import json
import os
from pathlib import Path
import shlex
import stat
import subprocess
import sys

SECRET=Path('/run/contextra-icerti-sudo.xAWjMb/password')
for p,mode in ((SECRET.parent,0o700),(SECRET,0o600)):
    s=p.lstat();assert not stat.S_ISLNK(s.st_mode) and s.st_uid==0 and stat.S_IMODE(s.st_mode)==mode
SCRIPT='import sys,json; p=json.load(sys.stdin); exec(compile(p["script"],"<approved-site-step>","exec"))'
def execute(script, payload=None, timeout=90):
    doc={'script':script,'payload':payload or {}}
    data=SECRET.read_bytes().rstrip(b'\n')+b'\n'+json.dumps(doc).encode()
    args=['ssh','-i','/root/.ssh/ltb1021_contextra_icerti_si_ed25519','-o','UserKnownHostsFile=/root/.ssh/contextra_icerti_known_hosts',
          '-o','StrictHostKeyChecking=yes','-o','BatchMode=yes','-o','ConnectTimeout=10','-p','1023','si@58.233.207.31',
          'sudo -S -p "" python3 -B -c '+shlex.quote(SCRIPT)]
    r=subprocess.run(args,input=data,capture_output=True,timeout=timeout)
    if r.returncode:
        print('REMOTE_STEP_EXIT',r.returncode)
    # Step scripts must print only safe summaries, never raw secret-bearing command errors.
    print(r.stdout.decode())
    if r.stderr:print('REMOTE_STDERR_PRESENT',len(r.stderr))
    return r
if __name__=='__main__':
    r=execute(Path(sys.argv[1]).read_text(),timeout=int(sys.argv[2]) if len(sys.argv)>2 else 90)
    sys.exit(r.returncode)