#!/usr/bin/env bash
# cpu-guard script-body resolution: project-named scripts (smoke, ui:matrix) must
# route to local-gate --remote-only; report/dev/watch never gate, and installs may
# gate but must stay off --remote-only (local materialization). Bodies are verbatim
# from real ~/Projects package.json files.
set -uo pipefail
TMP=$(mktemp -d "$HOME/.cache/pwgap2-XXXXXX"); trap 'rm -rf "$TMP"' EXIT
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
FAKE="$TMP/home"; mkdir -p "$FAKE/.claude/bin" "$FAKE/.claude/lib" "$TMP/proj/scripts"
cp "$SCRIPT_DIR/../lib/cpu-guard.sh" "$FAKE/.claude/lib/cpu-guard.sh"
printf '#!/usr/bin/env bash\necho "GATE $@"\n' > "$FAKE/.claude/bin/local-gate"
printf '#!/usr/bin/env bash\necho "LOCAL"\n' > "$FAKE/.claude/lib/buildslot.sh"
chmod +x "$FAKE/.claude/bin/local-gate" "$FAKE/.claude/lib/buildslot.sh"
echo '{"enabled": true}' > "$FAKE/.claude/build-remote.json"
# real bodies taken verbatim from the audit output
cat > "$TMP/proj/package.json" <<'EOF'
{"name":"t","scripts":{
 "smoke":"playwright test --config tests/smoke/playwright.config.ts",
 "ui:matrix":"playwright test --config tests/ui-matrix/playwright.config.ts",
 "test:e2e":"playwright test",
 "regression:rebaseline":"UPDATE_SNAPSHOTS=1 vitest run --config vitest.regression.config.ts",
 "regression:wrapped":"UPDATE_SNAPSHOTS=1 ./scripts/cpu-limit.sh vitest run --config vitest.regression.config.ts",
 "typecheck:e2e":"./scripts/cpu-limit.sh tsc --noEmit -p ../../tests/e2e/vendor/tsconfig.json",
 "report":"playwright show-report",
 "install-browsers":"npx playwright install chromium",
 "dev":"vite",
 "start":"next start",
 "lint":"eslint .",
 "watch":"vitest --watch"}}
EOF
fail=0
probe() { # want cmd...
  local want="$1"; shift
  local out got
  out=$(cd "$TMP/proj" && env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" "$@" 2>&1 | head -1)
  case "$out" in "GATE --remote-only"*) got=REMOTE ;; *) got=LOCAL ;; esac
  if [ "$got" = "$want" ]; then printf 'PASS %-6s <- %s\n' "$got" "$*"
  else printf 'FAIL want=%s got=%s <- %s\n' "$want" "$got" "$*"; fail=$((fail+1)); fi
}
echo "--- heavy: must go REMOTE ---"
probe REMOTE pnpm smoke
probe REMOTE pnpm ui:matrix
probe REMOTE pnpm run smoke
probe REMOTE pnpm test:e2e
probe REMOTE pnpm -w smoke
probe REMOTE pnpm regression:rebaseline
probe REMOTE pnpm regression:wrapped
probe REMOTE pnpm typecheck:e2e
probe REMOTE npx playwright test
probe REMOTE playwright test
probe REMOTE bun run test:e2e
echo "--- light/interactive: must stay LOCAL ---"
probe LOCAL pnpm report
probe LOCAL pnpm install-browsers
probe LOCAL pnpm dev
probe LOCAL pnpm start
probe LOCAL pnpm lint
probe LOCAL pnpm watch
probe LOCAL pnpm install

# A workspace selector moves the script's definition out of the cwd's package.json;
# the sibling worktree carries the same package name with stale scripts.
mkdir -p "$TMP/ws/apps/web" "$TMP/ws/.wt-stale/apps/web"
cat > "$TMP/ws/pnpm-workspace.yaml" <<'EOF'
packages:
  - 'apps/*'
onlyBuiltDependencies:
  - esbuild
EOF
echo '{"name":"@t/root","private":true}' > "$TMP/ws/package.json"
echo '{"name":"@t/web","scripts":{"lane:realpg":"vitest run --config vitest.realpg.config.ts","dev":"vite"}}' > "$TMP/ws/apps/web/package.json"
cp "$TMP/ws/pnpm-workspace.yaml" "$TMP/ws/.wt-stale/pnpm-workspace.yaml"
echo '{"name":"@t/web","scripts":{"dev":"vite"}}' > "$TMP/ws/.wt-stale/apps/web/package.json"

probe_at() { # want dir cmd...
  local want="$1" dir="$2"; shift 2
  local out got
  out=$(cd "$dir" && env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" "$@" 2>&1 | head -1)
  case "$out" in "GATE --remote-only"*) got=REMOTE ;; *) got=LOCAL ;; esac
  if [ "$got" = "$want" ]; then printf 'PASS %-6s <- (%s) %s\n' "$got" "${dir#"$TMP"/}" "$*"
  else printf 'FAIL want=%s got=%s <- (%s) %s\n' "$want" "$got" "${dir#"$TMP"/}" "$*"; fail=$((fail+1)); fi
}
echo "--- workspace selectors: heavy script in the selected package ---"
probe_at REMOTE "$TMP/ws" pnpm --filter @t/web run lane:realpg
probe_at REMOTE "$TMP/ws" pnpm --filter=@t/web run lane:realpg
probe_at REMOTE "$TMP/ws" pnpm --filter '@t/web...' run lane:realpg
probe_at REMOTE "$TMP/ws" pnpm --filter ./apps/web run lane:realpg
probe_at REMOTE "$TMP/ws" pnpm -C apps/web run lane:realpg
probe_at REMOTE "$TMP/ws/apps/web" pnpm --filter @t/web run lane:realpg
probe_at REMOTE "$TMP/ws" npm -w @t/web run lane:realpg
echo "--- workspace selectors: must stay LOCAL ---"
probe_at LOCAL "$TMP/ws" pnpm --filter @t/web run dev
probe_at LOCAL "$TMP/ws" pnpm --filter @t/web run absent-script
probe_at LOCAL "$TMP/ws" pnpm -w run lint

echo; echo "failures=$fail"; [ "$fail" -eq 0 ]