wbeam

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
HOST_SCRIPTS_DIR="$ROOT_DIR/host/scripts"
WBEAM_CONFIG_HELPER="$HOST_SCRIPTS_DIR/wbeam_config.sh"
if [[ -f "$WBEAM_CONFIG_HELPER" ]]; then
  # shellcheck source=host/scripts/wbeam_config.sh
  source "$WBEAM_CONFIG_HELPER"
  wbeam_load_config "$ROOT_DIR"
fi

CONTROL_PORT="${WBEAM_CONTROL_PORT:-5001}"
STREAM_PORT="${WBEAM_STREAM_PORT:-5000}"
DAEMON_NAME="${WBEAM_DAEMON_SERVICE_NAME:-wbeam-daemon}"

DAEMON_BIN="${WBEAM_DAEMON_BIN:-$ROOT_DIR/host/rust/target/release/wbeamd-server}"
if [[ ! -x "$DAEMON_BIN" && -x "/usr/local/bin/wbeamd-server" ]]; then
  DAEMON_BIN="/usr/local/bin/wbeamd-server"
fi

ANDROID_DIR="$ROOT_DIR/android"
ANDROID_PACKAGE="${WBEAM_ANDROID_PACKAGE:-com.wbeam}"
ANDROID_ACTIVITY="${WBEAM_ANDROID_ACTIVITY:-.MainActivity}"
ANDROID_APK="$ANDROID_DIR/app/build/outputs/apk/debug/app-debug.apk"
ANDROID_APK_RELEASE="$ANDROID_DIR/app/build/outputs/apk/release/app-release.apk"
ANDROID_APK_RELEASE_UNSIGNED="$ANDROID_DIR/app/build/outputs/apk/release/app-release-unsigned.apk"
ANDROID_SERIAL="${WBEAM_ANDROID_SERIAL:-}"
ANDROID_PIPELINE_FILE="$ROOT_DIR/.wbeam_android_pipeline"
LOG_DIR="$ROOT_DIR/logs"
ADB_LOGCAT_PID_FILE="$LOG_DIR/adb-logcat.pid"
BUILD_VERSION_FILE="$ROOT_DIR/.wbeam_build_version"
DEVICE_PORTS_FILE="$ROOT_DIR/.wbeam_device_ports"
VERSION_BASE="${WBEAM_VERSION_BASE:-0.1.2}"



print_help() {
  cat <<'EOF'
WBeam command runner

Usage:
  ./wbeam <group> <command>
  ./wbgui                        # interactive TUI menu (arrow keys)

Groups:
  ip        up | down | status
  host      build | run | debug | status | down | probe | tuner
  daemon    up | down | status   (alias for host)
  android   build | install | launch | deploy | deploy-all | build-release | install-release | deploy-release
  deps      virtual check [--json] | virtual install [--dry-run] [--yes]
  version   new | current | doctor
  watch     devices | connections | streaming | service | logs | status | health | doctor | tui
  debug     up | watch           (alias for host debug)
  logs      live | host | adb (start|stop|status|tail)

Examples:
  ./wbgui
  ./wbeam host build             # build wbeamd-server + wbeamd-streamer (evdi)
  ./wbeam host run               # release binary, foreground
  ./wbeam host debug             # debug build + coloured logs + ADB sidecar
  ./wbeam host probe             # host fingerprint JSON (os/session/display/providers/tools)
  ./wbeam host tuner             # interactive Rust TUI autotuner wizard
  ./wbeam android deploy         # build + install + launch in one step
  ./wbeam android deploy-all     # build once, install + launch on all connected devices
  ./wbeam android build          # ./gradlew assembleDebug only
  ./wbeam android install        # adb install only (uses existing debug APK)
  ./wbeam android launch         # adb shell am start only
  ./wbeam android build-release  # ./gradlew assembleRelease
  ./wbeam android install-release
  ./wbeam android deploy-release
  ./wbeam deps virtual check --json
  ./wbeam deps virtual install --dry-run
  ./wbeam version doctor         # diagnose host/APK version mismatch
  ./wbeam watch devices          # refresh adb/device status every 1s
  ./wbeam watch connections      # refresh host/ports/reverse map every 1s
  ./wbeam watch streaming        # per-device stream state + fps/config
  ./wbeam watch service          # service state + host probe + activity
  ./wbeam watch logs             # current host/adb/service logs snapshot
  ./wbeam watch tui              # interactive screens (1..5, r, q)
  ./wbeam watch connections --once
  watch -n 1 -d --color 'WBEAM_WATCH_COLOR=1 ./wbeam watch connections --once'
  WBEAM_WATCH_LOG=1 ./wbeam watch doctor
  ./wbeam debug up
  ./wbeam logs live
  ./wbeam logs adb start
EOF
}

adb_device_cmd() {
  require_cmd adb
  android_select_serial_if_needed || true
  if [[ -n "$ANDROID_SERIAL" ]]; then
    adb -s "$ANDROID_SERIAL" "$@"
  else
    adb "$@"
  fi
}

android_connected_serials() {
  if [[ -n "${WBEAM_ANDROID_SERIALS:-}" ]]; then
    printf '%s\n' "${WBEAM_ANDROID_SERIALS}" \
      | tr ',;[:space:]' '\n' \
      | awk 'NF { print $1 }'
    return 0
  fi
  require_cmd adb
  adb start-server >/dev/null 2>&1 || true
  adb devices | awk 'NR>1 && $2=="device"{print $1}'
}

android_select_serial_if_needed() {
  if [[ -n "$ANDROID_SERIAL" ]]; then
    return 0
  fi

  local serials=()
  mapfile -t serials < <(android_connected_serials)
  if [[ "${#serials[@]}" -eq 0 ]]; then
    return 1
  fi
  if [[ "${#serials[@]}" -eq 1 ]]; then
    ANDROID_SERIAL="${serials[0]}"
    return 0
  fi

  ANDROID_SERIAL="${serials[0]}"
  echo "[android] WARN: multiple adb devices detected (${serials[*]})." >&2
  echo "[android] WARN: auto-selecting serial=$ANDROID_SERIAL; set WBEAM_ANDROID_SERIAL to override." >&2
  return 0
}

android_pipeline_mode() {
  local mode="${WBEAM_ANDROID_PIPELINE:-}"
  if [[ -z "$mode" && -f "$ANDROID_PIPELINE_FILE" ]]; then
    mode="$(tr -d '[:space:]' < "$ANDROID_PIPELINE_FILE" 2>/dev/null || true)"
  fi

  if [[ -z "$mode" ]]; then
    mode="auto"
  fi

  case "$mode" in
    legacy|modern)
      echo "$mode"
      ;;
    auto)
      android_auto_pipeline_mode
      ;;
    *)
      android_auto_pipeline_mode
      ;;
  esac
}

android_connected_api_level() {
  local api
  require_cmd adb
  adb start-server >/dev/null 2>&1 || true
  api="$(adb_device_cmd shell getprop ro.build.version.sdk 2>/dev/null | tr -d '\r[:space:]' || true)"
  if [[ "$api" =~ ^[0-9]+$ ]]; then
    echo "$api"
    return 0
  fi
  return 1
}

android_auto_pipeline_mode() {
  local api
  api="$(android_connected_api_level || true)"
  # modern pipeline requires minSdk=19, so API <=18 must use legacy.
  if [[ "$api" =~ ^[0-9]+$ ]] && (( api <= 18 )); then
    echo "legacy"
  else
    if [[ "$api" =~ ^[0-9]+$ ]]; then
      echo "modern"
    else
      # When API detection is flaky (USB mode flips/race with adb), default to
      # legacy for compatibility so old tablets do not get unreachable LAN hosts.
      echo "[android] WARN: could not detect Android API level; defaulting pipeline=legacy for safety" >&2
      echo "legacy"
    fi
  fi
}

android_pipeline_min_sdk() {
  case "$1" in
    legacy) echo "17" ;;
    *) echo "19" ;;
  esac
}

detect_tether_ip() {
  # Determine host address reachable from the currently targeted Android device.
  # On old API levels `ip route` may be missing, so keep multiple probes.
  #
  # Priority 1 — ask the connected device for its default gateway.
  #   On USB tether this is the host address. We trust device route first,
  #   because host-side interface state can flap during reconnect and a strict
  #   host-IP cross-check can incorrectly fall back to LAN.
  local gw
  if command -v adb >/dev/null 2>&1; then
    gw="$(adb_device_cmd shell ip route 2>/dev/null \
          | awk '/^default/{for(i=1;i<=NF;i++){if($i=="via"){print $(i+1); exit}}}' \
          | tr -d '\r' || true)"
    if [[ -z "$gw" ]]; then
      # API17/legacy fallback (toolbox route).
      gw="$(adb_device_cmd shell route -n 2>/dev/null \
            | awk '$1=="0.0.0.0" || $1=="default"{print $2; exit}' \
            | tr -d '\r' || true)"
    fi
    if [[ -n "$gw" && "$gw" != "127."* ]]; then
      echo "$gw"; return 0
    fi
  fi
  # Priority 2 — look for a host interface in common USB-tether private ranges.
  # Keep AOSP 192.168.42/43 first.
  local ip
  ip="$(ip -4 addr show 2>/dev/null \
        | awk '/inet 192\.168\.4[23]\./{gsub(/\/.*/, "", $2); print $2; exit}')"
  if [[ -n "$ip" ]]; then echo "$ip"; return 0; fi
  # Priority 3 — USB-like interfaces with any private IPv4 (vendor subnets vary).
  ip="$(ip -4 addr show 2>/dev/null \
        | awk '
            /^[0-9]+: (usb|rndis|enx)/{iface=1; next}
            iface && /inet /{
              gsub(/\/.*/, "", $2);
              if ($2 ~ /^10\./ || $2 ~ /^192\.168\./ || $2 ~ /^172\.(1[6-9]|2[0-9]|3[01])\./) {
                print $2; exit
              }
              iface=0
            }')"
  if [[ -n "$ip" ]]; then echo "$ip"; return 0; fi
  # Priority 4 — as a last resort, any USB-like interface IPv4.
  ip="$(ip -4 addr show 2>/dev/null \
        | awk '/^[0-9]+: (usb|rndis|enx)/{iface=1; next} iface && /inet /{gsub(/\/.*/, "", $2); print $2; exit}')"
  if [[ -n "$ip" ]]; then echo "$ip"; return 0; fi
  return 1
}

detect_host_ip() {
  # For tethered Android (legacy path) we prefer the tether interface IP.
  local tether_ip
  tether_ip="$(detect_tether_ip 2>/dev/null || true)"
  if [[ -n "$tether_ip" ]]; then
    echo "$tether_ip"; return 0
  fi
  # Fallback: IP of the interface used to reach the internet (LAN).
  local ip_candidate=""
  ip_candidate="$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++){if($i=="src"){print $(i+1); exit}}}')"
  if [[ -n "$ip_candidate" ]]; then
    echo "$ip_candidate"
    return 0
  fi
  ip_candidate="$(hostname -I 2>/dev/null | awk '{print $1}')"
  if [[ -n "$ip_candidate" ]]; then
    echo "$ip_candidate"
    return 0
  fi
  return 1
}

android_build_host() {
  local pipeline_mode="$1"
  if [[ -n "${WBEAM_ANDROID_HOST:-}" ]]; then
    echo "$WBEAM_ANDROID_HOST"
    return 0
  fi

  if [[ "$pipeline_mode" == "legacy" ]]; then
    local detected
    detected="$(detect_host_ip || true)"
    if [[ -n "$detected" ]]; then
      echo "$detected"
      return 0
    fi
  fi

  echo "127.0.0.1"
}

normalize_build_version() {
  local raw="${1:-}"
  if [[ -z "$raw" ]]; then
    return 1
  fi
  if [[ "$raw" =~ ^([0-9]+\.[0-9]+\.[0-9]+)\.[0-9]+\.([A-Za-z0-9._-]+)$ ]]; then
    echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
  elif [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+(\.[A-Za-z0-9._-]+)?$ ]]; then
    echo "$raw"
  else
    echo "${VERSION_BASE}.${raw}"
  fi
}

git_short_rev() {
  local hash
  hash="$(git -C "$ROOT_DIR" rev-parse --short=5 HEAD 2>/dev/null || true)"
  if [[ "$hash" =~ ^[A-Fa-f0-9]{5}$ ]]; then
    echo "$hash"
  else
    echo "dev00"
  fi
}

build_version_generate() {
  echo "${VERSION_BASE}.$(git_short_rev)"
}

build_version_write_file() {
  local version="$1"
  printf '%s\n' "$version" > "$BUILD_VERSION_FILE"
}

build_version_read_file() {
  if [[ -f "$BUILD_VERSION_FILE" ]]; then
    tr -d '\r[:space:]' < "$BUILD_VERSION_FILE" 2>/dev/null || true
  fi
}

build_version_for_build() {
  local explicit="${WBEAM_BUILD_REV:-}"
  local version
  if [[ -n "$explicit" ]]; then
    version="$(normalize_build_version "$explicit")"
  else
    version="$(build_version_generate)"
  fi
  build_version_write_file "$version"
  echo "$version"
}

build_version_for_runtime() {
  local explicit="${WBEAM_BUILD_REV:-}"
  if [[ -n "$explicit" ]]; then
    normalize_build_version "$explicit"
    return 0
  fi
  local from_file
  from_file="$(build_version_read_file)"
  if [[ -n "$from_file" ]]; then
    normalize_build_version "$from_file"
    return 0
  fi
  build_version_generate
}

version_new() {
  build_version_for_build
}

version_current() {
  build_version_for_runtime
}

version_log_file() {
  local ts day counter_file n run_id
  mkdir -p "$LOG_DIR"
  ts="$(date +%Y%m%d-%H%M%S)"
  day="$(date +%Y%m%d)"
  counter_file="$LOG_DIR/.run.${day}.counter"
  n=0
  if [[ -f "$counter_file" ]]; then
    n="$(tr -d '[:space:]' < "$counter_file" 2>/dev/null || echo 0)"
  fi
  if [[ ! "$n" =~ ^[0-9]+$ ]]; then
    n=0
  fi
  n=$((n + 1))
  printf '%s' "$n" > "$counter_file"
  run_id="$(printf '%04d' "$n")"
  echo "$LOG_DIR/${ts}.version.${run_id}.log"
}

watch_log_file() {
  local topic="$1"
  local ts day counter_file n run_id
  mkdir -p "$LOG_DIR"
  ts="$(date +%Y%m%d-%H%M%S)"
  day="$(date +%Y%m%d)"
  counter_file="$LOG_DIR/.run.${day}.counter"
  n=0
  if [[ -f "$counter_file" ]]; then
    n="$(tr -d '[:space:]' < "$counter_file" 2>/dev/null || echo 0)"
  fi
  if [[ ! "$n" =~ ^[0-9]+$ ]]; then
    n=0
  fi
  n=$((n + 1))
  printf '%s' "$n" > "$counter_file"
  run_id="$(printf '%04d' "$n")"
  echo "$LOG_DIR/${ts}.watch-${topic}.${run_id}.log"
}

host_health_raw() {
  local url
  url="http://127.0.0.1:${CONTROL_PORT}/health"
  curl -fsS --max-time 1 "$url" 2>/dev/null || return 1
}

json_string_field() {
  local json="$1"
  local field="$2"
  printf '%s\n' "$json" \
    | sed -n "s/.*\"${field}\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p" \
    | head -n 1
}

json_scalar_field() {
  local json="$1"
  local field="$2"
  printf '%s\n' "$json" \
    | sed -n "s/.*\"${field}\"[[:space:]]*:[[:space:]]*\\([^,}]*\\).*/\\1/p" \
    | head -n 1 \
    | tr -d '"' \
    | tr -d '[:space:]'
}

version_doctor() {
  local log_file now host_health="" host_build="" host_service="" file_build="" host_status=""
  local serials=()
  now="$(date -Iseconds)"
  log_file="$(version_log_file)"

  {
    echo "[version-doctor] time=$now"
    echo "[version-doctor] control_api=http://127.0.0.1:${CONTROL_PORT}"

    if host_health="$(host_health_raw)"; then
      host_build="$(json_string_field "$host_health" "build_revision")"
      host_service="$(json_string_field "$host_health" "service")"
      host_status="reachable"
      echo "[version-doctor] host_health=$host_status service=${host_service:-unknown} build_revision=${host_build:-unknown}"
    else
      host_status="unreachable"
      echo "[version-doctor] host_health=$host_status"
    fi

    file_build="$(build_version_read_file || true)"
    echo "[version-doctor] build_file=${BUILD_VERSION_FILE} value=${file_build:-<empty>}"

    if [[ -n "${WBEAM_BUILD_REV:-}" ]]; then
      echo "[version-doctor] env_WBEAM_BUILD_REV=${WBEAM_BUILD_REV}"
    else
      echo "[version-doctor] env_WBEAM_BUILD_REV=<unset>"
    fi

    if ! command -v adb >/dev/null 2>&1; then
      echo "[version-doctor] adb=missing"
      exit 0
    fi

    mapfile -t serials < <(android_connected_serials)
    if [[ "${#serials[@]}" -eq 0 ]]; then
      echo "[version-doctor] adb_devices=none"
      exit 0
    fi

    echo "[version-doctor] adb_devices=${serials[*]}"
    for serial in "${serials[@]}"; do
      local api model apk_version expected reason
      api="$(adb -s "$serial" shell getprop ro.build.version.sdk 2>/dev/null | tr -d '\r[:space:]' || true)"
      model="$(adb -s "$serial" shell getprop ro.product.model 2>/dev/null | tr -d '\r' || true)"
      apk_version="$(adb -s "$serial" shell dumpsys package "$ANDROID_PACKAGE" 2>/dev/null \
        | sed -n 's/^[[:space:]]*versionName=//p' | head -n 1 | tr -d '\r' || true)"

      expected="$host_build"
      if [[ -z "$expected" ]]; then
        expected="$file_build"
      fi

      if [[ -z "$apk_version" ]]; then
        reason="apk_not_installed"
      elif [[ -z "$expected" ]]; then
        reason="missing_expected_version"
      elif [[ "$apk_version" == "$expected" ]]; then
        reason="match"
      else
        reason="mismatch"
      fi

      echo "[version-doctor][$serial] model=${model:-unknown} api=${api:-unknown} apk=${apk_version:-<none>} expected=${expected:-<none>} result=$reason"
    done
  } | tee "$log_file"

  echo "[version-doctor] log=$log_file"
}

android_expected_version_name() {
  build_version_for_runtime
}

android_installed_version_name() {
  adb_device_cmd shell dumpsys package "$ANDROID_PACKAGE" 2>/dev/null \
    | sed -n 's/^[[:space:]]*versionName=//p' \
    | head -n 1 \
    | tr -d '\r' \
    || true
}

android_build_stamp_path() {
  local apk_path="$1"
  echo "${apk_path}.wbeam-config"
}

android_install_stamp_path() {
  local apk_path="$1"
  echo "${apk_path}.wbeam-installed"
}

android_should_skip_install() {
  local apk_path="${1:-$ANDROID_APK}"
  local force_install="${WBEAM_ANDROID_FORCE_INSTALL:-0}"
  if [[ "$force_install" =~ ^(1|true|TRUE|yes|on)$ ]]; then
    return 1
  fi

  local expected installed
  expected="$(android_expected_version_name)"
  installed="$(android_installed_version_name)"
  if [[ -z "$installed" || "$installed" != "$expected" ]]; then
    return 1  # version mismatch — must install
  fi

  # Also force reinstall when the baked-in host/pipeline changed since last
  # install (covers: same git SHA but different host IP or pipeline variant).
  local build_stamp install_stamp
  build_stamp="$(android_build_stamp_path "$apk_path")"
  install_stamp="$(android_install_stamp_path "$apk_path")"
  if [[ -f "$build_stamp" && -f "$install_stamp" ]]; then
    if ! diff -q "$build_stamp" "$install_stamp" >/dev/null 2>&1; then
      return 1  # config changed since last install
    fi
  elif [[ -f "$build_stamp" && ! -f "$install_stamp" ]]; then
    return 1  # never recorded as installed with this config
  fi

  return 0  # version + config match — safe to skip
}

android_device_has_ipv4() {
  local ips line ip
  # Try modern 'ip addr' first; fall back to 'ifconfig' and 'netcfg' for API<21
  # Android (busybox) where 'ip' is absent or the GNU sed pattern fails.
  ips="$(adb_device_cmd shell 'ip -f inet addr show 2>/dev/null | grep inet || ifconfig 2>/dev/null | grep -Eo "addr:[0-9.]+" | sed s/addr:// || netcfg 2>/dev/null | awk "{print \$3}" | grep -v "^0\.0\.0\.0"' 2>/dev/null | tr -d '\r')"
  while IFS= read -r line; do
    ip="${line%%/*}"
    ip="${ip##addr:}"
    if [[ -n "$ip" && "$ip" != "127.0.0.1" && "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
      return 0
    fi
  done <<< "$ips"
  return 1
}

android_try_reverse_setup() {
  local stream_port="${1:-$STREAM_PORT}"
  local control_port="${2:-$CONTROL_PORT}"
  local legacy_stream_port=5002
  # Canonical device-side ports expected by Android app.
  adb_device_cmd reverse "tcp:5000" "tcp:${stream_port}" >/dev/null 2>&1 || return 1
  adb_device_cmd reverse "tcp:5001" "tcp:${control_port}" >/dev/null 2>&1 || return 1
  # Compatibility mapping for APKs built with per-device stream port.
  if [[ "$stream_port" != "5000" ]]; then
    adb_device_cmd reverse "tcp:${stream_port}" "tcp:${stream_port}" >/dev/null 2>&1 || true
  fi
  # Legacy compatibility: some builds are pinned to 5002 while host sessions may
  # currently run on 5000 (or another selected stream_port).
  if [[ "$stream_port" != "$legacy_stream_port" ]]; then
    adb_device_cmd reverse "tcp:${legacy_stream_port}" "tcp:${stream_port}" >/dev/null 2>&1 || true
  fi
  return 0
}

android_probe_control_api_from_device() {
  local host="$1"
  local control_port="${2:-$CONTROL_PORT}"
  local -a adb_base
  android_select_serial_if_needed || true
  adb_base=(adb)
  if [[ -n "$ANDROID_SERIAL" ]]; then
    adb_base+=(-s "$ANDROID_SERIAL")
  fi
  # On legacy Android (API 17), busybox wget is typically available.
  # We force a short timeout to avoid hanging deploy.
  if command -v timeout >/dev/null 2>&1; then
    if timeout 6 "${adb_base[@]}" shell "busybox wget -q -O - http://${host}:${control_port}/status" >/dev/null 2>&1; then
      return 0
    fi
    if timeout 6 "${adb_base[@]}" shell "wget -q -O - http://${host}:${control_port}/status" >/dev/null 2>&1; then
      return 0
    fi
    return 1
  fi
  "${adb_base[@]}" shell "busybox wget -q -O - http://${host}:${control_port}/status" >/dev/null 2>&1 \
    || "${adb_base[@]}" shell "wget -q -O - http://${host}:${control_port}/status" >/dev/null 2>&1
}

android_echo_hosts() {
  local api_host="$1"
  local stream_host="$2"
  printf '%s|%s\n' "$api_host" "$stream_host"
}

android_resolve_deploy_hosts() {
  local pipeline_mode="$1"
  local allow_no_transport="${WBEAM_ANDROID_ALLOW_NO_TRANSPORT:-0}"
  local api_only_fallback="${WBEAM_ANDROID_API_ONLY_FALLBACK:-0}"

  if [[ -n "${WBEAM_ANDROID_API_HOST:-}" || -n "${WBEAM_ANDROID_STREAM_HOST:-}" || -n "${WBEAM_ANDROID_HOST:-}" ]]; then
    local explicit_api="${WBEAM_ANDROID_API_HOST:-${WBEAM_ANDROID_HOST:-127.0.0.1}}"
    local explicit_stream="${WBEAM_ANDROID_STREAM_HOST:-${WBEAM_ANDROID_HOST:-127.0.0.1}}"
    android_echo_hosts "$explicit_api" "$explicit_stream"
    return 0
  fi

  require_cmd adb
  adb start-server >/dev/null
  adb_device_cmd wait-for-device

  if android_try_reverse_setup; then
    android_echo_hosts "127.0.0.1" "127.0.0.1"
    return 0
  fi

  if [[ "$pipeline_mode" != "legacy" ]]; then
    # Modern pipeline: adb reverse failed — fall back to LAN IP so the app can
    # still reach the host when connected on Wi-Fi.
    local host_ip_mod
    host_ip_mod="$(detect_host_ip || true)"
    if [[ -n "$host_ip_mod" ]]; then
      echo "[android] WARN: adb reverse failed; using LAN IP ${host_ip_mod} for modern pipeline" >&2
      android_echo_hosts "$host_ip_mod" "$host_ip_mod"
      return 0
    fi
    echo "[android] WARN: adb reverse failed and no LAN IP detected; falling back to 127.0.0.1" >&2
    android_echo_hosts "127.0.0.1" "127.0.0.1"
    return 0
  fi

  local host_ip
  host_ip="$(detect_host_ip || true)"

  # For the legacy pipeline, adb reverse is never available (API<21), so
  # 127.0.0.1 is NEVER useful — bake the host's LAN/tether IP instead.
  # Try host IP unconditionally; the device-side IP check is irrelevant here
  # because it's the *host* address we're embedding in the APK.
  if [[ -n "$host_ip" ]]; then
    if ! android_probe_control_api_from_device "$host_ip"; then
      local host_iface
      host_iface="$(ip -4 -o addr show scope global 2>/dev/null | awk -v target="$host_ip" '{split($4,a,"/"); if (a[1]==target) {print $2; exit}}' || true)"
      echo "[android] ERROR: device cannot reach host control API at http://${host_ip}:${CONTROL_PORT}/status" >&2
      echo "[android] - this causes the red 'control link' screen." >&2
      if [[ -n "$host_iface" ]]; then
        echo "[android] Fix firewall (run locally as root):" >&2
        echo "  sudo iptables -I INPUT -i ${host_iface} -s 192.168.42.0/24 -p tcp -m multiport --dports ${CONTROL_PORT},${STREAM_PORT} -j ACCEPT" >&2
      fi
      echo "[android] Then rerun: ./wbeam android deploy" >&2
      return 1
    fi
    # api_only_fallback is only meaningful for modern (where stream may use
    # adb reverse): for legacy both endpoints must use the direct IP.
    android_echo_hosts "$host_ip" "$host_ip"
    return 0
  fi

  if [[ "$allow_no_transport" =~ ^(1|true|TRUE|yes|on)$ ]]; then
    echo "[android] WARN: legacy pipeline — no host IP detected; app will be unreachable." >&2
    echo "[android] Hint: set WBEAM_ANDROID_HOST=<host-ip> explicitly (e.g. 192.168.100.201)." >&2
    android_echo_hosts "127.0.0.1" "127.0.0.1"
    return 0
  fi

  echo "[android] ERROR: no transport path to host for legacy device." >&2
  echo "[android] - adb reverse is unavailable on this device (or ADB transport is unstable)." >&2
  echo "[android] - device has no active IPv4 network interface for LAN fallback." >&2
  echo "[android] Hint: set WBEAM_ANDROID_ALLOW_NO_TRANSPORT=1 to force loopback deploy despite missing tunnel." >&2
  echo "[android] Fix: connect tablet to Wi-Fi (same LAN as host) or set WBEAM_ANDROID_HOST manually after network is up." >&2
  return 1
}

android_target_desc() {
  if [[ -n "$ANDROID_SERIAL" ]]; then
    echo "serial=$ANDROID_SERIAL"
  else
    echo "default-device"
  fi
}

require_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "Missing required command: $1" >&2
    exit 1
  fi
}

host_build() {
  require_cmd cargo
  local rust_dir="$ROOT_DIR/host/rust"
  local build_version
  build_version="$(build_version_for_build)"
  echo "[host] Build version: $build_version"
  echo "[host] Building Rust backend (release)…"
  cd "$rust_dir" && \
    WBEAM_BUILD_REV="$build_version" cargo build --release -p wbeamd-server && \
    WBEAM_BUILD_REV="$build_version" cargo build --release -p wbeamd-streamer --no-default-features --features evdi
  echo "[host] Build OK → $DAEMON_BIN"
}

ensure_daemon_binary() {
  if [[ -x "$DAEMON_BIN" ]]; then
    return 0
  fi
  echo "Daemon binary missing: $DAEMON_BIN" >&2
  echo "Build it first:" >&2
  echo "  cd $ROOT_DIR/host/rust && cargo build --release -p wbeamd-server" >&2
  echo "  cd $ROOT_DIR/host/rust && cargo build --release -p wbeamd-streamer --no-default-features --features evdi" >&2
  echo "or install package providing /usr/local/bin/wbeamd-server" >&2
  exit 1
}

stop_local_processes() {
  pkill -9 wbeamd-streamer 2>/dev/null || true
  pkill -9 wbeamd-server 2>/dev/null || true
  rm -f /tmp/wbeamd.lock
}

ensure_log_dir() {
  mkdir -p "$LOG_DIR"
}

next_log_run_id() {
  local day counter_file n
  ensure_log_dir
  day="$(date +%Y%m%d)"
  counter_file="$LOG_DIR/.run.${day}.counter"
  n=0
  if [[ -f "$counter_file" ]]; then
    n="$(tr -d '[:space:]' < "$counter_file" 2>/dev/null || echo 0)"
  fi
  if [[ ! "$n" =~ ^[0-9]+$ ]]; then
    n=0
  fi
  n=$((n + 1))
  printf '%s' "$n" > "$counter_file"
  printf '%04d' "$n"
}

new_log_file() {
  local domain ts run_id
  domain="$1"
  ts="$(date +%Y%m%d-%H%M%S)"
  run_id="$(next_log_run_id)"
  echo "$LOG_DIR/${ts}.${domain}.${run_id}.log"
}

adb_logcat_is_running() {
  local pid
  if [[ ! -f "$ADB_LOGCAT_PID_FILE" ]]; then
    return 1
  fi
  pid="$(awk 'NR==1{print $1}' "$ADB_LOGCAT_PID_FILE" 2>/dev/null || true)"
  [[ -n "$pid" ]] || return 1
  kill -0 "$pid" 2>/dev/null
}

adb_logcat_start() {
  local log_file pid serial
  require_cmd adb
  ensure_log_dir
  serial="${ANDROID_SERIAL:-default}"

  if adb_logcat_is_running; then
    echo "[logs][adb] already running: $(cat "$ADB_LOGCAT_PID_FILE" 2>/dev/null)"
    return 0
  fi

  adb start-server >/dev/null 2>&1 || true
  log_file="$(new_log_file "adb")"
  # Capture device logs continuously; useful for control-link failures.
  (adb_device_cmd logcat -v threadtime) >>"$log_file" 2>&1 &
  pid=$!
  printf '%s %s %s\n' "$pid" "$log_file" "$serial" > "$ADB_LOGCAT_PID_FILE"
  echo "[logs][adb] started pid=$pid serial=$serial file=$log_file"
}

adb_logcat_stop() {
  local pid
  if ! adb_logcat_is_running; then
    rm -f "$ADB_LOGCAT_PID_FILE"
    echo "[logs][adb] not running"
    return 0
  fi
  pid="$(awk 'NR==1{print $1}' "$ADB_LOGCAT_PID_FILE" 2>/dev/null || true)"
  kill "$pid" 2>/dev/null || true
  rm -f "$ADB_LOGCAT_PID_FILE"
  echo "[logs][adb] stopped pid=$pid"
}

adb_logcat_status() {
  if adb_logcat_is_running; then
    echo "[logs][adb] running: $(cat "$ADB_LOGCAT_PID_FILE" 2>/dev/null)"
  else
    echo "[logs][adb] not running"
    return 1
  fi
}

adb_logcat_tail() {
  local latest
  latest="$(ls -1t "$LOG_DIR"/*.adb.*.log 2>/dev/null | head -n 1 || true)"
  if [[ -z "$latest" ]]; then
    echo "[logs][adb] no adb logs in $LOG_DIR"
    exit 1
  fi
  echo "[logs][adb] tailing $latest"
  tail -n 200 -f "$latest"
}

adb_logcat_ensure_running() {
  local auto_on="${WBEAM_ADB_LOGCAT_AUTO:-1}"
  if [[ "$auto_on" =~ ^(1|true|TRUE|yes|on)$ ]]; then
    adb_logcat_start
  fi
}

control_api_status() {
  curl -sSf "http://127.0.0.1:${CONTROL_PORT}/status"
}

print_control_unreachable_diagnostics() {
  local lines ts diag_dir diag_file
  lines="${WBEAM_DAEMON_LOG_LINES:-40}"
  ts="$(date '+%Y-%m-%d %H:%M:%S %z')"
  diag_dir="$ROOT_DIR/.logs"
  diag_file="$diag_dir/wbeam-daemon-status.log"

  echo "Control API not reachable on 127.0.0.1:${CONTROL_PORT}"

  mkdir -p "$diag_dir"
  {
    echo "[$ts] control API unreachable on 127.0.0.1:${CONTROL_PORT}"
    echo "user=$(id -un) uid=${UID}"
    echo
  } >> "$diag_file"

  echo
  echo "Diagnostics saved to: $diag_file"
}

ip_up() {
  require_cmd adb
  adb start-server >/dev/null
  adb_device_cmd wait-for-device
  adb_device_cmd reverse "tcp:${STREAM_PORT}" "tcp:${STREAM_PORT}"
  adb_device_cmd reverse "tcp:${CONTROL_PORT}" "tcp:${CONTROL_PORT}"
  ip_status
}

ip_down() {
  adb_device_cmd reverse --remove "tcp:${STREAM_PORT}" >/dev/null 2>&1 || true
  adb_device_cmd reverse --remove "tcp:${CONTROL_PORT}" >/dev/null 2>&1 || true
  ip_status
}

ip_status() {
  adb_device_cmd version >/dev/null
  echo "ADB reverse mappings:"
  adb_device_cmd reverse --list || true
}

# Run the release binary in the foreground (no systemd, clean output)
host_run() {
  ensure_daemon_binary
  stop_local_processes
  if command -v adb >/dev/null 2>&1; then
    adb start-server >/dev/null 2>&1 || true
    adb_device_cmd reverse "tcp:${STREAM_PORT}"   "tcp:${STREAM_PORT}"   2>/dev/null || true
    adb_device_cmd reverse "tcp:${CONTROL_PORT}" "tcp:${CONTROL_PORT}" 2>/dev/null || true
  fi
  echo "[wbeam] host run — release binary, foreground"
  echo "[wbeam] control=127.0.0.1:${CONTROL_PORT}  stream=127.0.0.1:${STREAM_PORT}"
  echo "[wbeam] Ctrl-C to stop"
  echo ""
  export RUST_LOG="${RUST_LOG:-info}"
  export WBEAM_USE_RUST_STREAMER=1
  exec "$DAEMON_BIN" \
    --control-port "$CONTROL_PORT" \
    --stream-port  "$STREAM_PORT" \
    --root         "$ROOT_DIR"
}

# Debug run: full RUST_LOG=debug, coloured output, ADB logcat sidecar
host_debug() {
  exec "$HOST_SCRIPTS_DIR/run_wbeamd_debug.sh" "$CONTROL_PORT" "$STREAM_PORT"
}

# Backwards-compat aliases
daemon_up()   { host_run; }
daemon_down() { stop_local_processes; echo "Daemon processes stopped."; }
daemon_status() {
  if control_api_status >/dev/null 2>&1; then
    control_api_status
    echo
  else
    print_control_unreachable_diagnostics
    exit 1
  fi
}

host_probe() {
  if command -v python3 >/dev/null 2>&1; then
    exec python3 "$HOST_SCRIPTS_DIR/probe_host.py" "$@"
  fi
  if command -v python >/dev/null 2>&1; then
    exec python "$HOST_SCRIPTS_DIR/probe_host.py" "$@"
  fi
  echo "Missing required command: python3 (or python)" >&2
  exit 1
}

host_tuner() {
  require_cmd cargo
  android_select_serial_if_needed || true
  local rust_dir="$ROOT_DIR/host/rust"
  local tuner_stream_port="${WBEAM_STREAM_PORT:-$STREAM_PORT}"
  local tuner_control_port="${WBEAM_CONTROL_PORT:-$CONTROL_PORT}"
  local tuner_args=("--host-url" "http://127.0.0.1:${tuner_control_port}")
  if [[ -n "$ANDROID_SERIAL" ]]; then
    echo "[host] tuner using serial=$ANDROID_SERIAL" >&2
    if android_try_reverse_setup "$tuner_stream_port" "$tuner_control_port"; then
      echo "[host] tuner adb reverse OK (control:${tuner_control_port} stream:${tuner_stream_port})" >&2
    else
      echo "[host] WARN: tuner could not configure adb reverse (control:${tuner_control_port} stream:${tuner_stream_port})" >&2
    fi
    tuner_args+=("--serial" "$ANDROID_SERIAL")
    tuner_args+=("--stream-port" "$tuner_stream_port")
  else
    echo "[host] tuner using default session (no serial selected)" >&2
  fi
  tuner_args+=("$@")
  cd "$rust_dir" && cargo run --release -p wbeamd-tuner -- "${tuner_args[@]}"
}

android_build() {
  local pipeline_mode min_sdk build_api_host build_stream_host gradle_user_home build_version
  local build_stream_port build_control_port
  pipeline_mode="$(android_pipeline_mode)"
  min_sdk="$(android_pipeline_min_sdk "$pipeline_mode")"
  build_api_host="${WBEAM_ANDROID_API_HOST:-${WBEAM_ANDROID_HOST:-$(android_build_host "$pipeline_mode")}}"
  build_stream_host="${WBEAM_ANDROID_STREAM_HOST:-${WBEAM_ANDROID_HOST:-$(android_build_host "$pipeline_mode")}}"
  build_stream_port="${WBEAM_STREAM_PORT:-$STREAM_PORT}"
  build_control_port="${WBEAM_CONTROL_PORT:-$CONTROL_PORT}"
  build_version="$(build_version_for_build)"
  gradle_user_home="$ROOT_DIR/.gradle-user"
  mkdir -p "$gradle_user_home"

  echo "[android] Building debug APK (version=${build_version}, pipeline=${pipeline_mode}, minSdk=${min_sdk}, api_host=${build_api_host}, stream_host=${build_stream_host}, stream_port=${build_stream_port})…"
  android_gradle_build_retry_once ":app:assembleDebug" "$min_sdk" "$build_api_host" "$build_stream_host" "$build_control_port" "$build_stream_port" "$gradle_user_home" "$build_version"
  echo "[android] APK: $ANDROID_APK"
  # Record the baked config so android_should_skip_install can detect host changes.
  printf 'version=%s|api=%s|stream=%s|stream_port=%s|pipeline=%s' "$build_version" "$build_api_host" "$build_stream_host" "$build_stream_port" "$pipeline_mode" \
    > "$(android_build_stamp_path "$ANDROID_APK")" 2>/dev/null || true
}

android_install_with_signature_recover() {
  local apk_path="$1"
  local package_name="$2"
  local out=""
  local rc=1
  local install_ok=0

  out="$(adb_device_cmd install -r "$apk_path" 2>&1)" || rc=$?
  if [[ "$rc" -eq 0 ]] && ! printf '%s' "$out" | grep -q "Failure \["; then
    install_ok=1
  fi
  if [[ "$install_ok" -eq 1 ]]; then
    [[ -n "$out" ]] && printf '%s\n' "$out"
    return 0
  fi
  [[ -n "$out" ]] && printf '%s\n' "$out" >&2

  if printf '%s' "$out" | grep -Eq "INSTALL_FAILED_UPDATE_INCOMPATIBLE|INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES"; then
    echo "[android] Detected signature mismatch for ${package_name}; uninstalling existing package and retrying..."
    adb_device_cmd uninstall "$package_name" >/dev/null 2>&1 || true
    adb_device_cmd shell pm uninstall --user 0 "$package_name" >/dev/null 2>&1 || true

    rc=1
    install_ok=0
    out="$(adb_device_cmd install -r "$apk_path" 2>&1)" || rc=$?
    if [[ "$rc" -eq 0 ]] && ! printf '%s' "$out" | grep -q "Failure \["; then
      install_ok=1
    fi
    if [[ "$install_ok" -eq 1 ]]; then
      [[ -n "$out" ]] && printf '%s\n' "$out"
      return 0
    fi
    [[ -n "$out" ]] && printf '%s\n' "$out" >&2
  fi

  if [[ "$rc" -eq 0 ]]; then
    rc=1
  fi
  return "$rc"
}

android_install() {
  if [[ ! -f "$ANDROID_APK" ]]; then
    echo "APK not found: $ANDROID_APK" >&2
    echo "Run './wbeam android build' first." >&2
    exit 1
  fi
  adb start-server >/dev/null
  adb_device_cmd wait-for-device
  if android_should_skip_install "$ANDROID_APK"; then
    echo "[android] APK version+config unchanged ($(android_expected_version_name)); skipping install (${ANDROID_SERIAL:-default})."
    return 0
  fi
  echo "[android] Installing $ANDROID_APK (${ANDROID_SERIAL:-default})…"
  android_install_with_signature_recover "$ANDROID_APK" "$ANDROID_PACKAGE"
  # Record the build config that is now on the device so future skip checks work.
  local build_stamp install_stamp
  build_stamp="$(android_build_stamp_path "$ANDROID_APK")"
  install_stamp="$(android_install_stamp_path "$ANDROID_APK")"
  if [[ -f "$build_stamp" ]]; then
    cp "$build_stamp" "$install_stamp" 2>/dev/null || true
  fi
}

android_launch() {
  adb start-server >/dev/null
  adb_device_cmd wait-for-device
  echo "[android] Launching ${ANDROID_PACKAGE}/${ANDROID_ACTIVITY} ($(android_target_desc))…"
  adb_device_cmd shell am start -n "${ANDROID_PACKAGE}/${ANDROID_ACTIVITY}"
}

android_deploy() {
  local pipeline_mode build_hosts build_api_host build_stream_host
  local deploy_stream_port deploy_control_port
  local skip_launch="${WBEAM_ANDROID_SKIP_LAUNCH:-0}"
  adb_logcat_ensure_running
  deploy_stream_port="${WBEAM_STREAM_PORT:-$STREAM_PORT}"
  deploy_control_port="${WBEAM_CONTROL_PORT:-$CONTROL_PORT}"
  pipeline_mode="$(android_pipeline_mode)"
  build_hosts="$(android_resolve_deploy_hosts "$pipeline_mode")"
  build_api_host="${build_hosts%%|*}"
  build_stream_host="${build_hosts##*|}"
  echo "[android] Deploy hosts: api=$build_api_host stream=$build_stream_host"
  WBEAM_ANDROID_API_HOST="$build_api_host" WBEAM_ANDROID_STREAM_HOST="$build_stream_host" android_build
  android_install
  # Ensure adb reverse is active before the app launches so 127.0.0.1
  # loopback tunnels the control+stream ports to this host.
  if android_try_reverse_setup "$deploy_stream_port" "$deploy_control_port"; then
    echo "[android] adb reverse OK (control:${deploy_control_port} stream:${deploy_stream_port})"
  else
    echo "[android] WARN: adb reverse not available — app will use baked-in host ${build_api_host}" >&2
  fi
  if [[ "$skip_launch" == "1" ]]; then
    echo "[android] Skip launch requested (WBEAM_ANDROID_SKIP_LAUNCH=1)."
  else
    android_launch
  fi
}

android_deploy_all() {
  local serials=()
  local serial=""
  local ok_count=0
  local fail_count=0
  local serial_backup="$ANDROID_SERIAL"
  local pipeline_mode build_hosts build_api_host build_stream_host
  local skip_launch="${WBEAM_ANDROID_SKIP_LAUNCH:-0}"
  local shared_build_version=""

  mapfile -t serials < <(android_connected_serials)
  if [[ "${#serials[@]}" -eq 0 ]]; then
    echo "[android] No connected adb devices in 'device' state." >&2
    echo "[android] Run 'adb devices' and authorize at least one device." >&2
    exit 1
  fi

  echo "[android] Deploying to ${#serials[@]} device(s): ${serials[*]}"
  shared_build_version="$(build_version_for_build)"
  echo "[android] Shared build version for this deploy-all run: ${shared_build_version}"
  : > "$DEVICE_PORTS_FILE"

  local idx=0
  for serial in "${serials[@]}"; do
    idx=$((idx + 1))
    local serial_stream_port serial_control_port
    ANDROID_SERIAL="$serial"
    serial_stream_port=$((STREAM_PORT + idx + 1))
    serial_control_port="$CONTROL_PORT"
    if [[ "$serial_stream_port" -eq "$serial_control_port" ]]; then
      serial_stream_port=$((serial_stream_port + 1))
    fi
    echo
    pipeline_mode="$(android_pipeline_mode)"
    build_hosts="$(android_resolve_deploy_hosts "$pipeline_mode")" || {
      echo "[android][$serial] FAILED resolving hosts" >&2
      ((fail_count += 1))
      continue
    }
    build_api_host="${build_hosts%%|*}"
    build_stream_host="${build_hosts##*|}"
    echo "[android][$serial] pipeline=${pipeline_mode} api_host=${build_api_host} stream_host=${build_stream_host} stream_port=${serial_stream_port}"
    if WBEAM_ANDROID_PIPELINE="$pipeline_mode" \
       WBEAM_ANDROID_API_HOST="$build_api_host" \
       WBEAM_ANDROID_SERIAL="$serial" \
       WBEAM_ANDROID_STREAM_HOST="$build_stream_host" \
       WBEAM_BUILD_REV="$shared_build_version" \
       WBEAM_STREAM_PORT="$serial_stream_port" \
       WBEAM_CONTROL_PORT="$serial_control_port" \
       android_build \
       && android_install; then
      printf '%s %s\n' "$serial" "$serial_stream_port" >> "$DEVICE_PORTS_FILE"
      if android_try_reverse_setup "$serial_stream_port" "$serial_control_port"; then
        echo "[android][$serial] adb reverse OK (control:${serial_control_port} stream:${serial_stream_port})"
      else
        echo "[android][$serial] WARN: adb reverse not available — app will use baked-in host ${build_api_host}" >&2
      fi
      if [[ "$skip_launch" == "1" ]]; then
        echo "[android][$serial] OK (launch skipped)"
        ((ok_count += 1))
      else
        if android_launch; then
          echo "[android][$serial] OK"
          ((ok_count += 1))
        else
          echo "[android][$serial] FAILED launch" >&2
          ((fail_count += 1))
        fi
      fi
    else
      echo "[android][$serial] FAILED build/install" >&2
      ((fail_count += 1))
    fi
  done

  ANDROID_SERIAL="$serial_backup"
  echo
  echo "[android] Deploy summary: ok=${ok_count} failed=${fail_count}"
  if (( fail_count > 0 )); then
    exit 1
  fi
}

android_build_release() {
  local pipeline_mode min_sdk build_api_host build_stream_host gradle_user_home build_version
  local build_stream_port build_control_port
  pipeline_mode="$(android_pipeline_mode)"
  min_sdk="$(android_pipeline_min_sdk "$pipeline_mode")"
  build_api_host="${WBEAM_ANDROID_API_HOST:-${WBEAM_ANDROID_HOST:-$(android_build_host "$pipeline_mode")}}"
  build_stream_host="${WBEAM_ANDROID_STREAM_HOST:-${WBEAM_ANDROID_HOST:-$(android_build_host "$pipeline_mode")}}"
  build_stream_port="${WBEAM_STREAM_PORT:-$STREAM_PORT}"
  build_control_port="${WBEAM_CONTROL_PORT:-$CONTROL_PORT}"
  build_version="$(build_version_for_build)"
  gradle_user_home="$ROOT_DIR/.gradle-user"
  mkdir -p "$gradle_user_home"

  echo "[android] Building release APK (version=${build_version}, pipeline=${pipeline_mode}, minSdk=${min_sdk}, api_host=${build_api_host}, stream_host=${build_stream_host}, stream_port=${build_stream_port})…"
  android_gradle_build_retry_once ":app:assembleRelease" "$min_sdk" "$build_api_host" "$build_stream_host" "$build_control_port" "$build_stream_port" "$gradle_user_home" "$build_version"
  if [[ -f "$ANDROID_APK_RELEASE" ]]; then
    echo "[android] APK: $ANDROID_APK_RELEASE"
    printf 'version=%s|api=%s|stream=%s|stream_port=%s|pipeline=%s' "$build_version" "$build_api_host" "$build_stream_host" "$build_stream_port" "$pipeline_mode" \
      > "$(android_build_stamp_path "$ANDROID_APK_RELEASE")" 2>/dev/null || true
  elif [[ -f "$ANDROID_APK_RELEASE_UNSIGNED" ]]; then
    echo "[android] APK: $ANDROID_APK_RELEASE_UNSIGNED"
    printf 'version=%s|api=%s|stream=%s|stream_port=%s|pipeline=%s' "$build_version" "$build_api_host" "$build_stream_host" "$build_stream_port" "$pipeline_mode" \
      > "$(android_build_stamp_path "$ANDROID_APK_RELEASE_UNSIGNED")" 2>/dev/null || true
  fi
}

android_rotate_gradle_workspace_cache() {
  local gradle_user_home="$1"
  local cache_dir="${gradle_user_home}/caches/9.0-milestone-1"
  local ts
  ts="$(date +%Y%m%d-%H%M%S)"

  if [[ -d "${cache_dir}/transforms" ]]; then
    mv "${cache_dir}/transforms" "${cache_dir}/transforms.bak-${ts}"
    echo "[android] Rotated Gradle transforms cache -> ${cache_dir}/transforms.bak-${ts}" >&2
  fi
  if [[ -d "${cache_dir}/groovy-dsl" ]]; then
    mv "${cache_dir}/groovy-dsl" "${cache_dir}/groovy-dsl.bak-${ts}"
    echo "[android] Rotated Gradle groovy-dsl cache -> ${cache_dir}/groovy-dsl.bak-${ts}" >&2
  fi
}

android_select_java_home() {
  if [[ -n "${WBEAM_ANDROID_JAVA_HOME:-}" ]]; then
    echo "$WBEAM_ANDROID_JAVA_HOME"
    return 0
  fi
  if [[ -d "/usr/lib/jvm/java-17-openjdk" ]]; then
    echo "/usr/lib/jvm/java-17-openjdk"
    return 0
  fi
  return 1
}

android_gradle_build_retry_once() {
  local task="$1"
  local min_sdk="$2"
  local build_api_host="$3"
  local build_stream_host="$4"
  local build_control_port="$5"
  local build_stream_port="$6"
  local gradle_user_home="$7"
  local build_version="$8"
  local gradle_java_home=""
  local -a gradle_env
  local tmp_log
  local extra_args=()
  tmp_log="$(mktemp "$ROOT_DIR/.gradle-build.XXXXXX.log")"
  gradle_java_home="$(android_select_java_home || true)"
  gradle_env=(GRADLE_USER_HOME="$gradle_user_home")
  if [[ -n "$gradle_java_home" ]]; then
    gradle_env+=(JAVA_HOME="$gradle_java_home")
  fi

  if [[ "$task" == ":app:assembleRelease" ]]; then
    # Local deploy path: don't block release build on lint-vital crashes/noise.
    extra_args=(-x :app:lintVitalAnalyzeRelease -x :app:lintVitalReportRelease -x :app:lintVitalRelease)
  fi

  if [[ -n "$gradle_java_home" ]]; then
    echo "[android] Using JAVA_HOME=${gradle_java_home} for Gradle" >&2
  fi

  if (cd "$ANDROID_DIR" && env "${gradle_env[@]}" bash ./gradlew --no-daemon \
      -PWBEAM_MIN_SDK="$min_sdk" \
      -PWBEAM_BUILD_REV="$build_version" \
      -PWBEAM_HOST="$build_stream_host" \
      -PWBEAM_API_HOST="$build_api_host" \
      -PWBEAM_STREAM_HOST="$build_stream_host" \
      -PWBEAM_CONTROL_PORT="$build_control_port" \
      -PWBEAM_STREAM_PORT="$build_stream_port" \
      -PWBEAM_ANDROID_SERIAL="${ANDROID_SERIAL:-}" \
      "${extra_args[@]}" "$task" 2>&1 | tee "$tmp_log"); then
    rm -f "$tmp_log"
    return 0
  fi

  if grep -q "Could not read workspace metadata" "$tmp_log"; then
    echo "[android] WARN: detected Gradle workspace metadata corruption; retrying once after cache rotation..." >&2
    android_rotate_gradle_workspace_cache "$gradle_user_home"
    rm -f "$tmp_log"
    cd "$ANDROID_DIR" && env "${gradle_env[@]}" bash ./gradlew --no-daemon \
      -PWBEAM_MIN_SDK="$min_sdk" \
      -PWBEAM_BUILD_REV="$build_version" \
      -PWBEAM_HOST="$build_stream_host" \
      -PWBEAM_API_HOST="$build_api_host" \
      -PWBEAM_STREAM_HOST="$build_stream_host" \
      -PWBEAM_CONTROL_PORT="$build_control_port" \
      -PWBEAM_STREAM_PORT="$build_stream_port" \
      -PWBEAM_ANDROID_SERIAL="${ANDROID_SERIAL:-}" \
      "${extra_args[@]}" "$task"
    return $?
  fi

  rm -f "$tmp_log"
  return 1
}

android_install_release() {
  local release_apk=""
  if [[ -f "$ANDROID_APK_RELEASE" ]]; then
    release_apk="$ANDROID_APK_RELEASE"
  elif [[ -f "$ANDROID_APK_RELEASE_UNSIGNED" ]]; then
    release_apk="$ANDROID_APK_RELEASE_UNSIGNED"
  fi

  if [[ -z "$release_apk" ]]; then
    echo "Release APK not found." >&2
    echo "Run './wbeam android build-release' first." >&2
    exit 1
  fi

  if [[ "$release_apk" == *"-unsigned.apk" ]]; then
    echo "Release APK is unsigned: $release_apk" >&2
    echo "Configure signing for release build before install, or use debug deploy for local testing." >&2
    exit 1
  fi

  adb start-server >/dev/null
  adb_device_cmd wait-for-device
  if android_should_skip_install "$release_apk"; then
    echo "[android] APK version+config unchanged ($(android_expected_version_name)); skipping release install (${ANDROID_SERIAL:-default})."
    return 0
  fi
  echo "[android] Installing $release_apk ($(android_target_desc))…"
  android_install_with_signature_recover "$release_apk" "$ANDROID_PACKAGE"
  local build_stamp install_stamp
  build_stamp="$(android_build_stamp_path "$release_apk")"
  install_stamp="$(android_install_stamp_path "$release_apk")"
  if [[ -f "$build_stamp" ]]; then
    cp "$build_stamp" "$install_stamp" 2>/dev/null || true
  fi
}

android_deploy_release() {
  local pipeline_mode build_hosts build_api_host build_stream_host
  adb_logcat_ensure_running
  pipeline_mode="$(android_pipeline_mode)"
  build_hosts="$(android_resolve_deploy_hosts "$pipeline_mode")"
  build_api_host="${build_hosts%%|*}"
  build_stream_host="${build_hosts##*|}"
  echo "[android] Release deploy hosts: api=$build_api_host stream=$build_stream_host"
  WBEAM_ANDROID_API_HOST="$build_api_host" WBEAM_ANDROID_STREAM_HOST="$build_stream_host" android_build_release
  android_install_release
  android_launch
}

debug_up() {
  exec "$HOST_SCRIPTS_DIR/run_wbeamd_debug.sh" "$CONTROL_PORT" "$STREAM_PORT"
}

debug_watch() {
  exec "$HOST_SCRIPTS_DIR/watch_live_debug_logs.sh"
}

logs_live() {
  debug_watch
}

logs_host() {
  local host_log
  host_log="$(ls -1t "$ROOT_DIR"/logs/*.host.*.log 2>/dev/null | head -n 1 || true)"
  if [[ -z "$host_log" ]]; then
    host_log="$(ls -1t "$ROOT_DIR"/host/rust/logs/wbeamd-debug-*.log 2>/dev/null | head -n 1 || true)"
  fi
  if [[ -z "$host_log" ]]; then
    echo "No host debug log found in $ROOT_DIR/logs or $ROOT_DIR/host/rust/logs"
    exit 1
  fi
  tail -n 200 -f "$host_log"
}

logs_adb() {
  case "${1:-status}" in
    start|up)   adb_logcat_start ;;
    stop|down)  adb_logcat_stop ;;
    status)     adb_logcat_status ;;
    tail|watch) adb_logcat_tail ;;
    *)          print_help; exit 1 ;;
  esac
}

watch_use_color() {
  if [[ "${WBEAM_WATCH_COLOR:-0}" == "1" ]]; then
    return 0
  fi
  [[ -t 1 && "${NO_COLOR:-0}" != "1" ]]
}

watch_style() {
  local name="$1"
  if watch_use_color; then
    case "$name" in
      reset) printf '\033[0m' ;;
      title) printf '\033[1;36m' ;;
      ok)    printf '\033[1;32m' ;;
      warn)  printf '\033[1;33m' ;;
      err)   printf '\033[1;31m' ;;
      dim)   printf '\033[2m' ;;
      *)     printf '' ;;
    esac
  fi
}

watch_status_label() {
  local value="$1"
  case "$value" in
    true|ok|match|reachable|running)
      printf '%s%s%s' "$(watch_style ok)" "$value" "$(watch_style reset)"
      ;;
    2??)
      printf '%s%s%s' "$(watch_style ok)" "$value" "$(watch_style reset)"
      ;;
    false|mismatch|unreachable|stopped|none|missing)
      printf '%s%s%s' "$(watch_style err)" "$value" "$(watch_style reset)"
      ;;
    4??|5??|000|unavailable)
      printf '%s%s%s' "$(watch_style err)" "$value" "$(watch_style reset)"
      ;;
    *)
      printf '%s%s%s' "$(watch_style warn)" "$value" "$(watch_style reset)"
      ;;
  esac
}

watch_print_header() {
  local topic="$1"
  printf '%s[watch:%s]%s %s\n' "$(watch_style title)" "$topic" "$(watch_style reset)" "$(date -Iseconds)"
  printf '%s[watch:%s]%s host=%s control_port=%s stream_port=%s\n' \
    "$(watch_style dim)" "$topic" "$(watch_style reset)" \
    "$(hostname 2>/dev/null || echo unknown)" "$CONTROL_PORT" "$STREAM_PORT"
}

watch_device_stream_port() {
  local idx="$1"
  echo $((STREAM_PORT + idx))
}

watch_android_max_res() {
  local serial="$1"
  local res=""
  res="$(adb -s "$serial" shell wm size 2>/dev/null | sed -n 's/.*Physical size:[[:space:]]*//p' | head -n1 | tr -d '\r' || true)"
  if [[ -n "$res" ]]; then
    echo "$res"
    return 0
  fi

  local w h
  w="$(adb -s "$serial" shell dumpsys display 2>/dev/null | sed -n 's/.*deviceWidth=\([0-9][0-9]*\).*/\1/p' | head -n1 | tr -d '\r' || true)"
  h="$(adb -s "$serial" shell dumpsys display 2>/dev/null | sed -n 's/.*deviceHeight=\([0-9][0-9]*\).*/\1/p' | head -n1 | tr -d '\r' || true)"
  if [[ -n "$w" && -n "$h" ]]; then
    echo "${w}x${h}"
    return 0
  fi
  echo "unknown"
}

watch_session_status_json() {
  local serial="$1"
  local stream_port="$2"
  curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/status?serial=${serial}&stream_port=${stream_port}" 2>/dev/null || true
}

watch_session_metrics_json() {
  local serial="$1"
  local stream_port="$2"
  curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/metrics?serial=${serial}&stream_port=${stream_port}" 2>/dev/null || true
}

watch_adb_reverse_has_port() {
  local serial="$1"
  local port="$2"
  local rev
  rev="$(adb -s "$serial" reverse --list 2>/dev/null || true)"
  if [[ -n "$rev" ]] && printf '%s\n' "$rev" | grep -q "tcp:${port}[[:space:]]\+tcp:${port}"; then
    echo "yes"
  else
    echo "no"
  fi
}

watch_devices_once() {
  require_cmd adb
  local serial api model batt apk batt_view max_res session_state stream_port idx
  local status_json
  local -a serials

  adb start-server >/dev/null 2>&1 || true
  mapfile -t serials < <(android_connected_serials)
  printf '%-14s %s\n' "adb_devices" "${#serials[@]}"
  if [[ "${#serials[@]}" -eq 0 ]]; then
    echo "no adb devices in state=device"
    return 0
  fi

  printf '%-18s %-18s %-4s %-6s %-11s %-10s %-10s %-18s\n' "serial" "model" "api" "port" "max_res" "streaming" "battery" "apk"
  printf '%-18s %-18s %-4s %-6s %-11s %-10s %-10s %-18s\n' "------" "-----" "---" "----" "-------" "---------" "-------" "---"
  idx=1
  for serial in "${serials[@]}"; do
    api="$(adb -s "$serial" shell getprop ro.build.version.sdk 2>/dev/null | tr -d '\r[:space:]' || true)"
    model="$(adb -s "$serial" shell getprop ro.product.model 2>/dev/null | tr -d '\r' || true)"
    batt="$(adb -s "$serial" shell dumpsys battery 2>/dev/null | awk -F': ' '/level:/{print $2; exit}' | tr -d '\r[:space:]' || true)"
    apk="$(adb -s "$serial" shell dumpsys package "$ANDROID_PACKAGE" 2>/dev/null | sed -n 's/^[[:space:]]*versionName=//p' | head -n1 | tr -d '\r' || true)"
    stream_port="$(watch_device_stream_port "$idx")"
    status_json="$(watch_session_status_json "$serial" "$stream_port")"
    session_state="$(json_string_field "$status_json" "state")"
    if [[ -z "$session_state" ]]; then
      session_state="unknown"
    fi
    max_res="$(watch_android_max_res "$serial")"
    batt_view="${batt:-unknown}%"
    if [[ "$batt" =~ ^[0-9]+$ ]]; then
      if (( batt < 20 )); then
        batt_view="$(watch_status_label "low:${batt}%")"
      elif (( batt < 50 )); then
        batt_view="$(watch_status_label "mid:${batt}%")"
      else
        batt_view="$(watch_status_label "high:${batt}%")"
      fi
    fi
    printf '%-18s %-18s %-4s %-6s %-11s %-10s %-10s %-18s\n' \
      "$serial" "${model:-unknown}" "${api:-unknown}" "${stream_port}" "${max_res}" "$(watch_status_label "${session_state}")" "$batt_view" "${apk:-<none>}"
    idx=$((idx + 1))
  done
}

watch_connections_once() {
  local serial
  local health_json="" probe_json="" status_json="" rev=""
  local ok service build_rev stream_alive state supported capture session remote display
  local stream_port control_port reverse_count
  local -a serials

  health_json="$(curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/health" 2>/dev/null || true)"
  probe_json="$(curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/host-probe" 2>/dev/null || true)"
  status_json="$(curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/status" 2>/dev/null || true)"

  echo "host:"
  if [[ -z "$health_json" || -z "$probe_json" ]]; then
    echo "  health=$(watch_status_label unreachable) probe=$(watch_status_label unreachable)"
  else
    service="$(json_string_field "$health_json" "service")"
    build_rev="$(json_string_field "$health_json" "build_revision")"
    ok="$(json_scalar_field "$health_json" "ok")"
    stream_alive="$(json_scalar_field "$health_json" "stream_process_alive")"
    supported="$(json_scalar_field "$probe_json" "supported")"
    capture="$(json_string_field "$probe_json" "capture_mode")"
    session="$(json_string_field "$probe_json" "session")"
    remote="$(json_scalar_field "$probe_json" "remote")"
    display="$(json_string_field "$probe_json" "display")"
    state="$(json_string_field "$status_json" "state")"
    stream_port="$(json_scalar_field "$status_json" "stream_port")"
    control_port="$(json_scalar_field "$status_json" "control_port")"
    printf '  %-12s %-14s %-10s %-10s\n' "service" "${service:-unknown}" "build" "${build_rev:-unknown}"
    printf '  %-12s %-14s %-10s %-10s\n' "state" "${state:-unknown}" "capture" "${capture:-unknown}"
    printf '  %-12s %-14s %-10s %-10s\n' "ok" "$(watch_status_label "${ok:-unknown}")" "supported" "$(watch_status_label "${supported:-unknown}")"
    printf '  %-12s %-14s %-10s %-10s\n' "stream_proc" "$(watch_status_label "${stream_alive:-unknown}")" "remote" "$(watch_status_label "${remote:-unknown}")"
    printf '  %-12s %-14s %-10s %-10s\n' "session" "${session:-unknown}" "display" "${display:-unknown}"
    printf '  %-12s %-14s\n' "ports" "${control_port:-?}/${stream_port:-?}"
  fi
  echo

  echo "adb reverse:"
  if command -v adb >/dev/null 2>&1; then
    mapfile -t serials < <(android_connected_serials)
    if [[ "${#serials[@]}" -eq 0 ]]; then
      echo "  devices=$(watch_status_label none)"
      return 0
    fi
    printf '  %-18s %-14s\n' "serial" "reverse"
    printf '  %-18s %-14s\n' "------" "-------"
    for serial in "${serials[@]}"; do
      rev="$(adb -s "$serial" reverse --list 2>/dev/null || true)"
      if [[ -z "$rev" ]]; then
        printf '  %-18s %-14s\n' "$serial" "$(watch_status_label unavailable)"
      else
        reverse_count="$(printf '%s\n' "$rev" | sed '/^[[:space:]]*$/d' | wc -l | tr -d '[:space:]')"
        printf '  %-18s %-14s\n' "$serial" "$(watch_status_label "$reverse_count")"
      fi
    done
  fi
}

watch_status_once() {
  echo "daemon status:"
  daemon_status || true
  echo
  watch_doctor_once || true
}

watch_service_uptime() {
  local pid="$1"
  if [[ -z "$pid" || ! "$pid" =~ ^[0-9]+$ ]]; then
    echo "-"
    return 0
  fi
  ps -p "$pid" -o etime= 2>/dev/null | tr -d '[:space:]' || echo "-"
}

watch_service_once() {
  local unit_path="$HOME/.config/systemd/user/${DAEMON_NAME}.service"
  local installed="false" active="unknown" enabled="unknown" sub_state="unknown"
  local main_pid="-" uptime="-"
  local health_json="" probe_json="" status_json=""
  local build_rev service_name ok stream_proc supported capture session remote display state
  local serial stream_port s_state
  local -a serials

  if [[ -f "$unit_path" ]]; then
    installed="true"
  fi

  if command -v systemctl >/dev/null 2>&1; then
    active="$(systemctl --user is-active "$DAEMON_NAME" 2>/dev/null | tr -d '\r[:space:]' || true)"
    enabled="$(systemctl --user is-enabled "$DAEMON_NAME" 2>/dev/null | tr -d '\r[:space:]' || true)"
    sub_state="$(systemctl --user show "$DAEMON_NAME" -p SubState --value 2>/dev/null | tr -d '\r[:space:]' || true)"
    main_pid="$(systemctl --user show "$DAEMON_NAME" -p MainPID --value 2>/dev/null | tr -d '\r[:space:]' || true)"
  else
    active="systemctl-missing"
    enabled="systemctl-missing"
    sub_state="systemctl-missing"
    main_pid="-"
  fi
  uptime="$(watch_service_uptime "$main_pid")"

  health_json="$(curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/health" 2>/dev/null || true)"
  probe_json="$(curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/host-probe" 2>/dev/null || true)"
  status_json="$(curl -fsS --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/status" 2>/dev/null || true)"

  echo "service:"
  printf '  %-12s %-16s %-10s %-14s\n' "installed" "$(watch_status_label "$installed")" "active" "$(watch_status_label "${active:-unknown}")"
  printf '  %-12s %-16s %-10s %-14s\n' "enabled" "$(watch_status_label "${enabled:-unknown}")" "substate" "${sub_state:-unknown}"
  printf '  %-12s %-16s %-10s %-14s\n' "main_pid" "${main_pid:-?}" "uptime" "${uptime:--}"
  echo

  echo "runtime:"
  if [[ -z "$health_json" ]]; then
    echo "  health=$(watch_status_label unreachable)"
  else
    build_rev="$(json_string_field "$health_json" "build_revision")"
    service_name="$(json_string_field "$health_json" "service")"
    ok="$(json_scalar_field "$health_json" "ok")"
    stream_proc="$(json_scalar_field "$health_json" "stream_process_alive")"
    printf '  %-12s %-16s %-10s %-14s\n' "service" "${service_name:-unknown}" "build" "${build_rev:-unknown}"
    printf '  %-12s %-16s %-10s %-14s\n' "ok" "$(watch_status_label "${ok:-unknown}")" "stream_proc" "$(watch_status_label "${stream_proc:-unknown}")"
  fi

  if [[ -n "$probe_json" ]]; then
    supported="$(json_scalar_field "$probe_json" "supported")"
    capture="$(json_string_field "$probe_json" "capture_mode")"
    session="$(json_string_field "$probe_json" "session")"
    remote="$(json_scalar_field "$probe_json" "remote")"
    display="$(json_string_field "$probe_json" "display")"
    printf '  %-12s %-16s %-10s %-14s\n' "supported" "$(watch_status_label "${supported:-unknown}")" "capture" "${capture:-unknown}"
    printf '  %-12s %-16s %-10s %-14s\n' "session" "${session:-unknown}" "remote" "$(watch_status_label "${remote:-unknown}")"
    printf '  %-12s %-16s\n' "display" "${display:-unknown}"
  else
    echo "  probe=$(watch_status_label unreachable)"
  fi
  echo

  state="$(json_string_field "$status_json" "state")"
  printf 'activity: state=%s\n' "$(watch_status_label "${state:-unknown}")"
  mapfile -t serials < <(android_connected_serials)
  if [[ "${#serials[@]}" -eq 0 ]]; then
    echo "  adb_devices=$(watch_status_label none)"
    return 0
  fi
  printf '  %-18s %-6s %-12s\n' "serial" "port" "state"
  printf '  %-18s %-6s %-12s\n' "------" "----" "-----"
  local idx=1
  for serial in "${serials[@]}"; do
    stream_port="$(watch_device_stream_port "$idx")"
    s_state="$(json_string_field "$(watch_session_status_json "$serial" "$stream_port")" "state")"
    printf '  %-18s %-6s %-12s\n' "$serial" "$stream_port" "$(watch_status_label "${s_state:-unknown}")"
    idx=$((idx + 1))
  done
}

watch_logs_latest() {
  local pattern="$1"
  ls -1t "$LOG_DIR"/$pattern 2>/dev/null | head -n 1 || true
}

watch_logs_extract_run_id() {
  local path="$1"
  basename "$path" | sed -n 's/.*\.\([0-9][0-9][0-9][0-9]\)\.log$/\1/p' | head -n 1
}

watch_logs_latest_run_id() {
  local latest
  latest="$(ls -1t "$LOG_DIR"/*.[0-9][0-9][0-9][0-9].log 2>/dev/null | head -n 1 || true)"
  if [[ -z "$latest" ]]; then
    return 1
  fi
  watch_logs_extract_run_id "$latest"
}

watch_logs_files_for_run() {
  local run_id="$1"
  ls -1t "$LOG_DIR"/*."$run_id".log 2>/dev/null || true
}

watch_logs_domain_from_file() {
  local file="$1"
  basename "$file" | sed -n 's/^[^.]*\.\(.*\)\.[0-9][0-9][0-9][0-9]\.log$/\1/p' | head -n 1
}

watch_logs_file_epoch() {
  local file="$1" stamp
  stamp="$(basename "$file" | cut -d'.' -f1)"
  date -d "${stamp:0:8} ${stamp:9:2}:${stamp:11:2}:${stamp:13:2}" +%s 2>/dev/null || echo 0
}

watch_logs_latest_per_domain() {
  local -a candidates
  local -A seen=()
  local file domain
  mapfile -t candidates < <(ls -1t "$LOG_DIR"/*.[0-9][0-9][0-9][0-9].log 2>/dev/null || true)
  for file in "${candidates[@]}"; do
    domain="$(watch_logs_domain_from_file "$file")"
    if [[ -z "$domain" ]]; then
      continue
    fi
    if [[ -z "${seen[$domain]+x}" ]]; then
      seen[$domain]="$file"
      echo "$file"
    fi
  done
}

watch_logs_once() {
  local service_lines run_id
  local -a run_files
  local -a filtered_files
  local -A seen_domain=()

  run_id="$(watch_logs_latest_run_id || true)"
  if [[ -n "$run_id" ]]; then
    mapfile -t run_files < <(watch_logs_files_for_run "$run_id")
    filtered_files=()
    seen_domain=()
    if [[ "${#run_files[@]}" -gt 0 ]]; then
      local f d
      for f in "${run_files[@]}"; do
        d="$(watch_logs_domain_from_file "$f")"
        [[ -n "$d" ]] || continue
        if [[ -z "${seen_domain[$d]+x}" ]]; then
          seen_domain[$d]=1
          filtered_files+=("$f")
        fi
      done
      run_files=("${filtered_files[@]}")
    fi
    echo "run_id: $run_id"
    if [[ "${#run_files[@]}" -gt 1 ]]; then
      local min_ts=0 max_ts=0 ts
      for f in "${run_files[@]}"; do
        ts="$(watch_logs_file_epoch "$f")"
        if [[ "$ts" =~ ^[0-9]+$ ]] && [[ "$ts" -gt 0 ]]; then
          if (( min_ts == 0 || ts < min_ts )); then min_ts="$ts"; fi
          if (( ts > max_ts )); then max_ts="$ts"; fi
        fi
      done
      if (( min_ts > 0 && max_ts > 0 && (max_ts - min_ts) > 600 )); then
        mapfile -t run_files < <(watch_logs_latest_per_domain)
        if [[ "${#run_files[@]}" -gt 0 ]]; then
          echo "mode: latest-per-domain (run-id window too wide)"
        fi
      fi
    fi
    if [[ "${#run_files[@]}" -le 1 ]]; then
      # Some workflows allocate run counters per-domain; show latest file for each
      # domain so diagnostics include host/adb/desktop/service in one snapshot.
      mapfile -t run_files < <(watch_logs_latest_per_domain)
      if [[ "${#run_files[@]}" -gt 0 ]]; then
        echo "mode: latest-per-domain (fallback)"
      fi
    fi
    if [[ "${#run_files[@]}" -gt 0 ]]; then
      local file domain
      for file in "${run_files[@]}"; do
        domain="$(watch_logs_domain_from_file "$file")"
        if [[ -z "$domain" ]]; then
          domain="unknown"
        fi
        echo
        echo "${domain} log:"
        echo "  file=$file"
        tail -n 12 "$file" 2>/dev/null || true
      done
    else
      echo "logs: $(watch_status_label missing)"
    fi
  else
    echo "run_id: $(watch_status_label missing)"
  fi
  echo

  echo "service journal:"
  if command -v journalctl >/dev/null 2>&1; then
    service_lines="$(journalctl --user -u "$DAEMON_NAME" -n 12 --no-pager 2>/dev/null || true)"
    if [[ -n "$service_lines" ]]; then
      printf '%s\n' "$service_lines"
    else
      echo "  $(watch_status_label unavailable)"
    fi
  else
    echo "  journalctl not available"
  fi
}

watch_streaming_once() {
  require_cmd adb
  local serial stream_port status_json metrics_json
  local state encoder target_fps recv_fps present_fps decode_fps bitrate reverse_ok
  local idx
  local -a serials

  mapfile -t serials < <(android_connected_serials)
  printf '%-18s %-6s %-10s %-6s %-6s %-7s %-7s %-7s %-8s %-7s\n' \
    "serial" "port" "state" "t_fps" "r_fps" "p_fps" "d_fps" "kbps" "encoder" "reverse"
  printf '%-18s %-6s %-10s %-6s %-6s %-7s %-7s %-7s %-8s %-7s\n' \
    "------" "----" "-----" "-----" "-----" "-----" "-----" "----" "-------" "-------"

  if [[ "${#serials[@]}" -eq 0 ]]; then
    echo "no adb devices in state=device"
    return 0
  fi

  idx=1
  for serial in "${serials[@]}"; do
    stream_port="$(watch_device_stream_port "$idx")"
    status_json="$(watch_session_status_json "$serial" "$stream_port")"
    metrics_json="$(watch_session_metrics_json "$serial" "$stream_port")"

    state="$(json_string_field "$status_json" "state")"
    encoder="$(json_string_field "$status_json" "encoder")"
    target_fps="$(json_scalar_field "$status_json" "fps")"
    recv_fps="$(json_scalar_field "$metrics_json" "recv_fps")"
    present_fps="$(json_scalar_field "$metrics_json" "present_fps")"
    decode_fps="$(json_scalar_field "$metrics_json" "decode_fps")"
    bitrate="$(json_scalar_field "$status_json" "bitrate_kbps")"
    reverse_ok="$(watch_adb_reverse_has_port "$serial" "$stream_port")"

    printf '%-18s %-6s %-10s %-6s %-6s %-7s %-7s %-7s %-8s %-7s\n' \
      "$serial" \
      "${stream_port}" \
      "$(watch_status_label "${state:-unknown}")" \
      "${target_fps:-?}" \
      "${recv_fps:-0}" \
      "${present_fps:-0}" \
      "${decode_fps:-0}" \
      "${bitrate:-?}" \
      "${encoder:-?}" \
      "$(watch_status_label "${reverse_ok:-no}")"
    idx=$((idx + 1))
  done
}

watch_health_once() {
  local code_health code_probe code_status
  code_health="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/health" || true)"
  code_probe="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/host-probe" || true)"
  code_status="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 1 "http://127.0.0.1:${CONTROL_PORT}/v1/status" || true)"
  printf 'endpoint /v1/health    http=%s\n' "$(watch_status_label "${code_health:-000}")"
  printf 'endpoint /v1/host-probe http=%s\n' "$(watch_status_label "${code_probe:-000}")"
  printf 'endpoint /v1/status    http=%s\n' "$(watch_status_label "${code_status:-000}")"
  echo
  watch_connections_once
}

watch_doctor_once() {
  local host_health="" host_build="" host_service="" file_build=""
  local serial api model apk_version expected reason
  local -a serials

  if host_health="$(host_health_raw)"; then
    host_build="$(json_string_field "$host_health" "build_revision")"
    host_service="$(json_string_field "$host_health" "service")"
    echo "host_health=reachable service=${host_service:-unknown} build_revision=${host_build:-unknown}"
  else
    echo "host_health=unreachable"
  fi

  file_build="$(build_version_read_file || true)"
  echo "build_file=${file_build:-<empty>}"
  if [[ -n "${WBEAM_BUILD_REV:-}" ]]; then
    echo "env_build_rev=${WBEAM_BUILD_REV}"
  else
    echo "env_build_rev=<unset>"
  fi

  if ! command -v adb >/dev/null 2>&1; then
    echo "adb=missing"
    return 0
  fi

  mapfile -t serials < <(android_connected_serials)
  if [[ "${#serials[@]}" -eq 0 ]]; then
    echo "adb_devices=none"
    return 0
  fi

  echo "adb_devices=${serials[*]}"
  for serial in "${serials[@]}"; do
    api="$(adb -s "$serial" shell getprop ro.build.version.sdk 2>/dev/null | tr -d '\r[:space:]' || true)"
    model="$(adb -s "$serial" shell getprop ro.product.model 2>/dev/null | tr -d '\r' || true)"
    apk_version="$(adb -s "$serial" shell dumpsys package "$ANDROID_PACKAGE" 2>/dev/null \
      | sed -n 's/^[[:space:]]*versionName=//p' | head -n 1 | tr -d '\r' || true)"
    expected="$host_build"
    if [[ -z "$expected" ]]; then
      expected="$file_build"
    fi
    if [[ -z "$apk_version" ]]; then
      reason="apk_not_installed"
    elif [[ -z "$expected" ]]; then
      reason="missing_expected_version"
    elif [[ "$apk_version" == "$expected" ]]; then
      reason="match"
    else
      reason="mismatch"
    fi
    printf '[%s] model=%s api=%s apk=%s expected=%s result=%s\n' \
      "$serial" "${model:-unknown}" "${api:-unknown}" "${apk_version:-<none>}" "${expected:-<none>}" "$reason"
  done
}

watch_collect_once() {
  local topic="$1"
  case "$topic" in
    devices)     watch_devices_once ;;
    connections) watch_connections_once ;;
    streaming)   watch_streaming_once ;;
    service)     watch_service_once ;;
    logs)        watch_logs_once ;;
    status)      watch_status_once ;;
    health)      watch_health_once ;;
    doctor)      watch_doctor_once ;;
    *)           echo "unknown watch topic: $topic"; return 1 ;;
  esac
}

watch_tui_topic_label() {
  case "$1" in
    devices) echo "1:devices" ;;
    connections) echo "2:connections" ;;
    streaming) echo "3:streaming" ;;
    service) echo "4:service" ;;
    logs) echo "5:logs" ;;
    *) echo "$1" ;;
  esac
}

watch_tui_loop() {
  local interval="${WBEAM_WATCH_INTERVAL:-1}"
  local topic="devices" key=""
  local footer

  while true; do
    clear || true
    watch_print_header "tui"
    echo "screen: $(watch_tui_topic_label "$topic")"
    echo
    watch_collect_once "$topic" || true
    echo
    footer="[1] devices  [2] connections  [3] streaming  [4] service  [5] logs   [r] refresh   [q] quit"
    printf '%s%s%s\n' "$(watch_style dim)" "$footer" "$(watch_style reset)"
    printf '%sactive=%s%s\n' "$(watch_style dim)" "$(watch_tui_topic_label "$topic")" "$(watch_style reset)"

    key=""
    IFS= read -rsn1 -t "$interval" key || true
    case "$key" in
      1) topic="devices" ;;
      2) topic="connections" ;;
      3) topic="streaming" ;;
      4) topic="service" ;;
      5) topic="logs" ;;
      q|Q) break ;;
      r|R) ;;
      *) ;;
    esac
  done
}

watch_run_loop() {
  local topic="$1"
  local mode="${2:-loop}"
  local interval="${WBEAM_WATCH_INTERVAL:-1}"
  local logfile=""
  local current_snapshot=""
  local last_snapshot=""
  local changed_count=0

  if [[ "$mode" == "once" ]]; then
    watch_print_header "$topic"
    watch_collect_once "$topic"
    return 0
  fi

  if [[ "${WBEAM_WATCH_LOG:-0}" == "1" ]]; then
    logfile="$(watch_log_file "$topic")"
    echo "[watch:$topic] logging enabled: $logfile"
  fi

  while true; do
    current_snapshot="$(watch_collect_once "$topic" 2>&1 || true)"
    if [[ "$current_snapshot" != "$last_snapshot" ]]; then
      changed_count=$((changed_count + 1))
      clear || true
      watch_print_header "$topic"
      printf '%schange detected%s (#%d)\n' "$(watch_style ok)" "$(watch_style reset)" "$changed_count"
      printf '%s\n' "$current_snapshot"
      if [[ -n "$logfile" ]]; then
        {
          watch_print_header "$topic"
          printf 'change detected (#%d)\n' "$changed_count"
          printf '%s\n' "$current_snapshot"
          echo
        } >>"$logfile"
      fi
      last_snapshot="$current_snapshot"
    else
      printf '\r%s[watch:%s]%s %s no changes' \
        "$(watch_style dim)" "$topic" "$(watch_style reset)" "$(date +%H:%M:%S)"
    fi
    sleep "$interval"
  done
}

deps_virtual_check() {
  "$ROOT_DIR/scripts/virtual-deps-check.sh" "$@"
}

deps_virtual_install() {
  "$ROOT_DIR/scripts/virtual-deps-install.sh" "$@"
}

group="${1:-}"
cmd="${2:-}"

if [[ -z "$group" ]]; then
  print_help
  exit 1
fi

case "$group" in
  ip)
    case "$cmd" in
      up)             ip_up ;;
      down)           ip_down ;;
      status)         ip_status ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  host)
    case "$cmd" in
      build)          host_build ;;
      run|start|up)   host_run ;;
      debug)          host_debug ;;
      status)         daemon_status ;;
      down|stop)      daemon_down ;;
      probe)          shift 2; host_probe "$@" ;;
      tuner|tune)     shift 2; host_tuner "$@" ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  daemon)
    case "$cmd" in
      up|start|run)   daemon_up ;;
      down|stop)      daemon_down ;;
      status)         daemon_status ;;
      debug)          host_debug ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  android)
    case "$cmd" in
      build)          android_build ;;
      install)        android_install ;;
      launch)         android_launch ;;
      deploy|run)     android_deploy ;;
      deploy-all|run-all) android_deploy_all ;;
      build-release|release-build)    android_build_release ;;
      install-release|release-install) android_install_release ;;
      deploy-release|release-deploy)   android_deploy_release ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  deps)
    case "$cmd" in
      virtual)
        case "${3:-}" in
          check) shift 3; deps_virtual_check "$@" ;;
          install) shift 3; deps_virtual_install "$@" ;;
          *) print_help; exit 1 ;;
        esac
        ;;
      *) print_help; exit 1 ;;
    esac
    ;;
  version)
    case "$cmd" in
      new)            version_new ;;
      current)        version_current ;;
      doctor|diag|diagnose) version_doctor ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  watch)
    case "$cmd" in
      tui)
        watch_tui_loop
        ;;
      devices|connections|streaming|service|logs|status|health|doctor)
        case "${3:-}" in
          --once|once) watch_run_loop "$cmd" "once" ;;
          *)           watch_run_loop "$cmd" "loop" ;;
        esac
        ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  debug)
    case "$cmd" in
      up|start)       debug_up ;;
      watch|logs)     debug_watch ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  logs)
    case "$cmd" in
      live)           logs_live ;;
      host)           logs_host ;;
      adb)            logs_adb "${3:-status}" ;;
      *)              print_help; exit 1 ;;
    esac
    ;;
  help|-h|--help)
    print_help
    ;;
  *)
    print_help
    exit 1
    ;;
esac