#!/bin/bash
# Shared helper for Hermes contract reachability checks
# Separates SSH exit status from remote command result

hermes_check_host() {
    local host=$1
    local pattern=$2
    local path=$3
    
    # Remote side always succeeds (grep ...; true), so ssh exit code = connection status only
    local out
    out=$(ssh -o BatchMode=yes -o ConnectTimeout=3 root@"$host" "grep -RIn '$pattern' '$path' 2>/dev/null; true" 2>/dev/null)
    local status=$?
    
    if [ $status -ne 0 ]; then
        echo "$host: UNREACHABLE (ssh exit $status)"
    elif [ -n "$out" ]; then
        echo "$host: VIOLATION: $out"
    else
        echo "$host: COMPLIANT (no matches found)"
    fi
}

# Standalone mode: scripts/hermes-reachability-check.sh <host> <pattern> <path>
if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
    if [ $# -ne 3 ]; then
        echo "Usage: $0 <host> <pattern> <path>" >&2
        exit 2
    fi
    hermes_check_host "$1" "$2" "$3"
    exit 0
fi