#!/usr/bin/env bash
# Pathname-withdrawal test for the albok browse view over sshfs (unit 4.3 exposure gate).
#
#   1. ssh infra-ops@10.100.50.44 python3 - < setup-replica.py > manifest.json
#   2. ./run.sh [trials-per-condition]            # default 5; JSON lands in results-<stamp>.json
#   3. remove the replica on nh3-albok by its literal path when done
#
# The client is an ephemeral Debian 12 container on nh3-dev (sshfs 3.7.3 / libfuse 3), so
# nothing is installed on the host. It needs /dev/fuse and CAP_SYS_ADMIN to mount.
set -euo pipefail
here=$(cd "$(dirname "$0")" && pwd)
n=${1:-5}
stamp=$(date +%Y%m%d-%H%M)
out="$here/results-$stamp.json"
echo "start $(date '+%F %H%M %Z')" >&2
docker run --rm --device /dev/fuse --cap-add SYS_ADMIN --security-opt apparmor=unconfined \
  -v "$HOME/.ssh/infra-ops_ed25519:/keys/id:ro" \
  -v "$HOME/.ssh/known_hosts:/keys/known_hosts:ro" \
  -v "$here:/work" \
  debian:bookworm-slim bash -c "
    apt-get -qq update >/dev/null && apt-get -qq install -y sshfs python3 openssh-client >/dev/null 2>&1
    sshfs --version >&2
    python3 /work/run-trials.py /work/manifest.json $n" > "$out"
echo "end $(date '+%F %H%M %Z') -> $out" >&2