-- "Сохрани пароль от GitHub" — takes the password from clipboard (so user
-- never has to speak it), encrypts via DPAPI, stores in memory.
local phrase = (jarvis.context.phrase or ""):lower()
local name = jarvis.text.strip_trigger(phrase, {
    "сохрани пароль от",
    "запомни пароль от",
    "пароль для",
    "save password for",
    "remember password for",
    "запам'ятай пароль від",
})
name = name:gsub("^[%s,:%.]+", ""):gsub("%s+$", "")

if name == "" then
    return jarvis.cmd.error("Имя сервиса не указано.")
end

local plaintext = jarvis.system.clipboard.get()
if not plaintext or plaintext == "" then
    return jarvis.cmd.error("Скопируйте пароль в буфер сначала.")
end

-- Encrypt via DPAPI (current user scope) and base64-encode the ciphertext.
local escaped = plaintext:gsub("'", "''")
local ps = string.format([[
Add-Type -AssemblyName System.Security;
$bytes = [System.Text.Encoding]::UTF8.GetBytes('%s');
$enc = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser);
Write-Output ([Convert]::ToBase64String($enc))
]], escaped)

local res = jarvis.system.exec(string.format(
    'powershell -NoProfile -Command "%s"', ps:gsub('"', '\\"'):gsub("\r?\n", "; ")
))
if not res.success then
    return jarvis.cmd.error("Не получилось зашифровать.")
end

local b64 = (res.stdout or ""):gsub("%s+", "")
if b64 == "" then
    return jarvis.cmd.error("Шифр пустой.")
end

jarvis.memory.remember("vault." .. name, b64)

-- Clear clipboard for safety.
jarvis.system.clipboard.set("")
return jarvis.cmd.ok("Сохранил пароль от " .. name .. ".")