#!/usr/bin/env bash
set -euo pipefail

service="agents/windows/MinerOpsAgentService.ps1"
control="agents/windows/MinerOpsControl.ps1"
installer="agents/windows/install.ps1"
rg -q 'X-MinerOps-Agent-ID' "${service}"
! rg -q 'commands/pending\?agent_id=' "${service}"
! rg -q 'DefaultValue "super"' "${service}"
rg -q 'get\.miner\.setting' "${control}"
rg -q '\$attempt -le 3' "${control}"
rg -q 'VerificationStatus "unconfirmed"' "${control}"
for secret_field in 'api3_password =' 'api3_account =' 'raw_vendor' 'salt_response'; do
    ! rg -q "${secret_field}" "${control}"
done

rg -q 'Get-MinerOpsScheduledTask' "${installer}"
rg -q 'Stop-MinerOpsScheduledTaskForUpgrade' "${installer}"
rg -q 'mainTaskWasRunning' "${installer}"
rg -q 'Preserving existing Scheduled Task' "${installer}"
rg -q -- '-Limit 0 -TimeoutMs 8000' "${installer}"
rg -q 'Unregister-ScheduledTask' "${installer}"
rg -q 'could not restart restored MinerOpsAgent' "${installer}"
! rg -q 'Register-ScheduledTask.*-Force' "${installer}"
! rg -q 'agent_secret|api3_password|api3_account' "${installer}"

if command -v pwsh >/dev/null 2>&1; then
    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsControl.ps1
    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsInstaller.ps1
else
    echo "pwsh is not installed; deterministic PowerShell harnesses retained but not executed."
fi
echo "Windows Agent source contract checks passed."