"""Replay: python3 seed.py CHECKOUT OUTPUT; requires installed checkout deps, Node 24, OpenSSH, sudo sshd."""
from pathlib import Path
import subprocess as sp, sys, hashlib, json
repo=Path(sys.argv[1]).resolve(); p=Path(sys.argv[2]).resolve(); p.mkdir(parents=True,exist_ok=True)
revisions={'base':'909e4c948278afc2b3e1e665075fb1755a13f894','head':'3d9178e02ca1da0521bc6c27a31e17d835f6d0b7'}
observed=sp.check_output(['git','rev-parse','HEAD'],cwd=repo,text=True).strip()
assert not sp.check_output(['git','status','--porcelain'],cwd=repo)
lines=[]
for name,sha in revisions.items():
 d=p/name; d.mkdir(exist_ok=True)
 for f in ['command.ts','auth.ts','errors.ts']:
  data=sp.check_output(['git','show',f'{sha}:packages/ssh/src/{f}'],cwd=repo)
  (d/f).write_bytes(data)
  assert (d/f).read_bytes()==data
  lines.append(f'{name} {sha} packages/ssh/src/{f} sha256={hashlib.sha256(data).hexdigest()} exact git object bytes')
 link=d/'node_modules'
 if link.is_symlink(): link.unlink()
 link.symlink_to(repo/'packages/ssh/node_modules',target_is_directory=True)
(p/'args.ts').write_text('const {baseSshArgs} = await import(process.argv[2]);\nconsole.log(JSON.stringify(baseSshArgs({alias:"fixture",hostname:"127.0.0.1",username:null,port:Number(process.argv[3])},{batchMode:process.argv[4]})));\n')
for key in ['client','host']:
 assert not (p/key).exists(), 'Use a fresh output directory or clean prior fixture secrets'
 sp.run(['ssh-keygen','-q','-t','ed25519','-N','','-f',str(p/key)],check=True)
(p/'provenance.txt').write_text('\n'.join(lines)+'\n'+f'checkout={repo}\nobserved checkout HEAD={observed}; clean checkout at seeding; snapshots bound to explicit SHAs above, not checkout HEAD.\n')
(p/'full.diff').write_bytes(sp.check_output(['git','diff',revisions['base']+'...'+revisions['head']],cwd=repo))