#!/bin/bash
# scrub-logs.sh — Strip API keys from Clawdbot session logs
# Run via cron or manually after any session where keys might have been discussed

LOG_DIR="/root/.clawdbot/agents/main/sessions"
FOUND=0

cd "$LOG_DIR" 2>/dev/null || { echo "❌ Log dir not found"; exit 1; }

# Count before
ANT=$(grep -rlP 'sk-ant-[a-zA-Z0-9_-]{20,}' *.jsonl 2>/dev/null | wc -l)
OAI=$(grep -rlP 'sk-proj-[a-zA-Z0-9_-]{20,}' *.jsonl 2>/dev/null | wc -l)
JWT=$(grep -rlP 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[a-zA-Z0-9_-]{50,}' *.jsonl 2>/dev/null | wc -l)
NTN=$(grep -rlP 'ntn_[a-zA-Z0-9]{20,}' *.jsonl 2>/dev/null | wc -l)
TWL=$(grep -rlP 'AC[a-f0-9]{32}' *.jsonl 2>/dev/null | wc -l)

FOUND=$((ANT + OAI + JWT + NTN + TWL))

if [ "$FOUND" -eq 0 ]; then
    echo "✅ Clean — no exposed keys found in $( ls *.jsonl | wc -l ) log files"
    exit 0
fi

echo "🔴 Found exposed keys: Anthropic=$ANT OpenAI=$OAI JWT=$JWT Notion=$NTN Twilio=$TWL"

# Scrub
find . -name "*.jsonl" -exec sed -i 's/sk-ant-[a-zA-Z0-9_-]\{20,\}/[REDACTED-ANTHROPIC-KEY]/g' {} +
find . -name "*.jsonl" -exec sed -i 's/sk-proj-[a-zA-Z0-9_-]\{20,\}/[REDACTED-OPENAI-KEY]/g' {} +
find . -name "*.jsonl" -exec sed -i 's/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[a-zA-Z0-9_-]\{50,\}\.[a-zA-Z0-9_-]\{20,\}/[REDACTED-JWT]/g' {} +
find . -name "*.jsonl" -exec sed -i 's/ntn_[a-zA-Z0-9]\{20,\}/[REDACTED-NOTION-KEY]/g' {} +
find . -name "*.jsonl" -exec sed -i 's/secret_[a-zA-Z0-9]\{20,\}/[REDACTED-SECRET-KEY]/g' {} +
find . -name "*.jsonl" -exec sed -i 's/AC[a-f0-9]\{32\}/[REDACTED-TWILIO-SID]/g' {} +

echo "✅ Scrubbed $FOUND files. Verify with: grep -rP 'sk-ant-|sk-proj-|eyJhbG' *.jsonl | wc -l"