import base64
import hashlib
import json
import os
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, '/tmp/codex/ltb1021/2026-11-01_icerti-web-ssh-connect_r01')
from remote_read import powershell

os.umask(0o077)
preserved = json.loads((ROOT / 'private/preserve_crash.json').read_text())['data']
items = []
for entry in preserved['files']:
    if not entry.get('copied'):
        continue
    path = entry['destination']
    if path.endswith('Report.wer'):
        name = 'wer_20261031.wer' if '4c2aa910-' in path else 'wer_20261025.wer'
    elif path.endswith('system_summary.csv'):
        name = 'chrome_system_summary.csv'
    elif path.endswith('chrome-mem.csv'):
        name = 'chrome_memory.csv'
    else:
        continue
    items.append((name, path, entry['copy_sha256']))
xml = preserved['event_xml']
items.append(('ivpm-crash-events.xml', xml['path'], xml['sha256']))
history = json.loads((ROOT / 'private/history_1026_v2.json').read_text())['data']
items.append(('web-app_1026_0800-1300.log', history['files'][0]['path'], history['files'][0]['sha256']))
critical = json.loads((ROOT / 'private/critical_windows.json').read_text())['data']
for window in critical['windows']:
    f = window['files'][0]
    items.append((window['name'] + '.log', f['path'], f['sha256']))

manifest = []
for name, remote, expected in items:
    dest = ROOT / 'private' / name
    if not dest.exists():
        assert remote.startswith('C:\\Program Files\\Contextra-SSH-Diagnostics\\state\\evidence\\')
        escaped = remote.replace("'", "''")
        script = (
            "$p='" + escaped + "'\n"
            "if((Get-Item -LiteralPath $p).Length -gt 8MB){throw 'File exceeds transfer limit'}\n"
            "[Convert]::ToBase64String([IO.File]::ReadAllBytes($p))\n"
        )
        data = base64.b64decode(powershell(script, timeout=45), validate=True)
        if hashlib.sha256(data).hexdigest() != expected.lower():
            raise RuntimeError('Transfer hash mismatch: ' + name)
        dest.write_bytes(data)
    actual = hashlib.sha256(dest.read_bytes()).hexdigest()
    assert actual == expected.lower()
    manifest.append({'local': name, 'remote': remote, 'bytes': dest.stat().st_size, 'sha256': actual})
    print(json.dumps({'verified': name, 'bytes': dest.stat().st_size}), flush=True)
(ROOT / 'private/transfers.json').write_text(json.dumps(manifest, indent=2) + '\n')