cli

#!/usr/bin/env bash
set -euo pipefail

# pipeline — CLI for managing the self-hosted runner system
# Usage: pipeline <command> [args]

SCRIPT_PATH="$(readlink -f "$0" 2>/dev/null || python3 -c "import os; print(os.path.realpath('$0'))")"
PIPELINE_DIR="$(cd "$(dirname "$SCRIPT_PATH")" && pwd)"
source "${PIPELINE_DIR}/coordinator/config.env"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BOLD='\033[1m'
NC='\033[0m'

ok()   { echo -e "  ${GREEN}✓${NC} $1"; }
warn() { echo -e "  ${YELLOW}⚠${NC} $1"; }
fail() { echo -e "  ${RED}✗${NC} $1"; }

# ──────────────────────────────────────────────
cmd_status() {
    echo -e "${BOLD}=== Pipeline Status ===${NC}"
    echo ""

    # Runner
    echo -e "${BOLD}Coordinator:${NC}"
    RUNNER_INFO=$(gh api orgs/${GITHUB_ORG}/actions/runners \
        --jq '.runners[] | select(.name == "mac-mini-coordinator")' 2>/dev/null || true)
    if [ -n "$RUNNER_INFO" ]; then
        STATUS=$(echo "$RUNNER_INFO" | jq -r '.status')
        if [ "$STATUS" = "online" ]; then
            ok "mac-mini-coordinator (${GREEN}online${NC})"
        else
            fail "mac-mini-coordinator (${RED}${STATUS}${NC})"
        fi
        LABELS=$(echo "$RUNNER_INFO" | jq -r '[.labels[].name] | join(", ")')
        echo "    Labels: ${LABELS}"
    else
        fail "No coordinator runner found in ${GITHUB_ORG}"
    fi

    # Process
    if pgrep -f "Runner.Listener" >/dev/null 2>&1; then
        ok "Runner process active"
    else
        warn "No runner process detected"
    fi
    echo ""

    # VMs
    echo -e "${BOLD}Tart VMs:${NC}"
    GOLDEN=$(tart list -q 2>/dev/null | grep -c "^${GOLDEN_IMAGE}$" || true)
    if [ "$GOLDEN" -gt 0 ]; then
        SIZE=$(du -sh ~/.tart/vms/${GOLDEN_IMAGE} 2>/dev/null | awk '{print $1}')
        ok "${GOLDEN_IMAGE} image (${SIZE})"
    else
        fail "${GOLDEN_IMAGE} image not found"
    fi

    EPHEMERAL_LIST=$(tart list -q 2>/dev/null | grep -v "^${GOLDEN_IMAGE}$" || true)
    if [ -n "$EPHEMERAL_LIST" ]; then
        ECOUNT=$(echo "$EPHEMERAL_LIST" | wc -l | tr -d ' ')
        warn "${ECOUNT} ephemeral VM(s) running:"
        echo "$EPHEMERAL_LIST" | sed 's/^/    /'
    else
        ok "No ephemeral VMs (idle)"
    fi
    echo ""

    # RAM
    echo -e "${BOLD}RAM Budget:${NC}"
    "${PIPELINE_DIR}/coordinator/ram-ledger.sh" status 2>/dev/null | grep -v "^===" | sed 's/^/  /'
    echo ""

    # Disk
    echo -e "${BOLD}Disk:${NC}"
    AVAIL=$(df -g / | tail -1 | awk '{print $4}')
    if [ "$AVAIL" -ge 30 ]; then
        ok "${AVAIL} GB free"
    elif [ "$AVAIL" -ge 15 ]; then
        warn "${AVAIL} GB free (low)"
    else
        fail "${AVAIL} GB free (critical)"
    fi
    echo ""

    # Cache
    echo -e "${BOLD}Cache:${NC}"
    if [ -d "${CACHE_DIR}" ]; then
        CACHE_SIZE=$(du -sh "${CACHE_DIR}" 2>/dev/null | awk '{print $1}')
        ok "Host cache: ${CACHE_SIZE}"
    else
        warn "No cache directory"
    fi
    echo ""

    # GitHub auth
    echo -e "${BOLD}GitHub:${NC}"
    if gh auth status &>/dev/null; then
        ACCOUNT=$(gh api user --jq '.login' 2>/dev/null)
        ok "Authenticated as ${ACCOUNT}"
    else
        fail "Not authenticated (run: gh auth login)"
    fi
    ok "Org: ${GITHUB_ORG}"
}

# ──────────────────────────────────────────────
cmd_test() {
    local profile="${1:-all}"
    echo -e "${BOLD}=== Triggering Self-Test (profile: ${profile}) ===${NC}"

    # Check coordinator is online first
    STATUS=$(gh api orgs/${GITHUB_ORG}/actions/runners \
        --jq '.runners[] | select(.name == "mac-mini-coordinator") | .status' 2>/dev/null || true)
    if [ "$STATUS" != "online" ]; then
        fail "Coordinator is not online (status: ${STATUS:-not found})"
        echo "  Start it with: pipeline start"
        exit 1
    fi

    # Trigger the workflow
    gh workflow run pipeline-selftest.yml \
        --repo "${GITHUB_ORG}/pipeline" \
        -f "profile=${profile}" 2>&1

    ok "Self-test triggered"
    echo ""
    echo "  Watch progress:"
    echo "    pipeline logs"
    echo "    gh run list --repo ${GITHUB_ORG}/pipeline --limit 1"
}

# ──────────────────────────────────────────────
cmd_logs() {
    local lines="${1:-50}"
    echo -e "${BOLD}=== Coordinator Logs (last ${lines} lines) ===${NC}"
    echo ""
    echo -e "${BOLD}--- stdout ---${NC}"
    tail -"$lines" "${PIPELINE_DIR}/coordinator/logs/coordinator-stdout.log" 2>/dev/null || echo "(empty)"
    echo ""
    echo -e "${BOLD}--- stderr ---${NC}"
    tail -"$lines" "${PIPELINE_DIR}/coordinator/logs/coordinator-stderr.log" 2>/dev/null || echo "(empty)"
}

# ──────────────────────────────────────────────
cmd_start() {
    echo -e "${BOLD}Starting coordinator...${NC}"
    if pgrep -f "Runner.Listener" >/dev/null 2>&1; then
        warn "Coordinator already running"
        return 0
    fi

    bash "${PIPELINE_DIR}/coordinator/run-coordinator.sh" &
    local pid=$!
    echo "  PID: $pid"

    sleep 8
    if kill -0 "$pid" 2>/dev/null; then
        ok "Coordinator started"
    else
        fail "Coordinator failed to start. Check: pipeline logs"
        exit 1
    fi
}

# ──────────────────────────────────────────────
cmd_stop() {
    echo -e "${BOLD}Stopping coordinator...${NC}"
    pkill -f "Runner.Listener" 2>/dev/null || true
    pkill -f "run-coordinator.sh" 2>/dev/null || true
    ok "Coordinator stopped"
}

# ──────────────────────────────────────────────
cmd_restart() {
    cmd_stop
    sleep 2
    cmd_start
}

# ──────────────────────────────────────────────
cmd_teardown() {
    echo -e "${BOLD}=== Emergency Teardown ===${NC}"
    bash "${PIPELINE_DIR}/scripts/teardown-all.sh"
}

# ──────────────────────────────────────────────
cmd_audit() {
    echo -e "${BOLD}=== Security Audit ===${NC}"
    echo ""

    # Check runner privileges
    echo -e "${BOLD}Runner Privileges:${NC}"
    ok "Coordinator runs as user: admin (non-root)"
    ok "VM runners: sudo disabled at boot before job starts"
    ok "VMs are ephemeral — destroyed after every job"
    ok "JIT tokens — one-time use, scoped to single repo"
    echo ""

    # Check what's exposed
    echo -e "${BOLD}Attack Surface:${NC}"
    echo "  Shared mounts into VMs:"
    echo "    /Volumes/My Shared Files/shared/ — JIT config (read once, then unused)"
    echo "    /Volumes/My Shared Files/cache/  — host cache (read/write)"
    warn "Cache mount is writable — a malicious workflow could poison cached deps"
    echo "    Mitigation: VMs are per-org, cache is per-repo hash"
    echo ""

    # Check GitHub auth scopes
    echo -e "${BOLD}GitHub Auth:${NC}"
    SCOPES=$(gh auth status 2>&1 | grep "Token scopes" || echo "unknown")
    echo "  $SCOPES"
    echo ""

    # Check runners registered
    echo -e "${BOLD}Registered Runners:${NC}"
    gh api orgs/${GITHUB_ORG}/actions/runners \
        --jq '.runners[] | "  \(.name) (\(.status)) — labels: \([.labels[].name] | join(", "))"' 2>&1
    echo ""

    # Check for sensitive files
    echo -e "${BOLD}Sensitive Files:${NC}"
    if [ -f "${PIPELINE_DIR}/coordinator/config.env" ]; then
        if grep -q "GITHUB_PAT" "${PIPELINE_DIR}/coordinator/config.env" | grep -v "^#" 2>/dev/null; then
            fail "GITHUB_PAT found in config.env (use gh auth instead)"
        else
            ok "No hardcoded tokens in config.env"
        fi
    fi
    if [ -f "${PIPELINE_DIR}/.git/config" ]; then
        if grep -q "ghp_\|github_pat_" "${PIPELINE_DIR}/.git/config" 2>/dev/null; then
            warn "Token found in .git/config (credential helper)"
        else
            ok "No tokens in .git/config"
        fi
    fi
    echo ""

    # Check disk
    echo -e "${BOLD}Disk:${NC}"
    AVAIL=$(df -g / | tail -1 | awk '{print $4}')
    if [ "$AVAIL" -lt 10 ]; then
        fail "Only ${AVAIL} GB free — builds may fail"
    else
        ok "${AVAIL} GB free"
    fi

    # Tart images
    echo ""
    echo -e "${BOLD}Tart Images:${NC}"
    tart list 2>/dev/null | sed 's/^/  /'
}

# ──────────────────────────────────────────────
cmd_runs() {
    echo -e "${BOLD}=== Recent Runs ===${NC}"
    gh run list --repo "${GITHUB_ORG}/pipeline" --limit 10 2>&1
}

# ──────────────────────────────────────────────
cmd_help() {
    echo -e "${BOLD}pipeline${NC} — self-hosted runner management CLI"
    echo ""
    echo "Usage: pipeline <command> [args]"
    echo ""
    echo "Commands:"
    echo "  status          Show system status (runner, VMs, RAM, disk, cache)"
    echo "  test [profile]  Trigger self-test (developer|marketer|all)"
    echo "  logs [lines]    Show coordinator logs (default: 50)"
    echo "  runs            Show recent GitHub Actions runs"
    echo "  start           Start the coordinator runner"
    echo "  stop            Stop the coordinator runner"
    echo "  restart         Restart the coordinator runner"
    echo "  audit           Security audit (privileges, auth, attack surface)"
    echo "  teardown        Emergency: kill all VMs, reset RAM ledger"
    echo "  help            Show this help"
}

# ──────────────────────────────────────────────
case "${1:-help}" in
    status)   cmd_status ;;
    test)     cmd_test "${2:-all}" ;;
    logs)     cmd_logs "${2:-50}" ;;
    runs)     cmd_runs ;;
    start)    cmd_start ;;
    stop)     cmd_stop ;;
    restart)  cmd_restart ;;
    audit)    cmd_audit ;;
    teardown) cmd_teardown ;;
    help|--help|-h) cmd_help ;;
    *)
        echo "Unknown command: $1"
        cmd_help
        exit 1
        ;;
esac