#!/bin/bash
# bos-update — update all of BOS in one go.
#
# BOS packages come from two channels, so a full update touches both:
#   1. pacman   — Arch base/desktop + the [breadway] repo (breadlock + AUR
#                 republishes: calamares, zen-browser-bin, bibata, yay-bin,
#                 powerlevel10k). [breadway] does NOT provide bos-settings
#                 or other bakery desktop apps. Every transaction is
#                 snapshotted by snap-pac; recover via the GRUB "snapshots"
#                 submenu (grub-btrfs), not `snapper rollback`.
#   2. bakery   — the bread ecosystem apps in /usr/local (whatever `bakery list`
#                 reports as installed — bakery, bread, breadbar, breadbox,
#                 breadcrumbs, breadpad, breadman, bread-theme, breadpaper,
#                 breadmon, breadsearch, breadclip, breadshot, bos-settings,
#                 breadhelp, ...). Those bits live on @ and ride snapper
#                 root snapshots; recover via grub-btrfs, not `snapper rollback`.
#
# Best-effort: a failure in one channel doesn't abort the other.
set -uo pipefail

bold() { printf '\033[1m%s\033[0m\n' "$1"; }

# Timed snapper pre snapshot before either channel. snap-pac already
# snapshots root around pacman; bakery now writes /usr/local (on @), so
# that root snapshot includes the desktop apps. This extra snapshot is
# still best-effort — a home config if the installer created one (user
# bakery state), plus a root timeline around the whole update. Never
# fail the update if snapper is missing or the create errors.
if command -v snapper >/dev/null; then
    if snapper -c home list >/dev/null 2>&1; then
        snapper -c home create -t pre -c number \
            -d "bos-update (pre bakery)" \
            || echo "WARN: snapper home pre snapshot failed"
    fi
    snapper -c root create -t pre -c number \
        -d "bos-update (pre bakery)" \
        || echo "WARN: snapper pre snapshot failed"
fi

bold "==> System packages (pacman -Syu)"
if command -v pacman >/dev/null; then
    sudo pacman -Syu || echo "WARN: pacman update failed"
else
    echo "pacman not found; skipping"
fi

echo
bold "==> Bread ecosystem (bakery update --all)"
if command -v bakery >/dev/null; then
    # /usr/local is root-owned. Never run bakery as the user against it;
    # bakery itself also tries sudo -n then pkexec for privileged writes.
    if sudo -n true >/dev/null 2>&1; then
        sudo -n bakery update --all || echo "WARN: bakery update failed"
    elif command -v pkexec >/dev/null; then
        pkexec bakery update --all || echo "WARN: bakery update failed"
    else
        echo "WARN: bakery update needs sudo -n or pkexec for /usr/local"
    fi
else
    echo "bakery not found; skipping"
fi

echo
bold "==> BOS is up to date."
echo
bold "Recovery"
echo "If this update goes badly: reboot → GRUB “snapshots” submenu."
echo "snapper rollback will not change what GRUB boots (rootflags=subvol=@)."