#!/bin/bash
# .jules/setup-vm.sh - Auth-Yes IAM VM Initialization
# 
# 🛑 SAFEGUARD & USAGE INSTRUCTIONS:
# This script is intentionally disabled and benign by default with the 'exit 0' below.
# 
# DO NOT RUN THIS SCRIPT IN A TASK SESSION OR FROM THE CLI.
# 
# TO USE:
# 1. The human operator copies all lines BELOW the safeguard block.
# 2. Paste the payload directly into the Jules Web Platform VM Snapshot Initialization form.
# 3. Jules will use that snapshot as the pre-baked base image for sessions.
#
echo "SAFEGUARD: Script disabled. Do not execute directly. Copy payload below exit 0 into Jules VM snapshot form."
exit 0

# 1. TRACE ON: Every command prints to the log for VM debugging
set -x

echo "==== DIAG: SYSTEM STATE ===="
whoami
pwd
df -h
ls -la

echo "==== DIAG: DEPENDENCY CHECK ===="
if command -v unzip > /dev/null 2>&1 && command -v curl > /dev/null 2>&1; then
    echo "Core utilities: FOUND"
else
    echo "Core utilities: MISSING. Attempting install..."
    sudo apt-get update -qq
    sudo apt-get install -y unzip curl build-essential pkg-config -qq
fi

echo "==== DIAG: DENO ENGINE ===="
if command -v deno > /dev/null 2>&1; then
    echo "deno: ALREADY IN PATH"
else
    echo "deno: NOT FOUND. Triggering official install..."
    curl -fsSL https://deno.land/install.sh | sh
fi

# Force-inject Deno into the current shell and bashrc
export DENO_INSTALL="$HOME/.deno"
export PATH="$DENO_INSTALL/bin:$PATH"
grep -qxF "export PATH=\"\$HOME/.deno/bin:\$PATH\"" ~/.bashrc || echo "export PATH=\"\$HOME/.deno/bin:\$PATH\"" >> ~/.bashrc

echo "==== DIAG: RUST / CARGO TOOLCHAIN ===="
if command -v cargo > /dev/null 2>&1; then
    echo "cargo: FOUND"
else
    echo "cargo: NOT FOUND. Installing minimal Rust toolchain for spire_ffi..."
    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
    export PATH="$HOME/.cargo/bin:$PATH"
    grep -qxF "export PATH=\"\$HOME/.cargo/bin:\$PATH\"" ~/.bashrc || echo "export PATH=\"\$HOME/.cargo/bin:\$PATH\"" >> ~/.bashrc
fi

echo "==== DIAG: AUTH-YES DEFAULT ENVIRONMENT ===="
export RP_ID="atyg.org"
export ORIGIN="https://auth.atyg.org"
export REQUIRE_HARDWARE_TOKEN="false"
export DATABASE_URL="postgresql://postgres:postgres@localhost:5432/auth_yes"
export VALKEY_URL="redis://localhost:6379"

grep -qxF "export RP_ID=\"atyg.org\"" ~/.bashrc || cat << 'ENV_EOF' >> ~/.bashrc
export RP_ID="atyg.org"
export ORIGIN="https://auth.atyg.org"
export REQUIRE_HARDWARE_TOKEN="false"
export DATABASE_URL="postgresql://postgres:postgres@localhost:5432/auth_yes"
export VALKEY_URL="redis://localhost:6379"
ENV_EOF

echo "==== DIAG: HYGIENE ===="
sudo apt-get clean || true
sudo apt-get autoclean -y || true
sudo apt-get autoremove -y || true

echo "==== SETUP COMPLETE ===="
set +x