#!/usr/bin/env bash
set -euo pipefail

MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
backup_stamp="$(date +%Y%m%d%H%M%S)"

# ─── Install-ordering guard opt-out (#869 Point-1 C2) ───────────────────────
# Explicit, per-invocation CLI flag ONLY — deliberately NOT read from an
# environment variable, so it can never sit as a silently-inherited default in
# a shell profile or CI env. Absent (the default) => hard fail-loud path.
allow_inactive_enforcement=0
for arg in "$@"; do
  case "$arg" in
    --allow-inactive-enforcement) allow_inactive_enforcement=1 ;;
  esac
done

# Tracks whether the Claude settings install-ordering guard (below) reported a
# degraded (enforcement-not-wired) outcome, so this script's own exit status
# reflects it even though the rest of the runtime-asset sync must still run.
guard_degraded=0

copy_file_managed() {
  local src="$1"
  local dst="$2"

  mkdir -p "$(dirname "$dst")"

  if [[ -L "$dst" ]]; then
    rm -f "$dst"
  fi

  if [[ -f "$dst" ]]; then
    if cmp -s "$src" "$dst"; then
      return
    fi
    mv "$dst" "${dst}.mosaic-bak-${backup_stamp}"
  fi

  cp "$src" "$dst"
}

# ─── Install-ordering guard for settings.json (#869 Point-1 C2) ─────────────
#
# settings.json is where #828's enforcement hooks (PreToolUse mutator-gate.py,
# Stop receipt-observer-client.py) get wired unconditionally. Before copying
# it, delegate to `mosaic __link-claude-settings` (packages/mosaic/src/commands/
# install-ordering-guard.ts) so the wiring decision is made by importing the
# C1 activation probe (`leaseEnforcementActivatable()`) directly, rather than
# re-implementing the capability/supervisor checks in shell. That subcommand:
#   - activatable            -> writes settings.json with hooks intact, exits 0
#   - NOT activatable        -> writes settings.json with hooks STRIPPED,
#                                prints an actionable message, exits 1
#   - NOT activatable + opt-out -> writes settings.json with hooks intact,
#                                   prints a loud warning, exits 0
# The `mosaic` CLI is expected on PATH at this point ("No executables are
# placed on PATH — the mosaic npm CLI is the only binary", per install.sh).
# If it is not resolvable at all, that is itself strong evidence the
# activation half is absent, so the same fail-loud default applies via a
# minimal python3 fallback (this repo already depends on python3 for the
# lease broker itself).
copy_claude_settings_guarded() {
  local src="$1"
  local dst="$2"

  local guard_args=(__link-claude-settings "$src" "$dst")
  if [[ "$allow_inactive_enforcement" == "1" ]]; then
    guard_args+=(--allow-inactive-enforcement)
  fi

  if command -v mosaic >/dev/null 2>&1; then
    if mosaic "${guard_args[@]}"; then
      return 0
    fi
    echo "[mosaic-link] Enforcement hooks were NOT wired into $dst (see message above)." >&2
    guard_degraded=1
    return 0
  fi

  echo "[mosaic-link] ERROR: 'mosaic' CLI not found on PATH — cannot confirm lease-enforcement" >&2
  echo "[mosaic-link] activation capability. enforcement requested but activation half absent —" >&2
  echo "[mosaic-link] needs a published CLI carrying launch-runtime activation + a broker" >&2
  echo "[mosaic-link] supervisor; refusing to wire a dead gate (see #869)." >&2

  if [[ "$allow_inactive_enforcement" == "1" ]]; then
    echo "[mosaic-link] WARNING: --allow-inactive-enforcement set — wiring $dst AS-IS (with" >&2
    echo "[mosaic-link] enforcement hooks) despite being unable to confirm activation." >&2
    copy_file_managed "$src" "$dst"
    return 0
  fi

  mkdir -p "$(dirname "$dst")"
  if command -v python3 >/dev/null 2>&1; then
    python3 - "$src" "$dst" <<'PYEOF'
import json, sys

src, dest = sys.argv[1], sys.argv[2]
with open(src) as f:
    data = json.load(f)

hooks = data.get("hooks", {})

pre = hooks.get("PreToolUse", [])
hooks["PreToolUse"] = [
    t for t in pre
    if not any("mutator-gate.py" in h.get("command", "") for h in t.get("hooks", []))
]
if not hooks["PreToolUse"]:
    del hooks["PreToolUse"]

stop = hooks.get("Stop", [])
new_stop = []
for t in stop:
    kept = [h for h in t.get("hooks", []) if "receipt-observer-client.py" not in h.get("command", "")]
    if kept:
        t = dict(t)
        t["hooks"] = kept
        new_stop.append(t)
if new_stop:
    hooks["Stop"] = new_stop
elif "Stop" in hooks:
    del hooks["Stop"]

if hooks:
    data["hooks"] = hooks
else:
    data.pop("hooks", None)

with open(dest, "w") as f:
    json.dump(data, f, indent=2)
    f.write("\n")
PYEOF
  else
    cp "$src" "$dst"
  fi
  guard_degraded=1
  return 0
}

remove_legacy_path() {
  local p="$1"

  if [[ -L "$p" ]]; then
    rm -f "$p"
    return
  fi

  if [[ -d "$p" ]]; then
    find "$p" -depth -type l -delete 2>/dev/null || true
    find "$p" -depth -type d -empty -delete 2>/dev/null || true
    return
  fi

  # Remove stale symlinked files if present.
  if [[ -e "$p" && -L "$p" ]]; then
    rm -f "$p"
  fi
}

# Remove compatibility symlink surfaces for migrated content.
legacy_paths=(
  "$HOME/.claude/agent-guides"
  "$HOME/.claude/scripts/git"
  "$HOME/.claude/scripts/codex"
  "$HOME/.claude/scripts/bootstrap"
  "$HOME/.claude/scripts/cicd"
  "$HOME/.claude/scripts/portainer"
  "$HOME/.claude/scripts/debug-hook.sh"
  "$HOME/.claude/scripts/qa-hook-handler.sh"
  "$HOME/.claude/scripts/qa-hook-stdin.sh"
  "$HOME/.claude/scripts/qa-hook-wrapper.sh"
  "$HOME/.claude/scripts/qa-queue-monitor.sh"
  "$HOME/.claude/scripts/remediation-hook-handler.sh"
  "$HOME/.claude/templates"
  "$HOME/.claude/presets/domains"
  "$HOME/.claude/presets/tech-stacks"
  "$HOME/.claude/presets/workflows"
)

for p in "${legacy_paths[@]}"; do
  remove_legacy_path "$p"
done

# Claude-specific runtime files (settings, hooks — NOT CLAUDE.md which is now a thin pointer)
# When MOSAIC_SKIP_CLAUDE_HOOKS=1 is set (user declined hooks in the wizard
# preview stage), skip hooks-config.json but still copy the other runtime
# files so Claude still gets CLAUDE.md/settings.json/context7 guidance.
for runtime_file in \
  CLAUDE.md \
  settings.json \
  hooks-config.json \
  context7-integration.md; do
  if [[ "$runtime_file" == "hooks-config.json" ]] && [[ "${MOSAIC_SKIP_CLAUDE_HOOKS:-0}" == "1" ]]; then
    echo "[mosaic-link] Skipping hooks-config.json (user declined in wizard)"
    # An existing ~/.claude/hooks-config.json that we previously installed
    # is identified by one of:
    #   1. It's a symlink (legacy symlink-mode install)
    #   2. It contains the `mosaic-managed` marker string we embed in the
    #      template (survives template updates unlike byte-equality)
    #   3. It is byte-identical to the current Mosaic template (fallback
    #      for templates that pre-date the marker)
    # Anything else is user-owned and we must leave it alone.
    existing_hooks="$HOME/.claude/hooks-config.json"
    mosaic_hooks_src="$MOSAIC_HOME/runtime/claude/hooks-config.json"
    if [[ -L "$existing_hooks" ]]; then
      rm -f "$existing_hooks"
      echo "[mosaic-link] Removed previously-linked Mosaic hooks-config.json (was symlink)"
    elif [[ -f "$existing_hooks" ]]; then
      is_mosaic_managed=0
      if grep -q 'mosaic-managed' "$existing_hooks" 2>/dev/null; then
        is_mosaic_managed=1
      elif [[ -f "$mosaic_hooks_src" ]] && cmp -s "$existing_hooks" "$mosaic_hooks_src"; then
        is_mosaic_managed=1
      fi
      if [[ "$is_mosaic_managed" == "1" ]]; then
        mv "$existing_hooks" "${existing_hooks}.mosaic-bak-${backup_stamp}"
        echo "[mosaic-link] Removed previously-linked Mosaic hooks-config.json (backup at ${existing_hooks}.mosaic-bak-${backup_stamp})"
      else
        echo "[mosaic-link] Leaving existing non-Mosaic hooks-config.json in place"
      fi
    fi
    continue
  fi
  src="$MOSAIC_HOME/runtime/claude/$runtime_file"
  [[ -f "$src" ]] || continue
  if [[ "$runtime_file" == "settings.json" ]]; then
    # Install-ordering guard (#869 Point-1 C2): gate enforcement-hook wiring
    # on confirmed activation instead of the plain copy_file_managed used for
    # every other runtime file. See copy_claude_settings_guarded() above.
    copy_claude_settings_guarded "$src" "$HOME/.claude/$runtime_file"
    continue
  fi
  copy_file_managed "$src" "$HOME/.claude/$runtime_file"
done

# OpenCode runtime adapter (thin pointer to AGENTS.md)
opencode_adapter="$MOSAIC_HOME/runtime/opencode/AGENTS.md"
if [[ -f "$opencode_adapter" ]]; then
  copy_file_managed "$opencode_adapter" "$HOME/.config/opencode/AGENTS.md"
fi

# Codex runtime adapter (thin pointer to AGENTS.md)
codex_adapter="$MOSAIC_HOME/runtime/codex/instructions.md"
if [[ -f "$codex_adapter" ]]; then
  mkdir -p "$HOME/.codex"
  copy_file_managed "$codex_adapter" "$HOME/.codex/instructions.md"
fi

# Pi runtime settings (MCP + skills paths)
pi_settings_dir="$HOME/.pi/agent"
pi_settings_file="$pi_settings_dir/settings.json"
mkdir -p "$pi_settings_dir"

if [[ ! -f "$pi_settings_file" ]]; then
  echo '{}' > "$pi_settings_file"
fi

# Ensure Pi settings.json has Mosaic skills paths
mosaic_skills_path="$MOSAIC_HOME/skills"
mosaic_local_path="$MOSAIC_HOME/skills-local"
if ! grep -q "$mosaic_skills_path" "$pi_settings_file" 2>/dev/null; then
  if command -v python3 >/dev/null 2>&1; then
    python3 -c "
import json
with open('$pi_settings_file', 'r') as f:
    data = json.load(f)
skills = data.get('skills', [])
if not isinstance(skills, list):
    skills = []
for p in ['$mosaic_skills_path', '$mosaic_local_path']:
    if p not in skills:
        skills.append(p)
data['skills'] = skills
with open('$pi_settings_file', 'w') as f:
    json.dump(data, f, indent=2)
    f.write('\\n')
" 2>/dev/null
  fi
fi

# Pi extension is loaded via --extension flag in the mosaic launcher.
# Do NOT copy into ~/.pi/agent/extensions/ — that causes duplicate loading.

if [[ -x "$MOSAIC_HOME/tools/_scripts/mosaic-ensure-sequential-thinking" ]]; then
  "$MOSAIC_HOME/tools/_scripts/mosaic-ensure-sequential-thinking"
fi

echo "[mosaic-link] Runtime assets synced (non-symlink mode)"
echo "[mosaic-link] Canonical source: $MOSAIC_HOME"

# Propagate the install-ordering guard's outcome (#869 Point-1 C2): every
# other runtime asset above is best-effort/non-fatal, but a degraded
# (enforcement-not-wired) settings.json must make THIS script's own exit
# status non-zero so callers (framework/install.sh, finalize.ts) can surface
# it — never silently.
if [[ "$guard_degraded" == "1" ]]; then
  exit 1
fi