Distribution

#!/usr/bin/env bash
# ---------------------------------------------------------------------------
# Agent Safehouse Dist Binary (generated file)
# Project: https://agent-safehouse.dev
# Embedded Profiles Last Modified (UTC): 2026-03-09T12:34:56Z
# Generated by: scripts/generate-dist.sh
# ---------------------------------------------------------------------------
set -euo pipefail

PROFILE_KEYS=(
  "profiles/00-base.sb"
  "profiles/10-system-runtime.sb"
  "profiles/20-network.sb"
  "profiles/30-toolchains/bun.sb"
  "profiles/30-toolchains/deno.sb"
  # ... all profile files in lexicographic order
)

embedded_profile_body() {
  case "$1" in
    "profiles/00-base.sb")
      cat <<'__SAFEHOUSE_EMBEDDED_profiles_00_base_sb__'
(version 1)
;; Base profile content...
__SAFEHOUSE_EMBEDDED_profiles_00_base_sb__
      ;;
    "profiles/10-system-runtime.sb")
      cat <<'__SAFEHOUSE_EMBEDDED_profiles_10_system_runtime_sb__'
;; System runtime content...
__SAFEHOUSE_EMBEDDED_profiles_10_system_runtime_sb__
      ;;
    # ... all profiles
  esac
}

append_profile() {
  local target="$1"
  local source="$2"
  local key content

  key="$(profile_key_from_source "$source")"
  if content="$(embedded_profile_body "$key" 2>/dev/null)"; then
    append_policy_chunk "$content"
    append_policy_chunk ""
    return
  fi

  # Fallback: read from disk (for --append-profile external files)
  if [[ -f "$source" ]]; then
    content="$(<"$source")"
    append_policy_chunk "$content"
    append_policy_chunk ""
    return
  fi

  echo "Missing profile module: ${source}" >&2
  exit 1
}

main "$@"

collect_profiles() {
  while IFS= read -r rel_path; do
    profile_files+=("$rel_path")
  done < <(
    cd "$ROOT_DIR"
    find profiles -type f -name '*.sb' | LC_ALL=C sort
  )
}

resolve_embedded_profiles_last_modified_utc() {
  # Prefer git commit metadata for deterministic output
  epoch="$(git -C "$ROOT_DIR" log -1 --format=%ct -- "${profile_files[@]}" 2>/dev/null || true)"

  if [[ ! "$epoch" =~ ^[0-9]+$ ]] || (( epoch <= 0 )); then
    # Fallback: latest filesystem mtime
    epoch="$(latest_embedded_profile_epoch_from_fs)"
  fi

  format_epoch_utc "$epoch"
}

write_dist_script() {
  emit_banner "$embedded_profiles_last_modified_utc"
  emit_array_declaration "PROFILE_KEYS" "${profile_files[@]}"
  emit_embedded_profiles_function
  emit_safehouse_globals
  emit_inlined_runtime_sources
  emit_embedded_overrides
  echo 'main "$@"'
}

generate_static_policy_files() {
  # Create template directories
  mkdir -p "$template_home" "$template_workdir"

  # Generate default policy
  HOME="$template_home" "$GENERATOR" --enable=all-agents --workdir="" --output "$default_policy_path" >/dev/null

  # Generate apps policy
  HOME="$template_home" "$GENERATOR" --enable=macos-gui,electron,all-agents,all-apps --workdir="" --output "$apps_policy_path" >/dev/null

  # Rewrite HOME_DIR to template placeholder
  rewrite_static_policy_home_dir_literal "$default_policy_path"
  rewrite_static_policy_home_dir_literal "$apps_policy_path"

  # Append workdir grant template
  append_static_policy_workdir_grant "$default_policy_path"
  append_static_policy_workdir_grant "$apps_policy_path"
}

write_claude_launcher "$launcher_path"
write_claude_offline_launcher "$launcher_offline_path" "$apps_policy_path"

cleanup_template_root
printf '%s\n' "$output_path"
printf '%s\n' "$launcher_path"
printf '%s\n' "$launcher_offline_path"
printf '%s\n' "$default_policy_path"
printf '%s\n' "$apps_policy_path"