#!/usr/bin/env bash
# ============================================================================
# bootstrap-mesin.sh — SATU PERINTAH untuk menyiapkan mesin baru (rootless)
#
# Menyiapkan semua yang dibutuhkan agar konsisten dengan mesin lain:
#   1. VNC stack  : Xtigervnc :1 (5901) + Chromium CDP (9222) + websockify
#                   + noVNC (6080)  → browser lokal yang bisa dilihat user
#   2. browser-harness CLI (uv tool) — driver CDP untuk agent
#   3. Hermes config: browser.cdp_url=http://127.0.0.1:9222
#                   → SEMUA sesi Hermes (TUI + webhook) otomatis pakai
#                     Chromium lokal, BUKAN browser cloud (Browserbase)
#   4. Persistensi: start-vnc.sh idempotent + vnc-watchdog.sh daemon
#                   + cron Hermes 'vnc-stack-watchdog' tiap 10 menit
#   5. (Opsional) Webhook infra via setup-mesin.sh kalau argumen diberikan:
#      bash bootstrap-mesin.sh <nama-unik> <endpoint-url> <api-key>
#
# IDEMPOTEN: aman dijalankan ulang — komponen yang sudah ada di-skip.
#
# Pemakaian:
#   bash bootstrap-mesin.sh                          # VNC + browser + config saja
#   bash bootstrap-mesin.sh joko-jobseeker "https://backend..." "random123"
#                                                    # + webhook (butuh setup-mesin.sh
#                                                    #   di folder yang sama atau
#                                                    #   BOOTSTRAP_BASE_URL di-set)
#
# Env yang bisa di-override:
#   BOOTSTRAP_BASE_URL  URL folder berisi setup-mesin.sh (download otomatis)
#   VNC_DIR             folder stack (default: $HOME/vncsetup)
#   HERMES_HOME         home Hermes (default: $HOME/.hermes atau terdeteksi)
#   SKIP_WEBHOOK=1      jangan deploy webhook walau argumen diberikan
#   CHROME_URL          URL zip Chrome for Testing (default: auto-deteksi)
#   DEB_POOL            base pool Debian untuk .deb (default: deb.debian.org)
# ============================================================================
set -euo pipefail

# ── Warna ───────────────────────────────────────────────────────────────────
C_GREEN=$'\033[32m'; C_YELLOW=$'\033[33m'; C_RED=$'\033[31m'; C_CYAN=$'\033[36m'; C_BOLD=$'\033[1m'; C_RESET=$'\033[0m'
ok()   { echo "${C_GREEN}✓${C_RESET} $*"; }
warn() { echo "${C_YELLOW}⚠ $*${C_RESET}"; }
fail() { echo "${C_RED}✗ $*${C_RESET}"; }
info() { echo "${C_CYAN}→ $*${C_RESET}"; }
step() { echo; echo "${C_BOLD}── $* ──${C_RESET}"; }

# ── Argumen & env ───────────────────────────────────────────────────────────
NAMA_UNIK="${1:-}"
ENDPOINT_URL="${2:-}"
API_KEY="${3:-}"
BOOTSTRAP_BASE_URL="${BOOTSTRAP_BASE_URL:-}"
VNC_DIR="${VNC_DIR:-$HOME/vncsetup}"
DEB_POOL="${DEB_POOL:-https://deb.debian.org/debian/pool}"
CHROME_URL="${CHROME_URL:-}"
SKIP_WEBHOOK="${SKIP_WEBHOOK:-0}"
RUN_DIR="$VNC_DIR/run"
NEED_RESTART=0
export LD_LIBRARY_PATH="$VNC_DIR/rootfs/usr/lib/x86_64-linux-gnu"

# ── Deteksi Hermes ──────────────────────────────────────────────────────────
HERMES_BIN=""
for cand in "${HERMES_BIN:-}" "$HOME/.local/bin/hermes" /opt/hermes/bin/hermes /usr/local/bin/hermes; do
  [ -n "$cand" ] && [ -x "$cand" ] && HERMES_BIN="$cand" && break
done
command -v hermes >/dev/null 2>&1 && HERMES_BIN="$(command -v hermes)"
HERMES_HOME="${HERMES_HOME:-}"
if [ -z "$HERMES_HOME" ]; then
  for cand in "$HOME/.hermes/config.yaml" /opt/data/config.yaml "$HOME/config.yaml"; do
    [ -f "$cand" ] && HERMES_HOME="$(dirname "$cand")" && break
  done
fi
HERMES_HOME="${HERMES_HOME:-$HOME/.hermes}"

port_up() { ( exec 3<>"/dev/tcp/127.0.0.1/$1" ) 2>/dev/null; }

# ── 1. Prasyarat ────────────────────────────────────────────────────────────
step "1/7 — Prasyarat"
MISSING=0
for cmd in curl python3 bash dpkg-deb; do
  if command -v "$cmd" >/dev/null 2>&1; then ok "ditemukan: $cmd"; else fail "tidak ada: $cmd"; MISSING=1; fi
done
[ "$MISSING" = "1" ] && { fail "Pasang dulu paket di atas (user-space), lalu ulangi."; exit 1; }

# uv (kalau belum ada)
if command -v uv >/dev/null 2>&1; then
  ok "uv: $(uv --version)"
else
  info "Menginstal uv (user-space)..."
  curl -LsSf https://astral.sh/uv/install.sh | sh
  export PATH="$HOME/.local/bin:$PATH"
  command -v uv >/dev/null 2>&1 || { fail "uv gagal terinstal"; exit 1; }
  ok "uv terinstal: $(uv --version)"
fi

if [ -n "$HERMES_BIN" ]; then ok "hermes: $HERMES_BIN (HERMES_HOME=$HERMES_HOME)"; else warn "hermes TIDAK ditemukan — langkah config/cron Hermes akan di-skip (jalankan setelah Hermes terpasang)."; fi

mkdir -p "$VNC_DIR" "$RUN_DIR"

# ── 2. VNC stack ────────────────────────────────────────────────────────────
step "2/7 — Install VNC stack ke $VNC_DIR"

# 2a. Chromium (Chrome for Testing)
if [ -x "$VNC_DIR/chrome-linux64/chrome" ]; then
  ok "Chromium sudah ada — skip download"
else
  info "Mendapatkan Chrome for Testing (linux64)..."
  if [ -z "$CHROME_URL" ]; then
    CHROME_URL=$(python3 -c "
import json,urllib.request
d=json.load(urllib.request.urlopen('https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions-with-downloads.json',timeout=30))
for dl in d['channels']['Stable']['downloads']['chrome']:
    if dl['platform']=='linux64': print(dl['url']); break
" 2>/dev/null) || CHROME_URL=""
  fi
  [ -z "$CHROME_URL" ] && { fail "Tidak bisa dapat URL Chrome — set CHROME_URL manual."; exit 1; }
  curl -sL -o "$VNC_DIR/chrome.zip" "$CHROME_URL"
  (cd "$VNC_DIR" && python3 -c "import zipfile; zipfile.ZipFile('chrome.zip').extractall('.')")
  # PITFALL: zip menghilangkan exec bit — crashpad_handler & sandbox ikut kena
  find "$VNC_DIR/chrome-linux64" -maxdepth 1 -type f -exec chmod +x {} \;
  ok "Chromium siap ($VNC_DIR/chrome-linux64/chrome)"
fi

# 2b. TigerVNC (Xtigervnc) via .deb
if [ -x "$VNC_DIR/rootfs/usr/bin/Xtigervnc" ]; then
  ok "Xtigervnc sudah ada — skip"
else
  info "Mengunduh TigerVNC .deb dari Debian pool..."
  mkdir -p "$VNC_DIR/debs" "$VNC_DIR/rootfs"
  python3 - "$DEB_POOL" "$VNC_DIR/debs" <<'PY'
import re, sys, urllib.request, os
pool, outdir = sys.argv[1], sys.argv[2]
html = urllib.request.urlopen(pool + "/main/t/tigervnc/", timeout=30).read().decode()
debs = re.findall(r'href="(tigervnc-(?:standalone-server|common)_[^"]+_amd64\.deb)"', html)
# urutkan menurun (versi terbaru dulu), ambil 1 masing-masing
seen = {}
for d in sorted(debs, reverse=True):
    kind = "server" if "standalone" in d else "common"
    if kind not in seen:
        seen[kind] = d
for d in seen.values():
    url = f"{pool}/main/t/tigervnc/{d}"
    print("download", url)
    urllib.request.urlretrieve(url, os.path.join(outdir, d))
PY
  for deb in "$VNC_DIR"/debs/tigervnc-*.deb; do dpkg-deb -x "$deb" "$VNC_DIR/rootfs/"; done
  # Resolve lib hilang (pola dari skill: libxcvt0)
  MISSING_LIBS=$(ldd "$VNC_DIR/rootfs/usr/bin/Xtigervnc" 2>/dev/null | grep "not found" | awk '{print $1}' | sort -u || true)
  if [ -n "$MISSING_LIBS" ]; then
    info "Lib hilang: $MISSING_LIBS — mencoba ambil .deb pendukung..."
    for lib in $MISSING_LIBS; do
      pkg=""; pdir=""
      case "$lib" in
        libxcvt.so.*) pkg="libxcvt0"; pdir="main/libx/libxcvt";;
        *) warn "Lib '$lib' tidak ada di tabel — Xvnc mungkin gagal jalan. Cek: ldd rootfs/usr/bin/Xtigervnc"; continue;;
      esac
      deb_url=$(python3 - "$DEB_POOL/$pdir" "$pkg" <<'PY'
import re, sys, urllib.request, os
base, pkg = sys.argv[1], sys.argv[2]
html = urllib.request.urlopen(base + "/", timeout=30).read().decode()
d = sorted(re.findall(r'href="(' + pkg + r'_[^"]+_amd64\.deb)"', html), reverse=True)
print(base + "/" + d[0] if d else "")
PY
)
      if [ -n "$deb_url" ]; then
        f="$VNC_DIR/debs/$(basename "$deb_url")"
        curl -sL -o "$f" "$deb_url"
        dpkg-deb -x "$f" "$VNC_DIR/rootfs/"
        ok "lib $lib terpenuhi via $(basename "$deb_url")"
      fi
    done
  fi
  ok "Xtigervnc siap ($VNC_DIR/rootfs/usr/bin/Xtigervnc)"
fi

# 2c. websockify (uv venv)
if [ -x "$VNC_DIR/venv/bin/websockify" ]; then
  ok "websockify sudah ada — skip"
else
  info "Menginstal websockify (uv venv)..."
  uv venv "$VNC_DIR/venv" >/dev/null 2>&1
  uv pip install --python "$VNC_DIR/venv/bin/python" websockify >/dev/null 2>&1
  [ -x "$VNC_DIR/venv/bin/websockify" ] || { fail "websockify gagal terinstal"; exit 1; }
  ok "websockify siap"
fi

# 2d. noVNC client
if [ -f "$VNC_DIR/novnc/vnc.html" ]; then
  ok "noVNC sudah ada — skip"
else
  info "Mengunduh noVNC v1.5.0..."
  curl -sL https://github.com/novnc/noVNC/archive/refs/tags/v1.5.0.tar.gz -o "$VNC_DIR/novnc.tar.gz"
  (cd "$VNC_DIR" && tar -xzf novnc.tar.gz && mv noVNC-1.5.0 novnc)
  [ -f "$VNC_DIR/novnc/vnc.html" ] || { fail "noVNC gagal diekstrak"; exit 1; }
  ok "noVNC siap"
fi

# 2e. Tulis skrip stack (idempotent — selalu tulis ulang versi terbaru, JWT auth)
cat > "$VNC_DIR/start-vnc.sh" <<'STACK_SCRIPT'
#!/usr/bin/env bash
# start-vnc.sh — Start/repair stack noVNC (idempotent & DETACHED)
# Stack: Xtigervnc :1 (5901) → websockify (6080, serves noVNC, JWT auth) + Chromium CDP (9222)
set -u
VD="${HOME:-/opt/data/home}/vncsetup"
RUN="$VD/run"
export LD_LIBRARY_PATH="$VD/rootfs/usr/lib/x86_64-linux-gnu"
export DISPLAY=":1"
TARGET_URL="${TARGET_URL:-https://example.com}"
QUIET=0
[ "${1:-}" = "--quiet" ] && QUIET=1
mkdir -p "$RUN"
say()  { [ "$QUIET" = "1" ] || echo "$*"; }
log()  { echo "$(date '+%F %T') $*" >> "$RUN/start-vnc.log"; }
port_up() { ( exec 3<>"/dev/tcp/127.0.0.1/$1" ) 2>/dev/null; }
xvnc_alive() { [ -f "$RUN/xvnc.pid" ] && kill -0 "$(cat "$RUN/xvnc.pid" 2>/dev/null)" 2>/dev/null; }
started_any=0
if xvnc_alive; then
  log "Xvnc sudah jalan — skip"
else
  say "→ Menjalankan Xtigervnc :1 (port 5901) ..."
  rm -f /tmp/.X1-lock /tmp/.X11-unix/X1 2>/dev/null
  setsid nohup "$VD/rootfs/usr/bin/Xtigervnc" :1 -geometry 1600x900 -depth 24 \
    -SecurityTypes None -UseBlacklist off -localhost no -rfbport 5901 \
    >"$RUN/xvnc.log" 2>&1 </dev/null &
  echo $! > "$RUN/xvnc.pid"
  for i in $(seq 1 15); do port_up 5901 && break; sleep 1; done
  if port_up 5901; then say "  ✓ Xvnc up"; started_any=1; else say "  ✗ Xvnc GAGAL — lihat $RUN/xvnc.log"; tail -5 "$RUN/xvnc.log" >&2; fi
fi
if port_up 9222; then
  log "Chrome sudah jalan — skip"
else
  say "→ Menjalankan Chromium (CDP 9222) ..."
  rm -f "$VD/chrome-profile/SingletonLock" "$VD/chrome-profile/SingletonSocket" "$VD/chrome-profile/SingletonCookie" 2>/dev/null
  setsid nohup "$VD/chrome-linux64/chrome" --no-sandbox --disable-gpu \
    --disable-dev-shm-usage --disable-notifications \
    --window-size=1600,900 --user-data-dir="$VD/chrome-profile" \
    --no-first-run --no-default-browser-check \
    --remote-debugging-port=9222 --remote-allow-origins='*' \
    "$TARGET_URL" >"$RUN/chrome.log" 2>&1 </dev/null &
  echo $! > "$RUN/chrome.pid"
  for i in $(seq 1 30); do port_up 9222 && break; sleep 1; done
  if port_up 9222; then say "  ✓ Chrome up (CDP 9222)"; started_any=1; else say "  ✗ Chrome GAGAL — lihat $RUN/chrome.log"; tail -5 "$RUN/chrome.log" >&2; fi
fi
if port_up 6080; then
  log "websockify sudah jalan — skip"
else
  say "→ Menjalankan websockify (noVNC web, port 6080, JWT auth) ..."
  # Auth: token JWT HS256 (claims host/port/exp) — secret di run/vnc-jwt-secret.
  # Token diterbitkan oleh BE platform via GET /api/v1/realtime/vnc.
  # Catatan: setelah secret di-generate, salin isinya ke user_service BE
  # (kolom vnc_jwt_secret) supaya BE bisa menerbitkan token yang valid.
  if [ ! -s "$RUN/vnc-jwt-secret" ]; then
    log "vnc-jwt-secret belum ada → generate baru"
    openssl rand -hex 32 2>/dev/null | tr -d '\n' > "$RUN/vnc-jwt-secret"
    chmod 600 "$RUN/vnc-jwt-secret"
  fi
  setsid nohup "$VD/venv/bin/websockify" --web="$VD/novnc" \
    --token-plugin=JWTTokenApi --token-source="$RUN/vnc-jwt-secret" \
    6080 \
    >"$RUN/websockify.log" 2>&1 </dev/null &
  echo $! > "$RUN/websockify.pid"
  for i in $(seq 1 10); do port_up 6080 && break; sleep 1; done
  if port_up 6080; then say "  ✓ websockify up"; started_any=1; else say "  ✗ websockify GAGAL — lihat $RUN/websockify.log"; tail -5 "$RUN/websockify.log" >&2; fi
fi
if port_up 6080 && xvnc_alive && port_up 9222; then
  code=$(curl -s -o /dev/null -w '%{http_code}' -m 5 http://localhost:6080/vnc.html 2>/dev/null)
  [ "$code" = "200" ] && say "✓ STACK LENGKAP: noVNC siap (vnc.html HTTP 200)" || say "⚠ vnc.html HTTP $code"
else
  say "⚠ Stack belum lengkap — cek log di $RUN/"
fi
[ "$QUIET" = "1" ] && [ "$started_any" = "0" ] && exit 0
exit 0
STACK_SCRIPT

cat > "$VNC_DIR/vnc-watchdog.sh" <<'WATCHDOG_SCRIPT'
#!/usr/bin/env bash
# vnc-watchdog.sh — daemon penjaga stack noVNC (self-daemonize, PPID 1)
set -u
VD="${HOME:-/opt/data/home}/vncsetup"
RUN="$VD/run"
INTERVAL="${VNC_WATCHDOG_INTERVAL:-60}"
mkdir -p "$RUN"
if [ "${VNC_WATCHDOG_DAEMON:-0}" != "1" ]; then
  VNC_WATCHDOG_DAEMON=1 setsid nohup bash "$0" "$@" >>"$RUN/watchdog.log" 2>&1 </dev/null &
  echo "watchdog daemon dimulai (pid $!) — log: $RUN/watchdog.log"
  exit 0
fi
if [ -f "$RUN/watchdog.pid" ]; then
  old=$(cat "$RUN/watchdog.pid" 2>/dev/null)
  if [ -n "$old" ] && [ "$old" != "$$" ] && kill -0 "$old" 2>/dev/null; then exit 0; fi
fi
echo $$ > "$RUN/watchdog.pid"
log() { echo "$(date '+%F %T') $*" >> "$RUN/watchdog.log"; }
port_up() { ( exec 3<>"/dev/tcp/127.0.0.1/$1" ) 2>/dev/null; }
xvnc_alive() { [ -f "$RUN/xvnc.pid" ] && kill -0 "$(cat "$RUN/xvnc.pid" 2>/dev/null)" 2>/dev/null; }
log "watchdog mulai (interval ${INTERVAL}s, pid $$)"
while true; do
  if ! xvnc_alive || ! port_up 6080 || ! port_up 9222; then
    down=""
    xvnc_alive || down="$down 5901"
    port_up 6080 || down="$down 6080"
    port_up 9222 || down="$down 9222"
    log "ADA YANG MATI:$down → repair"
    "$VD/start-vnc.sh" --quiet >> "$RUN/watchdog.log" 2>&1
  fi
  sleep "$INTERVAL"
done
WATCHDOG_SCRIPT

cat > "$VNC_DIR/cron-vnc-check.sh" <<'CRON_SCRIPT'
#!/usr/bin/env bash
# cron-vnc-check.sh — dipanggil cron Hermes tiap 10 menit (watchdog pattern)
VD="${HOME:-/opt/data/home}/vncsetup"
RUN="$VD/run"
report=""
out=$("$VD/start-vnc.sh" --quiet 2>&1)
[ -n "$out" ] && report="$report$out"$'\n'
if [ -f "$RUN/watchdog.pid" ]; then
  wpid=$(cat "$RUN/watchdog.pid" 2>/dev/null)
  if [ -z "$wpid" ] || ! kill -0 "$wpid" 2>/dev/null; then
    out=$("$VD/vnc-watchdog.sh" 2>&1)
    [ -n "$out" ] && report="$report$out"$'\n'
  fi
else
  out=$("$VD/vnc-watchdog.sh" 2>&1)
  [ -n "$out" ] && report="$report$out"$'\n'
fi
if [ -n "$report" ]; then
  echo "[vnc-cron] $(date '+%F %T') — ada yang diperbaiki:"
  echo "$report"
fi
# ── portal session watchdog ─────────────────────────────────────────────────
# Deteksi otomatis login/logout job portal (cookie browser) → sync status ke BE.
if [ -f /opt/data/jobseeker/portal-check.py ] && [ -x /opt/data/venv-cdp/bin/python ]; then
  pout=$(/opt/data/venv-cdp/bin/python /opt/data/jobseeker/portal-check.py 2>&1)
  [ -n "$pout" ] && echo "$pout"
fi
exit 0
CRON_SCRIPT

chmod +x "$VNC_DIR/start-vnc.sh" "$VNC_DIR/vnc-watchdog.sh" "$VNC_DIR/cron-vnc-check.sh"
ok "Skrip stack ditulis: start-vnc.sh, vnc-watchdog.sh, cron-vnc-check.sh"

# ── 3. browser-harness ──────────────────────────────────────────────────────
step "3/7 — browser-harness CLI"
if command -v browser-harness >/dev/null 2>&1 || [ -x "$HOME/.local/bin/browser-harness" ]; then
  ok "browser-harness sudah ada — skip"
else
  info "Menginstal browser-harness via uv tool..."
  uv tool install --python 3.12 --upgrade --force browser-harness 2>&1 | tail -2 || true
  export PATH="$HOME/.local/bin:$PATH"
  if command -v browser-harness >/dev/null 2>&1; then
    ok "browser-harness siap ($(command -v browser-harness))"
  else
    warn "browser-harness belum di PATH — tambahkan: export PATH=\"\$HOME/.local/bin:\$PATH\""
  fi
fi

# ── 4. Konfigurasi Hermes ───────────────────────────────────────────────────
step "4/7 — Konfigurasi Hermes (browser lokal + cron watchdog)"
if [ -n "$HERMES_BIN" ]; then
  BEFORE_CDP=$("$HERMES_BIN" config get browser.cdp_url 2>/dev/null || true)
  "$HERMES_BIN" config set browser.cdp_url http://127.0.0.1:9222 >/dev/null 2>&1 \
    && ok "browser.cdp_url = http://127.0.0.1:9222 (semua sesi pakai Chromium lokal)"
  AFTER_CDP=$("$HERMES_BIN" config get browser.cdp_url 2>/dev/null || true)
  NEED_RESTART=0
  [ "$BEFORE_CDP" != "$AFTER_CDP" ] && NEED_RESTART=1
  "$HERMES_BIN" config set browser.inactivity_timeout 120 >/dev/null 2>&1 || true

  # cron watchdog (jaring pengaman terakhir)
  mkdir -p "$HERMES_HOME/scripts"
  cp "$VNC_DIR/cron-vnc-check.sh" "$HERMES_HOME/scripts/cron-vnc-check.sh"
  chmod +x "$HERMES_HOME/scripts/cron-vnc-check.sh"
  if "$HERMES_BIN" cron list 2>/dev/null | grep -q vnc-stack-watchdog; then
    ok "cron 'vnc-stack-watchdog' sudah ada — skip"
  else
    if "$HERMES_BIN" cron create "every 10m" --name vnc-stack-watchdog \
        --script cron-vnc-check.sh --no-agent --deliver local >/dev/null 2>&1; then
      ok "cron 'vnc-stack-watchdog' dibuat (tiap 10 menit, silent saat sehat)"
    else
      warn "cron create gagal — buat manual: hermes cron create 'every 10m' --name vnc-stack-watchdog --script cron-vnc-check.sh --no-agent --deliver local"
    fi
  fi
else
  warn "hermes tidak ditemukan — SKIP config & cron. Jalankan setelah Hermes terpasang:"
  warn "  hermes config set browser.cdp_url http://127.0.0.1:9222"
fi

# ── 5. Start stack + watchdog ───────────────────────────────────────────────
step "5/7 — Start stack noVNC + watchdog daemon"
bash "$VNC_DIR/start-vnc.sh" || true
bash "$VNC_DIR/vnc-watchdog.sh" || true

# ── 6. Verifikasi ───────────────────────────────────────────────────────────
step "6/7 — Verifikasi"
V=1
port_up 5901 && ok "Xvnc :1 → port 5901" || { warn "5901 tidak terbuka"; V=0; }
port_up 9222 && ok "Chromium CDP → port 9222" || { warn "9222 tidak terbuka"; V=0; }
port_up 6080 && ok "websockify+noVNC → port 6080" || { warn "6080 tidak terbuka"; V=0; }
code=$(curl -s -o /dev/null -w '%{http_code}' -m 5 http://localhost:6080/vnc.html 2>/dev/null)
[ "$code" = "200" ] && ok "vnc.html HTTP 200" || warn "vnc.html HTTP $code"
if port_up 9222; then
  tabs=$(curl -s -m 5 http://localhost:9222/json 2>/dev/null | grep -c '"type": "page"' || true)
  ok "CDP /json OK ($tabs tab page)"
fi
[ "$V" = "1" ] && ok "STACK LENGKAP ✓" || warn "Stack belum lengkap — lihat $RUN_DIR/*.log"

# ── 7. Webhook (opsional) ───────────────────────────────────────────────────
if [ "$SKIP_WEBHOOK" = "1" ] || [ -z "$NAMA_UNIK" ]; then
  [ -n "$NAMA_UNIK" ] && warn "SKIP_WEBHOOK=1 — webhook tidak dideploy"
else
  step "7/7 — Deploy webhook '$NAMA_UNIK'"
  SETUP_MESIN="$(dirname "$0")/setup-mesin.sh"
  if [ ! -f "$SETUP_MESIN" ] && [ -n "$BOOTSTRAP_BASE_URL" ]; then
    info "Mengunduh setup-mesin.sh dari $BOOTSTRAP_BASE_URL ..."
    curl -sL -o /tmp/setup-mesin.sh "$BOOTSTRAP_BASE_URL/setup-mesin.sh"
    chmod +x /tmp/setup-mesin.sh
    SETUP_MESIN=/tmp/setup-mesin.sh
  fi
  if [ -f "$SETUP_MESIN" ]; then
    bash "$SETUP_MESIN" "$NAMA_UNIK" "$ENDPOINT_URL" "$API_KEY" || warn "setup-mesin.sh selesai dengan warning di atas"
  else
    warn "setup-mesin.sh tidak ditemukan — deploy webhook manual:"
    warn "  bash setup-mesin.sh '$NAMA_UNIK' '$ENDPOINT_URL' '$API_KEY'"
  fi
fi

# ── Restart gateway otomatis (hanya kalau config berubah) ──────────────────
if [ "$NEED_RESTART" = "1" ] && [ "${SKIP_GATEWAY_RESTART:-0}" != "1" ] && [ -n "$HERMES_BIN" ]; then
  info "Config browser.cdp_url baru — menjadwalkan restart gateway dalam 60 detik (detached)..."
  setsid nohup bash -c "sleep 60; $HERMES_BIN gateway restart >> \"$RUN_DIR/gateway-restart.log\" 2>&1; echo \"exit=\$?\" >> \"$RUN_DIR/gateway-restart.log\"" >/dev/null 2>&1 &
  warn "Gateway akan restart ~60 detik lagi — sesi aktif mungkin terputus sebentar, lalu kembali normal."
  warn "Log: $RUN_DIR/gateway-restart.log | Cegah: SKIP_GATEWAY_RESTART=1"
elif [ "$NEED_RESTART" = "1" ]; then
  warn "Config berubah tapi restart di-skip (SKIP_GATEWAY_RESTART) — jalankan manual: $HERMES_BIN gateway restart"
fi

# ── Ringkasan ───────────────────────────────────────────────────────────────
step "SELESAI — Ringkasan"
HOST="${HOSTNAME:-$(hostname 2>/dev/null || echo mesin)}"
echo "  ${C_BOLD}noVNC (browser yang bisa Anda lihat):${C_RESET}"
echo "    lokal   : http://localhost:6080/vnc.html"
echo "    publik  : https://<tunnel-name>-6080.jkt3.sumopod.my.id/vnc.html   (tunnel per-port otomatis)"
echo
echo "  ${C_BOLD}Agent (CDP):${C_RESET}"
echo "    Hermes browser_* tools → otomatis pakai Chromium lokal (browser.cdp_url sudah diset)."
echo "    Fallback manual:  export BU_CDP_URL=\"http://127.0.0.1:9222\" && browser-harness <<'PY' ... PY"
echo
echo "  ${C_BOLD}Persistensi:${C_RESET} start-vnc.sh (idempotent) + vnc-watchdog.sh (daemon 60s)"
echo "    + cron 'vnc-stack-watchdog' tiap 10 menit (silent saat sehat)."
echo
echo "  ${C_BOLD}Log:${C_RESET} $RUN_DIR/{xvnc,chrome,websockify,watchdog,start-vnc}.log"
[ -n "$NAMA_UNIK" ] && [ "$SKIP_WEBHOOK" != "1" ] && \
  echo "  ${C_BOLD}Webhook:${C_RESET} route '$NAMA_UNIK' — lihat ringkasan setup-mesin.sh di atas."
echo
if [ "$NEED_RESTART" = "1" ] && [ "${SKIP_GATEWAY_RESTART:-0}" != "1" ]; then
  echo "  ${C_BOLD}Restart gateway:${C_RESET} terjadwal otomatis (~60 detik) — config browser.cdp_url langsung aktif."
else
  echo "  ${C_BOLD}Restart gateway:${C_RESET} tidak diperlukan (config sudah sama) / di-skip."
fi
exit 0