import argparse
import importlib.util
import json
import os
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
SOURCE = ROOT.parent / '2026-11-01_icerti-fight-r5_r01/remote.py'
spec = importlib.util.spec_from_file_location('prior_remote', SOURCE)
remote = importlib.util.module_from_spec(spec)
spec.loader.exec_module(remote)


def capture(name, timeout=45):
    os.umask(0o077)
    output = ROOT / 'private' / (name + '.json')
    if output.exists():
        raise RuntimeError('Existing evidence must not be overwritten')
    inner = (ROOT / 'helpers' / (name + '.py')).read_text()
    outer = '''import json,sys,subprocess,shutil
from pathlib import Path
d=json.loads(Path('/etc/contextra-maintenance/server.json').read_text())
assert d['server']=='icerti-ai2'
assert shutil.disk_usage('/').free>=15*1024**3
sys.path.insert(0,d['paths']['tools'])
import compose_backend as cb
rows=cb.containers()
r=next(x for x in rows if x['Config']['Labels']['com.docker.compose.service']=='analytics')
assert r['State']['Running']
p=subprocess.run(['docker','exec','-i',r['Id'],'python3','-B','-'],input=CODE.encode(),capture_output=True,timeout=TIMEOUT)
if p.returncode:
 print(json.dumps({'error':'READ_ONLY_CONTAINER_QUERY_FAILED','stderr':p.stderr.decode(errors='replace')[-2500:]}))
else:
 data=json.loads(p.stdout)
 data['container_evidence']={x['Config']['Labels']['com.docker.compose.service']:{'id':x['Id'],'image':x['Image'],'started':x['State']['StartedAt']} for x in rows}
 print(json.dumps(data))
'''.replace('CODE', repr(inner)).replace('TIMEOUT', str(timeout))
    raw = remote.python(outer, sudo=True, timeout=timeout+20)
    output.write_bytes(raw)
    data = json.loads(raw)
    if 'error' in data:
        raise RuntimeError('Restricted error saved; inspect without exposing secrets')
    print(json.dumps({'saved': str(output), 'keys': list(data)}))


if __name__ == '__main__':
    p=argparse.ArgumentParser();p.add_argument('name');p.add_argument('--timeout',type=int,default=45)
    a=p.parse_args();capture(a.name,a.timeout)