#!/usr/bin/env bash
set -euo pipefail

root="$(mktemp -d "${XDG_CACHE_HOME:-$HOME/.cache}/tmpjail-codex-native-XXXXXX")"
trap 'rm -rf "$root"' EXIT
module="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

home="$root/home"
shim_dir="$home/.claude/bin"
package_root="$home/.npm-global/lib/node_modules/@openai/codex"
native="$package_root/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex"

mkdir -p "$shim_dir" "$home/.claude/lib" "$home/.local/state/overdeck/shim-real" \
  "$package_root/bin" "$(dirname "$native")" "$home/.npm-global/bin"
printf '/usr/bin/git\n' >"$home/.local/state/overdeck/shim-real/git"
cat >"$home/.claude/lib/confine.sh" <<'EOF'
#!/usr/bin/env bash
shift
exec "$@"
EOF
chmod +x "$home/.claude/lib/confine.sh"
ln -s "$module/bin/_tmpjail-shim.sh" "$shim_dir/codex"
ln -s ../lib/node_modules/@openai/codex/bin/codex.js "$home/.npm-global/bin/codex"

cat > "$package_root/bin/codex.js" <<'EOF'
#!/usr/bin/env bash
printf 'npm-launcher\n'
EOF
chmod +x "$package_root/bin/codex.js"

cat > "$native" <<'EOF'
#!/usr/bin/env bash
printf '%s|%s|%s\n' "$1" "$CODEX_MANAGED_BY_NPM" "$CODEX_MANAGED_PACKAGE_ROOT"
EOF
chmod +x "$native"

actual="$({
  HOME="$home" \
  PATH="$shim_dir:$home/.npm-global/bin:/usr/bin:/bin" \
  TMPJAIL_ACTIVE=1 \
  AGENT_LEDGER_MUX=0 \
  AGENT_SESSION_SLOT_DIR="$root/slots" \
  "$shim_dir/codex" --version
})"
expected="--version|1|$package_root"

if [[ "$actual" != "$expected" ]]; then
  printf 'expected: %s\nactual:   %s\n' "$expected" "$actual" >&2
  exit 1
fi

rm "$native"
actual="$({
  HOME="$home" \
  PATH="$shim_dir:$home/.npm-global/bin:/usr/bin:/bin" \
  TMPJAIL_ACTIVE=1 \
  AGENT_LEDGER_MUX=0 \
  AGENT_SESSION_SLOT_DIR="$root/slots" \
  "$shim_dir/codex" --version
})"

if [[ "$actual" != "npm-launcher" ]]; then
  printf 'expected fallback: npm-launcher\nactual:            %s\n' "$actual" >&2
  exit 1
fi