main.rs

use anyhow::{Context, Result};
use clap::{Args, Parser, Subcommand, ValueEnum};
use futures_util::{SinkExt, StreamExt};
use rustyclaw_core::args::CommonArgs;
use rustyclaw_core::commands::{CommandAction, CommandContext, handle_command};
use rustyclaw_core::config::Config;
use rustyclaw_core::gateway::{
    ClientFrame, ClientFrameType, ClientPayload, ServerFrame, ServerFrameType, ServerPayload,
    deserialize_frame, serialize_frame,
};
use rustyclaw_core::providers;
use rustyclaw_core::secrets::SecretsManager;
use rustyclaw_core::skills::SkillManager;
#[cfg(feature = "tui")]
use rustyclaw_tui::app::App;
#[cfg(feature = "tui")]
use rustyclaw_tui::onboard::run_onboard_wizard;
use std::path::PathBuf;
use tokio_tungstenite::tungstenite::Message;
use url::Url;

mod commands;

// ── Top-level CLI ───────────────────────────────────────────────────────────

#[derive(Debug, Parser)]
#[command(
    name = "rustyclaw",
    version,
    about = "RustyClaw — lightweight agentic assistant",
    long_about = "RustyClaw — a super-lightweight super-capable agentic tool with improved security.\n\n\
                  Run without a subcommand to launch the TUI."
)]
struct Cli {
    #[command(flatten)]
    common: CommonArgs,
    #[command(subcommand)]
    command: Option<Commands>,
}

// ── Subcommands (mirrors openclaw command tree) ─────────────────────────────

#[derive(Debug, Subcommand)]
enum Commands {
    /// Initialise config + workspace (runs the wizard when wizard flags are present)
    Setup(SetupArgs),

    /// Interactive onboarding wizard — set up gateway, workspace, and skills
    Onboard(OnboardArgs),

    /// Import an existing OpenClaw installation into RustyClaw
    Import(ImportArgs),

    /// Interactive configuration wizard (models, gateway, skills)
    Configure,

    /// Config helpers: get / set / unset
    #[command(subcommand)]
    Config(ConfigCommands),

    /// Health checks + quick fixes for gateway and configuration
    Doctor(DoctorArgs),

    /// Launch the terminal UI
    #[command(alias = "ui")]
    Tui(TuiArgs),

    /// Send a one-shot message / slash-command
    #[command(alias = "cmd", alias = "run", alias = "message")]
    Command(CommandArgs),

    /// Send a prompt to the model and print the response (headless mode)
    #[command(alias = "chat", alias = "prompt")]
    Ask(AskArgs),

    /// Show system status (gateway, model, workspace)
    Status(StatusArgs),

    /// Gateway management (start / stop / restart / status)
    #[command(subcommand)]
    Gateway(GatewayCommands),

    /// List / manage skills
    #[command(subcommand)]
    Skills(SkillsCommands),

    /// Refresh the GitHub Copilot session token from OpenClaw
    #[command(alias = "refresh")]
    RefreshToken(RefreshTokenArgs),

    /// ClawHub skill registry commands (search, install, publish, …)
    #[command(name = "clawhub", alias = "hub", alias = "registry")]
    ClawHub(ClawHubCommands),
}

// ── Setup ───────────────────────────────────────────────────────────────────

#[derive(Debug, Args, Default)]
struct SetupArgs {
    /// Agent workspace directory (default: ~/.rustyclaw/workspace)
    #[arg(long, value_name = "DIR")]
    workspace: Option<String>,
    /// Run the onboarding wizard
    #[arg(long)]
    wizard: bool,
    /// Run wizard without prompts
    #[arg(long)]
    non_interactive: bool,
    /// Wizard mode
    #[arg(long, value_enum)]
    mode: Option<OnboardMode>,
    /// Remote gateway WebSocket URL
    #[arg(long, value_name = "URL")]
    remote_url: Option<String>,
    /// Remote gateway token (optional)
    #[arg(long, value_name = "TOKEN")]
    remote_token: Option<String>,
}

// ── RefreshToken ────────────────────────────────────────────────────────────

#[derive(Debug, Args)]
struct RefreshTokenArgs {
    /// Path to the OpenClaw directory (default: ~/.openclaw)
    #[arg(long, value_name = "PATH")]
    openclaw_dir: Option<String>,
    /// Restart the gateway after refreshing
    #[arg(long)]
    restart: bool,
}

// ── Import ──────────────────────────────────────────────────────────────────

#[derive(Debug, Args)]
struct ImportArgs {
    /// Path to the OpenClaw directory to import (default: ~/.openclaw)
    #[arg(value_name = "PATH")]
    source: Option<String>,
    /// RustyClaw settings directory (default: ~/.rustyclaw)
    #[arg(long, value_name = "DIR")]
    target: Option<String>,
    /// Overwrite existing files without prompting
    #[arg(long)]
    force: bool,
    /// Dry run — show what would be imported without making changes
    #[arg(long)]
    dry_run: bool,
}

// ── Onboard ─────────────────────────────────────────────────────────────────

#[derive(Debug, Clone, ValueEnum)]
enum OnboardMode {
    Local,
    Remote,
}

#[derive(Debug, Clone, ValueEnum)]
enum OnboardFlow {
    Quickstart,
    Advanced,
    Manual,
}

#[derive(Debug, Clone, ValueEnum)]
enum GatewayAuthMode {
    Token,
    Password,
}

#[derive(Debug, Clone, ValueEnum, Default)]
enum GatewayBind {
    #[default]
    Loopback,
    Lan,
    Tailnet,
    Auto,
    Custom,
}

#[derive(Debug, Args, Default)]
#[command(after_help = "\
SECURITY NOTE:
  API keys passed via CLI flags are visible in `ps aux` and process logs.
  For scripted/automated setups, prefer environment variables:

    ANTHROPIC_API_KEY=sk-xxx rustyclaw onboard
    OPENROUTER_API_KEY=sk-xxx rustyclaw onboard

  Or use the interactive wizard which prompts securely.
")]
struct OnboardArgs {
    /// Agent workspace directory
    #[arg(long, value_name = "DIR")]
    workspace: Option<String>,
    /// Reset config + credentials + sessions before wizard
    #[arg(long)]
    reset: bool,
    /// Run without prompts
    #[arg(long)]
    non_interactive: bool,
    /// Wizard mode
    #[arg(long, value_enum)]
    mode: Option<OnboardMode>,
    /// Wizard flow
    #[arg(long, value_enum)]
    flow: Option<OnboardFlow>,
    /// Auth provider choice (e.g. apiKey, openai-api-key, anthropic-api-key, …)
    #[arg(long, value_name = "CHOICE")]
    auth_choice: Option<String>,
    /// Output JSON summary
    #[arg(long)]
    json: bool,

    // ── Provider API-key flags (mirrors openclaw) ────────────────
    // ⚠️ CLI flags are visible in `ps aux`. Prefer env vars for security:
    //    ANTHROPIC_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, etc.
    /// Anthropic API key (prefer ANTHROPIC_API_KEY env var)
    #[arg(long, value_name = "KEY", env = "ANTHROPIC_API_KEY", hide = true)]
    anthropic_api_key: Option<String>,
    /// OpenAI API key (prefer OPENAI_API_KEY env var)
    #[arg(long, value_name = "KEY", env = "OPENAI_API_KEY", hide = true)]
    openai_api_key: Option<String>,
    /// OpenRouter API key (prefer OPENROUTER_API_KEY env var)
    #[arg(long, value_name = "KEY", env = "OPENROUTER_API_KEY", hide = true)]
    openrouter_api_key: Option<String>,
    /// OpenCode Zen API key (prefer OPENCODE_API_KEY env var)
    #[arg(long, value_name = "KEY", env = "OPENCODE_API_KEY", hide = true)]
    opencode_api_key: Option<String>,
    /// Gemini API key (prefer GEMINI_API_KEY env var)
    #[arg(long, value_name = "KEY", env = "GEMINI_API_KEY", hide = true)]
    gemini_api_key: Option<String>,
    /// xAI API key (prefer XAI_API_KEY env var)
    #[arg(long, value_name = "KEY", env = "XAI_API_KEY", hide = true)]
    xai_api_key: Option<String>,

    // ── Gateway flags (inline, mirrors openclaw) ────────────────
    /// Gateway port
    #[arg(long, value_name = "PORT")]
    gateway_port: Option<u16>,
    /// Gateway bind mode
    #[arg(long, value_enum)]
    gateway_bind: Option<GatewayBind>,
    /// Gateway auth mode
    #[arg(long, value_enum)]
    gateway_auth: Option<GatewayAuthMode>,
    /// Gateway token (token auth)
    #[arg(long, value_name = "TOKEN")]
    gateway_token: Option<String>,
    /// Gateway password (password auth)
    #[arg(long, value_name = "PASSWORD")]
    gateway_password: Option<String>,
    /// Remote gateway URL
    #[arg(long, value_name = "URL")]
    remote_url: Option<String>,
    /// Remote gateway token
    #[arg(long, value_name = "TOKEN")]
    remote_token: Option<String>,
    /// Skip skills setup
    #[arg(long)]
    skip_skills: bool,
    /// Skip health check
    #[arg(long)]
    skip_health: bool,
}

// ── Config ──────────────────────────────────────────────────────────────────

#[derive(Debug, Subcommand)]
enum ConfigCommands {
    /// Print a config value (dot path, e.g. model.provider)
    Get {
        /// Dot-separated config path
        #[arg(value_name = "PATH")]
        path: String,
    },
    /// Set a config value
    Set {
        /// Dot-separated config path
        #[arg(value_name = "PATH")]
        path: String,
        /// Value to set
        #[arg(value_name = "VALUE")]
        value: String,
    },
    /// Remove a config value
    Unset {
        /// Dot-separated config path
        #[arg(value_name = "PATH")]
        path: String,
    },
}

// ── Doctor ──────────────────────────────────────────────────────────────────

#[derive(Debug, Args, Default)]
struct DoctorArgs {
    /// Accept defaults without prompting
    #[arg(long)]
    yes: bool,
    /// Apply recommended repairs without prompting
    #[arg(long)]
    repair: bool,
    /// Run without prompts (safe migrations only)
    #[arg(long)]
    non_interactive: bool,
    /// Output JSON
    #[arg(long)]
    json: bool,
}

// ── TUI ─────────────────────────────────────────────────────────────────────

#[derive(Debug, Args, Default)]
struct TuiArgs {
    /// Gateway WebSocket URL (overrides config)
    #[arg(long = "url", value_name = "URL")]
    url: Option<String>,
    /// Gateway token
    #[arg(long, value_name = "TOKEN")]
    token: Option<String>,
    /// Gateway password
    #[arg(long, value_name = "PASSWORD")]
    password: Option<String>,
    /// Session key to resume
    #[arg(long, value_name = "KEY")]
    session: Option<String>,
    /// Send an initial message instead of entering interactive mode
    #[arg(long, value_name = "TEXT")]
    message: Option<String>,
}

// ── Command / Message ───────────────────────────────────────────────────────

#[derive(Debug, Args)]
struct CommandArgs {
    /// Command text to execute
    #[arg(value_name = "COMMAND", trailing_var_arg = true)]
    command: Vec<String>,
    /// Gateway WebSocket URL (ws://…)
    #[arg(
        long = "gateway",
        alias = "url",
        alias = "ws",
        value_name = "WS_URL",
        env = "RUSTYCLAW_GATEWAY"
    )]
    gateway: Option<String>,
}

// ── Ask (headless mode) ─────────────────────────────────────────────────────

#[derive(Debug, Args)]
#[command(after_help = "\
EXAMPLES:
  rustyclaw ask 'What is 2+2?'
  echo 'Summarize this' | rustyclaw ask --stdin
  rustyclaw ask --model anthropic/claude-haiku 'Quick question'
  rustyclaw ask --no-tools 'Just chat, no actions'
")]
struct AskArgs {
    /// Prompt text (can also be provided via --stdin)
    #[arg(value_name = "PROMPT", trailing_var_arg = true)]
    prompt: Vec<String>,
    /// Read prompt from stdin
    #[arg(long)]
    stdin: bool,
    /// Model to use (overrides default)
    #[arg(long, short, value_name = "MODEL")]
    model: Option<String>,
    /// Disable tool use (pure chat mode)
    #[arg(long)]
    no_tools: bool,
    /// Output raw JSON response
    #[arg(long)]
    json: bool,
    /// System prompt override
    #[arg(long, value_name = "PROMPT")]
    system: Option<String>,
    /// Gateway WebSocket URL (ws://…)
    #[arg(
        long = "gateway",
        alias = "url",
        alias = "ws",
        value_name = "WS_URL",
        env = "RUSTYCLAW_GATEWAY"
    )]
    gateway: Option<String>,
    /// Maximum tokens in response
    #[arg(long, value_name = "TOKENS")]
    max_tokens: Option<u32>,
    /// Temperature (0.0-2.0)
    #[arg(long, value_name = "TEMP")]
    temperature: Option<f32>,
}

// ── Status ──────────────────────────────────────────────────────────────────

#[derive(Debug, Args, Default)]
struct StatusArgs {
    /// Output JSON
    #[arg(long)]
    json: bool,
    /// Show all available information
    #[arg(long)]
    all: bool,
    /// Include usage statistics
    #[arg(long)]
    usage: bool,
    /// Verbose output
    #[arg(long, short)]
    verbose: bool,
}

// ── Gateway subcommands ─────────────────────────────────────────────────────

#[derive(Debug, Subcommand)]
enum GatewayCommands {
    /// Start the gateway (daemon/background)
    Start,
    /// Stop a running gateway
    Stop,
    /// Restart the gateway
    Restart,
    /// Show gateway status
    Status {
        /// Output JSON
        #[arg(long)]
        json: bool,
    },
    /// Reload gateway configuration without restarting
    Reload,
    /// Run the gateway in the foreground (like `rustyclaw-gateway`)
    Run(GatewayRunArgs),
}

#[derive(Debug, Args, Default)]
struct GatewayRunArgs {
    /// Gateway port
    #[arg(long, value_name = "PORT", default_value_t = 9001)]
    port: u16,
    /// Bind mode
    #[arg(long, value_enum, default_value_t = GatewayBind::Loopback)]
    bind: GatewayBind,
    /// Auth token
    #[arg(long, value_name = "TOKEN")]
    token: Option<String>,
    /// Auth mode
    #[arg(long, value_enum)]
    auth: Option<GatewayAuthMode>,
    /// Auth password
    #[arg(long, value_name = "PASSWORD")]
    password: Option<String>,
    /// Overwrite existing configuration
    #[arg(long)]
    force: bool,
    /// Verbose logging
    #[arg(long, short)]
    verbose: bool,
}

// ── Skills subcommands ──────────────────────────────────────────────────────

#[derive(Debug, Subcommand)]
enum SkillsCommands {
    /// List installed skills
    List,
    /// Show info about a skill
    Info {
        /// Skill name
        #[arg(value_name = "NAME")]
        name: String,
    },
    /// Check skills for issues
    Check,
}

// ── ClawHub subcommands ─────────────────────────────────────────────────────

#[derive(Debug, Args)]
struct ClawHubCommands {
    #[command(subcommand)]
    command: Option<ClawHubSub>,
}

#[derive(Debug, Subcommand)]
enum ClawHubSub {
    /// Authenticate with ClawHub
    #[command(subcommand)]
    Auth(ClawHubAuthCommands),

    /// Search skills on ClawHub
    Search {
        /// Search query
        #[arg(value_name = "QUERY", trailing_var_arg = true)]
        query: Vec<String>,
    },

    /// Show trending / popular skills
    Trending {
        /// Filter by category
        #[arg(value_name = "CATEGORY")]
        category: Option<String>,
        /// Max results to show
        #[arg(long, short = 'n', default_value_t = 15)]
        limit: usize,
    },

    /// List skill categories
    Categories,

    /// Show detailed info about a registry skill
    Info {
        /// Skill name
        #[arg(value_name = "NAME")]
        name: String,
    },

    /// Open ClawHub in your browser
    Browse,

    /// Show your ClawHub profile
    Profile,

    /// List your starred skills
    Starred,

    /// Star a skill
    Star {
        /// Skill name to star
        #[arg(value_name = "NAME")]
        name: String,
    },

    /// Unstar a skill
    Unstar {
        /// Skill name to unstar
        #[arg(value_name = "NAME")]
        name: String,
    },

    /// Install a skill from ClawHub
    Install {
        /// Skill name
        #[arg(value_name = "NAME")]
        name: String,
        /// Version to install (default: latest)
        #[arg(value_name = "VERSION")]
        version: Option<String>,
    },

    /// Publish a local skill to ClawHub
    Publish {
        /// Skill name to publish
        #[arg(value_name = "NAME")]
        name: String,
    },
}

#[derive(Debug, Subcommand)]
enum ClawHubAuthCommands {
    /// Authenticate with an API token
    Login {
        /// API token from https://clawhub.ai/settings/tokens
        #[arg(value_name = "TOKEN")]
        token: String,
    },
    /// Show authentication status
    Status,
    /// Remove stored credentials
    Logout,
}

// ═══════════════════════════════════════════════════════════════════════════
//  Entrypoint
// ═══════════════════════════════════════════════════════════════════════════

#[tokio::main]
async fn main() -> Result<()> {
    // Initialize structured logging from environment variables.
    // Set RUSTYCLAW_LOG=debug or RUST_LOG=debug for verbose output.
    rustyclaw_core::logging::init_from_env();

    let cli = Cli::parse();

    // Initialise colour output (respects --no-color / NO_COLOR).
    rustyclaw_core::theme::init_color(cli.common.no_color);

    let config_path = cli.common.config_path();
    let mut config = Config::load(config_path)?;
    cli.common.apply_overrides(&mut config);

    match cli.command.unwrap_or(Commands::Tui(TuiArgs::default())) {
        // ── Setup ───────────────────────────────────────────────
        Commands::Setup(args) => {
            // If any wizard-style flag is present, delegate to onboard.
            let has_wizard_flags = args.wizard
                || args.non_interactive
                || args.mode.is_some()
                || args.remote_url.is_some()
                || args.remote_token.is_some();

            if has_wizard_flags {
                #[cfg(feature = "tui")]
                {
                    let mut secrets = open_secrets(&config)?;
                    run_onboard_wizard(&mut config, &mut secrets, false, args.non_interactive)?;
                    // Optional agent setup step
                    let ws_dir = config.workspace_dir();
                    match rustyclaw_core::tools::agent_setup::exec_agent_setup(
                        &serde_json::json!({}),
                        &ws_dir,
                    ) {
                        Ok(msg) => println!("{}", rustyclaw_core::theme::icon_ok(&msg)),
                        Err(e) => println!(
                            "{}",
                            rustyclaw_core::theme::icon_fail(&format!("Agent setup failed: {}", e))
                        ),
                    }
                }
                #[cfg(not(feature = "tui"))]
                {
                    eprintln!(
                        "Onboarding wizard is not available in this build. Build with --features tui to enable."
                    );
                    std::process::exit(1);
                }
            } else {
                // Minimal setup: ensure directory skeleton + default config.
                if let Some(ws) = args.workspace {
                    config.workspace_dir = Some(ws.into());
                }
                config.ensure_dirs()?;
                config.save(None)?;
                println!(
                    "{}",
                    rustyclaw_core::theme::icon_ok(&format!(
                        "Initialised config + workspace at {}",
                        rustyclaw_core::theme::info(&config.settings_dir.display().to_string())
                    ))
                );
                // Optional agent setup step
                let ws_dir = config.workspace_dir();
                match rustyclaw_core::tools::agent_setup::exec_agent_setup(
                    &serde_json::json!({}),
                    &ws_dir,
                ) {
                    Ok(msg) => println!("{}", rustyclaw_core::theme::icon_ok(&msg)),
                    Err(e) => println!(
                        "{}",
                        rustyclaw_core::theme::icon_fail(&format!("Agent setup failed: {}", e))
                    ),
                }
            }
        }

        // ── Onboard ─────────────────────────────────────────────
        Commands::Onboard(_args) => {
            #[cfg(feature = "tui")]
            {
                let mut secrets = open_secrets(&config)?;
                run_onboard_wizard(&mut config, &mut secrets, _args.reset, _args.non_interactive)?;
                // Optional agent setup step
                let ws_dir = config.workspace_dir();
                match rustyclaw_core::tools::agent_setup::exec_agent_setup(
                    &serde_json::json!({}),
                    &ws_dir,
                ) {
                    Ok(msg) => println!("{}", rustyclaw_core::theme::icon_ok(&msg)),
                    Err(e) => println!(
                        "{}",
                        rustyclaw_core::theme::icon_fail(&format!("Agent setup failed: {}", e))
                    ),
                }
            }
            #[cfg(not(feature = "tui"))]
            {
                eprintln!(
                    "Onboarding wizard is not available in this build. Build with --features tui to enable."
                );
                std::process::exit(1);
            }
        }

        // ── Import ──────────────────────────────────────────────
        Commands::Import(args) => {
            run_import(&args, &mut config)?;
            // Optional agent setup step
            let ws_dir = config.workspace_dir();
            match rustyclaw_core::tools::agent_setup::exec_agent_setup(
                &serde_json::json!({}),
                &ws_dir,
            ) {
                Ok(msg) => println!("{}", rustyclaw_core::theme::icon_ok(&msg)),
                Err(e) => println!(
                    "{}",
                    rustyclaw_core::theme::icon_fail(&format!("Agent setup failed: {}", e))
                ),
            }
        }

        // ── RefreshToken ────────────────────────────────────────
        Commands::RefreshToken(args) => {
            run_refresh_token(&args, &mut config)?;
        }

        // ── Configure ───────────────────────────────────────────
        Commands::Configure => {
            #[cfg(feature = "tui")]
            {
                let mut secrets = open_secrets(&config)?;
                run_onboard_wizard(&mut config, &mut secrets, false, false)?;
            }
            #[cfg(not(feature = "tui"))]
            {
                eprintln!(
                    "Configuration wizard is not available in this build. Build with --features tui to enable."
                );
                std::process::exit(1);
            }
        }

        // ── Config get / set / unset ────────────────────────────
        Commands::Config(sub) => match sub {
            ConfigCommands::Get { path } => {
                let value = config_get(&config, &path);
                println!("{}", value);
            }
            ConfigCommands::Set { path, value } => {
                config_set(&mut config, &path, &value)?;
                config.save(None)?;
                println!(
                    "{}",
                    rustyclaw_core::theme::icon_ok(&format!(
                        "Set {} = {}",
                        rustyclaw_core::theme::accent_bright(&path),
                        rustyclaw_core::theme::info(&value)
                    ))
                );
            }
            ConfigCommands::Unset { path } => {
                config_unset(&mut config, &path)?;
                config.save(None)?;
                println!(
                    "{}",
                    rustyclaw_core::theme::icon_ok(&format!(
                        "Unset {}",
                        rustyclaw_core::theme::accent_bright(&path)
                    ))
                );
            }
        },

        // ── Doctor ──────────────────────────────────────────────
        Commands::Doctor(_args) => {
            use rustyclaw_core::theme as t;

            let sp = t::spinner("Running health checks…");

            let checks = vec![
                (
                    "Config file",
                    config.settings_dir.join("config.toml").exists(),
                ),
                ("Workspace dir", config.workspace_dir().exists()),
                ("Credentials dir", config.credentials_dir().exists()),
                ("SOUL.md", config.soul_path().exists()),
                ("Skills dir", config.skills_dir().exists()),
            ];

            // Brief pause so the spinner is visible.
            std::thread::sleep(std::time::Duration::from_millis(400));
            sp.finish_and_clear();

            let mut all_ok = true;
            for (label, passed) in &checks {
                if *passed {
                    println!("  {}", t::icon_ok(label));
                } else {
                    println!("  {}", t::icon_fail(label));
                    all_ok = false;
                }
            }
            println!();
            if all_ok {
                println!("{}", t::success("All checks passed."));
            } else {
                println!("{}", t::warn("Some checks failed."));
                println!(
                    "  Run {} or {} to fix.",
                    t::accent_bright("`rustyclaw setup`"),
                    t::accent_bright("`rustyclaw onboard`"),
                );
            }
        }

        // ── TUI ─────────────────────────────────────────────────
        Commands::Tui(_args) => {
            #[cfg(feature = "tui")]
            {
                // Apply TUI-specific overrides.
                if let Some(url) = &_args.url {
                    config.gateway_url = Some(url.clone());
                }
                // The gateway owns the secrets vault.  The TUI no longer needs
                // a local vault password — it fetches secrets via gateway messages.
                // A --password flag is forwarded to the gateway after connect if
                // the vault is locked.
                let mut app = App::new(config)?;
                if let Some(pw) = _args.password {
                    app.set_deferred_vault_password(pw);
                }
                app.run().await?;
            }
            #[cfg(not(feature = "tui"))]
            {
                eprintln!(
                    "TUI is not available in this build. Build with --features tui to enable."
                );
                std::process::exit(1);
            }
        }

        // ── Command / Message ───────────────────────────────────
        Commands::Command(args) => {
            let input = args.command.join(" ").trim().to_string();
            if input.is_empty() {
                anyhow::bail!("No command provided.");
            }

            if let Some(gateway_url) = args.gateway {
                let response = send_command_via_gateway(&gateway_url, &input).await?;
                println!("{}", response);
            } else {
                run_local_command(&mut config, &input)?;
            }
        }

        // ── Ask (headless model interaction) ────────────────────
        Commands::Ask(args) => {
            handle_ask(&config, args).await?;
        }

        // ── Status ──────────────────────────────────────────────
        Commands::Status(args) => {
            print_status(&config, &args);
        }

        // ── Gateway sub-commands ────────────────────────────────
        Commands::Gateway(sub) => {
            match sub {
                GatewayCommands::Start => {
                    let vault_password = extract_vault_password(&config);
                    let (port, bind) = commands::parse_gateway_defaults(&config);
                    commands::handle_start(&config, vault_password.as_deref(), port, bind)?;
                }
                GatewayCommands::Stop => {
                    commands::handle_stop(&config)?;
                }
                GatewayCommands::Restart => {
                    let vault_password = extract_vault_password(&config);
                    let (port, bind) = commands::parse_gateway_defaults(&config);
                    commands::handle_restart(&config, vault_password.as_deref(), port, bind)?;
                }
                GatewayCommands::Status { json } => {
                    commands::handle_status(&config, json);
                }
                GatewayCommands::Reload => {
                    use rustyclaw_core::theme as t;

                    let url = config
                        .gateway_url
                        .as_deref()
                        .unwrap_or("ws://127.0.0.1:9001");
                    let sp = t::spinner("Reloading gateway configuration\u{2026}");

                    match send_gateway_reload(url, config.totp_enabled).await {
                        Ok((provider, model)) => {
                            t::spinner_ok(
                                &sp,
                                &format!(
                                    "Gateway reloaded: {} / {}",
                                    t::info(&provider),
                                    t::info(&model),
                                ),
                            );
                        }
                        Err(e) => {
                            t::spinner_fail(&sp, &format!("Reload failed: {}", e));
                        }
                    }
                }
                GatewayCommands::Run(args) => {
                    let host = match args.bind {
                        GatewayBind::Loopback => "127.0.0.1",
                        GatewayBind::Lan => "0.0.0.0",
                        _ => "127.0.0.1",
                    };
                    commands::handle_run(config, host, args.port).await?;
                }
            }
        }

        // ── Skills sub-commands ─────────────────────────────────
        Commands::Skills(sub) => {
            // Use consolidated skills_dirs from config
            let skills_dirs = config.skills_dirs();

            let mut sm = SkillManager::with_dirs(skills_dirs);
            sm.load_skills()?;

            match sub {
                SkillsCommands::List => {
                    use rustyclaw_core::theme as t;
                    let skills = sm.get_skills();
                    if skills.is_empty() {
                        println!("{}", t::muted("No skills installed."));
                    } else {
                        for s in skills {
                            if s.enabled {
                                println!("  {}", t::icon_ok(&t::accent_bright(&s.name)));
                            } else {
                                println!("  {}", t::icon_muted(&s.name));
                            }
                        }
                    }
                }
                SkillsCommands::Info { name } => {
                    println!(
                        "{}",
                        rustyclaw_core::theme::muted(&format!(
                            "Skill info for '{}' is not yet implemented.",
                            name
                        ))
                    );
                }
                SkillsCommands::Check => {
                    println!(
                        "{}",
                        rustyclaw_core::theme::muted("Skill check is not yet implemented.")
                    );
                }
            }
        }

        // ── ClawHub sub-commands ────────────────────────────────
        Commands::ClawHub(args) => {
            use rustyclaw_core::theme as t;

            // Use consolidated skills_dirs from config
            let skills_dirs = config.skills_dirs();

            let mut sm = SkillManager::with_dirs(skills_dirs);
            sm.load_skills()?;
            if let Some(url) = config.clawhub_url.as_deref() {
                sm.set_registry(url, config.clawhub_token.clone());
            } else if let Some(ref token) = config.clawhub_token {
                let url = sm.registry_url().to_string();
                sm.set_registry(&url, Some(token.clone()));
            }

            match args.command {
                None => {
                    // No subcommand: show overview
                    println!("{}", t::accent_bright("ClawHub — Skill Registry"));
                    println!("  Registry: {}", t::info(sm.registry_url()));
                    match sm.auth_status() {
                        Ok(status) => println!("  Auth: {}", status),
                        Err(_) => println!("  Auth: {}", t::muted("unknown")),
                    }
                    println!();
                    println!(
                        "  {} search <query>        Search for skills",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} trending [category]   Browse trending skills",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} categories            List skill categories",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} info <name>           Show skill details",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} browse                Open ClawHub in browser",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} auth login <token>    Authenticate",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} profile               Show your profile",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} starred                List starred skills",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} install <name>        Install a skill",
                        t::muted("rustyclaw clawhub")
                    );
                    println!(
                        "  {} publish <name>        Publish a skill",
                        t::muted("rustyclaw clawhub")
                    );
                }
                Some(ClawHubSub::Auth(auth_cmd)) => match auth_cmd {
                    ClawHubAuthCommands::Login { token } => match sm.auth_token(&token) {
                        Ok(resp) if resp.ok => {
                            config.clawhub_token = Some(token);
                            config.save(None)?;
                            let user = resp.username.unwrap_or_else(|| "unknown".into());
                            println!(
                                "{}",
                                t::icon_ok(&format!("Authenticated as '{}' on ClawHub.", user))
                            );
                        }
                        Ok(_) => {
                            println!("{}", t::icon_fail("Token is invalid."));
                            std::process::exit(1);
                        }
                        Err(e) => {
                            println!("{}", t::icon_fail(&format!("Auth failed: {}", e)));
                            std::process::exit(1);
                        }
                    },
                    ClawHubAuthCommands::Status => match sm.auth_status() {
                        Ok(msg) => println!("{}", msg),
                        Err(e) => println!(
                            "{}",
                            t::icon_fail(&format!("Auth status check failed: {}", e))
                        ),
                    },
                    ClawHubAuthCommands::Logout => {
                        config.clawhub_token = None;
                        config.save(None)?;
                        println!("{}", t::icon_ok("Logged out from ClawHub."));
                    }
                },
                Some(ClawHubSub::Search { query }) => {
                    let q = query.join(" ");
                    if q.is_empty() {
                        println!(
                            "{}",
                            t::icon_fail("Usage: rustyclaw clawhub search <query>")
                        );
                        std::process::exit(1);
                    }
                    match sm.search_registry(&q) {
                        Ok(results) => {
                            if results.is_empty() {
                                println!(
                                    "{}",
                                    t::muted(&format!("No skills found matching '{}'.", q))
                                );
                            } else {
                                println!("{} result(s) for '{}':", results.len(), q);
                                for r in &results {
                                    let dl = if r.downloads > 0 {
                                        format!(" (↓{})", r.downloads)
                                    } else {
                                        String::new()
                                    };
                                    println!(
                                        "  {} {} v{} by {} — {}{}",
                                        t::icon_ok(""),
                                        r.name,
                                        r.version,
                                        r.author,
                                        r.description,
                                        dl,
                                    );
                                }
                                println!();
                                println!(
                                    "Install with: {} install <name>",
                                    t::muted("rustyclaw clawhub")
                                );
                            }
                        }
                        Err(e) => {
                            println!("{}", t::icon_fail(&format!("Search failed: {}", e)));
                            std::process::exit(1);
                        }
                    }
                }
                Some(ClawHubSub::Trending { category, limit }) => {
                    match sm.trending(category.as_deref(), Some(limit)) {
                        Ok(entries) => {
                            if entries.is_empty() {
                                println!("{}", t::muted("No trending skills found."));
                            } else {
                                let header = match &category {
                                    Some(cat) => format!("Trending skills in '{}':", cat),
                                    None => "Trending skills on ClawHub:".into(),
                                };
                                println!("{}", t::accent_bright(&header));
                                for (i, e) in entries.iter().enumerate() {
                                    println!(
                                        "  {}. {} — {} (★{} ↓{})",
                                        i + 1,
                                        e.name,
                                        e.description,
                                        e.stars,
                                        e.downloads,
                                    );
                                }
                            }
                        }
                        Err(e) => {
                            println!(
                                "{}",
                                t::icon_fail(&format!("Failed to fetch trending: {}", e))
                            );
                            std::process::exit(1);
                        }
                    }
                }
                Some(ClawHubSub::Categories) => match sm.categories() {
                    Ok(cats) => {
                        if cats.is_empty() {
                            println!("{}", t::muted("No categories found."));
                        } else {
                            println!("{}", t::accent_bright("ClawHub skill categories:"));
                            for c in &cats {
                                let count = if c.count > 0 {
                                    format!(" ({})", c.count)
                                } else {
                                    String::new()
                                };
                                println!("  • {}{} — {}", c.name, count, c.description);
                            }
                            println!();
                            println!(
                                "Browse by category: {} trending <category>",
                                t::muted("rustyclaw clawhub")
                            );
                        }
                    }
                    Err(e) => {
                        println!(
                            "{}",
                            t::icon_fail(&format!("Failed to fetch categories: {}", e))
                        );
                        std::process::exit(1);
                    }
                },
                Some(ClawHubSub::Info { name }) => match sm.registry_info(&name) {
                    Ok(detail) => {
                        println!(
                            "{}",
                            t::accent_bright(&format!("{}  v{}", detail.name, detail.version))
                        );
                        if !detail.description.is_empty() {
                            println!("  {}", detail.description);
                        }
                        if !detail.author.is_empty() {
                            println!("  Author: {}", detail.author);
                        }
                        if !detail.license.is_empty() {
                            println!("  License: {}", detail.license);
                        }
                        println!("  ★ {}  ↓ {}", detail.stars, detail.downloads);
                        if let Some(ref repo) = detail.repository {
                            println!("  Repo: {}", repo);
                        }
                        if !detail.categories.is_empty() {
                            println!("  Categories: {}", detail.categories.join(", "));
                        }
                        if !detail.required_secrets.is_empty() {
                            println!("  Requires secrets: {}", detail.required_secrets.join(", "));
                        }
                        if !detail.updated_at.is_empty() {
                            println!("  Updated: {}", detail.updated_at);
                        }
                    }
                    Err(e) => {
                        println!(
                            "{}",
                            t::icon_fail(&format!("Failed to fetch skill info: {}", e))
                        );
                        std::process::exit(1);
                    }
                },
                Some(ClawHubSub::Browse) => {
                    let url = sm.registry_url().to_string();
                    println!("Opening {} …", t::info(&url));
                    #[cfg(target_os = "macos")]
                    let _ = std::process::Command::new("open").arg(&url).spawn();
                    #[cfg(target_os = "linux")]
                    let _ = std::process::Command::new("xdg-open").arg(&url).spawn();
                    #[cfg(target_os = "windows")]
                    let _ = std::process::Command::new("cmd")
                        .args(["/C", "start", &url])
                        .spawn();
                }
                Some(ClawHubSub::Profile) => match sm.profile() {
                    Ok(p) => {
                        println!(
                            "{}",
                            t::accent_bright(&format!("ClawHub profile: {}", p.username))
                        );
                        if !p.display_name.is_empty() {
                            println!("  Name: {}", p.display_name);
                        }
                        if !p.bio.is_empty() {
                            println!("  Bio: {}", p.bio);
                        }
                        println!(
                            "  Published: {}  Starred: {}",
                            p.published_count, p.starred_count
                        );
                        if !p.joined.is_empty() {
                            println!("  Joined: {}", p.joined);
                        }
                    }
                    Err(e) => {
                        println!(
                            "{}",
                            t::icon_fail(&format!("Failed to fetch profile: {}", e))
                        );
                        std::process::exit(1);
                    }
                },
                Some(ClawHubSub::Starred) => match sm.starred() {
                    Ok(entries) => {
                        if entries.is_empty() {
                            println!("{}", t::muted("No starred skills."));
                            println!(
                                "Star skills with: {} star <name>",
                                t::muted("rustyclaw clawhub")
                            );
                        } else {
                            println!("{} starred skill(s):", entries.len());
                            for e in &entries {
                                println!(
                                    "  ★ {} v{} by {} — {}",
                                    e.name, e.version, e.author, e.description,
                                );
                            }
                        }
                    }
                    Err(e) => {
                        println!(
                            "{}",
                            t::icon_fail(&format!("Failed to fetch starred: {}", e))
                        );
                        std::process::exit(1);
                    }
                },
                Some(ClawHubSub::Star { name }) => match sm.star(&name) {
                    Ok(msg) => println!("{}", t::icon_ok(&msg)),
                    Err(e) => {
                        println!("{}", t::icon_fail(&format!("Star failed: {}", e)));
                        std::process::exit(1);
                    }
                },
                Some(ClawHubSub::Unstar { name }) => match sm.unstar(&name) {
                    Ok(msg) => println!("{}", t::icon_ok(&msg)),
                    Err(e) => {
                        println!("{}", t::icon_fail(&format!("Unstar failed: {}", e)));
                        std::process::exit(1);
                    }
                },
                Some(ClawHubSub::Install { name, version }) => {
                    match sm.install_from_registry(&name, version.as_deref()) {
                        Ok(skill) => {
                            println!(
                                "{}",
                                t::icon_ok(&format!(
                                    "Skill '{}' installed from ClawHub.",
                                    skill.name
                                ))
                            );
                        }
                        Err(e) => {
                            println!("{}", t::icon_fail(&format!("Install failed: {}", e)));
                            std::process::exit(1);
                        }
                    }
                }
                Some(ClawHubSub::Publish { name }) => match sm.publish_to_registry(&name) {
                    Ok(msg) => println!("{}", t::icon_ok(&msg)),
                    Err(e) => {
                        println!("{}", t::icon_fail(&format!("Publish failed: {}", e)));
                        std::process::exit(1);
                    }
                },
            }
        }
    }

    Ok(())
}

// ═══════════════════════════════════════════════════════════════════════════
//  Helpers
// ═══════════════════════════════════════════════════════════════════════════

/// Parse the default gateway port and bind address from Config.
/// If `gateway_url` is set (e.g. "ws://127.0.0.1:9001"), extract host/port
/// from it.  Otherwise fall back to 127.0.0.1:9001.
/// Extract the vault password for the gateway daemon.
///
/// If the vault is password-protected, prompt the user for it.  The
/// password will be passed to the daemon via an environment variable
/// so it can open the secrets vault on startup.
fn extract_vault_password(config: &Config) -> Option<String> {
    if !config.secrets_password_protected {
        return None;
    }
    match prompt_password(&format!(
        "{} Vault password (for gateway): ",
        rustyclaw_core::theme::info("🔑"),
    )) {
        Ok(pw) if !pw.is_empty() => Some(pw),
        _ => None,
    }
}

/// Open the secrets vault, prompting for a password and TOTP if required.
///
/// NOTE: Under the new security model, TOTP is only verified by the
/// gateway at WebSocket connect time.  The CLI `open_secrets` is only
/// used during onboarding and ad-hoc CLI vault access.
fn open_secrets(config: &Config) -> Result<SecretsManager> {
    let mut manager = if config.secrets_password_protected {
        let pw = prompt_password("Enter secrets vault password: ")?;
        SecretsManager::with_password(config.credentials_dir(), pw)
    } else {
        SecretsManager::new(config.credentials_dir())
    };

    // If TOTP 2FA is enabled, verify before returning.
    if config.totp_enabled {
        loop {
            let code = prompt_password("Enter your 2FA code: ")?;
            match manager.verify_totp(code.trim()) {
                Ok(true) => break,
                Ok(false) => {
                    eprintln!("Invalid code. Please try again.");
                }
                Err(e) => {
                    anyhow::bail!("2FA verification failed: {}", e);
                }
            }
        }
    }

    Ok(manager)
}

fn prompt_password(prompt: &str) -> Result<String> {
    use std::io::{self, Write};
    print!("{}", prompt);
    io::stdout().flush()?;
    let input = rpassword::read_password().context("Failed to read password")?;
    Ok(input.trim().to_string())
}

// ── Status ──────────────────────────────────────────────────────────────────

fn print_status(config: &Config, args: &StatusArgs) {
    if args.json {
        // Minimal JSON blob — extend as features land.
        println!("{{");
        println!("  \"settings_dir\": \"{}\",", config.settings_dir.display());
        println!(
            "  \"workspace_dir\": \"{}\",",
            config.workspace_dir().display()
        );
        if let Some(m) = &config.model {
            println!("  \"provider\": \"{}\",", m.provider);
            if let Some(model) = &m.model {
                println!("  \"model\": \"{}\",", model);
            }
        }
        if let Some(gw) = &config.gateway_url {
            println!("  \"gateway_url\": \"{}\"", gw);
        }
        println!("}}");
    } else {
        use rustyclaw_core::theme as t;
        println!("{}\n", t::heading("RustyClaw status"));
        println!(
            "{}",
            t::label_value("Settings dir", &config.settings_dir.display().to_string())
        );
        println!(
            "{}",
            t::label_value(
                "Workspace   ",
                &config.workspace_dir().display().to_string()
            )
        );
        if let Some(m) = &config.model {
            println!("{}", t::label_value("Provider    ", &m.provider));
            if let Some(model) = &m.model {
                println!("{}", t::label_value("Model       ", model));
            }
        } else {
            println!(
                "  {} : {}",
                t::muted("Provider    "),
                t::warn(&format!(
                    "(not configured — run {})",
                    t::accent_bright("`rustyclaw onboard`")
                ))
            );
        }
        if let Some(gw) = &config.gateway_url {
            println!("{}", t::label_value("Gateway URL ", gw));
        }
        if args.verbose || args.all {
            println!(
                "{}",
                t::label_value("SOUL.md     ", &config.soul_path().display().to_string())
            );
            println!(
                "{}",
                t::label_value("Skills dir  ", &config.skills_dir().display().to_string())
            );
            println!(
                "{}",
                t::label_value(
                    "Credentials ",
                    &config.credentials_dir().display().to_string()
                )
            );
        }
    }
}

// ── Config get / set / unset helpers ────────────────────────────────────────

fn config_get(config: &Config, path: &str) -> String {
    match path {
        "settings_dir" => config.settings_dir.display().to_string(),
        "workspace_dir" | "workspace" => config.workspace_dir().display().to_string(),
        "soul_path" | "soul" => config.soul_path().display().to_string(),
        "skills_dir" | "skills" => config.skills_dir().display().to_string(),
        "gateway_url" | "gateway" => config
            .gateway_url
            .as_deref()
            .unwrap_or("(not set)")
            .to_string(),
        "model.provider" | "provider" => config
            .model
            .as_ref()
            .map(|m| m.provider.clone())
            .unwrap_or_else(|| "(not set)".into()),
        "model.model" | "model" => config
            .model
            .as_ref()
            .and_then(|m| m.model.clone())
            .unwrap_or_else(|| "(not set)".into()),
        "secrets_password_protected" => config.secrets_password_protected.to_string(),
        _ => format!("(unknown config path: {})", path),
    }
}

fn config_set(config: &mut Config, path: &str, value: &str) -> Result<()> {
    match path {
        "workspace_dir" | "workspace" => {
            config.workspace_dir = Some(value.into());
        }
        "soul_path" | "soul" => {
            config.soul_path = Some(value.into());
        }
        "skills_dir" | "skills" => {
            config.skills_dir = Some(value.into());
        }
        "gateway_url" | "gateway" => {
            config.gateway_url = Some(value.to_string());
        }
        "model.provider" | "provider" => {
            let m = config
                .model
                .get_or_insert_with(|| rustyclaw_core::config::ModelProvider {
                    provider: String::new(),
                    model: None,
                    base_url: None,
                });
            m.provider = value.to_string();
        }
        "model.model" | "model" => {
            let m = config
                .model
                .get_or_insert_with(|| rustyclaw_core::config::ModelProvider {
                    provider: String::new(),
                    model: None,
                    base_url: None,
                });
            m.model = Some(value.to_string());
        }
        _ => anyhow::bail!("Unknown config path: {}", path),
    }
    Ok(())
}

fn config_unset(config: &mut Config, path: &str) -> Result<()> {
    match path {
        "workspace_dir" | "workspace" => config.workspace_dir = None,
        "soul_path" | "soul" => config.soul_path = None,
        "skills_dir" | "skills" => config.skills_dir = None,
        "gateway_url" | "gateway" => config.gateway_url = None,
        "model" | "model.provider" | "model.model" => config.model = None,
        _ => anyhow::bail!("Unknown config path: {}", path),
    }
    Ok(())
}

// ── Refresh Token from OpenClaw ─────────────────────────────────────────────

fn run_refresh_token(args: &RefreshTokenArgs, config: &mut Config) -> Result<()> {
    use colored::Colorize;
    use std::fs;

    let openclaw_dir = args
        .openclaw_dir
        .as_ref()
        .map(PathBuf::from)
        .unwrap_or_else(|| dirs::home_dir().unwrap_or_default().join(".openclaw"));

    let token_file = openclaw_dir.join("credentials/github-copilot.token.json");

    if !token_file.exists() {
        anyhow::bail!(
            "GitHub Copilot token file not found at: {}\nRun `openclaw onboard` first to authenticate.",
            token_file.display()
        );
    }

    let content = fs::read_to_string(&token_file)
        .with_context(|| format!("Failed to read {}", token_file.display()))?;

    let json: serde_json::Value =
        serde_json::from_str(&content).with_context(|| "Failed to parse token file as JSON")?;

    let token = json
        .get("token")
        .and_then(|v| v.as_str())
        .ok_or_else(|| anyhow::anyhow!("Token file missing 'token' field"))?;

    let expires_at = json
        .get("expiresAt")
        .and_then(|v| v.as_i64())
        .ok_or_else(|| anyhow::anyhow!("Token file missing 'expiresAt' field"))?;

    // expiresAt is in milliseconds, convert to seconds
    let expires_at_secs = expires_at / 1000;
    let now = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .unwrap_or_default()
        .as_secs() as i64;

    if expires_at_secs <= now + 60 {
        anyhow::bail!("OpenClaw token has expired. Run `openclaw onboard` to re-authenticate.");
    }

    let hours_left = (expires_at_secs - now) / 3600;
    let mins_left = ((expires_at_secs - now) % 3600) / 60;

    // Store in RustyClaw's vault
    let mut secrets = open_secrets(config)?;
    let session_data = serde_json::json!({
        "session_token": token,
        "expires_at": expires_at_secs,
    });
    secrets.store_secret("GITHUB_COPILOT_SESSION", &session_data.to_string())?;

    println!(
        "{} Imported GitHub Copilot session token (~{}h {}m remaining)",
        "✓".green(),
        hours_left,
        mins_left
    );

    if args.restart {
        println!("{}", "Restarting gateway...".cyan());
        // Send SIGHUP to gateway if running
        let pid_file = config.settings_dir.join("gateway.pid");
        if pid_file.exists() {
            if let Ok(pid_str) = fs::read_to_string(&pid_file) {
                if let Ok(pid) = pid_str.trim().parse::<i32>() {
                    #[cfg(unix)]
                    {
                        unsafe {
                            libc::kill(pid, libc::SIGHUP);
                        }
                        println!(
                            "{} Sent reload signal to gateway (pid {})",
                            "✓".green(),
                            pid
                        );
                    }
                    #[cfg(not(unix))]
                    {
                        let _ = pid; // Suppress unused warning
                        println!("{}", "Signal sending not supported on Windows. Please restart gateway manually.".yellow());
                    }
                }
            }
        } else {
            println!("{}", "Gateway not running (no pid file).".yellow());
        }
    } else {
        println!(
            "{}",
            "Restart the gateway to use the new token: rustyclaw gateway restart".dimmed()
        );
    }

    Ok(())
}

// ── Import from OpenClaw ────────────────────────────────────────────────────

fn run_import(args: &ImportArgs, config: &mut Config) -> Result<()> {
    use colored::Colorize;
    use rpassword::read_password;
    use std::fs;
    use std::io::{BufRead, Write};
    use std::path::PathBuf;

    let stdin = std::io::stdin();
    let mut reader = stdin.lock();

    let home = dirs::home_dir().context("Could not determine home directory")?;
    let source_dir = args
        .source
        .as_ref()
        .map(PathBuf::from)
        .unwrap_or_else(|| home.join(".openclaw"));

    if !source_dir.exists() {
        anyhow::bail!(
            "OpenClaw directory not found: {}\n\
             Specify the path with: rustyclaw import /path/to/.openclaw",
            source_dir.display()
        );
    }

    let target_dir = args
        .target
        .as_ref()
        .map(PathBuf::from)
        .unwrap_or_else(|| home.join(".rustyclaw"));

    println!();
    println!("{}", "━".repeat(60).dimmed());
    println!("{}", "  RustyClaw Import Wizard".cyan().bold());
    println!("{}", "━".repeat(60).dimmed());
    println!();
    println!(
        "  {} {}",
        "From:".bold(),
        source_dir.display().to_string().yellow()
    );
    println!(
        "  {}   {}",
        "To:".bold(),
        target_dir.display().to_string().green()
    );

    if args.dry_run {
        println!();
        println!("{}", "  (dry run — no changes will be made)".dimmed());
    }

    // ── Detect what's available to import ───────────────────────────────
    let source_workspace = source_dir.join("workspace");
    let source_credentials = source_dir.join("credentials");
    let openclaw_config_path = source_dir.join("openclaw.json");

    let has_workspace = source_workspace.exists();
    let has_credentials = source_credentials.exists();
    let has_config = openclaw_config_path.exists();

    println!();
    println!("{}", "  Available to import:".bold());
    if has_config {
        println!("    {} Configuration (model, settings)", "•".cyan());
    }
    if has_workspace {
        println!(
            "    {} Workspace files (SOUL.md, memory/, etc.)",
            "•".cyan()
        );
    }
    if has_credentials {
        println!("    {} API credentials", "•".cyan());
    }
    println!();

    // ── Confirm import ──────────────────────────────────────────────────
    print!("{} ", "Proceed with import? [Y/n]:".cyan());
    std::io::stdout().flush()?;
    let mut response = String::new();
    reader.read_line(&mut response)?;
    if response.trim().eq_ignore_ascii_case("n") {
        println!("  {}", "Import cancelled.".yellow());
        return Ok(());
    }

    // Create target directories
    let target_workspace = target_dir.join("workspace");
    let target_credentials = target_dir.join("credentials");

    if !args.dry_run {
        fs::create_dir_all(&target_dir).context("Failed to create target directory")?;
        fs::create_dir_all(&target_workspace).context("Failed to create workspace directory")?;
        fs::create_dir_all(&target_credentials)
            .context("Failed to create credentials directory")?;
    }

    let mut imported_count = 0;
    let mut skipped_count = 0;

    // ── Import configuration ────────────────────────────────────────────
    if has_config {
        println!();
        println!("{}", "━".repeat(60).dimmed());
        println!("{}", "Configuration".cyan().bold());
        println!("{}", "━".repeat(60).dimmed());

        if let Ok(content) = fs::read_to_string(&openclaw_config_path) {
            if let Ok(oc_config) = serde_json::from_str::<serde_json::Value>(&content) {
                if let Some(model_str) = oc_config
                    .pointer("/agents/defaults/model/primary")
                    .and_then(|v| v.as_str())
                {
                    let parts: Vec<&str> = model_str.splitn(2, '/').collect();
                    if parts.len() == 2 {
                        config.model = Some(rustyclaw_core::config::ModelProvider {
                            provider: parts[0].to_string(),
                            model: Some(parts[1].to_string()),
                            base_url: None,
                        });
                        println!("  {} Model: {}", "✓".green(), model_str.cyan());
                        imported_count += 1;
                    }
                }
            }
        }
    }

    // ── Import workspace files ──────────────────────────────────────────
    if has_workspace {
        println!();
        println!("{}", "━".repeat(60).dimmed());
        println!("{}", "Workspace Files".cyan().bold());
        println!("{}", "━".repeat(60).dimmed());

        print!(
            "{} ",
            "Import workspace files (SOUL.md, AGENTS.md, memory/, etc.)? [Y/n]:".cyan()
        );
        std::io::stdout().flush()?;
        let mut response = String::new();
        reader.read_line(&mut response)?;

        if !response.trim().eq_ignore_ascii_case("n") {
            let workspace_files = [
                "SOUL.md",
                "AGENTS.md",
                "TOOLS.md",
                "USER.md",
                "IDENTITY.md",
                "HEARTBEAT.md",
                "MEMORY.md",
            ];

            for file in &workspace_files {
                let src = source_workspace.join(file);
                let dst = target_workspace.join(file);

                if src.exists() {
                    if dst.exists() && !args.force {
                        println!(
                            "  {} {} (exists, use --force to overwrite)",
                            "⊘".yellow(),
                            file
                        );
                        skipped_count += 1;
                    } else {
                        if !args.dry_run {
                            fs::copy(&src, &dst)
                                .with_context(|| format!("Failed to copy {}", file))?;
                        }
                        println!("  {} {}", "✓".green(), file);
                        imported_count += 1;
                    }
                }
            }

            // Import memory/ directory
            let src_memory = source_workspace.join("memory");
            let dst_memory = target_workspace.join("memory");
            if src_memory.exists() && src_memory.is_dir() {
                if !args.dry_run {
                    fs::create_dir_all(&dst_memory)?;
                }

                let mut memory_count = 0;
                for entry in fs::read_dir(&src_memory)? {
                    let entry = entry?;
                    let path = entry.path();
                    if path.is_file() {
                        let file_name = path.file_name().unwrap();
                        let dst_file = dst_memory.join(file_name);

                        if dst_file.exists() && !args.force {
                            skipped_count += 1;
                        } else {
                            if !args.dry_run {
                                fs::copy(&path, &dst_file)?;
                            }
                            memory_count += 1;
                        }
                    }
                }
                if memory_count > 0 {
                    println!("  {} memory/ ({} files)", "✓".green(), memory_count);
                    imported_count += memory_count;
                }
            }

            // Import skills/ directory (recursive)
            let src_skills = source_workspace.join("skills");
            let dst_skills = target_workspace.join("skills");
            if src_skills.exists() && src_skills.is_dir() {
                if !args.dry_run {
                    fs::create_dir_all(&dst_skills)?;
                }

                let mut skills_count = 0;
                fn copy_dir_recursive(
                    src: &std::path::Path,
                    dst: &std::path::Path,
                    dry_run: bool,
                    force: bool,
                    count: &mut usize,
                    skipped: &mut usize,
                ) -> Result<()> {
                    if !dry_run {
                        fs::create_dir_all(dst)?;
                    }
                    for entry in fs::read_dir(src)? {
                        let entry = entry?;
                        let path = entry.path();
                        let file_name = path.file_name().unwrap();
                        let dst_path = dst.join(file_name);

                        if path.is_dir() {
                            copy_dir_recursive(&path, &dst_path, dry_run, force, count, skipped)?;
                        } else {
                            if dst_path.exists() && !force {
                                *skipped += 1;
                            } else {
                                if !dry_run {
                                    fs::copy(&path, &dst_path)?;
                                }
                                *count += 1;
                            }
                        }
                    }
                    Ok(())
                }

                copy_dir_recursive(
                    &src_skills,
                    &dst_skills,
                    args.dry_run,
                    args.force,
                    &mut skills_count,
                    &mut skipped_count,
                )?;

                if skills_count > 0 {
                    println!("  {} skills/ ({} files)", "✓".green(), skills_count);
                    imported_count += skills_count;
                }
            }

            // Extract agent name from IDENTITY.md as default, then prompt
            let mut default_name = String::new();
            let identity_path = source_workspace.join("IDENTITY.md");
            if identity_path.exists() {
                if let Ok(content) = fs::read_to_string(&identity_path) {
                    // Look for "- **Name:** <name>" pattern
                    for line in content.lines() {
                        let line = line.trim();
                        if line.starts_with("- **Name:**") || line.starts_with("**Name:**") {
                            if let Some(name) = line.split(":**").nth(1) {
                                let name = name.trim();
                                if !name.is_empty() {
                                    default_name = name.to_string();
                                }
                            }
                            break;
                        }
                    }
                }
            }

            // Prompt for agent name with default from IDENTITY.md
            println!();
            if default_name.is_empty() {
                print!("{} ", "Agent name:".cyan());
            } else {
                print!("{} ", format!("Agent name [{}]:", default_name).cyan());
            }
            std::io::stdout().flush()?;
            let mut name_input = String::new();
            reader.read_line(&mut name_input)?;
            let name_input = name_input.trim();

            if name_input.is_empty() && !default_name.is_empty() {
                config.agent_name = default_name.clone();
                println!("  {} Agent name: {}", "✓".green(), default_name.cyan());
            } else if !name_input.is_empty() {
                config.agent_name = name_input.to_string();
                println!("  {} Agent name: {}", "✓".green(), name_input.cyan());
            } else {
                println!("  {}", "Using default agent name.".dimmed());
            }
        } else {
            println!("  {}", "Skipping workspace files.".dimmed());
        }
    }

    // ── Credentials import ──────────────────────────────────────────────
    if has_credentials {
        println!();
        println!("{}", "━".repeat(60).dimmed());
        println!("{}", "Credentials".cyan().bold());
        println!("{}", "━".repeat(60).dimmed());

        // List available credentials
        let credential_files = [
            ("github-copilot.token.json", "GitHub Copilot"),
            ("anthropic.key", "Anthropic"),
            ("openai.key", "OpenAI"),
            ("openrouter.key", "OpenRouter"),
            ("opencode.key", "OpenCode Zen"),
            ("gemini.key", "Gemini"),
            ("xai.key", "xAI"),
        ];

        let mut found_creds: Vec<(&str, &str)> = Vec::new();
        for (file, name) in &credential_files {
            if source_credentials.join(file).exists() {
                found_creds.push((file, name));
            }
        }

        if found_creds.is_empty() {
            println!("  {}", "No credentials found to import.".dimmed());
        } else {
            println!("  Found credentials:");
            for (_, name) in &found_creds {
                println!("    {} {}", "•".cyan(), name);
            }
            println!();

            print!("{} ", "Import these credentials? [Y/n]:".cyan());
            std::io::stdout().flush()?;
            let mut response = String::new();
            reader.read_line(&mut response)?;

            if !response.trim().eq_ignore_ascii_case("n") {
                // Need to release stdin lock before password prompt
                drop(reader);

                // ── Vault security setup ────────────────────────────────
                println!();
                println!("{}", "━".repeat(60).dimmed());
                println!("{}", "Vault Security Setup".cyan().bold());
                println!("{}", "━".repeat(60).dimmed());
                println!();
                println!("  Your credentials will be stored in an encrypted vault.");
                println!("  You can add a password for additional security.");
                println!();
                println!(
                    "  {}  With a password, you'll need to enter it each time",
                    "⚠".yellow()
                );
                println!("     you start the agent. Without one, an auto-generated");
                println!("     key file protects the vault instead.");
                println!();

                let mut secrets = SecretsManager::new(&target_credentials);

                // Password setup
                print!("{} ", "Vault password (leave blank to skip):".cyan());
                std::io::stdout().flush()?;
                let password = read_password().unwrap_or_default();

                if password.trim().is_empty() {
                    println!("  {}", "✓ Using auto-generated key file.".green());
                    config.secrets_password_protected = false;
                } else {
                    print!("{} ", "Confirm password:".cyan());
                    std::io::stdout().flush()?;
                    let confirm = read_password().unwrap_or_default();

                    if password != confirm {
                        anyhow::bail!("Passwords do not match. Import cancelled.");
                    }

                    secrets.set_password(password);
                    config.secrets_password_protected = true;
                    println!("  {}", "✓ Vault will be password-protected.".green());
                }

                // Re-acquire stdin for TOTP setup
                let stdin = std::io::stdin();
                let mut reader = stdin.lock();

                // TOTP setup
                println!();
                println!("{}", "Two-Factor Authentication (optional)".cyan().bold());
                println!();
                println!("  Add TOTP 2FA using any authenticator app.");
                println!();

                print!("{} ", "Enable 2FA? [y/N]:".cyan());
                std::io::stdout().flush()?;
                let mut response = String::new();
                reader.read_line(&mut response)?;

                if response.trim().eq_ignore_ascii_case("y") {
                    // Initialize vault
                    if !args.dry_run {
                        secrets.store_secret("__init", "")?;
                        secrets.delete_secret("__init")?;
                    }

                    let account = std::env::var("USER")
                        .or_else(|_| std::env::var("USERNAME"))
                        .unwrap_or_else(|_| "user".to_string());
                    let agent_name = config.agent_name.clone();

                    if !args.dry_run {
                        let otpauth_url = secrets.setup_totp_with_issuer(&account, &agent_name)?;

                        println!();
                        println!("  {}", "Scan this QR code:".bold());
                        println!();
                        print_qr_code_import(&otpauth_url);
                        println!();
                        println!("  {}", otpauth_url.dimmed());
                        println!();

                        loop {
                            print!("{} ", "Enter 6-digit code to verify:".cyan());
                            std::io::stdout().flush()?;
                            let mut code = String::new();
                            reader.read_line(&mut code)?;
                            let code = code.trim();

                            if code.is_empty() {
                                println!("  {}", "⚠ 2FA setup cancelled.".yellow());
                                secrets.remove_totp()?;
                                break;
                            }

                            match secrets.verify_totp(code) {
                                Ok(true) => {
                                    config.totp_enabled = true;
                                    println!("  {}", "✓ 2FA enabled.".green());
                                    break;
                                }
                                Ok(false) => {
                                    println!("  {}", "⚠ Invalid code. Try again:".yellow());
                                }
                                Err(e) => {
                                    println!(
                                        "  {}",
                                        format!("⚠ Error: {}. 2FA not enabled.", e).yellow()
                                    );
                                    secrets.remove_totp()?;
                                    break;
                                }
                            }
                        }
                    }
                } else {
                    println!("  {}", "Skipping 2FA.".dimmed());
                }

                // Now import the credentials
                println!();
                println!("{}", "Importing credentials...".cyan());

                let secret_map = [
                    ("github-copilot.token.json", "GITHUB_COPILOT_TOKEN"),
                    ("anthropic.key", "ANTHROPIC_API_KEY"),
                    ("openai.key", "OPENAI_API_KEY"),
                    ("openrouter.key", "OPENROUTER_API_KEY"),
                    ("opencode.key", "OPENCODE_API_KEY"),
                    ("gemini.key", "GEMINI_API_KEY"),
                    ("xai.key", "XAI_API_KEY"),
                ];

                for (file, secret_name) in &secret_map {
                    // GitHub Copilot: try to import the session token directly
                    if *file == "github-copilot.token.json" {
                        let src = source_credentials.join(file);
                        if src.exists() {
                            if let Ok(content) = fs::read_to_string(&src) {
                                if let Ok(json) =
                                    serde_json::from_str::<serde_json::Value>(&content)
                                {
                                    let token = json.get("token").and_then(|v| v.as_str());
                                    let expires_at = json.get("expiresAt").and_then(|v| v.as_i64());

                                    if let (Some(token), Some(expires_at)) = (token, expires_at) {
                                        // expiresAt is in milliseconds, convert to seconds
                                        let expires_at_secs = expires_at / 1000;
                                        let now = std::time::SystemTime::now()
                                            .duration_since(std::time::UNIX_EPOCH)
                                            .unwrap_or_default()
                                            .as_secs()
                                            as i64;

                                        if expires_at_secs > now + 300 {
                                            // Token still valid for at least 5 minutes
                                            // Store as JSON with token and expiration
                                            let session_data = serde_json::json!({
                                                "session_token": token,
                                                "expires_at": expires_at_secs,
                                            });
                                            if !args.dry_run {
                                                secrets.store_secret(
                                                    "GITHUB_COPILOT_SESSION",
                                                    &session_data.to_string(),
                                                )?;
                                            }
                                            let hours_left = (expires_at_secs - now) / 3600;
                                            println!(
                                                "  {} {} (session token, ~{}h remaining)",
                                                "✓".green(),
                                                secret_name,
                                                hours_left
                                            );
                                            imported_count += 1;
                                            continue;
                                        } else {
                                            println!(
                                                "  {} {} (session expired, needs re-auth)",
                                                "⊘".yellow(),
                                                secret_name
                                            );
                                        }
                                    }
                                }
                            }
                        }
                        // Fall through to re-auth prompt below
                        skipped_count += 1;
                        continue;
                    }

                    let src = source_credentials.join(file);
                    if src.exists() {
                        if let Ok(content) = fs::read_to_string(&src) {
                            let token = if file.ends_with(".json") {
                                serde_json::from_str::<serde_json::Value>(&content)
                                    .ok()
                                    .and_then(|json| {
                                        json.get("access_token")
                                            .or_else(|| json.get("token"))
                                            .and_then(|v| v.as_str())
                                            .map(|s| s.to_string())
                                    })
                                    .or_else(|| Some(content.trim().to_string()))
                            } else {
                                Some(content.trim().to_string())
                            };

                            if let Some(token) = token {
                                if !token.is_empty() && !args.dry_run {
                                    secrets.store_secret(secret_name, &token)?;
                                    println!("  {} {}", "✓".green(), secret_name);
                                    imported_count += 1;
                                }
                            }
                        }
                    }
                }

                // Prompt for GitHub Copilot re-authentication
                println!();
                println!("{}", "GitHub Copilot Authentication".cyan().bold());
                println!("  OpenClaw stores session tokens that can't be migrated.");
                println!("  You'll need to re-authenticate with GitHub.");
                println!();
                print!("{} ", "Authenticate with GitHub Copilot now? [Y/n]:".cyan());
                std::io::stdout().flush()?;
                let mut response = String::new();
                reader.read_line(&mut response)?;

                if !response.trim().eq_ignore_ascii_case("n") {
                    // Re-use the device flow auth
                    use providers::GITHUB_COPILOT_DEVICE_FLOW;
                    let device_config = &GITHUB_COPILOT_DEVICE_FLOW;

                    println!();
                    println!("{}", "Starting GitHub device flow...".cyan());

                    let handle = tokio::runtime::Handle::current();
                    match tokio::task::block_in_place(|| {
                        handle.block_on(providers::start_device_flow(device_config))
                    }) {
                        Ok(auth_response) => {
                            println!();
                            println!("  {}", "Please complete the following steps:".bold());
                            println!();
                            println!("  1. Visit: {}", auth_response.verification_uri.cyan());
                            println!("  2. Enter code: {}", auth_response.user_code.cyan().bold());
                            println!();

                            print!(
                                "{} ",
                                "Press Enter after completing authorization (or type 'cancel'):"
                                    .cyan()
                            );
                            std::io::stdout().flush()?;
                            let mut response = String::new();
                            reader.read_line(&mut response)?;

                            if !response.trim().eq_ignore_ascii_case("cancel")
                                && !response.trim().eq_ignore_ascii_case("c")
                            {
                                println!("  {}", "Waiting for authorization...".dimmed());

                                let interval =
                                    std::time::Duration::from_secs(auth_response.interval);
                                let max_attempts =
                                    (auth_response.expires_in / auth_response.interval).max(10);

                                let mut token: Option<String> = None;
                                for _attempt in 0..max_attempts {
                                    match tokio::task::block_in_place(|| {
                                        handle.block_on(providers::poll_device_token(
                                            device_config,
                                            &auth_response.device_code,
                                        ))
                                    }) {
                                        Ok(Some(access_token)) => {
                                            token = Some(access_token);
                                            break;
                                        }
                                        Ok(None) => {
                                            print!(".");
                                            std::io::stdout().flush()?;
                                            std::thread::sleep(interval);
                                        }
                                        Err(e) => {
                                            println!();
                                            println!(
                                                "  {}",
                                                format!("⚠ Authentication failed: {}", e).yellow()
                                            );
                                            break;
                                        }
                                    }
                                }
                                println!();

                                if let Some(access_token) = token {
                                    if !args.dry_run {
                                        secrets
                                            .store_secret("GITHUB_COPILOT_TOKEN", &access_token)?;
                                    }
                                    println!("  {}", "✓ GitHub Copilot authenticated!".green());
                                    imported_count += 1;
                                } else {
                                    println!("  {}", "⚠ Authentication timed out.".yellow());
                                }
                            } else {
                                println!("  {}", "Skipping GitHub Copilot.".dimmed());
                            }
                        }
                        Err(e) => {
                            println!(
                                "  {}",
                                format!("⚠ Failed to start device flow: {}", e).yellow()
                            );
                        }
                    }
                } else {
                    println!("  {}", "Skipping GitHub Copilot.".dimmed());
                }
            } else {
                println!("  {}", "Skipping credentials.".dimmed());
            }
        }
    }

    // ── Save config ─────────────────────────────────────────────────────
    if !args.dry_run {
        config.settings_dir = target_dir.clone();
        config.workspace_dir = Some(target_workspace.clone());
        config.credentials_dir = Some(target_credentials);
        config.save(Some(target_dir.join("config.toml")))?;
    }

    // ── Summary ─────────────────────────────────────────────────────────
    println!();
    println!("{}", "━".repeat(60).dimmed());
    println!(
        "{} Import complete: {} items imported, {} skipped",
        "✓".green().bold(),
        imported_count.to_string().green(),
        skipped_count.to_string().yellow()
    );

    if config.secrets_password_protected {
        println!("  🔒 Vault is password-protected");
    }
    if config.totp_enabled {
        println!("  🔐 2FA is enabled");
    }

    if args.dry_run {
        println!();
        println!("{}", "Run without --dry-run to apply changes.".dimmed());
    } else {
        println!();
        println!(
            "{} Saved to {}",
            "✓".green(),
            target_dir.join("config.toml").display()
        );
        println!();
        println!(
            "{} Run {} to launch your agent!",
            "→".cyan(),
            "rustyclaw tui".green()
        );
    }

    Ok(())
}

/// Print a QR code to the terminal (simplified version for import)
fn print_qr_code_import(data: &str) {
    use qrcode::{QrCode, render::unicode};

    if let Ok(code) = QrCode::new(data.as_bytes()) {
        let image = code
            .render::<unicode::Dense1x2>()
            .dark_color(unicode::Dense1x2::Light)
            .light_color(unicode::Dense1x2::Dark)
            .build();
        for line in image.lines() {
            println!("    {}", line);
        }
    } else {
        println!("  (Could not generate QR code)");
    }
}

fn run_local_command(config: &mut Config, input: &str) -> Result<()> {
    let mut secrets_manager = open_secrets(config)?;
    let skills_dir = config.skills_dir();
    let mut skill_manager = SkillManager::new(skills_dir);
    skill_manager.load_skills()?;

    let mut context = CommandContext {
        secrets_manager: &mut secrets_manager,
        skill_manager: &mut skill_manager,
        config,
    };

    let response = handle_command(input, &mut context);
    if response.action == CommandAction::ClearMessages {
        for message in response.messages {
            println!("{}", message);
        }
        return Ok(());
    }

    if response.action == CommandAction::Quit {
        return Ok(());
    }

    for message in response.messages {
        println!("{}", message);
    }

    Ok(())
}

/// Send a reload command to the running gateway and wait for the result.
async fn send_gateway_reload(gateway_url: &str, totp_enabled: bool) -> Result<(String, String)> {
    let url = Url::parse(gateway_url).context("Invalid gateway URL")?;

    let (ws_stream, _) = tokio_tungstenite::connect_async(url.to_string())
        .await
        .context("Failed to connect to gateway. Is it running?")?;
    let (mut writer, mut reader) = ws_stream.split();

    // Handle auth challenge if TOTP is enabled
    if totp_enabled {
        loop {
            let msg = match reader.next().await {
                Some(m) => m,
                None => anyhow::bail!("Connection closed"),
            };
            let msg = msg.context("Gateway read error")?;
            // Handle both binary and text frames (for backwards compat during transition)
            match msg {
                Message::Binary(data) => {
                    if let Ok(frame) = deserialize_frame::<ServerFrame>(&data) {
                        match frame.frame_type {
                            ServerFrameType::AuthChallenge => {
                                if let ServerPayload::AuthChallenge { method: _ } = frame.payload {
                                    let code = rpassword::prompt_password(format!(
                                        "{} 2FA code: ",
                                        rustyclaw_core::theme::info("🔑")
                                    ))
                                    .unwrap_or_default();
                                    let auth_frame = ClientFrame {
                                        frame_type: ClientFrameType::AuthResponse,
                                        payload: ClientPayload::AuthResponse {
                                            code: code.trim().to_string(),
                                        },
                                    };
                                    let bytes = serialize_frame(&auth_frame)
                                        .map_err(|e| anyhow::anyhow!("serialize failed: {}", e))?;
                                    writer.send(Message::Binary(bytes.into())).await?;
                                }
                            }
                            ServerFrameType::AuthResult => {
                                if let ServerPayload::AuthResult {
                                    ok,
                                    message,
                                    retry: _,
                                } = frame.payload
                                {
                                    if !ok {
                                        let msg = message.as_deref().unwrap_or("Auth failed");
                                        anyhow::bail!("{}", msg);
                                    }
                                    break; // Auth succeeded
                                }
                            }
                            ServerFrameType::Hello => {
                                break; // No auth needed
                            }
                            _ => {}
                        }
                    }
                }
                Message::Text(text) => {
                    // Also handle text frames for backwards compat
                    if let Ok(val) = serde_json::from_str::<serde_json::Value>(text.as_ref()) {
                        let frame_type = val.get("type").and_then(|t| t.as_str());
                        if frame_type == Some("auth_challenge") {
                            let code = rpassword::prompt_password(format!(
                                "{} 2FA code: ",
                                rustyclaw_core::theme::info("🔑")
                            ))
                            .unwrap_or_default();
                            let auth_frame = ClientFrame {
                                frame_type: ClientFrameType::AuthResponse,
                                payload: ClientPayload::AuthResponse {
                                    code: code.trim().to_string(),
                                },
                            };
                            let bytes = serialize_frame(&auth_frame)
                                .map_err(|e| anyhow::anyhow!("serialize failed: {}", e))?;
                            writer.send(Message::Binary(bytes.into())).await?;
                            continue;
                        }
                        if frame_type == Some("auth_result") {
                            let ok = val.get("ok").and_then(|o| o.as_bool()).unwrap_or(false);
                            if !ok {
                                let msg = val
                                    .get("message")
                                    .and_then(|m| m.as_str())
                                    .unwrap_or("Auth failed");
                                anyhow::bail!("{}", msg);
                            }
                            break;
                        }
                        if frame_type == Some("hello") {
                            break;
                        }
                    }
                }
                _ => {}
            }
        }
    }

    // Wait for hello frame
    let mut _result_provider = String::new();
    let mut _result_model = String::new();
    loop {
        match reader.next().await {
            Some(Ok(Message::Binary(data))) => {
                if let Ok(frame) = deserialize_frame::<ServerFrame>(&data) {
                    match frame.frame_type {
                        ServerFrameType::Hello => {
                            if let ServerPayload::Hello {
                                provider, model, ..
                            } = frame.payload
                            {
                                _result_provider = provider.unwrap_or_default();
                                _result_model = model.unwrap_or_default();
                                break;
                            }
                        }
                        ServerFrameType::AuthChallenge => {
                            // Handle TOTP even when totp_enabled was false in config
                            if totp_enabled {
                                let code = rpassword::prompt_password(format!(
                                    "{} 2FA code: ",
                                    rustyclaw_core::theme::info("🔑")
                                ))
                                .unwrap_or_default();
                                let auth_frame = ClientFrame {
                                    frame_type: ClientFrameType::AuthResponse,
                                    payload: ClientPayload::AuthResponse {
                                        code: code.trim().to_string(),
                                    },
                                };
                                let bytes = serialize_frame(&auth_frame)
                                    .map_err(|e| anyhow::anyhow!("serialize failed: {}", e))?;
                                writer.send(Message::Binary(bytes.into())).await?;
                            }
                        }
                        _ => {}
                    }
                }
            }
            Some(Ok(Message::Text(text))) => {
                // Also handle text frames for backwards compat
                if let Ok(val) = serde_json::from_str::<serde_json::Value>(text.as_ref()) {
                    let frame_type = val.get("type").and_then(|t| t.as_str());
                    if frame_type == Some("hello") || frame_type == Some("auth_challenge") {
                        if frame_type == Some("auth_challenge") && !totp_enabled {
                            let code = rpassword::prompt_password(format!(
                                "{} 2FA code: ",
                                rustyclaw_core::theme::info("🔑")
                            ))
                            .unwrap_or_default();
                            let auth_frame = ClientFrame {
                                frame_type: ClientFrameType::AuthResponse,
                                payload: ClientPayload::AuthResponse {
                                    code: code.trim().to_string(),
                                },
                            };
                            let bytes = serialize_frame(&auth_frame)
                                .map_err(|e| anyhow::anyhow!("serialize failed: {}", e))?;
                            writer.send(Message::Binary(bytes.into())).await?;
                            continue;
                        }
                        let provider = val
                            .get("provider")
                            .and_then(|p| p.as_str())
                            .unwrap_or("")
                            .to_string();
                        let model = val
                            .get("model")
                            .and_then(|m| m.as_str())
                            .unwrap_or("")
                            .to_string();
                        _result_provider = provider;
                        _result_model = model;
                        break;
                    }
                }
            }
            Some(Ok(Message::Close(_))) => {
                anyhow::bail!("Gateway closed connection");
            }
            None => {
                anyhow::bail!("Gateway disconnected");
            }
            _ => {}
        }
    }

    // Drain remaining status frames briefly
    let drain_timeout = tokio::time::sleep(std::time::Duration::from_millis(500));
    tokio::pin!(drain_timeout);
    loop {
        tokio::select! {
            _ = &mut drain_timeout => break,
            msg = reader.next() => {
                match msg {
                    Some(Ok(Message::Text(text))) => {
                        if let Ok(val) = serde_json::from_str::<serde_json::Value>(text.as_ref()) {
                            let ft = val.get("type").and_then(|t| t.as_str());
                            if ft == Some("status") || ft == Some("model_configured") || ft == Some("model_ready") || ft == Some("model_error") {
                                continue; // Skip status frames
                            }
                        }
                        break; // Non-status frame, stop draining
                    }
                    Some(Ok(_)) => continue,
                    Some(Err(e)) => anyhow::bail!("Gateway error during drain: {}", e),
                    None => anyhow::bail!("Gateway closed unexpectedly"),
                }
            }
        }
    }

    // Send reload command using binary frame
    let reload_frame = ClientFrame {
        frame_type: ClientFrameType::Reload,
        payload: ClientPayload::Reload,
    };
    let bytes =
        serialize_frame(&reload_frame).map_err(|e| anyhow::anyhow!("serialize failed: {}", e))?;
    writer
        .send(Message::Binary(bytes.into()))
        .await
        .context("Failed to send reload command")?;

    // Wait for reload_result
    let timeout = tokio::time::sleep(std::time::Duration::from_secs(10));
    tokio::pin!(timeout);

    loop {
        tokio::select! {
            _ = &mut timeout => {
                anyhow::bail!("Timeout waiting for reload result");
            }
            msg = reader.next() => {
                match msg {
                    Some(Ok(Message::Binary(data))) => {
                        if let Ok(frame) = deserialize_frame::<ServerFrame>(&data) {
                            match frame.frame_type {
                                ServerFrameType::ReloadResult => {
                                    if let ServerPayload::ReloadResult { ok, provider, model, message } = frame.payload {
                                        if ok {
                                            // Close cleanly
                                            let _ = writer.send(Message::Close(None)).await;
                                            return Ok((provider, model));
                                        } else {
                                            let msg = message.as_deref().unwrap_or("Unknown error");
                                            anyhow::bail!("{}", msg);
                                        }
                                    }
                                }
                                _ => continue,
                            }
                        }
                    }
                    Some(Ok(Message::Text(text))) => {
                        if let Ok(val) = serde_json::from_str::<serde_json::Value>(text.as_ref()) {
                            let frame_type = val.get("type").and_then(|t| t.as_str());
                            if frame_type == Some("reload_result") {
                                let ok = val.get("ok").and_then(|o| o.as_bool()).unwrap_or(false);
                                if ok {
                                    let provider = val.get("provider").and_then(|p| p.as_str()).unwrap_or("unknown").to_string();
                                    let model = val.get("model").and_then(|m| m.as_str()).unwrap_or("unknown").to_string();
                                    // Close cleanly
                                    let _ = writer.send(Message::Close(None)).await;
                                    return Ok((provider, model));
                                } else {
                                    let msg = val.get("message").and_then(|m| m.as_str()).unwrap_or("Unknown error");
                                    anyhow::bail!("{}", msg);
                                }
                            }
                            // Skip other frames (status updates from reload)
                            continue;
                        }
                    }
                    Some(Ok(_)) => continue,
                    Some(Err(e)) => anyhow::bail!("Gateway error: {}", e),
                    None => anyhow::bail!("Gateway closed without reload result"),
                }
            }
        }
    }
}

async fn send_command_via_gateway(gateway_url: &str, command: &str) -> Result<String> {
    let url = Url::parse(gateway_url).context("Invalid gateway URL")?;

    let (ws_stream, _) = tokio_tungstenite::connect_async(url.to_string())
        .await
        .context("Failed to connect to gateway")?;
    let (mut writer, mut reader) = ws_stream.split();
    writer
        .send(Message::Text(command.to_string().into()))
        .await
        .context("Failed to send command")?;

    while let Some(message) = reader.next().await {
        let message = message.context("Gateway read error")?;
        if let Message::Text(text) = message {
            return Ok(text.to_string());
        }
    }

    anyhow::bail!("Gateway closed without responding")
}

/// Handle the `ask` command — headless model interaction.
async fn handle_ask(config: &Config, args: AskArgs) -> Result<()> {
    use rustyclaw_core::gateway::protocol::{
        ClientFrame, ClientFrameType, ClientPayload, ServerFrame, ServerFrameType, ServerPayload,
        deserialize_frame, serialize_frame,
    };
    use rustyclaw_core::gateway::protocol::types::ChatMessage;
    use std::io::{self, Read};

    // Gather the prompt
    let prompt = if args.stdin {
        let mut buf = String::new();
        io::stdin().read_to_string(&mut buf)?;
        if !args.prompt.is_empty() {
            // Prepend CLI args to stdin content
            format!("{}\n\n{}", args.prompt.join(" "), buf)
        } else {
            buf
        }
    } else {
        args.prompt.join(" ")
    };

    let prompt = prompt.trim().to_string();
    if prompt.is_empty() {
        anyhow::bail!("No prompt provided. Use `rustyclaw ask 'your prompt'` or `--stdin`.");
    }

    // Determine gateway URL
    let gateway_url = args
        .gateway
        .or_else(|| config.gateway_url.clone())
        .unwrap_or_else(|| "ws://127.0.0.1:9001".to_string());

    // Connect to gateway
    let url = Url::parse(&gateway_url).context("Invalid gateway URL")?;
    let (ws_stream, _) = tokio_tungstenite::connect_async(url.to_string())
        .await
        .context("Failed to connect to gateway. Is it running? Try `rustyclaw gateway start`")?;
    let (mut writer, mut reader) = ws_stream.split();

    // Handle auth if needed (simplified — skip TOTP for now)
    // TODO: Add TOTP support for headless mode

    // Build the chat message
    let message = ChatMessage::text("user", &prompt);

    // Send as ClientFrame
    let frame = ClientFrame {
        frame_type: ClientFrameType::Chat,
        payload: ClientPayload::Chat {
            messages: vec![message],
        },
    };
    let bytes = serialize_frame(&frame).map_err(|e| anyhow::anyhow!("serialize failed: {}", e))?;
    writer.send(Message::Binary(bytes.into())).await?;

    // Collect response
    let mut response_text = String::new();
    let mut tool_outputs: Vec<String> = Vec::new();

    while let Some(message) = reader.next().await {
        let message = message.context("Gateway read error")?;

        match message {
            Message::Binary(data) => {
                if let Ok(frame) = deserialize_frame::<ServerFrame>(&data) {
                    match frame.frame_type {
                        ServerFrameType::Chunk => {
                            if let ServerPayload::Chunk { delta } = frame.payload {
                                if !args.json {
                                    // Stream text to stdout
                                    print!("{}", delta);
                                    io::Write::flush(&mut io::stdout())?;
                                }
                                response_text.push_str(&delta);
                            }
                        }
                        ServerFrameType::ResponseDone => {
                            // Model finished
                            if !args.json {
                                println!(); // Final newline
                            }
                            break;
                        }
                        ServerFrameType::ToolCall => {
                            if let ServerPayload::ToolCall { id: _, name, .. } = frame.payload {
                                if !args.json {
                                    eprintln!("  → {}", name);
                                }
                            }
                        }
                        ServerFrameType::ToolResult => {
                            if let ServerPayload::ToolResult {
                                id: _,
                                name,
                                result,
                                ..
                            } = frame.payload
                            {
                                tool_outputs.push(format!("{}: {}", name, result));
                            }
                        }
                        ServerFrameType::Error => {
                            if let ServerPayload::Error { message, .. } = frame.payload {
                                anyhow::bail!("Gateway error: {}", message);
                            }
                        }
                        ServerFrameType::Info => {
                            if let ServerPayload::Info { message } = frame.payload {
                                if !args.json {
                                    eprintln!("  ℹ {}", message);
                                }
                            }
                        }
                        _ => {}
                    }
                }
            }
            Message::Text(text) => {
                // Legacy text frame — just print it
                if !args.json {
                    print!("{}", text);
                }
                response_text.push_str(&text);
            }
            Message::Close(_) => break,
            _ => {}
        }
    }

    // JSON output if requested
    if args.json {
        let output = serde_json::json!({
            "response": response_text,
            "tool_calls": tool_outputs,
        });
        println!("{}", serde_json::to_string_pretty(&output)?);
    }

    Ok(())
}