#!/usr/bin/env bash
# Launch one deployment emergency seat outside the consumer's service cgroup.
set -euo pipefail

if [[ $# -ne 3 ]]; then
  printf 'usage: %s <row-id> <signature> <fire-detail>\n' "$0" >&2
  exit 64
fi

ROW_ID=$1
SIGNATURE=$2
FIRE_DETAIL=$3
case "$ROW_ID" in
  *[!A-Za-z0-9._-]*|'') printf 'invalid incident row id\n' >&2; exit 64 ;;
esac

MODULE_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_ROOT="$(cd "$MODULE_DIR/../.." && pwd)"
BRIEF="$REPO_ROOT/docs/agents/deploy-incident-agent.md"
STATE_ROOT="${XDG_STATE_HOME:-${HOME}/.local/state}/overdeck/fire-agent"
TRANSCRIPT="$STATE_ROOT/$ROW_ID.log"
mkdir -p -m 700 "$STATE_ROOT"

# Deliberately split only the operator-configured command into argv. The incident
# context remains one argument and is never evaluated as shell syntax.
read -r -a AGENT_COMMAND <<<"${OVERDECK_FIRE_AGENT_CMD:-claude -p}"
if [[ ${#AGENT_COMMAND[@]} -eq 0 ]]; then
  printf 'OVERDECK_FIRE_AGENT_CMD is empty\n' >&2
  exit 64
fi

PROMPT="$(cat "$BRIEF")

## Incident assigned to this emergency seat

Row: $ROW_ID
Signature: $SIGNATURE
Fire detail:
$FIRE_DETAIL
"

# No MemoryHigh/MemoryMax transient properties: those have caused kernel OOM kills.
systemd-run --user --scope --slice=agent.slice -- "${AGENT_COMMAND[@]}" "$PROMPT" >"$TRANSCRIPT" 2>&1