#!/usr/bin/env bash
# agent-send.sh — standard inter-agent tmux messaging for the Mosaic stack.
#
# WHAT IT DOES
#   Sends a message to another agent's tmux pane (local or on a remote host)
#   with the canonical addressing preamble prepended:
#
#       [<src_host>:<src_session> -> <dst_host>:<dst_session>] <message>
#
#   The preamble makes every inter-agent message self-identifying, so a fresh
#   or context-wiped agent always knows who sent a message and to whom — no
#   ambiguity about lanes or origin. Recipients replying should FLIP the
#   preamble: [<dst> -> <src>] ... (this tool sends; it does not auto-reply).
#
#   Optionally tags the message with a TRIAGE CLASS (see -C / --class) so a
#   comms daemon can route it (deliver-to-agent vs log-and-drop) from an exact
#   field instead of re-deriving intent from the body.
#
# WHY A WRAPPER
#   Reliable submission into an interactive REPL (Claude Code / Codex) is fiddly:
#   a trailing Enter is often swallowed and the message sits as an unsubmitted
#   DRAFT. tools/tmux/send-message.sh already solves that for a LOCAL pane via
#   bracketed-paste + Enter-flush + draft-detection. For REMOTE targets this
#   wrapper SHIPS send-message.sh over ssh (stdin) and runs it there, so the
#   reliable send-keys happens local to the target pane — sidestepping the
#   ssh->nested-tmux Enter/C-m swallow entirely. No mosaic install needed on
#   the remote host; only bash + tmux + base64 (standard).
#
# USAGE
#   agent-send.sh [-L socket] -s <dst_session> -m "message"                 # local target
#   agent-send.sh [-L socket] -H user@host -s <dst_session> -m "message"    # remote target
#   agent-send.sh [-L socket] -H user@host -n <dst_hostname> -s <sess> -f msg.txt
#   agent-send.sh -s mos-claude --class terminal-log -m "ACK — received"
#   echo "msg" | agent-send.sh [-L socket] -H user@host -s <dst_session>
#
# OPTIONS
#   -L NAME         tmux socket name passed to `tmux -L NAME` on the target host
#
# Exit 4: local target session exists on multiple socket servers and no
#         -L / MOSAIC_TMUX_SOCKET disambiguated it (B1 stale-twin guard).
#   -s DST_SESSION  target tmux session (or session:window.pane)   [required]
#   -H SSH_TARGET   ssh target (user@host) for a remote pane; omit for local
#   -n DST_HOST     hostname to show in the preamble for the target.
#                   Default: local hostname, or (remote) resolved via one ssh.
#   -m MESSAGE      message text (single- or multi-line)
#   -f FILE         read message from FILE instead of -m
#   -C CLASS        triage class for a comms daemon. One of:
#                     terminal-log  log-only; never needs the agent's attention
#                     actionable    carries a decision/blocker/gate — deliver
#                     human         from a human operator — deliver
#                     reaction      an emoji/ack reaction
#                     digest        machine-wake, coalescible; batched wake/heartbeat signal
#                   Long form: --class CLASS (or --class=CLASS). When SET, the
#                   preamble carries a ` class=<CLASS>` token INSIDE the bracket:
#                       [<src> -> <dst> class=terminal-log] <message>
#                   When OMITTED, NO token is emitted and the preamble is
#                   byte-for-byte identical to the classic format. Consumers MUST
#                   treat an absent class as 'actionable' (fail-safe: agent sees it).
#   -S SRC_LABEL    override source label "<host>:<session>" (default: auto)
#   -r N            Enter-flush attempts passed through (default 2)
#   -v              verbose: print pane tail after delivery
#   -h              help
#
# PREAMBLE GRAMMAR  (for consumers / daemons mirroring this producer)
#   ^\[(\S+) -> (\S+?)(?: class=(terminal-log|actionable|human|reaction|digest))?\] (.*)$
#     group 1 = src label   group 2 = dst host:session
#     group 3 = class (absent => actionable)   group 4 = message body
#
# EXIT CODES  (passed through from send-message.sh, except 4)
#   0 delivered/queued · 1 target not found · 2 still draft · 3 usage error
#   4 agent-send refusal: local target session exists on multiple socket
#     servers and no -L / MOSAIC_TMUX_SOCKET disambiguated it (B1)
set -uo pipefail

SELF_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
# Sender is overridable via env purely for testing (inject a capture stub). The
# default is the canonical send-message.sh beside this script; production callers
# never set AGENT_SEND_SENDER, so behavior is unchanged.
SENDER="${AGENT_SEND_SENDER:-$SELF_DIR/send-message.sh}"

# Translate the long option --class[=value] into "-C value" so getopts (which is
# short-option-only) can parse it. Every other argument passes through untouched,
# so callers that never use --class hit the exact original getopts path.
args=()
while [ $# -gt 0 ]; do
  case "$1" in
    --class)   [ $# -ge 2 ] || { echo "ERROR: --class requires a value" >&2; exit 3; }
               args+=(-C "$2"); shift 2 ;;
    --class=*) args+=(-C "${1#*=}"); shift ;;
    *)         args+=("$1"); shift ;;
  esac
done
set -- ${args[@]+"${args[@]}"}

DST_SESSION=""; SSH_TARGET=""; DST_HOST=""; MSG=""; FILE=""; SOCKET_NAME=""
SRC_LABEL=""; RETRIES=2; VERBOSE=0; CLASS=""
usage() { sed -n '2,/^set -uo pipefail/{/^set -uo pipefail/d;p}' "$0"; exit "${1:-3}"; }

while getopts "L:s:H:n:m:f:S:r:C:vh" o; do
  case "$o" in
    L) SOCKET_NAME=$OPTARG ;;
    s) DST_SESSION=$OPTARG ;; H) SSH_TARGET=$OPTARG ;; n) DST_HOST=$OPTARG ;;
    m) MSG=$OPTARG ;; f) FILE=$OPTARG ;; S) SRC_LABEL=$OPTARG ;;
    C) CLASS=$OPTARG ;;
    r) RETRIES=$OPTARG ;; v) VERBOSE=1 ;; h) usage 0 ;; *) usage 3 ;;
  esac
done

[ -n "$DST_SESSION" ] || { echo "ERROR: -s DST_SESSION is required" >&2; usage 3; }
[ -x "$SENDER" ] || { echo "ERROR: send-message.sh not found beside this script" >&2; exit 3; }

# Validate the triage class only when one was given. An absent class emits NO
# token (preamble byte-identical to the classic format); the consumer defaults
# absent => actionable.
CLASS_TOKEN=""
if [ -n "$CLASS" ]; then
  case "$CLASS" in
    terminal-log|actionable|human|reaction|digest) CLASS_TOKEN=" class=${CLASS}" ;;
    *) echo "ERROR: invalid --class '$CLASS' (allowed: terminal-log, actionable, human, reaction, digest)" >&2; exit 3 ;;
  esac
fi

# Message body from -f / -m / stdin.
if   [ -n "$FILE" ]; then [ -r "$FILE" ] || { echo "ERROR: cannot read $FILE" >&2; exit 3; }; MSG=$(cat -- "$FILE")
elif [ -z "$MSG" ] && [ ! -t 0 ]; then MSG=$(cat)
fi
[ -n "$MSG" ] || { echo "ERROR: empty message (use -m, -f, or stdin)" >&2; exit 3; }

# Source label: this agent's host:session (auto-detected, overridable).
if [ -z "$SRC_LABEL" ]; then
  src_host=$(hostname -s 2>/dev/null || echo "?")
  src_sess=${MOSAIC_AGENT_NAME:-}
  if [ -z "$src_sess" ]; then
    if [ -n "${TMUX:-}" ]; then
      # Inside tmux: display-message resolves against this client's own session.
      src_sess=$(tmux display-message -p '#S' 2>/dev/null || echo "?")
    else
      # Outside tmux with no name: display-message reports the LAST-ACTIVE
      # session — someone else's identity (measured 2026-08-20: a nameless
      # non-tmux sender was stamped "peggy", a live seat, forged silently).
      # Stamp an explicit unverified label instead; deliberate senders use -S.
      src_sess="unverified"
    fi
  fi
  SRC_LABEL="${src_host}:${src_sess}"
fi

# Destination host label for the preamble.
if [ -z "$DST_HOST" ]; then
  if [ -n "$SSH_TARGET" ]; then
    DST_HOST=$(ssh -o ConnectTimeout=8 -o BatchMode=yes "$SSH_TARGET" 'hostname -s' 2>/dev/null || echo "${SSH_TARGET#*@}")
  else
    DST_HOST=$(hostname -s 2>/dev/null || echo "local")
  fi
fi

PREAMBLE="[${SRC_LABEL} -> ${DST_HOST}:${DST_SESSION}${CLASS_TOKEN}]"
FULL="${PREAMBLE} ${MSG}"
B64=$(printf '%s' "$FULL" | base64 -w0)

vflag=""; [ "$VERBOSE" = 1 ] && vflag="-v"

# Exact session matching for the sender target (codex PR #1466): without
# '=', tmux target syntax accepts an unambiguous PREFIX, so a delivery
# aimed at session X can land in X-old. Compound targets (session:win.pane)
# and already-exact ('=...') forms pass through untouched. Computed BEFORE
# socket discovery so the discovery probes use the same target semantics
# (probing '==name' for an already-exact input was a false-negative hit).
DST_TARGET="$DST_SESSION"
case "$DST_SESSION" in
  =*) ;;
  *:*)
    # Compound target (session:win.pane): pin the SESSION component exact
    # (=session:win.pane); unpinned, the session part still prefix-matches
    # (codex PR #1466: 'agent:0.0' can resolve into 'agent-old').
    DST_TARGET="=${DST_SESSION%%:*}:${DST_SESSION#*:}"
    ;;
  *) DST_TARGET="=$DST_SESSION" ;;
esac

# Socket default resolution (B1, 2026-08-29). Precedence: explicit -L >
# launcher-exported MOSAIC_TMUX_SOCKET > unique socket hit > refusal on
# ambiguity > tmux default socket. The ambiguity refusal fires ONLY when
# no explicit or env choice exists and the session name lives on multiple
# servers (measured 2026-08-28/29: tasking sends landed in a stale
# default-socket twin; rc 0 reported honest delivery to the wrong pane).
# Socket discovery scans tmux's own socket dir, ${TMUX_TMPDIR:-/tmp}/tmux-UID
# (codex PR #1466: TMPDIR is not where tmux keeps -L sockets).
# MOSAIC_TMUX_SOCKET is LOCAL-host state (launcher-exported): it must not
# leak into remote sends, where -L would target a socket on the remote
# host (codex PR #1466).
if [ -z "$SOCKET_NAME" ] && [ -z "$SSH_TARGET" ] && [ -n "${MOSAIC_TMUX_SOCKET:-}" ]; then
  SOCKET_NAME="$MOSAIC_TMUX_SOCKET"
fi
if [ -z "$SOCKET_NAME" ] && [ -z "$SSH_TARGET" ]; then
  socket_dir="${TMUX_TMPDIR:-/tmp}/tmux-$(id -u)"
  hits=""
  for sf in "$socket_dir"/*; do
    [ -S "$sf" ] || continue
    sname="${sf##*/}"
    # '=' forces exact session-name matching: tmux target syntax otherwise
    # accepts an unambiguous PREFIX, so a session named X-old on a socket
    # would count as a false hit for target X (codex PR #1466).
    tmux -L "$sname" has-session -t "$DST_TARGET" 2>/dev/null && hits="$hits$sname"$'\n'
  done
  hit_count=$(printf '%s' "$hits" | grep -c . || true)
  if [ "$hit_count" -gt 1 ]; then
    echo "agent-send.sh: REFUSING - session '$DST_SESSION' exists on multiple sockets:" >&2
    printf '  %s\n' $hits >&2
    echo "  Pass -L <socket> explicitly (or export MOSAIC_TMUX_SOCKET to disambiguate)." >&2
    exit 4
  elif [ "$hit_count" -eq 1 ]; then
    SOCKET_NAME="$(printf '%s' "$hits")"
  fi
fi

socket_args=()
if [ -n "$SOCKET_NAME" ]; then
  socket_args=(-L "$SOCKET_NAME")
fi

if [ -z "$SSH_TARGET" ]; then
  # Local pane: call the canonical sender directly.
  exec "$SENDER" "${socket_args[@]}" -t "$DST_TARGET" -b "$B64" -r "$RETRIES" $vflag
else
  # Remote pane: ship the sender over ssh and run it local to the target.
  ssh -o ConnectTimeout=10 "$SSH_TARGET" \
      "bash -s -- ${socket_args[*]@Q} -t '$DST_TARGET' -b '$B64' -r '$RETRIES' $vflag" < "$SENDER"
fi