#!/usr/bin/env bash
# Proves the agent CLIs baked into the sandbox image actually execute inside a live
# sandbox, at the pinned version, from /usr/local/bin — where the runtime /sandbox
# mount cannot shadow them.
set -uo pipefail

HOST="${1:-debian1}"
SSH=(ssh -F "$HOME/.ssh/config" -o BatchMode=yes "$HOST")
FAILURES=0

CLI_TABLE=(
  "codex 0.146.0"
  "claude 2.1.224"
  "cursor-agent 2026.08.04-aaa8809"
)

sandbox() { # script
  "${SSH[@]}" ".local/share/overdeck-sandbox/bin/sandbox-run --id agent-cli-proof -- /bin/bash -c $(printf '%q' "$1")"
}

report() {
  if [ "$2" = 1 ]; then printf 'PROVEN       %-28s %s\n' "$1" "$3"
  else printf 'PROVE-FAIL   %-28s %s\n' "$1" "$3"; FAILURES=$((FAILURES + 1)); fi
}

echo "=== agent CLI proofs on $HOST ==="

for spec in "${CLI_TABLE[@]}"; do
  cli_name="${spec%% *}"
  cli_version="${spec#* }"

  cli_path="$(sandbox "command -v ${cli_name}")"
  cli_rc=$?
  if [ "$cli_rc" -eq 0 ] && [ "${cli_path#"/usr/local/bin/"}" != "$cli_path" ]; then
    report "command -v $cli_name" 1 "$cli_path"
  else
    report "command -v $cli_name" 0 "${cli_path:-missing}"; continue
  fi

  out="$(sandbox "timeout 10s ${cli_name} --version")"
  out_rc=$?
  if [ "$out_rc" -ne 0 ]; then
    report "${cli_name} --version" 0 "$out"
    continue
  fi

  if printf '%s' "$out" | grep -qF "$cli_version"; then
    report "${cli_name} --version" 1 "$out"
  else
    report "${cli_name} --version" 0 "expected $cli_version in: $out"
  fi
done

# codex resolves these siblings relative to its own binary, so a flattened install
# passes --version and fails later.
out="$(sandbox 'ls /usr/local/lib/codex/bin/codex-code-mode-host /usr/local/lib/codex/codex-path/rg /usr/local/lib/codex/codex-resources/bwrap')"
if [ $? -eq 0 ]; then
  report "codex vendored tree intact" 1 "$(printf '%s' "$out" | tr '\n' ' ')"
else
  report "codex vendored tree intact" 0 "$out"
fi

# A CLI dlopens its native addons lazily, so --version succeeds even when they cannot
# link against the image's glibc. Every ELF and .node object the CLIs ship is checked,
# and an empty object set fails: a glob that matches nothing must not read as proof.
# The match is bash pattern matching, not `| grep`, because the image's toolgap wrapper
# reroutes grep to a tool the container does not carry, which would silently pass.
LINK_PROBE='
objs=()
while IFS= read -r -d "" f; do objs+=("$f"); done < <(
  /usr/bin/find /usr/local/lib/codex /usr/local/lib/claude-code /usr/local/lib/cursor-agent \
    -type f \( -name "?*.node" -o -perm -u+x \) -print0 2>/dev/null)
n=0; bad=0
for f in "${objs[@]}"; do
  case "$(/usr/bin/file -b "$f")" in *ELF*) ;; *) continue ;; esac
  n=$((n + 1))
  case "$(/usr/bin/ldd "$f" 2>/dev/null)" in *"not found"*) bad=$((bad + 1)); echo "$f" ;; esac
done
echo "objects=$n unresolved=$bad"'
out="$(sandbox "$LINK_PROBE")"
summary="${out##*$'\n'}"
if [ "${summary#*unresolved=}" = 0 ] && [ "${summary#objects=0 }" = "$summary" ]; then
  report "native addons link" 1 "$summary, no unresolved sonames"
else
  report "native addons link" 0 "${out//$'\n'/ }"
fi

# The runtime copies each staged credential to the pathname its CLI authenticates from;
# those live under HOME, which is a bind mount, not an image layer.
for auth_dir in .codex .claude .config/cursor; do
  out="$(sandbox "d=\$HOME/$auth_dir; mkdir -p \$d && touch \$d/.writeprobe && rm \$d/.writeprobe && echo \$d")"
  if [ $? -eq 0 ]; then
    report "auth path writable" 1 "$out"
  else
    report "auth path writable" 0 "$auth_dir: $out"
  fi
done

echo
[ "$FAILURES" -eq 0 ] && echo "all agent cli proofs held" || echo "$FAILURES agent cli proof(s) FAILED"
exit "$FAILURES"