import path from 'node:path';
import { findCodexBinary } from '../codex-adapter.js';
import { ensureDir, runProcess } from '../fsx.js';
import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
export async function runCodex0139SandboxProfileAliasProbe(input) {
    const started = Date.now();
    const codexBin = input.codexBin || await findCodexBinary();
    if (!codexBin)
        return skippedCodex0139Probe('codex_cli_missing');
    const help = await runProcess(codexBin, ['--help'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 256 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
    const sandboxHelp = await runProcess(codexBin, ['sandbox', '--help'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 256 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
    const helpText = `${help.stdout || ''}\n${help.stderr || ''}`;
    const sandboxHelpText = `${sandboxHelp.stdout || ''}\n${sandboxHelp.stderr || ''}`;
    const topLevelHelpMentionsAlias = /(^|\s)-P\b/.test(helpText);
    const sandboxHelpMentionsAlias = /(^|\s)-P,\s+--permissions-profile\b/.test(sandboxHelpText) || /(^|\s)-P\b/.test(sandboxHelpText);
    const dryArgs = sandboxHelpMentionsAlias ? ['sandbox', '-P', ':read-only', '--', 'true'] : ['-P', ':read-only', '--version'];
    const dry = await runProcess(codexBin, dryArgs, { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
    const dryAccepted = dry.code === 0;
    const ok = topLevelHelpMentionsAlias || sandboxHelpMentionsAlias;
    return {
        ok,
        mode: 'actual-cli',
        command_line: [codexBin, ...(sandboxHelpMentionsAlias ? ['sandbox', '--help'] : ['--help'])],
        duration_ms: Date.now() - started,
        stdout_tail: codex0139ProbeTail(`${help.stdout || ''}\n${sandboxHelp.stdout || ''}\n${dry.stdout || ''}`),
        stderr_tail: codex0139ProbeTail(`${help.stderr || ''}\n${sandboxHelp.stderr || ''}\n${dry.stderr || ''}`),
        artifact_paths: [],
        evidence: {
            help_mentions_P: topLevelHelpMentionsAlias || sandboxHelpMentionsAlias,
            top_level_help_mentions_P: topLevelHelpMentionsAlias,
            sandbox_help_mentions_P: sandboxHelpMentionsAlias,
            dry_command_attempted: true,
            dry_command_line: [codexBin, ...dryArgs],
            dry_command_accepted: dryAccepted,
            dry_command_warning: dryAccepted ? null : 'help proof accepted; dry no-op unsupported in this CLI shape'
        },
        blockers: ok ? [] : ['codex_sandbox_profile_alias_help_missing']
    };
}
export async function runCodex0139SandboxProxyPreservationProbe(input) {
    const started = Date.now();
    const codexBin = input.codexBin || await findCodexBinary();
    if (!codexBin)
        return skippedCodex0139Probe('codex_cli_missing');
    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `sandbox-proxy-${Date.now()}`);
    await ensureDir(tempDir);
    const args = ['sandbox', '-P', ':read-only', '-C', tempDir, '--', 'true'];
    const result = await runProcess(codexBin, args, {
        cwd: tempDir,
        timeoutMs: input.timeoutMs || 30000,
        maxOutputBytes: 64 * 1024
    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
    const safeNoopRan = result.code === 0;
    const proxyMarkerAvailable = Boolean(process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY);
    const approvedEscalationPreservationScriptable = process.env.SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY === '1';
    const ok = safeNoopRan && (!input.requireReal || approvedEscalationPreservationScriptable);
    return {
        ok,
        mode: 'actual-cli',
        command_line: [codexBin, ...args],
        duration_ms: Date.now() - started,
        stdout_tail: codex0139ProbeTail(result.stdout),
        stderr_tail: codex0139ProbeTail(result.stderr),
        artifact_paths: [tempDir],
        evidence: {
            safe_noop_ran: safeNoopRan,
            proxy_marker_available: proxyMarkerAvailable,
            proxy_marker_checked: proxyMarkerAvailable,
            approved_escalation_preservation_scriptable: approvedEscalationPreservationScriptable,
            approved_escalation_retry_env: 'SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY=1',
            permissions_profile: ':read-only'
        },
        blockers: ok ? [] : [
            ...(safeNoopRan ? [] : ['codex_sandbox_proxy_safe_noop_failed']),
            ...(input.requireReal && !approvedEscalationPreservationScriptable ? ['codex_sandbox_proxy_escalation_preservation_not_safely_scriptable'] : [])
        ]
    };
}
//# sourceMappingURL=codex-0139-sandbox-real-probe.js.map