#!/bin/bash

# Ensure a command was passed
if [ $# -eq 0 ]; then
    echo "Usage: ai-jail <command> [args...]"
    exit 1
fi

# Get the absolute path of the current working directory
PROJECT_DIR=$(pwd)

# Ensure the host directories exist so bubblewrap can mount them
mkdir -p "$HOME/.grok"
mkdir -p "$HOME/.npm"
mkdir -p "$HOME/.cache"

# Launch bubblewrap
bwrap \
    --ro-bind /usr /usr \
    --ro-bind /lib /lib \
    --ro-bind /lib64 /lib64 \
    --ro-bind /bin /bin \
    --ro-bind /sbin /sbin \
    --ro-bind /etc /etc \
    --dev /dev \
    --proc /proc \
    --tmpfs /tmp \
    --tmpfs /home/$(whoami) \
    --bind "$HOME/.grok" "$HOME/.grok" \
    --bind "$HOME/.npm" "$HOME/.npm" \
    --bind "$HOME/.cache" "$HOME/.cache" \
    --ro-bind-try "$HOME/.gitconfig" "$HOME/.gitconfig" \
    --ro-bind-try "$HOME/.config/git" "$HOME/.config/git" \
    --ro-bind-try "$HOME/.npmrc" "$HOME/.npmrc" \
    --bind "$PROJECT_DIR" "$PROJECT_DIR" \
    --chdir "$PROJECT_DIR" \
    --share-net \
    --die-with-parent \
    --unshare-pid \
    --unshare-uts \
    --unshare-ipc \
    --unshare-cgroup \
    "$@"