"""Private, append-only records of actual CLI attempts (never public by default)."""
import hashlib
import json
from datetime import datetime, timezone
from pathlib import Path
from uuid import uuid4


class RequestArchive:
    def __init__(self, directory):
        self.directory = Path(directory)

    def start(self, model, system, user):
        self.directory.mkdir(parents=True, exist_ok=True, mode=0o700)
        identifier = uuid4().hex
        self._write(identifier + '.input.json', {
            'schema': 1, 'id': identifier, 'timestamp': self.now(), 'requested_model': model,
            'system_prompt': system, 'user_prompt': user,
            'system_prompt_sha256': self.digest(system), 'user_prompt_sha256': self.digest(user),
            'scope': 'Exact CLI prompt arguments; provider-internal context is not observable.'})
        return identifier

    def finish(self, identifier, stdout='', stderr='', returncode=None, error=None):
        self._write(identifier + '.output.json', {
            'schema': 1, 'id': identifier, 'timestamp': self.now(), 'stdout': stdout,
            'stderr': stderr, 'returncode': returncode, 'error': error,
            'stdout_sha256': self.digest(stdout), 'stderr_sha256': self.digest(stderr)})

    def _write(self, name, record):
        # Exclusive creation: retries and concurrent workers never overwrite history.
        with (self.directory / name).open('x', encoding='utf-8') as stream:
            stream.write(json.dumps(record, ensure_ascii=False) + '\n')
        (self.directory / name).chmod(0o600)

    @staticmethod
    def digest(text):
        return hashlib.sha256(text.encode()).hexdigest()

    @staticmethod
    def now():
        return datetime.now(timezone.utc).isoformat()