#!/usr/bin/env bash
# Explicit remote-runner opt-in: invokes real models using the dedicated CLI login.
set -euo pipefail
umask 077
binary=$(realpath "$1")
cli=${FOUNDRY_REAL_CODEX_INSTALL:-/opt/endoleap-infra/codex-cli}
login=${FOUNDRY_REAL_CODEX_HOME:-/opt/endoleap-infra/foundry/codex/home}
: "${FOUNDRY_CANVAS_IMAGE_MODELS:?Set only backend model names verified for image output}"
test -x "$binary"
test -s "$login/auth.json"
test -s "$login/models_cache.json"
suffix=$(openssl rand -hex 8)
database=foundry-real-db-$suffix
worker=foundry-real-worker-$suffix
scratch=$(mktemp -d /tmp/foundry-real.XXXXXXXX)
cleanup(){ docker rm -f "$worker" "$database" >/dev/null 2>&1 || true; rm -rf "$scratch"; }
trap cleanup EXIT
install -d -m 700 "$scratch/run"
chown 1000:1000 "$scratch/run"
docker run -d --name "$database" --network none -e POSTGRES_HOST_AUTH_METHOD=trust postgres:17-alpine >/dev/null
for attempt in {1..30}; do if docker exec "$database" pg_isready -h 127.0.0.1 -U postgres >/dev/null 2>&1; then break; fi; sleep 1; done
docker exec -i "$database" psql -X -U postgres -v ON_ERROR_STOP=1 < db/001-auth.sql
docker exec "$database" psql -X -U postgres -v ON_ERROR_STOP=1 -c 'CREATE ROLE foundry_fixture LOGIN'
python3 deploy/migrate.py --container "$database" --database postgres --role foundry_fixture
# Only the CLI container sees the login. Core/tests receive the private socket,
# never the login, runtime configuration or Docker socket.
docker run -d --name "$worker" --init --network bridge --user 1000:1000 \
 --cap-drop ALL --security-opt no-new-privileges --read-only --pids-limit 128 --memory 1g \
 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /work:ro,nosuid,nodev \
 --tmpfs /home/node/.codex:rw,nosuid,nodev,size=32m,uid=1000,gid=1000 --workdir /work \
 -e "FOUNDRY_CANVAS_IMAGE_MODELS=$FOUNDRY_CANVAS_IMAGE_MODELS" \
 --mount "type=bind,source=$binary,target=/opt/foundry,readonly" \
 --mount "type=bind,source=$cli,target=/opt/codex,readonly" \
 --mount "type=bind,source=$login/auth.json,target=/home/node/.codex/auth.json,readonly" \
 --mount "type=bind,source=$login/models_cache.json,target=/home/node/.codex/models_cache.json,readonly" \
 --mount "type=bind,source=$scratch/run,target=/run/foundry-codex" \
 --mount type=bind,source=/etc/ssl/certs/ca-certificates.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly \
 node:24-bookworm-slim /opt/foundry codex-worker >/dev/null
for attempt in {1..30}; do if [[ -S "$scratch/run/worker.sock" ]]; then break; fi; sleep 1; done
test -S "$scratch/run/worker.sock"
CGO_ENABLED=0 go test -mod=readonly -c -o bin/platform-real-tests ./internal/platform
docker run --rm --network "container:$database" --user 1000:1000 \
 --read-only --cap-drop ALL --security-opt no-new-privileges \
 --tmpfs /tmp:rw,nosuid,nodev,noexec,size=16m,mode=1777 \
 --mount "type=bind,source=$(pwd)/bin/platform-real-tests,target=/opt/integration-tests,readonly" \
 --mount "type=bind,source=$scratch/run,target=/run/canvas-real,readonly" \
 -e PLATFORM_TEST_DATABASE_URL=postgres://foundry_fixture@127.0.0.1:5432/postgres?sslmode=disable \
 -e FOUNDRY_REAL_CODEX_SOCKET=/run/canvas-real/worker.sock \
 --entrypoint /opt/integration-tests postgres:17-alpine -test.v -test.run '^TestCanvasAIRealWorker$' -test.timeout 6m