#!/bin/bash
# hardening-apply.sh — 自願套 patch 落 kit 嘅 watcher。
# **自動按基底揀家族**（兩個認可基底，A10 2026-10-06）：
#   v093 線：md5 1ca46931b51912e70094a161f3c06f25（canonical v0.93）
#   v094 線：md5 cb11d45f639722650e3ebe156897da51（新 live 線＝v0.93＋召回＋ARENA_PW）
# 用法：bash hardening-apply.sh [--display | --all]
#   預設       = hardening hunk（LOGS_DIR mkdir／bus rc／seats ≥5 欄）
#   --display  = 只有「DISPLAY 動態」（跟主持 8568）
#   --all      = 兩者一齊（單一合併 patch；**唔可以**先 hardening 再 display——兩個 patch 喺 log() 區會撞）
# 全部：備份 → patch -p0 --fuzz=0 → 驗 md5 → py_compile → 寫紀錄（verify-workshop.sh §1 會認）。
set -euo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
ARENA_HOME="${ARENA_HOME:-$HOME/workspace/arena-system}"
W="$HERE/scripts/watcher.py"
MD5_V093=1ca46931b51912e70094a161f3c06f25
MD5_V094=cb11d45f639722650e3ebe156897da51
# v093 線目標
V093_HARD=52208202b2654ff2e9bae5048e80347d
V093_DISP=7011c3fe443b01ed5478d27ecab1fb36
V093_BOTH=0edcda0bdb365dd2e1eacb30f30d680f
# v094 線目標（work_v4/live 家族，A10 實測）
V094_HARD=fb89906b189f331b0c3f33c9bbaa5e0c
V094_DISP=02e47043f057b16aa6e827abe8dc7482
V094_BOTH=18427ef9ff5e86032a66adaf8a8d0ea6
MODE=hardening
case "${1:-}" in
  "" ) MODE=hardening ;;
  --display ) MODE=display ;;
  --all ) MODE=all ;;
  * ) echo "用法：bash hardening-apply.sh [--display|--all]"; exit 2 ;;
esac
[ -f "$W" ] || { echo "❌ 冇 $W"; exit 1; }
M=$(md5sum "$W" | awk '{print $1}')
# 認得嘅「已套狀態」（唔准疊；要換模式就由基底一次過）
KNOWN_TARGETS="$V093_HARD $V093_DISP $V093_BOTH $V094_HARD $V094_DISP $V094_BOTH"
case "$MODE" in
  hardening) MODE_TARGETS="$V093_HARD $V094_HARD" ;;
  display)   MODE_TARGETS="$V093_DISP $V094_DISP" ;;
  all)       MODE_TARGETS="$V093_BOTH $V094_BOTH" ;;
esac
for t in $MODE_TARGETS; do
  [ "$M" = "$t" ] && { echo "✅ 已經係（$MODE）版（md5 $M），唔重複套。"; exit 0; }
done
case "$M" in
  "$MD5_V093") F=v093 ;;
  "$MD5_V094") F=v094 ;;
  *) F=""
     for t in $KNOWN_TARGETS; do
       [ "$M" = "$t" ] && { echo "⚠️ watcher.py 已係一個已套狀態（md5 $M）：唔可以疊。"; echo "   要換模式：請由對應基底（v093 $MD5_V093／v094 $MD5_V094）行一次 --all／--display。"; exit 1; }
     done
     echo "❌ watcher.py md5 $M 唔係已知基底（v093 $MD5_V093／v094 $MD5_V094），亦唔係任何已套狀態 → 唔敢動。"; exit 1 ;;
esac
P="$HERE/$F-hardening.patch"; EXPECT="$V093_HARD"
REC="watcher.hardening"
case "$MODE" in
  hardening) REC="watcher.hardening" ;;
  display)   REC="watcher.display" ;;
  all)       REC="watcher.hardening+display" ;;
esac
case "$F/$MODE" in
  v093/hardening) P="$HERE/v093-kit-hardening.patch";     EXPECT="$V093_HARD" ;;
  v093/display)   P="$HERE/v093-display-dynamic.patch";   EXPECT="$V093_DISP" ;;
  v093/all)       P="$HERE/v093-hardening+display.patch"; EXPECT="$V093_BOTH" ;;
  v094/hardening) P="$HERE/v094-hardening.patch";         EXPECT="$V094_HARD" ;;
  v094/display)   P="$HERE/v094-display-dynamic.patch";   EXPECT="$V094_DISP" ;;
  v094/all)       P="$HERE/v094-hardening+display.patch"; EXPECT="$V094_BOTH" ;;
esac
[ -f "$P" ] || { echo "❌ 冇 $P"; exit 1; }
if [ "$M" = "$EXPECT" ]; then echo "✅ 已經係（$F/$MODE）版（md5 $M），唔重複套。"; exit 0; fi
cp -p "$W" "$W.$F.bak"
( cd "$HERE" && patch -p0 --fuzz=0 < "$P" )
M2=$(md5sum "$W" | awk '{print $1}')
[ "$M2" = "$EXPECT" ] || { echo "❌ 套完 md5 $M2 ≠ $EXPECT；已還原。"; cp -p "$W.$F.bak" "$W"; exit 1; }
python3 -m py_compile "$W" && echo "✅ py_compile OK"
S2=$(sha256sum "$W" | awk '{print $1}')
if [ -f "$ARENA_HOME/scripts/watcher.py" ]; then cp -p "$W" "$ARENA_HOME/scripts/watcher.py"; R="$ARENA_HOME/scripts/$REC"; else R="$HERE/scripts/$REC"; fi
{ echo "base=$F"; echo "mode=$MODE"; echo "applied_at=$(date -u +%FT%TZ)"; echo "md5=$M2"; echo "sha256=$S2"; echo "patch=$(basename "$P")"; } > "$R"; chmod 600 "$R"
echo "✅ 套好（$F/$MODE）：md5 $M2｜sha256 $S2｜紀錄 $R（verify-workshop.sh §1 會認）"