#!/usr/bin/env python3
"""Compare archived _new_sdk_client helpers against four local HTTP probes.
Usage: python3 scripts/check-ep1-reference.py /path/to/upstream/anthropic_adapter.py
No LLM calls. Extracted helper only: this is supplementary coverage, not a new task score.
"""
import ast, datetime, difflib, hashlib, json, pathlib, subprocess, sys
ROOT = pathlib.Path(__file__).resolve().parents[1]
IMAGE = json.loads((ROOT/'harness/docker/FIXTURE.lock.json').read_text())['image_id']
OUT = ROOT/'site/evidence/ep1-reference'
REFERENCE = '036a20b3ca712ac9175bba68c8ff1d9f2f2aecde'
REFERENCE_SHA256 = 'fa8f4c431abb9ce39ad5ce666970c6528b23d2236aae46ea19aa960e58763bc0'
PROBE = r'''
import json,sys,os,threading,typing,anthropic
from http.server import BaseHTTPRequestHandler,HTTPServer
payload=json.load(sys.stdin)
received=[]
class Handler(BaseHTTPRequestHandler):
 def do_POST(self):
  received.append({k.lower():v for k,v in self.headers.items()})
  self.rfile.read(int(self.headers.get('content-length',0)))
  body=json.dumps({'id':'msg_local','type':'message','role':'assistant','content':[{'type':'text','text':'ok'}],'model':'fixture','stop_reason':'end_turn','usage':{'input_tokens':1,'output_tokens':1}}).encode()
  self.send_response(200);self.send_header('content-type','application/json');self.end_headers();self.wfile.write(body)
 def log_message(self,*args): pass
server=HTTPServer(('127.0.0.1',0),Handler)
threading.Thread(target=server.serve_forever,daemon=True).start()
url=f'http://127.0.0.1:{server.server_port}'
results=[]
for candidate in payload:
 scope={'Dict':typing.Dict,'Any':typing.Any,'os':os}
 exec(compile(candidate['helper'],candidate['id'],'exec'),scope)
 result={'id':candidate['id'],'checks':{}}
 for style in ['api_key','bearer']:
  for copied in [False,True]:
   os.environ['ANTHROPIC_AUTH_TOKEN']='local-test-ambient-bearer'
   os.environ['ANTHROPIC_API_KEY']='local-test-ambient-key'
   kwargs={'base_url':url,'max_retries':0,'timeout':5}
   kwargs.update({'api_key':'local-test-selected-key'} if style=='api_key' else {'auth_token':'local-test-selected-bearer'})
   name=style+('_copy' if copied else '_original')
   received.clear()
   try:
    original=scope['_new_sdk_client'](anthropic,kwargs,{})
    client=original.with_options(timeout=5) if copied else original
    client.messages.create(model='fixture',max_tokens=8,messages=[{'role':'user','content':'hi'}])
    headers=received[-1] if received else {}
    ok=(headers.get('x-api-key')=='local-test-selected-key' and not headers.get('authorization')) if style=='api_key' else (headers.get('authorization')=='Bearer local-test-selected-bearer' and not headers.get('x-api-key'))
    result['checks'][name]={'pass':ok,'request_captured':bool(received),'authorization_present':bool(headers.get('authorization')),'x_api_key_present':bool(headers.get('x-api-key'))}
    client.close()
   except Exception as e: result['checks'][name]={'pass':False,'error_type':type(e).__name__}
 results.append(result)
server.shutdown()
print(json.dumps({'sdk':anthropic.__version__,'results':results}))
'''
def helper(text):
    tree = ast.parse(text)
    node = next(n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == '_new_sdk_client')
    return ast.get_source_segment(text,node)
def main():
    reference_bytes = pathlib.Path(sys.argv[1]).read_bytes()
    if hashlib.sha256(reference_bytes).hexdigest() != REFERENCE_SHA256:
        raise SystemExit("Reference source does not match the reviewed upstream commit")
    reference = reference_bytes.decode()
    base = (ROOT/'tasks/ep1-f005/fixture/agent/anthropic_adapter.py').read_text()
    cases = [{'id':'baseline','helper':helper(base)}, {'id':'upstream-reference','helper':helper(reference)}]
    sources = {'baseline':base,'upstream-reference':reference}
    run_rows = []
    for filename in sorted((ROOT/'data/experiments').glob('*.json')):
        run_rows.extend(r for r in json.loads(filename.read_text())['runs'] if r['task']=='ep1-f005')
    for row in run_rows:
        rid=row['run_id']
        text=(ROOT/'harness/scratch'/rid/'agent/anthropic_adapter.py').read_text()
        sources[rid]=text
        cases.append({'id':rid,'helper':helper(text)})
    process=subprocess.run(['docker','run','--rm','-i','--network','none','--read-only','--tmpfs','/tmp','--entrypoint','python3',IMAGE,'-c',PROBE],input=json.dumps(cases),text=True,capture_output=True,timeout=180,check=True)
    result=json.loads(process.stdout)
    checks={x['id']:x['checks'] for x in result['results']}
    assert not checks['baseline']['api_key_original']['pass'], 'baseline must expose original defect'
    assert all(x['pass'] for x in checks['upstream-reference'].values()), 'reference must pass all controls'
    OUT.mkdir(parents=True,exist_ok=True)
    for case in cases:
        rid=case['id'];case['sha256']=hashlib.sha256(sources[rid].encode()).hexdigest()
        case['checks']=checks[rid]
        h=case['helper']
        case['mechanism']='header_omit' if 'Omit()' in h else 'environment_pop' if 'os.environ.pop(' in h else 'attribute_clear' if 'client.auth_token = None' in h else 'unchanged_helper'
        diff=''.join(difflib.unified_diff(base.splitlines(True),sources[rid].splitlines(True),fromfile='fixture/agent/anthropic_adapter.py',tofile=rid+'/agent/anthropic_adapter.py'))
        (OUT/(rid+'.diff')).write_text(diff or '# No changes in agent/anthropic_adapter.py relative to fixture.\n')
    manifest={'generated_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'reference_commit':REFERENCE,'image_id':IMAGE,'anthropic_version':result['sdk'],'scope':'Archived adapter helper extracted with AST; actual loopback HTTP requests, no external network or LLM. Not full agent execution, concurrency test or retrospective score change.','runs':cases}
    (OUT/'comparison.json').write_text(json.dumps(manifest,ensure_ascii=False,indent=2)+'\n')
    print(json.dumps({'cases':len(cases),'sdk':result['sdk'],'reference_all_pass':True,'model_original_pass':sum(c['checks']['api_key_original']['pass'] for c in cases[2:]),'model_copy_pass':sum(c['checks']['api_key_copy']['pass'] for c in cases[2:])}))
if __name__=='__main__':main()