#!/usr/bin/env bash
# Remove everything the sandbox created. Findings are untouched: they live in
# the directory the caller named with OUT, not here.
#
#   ./teardown.sh                 # containers, networks, images, disposable copy
#   ./teardown.sh --deep          # also drop base images + prune build cache
#   ./teardown.sh --verify-only   # report residue, remove nothing
set -euo pipefail
cd "$(dirname "$0")"
PROJECT=member-console-audit
LABEL=com.member-console.audit=1

DEEP=0; VERIFY_ONLY=0
for a in "$@"; do case "$a" in
  --deep) DEEP=1 ;;
  --verify-only) VERIFY_ONLY=1 ;;
  *) echo "unknown flag: $a" >&2; exit 2 ;;
esac; done

report() {
  echo "== residue check (label $LABEL) =="
  echo "-- containers:"; docker ps -aq  --filter "label=$LABEL" | sed 's/^/   /' || true
  echo "-- networks:";   docker network ls -q --filter "label=$LABEL" | sed 's/^/   /' || true
  echo "-- images:";     docker images -q member-console-audit member-console-audit-proxy 2>/dev/null | sed 's/^/   /' || true
  echo "-- disposable copy (.code): $([[ -d .code ]] && echo PRESENT || echo gone)"
  echo "Note: containers ran with --rm, so no opencode session/snapshot data"
  echo "persisted. The host opencode config and your real repo were never mounted"
  echo "writable; auth.json was mounted read-only."
}

if [[ $VERIFY_ONLY -eq 1 ]]; then report; exit 0; fi

echo "==> Stopping stack, removing containers + networks + named volumes"
docker compose down -v --remove-orphans || true

echo "==> Removing built images"
docker image rm -f member-console-audit:latest member-console-audit-proxy:latest 2>/dev/null || true

echo "==> Removing the disposable working copy (.code) and run state"
rm -rf .code .run

if [[ $DEEP -eq 1 ]]; then
  echo "==> Deep clean: base images + build cache"
  docker image rm -f golang:1.25-alpine alpine:3.20 2>/dev/null || true
  docker builder prune -f >/dev/null || true
fi

echo
report
echo
echo "Done. Nothing else from this runner runs in the background."