#!/usr/bin/env python3
"""Silent attended child: protected PAT injection, then a value-free receipt."""
import argparse
import hashlib
import json
from pathlib import Path
import subprocess
import sys

HERE = Path(__file__).resolve().parent


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--proposal', type=Path, required=True)
    parser.add_argument('--receipt', type=Path, required=True)
    parser.add_argument('--cleanup-only', action='store_true')
    args = parser.parse_args()
    proposal_path, receipt = args.proposal.resolve(), args.receipt.resolve()
    transport = receipt.with_suffix('.cleanup-transport.json' if args.cleanup_only else '.transport.json')
    if transport.exists() or (receipt.exists() and not args.cleanup_only):
        return 2
    try:
        proposal = json.loads(proposal_path.read_text())
        for name, digest in proposal['source_sha256'].items():
            if Path(name).name != name or hashlib.sha256((HERE / name).read_bytes()).hexdigest() != digest:
                return 2
        if not {'run_forge_routes.py', 'accept_forge_routes.py'} <= set(proposal['source_sha256']):
            return 2
        child = [sys.executable, str(HERE / 'accept_forge_routes.py'), '--proposal', str(proposal_path),
                 '--receipt', str(receipt), '--name', proposal['repository_name']]
        if args.cleanup_only:
            child.append('--cleanup-only')
        # Capture/discard both streams, including warden proxy notices. The
        # containing login lane requires silence and handles session revocation.
        result = subprocess.run(['warden', 'access', 'forgejo-admin-api-token', '--field', 'API_TOKEN',
                                 '--exec', '--', *child], capture_output=True)
        transport.write_text(json.dumps({'route_exit_code': result.returncode,
            'receipt_present': receipt.exists(), 'cleanup_only': args.cleanup_only,
            'proposal_sha256': hashlib.sha256(proposal_path.read_bytes()).hexdigest(),
            'raw_diagnostics_retained': False, 'credential_returned_to_agent': False}, indent=2) + '\n')
        return result.returncode
    except Exception:
        transport.write_text(json.dumps({'result': 'handoff-unverified', 'raw_diagnostics_retained': False}) + '\n')
        return 1


if __name__ == '__main__':
    raise SystemExit(main())