"""Bounded transport for the explicitly approved AI2 target only."""
import base64
from pathlib import Path
import shlex
import subprocess

SSH = ['ssh', '-F', '/dev/null', '-i', '/root/.ssh/ltb1021_contextra_icerti2_si_ed25519',
       '-p', '1022', '-o', 'IdentitiesOnly=yes', '-o', 'BatchMode=yes',
       '-o', 'ConnectTimeout=8', '-o', 'StrictHostKeyChecking=yes',
       '-o', 'UserKnownHostsFile=/root/.ssh/contextra_icerti2_known_hosts',
       'si@58.233.207.31']
SUDO = Path('/run/contextra-icerti2-sudo.R0dC6Y/password')

def run(code, *, root=False, timeout=30, stdin=None):
    encoded = base64.b64encode(code.encode()).decode()
    command = 'python3 -B -c ' + shlex.quote('import base64;exec(base64.b64decode(' + repr(encoded) + '))')
    if root:
        command = 'sudo -k -S -p "" -- ' + command
    data=(SUDO.read_bytes().rstrip(b'\r\n') + b'\n' + (stdin or b'')) if root else stdin
    result = subprocess.run(SSH + [command], input=data,
                            capture_output=True, timeout=timeout)
    if result.returncode:
        raise RuntimeError('AI2 command failed: ' + str(result.returncode) + '\n' + result.stderr.decode(errors='replace')[:2000])
    return result.stdout.decode()