#!/usr/bin/env bash
# Codex Key Tool (Linux) — cấu hình Codex CLI (~/.codex)
# Cách dùng:
#   chmod +x CodexKeyTool.sh
#   ./CodexKeyTool.sh                 # menu tương tác
#   ./CodexKeyTool.sh sk-xxxx         # áp dụng key (CLI)
#   ./CodexKeyTool.sh --reset         # gỡ cấu hình
set -euo pipefail
export LANG="${LANG:-C.UTF-8}"
export LC_ALL="${LC_ALL:-C.UTF-8}"

VERSION="1.0.0"
CODEX_DIR="${HOME}/.codex"
AUTH="${CODEX_DIR}/auth.json"
CFG="${CODEX_DIR}/config.toml"
MARKER="${CODEX_DIR}/.codex-key-tool-applied"
BACKUP="${CODEX_DIR}/.codex-key-tool-backup/config.toml"

say() {
  echo "[Codex Key Tool] $*" >&2
}

write_auth() {
  local key="$1"
  mkdir -p "$CODEX_DIR"
  if command -v python3 >/dev/null 2>&1; then
    AUTH_PATH="$AUTH" KEY="$key" python3 <<'PY'
import json, os
from pathlib import Path
p = Path(os.environ["AUTH_PATH"])
data = {"auth_mode": "apikey", "OPENAI_API_KEY": os.environ["KEY"]}
p.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
PY
  else
    local esc
    esc=$(printf '%s' "$key" | sed 's/\\/\\\\/g; s/"/\\"/g')
    printf '{\n  "auth_mode": "apikey",\n  "OPENAI_API_KEY": "%s"\n}\n' "$esc" >"$AUTH"
  fi
}

write_config_cli() {
  cat >"$CFG" <<'EOF'
# Codex API-only — Nghimmo (Linux)
model = "gpt-5.6-sol"
model_provider = "Nghimmo"
model_reasoning_effort = "medium"
sandbox_mode = "danger-full-access"
approval_policy = "never"

[model_providers.Nghimmo]
name = "Nghimmo"
base_url = "https://api.nghimmo.com/v1"
env_key = "OPENAI_API_KEY"
wire_api = "responses"
request_max_retries = 2
stream_max_retries = 4
stream_idle_timeout_ms = 120000

[agents.subagent]
model = "nghi/gpt-5.4-mini"

[features]
js_repl = false
EOF
}

apply_cli() {
  local key="$1"
  mkdir -p "$CODEX_DIR"
  if [ -f "$CFG" ] && [ ! -f "$BACKUP" ]; then
    mkdir -p "$(dirname "$BACKUP")"
    cp "$CFG" "$BACKUP"
  fi
  write_auth "$key"
  write_config_cli
  printf '{\n  "mode": "cli",\n  "version": "%s",\n  "api_only": true\n}\n' "$VERSION" >"$MARKER"
}

reset_all() {
  rm -f "$AUTH"
  if [ -f "$BACKUP" ]; then
    cp "$BACKUP" "$CFG"
  elif [ -f "$MARKER" ]; then
    rm -f "$CFG"
  fi
  rm -f "$MARKER"
}

ask_key() {
  local preset="${1:-}"
  if [ -n "$preset" ]; then
    printf '%s' "$preset"
    return
  fi
  local out=""
  if [ -t 0 ] && [ -r /dev/tty ]; then
    read -r -s -p "License key Codex (sk-...): " out </dev/tty
    echo >&2
  fi
  printf '%s' "$out"
}

do_apply() {
  local key="$1"
  key="$(printf '%s' "$key" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
  if [ -z "$key" ] || [ "${#key}" -lt 8 ] || [[ "$key" == *YOUR_API_KEY* ]]; then
    say "Key không hợp lệ."
    exit 1
  fi
  apply_cli "$key"
  say "Đã ghi ~/.codex/auth.json + config.toml"
  say "Chạy: codex"
  say "Extension VS Code Codex: tắt hẳn IDE rồi mở lại."
}

do_reset() {
  reset_all
  say "Đã reset cấu hình Codex trên máy này."
}

# --- main ---
ARG1="${1:-}"
case "$ARG1" in
  --reset|-r)
    do_reset
    exit 0
    ;;
esac

if [ -n "$ARG1" ] && [[ "$ARG1" == sk-* ]]; then
  do_apply "$ARG1"
  exit 0
fi

echo ""
echo "  Codex Key Tool (Linux) v${VERSION}"
echo "  Base URL: https://api.nghimmo.com/v1"
echo ""
echo "  1) Áp dụng key (Codex CLI)"
echo "  2) Reset cấu hình"
echo "  3) Thoát"
read -r -p "Chọn [1]: " choice </dev/tty 2>/dev/null || choice="1"
case "${choice:-1}" in
  2)
    do_reset
    ;;
  3)
    exit 0
    ;;
  *)
    key="$(ask_key "")"
    do_apply "$key"
    ;;
esac