#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"
E2E_REMOTE="$ROOT/modules/workstation/claude/bin/e2e-remote"
TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT
HOME_DIR="$TMP/home"
XDG_DIR="$TMP/xdg"
BIN_DIR="$TMP/bin"
mkdir -p "$HOME_DIR/.claude/bin" "$XDG_DIR" "$BIN_DIR"
DISPATCH_LOG="$TMP/dispatch.log"
MARKER_LOG="$TMP/commands.log"

fail() {
  echo "FAIL: $1" >&2
  exit 1
}

cat >"$TMP/dispatch" <<'STUB'
#!/usr/bin/env bash
printf '%s\n' "$*" >>"$DISPATCH_LOG"
exit 0
STUB
chmod +x "$TMP/dispatch"

for command in ssh kubectl; do
  cat >"$BIN_DIR/$command" <<STUB
#!/usr/bin/env bash
printf '%s\\n' '$command' >>"\$MARKER_LOG"
exit 1
STUB
  chmod +x "$BIN_DIR/$command"
done

# Let SSH-lane cases terminate locally before any real transport is possible.
cat >"$HOME_DIR/.claude/bin/local-gate" <<'STUB'
#!/usr/bin/env bash
exit 1
STUB
chmod +x "$HOME_DIR/.claude/bin/local-gate"

run_case() {
  local name="$1"
  shift
  : >"$DISPATCH_LOG"
  : >"$MARKER_LOG"
  : >"$TMP/$name.err"
  set +e
  timeout 8 env -u IPZ_E2E_LANE HOME="$HOME_DIR" XDG_CONFIG_HOME="$XDG_DIR" \
    PATH="$BIN_DIR:$PATH" E2E_K8S_DISPATCH_STUB="$TMP/dispatch" \
    DISPATCH_LOG="$DISPATCH_LOG" MARKER_LOG="$MARKER_LOG" \
    "$@" >"$TMP/$name.out" 2>"$TMP/$name.err"
  CASE_STATUS=$?
  set -e
  [ "$CASE_STATUS" -ne 124 ] || fail "$name exceeded 8 seconds"
}

rm -rf "$XDG_DIR/overdeck"
run_case fallback "$E2E_REMOTE" -- /bin/true
[ ! -s "$DISPATCH_LOG" ] || fail "fallback should choose SSH, not k8s"
[ "$CASE_STATUS" -ne 2 ] || fail "fallback did not enter the SSH lane"

run_case env-k8s env IPZ_E2E_LANE=k8s "$E2E_REMOTE" -- /bin/true
[ "$CASE_STATUS" -eq 0 ] || fail "IPZ_E2E_LANE=k8s did not succeed"
[ -s "$DISPATCH_LOG" ] || fail "IPZ_E2E_LANE=k8s did not invoke dispatch"
grep -Fq 'running the k8s lane selected by environment variable IPZ_E2E_LANE' "$TMP/env-k8s.err" || fail "environment source message was absent"

mkdir -p "$XDG_DIR/overdeck"
printf '%s\n' 'IPZ_E2E_LANE=k8s' >"$XDG_DIR/overdeck/e2e-lane.env"
run_case config-k8s "$E2E_REMOTE" -- /bin/true
[ "$CASE_STATUS" -eq 0 ] || fail "config k8s lane did not succeed"
[ -s "$DISPATCH_LOG" ] || fail "config k8s lane did not invoke dispatch"
grep -Fq 'running the k8s lane selected by config file' "$TMP/config-k8s.err" || fail "config source message was absent"

run_case env-ssh env IPZ_E2E_LANE=ssh "$E2E_REMOTE" -- /bin/true
[ ! -s "$DISPATCH_LOG" ] || fail "environment ssh did not override config k8s"

run_case flag-ssh env IPZ_E2E_LANE=k8s "$E2E_REMOTE" --ssh -- /bin/true
[ ! -s "$DISPATCH_LOG" ] || fail "--ssh did not override environment k8s"

run_case flag-k8s env IPZ_E2E_LANE=ssh "$E2E_REMOTE" --k8s -- /bin/true
[ "$CASE_STATUS" -eq 0 ] || fail "--k8s did not override environment ssh"
[ -s "$DISPATCH_LOG" ] || fail "--k8s did not invoke dispatch"

run_case conflicting "$E2E_REMOTE" --k8s --ssh -- /bin/true
[ "$CASE_STATUS" -eq 2 ] || fail "conflicting flags did not exit 2"
[ ! -s "$DISPATCH_LOG" ] || fail "conflicting flags invoked dispatch"
grep -Fq -- '--k8s and --ssh' "$TMP/conflicting.err" || fail "conflicting flag message did not name both flags"

run_case bad-env env IPZ_E2E_LANE=kubernetes "$E2E_REMOTE" -- /bin/true
[ "$CASE_STATUS" -eq 2 ] || fail "invalid environment lane did not exit 2"
[ ! -s "$DISPATCH_LOG" ] || fail "invalid environment lane invoked dispatch"
grep -Fq "invalid IPZ_E2E_LANE value 'kubernetes'" "$TMP/bad-env.err" || fail "invalid environment message omitted bad value"

PWNED="$TMP/pwned-$$"
printf 'IPZ_E2E_LANE=k8s; touch %s\n' "$PWNED" >"$XDG_DIR/overdeck/e2e-lane.env"
run_case malicious-config "$E2E_REMOTE" -- /bin/true
[ "$CASE_STATUS" -eq 2 ] || fail "malformed config value was not rejected"
[ ! -s "$DISPATCH_LOG" ] || fail "malformed config value selected k8s"
[ ! -e "$PWNED" ] || fail "config file content was executed"

bash -n "$E2E_REMOTE" 2>/dev/null || fail "bash -n on e2e-remote failed"

echo "PASS: e2e-remote lane default and explicit override cases"