#!/usr/bin/env bash
# Asserts the containment chain as it is actually configured on this workstation,
# not as the repo describes it. Every check here failed silently at least once:
# a launcher resolved past the shim, a ceiling was shadowed by a same-named user
# drop-in, and oomd held a stale view that left the account unmonitored.
set -uo pipefail

AGENT_CEILING=/etc/systemd/user/agent.slice.d/90-ceiling.conf
BUILD_CEILING=/etc/systemd/user/build.slice.d/90-ceiling.conf

# Only the workstation install writes these root-owned drop-ins; buildboxes run this
# suite with a partial agent install and nothing here applies to them.
if [[ ! -r "$AGENT_CEILING" || ! -r "$BUILD_CEILING" ]]; then
  echo "SKIP containment invariants (no workstation agent install: $AGENT_CEILING absent)"
  exit 0
fi

pass=0
fail=0

check() { # $1=name $2=actual $3=expected
  if [[ "$2" == "$3" ]]; then
    pass=$((pass + 1))
    echo "PASS $1"
  else
    fail=$((fail + 1))
    echo "FAIL $1 (want=$3 got=$2)"
  fi
}

BIN="$HOME/.claude/bin"

for name in claude codex cursor-agent; do
  target="$(basename "$(readlink -f "$BIN/$name" 2>/dev/null)" 2>/dev/null)"
  check "entry-point-$name-is-jailed" "$target" "_tmpjail-shim.sh"
done

scope_body="$(<"$BIN/_agent-build-scope")"
case "$scope_body" in
  *"confine.sh"*) check "agent-scope-confines" yes yes ;;
  *) check "agent-scope-confines" no yes ;;
esac
case "$scope_body" in
  *"exec \"\$@\""*) check "agent-scope-has-no-raw-exec" no yes ;;
  *) check "agent-scope-has-no-raw-exec" yes yes ;;
esac

MEM_TOTAL_BYTES=$(awk '/^MemTotal:/ {print $2 * 1024}' /proc/meminfo)

declared() { # $1=drop-in $2=key — bytes, or pct:<n> for a host-relative ceiling
  local raw
  raw="$(grep -E "^$2=" "$1" 2>/dev/null | tail -1)"
  raw="${raw#*=}"
  [[ -n "$raw" ]] || { printf 'unset'; return; }
  case "$raw" in
    infinity|0) printf '%s' "$raw" ;;
    *%) printf 'pct:%s' "${raw%\%}" ;;
    *) numfmt --from=iec "$raw" 2>/dev/null || printf 'unparsed:%s' "$raw" ;;
  esac
}

check_ceiling() { # $1=name $2=effective $3=declared — percentages match within 2%
  local want=$3 target
  if [[ "$want" == pct:* ]]; then
    target=$(( MEM_TOTAL_BYTES * ${want#pct:} / 100 ))
    if [[ "$2" =~ ^[0-9]+$ ]] && (( $2 * 100 >= target * 98 && $2 * 100 <= target * 102 )); then
      pass=$((pass + 1)); echo "PASS $1"
    else
      fail=$((fail + 1)); echo "FAIL $1 (want~=$target got=$2)"
    fi
    return
  fi
  check "$1" "$2" "$want"
}

if systemctl --user show-environment >/dev/null 2>&1; then
  effective() { systemctl --user show "$1" -p "$2" --value 2>/dev/null; }
  # The drop-in is the intended ceiling and systemctl reports the effective one:
  # a shadowing user drop-in or a skipped daemon-reload shows up as a mismatch.
  for key in MemoryHigh MemoryMax MemorySwapMax; do
    check_ceiling "agent-slice-${key,,}" "$(effective agent.slice "$key")" "$(declared "$AGENT_CEILING" "$key")"
    check_ceiling "build-slice-${key,,}" "$(effective build.slice "$key")" "$(declared "$BUILD_CEILING" "$key")"
  done
else
  echo "SKIP slice ceilings (no user manager)"
fi

if command -v oomctl >/dev/null 2>&1 && systemctl is-active systemd-oomd >/dev/null 2>&1; then
  if oomctl 2>/dev/null | grep -q "user@$(id -u).service"; then
    check "oomd-watches-this-account" yes yes
  else
    check "oomd-watches-this-account" no yes
  fi
else
  echo "SKIP oomd (not active)"
fi

echo "passed=$pass failed=$fail"
(( fail == 0 ))