CHAT_OUTPUT_BEGIN
COMMAND_ID=RUNTIME-RECEIVER-FULL-023
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=gitea-runtime
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc
COMMAND_SHA256=d17752c0235202b5d9f1822d70680ea57dd4578bde6bbc906c7569c0d0463bb0
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGES_MADE=false
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=2c183b9ced4334e5ff12c1ba35dceb1f7f6ef113298d44bf3fb80ca07305b8b3
SANITIZED_OUTPUT_SHA256=cd4ccc98c3b9dff7bd1f5557b41fb60d073f889a31f3fd7d86900eecbe15dff4
OUTPUT_BEGIN
#!/usr/bin/env bash
set -Eeuo pipefail
umask 027

HOST_DATA='/opt/stacks/gitea/data'
BARE_CONTAINER='/data/git/repositories/homelab-admin/homelab-public-context.git'

PUBLIC_DIR="${HOST_DATA}/gitea/public/.well-known/homelab-runtime"
STAGE_DIR="${HOST_DATA}/gitea/runtime-stage"
WORK_ROOT="${HOST_DATA}/gitea/runtime-work"

LOCK='/run/lock/homelab-runtime-receive.lock'

[ "$#" -eq 3 ] || {
    echo 'RESULT=FAIL'
    echo 'REASON=USAGE'
    exit 64
}

COMMAND_ID="$1"
JSON_FILE="$2"
TXT_FILE="$3"

case "$COMMAND_ID" in
    ''|*[!A-Za-z0-9._-]*)
        echo 'RESULT=FAIL'
        echo 'REASON=INVALID_COMMAND_ID'
        exit 65
        ;;
esac

[ -f "$JSON_FILE" ] || {
    echo 'RESULT=FAIL'
    echo 'REASON=JSON_FILE_MISSING'
    exit 66
}

[ -f "$TXT_FILE" ] || {
    echo 'RESULT=FAIL'
    echo 'REASON=TXT_FILE_MISSING'
    exit 67
}

exec 9>"$LOCK"
flock -w 60 9 || {
    echo 'RESULT=FAIL'
    echo 'REASON=RECEIVER_LOCK_TIMEOUT'
    exit 68
}

python3 - "$JSON_FILE" "$TXT_FILE" "$COMMAND_ID" <<'PY'
import json
import re
import sys
from pathlib import Path

json_path = Path(sys.argv[1])
text_path = Path(sys.argv[2])
expected_id = sys.argv[3]

if json_path.stat().st_size > 524_288:
    raise SystemExit("JSON_TOO_LARGE")

if text_path.stat().st_size > 1_048_576:
    raise SystemExit("TEXT_TOO_LARGE")

json_text = json_path.read_text(encoding="utf-8")
text = text_path.read_text(encoding="utf-8")

data = json.loads(json_text)

if data.get("command_id") != expected_id:
    raise SystemExit("COMMAND_ID_MISMATCH")

if data.get("sanitized") is not True:
    raise SystemExit("SANITIZED_FLAG_REQUIRED")

if data.get("secrets_included") is not False:
    raise SystemExit("SECRETS_FLAG_INVALID")

if data.get("private_addresses_included") is not False:
    raise SystemExit("PRIVATE_ADDRESS_FLAG_INVALID")

combined = json_text + "\n" + text

patterns = [
    r"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",
    r"(?i)(password|passwd|passphrase|authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key)\s*[:=]\s*\S+",
    r"(?i)/root/\.ssh",
    r"(?i)[SENSITIVE_PATH]",
    r"(?i)rclone\.conf",
    r"\b10(?:\.\d{1,3}){3}\b",
    r"\b192\.168(?:\.\d{1,3}){2}\b",
    r"\b172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}\b",
]

for pattern in patterns:
    if re.search(pattern, combined):
        raise SystemExit("FORBIDDEN_PUBLIC_CONTENT")

print("PAYLOAD_VALIDATION=OK")
PY

GIT_UID="$(docker exec gitea id -u git)"
GIT_GID="$(docker exec gitea id -g git)"

mkdir -p \
    "$PUBLIC_DIR" \
    "$STAGE_DIR" \
    "$WORK_ROOT"

chown "$GIT_UID:$GIT_GID" \
    "$STAGE_DIR" \
    "$WORK_ROOT"

install \
    -o "$GIT_UID" \
    -g "$GIT_GID" \
    -m 0644 \
    "$JSON_FILE" \
    "$STAGE_DIR/latest.json"

install \
    -o "$GIT_UID" \
    -g "$GIT_GID" \
    -m 0644 \
    "$TXT_FILE" \
    "$STAGE_DIR/latest.txt"

cat > "$STAGE_DIR/README.md" <<'DOC'
# Homelab assistant runtime

Sanitized command results for read-only assistant inspection.

Credentials, authentication data, private keys, private IP addresses and
unfiltered configuration files are prohibited.
DOC

chown "$GIT_UID:$GIT_GID" "$STAGE_DIR/README.md"
chmod 0644 "$STAGE_DIR/README.md"

PUBLISHED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
WORK_CONTAINER="/data/gitea/runtime-work/${COMMAND_ID}.$$"

COMMIT_SHA="$(
    docker exec \
        -u "${GIT_UID}:${GIT_GID}" \
        -e COMMAND_ID="$COMMAND_ID" \
        -e PUBLISHED_AT="$PUBLISHED_AT" \
        -e WORK_CONTAINER="$WORK_CONTAINER" \
        gitea sh -lc '
set -eu

BARE="/data/git/repositories/homelab-admin/homelab-public-context.git"
STAGE="/data/gitea/runtime-stage"
WORK="$WORK_CONTAINER"

rm -rf "$WORK"

git clone --quiet "$BARE" "$WORK"

cd "$WORK"

git config user.name "homelab-runtime-publisher"
git config user.email "homelab-runtime@localhost"

if git show-ref \
    --verify \
    --quiet \
    refs/remotes/origin/assistant-runtime
then
    git checkout \
        --quiet \
        -B assistant-runtime \
        origin/assistant-runtime
else
    git checkout \
        --quiet \
        --orphan assistant-runtime

    git rm -rf . >/dev/null 2>&1 || true
fi

mkdir -p runtime/history

cp "$STAGE/latest.json" runtime/latest.json
cp "$STAGE/latest.txt" runtime/latest.txt
cp "$STAGE/latest.json" "runtime/history/${COMMAND_ID}.json"
cp "$STAGE/latest.txt" "runtime/history/${COMMAND_ID}.txt"
cp "$STAGE/README.md" README.md

git add \
    README.md \
    runtime/latest.json \
    runtime/latest.txt \
    "runtime/history/${COMMAND_ID}.json"

git add "runtime/history/${COMMAND_ID}.txt"

if ! git diff --cached --quiet
then
    GIT_AUTHOR_DATE="$PUBLISHED_AT" \
    GIT_COMMITTER_DATE="$PUBLISHED_AT" \
        git commit \
            --quiet \
            -m "runtime: publish ${COMMAND_ID}"
fi

COMMIT="$(git rev-parse HEAD)"

git --git-dir="$BARE" \
    fetch \
    --quiet \
    "$WORK" \
    refs/heads/assistant-runtime

OLD="$(
    git --git-dir="$BARE" \
        rev-parse refs/heads/assistant-runtime \
        2>/dev/null ||
    true
)"

if [ -n "$OLD" ]
then
    git --git-dir="$BARE" \
        update-ref \
        refs/heads/assistant-runtime \
        "$COMMIT" \
        "$OLD"
else
    git --git-dir="$BARE" \
        update-ref \
        refs/heads/assistant-runtime \
        "$COMMIT"
fi

rm -rf "$WORK"

printf "%s\n" "$COMMIT"
'
)"

JSON_TMP="$(mktemp "${PUBLIC_DIR}/.latest.json.XXXXXX")"
TXT_TMP="$(mktemp "${PUBLIC_DIR}/.latest.txt.XXXXXX")"
INDEX_TMP="$(mktemp "${PUBLIC_DIR}/.index.json.XXXXXX")"

install -m 0644 "$JSON_FILE" "$JSON_TMP"
install -m 0644 "$TXT_FILE" "$TXT_TMP"

python3 - \
    "$COMMAND_ID" \
    "$PUBLISHED_AT" \
    "$COMMIT_SHA" >"$INDEX_TMP" <<'PY'
import json
import sys

command_id, published_at, commit_sha = sys.argv[1:4]

print(json.dumps({
    "schema_version": 1,
    "channel": "homelab-runtime",
    "branch": "assistant-runtime",
    "latest_command_id": command_id,
    "published_at_utc": published_at,
    "commit_sha": commit_sha,
    "latest_json_url": (
        "https://git.gram1.ru/.well-known/"
        "homelab-runtime/latest.json"
    ),
    "latest_text_url": (
        "https://git.gram1.ru/.well-known/"
        "homelab-runtime/latest.txt"
    )
}, ensure_ascii=False, indent=2))
PY

chmod 0644 "$INDEX_TMP"

mv -f "$JSON_TMP" "$PUBLIC_DIR/latest.json"
mv -f "$TXT_TMP" "$PUBLIC_DIR/latest.txt"
mv -f "$INDEX_TMP" "$PUBLIC_DIR/index.json"

curl -fsS \
    --max-time 10 \
    http://127.0.0.1:3002/.well-known/homelab-runtime/latest.json |
grep -F "$COMMAND_ID" >/dev/null

curl -fsS \
    --max-time 10 \
    "http://127.0.0.1:3002/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/latest.json" |
grep -F "$COMMAND_ID" >/dev/null

echo 'RESULT=OK'
echo "COMMAND_ID=$COMMAND_ID"
echo "COMMIT_SHA=$COMMIT_SHA"
echo 'STATIC_PUBLICATION=OK'
echo 'RAW_BRANCH_PUBLICATION=OK'

OUTPUT_END
CHAT_OUTPUT_END