"""Pipe the existing registration secret directly between SSH sessions. No file/argv/log."""
import argparse,json,re,shlex,subprocess,tempfile
from pathlib import Path
parser=argparse.ArgumentParser(description=__doc__)
parser.add_argument('--worker',required=True,help='SSH target user@WSL-host')
parser.add_argument('--name',required=True)
parser.add_argument('--root',default=r'C:\pt-worker')
parser.add_argument('--server',default='root@100.92.231.98')
parser.add_argument('--server-key',default=str(Path.home()/'.ssh/id_rsa'))
parser.add_argument('--worker-key',default=str(Path.home()/'.ssh/devserver'))
args=parser.parse_args()
assert re.fullmatch(r'[A-Za-z0-9_-]+',args.name),'Use a simple unique runner name'
assert re.fullmatch(r'[A-Za-z]:\\[^\r\n]+',args.root),'Require local Windows drive root'
SSH=['ssh','-o','BatchMode=yes','-o','StrictHostKeyChecking=yes']
server=SSH+['-i',args.server_key,args.server]
worker=SSH+['-i',args.worker_key,args.worker]
query='SELECT "registrationToken" FROM "runnerRegistrationToken" WHERE id=1;'
command="docker exec -i occ-tube-peertube-postgres-1 sh -c 'exec psql -X -v ON_ERROR_STOP=1 -U \"$POSTGRES_USER\" -d peertube -At'"
# metadata check is independent of, and never prints, token material.
p=subprocess.run(server+[command],input=f"SELECT (SELECT count(*) FROM \"runnerRegistrationToken\"),(SELECT count(*) FROM \"runner\" WHERE name='{args.name}');",text=True,capture_output=True,check=True)
assert p.stdout.strip()=='1|0','Expected existing token and no duplicate runner'
marker=Path(tempfile.gettempdir())/('pt-worker-'+args.name+'-enrollment.pending')
assert not marker.exists(),'Previous result uncertain; inspect server before retrying'
marker.write_text('Registration attempted; contains no secrets.\n')
source=subprocess.Popen(server+[command],stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
source.stdin.write(query.encode());source.stdin.close()
node='/mnt/'+args.root[0].lower()+args.root[2:].replace('\\','/')+'/node/node.exe'
remote=shlex.join([node,args.root+r'\bin\ipc-nvenc.cjs','register',args.root])
receiver=subprocess.run(worker+[remote],stdin=source.stdout,capture_output=True)
source.stdout.close();source.wait(timeout=20)
if source.returncode or receiver.returncode:
 raise SystemExit('Registration failed; secret-bearing outputs suppressed, inspect safe metadata before retry')
assert json.loads(receiver.stdout)['success'] is True
marker.unlink()
print(json.dumps({'runner_name':args.name,'registration_success':True,'secret_transport':'SSH stdout->SSH stdin->official named-pipe IPC','secret_saved':False}))