# copilot/intent_parser.py
from pydantic import BaseModel, Field
from typing import Literal, Optional

class CommandIntent(BaseModel):
    """命令意图定义"""
    action: Literal[
        "diagnose", "monitor", "manage", "debug", "optimize", "security"
    ] = Field(..., description="操作类型")
    target: str = Field(..., description="操作目标，如 'nginx', 'docker', 'system'")
    command: str = Field(..., description="生成的具体命令")
    explanation: str = Field(..., description="命令说明")
    risk_level: Literal["low", "medium", "high"] = Field(
        ..., description="风险等级"
    )
    requires_approval: bool = Field(
        False, description="是否需要人工确认"
    )

    def validate_safety(self) -> bool:
        """安全校验：拒绝高危危险操作"""
        dangerous_patterns = [
            r"rm\s+/-rf\s*/", r">\s*/dev/sda", r"dd\s+if=.*of=/dev/"
        ]
        import re
        for pattern in dangerous_patterns:
            if re.search(pattern, self.command):
                return False
        return True

# Dockerfile.sandbox
FROM ubuntu:22.04

# 安装常用运维工具
RUN apt-get update && apt-get install -y \
    procps net-tools iproute2 curl wget \
    htop iotop nload lm-sensors \
    docker.io nginx mysql-client postgresql-client \
    && rm -rf /var/lib/apt/lists/*

# 限制资源
CMD ["/bin/bash"]

# copilot/sandbox.py
import docker
import json
from datetime import timedelta

class CommandSandbox:
    def __init__(self):
        self.client = docker.from_env()
        self.container = None

    def execute(self, command: str, timeout: int = 30) -> dict:
        """在沙箱中执行命令，返回结构化结果"""
        self.container = self.client.containers.run(
            "vps-copilot-sandbox:latest",
            command,
            detach=True,
            network_mode="none",  # 禁用网络，防止命令外发
            mem_limit="512m",
            cpu_period=100000,
            cpu_quota=200000,   # 限制 0.2 CPU
            read_only=True,
            tmpfs={"/tmp": "rw,nosuid,noexec,size=64m"},
            security_opt=["no-new-privileges:true"],
            user="nobody",
        )

        try:
            result = self.container.wait(timeout=timeout)
            logs = self.container.logs().decode("utf-8", errors="replace")
            exit_code = result.get("StatusCode", -1)

            return {
                "exit_code": exit_code,
                "stdout": logs,
                "success": exit_code == 0,
                "sandbox_id": self.container.id[:12],
            }
        finally:
            self.container.remove(force=True)

# copilot/context_manager.py
from langchain_community.vectorstores import Chroma
from langchain_community.embeddings import OllamaEmbeddings
from langchain.chains import LLMChain
from langchain.prompts import PromptTemplate
import json
import os

class VPSContextManager:
    def __init__(self, llm_model: str = "deepseek-r1:8b"):
        self.embeddings = OllamaEmbeddings(model=llm_model)
        self.vectorstore = Chroma(
            persist_directory="./data/vps_knowledge",
            embedding_function=self.embeddings,
        )
        self.session_history = []
        self.system_state = self._collect_system_state()

    def _collect_system_state(self) -> dict:
        """收集当前 VPS 系统状态作为上下文"""
        state = {
            "os": self._run_simple("cat /etc/os-release | grep PRETTY_NAME"),
            "cpu": self._run_simple("nproc"),
            "memory_total_gb": self._run_simple(
                "free -g | awk '/^Mem:/{print $2}'"
            ),
            "disk_total_gb": self._run_simple(
                "df -BG / | awk 'NR==2{print $2}' | tr -d 'G'"
            ),
            "running_services": self._run_simple(
                "systemctl list-units --type=service --state=running "
                "| awk 'NR>2{print $1}' | sed 's/.service//'"
            ),
            "uptime": self._run_simple("uptime -p"),
        }
        return state

    def add_to_context(self, message: str, role: str = "user"):
        """添加对话历史到上下文"""
        self.session_history.append({
            "role": role,
            "content": message,
            "timestamp": __import__("datetime").datetime.now().isoformat(),
        })
        # 保留最近 20 轮对话
        if len(self.session_history) > 20:
            self.session_history = self.session_history[-20:]

    def get_system_prompt(self) -> str:
        """构建包含系统状态的完整提示词"""
        state_desc = json.dumps(self.system_state, ensure_ascii=False, indent=2)
        history_desc = json.dumps(
            self.session_history[-10:], ensure_ascii=False, indent=2
        )

        return f"""你是一个专业的 VPS 运维 AI 助手。

【当前系统状态】
{state_desc}

【最近对话历史】
{history_desc}

请根据系统状态和历史对话，为用户提供精准、安全的运维建议。
对于可能影响生产环境的操作，务必标注风险等级并请求确认。"""

# copilot/diagnostician.py
class VPSDiagnostician:
    """智能诊断引擎"""

    DIAGNOSTIC_CHECKS = {
        "cpu": {
            "command": "top -bn1 | head -20",
            "alert_threshold": {"load_avg_1min": 8.0, "cpu_usage": 90},
        },
        "memory": {
            "command": "free -h && vmstat -s",
            "alert_threshold": {"memory_usage": 85, "swap_usage": 70},
        },
        "disk": {
            "command": "df -h && du -sh /var/log/* 2>/dev/null | sort -hr | head -10",
            "alert_threshold": {"disk_usage": 90},
        },
        "network": {
            "command": "ss -tuln | head -30 && curl -s --max-time 5 https://www.baidu.com > /dev/null && echo 'Network OK'",
            "alert_threshold": {"connection_count": 1000},
        },
        "process": {
            "command": "ps aux --sort=-%mem | head -15",
            "alert_threshold": {"max_procs": 500},
        },
    }

    def diagnose(self, scope: str = "all") -> dict:
        """执行诊断并返回结构化结果"""
        results = {}
        if scope == "all":
            checks = self.DIAGNOSTIC_CHECKS
        else:
            checks = {scope: self.DIAGNOSTIC_CHECKS[scope]}

        for check_name, config in checks.items():
            output = self._execute_command(config["command"])
            alerts = self._analyze_output(check_name, output, config["alert_threshold"])
            results[check_name] = {
                "output": output[:2000],  # 截断长输出
                "alerts": alerts,
                "status": "healthy" if not alerts else "warning",
            }

        return results

    def _analyze_output(self, check_name: str, output: str, thresholds: dict) -> list:
        """分析诊断输出，检测告警"""
        alerts = []
        import re

        if check_name == "disk":
            match = re.search(r'(\d+)%\s+/', output)
            if match and int(match.group(1)) > thresholds.get("disk_usage", 90):
                alerts.append({
                    "level": "critical",
                    "message": f"磁盘使用率 {match.group(1)}% 超过阈值",
                    "suggestion": "清理 /var/log 或旧备份文件",
                })

        if check_name == "memory":
            match = re.search(r'Mem:\s*\d+.*?(\d+)%', output)
            if match and int(match.group(1)) > thresholds.get("memory_usage", 85):
                alerts.append({
                    "level": "warning",
                    "message": f"内存使用率 {match.group(1)}% 偏高",
                    "suggestion": "检查内存占用进程，考虑增加 swap 或升级配置",
                })

        return alerts

# docker-compose.yml
version: "3.8"

services:
  copilot-api:
    build: .
    container_name: vps-copilot-api
    ports:
      - "8080:8080"
    environment:
      - LLM_PROVIDER=ollama
      - OLLAMA_HOST=http://ollama:11434
      - LLM_MODEL=deepseek-r1:8b
      - AUTH_SECRET=${AUTH_SECRET}
      - ENABLE_DANGER_APPROVAL=true
    volumes:
      - ./data:/app/data
      - /var/run/docker.sock:/var/run/docker.sock:ro  # 仅读取权限
    networks:
      - copilot-net
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true

  ollama:
    image: ollama/ollama:latest
    container_name: vps-copilot-ollama
    ports:
      - "11434:11434"
    volumes:
      - ./ollama-data:/root/.ollama
    networks:
      - copilot-net
    restart: unless-stopped

  chroma:
    image: chromadb/chroma:latest
    container_name: vps-copilot-chroma
    volumes:
      - ./chroma-data:/chroma/chroma
    networks:
      - copilot-net
    restart: unless-stopped

networks:
  copilot-net:
    driver: bridge

# api/routes.py
from fastapi import FastAPI, WebSocket, WebSocketDisconnect, HTTPException
from fastapi.middleware.cors import CORSMiddleware
from pydantic import BaseModel
import asyncio

app = FastAPI(title="VPS Copilot API", version="1.0.0")

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_methods=["*"],
    allow_headers=["*"],
)

class ChatRequest(BaseModel):
    message: str
    session_id: str = ""
    stream: bool = True

class ChatResponse(BaseModel):
    response: str
    commands_executed: list[dict] = []
    diagnostics: dict = {}

@app.post("/api/chat", response_model=ChatResponse)
async def chat(request: ChatRequest):
    """处理自然语言指令"""
    copilot = get_copilot_instance(request.session_id)
    response = await copilot.process_message(request.message)

    # 安全审计
    audit_log = await security_auditor.log(
        session_id=request.session_id,
        message=request.message,
        commands=response.commands_executed,
    )

    return ChatResponse(
        response=response.text,
        commands_executed=response.commands_executed,
        diagnostics=response.diagnostics,
    )

@app.websocket("/ws/terminal")
async def terminal_websocket(websocket: WebSocket):
    """实时终端 WebSocket"""
    await websocket.accept()
    try:
        while True:
            data = await websocket.receive_text()
            response = await process_terminal_input(data, websocket)
            await websocket.send_text(response)
    except WebSocketDisconnect:
        print("Client disconnected")

// config/rbac.json
{
  "roles": {
    "admin": {
      "permissions": ["read", "write", "execute", "approve", "manage"],
      "dangerous_commands": false,
      "max_concurrent_sessions": 10
    },
    "operator": {
      "permissions": ["read", "execute"],
      "dangerous_commands": true,
      "requires_approval_for": ["systemctl restart", "iptables"],
      "max_concurrent_sessions": 3
    },
    "viewer": {
      "permissions": ["read"],
      "dangerous_commands": false,
      "max_concurrent_sessions": 1
    }
  }
}

# copilot/security.py
import json
import logging
from datetime import datetime
from pathlib import Path

AUDIT_LOG = Path("/var/log/vps-copilot/audit.log")

class SecurityAuditor:
    def __init__(self):
        AUDIT_LOG.parent.mkdir(parents=True, exist_ok=True)
        self.logger = logging.getLogger("copilot.audit")

    async def log(self, session_id: str, message: str,
                  commands: list[dict], user: str = "anonymous") -> dict:
        """记录操作审计日志"""
        entry = {
            "timestamp": datetime.now().isoformat(),
            "session_id": session_id,
            "user": user,
            "natural_language": message,
            "commands_executed": commands,
            "risk_assessment": self._assess_risk(commands),
            "audit_id": self._generate_audit_id(),
        }

        with open(AUDIT_LOG, "a") as f:
            f.write(json.dumps(entry, ensure_ascii=False) + "\n")

        return entry

    def _assess_risk(self, commands: list[dict]) -> str:
        """评估操作风险等级"""
        risk_score = 0
        for cmd in commands:
            if "rm -rf" in cmd.get("command", ""):
                risk_score += 10
            if "iptables" in cmd.get("command", ""):
                risk_score += 5
            if "systemctl" in cmd.get("command", ""):
                risk_score += 3

        if risk_score >= 10:
            return "critical"
        elif risk_score >= 5:
            return "high"
        return "low"