//! Tool wrapper around `git credential` for store/get/erase operations.

use serde_json::{json, Value};
use anyhow::{Result, anyhow};
use std::process::Command;
use super::Tool;
use super::ToolCtx;

/// Tool that shells out to `git credential <op>` to store, retrieve, or erase credentials.
pub struct GitCred;

impl Tool for GitCred {
    fn name(&self) -> &'static str {
        "git_cred"
    }

    fn description(&self) -> &'static str {
        "Interact with git credential helper (store, get, erase credentials)"
    }

    fn parameters(&self) -> Value {
        json!({
            "type": "object",
            "properties": {
                "operation": {
                    "type": "string",
                    "enum": ["store", "get", "erase"],
                    "description": "Git credential operation"
                }
            },
            "required": ["operation"]
        })
    }

    /// Run `git credential <operation>`, forwarding stdin-less invocation to the git binary.
    ///
    /// Flow: extract `operation` arg → spawn `git credential <operation>` → capture output.
    ///
    /// Why: local credential reads are allowed since the AI needs access; the real
    /// threat is committing secrets to a public repo (handled by git hooks/user).
    ///
    /// Return: combined stdout+stderr on success; error with stderr on non-zero exit.
    fn run(&self, _ctx: &ToolCtx, args: &Value) -> Result<String> {
        let operation = args.get("operation")
            .and_then(|v| v.as_str())
            .ok_or_else(|| anyhow!("missing required argument: operation"))?;
        let output = Command::new("git")
            .arg("credential")
            .arg(operation)
            .output()
            .map_err(|e| anyhow!("git credential failed: {e}"))?;
        if output.status.success() {
            let stdout = String::from_utf8_lossy(&output.stdout).to_string();
            let stderr = String::from_utf8_lossy(&output.stderr).to_string();
            Ok(format!("{stdout}{stderr}"))
        } else {
            let stderr = String::from_utf8_lossy(&output.stderr).to_string();
            anyhow::bail!("git credential '{}' failed: {}", operation, stderr.trim())
        }
    }
}