#!/bin/sh
# felhom-poke v1.0.0 — the offsite endpoint's agent-plane immediate-sync surface (Direction-2a,
# SPIKE-immediate-sync-transport-2026-07-16). The hub's THIRD forced-command surface on ep0
# (alongside felhom-peersync and felhom-tenantsync).
#
# It sends ONE contentless UDP datagram from wg0 to a REGISTERED box's WireGuard /32 on the fixed
# poke port; the box's felhom-agent poke listener then runs an immediate desired-state cycle. This
# collapses a user-triggered agent-plane config change (a pbsdr descriptor, a MinAgent floor) from
# the 15-min report cycle to the spike-measured sub-second path.
#
# CONTRACT (do not weaken any of these):
#   - CONTENTLESS: an EMPTY datagram — a poke means only "tick now". No payload, no secret, no
#     version, no auth handshake. A forged or replayed poke costs at most one extra (debounced)
#     tick on the box, and the report cycle remains the guarantee.
#   - CONFINED: the target IP arrives as $SSH_ORIGINAL_COMMAND (the hub sets it as the SSH command;
#     this forced command ignores it for execution and reads it only as data). It is validated to
#     10.77.0.0/24 here, AND the WireGuard kernel independently refuses to encrypt to any /32 no
#     registered peer owns (EKEYREJECTED, spike P1) — so a poke can only ever reach a real box.
#   - NON-ROOT: sending a datagram needs no privilege. Unlike peersync/tenantsync this surface has
#     NO sudoers grant — the forced command runs as felhom-peersync directly.
#   - ORIGINATION, NOT TRANSIT: the datagram leaves via wg0's own output path; it never touches the
#     forward chain, so it needs no ip_forward and no nft rule (spike P1 §2).
#
# authorized_keys line on the box (PUBLIC key only; the private half lives in the hub k8s
# Secret/agent-poke, never here):
#   restrict,command="/usr/local/bin/felhom-poke" ssh-ed25519 AAAA... hub-poke@felhom
set -eu

POKE_PORT=51822

ip="${SSH_ORIGINAL_COMMAND:-}"
# Coarse then strict: WG /24 prefix, then a valid dotted octet (0-255) in it. Anything else refused.
case "$ip" in
  10.77.0.*) : ;;
  *) echo "felhom-poke: refused non-WG target: '$ip'" >&2; exit 1 ;;
esac
echo "$ip" | grep -Eq '^10\.77\.0\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$' \
  || { echo "felhom-poke: malformed target: '$ip'" >&2; exit 1; }

python3 - "$ip" "$POKE_PORT" <<'PY'
import socket, sys
ip, port = sys.argv[1], int(sys.argv[2])
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
    s.sendto(b"", (ip, port))   # contentless: an empty datagram = "tick now"
finally:
    s.close()
PY
echo "poke-fired"