#!/usr/bin/env sh
set -eu

if [ "$(uname -s 2>/dev/null || printf unknown)" != "Darwin" ]; then
  echo "This script is only for macOS." >&2
  exit 1
fi

CODEX_HOME_DIR="${CODEX_HOME:-"$HOME/.codex"}"
KEYCHAIN_SERVICE="com.unikeyx.codex.OPENAI_API_KEY"
KEYCHAIN_ACCOUNT="$(id -un)"
HELPER_DIR="$CODEX_HOME_DIR/bin"
HELPER_PATH="$HELPER_DIR/load-unikeyx-key.sh"
LOG_DIR="$CODEX_HOME_DIR/logs"
LAUNCH_AGENT_DIR="$HOME/Library/LaunchAgents"
LAUNCH_AGENT_LABEL="com.unikeyx.codex-env"
LAUNCH_AGENT_PATH="$LAUNCH_AGENT_DIR/$LAUNCH_AGENT_LABEL.plist"
SECURITY_BIN="${UNIKEYX_SECURITY_BIN:-/usr/bin/security}"
LAUNCHCTL_BIN="${UNIKEYX_LAUNCHCTL_BIN:-/bin/launchctl}"
OPEN_BIN="${UNIKEYX_OPEN_BIN:-/usr/bin/open}"

if [ -z "${OPENAI_API_KEY:-}" ] && [ -t 0 ]; then
  printf '请输入 UniKeyX API Key（输入内容不会显示）：'
  SAVED_STTY=$(stty -g 2>/dev/null || true)
  if [ -n "$SAVED_STTY" ]; then
    trap 'stty "$SAVED_STTY" 2>/dev/null || true; printf "\n"; exit 130' HUP INT TERM
    stty -echo
  fi

  if ! IFS= read -r OPENAI_API_KEY; then
    OPENAI_API_KEY=""
  fi

  if [ -n "$SAVED_STTY" ]; then
    stty "$SAVED_STTY"
    trap - HUP INT TERM
  fi
  printf '\n'
fi

if [ -z "${OPENAI_API_KEY:-}" ]; then
  echo "未输入 API Key，未进行任何修改。" >&2
  exit 1
fi

case "$OPENAI_API_KEY" in
  *[[:space:]]*|YOUR_UNIKEYX_API_KEY)
    echo "API Key 为空、包含空格，或仍是示例占位符。" >&2
    exit 1
    ;;
esac

if [ ! -x "$SECURITY_BIN" ] || [ ! -x "$LAUNCHCTL_BIN" ]; then
  echo "未找到 macOS 钥匙串或 launchctl 工具。" >&2
  exit 1
fi

"$SECURITY_BIN" add-generic-password -U -a "$KEYCHAIN_ACCOUNT" -s "$KEYCHAIN_SERVICE" -w "$OPENAI_API_KEY" >/dev/null

mkdir -p "$HELPER_DIR" "$LOG_DIR" "$LAUNCH_AGENT_DIR"

cat > "$HELPER_PATH" <<'EOF'
#!/usr/bin/env sh
set -u

KEYCHAIN_SERVICE="com.unikeyx.codex.OPENAI_API_KEY"
KEYCHAIN_ACCOUNT="$(id -un)"
ATTEMPT=0

while [ "$ATTEMPT" -lt 6 ]; do
  OPENAI_API_KEY=$(/usr/bin/security find-generic-password -a "$KEYCHAIN_ACCOUNT" -s "$KEYCHAIN_SERVICE" -w 2>/dev/null || true)
  if [ -n "$OPENAI_API_KEY" ]; then
    /bin/launchctl setenv OPENAI_API_KEY "$OPENAI_API_KEY"
    unset OPENAI_API_KEY
    exit 0
  fi
  ATTEMPT=$((ATTEMPT + 1))
  /bin/sleep 2
done

exit 1
EOF
chmod 700 "$HELPER_PATH"

PLIST_HELPER_PATH=$(printf '%s' "$HELPER_PATH" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g')
PLIST_STDOUT_PATH=$(printf '%s' "$LOG_DIR/unikeyx-key-loader.log" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g')
PLIST_STDERR_PATH=$(printf '%s' "$LOG_DIR/unikeyx-key-loader.err.log" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g')

cat > "$LAUNCH_AGENT_PATH" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>$LAUNCH_AGENT_LABEL</string>
  <key>ProgramArguments</key>
  <array>
    <string>/bin/sh</string>
    <string>$PLIST_HELPER_PATH</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>StandardOutPath</key>
  <string>$PLIST_STDOUT_PATH</string>
  <key>StandardErrorPath</key>
  <string>$PLIST_STDERR_PATH</string>
</dict>
</plist>
EOF
chmod 600 "$LAUNCH_AGENT_PATH"

USER_ID=$(id -u)
"$LAUNCHCTL_BIN" bootout "gui/$USER_ID/$LAUNCH_AGENT_LABEL" >/dev/null 2>&1 || true
"$LAUNCHCTL_BIN" bootstrap "gui/$USER_ID" "$LAUNCH_AGENT_PATH"
"$LAUNCHCTL_BIN" kickstart -k "gui/$USER_ID/$LAUNCH_AGENT_LABEL" >/dev/null 2>&1 || true
"$LAUNCHCTL_BIN" setenv OPENAI_API_KEY "$OPENAI_API_KEY"

echo "UniKeyX API Key 已保存到 macOS 登录钥匙串。"
echo "登录启动项已安装，重新启动电脑后会自动恢复 OPENAI_API_KEY。"

if [ -x "$OPEN_BIN" ]; then
  "$OPEN_BIN" -a "Codex" >/dev/null 2>&1 || true
fi

unset OPENAI_API_KEY
echo "Codex (ChatGPT) Desktop 已启动；如原来已打开，请完全退出后重新打开。"