Tooling

#!/usr/bin/env bash
# generate-hooks: Generate native git hooks from .pre-commit-config.yaml.
# Replaces the pre-commit Python package with zero-dependency bash hooks.
#
# Usage: generate-hooks [--config PATH] [--output-dir PATH] [--dry-run]
set -euo pipefail

_SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
_CI_ROOT="$(cd "$_SCRIPT_DIR/.." && pwd)"
if ! source "$_CI_ROOT/lib/ci.sh"; then
    echo "ERROR: failed to source $_CI_ROOT/lib/ci.sh" >&2
    exit 2
fi
# checks_quality.sh provides ci_resolve_tier and ci_autocreate_project_enforcement.
# Sourced here (not via checks.sh) so generate-hooks can run without the full
# check-function surface: keeps the bootstrap minimal.
if ! source "$_CI_ROOT/lib/checks_quality.sh"; then
    echo "ERROR: failed to source $_CI_ROOT/lib/checks_quality.sh" >&2
    exit 2
fi

# ── Defaults ──────────────────────────────────────────────────────────────
_config=".pre-commit-config.yaml"
_output_dir=""
_dry_run=0

while [[ $# -gt 0 ]]; do
    case "$1" in
        --config)     _config="$2"; shift 2 ;;
        --output-dir) _output_dir="$2"; shift 2 ;;
        --dry-run)    _dry_run=1; shift ;;
        -h|--help)
            echo "Usage: generate-hooks [--config PATH] [--output-dir PATH] [--dry-run]"
            echo ""
            echo "Generate native git hooks from .pre-commit-config.yaml."
            echo "Only repo:local / language:system hooks are supported."
            exit 0
            ;;
        *) ci_fail "Unknown option: $1"; exit 1 ;;
    esac
done

[[ -f "$_config" ]] || { ci_fail "Config not found: $_config"; exit 1; }

# ── Best bash shebang ─────────────────────────────────────────────────────
# Generated hooks source lib/ci.sh which uses `local -n` namerefs (bash 4.3+).
# macOS ships bash 3.2 at /bin/bash, so prefer Homebrew bash 5.x when present.
# Check /opt/homebrew (Apple Silicon) then /usr/local (Intel) then fall back.
_ci_best_bash="#!/usr/bin/env bash"
for _hb in /opt/homebrew/bin/bash /usr/local/bin/bash; do
    if [[ -x "$_hb" ]] && "$_hb" --version | grep -qE 'bash, version [5-9]\.'; then
        _ci_best_bash="#!$_hb"
        break
    fi
done

# ── Paths ─────────────────────────────────────────────────────────────────
if [[ -z "$_output_dir" ]]; then
    _git_dir="$(git rev-parse --git-dir)" || { ci_fail "Not a git repo"; exit 1; }
    _output_dir="$_git_dir/hooks"
fi
[[ -d "$_output_dir" ]] || mkdir -p "$_output_dir"

_repo_root="$(git rev-parse --show-toplevel)"
_ci_rel="$(ci_relative_path "$_repo_root" "$_CI_ROOT")"

# ── Tier resolution ───────────────────────────────────────────────────────
# Resolve the workspace root by walking up from the CI dir. Then resolve
# this consumer's tier via
# the project_enforcement.yaml registry (autocreated from template if
# missing).
_workspace_root="$(cd "$_CI_ROOT/../.." && pwd)"
_registry=""
if [[ -d "$_workspace_root/$CI_BOOT_NAME" ]]; then
    _reg_rc=0
    _registry="$(ci_autocreate_project_enforcement "$_workspace_root")" || _reg_rc=$?
fi
_repo_rel=""
if [[ "$_repo_root" == "$_workspace_root"* ]]; then
    _repo_rel="${_repo_root#"$_workspace_root"/}"
    [[ "$_repo_rel" == "$_repo_root" ]] && _repo_rel="."
fi
_tier="$(ci_resolve_tier "$_repo_rel" "$_registry")"

if [[ "$_tier" == "vendored" ]]; then
    ci_info "Project tier=vendored: skipping hook installation."
    exit 0
fi

ci_info "Project tier=$_tier"

# ── Parse config ──────────────────────────────────────────────────────────
_hooks="$(awk -f "$_CI_ROOT/lib/parse_precommit_config.awk" "$_config")"
if [[ -z "$_hooks" ]]; then
    ci_warn "No hooks found in $_config"
    exit 0
fi

# ── Helper: append line to temp file ──────────────────────────────────────
_tmp=""
w() { printf '%s\n' "$1" >> "$_tmp"; }

# ── Generate each stage ──────────────────────────────────────────────────
for _stage in pre-commit commit-msg pre-push; do
    _awk_rc=0
    _stage_hooks="$(printf '%s\n' "$_hooks" | awk -F'\034' -v s="$_stage" '$4 == s')" || _awk_rc=$?
    [[ -z "$_stage_hooks" ]] && continue

    _tmp="$(mktemp)"

    # ── Header ────────────────────────────────────────────────────────────
    cat > "$_tmp" << EOF
${_ci_best_bash}
# AUTO-GENERATED by ${_ci_rel}/scripts/generate-hooks: do not edit.
# Source: $_config | $(date -u +%Y-%m-%dT%H:%M:%SZ)
# Re-generate: ${_ci_rel}/scripts/generate-hooks
set -euo pipefail

# Capability scrub (audit C5): the workspace guard loans ambient and
# inheritable capabilities (CAP_DAC_OVERRIDE et al.) to git so it can
# write root-owned .git trees. Without this scrub those caps propagate
# into everything this hook spawns (pytest, node, repo scripts), letting
# agent code rewrite root-owned hooks, projects/CI, and exemption files.
# Re-exec once with inheritable and ambient caps cleared; git commands
# run later re-acquire their own loan from the guard wrapper per call.
if [[ -z "\${_CI_CAPS_SCRUBBED:-}" ]]; then
    if _setpriv="\$(command -v setpriv)"; then
        export _CI_CAPS_SCRUBBED=1
        exec setpriv --inh-caps=-all --ambient-caps=-all bash "\$0" "\$@"
    fi
fi

# PATH sanitize (hook-git resolution): git exports GIT_EXEC_PATH and prepends
# its exec dir (/usr/lib/git-core) to PATH for hook children. That dir holds
# the VANILLA distro git with no file capabilities: any 'git' resolved from
# there bypasses the workspace guard, never receives the CAP_DAC_OVERRIDE
# loan, and fails writing the root-owned .git tree (EACCES on
# .git/index.lock) -- this broke check-unstaged's 'git add -A'. Filter the
# exec-path entry out so every hook-spawned git resolves to the guard
# wrapper (/usr/bin/git) and re-acquires the loan per call, at any depth.
_git_exec_path="\$(command git --exec-path)"
if [[ -n "\$_git_exec_path" ]]; then
    _sanitized_path=""
    _saved_ifs="\$IFS"
    IFS=':'
    for _p in \$PATH; do
        [[ "\$_p" == "\$_git_exec_path" ]] && continue
        _sanitized_path="\${_sanitized_path:+\$_sanitized_path:}\$_p"
    done
    IFS="\$_saved_ifs"
    export PATH="\$_sanitized_path"
fi

_ROOT="\$(git rev-parse --show-toplevel)"
cd "\$_ROOT"
if ! source "\${_ROOT}/${_ci_rel}/lib/ci.sh"; then
    echo "ERROR: failed to source \${_ROOT}/${_ci_rel}/lib/ci.sh" >&2
    exit 2
fi
# Prepend boot dirs discovered by the boot-path resolver.
# ci_resolve_boot_path walks up from \$_ROOT, finds each \$CI_BOOT_NAME
# dir (python-env/bin and bin), and accumulates them with
# moon.yml::project.inherited_boot_dirs entries. The result is
# prepended to \$PATH so hooks resolve tools from the nearest boot dir
# first, walking up to workspace root.
_boot_path="\$(ci_resolve_boot_path "\$_ROOT")"
[[ -n "\$_boot_path" ]] && export PATH="\${_boot_path}:\$PATH"
EOF

    # quality_exceptions.yaml preflight: ALWAYS enforced, all tiers.
    # Hard-fails the hook chain if the file is missing: the contract says
    # every project must have this file at its root, even if
    # exceptions: [] is empty. Runs at the very top of every hook so the
    # error is the first thing the user sees.
        w ''
    w '# === quality_exceptions.yaml preflight (mandatory) ==='
        w 'if [[ ! -f "$_ROOT/quality_exceptions.yaml" ]]; then'
        w '    ci_fail "quality_exceptions.yaml missing at $_ROOT"'
        w "    echo \"  Fix: copy \${_ROOT}/${_ci_rel}/templates/quality_exceptions.template.yaml\""
        w '    echo "       to $_ROOT/quality_exceptions.yaml and replace __PROJECT_NAME__."'
        w '    exit 1'
        w 'fi'

    # Exemption-file compliance: ALWAYS enforced, all tiers, every stage.
    # Hard-fails if any file listed in the CI canonical manifest
    # (config/exemption_files.yaml) is missing or not root-owned. The
    # marker comment lets check-required-hooks-present
    # verify this built-in block survived rendering.
        w ''
        w '# === exemption-file compliance (mandatory) ==='
        w '# CI-BUILTIN-EXEMPTION-COMPLIANCE'
        w '_exemptions_lib="$_ROOT/'"${_ci_rel}"'/lib/ci_exemptions.sh"'
        w '_exemptions_manifest="$_ROOT/'"${_ci_rel}"'/config/exemption_files.yaml"'
        w 'if [[ ! -f "$_exemptions_lib" || ! -f "$_exemptions_manifest" ]]; then'
        w '    ci_fail "CI exemption infrastructure missing (lib/ci_exemptions.sh or config/exemption_files.yaml)"'
        w '    exit 1'
        w 'fi'
        w 'if ! source "$_exemptions_lib"; then'
        w '    ci_fail "failed to source $_exemptions_lib"'
        w '    exit 1'
        w 'fi'
        w '_exemption_fail=0'
        w 'for _rel in $(sed -n "s/^  - path: //p" "$_exemptions_manifest"); do'
        w '    _exemption_state="$(ci_exemption_file_state "$_ROOT/$_rel")"'
        w '    if [[ "$_exemption_state" != "ok" ]]; then'
        w '        ci_fail "exemption file not compliant: $_rel (state: $_exemption_state)"'
        w '        _exemption_fail=1'
        w '    fi'
        w 'done'
        w 'if [[ "$_exemption_fail" -eq 1 ]]; then'
        w "    echo \"  Fix: files must be root-owned regular files; edit via 'sudo workspace-yaml-edit'\""
        w '    exit 1'
        w 'fi'

    # CI-repo catalog provenance: in the CI work repo itself (detected by
    # scripts/generate-hooks at the project root), EVERY config/*.yaml is
    # policy: catalogs and schemas included. Agent-owned catalogs are a
    # self-gate-weakening hole, so all of them must be root-owned regular
    # files, edited only via the root-gated yaml editor.
        w ''
        w '# === CI catalog provenance (CI repo only, mandatory) ==='
        w '# CI-BUILTIN-CATALOG-PROVENANCE'
        w 'if [[ -f "$_ROOT/scripts/generate-hooks" && -d "$_ROOT/config" ]]; then'
        w '    _catalog_fail=0'
        w '    for _catalog in "$_ROOT"/config/*.yaml; do'
        w '        [[ -e "$_catalog" ]] || continue'
        w '        _catalog_state="$(ci_exemption_file_state "$_catalog")"'
        w '        if [[ "$_catalog_state" != "ok" ]]; then'
        w '            ci_fail "CI catalog not compliant: ${_catalog#$_ROOT/} (state: $_catalog_state)"'
        w '            _catalog_fail=1'
        w '        fi'
        w '    done'
        w '    if [[ "$_catalog_fail" -eq 1 ]]; then'
        w "        echo \"  Fix: chown root:root config/*.yaml; edit via 'sudo workspace-yaml-edit'\""
        w '        exit 1'
        w '    fi'
        w 'fi'

    # Compliance-report preamble (pre-commit only, non-blocking).
    # Always runs the compliance audit at the top of every commit
    # so the developer sees the current tier/violations before the hook
    # chain proceeds. Never blocks: the report is advisory.
    if [[ "$_stage" == "pre-commit" ]]; then
        w ''
        w '# === CI compliance report (advisory, non-blocking) ==='
        w "_compliance_script=\"\${_ROOT}/${_ci_rel}/scripts/compliance-report\""
        w 'if [[ -x "$_compliance_script" ]]; then'
        w '    _compliance_rc=0'
        w '    _compliance_output="$("$_compliance_script" "$_ROOT" 2>&1)" || _compliance_rc=$?'
        w '    if echo "$_compliance_output" | grep -qE "^FAILED|violation\\(s\\)"; then'
        w '        printf "\\n\\033[0;31m═══ CI COMPLIANCE (advisory, does not block commit) ═══\\033[0m\\n"'
        w '        printf "\\033[0;31m%s\\033[0m\\n" "$_compliance_output"'
        w '        printf "\\033[0;31m═══════════════════════════════════════════════════════════\\033[0m\\n\\n"'
        w '    else'
        w '        printf "\\n\\033[0;32m═══ CI COMPLIANCE ═══\\033[0m\\n"'
        w '        printf "%s\\n\\n" "$_compliance_output"'
        w '    fi'
        w 'fi'
    fi

    # Staged files list (pre-commit only)
    if [[ "$_stage" == "pre-commit" ]]; then
        w ''
        w '_STAGED="$(git diff --cached --name-only --diff-filter=ACMR)"'
    fi

    # ── Emit each hook ────────────────────────────────────────────────────
    while IFS=$'\034' read -r h_id h_name h_entry h_stage h_pass_fn h_always h_files h_exclude h_args h_types_or; do
        [[ -z "$h_id" ]] && continue
        h_vid="${h_id//-/_}"

        # Full command = entry + args
        # Replace `bash -c` with `"$BASH" -c` so child shells use the same
        # bash as the hook's shebang (Homebrew bash 5.x on macOS), not the
        # system /bin/bash 3.2 which lacks nameref support.
        h_cmd="${h_entry//bash -c/\"\$BASH\" -c}"
        [[ -n "$h_args" ]] && h_cmd="$h_cmd $h_args"

        # If a hook has an empty entry (e.g. when .pre-commit-config.yaml
        # references an upstream pre-commit-hooks repo whose entries
        # this generator does not resolve), refuse to emit the hook.
        if [[ -z "${h_entry// /}" ]]; then
            ci_fail "Hook '$h_id' has empty entry: cannot generate. \
Possible causes: (a) the .pre-commit-config.yaml references an upstream \
pre-commit-hooks repo this generator does not resolve; \
(b) a YAML parse glitch dropped the entry. \
Fix the config (move to a local 'repo: local' entry with a real entry: command) \
and re-run."
            exit 1
        fi

        # Convert types_or to a files regex (extension-based matching)
        if [[ -n "$h_types_or" ]]; then
            _type_exts=()
            for _type in $h_types_or; do
                case "$_type" in
                    javascript) _type_exts+=('\.(js|mjs|cjs)$') ;;
                    jsx)        _type_exts+=('\.jsx$') ;;
                    ts)         _type_exts+=('\.(ts|mts|cts)$') ;;
                    tsx)        _type_exts+=('\.tsx$') ;;
                    css)        _type_exts+=('\.css$') ;;
                    json)       _type_exts+=('\.json$') ;;
                    markdown)   _type_exts+=('\.md$') ;;
                    yaml)       _type_exts+=('\.ya?ml$') ;;
                    python)     _type_exts+=('\.py$') ;;
                    rust)       _type_exts+=('\.rs$') ;;
                    toml)       _type_exts+=('\.toml$') ;;
                    *)          ci_warn "Hook $h_id: unknown type '$_type', skipping" ;;
                esac
            done
            # Merge into a single alternation pattern
            if [[ ${#_type_exts[@]} -gt 0 ]]; then
                _types_pattern="$(IFS='|'; echo "${_type_exts[*]}")"
                # If files is already set, combine with types (both must match)
                if [[ -n "$h_files" ]]; then
                    h_files="(${h_files}).*(${_types_pattern})"
                else
                    h_files="$_types_pattern"
                fi
            fi
        fi

        # Validate: regex patterns must not contain single quotes (breaks generated grep)
        if [[ "$h_files" == *"'"* || "$h_exclude" == *"'"* ]]; then
            ci_fail "Hook $h_id: files/exclude patterns must not contain single quotes"
            exit 1
        fi

        # Classify
        _is_formatter=0
        [[ "$h_id" == "ruff-format" || "$h_id" == "ruff" || "$h_id" == "ci-lint" ]] && _is_formatter=1

        _need_gate=0  # skip hook if no staged files match
        [[ -n "$h_files" && "$h_always" != "true" && "$_stage" == "pre-commit" ]] && _need_gate=1

        _need_pass=0  # pass staged filenames as arguments
        [[ "$h_pass_fn" == "true" && "$_stage" == "pre-commit" ]] && _need_pass=1

        w ''
        w "# === Hook: $h_id ==="

        # ── File matching (pre-commit only) ───────────────────────────────
        if [[ $_need_gate -eq 1 || $_need_pass -eq 1 ]]; then
            if [[ -n "$h_files" ]]; then
                w "_rc_${h_vid}=0"
                w "_match=\"\$(echo \"\$_STAGED\" | grep -E '${h_files}')\" || _rc_${h_vid}=\$?"
            else
                w '_match="$_STAGED"'
            fi
            if [[ -n "$h_exclude" ]]; then
                w "_rc_ex_${h_vid}=0"
                w "_match=\"\$(echo \"\$_match\" | grep -vE '${h_exclude}')\" || _rc_ex_${h_vid}=\$?"
            fi
            w 'if [[ -n "$_match" ]]; then'
        fi

        w "ci_info \"Running: ${h_name}...\""

        # ── Execute ──────────────────────────────────────────────────────
        if [[ "$_stage" == "commit-msg" ]]; then
            w "${h_cmd} \"\$1\" || { ci_fail \"$h_name\"; exit 1; }"

        elif [[ $_is_formatter -eq 1 ]]; then
            w '_rc=0'
            w "${h_cmd} || _rc=\$?"
            w 'if [[ -n "$(git diff --stat)" ]]; then'
            w '    git add -A'
            w "    ci_fail \"${h_name} modified files. Re-run: git commit\""
            w '    exit 1'
            w 'fi'
            w "[[ \$_rc -ne 0 ]] && { ci_fail \"$h_name\"; exit 1; }"

        elif [[ $_need_pass -eq 1 ]]; then
            # shellcheck disable=SC2086
            w "${h_cmd} \$_match || { ci_fail \"$h_name\"; exit 1; }"

        elif [[ "$h_id" == "check-boot-venv-layout" || "$h_id" == "check-dead-code" ]]; then
            # Non-blocking advisory checks: rc-capture pattern.
            # Failures are surfaced as warnings, never hard-fail.
            w '_bl_rc=0'
            w "${h_cmd} || _bl_rc=\$?"
            w 'if [[ $_bl_rc -ne 0 ]]; then'
            w "    ci_warn \"${h_name} failed (exit \$_bl_rc): non-blocking, continuing\""
            w 'fi'

        else
            w "${h_cmd} || { ci_fail \"$h_name\"; exit 1; }"
        fi

        # Close file gate
        if [[ $_need_gate -eq 1 || $_need_pass -eq 1 ]]; then
            w 'fi'
        fi

    done <<< "$_stage_hooks"

    w ''
    w "ci_pass \"All $_stage hooks passed.\""

    # ── Output ────────────────────────────────────────────────────────────
    if [[ $_dry_run -eq 1 ]]; then
        echo ""
        ci_info "=== $_output_dir/$_stage ==="
        cat "$_tmp"
        rm -f "$_tmp"
    else
        # Hooks are root-owned by design: only root ever rewrites them.
        # Refuse with the root regeneration path instead of dying on the
        # EPERM from mv.
        if [[ -f "$_output_dir/$_stage" && ! -w "$_output_dir/$_stage" ]]; then
            rm -f "$_tmp"
            # -w fails for root too when the file carries chattr +i; tell the
            # two cases apart so the message names the right fix command.
            _attrs_rc=0
            _attrs="$(lsattr "$_output_dir/$_stage")" || _attrs_rc=$?
            if [[ $_attrs_rc -eq 0 && "${_attrs%% *}" == *i* ]]; then
                ci_fail "hook $_stage is immutable (chattr +i). Clear it first: sudo chattr -i $_output_dir/$_stage"
            else
                ci_fail "hook $_stage is root-owned. Regenerate as root: sudo make -C projects/CI install-hooks CONSUMER=<repo>"
            fi
            exit 1
        fi
        mv "$_tmp" "$_output_dir/$_stage"
        chmod +x "$_output_dir/$_stage"
        ci_pass "Generated $_output_dir/$_stage"
    fi
done

if [[ $_dry_run -eq 0 ]]; then
    echo ""
    ci_pass "All hooks generated from $_config"
fi

#!/usr/bin/env bash
# cleanup-precommit: Remove all traces of the pre-commit Python package.
# Does NOT remove .pre-commit-config.yaml by default (it's our config source).
#
# Usage: cleanup-precommit [--remove-config]
set -euo pipefail

_SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
_CI_ROOT="$(cd "$_SCRIPT_DIR/.." && pwd)"
if ! source "$_CI_ROOT/lib/ci.sh"; then
    echo "ERROR: failed to source $_CI_ROOT/lib/ci.sh" >&2
    exit 2
fi

_remove_config=0
[[ "${1:-}" == "--remove-config" ]] && _remove_config=1

# Remove pre-commit cache
if [[ -d "$HOME/.cache/pre-commit" ]]; then
    rm -rf "$HOME/.cache/pre-commit"
    ci_pass "Removed ~/.cache/pre-commit"
else
    ci_info "No pre-commit cache found"
fi

# Remove old hook backup
if [[ -f ".git/hooks/pre-commit.legacy" ]]; then
    rm -f ".git/hooks/pre-commit.legacy"
    ci_pass "Removed .git/hooks/pre-commit.legacy"
fi

# Uninstall pre-commit package via hermetic boot-dir uv only; never
# ambient system binaries. uv resolves the project venv itself when run
# from the project root.
_uv="$(ci_uv_bin)" || exit 1
if (cd "$CI_PROJECT_ROOT" && env -u VIRTUAL_ENV "$_uv" pip uninstall pre-commit); then
    ci_pass "Uninstalled pre-commit (uv, project venv)"
else
    ci_info "pre-commit not installed in project venv (or no venv yet)"
fi

# Optionally remove config
if [[ $_remove_config -eq 1 ]]; then
    rm -f .pre-commit-config.yaml
    ci_pass "Removed .pre-commit-config.yaml"
fi

echo ""
ci_info "NOTE: If pre-commit is in pyproject.toml dev dependencies, remove it manually."
ci_pass "Pre-commit cleanup complete."

#!/usr/bin/env bash
# bootstrap-gitleaks: fetch the gitleaks binary and place it on PATH.
#
# This project depends on `gitleaks` for the pre-commit secret-content scanner.
# This script is idempotent: if a compatible binary is already present at the
# target path, it exits 0 without redownloading.
#
# Default install location:
#   $CI_PROJECT_ROOT/$CI_BOOT_NAME/bin/gitleaks
# where $CI_BOOT_NAME is platform-aware (.boot-linux on Linux, .boot-macos
# on macOS), set at source-time by lib/ci.sh.
# Override with $GITLEAKS_BIN to drop somewhere else.
#
# Override the version with $GITLEAKS_VERSION (default below).
#
# CI_PROJECT_ROOT (this repo's own root) is delegated to lib/ci.sh. Per the
# boot contract, this script installs to CI's own boot dir: NOT the
# workspace root. Sibling repos reach this binary via the
# boot-path resolver (lib/ci.sh::ci_resolve_boot_path) which reads
# moon.yml::project.inherited_boot_dirs. See:
#   docs/specifications/SPEC-BOOT-LAYOUT.md

set -euo pipefail

GITLEAKS_VERSION="${GITLEAKS_VERSION:-8.21.2}"
#
# Supply-chain pinning: SHA256 verification is MANDATORY and always on.
# The checksum is fetched at runtime from the checksums.txt sidecar file
# published alongside the tarballs on the GitHub release page. No hardcoded
# hashes are used -- the sidecar is the trusted source of truth, fetched
# from the same release origin as the tarball.

_ci_lib="$(cd "$(dirname "${BASH_SOURCE[0]}")/../lib" && pwd)"
# shellcheck source=lib/ci.sh
if ! source "$_ci_lib/ci.sh"; then
    echo "ERROR: failed to source $_ci_lib/ci.sh" >&2
    exit 2
fi
if [[ -z "${CI_PROJECT_ROOT:-}" ]]; then
    echo "ERROR: CI_PROJECT_ROOT not set after sourcing ci.sh" >&2
    exit 2
fi

_log() { printf '[bootstrap-gitleaks] %s\n' "$*" >&2; }

main() {
    local target_dir target arch tarball url
    target_dir="${CI_PROJECT_ROOT}/${CI_BOOT_NAME}/bin"
    target="${GITLEAKS_BIN:-${target_dir}/gitleaks}"

    if ! mkdir -p "$(dirname "$target")"; then
        _log "mkdir failed for $(dirname "$target")"
        return 1
    fi

    if [[ -x "$target" ]]; then
        local v_out v_err v_rc=0
        v_out="$(mktemp)"
        v_err="$(mktemp)"
        "$target" version >"$v_out" 2>"$v_err" || v_rc=$?
        if [[ "$v_rc" -eq 0 ]]; then
            local cur
            cur="$(head -1 "$v_out")"
            rm -f "$v_out" "$v_err"
            if [[ "$cur" == *"$GITLEAKS_VERSION"* ]]; then
                _log "gitleaks ${GITLEAKS_VERSION} already at $target"
                return 0
            fi
            _log "found existing gitleaks ($cur), upgrading to ${GITLEAKS_VERSION}"
        else
            local err_msg
            err_msg="$(head -1 "$v_err")"
            rm -f "$v_out" "$v_err"
            _log "existing binary at $target did not respond to 'version' (rc=$v_rc): $err_msg"
            _log "re-downloading fresh copy"
        fi
    fi

    case "$(uname -m)" in
        x86_64|amd64)  arch="x64" ;;
        aarch64|arm64) arch="arm64" ;;
        *) _log "unsupported arch: $(uname -m)"; return 1 ;;
    esac

    case "$(uname -s)" in
        Linux) goos="linux" ;;
        Darwin) goos="darwin" ;;
        *) _log "unsupported platform: $(uname -s)"; return 1 ;;
    esac

    tarball="gitleaks_${GITLEAKS_VERSION}_${goos}_${arch}.tar.gz"
    url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${tarball}"

    local tmp
    tmp="$(mktemp -d)"
    # Use ${tmp:-} so the trap is safe under `set -u` once `tmp` (a local)
    # goes out of scope after main() returns.
    # shellcheck disable=SC2064
    trap "rm -rf \"\${tmp:-$tmp}\"" EXIT

    _log "fetching ${url}"
    if ! curl -fsSL --retry 3 --retry-delay 2 -o "${tmp}/${tarball}" "$url"; then
        _log "curl failed for $url"
        return 1
    fi

    # Mandatory SHA256 verification: fetch the checksums.txt sidecar from
    # the same GitHub release URL as the tarball. The sidecar contains
    # lines of "<hash>  <filename>" -- we extract the line matching our
    # tarball name and compare the hash against sha256sum of the download.
    # No hardcoded hashes.
    local checksums_url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
    _log "fetching checksum sidecar: ${checksums_url}"
    local sha_rc=0
    curl -fsSL --retry 3 --retry-delay 2 -o "${tmp}/checksums.txt" "$checksums_url" || sha_rc=$?
    if [[ "$sha_rc" -ne 0 ]]; then
        _log "failed to fetch checksums sidecar (rc=$sha_rc): $checksums_url"
        _log "cannot verify tarball integrity without sidecar; refusing to install"
        return 1
    fi

    local expected_sha
    expected_sha="$(awk -v tb="$tarball" '$2 == tb {print $1}' "${tmp}/checksums.txt")"
    if [[ -z "$expected_sha" ]]; then
        _log "no checksum entry for $tarball in sidecar; refusing to install"
        return 1
    fi

    local actual_sha
    actual_sha="$(ci_sha256 "${tmp}/${tarball}")"
    if [[ "$actual_sha" != "$expected_sha" ]]; then
        _log "checksum mismatch: expected $expected_sha, got $actual_sha"
        return 1
    fi
    _log "checksum OK ($expected_sha)"

    _log "extracting ${tarball} to ${tmp}"
    if ! tar -xzf "${tmp}/${tarball}" -C "$tmp" gitleaks; then
        _log "tar extraction failed"
        return 1
    fi
    _log "installing gitleaks to ${target}"
    if ! install -m 0755 "${tmp}/gitleaks" "$target"; then
        _log "install (copy) failed to $target"
        return 1
    fi

    local v_out2 v_rc2=0
    v_out2="$(mktemp)"
    "$target" version >"$v_out2" 2>&1 || v_rc2=$?
    if [[ "$v_rc2" -ne 0 ]]; then
        _log "post-install verification failed: '$target version' returned rc=$v_rc2"
        rm -f "$v_out2"
        return 1
    fi
    _log "installed: $(head -1 "$v_out2") => $target"
    rm -f "$v_out2"
}

main "$@"

#!/usr/bin/env bash
# bootstrap-cloc: fetch the cloc single-file Perl script and place it on PATH.
#
# This project depends on `cloc` (Count Lines of Code) for the code-stats
# script. cloc is distributed as a single self-contained Perl script, so
# bootstrapping it is a download + checksum verify + drop into the boot bin
# dir. This script is idempotent: if a compatible binary is already present
# at the target path, it exits 0 without redownloading.
#
# Default install location:
#   $CI_PROJECT_ROOT/$CI_BOOT_NAME/bin/cloc
# where $CI_BOOT_NAME is platform-aware (.boot-linux on Linux, .boot-macos
# on macOS), set at source-time by lib/ci.sh.
# Override with $CLOC_BIN to drop somewhere else.
#
# Override the version with $CLOC_VERSION (default below).
#
# Supply-chain pinning: SHA256 verification is MANDATORY and always on.
# Unlike gitleaks, cloc does NOT publish a checksums sidecar file alongside
# its release assets (verified via the GitHub releases API). The hash below
# is therefore hardcoded against the pinned CLOC_VERSION. Bumping the
# version requires recomputing the hash (sha256sum of the .pl asset).
#
# cloc is a Perl script; a working `perl` is a runtime dependency and is
# declared in config/system-deps.yaml. This script verifies perl presence
# before installing so the failure mode is obvious at bootstrap time.
#
# CI_PROJECT_ROOT (this repo's own root) is delegated to lib/ci.sh. Per the
# boot contract, this script installs to CI's OWN boot dir: NOT the
# workspace root. Sibling repos reach this binary via the boot-path
# resolver (lib/ci.sh::ci_resolve_boot_path) which reads
# moon.yml::project.inherited_boot_dirs. See:
#   docs/specifications/SPEC-BOOT-LAYOUT.md

set -euo pipefail

CLOC_VERSION="${CLOC_VERSION:-2.02}"
# SHA256 of cloc-2.02.pl (759966 bytes), fetched from:
#   https://github.com/AlDanial/cloc/releases/download/v2.02/cloc-2.02.pl
# Recompute with: sha256sum <(curl -fsSL <url>)  when bumping CLOC_VERSION.
CLOC_SHA256="373b4424acdf4bfb38e735a85c8a0e5731ee789e2fd95df2618d254cbdb7f355"

_ci_lib="$(cd "$(dirname "${BASH_SOURCE[0]}")/../lib" && pwd)"
# shellcheck source=lib/ci.sh
if ! source "$_ci_lib/ci.sh"; then
    echo "ERROR: failed to source $_ci_lib/ci.sh" >&2
    exit 2
fi
if [[ -z "${CI_PROJECT_ROOT:-}" ]]; then
    echo "ERROR: CI_PROJECT_ROOT not set after sourcing ci.sh" >&2
    exit 2
fi

_log() { printf '[bootstrap-cloc] %s\n' "$*" >&2; }

main() {
    local target_dir target
    target_dir="${CI_PROJECT_ROOT}/${CI_BOOT_NAME}/bin"
    target="${CLOC_BIN:-${target_dir}/cloc}"

    if ! mkdir -p "$(dirname "$target")"; then
        _log "mkdir failed for $(dirname "$target")"
        return 1
    fi

    # cloc is a Perl script: refuse to install without a working perl.
    local _perl_path=""
    if ! _perl_path="$(command -v perl 2>&1)"; then
        _log "perl not found on PATH; cloc is a Perl script and requires it"
        _log "install perl (declared in config/system-deps.yaml) then re-run"
        return 1
    fi

    if [[ -x "$target" ]]; then
        local v_out v_rc=0
        v_out="$(mktemp)"
        "$target" --version >"$v_out" 2>&1 || v_rc=$?
        if [[ "$v_rc" -eq 0 ]]; then
            local cur
            cur="$(head -1 "$v_out")"
            rm -f "$v_out"
            if [[ "$cur" == *"$CLOC_VERSION"* ]]; then
                _log "cloc ${CLOC_VERSION} already at $target"
                return 0
            fi
            _log "found existing cloc ($cur), upgrading to ${CLOC_VERSION}"
        else
            rm -f "$v_out"
            _log "existing binary at $target did not respond to '--version' (rc=$v_rc)"
            _log "re-downloading fresh copy"
        fi
    fi

    local asset="cloc-${CLOC_VERSION}.pl"
    local url="https://github.com/AlDanial/cloc/releases/download/v${CLOC_VERSION}/${asset}"

    local tmp
    tmp="$(mktemp -d)"
    # shellcheck disable=SC2064
    trap "rm -rf \"\${tmp:-$tmp}\"" EXIT

    _log "fetching ${url}"
    if ! curl -fsSL --retry 3 --retry-delay 2 -o "${tmp}/${asset}" "$url"; then
        _log "curl failed for $url"
        return 1
    fi

    # Mandatory SHA256 verification against the pinned hash.
    local actual_sha
    actual_sha="$(ci_sha256 "${tmp}/${asset}")"
    if [[ "$actual_sha" != "$CLOC_SHA256" ]]; then
        _log "checksum mismatch: expected $CLOC_SHA256, got $actual_sha"
        _log "if you bumped CLOC_VERSION, recompute the hash (see script header)"
        return 1
    fi
    _log "checksum OK ($CLOC_SHA256)"

    _log "installing cloc to ${target}"
    if ! install -m 0755 "${tmp}/${asset}" "$target"; then
        _log "install (copy) failed to $target"
        return 1
    fi

    local v_out2 v_rc2=0
    v_out2="$(mktemp)"
    "$target" --version >"$v_out2" 2>&1 || v_rc2=$?
    if [[ "$v_rc2" -ne 0 ]]; then
        _log "post-install verification failed: '$target --version' returned rc=$v_rc2"
        rm -f "$v_out2"
        return 1
    fi
    _log "installed: $(head -1 "$v_out2") => $target"
    rm -f "$v_out2"
}

main "$@"

#!/usr/bin/env bash
# bootstrap-uv: fetch the uv binary and place it on PATH.
#
# This project uses `uv` for dependency management (uv sync -> per-repo
# .venv/) and for cross-project Python invocation (uv run --project).
# This script is idempotent: if a compatible binary is already present at
# the target path, it exits 0 without redownloading.
#
# Default install location:
#   $CI_PROJECT_ROOT/$CI_BOOT_NAME/bin/uv
# where $CI_BOOT_NAME is platform-aware (.boot-linux on Linux, .boot-macos
# on macOS), set at source-time by lib/ci.sh.
# Override with $UV_BIN to drop somewhere else.
#
# Override the version with $UV_VERSION (default below).
#
# The per-repo private venv (`.venv/`) is created by `uv sync` (run from the
# repo root AFTER this script installs the uv binary): NOT by this script.
# This script installs ONLY the uv BINARY (and uvx if the release ships it).
# See: docs/specifications/SPEC-BOOT-LAYOUT.md
#
# Overrideable env vars:
#   $UV_VERSION        : release tag to fetch (default: 0.11.23, the
#                         version confirmed in AGENTS.md §2).
#   $UV_BIN            : override install target path.
#
# Supply-chain pinning: SHA256 verification is MANDATORY and always on.
# The checksum is fetched at runtime from the .sha256 sidecar file
# published alongside the tarball on the GitHub release page. No hardcoded
# hashes are used -- the sidecar is the trusted source of truth, fetched
# from the same release origin as the tarball.

set -euo pipefail

UV_VERSION="${UV_VERSION:-0.11.23}"

_ci_lib="$(cd "$(dirname "${BASH_SOURCE[0]}")/../lib" && pwd)"
# shellcheck source=lib/ci.sh
if ! source "$_ci_lib/ci.sh"; then
    echo "ERROR: failed to source $_ci_lib/ci.sh" >&2
    exit 2
fi
if [[ -z "${CI_PROJECT_ROOT:-}" ]]; then
    echo "ERROR: CI_PROJECT_ROOT not set after sourcing ci.sh" >&2
    exit 2
fi

_log() { printf '[bootstrap-uv] %s\n' "$*" >&2; }

main() {
    local target_dir target arch platform tarball url subdir
    target_dir="${CI_PROJECT_ROOT}/${CI_BOOT_NAME}/bin"
    target="${UV_BIN:-${target_dir}/uv}"

    if ! mkdir -p "$(dirname "$target")"; then
        _log "mkdir failed for $(dirname "$target")"
        return 1
    fi

    if [[ -x "$target" ]]; then
        local v_out v_err v_rc=0
        v_out="$(mktemp)"
        v_err="$(mktemp)"
        "$target" --version >"$v_out" 2>"$v_err" || v_rc=$?
        if [[ "$v_rc" -eq 0 ]]; then
            local cur
            cur="$(head -1 "$v_out")"
            rm -f "$v_out" "$v_err"
            if [[ "$cur" == *"${UV_VERSION}"* ]]; then
                _log "uv ${UV_VERSION} already at $target"
                return 0
            fi
            _log "found existing uv ($cur), upgrading to ${UV_VERSION}"
        else
            local err_msg
            err_msg="$(head -1 "$v_err")"
            rm -f "$v_out" "$v_err"
            _log "existing binary at $target did not respond to '--version'"
            _log "rc=$v_rc: $err_msg: re-downloading fresh copy"
        fi
    fi

    case "$(uname -m)" in
        x86_64|amd64)  arch="x86_64" ;;
        aarch64|arm64) arch="aarch64" ;;
        *) _log "unsupported arch: $(uname -m)"; return 1 ;;
    esac

    case "$(uname -s)" in
        Linux)  platform="unknown-linux-gnu" ;;
        Darwin) platform="apple-darwin" ;;
        *) _log "unsupported platform: $(uname -s)"; return 1 ;;
    esac

    tarball="uv-${arch}-${platform}.tar.gz"
    url="https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/${tarball}"
    # uv release tarballs extract into a subdir named uv-<arch>-<platform>.
    subdir="uv-${arch}-${platform}"

    local tmp
    tmp="$(mktemp -d)"
    # Use ${tmp:-} so the trap is safe under `set -u` once `tmp` (a local)
    # goes out of scope after main() returns.
    # shellcheck disable=SC2064
    trap "rm -rf \"\${tmp:-$tmp}\"" EXIT

    _log "fetching ${url}"
    local dl_rc=0
    curl -fsSL --retry 3 --retry-delay 2 -o "${tmp}/${tarball}" "$url" || dl_rc=$?
    if [[ "$dl_rc" -ne 0 ]]; then
        _log "curl failed for $url (rc=$dl_rc)"
        return 1
    fi

    # Mandatory SHA256 verification: fetch the .sha256 sidecar from the
    # same GitHub release URL as the tarball. The sidecar file contains
    # "<hash>  <filename>" -- we extract the hash and compare against
    # sha256sum of the downloaded tarball. No hardcoded hashes.
    local sha_url="${url}.sha256"
    _log "fetching checksum sidecar: ${sha_url}"
    local sha_rc=0
    curl -fsSL --retry 3 --retry-delay 2 -o "${tmp}/${tarball}.sha256" "$sha_url" || sha_rc=$?
    if [[ "$sha_rc" -ne 0 ]]; then
        _log "failed to fetch SHA256 sidecar from $sha_url (rc=$sha_rc)"
        _log "cannot verify tarball integrity without sidecar; refusing to install"
        return 1
    fi

    local expected_sha
    expected_sha="$(awk '{print $1}' "${tmp}/${tarball}.sha256")"
    if [[ -z "$expected_sha" ]]; then
        _log "SHA256 sidecar is empty or malformed; refusing to install"
        return 1
    fi

    local actual_sha
    actual_sha="$(ci_sha256 "${tmp}/${tarball}")"
    if [[ "$actual_sha" != "$expected_sha" ]]; then
        _log "checksum mismatch: expected $expected_sha, got $actual_sha"
        return 1
    fi
    _log "checksum OK ($expected_sha)"

    _log "extracting ${tarball} to ${tmp}"
    if ! tar -xzf "${tmp}/${tarball}" -C "$tmp"; then
        _log "tar extraction failed"
        return 1
    fi

    # Locate the uv binary inside the extracted subdir; fall back to the
    # archive root in case a future release flattens the layout.
    local uv_src="${tmp}/${subdir}/uv"
    if [[ ! -f "$uv_src" ]]; then
        uv_src="${tmp}/uv"
    fi
    if [[ ! -f "$uv_src" ]]; then
        _log "uv binary not found after extraction"
        _log "looked in ${subdir}/uv and at archive root of ${tmp}"
        return 1
    fi

    _log "installing uv to ${target}"
    if ! install -m 0755 "$uv_src" "$target"; then
        _log "install (copy) failed: $uv_src -> $target"
        return 1
    fi

    # Copy uvx if the release ships it (same subdir, then archive root).
    local uvx_src="${tmp}/${subdir}/uvx"
    if [[ ! -f "$uvx_src" ]]; then
        uvx_src="${tmp}/uvx"
    fi
    if [[ -f "$uvx_src" ]]; then
        local uvx_target
        uvx_target="$(dirname "$target")/uvx"
        if ! install -m 0755 "$uvx_src" "$uvx_target"; then
            _log "install (copy) of uvx failed: $uvx_src -> $uvx_target"
            return 1
        fi
        _log "uvx also installed to $uvx_target"
    fi

    local v_out2 v_err2 v_rc2=0
    v_out2="$(mktemp)"
    v_err2="$(mktemp)"
    "$target" --version >"$v_out2" 2>"$v_err2" || v_rc2=$?
    if [[ "$v_rc2" -ne 0 ]]; then
        _log "post-install verification failed: '$target --version' rc=$v_rc2"
        _log "stderr: $(head -1 "$v_err2")"
        rm -f "$v_out2" "$v_err2"
        return 1
    fi
    _log "installed: $(head -1 "$v_out2") => $target"
    rm -f "$v_out2" "$v_err2"
}

main "$@"

#!/usr/bin/env bash
# bootstrap-rust: bootstrap a $RUST_TOOLCHAIN Rust toolchain into CI's own
# $CI_BOOT_NAME/rust/ and create symlinks in $CI_BOOT_NAME/bin/.
#
# This project uses `rustc`/`cargo` for any native-Rust tooling. This script
# is idempotent: if $CI_PROJECT_ROOT/${boot_dir}/rust/bin/rustc AND cargo
# are already present and respond to `--version`, it refreshes symlinks and
# components, then exits 0 without reinstalling. If the existing toolchain
# is broken (rustc fails to report its version), it is removed and
# reinstalled from scratch.
#
# Default install location:
#   $CI_PROJECT_ROOT/$CI_BOOT_NAME/rust/
# with symlinks in:
#   $CI_PROJECT_ROOT/$CI_BOOT_NAME/bin/
# where $CI_BOOT_NAME is platform-aware (.boot-linux on Linux, .boot-macos
# on macOS), set at source-time by lib/ci.sh.
#
# Repo-private: does NOT touch $HOME/.rustup or $HOME/.cargo: the toolchain
# is fully isolated via RUSTUP_HOME / CARGO_HOME env exports pointing at
# $CI_BOOT_NAME/rust. Sibling repos reach these binaries via the boot-path
# resolver (lib/ci.sh::ci_resolve_boot_path) which reads
# moon.yml::project.inherited_boot_dirs.
#
# Reference spec: docs/specifications/SPEC-BOOT-LAYOUT.md
#
# Overrideable env vars:
#   $RUST_TOOLCHAIN : rustup toolchain channel to install (default: "stable").

set -euo pipefail

RUST_TOOLCHAIN="${RUST_TOOLCHAIN:-stable}"

_ci_lib="$(cd "$(dirname "${BASH_SOURCE[0]}")/../lib" && pwd)"
# shellcheck source=lib/ci.sh
if ! source "$_ci_lib/ci.sh"; then
    echo "ERROR: failed to source $_ci_lib/ci.sh" >&2
    exit 2
fi
if [[ -z "${CI_PROJECT_ROOT:-}" ]]; then
    echo "ERROR: CI_PROJECT_ROOT not set after sourcing ci.sh" >&2
    exit 2
fi

_log() { printf '[bootstrap-rust] %s\n' "$*" >&2; }

# _link_if_stale <target> <link>
#   Create the symlink only when missing or pointing elsewhere, so re-runs
#   against a root-locked bin dir are no-ops instead of Permission denied.
_link_if_stale() {
    local target="$1" link="$2"
    if [[ -L "$link" && "$(readlink "$link")" == "$target" ]]; then
        return 0
    fi
    ln -sf "$target" "$link"
}

# _create_symlinks <target_dir> <rust_home>
#   Mirror active-toolchain bin + llvm-tools-preview bin into ${target_dir}
#   via relative symlinks so the tree is relocatable.
_create_symlinks() {
    local _td="$1" _rh="$2"
    local tc_out tc_err tc_rc=0
    tc_out="$(mktemp)"; tc_err="$(mktemp)"
    "$_rh/bin/rustup" show active-toolchain >"$tc_out" 2>"$tc_err" || tc_rc=$?
    if [[ $tc_rc -ne 0 ]]; then
        _log "rustup show active-toolchain failed (rc=$tc_rc):"
        cat "$tc_err" >&2
        rm -f "$tc_out" "$tc_err"
        return 1
    fi
    local toolchain_name
    toolchain_name="$(awk 'NR==1{print $1}' "$tc_out")"
    rm -f "$tc_out" "$tc_err"
    if [[ -z "$toolchain_name" ]]; then
        # Reasonable default: rustup names toolchains <channel>-<host-triple>.
        local _rust_arch
        case "$(uname -m)" in
            x86_64|amd64) _rust_arch="x86_64" ;;
            aarch64|arm64) _rust_arch="aarch64" ;;
            *)             _rust_arch="$(uname -m)" ;;
        esac
        local _host_vendor
        case "$(uname -s)" in
            Linux)  _host_vendor="unknown-linux-gnu" ;;
            Darwin) _host_vendor="apple-darwin" ;;
            *)      _host_vendor="unknown-linux-gnu" ;;
        esac
        toolchain_name="${RUST_TOOLCHAIN}-${_rust_arch}-${_host_vendor}"
    fi

    local host_triple
    local _rust_arch
    case "$(uname -m)" in
        x86_64|amd64) _rust_arch="x86_64" ;;
        aarch64|arm64) _rust_arch="aarch64" ;;
        *)             _rust_arch="$(uname -m)" ;;
    esac
    case "$(uname -s)" in
        Linux)  host_triple="$_rust_arch-unknown-linux-gnu" ;;
        Darwin) host_triple="$_rust_arch-apple-darwin" ;;
        *)      host_triple="$_rust_arch-unknown-linux-gnu" ;;
    esac
    local toolchain_dir toolchain_bin toolchain_llvm_bin
    toolchain_dir="rust/toolchains/${toolchain_name}"
    toolchain_bin="${toolchain_dir}/bin"
    toolchain_llvm_bin="${toolchain_dir}/lib/rustlib/${host_triple}/bin"

    mkdir -p "$_td"
    _link_if_stale "../rust/bin/rustup" "${_td}/rustup"

    local bin
    for bin in cargo rustc rustfmt cargo-clippy cargo-fmt \
               clippy-driver rustdoc; do
        if [[ -x "${CI_PROJECT_ROOT}/${CI_BOOT_NAME}/${toolchain_bin}/${bin}" ]]; then
            _link_if_stale "../${toolchain_bin}/${bin}" "${_td}/${bin}"
        fi
    done

    local llvm_dir="${CI_PROJECT_ROOT}/${CI_BOOT_NAME}/${toolchain_llvm_bin}"
    if [[ -d "$llvm_dir" ]]; then
        local entry bin_name
        for entry in "$llvm_dir"/*; do
            [[ -d "$entry" ]] && continue
            [[ -x "$entry" ]] || continue
            bin_name="$(basename "$entry")"
            _link_if_stale "../${toolchain_llvm_bin}/${bin_name}" "${_td}/${bin_name}"
        done
        _log "LLVM tool symlinks created"
    else
        _log "LLVM tools dir not found at ${toolchain_llvm_bin}; skipping"
    fi
    _log "Rust symlinks created in ${_td}"
}

# _install_components <target_dir> <rust_home>
#   Add the extra components the workspace relies on (coverage + source).
_install_components() {
    local _td="$1" _rh="$2"
    local c_out c_err c_rc=0
    c_out="$(mktemp)"; c_err="$(mktemp)"
    "$_rh/bin/rustup" component add llvm-tools-preview rust-src \
        >"$c_out" 2>"$c_err" || c_rc=$?
    if [[ $c_rc -ne 0 ]]; then
        _log "rustup component add failed (rc=$c_rc):"
        cat "$c_err" >&2
        rm -f "$c_out" "$c_err"
        return 1
    fi
    rm -f "$c_out" "$c_err"
    _log "components installed: llvm-tools-preview, rust-src"
}

main() {
    local target_dir rust_home
    target_dir="${CI_PROJECT_ROOT}/${CI_BOOT_NAME}/bin"
    rust_home="${CI_PROJECT_ROOT}/${CI_BOOT_NAME}/rust"

    mkdir -p "$target_dir"
    mkdir -p "$rust_home"

    # Isolate rustup/cargo state inside $CI_BOOT_NAME/rust (NOT $HOME).
    # Exported BEFORE the idempotency check so rustup proxies (rustc/cargo)
    # can resolve their home directory and find the active toolchain.
    export RUSTUP_HOME="$rust_home"
    export CARGO_HOME="$rust_home"

    # Idempotency: existing toolchain must actually respond to --version.
    if [[ -x "$rust_home/bin/rustc" && -x "$rust_home/bin/cargo" ]]; then
        local v_out v_err v_rc=0
        v_out="$(mktemp)"; v_err="$(mktemp)"
        "$rust_home/bin/rustc" --version >"$v_out" 2>"$v_err" || v_rc=$?
        if [[ $v_rc -eq 0 ]]; then
            _log "Rust already installed: $(head -1 "$v_out")"
            rm -f "$v_out" "$v_err"
            _create_symlinks "$target_dir" "$rust_home"
            _install_components "$target_dir" "$rust_home"
            return 0
        fi
        _log "toolchain broken (rc=$v_rc): $(head -1 "$v_err")"
        _log "removing $rust_home and reinstalling"
        rm -f "$v_out" "$v_err"
        rm -rf "$rust_home"
        mkdir -p "$rust_home"
    fi

    # Rust needs a C linker. Short-circuit AND of absent compilers is the
    # real check: `command -v` returning nonzero IS the signal, not a swallow.
    if ! command -v cc && ! command -v gcc && ! command -v clang; then
        _log "no C compiler (cc/gcc/clang) found: required by Rust toolchain"
        return 1
    fi

    local tmp
    tmp="$(mktemp -d)"
    # Use ${tmp:-} so the trap is safe under `set -u` once `tmp` (a local)
    # goes out of scope after main() returns.
    # shellcheck disable=SC2064
    trap "rm -rf \"\${tmp:-$tmp}\"" EXIT

    local rustup_url="https://sh.rustup.rs"
    _log "fetching $rustup_url"
    local dl_rc=0
    curl -fsSL --retry 3 --retry-delay 2 \
        -o "$tmp/rustup-init.sh" "$rustup_url" || dl_rc=$?
    if [[ $dl_rc -ne 0 ]]; then
        _log "curl failed (rc=$dl_rc): $rustup_url"
        return 1
    fi

    _log "running rustup-init (toolchain=$RUST_TOOLCHAIN)"
    local ru_out ru_err ru_rc=0
    ru_out="$(mktemp)"; ru_err="$(mktemp)"
    bash "$tmp/rustup-init.sh" -y --no-modify-path \
        --default-toolchain "$RUST_TOOLCHAIN" >"$ru_out" 2>"$ru_err" \
        || ru_rc=$?
    if [[ $ru_rc -ne 0 ]]; then
        _log "rustup-init failed (rc=$ru_rc):"
        cat "$ru_err" >&2
        rm -f "$ru_out" "$ru_err"
        return 1
    fi
    rm -f "$ru_out" "$ru_err"

    # Post-install verify: both binaries must exist and answer --version.
    local p_out p_err p_rc=0
    p_out="$(mktemp)"; p_err="$(mktemp)"
    if [[ ! -x "$rust_home/bin/rustc" ]]; then
        _log "rustc not found after install: $rust_home/bin/rustc"
        rm -f "$p_out" "$p_err"
        return 1
    fi
    "$rust_home/bin/rustc" --version >"$p_out" 2>"$p_err" || p_rc=$?
    if [[ $p_rc -ne 0 ]]; then
        _log "rustc --version failed (rc=$p_rc): $(head -1 "$p_err")"
        rm -f "$p_out" "$p_err"
        return 1
    fi
    _log "rustc: $(head -1 "$p_out")"
    : >"$p_out"; p_rc=0
    if [[ ! -x "$rust_home/bin/cargo" ]]; then
        _log "cargo not found after install: $rust_home/bin/cargo"
        rm -f "$p_out" "$p_err"
        return 1
    fi
    "$rust_home/bin/cargo" --version >"$p_out" 2>"$p_err" || p_rc=$?
    if [[ $p_rc -ne 0 ]]; then
        _log "cargo --version failed (rc=$p_rc): $(head -1 "$p_err")"
        rm -f "$p_out" "$p_err"
        return 1
    fi
    _log "cargo: $(head -1 "$p_out")"
    rm -f "$p_out" "$p_err"

    _create_symlinks "$target_dir" "$rust_home"
    _install_components "$target_dir" "$rust_home"
}

main "$@"

#!/usr/bin/env bash
# Bootstrap: Build and install capability-based workspace guard (git)
# Called from CI Makefile: lives in the CI repo, builds from sibling WORKSPACE-GUARD.
set -euo pipefail

_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
_CI_ROOT="$(cd "$_SCRIPT_DIR/.." && pwd)"
WORKSPACE_ROOT="$(cd "$_CI_ROOT/../.." && pwd)"

_guard_dir="$_CI_ROOT/../WORKSPACE-GUARD"

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
CYAN='\033[0;36m'; BOLD='\033[1m'; NC='\033[0m'
log_info()  { echo -e "${GREEN}[INFO]${NC} $*"; }
log_warn()  { echo -e "${YELLOW}[WARN]${NC} $*"; }
log_error() { echo -e "${RED}[ERROR]${NC} $*"; }

MODE="${1:-install-host-exec}"  # install-host-exec | check-host-exec | uninstall | purge-guard-state | build-only

_guard_removed_target_error() {
    local removed_target="$1" replacement="$2"
    log_error "make $removed_target is removed. Use: make $replacement"
    exit 1
}

divert_is_active() {
    dpkg-divert --list /usr/bin/git | grep -q 'git.distrib'
}

_has_chattr() {
    local _path=""
    _path="$(command -v chattr 2>&1)" && return 0
    return 1
}

_has_func() {
    local _func="$1" _out=""
    _out="$(declare -F "$_func" 2>&1)" && return 0
    return 1
}

guard_is_installed() {
    [[ -f /usr/bin/git.original ]] \
        || divert_is_active \
        || [[ -f /usr/lib/workspace-guard/deployment-class ]]
}

_restore_stock_git() {
    if _has_chattr; then
        test -f /usr/bin/git       && chattr -i /usr/bin/git
        test -f /usr/bin/git.original && chattr -i /usr/bin/git.original
    fi
    rm -f /usr/bin/git
    if divert_is_active; then
        dpkg-divert --rename --remove /usr/bin/git
        log_info "Removed dpkg-divert"
    fi
    if [[ -f /usr/bin/git.original ]]; then
        mv /usr/bin/git.original /usr/bin/git
        chown root:root /usr/bin/git
        chmod 0755 /usr/bin/git
        _guard_best_effort setcap -r /usr/bin/git
        log_info "Restored /usr/bin/git from git.original"
    elif [[ -f /usr/bin/git.distrib ]]; then
        mv /usr/bin/git.distrib /usr/bin/git
        chown root:root /usr/bin/git
        chmod 0755 /usr/bin/git
        _guard_best_effort setcap -r /usr/bin/git
        log_info "Restored /usr/bin/git from git.distrib"
    else
        log_error "No git backup found: cannot restore"
        log_error "Reinstall git: sudo apt install --reinstall git"
        return 1
    fi
    return 0
}

_cleanup_git_guard_sidecars() {
    if _has_func guard_scrub_pam_artifacts; then
        guard_scrub_pam_artifacts || {
            local _scrub_rc=$?
            printf 'guard optional scrub failed (rc=%s)\n' "$_scrub_rc" >&2
        }
    fi
    rm -f /etc/apt/apt.conf.d/99workspace-guard
    rm -f /etc/apt/apt.conf.d/99git-guard
    if _has_func guard_remove_git_install_artifacts; then
        guard_remove_git_install_artifacts
    fi
    rm -rf /usr/lib/ami-git-guard
    rm -rf /var/log/workspace-guard
    rm -rf /var/log/ami-git-guard
}

uninstall_guard() {
    local state_dir="/usr/lib/workspace-guard"
    if _has_func guard_state_dir; then
        state_dir="$(guard_state_dir)"
    fi
    log_info "Uninstalling git guard (preserving host provision state under $state_dir)..."
    if ! guard_is_installed; then
        log_info "Git guard not installed; removing git-install artifacts only"
        if _has_chattr; then
            [[ -f /usr/bin/git ]] && _guard_best_effort chattr -i /usr/bin/git
            [[ -f /usr/bin/git.original ]] && _guard_best_effort chattr -i /usr/bin/git.original
        fi
        _cleanup_git_guard_sidecars
        if [[ -x /usr/bin/git ]]; then
            _guard_best_effort setcap -r /usr/bin/git
        fi
        log_info "Cleanup complete (provision state preserved)"
        git --version
        return 0
    fi
    _restore_stock_git || return 1
    _cleanup_git_guard_sidecars
    log_info "Git guard uninstalled: stock /usr/bin/git restored; provision state preserved"
    git --version
}

rollback_guard() {
    log_warn "Installation failed: rolling back..."
    if _has_chattr; then
        if [[ -f /usr/bin/git ]]; then
            rc=0; chattr -i /usr/bin/git || rc=$?
            if [ $rc -ne 0 ]; then
                echo "chattr -i /usr/bin/git: no-op or failed (rc=$rc)" >&2
            fi
        fi
        if [[ -f /usr/bin/git.original ]]; then
            rc=0; chattr -i /usr/bin/git.original || rc=$?
            if [ $rc -ne 0 ]; then
                echo "chattr -i /usr/bin/git.original: no-op or failed (rc=$rc)" >&2
            fi
        fi
    fi
    rm -f /usr/bin/git
    if divert_is_active; then
        rc=0; dpkg-divert --rename --remove /usr/bin/git || rc=$?
        if [ $rc -ne 0 ]; then
            echo "dpkg-divert --remove /usr/bin/git: no-op or failed (rc=$rc)" >&2
        fi
    fi
    if [[ -f /usr/bin/git.original ]]; then
        if _has_chattr; then
            rc=0; chattr -i /usr/bin/git.original || rc=$?
            if [ $rc -ne 0 ]; then
                echo "chattr -i /usr/bin/git.original: no-op or failed (rc=$rc)" >&2
            fi
        fi
        mv /usr/bin/git.original /usr/bin/git
        chown root:root /usr/bin/git
        chmod 0755 /usr/bin/git
        _guard_best_effort setcap -r /usr/bin/git
        log_info "Restored /usr/bin/git from git.original"
    elif [[ -f /usr/bin/git.distrib ]]; then
        mv /usr/bin/git.distrib /usr/bin/git
        chown root:root /usr/bin/git
        chmod 0755 /usr/bin/git
        _guard_best_effort setcap -r /usr/bin/git
        log_info "Restored /usr/bin/git from git.distrib"
    fi
    rm -f /etc/apt/apt.conf.d/99workspace-guard
    if _has_func guard_remove_git_install_artifacts; then
        guard_remove_git_install_artifacts
    else
        rm -rf /usr/lib/workspace-guard
    fi
}

_run_guard_install_with_drift_check() {
    local guard_bin="${1:-}"
    if [[ -z "$guard_bin" ]]; then
        guard_bin="$(_resolve_guard_bin)" || {
            log_error "Guard binary not found; run make build-guard first"
            return 1
        }
    fi
    local -a _drift=()
    if [[ "${GUARD_FORCE_RECONCILE:-}" == "1" ]]; then
        log_info "GUARD_FORCE_RECONCILE=1: reconciling regardless of drift status"
        export GUARD_RECONCILE=1
    else
        _guard_read_lines _drift guard_install_drift_reasons "$guard_bin"
        if [[ ${#_drift[@]} -eq 0 ]]; then
            log_info "Git guard healthy; nothing to do."
            return 0
        fi
        log_warn "Git guard drift detected; reconciling:"
        printf '  - %s\n' "${_drift[@]}"
        export GUARD_RECONCILE=1
    fi
    install_guard_binary "$guard_bin" || return 1
}

# Source the build and install helpers from lib/. These were extracted
# from this file to keep it under the 512-line source-length gate
# (AGENTS.md Rule 4). The helpers depend on globals defined above
# (WORKSPACE_ROOT, _CI_ROOT, _guard_dir, CYAN, BOLD, RED, NC, log_*,
# divert_is_active, rollback_guard) and inherit `set -euo pipefail`.
# Use `source ... || exit 1` per AGENTS.md Rule 14 (no bare source).
# shellcheck source=lib/guard-build.sh
source "$_CI_ROOT/lib/guard-build.sh" || exit 1
# shellcheck source=lib/guard-drift.sh
source "$_CI_ROOT/lib/guard-drift.sh" || exit 1
# shellcheck source=lib/guard-host-exec.sh
source "$_CI_ROOT/lib/guard-host-exec.sh" || exit 1
# shellcheck source=lib/guard-install.sh
source "$_CI_ROOT/lib/guard-install.sh" || exit 1

install_guard() {
    build_guard_binary || return 1
    _run_guard_install_with_drift_check "$GUARD_BIN" || return 1
}

check_guard() {
    local ref_bin=""
    ref_bin="$(_guard_capture_line _resolve_guard_bin)"
    local -a _drift=()
    _guard_read_lines _drift guard_install_drift_reasons "$ref_bin"

    if [[ ${#_drift[@]} -eq 0 ]]; then
        log_info "Rust guard status: HEALTHY"
        if [[ -f /usr/bin/git ]]; then
            log_info "  /usr/bin/git: $(stat -c '%a %U:%G' /usr/bin/git)"
        fi
        if [[ -f /usr/bin/git.original ]]; then
            log_info "  /usr/bin/git.original: $(stat -c '%a %U:%G' /usr/bin/git.original)"
        fi
        local _mode _cls
        _mode="$(_guard_reference_mode "$ref_bin")"
        _cls="$(_guard_capture_line guard_read_deployment_class)"
        log_info "  mode: $_mode"
        [[ -n "$_cls" ]] && log_info "  deployment-class: $_cls"
        return 0
    fi

    if [[ "${_drift[0]}" == "guard not installed:"* ]]; then
        log_info "Rust guard status: NOT INSTALLED"
    else
        log_info "Rust guard status: DRIFTED"
    fi
    log_warn "Drift items:"
    printf '  - %s\n' "${_drift[@]}"
    log_info "Fix: sudo make guard-refresh"
}

case "$MODE" in
    uninstall) uninstall_guard ;;
    purge-guard-state) purge_guard_state ;;
    check-host-exec) check_guard ;;
    check) _guard_removed_target_error check-guard check-guard-host-exec ;;
    build-only) build_guard_binary ;;
    install-host-exec)
        GUARD_BIN="$(_resolve_guard_bin)" || {
            log_error "Guard binary not found; make build-guard should run first"
            exit 1
        }
        _run_guard_install_with_drift_check "$GUARD_BIN"
        ;;
    install-only|install|reinstall)
        _guard_removed_target_error install-guard install-guard-host-exec
        ;;
    *) log_error "Unknown mode: $MODE"; exit 1 ;;
esac

#!/usr/bin/env bash
# audit-workspace -- Discover all git repos under a root and report status.
# Reports: working tree state, remote sync, CI integration level.
#
# Usage: audit-workspace [ROOT]
set -euo pipefail

_SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
_CI_ROOT="$(cd "$_SCRIPT_DIR/.." && pwd)"
if ! source "$_CI_ROOT/lib/ci.sh"; then
    echo "ERROR: failed to source $_CI_ROOT/lib/ci.sh" >&2
    exit 2
fi

# Capture stdout of <cmd...>, fall back to <default> string on failure.
# stderr is captured to a temp file and printed only on failure (real signal,
# no swallow). Use for UI display strings where a command failure should
# degrade to a static default rather than abort the audit.
_capture_or_default() {
    local default="$1"; shift
    local out err rc=0
    out="$(mktemp)"; err="$(mktemp)"
    "$@" >"$out" 2>"$err" || rc=$?
    if [[ $rc -ne 0 ]]; then
        if [[ -s "$err" ]]; then
            printf '[audit-workspace] %s (rc=%d): %s\n' "$*" "$rc" \
                "$(head -1 "$err")" >&2
        fi
        printf '%s' "$default"
    else
        cat "$out"
    fi
    rm -f "$out" "$err"
}

_ROOT="${1:-$(git rev-parse --show-toplevel || pwd)}"
_ROOT="$(cd "$_ROOT" && pwd)"

# Skip patterns for repo discovery
_SKIP_DIRS="tmp|node_modules|\.venv|__pycache__|research|python-ta-reference|\.boot-linux|\.boot-macos|dist|build"

# Load blocked patterns for L4 check
_blocked_combined=""
_blocked_config="$CI_CONFIG_DIR/blocked_commit_patterns.yaml"
if [[ -f "$_blocked_config" ]]; then
    while IFS= read -r _line; do
        if [[ "$_line" =~ pattern:[[:space:]]*[\"\']?(.+)[\"\']?$ ]]; then
            _pat="${BASH_REMATCH[1]}"
            _pat="${_pat%\"}" ; _pat="${_pat%\'}"
            _pat="${_pat#\"}" ; _pat="${_pat#\'}"
            [[ -n "$_blocked_combined" ]] && _blocked_combined="${_blocked_combined}|"
            _blocked_combined="${_blocked_combined}${_pat}"
        fi
    done < "$_blocked_config"
fi

# -- Discover repos --
_repos=()
_gitdirs=()
ci_capture_pipe _gitdirs 'find "$1" -name ".git" -type d | sort' "$_ROOT"
for _gitdir in "${_gitdirs[@]}"; do
    _repo="$(dirname "$_gitdir")"
    # Skip matches
    if echo "$_repo" | grep -qE "$_SKIP_DIRS"; then
        continue
    fi
    _repos+=("$_repo")
done


if [[ ${#_repos[@]} -eq 0 ]]; then
    ci_warn "No git repos found under $_ROOT"
    exit 0
fi

_total_repos=${#_repos[@]}
_fully_integrated=0
_total_score=0
_max_possible=0

# -- Helper: relative time --
_age() {
    local ts="$1"
    local now
    now="$(date +%s)"
    local diff=$(( now - ts ))
    if [[ $diff -lt 3600 ]]; then
        echo "$((diff / 60))m ago"
    elif [[ $diff -lt 86400 ]]; then
        echo "$((diff / 3600))h ago"
    else
        echo "$((diff / 86400))d ago"
    fi
}

# -- Audit each repo --
for _repo in "${_repos[@]}"; do
    _rel="${_repo#"$_ROOT"/}"
    [[ "$_repo" == "$_ROOT" ]] && _rel="(root)"

    echo ""
    ci_info "=== $_rel ==="

    # 1. Identity
    _branch="$(_capture_or_default "detached" git -C "$_repo" rev-parse --abbrev-ref HEAD)"
    _last_hash="$(_capture_or_default "none" git -C "$_repo" log -1 --format=%h)"
    _last_subj="$(_capture_or_default "" git -C "$_repo" log -1 --format=%s)"
    _last_ts="$(_capture_or_default "0" git -C "$_repo" log -1 --format=%at)"
    _last_age="$(_age "$_last_ts")"
    echo "Branch: $_branch | Last: $_last_hash ${_last_subj:0:60} ($_last_age)"

    # 2. Working tree
    _unstaged="$(git -C "$_repo" diff --name-only | wc -l | tr -d ' ')"
    _staged="$(git -C "$_repo" diff --cached --name-only | wc -l | tr -d ' ')"
    _untracked="$(git -C "$_repo" ls-files --others --exclude-standard | wc -l | tr -d ' ')"
    _stash="$(git -C "$_repo" stash list | wc -l | tr -d ' ')"
    if [[ $_unstaged -eq 0 && $_staged -eq 0 && $_untracked -eq 0 ]]; then
        echo "Tree:   clean"
    else
        echo "Tree:   dirty (unstaged:$_unstaged staged:$_staged untracked:$_untracked stash:$_stash)"
    fi

    # 3. Remote sync
    _rc_remotes=0
    _remotes="$(git -C "$_repo" remote)" || _rc_remotes=$?
    if [[ -z "$_remotes" ]]; then
        echo "Remotes: none"
    else
        echo "Remotes:"
        while IFS= read -r _remote; do
            _url="$(_capture_or_default "?" git -C "$_repo" remote get-url "$_remote")"
            _tracking="$(_capture_or_default "" git -C "$_repo" rev-parse --abbrev-ref "$_branch@{upstream}")"
            if [[ -z "$_tracking" || "$_tracking" == *"@{upstream}"* ]]; then
                printf "  %-8s (%s) : no tracking branch\n" "$_remote" "$_url"
                continue
            fi
            _ahead="$(_capture_or_default "?" git -C "$_repo" rev-list --count "$_tracking..HEAD")"
            _behind="$(_capture_or_default "?" git -C "$_repo" rev-list --count "HEAD..$_tracking")"
            if [[ "$_ahead" == "0" && "$_behind" == "0" ]]; then
                _sync="up-to-date"
            elif [[ "$_ahead" != "0" && "$_behind" != "0" ]]; then
                _sync="DIVERGED (ahead $_ahead, behind $_behind)"
            elif [[ "$_ahead" != "0" ]]; then
                _sync="ahead $_ahead"
            else
                _sync="behind $_behind"
            fi
            printf "  %-8s (%s) : %s\n" "$_remote" "$_url" "$_sync"
        done <<< "$_remotes"
    fi

    # 4. CI Integration
    _score=0
    _max=7
    _max_possible=$((_max_possible + _max))
    _checks=()

    # L0: Config
    if [[ -f "$_repo/.pre-commit-config.yaml" ]]; then
        _checks+=("[x] L0: .pre-commit-config.yaml")
        _score=$((_score + 1))
    else
        _checks+=("[ ] L0: .pre-commit-config.yaml (missing)")
    fi

    # L1: Native hooks
    if [[ -f "$_repo/.git/hooks/pre-commit" ]] && grep -q 'generate-hooks\|ci\.sh' "$_repo/.git/hooks/pre-commit"; then
        _checks+=("[x] L1: Native hooks installed")
        _score=$((_score + 1))
    elif [[ -f "$_repo/.git/hooks/pre-commit" ]]; then
        _checks+=("[ ] L1: Native hooks (pre-commit exists but not CI-generated)")
    else
        _checks+=("[ ] L1: Native hooks (not installed)")
    fi

    # L2: Makefile migrated
    if [[ -f "$_repo/Makefile" ]] && grep -q 'generate-hooks' "$_repo/Makefile"; then
        _checks+=("[x] L2: Makefile migrated")
        _score=$((_score + 1))
    elif [[ -f "$_repo/Makefile" ]] && grep -q 'pre-commit install' "$_repo/Makefile"; then
        _checks+=("[ ] L2: Makefile (still uses pre-commit install)")
    elif [[ -f "$_repo/Makefile" ]]; then
        _checks+=("[ ] L2: Makefile (no hooks target)")
    else
        _checks+=("[ ] L2: Makefile (no Makefile)")
    fi

    # L3: Commit msg enforced
    if [[ -f "$_repo/.pre-commit-config.yaml" ]] && grep -q 'check-commit-message\|ci_check_commit_message' "$_repo/.pre-commit-config.yaml"; then
        _checks+=("[x] L3: Commit message format enforced")
        _score=$((_score + 1))
    else
        _checks+=("[ ] L3: Commit message format (not configured)")
    fi

    # L4: History clean
    if [[ -n "$_blocked_combined" ]]; then
        _rc_blocked=0
        _violations="$(git -C "$_repo" log --format=%B HEAD | grep -ciE "$_blocked_combined")" || _rc_blocked=$?
        if [[ "$_violations" -eq 0 ]]; then
            _checks+=("[x] L4: History clean")
            _score=$((_score + 1))
        else
            _checks+=("[ ] L4: History clean ($_violations blocked pattern(s) found)")
        fi
    else
        _checks+=("[ ] L4: History clean (no blocked patterns config)")
    fi

    # L5: Pre-push hooks
    if [[ -f "$_repo/.git/hooks/pre-push" ]] && grep -q 'generate-hooks\|ci\.sh' "$_repo/.git/hooks/pre-push"; then
        _checks+=("[x] L5: Pre-push hooks")
        _score=$((_score + 1))
    else
        _checks+=("[ ] L5: Pre-push hooks (not installed)")
    fi

    # L6: Test suite on push
    if [[ -f "$_repo/.pre-commit-config.yaml" ]] && grep -q 'run-tests\|ci-check-push\|verify-coverage' "$_repo/.pre-commit-config.yaml"; then
        _checks+=("[x] L6: Test suite on push")
        _score=$((_score + 1))
    else
        _checks+=("[ ] L6: Test suite on push (not configured)")
    fi

    echo ""
    echo "CI Integration: $_score/$_max"
    for _c in "${_checks[@]}"; do
        echo "  $_c"
    done

    _total_score=$((_total_score + _score))
    [[ $_score -eq $_max ]] && _fully_integrated=$((_fully_integrated + 1))
done

# -- Summary --
echo ""
echo "==========================================="
ci_info "Workspace: $_ROOT"
echo "Repos: $_total_repos | Fully integrated: $_fully_integrated/$_total_repos | Score: $_total_score/$_max_possible"
echo "==========================================="

if [[ $_fully_integrated -lt $_total_repos ]]; then
    exit 1
fi
exit 0