push.js

#!/usr/bin/env node

/**
 * Mega Brain - Smart Multi-Layer Push System v2.0
 *
 * Pushes content to the appropriate git remote based on layer selection:
 *   Layer 1 (public)  → Community content, respects .gitignore → remote "origin"
 *   Layer 2 (premium) → Layer 1 + premium manifest paths → remote "premium"
 *   Layer 3 (backup)  → Everything, no filtering → remote "backup"
 *
 * Usage:
 *   mega-brain push               Interactive layer selection
 *   mega-brain push --layer 1     Direct push to Layer 1
 *   mega-brain push --layer 2     Direct push to Layer 2
 *   mega-brain push --layer 3     Direct push to Layer 3
 *   mega-brain push --dry-run     Show what would happen without executing
 *   mega-brain push --message "x" Commit message (skips prompt)
 *
 * Remotes (configure via git remote):
 *   origin  → <your-github>/mega-brain.git
 *   premium → <your-github>/mega-brain-premium.git
 *   backup  → <your-github>/mega-brain-full.git
 */

import { readFileSync, existsSync } from 'fs';
import { resolve, dirname } from 'path';
import { fileURLToPath } from 'url';
import { execFileSync } from 'child_process';
import inquirer from 'inquirer';
import chalk from 'chalk';
import ora from 'ora';
import boxen from 'boxen';

// ---------------------------------------------------------------------------
// Constants
// ---------------------------------------------------------------------------

const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const PROJECT_ROOT = resolve(__dirname, '..');

const LAYER_CONFIG = {
  1: {
    name: 'Community',
    label: 'Layer 1 — Community (publico, npm)',
    remote: 'origin',
    remoteUrl: 'https://github.com/<your-username>/mega-brain.git',
    color: '#6366f1',
  },
  2: {
    name: 'Premium',
    label: 'Layer 2 — Premium (MoneyClub, privado)',
    remote: 'premium',
    remoteUrl: 'https://github.com/<your-username>/mega-brain-premium.git',
    color: '#f59e0b',
  },
  3: {
    name: 'Full Backup',
    label: 'Layer 3 — Full Backup (tudo, privado)',
    remote: 'backup',
    remoteUrl: 'https://github.com/<your-username>/mega-brain-full.git',
    color: '#ef4444',
  },
};

const SENSITIVE_PATTERNS = [
  /github_pat_[A-Za-z0-9_]{20,}/,
  /ghp_[A-Za-z0-9]{20,}/,
  /gho_[A-Za-z0-9]{20,}/,
  /ghs_[A-Za-z0-9]{20,}/,
];

// sk-ant- check: match the prefix but NOT the known placeholder
const SK_ANT_REAL = /sk-ant-(?!api03-sua-chave-aqui)[A-Za-z0-9_-]+/;

// Excluded personas — add names of persona directories that should NOT go to Layer 2
const LAYER2_EXCLUDED_PERSONAS = ['example-persona-1', 'example-persona-2'];

// ---------------------------------------------------------------------------
// Git helpers
// ---------------------------------------------------------------------------

function git(args, opts = {}) {
  try {
    // Signal pre-push hook that push.js already validated this push
    const env = args[0] === 'push'
      ? { ...process.env, MEGA_BRAIN_PUSH_VALIDATED: 'true', ...opts.env }
      : { ...process.env, ...opts.env };

    return execFileSync('git', args, {
      cwd: PROJECT_ROOT,
      encoding: 'utf-8',
      stdio: opts.silent ? 'pipe' : 'inherit',
      env,
      ...opts,
    });
  } catch (err) {
    if (opts.silent) return '';
    throw err;
  }
}

function gitSilent(...args) {
  return git(args, { silent: true, stdio: 'pipe' }).trim();
}

function getRemotes() {
  const output = gitSilent('remote', '-v');
  const remotes = {};
  for (const line of output.split('\n')) {
    const match = line.match(/^(\S+)\s+(\S+)\s+\(push\)/);
    if (match) remotes[match[1]] = match[2];
  }
  return remotes;
}

function getCurrentBranch() {
  return gitSilent('rev-parse', '--abbrev-ref', 'HEAD') || 'main';
}

function hasUncommittedChanges() {
  return gitSilent('status', '--porcelain').length > 0;
}

function getStatusSummary() {
  const status = gitSilent('status', '--porcelain');
  if (!status) return null;
  const lines = status.split('\n').filter(Boolean);
  return {
    total: lines.length,
    preview: lines.slice(0, 8),
    hasMore: lines.length > 8,
    remaining: Math.max(0, lines.length - 8),
  };
}

// ---------------------------------------------------------------------------
// CLI argument parsing
// ---------------------------------------------------------------------------

function parseArgs(argv) {
  const args = argv.slice(2).filter((a) => a !== 'push');
  const result = { layer: null, dryRun: false, message: null };

  for (let i = 0; i < args.length; i++) {
    if (args[i] === '--layer' && args[i + 1]) {
      const num = parseInt(args[i + 1], 10);
      if ([1, 2, 3].includes(num)) result.layer = num;
      i++;
    } else if (args[i] === '--dry-run') {
      result.dryRun = true;
    } else if ((args[i] === '--message' || args[i] === '-m') && args[i + 1]) {
      result.message = args[i + 1];
      i++;
    }
  }

  return result;
}

// ---------------------------------------------------------------------------
// Layer 2 manifest parsing
// ---------------------------------------------------------------------------

function loadLayer2ManifestPaths() {
  const manifestPath = resolve(PROJECT_ROOT, '.github', 'layer2-manifest.txt');
  if (!existsSync(manifestPath)) return [];

  const content = readFileSync(manifestPath, 'utf-8');
  const paths = [];
  let inExclusions = false;

  for (const raw of content.split('\n')) {
    const line = raw.trim();
    if (line.includes('LAYER 3 EXCLUSIONS')) {
      inExclusions = true;
      continue;
    }
    if (inExclusions) continue;
    if (!line || line.startsWith('#')) continue;
    paths.push(line.replace(/\/+$/, ''));
  }

  return paths;
}

function loadLayer3ManifestPaths() {
  const manifestPath = resolve(PROJECT_ROOT, '.github', 'layer3-manifest.txt');
  if (!existsSync(manifestPath)) return [];

  const content = readFileSync(manifestPath, 'utf-8');
  const paths = [];

  for (const raw of content.split('\n')) {
    const line = raw.trim();
    if (line.includes('ALWAYS EXCLUDED')) break;
    if (!line || line.startsWith('#')) continue;
    paths.push(line.replace(/\/+$/, ''));
  }

  return paths;
}

/**
 * Load Layer 1 allowlist paths.
 * Layer 2 needs these to be complete (Layer 2 = Layer 1 + Premium).
 */
function loadLayer1AllowlistPaths() {
  const allowlistPath = resolve(PROJECT_ROOT, '.github', 'layer1-allowlist.txt');
  if (!existsSync(allowlistPath)) return [];

  const content = readFileSync(allowlistPath, 'utf-8');
  const paths = [];

  for (const raw of content.split('\n')) {
    const line = raw.trim();
    if (!line || line.startsWith('#')) continue;
    // Skip .gitkeep entries - they're just placeholders
    if (line.endsWith('.gitkeep')) continue;
    paths.push(line.replace(/\/+$/, ''));
  }

  return paths;
}

// Files that must NEVER be pushed to any remote
const SECRET_FILES = [
  '.env', '.env.local', '.env.production', '.env.development',
  '.mcp.json', 'credentials.json', 'token.json', 'token_write.json',
  'settings.local.json', '.claude/settings.local.json',
];

// ---------------------------------------------------------------------------
// Pre-push validation
// ---------------------------------------------------------------------------

/**
 * Validate the repository state for the target layer.
 * Returns { ok: boolean, warnings: string[], errors: string[] }
 */
function validateForLayer(layer) {
  const warnings = [];
  const errors = [];

  if (layer === 1) {
    // --- Check phantom tracked files (files tracked but should be ignored) ---
    const phantoms = gitSilent('ls-files', '-ci', '--exclude-standard');
    if (phantoms) {
      const phantomList = phantoms.split('\n').filter(Boolean);
      warnings.push(
        `${phantomList.length} arquivo(s) fantasma encontrado(s) (tracked mas deveria ser ignorado):\n` +
        phantomList.slice(0, 5).map((f) => `      ${chalk.dim(f)}`).join('\n') +
        (phantomList.length > 5 ? `\n      ${chalk.dim(`... e mais ${phantomList.length - 5}`)}` : '')
      );
    }

    // --- Check for real API keys in tracked files ---
    const trackedFiles = gitSilent('ls-files').split('\n').filter(Boolean);
    const keyFindings = [];

    for (const file of trackedFiles) {
      // Skip binary-like extensions
      if (/\.(png|jpg|jpeg|gif|ico|svg|woff2?|ttf|eot|pdf|zip|tar|gz)$/i.test(file)) continue;

      const filePath = resolve(PROJECT_ROOT, file);
      if (!existsSync(filePath)) continue;

      let content;
      try {
        content = readFileSync(filePath, 'utf-8');
      } catch {
        continue; // skip unreadable files
      }

      for (const pattern of SENSITIVE_PATTERNS) {
        if (pattern.test(content)) {
          keyFindings.push(`${file} contém token sensível (${pattern.source.slice(0, 15)}...)`);
          break;
        }
      }

      if (SK_ANT_REAL.test(content)) {
        keyFindings.push(`${file} contém chave Anthropic real (sk-ant-...)`);
      }
    }

    if (keyFindings.length > 0) {
      errors.push(
        `Chaves/tokens sensíveis detectados em arquivos tracked:\n` +
        keyFindings.map((f) => `      ${chalk.red(f)}`).join('\n')
      );
    }

    // --- Check no .env is tracked (exclude .env.example which is OK) ---
    const trackedEnv = trackedFiles.filter((f) =>
      (f === '.env' || f.match(/^\.env\.\w/)) && !f.endsWith('.example')
    );
    if (trackedEnv.length > 0) {
      errors.push(
        `Arquivo .env está tracked:\n` +
        trackedEnv.map((f) => `      ${chalk.red(f)}`).join('\n')
      );
    }
  }

  if (layer === 2) {
    const manifestPaths = loadLayer2ManifestPaths();

    // --- Check excluded personas are not in manifest paths ---
    for (const persona of LAYER2_EXCLUDED_PERSONAS) {
      const found = manifestPaths.filter((p) => p.includes(persona));
      if (found.length > 0) {
        errors.push(
          `Persona excluída "${persona}" encontrada nos caminhos do manifest:\n` +
          found.map((f) => `      ${chalk.red(f)}`).join('\n')
        );
      }
    }

    // --- Check no .env or .claude/agent-memory/ in manifest paths ---
    for (const mp of manifestPaths) {
      if (mp.includes('.env')) {
        errors.push(`Caminho do manifest contém .env: ${mp}`);
      }
      if (mp.includes('.claude/agent-memory')) {
        errors.push(`Caminho do manifest contém agent-memory: ${mp}`);
      }
    }

    // --- Check on-disk files: no excluded personas in premium content ---
    for (const mp of manifestPaths) {
      const fullPath = resolve(PROJECT_ROOT, mp);
      if (!existsSync(fullPath)) continue;

      for (const persona of LAYER2_EXCLUDED_PERSONAS) {
        // Check if any file inside the manifest path contains excluded persona name
        try {
          const checkOutput = execFileSync(
            'git', ['ls-files', mp],
            { cwd: PROJECT_ROOT, encoding: 'utf-8', stdio: 'pipe' }
          ).trim();
          const matchingFiles = checkOutput.split('\n').filter((f) => f && f.includes(persona));
          if (matchingFiles.length > 0) {
            warnings.push(
              `Conteúdo Layer 3 "${persona}" encontrado em ${mp}:\n` +
              matchingFiles.slice(0, 3).map((f) => `      ${chalk.dim(f)}`).join('\n')
            );
          }
        } catch {
          // Ignore errors
        }
      }
    }
  }

  // Layer 3: no validation needed

  return {
    ok: errors.length === 0,
    warnings,
    errors,
  };
}

// ---------------------------------------------------------------------------
// Interactive layer selection
// ---------------------------------------------------------------------------

async function selectLayerInteractive() {
  console.log();

  const { layer } = await inquirer.prompt([
    {
      type: 'list',
      name: 'layer',
      message: chalk.cyan('Para qual layer deseja publicar?'),
      choices: [
        {
          name:
            chalk.bold.hex('#6366f1')('Layer 1') +
            chalk.white(' — Community ') +
            chalk.dim('(publico, npm)'),
          value: 1,
        },
        {
          name:
            chalk.bold.hex('#f59e0b')('Layer 2') +
            chalk.white(' — Premium ') +
            chalk.dim('(MoneyClub, privado)'),
          value: 2,
        },
        {
          name:
            chalk.bold.hex('#ef4444')('Layer 3') +
            chalk.white(' — Full Backup ') +
            chalk.dim('(tudo, privado)'),
          value: 3,
        },
      ],
      loop: false,
    },
  ]);

  return layer;
}

// ---------------------------------------------------------------------------
// Commit message prompt
// ---------------------------------------------------------------------------

async function promptCommitMessage(defaultPrefix) {
  const { message } = await inquirer.prompt([
    {
      type: 'input',
      name: 'message',
      message: chalk.cyan('Mensagem do commit:'),
      default: defaultPrefix,
      validate: (input) => (input.trim() ? true : chalk.red('Mensagem nao pode estar vazia.')),
    },
  ]);
  return message.trim();
}

// ---------------------------------------------------------------------------
// Confirmation prompt
// ---------------------------------------------------------------------------

async function confirmAction(question) {
  const { confirmed } = await inquirer.prompt([
    {
      type: 'confirm',
      name: 'confirmed',
      message: chalk.cyan(question),
      default: true,
    },
  ]);
  return confirmed;
}

// ---------------------------------------------------------------------------
// Layer 1 Push Flow
// ---------------------------------------------------------------------------

async function pushLayer1({ dryRun, message }) {
  const config = LAYER_CONFIG[1];
  const branch = getCurrentBranch();

  // Step 1: Validate
  const spinner = ora({ text: 'Validando para Layer 1...', color: 'cyan' }).start();
  const validation = validateForLayer(1);

  if (validation.warnings.length > 0) {
    spinner.warn(chalk.yellow('Avisos de validacao:'));
    for (const w of validation.warnings) {
      console.log(`    ${chalk.yellow('!')} ${w}`);
    }
  }

  if (!validation.ok) {
    spinner.fail(chalk.red('Validacao falhou com erros:'));
    for (const e of validation.errors) {
      console.log(`    ${chalk.red('x')} ${e}`);
    }
    console.log();
    console.log(chalk.dim('  Corrija os erros acima antes de fazer push para Layer 1.'));
    console.log(chalk.dim('  Para remover arquivos do tracking: git rm --cached <arquivo>'));
    console.log();
    process.exit(1);
  }

  if (validation.warnings.length === 0) {
    spinner.succeed(chalk.green('Validacao OK'));
  }

  if (dryRun) {
    showDryRun(1, config, branch);
    return;
  }

  // Step 2: git add -A (respects .gitignore)
  const addSpinner = ora({ text: 'Staging arquivos (respeitando .gitignore)...', color: 'cyan' }).start();
  try {
    git(['add', '-A'], { silent: true, stdio: 'pipe' });
    addSpinner.succeed(chalk.green('Arquivos staged'));
  } catch (err) {
    addSpinner.fail(chalk.red(`Falha ao fazer staging: ${err.message}`));
    process.exit(1);
  }

  // Check if there's anything to commit
  const staged = gitSilent('diff', '--cached', '--stat');
  if (!staged) {
    console.log(chalk.dim('\n  Nenhuma mudanca para commit. Verificando se existe algo para push...\n'));

    // Still try to push in case there are local commits not yet pushed
    const pushSpinner = ora({ text: `Pushing para ${config.remote}/${branch}...`, color: 'cyan' }).start();
    try {
      git(['push', config.remote, branch], { silent: true, stdio: 'pipe' });
      pushSpinner.succeed(chalk.green(`Push concluido para ${config.remote}/${branch}`));
    } catch (err) {
      if (err.stderr && err.stderr.includes('Everything up-to-date')) {
        pushSpinner.info(chalk.dim('Ja esta atualizado.'));
      } else {
        pushSpinner.fail(chalk.red(`Falha no push: ${err.message}`));
        process.exit(1);
      }
    }

    await autoSyncToBackup(branch);
    return;
  }

  // Step 3: Commit message
  const commitMsg = message || (await promptCommitMessage('feat: update Layer 1 content'));

  // Step 4: git commit
  const commitSpinner = ora({ text: 'Criando commit...', color: 'cyan' }).start();
  try {
    git(['commit', '-m', commitMsg], { silent: true, stdio: 'pipe' });
    commitSpinner.succeed(chalk.green('Commit criado'));
  } catch (err) {
    const output = err.stdout || err.stderr || '';
    if (output.includes('nothing to commit')) {
      commitSpinner.info(chalk.dim('Nada para commitar.'));
    } else {
      commitSpinner.fail(chalk.red(`Falha no commit: ${err.message}`));
      process.exit(1);
    }
  }

  // Step 5: git push public main
  const pushSpinner = ora({ text: `Pushing para ${config.remote}/${branch}...`, color: 'cyan' }).start();
  try {
    git(['push', config.remote, branch]);
    pushSpinner.succeed(chalk.green(`Push concluido para ${config.remote}/${branch}`));
  } catch (err) {
    pushSpinner.fail(chalk.red(`Falha no push: ${err.message}`));
    process.exit(1);
  }

  // Step 6: Ask about npm publish
  const publishNpm = await confirmAction('Publicar no npm tambem?');
  if (publishNpm) {
    const npmSpinner = ora({ text: 'Publicando no npm...', color: 'cyan' }).start();
    try {
      execFileSync('npm', ['publish'], { cwd: PROJECT_ROOT, stdio: 'inherit' });
      npmSpinner.succeed(chalk.green('Publicado no npm!'));
    } catch (err) {
      npmSpinner.fail(chalk.red(`Falha ao publicar no npm: ${err.message}`));
    }
  }

  // Step 7: Auto-sync to backup (Layer 3)
  await autoSyncToBackup(branch);
}

// ---------------------------------------------------------------------------
// Layer 2 Push Flow
// ---------------------------------------------------------------------------

async function pushLayer2({ dryRun, message }) {
  const config = LAYER_CONFIG[2];
  const branch = getCurrentBranch();

  // Step 1: Validate
  const spinner = ora({ text: 'Validando para Layer 2...', color: 'yellow' }).start();
  const validation = validateForLayer(2);

  if (validation.warnings.length > 0) {
    spinner.warn(chalk.yellow('Avisos de validacao:'));
    for (const w of validation.warnings) {
      console.log(`    ${chalk.yellow('!')} ${w}`);
    }
  }

  if (!validation.ok) {
    spinner.fail(chalk.red('Validacao falhou com erros:'));
    for (const e of validation.errors) {
      console.log(`    ${chalk.red('x')} ${e}`);
    }
    console.log();
    process.exit(1);
  }

  if (validation.warnings.length === 0) {
    spinner.succeed(chalk.green('Validacao OK'));
  }

  // Step 2: Read layer1-allowlist.txt AND layer2-manifest.txt
  // Layer 2 = Layer 1 (base) + Premium (manifest)
  const layer1Paths = loadLayer1AllowlistPaths();
  const layer2Paths = loadLayer2ManifestPaths();

  if (layer1Paths.length === 0) {
    console.log(chalk.red('\n  Erro: layer1-allowlist.txt vazio ou nao encontrado.'));
    console.log(chalk.dim('  Verifique: .github/layer1-allowlist.txt\n'));
    process.exit(1);
  }

  if (layer2Paths.length === 0) {
    console.log(chalk.red('\n  Erro: layer2-manifest.txt vazio ou nao encontrado.'));
    console.log(chalk.dim('  Verifique: .github/layer2-manifest.txt\n'));
    process.exit(1);
  }

  // Combine Layer 1 + Layer 2 (deduplicated)
  const allPaths = [...new Set([...layer1Paths, ...layer2Paths])];

  console.log(chalk.dim(`\n  Layer 1 (base): ${layer1Paths.length} caminhos`));
  console.log(chalk.dim(`  Layer 2 (premium): ${layer2Paths.length} caminhos`));
  console.log(chalk.dim(`  Total combinado: ${allPaths.length} caminhos\n`));

  // Show Layer 1 paths
  console.log(chalk.hex('#6366f1')('  Layer 1 (Community):'));
  for (const p of layer1Paths.slice(0, 5)) {
    console.log(chalk.dim(`    + ${p}`));
  }
  if (layer1Paths.length > 5) {
    console.log(chalk.dim(`    ... e mais ${layer1Paths.length - 5} caminhos`));
  }

  // Show Layer 2 paths
  console.log(chalk.hex('#f59e0b')('\n  Layer 2 (Premium):'));
  for (const p of layer2Paths) {
    console.log(chalk.dim(`    + ${p}`));
  }
  console.log();

  // Use combined paths for the rest of the function
  const manifestPaths = allPaths;

  if (dryRun) {
    showDryRun(2, config, branch);
    console.log(chalk.dim('  Caminhos (Layer 1 + Layer 2) que seriam adicionados com git add -f:'));
    for (const p of manifestPaths.slice(0, 15)) {
      const exists = existsSync(resolve(PROJECT_ROOT, p));
      console.log(`    ${exists ? chalk.green('+') : chalk.red('x')} ${p} ${!exists ? chalk.dim('(nao existe)') : ''}`);
    }
    if (manifestPaths.length > 15) {
      console.log(chalk.dim(`    ... e mais ${manifestPaths.length - 15} caminhos`));
    }
    console.log();
    return;
  }

  // Step 3: git add -f each path (Layer 1 + Layer 2) that exists on disk
  const addSpinner = ora({ text: 'Staging caminhos Layer 1 + Layer 2 (force add)...', color: 'yellow' }).start();
  let addedCount = 0;
  let layer1Added = 0;
  let layer2Added = 0;

  for (const path of manifestPaths) {
    const fullPath = resolve(PROJECT_ROOT, path);
    if (!existsSync(fullPath)) continue;

    try {
      git(['add', '-f', path], { silent: true, stdio: 'pipe' });
      addedCount++;
      // Track which layer this path belongs to
      if (layer1Paths.includes(path)) layer1Added++;
      if (layer2Paths.includes(path)) layer2Added++;
    } catch {
      // Some paths may fail — that's ok
    }
  }

  if (addedCount === 0) {
    addSpinner.warn(chalk.yellow('Nenhum caminho encontrado no disco.'));
    console.log(chalk.dim('  Verifique se o conteudo existe localmente.\n'));
    process.exit(1);
  }

  addSpinner.succeed(chalk.green(`${addedCount} caminhos staged (L1: ${layer1Added}, L2: ${layer2Added})`));

  // Step 4: Commit (bypass pre-commit hook via env var — this is a temporary commit)
  const commitMsg = message || 'feat(premium): update Layer 2 (Layer 1 + Premium content)';
  const commitSpinner = ora({ text: 'Criando commit premium...', color: 'yellow' }).start();
  try {
    git(['commit', '-m', commitMsg], { silent: true, stdio: 'pipe', env: { MEGA_BRAIN_LAYER_PUSH: 'true' } });
    commitSpinner.succeed(chalk.green('Commit premium criado'));
  } catch (err) {
    const output = (err.stdout || '') + (err.stderr || '');
    if (output.includes('nothing to commit')) {
      commitSpinner.info(chalk.dim('Nada de novo para commitar no premium.'));
      return;
    }
    commitSpinner.fail(chalk.red(`Falha no commit: ${err.message}`));
    process.exit(1);
  }

  // Step 5: git push premium main --force
  const pushSpinner = ora({ text: `Pushing para ${config.remote}/${branch} (force)...`, color: 'yellow' }).start();
  try {
    git(['push', config.remote, branch, '--force']);
    pushSpinner.succeed(chalk.green(`Push concluido para ${config.remote}/${branch}`));
  } catch (err) {
    pushSpinner.fail(chalk.red(`Falha no push: ${err.message}`));
    // Still try to reset even if push fails
    resetLastCommit();
    process.exit(1);
  }

  // Step 6: git reset HEAD~1 (remove Layer 2 commit from local, keep files)
  resetLastCommit();

  // Step 7: Auto-sync to backup (Layer 3)
  await autoSyncToBackup(branch);
}

// ---------------------------------------------------------------------------
// Layer 3 Push Flow
// ---------------------------------------------------------------------------

async function pushLayer3({ dryRun, message }) {
  const config = LAYER_CONFIG[3];
  const branch = getCurrentBranch();

  // No validation for Layer 3

  // Read Layer 3 manifest
  const layer3Paths = loadLayer3ManifestPaths();
  if (layer3Paths.length === 0) {
    console.log(chalk.red('\n  Erro: layer3-manifest.txt vazio ou nao encontrado.'));
    console.log(chalk.dim('  Verifique: .github/layer3-manifest.txt\n'));
    process.exit(1);
  }

  if (dryRun) {
    showDryRun(3, config, branch);
    console.log(chalk.dim('  Caminhos do manifest que seriam adicionados com git add -f:'));
    for (const p of layer3Paths) {
      const exists = existsSync(resolve(PROJECT_ROOT, p));
      console.log(`    ${exists ? chalk.green('+') : chalk.red('x')} ${p} ${!exists ? chalk.dim('(nao existe)') : ''}`);
    }
    console.log();
    return;
  }

  // Step 1: Stage tracked files normally
  const addSpinner = ora({ text: 'Staging arquivos tracked...', color: 'red' }).start();
  try {
    git(['add', '-A'], { silent: true, stdio: 'pipe' });
    addSpinner.succeed(chalk.green('Arquivos tracked staged'));
  } catch (err) {
    addSpinner.fail(chalk.red(`Falha ao fazer staging: ${err.message}`));
    process.exit(1);
  }

  // Step 2: Force-add Layer 3 content (gitignored but needed for backup)
  const forceSpinner = ora({ text: 'Staging conteudo de backup (force add)...', color: 'red' }).start();
  let addedCount = 0;

  for (const manifestPath of layer3Paths) {
    const fullPath = resolve(PROJECT_ROOT, manifestPath);
    if (!existsSync(fullPath)) continue;

    try {
      git(['add', '-f', manifestPath], { silent: true, stdio: 'pipe' });
      addedCount++;
    } catch {
      // Some paths may fail — that's ok
    }
  }

  forceSpinner.succeed(chalk.green(`${addedCount} caminhos de backup staged`));

  // Step 3: Safety — unstage secrets that may have been caught
  for (const secretFile of SECRET_FILES) {
    try {
      git(['reset', 'HEAD', '--', secretFile], { silent: true, stdio: 'pipe' });
    } catch {
      // File may not exist or not be staged
    }
  }

  // Check if there's anything to commit
  const staged = gitSilent('diff', '--cached', '--stat');
  if (!staged) {
    console.log(chalk.dim('\n  Nenhuma mudanca para commit. Pushing estado atual...\n'));

    const pushSpinner = ora({ text: `Pushing para ${config.remote}/${branch} (force)...`, color: 'red' }).start();
    try {
      git(['push', config.remote, branch, '--force']);
      pushSpinner.succeed(chalk.green(`Push concluido para ${config.remote}/${branch}`));
    } catch (err) {
      pushSpinner.fail(chalk.red(`Falha no push: ${err.message}`));
      process.exit(1);
    }
    return;
  }

  // Step 4: Commit message
  const commitMsg = message || (await promptCommitMessage('backup: full state sync'));

  // Step 5: git commit (bypass pre-commit hook via env var — this is a temporary commit)
  const commitSpinner = ora({ text: 'Criando commit de backup...', color: 'red' }).start();
  try {
    git(['commit', '-m', commitMsg], { silent: true, stdio: 'pipe', env: { MEGA_BRAIN_LAYER_PUSH: 'true' } });
    commitSpinner.succeed(chalk.green('Commit criado'));
  } catch (err) {
    const output = (err.stdout || '') + (err.stderr || '');
    if (output.includes('nothing to commit')) {
      commitSpinner.info(chalk.dim('Nada para commitar.'));
    } else {
      commitSpinner.fail(chalk.red(`Falha no commit: ${err.message}`));
      process.exit(1);
    }
  }

  // Step 6: git push backup main --force
  const pushSpinner = ora({ text: `Pushing para ${config.remote}/${branch} (force)...`, color: 'red' }).start();
  try {
    git(['push', config.remote, branch, '--force']);
    pushSpinner.succeed(chalk.green(`Push concluido para ${config.remote}/${branch}`));
  } catch (err) {
    pushSpinner.fail(chalk.red(`Falha no push: ${err.message}`));
    // Still try to reset
    resetLastCommit();
    process.exit(1);
  }

  // Step 7: git reset HEAD~1 (Layer 3 commit doesn't stay on local main)
  resetLastCommit();
}

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

/**
 * Reset the last commit but keep files (mixed reset).
 * Used by Layer 2 and Layer 3 to avoid polluting local main.
 */
function resetLastCommit() {
  const resetSpinner = ora({ text: 'Limpando commit local (reset HEAD~1)...', color: 'gray' }).start();
  try {
    git(['reset', 'HEAD~1'], { silent: true, stdio: 'pipe' });
    resetSpinner.succeed(chalk.dim('Commit local removido (arquivos preservados)'));
  } catch (err) {
    resetSpinner.warn(chalk.yellow(`Nao foi possivel fazer reset: ${err.message}`));
  }
}

/**
 * Auto-sync current main to backup remote (Layer 3).
 */
async function autoSyncToBackup(branch) {
  const remotes = getRemotes();
  if (!remotes.backup) {
    console.log(chalk.dim('\n  Remote "backup" nao configurado. Pulando auto-sync.\n'));
    return;
  }

  const syncSpinner = ora({ text: 'Auto-sync para backup (Layer 3)...', color: 'gray' }).start();
  try {
    git(['push', 'backup', branch, '--force'], { silent: true, stdio: 'pipe' });
    syncSpinner.succeed(chalk.dim('Auto-sync para backup concluido'));
  } catch {
    syncSpinner.warn(chalk.dim('Auto-sync para backup falhou (nao critico)'));
  }
}

/**
 * Show dry-run summary without executing.
 */
function showDryRun(layer, config, branch) {
  console.log();
  console.log(
    boxen(
      chalk.bold.yellow(' DRY RUN ') +
        chalk.white(' — Nenhuma acao sera executada\n\n') +
        chalk.white(`  Layer:   ${config.label}\n`) +
        chalk.white(`  Remote:  ${config.remote} → ${config.remoteUrl}\n`) +
        chalk.white(`  Branch:  ${branch}\n`) +
        chalk.white(`  Comando: git push ${config.remote} ${branch}`) +
        (layer !== 1 ? chalk.white(' --force') : ''),
      {
        padding: 1,
        margin: { left: 2 },
        borderStyle: 'round',
        borderColor: 'yellow',
      }
    )
  );

  if (layer === 1) {
    console.log(chalk.dim('\n  Fluxo Layer 1:'));
    console.log(chalk.dim('    1. Validar (phantom files, API keys, .env)'));
    console.log(chalk.dim('    2. git add -A (respeita .gitignore)'));
    console.log(chalk.dim('    3. Prompt para commit message'));
    console.log(chalk.dim('    4. git commit'));
    console.log(chalk.dim('    5. git push origin main'));
    console.log(chalk.dim('    6. Perguntar sobre npm publish'));
    console.log(chalk.dim('    7. Auto-sync para backup (Layer 3)'));
  } else if (layer === 2) {
    console.log(chalk.dim('\n  Fluxo Layer 2 (Layer 1 + Premium):'));
    console.log(chalk.dim('    1. Validar (personas excluidas, .env)'));
    console.log(chalk.dim('    2. Ler layer1-allowlist.txt + layer2-manifest.txt'));
    console.log(chalk.dim('    3. git add -f para cada caminho (L1 + L2 combinados)'));
    console.log(chalk.dim('    4. git commit'));
    console.log(chalk.dim('    5. git push premium main --force'));
    console.log(chalk.dim('    6. git reset HEAD~1 (limpar commit local)'));
    console.log(chalk.dim('    7. Auto-sync para backup (Layer 3)'));
  } else {
    console.log(chalk.dim('\n  Fluxo Layer 3:'));
    console.log(chalk.dim('    1. Sem validacao (tudo vai)'));
    console.log(chalk.dim('    2. git add -A (tracked files)'));
    console.log(chalk.dim('    3. git add -f para caminhos do layer3-manifest.txt'));
    console.log(chalk.dim('    4. git reset HEAD -- secrets (safety net)'));
    console.log(chalk.dim('    5. Prompt para commit message'));
    console.log(chalk.dim('    6. git commit'));
    console.log(chalk.dim('    7. git push backup main --force'));
    console.log(chalk.dim('    8. git reset HEAD~1 (limpar commit local)'));
  }

  console.log();
}

/**
 * Verify that a remote exists and show helpful error if not.
 */
function ensureRemoteExists(layer) {
  const config = LAYER_CONFIG[layer];
  const remotes = getRemotes();

  if (!remotes[config.remote]) {
    console.log();
    console.log(chalk.red(`  Erro: Remote "${config.remote}" nao esta configurado.`));
    console.log();
    console.log(chalk.white('  Para adicionar:'));
    console.log(chalk.cyan(`    git remote add ${config.remote} ${config.remoteUrl}`));
    console.log();
    console.log(chalk.dim('  Remotes atuais:'));
    for (const [name, url] of Object.entries(remotes)) {
      console.log(chalk.dim(`    ${name} → ${url}`));
    }
    console.log();
    process.exit(1);
  }
}

// ---------------------------------------------------------------------------
// Banner
// ---------------------------------------------------------------------------

function showBanner() {
  console.log();
  console.log(
    boxen(chalk.bold.hex('#a855f7')('  Mega Brain Push  '), {
      padding: { left: 2, right: 2, top: 0, bottom: 0 },
      margin: { left: 2 },
      borderStyle: 'round',
      borderColor: '#a855f7',
    })
  );
}

function showSuccess(layer, branch) {
  const config = LAYER_CONFIG[layer];
  console.log();
  console.log(
    boxen(
      chalk.bold.hex(config.color)(`  Push concluido!  `) +
        '\n\n' +
        chalk.white(`  Layer:  ${config.label}\n`) +
        chalk.white(`  Remote: ${config.remote}/${branch}`),
      {
        padding: 1,
        margin: { left: 2 },
        borderStyle: 'round',
        borderColor: config.color,
      }
    )
  );
  console.log();
}

// ---------------------------------------------------------------------------
// Main
// ---------------------------------------------------------------------------

async function main() {
  const opts = parseArgs(process.argv);

  showBanner();

  // Select layer
  const layer = opts.layer || (await selectLayerInteractive());
  const config = LAYER_CONFIG[layer];
  const branch = getCurrentBranch();

  // Verify remote exists (unless dry-run)
  if (!opts.dryRun) {
    ensureRemoteExists(layer);
  }

  // Show current state
  console.log();
  console.log(chalk.white(`  Layer:  `) + chalk.bold.hex(config.color)(config.label));
  console.log(chalk.white(`  Remote: `) + chalk.dim(`${config.remote}/${branch}`));

  // Show uncommitted changes warning
  const status = getStatusSummary();
  if (status) {
    console.log();
    console.log(chalk.yellow(`  ${status.total} arquivo(s) com mudancas pendentes:`));
    for (const line of status.preview) {
      console.log(chalk.dim(`    ${line}`));
    }
    if (status.hasMore) {
      console.log(chalk.dim(`    ... e mais ${status.remaining} arquivo(s)`));
    }
  }

  console.log();

  // Confirm (unless dry-run or --layer was explicit)
  if (!opts.dryRun && !opts.layer) {
    const confirmed = await confirmAction('Confirmar push?');
    if (!confirmed) {
      console.log(chalk.dim('\n  Push cancelado.\n'));
      process.exit(0);
    }
  }

  // Execute the appropriate push flow
  switch (layer) {
    case 1:
      await pushLayer1(opts);
      break;
    case 2:
      await pushLayer2(opts);
      break;
    case 3:
      await pushLayer3(opts);
      break;
  }

  showSuccess(layer, branch);
}

// ---------------------------------------------------------------------------
// Entry point — works as standalone binary AND as module import
// ---------------------------------------------------------------------------

export { pushLayer1, pushLayer2, pushLayer3, validateForLayer, loadLayer1AllowlistPaths, loadLayer2ManifestPaths, loadLayer3ManifestPaths };

main().catch((err) => {
  console.error();
  console.error(chalk.red(`  Erro fatal: ${err.message}`));
  if (process.env.DEBUG) {
    console.error(err.stack);
  }
  console.error();
  process.exit(1);
});