#!/usr/bin/env python3
"""User-run setup only; writes an owner-only key file using a hidden TTY prompt."""
import getpass,os,sys,argparse
from pathlib import Path
p=argparse.ArgumentParser();p.add_argument('destination');args=p.parse_args()
if not sys.stdin.isatty():raise SystemExit('Run privately in your own terminal. Do not pipe a key or paste it into chat.')
secret=getpass.getpass('HQ API key (hidden): ').strip()
if not secret.startswith('hq_key_') or not 35<=len(secret)<=200 or any(x.isspace() for x in secret):raise SystemExit('Invalid HQ key format. Nothing stored.')
dest=Path(args.destination).expanduser();dest.parent.mkdir(mode=0o700,parents=True,exist_ok=True)
try:fd=os.open(dest,os.O_CREAT|os.O_EXCL|os.O_WRONLY,0o600)
except FileExistsError:raise SystemExit('Destination already exists. Refusing to overwrite a stored key.')
with os.fdopen(fd,'w') as f:f.write(secret+'\n')
secret=None
print('Key stored privately. Set HQ_API_KEY_FILE to this path in your authorized task environment; never set it to the key itself.')