"""Bounded SSH runner; sudo secret stays in stdin, never argv or output."""
import pathlib
import shlex
import subprocess
import sys

SSH = ['ssh', '-i', '/root/.ssh/ltb1021_contextra_icerti2_si_ed25519',
       '-o', 'UserKnownHostsFile=/root/.ssh/contextra_icerti2_known_hosts',
       '-o', 'StrictHostKeyChecking=yes', '-o', 'BatchMode=yes',
       '-o', 'ConnectTimeout=10', '-o', 'ServerAliveInterval=15',
       '-o', 'ServerAliveCountMax=3', '-p', '1022', 'si@58.233.207.31']
ROOT = '/storage/contextra/experiments/action-model-eval/2026/2026-10-26_contextra-camera23-prep_r01'

def run(args, sudo=False, timeout=120, data=None):
    if sudo:
        if data is not None:
            raise ValueError('sudo stdin is reserved')
        secret = pathlib.Path('/data/contextra-maintenance/secrets/icerti-ai2/sudo.password')
        data = secret.read_bytes().rstrip(b'\r\n') + b'\n'
        args = ['sudo', '-S', '-p', '', '--'] + args
    return subprocess.run(SSH + [shlex.join(args)], input=data, capture_output=True,
                          timeout=timeout, check=False)

if __name__ == '__main__':
    args = sys.argv[1:]
    sudo = bool(args and args[0] == '--sudo')
    if sudo:
        args = args[1:]
    result = run(args, sudo=sudo, timeout=1200)
    sys.stdout.buffer.write(result.stdout)
    sys.stderr.buffer.write(result.stderr)
    sys.exit(result.returncode)