#!/bin/bash

set -eo pipefail

if [[ -z "${OAUTH:-}" ]]; then
  echo "OAUTH is required: provide base64 encoded Codex auth.json." >&2
  exit 1
fi

if [[ -z "${MODEL:-}" ]]; then
  echo "MODEL is required." >&2
  exit 1
fi

CODEX_HOME="${CODEX_HOME:-/root/.codex}"
PROMPT="${PROMPT:-請自我介紹}"
mkdir -p "$CODEX_HOME"

auth_file="$(mktemp "$CODEX_HOME/auth.XXXXXX")"
trap 'rm -f "$auth_file"' EXIT

if ! printf '%s' "$OAUTH" | base64 -d > "$auth_file"; then
  echo "OAUTH must be valid base64 encoded Codex auth.json." >&2
  exit 1
fi

if ! jq -e 'type == "object"' "$auth_file" >/dev/null; then
  echo "Decoded OAUTH must be a JSON object." >&2
  exit 1
fi

mv "$auth_file" "$CODEX_HOME/auth.json"
chmod 600 "$CODEX_HOME/auth.json"
trap - EXIT

codex exec \
  --model "$MODEL" \
  "$PROMPT"

if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
  echo "status=completed" >> "$GITHUB_OUTPUT"
fi