#!/bin/sh
set -eu
APP_DIR="${TRIM_APPDEST:?}"
ETC_DIR="${TRIM_PKGETC:?}"
VAR_DIR="${TRIM_PKGVAR:?}"
BIN="$APP_DIR/bin/pdc-fnos-agent"
NODE="$APP_DIR/bin/node"
MANAGER="$APP_DIR/manager/manager.cjs"
PID="$VAR_DIR/agent.pid"
MANAGER_PID="$VAR_DIR/manager.pid"
LOG="$VAR_DIR/agent.log"
MANAGER_LOG="$VAR_DIR/manager.log"
TOKEN="$ETC_DIR/agent.token"
PROXY_TOKEN="$ETC_DIR/gateway.token"

running() {
  [ -f "$PID" ] || return 1
  p="$(cat "$PID" 2>/dev/null || true)"
  case "$p" in *[!0-9]*|"") return 1;; esac
  kill -0 "$p" 2>/dev/null || return 1
  ps -p "$p" -o args= 2>/dev/null | grep -q '[p]dc-fnos-agent'
}
manager_running() {
  [ -s "$MANAGER_PID" ] || return 1
  p="$(cat "$MANAGER_PID" 2>/dev/null || true)"
  case "$p" in *[!0-9]*|"") return 1;; esac
  kill -0 "$p" 2>/dev/null || return 1
  ps -p "$p" -o args= 2>/dev/null | grep -F -q 'manager.cjs'
}

case "${1:-}" in
  start)
    if running && manager_running; then exit 0; fi
    umask 077
    mkdir -p "$ETC_DIR" "$VAR_DIR" "$VAR_DIR/workspace"
    if [ ! -s "$TOKEN" ]; then
      od -An -N32 -tx1 /dev/urandom | tr -d '[:space:]' > "$TOKEN"
      chmod 600 "$TOKEN"
    fi
    if [ ! -s "$PROXY_TOKEN" ]; then
      od -An -N32 -tx1 /dev/urandom | tr -d '[:space:]' > "$PROXY_TOKEN"
      chmod 600 "$PROXY_TOKEN"
    fi
    [ -x "$NODE" ] && [ -s "$MANAGER" ] || { echo "Shared Node Manager missing" >&2; exit 1; }
    [ -s "$APP_DIR/agent/agent.cjs" ] &&
    [ -s "$APP_DIR/agent/node_modules/@wonderwhy-er/desktop-commander/dist/index.js" ] ||
      { echo "Shared desktop Agent missing" >&2; exit 1; }
    mkdir -p "$ETC_DIR/.private-desktop-commander"
    # Expose native NAS tools through the SAME shared extension registry.
    # Do not auto-run or auto-approve executable extensions. Preserve any
    # owner-installed or locally modified version on future FPK upgrades.
    BUILTIN="$ETC_DIR/.private-desktop-commander/extensions/fnos-native"
    if [ ! -e "$BUILTIN" ]; then
      mkdir -p "$BUILTIN"
      cp "$APP_DIR/agent/fnos-native/manifest.json" "$BUILTIN/manifest.json"
      cp "$APP_DIR/agent/fnos-native/index.cjs" "$BUILTIN/index.cjs"
      chmod 600 "$BUILTIN/manifest.json" "$BUILTIN/index.cjs"
    fi
    # Upgrade Go-only v0.3: migrate the existing pair once, without logging credentials.
    if [ -s "$ETC_DIR/relay.json" ] &&
       [ ! -s "$ETC_DIR/.private-desktop-commander/device.json" ]; then
      "$NODE" -e '
        const fs=require("fs");
        const previous=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
        if(previous.deviceId && previous.deviceToken && previous.serverUrl) {
          fs.writeFileSync(process.argv[2],JSON.stringify({
            serverUrl:previous.serverUrl,deviceId:previous.deviceId,deviceToken:previous.deviceToken
          },null,2),{flag:"wx",mode:0o600});
        }
      ' "$ETC_DIR/relay.json" "$ETC_DIR/.private-desktop-commander/device.json"
    fi
    HOME="$ETC_DIR"
    PORT=58622
    PDC_MANAGER_PROXY_TOKEN_FILE="$PROXY_TOKEN"
    PDC_AGENT_DIR="$APP_DIR/agent"
    PDC_AGENT_ENTRY="$APP_DIR/agent/agent.cjs"
    PDC_EXTENSION_HOST_ENTRY="$APP_DIR/agent/host.cjs"
    PDC_DESKTOP_COMMANDER_ENTRY="$APP_DIR/agent/node_modules/@wonderwhy-er/desktop-commander/dist/index.js"
    PDC_SHARED_AGENT=1
    export HOME PORT PDC_MANAGER_PROXY_TOKEN_FILE PDC_AGENT_DIR PDC_AGENT_ENTRY PDC_EXTENSION_HOST_ENTRY PDC_DESKTOP_COMMANDER_ENTRY PDC_SHARED_AGENT
    if ! manager_running; then
      nohup "$NODE" "$MANAGER" >>"$MANAGER_LOG" 2>&1 &
      echo "$!" > "$MANAGER_PID"
    fi
    [ -x "$BIN" ] || { echo "PDC agent binary missing" >&2; exit 1; }
    PDC_AGENT_TOKEN_FILE="$TOKEN"
    PDC_AGENT_PORT="${TRIM_SERVICE_PORT:-58621}"
    PDC_ALLOWED_ROOTS="$VAR_DIR/workspace"
    if [ -s "$ETC_DIR/allowed-roots" ]; then
      PDC_ALLOWED_ROOTS="$(tr '\n' ':' < "$ETC_DIR/allowed-roots" | sed 's/:$//')"
    fi
    PDC_DATA_DIR="$VAR_DIR"
    PDC_CONFIG_DIR="$ETC_DIR"
    PDC_DOCKER_ACTIONS_FILE="$ETC_DIR/docker-actions.enabled"
    PDC_UI_DIR="$APP_DIR/ui/web"
    PDC_GATEWAY_SOCKET="$APP_DIR/app.sock"
    PDC_SERVICE_LOG="$LOG"
    PDC_ENABLE_DOCKER_ACTIONS=0
    if [ -f "$ETC_DIR/docker-actions.enabled" ] && [ "$(cat "$ETC_DIR/docker-actions.enabled")" = 1 ]; then
      PDC_ENABLE_DOCKER_ACTIONS=1
    fi
    export PDC_AGENT_TOKEN_FILE PDC_AGENT_PORT PDC_ALLOWED_ROOTS PDC_DATA_DIR PDC_CONFIG_DIR PDC_ENABLE_DOCKER_ACTIONS PDC_DOCKER_ACTIONS_FILE PDC_UI_DIR PDC_GATEWAY_SOCKET PDC_SERVICE_LOG
    if ! running; then
      nohup "$BIN" >>"$LOG" 2>&1 &
      echo "$!" > "$PID"
    fi
    sleep 1
    { running && manager_running; } || { echo "PDC gateway or shared Manager failed to start" >&2; exit 1; }
    ;;
  stop)
    if running; then kill "$(cat "$PID")"; fi
    if manager_running; then kill "$(cat "$MANAGER_PID")"; fi
    sleep 2
    if ! running; then rm -f "$PID"; fi
    if ! manager_running; then rm -f "$MANAGER_PID"; fi
    # Avoid removing another process's socket; only remove if our Agent is stopped.
    if ! running && [ -S "$APP_DIR/app.sock" ]; then rm -f "$APP_DIR/app.sock"; fi
    ;;
  status)
    if running && manager_running; then exit 0; else exit 3; fi
    ;;
  *) echo "usage: $0 start|stop|status" >&2; exit 2;;
esac
