#!/bin/sh
# Stage the prebuilt `clawdie` FreeBSD binary + rc.d service into an image root.
#
# `clawdie` is the simplified, operator-friendly Colibri agent: one small binary
# (glasspane + herdr + DeepSeek/Telegram). This script does NOT build it — build
# or provide the artifact first, optionally with baked credentials:
#
#   (cd /home/clawdie/ai/colibri && CLAWDIE_TG_TOKEN=... CLAWDIE_DEEPSEEK_KEY=... \
#       cargo build --release -p clawdie)
#
# Usage:
#   COLIBRI_REPO=/home/clawdie/ai/colibri scripts/stage-clawdie-iso.sh /path/to/image-root
#   CLAWDIE_ARTIFACT_DIR=/path/to/release scripts/stage-clawdie-iso.sh /path/to/image-root

set -eu

if [ "${1:-}" = "" ]; then
    echo "usage: $0 DESTDIR" >&2
    exit 64
fi

DESTDIR=$1
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
REPO_ROOT=$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)
COLIBRI_REPO=${COLIBRI_REPO:-"/home/clawdie/ai/colibri"}
CLAWDIE_ARTIFACT_DIR=${CLAWDIE_ARTIFACT_DIR:-"${COLIBRI_REPO}/target/release"}
CLAWDIE_STAGE_ENABLE=${CLAWDIE_STAGE_ENABLE:-YES}

BIN_DIR="${DESTDIR}/usr/local/bin"
RC_DIR="${DESTDIR}/usr/local/etc/rc.d"
ETC_DIR="${DESTDIR}/usr/local/etc/clawdie"
DB_DIR="${DESTDIR}/var/db/clawdie"
RUN_DIR="${DESTDIR}/var/run/clawdie"
LOG_DIR="${DESTDIR}/var/log/clawdie"
RC_SOURCE="${COLIBRI_REPO}/packaging/freebsd/clawdie.in"

require_file() {
    if [ ! -f "$1" ]; then
        echo "missing required clawdie artifact: $1" >&2
        exit 66
    fi
}

require_exec() {
    if [ ! -x "$1" ]; then
        echo "missing executable clawdie artifact: $1" >&2
        echo "hint: (cd ${COLIBRI_REPO} && cargo build --release -p clawdie)" >&2
        exit 66
    fi
}

require_file "${RC_SOURCE}"
require_exec "${CLAWDIE_ARTIFACT_DIR}/clawdie"
mkdir -p "${BIN_DIR}" "${RC_DIR}" "${ETC_DIR}" "${DB_DIR}" "${RUN_DIR}" "${LOG_DIR}"

install -m 0555 "${CLAWDIE_ARTIFACT_DIR}/clawdie" "${BIN_DIR}/clawdie"
install -m 0555 "${RC_SOURCE}" "${RC_DIR}/clawdie"

cat > "${ETC_DIR}/rc.conf.sample" <<EOF
# Clawdie agent service defaults for the Clawdie ISO.
# Merge into /etc/rc.conf or /etc/rc.conf.d/clawdie.
clawdie_enable="${CLAWDIE_STAGE_ENABLE}"
clawdie_user="clawdie"
clawdie_group="clawdie"
clawdie_data_dir="/var/db/clawdie"
clawdie_run_dir="/var/run/clawdie"
clawdie_socket="/var/run/clawdie/clawdie.sock"
clawdie_db_path="/var/db/clawdie/clawdie.sqlite"
clawdie_logfile="/var/log/clawdie/clawdie.log"
clawdie_host="\$(hostname)"
clawdie_env_file="/usr/local/etc/clawdie/clawdie.env"
EOF

# Per-host credential override template (binary keeps its baked build-flag
# defaults; this file is optional and only read if present + readable).
if [ ! -f "${ETC_DIR}/clawdie.env" ]; then
    cat > "${ETC_DIR}/clawdie.env.sample" <<'EOF'
# Optional per-host credential overrides for clawdie.
# Copy to clawdie.env (chmod 0600) to override the baked build-flag values.
# CLAWDIE_TG_TOKEN=123456:telegram-bot-token
# CLAWDIE_DEEPSEEK_KEY=sk-deepseek-key
EOF
fi

cat > "${ETC_DIR}/README.iso" <<'EOF'
Clawdie agent ISO staging notes
===============================

The ISO build creates the clawdie user/group and enables the rc.d service
according to build.cfg. Out of the box clawdie offers exactly: a Telegram bot
and a DeepSeek lane — both normally baked at build time. Runtime validation:

  service clawdie start
  service clawdie status
  sockstat | grep clawdie     # Herdr socket bound
  service clawdie stop

Lifted on purpose: cost modes, quotas, multi-provider fallback, per-user limits.
EOF

chmod 0750 "${DB_DIR}" "${RUN_DIR}" "${LOG_DIR}"

cat <<EOF
Staged clawdie into ${DESTDIR}
  artifact : ${CLAWDIE_ARTIFACT_DIR}/clawdie
  rc.d     : ${RC_SOURCE}
  enable   : ${CLAWDIE_STAGE_ENABLE}
EOF