#!/bin/sh
# Root, on the VM, from mesh-agent launch (process exec; the values arrive on stdin as KEY=value lines).
# Installs the pinned atirc, makes the agent's and your node's users and iroh keys, writes the agent's
# atirc config (harness, model) 0600, and prints {"agent": <endpoint id>, "you": <endpoint id>}.
set -eu
while IFS='=' read -r k v; do
	case "$k" in
	NICK | YOU | ATIRC_URL | ATIRC_SHA256 | MODEL_B64 | BASE_URL_B64 | API_KEY_B64 | HARNESS_B64) eval "$k=\$v" ;;
	esac
done
b64() { printf %s "$1" | base64 -d; }
bin=/usr/local/bin/atirc
if [ "$(sha256sum "$bin" 2>/dev/null | cut -d' ' -f1)" != "$ATIRC_SHA256" ]; then
	tmp=$(mktemp)
	curl -fsSL -o "$tmp" "$ATIRC_URL"
	echo "$ATIRC_SHA256  $tmp" | sha256sum -c - >/dev/null
	install -m 0755 "$tmp" "$bin"
	rm -f "$tmp"
fi
key() {
	u=$1
	id -u "$u" >/dev/null 2>&1 || useradd -m -s /bin/bash "$u"
	d=/home/$u/.config/atirc
	install -d -m 0700 -o "$u" -g "$u" "/home/$u/.config" "$d"
	if [ ! -s "$d/iroh_key" ]; then
		(umask 077 && head -c 32 /dev/urandom >"$d/iroh_key")
		chown "$u:$u" "$d/iroh_key"
	fi
	# the endpoint id: the ed25519 public key of that seed (PKCS#8 prefix + seed), hex
	{ printf '\060\056\002\001\000\060\005\006\003\053\145\160\004\042\004\040'; cat "$d/iroh_key"; } |
		openssl pkey -inform DER -pubout -outform DER | tail -c 32 | od -An -tx1 | tr -d ' \n'
}
agent=$(key "$NICK")
you=$(key "$YOU")
d=/home/$NICK/.config/atirc
(
	umask 077
	{
		printf "[agent]\naddPath = '~/.local/bin'\nharness = '''\n%s\n'''\n\n[agent.anthropic]\n" "$(b64 "$HARNESS_B64")"
		printf 'model = "%s"\nbaseUrl = "%s"\napiKey = "%s"\n' "$(b64 "$MODEL_B64")" "$(b64 "$BASE_URL_B64")" "$(b64 "$API_KEY_B64")"
	} >"$d/config.toml"
)
chown "$NICK:$NICK" "$d/config.toml"
printf '{"agent":"%s","you":"%s"}\n' "$agent" "$you"