#!/usr/bin/env bash
set -euo pipefail
# Run from an installed, clean checkout. Keep this file beside tls-proxy.cjs.
checkout=${1:?Usage: reproduce.sh CHECKOUT OUTPUT_DIRECTORY}
output_root=${2:?Usage: reproduce.sh CHECKOUT OUTPUT_DIRECTORY}
script_dir=$(cd -- "$(dirname -- "$0")" && pwd)
run_dir="$output_root/$(date -u +%Y%m%dT%H%M%SZ)"
mkdir -p "$run_dir"
cp "$script_dir/tls-proxy.cjs" "$run_dir/tls-proxy.cjs"
openssl req -x509 -newkey rsa:2048 -nodes \
  -keyout "$run_dir/proxy-key.pem" -out "$run_dir/proxy-cert.pem" \
  -days 1 -subj /CN=api2.cursor.sh -addext subjectAltName=DNS:api2.cursor.sh \
  > "$run_dir/certificate.log" 2>&1
node "$run_dir/tls-proxy.cjs" > "$run_dir/proxy.log" 2>&1 &
proxy_pid=$!
cleanup() {
  kill -TERM -- "-$app_pid" 2>/dev/null || true
  kill -TERM "$proxy_pid" 2>/dev/null || true
}
cd "$checkout"
setsid env -u CURSOR_API_KEY NODE_USE_ENV_PROXY=1 \
  HTTPS_PROXY=http://127.0.0.1:18879 HTTP_PROXY=http://127.0.0.1:18879 \
  NO_PROXY=localhost,127.0.0.1 T3CODE_DEV_SEED=0 \
  vp run dev > "$run_dir/server.log" 2>&1 &
app_pid=$!
trap cleanup EXIT INT TERM
printf 'Private run output: %s\n' "$run_dir"
printf '%s\n' 'Pair using the startup URL in server.log. Do not publish that URL.'
printf '%s\n' 'Use a light 1280x800 browser. Settings > Providers > Add provider > Cursor > Next > Next > Add instance.'
printf '%s\n' 'Select Cursor, leave its API key empty, click Sign in, and wait for failure. Repeat with Retry sign-in while recording.'
printf '%s\n' 'For cancellation: Retry sign-in, then immediately Cancel. Inspect the completed CursorAuth.runLogin span and warning count.'
printf '%s\n' 'The proxy presents an untrusted certificate; no SDK or app implementation is patched.'
wait "$app_pid"