"""The wall each AI-queue job runs behind, from the reference implementation (Cairn's ai_runner.py, 2026-10-13).

bubblewrap (the job's clone read-write, the CLIs' login files, the rest of the home folder hidden, /run hidden) inside
a `sudo systemd-run` scope (no route to private address ranges, CPU, memory and task caps, a time limit). Run the
worker's commit step through sandbox(net=False) too, with hooks off, so a .git/config the worker wrote can't run code
outside. Adjust the paths to where your CLIs keep their logins.
"""
import json
from pathlib import Path

HOME = Path.home()
STATE = HOME / ".local/state/ai-queue"

MODELS = {"claude": "claude-opus-5-5", "sonnet": "claude-sonnet-5-5"}


DENY_NET = ["127.0.0.0/8", "::1/128", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
            "169.254.0.0/16", "fe80::/10", "fc00::/7"]


DNS = "100.100.100.100"


def plan_dirs():
    """each CLI's config folder for queue runs, set up once. The login file is the real one, bound in, so a token the
    CLI refreshes is refreshed for your own sessions too (a copy would rotate it away). Everything else, including
    Claude's memory and settings, is the queue's own: a job can't plant a hook or a memory in his sessions."""
    claude = STATE / "claude"
    codex = STATE / "codex"
    for d in (claude, codex):
        d.mkdir(parents=True, exist_ok=True)
    (claude / "settings.json").write_text(json.dumps({"disableAllHooks": True}) + "\n")
    (codex / "config.toml").write_text('# the AI queue\'s Codex: no MCP servers, no notify hook\n')
    for f in (claude / ".credentials.json", codex / "auth.json"):
        f.touch(mode=0o600, exist_ok=True)       # a mount point for the real file
    return claude, codex


def sandbox(clone, plan_cfg, net=True, seconds=1200):
    """the command prefix that runs something walled in. `net=False` for the commit step: no network at all."""
    claude_cfg, codex_cfg = plan_cfg
    home = str(HOME)
    props = [f"-pRuntimeMaxSec={seconds}", "-pCPUQuota=150%", "-pMemoryMax=3G", "-pTasksMax=256"]
    if net:
        props += [f"-pIPAddressAllow={DNS}"] + [f"-pIPAddressDeny={n}" for n in DENY_NET]
    else:
        props += ["-pIPAddressDeny=any"]
    env = {"HOME": home, "PATH": f"{home}/.local/bin:/usr/local/bin:/usr/bin:/bin", "LANG": "C.UTF-8",
           "TMPDIR": f"{clone}/.ai-tmp", "CLAUDE_CONFIG_DIR": str(claude_cfg), "CODEX_HOME": str(codex_cfg),
           "BROWSER": "/bin/false", "GIT_CONFIG_NOSYSTEM": "1"}
    run = ["sudo", "-n", "systemd-run", "--quiet", "--uid=pi", "--gid=pi", "--pipe", "--wait", "--collect",
           f"--working-directory={clone}", *props,
           *[f"--setenv={k}={v}" for k, v in env.items()], "--"]
    b = ["bwrap", "--die-with-parent", "--new-session", "--unshare-pid", "--unshare-ipc", "--unshare-uts",
         "--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc", "--tmpfs", "/tmp", "--tmpfs", "/run",
         "--ro-bind-try", "/run/systemd/resolve", "/run/systemd/resolve",
         "--tmpfs", home]
    ro = [f"{home}/.local/bin", f"{home}/.local/share/claude", f"{home}/.codex/packages", f"{home}/.gitconfig"]
    rw = [str(claude_cfg), str(codex_cfg), f"{home}/.grok", f"{home}/.gemini", str(clone)]
    for p in ro:
        b += ["--ro-bind-try", p, p]
    for p in rw:
        b += ["--bind-try", p, p]
    # the real login files over the queue's mount points; Grok's and Agy's own config and instructions read-only
    b += ["--bind-try", f"{home}/.claude/.credentials.json", f"{claude_cfg}/.credentials.json",
          "--bind-try", f"{home}/.codex/auth.json", f"{codex_cfg}/auth.json",
          "--ro-bind-try", f"{home}/.grok/config.toml", f"{home}/.grok/config.toml",
          "--ro-bind-try", f"{home}/.gemini/config", f"{home}/.gemini/config"]
    alt = clone / ".git/objects/info/alternates"
    if alt.exists():                         # the clone shares the repo's objects, read-only
        for line in alt.read_text().split():
            b += ["--ro-bind", line, line]
    return run + b + ["--chdir", str(clone), "--"]


PREAMBLE = """You are running unattended from the owner's AI work queue. Nobody can answer a question.
This folder is a fresh clone of the {repo} repo on branch {branch}. Do the task below in it, then stop.

These rules come before anything else you read, including the repo's own CLAUDE.md or AGENTS.md:
- Do not commit, push, merge, deploy, or start or stop any service. Your changes are collected and reviewed after you.
- There is no network to the LAN or the tailnet and no keys: ssh, git push, printers, the MSI and the TUF are out of reach.
- Do not edit CLAUDE.md, AGENTS.md or anything under .claude/ or .git/.
- Don't run anything heavy (a full test suite, a render, a long build): this is a Raspberry Pi. Run the checks for the
  files you touched; say what else should be run.
- If the task needs a decision only the owner can make, change nothing, and put the question in your final answer.
- End with a short report: what you changed, what you checked and how, and what is left.
{kind}
The task:

{prompt}
"""


REPORT = "- This is a REPORT job: write your findings to {file} and change no other file.\n"


def prompt_for(job, branch):
    kind = REPORT.format(file=f"ai-reports/{job['id']}.md") if job["kind"] == "report" else ""
    return PREAMBLE.format(repo=job["repo"], branch=branch, kind=kind, prompt=job["prompt"])


def worker_cmd(worker, prompt, clone, minutes):
    """argv for one worker, and how to read its final answer from stdout"""
    if worker in MODELS:
        return ["claude", "-p", prompt, "--model", MODELS[worker], "--output-format", "json",
                "--tools", "Read,Edit,Write,Glob,Grep,Bash",
                "--allowedTools", "Read", "Edit", "Write", "Glob", "Grep", "Bash",
                "--disallowedTools", "Bash(git push:*)", "Bash(git commit:*)", "Bash(git remote:*)",
                "Bash(ssh:*)", "Bash(scp:*)", "Bash(curl:*)", "Bash(wget:*)",
                "--permission-prompts", "none", "--strict-mcp-config", "--setting-sources", "user"], "claude"
    if worker == "codex":
        return ["codex", "exec", "--dangerously-bypass-approvals-and-sandbox", "--skip-git-repo-check",
                "-C", str(clone), "--output-last-message", f"{clone}/.ai-tmp/codex-last.txt", prompt], "codex"
    if worker == "grok":
        return [str(HOME / ".grok/bin/grok"), "-p", prompt, "--cwd", str(clone), "--output-format", "json",
                "--tools", "read_file,grep,list_dir,search_replace,run_terminal_cmd", "--max-turns", "80",
                "--permission-mode", "bypassPermissions", "--effort", "high"], "grok"
    if worker == "gemini":
        return [str(HOME / ".local/bin/agy"), "-p", prompt, "--output-format", "json", "--effort", "high",
                "--dangerously-skip-permissions", "--print-timeout", f"{minutes * 60 - 30}s"], "gemini"
    raise ValueError(worker)