awoooi/scripts/reboot-recovery/collect-windows99-vmx-source-locate-check.sh

#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
TARGET_HOST="${WINDOWS99_HOST:-192.168.0.99}"
TARGET_USER="${WINDOWS99_USER:-wooo}"
TARGET_PORT="${WINDOWS99_PORT:-22}"
VIA_HOST="${WINDOWS99_VIA_HOST:-}"
CONNECT_TIMEOUT="${WINDOWS99_CONNECT_TIMEOUT:-8}"
KNOWN_HOSTS_FILE="${WINDOWS99_KNOWN_HOSTS_FILE:-/tmp/awoooi-windows99-vmx-locate-known_hosts}"
LOCAL_LOCATE_SCRIPT="${WINDOWS99_VMX_LOCATE_SCRIPT:-${SCRIPT_DIR}/windows99-vmx-source-locate-check.ps1}"
INCLUDE_IDENTITY_METADATA=0

usage() {
  cat <<'USAGE'
usage: collect-windows99-vmx-source-locate-check.sh [options]

Runs the Windows99 VMX source locate check through public-key SSH only. This is
check-mode evidence: it does not read secrets, write files, start VMs, restart
services, apply registry changes, or reboot hosts.

Options:
  --host HOST                 Windows99 host. Default: 192.168.0.99
  --user USER                 Windows99 SSH user. Default: wooo
  --port PORT                 Windows99 SSH port. Default: 22
  --via-host USER@HOST        Optional SSH jump host, e.g. wooo@192.168.0.110
  --timeout SECONDS           SSH connect timeout. Default: 8
  --include-identity-metadata Read bounded VMX identity keys after path-only scan
  -h, --help                  Show this help
USAGE
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --host)
      shift
      TARGET_HOST="${1:?--host requires a value}"
      ;;
    --user)
      shift
      TARGET_USER="${1:?--user requires a value}"
      ;;
    --port)
      shift
      TARGET_PORT="${1:?--port requires a value}"
      ;;
    --via-host)
      shift
      VIA_HOST="${1:?--via-host requires a value}"
      ;;
    --timeout)
      shift
      CONNECT_TIMEOUT="${1:?--timeout requires a value}"
      ;;
    --include-identity-metadata)
      INCLUDE_IDENTITY_METADATA=1
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      printf 'error=unknown_argument:%s\n' "$1" >&2
      usage >&2
      exit 64
      ;;
  esac
  shift
done

if [[ ! -f "$LOCAL_LOCATE_SCRIPT" ]]; then
  printf 'schema_version=windows99_vmx_source_locate_collector_v1\n'
  printf 'status=blocked_local_locate_script_missing\n'
  printf 'local_locate_script=%s\n' "$LOCAL_LOCATE_SCRIPT"
  printf 'secret_value_read=false\n'
  printf 'remote_write_performed=false\n'
  printf 'vm_power_change_performed=false\n'
  exit 75
fi

payload_file="$(mktemp "${TMPDIR:-/tmp}/awoooi-windows99-vmx-locate.XXXXXX")"
trap 'rm -f "$payload_file"' EXIT

python3 - "$LOCAL_LOCATE_SCRIPT" "$INCLUDE_IDENTITY_METADATA" "$payload_file" <<'PY'
import pathlib
import sys

path = pathlib.Path(sys.argv[1])
include_identity = sys.argv[2] == "1"
output = pathlib.Path(sys.argv[3])
script = path.read_text(encoding="utf-8")
if include_identity:
    script = script.replace(
        "    [switch]$IncludeIdentityMetadata\n)",
        "    [switch]$IncludeIdentityMetadata = $true\n)",
    )
output.write_text(script, encoding="utf-8")
PY

SSH_OPTS=(
  -o BatchMode=yes
  -o PreferredAuthentications=publickey
  -o PubkeyAuthentication=yes
  -o PasswordAuthentication=no
  -o KbdInteractiveAuthentication=no
  -o NumberOfPasswordPrompts=0
  -o ConnectTimeout="${CONNECT_TIMEOUT}"
  -o ConnectionAttempts=1
  -o StrictHostKeyChecking=no
  -o UserKnownHostsFile="${KNOWN_HOSTS_FILE}"
)

bootstrap_command="$(
  python3 - <<'PY'
import base64

bootstrap = "& ([scriptblock]::Create([Console]::In.ReadToEnd()))"
print(base64.b64encode(bootstrap.encode("utf-16le")).decode("ascii"))
PY
)"

REMOTE_PS=(
  powershell
  -NoProfile
  -ExecutionPolicy
  Bypass
  -EncodedCommand
  "$bootstrap_command"
)

quote_words() {
  printf '%q ' "$@"
}

printf 'schema_version=windows99_vmx_source_locate_collector_v1\n'
printf 'target_host=%s\n' "$TARGET_HOST"
printf 'target_user=%s\n' "$TARGET_USER"
printf 'via_host=%s\n' "${VIA_HOST:-none}"
printf 'include_identity_metadata=%s\n' "$INCLUDE_IDENTITY_METADATA"
printf 'secret_value_read=false\n'
printf 'remote_write_performed=false\n'
printf 'vm_power_change_performed=false\n'
printf 'windows_service_restart_performed=false\n'
printf 'windows_registry_apply_performed=false\n'

if [[ -n "$VIA_HOST" ]]; then
  inner_ssh=(ssh "${SSH_OPTS[@]}" -p "$TARGET_PORT" "${TARGET_USER}@${TARGET_HOST}" "${REMOTE_PS[@]}")
  inner_command="$(quote_words "${inner_ssh[@]}")"
  ssh "${SSH_OPTS[@]}" "$VIA_HOST" "bash -lc $(printf '%q' "$inner_command")" <"$payload_file"
else
  ssh "${SSH_OPTS[@]}" -p "$TARGET_PORT" "${TARGET_USER}@${TARGET_HOST}" "${REMOTE_PS[@]}" <"$payload_file"
fi