#!/bin/bash
set -euo pipefail
proof_policy_dir="$(cd -- "$(dirname -- "$0")" && pwd)/policy"
proof_uid="$(id -u)"
proof_gid="$(id -g)"
proof_home="$HOME"
proof_cli="$(command -v codex)"
exec sudo -n -E unshare --mount --propagation private bash -c '
  mount --bind "$1" /etc/codex
  proof_uid="$2"; proof_gid="$3"; proof_home="$4"; proof_cli="$5"
  shift 5
  exec setpriv --reuid="$proof_uid" --regid="$proof_gid" --init-groups env HOME="$proof_home" "$proof_cli" "$@"
' policy-wrapper "$proof_policy_dir" "$proof_uid" "$proof_gid" "$proof_home" "$proof_cli" "$@"
