#!/bin/bash
set -euo pipefail

[[ $# -eq 2 ]] || { echo 'DENIED: exact phase and marker required' >&2; exit 78; }
cdx_phase="$1"
cdx_marker="$2"
[[ "$cdx_marker" =~ ^CDXPERSONAL[0-9A-F]{8}$ ]] || exit 78
case "$cdx_phase" in
    --preflight|--recover-probe) cdx_approval='' ;;
    --run|--audit)
        [[ "${CDX_PERSONAL_C_APPROVAL:-}" == 'OWNED_PERSONAL_NO_STAFF_V1' ]] || exit 78
        cdx_approval='OWNED_PERSONAL_NO_STAFF_V1' ;;
    *) exit 78 ;;
esac
cdx_socket="${CDX_DM_SSH_SOCKET:-}"
[[ -n "$cdx_socket" && -S "$cdx_socket" ]] || {
    echo 'DENIED: exact live SSH ControlMaster socket required' >&2
    exit 78
}
cdx_source=/Users/wiscourper/Documents/workspace/zhct/zhctprompt/work_ai_api/2026-09-30-dm8-interface-acceptance/parallel-ai-user-personal-write-20261008/personal_no_staff.disabled.php
cdx_expected=93a85fac58ef4cb25fac3666eefc5e7c1a0d8cc343f2b464f97375871d3a964e
[[ "$(shasum -a 256 "$cdx_source" | cut -d ' ' -f 1)" == "$cdx_expected" ]] || exit 78
cdx_remote='set -euo pipefail
[[ "$(readlink -f /proc/53772/exe)" == "/www/server/php/74/bin/php" ]]
cdx_ld=""
cdx_svc=""
while IFS= read -r -d "" cdx_entry; do
    case "$cdx_entry" in
        LD_LIBRARY_PATH=*) cdx_ld="${cdx_entry#LD_LIBRARY_PATH=}" ;;
        DM_SVC_PATH=*) cdx_svc="${cdx_entry#DM_SVC_PATH=}" ;;
    esac
done < /proc/53772/environ
[[ -n "$cdx_ld" && -n "$cdx_svc" ]]
exec /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    "LD_LIBRARY_PATH=$cdx_ld" "DM_SVC_PATH=$cdx_svc" \
    "CDX_PERSONAL_APPROVAL=$3" \
    "CDX_PERSONAL_REVIEWED_SHA256=93a85fac58ef4cb25fac3666eefc5e7c1a0d8cc343f2b464f97375871d3a964e" \
    "CDX_PERSONAL_SOURCE_CHECKED=1" \
    /www/server/php/74/bin/php -c /www/server/php/74/etc/php-cli.ini \
    -d extension=/home/dmdba/dmdbms/drivers/php_pdo/libphp74_dm.so \
    -d extension=/home/dmdba/dmdbms/drivers/php_pdo/php74_pdo_dm.so \
    /dev/stdin "$1" C "$2"'
printf -v cdx_remote_q '%q' "$cdx_remote"
printf -v cdx_phase_q '%q' "$cdx_phase"
printf -v cdx_marker_q '%q' "$cdx_marker"
printf -v cdx_approval_q '%q' "$cdx_approval"
ssh -S "$cdx_socket" -o BatchMode=yes root@121.43.241.161 \
    "bash -c $cdx_remote_q -- $cdx_phase_q $cdx_marker_q $cdx_approval_q" \
    < "$cdx_source"