#!/usr/bin/env zsh

set -euo pipefail

CODEX_AUTH_COMMON_SCRIPT="${CODEX_AUTH_COMMON_SCRIPT:-${HOME}/bin/codex-auth-common.zsh}"
CODEX_BIN="${CODEX_BIN:-/opt/homebrew/bin/codex}"
CODEX_WRAPPER_CODEX_PROFILE="${CODEX_WRAPPER_CODEX_PROFILE:-}"
CODEX_WRAPPER_DEFAULT_CODEX_PROFILE="${CODEX_WRAPPER_DEFAULT_CODEX_PROFILE:-gpt-5-5}"

if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
  print -u2 -- "Codex auth common helper not found or not readable: ${CODEX_AUTH_COMMON_SCRIPT}"
  exit 1
fi
source "${CODEX_AUTH_COMMON_SCRIPT}"

codex_home() {
  print -r -- "${CODEX_HOME:-${HOME}/.codex}"
}

codex_profile_file_exists() {
  local profile="$1"
  [[ -r "$(codex_home)/${profile}.config.toml" ]]
}

resolve_codex_profile() {
  if [[ -n "${CODEX_WRAPPER_CODEX_PROFILE}" ]]; then
    print -r -- "${CODEX_WRAPPER_CODEX_PROFILE}"
    return 0
  fi

  if codex_profile_file_exists "${CODEX_WRAPPER_DEFAULT_CODEX_PROFILE}"; then
    print -r -- "${CODEX_WRAPPER_DEFAULT_CODEX_PROFILE}"
  fi

  return 0
}

args_include_codex_profile() {
  local arg

  for arg in "$@"; do
    case "${arg}" in
      --profile|-p|--profile=*|-p=*|--profile-v2|--profile-v2=*)
        return 0
        ;;
    esac
  done

  return 1
}

codex_profile_flag() {
  local version_output version major minor rest

  version_output="$("${CODEX_BIN}" --version 2>/dev/null || true)"
  version="${version_output##* }"
  major="${version%%.*}"
  rest="${version#*.}"
  minor="${rest%%.*}"

  if [[ "${major}" == "0" && "${minor}" =~ '^[0-9]+$' && "${minor}" -lt 134 ]]; then
    print -r -- "--profile-v2"
    return 0
  fi

  print -r -- "--profile"
}

trap codex_auth_cleanup EXIT INT TERM

codex_auth_preflight

if codex_auth_is_truthy "${CODEX_WRAPPER_DRY_RUN:-}"; then
  codex_auth_log "CODEX_WRAPPER_DRY_RUN is set; skipping Codex launch."
  exit 0
fi

codex_args=()
if ! args_include_codex_profile "$@"; then
  resolved_codex_profile="$(resolve_codex_profile)"
  if [[ -n "${resolved_codex_profile}" ]]; then
    codex_args+=("$(codex_profile_flag)" "${resolved_codex_profile}")
  fi
fi
codex_args+=(-a on-request -s danger-full-access "$@")
"${CODEX_BIN}" "${codex_args[@]}"