#!/bin/sh

# parse agent from this scripts filename (format 'aicage-<agent>.*')
name=${0##*/}
agent=${name#aicage-}
agent=${agent%%.*}

# setup log dir and file
script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
log_dir="$script_dir/log"
mkdir -p "$log_dir"
log_file="$log_dir/$agent-$(date +%Y%m%d-%H%M%S).log"

# log request
{
  echo "=== aicage-$agent shim ==="
  echo "timestamp: $(date '+%Y-%m-%dT%H:%M:%S%z')"
  echo "pwd: $(pwd)"
  echo "agent: $agent"
  printf 'argv: %s\n' "$*"
  echo "argc: $#"
  echo "---"
} >>"$log_file"

# Extra args for sandbox
# Codex uses bubblewrap as sandbox on Linux with '--sandbox' and/or some network settings.
# For simplicity use of bubblewrap is assumed here, which requires docker run args:
# - '--privileged' or
# - '--cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor=unconfined'

# run agent in aicage container (with extra args) while passing arguments and logging stderr output
# '--' before the agent is needed for aicage to parse extra args for docker-run
exec aicage \
  --cap-add SYS_ADMIN \
  --security-opt seccomp=unconfined \
  --security-opt apparmor=unconfined \
  -- "$agent" "$@" 2>>"$log_file"