#!/usr/bin/env bash
# main-and-prod-push-guard.sh 的迴歸測試——重點在「geek6688 豁免的範圍夠不夠窄」。
# 🔴 寫成檔案跑：測試指令必然含 `wrangler deploy`，直接在 Bash 打會被 prod-write-guard 擋。
#
# 用一個**沒有 .github-armed** 的臨時 CLAUDE_PROJECT_DIR，
# 否則本機真的有那個檔 ⇒「該擋的」會假性通過，測了等於沒測。
HOOK="$1"
TMPPROJ=$(mktemp -d)
trap 'rm -rf "$TMPPROJ"' EXIT

mk(){ python3 -c "import json,sys;print(json.dumps({'tool_name':'Bash','tool_input':{'command':sys.argv[1]}}))" "$1"; }
PASS=0; FAIL=0
t(){ mk "$3" | env CLAUDE_PROJECT_DIR="$TMPPROJ" "$HOOK" >/dev/null 2>&1; rc=$?
  got=$([ $rc -eq 2 ] && echo block || echo pass)
  if [ "$got" = "$1" ]; then echo "  ✅ $2"; PASS=$((PASS+1))
  else echo "  ❌ $2 —— 期望 $1，實得 $got"; FAIL=$((FAIL+1)); fi; }

D="wrangler deploy"

echo "── geek6688（leo 2026-08-12 明文授權總管可直接動）應放行 ──"
t pass "指名 geek6688 主機名" "npx $D --name arcrun-cypher-executor --config geek6688.toml"
t pass "用 geek6688 的 token 變數" "CLOUDFLARE_API_TOKEN=\$CLOUDFLARE_API_TOKEN_CC_SHIPPING_CORE npx $D"
t pass "用 geek6688 的 account id 變數" "CLOUDFLARE_ACCOUNT_ID=\$CLOUDFLARE_ACCOUNT_ID_GEEK6688 npx $D"

echo "── 其他實例仍要 leo 親手 arm（範圍不能外溢）──"
t block "打 leo21c" "npx $D --name arcrun-mcp --account-id leo21c-acct"
t block "打 uncle6 官方" "npx $D --name arcrun-kbdb --config uncle6.toml"
t block "看不出打哪裡" "npx $D"
t block "wrangler publish 到別台" "npx wrangler publish --name arcrun-mcp"
t block "versions deploy 到別台" "npx wrangler versions deploy --name arcrun-kbdb"

echo "── stage 照舊自由 ──"
t pass "帶 --env staging" "npx $D --env staging"
t pass "打 staging 主機" "npx $D --name arcrun-rag-installer-staging"

echo "── 非部署動作不受影響 ──"
t pass "推自己的分支" "git push -u gitea fix/my-branch"
t pass "讀本閘原始碼（指令裡含關鍵字）" "sed -n '1,50p' .claude/hooks/main-and-prod-push-guard.sh"

echo
echo "結果：通過 $PASS ／ 失敗 $FAIL"
[ $FAIL -eq 0 ] || exit 1