#!/bin/bash
# Wait for release-keys bacon to finish, then start Stage1+combo4+CVE bacon.
set -euo pipefail
RK_STATUS=/srv/rom/artifacts/detach-009-bacon-axp-stage1-combo4-rk.status
CVE_NAME=009-bacon-axp-stage1-combo4-cve
CVE_SCRIPT=/srv/rom/artifacts/bin/009-bacon-axp-stage1-combo4-cve.sh
DETACH=/srv/rom/artifacts/bin/rom-detach

echo "watcher: waiting for RK bacon to leave 'running' ($(date -Is))"
while true; do
  if [[ -f "$RK_STATUS" ]]; then
    if grep -q '^exit=' "$RK_STATUS" 2>/dev/null; then
      break
    fi
    if ! grep -q '^running ' "$RK_STATUS" 2>/dev/null; then
      break
    fi
  else
    # no status → assume free
    break
  fi
  # still building?
  if ! pgrep -f 'm bacon -j' >/dev/null 2>&1 \
     && ! pgrep -f 'combined-lineage_sunfish.ninja' >/dev/null 2>&1; then
    # status stale?
    sleep 30
    if ! pgrep -f 'm bacon -j' >/dev/null 2>&1; then
      echo "watcher: no mka/ninja; treating RK as done ($(date -Is))"
      break
    fi
  fi
  sleep 60
done

echo "watcher: RK status now:"
cat "$RK_STATUS" 2>/dev/null || true

if grep -q '^exit=0' "$RK_STATUS" 2>/dev/null; then
  echo "watcher: RK bacon OK"
elif grep -q '^exit=' "$RK_STATUS" 2>/dev/null; then
  echo "watcher: RK bacon FAILED — still launching CVE (kernel will reset)"
else
  echo "watcher: RK status unclear — launching CVE after short settle"
  sleep 15
fi

# Ensure scripts synced into lineage vendor
KH=/srv/rom/src/lineage/vendor/sunfish-a16/patches/009-kernel-hardening
test -x "$CVE_SCRIPT"
test -f "$KH/cve-strict.list"
test -x "$KH/apply_stage1_combo4_cve.sh"

"$DETACH" "$CVE_NAME" -- bash "$CVE_SCRIPT"
echo "watcher: CVE bacon detached ($(date -Is))"