<?php
declare(strict_types=1);

// Run only in a fresh CLI process with auto_prepend_file and egress-deny PHP flags.
$root = (string)($argv[1] ?? '');
$expected = realpath(__DIR__ . '/coze_fail_closed.prepend.disabled.php');
if ($root === '' || !is_string($expected)
    || !is_file($root . '/vendor/autoload.php')) {
    fwrite(STDERR, "DENIED: exact Composer root required\n");
    exit(78);
}
require $root . '/vendor/autoload.php';
$class = new ReflectionClass(\app\common\CozeApi::class);
$actual = realpath((string)$class->getFileName());
$guardLoaded = $actual === $expected;
$curlBlocked = !function_exists('curl_exec') && !function_exists('curl_multi_exec');
$socketBlocked = !function_exists('fsockopen')
    && !function_exists('pfsockopen')
    && !function_exists('stream_socket_client');
$urlFopenBlocked = !filter_var(ini_get('allow_url_fopen'), FILTER_VALIDATE_BOOLEAN);
$constructionBlocked = false;
try {
    new \app\common\CozeApi();
} catch (RuntimeException $e) {
    $constructionBlocked = $e->getMessage() === 'CDX_COZE_CONSTRUCTION_BLOCKED';
}
echo json_encode(['guard_loaded_before_composer' => $guardLoaded,
    'guard_sha256' => $guardLoaded ? hash_file('sha256', $actual) : null,
    'curl_exec_blocked' => $curlBlocked,
    'socket_helpers_blocked' => $socketBlocked,
    'url_fopen_blocked' => $urlFopenBlocked,
    'construction_blocked' => $constructionBlocked,
    'business_http' => 0, 'business_dml' => 0], JSON_UNESCAPED_SLASHES), "\n";
exit($guardLoaded && $curlBlocked && $socketBlocked
    && $urlFopenBlocked && $constructionBlocked ? 0 : 3);