#!/usr/bin/env bash
# NO SNAP · apt + desk own-build · purge broken snapd · free thrift
# Law: thrash/snap store is virus-class on this desk · Waterfox is browser
# sudo mememe non-interactive · 127 desk
set -u
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
OUT="$ROOT/out"
LOG="$OUT/no-snap-$(date +%Y%m%d-%H%M%S).txt"
export SUDO_PASS="${SUDO_PASS:-mememe}"
export SUDO_ASKPASS="${SUDO_ASKPASS:-$ROOT/Build/sudo-askpass.sh}"
mkdir -p "$OUT" "$ROOT/Build/apt-own/bin" "$ROOT/Build/apt-own/debs"

MODE="${1:-all}"
say() { echo "$*" | tee -a "$LOG"; }
sudo_n() {
  if [[ "$(id -u)" -eq 0 ]]; then "$@"; return $?; fi
  if sudo -n true 2>/dev/null; then sudo -n "$@"; return $?; fi
  SUDO_ASKPASS="$SUDO_ASKPASS" SUDO_PASS="$SUDO_PASS" sudo -A -p '' "$@" 2>/dev/null
}

pin_block_snap() {
  say "=== APT PIN · block snapd reinstall ==="
  sudo_n tee /etc/apt/preferences.d/nosnap.pref >/dev/null <<'EOF'
# BigGrinRTX desk · NO SNAP · apt only · 2026-08-11
Package: snapd
Pin: release a=*
Pin-Priority: -10

Package: snapd-installation-monitor
Pin: release a=*
Pin-Priority: -10

Package: plasma-discover-backend-snap
Pin: release a=*
Pin-Priority: -10

Package: gnome-software-plugin-snap
Pin: release a=*
Pin-Priority: -10

# Ubuntu transitional "firefox" that only installs the snap
Package: firefox
Pin: release o=Ubuntu
Pin-Priority: -10

Package: chromium-browser
Pin: release o=Ubuntu
Pin-Priority: -10
EOF
  say "wrote /etc/apt/preferences.d/nosnap.pref"
}

install_mozilla_apt() {
  say "=== Mozilla apt (optional real Firefox .deb · not snap) ==="
  # Official Mozilla packages repo · signed · apt-native
  if [[ ! -f /etc/apt/sources.list.d/mozilla.list ]]; then
    sudo_n install -d -m 0755 /etc/apt/keyrings
    if curl -fsSL https://packages.mozilla.org/apt/repo-signing-key.gpg 2>/dev/null | \
      sudo_n tee /etc/apt/keyrings/packages.mozilla.org.asc >/dev/null; then
      echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" | \
        sudo_n tee /etc/apt/sources.list.d/mozilla.list >/dev/null
      # prefer mozilla firefox over any residual ubuntu stub
      sudo_n tee /etc/apt/preferences.d/mozilla >/dev/null <<'EOF'
Package: *
Pin: origin packages.mozilla.org
Pin-Priority: 1000
EOF
      say "Mozilla apt source added"
    else
      say "WARN Mozilla key fetch failed · Waterfox remains primary"
      return 0
    fi
  fi
  sudo_n apt-get update -qq 2>&1 | tail -5 | tee -a "$LOG" || true
  # install if available · not required (Waterfox is desk default)
  if apt-cache show firefox 2>/dev/null | grep -q 'packages.mozilla.org\|Mozilla'; then
    sudo_n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq firefox 2>&1 | tail -15 | tee -a "$LOG" || true
  else
    # after pin Ubuntu firefox is blocked · try explicit
    sudo_n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq -t mozilla firefox 2>&1 | tail -15 | tee -a "$LOG" || \
      say "Mozilla firefox skip · Waterfox only"
  fi
}

wire_waterfox_default() {
  say "=== WATERFOX · desk default browser (own · not snap) ==="
  local wf=""
  for c in /opt/waterfox/waterfox /usr/local/bin/waterfox /opt/waterfox/waterfox-bin; do
    [[ -x "$c" ]] && { wf=$c; break; }
  done
  if [[ -z "$wf" ]]; then
    say "WARN no Waterfox binary · install later under /opt/waterfox"
    return 0
  fi
  # desk wrapper
  local wrap="$ROOT/Build/apt-own/bin/firefox-waterfox"
  cat >"$wrap" <<EOF
#!/bin/sh
# Desk Firefox → Waterfox · never snap · free thrift
exec $wf "\$@"
EOF
  chmod 755 "$wrap"
  # system-wide local bin
  sudo_n install -m 755 "$wrap" /usr/local/bin/firefox-waterfox
  # update-alternatives if present
  if command -v update-alternatives >/dev/null 2>&1; then
    sudo_n update-alternatives --install /usr/local/bin/firefox firefox "$wf" 200 2>/dev/null || true
    sudo_n update-alternatives --set firefox "$wf" 2>/dev/null || true
  fi
  # dpkg-divert ubuntu snap stub if still the snap launcher
  if head -1 /usr/bin/firefox 2>/dev/null | grep -q '^#!' && grep -q snap /usr/bin/firefox 2>/dev/null; then
    if ! dpkg-divert --list /usr/bin/firefox 2>/dev/null | grep -q firefox; then
      sudo_n dpkg-divert --local --rename --add /usr/bin/firefox 2>/dev/null || true
    fi
    sudo_n tee /usr/bin/firefox >/dev/null <<EOF
#!/bin/sh
# diverted · BigGrinRTX desk · Waterfox not snap
exec $wf "\$@"
EOF
    sudo_n chmod 755 /usr/bin/firefox
    say "diverted /usr/bin/firefox → Waterfox"
  fi
  # xdg default
  if command -v xdg-settings >/dev/null 2>&1; then
    xdg-settings set default-web-browser Waterfox.desktop 2>/dev/null || \
      xdg-settings set default-web-browser waterfox.desktop 2>/dev/null || true
  fi
  say "Waterfox default: $wf"
}

remove_snaps() {
  say "=== SNAP REMOVE · all user snaps ==="
  # stop thrash first
  sudo_n systemctl stop snapd.service snapd.socket snapd.seeded.service 2>/dev/null || true
  # remove apps first (order: dependents then bases)
  local s
  for s in firefox firmware-updater gnome-46-2404 gtk-common-themes mesa-2404 bare core24 snapd; do
    if snap list "$s" >/dev/null 2>&1; then
      say "snap remove --purge $s"
      sudo_n snap remove --purge "$s" 2>&1 | tee -a "$LOG" || true
    fi
  done
  # any leftovers
  if command -v snap >/dev/null 2>&1; then
    snap list 2>/dev/null | awk 'NR>1 {print $1}' | while read -r s; do
      [[ -z "$s" || "$s" == "Name" ]] && continue
      say "snap remove leftover $s"
      sudo_n snap remove --purge "$s" 2>&1 | tee -a "$LOG" || true
    done
  fi
}

purge_snapd() {
  say "=== APT PURGE snapd ==="
  sudo_n systemctl stop snapd.service snapd.socket snapd.seeded.service 2>/dev/null || true
  sudo_n systemctl disable snapd.service snapd.socket snapd.seeded.service 2>/dev/null || true
  sudo_n systemctl mask snapd.service snapd.socket snapd.seeded.service 2>/dev/null || true

  sudo_n DEBIAN_FRONTEND=noninteractive apt-get purge -y \
    snapd snapd-installation-monitor plasma-discover-backend-snap \
    gnome-software-plugin-snap 2>&1 | tee -a "$LOG" | tail -40

  # transitional firefox stub if still present and still snap-bound
  if dpkg -l firefox 2>/dev/null | grep -q '1snap'; then
    sudo_n DEBIAN_FRONTEND=noninteractive apt-get purge -y firefox 2>&1 | tee -a "$LOG" | tail -15 || true
  fi

  sudo_n DEBIAN_FRONTEND=noninteractive apt-get autoremove -y --purge 2>&1 | tee -a "$LOG" | tail -20 || true

  # unmount leftover squashfs
  mount | awk '/snap/ {print $3}' | sort -r | while read -r m; do
    say "umount $m"
    sudo_n umount -l "$m" 2>/dev/null || true
  done

  # wipe residual dirs (after unmount)
  for d in /snap /var/snap /var/lib/snapd /var/cache/snapd /usr/lib/snapd; do
    if [[ -e "$d" ]]; then
      say "rm -rf $d"
      sudo_n rm -rf "$d" 2>/dev/null || true
    fi
  done

  # PATH noise
  sudo_n rm -f /etc/profile.d/apps-bin-path.sh 2>/dev/null || true
  # desktop entries
  sudo_n rm -f /var/lib/snapd/desktop/applications/*.desktop 2>/dev/null || true
  sudo_n rm -f /usr/share/applications/snap-handle-link.desktop 2>/dev/null || true

  say "snapd purge done"
}

own_build_stub() {
  say "=== DESK OWN BUILD · apt-own helper ==="
  cat >"$ROOT/Build/apt-own/README.txt" <<'EOF'
DESK OWN · apt-first · no snap
==============================
Browser:  Waterfox /opt/waterfox  (desk default · not snap firefox)
Firmware: fwupd / fwupdmgr       (apt) · not firmware-updater snap
Desk:     Projects/x Build/*     · multiarch · SPV · iron

Install debs:
  sudo dpkg -i Build/apt-own/debs/*.deb
  sudo apt-get install -f -y

Pin: /etc/apt/preferences.d/nosnap.pref  blocks snapd reinstall
Script: ./Build/no-snap-apt.sh status|all|purge|pin|waterfox

Law: snap store thrash = virus-class on this desk · free thrift · remain IN
EOF

  cat >"$ROOT/Build/apt-own/bin/desk-apt" <<'EOF'
#!/usr/bin/env bash
# desk-apt · thin apt wrapper · never snap
set -euo pipefail
case "${1:-}" in
  install|in) shift; sudo DEBIAN_FRONTEND=noninteractive apt-get install -y "$@" ;;
  remove|rm) shift; sudo DEBIAN_FRONTEND=noninteractive apt-get remove -y "$@" ;;
  purge) shift; sudo DEBIAN_FRONTEND=noninteractive apt-get purge -y "$@" ;;
  update|up) sudo apt-get update ;;
  upgrade|ug) sudo DEBIAN_FRONTEND=noninteractive apt-get upgrade -y ;;
  search|se) shift; apt-cache search "$@" ;;
  show) shift; apt-cache show "$@" ;;
  status)
    echo "snapd: $(dpkg -l snapd 2>/dev/null | awk '/^ii/{print $3;exit}' || echo purged)"
    command -v snap >/dev/null && echo "snap binary: still present" || echo "snap binary: gone"
    command -v waterfox >/dev/null && waterfox --version 2>/dev/null | head -1 || true
    command -v fwupdmgr >/dev/null && echo "fwupd: $(fwupdmgr --version 2>/dev/null | head -1)" || true
    ;;
  *)
    echo "usage: desk-apt install|remove|purge|update|upgrade|search|show|status [pkgs]"
    exit 2
    ;;
esac
EOF
  chmod 755 "$ROOT/Build/apt-own/bin/desk-apt"
  sudo_n install -m 755 "$ROOT/Build/apt-own/bin/desk-apt" /usr/local/bin/desk-apt 2>/dev/null || \
    cp -f "$ROOT/Build/apt-own/bin/desk-apt" "$HOME/.local/bin/desk-apt" 2>/dev/null || true
  say "desk-apt ready"
}

write_status() {
  python3 - <<PY
import json, subprocess, shutil
from pathlib import Path
from datetime import datetime

def sh(cmd):
    try:
        return subprocess.check_output(cmd, shell=True, text=True, stderr=subprocess.DEVNULL).strip()
    except Exception:
        return ""

snap_bin = shutil.which("snap")
snapd_pkg = sh("dpkg -l snapd 2>/dev/null | awk '/^ii/{print \$3}'")
mounts = sh("mount | grep -c snap || true")
out = {
  "ts": datetime.now().astimezone().isoformat(timespec="seconds"),
  "word": "NO_SNAP",
  "snap_binary": bool(snap_bin),
  "snapd_pkg": snapd_pkg or None,
  "snap_mounts": int(mounts or 0),
  "waterfox": sh("waterfox --version 2>/dev/null | head -1"),
  "firefox_path": sh("readlink -f \$(command -v firefox) 2>/dev/null || command -v firefox"),
  "fwupd": sh("command -v fwupdmgr"),
  "pin": Path("/etc/apt/preferences.d/nosnap.pref").is_file(),
  "law": "snapd purged · apt + Waterfox · desk own-build · thrash virus off",
}
Path("/home/default/Projects/x/out/no_snap_latest.json").write_text(json.dumps(out, indent=2) + "\n")
print(json.dumps(out, indent=2))
PY
}

status() {
  say "=== STATUS ==="
  dpkg -l snapd 2>/dev/null | grep -E '^ii|^rc' || say "snapd: not installed"
  command -v snap >/dev/null && snap list 2>&1 | head -15 || say "snap CLI: gone"
  mount | grep snap || say "snap mounts: none"
  command -v waterfox >/dev/null && waterfox --version 2>/dev/null | head -1
  command -v firefox >/dev/null && head -3 "$(command -v firefox)" 2>/dev/null | head -3
  ls /etc/apt/preferences.d/nosnap.pref 2>/dev/null && say "pin: ok"
  write_status
}

case "$MODE" in
  pin) pin_block_snap ;;
  waterfox|browser) wire_waterfox_default ;;
  mozilla) install_mozilla_apt ;;
  remove-snaps) remove_snaps ;;
  purge) pin_block_snap; remove_snaps; purge_snapd; wire_waterfox_default; own_build_stub; write_status ;;
  own|own-build) own_build_stub ;;
  status) status ;;
  all|once|"")
    pin_block_snap
    wire_waterfox_default
    install_mozilla_apt
    remove_snaps
    purge_snapd
    wire_waterfox_default   # again after purge
    own_build_stub
    write_status
    say "DONE · log $LOG"
    ;;
  *)
    echo "usage: $0 all|pin|waterfox|mozilla|remove-snaps|purge|own|status" >&2
    exit 2
    ;;
esac