#!/bin/sh

case "${1-}" in --devlab-clean-worker) shift ;; esac
/usr/bin/env -i PATH=/usr/bin:/bin /bin/bash --noprofile --norc -s -- "$@" <<'DEVLAB_BASH_WORKER'
# DEVLAB_BASH_WORKER_BEGIN
set -euo pipefail

if [[ "$#" -ne 1 ]]; then
  printf 'usage: check-linux.sh DEV_LAB_DIR\n' >&2
  exit 64
fi

BASH_ENV=
ENV=
export BASH_ENV ENV

target="$1"
if [[ ! -d "$target" || -L "$target" ]]; then
  printf 'linux checkpoint directory not found or linked: %s\n' "$target" >&2
  exit 1
fi
logical_target="$(cd -- "$target" && pwd -L)" || exit 1
physical_target="$(cd -- "$target" && pwd -P)" || exit 1
if [[ "$logical_target" != "$physical_target" || "$physical_target" == / ]]; then
  printf 'linux checkpoint path must be physical and non-root: %s\n' "$target" >&2
  exit 1
fi
target="$physical_target"

fail() {
  printf 'linux checkpoint mismatch: %s\n' "$1" >&2
  exit 1
}
file_identity() {
  local identity
  if identity="$(LC_ALL=C stat -L -c '%d:%i' "$1" 2>/dev/null)"; then :; else
    identity="$(LC_ALL=C stat -L -f '%d:%i' "$1")" || return 1
  fi
  printf '%s' "$identity"
}
fd_matches_identity() {
  local fd_identity
  fd_identity="$(file_identity "$1")" || return 1
  [[ "$fd_identity" == "$2" || "$(/usr/bin/uname -s 2>/dev/null || /bin/uname -s)" == Darwin \
    && "${fd_identity##*:}" == "${2##*:}" ]]
}
require_directory() {
  local relative_path="$1"
  [[ -d "$target/$relative_path" && ! -L "$target/$relative_path" ]] || fail "$target/$relative_path"
  local identity_variable="${2:-}"
  if [[ -n "$identity_variable" ]]; then
    printf -v "$identity_variable" '%s' "$(file_identity "$target/$relative_path")"
  fi
}
require_file() {
  local relative_path="$1"
  local expected_mode="$2"
  local identity_variable="${3:-}"
  [[ -f "$target/$relative_path" && ! -L "$target/$relative_path" ]] || fail "$target/$relative_path"
  case "$expected_mode" in
    executable) [[ -x "$target/$relative_path" ]] || fail "$target/$relative_path" ;;
    non-executable)
      local mode_text
      mode_text="$(LC_ALL=C ls -ld "$target/$relative_path")"
      mode_text="${mode_text%% *}"
      [[ "$mode_text" != *[xstST]* ]] || fail "$target/$relative_path"
      ;;
  esac
  if [[ -n "$identity_variable" ]]; then
    printf -v "$identity_variable" '%s' "$(file_identity "$target/$relative_path")"
  fi
}
require_hash() {
  local relative_path="$1"
  local expected_hash="$2"
  local expected_identity="$3"
  local hash_output
  local validation_failed=0
  [[ -f "$target/$relative_path" && ! -L "$target/$relative_path" ]] || fail "$target/$relative_path"
  [[ "$(file_identity "$target/$relative_path")" == "$expected_identity" ]] || fail "$target/$relative_path"
  exec 9< "$target/$relative_path" || fail "$target/$relative_path"
  fd_matches_identity /dev/fd/9 "$expected_identity" || validation_failed=1
  if command -v sha256sum >/dev/null 2>&1; then
    hash_output="$(sha256sum -- /dev/fd/9)" || validation_failed=1
  elif command -v shasum >/dev/null 2>&1; then
    hash_output="$(shasum -a 256 -- /dev/fd/9)" || validation_failed=1
  else
    exec 9<&-
    fail "SHA-256 tool unavailable for $target/$relative_path"
  fi
  [[ -f "$target/$relative_path" && ! -L "$target/$relative_path" \
    && "$(file_identity "$target/$relative_path")" == "$expected_identity" ]] || validation_failed=1
  exec 9<&-
  [[ "$validation_failed" -eq 0 && "${hash_output%% *}" == "$expected_hash" ]] || fail "$target/$relative_path"
}
require_syntax() {
  local expected_identity="$1" relative_path="$2"
  local validation_failed=0
  [[ -f "$target/$relative_path" && ! -L "$target/$relative_path" \
    && "$(file_identity "$target/$relative_path")" == "$expected_identity" ]] || fail "$target/$relative_path"
  exec 9< "$target/$relative_path" || fail "$target/$relative_path"
  fd_matches_identity /dev/fd/9 "$expected_identity" || validation_failed=1
  if [[ "$relative_path" == scripts/health-check.sh ]]; then
    /usr/bin/awk '
      $0 == "# DEVLAB_BASH_WORKER_BEGIN" { if (section != 0) exit 2; section = 1; next }
      $0 == "# DEVLAB_BASH_WORKER_END" { if (section != 1) exit 2; section = 2; complete = 1; next }
      section == 1 { print }
      END { if (!complete) exit 2 }
    ' <&9 | BASH_ENV= ENV= /bin/bash --noprofile --norc -n || validation_failed=1
  else
    BASH_ENV= ENV= /bin/bash --noprofile --norc -n <&9 || validation_failed=1
  fi
  [[ -f "$target/$relative_path" && ! -L "$target/$relative_path" \
    && "$(file_identity "$target/$relative_path")" == "$expected_identity" ]] || validation_failed=1
  exec 9<&-
  [[ "$validation_failed" -eq 0 ]] || fail "$target/$relative_path"
}

target_identity="$(file_identity "$target")" || fail "$target"
expected_paths='README.md
config
config/bashrc.dev-lab
config/env.dev-lab
data
data/access.log
data/health-events.log
notes
notes/linux-notes.md
notes/shell-notes.md
output
output/health-report.txt
output/summary.txt
scripts
scripts/health-check.sh
scripts/permission-demo.sh
scripts/report.sh'
actual_paths="$(
  cd "$target"
  find . -mindepth 1 -print | sed 's#^\./##' | LC_ALL=C sort
)"
if [[ "$actual_paths" != "$expected_paths" ]]; then
  while IFS= read -r expected_path; do
    if ! printf '%s\n' "$actual_paths" | while IFS= read -r actual_path; do
      [[ "$actual_path" == "$expected_path" ]] && exit 0
    done; then
      printf 'linux checkpoint missing path: %s (%s)\n' "$expected_path" "$target" >&2
      exit 1
    fi
  done <<< "$expected_paths"
  while IFS= read -r actual_path; do
    if ! printf '%s\n' "$expected_paths" | while IFS= read -r expected_path; do
      [[ "$expected_path" == "$actual_path" ]] && exit 0
    done; then
      printf 'linux checkpoint unexpected path: %s (%s)\n' "$actual_path" "$target" >&2
      exit 1
    fi
  done <<< "$actual_paths"
  fail "$target"
fi

for relative_path in config data notes output scripts; do
  require_directory "$relative_path" "${relative_path}_identity"
done
for relative_path in \
  README.md \
  config/bashrc.dev-lab \
  config/env.dev-lab \
  data/access.log \
  data/health-events.log \
  notes/shell-notes.md \
  notes/linux-notes.md \
  output/summary.txt \
  output/health-report.txt; do
  identity_variable="${relative_path//[^a-zA-Z0-9]/_}_identity"
  require_file "$relative_path" non-executable "$identity_variable"
done
require_file scripts/report.sh executable scripts_report_sh_identity
require_file scripts/permission-demo.sh executable scripts_permission_demo_sh_identity
require_file scripts/health-check.sh executable scripts_health_check_sh_identity

require_hash README.md f35c009dec20278b5df50693da43c54ae4b8e228a173fcb9f59e1b3aea5a2dc5 "$README_md_identity"
require_hash config/bashrc.dev-lab 882ef7d9502cc5d8145c5f8b0321dbd17b0c7d431db9421cbe390f1f86e94e12 "$config_bashrc_dev_lab_identity"
require_hash config/env.dev-lab 00aec1c6d894bb334bef59a03fad5d6392f0a2c1e5517cb89b788c4ad72b390a "$config_env_dev_lab_identity"
require_hash data/access.log 1df6e34d28da0483cc1e62523acc777597ce3178a77d089bf7ffcabb4b0ab254 "$data_access_log_identity"
require_hash data/health-events.log fe0119bfe33a541d816c33740f38b32280896ffce54bd7841985c7b1e6bd06e5 "$data_health_events_log_identity"
require_hash notes/shell-notes.md d937ab49e62af7d2f5bbb92f457476afa2a9632a9d1c68135a30a98ffe9aed7d "$notes_shell_notes_md_identity"
require_hash notes/linux-notes.md e54276c7c8a2c2818aa48891030e31f7712fde6f5f42b70257c1a3e9582086dc "$notes_linux_notes_md_identity"
require_hash output/summary.txt fd45eca2af0f073a58b8a6291f64804b6e5eade93aa773c6d5e49832edd65591 "$output_summary_txt_identity"
require_hash output/health-report.txt 32c0404e72a9692ecac0a2877a98b8ae09fa90090c2af9dbdbc3c9da18a1cf1e "$output_health_report_txt_identity"
require_hash scripts/report.sh eb8bf1b36e7bd043f64665680b71d086a0a9aeb3c5b5a045fe2fb3e40bb52e37 "$scripts_report_sh_identity"
require_hash scripts/permission-demo.sh 3f54de46ae71a2b3af65bd3aeaf9c28bbf91409abc67c87f718c16c4961445e8 "$scripts_permission_demo_sh_identity"
require_hash scripts/health-check.sh 5fa78e594202c38e9004b65fe69c0281c509b00ad7c10b0c48cfd2b383720e4f "$scripts_health_check_sh_identity"

require_syntax "$config_bashrc_dev_lab_identity" config/bashrc.dev-lab
require_syntax "$scripts_report_sh_identity" scripts/report.sh
require_syntax "$scripts_permission_demo_sh_identity" scripts/permission-demo.sh
require_syntax "$scripts_health_check_sh_identity" scripts/health-check.sh

identity_finalization_boundary=1
[[ -d "$target" && ! -L "$target" && "$(file_identity "$target")" == "$target_identity" ]] || fail "$target"
for relative_path in config data notes output scripts; do
  identity_variable="${relative_path}_identity"
  [[ -d "$target/$relative_path" && ! -L "$target/$relative_path" \
    && "$(file_identity "$target/$relative_path")" == "${!identity_variable}" ]] || fail "$target/$relative_path"
done
while read -r expected_hash relative_path expected_mode syntax_class; do
  final_verification_boundary="$relative_path"
  identity_variable="${relative_path//[^a-zA-Z0-9]/_}_identity"
  require_file "$relative_path" "$expected_mode"
  require_hash "$relative_path" "$expected_hash" "${!identity_variable}"
  if [[ "$syntax_class" == syntax ]]; then
    require_syntax "${!identity_variable}" "$relative_path"
  fi
done <<'EXPECTED_FINAL_STATE'
f35c009dec20278b5df50693da43c54ae4b8e228a173fcb9f59e1b3aea5a2dc5 README.md non-executable plain
882ef7d9502cc5d8145c5f8b0321dbd17b0c7d431db9421cbe390f1f86e94e12 config/bashrc.dev-lab non-executable syntax
00aec1c6d894bb334bef59a03fad5d6392f0a2c1e5517cb89b788c4ad72b390a config/env.dev-lab non-executable plain
1df6e34d28da0483cc1e62523acc777597ce3178a77d089bf7ffcabb4b0ab254 data/access.log non-executable plain
fe0119bfe33a541d816c33740f38b32280896ffce54bd7841985c7b1e6bd06e5 data/health-events.log non-executable plain
d937ab49e62af7d2f5bbb92f457476afa2a9632a9d1c68135a30a98ffe9aed7d notes/shell-notes.md non-executable plain
e54276c7c8a2c2818aa48891030e31f7712fde6f5f42b70257c1a3e9582086dc notes/linux-notes.md non-executable plain
fd45eca2af0f073a58b8a6291f64804b6e5eade93aa773c6d5e49832edd65591 output/summary.txt non-executable plain
32c0404e72a9692ecac0a2877a98b8ae09fa90090c2af9dbdbc3c9da18a1cf1e output/health-report.txt non-executable plain
eb8bf1b36e7bd043f64665680b71d086a0a9aeb3c5b5a045fe2fb3e40bb52e37 scripts/report.sh executable syntax
3f54de46ae71a2b3af65bd3aeaf9c28bbf91409abc67c87f718c16c4961445e8 scripts/permission-demo.sh executable syntax
5fa78e594202c38e9004b65fe69c0281c509b00ad7c10b0c48cfd2b383720e4f scripts/health-check.sh executable syntax
EXPECTED_FINAL_STATE
[[ -d "$target" && ! -L "$target" && "$(file_identity "$target")" == "$target_identity" ]] || fail "$target"
for relative_path in config data notes output scripts; do
  identity_variable="${relative_path}_identity"
  [[ -d "$target/$relative_path" && ! -L "$target/$relative_path" \
    && "$(file_identity "$target/$relative_path")" == "${!identity_variable}" ]] || fail "$target/$relative_path"
done
printf 'linux checkpoint: ok\n'
# DEVLAB_BASH_WORKER_END
DEVLAB_BASH_WORKER