#!/usr/bin/env bash
# Assemble the HeiniRemote agent Flatpak WITHOUT flatpak-builder.
#
# Same approach as o3de-flatpak: flatpak-builder would run build commands
# inside a bubblewrap sandbox (needs user namespaces / privileged CI). We
# don't need that — the real build (cargo) happens outside this script, and
# flatpak build-init/build-finish/build-export only touch files and the
# OSTree repo.
#
# Inputs (env):
#   AGENT_BIN         path to the compiled heiniremote-agent binary (required)
#   WL_CLIPBOARD_DIR  dir containing wl-copy/wl-paste to bundle (default /usr/bin)
#
# Produces ./repo (an OSTree repo with branch "stable").
set -euo pipefail
cd "$(dirname "$0")/.."

APP_ID=de.pc_heini.HeiniRemoteAgent
RUNTIME_VER=25.08
BRANCH=stable
AGENT_BIN="${AGENT_BIN:?set AGENT_BIN to the compiled heiniremote-agent}"
WL_DIR="${WL_CLIPBOARD_DIR:-/usr/bin}"

rm -rf build-dir repo

echo ">> build-init"
flatpak build-init build-dir "$APP_ID" org.freedesktop.Sdk org.freedesktop.Platform "$RUNTIME_VER"
DEST=build-dir/files

echo ">> installing agent + bundled tools"
install -Dm755 "$AGENT_BIN" "$DEST/bin/heiniremote-agent"
# wl-clipboard is bundled because the agent's clipboard sync shells out to it
# (clipboard.rs); the freedesktop runtime does not ship it.
install -Dm755 "$WL_DIR/wl-copy" "$DEST/bin/wl-copy"
install -Dm755 "$WL_DIR/wl-paste" "$DEST/bin/wl-paste"
install -Dm755 heiniremote-wrapper.sh "$DEST/bin/heiniremote-wrapper.sh"
install -Dm755 host-shell.sh "$DEST/bin/host-shell"

echo ">> installing desktop metadata"
install -Dm644 "$APP_ID.desktop" "$DEST/share/applications/$APP_ID.desktop"
install -Dm644 "$APP_ID.metainfo.xml" "$DEST/share/metainfo/$APP_ID.metainfo.xml"
install -Dm644 "$APP_ID.svg" "$DEST/share/icons/hicolor/scalable/apps/$APP_ID.svg"

echo ">> build-finish (sandbox permissions)"
# ScreenCast/RemoteDesktop run through xdg-desktop-portal, which sandboxed
# apps may always talk to — no extra permission needed. What IS needed:
#   network                     signaling wss + WebRTC/TURN
#   wayland                     wl-copy/wl-paste talk to the compositor
#   dri                         PipeWire screencast buffers may be dmabuf
#   xdg-config/heiniremote:ro   adopt an existing native install's agent.toml
#   StatusNotifier*             tray icon (ksni); non-fatal if absent. ksni
#                               owns org.kde.StatusNotifierItem-{pid}-1 and
#                               the wrapper exec's the agent, so inside the
#                               sandbox the pid is deterministically 2
#   org.freedesktop.Flatpak     flatpak-spawn --host for the rescue console's
#                               real host shell — deliberate sandbox escape,
#                               without it the console would show the sandbox
flatpak build-finish build-dir \
  --command=heiniremote-wrapper.sh \
  --share=network \
  --socket=wayland \
  --device=dri \
  --filesystem=xdg-config/heiniremote:ro \
  --talk-name=org.kde.StatusNotifierWatcher \
  --own-name=org.kde.StatusNotifierItem-2-1 \
  --talk-name=org.freedesktop.Flatpak

echo ">> export to OSTree repo"
# --disable-sandbox: build-export validates icons in bwrap by default, which
# fails in unprivileged CI containers; this runs the same validation in-process.
flatpak build-export --disable-sandbox repo build-dir "$BRANCH"
flatpak build-update-repo repo --title="HeiniRemote Agent" --prune --prune-depth=1

echo ">> done: ./repo"

# Touched to trigger a rebuild against upstream eac11e0 (2026-09-21).