#!/usr/bin/env bash
set -euo pipefail

ROOT="$(mktemp -d)"
trap 'rm -rf "$ROOT"' EXIT
MODULE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
! grep -q 'OVERDECK_SEAT_SCOPE_ENTRY' "$MODULE/bin/_agent-session-tmux" || {
  printf 'authority path must not be environment-selectable\n' >&2; exit 1;
}
BIN="$ROOT/bin"
HOME_DIR="$ROOT/home"
STATE="$HOME_DIR/.local/state/agent-sessions"
mkdir -p "$BIN" "$HOME_DIR/.claude/lib" "$STATE/sessions"
cp "$MODULE/lib/agent-session-reader.mjs" "$HOME_DIR/.claude/lib/agent-session-reader.mjs"

cat > "$BIN/sudo" <<'SH'
#!/usr/bin/env bash
[[ "$1" == -n ]] || exit 90
shift
exec "$@"
SH
cat > "$BIN/authority" <<'SH'
#!/usr/bin/env bash
printf '%s\0' "$@" > "$AUTH_CAPTURE"
exit 23
SH
chmod +x "$BIN/sudo" "$BIN/authority"
launcher="$ROOT/_agent-session-tmux"
python3 - "$MODULE/bin/_agent-session-tmux" "$launcher" "$BIN/authority" <<'PY'
import sys
text=open(sys.argv[1], encoding='utf-8').read()
text=text.replace('SELF_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"', f'SELF_DIR={sys.argv[1].rsplit("/", 1)[0]!r}')
text=text.replace('/usr/local/bin/overdeck-seat-scope-entry', sys.argv[3])
open(sys.argv[2], 'w', encoding='utf-8').write(text)
PY
chmod +x "$launcher"

id=local-authority-test
printf '{"schemaVersion":1,"ledgerId":"%s","runtime":"stub","cwd":"%s","startedAt":"2026-08-13T00:00:00.000Z","finishedAt":null,"mux":{"kind":null}}\n' \
  "$id" "$ROOT" > "$STATE/sessions/$id.json"

socket_key="$(printf '%s' "$id" | sha256sum | cut -c1-32)"
socket="$STATE/sock/$socket_key/tmux.sock"
set +e
HOME="$HOME_DIR" PATH="$BIN:$PATH" AGENT_LEDGER_ID="$id" \
AGENT_LEDGER_MUX_SOCKET="$socket" AGENT_LEDGER_MUX_TARGET=main \
AGENT_LEDGER_MUX_ATTACH=0 AGENT_LEDGER_MUX_JAILED=1 AUTH_CAPTURE="$ROOT/args" \
bash "$launcher" /bin/sh -c 'exit 23'
rc=$?
set -e
[[ "$rc" == 23 ]] || { printf 'expected exact 23, got %s\n' "$rc" >&2; exit 1; }
python3 - "$ROOT/args" "$id" "$socket" <<'PY'
import sys
args=[x for x in open(sys.argv[1],'rb').read().decode().split('\0') if x]
required=['--local-session','--seat-id',sys.argv[2],'--socket',sys.argv[3],'--cwd','--reap-identity','--']
for item in required:
    assert item in args, (item,args)
assert args[-4].endswith('/_agent-session-admission'), args
assert args[-3:] == ['/bin/sh','-c','exit 23'], args
PY
cat > "$BIN/tmpjail" <<'SH'
#!/usr/bin/env bash
exec "$@"
SH
chmod +x "$BIN/tmpjail"
set +e
HOME="$HOME_DIR" PATH="$BIN:$PATH" AGENT_LEDGER_ID="$id" \
AGENT_LEDGER_MUX_SOCKET="$socket" AGENT_LEDGER_MUX_TARGET=main \
AGENT_LEDGER_MUX_ATTACH=0 AGENT_LEDGER_MUX_JAILED=0 AUTH_CAPTURE="$ROOT/unjailed-args" \
bash "$launcher" /bin/sh -c 'exit 23'
rc=$?
set -e
[[ "$rc" == 23 ]] || { printf 'expected exact unjailed 23, got %s\n' "$rc" >&2; exit 1; }
python3 - "$ROOT/unjailed-args" "$BIN/tmpjail" <<'PY'
import sys
args=[x for x in open(sys.argv[1],'rb').read().decode().split('\0') if x]
assert args[-4] == sys.argv[2], args
assert args[-3:] == ['/bin/sh','-c','exit 23'], args
PY
printf 'agent-session-local-authority: ok\n'