import { existsSync, readFileSync } from "node:fs";
import { extname } from "node:path";
import { runCommand } from "./command";
import { type UniDeskConfig, repoRoot, rootPath } from "./config";
import { composeConfig } from "./docker";
import { compactD601RecoveryGuardrails, runD601RecoveryGuardrails } from "./recovery-guardrails";

interface CheckItem {
  name: string;
  ok: boolean;
  detail: unknown;
}

const syntaxFiles = [
  "scripts/cli.ts",
  "scripts/playwright-cli.ts",
  "scripts/playwright-cli-contract-test.ts",
  "scripts/src/playwright-cli.ts",
  "scripts/src/check.ts",
  "scripts/src/artifact-registry.ts",
  "scripts/src/auth-broker.ts",
  "scripts/src/code-queue.ts",
  "scripts/src/code-queue-execution-plane.ts",
  "scripts/src/command.ts",
  "scripts/src/d601-k3s-guard.ts",
  "scripts/src/hwlab-cd.ts",
  "scripts/src/decision-center.ts",
  "scripts/src/dev-env.ts",
  "scripts/src/deploy.ts",
  "scripts/src/docker.ts",
  "scripts/src/e2e.ts",
  "scripts/src/help.ts",
  "scripts/src/commander.ts",
  "scripts/src/commander-prompt-lint.ts",
  "scripts/src/recovery-guardrails.ts",
  "scripts/src/server-cleanup.ts",
  "scripts/src/remote.ts",
  "scripts/host-codex-commander-contract-test.ts",
  "scripts/host-codex-commander-no-daemon-smoke-contract-test.ts",
  "scripts/host-codex-commander-prompt-lint-contract-test.ts",
  "scripts/host-codex-commander-skeleton-contract-test.ts",
  "scripts/auth-broker-contract-test.ts",
  "scripts/code-queue-cli-disclosure-contract-test.ts",
  "scripts/code-queue-prompt-lint-contract-test.ts",
  "scripts/code-queue-cli-steer-test.ts",
  "scripts/code-queue-steer-confirmation-contract-test.ts",
  "scripts/code-queue-cli-submit-prompt-contract-test.ts",
  "scripts/code-queue-submit-execution-mode-contract-test.ts",
  "scripts/code-queue-submit-summary-contract-test.ts",
  "scripts/code-queue-cli-read-terminal-contract-test.ts",
  "scripts/code-queue-gh-auth-redaction-contract-test.ts",
  "scripts/d601-recovery-guardrails-contract-test.ts",
  "scripts/hwlab-cd-wrapper-contract-test.ts",
  "scripts/code-queue-queues-shape-contract-test.ts",
  "scripts/microservice-health-output-contract-test.ts",
  "scripts/code-queue-supervisor-disclosure-contract-test.ts",
  "scripts/code-queue-commander-view-contract-test.ts",
  "scripts/code-queue-postgres-rotation-contract-test.ts",
  "scripts/ssh-argv-guidance-contract-test.ts",
  "src/components/frontend/src/index.ts",
  "src/components/frontend/src/app.tsx",
  "src/components/frontend/src/decision-center.tsx",
  "src/components/provider-gateway/src/index.ts",
  "src/components/microservices/oa-event-flow/src/index.ts",
  "src/components/microservices/baidu-netdisk/src/index.ts",
  "src/components/microservices/k3sctl-adapter/src/index.ts",
  "src/components/microservices/mdtodo/src/index.ts",
  "src/components/microservices/decision-center/src/index.ts",
  "src/components/microservices/code-queue-mgr/src/index.ts",
  "src/components/microservices/code-agent-sandbox/src/index.ts",
  "src/components/microservices/host-codex-commander/src/index.ts",
  "src/components/microservices/host-codex-commander/src/contract.ts",
  "src/components/microservices/host-codex-commander/src/redaction.ts",
  "src/components/microservices/host-codex-commander/src/state.ts",
];

export interface CheckOptions {
  full: boolean;
  files: boolean;
  scriptsTypecheck: boolean;
  components: boolean;
  compose: boolean;
  logs: boolean;
  recoveryGuardrails: boolean;
  rust: boolean;
}

const defaultCheckOptions: CheckOptions = {
  full: false,
  files: false,
  scriptsTypecheck: false,
  components: false,
  compose: false,
  logs: false,
  recoveryGuardrails: false,
  rust: false,
};

export function checkHelp(): Record<string, unknown> {
  return {
    ok: true,
    command: "check",
    usage: [
      "bun scripts/cli.ts check [--syntax-only|--full|--files|--scripts-typecheck|--components|--compose|--logs|--recovery-guardrails|--rust]",
      "bun scripts/cli.ts check recovery-guardrails",
    ],
    defaultMode: "syntax/config only; Rust is never compiled on the master server by default",
    options: [
      { name: "--syntax-only|--basic", description: "Run only config validation, Bun version and TypeScript syntax transpile." },
      { name: "--full", description: "Enable all local checks except Rust compilation." },
      { name: "--files", description: "Verify required entrypoint files, including backend-core Cargo files." },
      { name: "--scripts-typecheck", description: "Run scripts TypeScript typecheck." },
      { name: "--components", description: "Run component TypeScript typecheck." },
      { name: "--compose", description: "Render Docker Compose config." },
      { name: "--logs", description: "Check unified log rotation policy." },
      { name: "--recovery-guardrails", description: "Run D601 k3s/Code Queue reboot recovery diagnostics in read-only mode." },
      { name: "--rust", description: "Run cargo check only when UNIDESK_D601_RUST_CHECK=1 or UNIDESK_NATIVE_K3S_RUST_CHECK=1 is set inside an approved native k3s CI/dev execution." },
    ],
    rustBoundary: {
      masterServer: "do not run cargo check/build here",
      nativeK3sCi: "use deploy apply --env dev --service backend-core and CI with UNIDESK_NATIVE_K3S_RUST_CHECK=1",
    },
    recoveryGuardrailsBoundary: {
      command: "bun scripts/cli.ts check recovery-guardrails",
      mutation: false,
      forbidden: ["restart k3s", "delete CRI sandboxes or pods", "modify hostPath directories", "deploy/rollout", "destructive prune/reset"],
    },
  };
}

export function parseCheckOptions(args: string[]): CheckOptions {
  const options = { ...defaultCheckOptions };
  for (const arg of args) {
    if (arg === "--full") {
      options.full = true;
      options.files = true;
      options.scriptsTypecheck = true;
      options.components = true;
      options.compose = true;
      options.logs = true;
      options.recoveryGuardrails = true;
    } else if (arg === "--files") {
      options.files = true;
    } else if (arg === "--scripts-typecheck") {
      options.scriptsTypecheck = true;
    } else if (arg === "--components") {
      options.components = true;
    } else if (arg === "--compose") {
      options.compose = true;
    } else if (arg === "--logs") {
      options.logs = true;
    } else if (arg === "--recovery-guardrails") {
      options.recoveryGuardrails = true;
    } else if (arg === "--rust") {
      options.rust = true;
    } else if (arg === "--basic" || arg === "--syntax-only") {
      Object.assign(options, defaultCheckOptions);
    } else {
      throw new Error(`unknown check option: ${arg}`);
    }
  }
  return options;
}

function fileItem(path: string): CheckItem {
  const absolute = rootPath(path);
  return { name: `file:${path}`, ok: existsSync(absolute), detail: absolute };
}

function commandItem(name: string, command: string[], timeoutMs = 30_000, env: NodeJS.ProcessEnv = process.env): CheckItem {
  const result = runCommand(command, repoRoot, { timeoutMs, env });
  return {
    name,
    ok: result.exitCode === 0,
    detail: {
      command,
      exitCode: result.exitCode,
      signal: result.signal,
      timedOut: result.timedOut,
      stdoutTail: result.stdout.slice(-4000),
      stderrTail: result.stderr.slice(-4000),
    },
  };
}

function syntaxItem(): CheckItem {
  const failures: Array<{ path: string; error: string }> = [];
  const checked: string[] = [];
  const ts = new Bun.Transpiler({ loader: "ts" });
  const tsx = new Bun.Transpiler({ loader: "tsx" });
  for (const path of syntaxFiles) {
    const absolute = rootPath(path);
    try {
      const source = readFileSync(absolute, "utf8");
      const loader = extname(path) === ".tsx" ? tsx : ts;
      loader.transformSync(source);
      checked.push(path);
    } catch (error) {
      failures.push({ path, error: error instanceof Error ? error.message : String(error) });
    }
  }
  return {
    name: "syntax:transpile",
    ok: failures.length === 0,
    detail: { checked, failures },
  };
}

function unifiedLogRotationItem(): CheckItem {
  const serviceFiles = [
    "src/components/frontend/src/index.ts",
    "src/components/provider-gateway/src/index.ts",
    "src/components/microservices/code-queue-mgr/src/index.ts",
    "src/components/microservices/code-queue/src/index.ts",
    "src/components/microservices/k3sctl-adapter/src/index.ts",
    "src/components/microservices/mdtodo/src/index.ts",
    "src/components/microservices/project-manager/src/index.ts",
    "src/components/microservices/baidu-netdisk/src/index.ts",
    "src/components/microservices/oa-event-flow/src/index.ts",
    "src/components/microservices/decision-center/src/index.ts",
    "src/components/microservices/code-agent-sandbox/src/index.ts",
    "src/components/microservices/host-codex-commander/src/index.ts",
  ];
  const offenders = serviceFiles.flatMap((path) => {
    const text = readFileSync(rootPath(path), "utf8");
    const directLogAppend = /appendFileSync\(\s*(?:config\.)?logFile\b/u.test(text) || /appendFileSync\(\s*process\.env\.LOG_FILE\b/u.test(text);
    const missingWriter = !text.includes("createHourlyJsonlWriter");
    return directLogAppend || missingWriter ? [{ path, directLogAppend, missingWriter }] : [];
  });
  const backendLogger = readFileSync(rootPath("src/components/backend-core/src/logger.rs"), "utf8");
  const backendMissingRotation = !backendLogger.includes("current_path") || !backendLogger.includes("prune");
  const backendDirectUnboundedAppend = backendLogger.includes("appendFileSync");
  if (backendMissingRotation || backendDirectUnboundedAppend) {
    offenders.push({ path: "src/components/backend-core/src/logger.rs", directLogAppend: backendDirectUnboundedAppend, missingWriter: backendMissingRotation });
  }
  return {
    name: "logs:unified-hourly-rotation",
    ok: offenders.length === 0,
    detail: {
      sharedWriter: "src/components/shared/src/rotating-jsonl.ts",
      checkedFiles: ["src/components/backend-core/src/logger.rs", ...serviceFiles],
      offenders,
    },
  };
}

function extractComposeServiceBlock(composeText: string, serviceName: string): string {
  const lines = composeText.split("\n");
  const startLine = lines.findIndex((line) => line === `  ${serviceName}:`);
  if (startLine < 0) return "";
  let endLine = lines.length;
  for (let index = startLine + 1; index < lines.length; index += 1) {
    if (/^  [A-Za-z0-9][A-Za-z0-9_-]*:$/u.test(lines[index])) {
      endLine = index;
      break;
    }
  }
  return lines.slice(startLine, endLine).join("\n");
}

function codeQueueMgrHealthcheckItem(): CheckItem {
  const composeText = readFileSync(rootPath("docker-compose.yml"), "utf8");
  const serviceBlock = extractComposeServiceBlock(composeText, "code-queue-mgr");
  const dockerfileText = readFileSync(rootPath("src/components/microservices/code-queue-mgr/Dockerfile"), "utf8");
  const sourceText = readFileSync(rootPath("src/components/microservices/code-queue-mgr/src-rs/main.rs"), "utf8");
  const healthcheckUsesRustProbe = serviceBlock.includes("code-queue-mgr") && serviceBlock.includes("--healthcheck");
  const healthcheckReferencesBun = /\bhealthcheck:[\s\S]*?\bbun\b/u.test(serviceBlock);
  const binaryCopiedIntoRuntime = dockerfileText.includes("/usr/local/bin/code-queue-mgr");
  const binaryImplementsProbe = sourceText.includes("--healthcheck") && sourceText.includes("run_healthcheck");
  return {
    name: "docker-compose:code-queue-mgr-rust-healthcheck",
    ok: healthcheckUsesRustProbe && !healthcheckReferencesBun && binaryCopiedIntoRuntime && binaryImplementsProbe,
    detail: {
      healthcheckUsesRustProbe,
      healthcheckReferencesBun,
      binaryCopiedIntoRuntime,
      binaryImplementsProbe,
      expected: "code-queue-mgr Rust runtime healthcheck must use code-queue-mgr --healthcheck and must not depend on bun/curl/wget being present.",
    },
  };
}

function rustCheckItem(): CheckItem {
  const rustCheckAllowed = process.env.UNIDESK_D601_RUST_CHECK === "1" || process.env.UNIDESK_NATIVE_K3S_RUST_CHECK === "1";
  if (!rustCheckAllowed) {
    return {
      name: "rust:backend-core",
      ok: false,
      detail: {
        skipped: true,
        reason: "Rust compilation is intentionally not allowed on the master server; run it from an approved native k3s CI/dev execution plane.",
        enableOnNativeK3s: "UNIDESK_NATIVE_K3S_RUST_CHECK=1 bun scripts/cli.ts check --rust",
        legacyEnableOnD601: "UNIDESK_D601_RUST_CHECK=1 bun scripts/cli.ts check --rust",
        deployPath: "bun scripts/cli.ts deploy apply --env dev --service backend-core",
      },
    };
  }
  const envPath = process.env.HOME ? `${process.env.HOME}/.cargo/bin:${process.env.PATH ?? ""}` : process.env.PATH;
  const env = envPath ? { ...process.env, PATH: envPath } : process.env;
  return commandItem("rust:backend-core", ["cargo", "check", "--manifest-path", "src/components/backend-core/Cargo.toml"], 180_000, env);
}

function skippedItem(name: string, reason: string, enableWith: string): CheckItem {
  return { name, ok: true, detail: { skipped: true, reason, enableWith } };
}

export function runRecoveryGuardrailsCheck(config: UniDeskConfig): ReturnType<typeof compactD601RecoveryGuardrails> {
  return compactD601RecoveryGuardrails(runD601RecoveryGuardrails(config));
}

export function runChecks(config: UniDeskConfig, options: CheckOptions = defaultCheckOptions): { ok: boolean; mode: string; options: CheckOptions; items: CheckItem[] } {
  const items: CheckItem[] = [
    { name: "config:validated", ok: true, detail: { project: config.project.name, runtime: config.runtime } },
    commandItem("bun:version", ["bun", "--version"]),
    syntaxItem(),
    codeQueueMgrHealthcheckItem(),
  ];
  if (options.files) {
    items.push(
      fileItem("scripts/cli.ts"),
      fileItem("scripts/playwright-cli.ts"),
      fileItem("scripts/src/playwright-cli.ts"),
      fileItem("AGENTS.md"),
      fileItem("TEST.md"),
      fileItem("docs/reference/artifact-registry.md"),
      fileItem("docs/reference/auth-broker.md"),
      fileItem("docker-compose.yml"),
      fileItem("src/components/backend-core/Cargo.toml"),
      fileItem("src/components/backend-core/Cargo.lock"),
      fileItem("src/components/backend-core/src/main.rs"),
      fileItem("src/components/backend-core/src/http.rs"),
      fileItem("src/components/frontend/src/index.ts"),
      fileItem("src/components/provider-gateway/src/index.ts"),
      fileItem("src/components/microservices/oa-event-flow/src/index.ts"),
      fileItem("src/components/microservices/k3sctl-adapter/src/index.ts"),
      fileItem("src/components/microservices/mdtodo/src/index.ts"),
      fileItem("src/components/microservices/decision-center/src/index.ts"),
      fileItem("src/components/microservices/code-queue-mgr/src/index.ts"),
      fileItem("src/components/microservices/code-agent-sandbox/src/index.ts"),
      fileItem("src/components/microservices/host-codex-commander/package.json"),
      fileItem("src/components/microservices/host-codex-commander/tsconfig.json"),
      fileItem("src/components/microservices/host-codex-commander/Dockerfile"),
      fileItem("src/components/microservices/host-codex-commander/src/index.ts"),
      fileItem("src/components/microservices/host-codex-commander/src/contract.ts"),
      fileItem("src/components/microservices/host-codex-commander/src/redaction.ts"),
      fileItem("src/components/microservices/host-codex-commander/src/state.ts"),
      fileItem("src/components/microservices/code-queue-mgr/src/prompt-observation.ts"),
      fileItem("scripts/src/commander-prompt-lint.ts"),
      fileItem("scripts/src/deploy.ts"),
      fileItem("scripts/code-queue-issue3-regression-test.ts"),
      fileItem("scripts/code-queue-liveness-diagnostics-test.ts"),
      fileItem("scripts/src/code-queue-liveness-fixtures.ts"),
      fileItem("scripts/code-queue-trace-summary-contract-test.ts"),
      fileItem("scripts/code-queue-pr-preflight-contract-test.ts"),
      fileItem("scripts/code-queue-runner-skills-contract-test.ts"),
      fileItem("scripts/code-queue-cli-disclosure-contract-test.ts"),
      fileItem("scripts/code-queue-prompt-lint-contract-test.ts"),
      fileItem("scripts/code-queue-cli-steer-test.ts"),
      fileItem("scripts/code-queue-steer-confirmation-contract-test.ts"),
      fileItem("scripts/code-queue-cli-read-terminal-contract-test.ts"),
      fileItem("scripts/code-queue-cli-submit-prompt-contract-test.ts"),
      fileItem("scripts/code-queue-submit-summary-contract-test.ts"),
      fileItem("scripts/code-queue-submit-routing-contract-test.ts"),
      fileItem("scripts/code-queue-gh-auth-redaction-contract-test.ts"),
      fileItem("scripts/code-queue-queues-shape-contract-test.ts"),
      fileItem("scripts/code-queue-supervisor-disclosure-contract-test.ts"),
      fileItem("scripts/code-queue-commander-view-contract-test.ts"),
      fileItem("scripts/code-queue-postgres-rotation-contract-test.ts"),
      fileItem("scripts/host-codex-commander-skeleton-contract-test.ts"),
      fileItem("scripts/host-codex-commander-no-daemon-smoke-contract-test.ts"),
      fileItem("scripts/host-codex-commander-prompt-lint-contract-test.ts"),
      fileItem("scripts/provider-runner-triage-contract-test.ts"),
      fileItem("scripts/ssh-argv-guidance-contract-test.ts"),
      fileItem("scripts/src/provider-triage.ts"),
      fileItem("src/components/microservices/code-queue/src/runner-error-classifier.ts"),
      fileItem("scripts/src/ci.ts"),
      fileItem("scripts/src/e2e.ts"),
      fileItem("scripts/deploy-artifact-matrix-contract-test.ts"),
      fileItem("scripts/decision-center-desired-state-contract-test.ts"),
      fileItem("scripts/code-queue-prompt-observation-test.ts"),
      fileItem("scripts/gh-cli-issue-guard-contract-test.ts"),
      fileItem("scripts/gh-cli-pr-files-contract-test.ts"),
      fileItem("scripts/gh-cli-pr-contract-test.ts"),
      fileItem("scripts/playwright-cli-contract-test.ts"),
      fileItem("scripts/code-queue-pr-preflight-example.ts"),
      fileItem("scripts/schedule-cli-contract-test.ts"),
      fileItem("scripts/server-cleanup-plan-contract-test.ts"),
      fileItem("scripts/src/artifact-registry.ts"),
      fileItem("scripts/src/server-cleanup.ts"),
      fileItem("scripts/src/recovery-guardrails.ts"),
      fileItem("scripts/src/auth-broker.ts"),
      fileItem("scripts/auth-broker-contract-test.ts"),
      fileItem("scripts/d601-recovery-guardrails-contract-test.ts"),
      fileItem("scripts/hwlab-cd-wrapper-contract-test.ts"),
      fileItem("src/components/microservices/auth-broker/Cargo.toml"),
      fileItem("src/components/microservices/auth-broker/Dockerfile"),
      fileItem("src/components/microservices/auth-broker/src/main.rs"),
      fileItem("scripts/artifact-consumer-dry-run-matrix-test.ts"),
      fileItem("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml"),
      fileItem("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.g14.yaml"),
      fileItem("src/components/microservices/k3sctl-adapter/k3s/code-queue.g14.k3s.json"),
      fileItem("src/components/microservices/k3sctl-adapter/k3s/code-queue.g14.k8s.yaml"),
    );
  } else {
    items.push(skippedItem("files:required-entrypoints", "required file presence scan is opt-in", "--files or --full"));
  }
  if (options.scriptsTypecheck) {
    items.push(commandItem("typescript:scripts", ["bunx", "tsc", "-p", "scripts/tsconfig.json", "--noEmit", "--pretty", "false"], 120_000));
    items.push(commandItem("code-queue:prompt-observation-contract", ["bun", "scripts/code-queue-prompt-observation-test.ts"], 30_000));
    items.push(commandItem("code-queue:issue3-diagnostics-and-image-preflight", ["bun", "scripts/code-queue-issue3-regression-test.ts"], 30_000));
    items.push(commandItem("code-queue:trace-summary-contract", ["bun", "scripts/code-queue-trace-summary-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:pr-preflight-contract", ["bun", "scripts/code-queue-pr-preflight-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:runner-skills-contract", ["bun", "scripts/code-queue-runner-skills-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:cli-disclosure-contract", ["bun", "scripts/code-queue-cli-disclosure-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:prompt-lint-contract", ["bun", "scripts/code-queue-prompt-lint-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:cli-steer-contract", ["bun", "scripts/code-queue-cli-steer-test.ts"], 30_000));
    items.push(commandItem("code-queue:steer-confirmation-contract", ["bun", "scripts/code-queue-steer-confirmation-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:resume-contract", ["bun", "scripts/code-queue-resume-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:read-terminal-contract", ["bun", "scripts/code-queue-cli-read-terminal-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:submit-prompt-contract", ["bun", "scripts/code-queue-cli-submit-prompt-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:submit-execution-mode-contract", ["bun", "scripts/code-queue-submit-execution-mode-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:submit-summary-contract", ["bun", "scripts/code-queue-submit-summary-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:submit-routing-contract", ["bun", "scripts/code-queue-submit-routing-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:gh-auth-redaction-contract", ["bun", "scripts/code-queue-gh-auth-redaction-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:queues-shape-contract", ["bun", "scripts/code-queue-queues-shape-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:supervisor-disclosure-contract", ["bun", "scripts/code-queue-supervisor-disclosure-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:commander-view-contract", ["bun", "scripts/code-queue-commander-view-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:postgres-rotation-contract", ["bun", "scripts/code-queue-postgres-rotation-contract-test.ts"], 30_000));
    items.push(commandItem("host-codex-commander:skeleton-contract", ["bun", "scripts/host-codex-commander-skeleton-contract-test.ts"], 30_000));
    items.push(commandItem("host-codex-commander:no-daemon-smoke-contract", ["bun", "scripts/host-codex-commander-no-daemon-smoke-contract-test.ts"], 30_000));
    items.push(commandItem("host-codex-commander:prompt-lint-contract", ["bun", "scripts/host-codex-commander-prompt-lint-contract-test.ts"], 30_000));
    items.push(commandItem("provider:runner-triage-contract", ["bun", "scripts/provider-runner-triage-contract-test.ts"], 30_000));
    items.push(commandItem("ssh:argv-guidance-contract", ["bun", "scripts/ssh-argv-guidance-contract-test.ts"], 30_000));
    items.push(commandItem("deploy:artifact-matrix-contract", ["bun", "scripts/deploy-artifact-matrix-contract-test.ts"], 90_000));
    items.push(commandItem("decision-center:desired-state-contract", ["bun", "scripts/decision-center-desired-state-contract-test.ts"], 30_000));
    items.push(commandItem("code-queue:active-run-heartbeat-visible", ["bun", "scripts/code-queue-liveness-diagnostics-test.ts", "--only", "code-queue:active-run-heartbeat-visible"], 30_000));
    items.push(commandItem("code-queue:trace-gap-not-stale", ["bun", "scripts/code-queue-liveness-diagnostics-test.ts", "--only", "code-queue:trace-gap-not-stale"], 30_000));
    items.push(commandItem("code-queue:stale-active-owner-expired", ["bun", "scripts/code-queue-liveness-diagnostics-test.ts", "--only", "code-queue:stale-active-owner-expired"], 30_000));
    items.push(commandItem("code-queue:control-plane-split-brain-diagnostics", ["bun", "scripts/code-queue-liveness-diagnostics-test.ts", "--only", "code-queue:control-plane-split-brain-diagnostics"], 30_000));
    items.push(commandItem("code-queue:oa-publisher-degraded-visible", ["bun", "scripts/code-queue-liveness-diagnostics-test.ts", "--only", "code-queue:oa-publisher-degraded-visible"], 30_000));
    items.push(commandItem("baidu-netdisk:artifact-guard-contract", ["bun", "scripts/baidu-netdisk-artifact-guard-contract-test.ts"], 30_000));
    items.push(commandItem("artifact-registry:direct-compose-dry-run-matrix", ["bun", "scripts/artifact-consumer-dry-run-matrix-test.ts"], 30_000));
    items.push(commandItem("schedule:cli-contract", ["bun", "scripts/schedule-cli-contract-test.ts"], 30_000));
    items.push(commandItem("server:cleanup-plan-contract", ["bun", "scripts/server-cleanup-plan-contract-test.ts"], 30_000));
    items.push(commandItem("gh:issue-guard-contract", ["bun", "scripts/gh-cli-issue-guard-contract-test.ts"], 30_000));
    items.push(commandItem("gh:pr-files-contract", ["bun", "scripts/gh-cli-pr-files-contract-test.ts"], 30_000));
    items.push(commandItem("gh:pr-contract", ["bun", "scripts/gh-cli-pr-contract-test.ts"], 30_000));
    items.push(commandItem("playwright:cli-wrapper-contract", ["bun", "scripts/playwright-cli-contract-test.ts"], 30_000));
    items.push(commandItem("auth-broker:p0-contract", ["bun", "scripts/auth-broker-contract-test.ts"], 30_000));
    items.push(commandItem("d601:recovery-guardrails-contract", ["bun", "scripts/d601-recovery-guardrails-contract-test.ts"], 30_000));
    items.push(commandItem("hwlab:cd-wrapper-contract", ["bun", "scripts/hwlab-cd-wrapper-contract-test.ts"], 30_000));
  } else {
    items.push(skippedItem("typescript:scripts", "scripts TypeScript typecheck is opt-in", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:prompt-observation-contract", "prompt observation contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:issue3-diagnostics-and-image-preflight", "Code Queue issue #3 regression fixtures are opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:trace-summary-contract", "Code Queue trace summary contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:pr-preflight-contract", "Code Queue PR preflight contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:runner-skills-contract", "Code Queue runner skill availability contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:cli-disclosure-contract", "Code Queue CLI disclosure/noise contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:prompt-lint-contract", "Code Queue prompt live-authorization lint contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:cli-steer-contract", "Code Queue steer CLI contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:steer-confirmation-contract", "Code Queue steer delivery confirmation contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:resume-contract", "Code Queue resume CLI and delivery contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:read-terminal-contract", "Code Queue terminal read contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:submit-prompt-contract", "Code Queue submit prompt contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:submit-execution-mode-contract", "Code Queue submit execution-mode contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:submit-summary-contract", "Code Queue submit summary contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:submit-routing-contract", "Code Queue submit routing contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:gh-auth-redaction-contract", "Code Queue GitHub auth output redaction contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:queues-shape-contract", "Code Queue queues shape contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:supervisor-disclosure-contract", "Code Queue supervisor disclosure contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:commander-view-contract", "Code Queue commander view contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:postgres-rotation-contract", "Code Queue postgres rotation crash contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("host-codex-commander:skeleton-contract", "host Codex commander skeleton contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("host-codex-commander:no-daemon-smoke-contract", "host Codex commander no-daemon smoke contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("host-codex-commander:prompt-lint-contract", "host Codex commander prompt boundary lint contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("provider:runner-triage-contract", "Provider runner triage contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("ssh:argv-guidance-contract", "SSH argv guidance and failure hint contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("deploy:artifact-matrix-contract", "deploy artifact matrix contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("decision-center:desired-state-contract", "Decision Center desired-state drift contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("code-queue:liveness-diagnostics-fixtures", "Code Queue liveness diagnostics fixtures are opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("baidu-netdisk:artifact-guard-contract", "Baidu Netdisk artifact guard contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("artifact-registry:direct-compose-dry-run-matrix", "main-server direct artifact consumer dry-run matrix is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("schedule:cli-contract", "Schedule CLI contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("server:cleanup-plan-contract", "Server cleanup dry-run contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("gh:issue-guard-contract", "GitHub issue CLI contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("gh:pr-files-contract", "GitHub PR files/stat contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("gh:pr-contract", "GitHub PR CLI contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("playwright:cli-wrapper-contract", "Playwright wrapper/headless/session contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("auth-broker:p0-contract", "Auth Broker P0 skeleton and CLI adapter contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("d601:recovery-guardrails-contract", "D601 recovery guardrails fixture contract is opt-in with script checks", "--scripts-typecheck or --full"));
    items.push(skippedItem("hwlab:cd-wrapper-contract", "HWLAB DEV CD wrapper contract is opt-in with script checks", "--scripts-typecheck or --full"));
  }
  if (options.logs) {
    items.push(unifiedLogRotationItem());
  } else {
    items.push(skippedItem("logs:unified-hourly-rotation", "policy scan is opt-in", "--logs or --full"));
  }
  if (options.recoveryGuardrails) {
    const recovery = runRecoveryGuardrailsCheck(config);
    items.push({
      name: "d601:recovery-guardrails",
      ok: recovery.ok,
      detail: recovery,
    });
  } else {
    items.push(skippedItem("d601:recovery-guardrails", "D601 reboot recovery diagnostics are opt-in and read-only", "--recovery-guardrails or --full"));
  }
  if (options.components) {
    items.push(commandItem("typescript:components", ["bunx", "tsc", "-p", "src/tsconfig.check.json", "--pretty", "false"], 180_000));
  } else {
    items.push(skippedItem("typescript:components", "component TypeScript check is opt-in", "--components or --full"));
  }
  if (options.compose) {
    const compose = composeConfig(config);
    items.push({
      name: "docker-compose:config",
      ok: compose.result.exitCode === 0,
      detail: {
        command: compose.command,
        exitCode: compose.result.exitCode,
        signal: compose.result.signal,
        timedOut: compose.result.timedOut,
        stdoutTail: compose.result.stdout.slice(-4000),
        stderrTail: compose.result.stderr.slice(-4000),
        runtimeEnv: compose.runtimeEnv,
      },
    });
  } else {
    items.push(skippedItem("docker-compose:config", "Docker Compose config rendering is opt-in", "--compose or --full"));
  }
  if (options.rust) {
    items.push(rustCheckItem());
  } else {
    items.push(skippedItem("rust:backend-core", "Rust check/build must run through an approved native k3s CI artifact publication, not on the master server or CD runtime target", "--rust inside native k3s CI with UNIDESK_NATIVE_K3S_RUST_CHECK=1"));
  }
  return { ok: items.every((item) => item.ok), mode: options.full ? "full" : "basic", options, items };
}