Pup - the AI's own browser

#!/usr/bin/env bash
# rollback.sh — re-point the PUBLIC tier at an earlier promoted build, on a human's exact words.
#
#   tools/rollback.sh <version> "<the human's exact words>" [--by "<name>"]
#
# Fast path for a bad public promote: the target must have been promoted before (its
# dist/<ver>/public-manifest.json exists, i.e. the public release asset is already on the page),
# so this only rewrites and pushes the public manifest — no upload, no source push, no pkg
# publish (the skills pkg is not rolled back here; do that deliberately if the skills changed).
set -euo pipefail
VER="${1:?usage: tools/rollback.sh <version> \"<words>\" [--by name]}"
ATTEST="${2:-}"; shift 2 || true
BY="${ADOM_PROMOTED_BY:-}"
while [ $# -gt 0 ]; do case "$1" in --by) BY="$2"; shift 2;; *) shift;; esac; done
REPO="$(cd "$(dirname "$0")/.." && pwd)"; cd "$REPO"
PUBLIC="adom/pup-bridge"
A="$(printf '%s' "$ATTEST" | tr -s '[:space:]' ' ' | sed 's/^ //;s/ $//')"
[ "${#A}" -ge 8 ] || { echo "REFUSED: rollback needs the human's exact words (>= 8 chars)."; exit 2; }
[ -n "$BY" ] || { echo "REFUSED: say who rolled back (--by \"<name>\")."; exit 2; }
SRC="dist/${VER}/public-manifest.json"
[ -f "$SRC" ] || { echo "MISSING $SRC — $VER was never promoted from this checkout; promote it (tools/promote.sh) instead of rolling back to it."; exit 1; }
python3 - "$SRC" "$A" "$BY" <<'PY'
import json, sys, datetime
src, words, by = sys.argv[1:4]
old = json.load(open(src))
now = datetime.datetime.now(datetime.timezone.utc).isoformat().replace('+00:00', 'Z')
m = json.load(open('adom-bridge-puppeteer-manifest.json'))
for k in ('version', 'url', 'sha256', 'size', 'released_at', 'insiders_released_at', 'promotion_attestation', 'promoted_by', 'promoted_at'):
    if k in old: m[k] = old[k]
m.update({'rollback_attestation': words, 'rolled_back_by': by, 'rolled_back_at': now})
json.dump(m, open('adom-bridge-puppeteer-manifest.json', 'w'), indent=2); open('adom-bridge-puppeteer-manifest.json', 'a').write('\n')
print(f"   public manifest -> {old['version']} ({old['url']})")
PY
adom-wiki repo push "$PUBLIC" --files adom-bridge-puppeteer-manifest.json -m "ROLLBACK public tier to v${VER} — ${BY}: ${A}" >/dev/null 2>&1 || {
  [ "${FORCE_PUSH:-0}" = "1" ] || { echo "   PUSH FAILED (set FORCE_PUSH=1 to retry)"; exit 1; }
}
echo "ROLLED BACK public tier to $VER (attested by $BY). Desktops pick it up on their next update check."