#!/usr/bin/env bash
set -euo pipefail

PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

if [[ -f "$PROJECT_DIR/.env" ]]; then
  set -a
  source "$PROJECT_DIR/.env"
  set +a
fi
OI_VENV="$PROJECT_DIR/venv-oi"
WORKSPACE="$PROJECT_DIR/workspace"
RUNNER="$PROJECT_DIR/scripts/safe_oi_runner.py"

mkdir -p "$WORKSPACE" "$PROJECT_DIR/logs" "$PROJECT_DIR/backups"

if [[ ! -x "$OI_VENV/bin/python" ]]; then
  echo "❌ Chybí Python prostředí: $OI_VENV"
  echo "   Spusť: cd \"$PROJECT_DIR\" && bash scripts/install.sh"
  exit 1
fi

if [[ ! -f "$RUNNER" ]]; then
  echo "❌ Chybí runner: $RUNNER"
  exit 1
fi

echo "🔒 Spouštím Open Interpreter v BEZPEČNÉM módu..."
echo "   Workspace: $WORKSPACE"

exec bwrap \
  --die-with-parent \
  --new-session \
  --proc /proc \
  --dev /dev \
  --ro-bind /usr /usr \
  --ro-bind /bin /bin \
  --ro-bind /lib /lib \
  --ro-bind /lib64 /lib64 \
  --ro-bind /etc /etc \
  --ro-bind "$PROJECT_DIR" "$PROJECT_DIR" \
  --ro-bind "$HOME/.cache/chroma" "$HOME/.cache/chroma" \
  --bind "$WORKSPACE" "$WORKSPACE" \
  --tmpfs /tmp \
  --chdir "$WORKSPACE" \
  --setenv HOME "$HOME" \
  --setenv OPENAI_API_KEY "${LITELLM_MASTER_KEY:-}" \
  --setenv PATH "$OI_VENV/bin:/usr/local/bin:/usr/bin:/bin" \
  --setenv PYTHONPATH "$PROJECT_DIR:$PROJECT_DIR/scripts:$PROJECT_DIR/tools" \
  "$OI_VENV/bin/python" "$RUNNER"