#!/usr/bin/env python3
"""Stamp Atlas WebUI shell URLs with the immutable image release identity."""

from __future__ import annotations

import os
from pathlib import Path
import re


ROOT = Path(os.environ.get("HERMES_WEBUI_PATCH_ROOT", "/opt/hermes-webui"))
RELEASE_ID = os.environ.get("HERMES_WEBUI_RELEASE_ID", "").strip()

if not re.fullmatch(r"[a-z0-9][a-z0-9.-]{0,127}", RELEASE_ID):
    raise SystemExit("HERMES_WEBUI_RELEASE_ID must be a safe immutable release token")

for relative in ("static/index.html", "static/sw.js"):
    path = ROOT / relative
    source = path.read_text(encoding="utf-8")
    if "__WEBUI_VERSION__" not in source:
        raise SystemExit(f"Hermes release patch context changed in {path}")
    path.write_text(
        source.replace("__WEBUI_VERSION__", f"__WEBUI_VERSION__-{RELEASE_ID}"),
        encoding="utf-8",
    )