#!/usr/bin/env bash
# Prepare the sandbox both lanes share: export a disposable copy of HEAD, seed
# it with the auditor config and scope, build the images, and pre-start the
# egress proxy. Nothing here touches the real working tree or the live stack.
# Run it once per session; then ./run-tools.sh and ./run-audit.sh (security),
# or ./run-ux.sh (ideation).
set -euo pipefail
cd "$(dirname "$0")"
HERE="$(pwd)"
REPO="$(git rev-parse --show-toplevel)"   # the runner lives under scripts/, not at the root
PROJECT=member-console-audit

AUTH_JSON="${AUDIT_AUTH_JSON:-$HOME/.local/share/opencode/auth.json}"
if [[ ! -f "$AUTH_JSON" ]]; then
  echo "ERROR: opencode auth file not found at $AUTH_JSON" >&2
  echo "Log in on the host first (opencode auth login) or set AUDIT_AUTH_JSON." >&2
  exit 1
fi

echo "==> Exporting a disposable copy of HEAD into .code/ (real repo untouched)"
rm -rf .code && mkdir -p .code
git -C "$REPO" archive HEAD | tar -x -C .code
# The export carries the repo's own .opencode/ skills (OpenSpec workflow
# helpers). They are irrelevant to a security audit and a model that notices
# them wastes a turn on them, so they do not travel.
rm -rf .code/.opencode .code/.claude

# Seed the throwaway copy with the auditor's config, instructions, and scope.
cp opencode.json .code/opencode.json
cp AUDITOR.md    .code/AUDITOR.md
cp CONTEXT.md    .code/CONTEXT.md
rm -rf .code/scope && cp -r scope .code/scope

[[ -f .code/go.mod && -f .code/go.sum ]] || {
  echo "ERROR: .code/go.mod missing; the image bakes the module cache from it." >&2
  exit 1
}
COMMIT="$(git -C "$REPO" rev-parse --short HEAD)"
echo "$COMMIT" > .code/AUDIT_COMMIT.txt

echo "==> Building images (auditor + egress proxy) — first build pulls the"
echo "    Go toolchain, opencode, the scanners, the semgrep rules, the Go"
echo "    vulnerability database, and this project's module cache."
docker compose build

echo "==> Starting the egress proxy (deny-by-default; allowlist.txt governs)"
docker compose up -d egress-proxy

cat <<MSG

Ready.
  Audited commit : $COMMIT
  Auth (ro)      : $AUTH_JSON
  Egress         : proxy only, allowlist = $(grep -c . allowlist.txt) host patterns
  Runner         : $HERE

Findings go where you send them: export OUT to a directory outside this one.

Next: OUT=<dir> ./run-tools.sh       # offline scanner pass -> <dir>/tools/
      OUT=<dir> ./run-audit.sh       # all models x all scope tasks
      ./run-ux.sh <brief-dir>        # the ideation lane
      ./teardown.sh                  # remove the containers and the copy
MSG