#!/usr/bin/env bash
set -euo pipefail

VERSION="1.0.2"
CODENAME="AMBROSO"
CONFIRM="CONVERT_DEBIAN_TO_SENTINELOS_PUBLIC_V1"
BACKEND_CONFIRM="CONVERT_DEBIAN_TO_SENTINELOS"

usage() {
  cat <<EOF
sentinelos-public-converter v$VERSION

Commands:
  --summary
  --preflight
  --verify
  --sanitize-check
  --launch-installer
  --run --mode desktop [options] --confirm $CONFIRM

Options:
  --install-libreoffice
  --install-mate-apps
  --install-sentinel-suite
  --appearance sentinel-dark|sentinel-light

Notes:
  Public AMBROSO keeps basic SentinelOS and AEGIS branding.
  Personal model/path/vault artifacts are not included.
  Private local repo bootstrap is not included.
EOF
}

summary() {
  cat <<EOF
SentinelOS Public Converter
version: $VERSION
codename: $CODENAME
branding: SentinelOS + basic AEGIS public branding
private_repo_bundle: no
personal_model_artifacts: no
personal_path_files: no
personal_vault_paths: no
clean_install: disabled_iso_only
disk_wipe: no
runtime_auto_enable: no
EOF
}

sanitize_check() {
  local ok=1
  echo "SentinelOS Public Sanitization Check"
  echo "version: $VERSION"

  if grep -RIlE '/home/[^/]+/AEGIS|AEGIS[_]Vault|ollama|qwen|@[A-Za-z0-9._%+-]+\.[A-Za-z]{2,}' /usr/share/sentinelos 2>/dev/null | head -1 | grep -q .; then
    echo "private_terms_in_public_share: present"
    ok=0
  else
    echo "private_terms_in_public_share: absent"
  fi

  if [ -d /opt/sentinelos/private-local-repo ]; then
    echo "private_local_repo_path: present"
    ok=0
  else
    echo "private_local_repo_path: absent"
  fi

  if [ "$ok" = "1" ]; then echo "sanitize-check: ok"; else echo "sanitize-check: failed"; exit 1; fi
}

preflight() {
  local ok=1
  echo "SentinelOS Public AMBROSO Preflight"
  echo "version: $VERSION"
  echo
  for cmd in sentinelos-hardening sentinelos-convert-debian sentinelos-installer-gui sentinelos-theme-base sentinelos-background-guard sentinelos-status-tray-live-icons sentinelos-login-screen; do
    if command -v "$cmd" >/dev/null 2>&1; then echo "$cmd: ok"; else echo "$cmd: missing"; ok=0; fi
  done
  command -v sentinelos-convert-debian >/dev/null 2>&1 && sentinelos-convert-debian --preflight || ok=0
  sanitize_check || ok=0
  [ "$ok" = "1" ] && echo "preflight: ok" || { echo "preflight: failed"; exit 1; }
}

verify() {
  local ok=1
  for cmd in sentinelos-hardening sentinelos-convert-debian sentinelos-installer-gui sentinelos-theme-base sentinelos-background-guard sentinelos-status-tray-live-icons sentinelos-login-screen; do
    command -v "$cmd" >/dev/null 2>&1 || { echo "missing command: $cmd"; ok=0; }
  done
  command -v sentinelos-hardening >/dev/null 2>&1 && sentinelos-hardening --verify || ok=0
  command -v sentinelos-convert-debian >/dev/null 2>&1 && sentinelos-convert-debian --verify || ok=0
  command -v sentinelos-installer-gui >/dev/null 2>&1 && sentinelos-installer-gui --verify || ok=0
  command -v sentinelos-theme-base >/dev/null 2>&1 && sentinelos-theme-base --verify || ok=0
  command -v sentinelos-background-guard >/dev/null 2>&1 && sentinelos-background-guard --verify || ok=0
  command -v sentinelos-status-tray-live-icons >/dev/null 2>&1 && sentinelos-status-tray-live-icons --verify || ok=0
  command -v sentinelos-login-screen >/dev/null 2>&1 && sentinelos-login-screen --verify || ok=0
  sanitize_check || ok=0
  [ "$ok" = "1" ] && echo "verify: ok" || { echo "verify: failed"; exit 1; }
}

launch_installer() {
  exec sentinelos-installer-gui
}

run_public() {
  local mode="" confirm="" args=()
  while [ $# -gt 0 ]; do
    case "$1" in
      --mode) mode="${2:-}"; args+=("--mode" "$mode"); shift 2 ;;
      --install-libreoffice) args+=("--install-libreoffice"); shift ;;
      --install-mate-apps) args+=("--install-mate-apps"); shift ;;
      --install-sentinel-suite) args+=("--install-sentinel-suite"); shift ;;
      --appearance) args+=("--appearance" "${2:-}"); shift 2 ;;
      --confirm) confirm="${2:-}"; shift 2 ;;
      *) echo "ERROR: unknown argument $1" >&2; exit 2 ;;
    esac
  done
  [ "$confirm" = "$CONFIRM" ] || { echo "ERROR: Missing confirmation. Use --confirm $CONFIRM" >&2; exit 2; }
  [ "$mode" = "desktop" ] || { echo "ERROR: only --mode desktop is supported" >&2; exit 2; }
  [ "$(id -u)" = "0" ] || { echo "ERROR: public conversion run requires root." >&2; exit 2; }

  sentinelos-convert-debian --run "${args[@]}" --confirm "$BACKEND_CONFIRM"
  sentinelos-login-screen --apply --confirm APPLY_SENTINELOS_LOGIN_SCREEN || true
  sentinelos-status-tray-live-icons --apply --confirm APPLY_SENTINELOS_STATUS_TRAY_LIVE_ICONS || true
  sentinelos-public-converter --verify || true
}

case "${1:-}" in
  --summary) summary ;;
  --preflight) preflight ;;
  --verify) verify ;;
  --sanitize-check) sanitize_check ;;
  --launch-installer) launch_installer ;;
  --run) shift; run_public "$@" ;;
  --help|-h|"") usage ;;
  *) usage; exit 2 ;;
esac
