( set -Eeuo pipefail; export LC_ALL=C;  EXPECTED_HOST="Work"; EXPECTED_USER="ray";  APP="/home/ray/ARMOR/apps/shire-mobile"; PACKAGE="com.shire.mobile"; ADB="/home/ray/Android/Sdk/platform-tools/adb";  GRADLE="$APP/app/build.gradle.kts"; APK="$APP/app/build/outputs/apk/debug/app-debug.apk";  GATEWAY_SCRIPT="/usr/local/lib/shire-mobile-gateway/server.py"; GATEWAY_ENV="/etc/shire-mobile-gateway/mobile-gateway.env"; GATEWAY_SERVICE="shire-mobile-gateway.service";  SENTINEL_BRIDGE="/usr/local/lib/shire-sentinel/alert_bridge.py"; SENTINEL_CONFIG="/etc/shire-sentinel/alert-bridge.json";  BACKUP_ROOT="/SHiREVault/Backup/OSBackups"; STAMP="$(date -u +%Y%m%dT%H%M%SZ)"; EVIDENCE="$BACKUP_ROOT/SHIRE-MOBILE-SENTINEL-REPLAY-AUDIT-$STAMP"; WORK="$(mktemp -d /tmp/shire-mobile-replay-audit.XXXXXX)";  HISTORY_CAPTURE="$WORK/history.txt"; RECOVERED="$EVIDENCE/corrected-pixel-deployment-recovered.sh";  cleanup() {   rm -rf "$WORK"; };  trap cleanup EXIT;  echo "============================================================"; echo " SHiRE MOBILE — SENTINEL DEPLOYMENT REPLAY AUDIT"; echo " Recover and inspect only — nothing will be deployed"; echo "============================================================"; echo;  [[ "$(hostname)" == "$EXPECTED_HOST" ]] || {   echo "STOP: Run this on SHiRE MINI — hostname Work.";   exit 1; };  [[ "$(id -un)" == "$EXPECTED_USER" ]] || {   echo "STOP: Run this as user ray.";   exit 1; };  [[ -d "$APP" ]] || {   echo "STOP: SHiRE Mobile project is missing:";   echo "  $APP";   exit 1; };  [[ -f "$GRADLE" ]] || {   echo "STOP: SHiRE Mobile Gradle file is missing.";   exit 1; };  [[ -x "$ADB" ]] || {   echo "STOP: ADB is unavailable.";   exit 1; };  FSTYPE="$(
  findmnt -T /SHiREVault \
    -n \
    -o FSTYPE \
    | tail -n 1
)";  echo "SHiREVault filesystem: $FSTYPE";  [[ "$FSTYPE" == "cifs" ]] || {   echo "STOP: SHiREVault is not confirmed as the CIFS mount.";   exit 1; };  mkdir -p "$EVIDENCE";  echo; echo "1. VERIFY AUTHORISED PIXEL"; echo "------------------------------------------------------------";  "$ADB" devices -l;  DEVICE="$(
  "$ADB" devices \
    | awk '$2 == "device" { print $1; exit }'
)";  [[ -n "$DEVICE" ]] || {   echo "STOP: No authorised Pixel is available.";   exit 1; };  MODEL="$(
  "$ADB" -s "$DEVICE" \
    shell getprop ro.product.model \
    | tr -d '\r'
)";  ANDROID="$(
  "$ADB" -s "$DEVICE" \
    shell getprop ro.build.version.release \
    | tr -d '\r'
)";  echo; echo "Selected ADB device: $DEVICE"; echo "Model: $MODEL"; echo "Android: $ANDROID";  [[ "$MODEL" == "Pixel 9 Pro Fold" ]] || {   echo "STOP: The authorised device is not the expected Pixel 9 Pro Fold.";   exit 1; };  echo; echo "2. CURRENT MOBILE VERSION"; echo "------------------------------------------------------------";  echo "Project version:";  grep -E   'versionCode[[:space:]]*=|versionName[[:space:]]*='   "$GRADLE"   | tee "$EVIDENCE/project-version-before.txt";  echo; echo "Pixel version:";  "$ADB" -s "$DEVICE"   shell dumpsys package "$PACKAGE"   | grep -E     'versionCode=|versionName=|firstInstallTime=|lastUpdateTime='   | sed -n '1,12p'   | tee "$EVIDENCE/pixel-version-before.txt";  CURRENT_PROJECT_VERSION="$(
  sed -nE \
    's/.*versionName[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' \
    "$GRADLE" \
    | head -n 1
)";  CURRENT_PROJECT_CODE="$(
  sed -nE \
    's/.*versionCode[[:space:]]*=[[:space:]]*([0-9]+).*/\1/p' \
    "$GRADLE" \
    | head -n 1
)";  echo; echo "Current project versionName: $CURRENT_PROJECT_VERSION"; echo "Current project versionCode: $CURRENT_PROJECT_CODE"; echo;  echo "3. RECOVER EXACT FAILED DEPLOYMENT FROM SHELL HISTORY"; echo "------------------------------------------------------------";  HISTTIMEFORMAT=; history > "$HISTORY_CAPTURE";  python3 -   "$HISTORY_CAPTURE"   "$RECOVERED" <<'PY'
from __future__ import annotations

import base64
import re
import sys
from pathlib import Path

history_path = Path(sys.argv[1])
output_path = Path(sys.argv[2])

required = [
    base64.b64decode(
        "U0hJUkUtTU9CSUxFLVNFTlRJTkVMLVBJWEVMLUZJWEVELQ=="
    ).decode(),
    base64.b64decode(
        "U2VudGluZWxNb2JpbGVBbGVydHMua3Q="
    ).decode(),
    base64.b64decode(
        "Q09SUkVDVEVEIFNFTlRJTkVMIFBJWEVMIERFUExPWU1FTlQ="
    ).decode(),
]

entries: list[tuple[int, str]] = []
current_number: int | None = None
current_lines: list[str] = []

for raw_line in history_path.read_text(
    encoding="utf-8",
    errors="replace",
).splitlines():
    match = re.match(r"^\s*(\d+)\s+(.*)$", raw_line)

    if match:
        if current_number is not None:
            entries.append(
                (
                    current_number,
                    "\n".join(current_lines),
                )
            )

        current_number = int(match.group(1))
        current_lines = [match.group(2)]
    elif current_number is not None:
        current_lines.append(raw_line)

if current_number is not None:
    entries.append(
        (
            current_number,
            "\n".join(current_lines),
        )
    )

matches = [
    (number, command)
    for number, command in entries
    if all(value in command for value in required)
]

if not matches:
    raise SystemExit(
        "The corrected Sentinel Pixel deployment command "
        "was not found in the active Bash history."
    )

event, command = matches[-1]

output_path.write_text(
    command.rstrip() + "\n",
    encoding="utf-8",
)

print(f"Recovered history event: {event}")
print(f"Recovered characters: {len(command)}")
print(f"Recovered lines: {command.count(chr(10)) + 1}")
PY
  chmod 600 "$RECOVERED";  echo; echo "Recovered script:"; echo "  $RECOVERED";  echo "SHA-256:"; sha256sum "$RECOVERED"   | tee "$EVIDENCE/recovered-script.sha256";  echo; echo "4. VERIFY RECOVERED COMMAND IDENTITY"; echo "------------------------------------------------------------";  for REQUIRED_TEXT in   "SHIRE-MOBILE-SENTINEL-PIXEL-FIXED-"   "SentinelMobileAlerts.kt"   "/usr/local/lib/shire-mobile-gateway/server.py"   "/etc/shire-mobile-gateway/mobile-gateway.env"   "/usr/local/lib/shire-sentinel/alert_bridge.py"   "/etc/shire-sentinel/alert-bridge.json"   "CORRECTED SENTINEL PIXEL DEPLOYMENT"; do   grep -Fq "$REQUIRED_TEXT" "$RECOVERED" || {     echo "STOP: Recovered command is missing:";     echo "  $REQUIRED_TEXT";     exit 1;   }; done;  echo "Recovered command identity: PASS"; echo;  echo "5. AUDIT INTENDED VERSION"; echo "------------------------------------------------------------";  grep -nE   'versionCode|versionName|0\.7\.[0-9]|EXPECTED_VERSION'   "$RECOVERED"   | sed -n '1,120p'   | tee "$EVIDENCE/recovered-version-references.txt"   || true;  TARGET_VERSION="$(
  python3 - "$RECOVERED" <<'PY'
import re
import sys
from pathlib import Path

text = Path(sys.argv[1]).read_text(
    encoding="utf-8",
    errors="replace",
)

values = re.findall(
    r'versionName(?:\s*=|\s+)[^\n"]*"([^"]+)"',
    text,
)

if not values:
    values = re.findall(
        r'versionName=([A-Za-z0-9._-]+)',
        text,
    )

unique = []

for value in values:
    if value not in unique:
        unique.append(value)

print(",".join(unique))
PY

)";  echo; echo "Current project version: $CURRENT_PROJECT_VERSION"; echo "Recovered command target references: ${TARGET_VERSION:-not resolved}";  VERSION_SAFE="unknown";  if [[ -n "$TARGET_VERSION" ]]; then   if printf '%s\n' "$TARGET_VERSION"     | grep -Fq "$CURRENT_PROJECT_VERSION";   then     VERSION_SAFE="same";   else     VERSION_SAFE="different";   fi; fi;  echo "Recovered target matches current project: $VERSION_SAFE"; echo;  echo "6. AUDIT FILE AND SERVICE CHANGES"; echo "------------------------------------------------------------";  grep -nE   '(^|[[:space:]])(cat >|install |cp |mv |rm |sed |python3 |systemctl |adb .*install|gradlew|alert_bridge\.py)'   "$RECOVERED"   | sed -n '1,260p'   | tee "$EVIDENCE/recovered-change-outline.txt"   || true;  echo; echo "Rollback references:";  grep -nEi   'rollback|restore|previous token|PREVIOUS_TOKEN|previous Pixel|safe rollback'   "$RECOVERED"   | sed -n '1,180p'   | tee "$EVIDENCE/recovered-rollback-outline.txt"   || true;  echo; echo "7. CURRENT FILE STATE AFTER PRIOR ROLLBACK"; echo "------------------------------------------------------------";  FILES=(   "$APP/app/src/main/java/com/shire/mobile/MainActivity.kt"   "$APP/app/src/main/java/com/shire/mobile/SentinelMobileAlerts.kt"   "$APP/app/src/main/AndroidManifest.xml"   "$APP/app/build.gradle.kts"   "$APP/gradle.properties" );  for FILE in "${FILES[@]}"; do   if [[ -f "$FILE" ]]; then     printf 'PRESENT  ';     sha256sum "$FILE";   else     echo "ABSENT   $FILE";   fi; done   | tee "$EVIDENCE/current-mobile-files.txt";  echo; echo "Privileged runtime files:";  for FILE in   "$GATEWAY_SCRIPT"   "$GATEWAY_ENV"   "$SENTINEL_BRIDGE"   "$SENTINEL_CONFIG"; do   if sudo -n test -f "$FILE" 2>/dev/null; then     echo "PRESENT  $FILE";      if [[ "$FILE" == "$GATEWAY_ENV" ]]; then       echo "  Environment keys:";        sudo -n awk -F=         '/^[A-Za-z_][A-Za-z0-9_]*=/ {
          print "    " $1 "=<redacted>"
        }'         "$FILE";     fi;   else     echo "ABSENT_OR_UNREADABLE  $FILE";   fi; done   | tee "$EVIDENCE/current-runtime-files.txt";  echo; echo "8. CURRENT SERVICE HEALTH — NO RESTART"; echo "------------------------------------------------------------";  for SERVICE in   "$GATEWAY_SERVICE"   shire-sentinel-alert.service   shire-sentinel-suricata.service   tailscaled.service; do   printf '%-42s %s\n'     "$SERVICE"     "$(systemctl is-active "$SERVICE" 2>/dev/null || true)"; done   | tee "$EVIDENCE/service-state.txt";  echo; echo "9. CURRENT APK STATE"; echo "------------------------------------------------------------";  if [[ -f "$APK" ]]; then   echo "APK present: YES";   echo "APK bytes: $(stat -c '%s' "$APK")";   sha256sum "$APK"     | tee "$EVIDENCE/current-apk.sha256"; else   echo "APK present: NO"; fi;  echo; echo "10. PRESERVE AUDIT EVIDENCE"; echo "------------------------------------------------------------";  {   echo "audit=shire-mobile-sentinel-replay";   echo "captured_at_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)";   echo "host=$(hostname)";   echo "user=$(id -un)";   echo "pixel_device=$DEVICE";   echo "pixel_model=$MODEL";   echo "current_version_name=$CURRENT_PROJECT_VERSION";   echo "current_version_code=$CURRENT_PROJECT_CODE";   echo "recovered_target_versions=${TARGET_VERSION:-unresolved}";   echo "target_matches_current=$VERSION_SAFE";   echo "deployment_executed=no";   echo "mobile_source_changed=no";   echo "gateway_changed=no";   echo "sentinel_changed=no";   echo "pixel_app_changed=no";   echo "services_restarted=no"; } > "$EVIDENCE/audit-result.txt";  MANIFEST_TEMP="$(mktemp)";  find "$EVIDENCE"   -type f   ! -path "$EVIDENCE/SHA256SUMS.txt"   -print0   | sort -z   | xargs -0 sha256sum   > "$MANIFEST_TEMP";  install   -m 0600   "$MANIFEST_TEMP"   "$EVIDENCE/SHA256SUMS.txt";  rm -f "$MANIFEST_TEMP";  (   cd /;   sha256sum -c     "$EVIDENCE/SHA256SUMS.txt"     >/dev/null; );  echo "Evidence verification: PASS"; echo; echo "============================================================"; echo " SENTINEL DEPLOYMENT REPLAY AUDIT — COMPLETE"; echo "============================================================"; echo; echo "Recovered command:"; echo "  $RECOVERED"; echo; echo "Current SHiRE Mobile:"; echo "  versionName=$CURRENT_PROJECT_VERSION"; echo "  versionCode=$CURRENT_PROJECT_CODE"; echo; echo "Recovered target:"; echo "  ${TARGET_VERSION:-UNRESOLVED}"; echo; echo "TARGET_MATCHES_CURRENT=$VERSION_SAFE"; echo "PIXEL_ADB_READY=YES"; echo "DEPLOYMENT_EXECUTED=NO"; echo "SOURCE_CHANGED=NO"; echo "SERVICES_RESTARTED=NO"; echo "NEXT_STAGE_READY=YES"; echo "============================================================"; )