port.sh

#!/usr/bin/env bash
set -euo pipefail

###############################################################################
#  Codex macOS -> Linux -- Universal port script (v3)
#
#  Fixes applied:
#    - isPackaged check  -> JS bundle patched
#    - pnpm symlinks     -> cp -aL (dereference) + cleanup before asar pack
#    - asar repack       -> app.isPackaged = true at runtime
#
#  Supported package managers:
#    pacman  apt  dnf  yum  zypper  apk  xbps  portage  nix-env
#
#  Usage:
#    bash ./port.sh
#
###############################################################################

# -- colors (only for interactive terminals) ----------------------------------
if [ -t 1 ]; then
  RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
  BLUE='\033[0;34m'; CYAN='\033[0;36m'; BOLD='\033[1m'; NC='\033[0m'
else
  RED=''; GREEN=''; YELLOW=''; BLUE=''; CYAN=''; BOLD=''; NC=''
fi

# -- log helpers --------------------------------------------------------------
info()    { echo -e "${BLUE}[INFO]${NC}    $*"; }
ok()      { echo -e "${GREEN}[ OK ]${NC}    $*"; }
warn()    { echo -e "${YELLOW}[WARN]${NC}    $*"; }
err()     { echo -e "${RED}[ERR ]${NC}    $*" >&2; }
detail()  { echo -e "${CYAN}         ->${NC} $*"; }

step() {
  echo ""
  echo -e "${BOLD}==================================================================${NC}"
  echo -e "${BOLD}  $*${NC}"
  echo -e "${BOLD}==================================================================${NC}"
}

# -- error / interrupt handling -----------------------------------------------
cleanup_on_error() {
  echo ""
  err "Unexpected error at line $1 -- script aborted."
  err "Fix the issue and re-run the script."
  exit 1
}
trap 'cleanup_on_error $LINENO' ERR
trap 'echo ""; warn "Interrupted by user (Ctrl+C)."; exit 130' INT

# -- sudo ---------------------------------------------------------------------
SUDO="sudo"
if [ "$(id -u)" -eq 0 ]; then
  SUDO=""
elif ! command -v sudo &>/dev/null; then
  warn "Neither root nor sudo available."
  SUDO=""
fi

# -- detect package manager ---------------------------------------------------
detect_pkg_manager() {
  for pm in pacman apt-get dnf yum zypper apk xbps-install emerge nix-env; do
    if command -v "$pm" &>/dev/null; then
      case "$pm" in
        apt-get)      echo "apt"     ;;
        xbps-install) echo "xbps"    ;;
        emerge)       echo "portage" ;;
        nix-env)      echo "nix"     ;;
        *)            echo "$pm"     ;;
      esac
      return 0
    fi
  done
  echo "unknown"
}

# -- find 7z binary (p7zip -> 7z, 7zip -> 7zz, minimal -> 7za) ---------------
find_7z_bin() {
  for bin in 7z 7zz 7za; do
    if command -v "$bin" &>/dev/null; then echo "$bin"; return 0; fi
  done
  return 1
}

# -- install system packages --------------------------------------------------
install_system_packages() {
  local mgr="$1"
  info "Detected package manager: ${BOLD}${mgr}${NC}"
  echo ""

  case "$mgr" in
    pacman)
      local pkg_7z="p7zip"
      if pacman -Si 7zip &>/dev/null; then pkg_7z="7zip"; fi
      $SUDO pacman -S --needed "$pkg_7z" nodejs npm python base-devel git curl
      $SUDO pacman -S --needed electron 2>/dev/null \
        || warn "Electron not available via pacman -- will install via pnpm."
      ;;
    apt)
      $SUDO apt-get update -y
      $SUDO apt-get install -y p7zip-full nodejs npm python3 \
        build-essential git curl
      ;;
    dnf)
      $SUDO dnf install -y p7zip p7zip-plugins nodejs npm python3 \
        gcc gcc-c++ make git curl
      ;;
    yum)
      $SUDO yum install -y p7zip p7zip-plugins nodejs npm python3 \
        gcc gcc-c++ make git curl
      ;;
    zypper)
      $SUDO zypper install -y p7zip nodejs npm python3 \
        gcc gcc-c++ make git curl || true
      ;;
    apk)
      $SUDO apk add --no-cache p7zip nodejs npm python3 build-base git curl
      ;;
    xbps)
      $SUDO xbps-install -Sy p7zip nodejs python3 base-devel git curl
      ;;
    portage)
      info "Gentoo detected. Required: p7zip nodejs python git curl"
      read -rp "  Install via emerge? [y/N] " ans
      if [[ "$ans" =~ ^[yY]$ ]]; then
        $SUDO emerge --ask app-arch/p7zip net-libs/nodejs \
          dev-lang/python dev-vcs/git net-misc/curl
      fi
      ;;
    nix)
      nix-env -iA nixpkgs.p7zip nixpkgs.nodejs nixpkgs.python3 \
        nixpkgs.git nixpkgs.curl nixpkgs.gcc
      ;;
    *)
      err "No supported package manager found."
      err "Install manually: p7zip nodejs npm python3 gcc g++ make git curl"
      exit 1
      ;;
  esac
}

# -- check node version (>= 18 required) -------------------------------------
check_node_version() {
  if ! command -v node &>/dev/null; then
    err "Node.js not found."; exit 1
  fi
  local major
  major="$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)"
  if [ "$major" -lt 18 ] 2>/dev/null; then
    warn "Node.js $(node -v) detected -- >= 18 recommended."
    read -rp "Continue anyway? [y/N] " ans
    [[ "$ans" =~ ^[yY]$ ]] || exit 1
  else
    ok "Node.js $(node -v) (>= 18)"
  fi
}

# -- remove broken symlinks from a directory ----------------------------------
remove_broken_symlinks() {
  local dir="$1"
  local count=0
  while IFS= read -r -d '' link; do
    rm -f "$link"
    ((count++)) || true
  done < <(find "$dir" -type l ! -exec test -e {} \; -print0 2>/dev/null)
  if [ "$count" -gt 0 ]; then
    info "Removed ${count} broken symlink(s) in $(basename "$dir")."
  fi
}

# -- replace all symlinks with real copies ------------------------------------
resolve_all_symlinks() {
  local dir="$1"
  local count=0
  while IFS= read -r -d '' link; do
    local target
    target="$(readlink -f "$link" 2>/dev/null || true)"
    if [ -n "$target" ] && [ -e "$target" ]; then
      rm -f "$link"
      cp -a "$target" "$link"
      ((count++)) || true
    fi
  done < <(find "$dir" -type l -print0 2>/dev/null)
  if [ "$count" -gt 0 ]; then
    info "Resolved ${count} symlink(s) in $(basename "$dir") to real files."
  fi
}

# -- DMG metadata helpers -----------------------------------------------------
fetch_remote_etag() {
  curl -fsSI -L "$DMG_URL" 2>/dev/null \
    | grep -i '^etag:' | tail -1 | tr -d '\r' \
    | sed 's/^[Ee][Tt][Aa][Gg]: *//' || true
}

save_dmg_meta() {
  local hash="$1"
  local etag="${2-}"
  cat > "$DMG_META" <<EOF
# codex-desktop-linux DMG metadata
# generated $(date -Iseconds)
sha256=$hash
etag=$etag
EOF
  ok "Metadata saved: $DMG_META"
}

check_for_update() {
  local local_hash=""
  local local_etag=""
  local remote_etag=""
  local needs_download=0

  # load previous metadata if it exists
  if [ -f "$DMG_META" ]; then
    local_hash="$(grep '^sha256=' "$DMG_META" 2>/dev/null | cut -d= -f2)"
    local_etag="$(grep '^etag='  "$DMG_META" 2>/dev/null | cut -d= -f2)"
  fi

  # try ETag first (no download required)
  remote_etag="$(fetch_remote_etag)"

  if [ -n "$remote_etag" ] && [ -n "$local_etag" ]; then
    if [ "$remote_etag" = "$local_etag" ]; then
      if [ -f "$DMG_FILE" ]; then
        ok "DMG is up to date (ETag match)."
        return 1
      fi
      warn "ETag matches metadata but local DMG is missing. Re-downloading."
      needs_download=1
    else
      info "Remote ETag changed."
      detail "local  : $local_etag"
      detail "remote : $remote_etag"
      needs_download=1
    fi
  elif [ -f "$DMG_FILE" ] && [ -n "$local_hash" ]; then
    # no ETag available -- compare SHA-256
    info "No ETag available. Checking SHA-256 of remote DMG..."
    local tmp_dmg="$DL_DIR/Codex.dmg.tmp"
    curl -L --progress-bar -o "$tmp_dmg" "$DMG_URL"
    local remote_hash
    remote_hash="$(sha256sum "$tmp_dmg" | cut -d' ' -f1)"

    if [ "$remote_hash" = "$local_hash" ]; then
      ok "DMG is up to date (SHA-256 match)."
      rm -f "$tmp_dmg"
      return 1
    fi

    info "SHA-256 mismatch -- new version available."
    detail "local  : $local_hash"
    detail "remote : $remote_hash"
    mv -f "$tmp_dmg" "$DMG_FILE"
    save_dmg_meta "$remote_hash" "$remote_etag"
    return 0
  else
    # no local file or no metadata -- need download
    needs_download=1
  fi

  if [ "$needs_download" -eq 1 ]; then
    info "Downloading new Codex.dmg..."
    curl -L --progress-bar -o "$DMG_FILE" "$DMG_URL"
    ok "Download complete."
  fi

  # compute and save metadata
  local new_hash
  new_hash="$(sha256sum "$DMG_FILE" | cut -d' ' -f1)"
  save_dmg_meta "$new_hash" "$remote_etag"
  return 0
}


###############################################################################
#                              MAIN
###############################################################################

echo -e "${BOLD}"
cat <<'BANNER'
  +-------------------------------------------------------------+
  |     Codex macOS -> Linux  --  Universal Port Script  v3      |
  |                                                              |
  |  - patches isPackaged       - symlinks -> real files         |
  |  - repacks as .asar         - works on all distros           |
  +-------------------------------------------------------------+
BANNER
echo -e "${NC}"

# -- [0/10] system check -----------------------------------------------------
step "[0/10] System check"

ARCH="$(uname -m 2>/dev/null || echo unknown)"
KERNEL="$(uname -r 2>/dev/null || echo unknown)"
OS_NAME="Unknown"
if [ -f /etc/os-release ]; then
  # shellcheck disable=SC1091
  . /etc/os-release
  OS_NAME="${PRETTY_NAME:-${NAME:-${ID:-Unknown}}}"
fi

info "OS           : $OS_NAME"
info "Kernel       : $KERNEL"
info "Architecture : $ARCH"
info "Home         : $HOME"
echo ""

info "Available tools:"
for cmd in curl git node npm pnpm 7z 7zz 7za electron gcc g++ make python3; do
  if command -v "$cmd" >/dev/null 2>&1; then
    ok "  ${cmd}  ->  $(command -v "$cmd")"
  else
    warn "  ${cmd}  ->  not found"
  fi
done

if [ "$ARCH" != "x86_64" ] && [ "$ARCH" != "aarch64" ]; then
  echo ""
  warn "Architecture '${ARCH}' may not be fully supported."
fi

# -- [1/10] system packages ---------------------------------------------------
step "[1/10] Install system packages"

PKG_MGR="$(detect_pkg_manager)"
install_system_packages "$PKG_MGR"
echo ""
check_node_version

echo ""
info "Versions:"
echo "  node  : $(node -v 2>/dev/null || echo '-')"
echo "  npm   : $(npm  -v 2>/dev/null || echo '-')"
echo "  git   : $(git --version 2>/dev/null | awk '{print $3}' || echo '-')"

# -- [2/10] pnpm and electron -------------------------------------------------
step "[2/10] Set up pnpm and tools"

if ! command -v pnpm &>/dev/null; then
  info "Installing pnpm via npm..."
  $SUDO npm i -g pnpm
fi
ok "pnpm $(pnpm -v)"

PNPM_BIN="$(command -v pnpm)"

export PNPM_HOME="${PNPM_HOME:-$HOME/.local/share/pnpm}"
mkdir -p "$PNPM_HOME"
export PATH="$PNPM_HOME:$PATH"

info "Checking asar..."
if "$PNPM_BIN" dlx asar --version 2>/dev/null; then
  ok "asar available."
else
  warn "asar check failed -- will retry during extraction."
fi

if ! command -v electron &>/dev/null; then
  info "Electron not found -- installing via pnpm..."
  "$PNPM_BIN" i -g electron
fi

if command -v electron &>/dev/null; then
  ok "Electron $(electron --version 2>/dev/null || echo '?')"
else
  err "Electron not available. Install manually."
  exit 1
fi

# base paths (needed before update-check in step 3)
ROOT_APP_DIR="$HOME/apps/codex-port"

# -- [3/10] download / update check -------------------------------------------
step "[3/10] Check for Codex.dmg updates"

DL_DIR="$HOME/Downloads/codex-macos"
mkdir -p "$DL_DIR"
DMG_FILE="$DL_DIR/Codex.dmg"
DMG_META="$DL_DIR/Codex.dmg.meta"
DMG_URL="https://persistent.oaistatic.com/codex-app-prod/Codex.dmg"

HAD_LOCAL_DMG=0
if [ -f "$DMG_FILE" ]; then
  HAD_LOCAL_DMG=1
fi

if check_for_update; then
  if [ "$HAD_LOCAL_DMG" -eq 1 ]; then
    info "New DMG downloaded -- cleaning old extraction artifacts."
    rm -rf "$ROOT_APP_DIR/dmg_extracted" \
           "$ROOT_APP_DIR/app_asar" \
           "$ROOT_APP_DIR/app.asar" \
           "$ROOT_APP_DIR/app.asar.unpacked"
  fi
else
  info "No DMG update detected -- existing file kept."
fi

# -- [4/10] extract DMG -------------------------------------------------------
step "[4/10] Extract DMG and unpack app.asar"

mkdir -p "$ROOT_APP_DIR"
cd "$ROOT_APP_DIR"

SEVEN_Z="$(find_7z_bin || true)"
if [ -z "$SEVEN_Z" ]; then
  err "No 7z binary found."; exit 1
fi
ok "Using: $SEVEN_Z"

info "Extracting Codex.dmg..."
"$SEVEN_Z" x -y -aoa "$DMG_FILE" -o"./dmg_extracted" > /dev/null 2>&1 \
  || "$SEVEN_Z" x -y "$DMG_FILE" -o"./dmg_extracted"

APP_ASAR_PATH="$(find ./dmg_extracted -name 'app.asar' -print 2>/dev/null \
  | head -n1 || true)"

# HFS fallback
if [ -z "$APP_ASAR_PATH" ]; then
  info "app.asar not found directly -- searching for HFS partitions..."
  while IFS= read -r -d '' hfs; do
    "$SEVEN_Z" x -y "$hfs" -o"./dmg_extracted/hfs_content" > /dev/null 2>&1 || true
  done < <(find ./dmg_extracted -maxdepth 3 \
    \( -name '*.hfs' -o -name '*.Apple_HFS' \) -print0 2>/dev/null)
  APP_ASAR_PATH="$(find ./dmg_extracted -name 'app.asar' -print 2>/dev/null \
    | head -n1 || true)"
fi

if [ -z "$APP_ASAR_PATH" ]; then
  err "app.asar not found."
  find ./dmg_extracted -maxdepth 4 -type f 2>/dev/null | head -25 || true
  exit 1
fi
ok "app.asar found: $APP_ASAR_PATH"

# remove old extraction
[ -d "$ROOT_APP_DIR/app_asar" ] && rm -rf "$ROOT_APP_DIR/app_asar"

mkdir -p "$ROOT_APP_DIR/app_asar"
info "Unpacking app.asar..."
"$PNPM_BIN" dlx asar extract "$APP_ASAR_PATH" "$ROOT_APP_DIR/app_asar"
ok "app.asar unpacked to: $ROOT_APP_DIR/app_asar"

# -- [5/10] rebuild native modules -------------------------------------------
step "[5/10] Rebuild native modules (better-sqlite3, node-pty)"

cd "$ROOT_APP_DIR/app_asar"

ELECTRON_VERSION="$(electron --version 2>/dev/null | tr -d 'v' || true)"
if [ -z "$ELECTRON_VERSION" ]; then
  err "Could not determine Electron version."; exit 1
fi
ok "Electron version: $ELECTRON_VERSION"

# isolated build project (outside app_asar)
TMP_BUILD_DIR="$ROOT_APP_DIR/_native-module-build"
rm -rf "$TMP_BUILD_DIR"
mkdir -p "$TMP_BUILD_DIR"
cd "$TMP_BUILD_DIR"

# read module versions from the Codex app
BSQL_VERSION="$(node -p \
  "require('$ROOT_APP_DIR/app_asar/node_modules/better-sqlite3/package.json').version" \
  2>/dev/null || echo '12.5.0')"

HAVE_NODE_PTY=0
NPT_VERSION=""
if [ -d "$ROOT_APP_DIR/app_asar/node_modules/node-pty" ]; then
  NPT_VERSION="$(node -p \
    "require('$ROOT_APP_DIR/app_asar/node_modules/node-pty/package.json').version" \
    2>/dev/null || echo '1.0.0')"
fi

# package.json with allowed build scripts (pnpm 10+)
cat > package.json <<PKGJSON
{
  "name": "codex-native-rebuild",
  "version": "1.0.0",
  "private": true,
  "pnpm": {
    "onlyBuiltDependencies": [
      "better-sqlite3",
      "node-pty"
    ]
  }
}
PKGJSON

info "Installing better-sqlite3@${BSQL_VERSION}..."
pnpm add "better-sqlite3@$BSQL_VERSION"

if [ -n "$NPT_VERSION" ]; then
  info "Installing node-pty@${NPT_VERSION}..."
  if pnpm add "node-pty@$NPT_VERSION"; then
    HAVE_NODE_PTY=1
  else
    warn "node-pty installation failed -- skipping."
  fi
fi

info "Rebuilding native modules for Electron ${ELECTRON_VERSION}..."
set +e
"$PNPM_BIN" dlx @electron/rebuild -v "$ELECTRON_VERSION"
REB_EXIT=$?
set -e

if [ "$REB_EXIT" -ne 0 ]; then
  warn "electron-rebuild exited with code ${REB_EXIT}."
else
  ok "electron-rebuild complete."
fi

# copy compiled modules into the app
info "Copying compiled modules into the Codex app..."
echo ""

# cp -aL: dereference symlinks -- this is the key fix for the ENOENT error
if [ -d "$TMP_BUILD_DIR/node_modules/better-sqlite3" ]; then
  rm -rf "$ROOT_APP_DIR/app_asar/node_modules/better-sqlite3"
  cp -aL "$TMP_BUILD_DIR/node_modules/better-sqlite3" \
         "$ROOT_APP_DIR/app_asar/node_modules/better-sqlite3"
  ok "better-sqlite3 copied (symlinks dereferenced)."

  # verify native binary exists
  BSQL_NODE="$(find "$ROOT_APP_DIR/app_asar/node_modules/better-sqlite3" \
    -name '*.node' -type f 2>/dev/null | head -n1 || true)"
  if [ -n "$BSQL_NODE" ]; then
    detail "Native lib: $(basename "$BSQL_NODE")"
    detail "Size: $(du -sh "$BSQL_NODE" 2>/dev/null | cut -f1)"
    detail "Arch: $(file "$BSQL_NODE" 2>/dev/null | grep -oP 'x86-64|aarch64|ARM' || echo '?')"
  else
    warn "No .node file found in better-sqlite3."
  fi
else
  warn "better-sqlite3 not found in build directory."
fi

echo ""

if [ "$HAVE_NODE_PTY" -eq 1 ] \
   && [ -d "$TMP_BUILD_DIR/node_modules/node-pty" ]; then
  rm -rf "$ROOT_APP_DIR/app_asar/node_modules/node-pty"
  cp -aL "$TMP_BUILD_DIR/node_modules/node-pty" \
         "$ROOT_APP_DIR/app_asar/node_modules/node-pty"
  ok "node-pty copied (symlinks dereferenced)."

  NPT_NODE="$(find "$ROOT_APP_DIR/app_asar/node_modules/node-pty" \
    -name '*.node' -type f 2>/dev/null | head -n1 || true)"
  if [ -n "$NPT_NODE" ]; then
    detail "Native lib: $(basename "$NPT_NODE")"
  fi
fi

# -- [6/10] patch JS bundle ---------------------------------------------------
step "[6/10] Patch JS bundle (bypass isPackaged checks)"

info "Locating Vite build files..."
VITE_BUILD_DIR="$ROOT_APP_DIR/app_asar/.vite/build"

if [ ! -d "$VITE_BUILD_DIR" ]; then
  VITE_BUILD_DIR="$(find "$ROOT_APP_DIR/app_asar" -type d -name build \
    -path '*/.vite/*' 2>/dev/null | head -n1 || true)"
fi

if [ -z "${VITE_BUILD_DIR:-}" ] || [ ! -d "$VITE_BUILD_DIR" ]; then
  warn "No .vite/build found -- searching entire app directory..."
  VITE_BUILD_DIR="$ROOT_APP_DIR/app_asar"
fi

PKG_JSON="$ROOT_APP_DIR/app_asar/package.json"

info "Patching JavaScript bundle..."
detail "Directory: $VITE_BUILD_DIR"

node <<PATCHSCRIPT
const fs   = require('fs');
const path = require('path');

const buildDir = '$VITE_BUILD_DIR';
const pkgPath  = '$PKG_JSON';
const appDir   = '$ROOT_APP_DIR/app_asar';

// -- patch JS files ----------------------------------------------------------
function patchDir(dir) {
  let patched = 0;
  let files;
  try { files = fs.readdirSync(dir); } catch { return 0; }

  for (const entry of files) {
    const fp = path.join(dir, entry);
    let stat;
    try { stat = fs.lstatSync(fp); } catch { continue; }

    if (stat.isDirectory() && entry !== 'node_modules') {
      patched += patchDir(fp);
      continue;
    }
    if (!stat.isFile() || !entry.endsWith('.js')) continue;

    const orig = fs.readFileSync(fp, 'utf8');
    let code = orig;

    // patch: "only bundled with the Electron app"
    code = code.replace(
      /throw\s+new\s+Error\([^)]*only bundled with the Electron app[^)]*\)/g,
      'void 0 /* linux-port: isPackaged bypass */'
    );

    // patch: "not supported outside of packaged"
    code = code.replace(
      /throw\s+new\s+Error\([^)]*not supported outside of packaged[^)]*\)/g,
      'void 0 /* linux-port: packaged bypass */'
    );

    // patch: "Cannot load native module"
    code = code.replace(
      /throw\s+new\s+Error\([^)]*[Cc]annot load native module[^)]*\)/g,
      'void 0 /* linux-port: native module bypass */'
    );

    // patch: !app.isPackaged guards -> (false)
    code = code.replace(
      /(![\w.]*app\.isPackaged)/g,
      '(false) /* linux-port: force packaged */'
    );

    if (code !== orig) {
      const bakPath = fp + '.orig';
      if (!fs.existsSync(bakPath)) fs.copyFileSync(fp, bakPath);
      fs.writeFileSync(fp, code);
      patched++;
      console.log('  Patched: ' + path.relative(appDir, fp));
    }
  }
  return patched;
}

const count = patchDir(buildDir);
if (count === 0) {
  console.log('  No files needed patching.');
} else {
  console.log('  ' + count + ' file(s) patched.');
}

// -- inject build metadata into package.json ---------------------------------
if (fs.existsSync(pkgPath)) {
  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
  let changed = false;

  if (!pkg.codexBuildFlavor) {
    pkg.codexBuildFlavor = 'prod';
    changed = true;
  }
  if (!pkg.CodexBuildNumber) {
    pkg.CodexBuildNumber = 'linux-port-1';
    changed = true;
  }
  if (!pkg.main) {
    try {
      const viteDir = path.join(appDir, '.vite', 'build');
      const mainFiles = fs.readdirSync(viteDir)
        .filter(f => f.startsWith('main') && f.endsWith('.js'));
      if (mainFiles.length > 0) {
        pkg.main = '.vite/build/' + mainFiles[0];
        changed = true;
      }
    } catch {}
  }

  if (changed) {
    fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\\n');
    console.log('  package.json: metadata injected.');
  }
}
PATCHSCRIPT

ok "Patch step complete."

# -- [7/10] resolve symlinks and repack as asar --------------------------------
step "[7/10] Resolve symlinks and repack as asar"

cd "$ROOT_APP_DIR"

info "Step 7a: Replacing all symlinks in app_asar with real files..."

remove_broken_symlinks "$ROOT_APP_DIR/app_asar"
resolve_all_symlinks "$ROOT_APP_DIR/app_asar"

REMAINING_LINKS="$(find "$ROOT_APP_DIR/app_asar" -type l 2>/dev/null | wc -l)"
if [ "$REMAINING_LINKS" -gt 0 ]; then
  warn "${REMAINING_LINKS} symlink(s) remain -- these may cause issues."
  find "$ROOT_APP_DIR/app_asar" -type l 2>/dev/null | head -5 | while read -r l; do
    detail "$l -> $(readlink "$l" 2>/dev/null || echo '?')"
  done
else
  ok "No symlinks remain in app_asar -- ready to pack."
fi

echo ""
info "Step 7b: Packing app_asar -> app.asar..."
detail "Native modules (*.node) kept in app.asar.unpacked."

rm -rf "$ROOT_APP_DIR/app.asar" "$ROOT_APP_DIR/app.asar.unpacked"

"$PNPM_BIN" dlx asar pack \
  "$ROOT_APP_DIR/app_asar" \
  "$ROOT_APP_DIR/app.asar" \
  --unpack "**/*.node"

USE_ASAR=0
if [ -f "$ROOT_APP_DIR/app.asar" ]; then
  ASAR_SIZE="$(du -sh "$ROOT_APP_DIR/app.asar" 2>/dev/null | cut -f1)"
  ok "app.asar created (${ASAR_SIZE})"

  if [ -d "$ROOT_APP_DIR/app.asar.unpacked" ]; then
    NODE_FILES="$(find "$ROOT_APP_DIR/app.asar.unpacked" -name '*.node' 2>/dev/null)"
    NODE_COUNT="$(echo "$NODE_FILES" | grep -c '.' 2>/dev/null || echo 0)"
    ok "${NODE_COUNT} native module(s) in app.asar.unpacked."
    echo "$NODE_FILES" | while read -r nf; do
      [ -n "$nf" ] && detail "$(basename "$nf")  ->  $(echo "$nf" | sed "s|$ROOT_APP_DIR/||")"
    done
  fi
  USE_ASAR=1
else
  warn "app.asar could not be created."
  warn "Falling back to directory mode (patched JS)."
fi

# -- [8/10] launcher script and desktop entry ----------------------------------
step "[8/10] Create launcher script and desktop entry"

cat > "$ROOT_APP_DIR/run-codex.sh" <<'RUNEOF'
#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")" && pwd)"

export ELECTRON_FORCE_IS_PACKAGED=1
export NODE_ENV=production

export CODEX_CLI_PATH="${CODEX_CLI_PATH:-$HOME/.local/share/pnpm/codex}"

export PNPM_HOME="${PNPM_HOME:-$HOME/.local/share/pnpm}"
export PATH="$PNPM_HOME:$PATH"

EFLAGS="${CODEX_ELECTRON_ARGS:---no-sandbox}"

# prefer asar (app.isPackaged = true), fall back to directory
if [ -f "$ROOT_DIR/app.asar" ]; then
  exec electron $EFLAGS "$ROOT_DIR/app.asar" "$@"
else
  exec electron $EFLAGS "$ROOT_DIR/app_asar" "$@"
fi
RUNEOF

chmod +x "$ROOT_APP_DIR/run-codex.sh"
ok "Launcher: $ROOT_APP_DIR/run-codex.sh"

# desktop entry
DESKTOP_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/applications"
mkdir -p "$DESKTOP_DIR"

cat > "$DESKTOP_DIR/codex.desktop" <<DESKEOF
[Desktop Entry]
Name=Codex
Comment=OpenAI Codex Desktop App (Linux port)
Exec=${ROOT_APP_DIR}/run-codex.sh
Icon=utilities-terminal
Terminal=false
Type=Application
Categories=Development;
StartupWMClass=Codex
DESKEOF

ok "Desktop entry: $DESKTOP_DIR/codex.desktop"

# -- [9/10] install Codex CLI --------------------------------------------------
step "[9/10] Install Codex CLI globally (@openai/codex)"

"$PNPM_BIN" setup 2>/dev/null || true
mkdir -p "$PNPM_HOME"

info "Installing @openai/codex globally..."
"$PNPM_BIN" i -g @openai/codex 2>/dev/null \
  || warn "@openai/codex could not be installed."

echo ""
if PATH="$PNPM_HOME:$PATH" command -v codex &>/dev/null; then
  ok "codex found : $(PATH="$PNPM_HOME:$PATH" command -v codex)"
  ok "codex version : $(PATH="$PNPM_HOME:$PATH" codex --version 2>/dev/null || echo '?')"
else
  warn "codex not in PATH."
  warn "Add to ~/.bashrc or ~/.zshrc:"
  echo "    export PNPM_HOME=\"$PNPM_HOME\""
  echo "    export PATH=\"\$PNPM_HOME:\$PATH\""
fi

# -- [10/10] cleanup and summary -----------------------------------------------
step "[10/10] Summary"

if [ -d "$ROOT_APP_DIR/_native-module-build" ]; then
  info "Cleaning up temp build directory..."
  rm -rf "$ROOT_APP_DIR/_native-module-build"
  ok "Temp files removed."
fi

echo ""
echo -e "  ${GREEN}${BOLD}Codex has been successfully ported to Linux.${NC}"
echo ""
echo "  Install directory:"
echo -e "      ${BOLD}${ROOT_APP_DIR}/${NC}"
echo ""
if [ "${USE_ASAR:-0}" -eq 1 ]; then
  echo -e "  Mode: ${GREEN}asar${NC} (app.isPackaged = true)"
else
  echo -e "  Mode: ${YELLOW}directory${NC} (JS patched, app.isPackaged = false)"
fi
echo ""
echo "  Launch GUI:"
echo -e "      ${BOLD}~/apps/codex-port/run-codex.sh${NC}"
echo ""
echo "  Custom CLI path:"
echo -e "      ${BOLD}CODEX_CLI_PATH=/path/to/codex ~/apps/codex-port/run-codex.sh${NC}"
echo ""
echo "  CLI:"
echo -e "      ${BOLD}codex --help${NC}"
echo ""

if ! PATH="$PNPM_HOME:$PATH" command -v codex &>/dev/null; then
  echo -e "  ${YELLOW}Note: add pnpm to PATH:${NC}"
  echo "      export PNPM_HOME=\"$PNPM_HOME\""
  echo "      export PATH=\"\$PNPM_HOME:\$PATH\""
  echo ""
fi

# verify files
echo "  File check:"
for f in app.asar run-codex.sh; do
  if [ -e "$ROOT_APP_DIR/$f" ]; then
    ok "  $f"
  else
    warn "  $f missing"
  fi
done
[ -d "$ROOT_APP_DIR/app.asar.unpacked" ] && ok "  app.asar.unpacked/"
[ -d "$ROOT_APP_DIR/app_asar" ] && ok "  app_asar/ (backup/fallback)"

echo ""
echo -e "${BOLD}==================================================================${NC}"
echo -e "${BOLD}  Done.${NC}"
echo -e "${BOLD}==================================================================${NC}"