#!/usr/bin/env bash
set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: claude-code-mode [mode] <task...>" >&2
  echo "Modes: anyrouter | volc | openrouter" >&2
  exit 1
fi

CONFIG_FILE="/home/lighthouse/.claude-provider-modes.json"
DEFAULT_WORKDIR="/home/lighthouse/coding-work"
LIGHTHOUSE_CMD_PREFIX='export HOME=/home/lighthouse; export NVM_DIR="$HOME/.nvm"; [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"; nvm use 22 >/dev/null;'

read_default_mode() {
  python3 - "$CONFIG_FILE" <<'PY'
import json, sys
cfg = json.load(open(sys.argv[1], 'r', encoding='utf-8'))
print(cfg.get('default', 'anyrouter'))
PY
}

is_restricted_mode() {
  local mode="$1"
  python3 - "$CONFIG_FILE" "$mode" <<'PY'
import json, sys
cfg = json.load(open(sys.argv[1], 'r', encoding='utf-8'))
restricted = set(cfg.get('restricted', []))
print('yes' if sys.argv[2] in restricted else 'no')
PY
}

extract_mode() {
  local mode="$1"
  python3 - "$CONFIG_FILE" "$mode" <<'PY'
import json, sys
cfg = json.load(open(sys.argv[1], 'r', encoding='utf-8'))
mode = sys.argv[2]
data = cfg.get('modes', {}).get(mode)
if not data:
    sys.exit(2)
print(data['base_url'])
print(data['auth_token'])
PY
}

mode_model_flag() {
  local mode="$1"
  case "$mode" in
    anyrouter)
      echo "--model opus"
      ;;
    *)
      echo ""
      ;;
  esac
}

MODE=""
TASK=""
DEFAULT_MODE="$(read_default_mode)"

if [[ $# -eq 1 ]]; then
  MODE="$DEFAULT_MODE"
  TASK="$1"
else
  case "$1" in
    anyrouter|volc|openrouter)
      MODE="$1"
      shift
      TASK="$*"
      ;;
    *)
      MODE="$DEFAULT_MODE"
      TASK="$*"
      ;;
  esac
fi

if [[ -z "$TASK" ]]; then
  echo "Task must not be empty" >&2
  exit 1
fi

if [[ "$(is_restricted_mode "$MODE")" == "yes" ]]; then
  echo "Mode '$MODE' requires explicit user approval before use." >&2
  exit 2
fi

mapfile -t PAIR < <(extract_mode "$MODE") || {
  echo "Failed to extract credentials for mode: $MODE" >&2
  exit 1
}

mkdir -p "$DEFAULT_WORKDIR"
chown lighthouse:lighthouse "$DEFAULT_WORKDIR"

BASE_URL="${PAIR[0]}"
AUTH_TOKEN="${PAIR[1]}"
MODEL_FLAG="$(mode_model_flag "$MODE")"
ESCAPED_TASK=$(printf '%q' "$TASK")
ESCAPED_URL=$(printf '%q' "$BASE_URL")
ESCAPED_TOKEN=$(printf '%q' "$AUTH_TOKEN")
ESCAPED_WORKDIR=$(printf '%q' "$DEFAULT_WORKDIR")

sudo -u lighthouse -H bash -lc "$LIGHTHOUSE_CMD_PREFIX cd $ESCAPED_WORKDIR; export ANTHROPIC_BASE_URL=$ESCAPED_URL; export ANTHROPIC_AUTH_TOKEN=$ESCAPED_TOKEN; claude --permission-mode bypassPermissions ${MODEL_FLAG} --print $ESCAPED_TASK"