// Explicit operator provisioning. No restart, inference, agent creation, or live-file reads.
import fs from "node:fs/promises";
import os from "node:os";
import path from "node:path";

if (process.argv.length !== 2) throw new Error("Usage: configure-inspector-co-chat (reads only explicitly supplied LETTA_API_KEY and LETTA_BASE_URL)");
if (process.env.LETTA_BASE_URL !== "https://api.letta.com") throw new Error("The verified Co API backend is required");
const apiKey = process.env.LETTA_API_KEY;
const agentId = process.env.THOUGHTSTREAM_CO_AGENT_ID;
const deviceId = process.env.THOUGHTSTREAM_CO_COMPUTER_DEVICE_ID;
if (!agentId || !/^agent-[a-zA-Z0-9-]+$/.test(agentId)) throw new Error("An explicit chat agent binding is required");
if (!deviceId || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(deviceId)) throw new Error("An explicit computer binding is required");
if (!apiKey || !/^[A-Za-z0-9._-]{20,4096}$/.test(apiKey)) throw new Error("An explicit valid server-held API credential is required");
const directory = process.env.THOUGHTSTREAM_CREDENTIALS_DIR ?? path.join(os.homedir(), ".config", "thoughtstream", "credentials");
if (!path.isAbsolute(directory)) throw new Error("Credential directory must be absolute");
for (let parent = directory; parent !== path.dirname(parent); parent = path.dirname(parent)) {
  const entry = await fs.lstat(parent).catch((error: NodeJS.ErrnoException) => { if (error.code === "ENOENT") return undefined; throw error; });
  if (entry?.isSymbolicLink()) throw new Error("Credential directories may not be symlinks");
}
await fs.mkdir(directory, { recursive: true, mode: 0o700 });
await fs.chmod(directory, 0o700);
const destination = path.join(directory, "inspector-co-chat.env");
const file = await fs.open(destination, "wx", 0o600);
try {
  await file.writeFile(`THOUGHTSTREAM_CO_CHAT_ENABLED=true\nLETTA_BASE_URL=https://api.letta.com\nLETTA_API_KEY=${apiKey}\nTHOUGHTSTREAM_CO_AGENT_ID=${agentId}\nTHOUGHTSTREAM_CO_COMPUTER_DEVICE_ID=${deviceId}\n`);
  await file.sync();
} finally { await file.close(); }
process.stdout.write("Created one owner-only Co chat client credential file. No service was changed or restarted.\n");