#!/usr/bin/env python3
"""sandbroker-session-init - mint a session id + queue for the launcher.

Run by the `c` launcher (as gray, OUTSIDE the sandbox) BEFORE starting the agent:

    export SANDBROKER_SID="$(sandbroker-session-init)"
    exec srt ... claude ...

Multi-vault model: there is NO per-project vault pin and no .sandbroker.toml. The
global vault registry (etc/vaults.json) defines the environments; the session
uses Dev (auto tier) frictionlessly and binds Staging/Production/Infra on a
Windows Hello approval, per vault, as needed. So all this needs to do is:

  1. Mint a random SID (binds the one-time approval code + the queue namespace).
  2. Create this session's bridge queue /tmp/sandbroker-bridge/<sid>/{req,resp}.
  3. Print the SID for the launcher to inject as SANDBROKER_SID.

The SID is not a secret and grants nothing on its own: Dev is low-sensitivity,
and every other vault is gated by the biometric regardless of the SID.
"""
import os
import sys
import uuid

BRIDGE_DIR = os.environ.get("SANDBROKER_BRIDGE_DIR", "/tmp/sandbroker-bridge")


def main() -> int:
    sid = uuid.uuid4().hex
    try:
        for sub in ("req", "resp"):
            os.makedirs(os.path.join(BRIDGE_DIR, sid, sub), exist_ok=True)
        os.chmod(BRIDGE_DIR, 0o700)
    except OSError:
        pass
    print(sid)
    return 0


if __name__ == "__main__":
    sys.exit(main())
