#!/usr/bin/env bash
set -Eeo pipefail

release_version="2026.10.21.3"
release_base_url="https://api.felixnode.com/tools/codex-provider/releases/${release_version}"
program_url="${release_base_url}/codex-provider"
expected_hash="fe4c544ad4a5360957fee6655fcd521ce1d99edac9e7ed47f372259952207592"
download_dir="$(mktemp -d "${TMPDIR:-/tmp}/codex-provider.XXXXXX")"
program_file="${download_dir}/codex-provider"

die() {
    printf 'codex-provider launcher: %s\n' "$*" >&2
    exit 1
}

cleanup() {
    [[ -f "$program_file" ]] && unlink "$program_file" 2>/dev/null || true
    rmdir "$download_dir" 2>/dev/null || true
}

trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM

command -v curl >/dev/null 2>&1 || die "curl is required"
command -v bash >/dev/null 2>&1 || die "bash is required"
command -v awk >/dev/null 2>&1 || die "awk is required"

if (($# == 0)); then
    set -- toggle --launch
fi

curl --proto '=https' --tlsv1.2 --retry 2 --connect-timeout 10 --max-time 60 \
    -fsS "$program_url" -o "$program_file"

[[ "${#expected_hash}" -eq 64 ]] || die "invalid published SHA-256 checksum"
case "$expected_hash" in
    *[!0-9a-fA-F]*) die "invalid published SHA-256 checksum" ;;
esac

if command -v sha256sum >/dev/null 2>&1; then
    actual_hash="$(sha256sum "$program_file" | awk '{ print $1 }')"
elif command -v shasum >/dev/null 2>&1; then
    actual_hash="$(shasum -a 256 "$program_file" | awk '{ print $1 }')"
else
    die "sha256sum or shasum is required"
fi

[[ "$actual_hash" == "$expected_hash" ]] || die "downloaded program checksum mismatch"
chmod 700 "$program_file"
bash "$program_file" "$@"