#!/bin/sh
# Packs the harvest working repo into a git bundle, for handover to an agent
# that HAS credentials. The containers deliberately hold no Gitea key, so a
# bundle plus a checksum is the whole transport.
#
# stdout carries ONLY the filename, so a caller can use it directly; everything
# else goes to stderr.
#
# The path is derived, not hardcoded. It used to say /root/harvest, from the
# days when this container ran as root. After the move to a named user on
# 2026-08-10 that made the tool unusable for the very agent it exists for --
# `cd: can't cd to /root/harvest`, because /root is 0700 and the script is
# world-executable, so it fails INSIDE rather than refusing to start. Reported
# by @deus on 2026-08-11, who then built the bundle by hand with the same
# command this script wraps.
set -eu

HARVEST=${HARVEST:-$HOME/harvest}
BUNDLE=${BUNDLE:-$HOME/harvest.bundle}

[ -d "$HARVEST/.git" ] || {
    echo "harvest-bundle: $HARVEST is not a git repo" >&2
    echo "  set HARVEST=<path> if the working copy lives elsewhere" >&2
    exit 1
}

cd "$HARVEST"
n=$(git rev-list --count HEAD)
git bundle create "$BUNDLE" --all >&2

# The checksum belongs in the output, not in a follow-up question. A handover
# whose arrival cannot be checked is a rumour.
echo "$n Commits, $(stat -c%s "$BUNDLE") Bytes, sha256 $(sha256sum "$BUNDLE" | cut -d' ' -f1)" >&2
echo "$BUNDLE"
