#!/usr/bin/env bash
set -euo pipefail

scope=/home/user/.claude/bin/_agent-build-scope
entry=/home/user/.claude/bin/pnpm-entrypoint
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT

mkdir -p "$tmp/home/.claude/bin" "$tmp/home/.claude/lib"
mkdir -p "$tmp/bin"
cat > "$tmp/home/.claude/lib/cpu-guard.sh" <<'EOF'
#!/usr/bin/env bash
printf 'GUARDED %s\n' "$*"
EOF
chmod +x "$tmp/home/.claude/lib/cpu-guard.sh"

# The real confinement script, driven against the fake systemctl/systemd-run below.
cp "$(dirname "${BASH_SOURCE[0]}")/../lib/confine.sh" "$tmp/home/.claude/lib/confine.sh"

cat > "$tmp/bin/systemctl" <<'EOF'
#!/usr/bin/env bash
exit 0
EOF
cat > "$tmp/bin/systemd-run" <<'EOF'
#!/usr/bin/env bash
printf 'SCOPED %s\n' "$*"
while [[ $# -gt 0 && "$1" != -- ]]; do shift; done
shift
exec "$@"
EOF
chmod +x "$tmp/bin/systemctl" "$tmp/bin/systemd-run"

cat > "$tmp/bin/codex" <<'EOF'
#!/usr/bin/env bash
printf 'CODEX %s %s\n' "${AGENT_BUILD_SCOPE_ACTIVE:-unset}" "$PATH"
EOF
chmod +x "$tmp/bin/codex"

path=$(env -i HOME="$tmp/home" PATH=/usr/bin:/bin "$scope" sh -c 'printf %s "$PATH"')
[[ "$path" == "$tmp/home/.claude/bin:"* ]]

scoped=$(env -i HOME="$tmp/home" PATH="$tmp/bin:/usr/bin:/bin" "$scope" printf COMMAND)
[[ "$scoped" == SCOPED*"--slice=agent.slice"*COMMAND ]]

# codex carries no exemption: it is confined like every other agent runtime.
codex_out=$(env -i HOME="$tmp/home" PATH="$tmp/bin:/usr/bin:/bin" "$scope" "$tmp/bin/codex")
[[ "$codex_out" == SCOPED*"--slice=agent.slice"* ]]
[[ "$codex_out" == *"CODEX 1 $tmp/home/.claude/bin:"* ]]

out=$(HOME="$tmp/home" "$entry" run typecheck)
[[ "$out" == "GUARDED /usr/bin/node /usr/share/nodejs/corepack/dist/pnpm.js run typecheck" ]]

for pnpm_path in /home/user/.local/bin/pnpm /home/user/.nvm/versions/node/*/bin/pnpm; do
  [[ -e "$pnpm_path" ]] || continue
  [[ "$(readlink -f "$pnpm_path")" == "$(readlink -f "$entry")" ]]
done

echo PASS