o

#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"

CREDS_ENV_FILE_LOCAL="${SCRIPT_DIR}/.a5c/creds.env"
CREDS_ENV_FILE_GLOBAL="${HOME}/.a5c/creds.env"
MANAGED_BEGIN="# --- A5C managed by \`o init\` ---"
MANAGED_END="# --- End A5C managed ---"
GITIGNORE_MANAGED_BEGIN="# --- o init install managed ---"
GITIGNORE_MANAGED_END="# --- end o init install managed ---"
GEMINI_DEFAULT_INSTALL_COMMAND="npm install -g @google/gemini-cli"
GEMINI_DEFAULT_COMMAND_TEMPLATE='gemini --model "$A5C_SELECTED_MODEL" "read {{prompt_path}} and follow the instructions in the file - use the plannedwork process."'

die() {
  echo "error: $*" >&2
  exit 1
}

info() {
  echo "$*" >&2
}

print_help() {
  cat <<'EOF'
Usage:
  o init [--global|--local|--file PATH] [--yes]
  o init --install [--to DIR] [--force] [--yes]
  o doctor [--global|--local|--file PATH] [--show-install-hints]
  o [--global|--local|--file PATH] "your request here"
  o help

Notes:
  - Config format: env-style file (KEY=VALUE) loaded by this script (no shell code).
  - Default config path (global): ~/.a5c/creds.env
  - Local config path (repo): .a5c/creds.env (next to ./o)
  - Resolution order: O_CREDS_FILE > global > local
  - Supported runner presets: codex, claude-code, gemini, custom
  - Re-running init is safe: only the managed block is rewritten; unmanaged content is preserved.
  - Windows: use WSL2 (recommended) or Git Bash/MSYS2 with mktemp/chmod available
EOF
}

resolve_creds_file() {
  if [[ -n "${O_CREDS_FILE:-}" ]]; then
    echo "${O_CREDS_FILE}"
    return 0
  fi
  if [[ -f "${CREDS_ENV_FILE_GLOBAL}" ]]; then
    echo "${CREDS_ENV_FILE_GLOBAL}"
    return 0
  fi
  if [[ -f "${CREDS_ENV_FILE_LOCAL}" ]]; then
    echo "${CREDS_ENV_FILE_LOCAL}"
    return 0
  fi
  echo "${CREDS_ENV_FILE_GLOBAL}"
}

ensure_parent_dir() {
  local file_path="$1"
  local parent_dir
  parent_dir="$(dirname -- "$file_path")"
  mkdir -p -- "$parent_dir"
  chmod 700 -- "$parent_dir" 2>/dev/null || true
}

is_windows_like() {
  case "$(uname -s 2>/dev/null || echo unknown)" in
    MINGW*|MSYS*|CYGWIN*) return 0 ;;
    *) return 1 ;;
  esac
}

get_file_mode_octal() {
  local file_path="$1"
  local mode=""
  if command -v stat >/dev/null 2>&1; then
    mode="$(stat -c '%a' -- "$file_path" 2>/dev/null || true)"
    if [[ -z "$mode" ]]; then
      mode="$(stat -f '%Lp' "$file_path" 2>/dev/null || true)"
    fi
  fi
  if [[ -z "$mode" ]] && command -v python3 >/dev/null 2>&1; then
    mode="$(python3 - "$file_path" 2>/dev/null <<'PY'
import os, sys
st = os.stat(sys.argv[1])
print(oct(st.st_mode & 0o777)[2:])
PY
)"
  fi
  printf '%s' "$mode"
}

warn_if_insecure_creds_perms() {
  local file_path="$1"
  local mode
  mode="$(get_file_mode_octal "$file_path")"
  if [[ -z "$mode" ]]; then
    info "warning: could not determine permissions for $file_path"
    return 0
  fi
  if ! [[ "$mode" =~ ^[0-7]{3,4}$ ]]; then
    info "warning: could not parse permissions for $file_path (mode=$mode)"
    return 0
  fi
  local mode_int=$((8#${mode}))
  if (( (mode_int & 077) != 0 )); then
    if is_windows_like; then
      info "warning: config may be readable by other users (mode $mode). On Windows filesystems, chmod may not be enforced; prefer WSL2."
    else
      chmod 600 -- "$file_path" 2>/dev/null || true
      mode="$(get_file_mode_octal "$file_path")"
      if [[ -n "$mode" && "$mode" =~ ^[0-7]{3,4}$ ]]; then
        mode_int=$((8#${mode}))
      fi
      if (( (mode_int & 077) != 0 )); then
        info "warning: config is group/world accessible (mode $mode). Recommended: chmod 600 $(shell_escape_sq "$file_path")"
      fi
    fi
  fi

  local parent_dir
  parent_dir="$(dirname -- "$file_path")"
  local parent_mode
  parent_mode="$(get_file_mode_octal "$parent_dir")"
  if [[ -n "$parent_mode" && "$parent_mode" =~ ^[0-7]{3,4}$ ]]; then
    local parent_int=$((8#${parent_mode}))
    if (( (parent_int & 077) != 0 )); then
      if is_windows_like; then
        info "warning: config directory may be accessible by other users (mode $parent_mode). Prefer WSL2 for reliable permissions."
      else
        chmod 700 -- "$parent_dir" 2>/dev/null || true
        parent_mode="$(get_file_mode_octal "$parent_dir")"
        if [[ -n "$parent_mode" && "$parent_mode" =~ ^[0-7]{3,4}$ ]]; then
          parent_int=$((8#${parent_mode}))
        fi
        if (( (parent_int & 077) != 0 )); then
          info "warning: config directory is group/world accessible (mode $parent_mode). Recommended: chmod 700 $(shell_escape_sq "$parent_dir")"
        fi
      fi
    fi
  fi
}

parse_env_value_kv_only() {
  local raw="$1"
  if [[ "$raw" == \"*\" && "$raw" == *\" ]]; then
    raw="${raw:1:${#raw}-2}"
    raw="${raw//\\\"/\"}"
    raw="${raw//\\\\/\\}"
    printf '%s' "$raw"
    return 0
  fi
  if [[ "$raw" == \'*\' && "$raw" == *\' ]]; then
    printf '%s' "${raw:1:${#raw}-2}"
    return 0
  fi
  if [[ "$raw" == *[[:space:]]#* ]]; then
    raw="${raw%%[[:space:]]#*}"
    raw="${raw%"${raw##*[![:space:]]}"}"
  fi
  if [[ "$raw" == *$'\t'* || "$raw" == *" "* ]]; then
    die "invalid value with whitespace (use quotes): $raw"
  fi
  printf '%s' "$raw"
}

load_env_file_kv_only() {
  local file_path="$1"
  [[ -f "$file_path" ]] || return 0
  local line trimmed key raw value
  while IFS= read -r line || [[ -n "$line" ]]; do
    line="${line%$'\r'}"
    trimmed="${line#"${line%%[![:space:]]*}"}"
    trimmed="${trimmed%"${trimmed##*[![:space:]]}"}"
    [[ -n "$trimmed" ]] || continue
    [[ "$trimmed" =~ ^# ]] && continue
    [[ "$trimmed" == "$MANAGED_BEGIN" || "$trimmed" == "$MANAGED_END" ]] && continue
    if [[ "$trimmed" =~ ^export[[:space:]]+ ]]; then
      trimmed="${trimmed#export}"
      trimmed="${trimmed#"${trimmed%%[![:space:]]*}"}"
    fi
    if [[ "$trimmed" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(.*)$ ]]; then
      key="${BASH_REMATCH[1]}"
      raw="${BASH_REMATCH[2]}"
      raw="${raw#"${raw%%[![:space:]]*}"}"
      raw="${raw%"${raw##*[![:space:]]}"}"
      value="$(parse_env_value_kv_only "$raw")"
      export "${key}=${value}"
      continue
    fi
    die "unsupported line in config (only KEY=VALUE supported): $line"
  done <"$file_path"
}

extract_unmanaged() {
  local file_path="$1"
  [[ -f "$file_path" ]] || return 0
  awk -v begin="$MANAGED_BEGIN" -v end="$MANAGED_END" '
    $0 == begin { in_block=1; next }
    $0 == end { in_block=0; next }
    in_block != 1 { print }
  ' "$file_path"
}

file_has_complete_managed_block() {
  local file_path="$1"
  [[ -f "$file_path" ]] || return 1
  # Require both markers as full lines; if the block is malformed, do not try to do an in-place replace.
  grep -Fqx -- "$MANAGED_BEGIN" "$file_path" 2>/dev/null || return 1
  grep -Fqx -- "$MANAGED_END" "$file_path" 2>/dev/null || return 1
  return 0
}

file_has_complete_block() {
  local file_path="$1"
  local begin="$2"
  local end="$3"
  [[ -f "$file_path" ]] || return 1
  grep -Fqx -- "$begin" "$file_path" 2>/dev/null || return 1
  grep -Fqx -- "$end" "$file_path" 2>/dev/null || return 1
  return 0
}

get_var_from_env_file() {
  local key="$1"
  local file_path="$2"
  [[ -f "$file_path" ]] || return 0
  # Only parse simple KEY=VALUE lines. This avoids executing arbitrary code.
  local line value
  if command -v rg >/dev/null 2>&1; then
    line="$(rg --no-filename -m 1 -e "^${key}=" "$file_path" 2>/dev/null | head -n 1 || true)"
  else
    line="$(grep -m 1 -E "^${key}=" "$file_path" 2>/dev/null || true)"
  fi
  [[ -n "$line" ]] || return 0
  value="${line#*=}"
  if [[ "$value" == \"*\" && "$value" == *\" ]]; then
    value="${value:1:${#value}-2}"
    value="${value//\\\"/\"}"
    value="${value//\\\\/\\}"
  fi
  printf '%s' "$value"
}

quote_env_value() {
  local v="$1"
  [[ "$v" != *$'\n'* ]] || die "newline not allowed in values"
  v="${v//\\/\\\\}"
  v="${v//\"/\\\"}"
  printf '"%s"' "$v"
}

shell_escape_sq() {
  local s="$1"
  s="${s//\'/\'\"\'\"\'}"
  printf "'%s'" "$s"
}

is_likely_gemini_template() {
  local t="$1"
  t="${t#"${t%%[![:space:]]*}"}"
  [[ "$t" == gemini || "$t" == gemini\ * || "$t" == $'gemini\t'* ]]
}

apply_template() {
  local template="$1"
  local key="$2"
  local replacement="$3"
  local out="${template//${key}/${replacement}}"
  printf '%s' "$out"
}

prompt_line() {
  local prompt="$1"
  local default_value="${2:-}"
  local input
  if [[ -n "$default_value" ]]; then
    read -r -p "${prompt} [${default_value}]: " input
    input="${input:-$default_value}"
  else
    read -r -p "${prompt}: " input
  fi
  printf '%s' "$input"
}

prompt_secret() {
  local prompt="$1"
  local already_set="${2:-false}"
  local input
  if [[ "$already_set" == "true" ]]; then
    read -r -s -p "${prompt} (leave blank to keep existing): " input
    echo >&2
  else
    read -r -s -p "${prompt}: " input
    echo >&2
  fi
  printf '%s' "$input"
}

write_creds_file() {
  local target_file="$1"
  local provider="$2"
  local cli_command="$3"
  local model="$4"
  local azure_project_name="${5:-}"
  local azure_api_key="${6:-}"
  local openai_api_key="${7:-}"
  local anthropic_api_key="${8:-}"
  local gemini_api_key="${9:-}"
  local gemini_command_template="${10:-}"
  local gemini_install_command="${11:-}"
  local custom_command_template="${12:-}"
  local custom_install_command="${13:-}"

  ensure_parent_dir "$target_file"

  (
    set -euo pipefail
    umask 077
    local tmp managed_inner_tmp
    tmp="$(mktemp "${target_file}.tmp.XXXXXX")"
    managed_inner_tmp="$(mktemp "${target_file}.managed.XXXXXX")"
    cleanup_write_creds_file() {
      rm -f -- "$tmp" "$managed_inner_tmp" 2>/dev/null || true
    }
    trap cleanup_write_creds_file EXIT

    {
      printf 'A5C_PROVIDER_NAME=%s\n' "$(quote_env_value "$provider")"
      printf 'A5C_SELECTED_CLI_COMMAND=%s\n' "$(quote_env_value "$cli_command")"
      printf 'A5C_SELECTED_MODEL=%s\n' "$(quote_env_value "$model")"

      case "$provider" in
        azure)
          printf 'AZURE_OPENAI_PROJECT_NAME=%s\n' "$(quote_env_value "$azure_project_name")"
          printf 'AZURE_OPENAI_API_KEY=%s\n' "$(quote_env_value "$azure_api_key")"
          ;;
        openai)
          printf 'OPENAI_API_KEY=%s\n' "$(quote_env_value "$openai_api_key")"
          ;;
        anthropic)
          printf 'ANTHROPIC_API_KEY=%s\n' "$(quote_env_value "$anthropic_api_key")"
          ;;
      esac

      if [[ "$provider" == "gemini" ]]; then
        printf 'GEMINI_API_KEY=%s\n' "$(quote_env_value "$gemini_api_key")"
      fi

      if [[ "$cli_command" == "gemini" ]]; then
        if [[ -n "$gemini_command_template" ]]; then
          printf 'A5C_GEMINI_COMMAND_TEMPLATE=%s\n' "$(quote_env_value "$gemini_command_template")"
        fi
        if [[ -n "$gemini_install_command" ]]; then
          printf 'A5C_GEMINI_INSTALL_COMMAND=%s\n' "$(quote_env_value "$gemini_install_command")"
        fi
      elif [[ "$cli_command" != "codex" && "$cli_command" != "claude-code" ]]; then
        printf 'A5C_CUSTOM_COMMAND_TEMPLATE=%s\n' "$(quote_env_value "$custom_command_template")"
        if [[ -n "$custom_install_command" ]]; then
          printf 'A5C_CUSTOM_INSTALL_COMMAND=%s\n' "$(quote_env_value "$custom_install_command")"
        fi
      fi
    } >"$managed_inner_tmp"

    if file_has_complete_managed_block "$target_file"; then
      awk -v begin="$MANAGED_BEGIN" -v end="$MANAGED_END" -v repl="$managed_inner_tmp" '
        $0 == begin {
          print $0
          while ((getline l < repl) > 0) print l
          close(repl)
          in_block = 1
          next
        }
        in_block == 1 {
          if ($0 == end) {
            in_block = 0
            print $0
          }
          next
        }
        { print }
      ' "$target_file" >"$tmp"
    else
      {
        echo "$MANAGED_BEGIN"
        cat "$managed_inner_tmp"
        echo "$MANAGED_END"
        if [[ -f "$target_file" ]]; then
          echo
          cat "$target_file"
        fi
      } >"$tmp"
    fi

    chmod 600 -- "$tmp" 2>/dev/null || true
    mv -f -- "$tmp" "$target_file"
    chmod 600 -- "$target_file" 2>/dev/null || true
  )
  warn_if_insecure_creds_perms "$target_file"
}

extract_unmanaged_block() {
  local file_path="$1"
  local begin="$2"
  local end="$3"
  [[ -f "$file_path" ]] || return 0
  awk -v begin="$begin" -v end="$end" '
    $0 == begin { in_block=1; next }
    $0 == end { in_block=0; next }
    in_block != 1 { print }
  ' "$file_path"
}

update_gitignore() {
  local gitignore_path="$1"
  ensure_parent_dir "$gitignore_path"
  (
    set -euo pipefail
    umask 077
    local tmp managed_inner_tmp
    tmp="$(mktemp "${gitignore_path}.tmp.XXXXXX")"
    managed_inner_tmp="$(mktemp "${gitignore_path}.managed.XXXXXX")"
    cleanup_update_gitignore() {
      rm -f -- "$tmp" "$managed_inner_tmp" 2>/dev/null || true
    }
    trap cleanup_update_gitignore EXIT

    {
      echo ".a5c/creds.env"
      echo ".a5c/creds.env.tmp.*"
      echo ".a5c/runs/"
    } >"$managed_inner_tmp"

    if file_has_complete_block "$gitignore_path" "$GITIGNORE_MANAGED_BEGIN" "$GITIGNORE_MANAGED_END"; then
      awk -v begin="$GITIGNORE_MANAGED_BEGIN" -v end="$GITIGNORE_MANAGED_END" -v repl="$managed_inner_tmp" '
        $0 == begin {
          print $0
          while ((getline l < repl) > 0) print l
          close(repl)
          in_block = 1
          next
        }
        in_block == 1 {
          if ($0 == end) {
            in_block = 0
            print $0
          }
          next
        }
        { print }
      ' "$gitignore_path" >"$tmp"
    else
      {
        echo "$GITIGNORE_MANAGED_BEGIN"
        cat "$managed_inner_tmp"
        echo "$GITIGNORE_MANAGED_END"
        if [[ -f "$gitignore_path" ]]; then
          echo
          cat "$gitignore_path"
        fi
      } >"$tmp"
    fi

    mv -f -- "$tmp" "$gitignore_path"
  )
}

install_scaffold() {
  local target_dir="$1"
  local force="${2:-false}"
  local assume_yes="${3:-false}"

  [[ -d "$target_dir" ]] || die "install target is not a directory: $target_dir"

  local source_root="$SCRIPT_DIR"
  local source_a5c="${source_root}/.a5c"
  [[ -f "${source_root}/o" ]] || die "missing source script: ${source_root}/o"
  [[ -d "$source_a5c" ]] || die "missing source templates: $source_a5c"

  local rel
  while IFS= read -r rel; do
    local src="${source_root}/${rel}"
    local dst="${target_dir}/${rel}"
    local dst_dir
    dst_dir="$(dirname -- "$dst")"
    mkdir -p -- "$dst_dir"
    if [[ -e "$dst" && "$force" != "true" ]]; then
      if [[ "$assume_yes" == "true" ]]; then
        :
      else
        local yn
        read -r -p "File exists at ${dst}. Overwrite? [y/N]: " yn
        yn="${yn:-N}"
        [[ "$yn" =~ ^[Yy]$ ]] || continue
      fi
    fi
    cp -f -- "$src" "$dst"
  done < <(
    {
      echo "o"
      find "${source_root}/.a5c/functions" -type f -print
      find "${source_root}/.a5c/processes" -type f -print
      echo "${source_root}/.a5c/o.md"
    } | sed "s|^${source_root}/||" | grep -v '^\\.a5c/runs/' || true
  )

  chmod +x -- "${target_dir}/o" 2>/dev/null || true
  update_gitignore "${target_dir}/.gitignore"

  info "Installed into: $target_dir"
  info "Next:"
  info "  cd $(shell_escape_sq "$target_dir")"
  info "  ./o init"
  info "  ./o doctor"
}

init_cmd() {
  local target_file="$CREDS_ENV_FILE_GLOBAL"
  local assume_yes="false"
  local install_mode="false"
  local install_target_dir=""
  local force_install="false"

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --local) target_file="$CREDS_ENV_FILE_LOCAL" ;;
      --global) target_file="$CREDS_ENV_FILE_GLOBAL" ;;
      --file)
        shift
        [[ $# -gt 0 ]] || die "--file requires a path"
        target_file="$1"
        ;;
      --install) install_mode="true" ;;
      --to)
        shift
        [[ $# -gt 0 ]] || die "--to requires a directory"
        install_target_dir="$1"
        ;;
      --force) force_install="true" ;;
      --yes) assume_yes="true" ;;
      -h|--help) print_help; exit 0 ;;
      *) die "unknown init flag: $1" ;;
    esac
    shift
  done

  if [[ "$install_mode" == "true" ]]; then
    install_target_dir="${install_target_dir:-$PWD}"
    install_scaffold "$install_target_dir" "$force_install" "$assume_yes"
    return 0
  fi

  local existing_cli existing_provider existing_model
  local existing_azure_project existing_azure_key existing_openai_key existing_anthropic_key
  local existing_gemini_key existing_gemini_template existing_gemini_install existing_custom_template existing_custom_install
  existing_cli="$(get_var_from_env_file "A5C_SELECTED_CLI_COMMAND" "$target_file")"
  existing_provider="$(get_var_from_env_file "A5C_PROVIDER_NAME" "$target_file")"
  existing_model="$(get_var_from_env_file "A5C_SELECTED_MODEL" "$target_file")"
  existing_azure_project="$(get_var_from_env_file "AZURE_OPENAI_PROJECT_NAME" "$target_file")"
  existing_azure_key="$(get_var_from_env_file "AZURE_OPENAI_API_KEY" "$target_file")"
  existing_openai_key="$(get_var_from_env_file "OPENAI_API_KEY" "$target_file")"
  existing_anthropic_key="$(get_var_from_env_file "ANTHROPIC_API_KEY" "$target_file")"
  existing_gemini_key="$(get_var_from_env_file "GEMINI_API_KEY" "$target_file")"
  existing_gemini_template="$(get_var_from_env_file "A5C_GEMINI_COMMAND_TEMPLATE" "$target_file")"
  existing_gemini_install="$(get_var_from_env_file "A5C_GEMINI_INSTALL_COMMAND" "$target_file")"
  existing_custom_template="$(get_var_from_env_file "A5C_CUSTOM_COMMAND_TEMPLATE" "$target_file")"
  existing_custom_install="$(get_var_from_env_file "A5C_CUSTOM_INSTALL_COMMAND" "$target_file")"

  if [[ -f "$target_file" && "$assume_yes" != "true" ]]; then
    local yn
    read -r -p "Config exists at ${target_file}. Overwrite managed values? [Y/n]: " yn
    yn="${yn:-Y}"
    [[ "$yn" =~ ^[Yy]$ ]] || die "aborted"
  fi

  info "Config file: $target_file"
  info "Choose runner preset (or custom):"
  info "  - codex       (OpenAI Codex CLI)"
  info "  - claude-code (Anthropic Claude Code)"
  info "  - gemini      (Google Gemini CLI; uses GEMINI_API_KEY)"
  info "  - custom      (provide an explicit command template)"
  local cli_command
  local runner_default="${existing_cli:-codex}"
  if [[ "$runner_default" == "custom" && "${existing_provider:-}" == "gemini" ]]; then
    runner_default="gemini"
  fi
  cli_command="$(prompt_line "Runner" "$runner_default")"
  case "$cli_command" in
    codex|claude-code|gemini|custom) ;;
    *) info "Unknown runner preset '$cli_command' will be treated as custom." ;;
  esac

  local provider
  case "$cli_command" in
    codex)
      info "Choose provider:"
      info "  - openai (uses OPENAI_API_KEY)"
      info "  - azure  (uses AZURE_OPENAI_* env vars)"
      provider="$(prompt_line "Provider" "${existing_provider:-openai}")"
      case "$provider" in
        openai|azure) ;;
        *) die "unsupported provider for codex: $provider" ;;
      esac
      ;;
    claude-code)
      info "Choose provider:"
      info "  - anthropic (uses ANTHROPIC_API_KEY)"
      info "  - bedrock / vertex (manual setup; not fully configured by init)"
      provider="$(prompt_line "Provider" "${existing_provider:-anthropic}")"
      case "$provider" in
        anthropic|bedrock|vertex) ;;
        *) die "unsupported provider for claude-code: $provider" ;;
      esac
      ;;
    gemini)
      provider="gemini"
      ;;
    *)
      provider="$(prompt_line "Provider (optional)" "${existing_provider:-custom}")"
      ;;
  esac
  case "$provider" in
    openai|azure|anthropic|bedrock|vertex|gemini|custom) ;;
    *) info "Unknown provider '$provider' will not be validated by doctor." ;;
  esac

  local model
  model="$(prompt_line "Model" "${existing_model:-gpt-5.2}")"
  [[ -n "$model" ]] || die "model cannot be empty"

  local azure_project_name="" azure_api_key="" openai_api_key="" anthropic_api_key="" gemini_api_key=""
  local gemini_command_template="" gemini_install_command=""
  local custom_command_template="" custom_install_command=""
  case "$provider" in
    azure)
      azure_project_name="$(prompt_line "Azure OpenAI project/resource name" "$existing_azure_project")"
      [[ -n "$azure_project_name" ]] || die "AZURE_OPENAI_PROJECT_NAME cannot be empty"
      azure_api_key="$(prompt_secret "Azure OpenAI API key" "$([[ -n "$existing_azure_key" ]] && echo true || echo false)")"
      azure_api_key="${azure_api_key:-$existing_azure_key}"
      [[ -n "$azure_api_key" ]] || die "AZURE_OPENAI_API_KEY cannot be empty"
      ;;
    openai)
      openai_api_key="$(prompt_secret "OpenAI API key" "$([[ -n "$existing_openai_key" ]] && echo true || echo false)")"
      openai_api_key="${openai_api_key:-$existing_openai_key}"
      [[ -n "$openai_api_key" ]] || die "OPENAI_API_KEY cannot be empty"
      ;;
    anthropic)
      anthropic_api_key="$(prompt_secret "Anthropic API key" "$([[ -n "$existing_anthropic_key" ]] && echo true || echo false)")"
      anthropic_api_key="${anthropic_api_key:-$existing_anthropic_key}"
      [[ -n "$anthropic_api_key" ]] || die "ANTHROPIC_API_KEY cannot be empty"
      ;;
    gemini)
      gemini_api_key="$(prompt_secret "Gemini API key" "$([[ -n "$existing_gemini_key" ]] && echo true || echo false)")"
      gemini_api_key="${gemini_api_key:-$existing_gemini_key}"
      [[ -n "$gemini_api_key" ]] || die "GEMINI_API_KEY cannot be empty"
      ;;
    *)
      info "Skipping credential prompts for ${cli_command}:${provider}. You may need to add provider-specific env vars manually in ${target_file}."
      ;;
  esac

  if [[ "$cli_command" == "custom" ]]; then
    custom_command_template="$(prompt_line "Custom command template (must include {{prompt_path}})" "$existing_custom_template")"
    [[ -n "$custom_command_template" ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE cannot be empty"
    [[ "$custom_command_template" == *"{{prompt_path}}"* ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE must include {{prompt_path}}"
    custom_install_command="$(prompt_line "Optional install command (shown by doctor)" "$existing_custom_install")"
    cli_command="custom"
  elif [[ "$cli_command" == "gemini" ]]; then
    gemini_command_template="$(prompt_line "Gemini runner command template (must include {{prompt_path}})" "${existing_gemini_template:-${existing_custom_template:-$GEMINI_DEFAULT_COMMAND_TEMPLATE}}")"
    [[ "$gemini_command_template" == *"{{prompt_path}}"* ]] || die "runner template must include {{prompt_path}}"
    gemini_install_command="$(prompt_line "Optional install command (shown by doctor)" "${existing_gemini_install:-${existing_custom_install:-$GEMINI_DEFAULT_INSTALL_COMMAND}}")"
  elif [[ "$cli_command" != "codex" && "$cli_command" != "claude-code" ]]; then
    custom_command_template="$(prompt_line "Runner command template (must include {{prompt_path}})" "$existing_custom_template")"
    [[ -n "$custom_command_template" ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE cannot be empty"
    [[ "$custom_command_template" == *"{{prompt_path}}"* ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE must include {{prompt_path}}"
    custom_install_command="$(prompt_line "Optional install command (shown by doctor)" "$existing_custom_install")"
    cli_command="custom"
  fi

  write_creds_file "$target_file" "$provider" "$cli_command" "$model" \
    "$azure_project_name" "$azure_api_key" "$openai_api_key" "$anthropic_api_key" "$gemini_api_key" \
    "$gemini_command_template" "$gemini_install_command" \
    "$custom_command_template" "$custom_install_command"

  info "Wrote config to $target_file (permissions set to 600 when supported)."
  info "Next: ./o doctor"
}

doctor_cmd() {
  local show_install_hints="false"
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --local) export O_CREDS_FILE="$CREDS_ENV_FILE_LOCAL" ;;
      --global) export O_CREDS_FILE="$CREDS_ENV_FILE_GLOBAL" ;;
      --file)
        shift
        [[ $# -gt 0 ]] || die "--file requires a path"
        export O_CREDS_FILE="$1"
        ;;
      --show-install-hints) show_install_hints="true" ;;
      -h|--help) print_help; exit 0 ;;
      *) die "unknown doctor flag: $1" ;;
    esac
    shift
  done

  local creds_file
  creds_file="$(resolve_creds_file)"
  [[ -f "$creds_file" ]] || die "config not found. Run: ./o init"

  warn_if_insecure_creds_perms "$creds_file"
  load_env_file_kv_only "$creds_file"

  [[ -n "${A5C_SELECTED_CLI_COMMAND:-}" ]] || die "A5C_SELECTED_CLI_COMMAND is missing in $creds_file (run ./o init)"
  [[ -n "${A5C_SELECTED_MODEL:-}" ]] || die "A5C_SELECTED_MODEL is missing in $creds_file (run ./o init)"
  [[ -n "${A5C_PROVIDER_NAME:-}" ]] || die "A5C_PROVIDER_NAME is missing in $creds_file (run ./o init)"

  case "${A5C_SELECTED_CLI_COMMAND}" in
    codex)
      case "${A5C_PROVIDER_NAME}" in
        openai|azure) ;;
        *) die "provider ${A5C_PROVIDER_NAME} is not supported for runner=codex" ;;
      esac
      ;;
    claude-code)
      case "${A5C_PROVIDER_NAME}" in
        anthropic|bedrock|vertex) ;;
        *) die "provider ${A5C_PROVIDER_NAME} is not supported for runner=claude-code" ;;
      esac
      ;;
    gemini)
      [[ "${A5C_PROVIDER_NAME}" == "gemini" ]] || die "provider must be gemini for runner=gemini (set A5C_PROVIDER_NAME=gemini)"
      ;;
  esac

  case "${A5C_PROVIDER_NAME}" in
    azure)
      [[ -n "${AZURE_OPENAI_PROJECT_NAME:-}" ]] || die "AZURE_OPENAI_PROJECT_NAME is missing for provider=azure"
      [[ -n "${AZURE_OPENAI_API_KEY:-}" ]] || die "AZURE_OPENAI_API_KEY is missing for provider=azure"
      ;;
    openai)
      [[ -n "${OPENAI_API_KEY:-}" ]] || die "OPENAI_API_KEY is missing for provider=openai"
      ;;
    anthropic)
      [[ -n "${ANTHROPIC_API_KEY:-}" ]] || die "ANTHROPIC_API_KEY is missing for provider=anthropic"
      ;;
    gemini)
      [[ -n "${GEMINI_API_KEY:-}" ]] || die "GEMINI_API_KEY is missing for provider=gemini"
      ;;
  esac

  if [[ "${A5C_SELECTED_CLI_COMMAND}:${A5C_PROVIDER_NAME}" == "claude-code:azure" ]]; then
    die "Azure is not supported yet for claude-code"
  fi

  case "${A5C_SELECTED_CLI_COMMAND}" in
    codex)
      if ! command -v codex >/dev/null 2>&1; then
        info "codex not found. Install:"
        info "  npm install -g @openai/codex@0.31.0"
      else
        info "codex: OK"
      fi
      ;;
    claude-code)
      if ! command -v claude >/dev/null 2>&1; then
        info "claude not found. Install:"
        info "  npm install -g @anthropic-ai/claude-code"
      else
        info "claude: OK"
      fi
      ;;
    gemini)
      if ! command -v gemini >/dev/null 2>&1; then
        local install_hint="${A5C_GEMINI_INSTALL_COMMAND:-${A5C_CUSTOM_INSTALL_COMMAND:-$GEMINI_DEFAULT_INSTALL_COMMAND}}"
        info "gemini not found. Install:"
        info "  ${install_hint}"
      else
        info "gemini: OK"
      fi
      if [[ -n "${A5C_GEMINI_INSTALL_COMMAND:-}" || -n "${A5C_CUSTOM_INSTALL_COMMAND:-}" ]]; then
        if [[ "$show_install_hints" == "true" ]]; then
          info "gemini install hint:"
          info "  ${A5C_GEMINI_INSTALL_COMMAND:-${A5C_CUSTOM_INSTALL_COMMAND:-}}"
        else
          info "gemini install hint: set (use: ./o doctor --show-install-hints)"
        fi
      fi
      if [[ -n "${A5C_GEMINI_COMMAND_TEMPLATE:-}" ]]; then
        [[ "${A5C_GEMINI_COMMAND_TEMPLATE}" == *"{{prompt_path}}"* ]] || die "A5C_GEMINI_COMMAND_TEMPLATE must include {{prompt_path}}"
      elif [[ -n "${A5C_CUSTOM_COMMAND_TEMPLATE:-}" ]]; then
        info "warning: gemini preset is using legacy A5C_CUSTOM_COMMAND_TEMPLATE; prefer A5C_GEMINI_COMMAND_TEMPLATE"
        [[ "${A5C_CUSTOM_COMMAND_TEMPLATE}" == *"{{prompt_path}}"* ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE must include {{prompt_path}}"
      else
        info "gemini runner template: using built-in default"
      fi
      ;;
    *)
      [[ -n "${A5C_CUSTOM_COMMAND_TEMPLATE:-}" ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE is required for custom runners (run ./o init)"
      [[ "${A5C_CUSTOM_COMMAND_TEMPLATE}" == *"{{prompt_path}}"* ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE must include {{prompt_path}}"
      if [[ "${A5C_PROVIDER_NAME:-}" == "gemini" ]] && is_likely_gemini_template "${A5C_CUSTOM_COMMAND_TEMPLATE}"; then
        info "warning: gemini appears configured via a custom runner; consider setting A5C_SELECTED_CLI_COMMAND=gemini (run ./o init)"
        if ! command -v gemini >/dev/null 2>&1; then
          local install_hint="${A5C_GEMINI_INSTALL_COMMAND:-${A5C_CUSTOM_INSTALL_COMMAND:-$GEMINI_DEFAULT_INSTALL_COMMAND}}"
          info "gemini not found. Install:"
          info "  ${install_hint}"
        else
          info "gemini: OK"
        fi
      fi
      if [[ -n "${A5C_CUSTOM_INSTALL_COMMAND:-}" ]]; then
        if [[ "$show_install_hints" == "true" ]]; then
          info "custom runner install hint:"
          info "  ${A5C_CUSTOM_INSTALL_COMMAND}"
        else
          info "custom runner install hint: set (use: ./o doctor --show-install-hints)"
        fi
      fi
      info "custom runner: configured"
      ;;
  esac

  local orchestration_agent_script="${SCRIPT_DIR}/.a5c/o.md"
  [[ -f "$orchestration_agent_script" ]] || die "missing agent script: $orchestration_agent_script"
  command -v mktemp >/dev/null 2>&1 || die "mktemp is required"
  command -v bash >/dev/null 2>&1 || die "bash is required"

  info "config: OK ($creds_file)"
}

render_prompt_file() {
  local template_path="$1"
  local request="$2"
  local output_path="$3"

  if command -v python3 >/dev/null 2>&1; then
    python3 - "$template_path" "$request" >"$output_path" <<'PY'
import pathlib, sys
template_path = pathlib.Path(sys.argv[1])
request = sys.argv[2]
text = template_path.read_text(encoding="utf-8")
sys.stdout.write(text.replace("{{request}}", request))
PY
  else
    local esc="$request"
    esc="${esc//\\/\\\\}"
    esc="${esc//&/\\&}"
    esc="${esc//\//\\/}"
    sed "s/{{request}}/${esc}/g" "$template_path" >"$output_path"
  fi
}

main() {
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --local) export O_CREDS_FILE="$CREDS_ENV_FILE_LOCAL"; shift ;;
      --global) export O_CREDS_FILE="$CREDS_ENV_FILE_GLOBAL"; shift ;;
      --file)
        shift
        [[ $# -gt 0 ]] || die "--file requires a path"
        export O_CREDS_FILE="$1"
        shift
        ;;
      --) shift; break ;;
      *) break ;;
    esac
  done

  local cmd="${1:-}"
  case "$cmd" in
    init) shift; init_cmd "$@"; exit 0 ;;
    doctor) shift; doctor_cmd "$@"; exit 0 ;;
    help|-h|--help|"") print_help; exit 0 ;;
  esac

  local creds_file
  creds_file="$(resolve_creds_file)"
  if [[ ! -f "$creds_file" ]]; then
    info "creds.env not found."
    info "Run: ./o init"
    exit 1
  fi

  warn_if_insecure_creds_perms "$creds_file"
  load_env_file_kv_only "$creds_file"

  [[ -n "${A5C_SELECTED_CLI_COMMAND:-}" ]] || die "A5C_SELECTED_CLI_COMMAND is not set (run ./o init)"
  [[ -n "${A5C_SELECTED_MODEL:-}" ]] || die "A5C_SELECTED_MODEL is not set (run ./o init)"
  [[ -n "${A5C_PROVIDER_NAME:-}" ]] || die "A5C_PROVIDER_NAME is not set (run ./o init)"

  case "${A5C_SELECTED_CLI_COMMAND}" in
    codex)
      case "${A5C_PROVIDER_NAME}" in
        openai|azure) ;;
        *) die "provider ${A5C_PROVIDER_NAME} is not supported for runner=codex" ;;
      esac
      ;;
    claude-code)
      case "${A5C_PROVIDER_NAME}" in
        anthropic|bedrock|vertex) ;;
        *) die "provider ${A5C_PROVIDER_NAME} is not supported for runner=claude-code" ;;
      esac
      ;;
    gemini)
      [[ "${A5C_PROVIDER_NAME}" == "gemini" ]] || die "provider must be gemini for runner=gemini (set A5C_PROVIDER_NAME=gemini)"
      [[ -n "${GEMINI_API_KEY:-}" ]] || die "GEMINI_API_KEY is required for runner=gemini"
      ;;
  esac

  if [[ "$A5C_SELECTED_CLI_COMMAND" == "codex" ]]; then
    export A5C_INSTALL_COMMAND="npm install -g @openai/codex@0.31.0"
    export A5C_BASE_COMMAND=`which codex`
    export A5C_CLI_ADDITIONAL_PARAMS=""
    if [[ "$A5C_PROVIDER_NAME" == "azure" ]]; then
      [[ -n "${AZURE_OPENAI_PROJECT_NAME:-}" ]] || die "AZURE_OPENAI_PROJECT_NAME is required for provider=azure"
      [[ -n "${AZURE_OPENAI_API_KEY:-}" ]] || die "AZURE_OPENAI_API_KEY is required for provider=azure"
      local azure_provider
      azure_provider="-c model_providers.azure.name=azure -c model_providers.azure.wire_api=responses -c model_providers.azure.base_url=https://${AZURE_OPENAI_PROJECT_NAME}.openai.azure.com/openai -c model_providers.azure.env_key=AZURE_OPENAI_API_KEY -c model_providers.azure.query_params.api-version=2025-04-01-preview"
      export A5C_CLI_ADDITIONAL_PARAMS="${A5C_CLI_ADDITIONAL_PARAMS}-c model_provider=azure ${azure_provider}"
    fi
    export A5C_CLI_ADDITIONAL_PARAMS="${A5C_CLI_ADDITIONAL_PARAMS} --dangerously-bypass-approvals-and-sandbox -c model=${A5C_SELECTED_MODEL}"
    export A5C_CLI_COMMAND_INTERACTIVE="${A5C_BASE_COMMAND} ${A5C_CLI_ADDITIONAL_PARAMS} --search"
    export A5C_CLI_COMMAND="${A5C_BASE_COMMAND} exec ${A5C_CLI_ADDITIONAL_PARAMS}"
  elif [[ "$A5C_SELECTED_CLI_COMMAND" == "claude-code" ]]; then
    export A5C_INSTALL_COMMAND="npm install -g @anthropic-ai/claude-code"
    export A5C_BASE_COMMAND=`which claude`
    export A5C_CLI_ADDITIONAL_PARAMS="-p 'fulfill the request' --output-format stream-json --allowedTools Bash,Read,Glob,Grep,Write,MultiEdit,Edit,NotebookRead,NotebookEdit,WebFetch,TodoRead,TodoWrite,WebSearch,Task,Agent,mcp__github,mcp__agent_reporter --dangerously-skip-permissions --verbose --model ${A5C_SELECTED_MODEL}"
    if [[ "$A5C_PROVIDER_NAME" == "azure" ]]; then
      die "Azure is not supported yet for claude-code."
    elif [[ "$A5C_PROVIDER_NAME" == "bedrock" ]]; then
      export CLAUDE_CODE_USE_BEDROCK=true
    elif [[ "$A5C_PROVIDER_NAME" == "vertex" ]]; then
      export CLOUD_ML_REGION=global
      export CLAUDE_CODE_USE_VERTEX=1
    fi
    export A5C_CLI_COMMAND_INTERACTIVE="${A5C_BASE_COMMAND} ${A5C_CLI_ADDITIONAL_PARAMS}"
    export A5C_CLI_COMMAND="${A5C_BASE_COMMAND} ${A5C_CLI_ADDITIONAL_PARAMS}"
  elif [[ "$A5C_SELECTED_CLI_COMMAND" == "gemini" ]]; then
    export A5C_INSTALL_COMMAND="$GEMINI_DEFAULT_INSTALL_COMMAND"
    export A5C_BASE_COMMAND=`which gemini`
    local gemini_template="${A5C_GEMINI_COMMAND_TEMPLATE:-${A5C_CUSTOM_COMMAND_TEMPLATE:-}}"
    if [[ -z "$gemini_template" ]]; then
      gemini_template="$GEMINI_DEFAULT_COMMAND_TEMPLATE"
    fi
    export A5C_CUSTOM_COMMAND_TEMPLATE="$gemini_template"
    [[ "${A5C_CUSTOM_COMMAND_TEMPLATE}" == *"{{prompt_path}}"* ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE must include {{prompt_path}}"
    export A5C_CLI_COMMAND="${A5C_BASE_COMMAND} ${A5C_CLI_ADDITIONAL_PARAMS}"
  else
    [[ -n "${A5C_CUSTOM_COMMAND_TEMPLATE:-}" ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE is required for custom runners (run ./o init)"
    [[ "${A5C_CUSTOM_COMMAND_TEMPLATE}" == *"{{prompt_path}}"* ]] || die "A5C_CUSTOM_COMMAND_TEMPLATE must include {{prompt_path}}"
  fi

  local orchestration_agent_script="${SCRIPT_DIR}/.a5c/o.md"
  [[ -f "$orchestration_agent_script" ]] || die "missing agent script: $orchestration_agent_script"

  local request="$*"
  [[ -n "$request" ]] || die "missing request (try: ./o help)"

  local prompt_path
  prompt_path="$(mktemp)"
  render_prompt_file "$orchestration_agent_script" "$request" "$prompt_path"

  if [[ "$A5C_SELECTED_CLI_COMMAND" == "codex" || "$A5C_SELECTED_CLI_COMMAND" == "claude-code" ]]; then
    info "running: ${A5C_CLI_COMMAND_INTERACTIVE}"
    RES="${A5C_CLI_COMMAND_INTERACTIVE} -- \"read ${prompt_path} and follow the instructions in the file\""
    # run the command
    eval "$RES"
  else
    info "running custom runner (command not echoed to avoid leaking secrets)"
    local cmd_template cmd
    cmd_template="${A5C_CUSTOM_COMMAND_TEMPLATE}"
    cmd="$(apply_template "$cmd_template" "{{prompt_path}}" "$(shell_escape_sq "$prompt_path")")"
    bash -lc "$cmd"
  fi
}

main "$@"