#!/usr/bin/env bash
# In-container entrypoint for one harness seat. Seeds credentials from the read-only
# /seed mount into the tmpfs HOME, then execs the WRAPPER-CONTRACT wrapper unchanged.
#
# Exit codes are the wrapper's own — this file never invents one except 2 (its own
# usage error). exec means the wrapper's rc is the container's rc.
set -uo pipefail

WRAPPER="" WORKSPACE="" TASK_SLUG="" MODEL="" TIMEOUT="" PROFILE="" RESUME="" THREAD_ID="" LOG_DIR=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --wrapper)   WRAPPER="${2:-}";   shift 2;;
    --workspace) WORKSPACE="${2:-}"; shift 2;;
    --task-slug) TASK_SLUG="${2:-}"; shift 2;;
    --model)     MODEL="${2:-}";     shift 2;;
    --timeout)   TIMEOUT="${2:-}";   shift 2;;
    --profile)   PROFILE="${2:-}";   shift 2;;
    --resume)    RESUME="${2:-}";    shift 2;;
    --thread-id) THREAD_ID="${2:-}"; shift 2;;
    --log-dir)   LOG_DIR="${2:-}";   shift 2;;
    *) echo "{\"ok\":false,\"detail\":\"seat-entrypoint: unknown arg $1\"}" >&2; exit 2;;
  esac
done

[[ -x "$WRAPPER" || -f "$WRAPPER" ]] || { echo '{"ok":false,"detail":"seat-entrypoint: wrapper missing in workspace mount"}' >&2; exit 2; }
[[ -d "$WORKSPACE" ]] || { echo '{"ok":false,"detail":"seat-entrypoint: workspace missing"}' >&2; exit 2; }
[[ -f /seed/prompt.txt ]] || { echo '{"ok":false,"detail":"seat-entrypoint: /seed/prompt.txt missing"}' >&2; exit 2; }
[[ -n "$TASK_SLUG" ]] || { echo '{"ok":false,"detail":"seat-entrypoint: --task-slug required"}' >&2; exit 2; }

# Its own tmpfs, not a subdir of /tmp: codex refuses to create its PATH helper binaries when
# CODEX_HOME resolves under a temporary directory, and warns on every run.
export HOME=/seat-home
mkdir -p "$HOME" || { echo '{"ok":false,"detail":"seat-entrypoint: HOME tmpfs not writable"}' >&2; exit 2; }
chmod 0700 "$HOME"

# Credentials are copied, never bind-mounted writable: a refreshed token stays inside
# this container and dies with it, so a seat can never rewrite the host's credentials.
seed_copy() {
  local src="$1" dest="$2"
  [[ -f "$src" ]] || return 0
  mkdir -p "$(dirname "$dest")" && install -m 0600 "$src" "$dest"
}
seed_copy /seed/claude/.credentials.json "$HOME/.claude/.credentials.json"
seed_copy /seed/codex/auth.json          "$HOME/.codex/auth.json"
seed_copy /seed/codex/config.toml        "$HOME/.codex/config.toml"
seed_copy /seed/cursor/auth.json         "$HOME/.config/cursor/auth.json"

export HARNESS_SEAT_CONTAINER=1
export TMPDIR=/tmp
[[ -n "$LOG_DIR" ]] && { mkdir -p "$LOG_DIR" || { echo '{"ok":false,"detail":"seat-entrypoint: log dir not writable"}' >&2; exit 2; }; export HARNESS_LOG_DIR="$LOG_DIR"; }

PROMPT="$(< /seed/prompt.txt)"

ARGS=("$WRAPPER" --workspace "$WORKSPACE" --trust "$PROMPT" --task-slug "$TASK_SLUG")
[[ -n "$MODEL" ]]     && ARGS+=(--model "$MODEL")
[[ -n "$TIMEOUT" ]]   && ARGS+=(--timeout "$TIMEOUT")
[[ -n "$PROFILE" ]]   && ARGS+=(--profile "$PROFILE")
[[ -n "$RESUME" ]]    && ARGS+=(--resume "$RESUME")
[[ -n "$THREAD_ID" ]] && ARGS+=(--thread-id "$THREAD_ID")

cd "$WORKSPACE" || { echo '{"ok":false,"detail":"seat-entrypoint: cd workspace failed"}' >&2; exit 2; }
exec bash "${ARGS[@]}" < /dev/null