pre-push

#!/usr/bin/env bash

set -eo pipefail

# Git runs hooks with the working directory at the top of the invoking work
# tree, so fall back to it when `git rev-parse --show-toplevel` cannot resolve a
# work tree. This keeps linked worktrees from aborting into a --no-verify push.
cd "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"

# shellcheck source=dev-harness/_resolve_python.sh
source scripts/dev-harness/_resolve_python.sh
PYTHON_BIN="$(dev_harness_python)"
BACKEND_PYTHON="$(dev_harness_canonical_python || true)"

PUSH_REMOTE="${1:-origin}"
BASE_REMOTE="${PRE_PUSH_BASE_REMOTE:-origin}"
BASE_BRANCH="${PRE_PUSH_BASE_BRANCH:-main}"
BASE_REMOTE_REF="refs/remotes/${BASE_REMOTE}/${BASE_BRANCH}"

if ! git rev-parse --verify "$BASE_REMOTE_REF" >/dev/null 2>&1; then
  BASE_REMOTE_REF="refs/remotes/origin/${BASE_BRANCH}"
fi

if ! git rev-parse --verify "$BASE_REMOTE_REF" >/dev/null 2>&1; then
  echo "FAIL: cannot find ${BASE_REMOTE}/${BASE_BRANCH} or origin/${BASE_BRANCH}. Run git fetch origin ${BASE_BRANCH}." >&2
  exit 1
fi

BASE_REF=$(git merge-base "$BASE_REMOTE_REF" HEAD)
CURRENT_BRANCH=$(git symbolic-ref --short -q HEAD || true)
ZERO_SHA="0000000000000000000000000000000000000000"

declare -a PUSH_UPDATES=()
declare -a DIFF_SUMMARIES=()
while read -r local_ref local_oid remote_ref remote_oid; do
  [ -n "${local_ref:-}" ] || continue
  [ "${local_oid:-$ZERO_SHA}" != "$ZERO_SHA" ] || continue
  PUSH_UPDATES+=("$local_oid:$remote_oid:$remote_ref")
done

if [ "${#PUSH_UPDATES[@]}" -gt 0 ]; then
  echo "Running bounded pre-push checks for ${#PUSH_UPDATES[@]} pushed ref(s) against ${BASE_REMOTE_REF#refs/remotes/}."
else
  echo "Running bounded pre-push checks against ${BASE_REMOTE_REF#refs/remotes/} (merge-base ${BASE_REF:0:12})"
fi

declare -a CHANGED_FILES=()
if [ "${#PUSH_UPDATES[@]}" -gt 0 ]; then
  for update in "${PUSH_UPDATES[@]}"; do
    IFS=: read -r local_oid remote_oid remote_ref <<<"$update"
    # Check selection describes the final review surface, not every historical
    # commit needed to reconcile a stale remote PR branch.
    DIFF_BASE=$(scripts/pre-push-diff-base "$BASE_REMOTE_REF" "$local_oid")
    changed_count=$(scripts/changed-files "$DIFF_BASE" "$local_oid" | wc -l | tr -d ' ')
    DIFF_SUMMARIES+=("${remote_ref:-$local_oid}: ${changed_count} changed file(s) since ${DIFF_BASE:0:12}")
    while IFS= read -r file; do
      [ -n "$file" ] && CHANGED_FILES+=("$file")
    done < <(scripts/changed-files "$DIFF_BASE" "$local_oid")
  done
else
  changed_count=$(scripts/changed-files "$BASE_REF" HEAD | wc -l | tr -d ' ')
  DIFF_SUMMARIES+=("HEAD: ${changed_count} changed file(s) since ${BASE_REF:0:12}")
  while IFS= read -r file; do
    [ -n "$file" ] && CHANGED_FILES+=("$file")
  done < <(scripts/changed-files "$BASE_REF" HEAD)
fi

if [ "${#CHANGED_FILES[@]}" -gt 0 ]; then
  declare -a UNIQUE_CHANGED_FILES=()
  while IFS= read -r file; do
    [ -n "$file" ] && UNIQUE_CHANGED_FILES+=("$file")
  done < <(printf '%s\n' "${CHANGED_FILES[@]}" | sort -u)
  CHANGED_FILES=("${UNIQUE_CHANGED_FILES[@]}")
fi

echo "Pre-push diff summary:"
for summary in "${DIFF_SUMMARIES[@]}"; do
  echo "  ${summary}"
done
echo "Unique changed files considered by hooks: ${#CHANGED_FILES[@]}"
if [ "${PRE_PUSH_DEBUG:-}" = "1" ] && [ "${#CHANGED_FILES[@]}" -gt 0 ]; then
  printf '  %s\n' "${CHANGED_FILES[@]}"
fi

CHANGED_FILES_LIST=$(mktemp "${TMPDIR:-/tmp}/omi-pre-push-changed-files.XXXXXX")
SELECTED_BACKEND_TESTS=$(mktemp "${TMPDIR:-/tmp}/omi-pre-push-backend-tests.XXXXXX")
SELECTED_BACKEND_TESTS_REASON=$(mktemp "${TMPDIR:-/tmp}/omi-pre-push-backend-tests-reason.XXXXXX")
FAST_BACKEND_TESTS=$(mktemp "${TMPDIR:-/tmp}/omi-pre-push-fast-backend-tests.XXXXXX")
RELEASE_GUARD_TESTS=$(mktemp "${TMPDIR:-/tmp}/omi-pre-push-release-guard-tests.XXXXXX")
trap 'rm -f "$CHANGED_FILES_LIST" "$SELECTED_BACKEND_TESTS" "$SELECTED_BACKEND_TESTS_REASON" "$FAST_BACKEND_TESTS" "$RELEASE_GUARD_TESTS"' EXIT
printf '%s\n' "${CHANGED_FILES[@]}" > "$CHANGED_FILES_LIST"
declare -a CI_PREDICTION_VERIFIED=()
declare -a CI_PREDICTION_DEFERRED=()
declare -a CI_PREDICTION_SKIPPED=()
CI_PREDICTION_SELECTION=""

ci_prediction_note_verified() {
  CI_PREDICTION_VERIFIED+=("$1")
}

ci_prediction_note_deferred() {
  CI_PREDICTION_DEFERRED+=("$1")
}

ci_prediction_note_skipped() {
  CI_PREDICTION_SKIPPED+=("$1")
}

ci_prediction_selected() {
  printf '%s\n' "$CI_PREDICTION_SELECTION" | grep -Fqx "$1"
}

print_ci_prediction_summary() {
  local item

  echo "CI prediction (bounded local evidence)"
  if [ "${#CI_PREDICTION_VERIFIED[@]}" -gt 0 ]; then
    echo "  verified:"
    for item in "${CI_PREDICTION_VERIFIED[@]}"; do
      echo "    - $item"
    done
  fi
  if [ "${#CI_PREDICTION_DEFERRED[@]}" -gt 0 ]; then
    echo "  deferred to CI:"
    for item in "${CI_PREDICTION_DEFERRED[@]}"; do
      echo "    - $item"
    done
  fi
  if [ "${#CI_PREDICTION_SKIPPED[@]}" -gt 0 ]; then
    echo "  deliberately skipped (not locally certified):"
    for item in "${CI_PREDICTION_SKIPPED[@]}"; do
      echo "    - $item"
    done
  fi
}

require_backend_python() {
  if [[ -n "$BACKEND_PYTHON" && -x "$BACKEND_PYTHON" ]]; then
    return 0
  fi
  echo "FAIL: a selected backend check requires the canonical backend/.venv interpreter, but it was not found." >&2
  echo "      Create it with: make setup" >&2
  return 1
}

run_step() {
  local started
  local elapsed
  started=$SECONDS
  echo "==> $*"
  "$@"
  elapsed=$((SECONDS - started))
  echo "<== PASS $* (${elapsed}s)"
}

changed_matches() {
  local file
  local pattern

  for file in "${CHANGED_FILES[@]}"; do
    for pattern in "$@"; do
      case "$file" in
        $pattern)
          return 0
          ;;
      esac
    done
  done
  return 1
}

CI_PREDICTION_SELECTION=$("$PYTHON_BIN" scripts/pre_push_ci_prediction.py --changed-files "$CHANGED_FILES_LIST" --base "$BASE_REF")
if ci_prediction_selected "app-ci-only"; then
  ci_prediction_note_deferred "full Flutter analyzer/tests and platform compiles"
fi
if ci_prediction_selected "desktop-ci-only"; then
  ci_prediction_note_deferred "full desktop harness, release builds, and platform packaging"
fi
if ci_prediction_selected "windows-kgworker-native-closure"; then
  ci_prediction_note_deferred "Windows packaged build and real asar worker proof"
fi

check_pr_preflight() {
  local has_supplied_pr_body=0

  if [ "${PRE_PUSH_SKIP_PR_PREFLIGHT:-}" = "1" ]; then
    # The broad preflight hatch is useful when local PR metadata discovery is
    # unavailable, but it must not let a recurring failure class bypass the
    # guard-artifact ratchet that CI enforces. That check is deterministic and
    # needs only the already-required local PR body, so keep it mandatory.
    if [ -z "${OMI_PR_BODY_FILE:-}" ] || [ ! -f "${OMI_PR_BODY_FILE}" ]; then
      echo "FAIL: PRE_PUSH_SKIP_PR_PREFLIGHT=1 requires OMI_PR_BODY_FILE so the failure-class guard-artifact ratchet still runs." >&2
      return 1
    fi
    echo "Skipping shared PR preflight because PRE_PUSH_SKIP_PR_PREFLIGHT=1."
    echo "==> failure-class guard-artifact ratchet (mandatory under preflight hatch)"
    "$PYTHON_BIN" .github/scripts/check_failure_class_guard_ratchet.py \
      --pr-body-file "$OMI_PR_BODY_FILE"
    ci_prediction_note_verified "failure-class guard-artifact ratchet (mandatory under PRE_PUSH_SKIP_PR_PREFLIGHT=1)"
    ci_prediction_note_skipped "shared PR contract and hygiene (PRE_PUSH_SKIP_PR_PREFLIGHT=1)"
    return
  fi

  if [ -n "${OMI_PR_BODY_FILE:-}" ]; then
    has_supplied_pr_body=1
  fi

  # Same cheap contracts Hygiene runs (invariants, e2e covers, changelog schema, …).
  # Draft a PR body first when invariants are required:
  #   scripts/pr-preflight --suggest
  #   scripts/pr-preflight --pr-body-file /tmp/pr-body.md
  # or: OMI_PR_BODY_FILE=/tmp/pr-body.md git push
  scripts/pr-preflight --lane local --base "$BASE_REF" --head HEAD --head-branch "$CURRENT_BRANCH"
  if [ "$has_supplied_pr_body" -eq 1 ]; then
    ci_prediction_note_verified "shared PR contract, hygiene, and supplied PR body"
  else
    ci_prediction_note_verified "shared PR hygiene and diff contracts"
    ci_prediction_note_deferred "final PR metadata/body: draft a body then scripts/pr-preflight --pr-body-file <file> (or set OMI_PR_BODY_FILE)"
  fi
}

check_firmware_formatters() {
  local -a firmware_files=()
  local file

  for file in "${CHANGED_FILES[@]}"; do
    [ -f "$file" ] || continue
    case "$file" in
      omi/*.c|omi/*.cc|omi/*.cpp|omi/*.cxx|omi/*.h|omi/*.hpp|omiGlass/*.c|omiGlass/*.cc|omiGlass/*.cpp|omiGlass/*.cxx|omiGlass/*.h|omiGlass/*.hpp)
        firmware_files+=("$file")
        ;;
    esac
  done

  if [ "${#firmware_files[@]}" -eq 0 ]; then
    return
  fi

  if [ "${PRE_PUSH_SKIP_FIRMWARE_FORMAT:-}" = "1" ]; then
    echo "Skipping C/C++ format check because PRE_PUSH_SKIP_FIRMWARE_FORMAT=1."
    ci_prediction_note_skipped "Firmware C/C++ formatting (PRE_PUSH_SKIP_FIRMWARE_FORMAT=1)"
  elif command -v clang-format >/dev/null 2>&1; then
    echo "==> clang-format --dry-run (${#firmware_files[@]} file(s))"
    clang-format --dry-run --Werror "${firmware_files[@]}"
  else
    echo "FAIL: changed firmware C/C++ files require clang-format for local CI certification." >&2
    echo "      Install clang-format (for example, 'brew install clang-format') and retry the push." >&2
    echo "      Deliberate hatch: PRE_PUSH_SKIP_FIRMWARE_FORMAT=1 git push" >&2
    return 1
  fi
}

check_optional_formatters() {
  local -a dart_files=()
  local -a python_files=()
  local -a arb_files=()
  local file

  for file in "${CHANGED_FILES[@]}"; do
    [ -f "$file" ] || continue
    case "$file" in
      *.dart)
        if [[ "$file" != *.gen.dart && "$file" != *.g.dart ]]; then
          dart_files+=("$file")
        fi
        ;;
      backend/*.py|backend/**/*.py)
        python_files+=("$file")
        ;;
      *.arb)
        arb_files+=("$file")
        ;;
    esac
  done

  if [ "${#dart_files[@]}" -gt 0 ]; then
    if [ "${PRE_PUSH_SKIP_DART_FORMAT:-}" = "1" ]; then
      echo "Skipping Dart format check because PRE_PUSH_SKIP_DART_FORMAT=1."
      if ci_prediction_selected "app-dart-format"; then
        ci_prediction_note_skipped "Dart formatting (PRE_PUSH_SKIP_DART_FORMAT=1)"
      fi
    elif command -v dart >/dev/null 2>&1; then
      echo "==> dart format --set-exit-if-changed (${#dart_files[@]} file(s))"
      dart format --line-length 120 --set-exit-if-changed --output=none "${dart_files[@]}"
      if ci_prediction_selected "app-dart-format"; then
        ci_prediction_note_verified "Dart formatting"
      fi
    elif ci_prediction_selected "app-dart-format"; then
      echo "FAIL: changed app Dart files require the Dart SDK for local CI certification." >&2
      echo "      Install Flutter (which includes Dart), then ensure 'dart' is on PATH." >&2
      echo "      Deliberate hatch: PRE_PUSH_SKIP_DART_FORMAT=1 git push" >&2
      return 1
    else
      echo "Skipping Dart format check; dart is not installed."
    fi
  fi

  if [ "${#python_files[@]}" -gt 0 ]; then
    echo "==> pinned backend Python format check (${#python_files[@]} file(s))"
    scripts/backend-python-format --check "${python_files[@]}"
  fi

  if [ "${#arb_files[@]}" -gt 0 ]; then
    echo "==> ARB JSON formatting (${#arb_files[@]} file(s))"
    "$PYTHON_BIN" - "${arb_files[@]}" <<'PY'
import json
import sys
from pathlib import Path

failed = False
for raw_path in sys.argv[1:]:
    path = Path(raw_path)
    try:
        original = path.read_text()
        formatted = json.dumps(json.loads(original), indent=4, ensure_ascii=False) + "\n"
    except json.JSONDecodeError as exc:
        print(f"FAIL: {path} is not valid JSON: {exc}", file=sys.stderr)
        failed = True
        continue
    if original != formatted:
        print(f"FAIL: {path} not formatted with 4-space indent", file=sys.stderr)
        failed = True

if failed:
    print("Fix: jq --indent 4 '.' <file> > tmp && mv tmp <file>", file=sys.stderr)
    sys.exit(1)
PY
  fi

  check_firmware_formatters
}

require_flutter_generated_prerequisites() {
  if [ ! -f app/.dart_tool/package_config.json ]; then
    echo "FAIL: Flutter generated-output checks need resolved app dependencies." >&2
    echo "      Run: cd app && flutter pub get" >&2
    # make setup provisions the backend venv only, so a contributor who never
    # touches app/ can reach this with no Flutter toolchain at all -- and the
    # selector wakes this lane for generator inputs and workflow definitions. CI still runs it.
    echo "      Deliberate hatch: PRE_PUSH_SKIP_FLUTTER_GENERATED=1 git push" >&2
    return 1
  fi
}

check_flutter_generated_if_needed() {
  local untracked

  if ! ci_prediction_selected "flutter-codegen" && ! ci_prediction_selected "flutter-l10n"; then
    return
  fi

  if [ "${PRE_PUSH_SKIP_FLUTTER_GENERATED:-}" = "1" ]; then
    echo "Skipping Flutter generated-output checks because PRE_PUSH_SKIP_FLUTTER_GENERATED=1."
    ci_prediction_note_skipped "Flutter generated output (PRE_PUSH_SKIP_FLUTTER_GENERATED=1)"
    return
  fi

  require_flutter_generated_prerequisites

  if ci_prediction_selected "flutter-codegen"; then
    if ! command -v flutter >/dev/null 2>&1 || ! command -v dart >/dev/null 2>&1; then
      echo "FAIL: changed Flutter generator inputs require Flutter and Dart for local CI certification." >&2
      echo "      Install Flutter, then ensure both 'flutter' and its bundled 'dart' are on PATH." >&2
      echo "      Deliberate hatch: PRE_PUSH_SKIP_FLUTTER_GENERATED=1 git push" >&2
      return 1
    fi
    echo "==> Flutter build_runner generated-output check"
    (
      # Git exports linked-worktree metadata to hooks. Flutter resolves its own
      # SDK version through Git, so those variables must not leak into Flutter.
      unset GIT_DIR GIT_WORK_TREE
      cd app
      flutter pub run build_runner build --delete-conflicting-outputs
      git diff --exit-code -- lib || {
        echo "FAIL: generated Dart files are stale. Run: cd app && flutter pub run build_runner build --delete-conflicting-outputs" >&2
        exit 1
      }
      untracked=$(git ls-files --others --exclude-standard -- lib)
      if [ -n "$untracked" ]; then
        echo "FAIL: generated Dart files are stale; untracked generated files were produced:" >&2
        echo "$untracked" >&2
        exit 1
      fi
    )
    ci_prediction_note_verified "Flutter build_runner generated output"
  fi

  if ci_prediction_selected "flutter-l10n"; then
    if ! command -v flutter >/dev/null 2>&1; then
      echo "FAIL: changed Flutter localization inputs require Flutter for local CI certification." >&2
      echo "      Install Flutter, then ensure 'flutter' is on PATH." >&2
      echo "      Deliberate hatch: PRE_PUSH_SKIP_FLUTTER_GENERATED=1 git push" >&2
      return 1
    fi
    echo "==> Flutter l10n generated-output check"
    (
      # Keep Flutter's SDK-version Git lookup isolated from hook worktree state.
      unset GIT_DIR GIT_WORK_TREE
      cd app
      flutter gen-l10n
      git diff --exit-code -- lib/l10n || {
        echo "FAIL: generated localization files are stale. Run: cd app && flutter gen-l10n" >&2
        exit 1
      }
      untracked=$(git ls-files --others --exclude-standard -- lib/l10n)
      if [ -n "$untracked" ]; then
        echo "FAIL: generated localization files are stale; untracked generated files were produced:" >&2
        echo "$untracked" >&2
        exit 1
      fi
    )
    ci_prediction_note_verified "Flutter localization generated output"
  fi
}

check_desktop_flow_lint_if_needed() {
  if ! ci_prediction_selected "desktop-flow-lint"; then
    return
  fi

  if [ "${PRE_PUSH_SKIP_DESKTOP_FLOW_LINT:-}" = "1" ]; then
    echo "Skipping desktop E2E flow lint because PRE_PUSH_SKIP_DESKTOP_FLOW_LINT=1."
    ci_prediction_note_skipped "desktop E2E flow metadata (PRE_PUSH_SKIP_DESKTOP_FLOW_LINT=1)"
    return
  fi

  if ! "$PYTHON_BIN" -c "import yaml" >/dev/null 2>&1; then
    echo "FAIL: desktop E2E flow metadata checks require Python 3 and PyYAML." >&2
    echo "      Run make setup to create the locked backend environment." >&2
    echo "      Deliberate hatch: PRE_PUSH_SKIP_DESKTOP_FLOW_LINT=1 git push" >&2
    return 1
  fi

  echo "==> desktop E2E flow metadata lint"
  "$PYTHON_BIN" desktop/macos/scripts/desktop-flow-lint.py
  ci_prediction_note_verified "desktop E2E flow metadata and bridge-action references"
}

check_windows_kgworker_native_closure_if_needed() {
  if ! ci_prediction_selected "windows-kgworker-native-closure"; then
    return
  fi

  if [ "${PRE_PUSH_SKIP_WINDOWS_KGWORKER_NATIVE_CLOSURE:-}" = "1" ]; then
    echo "Skipping Windows KG worker native-closure test because PRE_PUSH_SKIP_WINDOWS_KGWORKER_NATIVE_CLOSURE=1."
    ci_prediction_note_skipped "Windows KG worker native-module closure (PRE_PUSH_SKIP_WINDOWS_KGWORKER_NATIVE_CLOSURE=1)"
    return
  fi

  if ! command -v pnpm >/dev/null 2>&1 \
    || [ ! -x desktop/windows/node_modules/.bin/vitest ] \
    || [ ! -f desktop/windows/node_modules/better-sqlite3/package.json ] \
    || [ ! -f desktop/windows/node_modules/electron-builder/package.json ]; then
    echo "FAIL: Windows KG worker native-closure validation requires pnpm and installed desktop/windows dependencies." >&2
    echo "      Run: cd desktop/windows && pnpm install --frozen-lockfile" >&2
    echo "      Deliberate hatch: PRE_PUSH_SKIP_WINDOWS_KGWORKER_NATIVE_CLOSURE=1 git push" >&2
    return 1
  fi

  echo "==> Windows KG worker native-module closure"
  (
    cd desktop/windows
    pnpm exec vitest run scripts/kgworker-native-closure.test.mjs
  )
  ci_prediction_note_verified "Windows KG worker native-module closure"
}

check_backend_runtime_env_if_needed() {
  if [ "${PRE_PUSH_SKIP_BACKEND_RUNTIME_ENV:-}" = "1" ]; then
    echo "Skipping backend runtime env checks because PRE_PUSH_SKIP_BACKEND_RUNTIME_ENV=1."
    return
  fi

  if ! changed_matches \
    'backend/deploy/runtime_env.yaml' \
    'backend/deploy/runtime_env/*.yaml' \
    'backend/charts/backend-listen/*_values.yaml' \
    'backend/charts/backend-listen/**/*_values.yaml' \
    'backend/charts/pusher/*_values.yaml' \
    'backend/charts/pusher/**/*_values.yaml' \
    'backend/scripts/render-backend-runtime-env.py' \
    'backend/scripts/validate-backend-runtime-env.py' \
    'backend/scripts/runtime_env_capability_contracts.py' \
    'backend/scripts/runtime_env_validation/*.py' \
    '.github/workflows/gcp_backend*.yml' \
    '.github/workflows/gcp_backend*.yaml' \
    '.github/workflows/repo-checks.yml' \
    '.github/workflows/backend-checks.yml' \
    '.github/actions/detect-changes/*' \
    '.github/actions/detect-changes/**/*'
  then
    return
  fi

  require_backend_python
  "$BACKEND_PYTHON" backend/scripts/validate-backend-runtime-env.py --env dev --check-workflows
  "$BACKEND_PYTHON" backend/scripts/validate-backend-runtime-env.py --env prod
}

check_backend_typecheck_if_needed() {
  if [ "${PRE_PUSH_SKIP_BACKEND_TYPECHECK:-}" = "1" ]; then
    echo "Skipping backend type check because PRE_PUSH_SKIP_BACKEND_TYPECHECK=1."
    return
  fi

  if ! printf '%s\n' "${CHANGED_FILES[@]}" | backend/scripts/needs-typecheck.sh; then
    echo "Skipping backend type check: changed paths do not affect the typed boundary."
    return
  fi

  require_backend_python
  (
    cd backend
    PYRIGHT_PYTHON="$BACKEND_PYTHON" bash scripts/typecheck.sh
  )
}

check_backend_unit_tests_if_needed() {
  local selected_count
  local original_selected_count
  local changed_test_count
  local max_pre_push_tests
  local reason
  local file

  if [ "${PRE_PUSH_SKIP_BACKEND_UNIT_TESTS:-}" = "1" ]; then
    echo "Skipping backend unit tests because PRE_PUSH_SKIP_BACKEND_UNIT_TESTS=1."
    return
  fi

  if ! changed_matches \
    '.gitignore' \
    'backend/*.py' \
    'backend/**/*.py' \
    'backend/*.yaml' \
    'backend/**/*.yaml' \
    'backend/*.yml' \
    'backend/**/*.yml' \
    '.github/actions/detect-changes/*' \
    '.github/actions/detect-changes/**/*' \
    '.github/workflows/backend-checks.yml' \
    '.github/workflows/backend-unit-tests.yml' \
    '.github/workflows/desktop-checks.yml' \
    '.github/workflows/desktop-swift-ci.yml' \
    '.github/workflows/repo-checks.yml' \
    '.github/workflows/desktop_promote_beta.yml' \
    '.github/workflows/desktop_promote_prod.yml' \
    '.github/workflows/gcp_backend*.yml' \
    '.github/workflows/gcp_memory_maintenance_job.yml' \
    '.github/workflows/gcp_memory_maintenance_job_auto_dev.yml' \
    '.github/workflows/gcp_notifications_job.yml' \
    'scripts/changed-files' \
    'scripts/install-git-hooks.sh' \
    'scripts/pre-push' \
    'scripts/pre-push-singleflight'
  then
    return
  fi

  require_backend_python
  "$BACKEND_PYTHON" backend/scripts/select_backend_unit_tests.py \
    --changed-files "$CHANGED_FILES_LIST" \
    --output "$SELECTED_BACKEND_TESTS" \
    --reason-output "$SELECTED_BACKEND_TESTS_REASON"

  selected_count=$(wc -l < "$SELECTED_BACKEND_TESTS" | tr -d ' ')
  original_selected_count="$selected_count"
  reason=$(cat "$SELECTED_BACKEND_TESTS_REASON")
  if [ "$selected_count" -eq 0 ]; then
    echo "No backend unit tests selected: $reason"
    return
  fi

  # #9440: pre-push is intentionally a bounded local-feedback gate, not a CI clone.
  # Keep this cap: a broad selector must not turn ordinary pushes into the full suite.
  max_pre_push_tests="${PRE_PUSH_MAX_BACKEND_UNIT_TEST_FILES:-40}"
  if [ "$selected_count" -gt "$max_pre_push_tests" ]; then
    : > "$FAST_BACKEND_TESTS"
    for file in "${CHANGED_FILES[@]}"; do
      case "$file" in
        backend/tests/*.py|backend/tests/**/*.py)
          if [ -f "$file" ]; then
            printf '%s\n' "${file#backend/}" >> "$FAST_BACKEND_TESTS"
          fi
          ;;
      esac
    done
    if [ -s "$FAST_BACKEND_TESTS" ]; then
      sort -u "$FAST_BACKEND_TESTS" -o "$FAST_BACKEND_TESTS"
      changed_test_count=$(wc -l < "$FAST_BACKEND_TESTS" | tr -d ' ')
      if [ "$changed_test_count" -gt "$max_pre_push_tests" ]; then
        head -n "$max_pre_push_tests" "$FAST_BACKEND_TESTS" > "$FAST_BACKEND_TESTS.capped"
        mv "$FAST_BACKEND_TESTS.capped" "$FAST_BACKEND_TESTS"
        selected_count=$(wc -l < "$FAST_BACKEND_TESTS" | tr -d ' ')
        echo "Selector requested $reason ($original_selected_count files); the diff changes $changed_test_count backend test file(s), also over the cap of $max_pre_push_tests."
        echo "Running the first $selected_count in sorted order; run cd backend && bash test.sh for the rest, or rely on CI."
      else
        selected_count="$changed_test_count"
        echo "Selector requested $reason ($original_selected_count files; running $selected_count changed backend test file(s) instead; cap is $max_pre_push_tests)."
      fi
      cp "$FAST_BACKEND_TESTS" "$SELECTED_BACKEND_TESTS"
    else
      echo "Skipping broad backend unit suite in pre-push: $reason ($selected_count files; cap is $max_pre_push_tests)."
      echo "Run cd backend && bash test.sh for the full suite, or rely on CI."
      return
    fi
  fi

  echo "Selected $selected_count backend unit test file(s): $reason"
  (
    cd backend
    PYTHON="$BACKEND_PYTHON" bash test-preflight.sh
    BACKEND_UNIT_TEST_FILE_LIST="$SELECTED_BACKEND_TESTS" PYTHON="$BACKEND_PYTHON" bash test.sh
  )
}

check_runtime_image_source_closure_if_needed() {
  if [ "${PRE_PUSH_SKIP_RUNTIME_IMAGE_SOURCE_CLOSURE:-}" = "1" ]; then
    echo "Skipping runtime-image contract check because PRE_PUSH_SKIP_RUNTIME_IMAGE_SOURCE_CLOSURE=1."
    return
  fi

  if ! changed_matches \
    'backend/*.py' \
    'backend/**/*.py' \
    'backend/**/Dockerfile*' \
    'backend/runtime_images.json' \
    'backend/scripts/runtime_image_contracts.py' \
    '.github/workflows/runtime_image_contracts.yml' \
    '.github/workflows/gcp_backend*.yml' \
    '.github/workflows/gcp_diarizer.yml' \
    '.github/workflows/gcp_models.yml' \
    '.github/workflows/gcp_parakeet.yml' \
    '.github/workflows/gcp_nllb_translation.yml' \
    '.github/workflows/gcp_memory_maintenance_job*.yml' \
    '.github/workflows/gcp_notifications_job.yml' \
    '.github/workflows/gcp_plugins.yml' \
    'plugins/*.py' \
    'plugins/**/*.py' \
    'plugins/Dockerfile' \
    'scripts/pre-push'
  then
    return
  fi

    "$PYTHON_BIN" backend/scripts/runtime_image_contracts.py check
}

check_openapi_contract_if_needed() {
  if [ "${PRE_PUSH_SKIP_OPENAPI_CONTRACT:-}" = "1" ]; then
    echo "Skipping OpenAPI contract check because PRE_PUSH_SKIP_OPENAPI_CONTRACT=1."
    return
  fi

  if ! changed_matches \
    'backend/models/*.py' \
    'backend/models/**/*.py' \
    'backend/routers/*.py' \
    'backend/routers/**/*.py' \
    'docs/api-reference/app-client-openapi.json' \
    'app/lib/backend/http/api/**' \
    'app/lib/backend/schema/**' \
    '.github/workflows/openapi-contract.yml' \
    'scripts/pre-push'
  then
    return
  fi

  require_backend_python
  "$BACKEND_PYTHON" backend/scripts/check_app_client_openapi_compatibility.py \
    --base-ref "$BASE_REMOTE_REF"
  (
    cd backend
    scripts/openapi_runner.sh scripts/export_openapi.py --surface app-client --check ../docs/api-reference/app-client-openapi.json
  )

  "$BACKEND_PYTHON" backend/scripts/generate_dart_models.py --all --check
  "$BACKEND_PYTHON" backend/scripts/generate_ts_openapi_types.py --check
  "$BACKEND_PYTHON" backend/scripts/generate_swift_openapi_types.py --check
}

check_release_process_guards_if_needed() {
  if ! changed_matches \
    '.github/scripts/check-release-process-guards.py' \
    'scripts/run-release-process-guards.sh' \
    'backend/tests/unit/test_desktop_release_scripts.py'
  then
    return
  fi

  bash scripts/run-release-process-guards.sh
  printf '%s\n' 'tests/unit/test_desktop_release_scripts.py' > "$RELEASE_GUARD_TESTS"
  (
    cd backend
    BACKEND_UNIT_TEST_FILE_LIST="$RELEASE_GUARD_TESTS" PYTHON="$BACKEND_PYTHON" bash test.sh
  )
}

check_workflows_if_needed() {
  local -a workflow_files=()
  local -a actionlint_cmd=()
  local file

  if [ "${PRE_PUSH_SKIP_ACTIONLINT:-}" = "1" ]; then
    echo "Skipping actionlint because PRE_PUSH_SKIP_ACTIONLINT=1."
    return
  fi

  for file in "${CHANGED_FILES[@]}"; do
    case "$file" in
      .github/workflows/*.yml|.github/workflows/*.yaml)
        [ ! -f "$file" ] || workflow_files+=("$file")
        ;;
    esac
  done

  if [ "${#workflow_files[@]}" -eq 0 ]; then
    return
  fi

  if command -v actionlint >/dev/null 2>&1; then
    actionlint_cmd=(actionlint)
  elif command -v go >/dev/null 2>&1; then
    actionlint_cmd=(go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12)
  else
    echo "FAIL: actionlint or go is required to validate changed workflow files." >&2
    echo "      Deliberate hatch: PRE_PUSH_SKIP_ACTIONLINT=1 git push" >&2
    return 1
  fi

  "${actionlint_cmd[@]}" -shellcheck "" "${workflow_files[@]}"
}

check_desktop_swift_if_needed() {
  if [ "${PRE_PUSH_SKIP_DESKTOP_SWIFT:-}" = "1" ]; then
    echo "Skipping desktop Swift compile because PRE_PUSH_SKIP_DESKTOP_SWIFT=1."
    return
  fi

  if ! changed_matches \
    'desktop/macos/Desktop/*.swift' \
    'desktop/macos/Desktop/**/*.swift' \
    'desktop/macos/Desktop/Package.swift' \
    'desktop/macos/Desktop/Package.resolved' \
    'scripts/pre-push'
  then
    return
  fi

  if ! command -v xcrun >/dev/null 2>&1; then
    echo "FAIL: xcrun is required to compile the desktop Swift package for changed desktop files." >&2
    echo "Push from macOS with Xcode command line tools installed, or deliberately skip with PRE_PUSH_SKIP_DESKTOP_SWIFT=1 git push." >&2
    return 1
  fi

  # #9440: keep pre-push to this fast compile. The pinned-toolchain full suite and
  # release compile belong to CI; adding them here causes push-time budget bloat.
  (
    cd desktop/macos
    xcrun swift build -c debug --package-path Desktop
  )
}

check_desktop_launcher_tests_if_needed() {
  if [ "${PRE_PUSH_SKIP_DESKTOP_LAUNCHER_TESTS:-}" = "1" ]; then
    echo "Skipping desktop launcher tests because PRE_PUSH_SKIP_DESKTOP_LAUNCHER_TESTS=1."
    return
  fi

  if ! changed_matches \
    'desktop/macos/run.sh' \
    'desktop/macos/test.sh' \
    'desktop/macos/scripts/*.sh' \
    'desktop/macos/tests/test-*.sh'
  then
    return
  fi

  (
    cd desktop/macos
    for test_script in tests/test-*.sh; do
      # These are live named-bundle checks, not hermetic launcher tests. The
      # pre-push hook neither launches an automation bridge nor knows a QA app
      # path, so retain them for their Tier-3 E2E flow/direct harness command.
      case "$test_script" in
        tests/test-mounted-navigation-latency.sh|tests/test-named-bundle-resources.sh)
          echo "== $test_script (skipped: requires a mounted named bundle)"
          continue
          ;;
      esac
      echo "== $test_script"
      bash "$test_script"
    done
  )
}

check_desktop_tool_surfaces_if_needed() {
  local file
  for file in "${CHANGED_FILES[@]}"; do
    case "$file" in
      desktop/macos/agent/*|desktop/macos/agent/**/*|desktop/macos/pi-mono-extension/*|desktop/macos/pi-mono-extension/**/*|desktop/macos/run.sh|desktop/macos/scripts/prepare-agent-runtime.sh|desktop/macos/scripts/test-tool-surfaces.sh|codemagic.yaml)
        desktop/macos/scripts/test-tool-surfaces.sh
        return
        ;;
    esac
  done
}

check_gauntlet_evidence_if_needed() {
  if [ "${PRE_PUSH_SKIP_GAUNTLET_EVIDENCE:-}" = "1" ]; then
    echo "Skipping gauntlet evidence check because PRE_PUSH_SKIP_GAUNTLET_EVIDENCE=1."
    return
  fi

  desktop/macos/scripts/check-gauntlet-evidence-at-head.sh warn
}

run_step check_pr_preflight
run_step "$PYTHON_BIN" .github/scripts/check-desktop-prod-promotion-policy.py
run_step "$PYTHON_BIN" .github/scripts/check-deployment-concurrency.py --self-test
run_step "$PYTHON_BIN" .github/scripts/check-deployment-concurrency.py
run_step check_backend_runtime_env_if_needed
run_step check_backend_typecheck_if_needed
run_step check_runtime_image_source_closure_if_needed
run_step check_backend_unit_tests_if_needed
run_step check_openapi_contract_if_needed
run_step check_release_process_guards_if_needed
run_step check_workflows_if_needed
run_step check_flutter_generated_if_needed
run_step check_desktop_flow_lint_if_needed
run_step check_windows_kgworker_native_closure_if_needed
run_step check_desktop_swift_if_needed
run_step check_desktop_launcher_tests_if_needed
run_step check_desktop_tool_surfaces_if_needed
run_step check_gauntlet_evidence_if_needed
run_step check_optional_formatters

print_ci_prediction_summary
echo "Bounded pre-push gate passed; CI remains the full test authority."