agent-manager.sh

#!/usr/bin/env bash
# =============================================================================
# agent-manager — Manage your agent server from your LOCAL machine
# =============================================================================
# Usage:
#   ./agent-manager.sh                 Show server status (default)
#   ./agent-manager.sh --wakeup        Start a stopped instance, wait for SSH
#   ./agent-manager.sh --sleep         Stop a running instance
#   ./agent-manager.sh --always-on     Switch to always-on mode (remove scheduler)
#   ./agent-manager.sh --scheduled [N] [H] [WH]  Switch to scheduled mode (every N min, hours H, weekend WH)
#   ./agent-manager.sh --run-agent     Trigger an agent run (fire and forget)
#   ./agent-manager.sh --history [N]   Show wake/sleep/run timeline (last N days, default 7)
#   ./agent-manager.sh --log [N]       Show Nth most recent orchestrator log (default: latest)
#   ./agent-manager.sh --trigger       Show remote trigger URL and token
#   ./agent-manager.sh --ssh           SSH into the server
#   ./agent-manager.sh --ssh-mcp       SSH with MCP port forwarding (for auth)
#   ./agent-manager.sh --help          Show this help
#
# Reads deploy-state.json (created by deploy.sh) for instance details.
# =============================================================================

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
STATE_FILE="${SCRIPT_DIR}/deploy-state.json"

# --- Colors ------------------------------------------------------------------
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
CYAN='\033[0;36m'
BOLD='\033[1m'
DIM='\033[2m'
NC='\033[0m'

log()  { echo -e "${GREEN}[AGENT]${NC} $1"; }
warn() { echo -e "${YELLOW}[NOTE]${NC} $1"; }
err()  { echo -e "${RED}[ERROR]${NC} $1"; }

# --- Pre-flight: required tools ---------------------------------------------
check_tools() {
  local missing=()
  command -v aws &>/dev/null    || missing+=("aws (AWS CLI — https://aws.amazon.com/cli/)")
  command -v python3 &>/dev/null || missing+=("python3")
  command -v ssh &>/dev/null     || missing+=("ssh")
  command -v scp &>/dev/null     || missing+=("scp")
  if [[ ${#missing[@]} -gt 0 ]]; then
    err "Missing required tools:"
    for tool in "${missing[@]}"; do
      echo -e "  ${RED}✗${NC} ${tool}"
    done
    echo ""
    echo "Install the missing tools and try again."
    exit 1
  fi
}
check_tools

# --- Load configuration -----------------------------------------------------
# Source agent.conf so SCHEDULE_* variables are available to all commands.
if [[ -f "${SCRIPT_DIR}/agent.conf" ]]; then
  source "${SCRIPT_DIR}/agent.conf"
fi

# --- Load state --------------------------------------------------------------
load_state() {
  if [[ ! -f "${STATE_FILE}" ]]; then
    err "deploy-state.json not found. Run deploy.sh first."
    exit 1
  fi
  INSTANCE_ID=$(python3 -c "import json; print(json.load(open('${STATE_FILE}'))['instance_id'])")
  REGION=$(python3 -c "import json; print(json.load(open('${STATE_FILE}'))['region'])")
  SSH_HOST=$(python3 -c "import json; print(json.load(open('${STATE_FILE}'))['ssh_config_host'])")
  ELASTIC_IP=$(python3 -c "import json; print(json.load(open('${STATE_FILE}'))['elastic_ip'])")
  OWNER=$(python3 -c "import json; print(json.load(open('${STATE_FILE}'))['owner'])")
}

# --- JSON helpers for deploy-state.json --------------------------------------
json_get() {
  python3 -c "import json,sys; d=json.load(open(sys.argv[1])); print(d.get(sys.argv[2],''))" \
    "${STATE_FILE}" "$1"
}

# --- Get instance state ------------------------------------------------------
get_instance_state() {
  aws ec2 describe-instances \
    --instance-ids "${INSTANCE_ID}" \
    --region "${REGION}" \
    --query 'Reservations[0].Instances[0].State.Name' \
    --output text 2>/dev/null || echo "unknown"
}

# --- Check if SSH failure is caused by an IP change --------------------------
# Residential ISPs assign dynamic IPs via DHCP.  Router reboots, power outages,
# or lease expiry can change the public IP, breaking the security group rule
# that was created at deploy time.  This helper detects the mismatch and
# updates the rule automatically.
check_and_fix_ssh_ip() {
  local sg_id
  sg_id=$(json_get security_group_id)
  if [[ -z "${sg_id}" ]]; then
    return 1  # no SG info — can't help
  fi

  local my_ip
  my_ip=$(curl -s --max-time 5 https://checkip.amazonaws.com)
  if [[ -z "${my_ip}" ]]; then
    return 1  # can't determine current IP
  fi

  # Get the current SSH rule's CIDR
  local allowed_ip
  allowed_ip=$(aws ec2 describe-security-groups \
    --group-ids "${sg_id}" --region "${REGION}" \
    --query 'SecurityGroups[0].IpPermissions[?FromPort==`22` && ToPort==`22`].IpRanges[0].CidrIp' \
    --output text 2>/dev/null || echo "")

  if [[ -z "${allowed_ip}" || "${allowed_ip}" == "None" ]]; then
    return 1  # no SSH rule found
  fi

  local allowed_bare="${allowed_ip%/32}"
  if [[ "${allowed_bare}" == "${my_ip}" ]]; then
    return 1  # IPs match — SSH failure is something else
  fi

  warn "Your IP has changed: ${allowed_bare} → ${my_ip}"
  warn "Updating security group ${sg_id}..."

  # Revoke old rule, add new one
  aws ec2 revoke-security-group-ingress \
    --group-id "${sg_id}" --region "${REGION}" \
    --protocol tcp --port 22 --cidr "${allowed_ip}" >/dev/null 2>&1 || true
  aws ec2 authorize-security-group-ingress \
    --group-id "${sg_id}" --region "${REGION}" \
    --protocol tcp --port 22 \
    --cidr "${my_ip}/32" >/dev/null 2>&1 || {
      err "Failed to update security group SSH rule."
      return 1
    }
  log "SSH rule updated to ${my_ip}/32."
  return 0
}

# --- Commands ----------------------------------------------------------------

cmd_status() {
  local state
  state=$(get_instance_state)

  echo ""
  echo -e "${BOLD}  Agent Server — ${OWNER}${NC}"
  echo "  ─────────────────────────────────"
  echo -e "  Instance:   ${INSTANCE_ID}"
  echo -e "  Region:     ${REGION}"
  echo -e "  Elastic IP: ${ELASTIC_IP}"

  # Instance state with color
  case "${state}" in
    running)  echo -e "  State:      ${GREEN}running${NC}" ;;
    stopped)  echo -e "  State:      ${DIM}stopped${NC}" ;;
    stopping) echo -e "  State:      ${YELLOW}stopping${NC}" ;;
    pending)  echo -e "  State:      ${YELLOW}starting${NC}" ;;
    *)        echo -e "  State:      ${RED}${state}${NC}" ;;
  esac

  # Schedule info (agent.conf sourced at top level)
  local mode="${SCHEDULE_MODE:-unknown}"
  if [[ "$mode" == "scheduled" ]]; then
    local mode_detail="every ${SCHEDULE_INTERVAL:-60} min, hours ${SCHEDULE_HOURS:-6-22}"
    if [[ -n "${SCHEDULE_WEEKEND_HOURS:-}" ]]; then
      mode_detail+=", weekends ${SCHEDULE_WEEKEND_HOURS}"
    fi
    echo -e "  Mode:       ${CYAN}scheduled${NC} (${mode_detail})"
  else
    echo -e "  Mode:       ${CYAN}${mode}${NC}"
  fi

  # Fetch AWS cost estimates in background while SSH runs
  local cost_file cost_tmp_dir
  cost_file=$(mktemp)
  cost_tmp_dir=$(mktemp -d)
  (
    end_date=$(date -u +%Y-%m-%d)
    mtd_start=$(date -u +%Y-%m-01)  # 1st of current month
    # Cost Explorer: month-to-date by service (for actual + compute $/hour)
    aws ce get-cost-and-usage \
      --time-period "Start=${mtd_start},End=${end_date}" \
      --granularity MONTHLY \
      --metrics UnblendedCost \
      --filter "{\"Dimensions\":{\"Key\":\"REGION\",\"Values\":[\"${REGION}\"]}}" \
      --group-by Type=DIMENSION,Key=SERVICE \
      --region us-east-1 \
      --output json > "${cost_tmp_dir}/ce.json" 2>/dev/null || true
    # CloudWatch: count hours the instance was running this month (each datapoint = 1 hour)
    aws cloudwatch get-metric-statistics \
      --namespace AWS/EC2 \
      --metric-name CPUUtilization \
      --dimensions "Name=InstanceId,Value=${INSTANCE_ID}" \
      --start-time "${mtd_start}T00:00:00Z" \
      --end-time "${end_date}T00:00:00Z" \
      --period 3600 \
      --statistics Average \
      --region "${REGION}" \
      --output json > "${cost_tmp_dir}/cw.json" 2>/dev/null || true
    # Get average run duration from orchestrator logs on server
    ssh -o ConnectTimeout=5 "${SSH_HOST}" "
      for f in ~/logs/orchestrator-*.log; do
        s=\$(head -1 \"\$f\" | sed 's/.*started at //' | sed 's/ ===//')
        e=\$(stat -c %Y \"\$f\" 2>/dev/null)
        s_epoch=\$(date -d \"\$s\" +%s 2>/dev/null)
        if [ -n \"\$s_epoch\" ] && [ -n \"\$e\" ]; then
          echo \$(( e - s_epoch ))
        fi
      done" > "${cost_tmp_dir}/run_secs.txt" 2>/dev/null || true
    if [[ -s "${cost_tmp_dir}/ce.json" ]]; then
      python3 - "${SCHEDULE_HOURS:-6-22}" "${SCHEDULE_INTERVAL:-60}" "${SCHEDULE_WEEKEND_HOURS:-}" \
        "${cost_tmp_dir}/ce.json" "${cost_tmp_dir}/cw.json" "${cost_tmp_dir}/run_secs.txt" \
        > "${cost_file}" 2>/dev/null << 'PYEOF'
import json, sys, os
from datetime import date

schedule_hours = sys.argv[1]
schedule_interval = int(sys.argv[2])
weekend_hours = sys.argv[3]

with open(sys.argv[4]) as f:
    cost_data = json.load(f)
cw_data = {}
if os.path.getsize(sys.argv[5]) > 0:
    with open(sys.argv[5]) as f:
        cw_data = json.load(f)

# Average run duration from orchestrator logs (seconds per wake)
run_secs = []
if os.path.exists(sys.argv[6]):
    with open(sys.argv[6]) as f:
        for line in f:
            s = line.strip()
            if s.isdigit() and 0 < int(s) < 18000:  # sanity: < 5h
                run_secs.append(int(s))
# Add ~2 min boot overhead per wake; use actual avg or fallback to 5 min total
if run_secs:
    avg_wake_min = (sum(run_secs) / len(run_secs)) / 60 + 2  # run + boot overhead
else:
    avg_wake_min = 5  # fallback

# --- Month-to-date actual cost ---
compute_total = 0.0
fixed_total = 0.0
for r in cost_data.get("ResultsByTime", []):
    for g in r.get("Groups", []):
        svc = g["Keys"][0]
        amt = float(g["Metrics"]["UnblendedCost"]["Amount"])
        if "Compute" in svc:
            compute_total += amt
        else:
            fixed_total += amt

mtd_total = compute_total + fixed_total
if mtd_total < 0.001:
    sys.exit(0)

today = date.today()
day_of_month = today.day
import calendar
days_in_month = calendar.monthrange(today.year, today.month)[1]

# --- Schedule projection ---
# Derive compute $/hour from actual spend and CloudWatch uptime hours
running_hours = len(cw_data.get("Datapoints", []))
if running_hours > 0 and compute_total > 0:
    compute_per_hour = compute_total / running_hours
    fixed_daily = fixed_total / day_of_month

    # Calculate scheduled run-hours per week using actual wake duration
    h_start, h_end = (int(x) for x in schedule_hours.split("-"))
    weekday_active = h_end - h_start + 1

    if schedule_interval < 60:
        wakes_per_day = weekday_active * (60 / schedule_interval)
    else:
        wakes_per_day = weekday_active / (schedule_interval / 60)
    weekday_run_hours = wakes_per_day * (avg_wake_min / 60)

    if weekend_hours:
        weekend_wakes = len(weekend_hours.split(","))
        weekend_run_hours = weekend_wakes * (avg_wake_min / 60)
    else:
        weekend_run_hours = weekday_run_hours

    weekly_run_hours = (weekday_run_hours * 5) + (weekend_run_hours * 2)
    monthly_run_hours = weekly_run_hours * (30 / 7)
    projected_monthly = (compute_per_hour * monthly_run_hours) + (fixed_daily * days_in_month)

    print(f"${mtd_total:.1f} MTD (day {day_of_month}/{days_in_month}) \u00b7 ${projected_monthly:.0f}/mo projected (~{avg_wake_min:.0f} min/run)")
else:
    print(f"${mtd_total:.1f} MTD (day {day_of_month}/{days_in_month})")
PYEOF
    fi
    rm -rf "${cost_tmp_dir}"
  ) &
  local cost_pid=$!

  # If running, try to get on-server status
  if [[ "${state}" == "running" ]]; then
    check_and_fix_ssh_ip || true
    echo ""
    local remote_status
    remote_status=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" "agent status" 2>/dev/null) || true
    if [[ -n "${remote_status}" ]]; then
      echo "${remote_status}"
    else
      echo -e "  ${DIM}(could not reach server via SSH)${NC}"
    fi
  fi

  # Show cost estimate (wait up to 5s for background query)
  wait "${cost_pid}" 2>/dev/null || true
  local cost_estimate
  cost_estimate=$(cat "${cost_file}" 2>/dev/null)
  rm -f "${cost_file}"
  if [[ -n "${cost_estimate}" ]]; then
    echo ""
    echo -e "  Est. cost:  ${CYAN}${cost_estimate}${NC}"
  fi

  echo ""
  echo -e "  ${DIM}Commands: --wakeup, --sleep, --run-agent, --trigger, --log, --history, --scheduled, --ssh${NC}"
  echo ""
}

cmd_wakeup() {
  local state
  state=$(get_instance_state)

  if [[ "${state}" == "running" ]]; then
    log "Instance is already running."
    log "SSH: ssh ${SSH_HOST}"
    return 0
  elif [[ "${state}" == "pending" ]]; then
    log "Instance is already starting up..."
  elif [[ "${state}" == "stopping" ]]; then
    warn "Instance is still stopping. Waiting for it to fully stop..."
    aws ec2 wait instance-stopped --instance-ids "${INSTANCE_ID}" --region "${REGION}"
    log "Instance stopped. Starting it now..."
    aws ec2 start-instances --instance-ids "${INSTANCE_ID}" --region "${REGION}" >/dev/null
  elif [[ "${state}" == "stopped" ]]; then
    log "Starting instance ${INSTANCE_ID}..."
    aws ec2 start-instances --instance-ids "${INSTANCE_ID}" --region "${REGION}" >/dev/null
  else
    err "Instance is in unexpected state: ${state}"
    return 1
  fi

  log "Waiting for instance to be running..."
  aws ec2 wait instance-running --instance-ids "${INSTANCE_ID}" --region "${REGION}"
  log "Instance is running."

  log "Waiting for SSH..."
  local ssh_ok=false
  for i in $(seq 1 30); do
    if ssh -o ConnectTimeout=5 "${SSH_HOST}" "echo ready" 2>/dev/null; then
      ssh_ok=true
      break
    fi
    # After 30s of failures, check if IP changed before waiting the full 150s
    if [[ $i -eq 6 ]]; then
      if check_and_fix_ssh_ip; then
        # IP was updated — retry SSH immediately
        for j in $(seq 1 24); do
          if ssh -o ConnectTimeout=5 "${SSH_HOST}" "echo ready" 2>/dev/null; then
            ssh_ok=true
            break 2
          fi
          sleep 5
        done
      fi
    fi
    sleep 5
  done
  if [[ "${ssh_ok}" != "true" ]]; then
    warn "SSH not available after 150 seconds. Try manually: ssh ${SSH_HOST}"
    return 1
  fi

  # In scheduled mode, immediately create keep-running lock to prevent the
  # orchestrator's active-hours guard from hibernating before we can act.
  if [[ "${SCHEDULE_MODE:-always-on}" == "scheduled" ]]; then
    ssh -o ConnectTimeout=5 "${SSH_HOST}" 'mkdir -p ~/agents && touch ~/agents/.keep-running' 2>/dev/null || true
    log "Keep-running lock set (prevents auto-hibernate)."
  fi

  echo ""
  log "Server is ready."
  log "SSH: ssh ${SSH_HOST}"
  if [[ "${SCHEDULE_MODE:-always-on}" == "scheduled" ]]; then
    echo ""
    warn "Keep-running lock is active. Server will NOT self-stop."
    warn "To release: ssh ${SSH_HOST} 'rm ~/agents/.keep-running'"
  fi
  echo ""
}

cmd_sleep() {
  local state
  state=$(get_instance_state)

  if [[ "${state}" == "stopped" ]]; then
    log "Instance is already stopped."
    return 0
  elif [[ "${state}" == "stopping" ]]; then
    log "Instance is already stopping..."
    return 0
  elif [[ "${state}" != "running" ]]; then
    err "Instance is in state '${state}' — can only stop a running instance."
    return 1
  fi

  # Proactive IP check before SSH
  check_and_fix_ssh_ip || true

  # In scheduled mode, check if orchestrator is running — it will self-stop when done.
  if [[ "${SCHEDULE_MODE:-always-on}" == "scheduled" ]]; then
    local lock_held
    lock_held=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" \
      "flock -n ~/.agent-orchestrator.lock true 2>/dev/null && echo free || echo held" 2>/dev/null || echo "unknown")
    if [[ "${lock_held}" == "held" ]]; then
      # Remove keep-running so it self-stops after the run
      ssh -o ConnectTimeout=5 "${SSH_HOST}" 'rm -f ~/agents/.keep-running' 2>/dev/null || true
      log "Orchestrator is running. It will self-stop when done."
      echo -e "  Monitor: ${CYAN}ssh ${SSH_HOST} 'tail -f ~/logs/orchestrator-*.log'${NC}"
      return 0
    fi
  fi

  # Remove keep-running lock before stopping
  ssh -o ConnectTimeout=5 "${SSH_HOST}" 'rm -f ~/agents/.keep-running' 2>/dev/null || true

  log "Hibernating instance ${INSTANCE_ID}..."
  aws ec2 stop-instances --instance-ids "${INSTANCE_ID}" --region "${REGION}" --hibernate >/dev/null 2>&1 || {
    warn "Hibernate not available, falling back to stop..."
    aws ec2 stop-instances --instance-ids "${INSTANCE_ID}" --region "${REGION}" >/dev/null
  }
  log "Hibernate/stop command sent. Instance will freeze shortly."
}

cmd_ssh() {
  local state
  state=$(get_instance_state)

  if [[ "${state}" != "running" ]]; then
    err "Instance is ${state}. Use --wakeup first."
    return 1
  fi

  # Proactive IP check — update security group if our IP changed
  check_and_fix_ssh_ip || true

  exec ssh "${SSH_HOST}"
}

cmd_always_on() {
  local state
  state=$(get_instance_state)

  # Switch mode on the server
  if [[ "${state}" == "running" ]]; then
    log "Setting server to always-on mode..."
    ssh -o ConnectTimeout=5 "${SSH_HOST}" "sudo ~/scripts/set-schedule-mode.sh always-on" 2>/dev/null || true
  else
    warn "Instance is ${state}. Mode will be set on next boot."
  fi

  # Remove EventBridge scheduler
  log "Removing EventBridge scheduler..."
  if [[ -f "${SCRIPT_DIR}/deploy-scheduler.sh" ]]; then
    bash "${SCRIPT_DIR}/deploy-scheduler.sh" --remove "${REGION}"
  else
    warn "deploy-scheduler.sh not found. Remove scheduler manually."
  fi

  # Update local agent.conf
  if [[ -f "${SCRIPT_DIR}/agent.conf" ]]; then
    sed -i.bak 's/^SCHEDULE_MODE=.*/SCHEDULE_MODE="always-on"/' "${SCRIPT_DIR}/agent.conf"
    rm -f "${SCRIPT_DIR}/agent.conf.bak"
    log "Updated agent.conf: SCHEDULE_MODE=\"always-on\""
  fi

  # Ensure instance is running
  if [[ "${state}" == "stopped" ]]; then
    log "Starting instance (always-on means it should be running)..."
    cmd_wakeup
  fi

  echo ""
  log "Mode switched to always-on. Instance will run 24/7."
}

cmd_scheduled() {
  local interval="${1:-60}"
  local hours="${2:-${SCHEDULE_HOURS:-6-22}}"
  local weekend_hours="${3:-${SCHEDULE_WEEKEND_HOURS:-}}"
  local state
  state=$(get_instance_state)

  # Switch mode on the server (pass interval, hours, and weekend hours)
  if [[ "${state}" == "running" ]]; then
    log "Setting server to scheduled mode..."
    ssh -o ConnectTimeout=5 "${SSH_HOST}" "sudo ~/scripts/set-schedule-mode.sh scheduled ${interval} ${hours} ${weekend_hours}" 2>/dev/null || true
  else
    warn "Instance is ${state}. Mode will be set on next boot."
  fi

  # Deploy EventBridge scheduler (with hours and weekend hours)
  log "Deploying EventBridge scheduler..."
  if [[ -f "${SCRIPT_DIR}/deploy-scheduler.sh" ]]; then
    bash "${SCRIPT_DIR}/deploy-scheduler.sh" "${INSTANCE_ID}" "${interval}" "${REGION}" "${hours}" "${weekend_hours}"
  else
    err "deploy-scheduler.sh not found."
    return 1
  fi

  # Update local agent.conf
  if [[ -f "${SCRIPT_DIR}/agent.conf" ]]; then
    sed -i.bak 's/^SCHEDULE_MODE=.*/SCHEDULE_MODE="scheduled"/' "${SCRIPT_DIR}/agent.conf"
    sed -i.bak "s/^SCHEDULE_INTERVAL=.*/SCHEDULE_INTERVAL=${interval}/" "${SCRIPT_DIR}/agent.conf"
    if grep -q '^SCHEDULE_HOURS=' "${SCRIPT_DIR}/agent.conf"; then
      sed -i.bak "s/^SCHEDULE_HOURS=.*/SCHEDULE_HOURS=\"${hours}\"/" "${SCRIPT_DIR}/agent.conf"
    fi
    if [[ -n "${weekend_hours}" ]]; then
      if grep -q '^SCHEDULE_WEEKEND_HOURS=' "${SCRIPT_DIR}/agent.conf"; then
        sed -i.bak "s/^SCHEDULE_WEEKEND_HOURS=.*/SCHEDULE_WEEKEND_HOURS=\"${weekend_hours}\"/" "${SCRIPT_DIR}/agent.conf"
      else
        echo "SCHEDULE_WEEKEND_HOURS=\"${weekend_hours}\"" >> "${SCRIPT_DIR}/agent.conf"
      fi
    fi
    rm -f "${SCRIPT_DIR}/agent.conf.bak"
    log "Updated agent.conf"
  fi

  echo ""
  log "Mode switched to scheduled."
  echo ""
  echo -e "  ${BOLD}Both systems updated:${NC}"
  if [[ -n "${weekend_hours}" ]]; then
    echo -e "  ${CYAN}EventBridge (weekdays):${NC} wakes instance every ${interval} min during hours ${hours}"
    echo -e "  ${CYAN}EventBridge (weekends):${NC} wakes instance at hours ${weekend_hours}"
    echo -e "  ${CYAN}Server cron:${NC} weekdays every ${interval} min (${hours}), weekends at ${weekend_hours}"
  else
    echo -e "  ${CYAN}EventBridge:${NC} wakes instance every ${interval} min during hours ${hours}"
    echo -e "  ${CYAN}Server cron:${NC} runs orchestrator every ${interval} min during hours ${hours}"
  fi
  echo -e "  ${CYAN}Active guard:${NC} cron runs only during active hours; boot/trigger/run-agent bypass"
  echo ""
}

cmd_run_agent() {
  local state
  state=$(get_instance_state)

  # Wake up if needed — but don't set .keep-running (we want the instance to
  # self-stop after the run completes)
  if [[ "${state}" != "running" ]]; then
    log "Waking instance for agent run..."
    if [[ "${state}" == "stopping" ]]; then
      warn "Instance is still stopping. Waiting..."
      aws ec2 wait instance-stopped --instance-ids "${INSTANCE_ID}" --region "${REGION}"
    fi
    aws ec2 start-instances --instance-ids "${INSTANCE_ID}" --region "${REGION}" >/dev/null
    log "Waiting for instance to be running..."
    aws ec2 wait instance-running --instance-ids "${INSTANCE_ID}" --region "${REGION}"
    log "Waiting for SSH..."
    local ssh_ok=false
    for i in $(seq 1 30); do
      if ssh -o ConnectTimeout=5 "${SSH_HOST}" "echo ready" 2>/dev/null; then
        ssh_ok=true
        break
      fi
      # After 30s of failures, check if IP changed
      if [[ $i -eq 6 ]]; then
        if check_and_fix_ssh_ip; then
          for j in $(seq 1 24); do
            if ssh -o ConnectTimeout=5 "${SSH_HOST}" "echo ready" 2>/dev/null; then
              ssh_ok=true
              break 2
            fi
            sleep 5
          done
        fi
      fi
      sleep 5
    done
    if [[ "${ssh_ok}" != "true" ]]; then
      warn "SSH not available after 150 seconds."
      return 1
    fi
  fi

  # Check if orchestrator is already running (boot/resume may have started it)
  local lock_held
  lock_held=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" \
    "flock -n ~/.agent-orchestrator.lock true 2>/dev/null && echo free || echo held" || echo "free")
  if [[ "${lock_held}" == "held" ]]; then
    log "Orchestrator is already running (triggered on wake)."
    if [[ "${SCHEDULE_MODE:-always-on}" == "scheduled" ]]; then
      echo -e "  It will self-stop (hibernate) after completing tasks."
    fi
    echo -e "  Monitor: ${CYAN}ssh ${SSH_HOST} 'tail -f ~/logs/orchestrator-*.log'${NC}"
    return 0
  fi

  # Trigger orchestrator in background (--force bypasses active-hours guard
  # since this is an explicit manual action; instance still self-stops after)
  log "Starting agent orchestrator..."
  local pid
  pid=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" \
    "nohup ~/scripts/agent-orchestrator.sh --force </dev/null >> ~/logs/cron-orchestrator.log 2>&1 & echo \$!" 2>/dev/null)

  # Brief wait, then confirm via lock
  sleep 2
  local running
  running=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" \
    "flock -n ~/.agent-orchestrator.lock true 2>/dev/null && echo free || echo held" || echo "free")
  if [[ "${running}" == "held" ]]; then
    log "Orchestrator started."
    echo ""
    echo -e "  The agent is running in the background."
    if [[ "${SCHEDULE_MODE:-always-on}" == "scheduled" ]]; then
      echo -e "  It will self-stop (hibernate) after completing tasks."
    else
      echo -e "  Instance stays running after tasks complete (always-on mode)."
    fi
    echo ""
    echo -e "  Monitor: ${CYAN}ssh ${SSH_HOST} 'tail -f ~/logs/orchestrator-*.log'${NC}"
  else
    err "Orchestrator may not have started. Check: ssh ${SSH_HOST} 'agent status'"
  fi
  echo ""
}

cmd_ssh_mcp() {
  local state
  state=$(get_instance_state)

  if [[ "${state}" != "running" ]]; then
    err "Instance is ${state}. Use --wakeup first."
    return 1
  fi

  # Proactive IP check — update security group if our IP changed
  check_and_fix_ssh_ip || true

  log "Connecting with MCP port forwarding (18850-18852)..."
  exec ssh -L 18850:127.0.0.1:18850 -L 18851:127.0.0.1:18851 -L 18852:127.0.0.1:18852 "${SSH_HOST}"
}

cmd_history() {
  local days="${1:-7}"

  # Compute time range (python3 for cross-platform date math)
  local start_time end_time
  end_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
  start_time=$(python3 -c "from datetime import datetime,timedelta,timezone; print((datetime.now(timezone.utc)-timedelta(days=${days})).strftime('%Y-%m-%dT00:00:00Z'))")

  # Read timezone from deploy-state.json
  local tz_name="UTC"
  if [[ -f "${STATE_FILE}" ]]; then
    tz_name=$(python3 -c "import json; print(json.load(open('${STATE_FILE}')).get('timezone','UTC'))" 2>/dev/null || echo "UTC")
  fi

  log "Fetching instance activity for the last ${days} days (${tz_name})..."

  # Get CloudWatch CPUUtilization (hourly) — data point exists = instance was awake
  local cw_file
  cw_file=$(mktemp)
  aws cloudwatch get-metric-statistics \
    --namespace AWS/EC2 \
    --metric-name CPUUtilization \
    --dimensions "Name=InstanceId,Value=${INSTANCE_ID}" \
    --start-time "${start_time}" \
    --end-time "${end_time}" \
    --period 3600 \
    --statistics Maximum \
    --region "${REGION}" \
    --output json > "${cw_file}" 2>/dev/null || echo '{"Datapoints":[]}' > "${cw_file}"

  # Get orchestrator run timestamps and events.
  # Primary: SSH to server for detailed logs (if running).
  # Fallback: CloudTrail Start/Stop events (always available, even when stopped).
  local run_file events_file
  run_file=$(mktemp)
  events_file=$(mktemp)
  local state
  state=$(get_instance_state)
  local got_ssh_data=false
  if [[ "${state}" == "running" ]]; then
    if ssh -o ConnectTimeout=5 "${SSH_HOST}" \
      "ls -1 ~/logs/orchestrator-*.log 2>/dev/null | sed 's/.*orchestrator-//' | sed 's/\.log//' | tail -500" \
      > "${run_file}" 2>/dev/null; then
      got_ssh_data=true
    fi

    # For single-day view, get detailed event timestamps from logs
    if [[ "${got_ssh_data}" == "true" && "${days}" -eq 1 ]]; then
      local today_str
      today_str=$(date +%Y%m%d)
      ssh -o ConnectTimeout=10 "${SSH_HOST}" "
        for f in ~/logs/orchestrator-${today_str}*.log; do
          [ -f \"\$f\" ] || continue
          ts=\$(basename \"\$f\" .log | sed 's/orchestrator-//')
          echo \"START:\${ts}\"
          # File modification time as proxy for end/hibernate time
          echo \"ENDTIME:\$(stat -c '%Y' \"\$f\" 2>/dev/null || stat -f '%m' \"\$f\" 2>/dev/null)\"
          # Get the 'Claude Code finished' line with exit code
          grep -m1 'Claude Code finished' \"\$f\" 2>/dev/null && true
          # Check for hibernate/stop events
          grep -m1 'hibernating instance\|Falling back to shutdown\|Outside active hours' \"\$f\" 2>/dev/null && true
        done
      " > "${events_file}" 2>/dev/null || true
    fi
  fi

  # CloudTrail Start/Stop events — always fetched.
  # When SSH data is available, CloudTrail supplements the events view with
  # trigger/wakeup events that didn't produce orchestrator logs.
  # When SSH is unavailable, CloudTrail is the sole data source.
  local ct_file
  ct_file=$(mktemp)
  aws cloudtrail lookup-events \
    --lookup-attributes "AttributeKey=ResourceName,AttributeValue=${INSTANCE_ID}" \
    --start-time "${start_time}" \
    --end-time "${end_time}" \
    --max-results 200 \
    --region "${REGION}" \
    --output json > "${ct_file}" 2>/dev/null || echo '{"Events":[]}' > "${ct_file}"

  # Convert CloudTrail events into run timestamps and event details.
  # Timestamps are converted to the server's local timezone so the rendering
  # code (which treats them as naive local times) displays correct hours.
  #
  # Mode: "supplement" — SSH logs are primary; only add non-overlapping events.
  #        "primary"   — no SSH data; CloudTrail is the sole source.
  local ct_mode="primary"
  [[ "${got_ssh_data}" == "true" ]] && ct_mode="supplement"
  python3 - "${ct_file}" "${run_file}" "${events_file}" "${days}" "${tz_name}" "${ct_mode}" << 'CT_PYEOF'
import json, sys
from datetime import datetime, timezone

ct_file, run_file, events_file, days_str, tz_name, ct_mode = sys.argv[1:7]
days = int(days_str)

try:
    from zoneinfo import ZoneInfo
    local_tz = ZoneInfo(tz_name)
except (ImportError, KeyError):
    local_tz = timezone.utc

with open(ct_file) as f:
    ct_data = json.load(f)

scheduled_starts = []  # EventBridge-triggered (= agent ran)
trigger_starts = []    # Remote trigger (Lambda) (= agent ran)
manual_starts = []     # Manual wakeups (= awake but no agent run)
noop_starts = set()    # StartInstances where instance was already running
stops = []

def parse_ts(ts):
    if isinstance(ts, str):
        for fmt in ("%Y-%m-%dT%H:%M:%S%z", "%Y-%m-%dT%H:%M:%SZ"):
            try:
                dt = datetime.strptime(ts, fmt)
                if dt.tzinfo is None:
                    dt = dt.replace(tzinfo=timezone.utc)
                return dt.astimezone(local_tz)
            except ValueError:
                continue
    elif isinstance(ts, (int, float)):
        return datetime.fromtimestamp(ts, tz=timezone.utc).astimezone(local_tz)
    return None

for ev in ct_data.get("Events", []):
    name = ev.get("EventName", "")
    dt = parse_ts(ev.get("EventTime", ""))
    if dt is None:
        continue
    if name == "StartInstances":
        # Distinguish scheduler-triggered, remote-triggered, and manual starts.
        ce = json.loads(ev.get("CloudTrailEvent", "{}"))
        ua = ce.get("userAgent", "")
        arn = ce.get("userIdentity", {}).get("arn", "")
        # Check if instance was already running (StartInstances was a no-op).
        prev_state = ""
        try:
            items = ce.get("responseElements", {}).get("instancesSet", {}).get("items", [])
            if items:
                prev_state = items[0].get("previousState", {}).get("name", "")
        except (AttributeError, IndexError, KeyError):
            pass
        if "EventBridge" in ua or "Scheduler" in ua:
            scheduled_starts.append(dt)
        elif "agent-server-trigger-role" in arn:
            trigger_starts.append(dt)
        else:
            manual_starts.append(dt)
        if prev_state == "running":
            noop_starts.add(dt.strftime("%Y%m%d-%H%M%S"))
    elif name == "StopInstances":
        stops.append(dt)

scheduled_starts.sort()
trigger_starts.sort()
manual_starts.sort()
stops.sort()
all_starts = sorted(scheduled_starts + trigger_starts + manual_starts)

# Filter to only the requested date range (local time)
from datetime import timedelta
now_local = datetime.now(local_tz)
date_start = (now_local - timedelta(days=days)).replace(hour=0, minute=0, second=0, microsecond=0)
scheduled_starts = [s for s in scheduled_starts if s >= date_start]
trigger_starts = [s for s in trigger_starts if s >= date_start]
manual_starts = [s for s in manual_starts if s >= date_start]
all_starts = [s for s in all_starts if s >= date_start]
stops = [s for s in stops if s >= date_start]

if ct_mode == "primary":
    # No SSH data — CloudTrail is the sole source for run timestamps.
    # First line "SOURCE:cloudtrail" signals estimated data.
    with open(run_file, "w") as rf:
        rf.write("SOURCE:cloudtrail\n")
        for s in scheduled_starts:
            ts = s.strftime("%Y%m%d-%H%M%S")
            if ts not in noop_starts:
                rf.write(ts + "\n")
        for s in trigger_starts:
            ts = s.strftime("%Y%m%d-%H%M%S")
            if ts not in noop_starts:
                rf.write(ts + "\n")
        for s in manual_starts:
            ts = s.strftime("%Y%m%d-%H%M%S")
            if ts not in noop_starts:
                rf.write("AWAKE:" + ts + "\n")

# For single-day view, build event pairs sorted chronologically.
# In supplement mode, merge CloudTrail events with existing SSH-based events,
# adding only start/stop events that don't overlap with orchestrator logs.
if days == 1:
    today_str = now_local.strftime("%Y-%m-%d")
    today_starts = [s for s in all_starts if s.strftime("%Y-%m-%d") == today_str]
    today_stops = [s for s in stops if s.strftime("%Y-%m-%d") == today_str]
    is_scheduled = set(s.strftime("%Y%m%d-%H%M%S") for s in scheduled_starts)
    is_trigger = set(s.strftime("%Y%m%d-%H%M%S") for s in trigger_starts)

    # Build a map from each start to its matching stop.
    # Each stop pairs with the last start before it (not all starts before it).
    start_to_stop = {}
    stop_idx = 0
    for si in range(len(today_starts)):
        s = today_starts[si]
        # A stop matches this start only if no later start exists before that stop.
        next_start = today_starts[si + 1] if si + 1 < len(today_starts) else None
        while stop_idx < len(today_stops):
            st = today_stops[stop_idx]
            if st <= s:
                stop_idx += 1
                continue
            if next_start and st > next_start:
                break  # this stop is after the next start — belongs to a later group
            start_to_stop[s] = st
            stop_idx += 1
            break

    def write_start_event(ef, s, ts_str):
        """Write a START/TRIGGER/WAKEUP line, with NOOP_ prefix if already running."""
        is_noop = ts_str in noop_starts
        if ts_str in is_trigger:
            prefix = "NOOP_TRIGGER" if is_noop else "TRIGGER"
        elif ts_str in is_scheduled:
            prefix = "NOOP_START" if is_noop else "START"
        else:
            prefix = "NOOP_WAKEUP" if is_noop else "WAKEUP"
        ef.write(f"{prefix}:{ts_str}\n")

    def write_stop_event(ef, s):
        """Write ENDTIME + hibernate line if this start has a matching stop."""
        matching_stop = start_to_stop.get(s)
        if matching_stop:
            ef.write(f"ENDTIME:{int(matching_stop.timestamp())}\n")
            ef.write("hibernating instance\n")

    if ct_mode == "supplement":
        # Read existing SSH-based events to find which hours already have entries.
        existing_start_hours = set()
        try:
            with open(events_file) as ef:
                for line in ef:
                    line = line.strip()
                    if line.startswith("START:") and len(line) >= 17:
                        # Extract hour from START:YYYYMMDD-HHMMSS
                        existing_start_hours.add(line[15:17])
        except (FileNotFoundError, IOError):
            pass

        # Append CloudTrail events that don't overlap with existing orchestrator runs.
        # A start is "overlapping" if there's an orchestrator log in the same hour.
        with open(events_file, "a") as ef:
            for s in today_starts:
                hour_str = s.strftime("%H")
                if hour_str in existing_start_hours:
                    continue  # orchestrator log already covers this start
                ts_str = s.strftime("%Y%m%d-%H%M%S")
                write_start_event(ef, s, ts_str)
                write_stop_event(ef, s)
    else:
        # Primary mode — write all events from CloudTrail
        with open(events_file, "w") as ef:
            for s in today_starts:
                ts_str = s.strftime('%Y%m%d-%H%M%S')
                write_start_event(ef, s, ts_str)
                write_stop_event(ef, s)
CT_PYEOF
  rm -f "${ct_file}"

  # Render timeline with python3
  python3 - "${days}" "${cw_file}" "${run_file}" "${tz_name}" "${events_file}" << 'PYEOF'
import json, sys, re
from datetime import datetime, timedelta, timezone

days = int(sys.argv[1])
with open(sys.argv[2]) as f:
    cw_raw = json.load(f)
with open(sys.argv[3]) as f:
    run_raw = f.read().strip()
tz_name = sys.argv[4]
events_file = sys.argv[5] if len(sys.argv) > 5 else ""

# Set up timezone
try:
    from zoneinfo import ZoneInfo
    local_tz = ZoneInfo(tz_name)
except (ImportError, KeyError):
    local_tz = timezone.utc

# Compute displayed date range
now = datetime.now(local_tz)
display_dates = set()
for d in range(days):
    day = now - timedelta(days=d)
    display_dates.add(day.strftime("%Y-%m-%d"))

# Parse CloudWatch → set of (date_str, hour) in local time + CPU values
awake = set()
cpu_max = {}
for dp in cw_raw.get("Datapoints", []):
    ts = dp["Timestamp"]
    try:
        dt = datetime.fromisoformat(ts)
        if dt.tzinfo is None:
            dt = dt.replace(tzinfo=timezone.utc)
    except ValueError:
        continue
    local_dt = dt.astimezone(local_tz)
    ds = local_dt.strftime("%Y-%m-%d")
    if ds in display_dates:
        key = (ds, local_dt.hour)
        awake.add(key)
        cpu_val = dp.get("Maximum", 0)
        cpu_max[key] = max(cpu_max.get(key, 0), cpu_val)

# Parse orchestrator log filenames → set of (date_str, hour) + count per day.
# Lines prefixed with "AWAKE:" are manual wakeups (no agent run) from CloudTrail.
# A "SOURCE:cloudtrail" header means run counts are estimated (no SSH access).
runs = set()
from collections import Counter
runs_per_day = Counter()
estimated = False
for line in run_raw.split("\n"):
    line = line.strip()
    if line == "SOURCE:cloudtrail":
        estimated = True
        continue
    is_awake_only = line.startswith("AWAKE:")
    ts_str = line[6:] if is_awake_only else line
    if len(ts_str) >= 15:
        try:
            dt = datetime.strptime(ts_str[:15], "%Y%m%d-%H%M%S")
            ds = dt.strftime("%Y-%m-%d")
            if ds in display_dates:
                if is_awake_only:
                    awake.add((ds, dt.hour))
                else:
                    runs.add((ds, dt.hour))
                    runs_per_day[ds] += 1
        except ValueError:
            pass

# When run data is estimated from CloudTrail (instance stopped, no SSH),
# use CloudWatch CPU to detect hours where the agent likely ran.
# CloudTrail only captures instance Start/Stop events, missing orchestrator
# runs that happen while the instance is already running continuously.
CPU_RUN_THRESHOLD = 5  # percent — idle is ~0.5-1.3%, agent runs are ~8-12%+
if estimated:
    for key, cpu in cpu_max.items():
        if cpu > CPU_RUN_THRESHOLD and key not in runs:
            runs.add(key)
            # Each high-CPU hour ≈ 1 orchestrator run (cron interval is ~60 min)
            runs_per_day[key[0]] += 1

# Merge: hours with runs are also awake
awake |= runs

# Colors
G = "\033[0;32m"; Y = "\033[1;33m"; D = "\033[2m"; B = "\033[1m"
C = "\033[0;36m"; NC = "\033[0m"

# --- Render bar chart -------------------------------------------------------
print()
print(f"  {B}Agent History — last {days} day(s){NC}")
print(f"  {'─' * 56}")

for d in range(days - 1, -1, -1):
    day = now - timedelta(days=d)
    ds = day.strftime("%Y-%m-%d")
    label = day.strftime("%b %d")

    bar = ""
    for h in range(24):
        k = (ds, h)
        if k in runs:
            bar += f"{G}██{NC}"
        elif k in awake:
            bar += f"{Y}░░{NC}"
        else:
            bar += f"{D}··{NC}"
    rc = runs_per_day.get(ds, 0)
    prefix = "~" if estimated and rc > 0 else ""
    suffix = f"  {D}{prefix}{rc} run{'s' if rc != 1 else ''}{NC}" if rc > 0 else ""
    print(f"  {label}  {bar}{suffix}")

# Hour axis
axis = ""
for h in range(0, 24, 3):
    label = str(h)
    axis += label + " " * (6 - len(label))
print(f"  {'':8}{axis}")

print()
print(f"  {G}██{NC} agent ran   {Y}░░{NC} awake (idle)   {D}··{NC} stopped")

total_active_hours = len(awake)
total_run_hours = len(runs)
total_runs = sum(runs_per_day.values())
est_prefix = "~" if estimated else ""
print()
print(f"  Hours with wake-ups: {total_active_hours}  |  Total runs: {est_prefix}{total_runs}")
if total_active_hours > 0 and total_active_hours != total_run_hours:
    idle_hours = total_active_hours - total_run_hours
    print(f"  Hours idle (awake, no run): {idle_hours}")
if estimated:
    print(f"  {D}(runs estimated from CloudTrail + CPU activity — start server for exact counts){NC}")

# --- Detailed event timeline (single-day only) ------------------------------
if days == 1 and events_file:
    try:
        with open(events_file) as f:
            raw = f.read().strip()
    except (FileNotFoundError, IOError):
        raw = ""

    if raw:
        # Parse event blocks (START/TRIGGER/WAKEUP + ENDTIME + status lines).
        # Each block becomes a group of events with a sort key (timestamp).
        # We sort by sort key so that SSH-based and CloudTrail-supplemented
        # events appear in chronological order.
        event_groups = []  # list of (sort_key_minutes, [(HH:MM, symbol, desc), ...])
        current_start = None
        end_hm = None

        for line in raw.split("\n"):
            line = line.strip()
            # Match START/TRIGGER/WAKEUP and their NOOP_ variants.
            is_start_line = False
            is_noop = line.startswith("NOOP_")
            check = line[5:] if is_noop else line
            if check.startswith("START:") or check.startswith("WAKEUP:") or check.startswith("TRIGGER:"):
                is_start_line = True
                is_manual = check.startswith("WAKEUP:")
                is_trigger = check.startswith("TRIGGER:")
            if is_start_line:
                ts_str = check.split(":", 1)[1]
                try:
                    dt = datetime.strptime(ts_str[:15], "%Y%m%d-%H%M%S")
                    hm = dt.strftime("%H:%M")
                    sort_key = dt.hour * 60 + dt.minute
                    group = []
                    current_start = hm
                    end_hm = None
                    if is_noop:
                        # Instance was already running — mark group so no
                        # "instance woke up" is prepended during rendering.
                        if is_manual:
                            group.append((hm, "○", "start triggered (already running)"))
                        elif is_trigger:
                            group.append((hm, "▶", "remote trigger (already running)"))
                        else:
                            group.append((hm, "▶", "scheduled start (already running)"))
                    elif is_manual:
                        group.append((hm, "○", "manual wakeup (no agent run)"))
                    elif is_trigger:
                        group.append((hm, "▶", "remote trigger → orchestrator started"))
                    else:
                        group.append((hm, "▶", "orchestrator started"))
                    event_groups.append((sort_key, group, is_noop))
                except ValueError:
                    pass
            elif line.startswith("ENDTIME:"):
                try:
                    epoch = int(line[8:])
                    dt = datetime.fromtimestamp(epoch, tz=local_tz)
                    end_hm = dt.strftime("%H:%M")
                except (ValueError, OSError):
                    end_hm = None
            elif "Claude Code finished" in line:
                m = re.search(r"exit code: (\d+)", line)
                code = m.group(1) if m else "?"
                hm = end_hm or current_start or "??:??"
                if event_groups:
                    event_groups[-1][1].append((hm, "■", f"agent finished (exit {code})"))
            elif "hibernating instance" in line or "Falling back to shutdown" in line:
                hm = end_hm or "??:??"
                if event_groups:
                    event_groups[-1][1].append((hm, "▼", "instance hibernated"))
            elif "Outside active hours" in line:
                hm = end_hm or "??:??"
                if event_groups:
                    event_groups[-1][1].append((hm, "▼", "stopped (outside active hours)"))

        # Sort groups chronologically, then infer "instance woke up" events.
        # Wake-up is inferred when there's no previous group or the previous
        # group ended with a stop (▼) — unless this group is a no-op start
        # (instance was already running per CloudTrail previousState).
        event_groups.sort(key=lambda g: g[0])
        events = []
        for i, (_, group, noop) in enumerate(event_groups):
            if not noop:
                prev_last_sym = event_groups[i-1][1][-1][1] if i > 0 else "▼"
                if i == 0 or prev_last_sym == "▼":
                    hm = group[0][0]  # use timestamp of first event in group
                    events.append((hm, "▲", "instance woke up"))
            events.extend(group)

        if events:
            print()
            print(f"  {B}Events{NC}")
            print(f"  {'─' * 40}")
            for hm, sym, desc in events:
                if sym == "▲" or sym == "○":
                    color = Y
                elif sym == "▶" or sym == "■":
                    color = G
                else:
                    color = D
                print(f"  {color}{hm}  {sym}{NC}  {desc}")
            print()
    elif not raw:
        print()
        print(f"  {D}(no detailed event data for today){NC}")
        print()

print()
PYEOF

  rm -f "${cw_file}" "${run_file}" "${events_file}"
}

cmd_log() {
  local n="${1:-1}"
  local state
  state=$(get_instance_state)

  if [[ "${state}" != "running" ]]; then
    err "Instance is ${state}. Use --wakeup first."
    return 1
  fi

  # Proactive IP check before SSH
  check_and_fix_ssh_ip || true

  # Get the Nth most recent orchestrator log and the run log it references
  local log_output
  log_output=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" "
    LOG=\$(ls -1t ~/logs/orchestrator-*.log 2>/dev/null | sed -n '${n}p')
    if [[ -z \"\${LOG}\" ]]; then
      echo 'ERROR: No orchestrator log #${n} found.'
      exit 1
    fi
    echo \"=== \$(basename \"\${LOG}\") ===\"
    echo ''
    cat \"\${LOG}\"

    # Also show the agent run log if referenced
    RUN_LOG=\$(grep -oP 'Run log: \\K.*' \"\${LOG}\" 2>/dev/null | head -1)
    if [[ -n \"\${RUN_LOG}\" && -f \"\${RUN_LOG}\" ]]; then
      echo ''
      echo \"=== Agent Run Log: \$(basename \"\${RUN_LOG}\") ===\"
      echo ''
      cat \"\${RUN_LOG}\"
    fi
  " 2>/dev/null) || {
    err "Could not fetch log from server."
    return 1
  }

  echo "${log_output}"
}

cmd_trigger() {
  local trigger_url trigger_token
  trigger_url="$(json_get trigger_function_url)"
  trigger_token="$(json_get trigger_token)"

  if [[ -z "${trigger_url}" ]]; then
    echo ""
    echo "No remote trigger deployed."
    echo ""
    echo "  To set one up, run:"
    echo "    ./deploy-trigger.sh --deploy"
    echo ""
    return
  fi

  echo ""
  echo "============================================================"
  echo " REMOTE TRIGGER"
  echo "============================================================"
  echo ""
  echo "  Function URL:"
  echo "    ${trigger_url}"
  echo ""
  echo "  Bearer Token:"
  echo "    ${trigger_token}"
  echo ""
  echo "  Test:"
  echo "    curl -s -X POST '${trigger_url}' \\"
  echo "      -H 'Authorization: Bearer ${trigger_token}' | python3 -m json.tool"
  echo ""
  echo "  iOS Shortcuts:"
  echo "    Action:  Get Contents of URL"
  echo "    URL:     ${trigger_url}"
  echo "    Method:  POST"
  echo "    Headers: Authorization = Bearer ${trigger_token}"
  echo ""
  echo "============================================================"
}

cmd_check_version() {
  local REPO_URL="https://github.com/gregertw/claude-code-agent.git"
  local state
  state=$(get_instance_state)

  # GitHub version: latest commit on remote main
  echo ""
  echo -e "${BOLD}Agent Version Check${NC}"
  echo "─────────────────────────────────"

  local github_rev
  github_rev=$(git ls-remote "${REPO_URL}" HEAD 2>/dev/null | cut -c1-7) || github_rev="unknown"
  local github_date
  github_date=$(curl -s "https://raw.githubusercontent.com/gregertw/claude-code-agent/main/CHANGELOG.md" 2>/dev/null \
    | grep -m1 '^## \[' | sed 's/## \[\(.*\)\]/\1/') || github_date="unknown"

  echo -e "  GitHub: ${GREEN}${github_rev}${NC} (${github_date})"

  if [[ "${state}" != "running" ]]; then
    echo -e "  Server: ${DIM}unknown (instance is ${state})${NC}"
    echo ""
    echo "  Start the instance with --wakeup to check server version."
    echo ""
    return
  fi

  check_and_fix_ssh_ip || true

  local server_rev
  server_rev=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" \
    "git -C ~/.agent-repo rev-parse --short HEAD 2>/dev/null || echo 'unknown'" 2>/dev/null) || server_rev="unknown"
  local server_date
  server_date=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" \
    "grep -m1 '^## \[' ~/.agent-repo/CHANGELOG.md 2>/dev/null | sed 's/## \[\(.*\)\]/\1/'" 2>/dev/null) || server_date="unknown"

  echo -e "  Server: ${CYAN}${server_rev}${NC} (${server_date})"
  echo ""

  if [[ "${github_rev}" == "${server_rev}" ]]; then
    echo -e "  ${GREEN}Up to date.${NC}"
  else
    echo -e "  ${YELLOW}Update available.${NC} Run ${CYAN}./agent-manager.sh --upgrade-agent${NC} to upgrade."
    echo ""
    # Show commits between server and GitHub
    local changes
    changes=$(git -C "${SCRIPT_DIR}" log --oneline "${server_rev}..${github_rev}" 2>/dev/null) || changes=""
    if [[ -n "${changes}" ]]; then
      echo -e "  ${BOLD}Changes:${NC}"
      echo "${changes}" | while IFS= read -r line; do
        echo "    ${line}"
      done
    fi
  fi
  echo ""
}

cmd_upgrade_agent() {
  local state
  state=$(get_instance_state)

  if [[ "${state}" != "running" ]]; then
    err "Instance is ${state}. Use --wakeup first."
    return 1
  fi

  check_and_fix_ssh_ip || true

  # Check if orchestrator is currently running
  local lock_status
  lock_status=$(ssh -o ConnectTimeout=5 "${SSH_HOST}" \
    "flock -n ~/.agent-orchestrator.lock true 2>/dev/null && echo free || echo held" 2>/dev/null) || lock_status="unknown"

  if [[ "${lock_status}" == "held" ]]; then
    err "Orchestrator is currently running. Wait for it to finish or use --sleep first."
    return 1
  fi

  log "Upgrading agent scripts on server..."
  echo ""

  local output
  output=$(ssh -o ConnectTimeout=10 "${SSH_HOST}" \
    "~/scripts/agent-cli.sh upgrade" 2>/dev/null) || {
    err "Upgrade failed."
    return 1
  }

  echo "${output}"
}

cmd_help() {
  echo ""
  echo -e "${BOLD}agent-manager${NC} — Manage your agent server"
  echo ""
  echo "Commands:"
  echo -e "  ${CYAN}./agent-manager.sh${NC}              Show server status (default)"
  echo -e "  ${CYAN}./agent-manager.sh --wakeup${NC}     Start a stopped instance, wait for SSH"
  echo -e "  ${CYAN}./agent-manager.sh --sleep${NC}      Stop a running instance"
  echo -e "  ${CYAN}./agent-manager.sh --always-on${NC}  Switch to always-on mode (remove scheduler)"
  echo -e "  ${CYAN}./agent-manager.sh --scheduled${NC}  Switch to scheduled mode (default: every 60 min)"
  echo -e "  ${CYAN}./agent-manager.sh --scheduled 30${NC} Scheduled mode, every 30 min"
  echo -e "  ${CYAN}./agent-manager.sh --scheduled 60 8-20${NC}  Scheduled, every 60 min, 8am-8pm"
  echo -e "  ${CYAN}./agent-manager.sh --run-agent${NC}  Trigger an agent run (fire and forget)"
  echo -e "  ${CYAN}./agent-manager.sh --history${NC}   Show wake/sleep/run timeline (last 7 days)"
  echo -e "  ${CYAN}./agent-manager.sh --history 14${NC} Timeline for the last 14 days"
  echo -e "  ${CYAN}./agent-manager.sh --log${NC}       Show latest orchestrator log"
  echo -e "  ${CYAN}./agent-manager.sh --log 3${NC}     Show 3rd most recent log"
  echo -e "  ${CYAN}./agent-manager.sh --trigger${NC}     Show remote trigger URL and token"
  echo -e "  ${CYAN}./agent-manager.sh --ssh${NC}        SSH into the server"
  echo -e "  ${CYAN}./agent-manager.sh --check-version${NC}  Compare local vs server agent version"
  echo -e "  ${CYAN}./agent-manager.sh --upgrade-agent${NC}  Upgrade agent scripts on the server"
  echo -e "  ${CYAN}./agent-manager.sh --ssh-mcp${NC}    SSH with MCP port forwarding (for auth)"
  echo -e "  ${CYAN}./agent-manager.sh --help${NC}       Show this help"
  echo ""
}

# --- Main dispatch -----------------------------------------------------------
load_state

case "${1:---status}" in
  --status|status)     cmd_status ;;
  --wakeup|wakeup)     cmd_wakeup ;;
  --sleep|sleep)       cmd_sleep ;;
  --always-on|always-on)     cmd_always_on ;;
  --scheduled|scheduled)     cmd_scheduled "${2:-60}" "${3:-}" "${4:-}" ;;
  --run-agent|run-agent)     cmd_run_agent ;;
  --history|history)         cmd_history "${2:-7}" ;;
  --log|log)                 cmd_log "${2:-1}" ;;
  --trigger|trigger)   cmd_trigger ;;
  --check-version|check-version)   cmd_check_version ;;
  --upgrade-agent|upgrade-agent)   cmd_upgrade_agent ;;
  --ssh|ssh)           cmd_ssh ;;
  --ssh-mcp|ssh-mcp)   cmd_ssh_mcp ;;
  --help|-h|help)      cmd_help ;;
  *)
    err "Unknown command: $1"
    cmd_help
    exit 1 ;;
esac