#!/usr/bin/env bash
set -euo pipefail
ACTION=${1:-dry-run}; MODEL=${MODEL:-gpt-5.6-sol}; CODEX_HOME=${CODEX_HOME:-$HOME/.codex}; CONFIG=$CODEX_HOME/config.toml; AUTH=$CODEX_HOME/auth.json; STATE=$CODEX_HOME/bobrouter-backups; MARKER='# Managed by BobRouter Codex helper'
usage(){ printf 'Usage: %s [status|dry-run|install|rollback|uninstall]\n' "$0"; }
ensure(){ mkdir -p "$CODEX_HOME" "$STATE"; chmod 700 "$CODEX_HOME" "$STATE"; }
backup(){ local f=$1; [ -f "$f" ] || return 0; local n; n=$(basename "$f").$(date -u +%Y%m%d-%H%M%S).bak; cp -p "$f" "$STATE/$n"; chmod 600 "$STATE/$n"; printf 'Backup created: %s\n' "$STATE/$n"; }
render_config(){ cat <<EOF
$MARKER
model_provider = "bobrouter"
model = "$MODEL"
review_model = "$MODEL"
model_reasoning_effort = "high"
disable_response_storage = true
network_access = "enabled"

[model_providers.bobrouter]
name = "BobRouter"
base_url = "https://api.bobrouter.com/v1"
wire_api = "responses"
requires_openai_auth = true
supports_websockets = false
EOF
}
install(){ [ -n "${BOBROUTER_API_KEY:-}" ] || { printf 'Set BOBROUTER_API_KEY in the current shell; it is never embedded in this script.\n' >&2; exit 2; }; ensure; backup "$CONFIG"; backup "$AUTH"; umask 077; render_config > "$CONFIG"; printf '{\n  "OPENAI_API_KEY": "%s"\n}\n' "$BOBROUTER_API_KEY" > "$AUTH"; chmod 600 "$CONFIG" "$AUTH"; printf 'Installed BobRouter config for native Codex app and Codex CLI.\n'; }
rollback(){ ensure; local c a; c=$(find "$STATE" -maxdepth 1 -name 'config.toml.*.bak' -type f -printf '%T@ %p\n'|sort -nr|awk 'NR==1{print $2}'); a=$(find "$STATE" -maxdepth 1 -name 'auth.json.*.bak' -type f -printf '%T@ %p\n'|sort -nr|awk 'NR==1{print $2}'); [ -n "$c" ] && [ -n "$a" ] || { printf 'Complete backup set not found.\n' >&2; exit 2; }; cp "$c" "$CONFIG"; cp "$a" "$AUTH"; chmod 600 "$CONFIG" "$AUTH"; printf 'Rolled back the latest BobRouter configuration.\n'; }
uninstall(){ ensure; if [ -f "$CONFIG" ]; then grep -Fqx "$MARKER" "$CONFIG" || { printf 'Refusing to remove unmanaged config.toml.\n' >&2; exit 2; }; backup "$CONFIG"; rm -f "$CONFIG"; fi; if [ -f "$AUTH" ]; then backup "$AUTH"; rm -f "$AUTH"; fi; printf 'Removed BobRouter-managed files; backups retained.\n'; }
case "$ACTION" in status) printf 'Codex home: %s\nConfig: %s\nAuth: %s\n' "$CODEX_HOME" "$(test -f "$CONFIG"&&echo present||echo absent)" "$(test -f "$AUTH"&&echo present||echo absent)";; dry-run) printf 'Would write %s and %s; no files changed. Set BOBROUTER_API_KEY and run install.\n' "$CONFIG" "$AUTH";; install) install;; rollback) rollback;; uninstall) uninstall;; -h|--help) usage;; *) usage; exit 2;; esac