"""Report non-secret runtime availability inside the existing bwrap profile.

This diagnostic uses owner execution, never runs a model, and does not change
profile readiness. Command discovery does not prove runtime or authentication
health. Run with .venv/bin/python scripts/inspect-local-runtime.py.
"""

import json
import tempfile
from pathlib import Path

from sandboxer.core.manager import SandboxManager
from sandboxer.lifecycle.store import SandboxStore
from sandboxer.models import Consumer, SandboxCreateRequest, SandboxExecRequest
from sandboxer.payments.credits import CreditsStore
from sandboxer.snapshots.store import SnapshotStore


PROBE = """
import importlib.util, json, os, shutil
from pathlib import Path
print(json.dumps({
    'commands': {name: shutil.which(name) is not None for name in
                 ['python3', 'git', 'rein-aharness', 'claude', 'kaizen-agentic']},
    'python_modules': {name: importlib.util.find_spec(name) is not None
                       for name in ['rein_aharness', 'llm_connect']},
    'interfaces': [line.split(':', 1)[0].strip()
                   for line in Path('/proc/net/dev').read_text().splitlines()[2:]],
    'credential_route_refs': json.loads(os.environ['SANDBOXER_CREDENTIAL_ROUTE_REFS']),
    'home_is_workspace': os.environ['HOME'] == str(Path.cwd()),
}))
"""


def main():
    with tempfile.TemporaryDirectory(prefix="glas-runtime-baseline-") as temp:
        root = Path(temp)
        source = root / "source"
        source.mkdir()
        manager = SandboxManager(
            store=SandboxStore(path=root / "sandboxes.json"),
            credits=CreditsStore(path=root / "credits.json"),
            snapshots=SnapshotStore(path=root / "snapshots.json"),
        )
        consumer = Consumer(actor="agt", project="glas-runtime-baseline",
                            run_id="glas-wp-0012-baseline")
        status = manager.create(SandboxCreateRequest(
            profile="profile.bwrap-local", inputs={"repo": str(source)},
            consumer=consumer, ttl="5m",
        ))
        try:
            result = manager.execute(status.sandbox_id, SandboxExecRequest(
                command=["/usr/bin/python3", "-c", PROBE], consumer=consumer,
                timeout_seconds=15,
            ))
            if result.exit_code or result.timed_out or result.output_truncated:
                raise RuntimeError("runtime inventory probe failed")
            facts = json.loads(result.stdout)
        finally:
            destroyed = manager.destroy(status.sandbox_id)
        removed = not Path(status.reachability.workspace_dir).exists()
        facts.update(
            sandbox_id=status.sandbox_id, workspace_removed=removed,
            state=destroyed.state.value, network_default=result.network_default,
            network_egress=result.network_egress,
        )
        print(json.dumps(facts, indent=2))
        return 0 if removed and destroyed.state.value == "destroyed" else 1


if __name__ == "__main__":
    raise SystemExit(main())