"""Read a cloud-only AI key without echoing it or putting it in shell history."""
import getpass
import os
from pathlib import Path
import tempfile


def main():
    config = Path(__file__).resolve().parents[1] / ".env.cloud"
    if not config.is_file():
        raise SystemExit("Cloud environment file not found; run this on the deployed server.")
    text = config.read_text(encoding="utf-8")
    lines = text.splitlines()
    matches = [i for i, line in enumerate(lines) if line.startswith("DEEPSEEK_API_KEY=")]
    if len(matches) > 1:
        raise SystemExit("Duplicate DEEPSEEK_API_KEY entries; no changes made.")
    while True:
        try:
            key = getpass.getpass("Paste your dedicated DeepSeek API key (hidden), then press Enter: ").strip()
        except (EOFError, KeyboardInterrupt):
            raise SystemExit("Cancelled; no changes made.") from None
        if not key:
            print("Nothing entered. Still waiting for your API key; Ctrl+C cancels.")
            continue
        if any(c.isspace() for c in key) or any(c in key for c in "'\"$#\\="):
            print("Paste only the API key, without quotes or a configuration line. Please retry.")
            continue
        break
    entry = "DEEPSEEK_API_KEY=" + key
    if matches:
        lines[matches[0]] = entry
    else:
        lines.append(entry)
    fd, name = tempfile.mkstemp(prefix=".env.cloud.ai-", dir=config.parent)
    try:
        os.fchmod(fd, 0o600)
        with os.fdopen(fd, "w", encoding="utf-8") as output:
            output.write("\n".join(lines) + "\n")
        os.replace(name, config)
    finally:
        if os.path.exists(name):
            os.unlink(name)
    print("Dedicated AI key saved privately. Recreate the web container to apply it.")


if __name__ == "__main__":
    main()