#!/usr/bin/env bash
# Wrapper-layer remote-seat shim. Sourced by a WRAPPER-CONTRACT wrapper AFTER its own arg
# validation and inspection modes, so bad args still fail locally with exit 2 and --health /
# --list-models never pay an ssh round-trip.
#
# seat_remote_dispatch returns 1 when this adapter is not remoted — the wrapper then continues
# down its normal local path unchanged. When it IS remoted the function never returns: it exits
# with the launcher's rc, which is the wrapper's rc.
#
# Launcher rc 70 also means "run it here": remoting is switched off in build-remote.json for this
# repo. A broken or busy buildbox is rc 3, never a fallback onto the workstation.
#
# Enable/disable is CONFIG (modules/harness/seat/seat-remote.json) only; there is no env kill
# switch. When the launcher says run-locally, local execution is still subject to
# local-dispatch-guard, which denies a headless dispatch with exit 97.
#
# Account provenance: only adapters that select credentials via --profile (codex) may journal
# account. ca/grok/na ignore --profile — never claim seat role or an ignored profile as account.

seat_remote_dispatch() {
  local adapter="$1" wrapper_file="$2" workspace="$3" prompt="$4" slug="$5" model="$6" timeout="$7" profile="$8" permission_mode="${9:-}" cont_flag="${10:-}" cont_id="${11:-}"
  if [[ "$adapter" != "codex" ]]; then
    cont_flag="$permission_mode"
    cont_id="${10:-}"
    permission_mode=""
  fi

  [[ "${HARNESS_SEAT_CONTAINER:-}" == "1" ]] && return 1

  # This shim shipping without the seat stack beside it is a broken deployment, not an opt-out:
  # returning 1 here would silently run the model on the workstation. Engine bundles cut before
  # `seat` entered the release manifest did exactly that.
  local seat_dir launcher
  seat_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../seat" 2>/dev/null && pwd)" \
    || { echo '{"ok":false,"detail":"seat stack missing beside wrappers/lib — engine bundle is incomplete"}' >&2; exit 3; }
  launcher="$seat_dir/remote-seat.mjs"
  [[ -f "$launcher" ]] \
    || { echo "{\"ok\":false,\"detail\":\"seat launcher missing: $launcher\"}" >&2; exit 3; }
  command -v node >/dev/null 2>&1 \
    || { echo '{"ok":false,"detail":"node not on PATH — seat launcher cannot run"}' >&2; exit 3; }

  if [[ "$adapter" == "codex" ]]; then
    if [[ "$slug" == incident-* ]]; then
      [[ "$permission_mode" == "safe" ]] \
        || { echo '{"ok":false,"detail":"remote incident codex requires safe permission mode"}' >&2; exit 2; }
    else
      [[ -z "$permission_mode" || "$permission_mode" == "safe" || "$permission_mode" == "unsafe" ]] \
        || { echo '{"ok":false,"detail":"remote codex permission mode is invalid"}' >&2; exit 2; }
      [[ "$permission_mode" != "unsafe" ]] || return 1
    fi
  fi

  node "$launcher" --check "$adapter"
  local check_rc=$?
  if [[ $check_rc -ne 0 ]]; then
    [[ "$adapter" == "codex" && "$slug" == incident-* ]] \
      && { echo '{"ok":false,"detail":"remote incident codex is unavailable; local fallback refused"}' >&2; exit 3; }
    return 1
  fi

  local seat="${HARNESS_SEAT:-$adapter}"
  local account=""
  if [[ "$adapter" == "codex" && -n "$profile" ]]; then
    account="$profile"
  fi
  if [[ -n "$account" ]]; then
    printf '%s\n' "{\"kind\":\"seat.remote\",\"seat\":\"$seat\",\"account\":\"$account\",\"adapter\":\"$adapter\"}" >&2
  else
    printf '%s\n' "{\"kind\":\"seat.remote\",\"seat\":\"$seat\",\"adapter\":\"$adapter\"}" >&2
  fi

  local args=(--adapter "$adapter" --wrapper "$wrapper_file" --workspace "$workspace" --trust "$prompt" --task-slug "$slug")
  [[ -n "$model" ]]   && args+=(--model "$model")
  [[ -n "$timeout" ]] && args+=(--timeout "$timeout")
  if [[ "$adapter" == "codex" && -n "$profile" ]]; then
    args+=(--profile "$profile")
  fi
  if [[ "$adapter" == "codex" && -n "$permission_mode" ]]; then
    args+=(--permission-mode "$permission_mode")
  fi
  [[ -n "$cont_flag" && -n "$cont_id" ]] && args+=("$cont_flag" "$cont_id")

  node "$launcher" "${args[@]}"
  local rc=$?
  if [[ $rc -eq 70 ]]; then
    [[ "$adapter" == "codex" && "$slug" == incident-* ]] \
      && { echo '{"ok":false,"detail":"remote incident codex is disabled; local fallback refused"}' >&2; exit 3; }
    return 1
  fi
  exit $rc
}