#!/usr/bin/env bash
# Parameterized version of the isolated Linux fixture and app launch used for this proof.
# Usage: ./reproduce.sh WORKTREE SCRATCH_DIRECTORY
set -euo pipefail
worktree=$(realpath "$1")
scratch=$(realpath "$2")
mkdir -p "$scratch/prefix"
npm install -g --prefix "$scratch/prefix" @openai/codex@0.166.0
sudo chown -R root:root "$scratch/prefix"
sudo mkdir -p "$scratch/prefix/codex-home" "$scratch/prefix/writable"
sudo chown "$(id -u):$(id -g)" "$scratch/prefix/codex-home" "$scratch/prefix/writable"
npm install -g --prefix "$scratch/prefix/writable" @openai/codex@0.166.0
vp_binary=$(command -v vp)
export T3CODE_DEV_AUTH_TOKEN=${T3CODE_DEV_AUTH_TOKEN:-$(openssl rand -hex 32)}
# One fresh .t3 per checkout. Never seed from an installed app.
sudo --preserve-env=T3CODE_DEV_AUTH_TOKEN unshare --mount --uts bash -s -- \
  "$worktree" "$scratch/prefix" "$(id -un)" "$vp_binary" <<'NAMESPACE'
set -euo pipefail
mount --make-rprivate /
mount --bind "$2" /usr/local
hostname provider-proof
cd "$1"
exec sudo -u "$3" env T3CODE_DEV_SEED=0 \
  T3CODE_DEV_AUTH_TOKEN="$T3CODE_DEV_AUTH_TOKEN" \
  T3CODE_OTLP_METRICS_URL= T3CODE_OTLP_LOGS_URL= T3CODE_OTLP_TRACES_URL= \
  "$4" run dev
NAMESPACE