#!/usr/bin/env bash
#
# DCENT_OS fast pre-commit verification gate.
#
# Runs the blocking behavior, signing and storage safety tier before a commit.
# The comprehensive docs, registry and receipt checks remain in make verify.

set -euo pipefail

REPO_ROOT="$(git rev-parse --show-toplevel)"
DCENTOS_DIR="$REPO_ROOT/projects/dcentos"
STAGED_FILES="$(git diff --cached --name-only --diff-filter=ACMR || true)"
GIT_LOCAL_ENV="$(git rev-parse --local-env-vars)"

if [ ! -f "$DCENTOS_DIR/scripts/ci_offline_gates.sh" ]; then
    echo "pre-commit: ERROR - DCENT_OS offline gate script missing." >&2
    exit 1
fi

reject_staged_repo_hygiene_violations() {
    if [ -z "$STAGED_FILES" ]; then
        return 0
    fi

    bad_paths="$(
        printf '%s\n' "$STAGED_FILES" \
            | grep -E '^(tmp|node_modules|target)(/|$)|^[^/]*;C(/|$)' \
            || true
    )"

    if [ -n "$bad_paths" ]; then
        echo "pre-commit: ERROR - refusing to stage disposable root artifacts:" >&2
        printf '%s\n' "$bad_paths" >&2
        echo "pre-commit: root tmp/, node_modules/, target/, and *;C/ artifact dirs are not durable source." >&2
        exit 1
    fi
}

reject_staged_repo_hygiene_violations

if [ "${DCENT_SKIP_VERIFY:-0}" = "1" ]; then
    echo "pre-commit: DCENT_SKIP_VERIFY=1 - skipping fast DCENT_OS gates after staged-path hygiene." >&2
    exit 0
fi

run_blocking_gates() {
    case "$(uname -s 2>/dev/null || echo unknown)" in
        MINGW*|MSYS*|CYGWIN*)
            if command -v wsl.exe >/dev/null 2>&1; then
                if command -v cygpath >/dev/null 2>&1; then
                    repo_win="$(cygpath -w "$REPO_ROOT")"
                else
                    repo_win="$REPO_ROOT"
                fi
                repo_wsl="$(MSYS_NO_PATHCONV=1 wsl.exe wslpath -a "$repo_win" | tr -d '\r')"
                MSYS_NO_PATHCONV=1 wsl.exe -e bash -lc 'cd "$1" && flock --close /tmp/dcent-heavy.lock bash projects/dcentos/scripts/ci_offline_gates.sh --blocking' _ "$repo_wsl"
                return
            fi
            ;;
    esac

    (
    while IFS= read -r name; do
        [ -n "$name" ] && unset "$name"
    done <<EOF
$GIT_LOCAL_ENV
EOF
    # Signing fixtures compile tiny production ELF images. Serialize them with
    # the workspace's heavier Cargo jobs; children never acquire this lock.
    flock --close /tmp/dcent-heavy.lock bash "$DCENTOS_DIR/scripts/ci_offline_gates.sh" --blocking
    )
}

echo "pre-commit: running DCENT_OS blocking offline gates..." >&2
run_blocking_gates

echo "pre-commit: fast gates passed." >&2
