#!/usr/bin/env bash
# sync-codex-tokens.sh — Read fresh Codex CLI tokens and propagate to all OpenClaw instances
# Run after: codex login
# Can also be called from a cron job or post-login hook

set -euo pipefail

CODEX_AUTH="$HOME/.codex/auth.json"
OPENCLAW_AGENTS_DIR="$HOME/.openclaw/agents"
ATOMIZER_AGENTS_DIR="$HOME/.openclaw-atomizer/agents"  # fallback if shared state

if [ ! -f "$CODEX_AUTH" ]; then
    echo "ERROR: No codex auth.json found at $CODEX_AUTH"
    echo "Run: codex login"
    exit 1
fi

# Check token freshness (< 1 hour old = fresh)
AGE=$(( $(date +%s) - $(stat -c %Y "$CODEX_AUTH") ))
if [ "$AGE" -gt 3600 ]; then
    echo "WARNING: Codex auth.json is ${AGE}s old. Consider running 'codex login' first."
fi

# Python does the heavy lifting
python3 << 'PYEOF'
import json, os, time, sys, glob

codex_path = os.path.expanduser("~/.codex/auth.json")
with open(codex_path) as f:
    codex = json.load(f)
t = codex["tokens"]

new_profile = {
    "type": "oauth",
    "provider": "openai-codex",
    "access": t["access_token"],
    "refresh": t["refresh_token"],
    "expires": int(time.time() * 1000) + 10 * 24 * 3600 * 1000,
    "accountId": t.get("account_id", "")
}

# Find all auth-profiles.json files
patterns = [
    os.path.expanduser("~/.openclaw/agents/*/agent/auth-profiles.json"),
    os.path.expanduser("~/.openclaw-atomizer/agents/*/agent/auth-profiles.json"),
]

updated = 0
for pattern in patterns:
    for path in glob.glob(pattern):
        try:
            with open(path) as f:
                data = json.load(f)
            changed = False
            for key in list(data.get("profiles", {}).keys()):
                if key.startswith("openai-codex:"):
                    data["profiles"][key] = new_profile.copy()
                    changed = True
            if changed:
                with open(path, "w") as f:
                    json.dump(data, f, indent=2)
                agent = path.split("/agents/")[1].split("/")[0]
                print(f"  ✓ {agent}")
                updated += 1
        except Exception as e:
            print(f"  ✗ {path}: {e}", file=sys.stderr)

print(f"\nUpdated {updated} agent profiles.")
PYEOF

# Restart Atomizer cluster if it exists
CLUSTER="$HOME/atomizer/cluster.sh"
if [ -f "$CLUSTER" ] && [ "${1:-}" = "--restart" ]; then
    echo ""
    echo "Restarting Atomizer cluster..."
    bash "$CLUSTER" restart
fi

echo "Done."