#!/usr/bin/env bash

DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"

export HOME="${HOME:-/home/comma}"
export IQPILOT_PROPRIETARY_ROOT="$DIR/artifacts"
source "$DIR/launch_env.sh"
export PATH="/usr/local/venv/bin:$PATH"

function agnos_version_allowed {
  local current_version="$1"
  local expected_version="$2"
  local compat_version

  if [ "$current_version" = "$expected_version" ] || [[ "$current_version" = "$expected_version"-* ]]; then
    return 0
  fi

  IFS=',' read -r -a compat_versions <<< "${AGNOS_COMPAT_VERSIONS:-}"
  for compat_version in "${compat_versions[@]}"; do
    compat_version="${compat_version// /}"
    if [ -n "$compat_version" ] && [ "$current_version" = "$compat_version" ]; then
      return 0
    fi
  done

  return 1
}

function set_lite_hw() {
  # Detect mr.one C3 Lite: tici platform without a cellular modem at i2c 0x10
  if grep -q "tici" /sys/firmware/devicetree/base/model 2>/dev/null; then
    output=$(i2cget -y 0 0x10 0x00 2>/dev/null)
    if [ -z "$output" ]; then
      echo "C3 Lite hardware detected"
      export LITE=1
      echo "1" > /tmp/lite_hw
    fi
  fi
}

function install_iq_command() {
  local rc_file="$HOME/.bashrc"
  local iq_script="$DIR/iqpilot/tools/iq.sh"

  [ -w "$HOME" ] || return 0
  touch "$rc_file" 2>/dev/null || return 0
  local rc_temp="${rc_file}.iq-tmp.$$"
  awk '!/^alias op=.*tools\/op\.sh/ && !/^alias iq=.*tools\/iq\.sh/' "$rc_file" > "$rc_temp" || return 0
  mv "$rc_temp" "$rc_file" || return 0
  printf '\nalias iq='%s'\n' "'${iq_script} \"\$@\"'" >> "$rc_file"
}

function agnos_init {
  # TODO: move this to agnos
  sudo rm -f /data/etc/NetworkManager/system-connections/*.nmmeta

  # set success flag for current boot slot
  sudo abctl --set_success

  # TODO: do this without udev in AGNOS
  # udev does this, but sometimes we startup faster
  sudo chgrp gpu /dev/adsprpc-smd /dev/ion /dev/kgsl-3d0
  sudo chmod 660 /dev/adsprpc-smd /dev/ion /dev/kgsl-3d0

  # iptables-nft fails on this kernel (no nf_tables module), breaking NM hotspot NAT rules
  if [ "$(readlink /etc/alternatives/iptables)" != "/usr/sbin/iptables-legacy" ]; then
    sudo mount -o remount,rw /
    sudo ln -sf /usr/sbin/iptables-legacy /etc/alternatives/iptables
    sudo ln -sf /usr/sbin/iptables-legacy-restore /etc/alternatives/iptables-restore
    sudo ln -sf /usr/sbin/iptables-legacy-save /etc/alternatives/iptables-save
    sudo mount -o remount,ro /
  fi

  # Check if AGNOS update is required
  CURRENT_AGNOS_VERSION=$(< /VERSION)
  if ! agnos_version_allowed "$CURRENT_AGNOS_VERSION" "$AGNOS_VERSION"; then
    AGNOS_PY="$DIR/iqpilot/system/hardware/tici/agnos.py"
    MANIFEST="$DIR/iqpilot/system/hardware/tici/agnos.json"
    if [ -f /sys/firmware/devicetree/base/model ]; then
      DEVICE_MODEL="$(tr -d '\0' </sys/firmware/devicetree/base/model)"
      case "$DEVICE_MODEL" in
        *"comma tici"*|*"comma three"*)
          # comma 3 keeps its stock 15.1 bootloaders: comma's 16 abl has a board-id
          # check that rejects comma 3 ("Unsupported firmware detected"). It still gets
          # the IQ boot (comma_tici.dtb) + IQ.OS 3.4 system via this hybrid manifest.
          MANIFEST="$DIR/iqpilot/system/hardware/tici/agnos_tici_15_1.json"
          ;;
      esac
    fi
    if $AGNOS_PY --verify $MANIFEST; then
      sudo reboot
    fi
    # On stock AGNOS the updater picks updater_weston (weston is up), a compiled display binary that
    # can't get a compositor surface on a first boot, so the IQ.OS flash silently wedges on the comma
    # logo. There, flash headless via agnos.py --swap (identical download+write+swap, no surface).
    # On IQ.OS weston is down -> the updater picks updater_magic (DRM), which renders the on-screen
    # progress prompt fine, so fall through and keep it. This mirrors the updater's own weston check.
    if systemctl is-active --quiet weston-ready; then
      if $AGNOS_PY --swap $MANIFEST; then
        sudo reboot
      fi
    fi
    $DIR/iqpilot/system/hardware/tici/updater $AGNOS_PY $MANIFEST
  fi
}

function launch {
  # Remove orphaned git lock if it exists on boot
  [ -f "$DIR/.git/index.lock" ] && rm -f $DIR/.git/index.lock
  for server_dir in "$HOME/.cursor-server" "$HOME/.windsurf-server" "$HOME/.vscode-server"; do
    [ -L "$server_dir" ] && unlink "$server_dir"
  done

  install_iq_command

  # Check to see if there's a valid overlay-based update available. Conditions
  # are as follows:
  #
  # 1. The DIR init file has to exist, with a newer modtime than anything in
  #    the DIR Git repo. This checks for local development work or the user
  #    switching branches/forks, which should not be overwritten.
  # 2. The FINALIZED consistent file has to exist, indicating there's an update
  #    that completed successfully and synced to disk.

  if [ -f "${DIR}/.overlay_init" ]; then
    find ${DIR}/.git -newer ${DIR}/.overlay_init | grep -q '.' 2> /dev/null
    if [ $? -eq 0 ]; then
      echo "${DIR} has been modified, skipping overlay update installation"
    else
      if [ -f "${STAGING_ROOT}/finalized/.overlay_consistent" ]; then
        if [ ! -d /data/safe_staging/old_openpilot ]; then
          echo "Valid overlay update found, installing"
          LAUNCHER_LOCATION="${BASH_SOURCE[0]}"

          mv $DIR /data/safe_staging/old_openpilot
          mv "${STAGING_ROOT}/finalized" $DIR
          cd $DIR

          echo "Restarting launch script ${LAUNCHER_LOCATION}"
          unset AGNOS_VERSION
          exec "${LAUNCHER_LOCATION}"
        else
          echo "openpilot backup found, not updating"
          # TODO: restore backup? This means the updater didn't start after swapping
        fi
      fi
    fi
  fi

  # Best-effort: install the verified runtime before anything starts the services that
  # need it. This only succeeds on a tree that has built _verified_import.so, so on a
  # prebuilt release install it is a no-op -- there the runtime arrives with the IQ.OS
  # flash, whose image bakes it in. What actually fixes the 20+ minute first-install hang
  # is --no-block on the service starts below: hephaestusd/ble-transportd/flockd each
  # ExecStartPre-wait up to 600s for /usr/libexec/iqpilot/iqpilot_bundle_runner.
  if [ -x "$DIR/iqpilot/system/proprietary_runtime/install_verified_runtime.sh" ]; then
    "$DIR/iqpilot/system/proprietary_runtime/install_verified_runtime.sh" || true
  fi

  # Install/update proprietary runtime bundles.
  if [ -f "$DIR/artifacts/runtime/ensure_private_installed.sh" ]; then
    bash "$DIR/artifacts/runtime/ensure_private_installed.sh" || true
  elif [ -x "$DIR/scripts/iqpilot/ensure_navd_private_installed.sh" ]; then
    # Backward-compat fallback for older trees.
    "$DIR/scripts/iqpilot/ensure_navd_private_installed.sh" || true
  fi

  PYTHONPATH="$DIR" /usr/local/venv/bin/python3 -c "from iqpilot.common.git_creds import install_credential_helper; install_credential_helper('$DIR')" 2>/dev/null || true
  PACKAGE_LOCK_SHA="$(sha256sum "$DIR/uv.lock" | awk '{print $1}')"
  INSTALLED_PACKAGE_LOCK_SHA="$(cat "$DIR/.iqpilot-package-lock-sha256" 2>/dev/null || true)"
  BASE_SITE_PACKAGES="$(/usr/local/venv/bin/python3 -c 'import site; print(site.getsitepackages()[0])')"
  PROJECT_RAYLIB="$("$DIR/.venv/bin/python3" -c 'import importlib.metadata; print(importlib.metadata.distribution("raylib").locate_file(""))' 2>/dev/null || true)"
  if [[ "$PROJECT_RAYLIB" = "$DIR/.venv"/* ]]; then
    sudo rm -rf "$DIR/.venv"
    rm -f "$DIR/.iqpilot-package-lock-sha256"
    INSTALLED_PACKAGE_LOCK_SHA=""
  fi
  VENV_SITE_PACKAGES="$("$DIR/.venv/bin/python3" -c 'import site; print(site.getsitepackages()[0])' 2>/dev/null || true)"
  PACKAGES_READY=0
  if [ -d "$DIR/_vendor_runtime" ] && PYTHONPATH="$DIR/_vendor_runtime" /usr/local/venv/bin/python3 -c "import iqdbc, msgq, panda, rednose, teleoprtc, tinygrad" 2>/dev/null; then
    PACKAGES_READY=1
  elif [ "$PACKAGE_LOCK_SHA" = "$INSTALLED_PACKAGE_LOCK_SHA" ] && "$DIR/.venv/bin/python3" -c "import iqdbc, msgq, panda, rednose, teleoprtc, tinygrad" 2>/dev/null; then
    PACKAGES_READY=1
  fi
  if [ "$PACKAGES_READY" != "1" ]; then
    UV_CACHE_DIR="$DIR/.uv-cache"
    if [ ! -x "$DIR/.venv/bin/python3" ]; then
      UV_CACHE_DIR="$UV_CACHE_DIR" uv venv --python /usr/local/venv/bin/python3 "$DIR/.venv" || return 1
      VENV_SITE_PACKAGES="$("$DIR/.venv/bin/python3" -c 'import site; print(site.getsitepackages()[0])')"
    fi
    sudo chown -R "$(id -u):$(id -g)" "$DIR/.venv" "$UV_CACHE_DIR" "$DIR/_vendor_sources" 2>/dev/null || true
    IQDBC_PACKAGE_SOURCE=""
    PACKAGE_SOURCES=()
    while IFS=$'\t' read -r package_name package_source; do
      PACKAGE_SOURCES+=("$package_source")
      if [ "$package_name" = "iqdbc" ]; then
        IQDBC_PACKAGE_SOURCE="$package_source"
      fi
    done < <(/usr/local/venv/bin/python3 "$DIR/scripts/iqpilot/runtime_package_sources.py" "$DIR")
    if [ "${#PACKAGE_SOURCES[@]}" = "0" ] || [ -z "$IQDBC_PACKAGE_SOURCE" ]; then
      return 1
    fi
    PACKAGE_BUILD_PYTHONPATH="$BASE_SITE_PACKAGES:$VENV_SITE_PACKAGES"
    UV_CACHE_DIR="$UV_CACHE_DIR" PYTHONPATH="$PACKAGE_BUILD_PYTHONPATH" PATH="/usr/local/venv/bin:/usr/bin:$PATH" \
      uv pip install --python "$DIR/.venv/bin/python" --no-build-isolation --no-deps --reinstall "$IQDBC_PACKAGE_SOURCE" || return 1
    UV_CACHE_DIR="$UV_CACHE_DIR" PYTHONPATH="$PACKAGE_BUILD_PYTHONPATH" PATH="/usr/local/venv/bin:/usr/bin:$PATH" \
      uv pip install --python "$DIR/.venv/bin/python" --no-build-isolation --no-deps --reinstall "${PACKAGE_SOURCES[@]}" || return 1
    printf '%s\n' "$PACKAGE_LOCK_SHA" > "$DIR/.iqpilot-package-lock-sha256"
  fi
  if [ -n "$VENV_SITE_PACKAGES" ]; then
    printf 'import site; site.addsitedir("%s")\n' "$BASE_SITE_PACKAGES" | sudo tee "$VENV_SITE_PACKAGES/iqpilot-system-venv.pth" >/dev/null
  fi
  export PATH="$DIR/.venv/bin:$PATH"

  RUNTIME_COMPAT_ROOT="$DIR/.iqpilot/runtime_root"
  mkdir -p "$RUNTIME_COMPAT_ROOT"
  ln -sfn "$DIR/iqpilot" "$RUNTIME_COMPAT_ROOT/iqpilot"
  ln -sfn iqpilot "$RUNTIME_COMPAT_ROOT/openpilot"
  ln -sfn "$DIR/iqpilot/system" "$RUNTIME_COMPAT_ROOT/system"

  ln -sfn $(pwd) /data/pythonpath
  export IQPILOT_SOURCE_ROOT="${IQPILOT_SOURCE_ROOT:-$DIR/iqpilot}"
  export PYTHONSAFEPATH=1
  VERIFIED_PYTHON_ROOT="/usr/libexec/iqpilot/python"
  IQPILOT_PYTHONPATH="$VENV_SITE_PACKAGES:$PWD"
  if [ -d "$PWD/_vendor_runtime" ]; then
    IQPILOT_PYTHONPATH="$PWD/_vendor_runtime:$IQPILOT_PYTHONPATH"
  fi
  if [ -d "$VERIFIED_PYTHON_ROOT" ]; then
    export PYTHONPATH="$VERIFIED_PYTHON_ROOT:$IQPILOT_PYTHONPATH"
  else
    export PYTHONPATH="$IQPILOT_PYTHONPATH"
  fi

  # Install independent systemd services BEFORE build so they run even
  # when openpilot fails to compile — SSH/BLE/hephaestusd must always
  # be reachable for device recovery.
  for service_name in hephaestusd ble-transportd flockd; do
    service_src="$DIR/iqpilot/system/${service_name}.service"
    service_dst="/etc/systemd/system/${service_name}.service"
    service_lib="/lib/systemd/system/${service_name}.service"
    service_dropin="/run/systemd/system/${service_name}.service.d"
    service_exec="$(grep '^ExecStart=' "$service_src")"
    sudo mkdir -p "$service_dropin"
    printf '[Service]\nWorkingDirectory=%s\nEnvironment="IQPILOT_SOURCE_ROOT=%s/iqpilot"\nEnvironment="IQPILOT_PROPRIETARY_ROOT=%s/artifacts"\nEnvironment="PYTHONPATH=/usr/libexec/iqpilot/python:%s:%s"\nExecStart=\n%s\n' "$RUNTIME_COMPAT_ROOT" "$DIR" "$DIR" "$VENV_SITE_PACKAGES" "$DIR" "$service_exec" | sudo tee "$service_dropin/iqpilot-packages.conf" >/dev/null
    sudo systemctl daemon-reload
    if [ -f "$service_lib" ] && grep -q "/usr/libexec/iqpilot/iqpilot_bundle_runner" "$service_lib"; then
      if [ -f "$service_dst" ]; then
        sudo mount -o remount,rw /
        sudo rm -f "$service_dst"
        sudo systemctl daemon-reload
        sudo mount -o remount,ro /
      fi
      sudo systemctl enable "${service_name}.service"
      # --no-block: these units ExecStartPre-wait for the verified runtime. Blocking here
      # made a missing runner stall the whole install for the unit's 600s timeout (x3 units).
      if systemctl is-active --quiet "${service_name}.service"; then
        sudo systemctl restart --no-block "${service_name}.service"
      else
        sudo systemctl start --no-block "${service_name}.service"
      fi
    elif [ -f "$service_src" ]; then
      if [ ! -f "$service_dst" ] || ! cmp -s "$service_src" "$service_dst"; then
        sudo mount -o remount,rw /
        sudo cp "$service_src" "$service_dst"
        sudo systemctl daemon-reload
        sudo systemctl enable "${service_name}.service"
        sudo mount -o remount,ro /
        sudo systemctl restart --no-block "${service_name}.service"
      elif ! systemctl is-active --quiet "${service_name}.service"; then
        sudo systemctl start --no-block "${service_name}.service"
      fi
    fi
  done

  # detect mr.one C3 Lite hardware
  set_lite_hw

  # hardware specific init
  if [ -f /AGNOS ]; then
    agnos_init

    sudo "$DIR/iqpilot/system/hardware/tici/zram_setup.sh" || true
  fi

  if [ -f "$DIR/artifacts/runtime/apply_boot_branding.py" ]; then
    sudo python3 "$DIR/artifacts/runtime/apply_boot_branding.py" || true
  fi

  # /home is an ephemeral overlay (resets each boot); re-inject the source line. best-effort
  if [ -f "$DIR/iqpilot/tools/iqpilot/git-pretty.sh" ] && [ -w "$HOME/.bashrc" ]; then
    grep -q 'iqpilot/git-pretty.sh' "$HOME/.bashrc" 2>/dev/null || \
      echo "[ -f $DIR/iqpilot/tools/iqpilot/git-pretty.sh ] && source $DIR/iqpilot/tools/iqpilot/git-pretty.sh" >> "$HOME/.bashrc" || true
  fi

  # write tmux scrollback to a file
  tmux capture-pane -pq -S-1000 > /tmp/launch_log

  # start manager
  cd "$DIR/iqpilot/system/manager"
  export PWD="$(pwd)"
  if [ ! -f $DIR/prebuilt ]; then
    if pkill -f /tmp/installer 2>/dev/null; then sleep 1; fi
    "$DIR/.venv/bin/python3" ./build.py
  fi

  "$DIR/.venv/bin/python3" ./manager.py

  # if broken, keep on screen error
  while true; do sleep 1; done
}

launch