#!/data/data/com.termux/files/usr/bin/bash
# SN512A authorized Android connectivity and diagnostics — no root or MDM changes.
set -eo pipefail
umask 077
ROOT="$HOME/.local/share/sn512a"
mkdir -p "$ROOT/reports"
DNS="uazda8rfs6.cloudflare-gateway.com"
say(){ printf '%s\n' "$*"; }
settings_open(){
  if ! am start -a "$1" >/dev/null 2>&1; then say "Open Android Settings manually: $2"; fi
}
network(){
  if command -v curl >/dev/null 2>&1 && curl --fail --silent --show-error --max-time 10 -o /dev/null https://www.cloudflare.com/cdn-cgi/trace; then
    say "HTTPS network: available"
  else
    say "HTTPS unavailable. Join Wi-Fi or cellular; use Wi-Fi proxy None and Private DNS Automatic."
    return 1
  fi
}
profile(){
  case "$1" in
    list|"") say 'Profiles: wifi mobile bluetooth usb dns vpn';;
    wifi) settings_open android.settings.WIFI_SETTINGS Wi-Fi;;
    mobile) settings_open android.settings.DATA_ROAMING_SETTINGS 'Mobile network / SIM / APN';;
    bluetooth) settings_open android.settings.BLUETOOTH_SETTINGS Bluetooth;;
    usb) settings_open android.settings.DEVELOPMENT_SETTINGS 'USB preferences';;
    dns) settings_open android.settings.PRIVATE_DNS_SETTINGS 'Private DNS';;
    vpn) settings_open android.settings.VPN_SETTINGS VPN;;
    *) say "Unknown profile"; return 2;;
  esac
}
audit(){
  f="$ROOT/reports/audit-$(date -u +%Y%m%dT%H%M%SZ).txt"
  {
    say "SN512A authorized read-only audit"; date -u
    for k in ro.product.model ro.product.device ro.build.version.release ro.build.fingerprint ro.boot.verifiedbootstate;do
      printf '%s=' "$k";getprop "$k" 2>/dev/null || true
    done
    say "PRIVATE DNS"
    settings get global private_dns_mode 2>&1 || true
    settings get global private_dns_specifier 2>&1 || true
    say "DISABLED PACKAGES (may be permission restricted)"
    cmd package list packages -d 2>&1 || true
    say "DEVICE POLICY OWNERS (may be permission restricted)"
    cmd device_policy list-owners 2>&1 || true
  } >"$f"
  say "Audit saved locally: $f"; say "Nothing uploaded automatically."
}
case "$1" in
  ""|help|--help) cat <<'HELP'
SN512A device owner-approved setup:
  snctl onboard                     Connection recovery sequence
  snctl profile wifi|mobile|bluetooth|usb|dns|vpn|list
  snctl network                     HTTPS test
  snctl dns                         Private DNS hostname
  snctl vpn                         VPN installation and consent
  snctl shizuku                     Wireless debugging + Shizuku pairing
  snctl adb                         Wireless ADB pairing guide
  snctl setup                       Install Termux tools with consent
  snctl linux install debian|alpine
  snctl linux login debian|alpine
  snctl audit                       Local read-only inventory
  snctl status                      Installed tool status
  snctl hash FILE                   SHA-256 of an offline image/APK
HELP
  ;;
  onboard) say "1. Join Wi-Fi/cellular; Private DNS Automatic; proxy None.";profile wifi; say "2. When online, enter Private DNS hostname: $DNS";say "3. Install and sign in to VPN, then run snctl setup, snctl shizuku and snctl audit.";;
  network) network;;
  profile) profile "$2";;
  dns) say "Android DoT: $DNS";say "DoH: https://uazda8rfs6.cloudflare-gateway.com/dns-query";say 'Private DNS never authorizes ADB or releases AT&T management.';;
  vpn) say 'Install authorized VPN app (Tailscale official: https://pkgs.tailscale.com/stable/)';say 'Sign in and approve the Android VPN request. A DNS entry alone is not a VPN.'; profile vpn;;
  shizuku) say 'Official Shizuku releases: https://github.com/RikkaApps/Shizuku/releases';say 'Settings -> Developer options -> Wireless debugging -> Pair with pairing code. Start Shizuku and authorize your client.';;
  adb) say 'Enable Wireless debugging on the phone; read pairing code + IP:PAIR_PORT.';say 'From trusted Termux with android-tools: adb pair IP:PAIR_PORT';say 'Then adb connect IP:ADB_PORT (different port). Never expose ADB publicly.';;
  setup) network || exit 1;command -v pkg >/dev/null || { say 'Requires Termux.';exit 1; };pkg update && pkg install -y curl openssh python git proot-distro android-tools; say 'To install Linux: snctl linux install debian';;
  linux) if ! command -v proot-distro >/dev/null 2>&1;then say 'Run snctl setup first';exit 1;fi
    case "$2:$3" in
      install:debian|install:alpine) network && proot-distro install "$3";;
      login:debian|login:alpine) proot-distro login "$3";;
      *) say 'Use snctl linux install|login debian|alpine';exit 2;;
    esac;;
  audit|demo) audit;;
  status) say "Model: $(getprop ro.product.model 2>/dev/null)";say "Android: $(getprop ro.build.version.release 2>/dev/null)";say "DNS: $DNS";for c in curl adb proot-distro rish;do if command -v "$c" >/dev/null 2>&1;then say "$c installed";else say "$c unavailable";fi;done;;
  hash) if test -f "$2";then sha256sum "$2";else say 'Usage: snctl hash FILE';exit 2;fi;;
  *) say 'Unknown command: snctl help';exit 2;;
esac