#!/usr/bin/env python3
"""Export the current macOS Kiro CLI social login locally. No network calls."""
import argparse
import datetime
import json
import os
from pathlib import Path
import sqlite3
import sys


def main():
    parser = argparse.ArgumentParser(description="在本机导出当前 macOS Kiro CLI 社交登录凭据，不上传、不退出登录。")
    parser.add_argument("--database", type=Path, default=Path.home() / "Library/Application Support/kiro-cli/data.sqlite3")
    parser.add_argument("--output", type=Path, help="输出 JSON 路径；必须是尚不存在的文件")
    args = parser.parse_args()
    target = None
    created = False
    try:
        db_path = args.database.expanduser().resolve()
        if not db_path.is_file():
            raise ValueError("未找到 Kiro CLI 登录缓存。请先在官方 Kiro CLI 登录要添加的账号。")
        with sqlite3.connect(db_path.as_uri() + "?mode=ro", uri=True) as database:
            row = database.execute("SELECT value FROM auth_kv WHERE key=?", ("kirocli:social:token",)).fetchone()
        if not row:
            raise ValueError("未找到社交登录。此工具仅支持 Google / GitHub 社交登录；Builder ID 请从官方客户端导入完整凭据。")
        credentials = json.loads(row[0])
        if not isinstance(credentials, dict):
            raise ValueError("登录缓存格式不受支持。")
        refresh = credentials.get("refresh_token") or credentials.get("refreshToken")
        if not isinstance(refresh, str) or len(refresh) < 20:
            raise ValueError("登录缓存缺少有效刷新令牌，请在官方客户端重新登录。")
        stamp = datetime.datetime.now().strftime("%Y%m%d-%H%M%S-%f")
        target = (args.output or Path.home() / "Downloads" / ("kiro-account-" + stamp + ".credentials.local.json")).expanduser().resolve()
        # Exclusive creation prevents overwriting an existing file or following a symlink.
        fd = os.open(target, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
        created = True
        with os.fdopen(fd, "w", encoding="utf-8") as output:
            json.dump(credentials, output, ensure_ascii=False, indent=2)
            output.write("\n")
        print("已在本机导出当前登录账号：\n" + str(target))
        print("打开 Kiro Hub → 账号管理 → 添加账号 → 从 JSON 文件导入，选择此文件。")
        print("文件包含登录凭据，请只导入自己的控制台，勿发送给他人。")
        return 0
    except (OSError, sqlite3.Error, ValueError, TypeError):
        if created and target:
            target.unlink(missing_ok=True)
        # Cache contents and third-party exception messages may contain secrets.
        print("导出失败：请确认已使用 Google / GitHub 登录官方 Kiro CLI，数据库可读取，且输出目录存在、目标文件尚不存在。Builder ID 需要完整 OIDC 凭据。", file=sys.stderr)
        return 1


if __name__ == "__main__":
    raise SystemExit(main())