#!/usr/bin/env python3
"""Repeat the bounded Linux x64 environment probe; never install system tools."""
import hashlib
import json
import os
from pathlib import Path
import platform
import shutil
import subprocess
import tarfile
import tempfile

HERE = Path(__file__).resolve().parent
PARENT = HERE.parent
ARCHIVE = 'node-v24.21.0-linux-x64.tar.xz'
ORIGIN = 'https://nodejs.org/dist/v24.21.0/'


def run(argv, **kwargs):
    return subprocess.check_output(argv, text=True, **kwargs).strip()


def digest(path):
    return hashlib.sha256(path.read_bytes()).hexdigest()


def main():
    if (platform.system(), platform.machine()) != ('Linux', 'x86_64'):
        raise SystemExit('This probe requires Linux x86_64; no alternate runtime is selected.')
    work = Path(tempfile.mkdtemp(prefix='luma-S00-026-'))
    for name in ('SHASUMS256.txt', ARCHIVE):
        subprocess.run(['curl', '--fail', '--silent', '--show-error',
                        '--proto', '=https', '--connect-timeout', '10',
                        '--max-time', '60', ORIGIN + name, '-o', str(work / name)], check=True)
    shutil.copyfile(work / 'SHASUMS256.txt', HERE / 'SHASUMS256.txt')
    entries = dict(line.split()[::-1] for line in (work / 'SHASUMS256.txt').read_text().splitlines())
    archive_hash = digest(work / ARCHIVE)
    if entries.get(ARCHIVE) != archive_hash:
        raise SystemExit('Vendor archive checksum mismatch; extraction refused.')
    # Python data filter prevents traversal and unsafe special-file extraction.
    with tarfile.open(work / ARCHIVE) as archive:
        archive.extractall(work, filter='data')
    runtime = work / 'node-v24.21.0-linux-x64' / 'bin'
    env = dict(os.environ, PATH=str(runtime) + os.pathsep + os.environ.get('PATH', ''))
    versions = {tool: run([str(runtime / tool), '--version'], env=env) for tool in ('node', 'npm')}
    if versions != {'node': 'v24.21.0', 'npm': '11.19.0'}:
        raise SystemExit('Pinned runtime versions do not match.')
    for name in ('package.json', 'package-lock.json'):
        shutil.copyfile(PARENT / name, HERE / name)
    lock = json.loads((HERE / 'package-lock.json').read_text())
    for name, package in lock['packages'].items():
        if name and (not package['resolved'].startswith('https://registry.npmjs.org/')
                     or not package['integrity'].startswith('sha512-')):
            raise SystemExit('Locked dependency lacks required HTTPS/SHA512 integrity.')
    subprocess.run([str(runtime / 'npm'), 'ci', '--ignore-scripts', '--no-audit', '--no-fund',
                    '--strict-ssl=true', '--engine-strict=true',
                    '--registry=https://registry.npmjs.org/', '--fetch-retries=0',
                    '--fetch-timeout=15000', '--cache', str(work / 'npm-cache')],
                   cwd=HERE, env=env, check=True)
    hashes = {}
    for name in ('package.json', 'package-lock.json'):
        if (PARENT / name).read_bytes() != (HERE / name).read_bytes():
            raise SystemExit('Copied parent manifest/lock changed.')
        hashes[name] = digest(HERE / name)
    for name, package in lock['packages'].items():
        if name:
            installed = json.loads((HERE / name / 'package.json').read_text())
            if installed['version'] != package['version']:
                raise SystemExit('Installed version differs from parent lock: ' + name)
    stanza = run([str(runtime / 'node'), '--input-type=module', '-e',
                  "import {createClient} from 'stanza'; if(typeof createClient !== 'function') process.exit(1); console.log('Stanza createClient import passed')"], cwd=HERE, env=env)
    report = {'platform': 'Linux x86_64', 'origin': ORIGIN, 'archive': ARCHIVE,
              'archive_sha256': archive_hash, 'versions': versions, 'runtime_bin': str(runtime),
              'cache': str(work / 'npm-cache'), 'parent_sha256': hashes,
              'locked_packages': len(lock['packages']) - 1, 'stanza': '12.22.1',
              'import_check': stanza, 'checksum_method': 'Vendor HTTPS SHASUMS256.txt; no detached signature check'}
    (HERE / 'result.json').write_text(json.dumps(report, indent=2) + '\n')
    print(json.dumps(report, indent=2))


if __name__ == '__main__':
    main()