#!/usr/bin/env python3
"""Upload an explicit public-artifact allowlist; private homes/configs are excluded."""
from pathlib import Path
import subprocess,json,re,yaml,time
root=Path('/tmp/lead-27840-r1/capture')
files=[]
for suffix in ['before','after','diff0','diffT16']:
    files+=sorted((root/'stills').glob('*-'+suffix+'.png'))
files+=sorted(root.glob('*-sheet.png'))
for pattern in ['*.py','*.js','*.mjs','R6*-wrapper.sh','R6*-argv.txt','*-REDACTED.yml']:
    files+=sorted(root.glob(pattern))
files += [root/n for n in ['fixture-transcript.txt','run-manifest.json','diff-stats.json','first-pass-frames.zip','settle-pairs.zip']]
private=yaml.safe_load(Path('/home/ubuntu/.config/glab-cli/config.yml').read_text())
tokens=[str(v).encode() for host in private.get('hosts',{}).values() for k,v in host.items() if 'token' in k and v and len(str(v))>8]
for file in files:
    data=file.read_bytes()
    assert not any(t in data for t in tokens),'Credential detected in '+file.name
from concurrent.futures import ThreadPoolExecutor,as_completed
items={
 'cleanup.json':{'url':'https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0191b764162f4f1/cleanup.json','markdown':'[cleanup.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0191b764162f4f1/cleanup.json)'},
 'R2-1440-dark-sheet.png':{'url':'https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8ba735787a902547/R2-1440-dark-sheet.png','markdown':'![R2-1440-dark-sheet.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8ba735787a902547/R2-1440-dark-sheet.png)'}
}
if (root/'uploads.json').exists():items.update(json.loads((root/'uploads.json').read_text()))
for log in sorted(root.glob('upload-single-*.log'),key=lambda p:p.stat().st_mtime):
    for line in log.read_text().splitlines():
        m=re.fullmatch(r'!?\[([^\]]+)\]\(([^)]+)\)',line)
        if m:items[m[1]]={'url':m[2],'markdown':line}
def upload(file):
    result=subprocess.run(['ghdrop','upload','-m',str(file)],capture_output=True,text=True)
    (root/('upload-single-'+file.name+'.'+str(time.time_ns())+'.log')).write_text(result.stdout+result.stderr)
    result.check_returncode()
    line=result.stdout.strip()
    m=re.fullmatch(r'!?\[([^\]]+)\]\(([^)]+)\)',line)
    assert m,(file.name,line)
    return m[1],{'url':m[2],'markdown':line}
with ThreadPoolExecutor(max_workers=4) as pool:
    pending=[pool.submit(upload,f) for f in files if f.name not in items]
    for future in as_completed(pending):
        try:name,item=future.result()
        except Exception as error:
            print(str(error),flush=True);continue
        items[name]=item
        (root/'uploads.json').write_text(json.dumps(items,indent=2))
        (root/'uploads.md').write_text('\n'.join(v['markdown'] for v in items.values())+'\n')
        print(item['markdown'],flush=True)
(root/'uploads.json').write_text(json.dumps(items,indent=2))
(root/'uploads.md').write_text('\n'.join(v['markdown'] for v in items.values())+'\n')
assert all(f.name in items for f in files),[f.name for f in files if f.name not in items]