#!/usr/bin/env bash
# install-tool-shims-real — pin the real binaries for the GENERATED tool shims
# (bin/<binary>, produced by generate-tool-shims from tools.json shim_binary rules).
#
# Same resolution rule as install-git-guard-real, generalized to a name list: every
# candidate must be an ELF binary carrying no shim marker, so a pin can never name a
# copy of a shim. Idempotent — safe to run on every dispatch/deploy.
#
# Usage: install-tool-shims-real [--status]
set -uo pipefail

PIN_DIR="$HOME/.local/state/overdeck/shim-real"
SHIM_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

NAMES=()
for f in "$SHIM_DIR"/*; do
  [[ -f "$f" && -x "$f" ]] || continue
  base="$(basename "$f")"
  # This script and generate-tool-shims are excluded by name: both mention
  # OD_TOOL_SHIM_MARKER in their own source (they check for it / emit it), so a text
  # scan alone would misidentify them as generated shims.
  case "$base" in
    install-tool-shims-real | generate-tool-shims) continue ;;
  esac
  head -c 400 -- "$f" 2>/dev/null | grep -qF 'OD_TOOL_SHIM_MARKER' && NAMES+=("$base")
done

fail() {
  echo "install-tool-shims-real: $1" >&2
  exit 1
}

is_elf() { # $1=path
  local magic
  magic=$(head -c 4 -- "$1" 2>/dev/null | od -An -tx1 | tr -d ' \n') || return 1
  [[ "$magic" == "7f454c46" ]]
}

carries_shim_marker() { # $1=path
  head -c 8192 -- "$1" 2>/dev/null | grep -qE 'OD_(PATH|TOOL)_SHIM_MARKER'
}

candidate_ok() { # $1=path
  local p="$1"
  [[ -n "$p" && "$p" == /* && -f "$p" && -x "$p" ]] || return 1
  is_elf "$p" || return 1
  ! carries_shim_marker "$p"
}

if [[ "${1:-}" == "--status" ]]; then
  rc=0
  for name in "${NAMES[@]}"; do
    pin="$PIN_DIR/$name"
    if [[ ! -r "$pin" ]]; then
      echo "install-tool-shims-real: no pin for $name at $pin" >&2
      rc=1
      continue
    fi
    IFS= read -r pinned <"$pin" || true
    if candidate_ok "$pinned"; then
      echo "tool-shim pin: $name -> $pinned"
    else
      echo "install-tool-shims-real: pinned $name is not a usable ELF binary: '$pinned' ($pin)" >&2
      rc=1
    fi
  done
  exit "$rc"
fi
[[ $# -eq 0 ]] || fail "usage: install-tool-shims-real [--status]"

if [[ ${#NAMES[@]} -eq 0 ]]; then
  echo "install-tool-shims-real: no generated shims present under $SHIM_DIR — nothing to pin"
  exit 0
fi

mkdir -p "$PIN_DIR" || fail "cannot create $PIN_DIR"

rc=0
for name in "${NAMES[@]}"; do
  resolved=""
  IFS=':' read -ra parts <<<"$PATH:/usr/bin:/bin:/usr/local/bin"
  for d in "${parts[@]}"; do
    [[ -n "$d" && "$d" == /* ]] || continue
    [[ "$d" == "$SHIM_DIR" ]] && continue
    if candidate_ok "$d/$name"; then
      resolved="$d/$name"
      break
    fi
  done
  if [[ -z "$resolved" ]]; then
    echo "install-tool-shims-real: no real $name found on PATH — skipping pin (its shim will refuse until $name is installed)" >&2
    rc=1
    continue
  fi
  pin="$PIN_DIR/$name"
  tmp="$pin.$$"
  printf '%s\n' "$resolved" >"$tmp" || fail "cannot write $tmp"
  mv -f "$tmp" "$pin" || fail "cannot install $pin"
  echo "tool-shim pin: $name -> $resolved"
done
exit "$rc"