#!/usr/bin/env python3
"""Load the Vault-derived tool environment in Hermes's main gateway."""

from __future__ import annotations

import argparse
import shutil
from pathlib import Path


BEFORE = """# HOME comes through with-contenv as /root (the /init context). Override
"""
AFTER = """# The init container writes Vault-derived tool credentials here. Load them
# after with-contenv restores the container environment so dashboard-spawned
# terminal tools receive the same Git identity as durable CLI workers.
if [ -r /opt/data/.env ]; then
    set -a
    # shellcheck disable=SC1091
    . /opt/data/.env
    set +a
fi

# HOME comes through with-contenv as /root (the /init context). Override
"""


def patch(source: Path, destination: Path) -> None:
    """Apply the narrow environment load and fail on upstream drift."""
    content = source.read_text(encoding="utf-8")
    if BEFORE not in content:
        raise RuntimeError("Hermes main-wrapper patch context changed")
    destination.parent.mkdir(parents=True, exist_ok=True)
    destination.write_text(content.replace(BEFORE, AFTER, 1), encoding="utf-8")
    shutil.copymode(source, destination)


def main() -> int:
    """Patch the wrapper path supplied by the deployment init container."""
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("source", type=Path)
    parser.add_argument("destination", type=Path)
    args = parser.parse_args()
    patch(args.source, args.destination)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())