#!/usr/bin/env bash
# check-headers.sh — audit the repo for applicable source files missing the
# mandatory copyright/authorship header (see skills/file-headers).
# Prints each non-compliant file; exits 0 when fully compliant, 1 otherwise.
#
# The file list comes from git (tracked + untracked-but-not-ignored), never a
# raw `find`: the header rule governs this repository's SOURCE, and a `find`
# also walks local runtime state that happens to live in the checkout — a
# lane's own `.ccam/profile/hooks/*.sh`, a scratch venv — which is gitignored,
# differs per machine, and can never be made compliant here. Untracked files
# are still audited, so a file an agent just wrote is caught before it is
# staged. The extra excludes below are for paths git DOES track (or would list)
# but the rule exempts — notably `mcp/build/`, which is committed on purpose
# (plugin MCP servers start before anything could build them) yet is still
# generated tsc output, and snapshots.
# @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>

set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
AUTHOR_MARK="@author Nguyễn Ngọc Trí Vĩ"

if ! git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
  echo "check-headers.sh: $ROOT is not a git work tree — nothing to audit against." >&2
  exit 1
fi

missing=0
while IFS= read -r f; do
  [ -f "$ROOT/$f" ] || continue # a staged deletion still lists
  if ! grep -q "$AUTHOR_MARK" "$ROOT/$f"; then
    echo "MISSING HEADER: $f"
    missing=1
  fi
done < <(
  git -C "$ROOT" ls-files --cached --others --exclude-standard |
    grep -E '\.(js|ts|tsx|cjs|mjs|py|sh|css)$' |
    grep -vE '\.min\.js$|(^|/)(__snapshots__|node_modules|dist|build)/|^(data|monitoring/\.(bin|data))/' || true
)

if [ "$missing" -eq 0 ]; then
  echo "✔ All applicable files carry the authorship header."
fi
exit "$missing"