"""Mac Keychain credentials; no plaintext secret file or logging."""
import getpass,os,subprocess,sys
from pathlib import Path

ENV={'openrouter':'OPENROUTER_API_KEY','perplexity':'PERPLEXITY_API_KEY'}
SERVICES={'openrouter':'brain-lab.openrouter','perplexity':'brain-lab.perplexity'}
START='# >>> Brain Lab global API exports >>>'
END='# <<< Brain Lab global API exports <<<'

def get_key(provider):
    if provider not in ENV: return ''
    key=os.environ.get(ENV[provider])
    if key: return key
    if provider=='perplexity' and os.environ.get('PPLX_API_KEY'): return os.environ['PPLX_API_KEY']
    if sys.platform!='darwin': return ''
    try:
        result=subprocess.run(['/usr/bin/security','find-generic-password','-s',SERVICES[provider],'-a',getpass.getuser(),'-w'],capture_output=True,text=True,timeout=4)
        return result.stdout.strip() if result.returncode==0 else ''
    except (OSError,subprocess.SubprocessError): return ''

def install_shell_exports():
    profile=Path.home()/'.zshenv'
    original=profile.read_text() if profile.exists() else ''
    if START in original: return
    lines=[START,'# Values are fetched from macOS Keychain. Existing exports take precedence.']
    for provider,var in ENV.items():
        service=SERVICES[provider]
        lines.extend([f'if [[ -z "${{{var}:-}}" ]]; then',
            f'  _brain_lab_key=$(/usr/bin/security find-generic-password -s {service} -a "$USER" -w 2>/dev/null || true)',
            f'  [[ -n "$_brain_lab_key" ]] && export {var}="$_brain_lab_key"',
            '  unset _brain_lab_key','fi'])
    lines.append(END)
    if profile.exists():
        backup=profile.with_name('.zshenv.before-brain-lab')
        if not backup.exists(): backup.write_text(original);backup.chmod(0o600)
    profile.write_text(original.rstrip()+'\n\n'+'\n'.join(lines)+'\n')
    profile.chmod(0o600)

def set_global_key(provider,key):
    if provider not in ENV: raise ValueError('Select OpenRouter or Perplexity.')
    if not key or '\n' in key or len(key)>500: raise ValueError('Enter a valid single-line API key.')
    if sys.platform!='darwin': raise RuntimeError('Global Keychain setup is available on macOS. Export the corresponding environment variable on other systems.')
    result=subprocess.run(['/usr/bin/security','add-generic-password','-U','-s',SERVICES[provider],'-a',getpass.getuser(),'-w',key],capture_output=True,text=True,timeout=15)
    if result.returncode: raise RuntimeError('macOS could not save the key in Keychain. Retry from Set API Key.command.')
    install_shell_exports();os.environ[ENV[provider]]=key

if __name__=='__main__':
    print('Brain Lab · global API key setup\nStored in macOS Keychain; exported in new zsh sessions.\nThe key is never printed.')
    answer=input('Provider: 1 = OpenRouter, 2 = Perplexity [1]: ').strip()
    provider='perplexity' if answer=='2' else 'openrouter'
    key=getpass.getpass('Paste your '+ENV[provider]+' (hidden): ').strip()
    if not key: print('No key entered; nothing changed.');sys.exit(1)
    try: set_global_key(provider,key)
    except Exception as e: print(str(e));sys.exit(1)
    print(ENV[provider]+' is configured globally. Open a new Terminal window to use it. Brain Lab can read it immediately.')