# 1️⃣ Create a clean virtual environment
python -m venv .venv
source .venv/bin/activate   # on Windows: .venv\Scripts\activate

# 2️⃣ Upgrade pip & install core libraries
pip install --upgrade pip
pip install anthropic openai transformers[sentencepiece] python-dotenv tenacity

# 3️⃣ (Optional) Install pre‑commit hooks for linting
pip install pre-commit
pre-commit install

# 1️⃣ Initialize a new npm project (if you don’t have one)
npm init -y
npm install typescript ts-node @types/node --save-dev

# 2️⃣ Install API clients & utilities
npm install anthropic-sdk openai @huggingface/inference dotenv axios
npm install --save-dev typescript-eslint eslint prettier

# .env
ANTHROPIC_API_KEY=your_anthropic_key_here
OPENAI_API_KEY=your_openai_key_here
HF_TOKEN=your_huggingface_token_here

# file: ai_code_provenance.py
"""
Securely invoke Claude, Codex, and Hermes to generate code,
attach provenance metadata, and detect unowned output.

Requirements:
    pip install anthropic openai transformers[sentencepiece] python-dotenv tenacity
"""

import os
import hashlib
import json
import datetime as dt
from typing import Tuple

import anthropic
import openai
from transformers import pipeline
from dotenv import load_dotenv
from tenacity import retry, stop_after_attempt, wait_exponential

# ----------------------------------------------------------------------
# Load environment variables from .env (ignore if not present)
load_dotenv()

ANTHROPIC_KEY = os.getenv("ANTHROPIC_API_KEY")
OPENAI_KEY    = os.getenv("OPENAI_API_KEY")
HF_TOKEN      = os.getenv("HF_TOKEN")

if not all([ANTHROPIC_KEY, OPENAI_KEY, HF_TOKEN]):
    raise RuntimeError("Missing one or more required API keys in environment.")

# ----------------------------------------------------------------------
# Initialize clients
anthropic_client = anthropic.Anthropic(api_key=ANTHROPIC_KEY)
openai_client    = openai.OpenAI(api_key=OPENAI_KEY)

# Hermes – using HuggingFace Inference API (text generation)
hermes_generator = pipeline(
    "text-generation",
    model="NousResearch/Hermes-2-Pro-Llama-3-8B",
    token=HF_TOKEN,
    device=-1,  # CPU; set to 0 for first GPU if available
)

# ----------------------------------------------------------------------
def _sha256(text: str) -> str:
    """Return hex SHA‑256 digest of the supplied string."""
    return hashlib.sha256(text.encode("utf-8")).hexdigest()


def _add_provenance_header(code: str, model: str) -> str:
    """
    Prepend a JSON‑style comment block containing provenance info.
    The comment style is language‑agnostic; adjust for target language if needed.
    """
    metadata = {
        "generated_by": model,
        "generated_at": dt.datetime.utcnow().isoformat() + "Z",
        "code_sha256": _sha256(code),
    }
    header = f"// PROVENANCE: {json.dumps(metadata, separators=(',', ':'))}\n"
    return header + code


@retry(stop=stop_after_attempt(3), wait=wait_exponential(multiplier=1, min=2, max=10))
def generate_with_claude(prompt: str) -> str:
    """
    Call Claude (Anthropic) to complete the prompt.
    Returns raw model output (no provenance added yet).
    """
    response = anthropic_client.messages.create(
        model="claude-3-opus-20240229",  # latest as of writing
        max_tokens=500,
        temperature=0.2,
        system="You are a helpful coding assistant. Return only code, no extra explanation.",
        messages=[{"role": "user", "content": prompt}],
    )
    # The API returns a list of content blocks; we concatenate text blocks.
    return "".join(block.text for block in response.content if block.type == "text")


@retry(stop=stop_after_attempt(3), wait=wait_exponential(multiplier=1, min=2, max=10))
def generate_with_codex(prompt: str) -> str:
    """
    Call OpenAI Codex (code‑davinci-002) to complete the prompt.
    """
    response = openai_client.completions.create(
        model="code-davinci-002",
        prompt=prompt,
        max_tokens=500,
        temperature=0.2,
        stop=["\n\n"],  # stop at blank line to avoid extra commentary
    )
    return response.choices[0].text.strip()


@retry(stop=stop_after_attempt(3), wait=wait_exponential(multiplier=1, min=2, max=10))
def generate_with_hermes(prompt: str) -> str:
    """
    Call Hermes via HuggingFace Inference API.
    """
    # The pipeline returns a list of dicts; we take the first generated text.
    outputs = hermes_generator(
        prompt,
        max_new_tokens=500,
        temperature=0.2,
        do_sample=True,
        return_full_text=False,  # only the newly generated part
    )
    return outputs[0]["generated_text"].strip()


def generate_and_provenance(model_name: str, prompt: str) -> Tuple[str, str, bool]:
    """
    Dispatch to the correct generator, add provenance header,
    and flag whether the output is considered *owned* (i.e., we added the header).

    Returns:
        (final_code, model_used, is_owned)
    """
    if model_name.lower() == "claude":
        raw = generate_with_claude(prompt)
    elif model_name.lower() == "codex":
        raw = generate_with_codex(prompt)
    elif model_name.lower() == "hermes":
        raw = generate_with_hermes(prompt)
    else:
        raise ValueError(f"Unsupported model: {model_name}")

    # Heuristic: if the model output already contains a provenance‑like comment,
    # we treat it as potentially owned (could be a previous run). Otherwise,
    # we add our own header and mark as owned.
    if "PROVENANCE:" in raw:
        # Existing provenance – keep as‑is and consider it owned.
        final_code = raw
        is_owned = True
    else:
        final_code = _add_provenance_header(raw, model_name)
        is_owned = True  # we just added provenance, so we own it now

    return final_code, model_name, is_owned


# ----------------------------------------------------------------------
if __name__ == "__main__":
    # Example prompt: generate a factorial function in Python
    prompt = """Write a Python function named `factorial` that computes the factorial of a non‑negative integer.
    Include a docstring and raise ValueError for negative inputs."""

    for model in ["Claude", "Codex", "Hermes"]:
        code, used_model, owned = generate_and_provenance(model, prompt)
        print(f"\n=== {used_model} output (owned={owned}) ===")
        print(code)
        # Optionally write to a file for later review / SBOM generation
        out_path = f"generated_{used_model.lower()}_factorial.py"
        with open(out_path, "w", encoding="utf-8") as f:
            f.write(code)
        print(f"💾 Saved to {out_path}")

// file: ai-code-provenance.ts
/**
 * TypeScript implementation that mirrors the Python workflow:
 *   - Calls Claude (Anthropic), Codex (OpenAI), and Hermes (HF Inference)
 *   - Adds a provenance header if missing
 *   - Returns the final code plus ownership flag
 *
 * Prerequisites:
 *   npm install anthropic-sdk openai @huggingface/inference dotenv axios
 *   npm install --save-dev typescript ts-node @types/node
 */

import "dotenv/config";
import { Anthropic } from "@anthropic-ai/sdk";
import { OpenAI } from "openai";
import { InferenceApi } from "@huggingface/inference";
import axios from "axios";
import crypto from "crypto";

// ----------------------------------------------------------------------
// Load environment variables (already done by dotenv/config)
const ANTHROPIC_KEY = process.env.ANTHROPIC_API_KEY ?? "";
const OPENAI_KEY    = process.env.OPENAI_API_KEY ?? "";
const HF_TOKEN      = process.env.HF_TOKEN ?? "";

if (!ANTHROPIC_KEY || !OPENAI_KEY || !HF_TOKEN) {
  throw new Error("Missing required API keys in environment.");
}

// ----------------------------------------------------------------------
// Initialise clients
const anthropic = new Anthropic({ apiKey: ANTHROPIC_KEY });
const openai    = new OpenAI({ apiKey: OPENAI_KEY });
const hf        = new InferenceApi(HF_TOKEN);

// ----------------------------------------------------------------------
/**
 * Compute SHA‑256 hex digest of a string.
 */
function sha256(str: string): string {
  return crypto.createHash("sha256").update(str, "utf8").digest("hex");
}

/**
 * Add a provenance header (JSON comment) to the supplied code.
 * Header format: // PROVENANCE: {"generated_by":"<model>","generated_at":"<ISO>","code_sha256":"<hash>"}
 */
function addProvenanceHeader(code: string, model: string): string {
  const metadata = {
    generated_by: model,
    generated_at: new Date().toISOString(),
    code_sha256: sha256(code),
  };
  const header = `// PROVENANCE: ${JSON.stringify(metadata)}\n`;
  return header + code;
}

// ----------------------------------------------------------------------
/**
 * Retry helper – exponential backoff, max 3 attempts.
 */
async function retry<T>(fn: () => Promise<T>, retries = 3): Promise<T> {
  let attempt = 0;
  while (true) {
    try {
      return await fn();
    } catch (err) {
      attempt++;
      if (attempt >= retries) throw err;
      // wait 2^attempt * 100ms
      await new Promise((r) => setTimeout(r, 2 ** attempt * 100));
    }
  }
}

// ----------------------------------------------------------------------
/**
 * Call Claude (Anthropic) to complete a prompt.
 */
async function generateClaude(prompt: string): Promise<string> {
  return retry(async () => {
    const msg = await anthropic.messages.create({
      model: "claude-3-opus-20240229",
      max_tokens: 500,
      temperature: 0.2,
      system: "You are a helpful coding assistant. Return only code, no extra explanation.",
      messages: [{ role: "user", content: prompt }],
    });
    // Concatenate all text blocks
    return msg.content
      .filter((block): block is { type: "text"; text: string } => block.type === "text")
      .map((b) => b.text)
      .join("");
  });
}

/**
 * Call OpenAI Codex (code-davinci-002) to complete a prompt.
 */
async function generateCodex(prompt: string): Promise<string> {
  return retry(async () => {
    const resp = await openai.completions.create({
      model: "code-davinci-002",
      prompt: prompt,
      max_tokens: 500,
      temperature: 0.2,
      stop: ["\n\n"],
    });
    return resp.choices[0]?.text?.trim() ?? "";
  });
}

/**
 * Call Hermes via HuggingFace Inference API.
 */
async function generateHermes(prompt: string): Promise<string> {
  return retry(async () => {
    const result = await hf.textGeneration({
      model: "NousResearch/Hermes-2-Pro-Llama-3-8B",
      inputs: prompt,
      parameters: {
        max_new_tokens: 500,
        temperature: 0.2,
        return_full_text: false,
      },
    });
    // HF returns an array; we take the first generated text.
    return Array.isArray(result) && result[0]?.generated_text
      ? result[0].generated_text.trim()
      : "";
  });
}

/**
 * Dispatch to the correct generator, add provenance header if missing,
 * and return (finalCode, modelUsed, isOwned).
 */
async function generateAndProvenance(
  modelName: string,
  prompt: string
): Promise<{ code: string; model: string; owned: boolean }> {
  let raw: string;
  switch (modelName.toLowerCase()) {
    case "claude":
      raw = await generateClaude(prompt);
      break;
    case "codex":
      raw = await generateCodex(prompt);
      break;
    case "hermes":
      raw = await generateHermes(prompt);
      break;
    default:
      throw new Error(`Unsupported model: ${modelName}`);
  }

  // If the model already emitted a provenance‑like comment, treat as owned.
  const owned = raw.includes("PROVENANCE:");
  const final = owned ? raw : addProvenanceHeader(raw, modelName);
  return { code: final, model: modelName, owned };
}

// ----------------------------------------------------------------------
// Example usage
(async () => {
  const prompt = `Write a TypeScript function named \`factorial\` that computes the factorial of a non‑negative integer.
Include JSDoc documentation and throw an Error for negative inputs.`;

  for (const model of ["Claude", "Codex", "Hermes"]) {
    const { code, model: used, owned } = await generateAndProvenance(model, prompt);
    console.log(`\n=== ${used} output (owned=${owned}) ===`);
    console.log(code);
    // Optional: write to file for later review / SBOM
    const fs = await import("fs");
    const path = await import("path");
    const outPath = path.join(__dirname, `generated_${used.toLowerCase()}_factorial.ts`);
    fs.writeFileSync(outPath, code, "utf8");
    console.log(`💾 Saved to ${outPath}`);
  }
})();

import re, json
pattern = r"// PROVENANCE: (\{.*\})"
match = re.search(pattern, code)
if match:
    metadata = json.loads(match.group(1))
    # metadata now contains generated_by, generated_at, code_sha256

# .github/workflows/ai-provenance.yml
name: AI Provenance Check
on: [push, pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node (for JS check)
        uses: actions/setup-node@v3
        with:
          node-version: '20'
      - name: Run provenance scanner
        run: |
          npm i -g @oxsecurity/provenance-scanner   # hypothetical scanner
          provenance-scan --src . --fail-on-missing