setup-docker.sh

#!/bin/bash
set -euo pipefail

# =========================================================================
# Kōan Docker Setup — Auto-detect host auth and generate mounts
# =========================================================================
# This script inspects the host system to find auth directories (gh, copilot)
# and workspace layout, then generates a docker-compose.override.yml with
# the correct volume mounts.
#
# Claude CLI is installed in the Docker image via npm — no host mount needed.
# Auth: ANTHROPIC_API_KEY in .env (API billing) or interactive login (subscription).
#
# Usage:
#   ./setup-docker.sh           # Auto-detect and generate
#   ./setup-docker.sh --dry-run # Show what would be mounted without writing
# =========================================================================

DRY_RUN=false
if [ "${1:-}" = "--dry-run" ]; then
    DRY_RUN=true
fi

OVERRIDE_FILE="docker-compose.override.yml"

# --- ANSI Colors (disabled when stdout is not a TTY) ---
if [ -n "${KOAN_FORCE_COLOR:-}" ] || [ -t 1 ]; then
    BOLD='\033[1m' DIM='\033[2m'
    RED='\033[31m' GREEN='\033[32m' YELLOW='\033[33m' CYAN='\033[36m'
    RESET='\033[0m'
else
    BOLD='' DIM='' RED='' GREEN='' YELLOW='' CYAN='' RESET=''
fi

log()     { printf "${DIM}[setup-docker]${RESET} %s\n" "$*"; }
warn()    { printf "${YELLOW}[setup-docker] ⚠ %s${RESET}\n" "$*" >&2; }
error()   { printf "${RED}[setup-docker] ✗ %s${RESET}\n" "$*" >&2; }
success() { printf "${GREEN}[setup-docker] ✓ %s${RESET}\n" "$*"; }
section() { printf "\n${BOLD}${CYAN}--- %s ---${RESET}\n" "$*"; }

# -------------------------------------------------------------------------
# Detect binaries and their real paths (resolve symlinks)
# -------------------------------------------------------------------------
declare -a VOLUME_MOUNTS=()
declare -a FOUND_BINS=()

detect_binary() {
    local name="$1"
    local target="/host-bin/$name"

    local path
    path=$(command -v "$name" 2>/dev/null || true)
    if [ -z "$path" ]; then
        return 1
    fi

    # Resolve symlinks to get the real binary
    local real_path
    real_path=$(realpath "$path" 2>/dev/null || readlink -f "$path" 2>/dev/null || echo "$path")

    success "Found $name: $real_path"
    VOLUME_MOUNTS+=("      - ${real_path}:${target}:ro")
    FOUND_BINS+=("$name")
    return 0
}

# Detect a directory if it exists
detect_dir() {
    local host_dir="$1"
    local container_dir="$2"
    local mode="${3:-ro}"
    local label="${4:-$host_dir}"

    # Expand ~ to $HOME
    local expanded="${host_dir/#\~/$HOME}"

    if [ -d "$expanded" ]; then
        success "Found $label: $expanded"
        VOLUME_MOUNTS+=("      - ${expanded}:${container_dir}:${mode}")
        return 0
    fi
    return 1
}

# Node.js and gh are installed in the Docker image — no host mounts needed.

# -------------------------------------------------------------------------
# Detect host UID/GID
# -------------------------------------------------------------------------
detect_uid_gid() {
    local uid gid tz
    uid=$(id -u)
    gid=$(id -g)
    if [ -n "${TZ:-}" ]; then
        tz="$TZ"
    elif [ -L /etc/localtime ]; then
        tz=$(readlink /etc/localtime | sed 's|.*/zoneinfo/||')
    elif [ -f /etc/timezone ]; then
        tz=$(cat /etc/timezone)
    else
        tz="UTC"
    fi
    log "Host user: UID=$uid GID=$gid TZ=$tz"
    { echo "HOST_UID=$uid"; echo "HOST_GID=$gid"; echo "TZ=$tz"; } > .env.docker
}

# -------------------------------------------------------------------------
# Resolve workspace entries for Docker bind mounts (per-project, no symlinks)
# -------------------------------------------------------------------------
resolve_workspace() {
    if [ ! -d "workspace" ]; then
        log "No workspace/ directory — skipping"
        return
    fi

    local count=0
    local entry name real_path
    for entry in workspace/*/; do
        [ -d "$entry" ] || continue
        name=$(basename "$entry")
        real_path=$(realpath "workspace/$name" 2>/dev/null || echo "$(pwd)/workspace/$name")
        VOLUME_MOUNTS+=("      - ${real_path}:/app/workspace/${name}")
        count=$((count + 1))
        log "Workspace: $name → $real_path"
    done

    if [ $count -gt 0 ]; then
        success "Resolved $count workspace project(s)"
    fi
}

# -------------------------------------------------------------------------
# Generate docker-compose.override.yml
# -------------------------------------------------------------------------
generate_override() {
    if [ ${#VOLUME_MOUNTS[@]} -eq 0 ]; then
        warn "No volume mounts detected — override file will be minimal"
    fi

    local content
    content="# Auto-generated by setup-docker.sh — $(date -Iseconds)
# Re-run ./setup-docker.sh if you change your workspace layout.
# This file is gitignored.

services:
  koan:
    build:
      args:
        HOST_UID: \${HOST_UID:-$(id -u)}
        HOST_GID: \${HOST_GID:-$(id -g)}
    volumes:"

    for mount in "${VOLUME_MOUNTS[@]}"; do
        content="$content
$mount"
    done

    if [ "$DRY_RUN" = true ]; then
        printf "\n${BOLD}${CYAN}=== Would write to %s ===${RESET}\n" "$OVERRIDE_FILE"
        echo "$content"
        printf "${BOLD}${CYAN}=== End ===${RESET}\n"
    else
        echo "$content" > "$OVERRIDE_FILE"
        success "Written: $OVERRIDE_FILE"
    fi
}

# =========================================================================
# Main
# =========================================================================

log "Detecting host environment..."

# 1. Auth directories (Claude CLI is installed in the image — no host mount needed)
section "Auth Directories"
log "Claude CLI: installed in Docker image via npm"
log "  Auth option 1: ANTHROPIC_API_KEY in .env (API billing)"
log "  Auth option 2: make docker-auth (subscription — generates OAuth token from host CLI)"

# Create claude-auth/ for interactive login persistence
if [ ! -d "claude-auth" ]; then
    mkdir -p "claude-auth"
    success "Created claude-auth/ (persistent auth state for Claude CLI)"
else
    success "Found claude-auth/"
fi
VOLUME_MOUNTS+=("      - ./claude-auth:/home/koan/.claude:rw")

detect_dir "~/.copilot" "/home/koan/.copilot" "rw" "Copilot auth" || \
    log "~/.copilot not found (ok if not using Copilot)"

detect_dir "~/.config/gh" "/home/koan/.config/gh" "ro" "GitHub CLI auth" || \
    warn "~/.config/gh not found — gh CLI won't be authenticated"

# SSH agent socket forwarding (for git push/fetch over SSH)
if [ -n "${SSH_AUTH_SOCK:-}" ] && [ -S "$SSH_AUTH_SOCK" ]; then
    success "Found SSH agent socket: $SSH_AUTH_SOCK"
    VOLUME_MOUNTS+=("      - ${SSH_AUTH_SOCK}:/run/ssh-agent.sock:ro")
else
    log "No SSH agent socket — see docs/ssh-setup.md for options"
fi

# SSH keys (fallback when agent is unavailable)
detect_dir "~/.ssh" "/home/koan/.ssh" "ro" "SSH keys" || \
    log "~/.ssh not found (SSH key fallback not available)"

detect_dir "~/.gitconfig" "/home/koan/.gitconfig" "ro" "Git config" || true

# 2. Workspace symlink resolution + projects.yaml
section "Workspace"
resolve_workspace

# 2b. Ensure missions.docker.md exists (isolated mission queue for container)
if [ ! -f "instance/missions.docker.md" ]; then
    touch "instance/missions.docker.md"
    success "Created instance/missions.docker.md (empty mission queue for container)"
else
    success "Found instance/missions.docker.md"
fi

# 2c. Generate projects.docker.yaml with workspace entries (smart merge)
generate_projects_yaml() {
    local yaml_file="projects.docker.yaml"

    # Create skeleton if file doesn't exist
    if [ ! -f "$yaml_file" ]; then
        cat > "$yaml_file" << 'EOF'
defaults:
  git_auto_merge:
    enabled: false
    base_branch: "main"
    strategy: "squash"
  max_open_prs: 10

projects:
EOF
        log "Created $yaml_file"
    fi

    # Ensure projects: section exists (handles files generated before this fix)
    if ! grep -q '^projects:' "$yaml_file"; then
        printf '\nprojects:\n' >> "$yaml_file"
        log "Added projects: section to $yaml_file"
    fi

    # Append workspace entries not already present
    local added=0
    local entry name
    for entry in workspace/*/; do
        [ -d "$entry" ] || continue
        name=$(basename "$entry")
        if ! grep -qE "^  ${name}:" "$yaml_file"; then
            printf '  %s:\n    path: /app/workspace/%s\n' "$name" "$name" >> "$yaml_file"
            added=$((added + 1))
            log "Added project '$name'"
        fi
    done

    if [ $added -gt 0 ]; then
        success "Added $added new workspace project(s) to $yaml_file"
    else
        success "$yaml_file up to date"
    fi
}

generate_projects_yaml
VOLUME_MOUNTS+=("      - ./projects.docker.yaml:/app/projects.docker.yaml:rw")

# 3. Generate files
section "Generating"
detect_uid_gid
generate_override

if [ "$DRY_RUN" = false ]; then
    printf "\n${BOLD}${CYAN}╭──────────────────────────────────────────────────────────╮${RESET}\n"
    printf "${BOLD}${CYAN}│${RESET} ${GREEN}✓ Setup complete!${RESET}                                        ${BOLD}${CYAN}│${RESET}\n"
    printf "${BOLD}${CYAN}├──────────────────────────────────────────────────────────┤${RESET}\n"
    printf "${BOLD}${CYAN}│${RESET}  1. Review %-43s ${BOLD}${CYAN}│${RESET}\n" "$OVERRIDE_FILE"
    printf "${BOLD}${CYAN}│${RESET}  2. Auth (pick one):                                     ${BOLD}${CYAN}│${RESET}\n"
    printf "${BOLD}${CYAN}│${RESET}     a. Set ANTHROPIC_API_KEY in .env (API billing)        ${BOLD}${CYAN}│${RESET}\n"
    printf "${BOLD}${CYAN}│${RESET}     b. make docker-auth (subscription — host token)       ${BOLD}${CYAN}│${RESET}\n"
    printf "${BOLD}${CYAN}│${RESET}  3. docker compose up --build                            ${BOLD}${CYAN}│${RESET}\n"
    printf "${BOLD}${CYAN}╰──────────────────────────────────────────────────────────╯${RESET}\n"
fi