#!/usr/bin/env bash
 # ccebuild — build, install and inspect every binary in the cce workspace.
 #
 # The per-crate Makefiles name their binaries by hand, so a crate with extra
 # [[bin]] targets (cce-ui's cce-bevel/cce-ramp, cce-display-manager's keyring
 # helpers) or a crate with no Makefile at all silently never gets installed —
 # 11 of the workspace's 33 bin targets were unreachable that way. Everything
 # here is derived from `cargo metadata` instead, so new crates and new
 # src/bin/*.rs files are picked up with no edit to this script.
 
 set -euo pipefail
 
 # Dev-only binaries: built by the workspace, never installed.
 EXCLUDE=(vk-smoke)
 
 # Session targets a USER unit can be wanted by. Anything else (graphical.target,
 # multi-user.target) is a SYSTEM unit: root-owned, /etc/systemd/system, never
 # installed here.
 #
 # Classified per FILE, from the unit's own [Install] WantedBy, because a crate
 # can legitimately ship both: cce-display-manager once had the root unlock
 # daemon (multi-user.target) next to the per-session unlock client and KeePassXC
 # units (graphical-session.target). The old per-crate exclusion list swallowed the
 # whole crate, so its user units silently never installed — the same
 # hand-maintained-list failure this script exists to avoid. Matching is exact:
 # graphical.target and graphical-session.target are different targets.
 USER_UNIT_TARGETS=(default.target graphical-session.target cce-session.target timers.target)
 
 PREFIX="${CCE_PREFIX:-$HOME/.local}"
 BINDIR="$PREFIX/bin"
 UNITDIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
 DESKTOPDIR="${XDG_DATA_HOME:-$HOME/.local/share}/applications"
 ICONDIR="${XDG_DATA_HOME:-$HOME/.local/share}/icons"
 DBUSDIR="${XDG_DATA_HOME:-$HOME/.local/share}/dbus-1/services"
 PORTALDIR="${XDG_DATA_HOME:-$HOME/.local/share}/xdg-desktop-portal/portals"
 
 die() { printf 'ccebuild: %s\n' "$*" >&2; exit 1; }
 
 # Where the last `install` ran from, so a caller with neither $CCE_WORKSPACE nor
 # a cwd inside the tree can still find it: a GUI (the settings app's System
 # page shells out to install-system) and anything under pkexec, which scrubs
 # the environment. Written on every install, so it tracks a moved tree.
 WS_STAMP="${XDG_STATE_HOME:-$HOME/.local/state}/cce/workspace"
 
 # How long each binary last took to build, one `bin<TAB>seconds<TAB>epoch` line
 # per bin target, merged after every build (see record_build_times). The
 # settings app's System page reads it; cargo itself keeps no such record.
 BUILD_TIMES="${XDG_STATE_HOME:-$HOME/.local/state}/cce/build-times"
 
 # The workspace root. Never hardcoded: honour $CCE_WORKSPACE, else ask cargo
 # about the current directory (this script lives in ~/.local/bin once installed,
 # so its own path says nothing about where the source tree is), else the last
 # tree an install ran from.
 resolve_workspace() {
     if [ -n "${CCE_WORKSPACE:-}" ]; then
         [ -f "$CCE_WORKSPACE/Cargo.toml" ] || die "CCE_WORKSPACE=$CCE_WORKSPACE has no Cargo.toml"
         printf '%s\n' "$CCE_WORKSPACE"
         return
     fi
     local manifest
     if manifest=$(cargo locate-project --workspace --message-format plain 2>/dev/null); then
         dirname "$manifest"
         return
     fi
     local remembered
     if [ -r "$WS_STAMP" ] && remembered=$(cat "$WS_STAMP" 2>/dev/null) \
         && [ -n "$remembered" ] && [ -f "$remembered/Cargo.toml" ]; then
         printf '%s\n' "$remembered"
         return
     fi
     die "not inside the cce workspace — cd into it, or set CCE_WORKSPACE=/path/to/cce"
 }
 
 # Record the tree this run resolved, for the fallback above.
 remember_workspace() {
     mkdir -p "$(dirname "$WS_STAMP")" 2>/dev/null || return 0
     printf '%s\n' "$WS" > "$WS_STAMP" 2>/dev/null || true
 }
 
 # Every bin target cargo knows about, minus EXCLUDE. This is the whole point of
 # the script: one authoritative list, not 20 hand-written ones. With package
 # names as arguments, only those packages' bins — what a per-crate `make install`
 # needs.
 workspace_bins() {
     local filter='.packages[]'
     if [ "$#" -gt 0 ]; then
         local json
         json=$(printf '%s\n' "$@" | jq -R . | jq -sc .)
         filter=".packages[] | select(.name as \$n | $json | index(\$n))"
     fi
     cargo metadata --manifest-path "$WS/Cargo.toml" --no-deps --format-version 1 2>/dev/null \
         | jq -r "$filter | .targets[] | select(.kind | index(\"bin\")) | .name" \
         | sort -u \
         | while read -r bin; do
             case " ${EXCLUDE[*]} " in *" $bin "*) continue ;; esac
             printf '%s\n' "$bin"
           done
 }
 
 # Guard against a typo'd package name silently installing nothing.
 assert_packages() {
     local known name
     known=$(cargo metadata --manifest-path "$WS/Cargo.toml" --no-deps --format-version 1 2>/dev/null \
             | jq -r '.packages[].name')
     for name in "$@"; do
         printf '%s\n' "$known" | grep -qxF "$name" || die "unknown package '$name'"
     done
 }
 
 # Every systemd unit a crate ships, of any type. Units are NOT only .service:
 # cce-session.target is the session root — startcce starts and stops it, and
 # cce-grid/cce-remote are WantedBy it — and it sat unversioned for months partly
 # because a .service-only glob could not see it, so versioning it would have
 # deployed nothing. One helper feeds both classifiers so their globs cannot
 # drift apart.
 #
 # dbus/ is excluded outright: D-Bus activation files share the .service
 # extension but are not units (see dbus_services()). That used to be implicit —
 # they carry no [Install] WantedBy, so the old classifiers skipped them — but
 # the no-[Install] fallback below would otherwise adopt one.
 unit_files() {
     find "$WS" -maxdepth 3 \
          \( -name '*.service' -o -name '*.target' -o -name '*.timer' \
             -o -name '*.socket' -o -name '*.path' \) \
          -not -path "$WS/target/*" -not -path '*/dbus/*' 2>/dev/null
 }
 
 # The unit's [Install] WantedBy list; empty when it has no [Install] section.
 unit_wanted_by() {
     sed -n 's/^[[:space:]]*WantedBy[[:space:]]*=[[:space:]]*//p' "$1" | tr -d '\r'
 }
 
 # User-session unit files shipped by crates (system units excluded — see above).
 user_units() {
     local unit wanted t match base
     unit_files | while read -r unit; do
             wanted=$(unit_wanted_by "$unit")
             if [ -z "$wanted" ]; then
                 # No [Install] at all: a static unit, pulled in by a dependency
                 # or started by hand (cce-session.target — startcce starts it
                 # explicitly). There is no WantedBy to classify on, so default
                 # to the USER side, which is the direction that fails safe: the
                 # worst case is an inert file in ~/.config/systemd/user, whereas
                 # defaulting to the system side would write to /etc as root.
                 # .service is deliberately NOT eligible for this fallback —
                 # still requiring WantedBy there keeps the classification of
                 # every unit shipped today bit-for-bit unchanged.
                 # .service is deliberately NOT eligible for this fallback,
                 # with ONE exception: a service activated by a sibling
                 # .timer/.socket/.path. That pair is how a scheduled or
                 # socket-activated job is expressed and the service half
                 # legitimately carries no [Install] — without this, shipping a
                 # timer installed the timer and silently dropped the unit it
                 # triggers. Keyed on the sibling so a stray service file is
                 # still skipped.
                 case "$unit" in
                     *.service)
                         base=${unit%.service}
                         [ -f "$base.timer" ] || [ -f "$base.socket" ] \
                             || [ -f "$base.path" ] || continue
                         ;;
                 esac
                 printf '%s\n' "$unit"
                 continue
             fi
             match=0
             for t in $wanted; do
                 case " ${USER_UNIT_TARGETS[*]} " in *" $t "*) match=1 ;; esac
             done
             [ "$match" -eq 1 ] && printf '%s\n' "$unit"
           done
 }
 
 # System unit files: same per-file [Install] WantedBy classification as
 # user_units(), inverted — anything wanted by a non-session target
 # (graphical.target, multi-user.target) is root-owned and belongs in
 # /etc/systemd/system. Installed by install-system only, never here.
 system_units() {
     local unit wanted t match
     unit_files | while read -r unit; do
             wanted=$(unit_wanted_by "$unit")
             # A unit with no [Install] is never installed to /etc from here:
             # root deployment must be explicit, so it gets no fallback. See the
             # note in user_units().
             [ -n "$wanted" ] || continue
             match=0
             for t in $wanted; do
                 case " ${USER_UNIT_TARGETS[*]} " in *" $t "*) match=1 ;; esac
             done
             [ "$match" -eq 0 ] && printf '%s\n' "$unit"
           done
 }
 
 # PAM service files a crate ships in its pam/ dir, for /etc/pam.d. These were
 # hand-installed (`sudo install -m644 pam/* /etc/pam.d/`), which is the same
 # drift-by-hand failure as everything else this script absorbs: the /etc copy
 # quietly stops matching the repo the first time someone forgets the command.
 pam_files() {
     find "$WS" -mindepth 3 -maxdepth 3 -path '*/pam/*' -type f \
         -not -path "$WS/target/*" 2>/dev/null
 }
 
 # udev rules a crate ships in its udev/ dir, for /etc/udev/rules.d. Root-owned
 # like the system units, so install-system only; today that is the Power
 # page's plug/unplug trigger (cce-system-interface/udev/).
 udev_rules() {
     find "$WS" -mindepth 3 -maxdepth 3 -path '*/udev/*.rules' -type f \
         -not -path "$WS/target/*" 2>/dev/null
 }
 
 # The root-bound files whose names are not cce's own, one "!! why: path" per
 # line; empty when all are. A PAM stack must be named after the crate that
 # ships it (<crate> or <crate>-<word>), so no crate can replace a system
 # stack or another crate's; a system unit must be cce-*; a udev rule
 # NN-cce-*.rules. Lowercase, digits and dashes only, which also refuses an
 # editor's backup (`cce-lock~`, `.cce-lock.swp`).
 system_artifact_misnamed() {
     local file name crate
     while read -r file; do
         name=$(basename "$file")
         crate=$(basename "$(dirname "$(dirname "$file")")")
         [[ "$name" =~ ^${crate}(-[a-z0-9]+)*$ ]] \
             || printf '!! PAM stack not named after its crate (%s): %s\n' "$crate" "${file#"$WS"/}"
     done < <(pam_files)
     while read -r file; do
         name=$(basename "$file")
         [[ "$name" =~ ^cce(-[a-z0-9]+)+@?\.(service|timer|path|socket)$ ]] \
             || printf '!! system unit not named cce-*: %s\n' "${file#"$WS"/}"
     done < <(system_units)
     while read -r file; do
         name=$(basename "$file")
         [[ "$name" =~ ^[0-9][0-9]-cce(-[a-z0-9]+)+\.rules$ ]] \
             || printf '!! udev rule not named NN-cce-*.rules: %s\n' "${file#"$WS"/}"
     done < <(udev_rules)
 }
 
 # Helper scripts a crate ships in its own scripts/ dir. Not just this crate's:
 # a script belongs in the repo whose code it is about (cce-keyring-selftest
 # reports on the keyring chain, so it lives with it in cce-display-manager), and
 # anything installed from outside a repo is unversioned and lost on a fresh
 # clone. Units are excluded here — user_units() installs those, to a different
 # directory — and .desktop entries never live here.
 crate_scripts() {
     find "$WS" -mindepth 3 -maxdepth 3 -path '*/scripts/*' -type f \
         -not -path "$WS/target/*" 2>/dev/null
 }
 
 # D-Bus activation files a crate ships in its dbus/ dir, installed to
 # ~/.local/share/dbus-1/services where they shadow /usr/share ones by basename
 # (that shadowing is the mechanism: org.freedesktop.secrets.service overrides
 # the stock gnome-keyring activation with the TPM-unlocking unit's). Same
 # .service extension as systemd
 # units, but user_units() cannot mistake one for a unit: it keys on [Install]
 # WantedBy, which D-Bus files don't have.
 dbus_services() {
     find "$WS" -mindepth 3 -maxdepth 3 -path '*/dbus/*.service' -type f \
         -not -path "$WS/target/*" 2>/dev/null
 }
 
 # xdg-desktop-portal backend declarations a crate ships in its portals/ dir
 # (`<name>.portal`: the backend's bus name and the impl.portal interfaces it
 # serves), installed to $XDG_DATA_HOME/xdg-desktop-portal/portals where the
 # portal frontend reads them beside /usr/share's. The file only announces the
 # backend; the bus name it names must be activatable, which is the crate's
 # dbus/ service file. Which backend a desktop USES for an interface is
 # ~/.config/xdg-desktop-portal/cce-portals.conf, not installed from here.
 portal_files() {
     find "$WS" -mindepth 3 -maxdepth 3 -path '*/portals/*.portal' -type f \
         -not -path "$WS/target/*" 2>/dev/null
 }
 
 # XDG .desktop entries shipped by crates, at the crate root next to Cargo.toml.
 #
 # These used to be hand-written straight into ~/.local/share/applications, which
 # put them outside version control entirely: the workspace root is not a git
 # repo, so nothing there survives a fresh clone. They also went stale silently —
 # every one hardcoded Exec=/home/lsgalante/.local/bin/<bin>, and one pointed its
 # Icon at a path that no longer existed. A crate that ships its own entry is the
 # same rule as the units above: the file lives in the repo that owns it.
 #
 # An app is only reachable as an XDG default (mailto:, inode/directory, …) if it
 # declares a MimeType here, so this is also what makes cce apps selectable on the
 # settings app's Default Apps page.
 desktop_entries() {
     find "$WS" -maxdepth 2 -name '*.desktop' -not -path "$WS/target/*" 2>/dev/null
 }
 
 # App icons, as a whole XDG icon theme tree a crate ships under hicolor/ —
 # cce-icons/hicolor/scalable/apps/cce-files.svg installs to
 # $XDG_DATA_HOME/icons/hicolor/scalable/apps/cce-files.svg. The path IS the
 # install path, so an icon's size and context are its directory rather than a
 # rule in this script: adding 48x48/apps or scalable/mimetypes later needs no
 # edit here. The icon's basename must equal the Icon= key in the crate's
 # .desktop entry, which is what makes them resolve at all.
 #
 # Two things are load-bearing:
 #
 # - **`-type l` as well as `-type f`.** Every file in cce-icons/hicolor is a
 #   symlink into ../../../svg (svg/ is the sole source; an entry there is a name
 #   for a glyph, not a second copy of it). `-type f` alone does not match a
 #   symlink, so the plain `-type f` used by crate_scripts/dbus_services would
 #   find nothing at all here and report success. `install` dereferences, so the
 #   destination is a real file either way.
 # - **hicolor, and no index.theme.** hicolor is the spec's fallback theme,
 #   searched whatever the user's icon theme is; the sibling cce cursor theme
 #   installs to icons/cce and nothing anywhere selects it. The system
 #   hicolor-icon-theme package owns the index.theme listing every size/context
 #   dir, and a theme is the union of its trees across base dirs — shipping a
 #   second index here that named only scalable/apps would be read first and hide
 #   every other hicolor directory.
 #
 # The extension filter is the icon formats the icon-theme spec defines, not a
 # per-crate list: it is what keeps the tree's own README.md out of the install.
 app_icons() {
     find "$WS" -mindepth 3 -path '*/hicolor/*' \( -type f -o -type l \) \
         \( -name '*.svg' -o -name '*.png' -o -name '*.xpm' \) \
         -not -path "$WS/target/*" 2>/dev/null
 }
 
 # The crate directory a shipped data file belongs to. Units may sit one level
 # deeper (cce-compositor/scripts/gpu-watcher.service), so that case unwraps.
 file_crate_dir() {
     local dir
     dir=$(basename "$(dirname "$1")")
     # The subdirectories a crate ships installable files in; a file one level
     # down reports the crate above. A new kind of shipped file needs its dir
     # here, or its crate reads as e.g. "portals" and the package filter drops
     # it silently (which is how the first portal declaration went uninstalled).
     case "$dir" in
         scripts|dbus|portals) dir=$(basename "$(dirname "$(dirname "$1")")") ;;
     esac
     printf '%s\n' "$dir"
 }
 
 # Fold the `--timings` reports a build just wrote into BUILD_TIMES. A report
 # lists the build's units as JSON in its UNIT_DATA block: lib units have
 # target "", bins ` name "bin"`, build scripts ` build-script` /
 # ` build-script (run)`. Fresh units are listed too, with a duration of 0
 # (real ones are reported to 0.01s), so a bin at 0 was not rebuilt and keeps
 # the time already on file — a no-op build must not zero every entry. A binary's time is its own bin unit
 # plus every non-bin unit of its package — the lib and build script it cannot
 # be built without — so an incremental relink of a bin alone records just
 # that relink, which is what that build took. Dependencies (cce-ui included)
 # are not charged to anyone: one compile of them serves every app at once.
 #
 # Reports newer than the marker are this build's; a concurrent session's build
 # landing in the same window is a real build too, so recording it is right.
 # They are deleted once read — cargo writes a new one per invocation and they
 # would otherwise pile up in target/ forever.
 record_build_times() {
     local marker=$1 report new
     local dir="$WS/target/cargo-timings"
     [ -d "$dir" ] || return 0
     new=$(mktemp)
     while read -r report; do
         [ -n "$report" ] || continue
         awk '/^const UNIT_DATA = /,/^\];/' "$report" \
             | sed -e '1s/^const UNIT_DATA = //' -e '$s/;$//' \
             | jq -r --arg now "$(date -r "$report" +%s)" '
                 group_by(.name)[]
                 | (map(select(.target | endswith("\"bin\"") | not) | .duration) | add // 0) as $shared
                 | .[] | select((.target | endswith("\"bin\"")) and .duration > 0)
                 | [(.target | ltrimstr(" ") | split(" ")[0]),
                    ((.duration + $shared) * 100 | round / 100), $now]
                 | @tsv' >> "$new" 2>/dev/null || true
         rm -f "$report"
     done < <(find "$dir" -maxdepth 1 -name 'cargo-timing-*.html' -newer "$marker" 2>/dev/null | sort)
     if [ -s "$new" ]; then
         mkdir -p "$(dirname "$BUILD_TIMES")"
         # Last line per bin wins: the old file first, then this build's
         # reports in the order they were written (their names sort by time).
         # (A missing file is the first build, not a failure — pipefail would
         # otherwise drop the whole merge.)
         { cat "$BUILD_TIMES" 2>/dev/null || true; cat "$new"; } \
             | awk -F'\t' 'NF == 3 { t[$1] = $0 } END { for (b in t) print t[b] }' \
             | sort > "$BUILD_TIMES.tmp" && mv "$BUILD_TIMES.tmp" "$BUILD_TIMES"
     fi
     rm -f "$new"
 }
 
 # `cargo build --release` in the workspace with ARGS, recording how long each
 # binary took. The build's own exit status is returned untouched. A failed
 # build records nothing: its report carries the failed unit's time to the
 # error as if it were a build, and nothing it produced gets installed anyway.
 cargo_release_build() {
     local marker status=0
     marker=$(mktemp)
     ( cd "$WS" && cargo build --release --timings "$@" ) || status=$?
     if [ "$status" -eq 0 ]; then
         record_build_times "$marker"
     else
         find "$WS/target/cargo-timings" -maxdepth 1 -name 'cargo-timing-*.html' \
              -newer "$marker" -delete 2>/dev/null || true
     fi
     rm -f "$marker"
     return "$status"
 }
 
 # build [PKG...] — no packages means the whole workspace. The scoped form is
 # for sweeps (`ccebuild build a b c`, then `install --no-build` each): the same
 # single cargo invocation over the dependents, with build times recorded,
 # which a bare `cargo build -p …` would not do.
 cmd_build() {
     if [ "$#" -gt 0 ]; then
         assert_packages "$@"
         printf '==> building %s (release)\n' "$*"
         local args=("$@")
         cargo_release_build "${args[@]/#/-p}"
         return
     fi
     printf '==> building workspace (release)\n'
     # One invocation for the whole workspace. Building per-crate with -p would
     # resolve a different unified feature set and re-invalidate crates on every
     # alternation between the two command shapes.
     cargo_release_build --workspace
 }
 
 # install [--no-build] [PKG...] — no packages means the whole workspace; named
 # packages install only their own bins and units, which is what the per-crate
 # Makefile wrappers call.
 cmd_install() {
     remember_workspace
     local build=1
     [ "${1:-}" = --no-build ] && { build=0; shift; }
     local pkgs=("$@")
     [ ${#pkgs[@]} -gt 0 ] && assert_packages "${pkgs[@]}"
 
     if [ "$build" -eq 1 ]; then
         cmd_build "${pkgs[@]}"
     fi
 
     mkdir -p "$BINDIR" "$UNITDIR" "$DESKTOPDIR" "$DBUSDIR"
     local n=0 missing=()
 
     printf '==> installing binaries -> %s\n' "$BINDIR"
     while read -r bin; do
         if [ ! -f "$WS/target/release/$bin" ]; then
             missing+=("$bin")
             continue
         fi
         # `install` unlinks the destination first, so replacing a binary that is
         # currently running is safe (the live process keeps its inode).
         install -m 755 "$WS/target/release/$bin" "$BINDIR/$bin"
         n=$((n + 1))
     done < <(workspace_bins "${pkgs[@]}")
 
     # The compositor is installed as cce-fx and invoked as `cce`.
     if [ -f "$BINDIR/cce-fx" ]; then
         ln -sf cce-fx "$BINDIR/cce"
     fi
 
     local s scripts=0
     while read -r s; do
         [ -n "$s" ] || continue
         # Units living in a scripts/ dir (gpu-watcher.service) are installed by
         # user_units() to a different directory — never as an executable here.
         # Every unit extension, not just .service: a .target landing in BINDIR
         # would be an unexecutable "helper script" on PATH.
         case "$s" in *.service|*.target|*.timer|*.socket|*.path) continue ;; esac
         # Same filtered install as the units and desktop entries below.
         if [ ${#pkgs[@]} -gt 0 ]; then
             crate_selected "$(file_crate_dir "$s")" "${pkgs[@]}" || continue
         fi
         [ "$scripts" -eq 0 ] && printf '==> installing helper scripts -> %s\n' "$BINDIR"
         install -m 755 "$s" "$BINDIR/$(basename "$s")"
         scripts=$((scripts + 1))
         n=$((n + 1))
     done < <(crate_scripts)
 
     local u units=0
     while read -r u; do
         [ -n "$u" ] || continue
         # Filtered install: only units belonging to a selected package's crate.
         if [ ${#pkgs[@]} -gt 0 ]; then
             crate_selected "$(file_crate_dir "$u")" "${pkgs[@]}" || continue
         fi
         [ "$units" -eq 0 ] && printf '==> installing user units -> %s\n' "$UNITDIR"
         install -m 644 "$u" "$UNITDIR/$(basename "$u")"
         units=$((units + 1))
     done < <(user_units)
     [ "$units" -gt 0 ] && { systemctl --user daemon-reload 2>/dev/null || true; }
 
     local b dbus=0
     while read -r b; do
         [ -n "$b" ] || continue
         # Same filtered install as the units above.
         if [ ${#pkgs[@]} -gt 0 ]; then
             crate_selected "$(file_crate_dir "$b")" "${pkgs[@]}" || continue
         fi
         [ "$dbus" -eq 0 ] && printf '==> installing dbus activation files -> %s\n' "$DBUSDIR"
         install -m 644 "$b" "$DBUSDIR/$(basename "$b")"
         dbus=$((dbus + 1))
     done < <(dbus_services)
 
     local pf portals=0
     while read -r pf; do
         [ -n "$pf" ] || continue
         # Same filtered install as the units above.
         if [ ${#pkgs[@]} -gt 0 ]; then
             crate_selected "$(file_crate_dir "$pf")" "${pkgs[@]}" || continue
         fi
         [ "$portals" -eq 0 ] && { printf '==> installing portal declarations -> %s\n' "$PORTALDIR"; mkdir -p "$PORTALDIR"; }
         install -m 644 "$pf" "$PORTALDIR/$(basename "$pf")"
         portals=$((portals + 1))
     done < <(portal_files)
 
     local d desktops=0
     while read -r d; do
         [ -n "$d" ] || continue
         # Same filtered install as the units above.
         if [ ${#pkgs[@]} -gt 0 ]; then
             crate_selected "$(file_crate_dir "$d")" "${pkgs[@]}" || continue
         fi
         [ "$desktops" -eq 0 ] && printf '==> installing desktop entries -> %s\n' "$DESKTOPDIR"
         install -m 644 "$d" "$DESKTOPDIR/$(basename "$d")"
         desktops=$((desktops + 1))
     done < <(desktop_entries)
     # Refreshes the MIME cache that makes a newly-declared MimeType resolvable.
     # Absent on a minimal install and non-fatal there, so failure is ignored.
     [ "$desktops" -gt 0 ] && { update-desktop-database "$DESKTOPDIR" 2>/dev/null || true; }
 
     # Deliberately NOT filtered by package. The icon theme is one shared tree
     # owned by cce-icons, which has no Cargo.toml — it is an asset repo, not a
     # crate — so crate_selected() can never match it and a filtered install
     # would silently install no icons at all. file_crate_dir() is no help
     # either: the dir above an icon is `apps`, not the crate. Over-installing a
     # dozen small files on `ccebuild install cce-preview` is the cheaper wrong
     # answer than an app whose entry points at an icon that was never shipped.
     local i icons=0 rel
     while read -r i; do
         [ -n "$i" ] || continue
         # Everything after the hicolor/ component, so the source tree's layout
         # is reproduced verbatim under $ICONDIR.
         rel="hicolor/${i#*/hicolor/}"
         [ "$icons" -eq 0 ] && printf '==> installing app icons -> %s\n' "$ICONDIR"
         install -D -m 644 "$i" "$ICONDIR/$rel"
         icons=$((icons + 1))
         n=$((n + 1))
     done < <(app_icons)
     # GTK reads the mmapped cache in preference to the directory when it is
     # newer than the directory, so a new icon can be invisible until it is
     # rebuilt. --ignore-theme-index because this tree deliberately ships no
     # index.theme (see app_icons above); absent on a minimal install, so
     # failure is ignored.
     [ "$icons" -gt 0 ] && {
         gtk-update-icon-cache --ignore-theme-index -q -f "$ICONDIR/hicolor" 2>/dev/null || true
     }
 
     if [ ${#missing[@]} -gt 0 ]; then
         printf 'ccebuild: NOT BUILT, skipped: %s\n' "${missing[*]}" >&2
     fi
     printf '==> installed %d files\n' "$n"
 }
 
 # Is directory name $1 the crate dir of any of the packages in $2..? Package name
 # and directory usually match, but not always (cce-fx lives in cce-compositor).
 crate_selected() {
     local dir=$1; shift
     local pkg manifest
     for pkg in "$@"; do
         manifest=$(cargo metadata --manifest-path "$WS/Cargo.toml" --no-deps --format-version 1 2>/dev/null \
                    | jq -r --arg p "$pkg" '.packages[] | select(.name == $p) | .manifest_path')
         [ "$(basename "$(dirname "$manifest")")" = "$dir" ] && return 0
     done
     return 1
 }
 
 # Report drift three ways: built-vs-installed, and installed-vs-running. The
 # last one matters because an app launched straight out of target/ (or from a
 # stale path) keeps running old code that no reinstall can touch.
 cmd_status() {
     local built inst stale=0 missing=0 ok=0
     printf '%-28s %-8s %s\n' NAME STATE DETAIL
     while read -r bin; do
         built="$WS/target/release/$bin"
         inst="$BINDIR/$bin"
         if [ ! -f "$built" ]; then
             printf '%-28s %-8s %s\n' "$bin" "nobuild" "not in target/release"
             continue
         fi
         if [ ! -f "$inst" ]; then
             printf '%-28s %-8s %s\n' "$bin" "MISSING" "never installed"
             missing=$((missing + 1))
         elif [ "$built" -nt "$inst" ]; then
             printf '%-28s %-8s %s\n' "$bin" "STALE" "built $(date -r "$built" +%m-%d_%H:%M:%S) > installed $(date -r "$inst" +%m-%d_%H:%M:%S)"
             stale=$((stale + 1))
         else
             ok=$((ok + 1))
         fi
     done < <(workspace_bins)
     printf -- '-- %d up to date, %d stale, %d missing\n' "$ok" "$stale" "$missing"
 
     printf '\n==> running processes not using the installed binary\n'
     # Scan /proc directly rather than prefiltering with `pgrep -f cce-`: a
     # process's ARGV has no reliable bearing on which binary it is. The
     # compositor is the case that matters — startcce launches it through the
     # `cce` symlink, so its argv is "…/bin/cce --log-level debug -c
     # /tmp/cce-launch.sh" and it only ever matched 'cce-' by way of that
     # incidental script path. Rename or drop that argument and the one process
     # this report exists for would silently vanish from it, precisely because
     # `restart` cannot restart the compositor and it therefore sits on a stale
     # binary longer than anything else. (`ccectl` was unreachable for the same
     # reason.) The exe basename below is the authoritative test; it needs no
     # help from a guess about argv.
     local found=0 pid exe base
     for pid in /proc/[0-9]*; do
         pid=${pid#/proc/}
         exe=$(readlink "/proc/$pid/exe" 2>/dev/null) || continue
         base=${exe%% (deleted)}
         base=$(basename "$base")
         # `cce*` already covers ccectl and the bare `cce` symlink.
         case "$base" in cce*) ;; *) continue ;; esac
         if [ "$exe" != "$BINDIR/$base" ]; then
             printf '  %-8s %-24s %s\n' "$pid" "$base" "$exe"
             found=1
         fi
     done
     [ "$found" -eq 0 ] && printf '  (none — every running cce process is on its installed binary)\n'
 }
 
 # Delete target/ artifacts belonging to crates cargo no longer knows about —
 # what renamed crates leave behind (cce-system-settings, cce-wallpaper, …), once
 # 15G of it. Dry-run by default.
 #
 # The matching is deliberately strict. A glob like 'cce-status*' also eats the
 # LIVE cce-status-interface, and a bare 'cce*' matches the entire tree; both were
 # real near-misses. So: a basename must equal a dead crate name exactly, or that
 # name followed by a hex hash (cargo's artifact suffix) — never a name followed
 # by more words.
 cmd_prune() {
     local apply=0
     [ "${1:-}" = --apply ] && apply=1
 
     # Live names in both hyphen and underscore form (cargo uses both).
     local live
     live=$( { cargo metadata --manifest-path "$WS/Cargo.toml" --no-deps --format-version 1 2>/dev/null \
                 | jq -r '.packages[] | .name, (.targets[] | .name)'; } | sort -u )
     live=$(printf '%s\n%s\n' "$live" "$(printf '%s\n' "$live" | tr '-' '_')" | sort -u)
 
     # Detect dead crates from .fingerprint/ ONLY. Those directories are exactly
     # <pkgname>-<hex hash>, one per crate, so stripping the hash yields a real
     # package name. Deriving names from deps/ instead reads artifacts like
     # cce_terminal-0qsvll1iqr9dj (incremental) whose suffix is not hex, leaving a
     # bogus "crate name" that looks orphaned — a false positive that would have
     # deleted live cce-ui and cce-terminal caches.
     local dead
     dead=$(find "$WS/target" -maxdepth 3 -path '*/.fingerprint/*' -name 'cce*' -printf '%f\n' 2>/dev/null \
            | sed -E 's/-[0-9a-f]{8,}$//' | sort -u)
     dead=$(comm -23 <(printf '%s\n' "$dead" | grep -v '^$' | sort -u) <(printf '%s\n' "$live"))
 
     if [ -z "$dead" ]; then
         printf 'ccebuild: no orphaned crate artifacts\n'
         return
     fi
 
     printf '==> orphaned crates (no longer in cargo metadata):\n'
     printf '%s\n' "$dead" | sed 's/^/  /'
 
     local list total
     list=$(mktemp); trap 'rm -f "$list"' RETURN
     # Only hex-suffixed artifacts (deps/, .fingerprint/, top-level binaries).
     # incremental/ is deliberately NOT pruned: its directory suffixes are not hex,
     # so a pattern loose enough to catch them ("cce" + any alnum) would also match
     # live siblings like cce-authenticator. It is regenerable anyway — clear the
     # whole of target/*/incremental if you want that space.
     local name under
     while read -r name; do
         [ -n "$name" ] || continue
         under=$(printf '%s' "$name" | tr '-' '_')
         find "$WS/target" -maxdepth 4 -regextype posix-extended \
              -not -path '*/incremental/*' \
              -regex ".*/($name|$under)(-[0-9a-f]{8,})?(\..*)?" -prune -print 2>/dev/null >> "$list"
     done <<< "$dead"
     sort -u "$list" -o "$list"
 
     # Guard: nothing whose basename stem is a live crate may be in the list.
     local leak
     leak=$(awk -F/ 'NR==FNR{l[$0];next}{b=$NF; sub(/\.(d|rlib|rmeta|so|o|dwo)$/,"",b); sub(/-[0-9a-f]{8,}$/,"",b); if(b in l) print $0}' \
            <(printf '%s\n' "$live") "$list" | head -3)
     [ -n "$leak" ] && die "refusing to prune: live artifacts matched:"$'\n'"$leak"
 
     total=$(tr '\n' '\0' < "$list" | du -shc --files0-from=- 2>/dev/null | tail -1 | cut -f1)
     printf -- '-- %s entries, %s\n' "$(wc -l < "$list")" "${total:-0}"
 
     if [ "$apply" -eq 0 ]; then
         printf 'ccebuild: dry run — pass `prune --apply` to delete\n'
         return
     fi
     tr '\n' '\0' < "$list" | xargs -0 rm -rf
     printf '==> pruned\n'
 }
 
 # Restart the user services whose binary has been replaced underneath them.
 #
 # `install` unlinks the destination before writing, so a service still running
 # the pre-install inode reports its exe as "... (deleted)" — a precise signal
 # that a restart is owed, and one that needs no timestamp bookkeeping. Units
 # already on the current binary are left alone, so this is safe to run after
 # every install.
 #
 # The compositor is deliberately unreachable here: it is not a user unit (it is
 # started by startcce), and restarting it would tear down the session.
 #
 # `restart PKG...` scopes the sweep to units whose unit files live in the named
 # crates (same crate_selected/file_crate_dir mapping as the filtered install).
 # This is the multi-session-safe form: several agents work in sibling crates
 # concurrently, and an unscoped restart bounces services another session has
 # installed but is not ready to restart (WORKSPACE.md "Concurrent sessions").
 cmd_restart() {
     local all=0
     [ "${1:-}" = --all ] && { all=1; shift; }
     local pkgs=("$@")
     [ ${#pkgs[@]} -gt 0 ] && assert_packages "${pkgs[@]}"
 
     # Crate scope: unit-file basenames belonging to the named packages.
     local scoped="" u
     if [ ${#pkgs[@]} -gt 0 ]; then
         while read -r u; do
             [ -n "$u" ] || continue
             crate_selected "$(file_crate_dir "$u")" "${pkgs[@]}" || continue
             scoped="$scoped $(basename "$u")"
         done < <(user_units)
         [ -n "$scoped" ] || { printf 'ccebuild: no user units belong to: %s\n' "${pkgs[*]}"; return; }
     fi
 
     systemctl --user daemon-reload 2>/dev/null || true
 
     local units unit pid exe want=()
     units=$(systemctl --user list-units --type=service --state=running --no-legend 2>/dev/null \
             | awk '{print $1}' | grep -E '^(cce|gpu-watcher)' || true)
     [ -n "$units" ] || { printf 'ccebuild: no cce user services running\n'; return; }
 
     for unit in $units; do
         if [ -n "$scoped" ]; then
             case " $scoped " in
                 *" $unit "*) ;;
                 *) continue ;;
             esac
         fi
         if [ "$all" -eq 1 ]; then
             want+=("$unit")
             continue
         fi
         pid=$(systemctl --user show -p MainPID --value "$unit" 2>/dev/null)
         [ -n "$pid" ] && [ "$pid" != 0 ] || continue
         exe=$(readlink "/proc/$pid/exe" 2>/dev/null) || continue
         case "$exe" in *"(deleted)") want+=("$unit") ;; esac
     done
 
     if [ ${#want[@]} -eq 0 ]; then
         if [ ${#pkgs[@]} -gt 0 ]; then
             printf 'ccebuild: no running service of %s is on a replaced binary\n' "${pkgs[*]}"
         else
             printf 'ccebuild: every running cce service is already on its current binary\n'
         fi
         return
     fi
 
     printf '==> restarting %d service(s)\n' "${#want[@]}"
     for unit in "${want[@]}"; do
         printf '  %s ... ' "$unit"
         if systemctl --user restart "$unit" 2>/dev/null; then
             printf '%s\n' "$(systemctl --user is-active "$unit")"
         else
             printf 'FAILED\n'
         fi
     done
 
     # A unit that comes back inactive is a silent breakage — surface it.
     local bad=0
     for unit in "${want[@]}"; do
         [ "$(systemctl --user is-active "$unit")" = active ] || { printf 'ccebuild: %s is NOT active\n' "$unit" >&2; bad=1; }
     done
     [ "$bad" -eq 0 ] || exit 1
 }
 
 # The root-owned install paths. Separate command because it needs sudo, which is
 # exactly why these drifted three weeks behind everything else.
 #
 # Planned here as the normal user (every target is world-readable, so the
 # compare needs no privilege), then applied by ONE `sudo bash -c` call. One
 # prompt however sudo authenticates: fingerprint sudo never caches a timestamp
 # on this machine, so the former `sudo -n true` guard refused every run and a
 # chain of separate `sudo` calls would prompt once per file. A single script
 # under `set -e` is also all-or-nothing — no half-applied update.
 cmd_install_system() {
     local dry=0 how=auto
     while [ $# -gt 0 ]; do
         case "$1" in
             -n|--dry-run) dry=1 ;;
             --pkexec) how=pkexec ;;
             --sudo) how=sudo ;;
             *) die "install-system takes only --dry-run, --pkexec or --sudo" ;;
         esac
         shift
     done
     # Everything below lands in /etc as root, discovered from whatever the
     # crates' pam/, udev/ and unit files hold. Until 2026-10-02 nothing
     # checked a name: a pam/system-auth or pam/sudo in any crate, or an
     # editor's backup of a real stack, would have replaced a system file
     # with no prompt beyond the one sudo. Names are now held to what cce
     # ships, and anything else stops the run before a root command is
     # planned.
     local bad; bad=$(system_artifact_misnamed)
     if [ -n "$bad" ]; then
         printf '%s\n' "$bad" >&2
         die "install-system refuses files not named as cce's own (see above); rename or remove them"
     fi
     local stamp; stamp=$(date +%F)
     local plan="set -e"
     # Append one root command to the plan, each word shell-quoted.
     queue() { plan+=$'\n'"$(printf '%q ' "$@")"; }
 
     local pairs=(
         "cce-display-manager:/usr/bin/cce-display-manager"
         # The Power page's root-side applier: the udev rule and system unit
         # both name this path.
         "cce-power-apply:/usr/bin/cce-power-apply"
     )
     local entry bin dest src
     for entry in "${pairs[@]}"; do
         bin=${entry%%:*}; dest=${entry#*:}
         src="$WS/target/release/$bin"
         [ -f "$src" ] || die "$bin not built — run: ccebuild build"
         if [ -e "$dest" ] && cmp -s "$src" "$dest"; then continue; fi
         printf '  %s -> %s\n' "$bin" "$dest"
         # A first install has nothing to back up. (This used to skip an
         # absent destination, which made a NEW root binary — cce-power-apply
         # — uninstallable by the one command meant to install it.)
         if [ -e "$dest" ]; then queue cp -a "$dest" "$dest.bak-$stamp"; fi
         # `install` unlinks first: safe even though these are running as root.
         queue install -m 755 "$src" "$dest"
     done
 
     # System units and PAM stacks ship from the crates too (discovered, not
     # hand-listed). Backups only when the content actually changed, so a no-op
     # run does not accrete .bak files.
     local file reload=0
     while read -r file; do
         dest="/etc/systemd/system/$(basename "$file")"
         if [ -e "$dest" ] && cmp -s "$file" "$dest"; then continue; fi
         printf '  %s -> %s\n' "$(basename "$file")" "$dest"
         if [ -e "$dest" ]; then queue cp -a "$dest" "$dest.bak-$stamp"; fi
         queue install -m 644 "$file" "$dest"
         reload=1
     done < <(system_units)
     if [ "$reload" -eq 1 ]; then queue systemctl daemon-reload; fi
 
     # Enabling is opt-in per unit, with `X-CceEnable=yes` in its [Install]
     # (systemd ignores X- keys). Most units here must not be enabled on
     # install: cce-display-manager.service stays disabled because the
     # template is what runs. But a unit wanted by a sleep target, like
     # cce-power-apply-resume.service, does nothing until it is enabled, and
     # an install that skipped that step would report success for a hook
     # that never fires. Checked as the user (is-enabled needs no privilege),
     # queued after the daemon-reload so a unit that is new in this run is
     # already known.
     local unit
     while read -r file; do
         grep -qE '^[[:space:]]*X-CceEnable[[:space:]]*=[[:space:]]*yes[[:space:]]*$' "$file" || continue
         unit=$(basename "$file")
         if systemctl is-enabled --quiet "$unit" 2>/dev/null; then continue; fi
         printf '  enable %s\n' "$unit"
         queue systemctl enable "$unit"
     done < <(system_units)
 
     while read -r file; do
         dest="/etc/pam.d/$(basename "$file")"
         if [ -e "$dest" ] && cmp -s "$file" "$dest"; then continue; fi
         printf '  %s -> %s\n' "$(basename "$file")" "$dest"
         if [ -e "$dest" ]; then queue cp -a "$dest" "$dest.bak-$stamp"; fi
         queue install -m 644 "$file" "$dest"
     done < <(pam_files)
 
     # udev rules: reload after a change, and re-trigger the power_supply
     # class so a freshly installed plug/unplug rule applies the plan now
     # rather than at the next replug. (A trigger is not a restart: it runs
     # the oneshot the rule names, nothing else.)
     local rules_changed=0
     while read -r file; do
         dest="/etc/udev/rules.d/$(basename "$file")"
         if [ -e "$dest" ] && cmp -s "$file" "$dest"; then continue; fi
         printf '  %s -> %s\n' "$(basename "$file")" "$dest"
         if [ -e "$dest" ]; then queue cp -a "$dest" "$dest.bak-$stamp"; fi
         queue install -m 644 "$file" "$dest"
         rules_changed=1
     done < <(udev_rules)
     if [ "$rules_changed" -eq 1 ]; then
         queue udevadm control --reload
         queue udevadm trigger --subsystem-match=power_supply --action=change
     fi
 
     if [ "$plan" = "set -e" ]; then
         printf '==> system artifacts already up to date\n'
         return 0
     fi
     if [ "$dry" -eq 1 ]; then
         printf '==> dry run; would run as root:\n%s\n' "${plan#set -e}"
         return 0
     fi
     # How the one root call authenticates. sudo on a terminal, pkexec
     # otherwise — a GUI caller (the settings app's System page) and an agent
     # shell both have no TTY, and sudo there dies on "a terminal is required
     # to read the password" after the fingerprint prompt it cannot show times
     # out. pkexec asks the session's polkit agent (cce-authenticator) instead,
     # which is how every other privileged action in this desktop already
     # authenticates. The PLAN is still built as the user either way, which is
     # what makes this safe: pkexec scrubs the environment, so $WS, $HOME and
     # `cargo locate-project` would all be gone if the resolution happened on
     # the far side.
     if [ "$how" = auto ]; then
         if [ -t 0 ]; then how=sudo; else how=pkexec; fi
     fi
     case "$how" in
         sudo)
             printf '==> applying as root (one sudo prompt)\n'
             sudo bash -c "$plan"
             ;;
         pkexec)
             command -v pkexec >/dev/null 2>&1 || die "pkexec not found — run from a terminal for the sudo path"
             printf '==> applying as root (authenticate in the polkit prompt)\n'
             # Full path: pkexec refuses a bare program name.
             pkexec /bin/bash -c "$plan"
             ;;
     esac
     printf '==> system artifacts updated (binaries take effect at next login; nothing restarted)\n'
 }
 
 usage() {
     cat <<'EOF'
 usage: ccebuild <command>
 
   build [PKG...]        cargo build --release --workspace (or -p each PKG),
                         recording each binary's build time
   install [--no-build]  build, then install every bin target, helper script
                         and user unit (derived from cargo metadata)
   status                show built-vs-installed drift, and running processes
                         that are not on their installed binary
   restart [--all] [PKG...]
                         restart user services still running a replaced binary
                         (--all: regardless of binary state; PKG...: only units
                         belonging to those crates — the safe form when other
                         sessions are working). Never the compositor.
   prune [--apply]       delete target/ artifacts of crates cargo no longer
                         knows about (renamed/retired); dry-run by default
   install-system [--dry-run] [--pkexec|--sudo]
                         update the root-owned artifacts: binaries, system
                         units, /etc/pam.d stacks, udev rules — one prompt for the whole
                         batch; backs up each changed file and restarts
                         nothing (--dry-run: print the root commands only).
                         Authenticates with sudo on a terminal and pkexec
                         (the session's polkit agent) without one; --pkexec
                         and --sudo force the choice.
 
 environment:
   CCE_WORKSPACE  workspace root (default: located from the current directory)
   CCE_PREFIX     install prefix (default: ~/.local)
 EOF
 }
 
 command -v jq >/dev/null || die "jq is required"
 WS=$(resolve_workspace)
 
 case "${1:-}" in
     build)          shift; cmd_build "$@" ;;
     install)        shift; cmd_install "$@" ;;
     status)         cmd_status ;;
     restart)        shift; cmd_restart "$@" ;;
     prune)          shift; cmd_prune "$@" ;;
     install-system) shift; cmd_install_system "$@" ;;
     -h|--help|help|"") usage ;;
     *) die "unknown command '$1' (try: ccebuild --help)" ;;
 esac