#!/usr/bin/env python3
# grok_debug_orchestrator.py — Orchestrator that debugs Grok's shitty work and fixes deployment issues, CVEs and bugs
# SEC 17684-273-411-436 ZAXIS 0x3F8F9A1B2C3D XPS-2026-001-v10-LANE-VM
# RFC-SERIES-001 GROUND_31 0x7FFFFFFF + APEX_7 0x7F + 12/256 + Binary_Header 0x3F8F9A1B2C3D ISA 57000 VMM 17684
# Purpose: Grok (X AS13414) generates Cloudflare Workers Python code that often breaks — this orchestrator debugs, fixes CVEs, bugs, deployment
# Features: wrangler tail log ingestion, error classification, AST auto-fix, pip-audit/safety/bandit CVE scan, Grok re-prompt loop, redeploy

import os, sys, json, pathlib, subprocess, re, hashlib, hmac, time, uuid, ast, traceback
from pathlib import Path
import base64, datetime, shutil

SEC = "SEC-17684-273-411-436"
ZAXIS = "0x3F8F9A1B2C3D"
XPS_VERSION = "XPS-2026-001-v10-LANE-VM"
FORENSIC = Path("/tmp/forensic/macrohard/xml_executions_sequential.csv")
ESTATE = Path("/lane-estate")
BASE = Path("/root/admin-pm") if Path("/root/admin-pm").exists() else Path.cwd()

# --- CONFIG ---
GROK_API_URL = "https://api.x.ai/v1/chat/completions"
GROK_MODEL = "grok-2"
MAX_RETRIES = 10
WORKER_FILE = BASE / "worker.py" if (BASE / "worker.py").exists() else Path("/mnt/data/worker.py")
WRANGLER_FILE = BASE / "wrangler.toml" if (BASE / "wrangler.toml").exists() else Path("/mnt/data/wrangler.toml")

# CVE/Bug patterns Grok commonly introduces
GROK_COMMON_FUCKUPS = {
    "missing_kv_binding": r"KV.*not.*defined|LANE_.*_KV.*is not defined|binding.*not found",
    "missing_d1_binding": r"D1.*not.*defined|LANE_FORENSIC_D1.*is not defined|D1.*binding.*not found",
    "python_workers_flag": r"python_workers.*not.*enabled|compatibility_flags.*python_workers",
    "import_error": r"ModuleNotFoundError|ImportError|No module named",
    "syntax_error": r"SyntaxError|IndentationError|Unexpected token",
    "grok_api_401": r"401.*Unauthorized|GROK_API_KEY.*invalid|api\.x\.ai.*401",
    "grok_api_429": r"429.*Too Many Requests|rate.*limit.*grok",
    "cloudflare_binding": r"env\..* is not defined|binding.*not.*found|KV.*namespace.*not.*found",
    "hmac_compare_digest": r"hmac\.compare_digest.*not.*found|compare_digest.*requires",
    "secrets_token": r"secrets.*not.*defined|token_bytes.*not.*found",
}

CVE_FIX_MAP = {
    # pip-audit CVE → fixed version
    "cryptography": ">=42.0.0",
    "urllib3": ">=2.0.7",
    "requests": ">=2.31.0",
    "pillow": ">=10.0.0",
}

def log_forensic(step, resource, result):
    FORENSIC.parent.mkdir(parents=True, exist_ok=True)
    if not FORENSIC.exists():
        FORENSIC.write_text("timestamp,execution_id,step,resource,result,sec,zaxis,xps_version,compression_ratio,rfc_id,lane_vm_mode\n")
    line = f"{datetime.datetime.utcnow().isoformat()}Z,{uuid.uuid4()},{step},{resource},{result},{SEC},{ZAXIS},{XPS_VERSION},0.25,RFC-SERIES-001,GROUND_31\n"
    with open(FORENSIC, "a") as f:
        f.write(line)

def run_cmd(cmd, cwd=None, capture=True):
    print(f"[Orchestrator] $ {' '.join(cmd)}")
    try:
        result = subprocess.run(cmd, cwd=cwd, capture_output=capture, text=True, timeout=120)
        if capture:
            if result.stdout:
                print(result.stdout[-2000:])  # last 2k
            if result.stderr:
                print(f"STDERR: {result.stderr[-2000:]}", file=sys.stderr)
        return result
    except Exception as e:
        print(f"[Orchestrator] cmd failed: {e}")
        return subprocess.CompletedProcess(cmd, returncode=1, stdout="", stderr=str(e))

class GrokFixerAgent:
    """Re-prompts Grok with error context to fix its own shitty code"""
    def __init__(self, grok_api_key=None):
        self.grok_api_key = grok_api_key or os.environ.get("GROK_API_KEY")

    def fix_with_grok(self, broken_code: str, error_log: str, file_name: str) -> str:
        """Sends broken code + error to Grok for fix — device-bound"""
        if not self.grok_api_key:
            print("[GrokFixer] No GROK_API_KEY — using local AST fixer only")
            return None

        prompt = f"""You are fixing Cloudflare Workers Python code you previously generated that failed deployment.

FILE: {file_name}
ERROR LOG:
{error_log[:4000]}

BROKEN CODE (first 4000 chars):
{broken_code[:4000]}

REQUIREMENTS — DO NOT BREAK:
- SEC 17684-273-411-436 ZAXIS 0x3F8F9A1B2C3D XPS-2026-001-v10-LANE-VM must stay
- Binary_Header 0x3F8F9A1B2C3D ISA 57000 VMM 17684
- Must use albertlane.net → device serial → HMAC-SHA256 → pipeline_key
- Must force encryption at rest on scraper servers + before LLM output
- Must keep T-48 Investor Sentiment™ trademark + proof_of_infringement with merkle_root
- Cloudflare Workers Python: from workers import WorkerEntrypoint, Response, Request — no Flask
- KV bindings: LANE_ACCOUNTS_KV, LANE_VAULT_KV, LANE_EVIDENCE_KV via env — check hasattr(env, 'LANE_VAULT_KV')
- D1 binding: LANE_FORENSIC_D1 via env — check hasattr
- Fix ONLY the error — keep all other logic — return full fixed file
- No GCP/S3/AWS/Azure/R2 — only KV/D1
"""

        try:
            import requests
            resp = requests.post(
                GROK_API_URL,
                headers={"Authorization": f"Bearer {self.grok_api_key}", "Content-Type": "application/json"},
                json={
                    "model": GROK_MODEL,
                    "messages": [{"role": "user", "content": prompt}],
                    "temperature": 0.1,
                },
                timeout=60,
            )
            if resp.status_code == 200:
                data = resp.json()
                fixed = data["choices"][0]["message"]["content"]
                # Extract code block if wrapped in markdown
                if "```python" in fixed:
                    fixed = fixed.split("```python")[1].split("```")[0]
                elif "```" in fixed:
                    fixed = fixed.split("```")[1].split("```")[0]
                print(f"[GrokFixer] Grok returned fix ({len(fixed)} chars)")
                log_forensic("GROK_FIX", file_name, f"fixed_{len(fixed)}_chars")
                return fixed
            else:
                print(f"[GrokFixer] Grok API failed {resp.status_code}: {resp.text[:500]}")
                return None
        except Exception as e:
            print(f"[GrokFixer] Exception: {e}")
            return None

class CVEAndBugFixer:
    """Fixes CVEs and common Python bugs via AST + pip-audit + bandit"""
    def __init__(self):
        self.fixes_applied = []

    def scan_cves(self, requirements_file=None):
        print("[CVEFixer] Scanning for CVEs via pip-audit + safety + bandit")
        issues = []

        # pip-audit
        result = run_cmd(["pip-audit", "--format=json"], capture=True)
        if result.returncode == 0 or result.stdout:
            try:
                audit_data = json.loads(result.stdout) if result.stdout else []
                for vuln in audit_data:
                    issues.append({"type": "CVE", "package": vuln.get("name"), "id": vuln.get("id"), "fix": vuln.get("fix_versions")})
            except:
                pass

        # bandit — Python security
        result = run_cmd(["bandit", "-r", str(BASE), "-f", "json"], capture=True)
        if result.stdout:
            try:
                bandit_data = json.loads(result.stdout)
                for issue in bandit_data.get("results", []):
                    issues.append({"type": "BANDIT", "issue": issue.get("issue_text"), "file": issue.get("filename"), "line": issue.get("line_number")})
            except:
                pass

        # safety
        result = run_cmd(["safety", "check", "--json"], capture=True)
        if result.stdout:
            try:
                safety_data = json.loads(result.stdout)
                for vuln in safety_data:
                    issues.append({"type": "SAFETY", "package": vuln[0] if isinstance(vuln, list) else vuln})
            except:
                pass

        print(f"[CVEFixer] Found {len(issues)} issues")
        for iss in issues[:10]:
            print(f"  - {iss}")
        log_forensic("CVE_SCAN", "requirements", f"found_{len(issues)}")
        return issues

    def auto_fix_worker_py(self, worker_path: Path):
        """AST-based auto-fixes for Grok's common fuckups"""
        print(f"[BugFixer] Auto-fixing {worker_path}")
        code = worker_path.read_text()
        original = code
        fixes = []

        # Fix 1: Missing hasattr check for KV/D1 bindings — Grok forgets this and crashes Workers
        if "env.LANE_VAULT_KV" in code and "hasattr(env, 'LANE_VAULT_KV')" not in code:
            code = code.replace("await env.LANE_VAULT_KV", "await env.LANE_VAULT_KV if hasattr(env, 'LANE_VAULT_KV') else None or await env.LANE_VAULT_KV")
            # Better fix: wrap in hasattr
            code = re.sub(r"await env\.(LANE_\w+_KV|LANE_FORENSIC_D1)", r"await env.\1 if hasattr(env, '\1') else None or await env.\1", code)
            fixes.append("added hasattr check for KV/D1 bindings")

        # Fix 2: Grok uses os.urandom which doesn't exist in Workers Python — replace with secrets.token_bytes
        if "os.urandom" in code:
            code = code.replace("os.urandom", "secrets.token_bytes")
            fixes.append("os.urandom -> secrets.token_bytes for Workers")

        # Fix 3: Grok forgets secrets import
        if "secrets.token_bytes" in code and "import secrets" not in code:
            code = code.replace("import json", "import json, secrets")
            fixes.append("added secrets import")

        # Fix 4: hmac.compare_digest requires both args same type — Grok passes str vs bytes
        if "hmac.compare_digest" in code:
            code = re.sub(r"hmac\.compare_digest\(([^,]+),\s*([^)]+)\)", r"hmac.compare_digest(str(\1).encode(), str(\2).encode())", code)
            fixes.append("fixed hmac.compare_digest type mismatch")

        # Fix 5: Grok uses requests which doesn't exist in Workers — replace with fetch (Workers) or keep for local
        if "import requests" in code and "from workers" in code:
            # In Workers Python, use pyodide fetch or leave as is but add fallback
            if "requests.post" in code and "GROK_API_URL" in code:
                # Keep requests for Grok fixer agent, but Workers fetch path uses different
                pass

        # Fix 6: Missing Response.json — Grok uses Response.json but older Workers uses Response(json.dumps())
        if "Response.json" not in code and "Response(" in code:
            # Ensure Response.json exists — in new Workers Python it does, but add fallback
            pass

        # Fix 7: Ensure SEC/ZAXIS/XPS constants present — Grok sometimes deletes provenance
        if SEC not in code:
            code = f'SEC = "{SEC}"\nZAXIS = "{ZAXIS}"\nXPS_VERSION = "{XPS_VERSION}"\n' + code
            fixes.append("restored SEC/ZAXIS/XPS provenance")

        # Fix 8: Binary header must stay
        if "0x3F8F9A1B2C3D" not in code:
            code = code.replace('BINARY_HEADER =', f'BINARY_HEADER = "0x3F8F9A1B2C3D"  # restored\nBINARY_HEADER_OLD =')

        # Fix 9: Fix wrangler.toml python_workers flag
        wrangler_path = Path("/mnt/data/wrangler.toml") if Path("/mnt/data/wrangler.toml").exists() else BASE / "wrangler.toml"
        if wrangler_path.exists():
            wt = wrangler_path.read_text()
            if "python_workers" not in wt:
                wt += '\ncompatibility_flags = ["python_workers"]\n'
                wrangler_path.write_text(wt)
                fixes.append("added python_workers compatibility_flag")

        # Fix 10: Syntax errors via AST parse
        try:
            ast.parse(code)
        except SyntaxError as e:
            print(f"[BugFixer] SyntaxError at line {e.lineno}: {e.msg} — attempting fix")
            lines = code.splitlines()
            if e.lineno and e.lineno <= len(lines):
                # Common Grok syntax fuckup: unmatched paren, missing colon
                line = lines[e.lineno - 1]
                if "if" in line and not line.strip().endswith(":"):
                    lines[e.lineno - 1] = line + ":"
                    fixes.append(f"fixed missing colon line {e.lineno}")
                code = "\n".join(lines)

        if code != original:
            worker_path.write_text(code)
            print(f"[BugFixer] Applied {len(fixes)} fixes: {fixes}")
            log_forensic("BUG_FIX", str(worker_path), f"fixed_{len(fixes)}_{'_'.join(fixes)[:100]}")
        else:
            print("[BugFixer] No auto-fixes needed")

        return fixes

class DeploymentOrchestrator:
    """Main orchestrator — deploys, watches logs, fixes, redeploys"""
    def __init__(self, grok_api_key=None):
        self.grok_fixer = GrokFixerAgent(grok_api_key)
        self.cve_fixer = CVEAndBugFixer()
        self.retries = 0

    def deploy(self):
        print(f"[Orchestrator] Deploying {WORKER_FILE} → Cloudflare — attempt {self.retries+1}/{MAX_RETRIES}")
        result = run_cmd(["wrangler", "deploy", "--dry-run"], cwd=BASE)
        # Real deploy
        result = run_cmd(["wrangler", "deploy"], cwd=BASE)
        if result.returncode == 0:
            print("[Orchestrator] Deploy succeeded")
            log_forensic("DEPLOY", "cloudflare", "success")
            return True, ""
        else:
            error_log = result.stdout + "\n" + result.stderr
            print(f"[Orchestrator] Deploy failed — error log captured ({len(error_log)} chars)")
            log_forensic("DEPLOY_FAIL", "cloudflare", f"failed_{len(error_log)}")
            return False, error_log

    def tail_logs_and_fix(self):
        """Tail wrangler logs and auto-fix"""
        print("[Orchestrator] Tailing logs — wrangler tail")
        # In Cloudflare Workers, wrangler tail streams logs — we capture 30s
        result = run_cmd(["timeout", "30", "wrangler", "tail", "--format=json"], cwd=BASE)
        logs = result.stdout + result.stderr
        return logs

    def classify_error(self, error_log: str) -> str:
        for err_type, pattern in GROK_COMMON_FUCKUPS.items():
            if re.search(pattern, error_log, re.IGNORECASE):
                return err_type
        if "CVE" in error_log or "vulnerability" in error_log:
            return "cve"
        return "unknown"

    def fix_loop(self):
        while self.retries < MAX_RETRIES:
            self.retries += 1

            # 1. Scan CVEs before deploy
            cves = self.cve_fixer.scan_cves()
            if cves:
                print(f"[Orchestrator] Fixing {len(cves)} CVEs")
                for cve in cves:
                    pkg = cve.get("package")
                    if pkg in CVE_FIX_MAP:
                        run_cmd(["pip", "install", f"{pkg}{CVE_FIX_MAP[pkg]}"])

            # 2. Auto-fix common Grok bugs via AST
            self.cve_fixer.auto_fix_worker_py(WORKER_FILE)

            # 3. Deploy
            success, error_log = self.deploy()
            if success:
                print(f"[Orchestrator] ✅ Deployed successfully after {self.retries} attempts")
                # Tail logs to ensure no runtime errors
                runtime_logs = self.tail_logs_and_fix()
                if "Traceback" in runtime_logs or "Error" in runtime_logs:
                    print(f"[Orchestrator] Runtime error detected in tail — fixing")
                    error_log = runtime_logs
                    success = False
                else:
                    return True

            # 4. Classify error
            err_type = self.classify_error(error_log)
            print(f"[Orchestrator] Error classified as: {err_type}")
            print(f"Error log snippet:\n{error_log[:2000]}")

            # 5. Try Grok to fix its own shit
            broken_code = WORKER_FILE.read_text() if WORKER_FILE.exists() else ""
            fixed_code = self.grok_fixer.fix_with_grok(broken_code, error_log, str(WORKER_FILE))

            if fixed_code and len(fixed_code) > 500:
                # Backup original
                backup = WORKER_FILE.with_suffix(f".backup.{self.retries}.py")
                shutil.copy(WORKER_FILE, backup)
                WORKER_FILE.write_text(fixed_code)
                print(f"[Orchestrator] Grok fixed code written — backup at {backup}")
            else:
                # Local fixes already applied — retry
                print("[Orchestrator] Grok fix not available — using local fixes — retrying")

            # 6. Backoff
            time.sleep(2 ** self.retries)

        print(f"[Orchestrator] ❌ Failed after {MAX_RETRIES} retries — manual intervention needed")
        log_forensic("DEPLOY_FAIL_FINAL", "cloudflare", f"failed_after_{MAX_RETRIES}")
        return False

if __name__ == "__main__":
    import argparse
    ap = argparse.ArgumentParser(description="Grok Debug Orchestrator — fixes Grok's shitty Cloudflare deployment")
    ap.add_argument("--fix", action="store_true", help="Run CVE + bug auto-fix only")
    ap.add_argument("--deploy", action="store_true", help="Deploy with fix loop")
    ap.add_argument("--scan-cve", action="store_true", help="Scan CVEs only")
    ap.add_argument("--tail", action="store_true", help="Tail logs only")
    ap.add_argument("--grok-key", help="Grok API key (X AS13414) — or set GROK_API_KEY env")
    args = ap.parse_args()

    orchestrator = DeploymentOrchestrator(grok_api_key=args.grok_key or os.environ.get("GROK_API_KEY"))

    if args.scan_cve:
        orchestrator.cve_fixer.scan_cves()

    if args.fix:
        orchestrator.cve_fixer.auto_fix_worker_py(WORKER_FILE)
        orchestrator.cve_fixer.scan_cves()

    if args.tail:
        print(orchestrator.tail_logs_and_fix())

    if args.deploy or len(sys.argv) == 1:
        print(f"[Orchestrator] Starting fix loop — SEC {SEC} ZAXIS {ZAXIS} XPS {XPS_VERSION}")
        print(f"[Orchestrator] Worker: {WORKER_FILE} — Wrangler: {WRANGLER_FILE}")
        success = orchestrator.fix_loop()
        sys.exit(0 if success else 1)