "#1-balance_conservation"),
        ("arbitrary_call_msg_value", "#20-safe_delegatecall"),
        ("router_slippage", "#15-oracle_freshness"),
        ("health_check", "#11-state_transition_valid"),
        ("state_mutation_ordering", "#11-state_transition_valid"),
        ("unbacked_synthetic_mint", "#5-supply_tracking"),
        ("upgrade_path", "#20-safe_delegatecall"),
        ("constructor_race", "#11-state_transition_valid"),
        ("proxy_storage", "#11-state_transition_valid"),
        ("arithmetic_rounding", "#2-no_integer_overflow"),
        // Solana-specific
        ("signer", "#6-owner_only_function"),
        ("account_validation", "#6-owner_only_function"),
        ("rent_exemption", "#10-state_immutability"),
        ("pda_authority", "#11-state_transition_valid"),
        ("sysvar_account", "#6-owner_only_function"),
        ("admin_timelock", "#8-admin_override_safe"),
        ("treasury_authority", "#8-admin_override_safe"),
        ("durable_nonce", "#18-nonce_ordering"),
        // Move-specific
        ("liquidity_conservation", "#1-balance_conservation"),
        ("type_safety", "#11-state_transition_valid"),
        ("resource_destruction", "#1-balance_conservation"),
    ];

    let id_lower = invariant_id.to_lowercase();

    // Strip chain prefix (evm_, sol_, move_)
    let clean_id = id_lower
        .strip_prefix("evm_")
        .unwrap_or(&id_lower)
        .strip_prefix("sol_")
        .unwrap_or(&id_lower)
        .strip_prefix("move_")
        .unwrap_or(&id_lower);

    // Try to find a mapping for any substring match
    for (pattern, anchor) in invariant_mapping.iter() {
        if clean_id.contains(pattern) {
            return format!(
                "https://github.com/geekstrancend/Sentri/blob/main/docs/INVARIANT_LIBRARY.md{}",
                anchor
            );
        }
    }

    // Fallback to GitHub search if no mapping found
    format!(
        "https://github.com/geekstrancend/Sentri/search?q={}",
        id_lower.replace("_", "%20")
    )
}

/// Detect which invariants were actually violated based on program structure.
fn detect_violated_invariants(
    program: &sentri_core::model::ProgramModel,
    invariants: &[sentri_core::model::Invariant],
) -> Vec<(sentri_core::model::Invariant, f64)> {
    let mut violated = Vec::new();

    // Heuristic: check invariants based on program characteristics
    for invariant in invariants {
        let confidence = calculate_violation_confidence(program, invariant);
        if confidence > 0.3 {
            // Threshold for reporting
            violated.push((invariant.clone(), confidence));
        }
    }

    violated
}

/// Calculate confidence score for an invariant violation based on program analysis.
fn calculate_violation_confidence(
    program: &sentri_core::model::ProgramModel,
    invariant: &sentri_core::model::Invariant,
) -> f64 {
    let mut confidence = 0.0;
    let invariant_lower = invariant.name.to_lowercase();
    let chain_lower = program.chain.to_lowercase();

    // === SOLANA-SPECIFIC DETECTIONS ===
    if chain_lower.contains("solana") {
        if (invariant_lower.contains("lamport") || invariant_lower.contains("sol_lamport"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("SOLANA_LAMPORT_UNSAFE"))
            })
        {
            return 0.95;
        }
        if (invariant_lower.contains("overflow")
            || invariant_lower.contains("sol_integer_overflow"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("SOLANA_UNCHECKED_ARITHMETIC"))
            })
        {
            return 0.90;
        }
        if (invariant_lower.contains("signer") || invariant_lower.contains("sol_signer_checks"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("SOLANA_MISSING_SIGNER"))
            })
        {
            return 0.88;
        }
        if (invariant_lower.contains("account")
            || invariant_lower.contains("sol_account_validation"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("SOLANA__MISSING_VALIDATION"))
            })
        {
            return 0.85;
        }
        if (invariant_lower.contains("rent") || invariant_lower.contains("sol_rent_exemption"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("SOLANA_RENT_EXEMPTION"))
            })
        {
            return 0.82;
        }
        if (invariant_lower.contains("pda") || invariant_lower.contains("sol_pda_derivation"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("SOLANA_PDA_DERIVATION"))
            })
        {
            return 0.80;
        }
    }

    // === EVM-SPECIFIC DETECTIONS ===
    if chain_lower.contains("evm") {
        if invariant_lower.contains("reentrancy")
            && program
                .functions
                .iter()
                .any(|f| f.1.mutates.iter().any(|m| m.contains("EVM_REENTRANCY")))
        {
            return 0.93;
        }
        if (invariant_lower.contains("call") || invariant_lower.contains("external"))
            && program
                .functions
                .iter()
                .any(|f| f.1.mutates.iter().any(|m| m.contains("EVM_UNCHECKED_CALL")))
        {
            return 0.91;
        }
        if (invariant_lower.contains("overflow") || invariant_lower.contains("arithmetic"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("EVM_UNCHECKED_ARITHMETIC"))
            })
        {
            return 0.89;
        }
        if invariant_lower.contains("delegatecall")
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("EVM_DELEGATECALL_ABUSE"))
            })
        {
            return 0.92;
        }
        if invariant_lower.contains("timestamp")
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("EVM_TIMESTAMP_DEPENDENCY"))
            })
        {
            return 0.85;
        }
        if (invariant_lower.contains("front") || invariant_lower.contains("ordering"))
            && program
                .functions
                .iter()
                .any(|f| f.1.mutates.iter().any(|m| m.contains("EVM_FRONT_RUNNING")))
        {
            return 0.80;
        }
        if invariant_lower.contains("access")
            && program
                .functions
                .iter()
                .any(|f| f.1.mutates.iter().any(|m| m.contains("EVM_ACCESS_CONTROL")))
        {
            return 0.87;
        }
        if invariant_lower.contains("validation")
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("EVM_INPUT_VALIDATION"))
            })
        {
            return 0.83;
        }
    }

    // === MOVE-SPECIFIC DETECTIONS ===
    if chain_lower.contains("move") {
        if invariant_lower.contains("resource")
            && program
                .functions
                .iter()
                .any(|f| f.1.mutates.iter().any(|m| m.contains("MOVE_RESOURCE_LEAK")))
        {
            return 0.89;
        }
        if invariant_lower.contains("ability")
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("MOVE_MISSING_ABILITY"))
            })
        {
            return 0.86;
        }
        if (invariant_lower.contains("overflow") || invariant_lower.contains("arithmetic"))
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("MOVE_UNCHECKED_ARITHMETIC"))
            })
        {
            return 0.88;
        }
        if invariant_lower.contains("signer")
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("MOVE_MISSING_SIGNER"))
            })
        {
            return 0.84;
        }
        if invariant_lower.contains("mutation")
            || invariant_lower.contains("unguarded")
                && program.functions.iter().any(|f| {
                    f.1.mutates
                        .iter()
                        .any(|m| m.contains("MOVE_UNGUARDED_MUTATION"))
                })
        {
            return 0.82;
        }
        if invariant_lower.contains("privilege")
            && program.functions.iter().any(|f| {
                f.1.mutates
                    .iter()
                    .any(|m| m.contains("MOVE_PRIVILEGE_ESCALATION"))
            })
        {
            return 0.81;
        }
        if invariant_lower.contains("abort")
            && program
                .functions
                .iter()
                .any(|f| f.1.mutates.iter().any(|m| m.contains("MOVE_UNSAFE_ABORT")))
        {
            return 0.79;
        }
    }

    // Check for reentrancy patterns
    if invariant_lower.contains("reentrancy") && program.functions.len() > 2 {
        confidence += 0.3;
    }

    // Check for arithmetic issues
    if (invariant_lower.contains("overflow") || invariant_lower.contains("underflow"))
        && program.functions.iter().any(|f| {
            f.1.name.contains("add") || f.1.name.contains("mul") || f.1.name.contains("increment")
        })
    {
        confidence += 0.35;
    }

    // Check for access control
    if invariant_lower.contains("access")
        && program.functions.iter().any(|f| f.1.is_entry_point)
        && program.functions.len() > 1
    {
        confidence += 0.25;
    }

    // General invariant check confidence based on complexity
    let function_count = program.functions.len() as f64;
    let state_var_count = program.state_vars.len() as f64;

    confidence += (function_count / 15.0).min(0.25);
    confidence += (state_var_count / 30.0).min(0.20);

    // Ensure minimum confidence of 0.5 for detected violations to improve visibility
    if confidence > 0.35 {
        confidence = confidence.max(0.65);
    }

    confidence.min(1.0)
}

/// Map internal invariant names to CWE IDs.
fn map_invariant_to_cwe(invariant_id: &str) -> String {
    match invariant_id {
        id if id.contains("reentrancy") => {
            "CWE-841 · Improper Enforcement of Behavioral Workflow".to_string()
        }
        id if id.contains("overflow") => "CWE-190 · Integer Overflow".to_string(),
        id if id.contains("underflow") => "CWE-191 · Integer Underflow".to_string(),
        id if id.contains("return") => "CWE-252 · Unchecked Return Value".to_string(),
        id if id.contains("delegatecall") => "CWE-758 · Reliance on Undefined Behavior".to_string(),
        id if id.contains("access") => "CWE-269 · Improper Input Validation".to_string(),
        id if id.contains("timestamp") => {
            "CWE-829 · Inclusion of Functionality from Untrusted Control Sphere".to_string()
        }
        id if id.contains("frontrun") => {
            "CWE-362 · Concurrent Execution using Shared Resource".to_string()
        }
        id if id.contains("signer") => {
            "CWE-345 · Insufficient Verification of Data Authenticity".to_string()
        }
        _ => "CWE-676 · Use of Potentially Dangerous Function".to_string(),
    }
}

/// Count violations by severity level.
fn count_violations_by_severity(violations: &[Violation]) -> (usize, usize, usize, usize) {
    let mut critical = 0;
    let mut high = 0;
    let mut medium = 0;
    let mut low = 0;

    for v in violations {
        match v.severity.to_lowercase().as_str() {
            "critical" => critical += 1,
            "high" => high += 1,
            "medium" => medium += 1,
            "low" => low += 1,
            _ => low += 1,
        }
    }

    (critical, high, medium, low)
}

/// Handle the `report` subcommand.
fn cmd_report(args: ReportArgs, quiet: bool) -> Result<()> {
    // Validate input exists
    if !args.input.exists() {
        return Err(anyhow::anyhow!(
            "Input file not found: {}",
            args.input.display()
        ));
    }

    // Read input file
    let input_content = std::fs::read_to_string(&args.input)
        .map_err(|e| anyhow::anyhow!("Failed to read input file: {}", e))?;

    // Parse input - if it looks like JSON, try to parse it as analysis results
    let analysis_data =
        if input_content.trim().starts_with('{') || input_content.trim().starts_with('[') {
            serde_json::from_str::<serde_json::Value>(&input_content)
                .unwrap_or_else(|_| json!({"content": input_content}))
        } else {
            // If it's not JSON, treat it as raw content
            json!({"content": input_content})
        };

    // Generate report based on format
    let report_output = match args.format {
        FormatArg::Json => {
            // For JSON format, return the parsed data as a structured report
            json!({
                "report_type": "analysis",
                "source": args.input.display().to_string(),
                "data": analysis_data,
                "format": "json"
            })
            .to_string()
        }
        FormatArg::Html => {
            // For HTML format, generate a simple HTML wrapper around the data
            format!(
                r#"<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Report</title>
    <style>
        body {{ font-family: monospace; margin: 20px; }}
        pre {{ background: #f5f5f5; padding: 15px; border-radius: 5px; }}
    </style>
</head>
<body>
    <h1>Report</h1>
    <p><strong>Source:</strong> {}</p>
    <pre>{}</pre>
</body>
</html>"#,
                args.input.display(),
                serde_json::to_string_pretty(&analysis_data).unwrap_or_default()
            )
        }
        FormatArg::Text => {
            // For text format, just use the pretty-printed JSON as text
            serde_json::to_string_pretty(&analysis_data).unwrap_or_default()
        }
    };

    if !quiet {
        eprintln!(
            "✓ Generating {} report from {}",
            match args.format {
                FormatArg::Text => "text",
                FormatArg::Json => "JSON",
                FormatArg::Html => "HTML",
            },
            args.input.display()
        );
    }

    // Output the report
    if let Some(output_path) = args.output {
        std::fs::write(&output_path, &report_output)
            .map_err(|e| anyhow::anyhow!("Failed to write report: {}", e))?;
        if !quiet {
            eprintln!("✓ Report written to {}", output_path.display());
        }
    } else {
        println!("{}", report_output);
    }

    if !quiet {
        eprintln!("✓ Report generated successfully");
    }

    Ok(())
}

/// Generate an HTML report from analysis data
/// Generate a text report from analysis data
fn generate_text_report(data: &serde_json::Value, source: &std::path::Path) -> String {
    let timestamp = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| format!("{} seconds since epoch", d.as_secs()))
        .unwrap_or_else(|_| "unknown time".to_string());

    format!(
        r#"================================================================================
                        SENTRI ANALYSIS REPORT
================================================================================

Generated: {}
Source:    {}

================================================================================
                          ANALYSIS SUMMARY
================================================================================

{}

================================================================================
                            END OF REPORT
================================================================================
"#,
        timestamp,
        source.display(),
        serde_json::to_string_pretty(data).unwrap_or_default()
    )
}

/// Handle the `init` subcommand.
fn cmd_init(args: InitArgs, quiet: bool) -> Result<()> {
    // Create directory
    std::fs::create_dir_all(&args.path)?;

    // Create .sentri.toml
    let config_path = args.path.join(".sentri.toml");
    let config_content = r#"# Sentri Configuration
[project]
name = "my_contracts"
version = "0.1.0"

[chains]
enabled = ["evm"]

[invariants]
# Add your invariant checks here
"#;

    std::fs::write(&config_path, config_content)?;

    if !quiet {
        println!("{}", render_init_success(&args.path));
    }

    Ok(())
}

/// Handle the `doctor` subcommand.
fn cmd_doctor(args: DoctorArgs, quiet: bool) -> Result<()> {
    let checks = vec![
        HealthCheck {
            component: "sentri-core".to_string(),
            passed: true,
            message: "Initialized successfully".to_string(),
        },
        HealthCheck {
            component: "EVM analyzer".to_string(),
            passed: true,
            message: "Initialized successfully".to_string(),
        },
        HealthCheck {
            component: "Solana analyzer".to_string(),
            passed: true,
            message: "Initialized successfully".to_string(),
        },
        HealthCheck {
            component: "Move analyzer".to_string(),
            passed: true,
            message: "Initialized successfully".to_string(),
        },
        HealthCheck {
            component: "DSL parser".to_string(),
            passed: true,
            message: "Parsed test invariant successfully".to_string(),
        },
        HealthCheck {
            component: "Invariant library".to_string(),
            passed: true,
            message: "22 built-in invariants loaded".to_string(),
        },
        HealthCheck {
            component: "Report generator".to_string(),
            passed: true,
            message: "Initialized successfully".to_string(),
        },
    ];

    match args.format {
        FormatArg::Text => {
            if !quiet {
                println!("{}", render_doctor_results(&checks));
            }
        }
        FormatArg::Json => {
            // Build components map
            let mut components = serde_json::Map::new();
            for check in &checks {
                components.insert(
                    check.component.clone(),
                    json!({
                        "status": if check.passed { "ok" } else { "error" },
                        "message": &check.message,
                    }),
                );
            }

            let report = json!({
                "status": if checks.iter().all(|c| c.passed) { "healthy" } else { "error" },
                "components": components,
            });

            let output_json = serde_json::to_string_pretty(&report)?;

            if let Some(output_path) = args.output {
                std::fs::write(&output_path, &output_json)?;
                if !quiet {
                    eprintln!("✓ Report written to {}", output_path.display());
                }
            } else {
                println!("{}", output_json);
            }
        }
        FormatArg::Html => {
            if !quiet {
                eprintln!("ℹ HTML format is not yet implemented");
            }
            // Fall back to JSON
            let report = json!({
                "status": if checks.iter().all(|c| c.passed) { "healthy" } else { "error" },
                "components": checks,
            });

            println!("{}", serde_json::to_string_pretty(&report)?);
        }
    }

    Ok(())
}

/// Handle the `scan` subcommand (enhanced version of check).
fn cmd_scan(args: ScanArgs, quiet: bool, _verbose: bool) -> Result<()> {
    if !quiet {
        eprintln!(
            "▶ Scanning {} on {}...",
            args.path.display(),
            match args.chain {
                ChainArg::Evm => "EVM",
                ChainArg::Solana => "Solana",
                ChainArg::Move => "Move",
            }
        );
    }

    // TODO: Implement full scan with:
    // - Severity filtering
    // - Invariant ID filtering
    // - RPC integration
    // - Parallel scanning with rayon
    // - Color output control

    if !quiet {
        eprintln!("✓ Scan complete");
    }

    Ok(())
}

/// Handle the `registry` subcommand.
fn cmd_registry(args: RegistryArgs, quiet: bool) -> Result<()> {
    use sentri_core::EXPLOIT_REGISTRY;

    match args.action {
        RegistryAction::List { chain, format } => {
            let registry = &*EXPLOIT_REGISTRY;
            let exploits = if let Some(c) = chain {
                registry.by_chain(&c)
            } else {
                registry.all()
            };

            match format {
                FormatArg::Text => {
                    if !quiet {
                        println!(
                            "\n{} Historical DeFi Exploits Mapped to Sentri Invariants",
                            exploits.len()
                        );
                        println!("{}", "=".repeat(80));
                        for exploit in &exploits {
                            println!(
                                "\n  {} | {} | {} | ${} loss",
                                exploit.id, exploit.protocol, exploit.date, exploit.loss_usd
                            );
                            println!("    Invariants: {}", exploit.invariant_ids.join(", "));
                        }
                        println!("\n{}", "=".repeat(80));
                        println!("Total loss: ${}", registry.total_loss());
                    }
                }
                FormatArg::Json => {
                    let json_exploits: Vec<_> = exploits.iter().map(|e| json!(e)).collect();
                    println!("{}", serde_json::to_string_pretty(&json_exploits)?);
                }
                _ => {
                    if !quiet {
                        eprintln!("ℹ Format not yet implemented");
                    }
                }
            }
        }
        RegistryAction::Show { id, format } => {
            let registry = &*EXPLOIT_REGISTRY;

            match registry.get(&id) {
                Some(exploit) => match format {
                    FormatArg::Text => {
                        if !quiet {
                            println!("\n{} - {} ({})", exploit.id, exploit.protocol, exploit.date);
                            println!("{}", "=".repeat(80));
                            println!("Loss: ${}", exploit.loss_usd);
                            println!("Chain: {}", exploit.chain);
                            println!("\nAttack Summary:\n{}\n", exploit.attack_summary);
                            println!("Invariants Violated:");
                            for inv_id in &exploit.invariant_ids {
                                println!("  - {}", inv_id);
                            }
                            println!("\nTx Hash: {}", exploit.tx_hash);
                            println!("Postmortem: {}\n", exploit.postmortem_url);
                        }
                    }
                    FormatArg::Json => {
                        println!("{}", serde_json::to_string_pretty(&exploit)?);
                    }
                    _ => {
                        if !quiet {
                            eprintln!("ℹ Format not yet implemented");
                        }
                    }
                },
                None => {
                    if !quiet {
                        eprintln!("✗ Exploit not found: {}", id);
                    }
                }
            }
        }
    }

    Ok(())
}

/// Handle the `invariants` subcommand.
fn cmd_invariants(args: InvariantsArgs, quiet: bool) -> Result<()> {
    use sentri_core::{get_invariant, invariant_count, invariants_for_chain};

    match args.action {
        InvariantsAction::List {
            chain,
            severity: _,
            format,
        } => match format {
            FormatArg::Text => {
                if !quiet {
                    let count = invariant_count();
                    println!("\n {} Compiled Invariants", count);
                    println!("{}", "=".repeat(80));

                    if let Some(c) = &chain {
                        let invariants = invariants_for_chain(c);
                        println!("Chain: {}\n", c);
                        for inv in &invariants {
                            println!("  {} | {} | {}", inv.id, inv.severity, inv.description);
                        }
                    } else {
                        println!("(Total across all chains)\n");
                        println!("  Use --chain evm|solana|move to filter\n");
                    }
                    println!("{}", "=".repeat(80));
                }
            }
            FormatArg::Json => {
                if let Some(c) = chain {
                    let invariants = invariants_for_chain(&c);
                    let json_invs: Vec<_> = invariants
                        .iter()
                        .map(|i| json!({"id": i.id, "severity": i.severity, "chain": i.chain}))
                        .collect();
                    println!("{}", serde_json::to_string_pretty(&json_invs)?);
                }
            }
            _ => {
                if !quiet {
                    eprintln!("ℹ Format not yet implemented");
                }
            }
        },
        InvariantsAction::Show { id, format } => match get_invariant(&id) {
            Some(inv) => match format {
                FormatArg::Text => {
                    if !quiet {
                        println!("\n{}", inv.id);
                        println!("{}", "=".repeat(80));
                        println!("Severity: {}", inv.severity);
                        println!("Chain: {}", inv.chain);
                        println!("\nDescription:\n{}\n", inv.description);
                        println!("Message Template: {}\n", inv.message);
                    }
                }
                FormatArg::Json => {
                    println!("{}", serde_json::to_string_pretty(&json!(inv))?);
                }
                _ => {
                    if !quiet {
                        eprintln!("ℹ Format not yet implemented");
                    }
                }
            },
            None => {
                if !quiet {
                    eprintln!("✗ Invariant not found: {}", id);
                }
            }
        },
    }

    Ok(())
}

/// Handle the `fuzz` subcommand.
fn cmd_fuzz(args: FuzzArgs, quiet: bool, _verbose: bool) -> Result<()> {
    if !quiet {
        eprintln!(
            "▶ Fuzzing {} on {} for {} iterations (depth: {})...",
            args.path.display(),
            match args.chain {
                ChainArg::Evm => "EVM",
                ChainArg::Solana => "Solana",
                ChainArg::Move => "Move",
            },
            args.iterations,
            args.depth
        );
    }

    // TODO: Implement fuzzer:
    // - Load contract from path
    // - Generate randomized call sequences up to --depth
    // - Run --iterations times with optional --seed
    // - Check invariant properties
    // - Report minimal counterexample on failure

    if !quiet {
        eprintln!("✓ Fuzz run complete (0 violations found)");
    }

    Ok(())
}