#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "$ROOT_DIR"

ENV_FILE=""

while [ "$#" -gt 0 ]; do
  case "$1" in
    --env)
      ENV_FILE="${2:-}"
      shift 2
      ;;
    -h|--help)
      echo "Usage: ./scripts/deploy/start.sh [--env PATH]"
      exit 0
      ;;
    *)
      echo "Unknown option: $1" >&2
      exit 1
      ;;
  esac
done

if [ -n "$ENV_FILE" ]; then
  if [ ! -f "$ENV_FILE" ]; then
    echo "Environment file not found: $ENV_FILE" >&2
    exit 1
  fi
  set -a
  # shellcheck disable=SC1090
  . "$ENV_FILE"
  set +a
fi

if [ -z "${SEELE_ROOT:-}" ]; then
  echo "SEELE_ROOT is required." >&2
  echo "Set it in seele.env to the confirmed Seele root directory." >&2
  exit 1
fi
export SEELE_ROOT
RUNTIME_DIR="${SEELE_RUNTIME_DIR:-$SEELE_ROOT/.runtime}"
export SEELE_RUNTIME_DIR="$RUNTIME_DIR"
export SEELE_CODEX_HOST="${SEELE_CODEX_HOST:-0.0.0.0}"
export SEELE_CODEX_PORT="${SEELE_CODEX_PORT:-3000}"
export SEELE_CODEX_WORKSPACE_ROOT="${SEELE_CODEX_WORKSPACE_ROOT:-$SEELE_ROOT/workspaces}"
export SEELE_CODEX_WEB_DIST="${SEELE_CODEX_WEB_DIST:-$ROOT_DIR/web/dist}"

export NO_PROXY="${NO_PROXY:-127.0.0.1,localhost,.svc,.cluster.local}"
export no_proxy="$NO_PROXY"

SERVER_BIN="${SEELE_SERVER_BIN:-$ROOT_DIR/libexec/seele-server}"
WORKER_BIN="${SEELE_WORKER_BIN:-$ROOT_DIR/libexec/seele-worker}"
if [ ! -x "$SERVER_BIN" ] && [ -x "$ROOT_DIR/target/release/seele-server" ]; then
  SERVER_BIN="$ROOT_DIR/target/release/seele-server"
fi
if [ ! -x "$WORKER_BIN" ] && [ -x "$ROOT_DIR/target/release/seele-worker" ]; then
  WORKER_BIN="$ROOT_DIR/target/release/seele-worker"
fi
if [ ! -x "$SERVER_BIN" ] || [ ! -x "$WORKER_BIN" ] || [ ! -f "$SEELE_CODEX_WEB_DIST/index.html" ]; then
  echo "Build output is missing. Run ./scripts/deploy/bootstrap.sh first." >&2
  exit 1
fi
export SEELE_WORKER_BIN="$WORKER_BIN"

# Prepare the local no-auth proxy entrypoint when an upstream proxy with
# credentials is configured. Codex's models-refresh / MCP HTTP clients send a
# bare HTTP CONNECT without proxy credentials; an authenticated upstream then
# replies 407 and resets the stream. prepare-proxy.sh runs a local no-auth
# listener (SEELE_PROXY) that forwards to the credentialed upstream
# (SEELE_UPSTREAM_PROXY). It is idempotent, so a restart re-syncs it.
# Skipped when SEELE_UPSTREAM_PROXY is unset (legacy single-proxy mode).
if [ -n "${SEELE_UPSTREAM_PROXY:-}" ]; then
  echo "Preparing local no-auth proxy entrypoint (SEELE_UPSTREAM_PROXY is set)..."
  PREPARE_PROXY="$ROOT_DIR/scripts/deploy/prepare-proxy.sh"
  if [ ! -x "$PREPARE_PROXY" ]; then
    echo "prepare-proxy.sh not found or not executable at $PREPARE_PROXY" >&2
    exit 1
  fi
  if [ -n "$ENV_FILE" ]; then
    "$PREPARE_PROXY" --env "$ENV_FILE"
  else
    "$PREPARE_PROXY"
  fi
fi

mkdir -p "$SEELE_CODEX_WORKSPACE_ROOT"

echo "Starting Seele on http://$SEELE_CODEX_HOST:$SEELE_CODEX_PORT"
echo "Workspace root: $SEELE_CODEX_WORKSPACE_ROOT"
echo "Server runtime: $SERVER_BIN"
echo "Worker runtime: $SEELE_WORKER_BIN"

exec "$SERVER_BIN"