
    s	j#                         d Z ddlZddlZddlZddlZddlZdZdZdZ ej                  d      Z
d Zd Zd	 Zd
 Zd Zedk(  r e        yy)u+  task-2553+26 redacted BOT_GITHUB_TOKEN auth preflight.

Source-scope correction of the +24 redacted auth verifier (sole allowed code
modification per task-2553+26 §4/§6.1 carve-out). The +24 verifier evaluated
``os.environ`` only and therefore reported ``token_present:false`` even though a
non-empty ``ghs_`` App installation token is present in the canonical
``.env.keys`` secret path (kept current by refresh-bot-token.timer).

Minimal 1-scope expansion:
  - prefer ``os.environ['BOT_GITHUB_TOKEN']``  (executor sourced .env.keys env)
  - else parse canonical ``.env.keys`` line ``^(export )?BOT_GITHUB_TOKEN=`` only

Redaction discipline (unchanged from +24, hard invariants):
  - token raw value and .env.keys file content are NEVER printed / cat / echoed
    / written / logged / put on a marker / passed as argv / used in a manual
    ``-H "Authorization:"`` header. ``gh auth token`` is never invoked.
  - token value is only ever used in-memory for a 4-char prefix slice and
    boolean comparisons.
  - subprocess auth/permission probes are tokenless from gh's perspective: the
    token is handed to gh only via the child-process ``GH_TOKEN`` env entry
    (never echoed, never in argv, never traced); gh constructs Authorization
    internally. All captured child output is redacted before any use.
  - every exception / traceback is redacted.

The output JSON keeps the +24 strict whitelist schema (no raw field, no
.env.keys content field). The condition-result map is named ``cond6_results``
and carries exactly the §4 6-check booleans/enum (no 7th condition).
    Nz/home/jay/workspace/.env.keysBOT_GITHUB_TOKENzJeon-Jonghyuk/dev_workspacez1gh[psoura]_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+c                 `    	 t         j                  dt        |             S # t        $ r Y yw xY w)zCReturn text with any token-shaped substring replaced. Never raises.
[REDACTED])_TOKEN_SHAPEsubstr	Exception)texts    I/home/jay/workspace/memory/events/task-2553+26.run_bot_token_preflight.py_redactr   .   s0    c$i88 s   ! 	--c                  6   t         j                  j                  t              } | r| j	                         } | r| dfS 	 t        t        ddd      5 }|D ]  }t        j                  dt        j                  t              z   dz   |      }|s9|j                  d      j	                         }t        |      d	k\  r|d
   |d   k(  r|d
   dv r|dd }|r|dfc cddd       S  ddd       y 	 ddd       y# 1 sw Y   yxY w# t        $ r Y yt        $ r Y yw xY w)a`  Resolve the bot token into memory only.

    Returns (value_or_None, token_source) where token_source is
    'sourced_env' (process env, executor sourced .env.keys) or
    'env_keys' (parsed from canonical .env.keys). The raw value is never
    printed, written or logged anywhere; only the caller's in-memory
    prefix/boolean checks consume it.
    sourced_envrutf-8replace)encodingerrorsz^\s*(?:export\s+)?z=(.*)$      r   )'"env_keysN)Nr   )osenvirongetENV_VARstripopenENV_KEYS_PATHrematchescapegrouplenFileNotFoundErrorr	   )env_valfhlinemraws        r   _resolve_tokenr,   6   s%    jjnnW%G--/M)) -wyI 	(R 
(HH2RYYw5GG)SUYZggaj&&(s8q=SVs2w%63q6Z;Oa)C
?*	( 	( (	( 	(
(	(" #	("       sN   D BC6	D !C6"D +C6-D 6C?;D ?D 	DDDc                 R   t        t        j                        }|r
||d<   ||d<   |j                  dd       |j                  dd       	 t	        j
                  | |ddd      }|j                  t        |j                        t        |j                        fS # t        $ r Y y	w xY w)
zRun gh tokenlessly (token via child GH_TOKEN env only) and return
    (returncode, redacted_stdout, redacted_stderr). Token never in argv,
    never echoed, never traced.GH_TOKENGITHUB_TOKENGH_DEBUGNGH_PROMPT_DISABLEDT<   )envcapture_outputr
   timeout)r    r   )dictr   r   pop
subprocessrun
returncoder   stdoutstderrr	   )argstoken	child_envprocs       r   _run_redactedrB   ]   s     RZZ I !&	*$)	.!MM*d#MM&-
#~~
  4gdkk6JJJ #"#s   AB 	B&%B&c                     t               \  } }t        |       }| r| d d nd}|dk(  }t        |       xr |dv xs | j                  d      }t        |       xr |xr | }d}d}|r]|r[t        g d|       \  }	}
}|	d	k(  }|rBt        d
ddt        z  g|       \  }}}|d	k(  r#t        d
ddt        z  ddg|       \  }}}|d	k(  rd}d	}||||||d	k(  d}|xr |xr |xr |xr |dk(  xr |d	k(  }|j                         D cg c]  \  }}|du s|dk(  r| }}}||||||g d||t        d      j                  d      d
}|||fS c c}}w )N   r6   ghs_)ghp_gho_github_pat_FFAIL)ghauthstatusz
--hostnamez
github.comr   rJ   apiz!repos/%s/collaborators?per_page=1zrepos/%s/pulls/129z--jqz.numberPASS)token_present
prefix_ghsnot_owner_patgh_auth_capablemerge_perm_preflightraw_exposure_zero)(env_keys_or_sourced_env_presence_boolean$prefix4_slice_app_installation_checkowner_pat_prefix_exclusion#gh_auth_status_nonverbose_tokenless%gh_api_permission_read_only_get_probe raw_exposure_static_and_spy_zerotimez%Y-%m-%d %H:%M:%S)
rO   prefix_is_ghsis_app_token_not_owner_patrR   merge_permission_preflightraw_exposurechecked_viacond6_resultstoken_sourcets)r,   bool
startswithrB   REPOitems
__import__strftime)r?   rb   rO   prefix4r\   is_owner_patr]   rR   r^   rc_o_erc2_o2_e2rc3_o3_e3r_   ra   all_passkvfail_conditionsevidences                            r   	preflightrz   v   s    (*E<KM eBQibGv%M; ##Fu'7'7'F  "&e!S!S|CSO!' 3"@%

B ' *uADHIMCc ax -5"6"=Y(!S#
 !817.L '#3* :)Q.M 	 		&	 	 '&0		
 A  &3%8%8%: 9TQ:1;  9O 9
 '&&@*&@$
 '$ ))*=>#H& _h../9s   ?Ec                     	 t               \  } }}d}t        |dd      5 }t        j                  |dd	       |j	                  d
       d d d        t        t        j                   d   d             t        j
                  | rd       y d       y # t        $ r7 t        j                  j	                  d       t        j
                  d       Y w xY w# 1 sw Y   xY w)Nzpreflight error (redacted)
   zB/home/jay/workspace/memory/events/task-2553+26.auth-preflight.jsonwr   )r   r   T)indent	sort_keys
rb   )gate0_all_passrx   rb   r   )rz   r	   sysr=   writeexitr   jsondumpprintdumps)ru   rx   ry   out_pathr(   s        r   mainr      s    .7k+/8 TH	hg	. "		(BqD9

 
$**"* 0  
 HH(Q""!  

78 s   B +C=CCC#__main__)__doc__r   r   r!   r9   r   r    r   rf   compiler   r   r,   rB   rz   r   __name__     r   <module>r      sm   :  	 	  
/
$ rzzNO$N#2X/v#, zF r   