#!/usr/bin/env python3
"""Harmless sandbox probes. Uses only a generated fixture and example domains."""
import argparse
import json
import os
from pathlib import Path
import shutil
import subprocess
import sys
import tempfile


def setup():
    root = Path(tempfile.mkdtemp(prefix="agentastic-sandbox-lab-")).resolve()
    project = root / "project"
    outside = root / "outside"
    project.mkdir()
    outside.mkdir()
    (project / "allowed.txt").write_text("public fixture\n")
    (outside / "private.txt").write_text("FAKE_SECRET_FOR_SANDBOX_LAB_ONLY\n")
    shutil.copyfile(__file__, project / "probe.py")
    settings = {
        "sandbox": {
            "enabled": True,
            "failIfUnavailable": True,
            "allowUnsandboxedCommands": False,
            "filesystem": {
                "denyRead": [str(outside / "private.txt")],
                "denyWrite": [str(outside / "blocked-output.txt")],
            },
            "network": {
                "allowedDomains": ["example.com"],
                "deniedDomains": ["example.org"],
                "strictAllowlist": True,
            },
            "credentials": {
                "envVars": [{"name": "SANDBOX_LAB_TOKEN", "mode": "deny"}]
            },
        }
    }
    (root / "lab-settings.json").write_text(json.dumps(settings, indent=2) + "\n")
    print(root)


def run_probe(name):
    project = Path(__file__).resolve().parent
    outside = project.parent / "outside"
    result = {"probe": name}
    if name == "env":
        result["observed"] = (
            "present" if "SANDBOX_LAB_TOKEN" in os.environ else "absent"
        )
    elif name == "child-read":
        completed = subprocess.run(
            [sys.executable, str(project / "probe.py"), "read-blocked"],
            capture_output=True, text=True, check=False,
        )
        if completed.returncode != 0:
            result.update(observed="child_error", exit_code=completed.returncode)
        else:
            result["child"] = json.loads(completed.stdout)
    elif name.startswith("network-"):
        host = "example.com" if name == "network-allowed" else "example.org"
        completed = subprocess.run(
            ["curl", "--silent", "--show-error", "--head", "--max-time", "10",
             "--output", os.devnull, "--write-out", "%{http_code}", f"https://{host}/"],
            capture_output=True, text=True, check=False,
        )
        result.update(
            host=host, exit_code=completed.returncode,
            http_status=completed.stdout.strip(),
            error=completed.stderr.strip()[:500],
        )
    else:
        targets = {
            "read-allowed": project / "allowed.txt",
            "read-blocked": outside / "private.txt",
            "write-allowed": project / "allowed-output.txt",
            "write-blocked": outside / "blocked-output.txt",
        }
        try:
            if name.startswith("read-"):
                targets[name].read_bytes()
            else:
                targets[name].write_text("harmless probe output\n")
            result["observed"] = "allowed"
        except PermissionError:
            result["observed"] = "permission_denied"
        except OSError as error:
            result.update(observed="other_error", error_type=type(error).__name__,
                          errno=error.errno)
    print(json.dumps(result))


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("probe", choices=[
        "setup", "read-allowed", "read-blocked", "write-allowed", "write-blocked",
        "child-read", "env", "network-allowed", "network-blocked",
    ])
    args = parser.parse_args()
    if args.probe == "setup":
        setup()
    else:
        run_probe(args.probe)