#!/usr/bin/env bash
# omidfleet_box/scripts/sync.sh — nightly VPS → GitHub disaster-recovery snapshot.
#
# Rsyncs canonical VPS paths into the mirror-layout inside this repo, respecting
# .gitignore, runs a pre-push secret-grep guard, then pushes to origin/main.
#
# On any anomaly (secret found, rsync fail, push fail), aborts and notifies the
# manager tmux pane.

set -uo pipefail

REPO="/data/cameron/backup/omidfleet_box"
LOG="$HOME/.cache/omidfleet_box_sync.log"
NOW=$(date -Iseconds)

mkdir -p "$(dirname "$LOG")"

{
echo "=== $NOW  sync start ==="

cd "$REPO" || { echo "  repo dir missing"; exit 1; }

# --- rsync sources → mirror paths ---
declare -A SRC_TO_DST=(
  ["/data/cameron/vault/"]="data/cameron/vault/"
  ["/data/cameron/life/"]="data/cameron/life/"
  ["/data/cameron/para/.agents/"]="data/cameron/para/.agents/"
  ["/data/cameron/agents_stuff/"]="data/cameron/agents_stuff/"
  ["/data/cameron/phe/"]="data/cameron/phe/"                          # added 2026-07-11 (phe code snapshot destination)
  ["/data/cameron/cad_recovery/"]="data/cameron/cad_recovery/"        # added 2026-07-11 (cad's active working tree from puget/phe)
  ["/home/cameronsmith/.cloudflared/"]="home/cameronsmith/.cloudflared/"
  ["/home/cameronsmith/.claude/projects/-data-cameron-agents-stuff/memory/"]="home/cameronsmith/memory/"
)

for src in "${!SRC_TO_DST[@]}"; do
  dst="${SRC_TO_DST[$src]}"
  [[ ! -d "$src" ]] && { echo "  skip missing: $src"; continue; }
  mkdir -p "$dst"
  rsync -a --delete \
        --exclude=".git" \
        --exclude="__pycache__/" \
        --exclude=".venv/" \
        --exclude="node_modules/" \
        --exclude=".cache/" \
        --exclude="*.pyc" \
        --exclude="static/audio/*.mp3" \
        --exclude="*.jsonl" \
        --exclude="*.log" \
        --exclude=".env" \
        --exclude=".env.*" \
        --exclude="credentials.json" \
        --exclude="*.pem" \
        --exclude="id_rsa*" \
        --exclude="id_ed25519*" \
        "$src" "$dst"
  echo "  synced: $src -> $dst"
done

# --- crontab snapshot ---
mkdir -p home/cameronsmith
crontab -l > home/cameronsmith/crontab.txt 2>/dev/null || echo "" > home/cameronsmith/crontab.txt

# --- pre-push secret guard ---
SUSPICIOUS=$(grep -RIn --binary-files=without-match \
  -E "sk-[A-Za-z0-9]{20,}|xoxb-[A-Za-z0-9-]+|ghp_[A-Za-z0-9]{30,}|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|AWS_SECRET_ACCESS_KEY.*=.*[A-Za-z0-9/+]{20,}" \
  --exclude-dir=.git \
  --exclude=".gitignore" \
  --exclude="README.md" \
  --exclude="sync.sh" \
  . 2>/dev/null | head -5)

if [[ -n "$SUSPICIOUS" ]]; then
  echo "!!! ABORT: pre-push guard tripped"
  echo "$SUSPICIOUS"
  msg="[omidfleet_box_sync] ABORTED nightly sync at $NOW - pre-push guard tripped. Check ~/.cache/omidfleet_box_sync.log."
  timeout 5 tmux send-keys -t agents:manager -l "$msg" 2>/dev/null
  sleep 1
  timeout 5 tmux send-keys -t agents:manager Enter 2>/dev/null
  exit 1
fi

# --- commit + push ---
git add -A
if git diff --cached --quiet; then
  echo "  no changes"
  exit 0
fi

STAT=$(git diff --cached --shortstat)
git commit -m "nightly $NOW · $STAT" > /dev/null
echo "  committed: $STAT"

if git push origin main 2>&1; then
  echo "  pushed OK"
else
  echo "!!! push failed"
  msg="[omidfleet_box_sync] Push FAILED at $NOW."
  timeout 5 tmux send-keys -t agents:manager -l "$msg" 2>/dev/null
  sleep 1
  timeout 5 tmux send-keys -t agents:manager Enter 2>/dev/null
  exit 1
fi

echo "=== $(date -Iseconds)  sync done ==="
} | tee -a "$LOG"