#!/bin/bash
# Read the harness registry and derive per-harness credentials from it.
#
# Source it — the whole point is exporting into the caller's environment, which a subshell
# would lose:
#
#     HARNESS_SCRIPTS_DIR=/workspace/scripts . /workspace/scripts/lib/harness-credentials.sh
#     harness_setup_credentials
#
# Three callers: `harbor-run`, which needs only this; `refresh-harness-auth`, which
# re-derives and rewrites the auth files before an interactive launch; and
# `setup-harnesses.sh`, which sources it and adds installs, config writing and launchers
# on top.
#
# No -e here — this file is SOURCED, and shell options belong to the caller's shell (both
# post-creates run with -e). An unguarded failure below therefore aborts container
# creation, which is why every failure site is individually guarded rather than relying on
# this line.
set -uo pipefail

_HARNESS_REGISTRY_DIR="${HARNESS_SCRIPTS_DIR:-/workspace/scripts}"

# The registry is read with tomllib (stdlib from 3.11), and `python3` is not always new
# enough — macOS ships 3.9, and a container may symlink an older managed interpreter. Pick
# the first one that can actually import it rather than assuming.
_raccoon_python() {
    local p
    for p in "${RACCOON_PYTHON:-}" python3 python3.13 python3.12 python3.11; do
        [ -n "$p" ] || continue
        command -v "$p" >/dev/null 2>&1 || continue
        if "$p" -c "import tomllib" >/dev/null 2>&1; then
            printf '%s' "$p"
            return 0
        fi
    done
    return 1
}

_harness_query() {
    local py
    py=$(_raccoon_python) || return 1
    "$py" "$_HARNESS_REGISTRY_DIR/resolve_harness.py" "$@"
}

# Drop every whitespace character from a value read out of .env. A Windows-saved .env leaves a
# \r on each value, which reaches the proxy as a 401; no key or base URL legitimately contains
# whitespace anywhere, so deleting rather than trimming needs no cases.
_harness_trim() {
    local out
    # Fall back to the raw value: a trim that cannot run must never turn a working key into an
    # empty one, which is what an unavailable `tr` would otherwise do to every caller.
    out="$(printf '%s' "$1" | tr -d '[:space:]' 2>/dev/null)" || out="$1"
    printf '%s' "${out:-$1}"
}

# The proxy root: the worker's ANTHROPIC_BASE_URL minus its provider path.
_harness_proxy_root() {
    local base_url
    base_url="$(_harness_trim "${ANTHROPIC_BASE_URL:-}")"
    [ -n "$base_url" ] || return 1
    base_url="${base_url%"${base_url##*[!/]}"}"
    # ".../llm_proxy/projects/<id>/anthropic" -> ".../llm_proxy/projects/<id>", so each
    # harness's proxy_path composes onto the project route. Requires a path to strip: a base
    # URL that is a bare host with no path — a provider's own API root rather than the
    # proxy — would yield "https:/", handed to codex as a base URL and failing obscurely.
    case "${base_url#*://}" in
        */*) printf '%s' "${base_url%/*}" ;;
        *) return 2 ;;
    esac
}

harness_setup_credentials() {
    # `|| rc=$?` and not a bare assignment: this is sourced into a `set -e` shell (see the
    # note at the top), and a bare failing assignment would exit the caller's post-create
    # outright — silently, since the failure paths below are what do the explaining.
    local root rc=0
    root="$(_harness_proxy_root)" || rc=$?
    if [ "$rc" -ne 0 ]; then
        if [ "$rc" -eq 2 ]; then
            echo "harness-setup: ANTHROPIC_BASE_URL (${ANTHROPIC_BASE_URL:-}) has no provider" >&2
            echo "harness-setup:   path, so it is not the proxy URL other harnesses derive their" >&2
            echo "harness-setup:   credentials from. claude will work; codex will not be" >&2
            echo "harness-setup:   authenticated. Use the base URL you were given." >&2
        else
            echo "harness-setup: ANTHROPIC_BASE_URL unset — skipping credential derivation" >&2
        fi
        return 0
    fi
    ANTHROPIC_BASE_URL="$(_harness_trim "${ANTHROPIC_BASE_URL:-}")"
    export ANTHROPIC_BASE_URL
    local key
    key="$(_harness_trim "${ANTHROPIC_API_KEY:-}")"
    if [ -z "$key" ]; then
        echo "harness-setup: ANTHROPIC_API_KEY unset — skipping credential derivation" >&2
        return 0
    fi
    # harbor-run sources .env itself and passes ANTHROPIC_* through to the trial sandbox, so
    # cleaning only the derived per-harness copies would leave a claude trial carrying the CR.
    export ANTHROPIC_API_KEY="$key"

    local id key_env base_url_env proxy_path
    while IFS=$'\t' read -r id key_env base_url_env proxy_path; do
        [ -n "$key_env" ] || continue
        # ${!name} is an indirect expansion. Only set when empty: an explicit key wins.
        if [ -z "${!key_env:-}" ]; then
            export "$key_env=$key"
        fi
        if [ -n "$base_url_env" ] && [ -n "$proxy_path" ] && [ -z "${!base_url_env:-}" ]; then
            export "$base_url_env=$root/$proxy_path"
        fi
        echo "harness-setup: $id credentials ready ($key_env, ${base_url_env:-no base url})" >&2
    done < <(_harness_query --authoring-credentials 2>/dev/null || true)
}

# Write the auth file for harnesses that read credentials from disk rather than $ENV.
harness_write_auth() {
    local id auth_path key_env target key py
    py=$(_raccoon_python) || {
        echo "harness-setup: no python3.11+ with tomllib — skipping auth files" >&2
        return 0
    }
    while IFS=$'\t' read -r id auth_path key_env; do
        [ -n "$auth_path" ] && [ -n "$key_env" ] || continue
        # Last mile: an explicit OPENAI_API_KEY bypasses the derivation above, so trim here
        # too — this is the value that reaches the file the harness authenticates with.
        key="$(_harness_trim "${!key_env:-}")"
        if [ -z "$key" ]; then
            echo "harness-setup: $key_env unset — skipping $id auth file" >&2
            continue
        fi
        target=$(eval "printf '%s' \"$auth_path\"") || {
            echo "harness-setup: WARNING $id auth_path could not be expanded — skipping" >&2
            continue
        }
        mkdir -p "$(dirname "$target")" || {
            echo "harness-setup: WARNING $id auth dir not creatable — skipping $target" >&2
            continue
        }
        # json.dumps, not printf: a key containing a quote or backslash would otherwise
        # produce a file the CLI cannot parse, and the failure would surface as an auth
        # error rather than a malformed file.
        # 0600 tmp + rename, never a redirect onto the target: a redirect truncates the live
        # file first, so a write dying mid-flight leaves codex an EMPTY auth.json.
        if ! RACCOON_AUTH_K="$key_env" RACCOON_AUTH_V="$key" RACCOON_AUTH_TARGET="$target" \
            "$py" -c 'import json, os
target = os.environ["RACCOON_AUTH_TARGET"]
tmp = target + ".raccoon-tmp." + str(os.getpid())
try:
    with os.fdopen(os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600), "w") as fh:
        json.dump({os.environ["RACCOON_AUTH_K"]: os.environ["RACCOON_AUTH_V"]}, fh)
        fh.write("\n")
    os.replace(tmp, target)
except OSError:
    try:
        os.unlink(tmp)
    except OSError:
        pass
    raise SystemExit(1)
'; then
            echo "harness-setup: WARNING $id auth file NOT written — $target unwritable." >&2
            echo "harness-setup:   the key already on disk (if any) is left untouched." >&2
            continue
        fi
        echo "harness-setup: $id auth -> $target" >&2
    done < <(_harness_query --auth-files 2>/dev/null || true)
}

# Re-set just the root keys of a harness's config file (codex's `openai_base_url`),
# leaving every other line — the explore surface's [hooks] table included — untouched.
harness_refresh_config_keys() {
    local id config_path blob target py
    py=$(_raccoon_python) || return 0
    # The surface only decides what a CREATE writes. An update takes the root keys off the
    # front of the same blob, so a surface's tables survive byte-for-byte either way.
    while IFS=$'\t' read -r id config_path blob; do
        [ -n "$config_path" ] && [ -n "$blob" ] || continue
        target=$(eval "printf '%s' \"$config_path\"") || continue
        mkdir -p "$(dirname "$target")" || continue
        if printf '%s' "$blob" | base64 -d |
            RACCOON_CONFIG_TARGET="$target" "$py" -c '
import os, re, sys, tomllib

HEADER = "# Generated from harness-registry.toml — edits here are overwritten."

target = os.environ["RACCOON_CONFIG_TARGET"]
text = sys.stdin.read()
# Empty counts as unresolved: writing an empty base URL would break a container whose
# config is currently right, which is the one thing this must never do.
if [m for m in re.finditer(r"\$\{(\w+)\}", text) if not os.environ.get(m.group(1))]:
    raise SystemExit(1)
text = os.path.expandvars(text)

wanted = []
for line in text.splitlines():
    if line.lstrip().startswith("["):
        break
    m = re.match(r"\s*([A-Za-z0-9_-]+)\s*=", line)
    if m:
        wanted.append((m.group(1), line.rstrip()))
if not wanted:
    raise SystemExit(0)

mode = None
if os.path.exists(target):
    try:
        with open(target, encoding="utf-8") as fh:
            lines = fh.read().splitlines()
        mode = os.stat(target).st_mode & 0o777
    except OSError:
        raise SystemExit(1)
    # Everything from the first table header on belongs to a table. A key appended after
    # one is reparented into it, so both the search and the insert stay above the line.
    root_end = next((i for i, l in enumerate(lines) if l.lstrip().startswith("[")), len(lines))
    changed = False
    for key, line in wanted:
        # The quoted spelling is the same key: replacing it beats adding a duplicate.
        pat = re.compile(r"\s*\"?" + re.escape(key) + r"\"?\s*=")
        at = next((i for i in range(root_end) if pat.match(lines[i])), None)
        if at is None:
            if root_end < len(lines) and lines[root_end].strip():
                lines.insert(root_end, "")
            lines.insert(root_end, line)
            root_end += 1
            changed = True
        elif lines[at] != line:
            lines[at] = line
            changed = True
    if not changed:
        raise SystemExit(0)
    out = "\n".join(lines).rstrip("\n") + "\n"
else:
    # No file means container-create could not write one, so write what it would have:
    # on the explore surface that is the capture hooks too, not just the root keys.
    out = HEADER + "\n" + text

try:
    doc = tomllib.loads(out)
except tomllib.TOMLDecodeError:
    raise SystemExit(1)
# Parsing is not enough: a line edit can land inside a multi-line value, which still
# parses while leaving the key unset. Require every key to have reached the root.
if doc != {**doc, **tomllib.loads("\n".join(line for _, line in wanted))}:
    raise SystemExit(1)

# Pid-suffixed: two launches at once must not write the same scratch path.
tmp = target + ".raccoon-tmp." + str(os.getpid())
try:
    with open(tmp, "w", encoding="utf-8") as fh:
        fh.write(out)
    if mode is not None:
        os.chmod(tmp, mode)
    os.replace(tmp, target)
except OSError:
    try:
        os.unlink(tmp)
    except OSError:
        pass
    raise SystemExit(1)
'; then
            echo "harness-setup: $id config keys refreshed -> $target" >&2
        fi
    done < <(_harness_query --container-configs --surface "${RACCOON_SURFACE:-authoring}" 2>/dev/null || true)
}