#!/bin/sh
# v46.1 UI-only live install helper
# - Only installs the 5 audited IPKs (NO opkg update, NO network/firewall/wifi changes)
# - Pre-checks live immutable hashes, then installs, then post-checks
# - All operations are idempotent; safe to re-run after a partial failure
set -eu

BASE=/tmp/v46.1-ui
mkdir -p "$BASE"
cd "$BASE"

PKGS="
luci-theme-argon_2.4.3-r20250722_all.ipk
luci-app-argon-config_26.187.07912~668cdc6_all.ipk
luci-i18n-argon-config-zh-cn_26.187.07912~668cdc6_all.ipk
luci-app-wgtunnel_0_all.ipk
luci-app-tr3000-status_0_all.ipk
"

IMMU="
/etc/config/network
/etc/config/firewall
/etc/config/dhcp
/etc/config/wireless
/etc/rc.local
/etc/hotplug.d/iface/20-vxlan
/etc/hotplug.d/iface/30-mss-clamp
/usr/share/nftables.d/chain-pre/mangle_forward/30-mss-clamp.nft
"

sha256() { sha256sum "$1" 2>/dev/null | awk '{print $1}'; }

echo "=== pre-install snapshot ==="
{
  for f in $IMMU; do
    s=$(sha256 "$f" 2>/dev/null) || s=missing
    printf "%s  %s\n" "$s" "$f"
  done
} > pre.sha256
cat pre.sha256

missing=""
for p in $PKGS; do
  if [ ! -f "$BASE/$p" ]; then
    missing="$missing $p"
  fi
done
if [ -n "$missing" ]; then
  echo "FAIL: missing IPK files in $BASE:$missing"
  exit 1
fi

for p in $PKGS; do
  echo "=== opkg install --force-reinstall $p ==="
  opkg install --force-reinstall --noaction "$p" || true
done

for p in $PKGS; do
  opkg install --force-reinstall "$p"
done

# Keep the active theme on Bootstrap until admin chooses Argon.
# To activate Argon:
#   uci set luci.main.mediaurlbase=/luci-static/argon
#   uci commit luci
#   /etc/init.d/rpcd restart; /etc/init.d/uhttpd restart

rm -rf /tmp/luci-cache /tmp/luci-indexcache 2>/dev/null || true
/etc/init.d/rpcd restart
/etc/init.d/uhttpd restart

echo "=== post-install snapshot ==="
{
  for f in $IMMU; do
    s=$(sha256 "$f" 2>/dev/null) || s=missing
    printf "%s  %s\n" "$s" "$f"
  done
} > post.sha256
cat post.sha256

if cmp -s pre.sha256 post.sha256; then
  echo "PASS: immutable files unchanged"
else
  echo "FAIL: immutable files differ; diff:"
  diff -u pre.sha256 post.sha256 || true
fi