#!/usr/bin/env bash
# Prepare the sandbox both lanes share: export a disposable copy of HEAD, seed
# it with the auditor config and scope, build the images, and pre-start the
# egress proxy. Nothing here touches the real working tree or the live stack.
# Run it once per session; then ./run-tools.sh and ./run-audit.sh (security),
# or ./run-ux.sh (ideation).
set -euo pipefail
cd "$(dirname "$0")"
HERE="$(pwd)"
REPO="$(git rev-parse --show-toplevel)"   # the runner lives under scripts/, not at the root
PROJECT=member-console-audit

. ./harness.sh
# At least one harness must be signed in on the host; the run scripts check
# the one each named model needs.
AUTH_SUMMARY=""
for h in $HARNESSES; do
  f="$(harness_auth_path "$h")"
  [[ -f "$f" ]] && AUTH_SUMMARY+="$h=$f "
done
if [[ -z "$AUTH_SUMMARY" ]]; then
  echo "ERROR: no harness is signed in on the host." >&2
  echo "  opencode: 'opencode auth login' (or set AUDIT_AUTH_JSON)" >&2
  echo "  codex:    'codex login' (or set AUDIT_CODEX_AUTH_JSON)" >&2
  exit 1
fi

echo "==> Exporting a disposable copy of HEAD into .code/ (real repo untouched)"
rm -rf .code && mkdir -p .code
# Lane state lives under .run/. Create it as the invoking user now: a compose
# call made without OUT lets the daemon create .run/out as root, and a
# root-owned .run/ would refuse the lanes their state directories.
mkdir -p .run
git -C "$REPO" archive HEAD | tar -x -C .code
# The export carries the repo's own .opencode/ skills (OpenSpec workflow
# helpers). They are irrelevant to a security audit and a model that notices
# them wastes a turn on them, so they do not travel.
rm -rf .code/.opencode .code/.claude

# Seed the throwaway copy with the auditor's config, instructions, and scope.
cp opencode.json .code/opencode.json
cp AUDITOR.md    .code/AUDITOR.md
cp CONTEXT.md    .code/CONTEXT.md
cp REPORT.md     .code/REPORT.md
rm -rf .code/scope .code/open .code/codex-security && cp -r scope .code/scope && cp -r open .code/open && cp -r codex-security .code/codex-security

[[ -f .code/go.mod && -f .code/go.sum ]] || {
  echo "ERROR: .code/go.mod missing; the image bakes the module cache from it." >&2
  exit 1
}
COMMIT="$(git -C "$REPO" rev-parse --short HEAD)"
echo "$COMMIT" > .code/AUDIT_COMMIT.txt

echo "==> Building images (auditor + egress proxy) — first build pulls the"
echo "    Go toolchain, opencode, Codex CLI, the scanners, the semgrep rules,"
echo "    the Go vulnerability database, and this project's module cache."
docker compose build

echo "==> Starting the egress proxy (deny-by-default; allowlist.txt governs)"
docker compose up -d egress-proxy

cat <<MSG

Ready.
  Audited commit : $COMMIT
  Signed in      : $AUTH_SUMMARY
  Egress         : proxy only, allowlist = $(grep -c . allowlist.txt) host patterns
  Runner         : $HERE

Findings go where you send them: export OUT to a directory outside this one.

Next: OUT=<dir> ./run-tools.sh       # offline scanner pass -> <dir>/tools/
      OUT=<dir> ./run-audit.sh       # all models x all scope tasks
      ./run-ux.sh <brief-dir>        # the ideation lane
      ./teardown.sh                  # remove the containers and the copy
MSG