"""Inspect or screen a local skill package. Python 3.12+. Sample files are read only."""
import argparse
import json
from datetime import datetime, timezone
from pathlib import Path
import sys

from scripts.skill_package import read_package, write_json


def scan(path, checks='model', mode=None, inspect_only=False, model_dir=None, operating_point='auto'):
    row, coverage = read_package(path)
    bundled = Path(model_dir) if model_dir else Path(__file__).resolve().parent
    settings_file = bundled / 'deployment_settings.json'
    if mode is None and settings_file.is_file():
        saved_mode = json.loads(settings_file.read_text(encoding='utf-8'))['input_mode']
        mode = {'package32k': 'package', 'markdown8k': 'markdown'}[saved_mode]
    mode = mode or ('markdown' if coverage['input_kind'] == 'markdown_file' else 'package')
    report = {'created_at': datetime.now(timezone.utc).isoformat(),
              'package': coverage, 'model': {'status': 'not_run'},
              'dependencies': {'status': 'not_run'}}
    if inspect_only:
        return report
    if checks in ('dependencies', 'all'):
        from scripts.check_dependencies import check_dependencies
        report['dependencies'] = check_dependencies(row)
    if checks in ('model', 'all'):
        from scripts.model_score import score_model
        try:
            report['model'] = score_model(row, mode, model_dir=model_dir, operating_point=operating_point)
        except (OSError, ValueError, RuntimeError, ImportError) as exc:
            report['model'] = {'status': 'unavailable', 'reason': str(exc)}
    return report


def print_summary(report):
    coverage = report['package']
    print(f"Read {coverage['text_files']} text files; skipped {len(coverage['skipped'])} entries.")
    model = report['model']
    if model['status'] == 'complete':
        decision = 'review' if model['review'] else 'below the configured review threshold'
        print(f"Model: {model['score']:.6f} / threshold {model['threshold']:.6f} ({decision}).")
        print(f"Release: {model['repo_id']} @ {model['revision']}; operating point: {model['operating_point']}.")
        print(f"Model input: {model['input_mode']}; {model['coverage']['used_tokens']} tokens; truncated={model['coverage']['truncated']}.")
    else:
        print('Model: ' + model['status'].replace('_', ' ') + '.')
        if model.get('reason'):
            print(model['reason'])
    deps = report['dependencies']
    print('Dependencies: ' + deps['status'].replace('_', ' ') + '.')
    if deps['status'] != 'not_run':
        print(f"Checked {len(deps['checked'])} exact pins; {len(deps['findings'])} advisory matches; {len(deps['unresolved'])} unresolved entries; {len(deps['errors'])} lookup errors.")
        for finding in deps['findings']:
            print(f"  {finding['package']}=={finding['version']}: {finding['advisory_id']} at {finding['path']}:{finding['line']}")
        print('Only declared exact PyPI pins are checked. A match is not a finding of malicious intent.')
    if model['status'] == deps['status'] == 'not_run':
        print('Inspection only. No security checks were run.')


def main(argv=None):
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('path', type=Path, help='Skill directory containing SKILL.md, or a single SKILL.md')
    parser.add_argument('--inspect', action='store_true', help='Offline inventory only; no models or network')
    parser.add_argument('--checks', choices=('model', 'dependencies', 'all'), default='model')
    parser.add_argument('--mode', choices=('package', 'markdown'), help='Defaults to package for a directory, markdown for a file')
    parser.add_argument('--model-dir', type=Path, help='Use a downloaded deployment release instead of the Hub')
    parser.add_argument('--operating-point', choices=('auto', 'native', 'high-recall', 'balanced'), default='auto',
                        help='Saved operating point; auto uses the release default, native uses 0.5')
    parser.add_argument('--output', type=Path, help='Create a JSON report without raw file contents')
    args = parser.parse_args(argv)
    if args.output and (args.output.exists() or args.output.resolve().is_relative_to(args.path.resolve() if args.path.is_dir() else args.path.parent.resolve())):
        parser.error('Choose a new output file outside the input package.')
    report = scan(args.path, args.checks, args.mode, args.inspect, args.model_dir, args.operating_point)
    if args.output:
        write_json(args.output, report)
    print_summary(report)
    return 1 if any(report[key]['status'] == 'unavailable' or report[key].get('errors') for key in ('model', 'dependencies')) else 0


if __name__ == '__main__':
    try:
        sys.exit(main())
    except (ValueError, OSError) as exc:
        print(f'ERROR: {exc}', file=sys.stderr)
        sys.exit(1)