import json, os, pathlib, subprocess, sys, datetime
# Usage: python3 driver.py CHECKOUT OUTPUT_DIRECTORY TARGET_URL
checkout, output, url = sys.argv[1:]
root=pathlib.Path(output); root.mkdir(parents=True, exist_ok=True)
home=root/'source'; (home/'userdata').mkdir(parents=True, exist_ok=True)
(home/'userdata'/'settings.json').write_text(json.dumps({'linkedEnvironmentsEnabled':True}))
env={**os.environ,'T3CODE_DEV_SEED':'0'}
def cli(args):
 return subprocess.run(['node','apps/server/src/bin.ts',*args,'--log-level','error'], cwd=checkout, env=env, text=True, stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
# Mint a fresh disposable credential on the isolated target. Never print the credential.
target=root.parent/'target'
pair=cli(['auth','pairing','create','--base-dir',str(target),'--json'])
credential=json.loads(pair.stdout)['credential']
revision=subprocess.check_output(['git','rev-parse','HEAD'],cwd=checkout,text=True).strip()
status=json.loads(subprocess.check_output(['tailscale','status','--json'],text=True))
print('Running real T3 Code environment link command…', flush=True)
result=cli(['environment','link',url,'--pairing-code',credential,'--base-dir',str(home)])
# Redact machine metadata and filesystem paths before producing public evidence.
text=result.stdout
for private in [status['Self'].get('HostName',''),status['Self'].get('DNSName','').rstrip('.')]:
 if private: text=text.replace(private,'Evidence target')
text=text.replace(checkout,'<checkout>').replace(str(root.parent),'<isolated-state>')
text=text.replace(credential,'<redacted>')
transcript=f'''Real T3 Code command capture
Commit: {revision}
Surface: server CLI; two isolated environments on one Linux VM
Tailscale: BackendState={status['BackendState']}, TUN={status['TUN']}
Target: {url}
State: fresh source database; linkedEnvironmentsEnabled=true
Command: t3 environment link {url} --pairing-code <redacted> --base-dir <fresh-source>

{text}
Exit code: {result.returncode}
'''
(root/'transcript.txt').write_text(transcript)
print(transcript)