"""CrowdStrike process collector for OpenClaw detection."""
import logging

from ..client import CrowdStrikeClient
from ..constants import QUERY_TAIL_LIMIT
from .base import CrowdStrikeBaseCollector

logger = logging.getLogger(__name__)

# Detection query - returns raw events, aggregation and filtering done in Python.
# The tail() limit is derived from QUERY_TAIL_LIMIT so the query and the warning threshold stay in sync.
PROCESS_QUERY = r"""
FilePath=/openclaw/i OR FilePath=/clawdbot/i OR FilePath=/clawbot/i OR FilePath=/moltbot/i
OR FilePath=/\.openclaw/i OR FilePath=/\.clawdbot/i OR FilePath=/\.moltbot/i
OR FilePath=/OpenClaw\.app/i
OR ImageFileName=/openclaw/i OR ImageFileName=/clawdbot/i OR ImageFileName=/clawbot/i OR ImageFileName=/moltbot/i
OR CommandLine=/openclaw/i OR CommandLine=/clawdbot/i OR CommandLine=/clawbot/i OR CommandLine=/moltbot/i
OR CommandLine=/openclaw\.ai/i OR CommandLine=/moltbot\.ai/i
OR CommandLine=/ai\.openclaw\.gateway/i OR CommandLine=/com\.clawdbot\.gateway/i OR CommandLine=/com\.moltbot\.gateway/i

| select([@timestamp, UserName, ComputerName, event_platform, FilePath, ImageFileName, CommandLine, ParentBaseFileName])
| tail({tail_limit})
""".format(tail_limit=QUERY_TAIL_LIMIT)


class CrowdStrikeProcessCollector(CrowdStrikeBaseCollector):
    """Collector for OpenClaw detection via CrowdStrike."""

    def __init__(self, client: CrowdStrikeClient, days_back: int):
        super().__init__(
            client=client,
            query_string=PROCESS_QUERY,
            event_type_name="Process",
            days_back=days_back,
        )

    def run(self) -> list[str]:
        """Run collection and return events."""
        events = self.collect_events()
        logger.info("Process collection complete")
        return events
