"""Read-only, allowlisted local/remote configuration diagnostics; never print secrets."""
import json
import sys
from pathlib import Path
from urllib.parse import urlsplit

root = Path(sys.argv[1]).resolve()
sys.path.insert(0, str(root))
import backend_client
import ai_config

settings = backend_client.load_settings()
gateway = settings.get('gateway') or {}
def endpoint(value):
    parts = urlsplit(str(value or ''))
    return {'scheme': parts.scheme, 'host': parts.hostname, 'port': parts.port, 'path': parts.path}
def knowledge(value):
    value = value if isinstance(value, dict) else {}
    return {key: value[key] for key in ('enabled', 'published', 'draft', 'approved', 'stale', 'retrieval_mode') if key in value}
token = backend_client.desktop_access_token()
result = {
    'root': str(root), 'server': endpoint(settings.get('server_url')),
    'gateway': {'enabled': bool(gateway.get('enabled')), 'endpoint': endpoint(gateway.get('url'))},
    'desktop_token_available': bool(token),
    'knowledge_cached': knowledge(settings.get('knowledge_summary')),
    'last_sync_at': settings.get('last_sync_at'),
    'ai': {name: getattr(ai_config, name, None) for name in (
        'AI_ENABLED', 'AI_CONTEXT_ENABLED', 'AI_CONTEXT_MAX_ROUNDS', 'AI_MCP_ENABLED',
        'AI_MODEL', 'AI_API_TYPE', 'AI_VISION_ENABLED', 'AI_UI_GUARD_ENABLED')},
}
if '--remote' in sys.argv and token:
    try:
        status, response = backend_client._request(
            'GET', settings['server_url'], backend_client.DESKTOP_CONFIG_PATHS[0], token=token, timeout=8.0)
        config = response.get('config') or {}
        remote_gateway = response.get('gateway') or {}
        result['remote'] = {'http_status': status,
            'knowledge': knowledge(response.get('knowledge')),
            'gateway_enabled': remote_gateway.get('enabled'),
            'context': {key: config.get(key) for key in ('AI_CONTEXT_ENABLED','AI_CONTEXT_MAX_ROUNDS','AI_MCP_ENABLED')},
            'model_count': len(response.get('models') or []),
            'model_protocols': [{key: model.get(key) for key in ('id','kind','model','enabled')} for model in response.get('models') or []],
            'roles': response.get('roles')}
    except Exception as exc:
        result['remote'] = {'error_type': type(exc).__name__}
text = json.dumps(result, ensure_ascii=False, indent=2)
print(text)
if '--output' in sys.argv:
    Path(sys.argv[sys.argv.index('--output')+1]).write_text(text, encoding='utf-8')