#!/bin/sh
# 编译产物必须在空环境、其它工作目录下加载完整模块图与解析沙箱。
# preflight 缺配置以 2 退出;模块图加载失败以 1 退出。
set -u
bin="${1:-dist/umt-server}"
case "$bin" in /*) ;; *) bin="$PWD/$bin" ;; esac
[ -x "$bin" ] || { echo "check-compiled-binary: 找不到编译产物 $bin(先跑 bun run build)" >&2; exit 1; }
out=$(cd /tmp && env -i PATH="$PATH" "$bin" --role preflight 2>&1)
code=$?
if [ "$code" -eq 2 ] && printf '%s' "$out" | grep -q '配置无效'; then
  # 正常任务与拒绝策略都必须在空环境、/tmp 下成立。
  sb=$(cd /tmp && printf '{"id":"1","task":"self.test","input":{"mode":"ok"}}\n' | env -i PATH="$PATH" "$bin" --role sandbox 2>&1)
  if ! printf '%s' "$sb" | grep -q '"type":"result"'; then
    echo "check-compiled-binary: 沙箱子进程起不来:$sb" >&2
    exit 1
  fi
  for mode in io async-io write net exec; do
    sb=$(cd /tmp && printf '{"id":"1","task":"self.test","input":{"mode":"%s"}}\n' "$mode" | env -i PATH="$PATH" "$bin" --role sandbox 2>&1)
    # policy.lockdown 已直接核验 socket/openat/execve 返回 EPERM。
    # Bun 编译产物的网络异常可能被归一化成 ECONNREFUSED。
    if ! printf '%s' "$sb" | grep -q '"type":"error"' || ! printf '%s' "$sb" | grep -Eiq 'EPERM|operation not permitted|ECONNREFUSED'; then
      echo "check-compiled-binary: 沙箱没有拒绝 $mode:$sb" >&2
      exit 1
    fi
  done
  echo "check-compiled-binary: ok(模块图加载完整,沙箱拒绝文件访问/网络/执行程序)"
  exit 0
fi
echo "check-compiled-binary: 编译产物自检失败(退出码 $code):" >&2
printf '%s\n' "$out" >&2
exit 1