// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. images module for scripts/src/hwlab-g14.ts.

// Moved mechanically from scripts/src/hwlab-g14.ts:8075-8386 for #903.

import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
import { dirname, join } from "node:path";
import { createHash, randomBytes } from "node:crypto";
import { repoRoot, rootPath, type Config } from "../config";
import { runCommand } from "../command";
import { cancelJob, listJobs, readJob, startJob } from "../jobs";
import { hwlabRequiredNoProxyEntries, hwlabRuntimeLaneConfigPath, hwlabRuntimeLaneIds, hwlabRuntimeLaneSpec, isHwlabRuntimeLane, type HwlabRuntimeLane, type HwlabRuntimeLaneSpec } from "../hwlab-node-lanes";

import type { CommandJsonResult, G14ControlPlaneOptions, G14GitMirrorOptions, G14ToolsImageOptions, G14UpstreamImageOptions } from "./types";
import { statusText } from "./pr-monitor";
import { cliJson, isCommandSuccess, record, shellQuote } from "./remote";
import { G14_CI_TOOLS_IMAGE_REPO, G14_PROVIDER, GIT_MIRROR_NAMESPACE, V02_REGISTRY_PREFIX, V02_WORKSPACE } from "./types";

export function startAsyncHwlabG14Job(name: string, command: string[], note: string): Record<string, unknown> {
  const job = startJob(name, command, note);
  const statusCommand = `bun scripts/cli.ts job status ${job.id} --tail-bytes 12000`;
  return {
    ok: true,
    mode: "async-job",
    job,
    statusCommand,
    tailCommand: `tail -f ${job.stdoutFile}`,
    next: {
      status: statusCommand,
      tail: `tail -f ${job.stdoutFile}`,
    },
  };
}

export function startControlPlaneTriggerJob(options: G14ControlPlaneOptions): Record<string, unknown> {
  const command = [
    "bun",
    "scripts/cli.ts",
    "hwlab",
    "g14",
    "control-plane",
    "trigger-current",
    "--lane",
    options.lane,
    "--confirm",
    "--timeout-seconds",
    String(options.timeoutSeconds),
    "--wait",
  ];
  if (options.rerun) command.splice(command.length - 1, 0, "--rerun");
  return {
    command: `hwlab g14 control-plane trigger-current --lane ${options.lane}`,
    lane: options.lane,
    reason: "confirmed trigger can spend tens of seconds syncing git mirror and creating PipelineRun; default is fire-and-forget to avoid silent blocking",
    waitCommand: command.join(" "),
    ...startAsyncHwlabG14Job(
      `hwlab_g14_${options.lane}_trigger_current`,
      command,
      `Trigger HWLAB ${options.lane} current commit PipelineRun with git mirror pre-sync through G14 control-plane`,
    ),
  };
}

export function startGitMirrorJob(options: G14GitMirrorOptions): Record<string, unknown> {
  const command = [
    "bun",
    "scripts/cli.ts",
    "hwlab",
    "g14",
    "git-mirror",
    options.action,
    "--lane",
    options.lane,
    "--confirm",
    "--timeout-seconds",
    String(options.timeoutSeconds),
    "--wait",
  ];
  return {
    command: `hwlab g14 git-mirror ${options.action} --lane ${options.lane}`,
    lane: options.lane,
    namespace: GIT_MIRROR_NAMESPACE,
    reason: "manual git mirror sync/flush waits for a Kubernetes Job; default is fire-and-forget to keep CLI output immediately visible",
    waitCommand: command.join(" "),
    ...startAsyncHwlabG14Job(
      `hwlab_g14_git_mirror_${options.action}`,
      command,
      `Run HWLAB devops-infra git mirror ${options.action} through a bounded manual Kubernetes Job`,
    ),
  };
}

export function g14HostScript(script: string, timeoutMs = 120_000): CommandJsonResult {
  return cliJson(["ssh", G14_PROVIDER, "sh", "--", script], timeoutMs);
}

export function g14CiToolsImage(tag: string): string {
  return `${G14_CI_TOOLS_IMAGE_REPO}:${tag}`;
}

export function runG14ToolsImageStatus(options: G14ToolsImageOptions): Record<string, unknown> {
  const image = g14CiToolsImage(options.tag);
  const script = [
    "set -u",
    `image=${shellQuote(image)}`,
    "exists=false",
    "image_id=",
    "created=",
    "size=",
    "node_version=",
    "npm_version=",
    "bun_version=",
    "git_version=",
    "docker_version=",
    "python_version=",
    "registry_tags=",
    "if docker image inspect \"$image\" >/tmp/hwlab-tools-image-inspect.json 2>/tmp/hwlab-tools-image-inspect.err; then",
    "  exists=true",
    "  image_id=$(docker image inspect \"$image\" --format '{{.Id}}' 2>/dev/null || true)",
    "  created=$(docker image inspect \"$image\" --format '{{.Created}}' 2>/dev/null || true)",
    "  size=$(docker image inspect \"$image\" --format '{{.Size}}' 2>/dev/null || true)",
    "  node_version=$(docker run --rm \"$image\" node --version 2>/dev/null || true)",
    "  npm_version=$(docker run --rm \"$image\" npm --version 2>/dev/null || true)",
    "  bun_version=$(docker run --rm \"$image\" bun --version 2>/dev/null || true)",
    "  git_version=$(docker run --rm \"$image\" git --version 2>/dev/null || true)",
    "  docker_version=$(docker run --rm \"$image\" docker --version 2>/dev/null || true)",
    "  python_version=$(docker run --rm \"$image\" python3 --version 2>/dev/null || true)",
    "fi",
    `registry_tags=$(curl -fsS --max-time 10 http://127.0.0.1:5000/v2/hwlab/hwlab-ci-node-tools/tags/list 2>/dev/null || true)`,
    "export image exists image_id created size node_version npm_version bun_version git_version docker_version python_version registry_tags",
    "node - <<'NODE'",
    "const fs = require('node:fs');",
    "const env = process.env;",
    "const payload = {",
    "  image: env.image,",
    "  exists: env.exists === 'true',",
    "  imageId: env.image_id || null,",
    "  created: env.created || null,",
    "  sizeBytes: env.size ? Number(env.size) : null,",
    "  tools: {",
    "    node: env.node_version || null,",
    "    npm: env.npm_version || null,",
    "    bun: env.bun_version || null,",
    "    git: env.git_version || null,",
    "    docker: env.docker_version || null,",
    "    python: env.python_version || null",
    "  },",
    "  registryTagsRaw: env.registry_tags || null",
    "};",
    "console.log(JSON.stringify(payload, null, 2));",
    "NODE",
  ].join("\n");
  const result = g14HostScript(script, 180_000);
  let parsedStatus: unknown = null;
  const text = statusText(result);
  if (text.length > 0) {
    try {
      parsedStatus = JSON.parse(text) as unknown;
    } catch {
      parsedStatus = null;
    }
  }
  return {
    ok: isCommandSuccess(result) && record(parsedStatus).exists === true,
    command: "hwlab g14 tools-image status --name ci-node-tools",
    name: options.name,
    image,
    status: parsedStatus ?? text,
    result,
  };
}

export function runG14ToolsImageBuild(options: G14ToolsImageOptions): Record<string, unknown> {
  const image = g14CiToolsImage(options.tag);
  const script = [
    "set -eu",
    `cd ${shellQuote(V02_WORKSPACE)}`,
    "git fetch origin v0.2 --prune",
    "git checkout v0.2 >/dev/null 2>&1 || true",
    "git merge --ff-only origin/v0.2",
    `test -f ${shellQuote(options.dockerfile)}`,
    `image=${shellQuote(image)}`,
    `dockerfile=${shellQuote(options.dockerfile)}`,
    "echo \"{\\\"phase\\\":\\\"preflight\\\",\\\"image\\\":\\\"$image\\\",\\\"dockerfile\\\":\\\"$dockerfile\\\",\\\"commit\\\":\\\"$(git rev-parse HEAD)\\\"}\"",
    "export HTTP_PROXY=http://127.0.0.1:10808 HTTPS_PROXY=http://127.0.0.1:10808 http_proxy=http://127.0.0.1:10808 https_proxy=http://127.0.0.1:10808",
    "export NO_PROXY=localhost,127.0.0.1,::1,host.docker.internal,74.48.78.17,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,10.42.0.0/16,10.43.0.0/16,.svc,.svc.cluster.local,.cluster.local,kubernetes,kubernetes.default,kubernetes.default.svc,127.0.0.1:5000,localhost:5000",
    "export no_proxy=$NO_PROXY",
    "docker build --pull --build-arg HTTP_PROXY --build-arg HTTPS_PROXY --build-arg http_proxy --build-arg https_proxy --build-arg NO_PROXY --build-arg no_proxy -f \"$dockerfile\" -t \"$image\" .",
    "docker run --rm \"$image\" sh -lc 'node --version && npm --version && bun --version && git --version && python3 --version && docker --version && ssh -V'",
    "docker push \"$image\"",
    "digest=$(docker image inspect \"$image\" --format '{{index .RepoDigests 0}}' 2>/dev/null || true)",
    "echo \"{\\\"phase\\\":\\\"published\\\",\\\"image\\\":\\\"$image\\\",\\\"digest\\\":\\\"$digest\\\"}\"",
  ].join("\n");
  if (options.dryRun) {
    return {
      ok: true,
      command: "hwlab g14 tools-image build --name ci-node-tools",
      mode: "dry-run",
      image,
      workspace: V02_WORKSPACE,
      dockerfile: options.dockerfile,
      buildScriptPreview: script.split(/\n/u),
      next: { build: `bun scripts/cli.ts hwlab g14 tools-image build --name ci-node-tools --tag ${options.tag} --confirm` },
    };
  }
  const result = g14HostScript(script, options.timeoutSeconds * 1000);
  return {
    ok: isCommandSuccess(result),
    command: "hwlab g14 tools-image build --name ci-node-tools",
    mode: "confirmed-build",
    image,
    workspace: V02_WORKSPACE,
    dockerfile: options.dockerfile,
    result,
    status: runG14ToolsImageStatus({ ...options, action: "status", dryRun: true, confirm: false }),
  };
}

export function runG14ToolsImage(options: G14ToolsImageOptions): Record<string, unknown> {
  if (options.action === "status") return runG14ToolsImageStatus(options);
  return runG14ToolsImageBuild(options);
}

export function g14UpstreamImageTarget(options: G14UpstreamImageOptions): string {
  return `${V02_REGISTRY_PREFIX}/${options.name}:${options.tag}`;
}

export function g14UpstreamImageSource(options: G14UpstreamImageOptions): string {
  if (options.name === "openfga") return `docker.io/openfga/openfga:${options.tag}`;
  return `${options.name}:${options.tag}`;
}

export function runG14UpstreamImageStatus(options: G14UpstreamImageOptions): Record<string, unknown> {
  const sourceImage = g14UpstreamImageSource(options);
  const targetImage = g14UpstreamImageTarget(options);
  const script = [
    "set +e",
    `source_image=${shellQuote(sourceImage)}`,
    `target_image=${shellQuote(targetImage)}`,
    `repo_path=${shellQuote(`hwlab/${options.name}`)}`,
    `tag=${shellQuote(options.tag)}`,
    "local_id=$(docker image inspect \"$target_image\" --format '{{.Id}}' 2>/dev/null || true)",
    "local_created=$(docker image inspect \"$target_image\" --format '{{.Created}}' 2>/dev/null || true)",
    "registry_tags=$(curl -fsS --max-time 10 \"http://127.0.0.1:5000/v2/$repo_path/tags/list\" 2>/dev/null || true)",
    "registry_has_tag=false",
    "if printf '%s' \"$registry_tags\" | grep -F '\"'$tag'\"' >/dev/null 2>&1; then registry_has_tag=true; fi",
    "export source_image target_image local_id local_created registry_tags registry_has_tag",
    "node <<'NODE'",
    "const env = process.env;",
    "console.log(JSON.stringify({",
    "  sourceImage: env.source_image,",
    "  targetImage: env.target_image,",
    "  localExists: Boolean(env.local_id),",
    "  localImageId: env.local_id || null,",
    "  localCreated: env.local_created || null,",
    "  registryHasTag: env.registry_has_tag === 'true',",
    "  registryTagsRaw: env.registry_tags || null",
    "}, null, 2));",
    "NODE",
  ].join("\n");
  const result = g14HostScript(script, 120_000);
  let parsedStatus: unknown = null;
  const text = statusText(result);
  if (text.length > 0) {
    try {
      parsedStatus = JSON.parse(text) as unknown;
    } catch {
      parsedStatus = null;
    }
  }
  return {
    ok: isCommandSuccess(result) && record(parsedStatus).registryHasTag === true,
    command: "hwlab g14 upstream-image status --name openfga",
    name: options.name,
    tag: options.tag,
    sourceImage,
    targetImage,
    status: parsedStatus ?? text,
    result,
  };
}

export function runG14UpstreamImageEnsure(options: G14UpstreamImageOptions): Record<string, unknown> {
  const sourceImage = g14UpstreamImageSource(options);
  const targetImage = g14UpstreamImageTarget(options);
  if (options.dryRun) {
    return {
      ok: true,
      command: "hwlab g14 upstream-image ensure --name openfga",
      mode: "dry-run",
      name: options.name,
      tag: options.tag,
      sourceImage,
      targetImage,
      mutation: false,
      next: { confirm: `bun scripts/cli.ts hwlab g14 upstream-image ensure --name ${options.name} --tag ${options.tag} --confirm` },
    };
  }
  const script = [
    "set -eu",
    `source_image=${shellQuote(sourceImage)}`,
    `target_image=${shellQuote(targetImage)}`,
    "export HTTP_PROXY=http://127.0.0.1:10808 HTTPS_PROXY=http://127.0.0.1:10808 http_proxy=http://127.0.0.1:10808 https_proxy=http://127.0.0.1:10808",
    "export NO_PROXY=localhost,127.0.0.1,::1,host.docker.internal,74.48.78.17,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,10.42.0.0/16,10.43.0.0/16,.svc,.svc.cluster.local,.cluster.local,kubernetes,kubernetes.default,kubernetes.default.svc,127.0.0.1:5000,localhost:5000",
    "export no_proxy=$NO_PROXY",
    "echo \"{\\\"phase\\\":\\\"pull\\\",\\\"sourceImage\\\":\\\"$source_image\\\"}\"",
    "docker pull \"$source_image\"",
    "docker tag \"$source_image\" \"$target_image\"",
    "echo \"{\\\"phase\\\":\\\"push\\\",\\\"targetImage\\\":\\\"$target_image\\\"}\"",
    "docker push \"$target_image\"",
    "digest=$(docker image inspect \"$target_image\" --format '{{index .RepoDigests 0}}' 2>/dev/null || true)",
    "echo \"{\\\"phase\\\":\\\"published\\\",\\\"targetImage\\\":\\\"$target_image\\\",\\\"digest\\\":\\\"$digest\\\"}\"",
  ].join("\n");
  const result = g14HostScript(script, options.timeoutSeconds * 1000);
  const status = runG14UpstreamImageStatus(options);
  return {
    ok: isCommandSuccess(result) && status.ok === true,
    command: "hwlab g14 upstream-image ensure --name openfga",
    mode: "confirmed-ensure",
    name: options.name,
    tag: options.tag,
    sourceImage,
    targetImage,
    mutation: true,
    result,
    status,
  };
}

export function runG14UpstreamImage(options: G14UpstreamImageOptions): Record<string, unknown> {
  if (options.action === "status") return runG14UpstreamImageStatus(options);
  return runG14UpstreamImageEnsure(options);
}