#!/usr/bin/env bash
set -euo pipefail
readonly VERIFIED_GEMINI_CLI_VERSION="0.55.1"
readonly DEFAULT_MODEL="gpt-5.6-sol"
readonly DEFAULT_BASE_URL="https://api.bobrouter.com"
command_name="${1:-dry-run}"; [[ $# -gt 0 ]] && shift || true
model="${GEMINI_MODEL:-$DEFAULT_MODEL}"
base_url="${GOOGLE_GEMINI_BASE_URL:-$DEFAULT_BASE_URL}"
gemini_home="${GEMINI_CLI_HOME:-$HOME/.gemini}"
allow_version_drift=false

usage(){ cat <<'EOF'
Usage: bobrouter-gemini-cli.sh [status|dry-run|run] [--model ID] [--allow-version-drift] [-- gemini arguments]
The helper is launcher-only: it writes no settings, shell profile, or credentials.
It maps BOBROUTER_API_KEY into process-scoped GEMINI_API_KEY for Gemini CLI.
Verified contract: @google/gemini-cli 0.55.1, GOOGLE_GEMINI_BASE_URL, GEMINI_API_KEY, GEMINI_MODEL, GEMINI_CLI_HOME, auth type gateway.
EOF
}
die(){ printf 'error: %s\n' "$*" >&2; exit 1; }
validate(){
 [[ "$base_url" == "$DEFAULT_BASE_URL" || "$base_url" == "$DEFAULT_BASE_URL/" ]] || die "refusing unapproved base URL: $base_url"
 base_url="${base_url%/}"
 [[ "$model" =~ ^[A-Za-z0-9._:/-]+$ ]] || die 'invalid model ID'
}
version(){ gemini --version 2>/dev/null | tr -d '\r' | head -1; }
check_cli(){
 command -v gemini >/dev/null || die 'Gemini CLI is not installed'
 local actual; actual="$(version)"
 if [[ "$actual" != "$VERIFIED_GEMINI_CLI_VERSION" && "$allow_version_drift" != true ]]; then die "Gemini CLI $actual is not the reviewed $VERIFIED_GEMINI_CLI_VERSION; review upstream contract or pass --allow-version-drift deliberately"; fi
}
status(){
 validate
 printf 'Gemini CLI reviewed version: %s\nInstalled version: %s\nBase URL: %s\nModel: %s\nGEMINI_CLI_HOME: %s\nBOBROUTER_API_KEY: %s\n' "$VERIFIED_GEMINI_CLI_VERSION" "$(command -v gemini >/dev/null && version || printf 'not installed')" "$base_url" "$model" "$gemini_home" "$([[ -n "${BOBROUTER_API_KEY:-}" ]] && printf 'set (value hidden)' || printf 'not set')"
}
dry_run(){
 validate
 printf 'Would launch Gemini CLI with process-scoped variables only:\n  GOOGLE_GEMINI_BASE_URL=%s\n  GEMINI_MODEL=%s\n  GEMINI_CLI_HOME=%s\n  GEMINI_API_KEY=<from BOBROUTER_API_KEY; not persisted>\n  auth type: gateway\n  command: gemini --model %q' "$base_url" "$model" "$gemini_home" "$model"
 if [[ $# -gt 0 ]]; then printf ' %q' "$@"; fi; printf '\n'
}
run(){
 validate; check_cli
 [[ -n "${BOBROUTER_API_KEY:-}" ]] || die 'set BOBROUTER_API_KEY in the current environment'
 [[ "$BOBROUTER_API_KEY" != *$'\n'* && "$BOBROUTER_API_KEY" != *$'\r'* ]] || die 'BOBROUTER_API_KEY contains a newline'
 exec env GOOGLE_GEMINI_BASE_URL="$base_url" GEMINI_API_KEY="$BOBROUTER_API_KEY" GEMINI_MODEL="$model" GEMINI_CLI_HOME="$gemini_home" gemini --model "$model" "$@"
}
args=()
while [[ $# -gt 0 ]]; do case "$1" in --model) [[ $# -ge 2 ]]||die '--model requires value'; model="$2"; shift 2;; --allow-version-drift) allow_version_drift=true; shift;; --) shift; args+=("$@"); break;; -h|--help) usage; exit 0;; *) args+=("$1"); shift;; esac; done
case "$command_name" in status) status;; dry-run) dry_run "${args[@]}";; run) run "${args[@]}";; help|-h|--help) usage;; *) die "unknown command: $command_name";; esac