"""Dependency-light venv recovery that runs BEFORE hermes_cli.main's imports.

This module is deliberately **stdlib-only** so importing it can never fail on a corrupted venv.
``hermes_cli.main`` imports and calls :func:`recover_if_needed` at the very top of its module body,
before any third-party import.

Scope: this early pass only repairs enough for ``hermes_cli.main`` to become importable again
(force-reinstall of the known-fragile core packages, using the pins from pyproject.toml).
"""

from __future__ import annotations

import importlib
import os
import shutil
import subprocess
import sys
import time
from pathlib import Path

# Core packages a failed lazy ``uv pip install`` is known to leave with intact
# distribution metadata but wiped import files (#57828).  ``module`` is what we
# probe via a real import; ``attr`` guards against an empty/stub module.
# main.py's marker-recovery path reuses these tables — keep them here (the
# dependency-light module) so both layers probe and repair the same set.
LAZY_REFRESH_IMPORT_PROBES: tuple[tuple[str, str], ...] = (
    ("yaml", "SafeDumper"),
    ("dotenv", "load_dotenv"),
    ("click", "Command"),
    ("certifi", "contents"),
    ("rich", "print"),
    ("cryptography", "__version__"),
    ("jwt", "encode"),
)

LAZY_REFRESH_REPAIR_PACKAGES: dict[str, str] = {
    "yaml": "PyYAML",
    "dotenv": "python-dotenv",
    "click": "click",
    "certifi": "certifi",
    "rich": "rich",
    "cryptography": "cryptography",
    "jwt": "PyJWT",
}


# --- Windows entry-point shim quarantine -----------------------------------
#
# ``hermes update`` renames the live ``hermes*.exe`` shims aside
# (``hermes.exe.old.<unix-ms>``) so uv can write replacements. Putting them BACK
# is the safety-critical direction: losing that rename leaves the install with
# no ``hermes`` on PATH, and the command that would repair it IS ``hermes
# update`` (#75584).
#
# Three call sites restore a quarantined shim -- the updater, the
# early-recovery installer, and the startup sweep's orphan rescue. They used to
# be separate one-shot renames with swallowed errors; the two that had messages
# had already drifted apart. The logic lives here, in the one stdlib-only module
# all of them can import, so the ladder and the recovery wording stay in
# lockstep.

QUARANTINE_RESTORE_BACKOFF_MS: tuple[int, ...] = (0, 100, 250, 500, 1000)


def restore_quarantined_shims(
    moved: list[tuple[Path, Path]],
    *,
    stream=None,
    backoff_ms: tuple[int, ...] = QUARANTINE_RESTORE_BACKOFF_MS,
) -> list[tuple[Path, Path]]:
    """Rename quarantined shims back, retrying a lock instead of giving up.

    A pair is not a failure when ``original`` already exists or ``quarantined`` has gone: the
    installer wrote a fresh shim, or a concurrent sweep won the race. Both are silent, so two
    processes sweeping the same orphan cannot produce a spurious error.
    """
    if stream is None:
        stream = sys.stderr

    failed: list[tuple[Path, Path]] = []

    for original, quarantined in moved:
        last_exc: OSError | None = None

        for delay_ms in backoff_ms:
            try:
                if os.path.exists(original) or not os.path.exists(quarantined):
                    last_exc = None
                    break
                if delay_ms:
                    time.sleep(delay_ms / 1000.0)
                os.rename(quarantined, original)
                last_exc = None
                break
            except OSError as exc:
                last_exc = exc
                continue

        if last_exc is None:
            continue

        failed.append((original, quarantined))
        name = os.path.basename(str(original))
        stem = name[:-4] if name.lower().endswith(".exe") else name
        print(
            f"  ✖ FAILED to restore {name} "
            f"({last_exc.__class__.__name__}) — it is still quarantined "
            f"as {os.path.basename(str(quarantined))}.\n"
            f"    `{stem}` will NOT be on PATH until it is put back. Run this, "
            f"then re-run the update:\n"
            f'      move "{quarantined}" "{original}"',
            file=stream,
        )

    return failed


# Set only when this process successfully finishes a deferred core install for
# an ``update`` invocation.  The normal CLI import that follows must not resolve
# external secret sources: a configured source can map cryptography._rust and
# immediately recreate the self-lock marker this fresh process just consumed.
# Process-local state is intentional so child processes do not inherit the
# bootstrap exception.
_UPDATE_RETRY_RECOVERED = False


def _should_skip_external_secret_sources() -> bool:
    """Whether this updater already completed its deferred native install."""
    return _UPDATE_RETRY_RECOVERED


def _project_root() -> Path:
    return Path(__file__).resolve().parent.parent


def _load_pyproject_project(root: Path) -> dict | None:
    """``[project]`` table of ``root/pyproject.toml``; ``None`` when missing/unreadable.

    Stdlib-only (tomllib) — shared by every pyproject lookup in the repair path so ``packaging``
    is never needed in the broken-venv state.
    """
    pyproject = root / "pyproject.toml"
    if not pyproject.is_file():
        return None
    try:
        import tomllib

        with open(pyproject, "rb") as f:
            project = tomllib.load(f).get("project", {})
    except Exception:
        return None
    return project if isinstance(project, dict) else None


def _read_marker_attempts(marker_path: Path) -> int:
    """Attempt counter from a marker's opportunistic JSON body; corrupt/missing → 0."""
    try:
        raw = marker_path.read_text(encoding="utf-8", errors="replace").strip()
    except OSError:
        return 0
    if not raw:
        return 0
    try:
        import json

        return int(json.loads(raw).get("attempts", 0))
    except (ValueError, AttributeError):
        return 0


def _run_ensurepip(root: Path) -> None:
    """Best-effort pip bootstrap — a killed install can leave the venv with no pip module at all."""
    try:
        subprocess.run(
            [sys.executable, "-m", "ensurepip", "--upgrade", "--default-pip"],
            cwd=root,
            capture_output=True,
        )
    except Exception:
        pass


def _report_failed_install(result) -> bool:
    """Replay the captured tail of a failed installer run to stderr; always ``False``."""
    tail = (result.stderr or result.stdout or "")[-2000:]
    if tail:
        print(tail, file=sys.stderr)
    return False


def _pid_is_running(pid: int) -> bool:
    """Best-effort stdlib-only process liveness probe.

    ``os.kill(pid, 0)`` is not a no-op on Windows, so use the Win32 process handle API there. An
    access-denied result counts as live: racing an elevated updater is worse than postponing
    recovery for one launch.
    """
    if pid <= 0:
        return False
    if sys.platform == "win32":
        try:
            import ctypes

            synchronize = 0x00100000
            kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
            kernel32.OpenProcess.argtypes = [
                ctypes.c_ulong,
                ctypes.c_int,
                ctypes.c_ulong,
            ]
            kernel32.OpenProcess.restype = ctypes.c_void_p
            kernel32.WaitForSingleObject.argtypes = [ctypes.c_void_p, ctypes.c_ulong]
            kernel32.WaitForSingleObject.restype = ctypes.c_ulong
            kernel32.CloseHandle.argtypes = [ctypes.c_void_p]
            kernel32.CloseHandle.restype = ctypes.c_int
            handle = kernel32.OpenProcess(synchronize, False, pid)
            if not handle:
                return ctypes.get_last_error() == 5  # ERROR_ACCESS_DENIED
            try:
                return kernel32.WaitForSingleObject(handle, 0) == 258
            finally:
                kernel32.CloseHandle(handle)
        except Exception:
            return True
    try:
        os.kill(pid, 0)  # windows-footgun: ok — Windows returns above
    except ProcessLookupError:
        return False
    except PermissionError:
        return True
    except OSError:
        return False
    return True


def _marker_owner_is_live(marker: Path) -> bool:
    """True when a legacy update marker names a process still running."""
    try:
        body = marker.read_text(encoding="utf-8", errors="replace")
    except OSError:
        return False
    for line in body.splitlines():
        key, separator, value = line.partition("=")
        if separator and key.strip() == "pid":
            try:
                return _pid_is_running(int(value.strip()))
            except ValueError:
                return False
    return False


def _pinned_specs(packages: list[str], project_root: Path) -> list[str]:
    """Map bare package names to their pinned specs from pyproject.toml.

    Stdlib-only (tomllib + naive requirement-head parsing — ``packaging`` may itself be broken in
    the failure state this module exists for). Unknown packages fall back to their bare name.
    """
    project = _load_pyproject_project(project_root)
    if project is None:
        return packages
    raw_deps = project.get("dependencies", []) or []

    name_to_spec: dict[str, str] = {}
    for spec in raw_deps:
        head = spec.split(";", 1)[0].strip()
        bare = head
        for op in ("==", ">=", "<=", "~=", ">", "<", "!="):
            if op in bare:
                bare = bare.split(op, 1)[0]
                break
        key = bare.strip().split("[", 1)[0].strip().lower()
        if key:
            name_to_spec[key] = head
    return [name_to_spec.get(pkg.lower(), pkg) for pkg in packages]


def _certifi_bundle_broken() -> bool:
    """True when certifi imports but its ``cacert.pem`` is missing/corrupt.

    A brew Python upgrade or interrupted venv rebuild can leave certifi's metadata intact while
    ``cacert.pem`` is gone or a dangling symlink; every TLS connection then fails opaquely deep in
    httpx/requests. An attribute probe passes in that state, so validate the bundle path itself.
    """
    try:
        import certifi

        bundle = Path(certifi.where())
        # <1 KiB cannot hold a single PEM certificate — treat as corrupt.
        return not bundle.is_file() or bundle.stat().st_size < 1024
    except Exception:
        # Import failure is caught by the regular probe table; a failure to
        # even stat is treated as broken.
        return True


def _probe_broken_packages() -> list[str]:
    """Import-probe the fragile core packages in THIS process.

    Returns repair package names (deduped, probe order) for modules that fail to import or lack
    their sentinel attribute. Failed imports leave nothing in ``sys.modules``, so a post-repair
    retry in the same process works.
    """
    broken: list[str] = []
    for mod_name, attr in LAZY_REFRESH_IMPORT_PROBES:
        try:
            mod = importlib.import_module(mod_name)
            if not hasattr(mod, attr):
                raise ImportError(f"{mod_name} missing {attr}")
            if mod_name == "certifi" and _certifi_bundle_broken():
                raise ImportError("certifi cacert.pem missing or corrupt")
        except Exception:
            pkg = LAZY_REFRESH_REPAIR_PACKAGES.get(mod_name)
            if pkg and pkg not in broken:
                broken.append(pkg)
    return broken


def _find_uv_binary() -> str | None:
    """Locate a ``uv`` binary without importing third-party modules.

    uv-managed base interpreters carry an ``EXTERNALLY-MANAGED`` marker, so the stdlib ``pip``
    fallback below refuses to touch them. In that state the only sanctioned installer is uv itself,
    which Hermes already vendors (``~/.hermes/bin/uv.exe``) or the user has on PATH. Stdlib-only.
    """
    exe = "uv.exe" if sys.platform == "win32" else "uv"
    candidates = [
        Path.home() / ".hermes" / "bin" / exe,
        Path.home() / ".local" / "bin" / exe,
        Path.home() / ".cargo" / "bin" / exe,
    ]
    for path in candidates:
        if path.is_file():
            return str(path)
    return shutil.which(exe)


def _base_interpreter_is_externally_managed() -> bool:
    """True when ``sys.executable`` is a uv/standalone-builds managed install.

    Those interpreters ship an ``EXTERNALLY-MANAGED`` marker next to their stdlib (PEP 668), so
    ``python -m pip install`` aborts with ``externally-managed-environment``. The early repair must
    then go through uv (or explicitly override pip) or the reinstall no-ops and the venv stays
    broken (#83569).
    """
    try:
        import sysconfig

        stdlib = Path(sysconfig.get_path("stdlib"))
        # uv 0.5+ moved the marker one level up next to a ``_uv_managed`` sentinel dir.
        return (stdlib / "EXTERNALLY-MANAGED").exists() or (
            stdlib.parent / "EXTERNALLY-MANAGED"
        ).exists()
    except Exception:
        return False


def _run_repair_install(specs: list[str], project_root: Path) -> bool:
    """``uv pip`` (or stdlib ``pip``) force-reinstall of the given specs.

    Streams nothing to stdout (``hermes acp`` speaks JSON-RPC on stdout); output is captured and
    replayed to stderr only on failure. Never raises.

    Two installer paths, in priority order:
    """
    externally_managed = _base_interpreter_is_externally_managed()
    if externally_managed:
        uv = _find_uv_binary()
        if uv:
            env = {**os.environ, "VIRTUAL_ENV": str(project_root / "venv")}
            env.pop("PYTHONHOME", None)
            env.pop("PYTHONPATH", None)
            try:
                result = subprocess.run(
                    [uv, "pip", "install", "--force-reinstall", *specs],
                    cwd=project_root,
                    capture_output=True,
                    text=True, encoding="utf-8", errors="replace",
                    env=env,
                )
            except Exception as exc:
                print(f"  ✗ Early venv repair could not run uv: {exc}", file=sys.stderr)
                return False
            return result.returncode == 0 or _report_failed_install(result)
        # No uv available: fall through to pip with the PEP 668 override so
        # the repair at least attempts to fix the venv instead of no-oping.
        print(
            "  ⚠ Base interpreter is externally managed and no uv binary was "
            "found; retrying repair via pip with PEP 668 override.",
            file=sys.stderr,
        )

    _run_ensurepip(project_root)
    pip_cmd = [sys.executable, "-m", "pip", "install", "--force-reinstall"]
    if externally_managed:
        pip_cmd.append("--break-system-packages")
    pip_cmd.extend(specs)
    try:
        result = subprocess.run(
            pip_cmd,
            cwd=project_root,
            capture_output=True,
            text=True, encoding="utf-8", errors="replace",
        )
    except Exception as exc:
        print(f"  ✗ Early venv repair could not run pip: {exc}", file=sys.stderr)
        return False
    return result.returncode == 0 or _report_failed_install(result)


def _pytest_owns_live_checkout(root: Path) -> bool:
    """True when running under pytest AND ``root`` is this module's own checkout — the one whose
    venv is executing the suite right now.

    Lifecycle tests spawn real subprocesses that import ``hermes_cli.main`` with recovery armed and
    inherit ``PYTEST_CURRENT_TEST``. Without this guard a broken dev venv would get a REAL ensurepip
    + ``pip install --force-reinstall`` from inside a running suite. Tests sandboxing
    ``project_root`` to a tmp_path are unaffected.
    """
    return (
        "PYTEST_CURRENT_TEST" in os.environ
        and root == Path(__file__).resolve().parent.parent
    )


def recover_if_needed(
    project_root: Path | None = None,
    argv: list[str] | None = None,
) -> None:
    """Repair wiped core packages so ``hermes_cli.main`` can import at all.

    Fast path (no marker present) is two ``lstat`` calls. Only acts when a recovery marker from a
    prior ``hermes update`` exists AND an import probe confirms a core package is actually broken.

    Never raises: on any failure the import of main.py proceeds and surfaces the real error.
    """
    global _UPDATE_RETRY_RECOVERED

    try:
        args = sys.argv[1:] if argv is None else argv
        root = _project_root() if project_root is None else project_root
        if _pytest_owns_live_checkout(root):
            return
        core_marker = root / ".update-incomplete"
        lazy_marker = root / ".lazy-refresh-incomplete"
        if not core_marker.exists() and not lazy_marker.exists():
            return
        # Managed/Docker/PyPI installs have no source tree here — the marker
        # is not ours to act on; main.py's recovery clears it.
        if not (root / "pyproject.toml").is_file():
            return

        # Pending core install (.update-incomplete) — complete it NOW, before
        # any native extension can be imported by this process.  The lazy
        # import-probe path below only proves main.py is importable; the core
        # install here guarantees the WHOLE dependency set is replaced while
        # nothing pins venv .pyd files yet (#83569 self-lock: deferring the
        # install to main()'s post-import recovery re-locks it on Windows).
        # Bounded retries: a persistently failing install must not hammer
        # every launch, so attempts past the ceiling are left for main.py's
        # post-import recovery path (which can safely probe-import after this
        # process already holds whatever extensions it needs).
        # A live marker owner means another updater is currently inside the
        # marker-to-install window.  Never race it.  A dead owner means this is
        # a prior deferral/interruption and MUST be recovered even when this
        # launch is itself `hermes update`: CLI and Desktop retries preserve
        # that argv, and skipping solely on argv recreates the self-lock loop.
        if core_marker.exists():
            if _marker_owner_is_live(core_marker):
                return
            completed = _complete_pending_core_install(root, core_marker)
            if completed and "update" in args:
                _UPDATE_RETRY_RECOVERED = True
            return

        # Keep the historical update-argv exclusion for the lazy-refresh
        # marker.  Unlike the core marker it is not a deferred native install,
        # and the active update flow owns its probe/repair lifecycle.
        if "update" in args:
            return

        broken = _probe_broken_packages()
        if not broken:
            # Imports are fine — main.py will load and run full recovery.
            return

        # Single-flight: share main.py's recovery lock so an early repair
        # never races a concurrent full recovery into the same shared venv.
        if not _claim_recovery_lock(root):
            return

        try:
            specs = _pinned_specs(broken, root)
            print(
                "⚠ Core package(s) broken by an interrupted update — "
                f"repairing before launch: {', '.join(broken)}",
                file=sys.stderr,
            )
            if _run_repair_install(specs, root) and not _probe_broken_packages():
                print("  ✓ Core packages repaired.", file=sys.stderr)
            else:
                print(
                    "  ✗ Automatic repair incomplete. Recover manually with:",
                    file=sys.stderr,
                )
                print(
                    f"    {sys.executable} -m pip install --force-reinstall "
                    + " ".join(specs),
                    file=sys.stderr,
                )
        finally:
            _release_recovery_lock(root)
    except Exception:
        # Never block launch — the import of main.py will surface the truth.
        pass


# Cap on automatic early-pass install retries.  A persistently failing
# install (e.g. network down, index unreachable) must not reinstall-hammer
# every `hermes` launch: past this many attempts the early pass hands the
# marker to main.py's post-import recovery, which presents the manual
# recovery command.  The counter lives inside the marker file itself (JSON
# body) and is bumped on each failed attempt.
_EARLY_CORE_INSTALL_MAX_ATTEMPTS = 3


def _claim_recovery_lock(root: Path) -> bool:
    """Single-flight claim on the shared recovery lock.  Never raises."""
    lock_path = root / ".update-incomplete.lock"
    try:
        fd = os.open(lock_path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)
        os.write(fd, f"{os.getpid()}\n".encode())
        os.close(fd)
        return True
    except FileExistsError:
        try:
            if time.time() - lock_path.stat().st_mtime > 3600:
                lock_path.unlink()
        except OSError:
            pass
        return False
    except OSError:
        # Read-only fs / perms — proceed unlocked; the install itself
        # surfaces the real problem.  Recoverable.
        return True


def _release_recovery_lock(root: Path) -> None:
    """Best-effort release of the shared recovery lock."""
    try:
        (root / ".update-incomplete.lock").unlink()
    except OSError:
        pass


def _complete_pending_core_install(root: Path, core_marker: Path) -> bool:
    """Run the pending core install BEFORE main.py can import native modules.

    ``recover_if_needed`` invokes this when ``.update-incomplete`` exists — a prior ``hermes
    update`` (or the self-lock preflight, #83569) left the dependency sync deliberately unfinished.

    Never raises: any failure leaves the marker for the post-import path and returns ``False``.
    Returns ``True`` only after the install succeeds.
    """
    try:
        from hermes_cli import _install_repair as ir

        # Retry backoff: read current attempts before claiming the lock so a
        # persistently-failing install stops hammering early.  After the
        # increment the counter reflects THIS attempt.
        attempts = _read_marker_attempts(core_marker)

        if attempts >= _EARLY_CORE_INSTALL_MAX_ATTEMPTS:
            print(
                "⚠ Pending interrupted-update install has already failed "
                f"{attempts} times in the early pass — leaving it for the "
                "post-import recovery path.",
                file=sys.stderr,
            )
            return False

        if not _claim_recovery_lock(root):
            return False

        try:
            print(
                "⚠ A previous `hermes update` was interrupted mid-install — "
                "finishing dependency installation now (before any native "
                "extensions load)...",
                file=sys.stderr,
            )
            ir.run_core_install(root)
        except Exception as exc:
            new_attempts = ir.bump_marker_attempts(core_marker)
            print(
                f"  ✗ Early interrupted-install completion failed (attempt "
                f"{new_attempts}/{_EARLY_CORE_INSTALL_MAX_ATTEMPTS}): {exc}",
                file=sys.stderr,
            )
            print(
                "  The next launch will retry; hermes will keep working from "
                "the current venv in the meantime.",
                file=sys.stderr,
            )
            return False
        finally:
            _release_recovery_lock(root)

        try:
            core_marker.unlink()
        except OSError:
            pass
        print(
            "  ✓ Dependency installation completed in the early pass.",
            file=sys.stderr,
        )
        return True
    except Exception:
        # Never block launch — the marker stays for the post-import path.
        return False