#!/usr/bin/env bash
# Silicon Passport read-only seller preflight v1. No uploads or host changes.
set -u
if [ "$#" -ne 0 ]; then
  printf 'No arguments accepted. Do not supply tokens or private keys.\n' >&2
  exit 2
fi
printf 'SILICON PASSPORT — READ-ONLY TERMINAL PREFLIGHT v1\n'
printf 'Local output only. No benchmarks, signing, payment or certificate issuance.\n\n'
printf 'Shows model, full driver serial, driver version, memory (MiB), PCI bus ID,\n'
printf 'GPU temperature (C), PCIe generation/width and available ECC error count.\n'
printf 'These details are not uploaded or saved by this script. Terminal history/logs\n'
printf 'may retain output; redact serial and bus ID before sharing screenshots.\n\n'
if [ "$(uname -s)" != 'Linux' ]; then
  printf '[BLOCKED] This preflight supports Linux hosts only.\n'
  exit 2
fi
if ! command -v timeout >/dev/null 2>&1; then
  printf '[BLOCKED] timeout is required to bound driver queries.\n'
  exit 2
fi
if ! command -v nvidia-smi >/dev/null 2>&1; then
  printf '[BLOCKED] nvidia-smi unavailable. Check NVIDIA driver installation and container GPU access.\n'
  printf 'AMD/MI300X and non-NVIDIA devices are not supported. No payment is needed for this check.\n'
  exit 2
fi
blocked=0
printf 'Agent prerequisites\n'
if command -v node >/dev/null 2>&1; then
  version=$(timeout 10s node --version 2>/dev/null) || version='unknown'
  major=${version#v}; major=${major%%.*}
  if [[ "$major" =~ ^[0-9]+$ ]] && [ "$major" -ge 20 ]; then
    printf '[AVAILABLE] Node.js %s\n' "$version"
  else
    printf '[BLOCKED] Node.js 20+ required.\n'; blocked=1
  fi
else
  printf '[BLOCKED] Node.js 20+ unavailable.\n'; blocked=1
fi
if command -v nvbandwidth >/dev/null 2>&1; then
  printf '[AVAILABLE] nvbandwidth executable (not run).\n'
else
  printf '[BLOCKED] nvbandwidth unavailable; no bandwidth test performed.\n'; blocked=1
fi
indices=$(timeout 10s nvidia-smi --query-gpu=index --format=csv,noheader,nounits 2>/dev/null) || indices=''
if [ -z "$indices" ]; then
  printf '[BLOCKED] GPU enumeration failed or timed out.\n'
  printf 'Recovery: run nvidia-smi directly to inspect driver access. On a container,\n'
  printf 'ask your host administrator to confirm GPU passthrough. No settings changed.\n'
  exit 2
fi
count=0
while IFS= read -r index; do
  index=${index//[[:space:]]/}
  if ! [[ "$index" =~ ^[0-9]+$ ]]; then
    printf '[BLOCKED] Invalid GPU index from driver.\n'; blocked=1; continue
  fi
  count=$((count + 1))
  if [ "$count" -gt 32 ]; then
    printf '[BLOCKED] Enumeration exceeds the 32-device preflight bound.\n'; blocked=1; break
  fi
  printf '\nGPU %s — driver-reported, not independently authenticated\n' "$index"
  for field in name serial driver_version memory.total pci.bus_id temperature.gpu pcie.link.gen.current pcie.link.width.current ecc.errors.uncorrected.aggregate.total; do
    value=$(timeout 10s nvidia-smi "--id=$index" "--query-gpu=$field" --format=csv,noheader,nounits 2>/dev/null) || value=''
    value=${value//$'\r'/}; value=${value//$'\n'/ }
    lower=${value,,}
    if [ -z "$value" ] || [[ "$lower" == *'n/a'* || "$lower" == *'not supported'* || "$lower" == *'unknown'* ]]; then
      printf '  %s: UNVERIFIED / unavailable\n' "$field"
      case "$field" in name|serial|driver_version|memory.total|pci.bus_id) blocked=1 ;; esac
    else
      # Remove terminal control bytes; never interpret driver text as commands.
      value=$(printf '%s' "$value" | LC_ALL=C tr -cd '\11\40-\176' | cut -c1-160)
      printf '  %s: %s\n' "$field" "$value"
      if [ "$field" = name ]; then
        case "$value" in
          *'RTX 4090'*|*'RTX 4080'*|*'RTX 6000 Ada'*|*'L40S'*|*'A100'*|*'H100'*) ;;
          *) printf '  [BLOCKED] Supported: RTX 4090/4080, RTX 6000 Ada, L40S, A100, H100.\n'
             printf '  Other models (including RTX 5090, H200, B200 and MI300X) are not enabled. Do not purchase for this host yet.\n'; blocked=1 ;;
        esac
      fi
    fi
  done
done <<< "$indices"
printf '\nNOT VERIFIED: SPDM vendor-root attestation, VBIOS image/hash, PCIe AER deltas,\n'
printf 'HBM row-remap audit, NVLink topology, stress/thermal balance and benchmark bandwidth.\n'
printf 'Still required for certification: VBIOS dump, measured ambient temperature,\n'
printf 'operator-enrolled signer and paid authorization. Never paste private keys into this check.\n'
printf 'This check does not prove authenticity, ownership, health or certification eligibility.\n'
printf 'No diagnostic upload is required. Review /check, then /verify on the site\n'
printf 'where you downloaded this script; enter model/serial manually only when ready.\n'
if [ "$blocked" -ne 0 ]; then
  printf '\nRESULT: BLOCKED — resolve unavailable prerequisites before purchase.\n'
  printf 'Recovery: inspect nvidia-smi on the host, confirm the GPU is supported,\n'
  printf 'and ask your administrator about missing driver serial or device access.\n'
  printf 'Unavailable optional ECC is not zero errors. Retry after prerequisites\n'
  printf 'are available; this script never installs drivers or changes GPU settings.\n'
  exit 2
fi
printf '\nRESULT: BASIC PREREQUISITES FOUND — full verification readiness remains unconfirmed.\n'