#!/usr/bin/env python3
"""Keep Atlas runtime credentials out of Hermes-spawned subprocesses."""

from __future__ import annotations

import argparse
from pathlib import Path


BEFORE = '''    upper = key.upper()
    if upper.startswith("AUXILIARY_") and (
'''

AFTER = '''    upper = key.upper()
    if upper in {
        "API_SERVER_KEY",
        "CLAUDE_CODE_OAUTH_TOKEN",
        "GITEA_TOKEN",
        "HERMES_IMAGE_BROKER_KEY",
    }:
        return True
    if upper.startswith("AUXILIARY_") and (
'''


def patch(source: Path, destination: Path) -> None:
    """Apply the runtime-credential boundary and fail on upstream drift."""
    content = source.read_text(encoding="utf-8")
    if content.count(BEFORE) != 1:
        raise RuntimeError("Hermes subprocess secret boundary context changed")
    destination.parent.mkdir(parents=True, exist_ok=True)
    destination.write_text(content.replace(BEFORE, AFTER, 1), encoding="utf-8")


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("source", type=Path)
    parser.add_argument("destination", type=Path)
    args = parser.parse_args()
    patch(args.source, args.destination)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())