import hashlib
import json
import os
from pathlib import Path
import subprocess
import sys


ROOT = Path(__file__).resolve().parent.parent
PACKAGE = ROOT / 'Contextra_Offline_USB_20261103_r01/package'
TEMP = Path('/tmp/codex/ltb1021/2026-11-03_offline-seal_r01')


def main():
    seal = json.loads((ROOT / 'reports/sealed-package.json').read_bytes())
    if seal['status'] != 'SEALED_PACKAGE_VERIFIED':
        raise RuntimeError('Sealing not complete')
    actual = hashlib.sha256((PACKAGE / 'package.json').read_bytes()).hexdigest()
    if actual != seal['sha256']:
        raise RuntimeError('Manifest mismatch')
    env = dict(os.environ, PYTHONDONTWRITEBYTECODE='1', DOCKER_HOST='unix:///var/run/docker.sock')
    for key in ('PYTHONPATH', 'DOCKER_CONTEXT'):
        env.pop(key, None)
    prefix = ['/usr/bin/unshare', '--net', '/usr/bin/python3', '-B']
    help_result = subprocess.run(prefix + [str(PACKAGE / 'ct-offline'), '--help'],
                                 cwd=TEMP, env=env, capture_output=True, text=True, timeout=30)
    if help_result.returncode or 'rollback' not in help_result.stdout or 'stage' not in help_result.stdout:
        raise RuntimeError('Standalone help failed: exit ' + str(help_result.returncode))
    code = '''
import json, socket, sys
from pathlib import Path
root=Path(sys.argv[1]); sys.path.insert(0,str(root))
from deployment_kit.offline.host import Host
from deployment_kit.core import docker
m=json.loads((root/'package.json').read_bytes())
h=Host(); s=h.snapshot()
present={}
for role,image in m['after_images'].items():
    rc,raw=docker('image','inspect','--format','{{.Id}}',image,check=False)
    present[role]=rc==0 and raw.strip()==image
result={'interfaces':[name for _,name in socket.if_nameindex()],
        'target_match':all(s[k]==m['target'][k] for k in ('server','backend','definition_sha256')),
        'before_images_match':s['images']==m['before_images'],
        'server':s['server'],'backend':s['backend'],
        'active_transaction':s['active']['transaction'],
        'installed_tools_guard':'PASS','after_images_present':present,'runtime_changed':False}
assert result['interfaces']==['lo'] and result['target_match'] and result['before_images_match'] and all(present.values())
print(json.dumps(result))
'''
    host_result = subprocess.run(prefix + ['-c', code, str(PACKAGE)],
                                 cwd=TEMP, env=env, capture_output=True, text=True, timeout=60)
    if host_result.returncode:
        raise RuntimeError('Packaged read-only Host check failed: exit ' + str(host_result.returncode))
    host = json.loads(host_result.stdout)
    result = dict(status='PASS', package_manifest_sha256=actual,
                  cwd_outside_repo=True, pythonpath_removed=True, standalone_help=True,
                  network_namespace='loopback_only_child', host=host,
                  prepare=False, apply=False, rollback=False, service_stop=False,
                  host_network_changed=False, new_dependencies=False)
    (ROOT / 'reports/entrypoint-check.json').write_text(json.dumps(result, indent=2) + '\n')
    print(json.dumps(result))


if __name__ == '__main__':
    main()