entrypoint.sh

#!/bin/sh
set -e

# ── Fix OpenShift environment overrides ──────────────────────────────────────
# OpenShift sets HOME=/ (read-only) and SHELL=/sbin/nologin (exits immediately).
# Both break tmux: it can't write to HOME and spawned shells die instantly.
export HOME="/home/tinycode"
export SHELL="/bin/sh"

# Write container defaults to config.json unconditionally on every start.
# tinycode loads config in order: config.json -> tinycode.json -> tinycode.jsonc
# (src/config/config.ts:484-486). Writing to the lowest-priority config.json
# ensures the plugin entry is always present while user customizations in
# PVC-persisted tinycode.jsonc survive image upgrades without being overwritten.

# TINYCODE_OLLAMA_HOST is natively supported by tinycode (issue #8 fix).
# Default to host.containers.internal so local Ollama is reachable from the container.
# Override via TINYCODE_OLLAMA_HOST env var for k8s or custom Ollama locations.
export TINYCODE_OLLAMA_HOST="${TINYCODE_OLLAMA_HOST:-http://host.containers.internal:11434}"

# Sanitize URLs in logs to hide credentials
sanitize_url() {
  echo "$1" | sed -E 's|://[^@]*@|://***@|g'
}

# Bridge TINYCODE_VLLM_URL to TINYCODE_VLLM_HOST (tinycode core's native env var)
if [ -n "${TINYCODE_VLLM_URL:-}" ] && [ -z "${TINYCODE_VLLM_HOST:-}" ]; then
  export TINYCODE_VLLM_HOST="$TINYCODE_VLLM_URL"
fi

# In-cluster auto-detection
if [ -n "${KUBERNETES_SERVICE_HOST:-}" ] && [ "${TINYCODE_AUTO_DETECT:-true}" != "false" ]; then
  echo "[tinycode] Running in-cluster (Kubernetes detected)"

  # Disable LSP download in air-gapped environments
  if [ -z "${TINYCODE_DISABLE_LSP_DOWNLOAD:-}" ]; then
    export TINYCODE_DISABLE_LSP_DOWNLOAD=1
    echo "[tinycode] LSP download disabled (in-cluster default)"
  fi

  # Log discovery mode
  if [ -n "${TINYCODE_VLLM_HOST:-}" ]; then
    echo "[tinycode] vLLM endpoint: $TINYCODE_VLLM_HOST"
  else
    echo "[tinycode] vLLM: auto-discovery via Kubernetes services"
  fi
fi

# Build plugin list from bundled plugin binaries in /opt/tinycode-plugins/
# Go plugins are standalone binaries named tinycode-plugin-<name>.
PLUGIN_LIST=""
if [ -d "/opt/tinycode-plugins" ]; then
  for plugin_bin in /opt/tinycode-plugins/tinycode-plugin-*; do
    [ -x "$plugin_bin" ] || continue
    plugin_name=$(basename "$plugin_bin" | sed 's/^tinycode-plugin-//')
    [ -n "$PLUGIN_LIST" ] && PLUGIN_LIST="$PLUGIN_LIST, "
    PLUGIN_LIST="$PLUGIN_LIST\"$plugin_name\""
    echo "[tinycode] Bundled plugin: $plugin_name"
  done
fi

DEFAULTS_FILE="$XDG_CONFIG_HOME/tinycode/config.json"
if [ -n "${TINYCODE_VLLM_MODEL:-}" ]; then
  # Validate model string: allow only safe characters
  if printf '%s' "$TINYCODE_VLLM_MODEL" | grep -qE '^[a-zA-Z0-9/_:@. -]+$' && \
     [ "${#TINYCODE_VLLM_MODEL}" -le 255 ]; then
    cat > "$DEFAULTS_FILE" << EOF
{
  "plugin": [$PLUGIN_LIST],
  "model": "$TINYCODE_VLLM_MODEL"
}
EOF
  else
    echo "[tinycode] WARNING: TINYCODE_VLLM_MODEL contains invalid characters, ignoring model override"
    cat > "$DEFAULTS_FILE" << EOF
{
  "plugin": [$PLUGIN_LIST]
}
EOF
  fi
else
  cat > "$DEFAULTS_FILE" << EOF
{
  "plugin": [$PLUGIN_LIST]
}
EOF
fi

# ── Create required directories ───────────────────────────────────────────────
# tinycode expects these directories to exist. The PVC provides ~/.config/tinycode/
# but the project-level .tinycode/ must be created in the working directory.
# /projects is where user workspaces live; /home/tinycode is the fallback.
WORKDIR="${TINYCODE_WORKDIR:-/projects}"
mkdir -p "$WORKDIR/.tinycode" 2>/dev/null || mkdir -p /home/tinycode/.tinycode 2>/dev/null || true
mkdir -p /tmp/tinycode 2>/dev/null || true

# GitOps mode: clone/pull repo into /projects
if [ -n "${TINYCODE_GIT_REPO:-}" ]; then
  CLONE_DIR="/projects"
  GIT_BRANCH="${TINYCODE_GIT_BRANCH:-}"
  GIT_TIMEOUT="${TINYCODE_GIT_CLONE_TIMEOUT:-300}"

  # Configure credentials if available
  if [ -f "/home/tinycode/.git-credentials" ]; then
    git config --global credential.helper "store --file=/home/tinycode/.git-credentials"
  elif [ -f "/home/tinycode/.netrc" ]; then
    :  # git uses .netrc automatically
  fi

  if [ -d "$CLONE_DIR/.git" ]; then
    REMOTE_URL=$(cd "$CLONE_DIR" && git remote get-url origin 2>/dev/null || echo "")
    if [ -z "$REMOTE_URL" ]; then
      # Empty init repo — remove and clone fresh
      echo "[tinycode] Removing empty init repo, cloning $(sanitize_url "$TINYCODE_GIT_REPO")..."
      rm -rf "$CLONE_DIR/.git"
      timeout "$GIT_TIMEOUT" git clone --depth 1 \
        ${GIT_BRANCH:+--branch "$GIT_BRANCH"} \
        "$TINYCODE_GIT_REPO" "$CLONE_DIR" || echo "[tinycode] WARNING: Git clone failed — starting with empty /projects"
    elif [ "${TINYCODE_GIT_PULL_ON_RESTART:-false}" = "true" ]; then
      echo "[tinycode] Pulling latest from ${GIT_BRANCH:-default branch}..."
      cd "$CLONE_DIR" && git pull --ff-only || echo "[tinycode] WARNING: Git pull failed (likely local changes). Skipping."
      cd /
    else
      echo "[tinycode] Repo exists, pull on restart disabled. Skipping."
    fi
  else
    echo "[tinycode] Cloning $(sanitize_url "$TINYCODE_GIT_REPO") (branch: ${GIT_BRANCH:-default})..."
    timeout "$GIT_TIMEOUT" git clone --depth 1 \
      ${GIT_BRANCH:+--branch "$GIT_BRANCH"} \
      "$TINYCODE_GIT_REPO" "$CLONE_DIR" || echo "[tinycode] WARNING: Git clone failed — starting with empty /projects"
  fi
fi

# Init a git repo in the workspace so tinycode detects it as the worktree.
# Without this, worktree resolves to "/" (read-only) and swarm/skill dirs
# get created at /.tinycode/ which fails with permission denied.
if [ -d "$WORKDIR" ] && command -v git >/dev/null 2>&1; then
  # Mark workspace as safe regardless of UID mismatch (OpenShift assigns random UIDs)
  git config --global --add safe.directory "$WORKDIR" 2>/dev/null || true
  # Only init if .git doesn't exist (skip if GitOps mode already cloned)
  if [ ! -d "$WORKDIR/.git" ]; then
    cd "$WORKDIR"
    git init -q 2>/dev/null || true
    git config user.email "tinycode@container" 2>/dev/null || true
    git config user.name "tinycode" 2>/dev/null || true
  fi
fi
mkdir -p /tmp/tinycode 2>/dev/null || true

# Copy bundled agents and skills into the PVC-mounted config directory.
# The PVC shadows /home/tinycode/.config/tinycode so files COPY'd into the image
# at build time are hidden. This copies from a staging path (/opt/tinycode-defaults/)
# into the PVC on every startup, ensuring bundled defaults are always present.
# User customizations in the PVC take priority (loaded after bundled defaults by tinycode).
DEFAULTS_SRC="/opt/tinycode-defaults"
if [ -d "$DEFAULTS_SRC/agent" ]; then
  mkdir -p "$XDG_CONFIG_HOME/tinycode/agent"
  cp -n "$DEFAULTS_SRC/agent/"*.md "$XDG_CONFIG_HOME/tinycode/agent/" 2>/dev/null || true
fi
if [ -d "$DEFAULTS_SRC/skills" ]; then
  for skill_dir in "$DEFAULTS_SRC/skills"/*/; do
    skill_name=$(basename "$skill_dir")
    mkdir -p "$XDG_CONFIG_HOME/tinycode/skills/$skill_name"
    cp -n "$skill_dir"SKILL.md "$XDG_CONFIG_HOME/tinycode/skills/$skill_name/" 2>/dev/null || true
  done
fi

# ── oc CLI for cluster management mode ───────────────────────────────────────
if [ "${TINYCODE_CLUSTER_ADMIN}" = "true" ]; then
  OC_BIN="/home/tinycode/.local/bin/oc"
  if [ ! -f "$OC_BIN" ]; then
    echo "[tinycode] Downloading oc CLI (version: ${TINYCODE_OC_VERSION:-stable})..."
    ARCH=$(uname -m)
    case "$ARCH" in
      x86_64)  OC_ARCH="amd64" ;;
      aarch64) OC_ARCH="arm64" ;;
      *)       OC_ARCH="amd64" ;;
    esac
    OC_VERSION="${TINYCODE_OC_VERSION:-stable}"

    # Validate version format
    case "$OC_VERSION" in
      stable|latest|fast|candidate) ;;
      [0-9]*.[0-9]*.[0-9]*) ;;
      *) echo "[tinycode] ERROR: Invalid OC_VERSION format: $OC_VERSION"; OC_VERSION="" ;;
    esac

    if [ -n "$OC_VERSION" ]; then
      case "$OC_ARCH" in
        arm64) OC_URL="https://mirror.openshift.com/pub/openshift-v4/clients/ocp/${OC_VERSION}/openshift-client-linux-arm64.tar.gz" ;;
        *)     OC_URL="https://mirror.openshift.com/pub/openshift-v4/clients/ocp/${OC_VERSION}/openshift-client-linux.tar.gz" ;;
      esac
      mkdir -p /home/tinycode/.local/bin
      set +e
      OC_TMP=$(mktemp /tmp/oc-XXXXXX.tar.gz)
      if curl -fsSL --max-time 120 "$OC_URL" -o "$OC_TMP" 2>/dev/null; then
        # Verify checksum if available
        if command -v sha256sum >/dev/null 2>&1; then
          CHECKSUM_URL="${OC_URL%.tar.gz}.tar.gz.sha256"
          OC_SHA_TMP=$(mktemp /tmp/oc-sha-XXXXXX)
          if curl -fsSL --max-time 30 "$CHECKSUM_URL" -o "$OC_SHA_TMP" 2>/dev/null; then
            EXPECTED_SHA=$(awk '{print $1}' "$OC_SHA_TMP")
            ACTUAL_SHA=$(sha256sum "$OC_TMP" | awk '{print $1}')
            if [ "$EXPECTED_SHA" != "$ACTUAL_SHA" ]; then
              echo "[tinycode] ERROR: oc CLI checksum mismatch"
              rm -f "$OC_TMP" "$OC_SHA_TMP"
              OC_TMP=""
            fi
          else
            echo "[tinycode] WARNING: Could not verify oc CLI checksum"
          fi
          rm -f "$OC_SHA_TMP"
        fi

        if [ -n "$OC_TMP" ] && [ -f "$OC_TMP" ] && tar xz -C /home/tinycode/.local/bin oc -f "$OC_TMP" 2>/dev/null; then
          echo "[tinycode] oc CLI installed: $(/home/tinycode/.local/bin/oc version --client 2>/dev/null | head -1)"
        else
          echo "[tinycode] WARNING: Failed to extract oc CLI. Cluster-admin agent will be available but oc commands will fail."
        fi
      else
        echo "[tinycode] WARNING: Failed to download oc CLI. Cluster-admin agent will be available but oc commands will fail."
      fi
      rm -f "$OC_TMP"
      set -e
    fi
  fi

  # Auto-detect cluster type: OpenShift or vanilla Kubernetes
  if oc api-resources --api-group=route.openshift.io --no-headers 2>/dev/null | grep -q "route"; then
    export TINYCODE_CLUSTER_TYPE=openshift
    echo "[tinycode] Cluster type: OpenShift"
  else
    export TINYCODE_CLUSTER_TYPE=kubernetes
    echo "[tinycode] Cluster type: Kubernetes"
  fi
fi

# Bind on all interfaces for k8s pod networking (default is 127.0.0.1).
# TINYCODE_HOST and TINYCODE_PORT are read by serverConfig in config.go.
export TINYCODE_HOST="${TINYCODE_HOST:-0.0.0.0}"

# Session attach: if TINYCODE_SESSION_ID is set, attach to an existing session
# instead of starting a new one. Useful for persistent containers.
if [ -n "$TINYCODE_SESSION_ID" ]; then
  echo "Attaching to session: $TINYCODE_SESSION_ID"
  exec tinycode web --session "$TINYCODE_SESSION_ID"
fi

# Start tinycode in web mode (HTTP API + embedded SolidJS web UI)
exec tinycode web