#!/bin/sh
# neuron-verify: one-command integrity audit for the Neuron install.
# Run any time; run especially after OS updates, brew operations, or anything
# that touches PATH.

FAIL=0

echo "== 1. Command resolution =="
for cmd in neuron opencode; do
  echo "-- $cmd:"
  type -a "$cmd" 2>/dev/null || echo "   (not found)"
done
echo "   [expect: neuron -> ~/.bun/bin or /opt/homebrew/bin -> repo launcher]"
echo "   [expect: opencode -> NOT FOUND]"

echo ""
echo "== 2. Launcher symlink chain =="
for link in /Users/will/.bun/bin/neuron /opt/homebrew/bin/neuron; do
  if [ -L "$link" ]; then
    target=$(readlink "$link")
    case "$target" in
      */opencode/bin/neuron) echo "OK  $link -> $target" ;;
      *) echo "BAD $link -> $target (points at wrong script)"; FAIL=1 ;;
    esac
  else
    echo "MISSING $link"; FAIL=1
  fi
done

echo ""
echo "== 3. Binary fingerprint (compare against last build) =="
BIN="/Users/will/Development/neuron-technologies/opencode/packages/opencode/dist/opencode-darwin-arm64/bin/opencode"
if [ -x "$BIN" ]; then
  shasum -a 256 "$BIN"
else
  echo "no dist binary (launcher will use source mode)"; FAIL=1
fi

echo ""
echo "== 4. Launch history — look for sha256 values you don't recognize =="
LOG="${XDG_STATE_HOME:-$HOME/.local/state}/neuron-guard.jsonl"
if [ -f "$LOG" ]; then
  grep '"event":"launch"' "$LOG" | tail -10
else
  echo "no launch log yet"
fi

echo ""
echo "== 5. Vendor egress check =="
grep -c "opencode.ai\|anomalyco" "$LOG" 2>/dev/null | { read n; echo "$n vendor egress entries in guard log"; }
grep '"blocked":true' "$LOG" 2>/dev/null | tail -3

echo ""
echo "== 6. Upstream binaries on this machine =="
find /opt/homebrew/Cellar ~/Library -maxdepth 3 -iname "*opencode*" 2>/dev/null | head -5
ls ~/.bun/install/global/node_modules 2>/dev/null | grep -i opencode | head -3
echo "[empty is good]"

exit $FAIL