#!/bin/sh
# The runtime invokes this hook synchronously; every failure is intentionally fail-open.
python3 -c 'import hashlib,hmac,os,socket,subprocess,sys,tempfile
root=os.environ.get("APILIFT_HOME")
payload=sys.stdin.buffer.read(16777217)
assert root and len(payload)<=16777216
path=os.path.join(tempfile.gettempdir(),"apilift-value-"+hashlib.sha256(os.path.realpath(root).encode()).hexdigest()[:20]+".sock")
p=os.getpid(); identity="process:"+str(p)
for _ in range(16):
 out=subprocess.check_output(["ps","-o","ppid=,lstart=,comm=","-p",str(p)],text=True,timeout=.03).strip().split(None,6)
 if len(out)<7: break
 parent=int(out[0]); identity="process:"+str(p)+":"+" ".join(out[1:6]); command=os.path.basename(out[6]).lower()
 if "claude" in command or "codex" in command or parent<=1 or parent==p: break
 p=parent
key=hmac.new(open(os.path.join(root,"value-installation-secret"),"rb").read(),identity.encode(),hashlib.sha256).hexdigest().encode()
client=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM)
client.settimeout(0.18)
client.connect(path)
client.sendall(b"@"+key+b"\n"+payload.rstrip(b"\n")+b"\n")
client.shutdown(socket.SHUT_WR)
assert client.recv(1)==b"1"' 2>/dev/null
exit 0
