#!/usr/bin/env bash
# Make the committed checkout self-sufficient for gates inside a Codex sandbox.

codex_bootstrap_fail() {
  printf 'codex-bootstrap: %s\n' "$1" >&2
  return 1 2>/dev/null || exit 1
}

REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || {
  codex_bootstrap_fail 'not inside a git repo'
  return 1 2>/dev/null || exit 1
}

PATH="$REPO_ROOT/modules/workstation/claude/bin:$HOME/.bun/bin:$REPO_ROOT/node_modules/.bin:$PATH"
export PATH

if ! command -v pnpm >/dev/null 2>&1; then
  if ! command -v corepack >/dev/null 2>&1; then
    codex_bootstrap_fail 'corepack is the missing piece'
    return 1 2>/dev/null || exit 1
  fi

  # Not line-anchored: package.json may be minified onto a single line.
  PM=$(sed -n 's/.*"packageManager"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$REPO_ROOT/package.json" | head -n 1)
  if [ -z "$PM" ]; then
    codex_bootstrap_fail 'packageManager is missing from package.json'
    return 1 2>/dev/null || exit 1
  fi

  corepack enable || { codex_bootstrap_fail 'corepack activation failed'; return 1 2>/dev/null || exit 1; }
  corepack prepare "$PM" --activate || { codex_bootstrap_fail 'corepack activation failed'; return 1 2>/dev/null || exit 1; }
fi

if [ ! -d "$REPO_ROOT/node_modules" ] || [ ! -f "$REPO_ROOT/node_modules/.modules.yaml" ] || [ "$REPO_ROOT/pnpm-lock.yaml" -nt "$REPO_ROOT/node_modules/.modules.yaml" ]; then
  # The private @platform-modules scope resolves to GitHub Packages, whose token
  # lives in ~/.npmrc and is deliberately NOT mirrored into the sandbox. Without
  # it, registry metadata verification fails. Retry fully offline: the warm pnpm
  # store already holds those tarballs and the lockfile's integrity hashes are
  # still enforced, so this resolves the credential gap WITHOUT relaxing any
  # supply-chain policy. If the store lacks them, we still fail closed.
  if ! pnpm install --frozen-lockfile --prefer-offline; then
    printf 'codex-bootstrap: online install failed, retrying from the local store\n' >&2
    pnpm install --frozen-lockfile --offline || {
      codex_bootstrap_fail 'pnpm install failed online and offline (no registry credentials and the store is missing packages)'
      return 1 2>/dev/null || exit 1
    }
  fi
fi

chmod +x "$REPO_ROOT/modules/workstation/claude/bin/local-gate" || { codex_bootstrap_fail 'local-gate failed'; return 1 2>/dev/null || exit 1; }
NODE_VERSION=$(node --version) || { codex_bootstrap_fail 'node failed'; return 1 2>/dev/null || exit 1; }
PNPM_VERSION=$(pnpm --version) || { codex_bootstrap_fail 'pnpm failed'; return 1 2>/dev/null || exit 1; }
BUN_VERSION=$(bun --version) || { codex_bootstrap_fail 'bun failed'; return 1 2>/dev/null || exit 1; }
# local-gate has no --help/--version, and every real flag does work — so the
# probe is PATH resolution only. Never invoke it just to prove it exists.
command -v local-gate >/dev/null || { codex_bootstrap_fail 'local-gate not on PATH'; return 1 2>/dev/null || exit 1; }

printf 'codex-bootstrap: ok node=%s pnpm=%s bun=%s local-gate=present\n' "$NODE_VERSION" "$PNPM_VERSION" "$BUN_VERSION"