server.mjs

import 'dotenv/config';
import express from 'express';
import { fileURLToPath } from 'url';
import path from 'path';
import fs from 'fs';
import https from 'https';
import http from 'http';
import { spawn } from 'child_process';
import { tmpdir } from 'os';
import { mkdtempSync, writeFileSync, rmSync } from 'fs';
import { randomUUID, randomBytes, createHash } from 'crypto';
import { createServer } from 'http';
import { WebSocketServer } from 'ws';
import { createRequire } from 'module';
import { Client, GatewayIntentBits, Events } from 'discord.js';

// node-pty ships as CJS; use createRequire for ESM compatibility
const require = createRequire(import.meta.url);
const pty = require('node-pty');

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const app = express();
const PORT = parseInt(process.env.REPLIT_SERVER_PORT || '3001', 10);

app.use(express.json({ limit: '8mb' }));

app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', '*');
  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
  if (req.method === 'OPTIONS') return res.sendStatus(200);
  next();
});

// ---------------------------------------------------------------------------
// Discord Activity — OAuth2 token exchange endpoint
// ---------------------------------------------------------------------------

app.post('/api/token', async (req, res) => {
  try {
    const clientId = process.env.VITE_DISCORD_CLIENT_ID;
    const clientSecret = process.env.DISCORD_CLIENT_SECRET;
    if (!clientId || !clientSecret) {
      console.error('[Discord] Token exchange: VITE_DISCORD_CLIENT_ID or DISCORD_CLIENT_SECRET not set');
      return res.status(500).json({ error: 'Discord OAuth2 credentials not configured on server' });
    }

    const body = new URLSearchParams({
      client_id: clientId,
      client_secret: clientSecret,
      grant_type: 'authorization_code',
      code: req.body.code,
      redirect_uri: 'https://127.0.0.1',
    });

    const response = await fetch('https://discord.com/api/oauth2/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body,
    });
    const data = await response.json();
    if (!response.ok) {
      console.error('[Discord] Token exchange error from Discord:', JSON.stringify(data));
      return res.status(response.status).json({ error: data.error_description || data.error });
    }
    console.log('[Discord] Token exchange successful');
    res.json({ access_token: data.access_token });
  } catch (err) {
    console.error('[Discord] Token exchange exception:', err.message);
    res.status(500).json({ error: err.message });
  }
});

// ---------------------------------------------------------------------------
// OAuth — userinfo + token refresh for "Login with Code Canvas" external apps
// ---------------------------------------------------------------------------

app.get('/api/oauth/userinfo', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Missing or invalid Authorization header' });
    }
    const token = authHeader.slice(7);
    const SUPABASE_URL = process.env.VITE_SUPABASE_URL;
    const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
      return res.status(500).json({ error: 'Supabase not configured on server' });
    }
    const resp = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
      headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY },
    });
    if (!resp.ok) {
      return res.status(401).json({ error: 'Token invalid or expired' });
    }
    const userData = await resp.json();
    const userId = userData.id;
    if (!userId) {
      return res.status(401).json({ error: 'Could not identify user from token' });
    }
    const profileResp = await fetch(`${SUPABASE_URL}/rest/v1/profiles?user_id=eq.${userId}&select=*`, {
      headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY, 'Content-Type': 'application/json' },
    });
    let profile = null;
    if (profileResp.ok) {
      const profiles = await profileResp.json();
      profile = Array.isArray(profiles) && profiles.length > 0 ? profiles[0] : null;
    }
    res.json({
      id: userId,
      email: userData.email || null,
      display_name: profile?.display_name || null,
      avatar_url: profile?.avatar_url || null,
    });
  } catch (err) {
    console.error('[OAuth] userinfo error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.post('/api/oauth/token/refresh', async (req, res) => {
  try {
    const { refresh_token } = req.body || {};
    if (!refresh_token) {
      return res.status(400).json({ error: 'refresh_token required' });
    }
    const SUPABASE_URL = process.env.VITE_SUPABASE_URL;
    const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
      return res.status(500).json({ error: 'Supabase not configured on server' });
    }
    const resp = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', apikey: SUPABASE_ANON_KEY },
      body: JSON.stringify({ refresh_token }),
    });
    const data = await resp.json();
    if (!resp.ok) {
      return res.status(401).json({ error: data.error_description || data.error || 'Refresh failed' });
    }
    res.json({
      access_token: data.access_token,
      refresh_token: data.refresh_token,
      expires_in: data.expires_in,
    });
  } catch (err) {
    console.error('[OAuth] token refresh error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ---------------------------------------------------------------------------
// OAuth — create a Redactor proxy key for the external app
// ---------------------------------------------------------------------------

app.post('/api/oauth/redactor/proxy-keys', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Missing or invalid Authorization header' });
    }
    const token = authHeader.slice(7);
    const SUPABASE_URL = process.env.VITE_SUPABASE_URL;
    const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
      return res.status(500).json({ error: 'Supabase not configured on server' });
    }

    // Validate token and get user
    const userResp = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
      headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY },
    });
    if (!userResp.ok) {
      return res.status(401).json({ error: 'Token invalid or expired' });
    }
    const userData = await userResp.json();
    const userId = userData.id;
    if (!userId) return res.status(401).json({ error: 'Could not identify user from token' });

    // Generate proxy key
    const raw = randomBytes(32);
    const randomStr = Array.from(raw).map((b) => b.toString(36).padStart(2, '0')).join('');
    const fullKey = `lvp_live_${randomStr}`;
    const prefix = fullKey.slice(0, 16);
    const hash = createHash('sha256').update(fullKey).digest('hex');

    const { name, allowed_providers, rate_limit_rpm, monthly_cap_usd, ip_allowlist, log_requests, redact_images, redact_videos, expires_at } = req.body || {};

    // Insert via Supabase REST API (JWT auth passes user context for RLS)
    const insertResp = await fetch(`${SUPABASE_URL}/rest/v1/redactor_proxy_keys`, {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${token}`,
        apikey: SUPABASE_ANON_KEY,
        'Content-Type': 'application/json',
        Prefer: 'return=representation',
      },
      body: JSON.stringify({
        key_hash: hash,
        key_prefix: prefix,
        name: name || 'OAuth-generated key',
        allowed_providers: allowed_providers || [],
        rate_limit_rpm: rate_limit_rpm || null,
        monthly_cap_usd: monthly_cap_usd || null,
        ip_allowlist: ip_allowlist || [],
        log_requests: log_requests !== undefined ? log_requests : true,
        redact_images: redact_images !== undefined ? redact_images : true,
        redact_videos: redact_videos !== undefined ? redact_videos : true,
        expires_at: expires_at || null,
      }),
    });

    if (!insertResp.ok) {
      const errBody = await insertResp.text();
      console.error('[OAuth] Failed to insert proxy key:', errBody);
      return res.status(500).json({ error: 'Failed to create proxy key' });
    }

    const inserted = await insertResp.json();
    const row = Array.isArray(inserted) ? inserted[0] : inserted;

    res.status(201).json({
      id: row.id,
      name: row.name,
      key: fullKey,
      prefix: row.key_prefix,
      allowed_providers: row.allowed_providers,
      rate_limit_rpm: row.rate_limit_rpm,
      monthly_cap_usd: row.monthly_cap_usd,
      expires_at: row.expires_at,
      created_at: row.created_at,
    });
  } catch (err) {
    console.error('[OAuth] proxy key creation error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ---------------------------------------------------------------------------
// OAuth — list external app's Redactor proxy keys
// ---------------------------------------------------------------------------

app.get('/api/oauth/redactor/proxy-keys', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Missing or invalid Authorization header' });
    }
    const token = authHeader.slice(7);
    const SUPABASE_URL = process.env.VITE_SUPABASE_URL;
    const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
      return res.status(500).json({ error: 'Supabase not configured on server' });
    }

    const userResp = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
      headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY },
    });
    if (!userResp.ok) return res.status(401).json({ error: 'Token invalid or expired' });
    const userData = await userResp.json();
    if (!userData.id) return res.status(401).json({ error: 'Could not identify user from token' });

    const keysResp = await fetch(`${SUPABASE_URL}/rest/v1/redactor_proxy_keys?order=created_at.desc`, {
      headers: {
        Authorization: `Bearer ${token}`,
        apikey: SUPABASE_ANON_KEY,
        'Content-Type': 'application/json',
      },
    });
    if (!keysResp.ok) {
      return res.status(500).json({ error: 'Failed to fetch proxy keys' });
    }
    const keys = await keysResp.json();
    res.json(Array.isArray(keys) ? keys : []);
  } catch (err) {
    console.error('[OAuth] list proxy keys error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ---------------------------------------------------------------------------
// OAuth — revoke a Redactor proxy key
// ---------------------------------------------------------------------------

app.post('/api/oauth/redactor/proxy-keys/:id/revoke', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Missing or invalid Authorization header' });
    }
    const token = authHeader.slice(7);
    const SUPABASE_URL = process.env.VITE_SUPABASE_URL;
    const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
      return res.status(500).json({ error: 'Supabase not configured on server' });
    }

    const userResp = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
      headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY },
    });
    if (!userResp.ok) return res.status(401).json({ error: 'Token invalid or expired' });
    const userData = await userResp.json();
    if (!userData.id) return res.status(401).json({ error: 'Could not identify user from token' });

    const { id } = req.params;
    const updateResp = await fetch(`${SUPABASE_URL}/rest/v1/redactor_proxy_keys?id=eq.${id}`, {
      method: 'PATCH',
      headers: {
        Authorization: `Bearer ${token}`,
        apikey: SUPABASE_ANON_KEY,
        'Content-Type': 'application/json',
        Prefer: 'return=representation',
      },
      body: JSON.stringify({ revoked_at: new Date().toISOString() }),
    });

    if (!updateResp.ok) {
      return res.status(500).json({ error: 'Failed to revoke proxy key' });
    }

    res.json({ ok: true });
  } catch (err) {
    console.error('[OAuth] revoke proxy key error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ---------------------------------------------------------------------------
// OAuth — AI chat via the user's configured AI providers
// ---------------------------------------------------------------------------

app.post('/api/oauth/ai/chat', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Missing or invalid Authorization header' });
    }
    const token = authHeader.slice(7);
    const SUPABASE_URL = process.env.VITE_SUPABASE_URL;
    const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
      return res.status(500).json({ error: 'Supabase not configured on server' });
    }

    const userResp = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
      headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY },
    });
    if (!userResp.ok) return res.status(401).json({ error: 'Token invalid or expired' });
    const userData = await userResp.json();
    const userId = userData.id;
    if (!userId) return res.status(401).json({ error: 'Could not identify user from token' });

    const { model, messages, temperature, max_tokens, provider: requestedProvider } = req.body || {};
    if (!messages || !Array.isArray(messages) || messages.length === 0) {
      return res.status(400).json({ error: 'messages array is required' });
    }

    // Look up user's API keys from server file store
    const userKeys = _aiKeys[userId] || {};

    // Also check Supabase user_api_keys table
    let supabaseKeys = [];
    try {
      const keysResp = await fetch(`${SUPABASE_URL}/rest/v1/user_api_keys?user_id=eq.${userId}&select=provider,api_key,base_url`, {
        headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY, 'Content-Type': 'application/json' },
      });
      if (keysResp.ok) {
        supabaseKeys = await keysResp.json();
      }
    } catch { /* fallback to server store only */ }

    for (const row of supabaseKeys) {
      if (!userKeys[row.provider]) {
        userKeys[row.provider] = { api_key: row.api_key, base_url: row.base_url || '' };
      }
    }

    // Find the provider to use
    let provider = requestedProvider || null;
    let keyData = provider ? userKeys[provider] : null;

    if (!provider || !keyData) {
      // Auto-select first available provider
      for (const p of Object.keys(BYOK_PROVIDERS)) {
        if (p === 'openai-compatible') continue;
        if (userKeys[p]) { provider = p; keyData = userKeys[p]; break; }
      }
    }

    if (!provider || !keyData || !keyData.api_key) {
      return res.status(503).json({ error: 'No AI API key configured for this user. They need to add one in their Code Canvas settings.' });
    }

    const isOpenAICompatible = provider === 'openai-compatible';
    const cfg = isOpenAICompatible
      ? { url: keyData.base_url || '', authHeader: 'Bearer' }
      : BYOK_PROVIDERS[provider];

    if (!cfg || !cfg.url) {
      return res.status(400).json({ error: `Unsupported provider: ${provider}` });
    }

    const effectiveModel = model || BYOK_DEFAULT_MODELS[provider] || 'gpt-4o';

    const body = {
      model: effectiveModel,
      messages,
      ...(temperature !== undefined ? { temperature } : {}),
      ...(max_tokens !== undefined ? { max_tokens } : {}),
    };

    const headers = { 'Content-Type': 'application/json' };
    if (cfg.authHeader === 'x-api-key') {
      headers['x-api-key'] = keyData.api_key;
      if (provider === 'anthropic') headers['anthropic-version'] = '2023-06-01';
    } else {
      headers['Authorization'] = `Bearer ${keyData.api_key}`;
    }

    const apiUrl = isOpenAICompatible
      ? `${cfg.url.replace(/\/$/, '')}/chat/completions`
      : cfg.url;

    const apiResp = await fetch(apiUrl, {
      method: 'POST',
      headers,
      body: JSON.stringify(body),
    });

    const data = await apiResp.json();

    if (!apiResp.ok) {
      const errMsg = data?.error?.message || data?.error || `Provider returned ${apiResp.status}`;
      return res.status(502).json({ error: errMsg, provider });
    }

    res.json(data);
  } catch (err) {
    console.error('[OAuth] AI chat error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ---------------------------------------------------------------------------
// OAuth — list the user's configured AI providers (no key values)
// ---------------------------------------------------------------------------

app.get('/api/oauth/ai/providers', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Missing or invalid Authorization header' });
    }
    const token = authHeader.slice(7);
    const SUPABASE_URL = process.env.VITE_SUPABASE_URL;
    const SUPABASE_ANON_KEY = process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
      return res.status(500).json({ error: 'Supabase not configured on server' });
    }

    const userResp = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
      headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY },
    });
    if (!userResp.ok) return res.status(401).json({ error: 'Token invalid or expired' });
    const userData = await userResp.json();
    const userId = userData.id;
    if (!userId) return res.status(401).json({ error: 'Could not identify user from token' });

    // Gather keys from both stores
    const serverKeys = Object.keys(_aiKeys[userId] || {});
    let supabaseKeys = [];
    try {
      const keysResp = await fetch(`${SUPABASE_URL}/rest/v1/user_api_keys?user_id=eq.${userId}&select=provider,base_url`, {
        headers: { Authorization: `Bearer ${token}`, apikey: SUPABASE_ANON_KEY, 'Content-Type': 'application/json' },
      });
      if (keysResp.ok) {
        supabaseKeys = await keysResp.json();
      }
    } catch { /* ignore */ }

    const providerSet = new Set([...serverKeys, ...supabaseKeys.map((k) => k.provider)]);
    const providers = Array.from(providerSet)
      .filter((p) => p && p !== 'openai-compatible')
      .sort();

    res.json({ providers });
  } catch (err) {
    console.error('[OAuth] list providers error:', err.message);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ---------------------------------------------------------------------------
// Discord bot — link Discord user to authenticated web user
// ---------------------------------------------------------------------------

app.post('/api/discord/link', (req, res) => {
  try {
    const { code } = req.body || {};
    const userId = req.headers['x-user-id'];
    if (!code || !userId) {
      return res.status(400).json({ error: 'Missing code or user id' });
    }

    let matchedDiscordId = null;
    for (const [discordUserId, link] of Object.entries(_discordLinks)) {
      if (link.authCode === code && !link.userId && link.authCodeExpiresAt > Date.now()) {
        matchedDiscordId = discordUserId;
        break;
      }
    }

    if (!matchedDiscordId) {
      return res.status(400).json({ error: 'Invalid or expired code. DM the bot again for a new code.' });
    }

    _discordLinks[matchedDiscordId].userId = userId;
    _discordLinks[matchedDiscordId].linkedAt = new Date().toISOString();
    delete _discordLinks[matchedDiscordId].authCode;
    delete _discordLinks[matchedDiscordId].authCodeExpiresAt;
    saveDiscordLinks();

    console.log(`[Discord Bot] Linked Discord user ${matchedDiscordId} to Code Canvas user ${userId}`);
    res.json({ ok: true, discordUserId: matchedDiscordId });
  } catch (err) {
    console.error('[Discord Bot] Link error:', err.message);
    res.status(500).json({ error: err.message });
  }
});

app.get('/api/discord/link-status', (req, res) => {
  try {
    const userId = req.headers['x-user-id'];
    if (!userId) return res.status(400).json({ error: 'Missing user id' });
    const linked = Object.entries(_discordLinks)
      .filter(([, link]) => link.userId === userId)
      .map(([discordUserId, link]) => ({
        discordUserId,
        discordUsername: link.discordUsername || null,
        linkedAt: link.linkedAt,
      }));
    res.json({ linked });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// ---------------------------------------------------------------------------
// Supabase proxy — allows Supabase API calls from within Discord's CSP-restricted iframe
// ---------------------------------------------------------------------------

function proxySupabase(targetUrl, req, res) {
  const parsedUrl = new URL(targetUrl);
  const protocol = parsedUrl.protocol === 'https:' ? https : http;
  const port = parsedUrl.port || (parsedUrl.protocol === 'https:' ? 443 : 80);
  const options = {
    method: req.method,
    headers: { ...req.headers },
    hostname: parsedUrl.hostname,
    path: parsedUrl.pathname + parsedUrl.search,
    port,
  };
  delete options.headers.host;
  delete options.headers.connection;
  delete options.headers.referer;
  const proxyReq = protocol.request(options, (proxyRes) => {
    const chunks = [];
    proxyRes.on('data', (chunk) => chunks.push(chunk));
    proxyRes.on('end', () => {
      const body = Buffer.concat(chunks);
      if (!res.headersSent) {
        res.writeHead(proxyRes.statusCode, { ...proxyRes.headers, 'access-control-allow-origin': '*' });
      }
      res.end(body);
    });
  });
  proxyReq.on('error', (err) => {
    if (!res.headersSent) res.status(502).json({ error: err.message });
  });
  if (req.method === 'GET' || req.method === 'HEAD') {
    proxyReq.end();
  } else if (req.body && typeof req.body === 'object') {
    const bodyStr = JSON.stringify(req.body);
    proxyReq.setHeader('content-length', Buffer.byteLength(bodyStr));
    proxyReq.end(bodyStr);
  } else {
    req.pipe(proxyReq, { end: true });
  }
}

// Catch-all for /api/supabase/* — proxies to the real Supabase instance
app.all('/api/supabase/{*path}', (req, res) => {
  const supabaseUrl = process.env.VITE_SUPABASE_URL;
  if (!supabaseUrl) return res.status(500).json({ error: 'VITE_SUPABASE_URL not configured' });
  const tail = Array.isArray(req.params.path) ? req.params.path.join('/') : req.params.path;
  const target = `${supabaseUrl}/${tail}`;
  proxySupabase(target, req, res);
});

// Redactor proxy — forwards /redactor/public/v1/* to the Supabase redactor-proxy edge function
app.all('/redactor/public/v1/{*path}', (req, res) => {
  const supabaseUrl = process.env.VITE_SUPABASE_URL;
  if (!supabaseUrl) return res.status(500).json({ error: 'VITE_SUPABASE_URL not configured' });
  const tail = Array.isArray(req.params.path) ? req.params.path.join('/') : req.params.path;
  const target = `${supabaseUrl}/functions/v1/redactor-proxy/v1/${tail}`;
  proxySupabase(target, req, res);
});

// ---------------------------------------------------------------------------
// Model Proxy — allows downloading models from HuggingFace/CDNs via our server
// to bypass strict client-side firewalls or VPNs.
// ---------------------------------------------------------------------------

function proxyRequest(targetUrl, req, res, redirects = 0) {
  if (redirects > 10) {
    return res.status(502).send('Too many redirects');
  }

  // console.log(`[Proxy] ${req.method} ${targetUrl} (redirects: ${redirects})`);

  const parsedUrl = new URL(targetUrl);
  const options = {
    method: req.method,
    headers: { ...req.headers },
    hostname: parsedUrl.hostname,
    path: parsedUrl.pathname + parsedUrl.search,
    port: parsedUrl.port || (parsedUrl.protocol === 'https:' ? 443 : 80),
  };

  // Strip headers that should not be forwarded
  delete options.headers.host;
  delete options.headers.connection;
  delete options.headers.referer;
  delete options.headers['content-length'];
  delete options.headers.cookie;
  delete options.headers.authorization;
  delete options.headers['set-cookie'];
  // Hugging Face can require a User-Agent and now requires auth for all downloads
  options.headers['user-agent'] = 'CanvasIDE/1.0';
  if (process.env.HF_TOKEN) {
    options.headers['Authorization'] = `Bearer ${process.env.HF_TOKEN}`;
  }

  const protocol = parsedUrl.protocol === 'https:' ? https : http;
  const proxyReq = protocol.request(options, (proxyRes) => {
    // Handle redirects (HuggingFace often redirects to S3)
    if (proxyRes.statusCode >= 300 && proxyRes.statusCode < 400 && proxyRes.headers.location) {
      let nextUrl = proxyRes.headers.location;
      if (!nextUrl.startsWith('http')) {
        nextUrl = new URL(nextUrl, targetUrl).href;
      }
      return proxyRequest(nextUrl, req, res, redirects + 1);
    }

    // Forward the response
    res.writeHead(proxyRes.statusCode, proxyRes.headers);
    proxyRes.pipe(res, { end: true });
  });

  proxyReq.on('error', (err) => {
    console.error(`Proxy error for ${targetUrl}:`, err.message);
    if (!res.headersSent) {
      res.status(502).json({ error: 'Proxy failed to reach target', message: err.message, target: targetUrl });
    }
  });

  if (req.method === 'GET') {
    proxyReq.end();
  } else {
    req.pipe(proxyReq, { end: true });
  }
}

app.get(/^\/api\/proxy\/hf\/(.*)/, (req, res) => {
  const targetUrl = `https://huggingface.co/${req.params[0]}`;
  proxyRequest(targetUrl, req, res);
});

app.get(/^\/api\/proxy\/jsdelivr\/(.*)/, (req, res) => {
  const targetUrl = `https://cdn.jsdelivr.net/${req.params[0]}`;
  proxyRequest(targetUrl, req, res);
});

app.get(/^\/api\/proxy\/unpkg\/(.*)/, (req, res) => {
  const targetUrl = `https://unpkg.com/${req.params[0]}`;
  proxyRequest(targetUrl, req, res);
});

// Backward/hosted compatibility aliases.
// Some deployments only expose /api/replit/* routes to the browser,
// so mirror the model proxy endpoints there as well.
app.get(/^\/api\/replit\/proxy\/hf\/(.*)/, (req, res) => {
  const targetUrl = `https://huggingface.co/${req.params[0]}`;
  proxyRequest(targetUrl, req, res);
});

app.get(/^\/api\/replit\/proxy\/jsdelivr\/(.*)/, (req, res) => {
  const targetUrl = `https://cdn.jsdelivr.net/${req.params[0]}`;
  proxyRequest(targetUrl, req, res);
});

app.get(/^\/api\/replit\/proxy\/unpkg\/(.*)/, (req, res) => {
  const targetUrl = `https://unpkg.com/${req.params[0]}`;
  proxyRequest(targetUrl, req, res);
});

// ---------------------------------------------------------------------------
// AI proxy — self-contained, calls AI provider APIs directly from the server
// so no Supabase session is needed. BYOK keys are stored per-user in memory
// and on disk (aikeys.json) so they survive server restarts.
// ---------------------------------------------------------------------------

const AI_KEYS_FILE = path.join(__dirname, 'aikeys.json');

// { [userId]: { [provider]: apiKey } }
let _aiKeys = {};
try {
  if (fs.existsSync(AI_KEYS_FILE)) {
    _aiKeys = JSON.parse(fs.readFileSync(AI_KEYS_FILE, 'utf8'));
    // Migrate old format to new object format
    for (const uid of Object.keys(_aiKeys)) {
      for (const provider of Object.keys(_aiKeys[uid])) {
        if (typeof _aiKeys[uid][provider] === 'string') {
          _aiKeys[uid][provider] = { api_key: _aiKeys[uid][provider], base_url: '' };
        }
      }
    }
  }
} catch { _aiKeys = {}; }

function saveAiKeys() {
  try { fs.writeFileSync(AI_KEYS_FILE, JSON.stringify(_aiKeys)); } catch {}
}

// MCP server local storage — mirrors aikeys approach so no Supabase needed.
// { [userId]: MCPServer[] }
const MCP_FILE = path.join(__dirname, 'mcpservers.json');
let _mcpServers = {};
try {
  if (fs.existsSync(MCP_FILE)) _mcpServers = JSON.parse(fs.readFileSync(MCP_FILE, 'utf8'));
} catch { _mcpServers = {}; }

function saveMcpServers() {
  try { fs.writeFileSync(MCP_FILE, JSON.stringify(_mcpServers)); } catch {}
}

// Agent skills local storage — persists custom AI instructions per user.
// { [userId]: AgentSkill[] }
const SKILLS_FILE = path.join(__dirname, 'agentskills.json');
let _agentSkills = {};
try {
  if (fs.existsSync(SKILLS_FILE)) _agentSkills = JSON.parse(fs.readFileSync(SKILLS_FILE, 'utf8'));
} catch { _agentSkills = {}; }

function saveAgentSkills() {
  try { fs.writeFileSync(SKILLS_FILE, JSON.stringify(_agentSkills)); } catch {}
}

// ---------------------------------------------------------------------------
// Discord link storage — maps Discord user IDs to Supabase user IDs
// ---------------------------------------------------------------------------

const DISCORD_LINKS_FILE = path.join(__dirname, 'discord-links.json');
let _discordLinks = {};
try {
  if (fs.existsSync(DISCORD_LINKS_FILE)) _discordLinks = JSON.parse(fs.readFileSync(DISCORD_LINKS_FILE, 'utf8'));
} catch { _discordLinks = {}; }
function saveDiscordLinks() {
  try { fs.writeFileSync(DISCORD_LINKS_FILE, JSON.stringify(_discordLinks)); } catch {}
}

// ---------------------------------------------------------------------------
// Discord chat history — per-user conversation state for DM AI chats
// ---------------------------------------------------------------------------

const DISCORD_CHATS_FILE = path.join(__dirname, 'discord-chats.json');
let _discordChats = {};
try {
  if (fs.existsSync(DISCORD_CHATS_FILE)) _discordChats = JSON.parse(fs.readFileSync(DISCORD_CHATS_FILE, 'utf8'));
} catch { _discordChats = {}; }
function saveDiscordChats() {
  try { fs.writeFileSync(DISCORD_CHATS_FILE, JSON.stringify(_discordChats)); } catch {}
}

function getReplitUserId(req) {
  return req.headers['x-replit-user-id'] || null;
}

// Provider endpoint configs (mirrors the edge function)
const BYOK_PROVIDERS = {
  openai:      { url: 'https://api.openai.com/v1/chat/completions',                          authHeader: 'Bearer' },
  anthropic:   { url: 'https://api.anthropic.com/v1/messages',                               authHeader: 'x-api-key' },
  gemini:      { url: 'https://generativelanguage.googleapis.com/v1beta/openai/chat/completions', authHeader: 'Bearer' },
  perplexity:  { url: 'https://api.perplexity.ai/chat/completions',                          authHeader: 'Bearer' },
  deepseek:    { url: 'https://api.deepseek.com/v1/chat/completions',                        authHeader: 'Bearer' },
  xai:         { url: 'https://api.x.ai/v1/chat/completions',                                authHeader: 'Bearer' },
  cohere:      { url: 'https://api.cohere.com/v2/chat',                                      authHeader: 'Bearer' },
  openrouter:  { url: 'https://openrouter.ai/api/v1/chat/completions',                       authHeader: 'Bearer' },
  pollinations:{ url: 'https://gen.pollinations.ai/v1/chat/completions',                     authHeader: 'Bearer' },
  github:      { url: 'https://models.inference.ai.azure.com/chat/completions',              authHeader: 'Bearer' },
  groq:        { url: 'https://api.groq.com/openai/v1/chat/completions',                     authHeader: 'Bearer' },
  'openai-compatible': { url: '',                                                           authHeader: 'Bearer' },
};

const BYOK_DEFAULT_MODELS = {
  openai: 'gpt-4o', anthropic: 'claude-3-5-sonnet-latest', gemini: 'gemini-2.5-flash',
  perplexity: 'sonar', deepseek: 'deepseek-chat', xai: 'grok-3-fast',
  cohere: 'command-r-plus', openrouter: 'openai/gpt-4o', pollinations: 'openai', github: 'gpt-4o',
  groq: 'llama-3.3-70b-versatile',
  'openai-compatible': 'custom-model',
};

// BYOK key management endpoints
app.get('/api/replit/ai/keys', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const userKeys = _aiKeys[uid] || {};
  const sanitized = Object.keys(userKeys).map(provider => ({
    id: `${uid}-${provider}`, provider, api_key: userKeys[provider].api_key,
    base_url: userKeys[provider].base_url || null,
    created_at: new Date().toISOString(), updated_at: new Date().toISOString(), user_id: uid,
  }));
  res.json(sanitized);
});

app.put('/api/replit/ai/keys', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { provider, api_key, base_url } = req.body || {};
  if (!provider || !api_key) return res.status(400).json({ error: 'provider and api_key required' });
  if (!_aiKeys[uid]) _aiKeys[uid] = {};
  _aiKeys[uid][provider] = { api_key, base_url: base_url || '' };
  saveAiKeys();
  res.json({ ok: true });
});

app.delete('/api/replit/ai/keys', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { provider } = req.query;
  if (!provider) return res.status(400).json({ error: 'provider required' });
  if (_aiKeys[uid]) { delete _aiKeys[uid][provider]; saveAiKeys(); }
  res.json({ ok: true });
});

// ---------------------------------------------------------------------------
// MCP server CRUD endpoints
// ---------------------------------------------------------------------------

app.get('/api/replit/ai/mcp-servers', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  res.json(_mcpServers[uid] || []);
});

app.post('/api/replit/ai/mcp-servers', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { name, url, description, api_key } = req.body || {};
  if (!name || !url) return res.status(400).json({ error: 'name and url required' });
  if (!_mcpServers[uid]) _mcpServers[uid] = [];
  const now = new Date().toISOString();
  const server = { id: randomUUID(), name, url, description: description || null, api_key: api_key || null, is_enabled: true, created_at: now, updated_at: now };
  _mcpServers[uid].unshift(server);
  saveMcpServers();
  res.json(server);
});

app.patch('/api/replit/ai/mcp-servers/:id', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { id } = req.params;
  const updates = req.body || {};
  if (!_mcpServers[uid]) return res.status(404).json({ error: 'Not found' });
  _mcpServers[uid] = _mcpServers[uid].map(s =>
    s.id === id ? { ...s, ...updates, id, updated_at: new Date().toISOString() } : s
  );
  saveMcpServers();
  res.json({ ok: true });
});

app.delete('/api/replit/ai/mcp-servers/:id', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { id } = req.params;
  if (_mcpServers[uid]) _mcpServers[uid] = _mcpServers[uid].filter(s => s.id !== id);
  saveMcpServers();
  res.json({ ok: true });
});

// ---------------------------------------------------------------------------
// Agent skills CRUD endpoints
// ---------------------------------------------------------------------------

app.get('/api/replit/ai/skills', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  res.json(_agentSkills[uid] || []);
});

app.post('/api/replit/ai/skills', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { name, instruction, description, icon } = req.body || {};
  if (!name || !instruction) return res.status(400).json({ error: 'name and instruction required' });
  if (!_agentSkills[uid]) _agentSkills[uid] = [];
  const now = new Date().toISOString();
  const skill = { id: randomUUID(), name, instruction, description: description || null, icon: icon || 'sparkles', is_enabled: true, created_at: now, updated_at: now };
  _agentSkills[uid].unshift(skill);
  saveAgentSkills();
  res.json(skill);
});

app.patch('/api/replit/ai/skills/:id', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { id } = req.params;
  const updates = req.body || {};
  if (!_agentSkills[uid]) return res.status(404).json({ error: 'Not found' });
  _agentSkills[uid] = _agentSkills[uid].map(s =>
    s.id === id ? { ...s, ...updates, id, updated_at: new Date().toISOString() } : s
  );
  saveAgentSkills();
  res.json({ ok: true });
});

app.delete('/api/replit/ai/skills/:id', (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { id } = req.params;
  if (_agentSkills[uid]) _agentSkills[uid] = _agentSkills[uid].filter(s => s.id !== id);
  saveAgentSkills();
  res.json({ ok: true });
});

// ---------------------------------------------------------------------------
// Skills library — VoltAgent/awesome-agent-skills (public GitHub, no API key)
// ---------------------------------------------------------------------------

const AGENT_SKILLS_README_URL = 'https://raw.githubusercontent.com/VoltAgent/awesome-agent-skills/main/README.md';

// Strip common prefix from section headers to get a clean author/category name
function cleanCategoryHeader(raw) {
  return raw
    .replace(/<[^>]+>/g, '') // remove HTML tags
    .replace(/^(Official\s+|Skills\s+by\s+|Skill\s+by\s+|Security\s+Skills\s+by\s+|Marketing\s+Skills\s+by\s+|Product\s+Manager\s+Skills\s+by\s+|Product\s+Management\s+Skills\s+by\s+|Advertising\s+Skills\s+by\s+)/i, '')
    .replace(/\s+Team$/i, '')
    .replace(/\s*❤️.*$/, '')
    .trim();
}

// Extract the org/author from a skill id like "anthropics/docx" → "Anthropic"
function parseAgentSkillsReadme(md) {
  const skills = [];
  const lines = md.split('\n');

  // Sections to skip entirely
  const SKIP_SECTIONS = new Set([
    'table of contents', 'sponsors', 'official skills by',
    'skill quality standards', 'contributing', 'community skills',
    'awesome agent skills',
  ]);

  let currentCategory = 'Community';

  for (const line of lines) {
    // <summary><h3>Official Claude Skills</h3></summary>  OR  ### Skills by VoltAgent
    const headerMatch =
      line.match(/^\s*#{2,4}\s+(.+)/) ||
      line.match(/<summary[^>]*><h[0-9][^>]*>([^<]+)<\/h[0-9]><\/summary>/i);
    if (headerMatch) {
      const raw = cleanCategoryHeader(headerMatch[1]);
      if (raw && !SKIP_SECTIONS.has(raw.toLowerCase())) {
        currentCategory = raw;
      }
      continue;
    }

    // Skill entry: - **[org/name](url)** - Description
    const skillMatch = line.match(/^\s*[-*]\s+\*\*\[([^\]]+)\]\(([^)]+)\)\*\*\s*(?:\\?[-–]|[-–])\s*(.+)/);
    if (skillMatch) {
      const id = skillMatch[1].trim();       // e.g. "anthropics/docx"
      const url = skillMatch[2].trim();
      const description = skillMatch[3].replace(/\\$/, '').trim();
      // Derive human-readable name: "anthropics/docx" → "docx" (keep id for uniqueness)
      const nameParts = id.split('/');
      const shortName = nameParts[nameParts.length - 1]
        .replace(/-/g, ' ')
        .replace(/\b\w/g, c => c.toUpperCase());
      const author = currentCategory;
      skills.push({
        id,
        name: shortName,
        fullName: id,
        description,
        url,
        category: currentCategory,
        author,
        stars: 0,
        instruction: null,
      });
    }
  }

  return skills;
}

let _libCache = null;
let _libCacheTime = 0;
const LIB_CACHE_TTL = 3600000; // 1 hour

async function fetchSkillsLibrary() {
  if (_libCache && (Date.now() - _libCacheTime) < LIB_CACHE_TTL) return _libCache;
  const resp = await fetch(AGENT_SKILLS_README_URL, { headers: { 'User-Agent': 'CodeCanvas-IDE/1.0' } });
  if (!resp.ok) throw new Error(`GitHub fetch failed: ${resp.status}`);
  const md = await resp.text();
  _libCache = parseAgentSkillsReadme(md);
  _libCacheTime = Date.now();
  return _libCache;
}

// Try to fetch the actual skill instruction from officialskills.sh (SSR page)
// or directly from a GitHub raw URL if the link points to GitHub.
async function fetchSkillContent(url, description) {
  try {
    // If the URL is a direct GitHub link, try to find the raw skill file
    if (url.includes('github.com') && !url.includes('officialskills.sh')) {
      // e.g. https://github.com/angular/skills  — just use description fallback
      return null;
    }

    // For officialskills.sh URLs, try fetching the page (Next.js SSR)
    const resp = await fetch(url, {
      headers: { 'User-Agent': 'Mozilla/5.0 (compatible; CodeCanvas-IDE/1.0)' },
      signal: AbortSignal.timeout(6000),
    });
    if (!resp.ok) return null;
    const html = await resp.text();

    // Try to find skill content in code blocks or <pre> tags
    const codeBlock = html.match(/<pre[^>]*><code[^>]*>([\s\S]{80,}?)<\/code><\/pre>/i);
    if (codeBlock) {
      return codeBlock[1]
        .replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&').replace(/&#39;/g, "'").replace(/&quot;/g, '"')
        .trim();
    }
    return null;
  } catch {
    return null;
  }
}

app.get('/api/replit/ai/skills/library', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { mode, category, search } = req.query;
  try {
    const allSkills = await fetchSkillsLibrary();

    if (!mode || mode === 'categories') {
      const catMap = {};
      for (const s of allSkills) catMap[s.category] = (catMap[s.category] || 0) + 1;
      const categories = Object.entries(catMap)
        .map(([label, count]) => ({ slug: label.toLowerCase().replace(/[^a-z0-9]+/g, '-'), label, description: '', count }))
        .sort((a, b) => b.count - a.count);
      return res.json({ categories });
    }

    if (mode === 'top') {
      // Return the first 40 (ordered as they appear in the README = by prestige)
      return res.json({ skills: allSkills.slice(0, 40) });
    }

    if (mode === 'category' && category) {
      const slug = String(category).toLowerCase();
      const filtered = allSkills.filter(s =>
        s.category.toLowerCase().replace(/[^a-z0-9]+/g, '-') === slug
      );
      return res.json({ skills: filtered });
    }

    if (mode === 'search' && search) {
      const q = String(search).toLowerCase();
      const filtered = allSkills.filter(s =>
        s.name.toLowerCase().includes(q) ||
        s.fullName.toLowerCase().includes(q) ||
        s.description.toLowerCase().includes(q) ||
        s.author.toLowerCase().includes(q)
      );
      return res.json({ skills: filtered.slice(0, 50) });
    }

    res.json({ skills: [], categories: [] });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// Fetch actual skill instruction content (best-effort, falls back to null)
app.get('/api/replit/ai/skills/fetch-content', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { url, description } = req.query;
  if (!url) return res.status(400).json({ error: 'url required' });
  try {
    const content = await fetchSkillContent(String(url), String(description || ''));
    res.json({ content });
  } catch (err) {
    res.json({ content: null });
  }
});

// Generate a shell command from a natural language prompt (for Terminal AI button)
app.post('/api/replit/ai/generate-command', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { prompt } = req.body || {};
  if (!prompt) return res.status(400).json({ error: 'prompt required' });
  const keys = _aiKeys[uid] || {};
  const provider = keys.openai ? 'openai' : keys.anthropic ? 'anthropic' : keys.google ? 'google' : null;
  const apiKey = provider ? keys[provider] : null;
  if (!apiKey) return res.status(400).json({ error: 'No AI API key configured. Add a key in Settings → AI Keys.' });
  const system = 'You are a shell command generator. Given a description, output ONLY the shell command — no explanation, no markdown, no backticks. One line only.';
  try {
    let command = null;
    if (provider === 'openai') {
      const r = await fetch('https://api.openai.com/v1/chat/completions', {
        method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
        body: JSON.stringify({ model: 'gpt-4o-mini', messages: [{ role: 'system', content: system }, { role: 'user', content: prompt }], max_tokens: 120 }),
      });
      const d = await r.json(); command = d.choices?.[0]?.message?.content?.trim();
    } else if (provider === 'anthropic') {
      const r = await fetch('https://api.anthropic.com/v1/messages', {
        method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' },
        body: JSON.stringify({ model: 'claude-haiku-20240307', system, messages: [{ role: 'user', content: prompt }], max_tokens: 120 }),
      });
      const d = await r.json(); command = d.content?.[0]?.text?.trim();
    } else if (provider === 'google') {
      const r = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:generateContent?key=${apiKey}`, {
        method: 'POST', headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ contents: [{ parts: [{ text: `${system}\n\n${prompt}` }] }], generationConfig: { maxOutputTokens: 120 } }),
      });
      const d = await r.json(); command = d.candidates?.[0]?.content?.parts?.[0]?.text?.trim();
    }
    if (!command) return res.status(500).json({ error: 'No command generated' });
    // Strip any accidental markdown fences
    command = command.replace(/^```(?:bash|sh|shell)?\n?/i, '').replace(/\n?```$/, '').trim();
    res.json({ command });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

function firstSavedProvider(uid) {
  const keys = _aiKeys[uid] || {};
  return keys.openai ? 'openai' : keys.anthropic ? 'anthropic' : keys.google ? 'google' : null;
}

app.post('/api/replit/send-collab-notification', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { provider, apiKey, accountSid, authToken, from, to, subject, html } = req.body || {};
  const hasEmail = !!(apiKey && subject && html);
  const hasSms = !!(accountSid && authToken);
  if (!provider || !to || !(hasEmail || hasSms)) return res.status(400).json({ error: 'Missing required fields' });
  try {
    if (provider === 'twilio') {
      if (accountSid) {
        // Twilio SMS
        const params = new URLSearchParams({ From: from || '', To: to, Body: subject });
        const auth = Buffer.from(`${accountSid}:${authToken}`).toString('base64');
        const r = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${accountSid}/Messages.json`, {
          method: 'POST',
          headers: { Authorization: `Basic ${auth}`, 'Content-Type': 'application/x-www-form-urlencoded' },
          body: params,
        });
        if (!r.ok) throw new Error(await r.text());
      } else {
        // Twilio SendGrid email
        const r = await fetch('https://api.sendgrid.com/v3/mail/send', {
          method: 'POST',
          headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
          body: JSON.stringify({
            personalizations: [{ to: [{ email: to }] }],
            from: { email: from },
            subject,
            content: [{ type: 'text/html', value: html }],
          }),
        });
        if (!r.ok) throw new Error(await r.text());
      }
    } else if (provider === 'resend') {
      const r = await fetch('https://api.resend.com/emails', {
        method: 'POST',
        headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
        body: JSON.stringify({ from, to, subject, html }),
      });
      if (!r.ok) throw new Error(await r.text());
    } else if (provider === 'postmark') {
      const r = await fetch('https://api.postmarkapp.com/email', {
        method: 'POST',
        headers: { 'X-Postmark-Server-Token': apiKey, 'Content-Type': 'application/json' },
        body: JSON.stringify({ From: from, To: to, Subject: subject, HtmlBody: html }),
      });
      if (!r.ok) throw new Error(await r.text());
    } else if (provider === 'mailgun') {
      const r = await fetch(`https://api.mailgun.net/v3/${from.split('@')[1]}/messages`, {
        method: 'POST',
        headers: { Authorization: `Basic ${Buffer.from(`api:${apiKey}`).toString('base64')}`, 'Content-Type': 'application/x-www-form-urlencoded' },
        body: new URLSearchParams({ from, to, subject, html }),
      });
      if (!r.ok) throw new Error(await r.text());
    }
    res.json({ ok: true });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

app.post('/api/replit/send-sms-notification', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { provider, accountSid, authToken, from, to, body } = req.body || {};
  if (!provider || !authToken || !from || !to || !body) return res.status(400).json({ error: 'Missing required fields' });
  try {
    if (provider === 'twilio') {
      const r = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${accountSid}/Messages.json`, {
        method: 'POST',
        headers: { Authorization: `Basic ${Buffer.from(`${accountSid}:${authToken}`).toString('base64')}`, 'Content-Type': 'application/x-www-form-urlencoded' },
        body: new URLSearchParams({ From: from, To: to, Body: body }),
      });
      if (!r.ok) throw new Error(await r.text());
    }
    res.json({ ok: true });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

app.post('/api/replit/compile-ftc', (req, res) => {
  res.status(503).json({ status: 'error', message: 'FTC cloud compilation is not available on Replit.', errors: ['Supabase-only FTC compile flow is not implemented locally.'] });
});

app.post('/api/replit/github-proxy', async (req, res) => {
  const { action, owner, repo, path: filePath, branch, query } = req.body || {};
  try {
    if (action === 'repo-info') {
      const r = await fetch(`https://api.github.com/repos/${owner}/${repo}`);
      return res.json(await r.json());
    }
    if (action === 'search') {
      const r = await fetch(`https://api.github.com/search/repositories?q=${encodeURIComponent(query)}`);
      return res.json(await r.json());
    }
    if (action === 'tree') {
      const r = await fetch(`https://api.github.com/repos/${owner}/${repo}/git/trees/${branch}?recursive=1`);
      return res.json(await r.json());
    }
    if (action === 'file-content') {
      const r = await fetch(`https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${filePath}`);
      return res.json({ content: await r.text() });
    }
    if (action === 'replit-metadata') {
      const r = await fetch(`https://replit.com/data/oembed?url=${encodeURIComponent(`https://replit.com/@${owner}/${repo}`)}`);
      if (!r.ok) return res.json({ exists: false });
      const d = await r.json();
      return res.json({
        exists: true,
        title: typeof d?.title === 'string' ? d.title : repo,
        description: typeof d?.author_name === 'string' ? `By ${d.author_name}` : null,
        githubOwner: null,
        githubRepo: null,
      });
    }
    if (action === 'replit-download-zip') {
      const r = await fetch(`https://replit.com/@${owner}/${repo}.zip`);
      if (!r.ok) return res.status(404).json({ error: 'Replit zip not available' });
      const buf = await r.arrayBuffer();
      return res.json({ zipBase64: Buffer.from(buf).toString('base64') });
    }
    return res.status(400).json({ error: 'Unknown action' });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

app.post('/api/replit/ai/identify-part', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const { partName, platform, vendorUrl } = req.body || {};
  const provider = firstSavedProvider(uid);
  const keyData = provider ? _aiKeys[uid][provider] : null;
  const apiKey = keyData?.api_key || null;
  if (!apiKey) return res.status(400).json({ error: 'No AI API key configured' });
  const prompt = `Identify this part for ${platform || 'general'} use.\nName: ${partName}\nVendor URL: ${vendorUrl || 'n/a'}\nReturn JSON with fields description, manufacturer, partNumber, category, specifications, compatibleWith, tips.`;
  try {
    const r = await fetch('https://api.openai.com/v1/chat/completions', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
      body: JSON.stringify({ model: 'gpt-4o-mini', messages: [{ role: 'system', content: 'Return only JSON.' }, { role: 'user', content: prompt }], max_tokens: 500 }),
    });
    const d = await r.json();
    const text = d.choices?.[0]?.message?.content || '{}';
    res.json(JSON.parse(text.replace(/```json|```/g, '').trim() || '{}'));
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// ---------------------------------------------------------------------------
// MCP tool helpers + agentic tool-calling loop
// ---------------------------------------------------------------------------

function buildMCPTool(servers) {
  const list = servers.map(s => s.name).join(', ');
  return {
    type: 'function',
    function: {
      name: 'mcp_call',
      description: `Call a configured MCP (Model Context Protocol) server. Available servers: ${list}. Start with tools/list to discover capabilities, then tools/call to invoke them.`,
      parameters: {
        type: 'object',
        properties: {
          server_name: { type: 'string', description: `Name of the MCP server. One of: ${list}` },
          method: { type: 'string', description: "JSON-RPC method, e.g. 'tools/list', 'tools/call', 'resources/list', 'resources/read'" },
          params: { type: 'object', description: 'Parameters for the method call' },
        },
        required: ['server_name', 'method'],
      },
    },
  };
}

async function executeMCPCall(serverName, method, params, servers) {
  const server = servers.find(s => s.name.toLowerCase() === serverName.toLowerCase());
  if (!server) {
    return JSON.stringify({ error: `MCP server "${serverName}" not found. Available: ${servers.map(s => s.name).join(', ')}` });
  }
  try {
    const headers = { 'Content-Type': 'application/json' };
    if (server.api_key) headers['Authorization'] = `Bearer ${server.api_key}`;
    const body = { jsonrpc: '2.0', id: randomUUID(), method, params: params || {} };
    const resp = await fetch(server.url, { method: 'POST', headers, body: JSON.stringify(body) });
    if (!resp.ok) {
      const txt = await resp.text();
      return JSON.stringify({ error: `MCP server returned ${resp.status}: ${txt.slice(0, 300)}` });
    }
    const data = await resp.json();
    return JSON.stringify(data);
  } catch (err) {
    return JSON.stringify({ error: `Failed to call MCP server "${serverName}": ${err.message}` });
  }
}

// Agentic loop: keeps calling the provider until no more tool calls are needed.
// Handles both OpenAI-compatible and Anthropic formats.
async function runChatWithTools(provider, cfg, apiKey, model, messages, tools, mcpServers) {
  const MAX_LOOPS = 8;
  let msgs = [...messages];

  for (let loop = 0; loop < MAX_LOOPS; loop++) {
    if (provider === 'anthropic') {
      const sysMsg = msgs.find(m => m.role === 'system');
      const chatMsgs = msgs.filter(m => m.role !== 'system');
      const body = {
        model, max_tokens: 8192,
        messages: chatMsgs,
        ...(sysMsg ? { system: sysMsg.content } : {}),
      };
      if (tools.length > 0) {
        body.tools = tools.map(t => ({
          name: t.function.name,
          description: t.function.description,
          input_schema: t.function.parameters,
        }));
      }
      const res = await fetch(cfg.url, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' },
        body: JSON.stringify(body),
      });
      if (!res.ok) { const e = await res.text(); throw new Error(`Anthropic ${res.status}: ${e.slice(0, 300)}`); }
      const data = await res.json();
      const toolUseBlocks = (data.content || []).filter(b => b.type === 'tool_use');
      const textBlock = (data.content || []).find(b => b.type === 'text');
      if (!toolUseBlocks.length || data.stop_reason !== 'tool_use') return textBlock?.text || '';
      // Execute tool calls
      msgs.push({ role: 'assistant', content: data.content });
      const results = await Promise.all(toolUseBlocks.map(async block => {
        const result = block.name === 'mcp_call'
          ? await executeMCPCall(block.input.server_name, block.input.method, block.input.params, mcpServers)
          : `Unknown tool: ${block.name}`;
        return { type: 'tool_result', tool_use_id: block.id, content: result };
      }));
      msgs.push({ role: 'user', content: results });

    } else {
      // OpenAI-compatible
      const body = { model, messages: msgs };
      if (tools.length > 0) { body.tools = tools; body.tool_choice = 'auto'; }
      const res = await fetch(cfg.url, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
        body: JSON.stringify(body),
      });
      if (!res.ok) { const e = await res.text(); throw new Error(`${provider} ${res.status}: ${e.slice(0, 300)}`); }
      const data = await res.json();
      const choice = data.choices?.[0];
      const toolCalls = choice?.message?.tool_calls;
      if (!toolCalls || !toolCalls.length) return choice?.message?.content || '';
      // Execute tool calls
      msgs.push(choice.message);
      const results = await Promise.all(toolCalls.map(async call => {
        let args = {};
        try { args = JSON.parse(call.function.arguments || '{}'); } catch {}
        const result = call.function.name === 'mcp_call'
          ? await executeMCPCall(args.server_name, args.method, args.params, mcpServers)
          : `Unknown tool: ${call.function.name}`;
        return { role: 'tool', tool_call_id: call.id, name: call.function.name, content: result };
      }));
      msgs.push(...results);
    }
  }
  return 'Reached the maximum number of tool calls without a final answer.';
}

// Build a simple system prompt for the AI
function buildSimpleSystemPrompt(currentFile, consoleErrors, workflows, mcpServers = [], agentSkills = []) {
  let ctx = 'You are a helpful AI coding assistant in Code Canvas IDE.\n\n';
  if (currentFile) {
    ctx += `### Active File: \`${currentFile.name}\`\n**Language**: ${currentFile.language || 'unknown'}\n\n\`\`\`${currentFile.language || ''}\n${currentFile.content || ''}\n\`\`\`\n`;
  } else {
    ctx += '📂 No file is currently open.\n';
  }
  if (consoleErrors) ctx += `\n### Console Errors\n\`\`\`\n${consoleErrors}\n\`\`\`\n`;
  if (workflows && workflows.length > 0) {
    ctx += `\n### Workflows\n${workflows.map(w => `- **${w.name}**: \`${w.command}\``).join('\n')}\n`;
  }
  if (mcpServers.length > 0) {
    ctx += `\n### Connected MCP Servers\nUse the mcp_call tool to interact with these servers. Start with tools/list to discover available tools.\n${mcpServers.map(s => `- **${s.name}**: ${s.url}${s.description ? ` — ${s.description}` : ''}`).join('\n')}\n`;
  }
  if (agentSkills.length > 0) {
    ctx += `\n### Active Agent Skills\nFollow these custom instructions provided by the user:\n${agentSkills.map(s => `#### ${s.name}${s.description ? ` (${s.description})` : ''}\n${s.instruction}`).join('\n\n')}\n`;
  }
  return ctx;
}

// Send a streaming SSE response with a single text chunk
function sseResponse(res, content) {
  res.setHeader('Content-Type', 'text/event-stream');
  res.setHeader('Cache-Control', 'no-cache');
  const chunk = JSON.stringify({ choices: [{ delta: { content } }] });
  res.write(`data: ${chunk}\n\n`);
  res.write('data: [DONE]\n\n');
  res.end();
}

function sseError(res, status, message) {
  res.status(status).json({ error: message });
}

// Main chat handler — supports MCP tool calling
app.post('/api/replit/ai/chat', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return sseError(res, 401, 'Not authenticated with Replit');

  const { messages, currentFile, consoleErrors, workflows, model, byokProvider, byokModel, byokBaseUrl, enableMCP } = req.body || {};

  // Determine which API key and provider to use
  const userKeys = _aiKeys[uid] || {};
  let provider = byokProvider || null;
  let keyData = provider ? userKeys[provider] : null;
  let apiKey = keyData ? keyData.api_key : null;
  let baseUrl = keyData ? keyData.base_url : (byokBaseUrl || '');

  // If no explicit provider, find the first saved key (skip openai-compatible which needs a base URL)
  if (!provider || !apiKey) {
    for (const p of Object.keys(BYOK_PROVIDERS)) {
      if (p === 'openai-compatible') continue;
      if (userKeys[p]) { provider = p; keyData = userKeys[p]; apiKey = keyData.api_key; break; }
    }
  }

  if (!provider || !apiKey) {
    return sseError(res, 503,
      'No API key configured. Please add your own API key (OpenAI, Anthropic, Gemini, etc.) in the API Keys settings to use the AI assistant on Replit.'
    );
  }

  const isOpenAICompatible = provider === 'openai-compatible';
  const cfg = isOpenAICompatible ? { url: baseUrl, authHeader: 'Bearer' } : BYOK_PROVIDERS[provider];
  if (!cfg || !cfg.url) return sseError(res, 400, `Unsupported provider: ${provider}`);

  const effectiveModel = byokModel || BYOK_DEFAULT_MODELS[provider] || 'gpt-4o';

  // Load user's enabled MCP servers and agent skills
  const enabledMCPServers = enableMCP !== false
    ? ((_mcpServers[uid] || []).filter(s => s.is_enabled))
    : [];
  const enabledSkills = (_agentSkills[uid] || []).filter(s => s.is_enabled);

  const tools = enabledMCPServers.length > 0 ? [buildMCPTool(enabledMCPServers)] : [];
  const systemPrompt = buildSimpleSystemPrompt(currentFile, consoleErrors, workflows, enabledMCPServers, enabledSkills);
  const aiMessages = [{ role: 'system', content: systemPrompt }, ...(messages || [])];

  try {
    const content = await runChatWithTools(provider, cfg, apiKey, effectiveModel, aiMessages, tools, enabledMCPServers);
    return sseResponse(res, content);
  } catch (err) {
    return sseError(res, 500, `AI request failed: ${err.message}`);
  }
});

// Image generation — requires a key from a supported image provider
app.post('/api/replit/ai/image', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated with Replit' });
  const { prompt } = req.body || {};
  if (!prompt) return res.status(400).json({ error: 'prompt required' });

  const userKeys = _aiKeys[uid] || {};
  const openaiKey = userKeys['openai']?.api_key;
  if (!openaiKey) {
    return res.status(503).json({ error: 'Image generation requires an OpenAI API key. Add one in API Keys settings.' });
  }

  try {
    const r = await fetch('https://api.openai.com/v1/images/generations', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${openaiKey}` },
      body: JSON.stringify({ model: 'dall-e-3', prompt, n: 1, size: '1024x1024', response_format: 'url' }),
    });
    if (!r.ok) {
      const err = await r.text();
      return res.status(502).json({ error: `OpenAI image error: ${err.slice(0, 300)}` });
    }
    const data = await r.json();
    res.json(data);
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// Music generation — placeholder (no free provider without Lovable key)
app.post('/api/replit/ai/music', (req, res) => {
  res.status(503).json({ error: 'Music generation is not available on Replit.' });
});

// ---------------------------------------------------------------------------
// Media generation proxy (image + video) — all BYOK providers
// ---------------------------------------------------------------------------

function bufferToDataUrl(buffer, mimeType = 'image/png') {
  return `data:${mimeType};base64,${Buffer.from(buffer).toString('base64')}`;
}

function extractMediaUrl(payload) {
  return (
    payload?.mediaUrl ||
    payload?.output?.[0] ||
    payload?.data?.[0]?.url ||
    payload?.data?.[0]?.image_url ||
    payload?.data?.[0]?.video_url ||
    payload?.result?.url ||
    payload?.result?.video?.url ||
    payload?.output?.video ||
    payload?.choices?.[0]?.message?.images?.[0]?.image_url?.url ||
    payload?.choices?.[0]?.message?.videos?.[0]?.video_url?.url ||
    null
  );
}

async function mediaCallOpenRouter(apiKey, mode, prompt, model) {
  const r = await fetch('https://openrouter.ai/api/v1/chat/completions', {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({
      model,
      messages: [{ role: 'user', content: `${mode === 'video' ? 'Generate a short video' : 'Generate an image'}: ${prompt}` }],
      modalities: [mode, 'text'],
    }),
  });
  const data = await r.json();
  const mediaUrl = extractMediaUrl(data);
  if (!r.ok || !mediaUrl) throw new Error(data?.error?.message || 'OpenRouter generation failed');
  return mediaUrl;
}

async function mediaCallOpenAI(apiKey, prompt, model) {
  const r = await fetch('https://api.openai.com/v1/images/generations', {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ model, prompt, size: '1024x1024' }),
  });
  const data = await r.json();
  const mediaUrl = extractMediaUrl(data);
  if (!r.ok || !mediaUrl) throw new Error(data?.error?.message || 'OpenAI image generation failed');
  return mediaUrl;
}

async function mediaCallGemini(apiKey, prompt, model) {
  const r = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent`, {
    method: 'POST',
    headers: { 'x-goog-api-key': apiKey, 'Content-Type': 'application/json' },
    body: JSON.stringify({
      contents: [{ role: 'user', parts: [{ text: prompt }] }],
      generationConfig: { responseModalities: ['TEXT', 'IMAGE'] },
    }),
  });
  const data = await r.json();
  const part = data?.candidates?.[0]?.content?.parts?.find(p => p?.inlineData?.data);
  if (!r.ok || !part?.inlineData?.data) throw new Error(data?.error?.message || 'Gemini image generation failed');
  return `data:${part.inlineData.mimeType || 'image/png'};base64,${part.inlineData.data}`;
}

async function mediaCallStability(apiKey, prompt, model) {
  const endpoint = model === 'stable-image-ultra' ? 'ultra' : 'core';
  const r = await fetch(`https://api.stability.ai/v2beta/stable-image/generate/${endpoint}`, {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, Accept: 'application/json', 'Content-Type': 'application/json' },
    body: JSON.stringify({ prompt, output_format: 'png' }),
  });
  if (!r.ok) { const txt = await r.text(); throw new Error(txt || 'Stability generation failed'); }
  const ct = r.headers.get('content-type') || '';
  if (ct.includes('application/json')) {
    const data = await r.json();
    if (data?.image) return `data:image/png;base64,${data.image}`;
    const url = extractMediaUrl(data);
    if (!url) throw new Error('Stability returned no image');
    return url;
  }
  const buf = await r.arrayBuffer();
  return bufferToDataUrl(buf, 'image/png');
}

async function mediaCallIdeogram(apiKey, prompt, model) {
  const r = await fetch('https://api.ideogram.ai/generate', {
    method: 'POST',
    headers: { 'Api-Key': apiKey, 'Content-Type': 'application/json' },
    body: JSON.stringify({ image_request: { prompt, model, aspect_ratio: '1:1' } }),
  });
  const data = await r.json();
  const mediaUrl = data?.data?.[0]?.url || extractMediaUrl(data);
  if (!r.ok || !mediaUrl) throw new Error(data?.error?.message || 'Ideogram generation failed');
  return mediaUrl;
}

async function mediaCallReplicate(apiKey, prompt, model) {
  const create = await fetch('https://api.replicate.com/v1/predictions', {
    method: 'POST',
    headers: { Authorization: `Token ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ model, input: { prompt } }),
  });
  const createData = await create.json();
  if (!create.ok) throw new Error(createData?.detail || 'Replicate request failed');
  const predictionUrl = createData?.urls?.get;
  let status = createData;
  for (let i = 0; i < 30 && predictionUrl; i++) {
    if (['succeeded', 'failed', 'canceled'].includes(status?.status)) break;
    await new Promise(resolve => setTimeout(resolve, 1500));
    const poll = await fetch(predictionUrl, { headers: { Authorization: `Token ${apiKey}` } });
    status = await poll.json();
  }
  const output = status?.output;
  const mediaUrl = Array.isArray(output) ? output[0] : output || extractMediaUrl(status);
  if (!mediaUrl) throw new Error(status?.error || 'Replicate returned no media');
  return mediaUrl;
}

async function mediaCallRunway(apiKey, prompt, model) {
  const create = await fetch('https://api.dev.runwayml.com/v1/text_to_video', {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json', 'X-Runway-Version': '2024-11-06' },
    body: JSON.stringify({ model, promptText: prompt }),
  });
  const createData = await create.json();
  if (!create.ok) throw new Error(createData?.error || 'Runway request failed');
  const taskId = createData?.id;
  if (!taskId) throw new Error('Runway task id missing');
  for (let i = 0; i < 30; i++) {
    await new Promise(resolve => setTimeout(resolve, 2000));
    const poll = await fetch(`https://api.dev.runwayml.com/v1/tasks/${taskId}`, {
      headers: { Authorization: `Bearer ${apiKey}`, 'X-Runway-Version': '2024-11-06' },
    });
    const data = await poll.json();
    const mediaUrl = extractMediaUrl(data);
    if (mediaUrl) return mediaUrl;
    if (data?.status === 'FAILED' || data?.status === 'CANCELLED') throw new Error(data?.error || 'Runway generation failed');
  }
  throw new Error('Runway generation timed out');
}

async function mediaCallFalVideo(apiKey, prompt, endpoint) {
  const r = await fetch(endpoint, {
    method: 'POST',
    headers: { Authorization: `Key ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ prompt }),
  });
  const data = await r.json();
  const mediaUrl = extractMediaUrl(data);
  if (!r.ok || !mediaUrl) throw new Error(data?.detail || data?.error || 'Video generation failed');
  return mediaUrl;
}

app.post('/api/replit/ai/media', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated with Replit' });
  const { mode, prompt, provider, model } = req.body || {};
  if (!mode || !prompt || !provider || !model) return res.status(400).json({ error: 'Missing required fields' });

  const userKeys = _aiKeys[uid] || {};
  const apiKey = userKeys[provider]?.api_key;
  if (!apiKey) return res.status(400).json({ error: `No ${provider} API key configured. Add one in the API Keys settings.` });

  try {
    let mediaUrl;
    if (provider === 'openrouter') {
      mediaUrl = await mediaCallOpenRouter(apiKey, mode, prompt, model);
    } else if (provider === 'openai') {
      if (mode !== 'image') return res.status(400).json({ error: 'OpenAI direct provider supports image mode only' });
      mediaUrl = await mediaCallOpenAI(apiKey, prompt, model);
    } else if (provider === 'gemini') {
      if (mode !== 'image') return res.status(400).json({ error: 'Gemini direct provider supports image mode only' });
      mediaUrl = await mediaCallGemini(apiKey, prompt, model);
    } else if (provider === 'stability') {
      if (mode !== 'image') return res.status(400).json({ error: 'Stability supports image generation only' });
      mediaUrl = await mediaCallStability(apiKey, prompt, model);
    } else if (provider === 'ideogram') {
      if (mode !== 'image') return res.status(400).json({ error: 'Ideogram supports image generation only' });
      mediaUrl = await mediaCallIdeogram(apiKey, prompt, model);
    } else if (provider === 'replicate') {
      mediaUrl = await mediaCallReplicate(apiKey, prompt, model);
    } else if (provider === 'runway') {
      if (mode !== 'video') return res.status(400).json({ error: 'Runway supports video generation only' });
      mediaUrl = await mediaCallRunway(apiKey, prompt, model);
    } else if (provider === 'kling') {
      if (mode !== 'video') return res.status(400).json({ error: 'Kling supports video generation only' });
      mediaUrl = await mediaCallFalVideo(apiKey, prompt, 'https://fal.run/fal-ai/kling-video/v2.1/master/text-to-video');
    } else if (provider === 'higgsfield') {
      if (mode !== 'video') return res.status(400).json({ error: 'Higgsfield supports video generation only' });
      mediaUrl = await mediaCallFalVideo(apiKey, prompt, 'https://fal.run/fal-ai/higgsfield/text-to-video');
    } else if (provider === 'luma') {
      if (mode !== 'video') return res.status(400).json({ error: 'Luma supports video generation only' });
      mediaUrl = await mediaCallFalVideo(apiKey, prompt, 'https://fal.run/fal-ai/luma-dream-machine');
    } else if (provider === 'pika') {
      if (mode !== 'video') return res.status(400).json({ error: 'Pika supports video generation only' });
      mediaUrl = await mediaCallFalVideo(apiKey, prompt, 'https://fal.run/fal-ai/pika/v2.2/text-to-video');
    } else {
      return res.status(400).json({ error: `Unsupported provider: ${provider}` });
    }
    res.json({ mediaUrl });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// ---------------------------------------------------------------------------
// 3D generation proxy — all BYOK providers (Meshy, Sloyd, Tripo, ModelsLab, Fal.ai, Neural4D)
// ---------------------------------------------------------------------------

async function gen3DMeshy(apiKey, prompt, taskId) {
  if (taskId) {
    const r = await fetch(`https://api.meshy.ai/openapi/v1/text-to-3d/${taskId}`, {
      headers: { Authorization: `Bearer ${apiKey}` },
    });
    const d = await r.json();
    if (d.status === 'SUCCEEDED') return { status: 'SUCCEEDED', glbUrl: d.model_urls?.glb || d.model_url };
    if (d.status === 'FAILED') return { status: 'FAILED', error: d.message || 'Generation failed' };
    return { status: d.status || 'PENDING' };
  }
  const r = await fetch('https://api.meshy.ai/openapi/v1/text-to-3d', {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ mode: 'preview', prompt, art_style: 'realistic', negative_prompt: 'low quality, blurry, distorted' }),
  });
  const d = await r.json();
  if (!r.ok) return { error: d.message || 'Failed to start generation' };
  return { status: 'polling', taskId: d.result || d.id };
}

async function gen3DSloyd(apiKey, prompt) {
  const r = await fetch('https://api.sloyd.ai/v1/generate', {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ prompt, output_format: 'glb' }),
  });
  const d = await r.json();
  if (!r.ok) return { error: d.error || d.message || 'Sloyd generation failed' };
  return { status: 'SUCCEEDED', glbUrl: d.model_url || d.url };
}

async function gen3DTripo(apiKey, prompt, taskId) {
  if (taskId) {
    const r = await fetch(`https://api.tripo3d.ai/v2/openapi/task/${taskId}`, {
      headers: { Authorization: `Bearer ${apiKey}` },
    });
    const d = await r.json();
    const s = d.data?.status;
    if (s === 'success') return { status: 'SUCCEEDED', glbUrl: d.data?.output?.model };
    if (s === 'failed') return { status: 'FAILED', error: 'Tripo generation failed' };
    return { status: 'PENDING' };
  }
  const r = await fetch('https://api.tripo3d.ai/v2/openapi/task', {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ type: 'text_to_model', prompt }),
  });
  const d = await r.json();
  if (!r.ok) {
    const errMsg = d.message || d.error || 'Tripo generation failed';
    const isBilling = /credit|balance|payment|subscribe/i.test(String(errMsg));
    return { status: 'FAILED', error: isBilling ? 'Your Tripo account is out of credits. Top up at tripo3d.ai or switch providers.' : errMsg, billing: isBilling };
  }
  return { status: 'polling', taskId: d.data?.task_id };
}

async function gen3DModelsLab(apiKey, prompt, taskId) {
  if (taskId) {
    const r = await fetch('https://modelslab.com/api/v6/3d/fetch', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ key: apiKey, request_id: taskId }),
    });
    const d = await r.json();
    if (d.status === 'success') return { status: 'SUCCEEDED', glbUrl: d.output?.[0] };
    if (d.status === 'error') return { status: 'FAILED', error: d.message || 'ModelsLab failed' };
    return { status: 'PENDING' };
  }
  const r = await fetch('https://modelslab.com/api/v6/3d/text_to_3d', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ key: apiKey, prompt, negative_prompt: 'low quality', guidance_scale: 15, num_inference_steps: 64 }),
  });
  const d = await r.json();
  if (d.status === 'error' || !r.ok) {
    const errMsg = d.message || d.messege || 'ModelsLab failed';
    const isBilling = /out of credits|subscribe|fund your wallet|exhausted/i.test(String(errMsg));
    return { status: 'FAILED', error: isBilling ? 'Your ModelsLab account is out of credits. Top up at modelslab.com or switch providers.' : errMsg, billing: isBilling };
  }
  if (d.status === 'success' && d.output?.[0]) return { status: 'SUCCEEDED', glbUrl: d.output[0] };
  return { status: 'polling', taskId: d.id || d.request_id };
}

async function gen3DFal(apiKey, prompt) {
  const r = await fetch('https://fal.run/fal-ai/hyper3d/rodin', {
    method: 'POST',
    headers: { Authorization: `Key ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ prompt, geometry_file_format: 'glb' }),
  });
  const d = await r.json();
  if (!r.ok) {
    const errMsg = d.detail || d.message || d.error || 'Fal.ai generation failed';
    const isBilling = /exhausted balance|user is locked|top up/i.test(String(errMsg));
    return { status: 'FAILED', error: isBilling ? 'Your Fal.ai account is out of credits. Top up at fal.ai/dashboard/billing or switch providers.' : errMsg, billing: isBilling };
  }
  return { status: 'SUCCEEDED', glbUrl: d.model_mesh?.url || d.output?.url };
}

async function gen3DNeural4D(apiKey, prompt, taskId) {
  const BASE = 'https://alb.neural4d.com:3000/api';
  const headers = { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' };
  const tryFetch = async (url, body) => {
    try {
      const r = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(20000) });
      let data = {};
      try { data = await r.json(); } catch {}
      return { ok: true, data, status: r.status };
    } catch (e) {
      return { ok: false, error: `Neural4D temporarily unreachable (${e.message}). Please retry, or switch to Meshy / Tripo / Sloyd.` };
    }
  };
  if (taskId) {
    const result = await tryFetch(`${BASE}/retrieveModel`, { uuid: taskId });
    if (!result.ok) return { status: 'FAILED', error: result.error, unreachable: true };
    if (result.status >= 400) return { status: 'FAILED', error: result.data.error || result.data.message || `Neural4D status check failed (${result.status})` };
    const codeStatus = result.data.codeStatus;
    if (codeStatus === 0 && result.data.modelUrl) return { status: 'SUCCEEDED', glbUrl: result.data.modelUrl };
    if (codeStatus < 0) return { status: 'FAILED', error: result.data.message || 'Neural4D generation failed' };
    return { status: 'PENDING' };
  }
  const result = await tryFetch(`${BASE}/generateModelWithText`, { prompt, modelCount: 1, disablePbr: 0 });
  if (!result.ok) return { status: 'FAILED', error: result.error, unreachable: true };
  if (result.status >= 400) {
    const errMsg = result.data.error || result.data.message || `Neural4D returned ${result.status}`;
    const isAuth = result.status === 401 || /unauthor/i.test(String(errMsg));
    const isBilling = /credit|balance|insufficient|points|quota/i.test(String(errMsg));
    return { status: 'FAILED', error: isAuth ? 'Neural4D API key is invalid. Get one at neural4d.com/api and re-add it.' : isBilling ? 'Your Neural4D account is out of credits. Top up at neural4d.com or switch providers.' : errMsg, billing: isBilling };
  }
  const firstUuid = Array.isArray(result.data.uuids) ? result.data.uuids[0] : null;
  if (!firstUuid) return { status: 'FAILED', error: result.data.message || 'Neural4D did not return a model id' };
  return { status: 'polling', taskId: firstUuid };
}

app.post('/api/replit/ai/3d', async (req, res) => {
  const uid = getReplitUserId(req);
  if (!uid) return res.status(401).json({ error: 'Not authenticated with Replit' });
  const { prompt, taskId, provider = 'meshy' } = req.body || {};
  if (!taskId && !prompt) return res.status(400).json({ error: 'prompt required' });

  const userKeys = _aiKeys[uid] || {};
  const apiKey = userKeys[provider]?.api_key;
  if (!apiKey) return res.status(400).json({ error: `No ${provider} API key configured. Add one in the API Keys settings.` });

  try {
    let result;
    switch (provider) {
      case 'meshy':     result = await gen3DMeshy(apiKey, prompt, taskId || null); break;
      case 'sloyd':     result = await gen3DSloyd(apiKey, prompt); break;
      case 'tripo':     result = await gen3DTripo(apiKey, prompt, taskId || null); break;
      case 'modelslab': result = await gen3DModelsLab(apiKey, prompt, taskId || null); break;
      case 'fal':       result = await gen3DFal(apiKey, prompt); break;
      case 'neural4d':  result = await gen3DNeural4D(apiKey, prompt, taskId || null); break;
      default: return res.status(400).json({ error: `Unknown 3D provider: ${provider}` });
    }
    res.json(result);
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// ---------------------------------------------------------------------------
// One-shot code execution  (Run button — fresh process per run, stdin piped)
// ---------------------------------------------------------------------------
//
// Execution strategies:
//   interpret — write code to a file, invoke interpreter directly
//   cargo     — scaffold a Cargo project, `cargo run --quiet`
//   compile   — compile with gcc/g++, then run the resulting binary

const LANG_CONFIG = {
  // Interpreted
  python:     { type: 'interpret', cmd: 'python3', ext: 'py' },
  py:         { type: 'interpret', cmd: 'python3', ext: 'py' },
  javascript: { type: 'interpret', cmd: 'node',    ext: 'js' },
  js:         { type: 'interpret', cmd: 'node',    ext: 'js' },
  typescript: { type: 'interpret', cmd: 'node',    ext: 'js' },
  ts:         { type: 'interpret', cmd: 'node',    ext: 'js' },
  bash:       { type: 'interpret', cmd: 'bash',    ext: 'sh' },
  shell:      { type: 'interpret', cmd: 'bash',    ext: 'sh' },
  sh:         { type: 'interpret', cmd: 'bash',    ext: 'sh' },
  // Rust via Cargo
  rust:       { type: 'cargo',                              ext: 'rs' },
  rs:         { type: 'cargo',                              ext: 'rs' },
  // C / C++ via GCC
  c:          { type: 'compile', compiler: 'gcc', ext: 'c',   compileFlags: ['-lm'] },
  cpp:        { type: 'compile', compiler: 'g++', ext: 'cpp', compileFlags: ['-lm', '-std=c++17'] },
  'c++':      { type: 'compile', compiler: 'g++', ext: 'cpp', compileFlags: ['-lm', '-std=c++17'] },
};

// Shared finish-and-respond helper used by all strategies.
function finishExec(proc, tmpDir, stdin, res, timeoutMs = 30000) {
  let stdoutBuf = '';
  let stderrBuf = '';
  let timedOut  = false;

  const timer = setTimeout(() => {
    timedOut = true;
    proc.kill('SIGTERM');
    setTimeout(() => { try { proc.kill('SIGKILL'); } catch {} }, 3000);
  }, timeoutMs);

  if (stdin) proc.stdin.write(stdin);
  proc.stdin.end();

  proc.stdout.on('data', (d) => { stdoutBuf += d.toString(); });
  proc.stderr.on('data', (d) => { stderrBuf += d.toString(); });

  proc.on('close', (exitCode) => {
    clearTimeout(timer);
    try { rmSync(tmpDir, { recursive: true, force: true }); } catch {}

    const lines = stdoutBuf.split('\n');
    if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop();

    if (timedOut) {
      return res.json({ output: lines, error: '⏱️ Execution timed out.', executedAt: new Date().toISOString() });
    }
    if (exitCode !== 0) {
      const escapedTmp = tmpDir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
      const cleanErr = stderrBuf.replace(new RegExp(escapedTmp + '\\/', 'g'), '').trim();
      return res.json({ output: lines, error: cleanErr || `Process exited with code ${exitCode}`, executedAt: new Date().toISOString() });
    }
    return res.json({ output: lines.length > 0 ? lines : ['(no output)'], error: null, executedAt: new Date().toISOString() });
  });

  proc.on('error', (err) => {
    clearTimeout(timer);
    try { rmSync(tmpDir, { recursive: true, force: true }); } catch {}
    return res.json({ output: [], error: err.message, executedAt: new Date().toISOString() });
  });
}

app.post('/api/replit/execute', (req, res) => {
  const { code, language = 'python', stdin } = req.body;

  if (!code || !code.trim()) {
    return res.status(400).json({ error: 'No code provided', output: [], executedAt: new Date().toISOString() });
  }

  const normalized = language.toLowerCase().trim();
  const config = LANG_CONFIG[normalized];

  if (!config) {
    return res.status(400).json({
      error: `Language '${language}' is not supported.`,
      output: [],
      executedAt: new Date().toISOString(),
    });
  }

  let tmpDir;
  try {
    tmpDir = mkdtempSync(path.join(tmpdir(), 'cc-exec-'));

    // ── Cargo (Rust) ─────────────────────────────────────────────────────────
    if (config.type === 'cargo') {
      const srcDir = path.join(tmpDir, 'src');
      fs.mkdirSync(srcDir);
      writeFileSync(path.join(tmpDir, 'Cargo.toml'), [
        '[package]',
        'name = "canvas-run"',
        'version = "0.1.0"',
        'edition = "2021"',
      ].join('\n') + '\n', 'utf8');
      writeFileSync(path.join(srcDir, 'main.rs'), code, 'utf8');

      const proc = spawn('cargo', ['run', '--quiet'], {
        cwd: tmpDir,
        env: { ...process.env, CARGO_TERM_COLOR: 'never' },
      });
      return finishExec(proc, tmpDir, stdin, res, 90000); // compile + run
    }

    // ── Compile then run (C / C++) ────────────────────────────────────────────
    if (config.type === 'compile') {
      const codeFile = path.join(tmpDir, `main.${config.ext}`);
      const binFile  = path.join(tmpDir, 'main');
      writeFileSync(codeFile, code, 'utf8');

      const compile = spawn(
        config.compiler,
        [codeFile, '-o', binFile, ...(config.compileFlags || [])],
        { cwd: tmpDir, env: process.env },
      );
      let compileErr = '';
      compile.stderr.on('data', (d) => { compileErr += d.toString(); });
      compile.stdout.on('data', () => {}); // drain

      compile.on('close', (exitCode) => {
        if (exitCode !== 0) {
          try { rmSync(tmpDir, { recursive: true, force: true }); } catch {}
          const cleanErr = compileErr.replace(new RegExp(tmpDir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\/', 'g'), '').trim();
          return res.json({ output: [], error: cleanErr || `Compilation failed (exit ${exitCode})`, executedAt: new Date().toISOString() });
        }
        const proc = spawn(binFile, [], { cwd: tmpDir, env: process.env });
        finishExec(proc, tmpDir, stdin, res);
      });

      compile.on('error', (err) => {
        try { rmSync(tmpDir, { recursive: true, force: true }); } catch {}
        return res.json({ output: [], error: `Compiler error: ${err.message}`, executedAt: new Date().toISOString() });
      });
      return;
    }

    // ── Interpret (python / node / bash) ─────────────────────────────────────
    const codeFile = path.join(tmpDir, `main.${config.ext}`);
    writeFileSync(codeFile, code, 'utf8');
    const proc = spawn(config.cmd, [codeFile], {
      cwd: tmpDir,
      env: { ...process.env, PYTHONUNBUFFERED: '1' },
    });
    finishExec(proc, tmpDir, stdin, res);

  } catch (err) {
    if (tmpDir) try { rmSync(tmpDir, { recursive: true, force: true }); } catch {}
    return res.status(500).json({ output: [], error: err.message, executedAt: new Date().toISOString() });
  }
});

// ---------------------------------------------------------------------------
// Preview proxy — forwards requests to user project dev servers
// (e.g. npm run dev, python -m http.server, etc.)
// Security: only proxies to localhost, restricted port range.
// Also rewrites HTML responses to fix root-relative asset paths (Vite etc.).
// ---------------------------------------------------------------------------

const PREVIEW_PORT_MIN = 1024;
const PREVIEW_PORT_MAX = 65535;

function handlePreviewProxy(req, res, port, targetPath) {
  const query = req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '';

  const proxyReq = http.request(
    {
      hostname: 'localhost',
      port,
      path: targetPath + query,
      method: req.method,
      headers: {
        ...req.headers,
        host: `localhost:${port}`,
      },
    },
    (proxyRes) => {
      const ct = proxyRes.headers['content-type'] || '';
      if (ct.includes('text/html') && proxyRes.statusCode === 200) {
        let body = '';
        proxyRes.on('data', (chunk) => { body += chunk.toString(); });
        proxyRes.on('end', () => {
          const prefix = `/api/preview/${port}`;
          const rewritten = body.replace(
            /((?:src|href|action|data-src|poster)\s*=\s*)"\//gi,
            (_a, attr) => `${attr}"${prefix}/`
          );
          const headers = { ...proxyRes.headers };
          delete headers['content-length'];
          delete headers['content-encoding'];
          delete headers['transfer-encoding'];
          res.writeHead(proxyRes.statusCode, headers);
          res.end(rewritten);
        });
        return;
      }
      res.writeHead(proxyRes.statusCode, proxyRes.headers);
      proxyRes.pipe(res);
    },
  );

  proxyReq.on('error', (err) => {
    if (!res.headersSent) {
      res.status(502).json({ error: 'Preview server not reachable', message: err.message });
    }
  });

  if (req.method !== 'GET' && req.method !== 'HEAD') {
    req.pipe(proxyReq);
  } else {
    proxyReq.end();
  }
}

// Match any /api/preview/:port[/...] path using a simple middleware
// (Express 5 / path-to-regexp v8 does not support bare `*` in route patterns)
app.use((req, res, next) => {
  if (!req.path.startsWith('/api/preview/')) return next();
  const m = req.path.match(/^\/api\/preview\/(\d{2,5})(\/.*)?$/);
  if (!m) return next();

  const port = parseInt(m[1], 10);
  if (isNaN(port) || port < PREVIEW_PORT_MIN || port > PREVIEW_PORT_MAX) {
    return res.status(403).json({ error: `Port ${port} is not allowed (must be ${PREVIEW_PORT_MIN}-${PREVIEW_PORT_MAX})` });
  }

  const targetPath = m[2] || '/';
  handlePreviewProxy(req, res, port, targetPath);
});

// ---------------------------------------------------------------------------
// Static file serving (production build)
// ---------------------------------------------------------------------------

const distPath = path.join(__dirname, 'dist');
if (fs.existsSync(distPath)) {
  app.use(express.static(distPath));
  app.get(/.*/, (req, res) => {
    if (!req.path.startsWith('/api/')) {
      res.sendFile(path.join(distPath, 'index.html'));
    }
  });
}

// ---------------------------------------------------------------------------
// Discord bot — DM-based AI assistant
// ---------------------------------------------------------------------------

const APP_URL = process.env.DISCORD_APP_URL || 'http://localhost:5173';

async function discordAIChat(userId, discordUserId, userMessages) {
  const userKeys = _aiKeys[userId] || {};
  let provider = null;
  let keyData = null;
  for (const p of Object.keys(BYOK_PROVIDERS)) {
    if (p === 'openai-compatible') continue;
    if (userKeys[p]) { provider = p; keyData = userKeys[p]; break; }
  }
  if (!provider || !keyData) {
    return 'No AI API key configured. Set one with `/key <provider> <apiKey>` (e.g. `/key openai sk-xxx`).';
  }

  const cfg = BYOK_PROVIDERS[provider];
  const effectiveModel = BYOK_DEFAULT_MODELS[provider] || 'gpt-4o';

  // Load conversation history (last 50 messages)
  const history = _discordChats[discordUserId] || [];
  const aiMessages = [
    { role: 'system', content: 'You are a helpful AI coding assistant in Code Canvas IDE. The user is chatting with you via Discord DM. Keep responses concise and helpful.' },
    ...history.map(m => ({ role: m.role, content: m.content })),
    { role: 'user', content: userMessages.join('\n') },
  ];

  try {
    const content = await runChatWithTools(provider, cfg, keyData.api_key, effectiveModel, aiMessages, [], []);
    // Store conversation history
    history.push({ role: 'user', content: userMessages.join('\n'), ts: new Date().toISOString() });
    history.push({ role: 'assistant', content, ts: new Date().toISOString() });
    // Keep last 50
    if (history.length > 50) history.splice(0, history.length - 50);
    _discordChats[discordUserId] = history;
    saveDiscordChats();
    return content;
  } catch (err) {
    console.error('[Discord Bot] AI chat error:', err.message);
    return `AI request failed: ${err.message}`;
  }
}

if (process.env.DISCORD_BOT_KEY) {
  const discordClient = new Client({
    intents: [GatewayIntentBits.Guilds, GatewayIntentBits.DirectMessages],
  });

  discordClient.once(Events.ClientReady, (c) => {
    console.log(`[Discord Bot] Logged in as ${c.user.tag}`);
  });

  discordClient.on(Events.MessageCreate, async (message) => {
    if (message.author.bot) return;
    if (message.channel.type !== 1) return; // DM only

    const discordUserId = message.author.id;
    const content = message.content.trim();
    const link = _discordLinks[discordUserId];

    // ── Not linked → send auth code ──────────────────────────────────────
    if (!link || !link.userId) {
      const authCode = crypto.randomUUID ? crypto.randomUUID() : randomUUID();
      _discordLinks[discordUserId] = {
        authCode,
        authCodeExpiresAt: Date.now() + 15 * 60 * 1000,
        discordUsername: message.author.username,
        userId: null,
        linkedAt: null,
      };
      saveDiscordLinks();
      await message.reply(
        `Welcome to Code Canvas, ${message.author.username}! 🎨\n\nTo link your account, please visit:\n${APP_URL}/link-discord?code=${authCode}\n\nSign in (or create an account), then your Discord will be linked. This code expires in 15 minutes.`
      );
      return;
    }

    const userId = link.userId;

    // ── /help ────────────────────────────────────────────────────────────
    if (content === '/help') {
      await message.reply(
        '**Code Canvas Bot — Commands**\n\n' +
        '• Send any message to chat with the AI assistant\n' +
        '• `/key` — List your configured AI providers\n' +
        '• `/key <provider> <apiKey> [baseUrl]` — Set an API key (e.g. `/key openai sk-xxx`)\n' +
        '• `/key remove <provider>` — Remove an API key\n' +
        '• `/help` — Show this message\n\n' +
        'Supported providers: openai, anthropic, gemini, deepseek, groq, and more.'
      );
      return;
    }

    // ── /key ─────────────────────────────────────────────────────────────
    if (content.startsWith('/key')) {
      const parts = content.split(/\s+/);
      if (parts.length === 1 || (parts.length === 2 && (parts[1] === 'list' || parts[1] === 'ls'))) {
        const userKeys = _aiKeys[userId] || {};
        const keyList = Object.keys(userKeys);
        if (keyList.length === 0) {
          await message.reply('No API keys configured. Use `/key <provider> <apiKey>` to add one.');
        } else {
          const masked = keyList.map(p => {
            const k = userKeys[p].api_key;
            const mask = k.length > 8 ? k.slice(0, 4) + '…' + k.slice(-4) : '***';
            return `• **${p}**: \`${mask}\``;
          }).join('\n');
          await message.reply(`**Your configured API keys:**\n${masked}`);
        }
        return;
      }

      if (parts[1] === 'remove' && parts[2]) {
        const provider = parts[2].toLowerCase();
        if (_aiKeys[userId] && _aiKeys[userId][provider]) {
          delete _aiKeys[userId][provider];
          saveAiKeys();
          await message.reply(`Removed **${provider}** key.`);
        } else {
          await message.reply(`No key found for **${provider}**.`);
        }
        return;
      }

      if (parts.length >= 3) {
        const provider = parts[1].toLowerCase();
        const apiKey = parts[2];
        const baseUrl = parts.slice(3).join(' ') || '';
        if (!BYOK_PROVIDERS[provider] && provider !== 'openai-compatible') {
          const supported = Object.keys(BYOK_PROVIDERS).join(', ');
          await message.reply(`Unknown provider **${provider}**. Supported: ${supported}`);
          return;
        }
        if (!_aiKeys[userId]) _aiKeys[userId] = {};
        _aiKeys[userId][provider] = { api_key: apiKey, base_url: baseUrl };
        saveAiKeys();
        await message.reply(`Saved **${provider}** API key. You can now chat with AI!`);
        return;
      }

      await message.reply('Usage: `/key <provider> <apiKey>` or `/key remove <provider>`');
      return;
    }

    // ── AI Chat ──────────────────────────────────────────────────────────
    await message.channel.sendTyping();
    const reply = await discordAIChat(userId, discordUserId, [content]);

    // Discord has a 2000-char message limit; split if needed
    if (reply.length <= 2000) {
      await message.reply(reply);
    } else {
      const chunks = [];
      for (let i = 0; i < reply.length; i += 1990) {
        chunks.push(reply.slice(i, i + 1990));
      }
      await message.reply(chunks[0]);
      for (let i = 1; i < chunks.length; i++) {
        await message.channel.send(chunks[i]);
      }
    }
  });

  discordClient.login(process.env.DISCORD_BOT_KEY).catch(err => {
    console.error('[Discord Bot] Login failed:', err.message);
  });
} else {
  console.log('[Discord Bot] DISCORD_BOT_KEY not set — bot not started');
}

// ---------------------------------------------------------------------------
// HTTP server + WebSocket server (PTY interactive terminal)
// ---------------------------------------------------------------------------

const httpServer = createServer(app);

const wss = new WebSocketServer({ noServer: true });

httpServer.on('upgrade', (request, socket, head) => {
  const url = new URL(request.url, `http://${request.headers.host}`);
  if (url.pathname === '/api/replit/pty') {
    wss.handleUpgrade(request, socket, head, (ws) => {
      wss.emit('connection', ws, request);
    });
  } else if (url.pathname.startsWith('/api/preview/')) {
    // Preview proxy WebSocket (HMR support for Vite etc.)
    const m = url.pathname.match(/^\/api\/preview\/(\d{2,5})(?:\/|$)/);
    if (!m) { socket.destroy(); return; }
    const port = parseInt(m[1], 10);
    if (isNaN(port) || port < PREVIEW_PORT_MIN || port > PREVIEW_PORT_MAX) { socket.destroy(); return; }
    const wsPath = url.pathname.replace(/^\/api\/preview\/\d+/, '') + (url.search || '') || '/';
    const proxyReq = http.request({
      hostname: 'localhost',
      port,
      path: wsPath,
      method: 'GET',
      headers: {
        'Connection': 'Upgrade',
        'Upgrade': 'websocket',
        'Host': `localhost:${port}`,
        'Sec-WebSocket-Key': request.headers['sec-websocket-key'] || '',
        'Sec-WebSocket-Version': request.headers['sec-websocket-version'] || '13',
        'Sec-WebSocket-Extensions': request.headers['sec-websocket-extensions'] || '',
        'Sec-WebSocket-Protocol': request.headers['sec-websocket-protocol'] || '',
        'Origin': request.headers['origin'] || '',
      },
    });
    proxyReq.on('upgrade', (_proxyRes, proxySocket, proxyHead) => {
      socket.write(proxyHead);
      socket.pipe(proxySocket).pipe(socket);
    });
    proxyReq.on('error', () => socket.destroy());
    proxyReq.end();
  } else if (url.pathname === '/api/lsp/ws') {
    const language = url.searchParams.get('language') || 'unknown';
    const connectionId = randomUUID();
    wss.handleUpgrade(request, socket, head, (ws) => {
      wss.emit('connection', ws, request);
      setupLspConnection(ws, language, connectionId);
    });
  } else {
    socket.destroy();
  }
});

// ---------------------------------------------------------------------------
// LSP — Language Server Protocol bridge (Replit backend)
// Spawns language server processes and forwards JSON-RPC over WebSocket.
// Uses LSP's Content-Length framing for stdin/stdout communication.
// ---------------------------------------------------------------------------

const lspProcesses = new Map();

function lspEncode(msg) {
  const body = JSON.stringify(msg);
  const headers = `Content-Length: ${Buffer.byteLength(body, 'utf-8')}\r\n\r\n`;
  return headers + body;
}

function setupLspConnection(ws, language, connectionId) {
  ws.on('message', (data) => {
    try {
      const msg = JSON.parse(data.toString());
      handleLspMessage(ws, language, msg, connectionId);
    } catch (err) {
      ws.send(JSON.stringify({ jsonrpc: '2.0', error: { code: -32700, message: 'Parse error' } }));
    }
  });

  ws.on('close', () => {
    const entry = lspProcesses.get(connectionId);
    if (entry) {
      entry.process.kill();
      lspProcesses.delete(connectionId);
    }
  });

  ws.on('error', () => {
    const entry = lspProcesses.get(connectionId);
    if (entry) {
      entry.process.kill();
      lspProcesses.delete(connectionId);
    }
  });
}

function handleLspMessage(ws, language, msg, connectionId) {
  const entry = findLspEntry(language);

  if (msg.method === 'initialize') {
    const lsProcess = getOrCreateLsProcess(language, entry, ws, connectionId);
    if (lsProcess) {
      lsProcess.stdin.write(lspEncode(msg));
    } else {
      ws.send(JSON.stringify({
        jsonrpc: '2.0',
        id: msg.id,
        result: {
          capabilities: {
            textDocumentSync: 1,
            completionProvider: { triggerCharacters: ['.', '<', '"', "'", '/', '@', '(', ':'] },
            hoverProvider: true,
            definitionProvider: true,
            referencesProvider: true,
            signatureHelpProvider: { triggerCharacters: ['(', ','] },
            documentFormattingProvider: true,
            codeActionProvider: true,
          },
          serverInfo: { name: 'Fallback (no LS process)', version: '1.0' },
        },
      }));
    }
    return;
  }

  if (msg.method === 'initialized') {
    return;
  }

  if (!entry) {
    if (msg.id) {
      ws.send(JSON.stringify({ jsonrpc: '2.0', id: msg.id, error: { code: -32601, message: `No LSP server for: ${language}` } }));
    }
    return;
  }

  const lsProcess = getOrCreateLsProcess(language, entry, ws, connectionId);
  if (lsProcess) {
    lsProcess.stdin.write(lspEncode(msg));
  } else if (msg.id) {
    ws.send(JSON.stringify({ jsonrpc: '2.0', id: msg.id, error: { code: -32603, message: 'Language server not available' } }));
  }
}

const LSP_SERVER_MAP = {
  python: { name: 'Pyright', command: 'pyright-langserver', args: ['--stdio'] },
  css: { name: 'CSS Language Server', command: 'vscode-css-languageserver', args: ['--stdio'] },
  html: { name: 'HTML Language Server', command: 'vscode-html-languageserver', args: ['--stdio'] },
  json: { name: 'JSON Language Server', command: 'vscode-json-languageserver', args: ['--stdio'] },
  markdown: { name: 'Markdown Language Server', command: 'vscode-markdown-languageserver', args: ['--stdio'] },
  xml: { name: 'XML Language Server', command: 'vscode-xml-languageserver', args: ['--stdio'] },
  sql: { name: 'SQL Language Server', command: 'sql-language-server', args: ['up', '--method', 'stdio'] },
  yaml: { name: 'YAML Language Server', command: 'yaml-language-server', args: ['--stdio'] },
  bash: { name: 'Bash Language Server', command: 'bash-language-server', args: ['start'] },
};

function findLspEntry(language) {
  const entry = LSP_SERVER_MAP[language];
  if (entry) return entry;
  return LSP_SERVER_MAP[language.split('-')[0]] || null;
}

function getOrCreateLsProcess(language, entry, ws, connectionId) {
  const existing = lspProcesses.get(connectionId);
  if (existing) return existing.process;

  if (!entry) return null;

  try {
    const lsProcess = spawn(entry.command, entry.args, {
      stdio: ['pipe', 'pipe', 'pipe'],
      env: { ...process.env },
    });

    let readBuffer = '';
    let contentLength = -1;

    lsProcess.stdout.on('data', (chunk) => {
      readBuffer += chunk.toString();

      while (readBuffer.length > 0) {
        if (contentLength < 0) {
          const headerEnd = readBuffer.indexOf('\r\n\r\n');
          if (headerEnd === -1) break;
          const header = readBuffer.substring(0, headerEnd);
          const match = header.match(/Content-Length:\s*(\d+)/i);
          if (match) contentLength = parseInt(match[1], 10);
          else contentLength = 0;
          readBuffer = readBuffer.substring(headerEnd + 4);
        }

        if (contentLength >= 0 && readBuffer.length >= contentLength) {
          const body = readBuffer.substring(0, contentLength);
          readBuffer = readBuffer.substring(contentLength);
          contentLength = -1;

          try {
            const msg = JSON.parse(body);
            if (ws && ws.readyState === 1) {
              ws.send(JSON.stringify(msg));
            }
          } catch {
            // ignore non-JSON output
          }
        } else {
          break;
        }
      }
    });

    lsProcess.stderr.on('data', (chunk) => {
      console.error(`[LSP:${language}] stderr:`, chunk.toString());
    });

    lsProcess.on('close', (code) => {
      console.log(`[LSP:${language}] process exited with code ${code}`);
      lspProcesses.delete(connectionId);
    });

    lsProcess.on('error', (err) => {
      console.error(`[LSP:${language}] error:`, err.message);
      lspProcesses.delete(connectionId);
      const errMsg = JSON.stringify({
        jsonrpc: '2.0',
        method: 'textDocument/publishDiagnostics',
        params: {
          uri: '',
          diagnostics: [{
            range: { start: { line: 0, character: 0 }, end: { line: 0, character: 0 } },
            severity: 1,
            message: `Language server for ${language} failed to start: ${err.message}`,
            source: 'lsp',
          }],
        },
      });
      if (ws && ws.readyState === 1) ws.send(errMsg);
    });

    lspProcesses.set(connectionId, { process: lsProcess, ws, language, connectionId });
    return lsProcess;
  } catch (err) {
    console.error(`[LSP:${language}] failed to spawn:`, err.message);
    return null;
  }
}

// ---------------------------------------------------------------------------
// Command safety filter
// Checks a fully-typed shell line (before the user hits Enter) against a list
// of patterns that could damage the host environment or other sessions.
// ---------------------------------------------------------------------------
function isBlockedCommand(line) {
  const cmd = line.trim().replace(/\s+/g, ' ');
  if (!cmd) return false;

  const BLOCKED = [
    // kill -9 -1 / kill -KILL -1 / kill -- -1  (kill ALL processes)
    /\bkill\b\s+(?:-[-a-zA-Z0-9]+\s+)*-1(\s|$)/,
    // kill without explicit signal: just `kill -1`
    /\bkill\b\s+-1(\s|$)/,
    // rm -rf /  or  rm -fr /  or  rm --recursive --force /
    /\brm\b\s+(?:-[a-zA-Z]*[rR][a-zA-Z]*\s+|--recursive\s+|--force\s+){1,4}\s*\/[* ]*/,
    /\brm\b\s+(?:-[a-zA-Z]*[fF][a-zA-Z]*\s+|--force\s+){1,4}(?:-[a-zA-Z]*[rR][a-zA-Z]*\s+|--recursive\s+)+\s*\/[* ]*/,
    // fork bomb  :(){ :|:& };:
    /:\s*\(\s*\)\s*\{/,
    // dd writing to a block device
    /\bdd\b.*\bof=\/dev\/(sd|hd|vd|nvme|xvd)/,
    // mkfs — reformats a filesystem
    /\bmkfs\b/,
    // direct redirect to a block device
    />\s*\/dev\/(sd[a-z]|hd[a-z]|vd[a-z]|nvme|xvd)/,
  ];

  return BLOCKED.some((re) => re.test(cmd));
}

wss.on('connection', (ws, req) => {
  let ptyProcess = null;

  // Per-connection fallback ID — guarantees the shell never starts in the
  // workspace root even if the client sends no projectId.
  const connSessionId = `conn-${Date.now()}-${Math.random().toString(36).slice(2)}`;

  // Only show the sudo override message on .replit.dev hosts
  const host = req?.headers?.host || '';
  const isReplitDev = host.endsWith('.replit.dev');

  // Tracks characters typed on the current line so we can inspect the full
  // command before forwarding the Enter key to bash.
  let lineBuffer = '';

  // cwd is set during init and reused for later sync-files messages.
  let cwd = '';

  ws.on('message', (msg) => {
    const str = msg.toString();

    // First message must be {type:'init'} — write project files and spawn PTY
    if (ptyProcess === null) {
      try {
        const parsed = JSON.parse(str);
        if (parsed.type !== 'init') return; // drop anything until init

        const { projectId, projectName, files = [], cols = 80, rows = 24 } = parsed;

        // Always use a temp dir — never the workspace root.
        const resolvedId = projectId || connSessionId;
        const projectDir = path.join(tmpdir(), `canvas-${resolvedId}`);

        cwd = projectDir; // default; refined below after writing files

        try {
          fs.mkdirSync(projectDir, { recursive: true });
          for (const { path: filePath, content } of files) {
            if (!filePath || typeof content !== 'string') continue;
            // Sanitise path — strip leading slashes / traversals
            const safe = filePath.replace(/^[./\\]+/, '').replace(/\.\.\//g, '');
            if (!safe) continue;
            const fullPath = path.join(projectDir, safe);
            fs.mkdirSync(path.dirname(fullPath), { recursive: true });
            fs.writeFileSync(fullPath, content, 'utf8');
          }

          console.log(`[PTY] projectDir=${projectDir}  startCwd=${cwd}`);

          // Sanitise the project name for safe embedding in a bash variable.
          const safeProjectName = (projectName || 'project')
            .toString()
            .replace(/['"\\`$\x00-\x1f]/g, '_')
            .slice(0, 64) || 'project';

          // Write a .bashrc so bash picks up our prompt when it sources HOME/.bashrc.
          // PROMPT_COMMAND updates PS1 before each prompt so cd is reflected.
          // HOME is set to startDir so ${PWD/#$HOME/...} shows a friendly path.
          // Also installs runtime safety: ulimit caps + kill() override.
          const bashrc = [
            '# CodeCanvas shell',
            '[ -f /etc/bash.bashrc ] && source /etc/bash.bashrc',
            `CANVAS_PROJECT='${safeProjectName}'`,
            '__canvas_prompt() {',
            '  local p="${PWD/#$HOME/$CANVAS_PROJECT}"',
            '  PS1="\\[\\033[01;36m\\]${p}\\[\\033[00m\\]\\[\\033[01m\\]\\$\\[\\033[00m\\] "',
            '}',
            "PROMPT_COMMAND='__canvas_prompt'",
            '# Resource limits — defence against fork bombs and runaway writes',
            'ulimit -u 2048    # max 2048 user processes (fork bomb protection)',
            'ulimit -f 204800  # max 200 MB per file write',
            '# Shell-level kill guard (server-side filter is the primary block)',
            'kill() {',
            '  for _arg in "$@"; do',
            '    if [[ "$_arg" == "-1" ]]; then',
            '      echo -e "\\033[31m\u26d4  Blocked: kill -1 (kill all processes) is not permitted.\\033[0m" >&2',
            '      return 1',
            '    fi',
            '  done',
            '  command kill "$@"',
            '}',
          ];
          if (isReplitDev) {
            bashrc.push(
              '# Override sudo message — only on Replit',
              'sudo() {',
              '  if [[ ! -f ~/.sudo_motd ]]; then',
              '    echo -e "\\t\\033[93mYou don\'t need sudo in CodeCanvas, all files that\\033[0m" >&2',
              '    echo -e "\\t\\033[93mcan be modified already have the correct permissions.\\033[0m" >&2',
              '    echo -e "" >&2',
              '    touch ~/.sudo_motd',
              '  fi',
              '  command sudo "$@"',
              '}',
            );
          }
          const bashrcContent = bashrc.join('\n') + '\n';
          fs.writeFileSync(path.join(projectDir, '.bashrc'), bashrcContent, 'utf8');
        } catch (e) {
          console.error('Failed to write project files:', e.message);
        }

        ptyProcess = pty.spawn('bash', ['--rcfile', path.join(projectDir, '.bashrc')], {
          name: 'xterm-256color',
          cols: Math.max(1, cols),
          rows: Math.max(1, rows),
          cwd,
          env: {
            ...process.env,
            TERM: 'xterm-256color',
            COLORTERM: 'truecolor',
            PYTHONUNBUFFERED: '1',
            // HOME = cwd so PROMPT_COMMAND shows project-relative paths
            HOME: cwd,
          },
        });

        ptyProcess.onData((data) => {
          try { if (ws.readyState === ws.OPEN) ws.send(data); } catch {}
        });

        ptyProcess.onExit(() => {
          try { if (ws.readyState === ws.OPEN) ws.close(); } catch {}
        });

      } catch (e) {
        console.error('PTY init error:', e.message);
      }
      return;
    }

    // PTY is running — handle resize, sync-files, or forward raw input
    try {
      const parsed = JSON.parse(str);

      if (parsed.type === 'resize' && parsed.cols && parsed.rows) {
        ptyProcess.resize(Math.max(1, parsed.cols), Math.max(1, parsed.rows));
        return;
      }

      // sync-files — write new/updated project files into the live shell dir
      // without restarting the PTY. Sent by the client whenever the IDE file
      // tree changes (e.g. after a git clone or GitHub import).
      if (parsed.type === 'sync-files' && Array.isArray(parsed.files) && cwd) {
        try {
          for (const { path: filePath, content } of parsed.files) {
            if (!filePath || typeof content !== 'string') continue;
            const safe = filePath.replace(/^[./\\]+/, '').replace(/\.\.\//g, '');
            if (!safe) continue;
            const fullPath = path.join(cwd, safe);
            fs.mkdirSync(path.dirname(fullPath), { recursive: true });
            fs.writeFileSync(fullPath, content, 'utf8');
          }
        } catch (e) {
          console.error('sync-files error:', e.message);
        }
        return;
      }

      // list-files — read the shell's cwd recursively and send back all files
      // as a JSON control message so the IDE can sync its file tree.
      if (parsed.type === 'list-files' && cwd) {
        try {
          const fileList = [];
          const MAX_FILE_SIZE = 512 * 1024; // 512 KB
          const SKIP_DIRS = new Set([
            'node_modules', '.git', '__pycache__', '.cache',
            'dist', 'build', '.next', '.turbo', 'coverage',
          ]);
          const MIME_MAP = {
            '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
            '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
            '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
            '.pdf': 'application/pdf',
            '.png': 'image/png',
            '.jpg': 'image/jpeg',
            '.jpeg': 'image/jpeg',
            '.gif': 'image/gif',
            '.webp': 'image/webp',
            '.zip': 'application/zip',
          };

          function walk(dir, prefix) {
            let entries;
            try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
            for (const entry of entries) {
              if (entry.name.startsWith('.')) continue;
              const fullPath = path.join(dir, entry.name);
              const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
              if (entry.isDirectory()) {
                if (!SKIP_DIRS.has(entry.name)) walk(fullPath, relPath);
              } else if (entry.isFile()) {
                try {
                  const stat = fs.statSync(fullPath);
                  if (stat.size > MAX_FILE_SIZE) continue;
                  const buf = fs.readFileSync(fullPath);
                  const ext = path.extname(entry.name).toLowerCase();
                  const mime = MIME_MAP[ext];
                  let content;
                  if (mime) {
                    content = `data:${mime};base64,${buf.toString('base64')}`;
                  } else {
                    // Detect binary by null bytes in first 8KB
                    const sample = buf.slice(0, 8192);
                    const isBinary = sample.includes(0);
                    if (isBinary) continue; // skip unknown binary files
                    content = buf.toString('utf8');
                  }
                  fileList.push({ path: relPath, content });
                } catch { continue; }
              }
            }
          }

          walk(cwd, '');

          if (ws.readyState === ws.OPEN) {
            ws.send(JSON.stringify({ __cc_ctrl: true, type: 'file-list', files: fileList }));
          }
        } catch (e) {
          console.error('list-files error:', e.message);
        }
        return;
      }
    } catch {}

    // Feed each character through the safety filter.
    // We buffer the current line so that when Enter arrives we can inspect the
    // full command before deciding whether to forward the keystroke to bash.
    let toWrite = '';
    for (const ch of str) {
      if (ch === '\r' || ch === '\n') {
        if (isBlockedCommand(lineBuffer)) {
          // Flush safe chars typed so far, then cancel the line with Ctrl-C.
          if (toWrite) { try { ptyProcess.write(toWrite); } catch {} toWrite = ''; }
          try { ptyProcess.write('\x03'); } catch {} // ^C clears bash readline
          const cmdName = lineBuffer.trim().split(/\s+/)[0] || 'command';
          setTimeout(() => {
            try {
              ws.send(`\r\n\x1b[31m\u26d4  Blocked: '${cmdName}' is not permitted in this environment.\x1b[0m\r\n`);
            } catch {}
          }, 40);
          lineBuffer = '';
          continue; // do NOT forward the Enter key
        }
        lineBuffer = '';
        toWrite += ch;
      } else if (ch === '\x7f' || ch === '\x08') {
        // Backspace — keep buffer in sync
        lineBuffer = lineBuffer.slice(0, -1);
        toWrite += ch;
      } else if (ch === '\x03') {
        // Ctrl-C — user cancelled the line themselves
        lineBuffer = '';
        toWrite += ch;
      } else {
        lineBuffer += ch;
        toWrite += ch;
      }
    }
    if (toWrite) { try { ptyProcess.write(toWrite); } catch {} }
  });

  ws.on('close', () => {
    try { ptyProcess?.kill(); } catch {}
  });

  ws.on('error', () => {
    try { ptyProcess?.kill(); } catch {}
  });
});

httpServer.listen(PORT, '0.0.0.0', () => {
  console.log(`Replit server running on port ${PORT}`);
});