setup-coder.sh

#!/usr/bin/env bash
# ===========================================================================
# setup-coder.sh — Provision a sandboxed user for AI coding agents
# ===========================================================================
#
# Idempotent — safe to run multiple times. Each step checks whether its
# work is already done before acting.
#
# Creates an isolated Linux user that can:
#   - Run Claude Code, Codex, and other AI agents safely
#   - Use Podman (rootless) for containers — NO Docker socket access
#   - Use the homelab CLI to expose dev servers through Traefik
#   - Access GitHub with a fine-grained PAT scoped to specific repos
#
# Security boundaries:
#   - Primary user's home is chmod 700 — coder cannot read personal data
#   - Coder is NOT in docker or sudo groups
#   - Podman runs rootless (no daemon, no privilege escalation)
#   - GitHub PAT is fine-grained, limited to target repos only
#
# Configuration (via environment variables):
#   CODER_USER     — username to create (default: coder)
#   PRIMARY_USER   — user whose home to protect (default: SUDO_USER)
#   DOMAIN         — homelab domain (default: read from /opt/homelab/.env)
#   HOMELAB_DIR    — homelab directory (default: /opt/homelab)
#   AITOOLS_DIR    — MCP tools source (default: $PRIMARY_HOME/Programming/AITOOLS)
#
# Usage:
#   sudo bash setup-coder.sh [--yes]
#   sudo CODER_USER=agent PRIMARY_USER=alice DOMAIN=mylab.local bash setup-coder.sh
#
# ===========================================================================

set -euo pipefail

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------

CODER_USER="${CODER_USER:-coder}"
CODER_HOME="/home/${CODER_USER}"
HOMELAB_DIR="${HOMELAB_DIR:-/opt/homelab}"
ASSUME_YES=false

# Primary user: the human account whose home directory we protect.
# Defaults to SUDO_USER (the user who ran sudo), fallback to logname.
PRIMARY_USER="${PRIMARY_USER:-${SUDO_USER:-$(logname 2>/dev/null || echo "")}}"
PRIMARY_HOME=""
if [[ -n "$PRIMARY_USER" ]]; then
    PRIMARY_HOME="/home/${PRIMARY_USER}"
fi

# Domain: read from homelab .env if available, or from env var.
_read_homelab_env() {
    local key="$1"
    [[ -f "${HOMELAB_DIR}/.env" ]] || return 1
    local line
    line="$(grep -m1 "^${key}=" "${HOMELAB_DIR}/.env" 2>/dev/null || true)"
    [[ -n "$line" ]] || return 1
    printf '%s\n' "${line#*=}"
}

if [[ -z "${DOMAIN:-}" ]]; then
    DOMAIN="$(_read_homelab_env DOMAIN 2>/dev/null || echo "")"
fi
DOMAIN="${DOMAIN:-homelab.local}"

LAN_IP="${LAN_IP:-$(_read_homelab_env LAN_IP 2>/dev/null || echo "")}"
if [[ -z "$LAN_IP" ]]; then
    LAN_IP="$(ip -4 route get 1.1.1.1 2>/dev/null | awk '/src/ {for (i=1;i<=NF;i++) if ($i=="src") print $(i+1)}' | head -n1 || true)"
fi
HOSTNAME_SHORT="$(hostname -s 2>/dev/null || echo "homelab")"

# AITOOLS: source directory for MCP tools (coder, qt-mcp, cratedex).
# Defaults to $PRIMARY_HOME/Programming/AITOOLS if it exists.
if [[ -z "${AITOOLS_DIR:-}" && -n "$PRIMARY_USER" ]]; then
    _candidate="/home/${PRIMARY_USER}/Programming/AITOOLS"
    [[ -d "$_candidate" ]] && AITOOLS_DIR="$_candidate"
fi
AITOOLS_DIR="${AITOOLS_DIR:-}"

# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

info()  { echo -e "${GREEN}[INFO]${NC}  $*"; }
warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
err()   { echo -e "${RED}[ERR]${NC}   $*" >&2; }
step()  { echo -e "\n${CYAN}── $* ──${NC}"; }

confirm() {
    local msg="$1"
    if [[ "${ASSUME_YES}" == "true" ]]; then
        return 0
    fi
    echo -en "${YELLOW}$msg [y/N]: ${NC}"
    read -r ans
    [[ "$ans" =~ ^[Yy] ]]
}

run_as_coder() {
    # Use -H (set HOME) + bash -lc (login shell) instead of sudo -i.
    # sudo -i re-escapes arguments for the login shell's -c option, which
    # breaks compound commands (&&) by splitting them across shell contexts.
    # With -H + bash -l, the -c argument is passed directly to bash by the
    # OS exec, bypassing sudo's escaping entirely.
    sudo -Hu "$CODER_USER" bash -lc "cd \"\$HOME\" && $1"
}

# Read/write env vars in coder's .bashrc (idempotent)
_coder_has_env() { grep -q "^export $1=" "${CODER_HOME}/.bashrc" 2>/dev/null; }

_coder_set_env() {
    local name="$1" value="$2"
    local bashrc="${CODER_HOME}/.bashrc"
    sed -i "/^export ${name}=/d" "$bashrc"
    printf 'export %s="%s"\n' "$name" "$value" >> "$bashrc"
    chown "${CODER_USER}:${CODER_USER}" "$bashrc"
    chmod 600 "$bashrc"
}

# ---------------------------------------------------------------------------
# Args
# ---------------------------------------------------------------------------

while [[ $# -gt 0 ]]; do
    case "$1" in
        --yes|-y) ASSUME_YES=true; shift ;;
        -h|--help)
            echo "Usage: sudo bash $0 [--yes]"
            echo ""
            echo "Environment variables:"
            echo "  CODER_USER     Username to create (default: coder)"
            echo "  PRIMARY_USER   User whose home to protect (default: \$SUDO_USER)"
            echo "  DOMAIN         Homelab domain (default: from /opt/homelab/.env)"
            echo "  HOMELAB_DIR    Homelab directory (default: /opt/homelab)"
            exit 0
            ;;
        *) err "Unknown argument: $1"; exit 1 ;;
    esac
done

# ---------------------------------------------------------------------------
# Pre-flight
# ---------------------------------------------------------------------------

step "Pre-flight checks"

if [[ $EUID -ne 0 ]]; then
    err "This script must be run as root. Try: sudo bash $0"
    exit 1
fi

info "Configuration:"
info "  CODER_USER:   ${CODER_USER}"
info "  PRIMARY_USER: ${PRIMARY_USER:-"(none)"}"
info "  DOMAIN:       ${DOMAIN}"
info "  LAN_IP:       ${LAN_IP:-"(unknown)"}"
info "  HOMELAB_DIR:  ${HOMELAB_DIR}"
info "  AITOOLS_DIR:  ${AITOOLS_DIR:-"(not set)"}"

echo ""
echo "This script will:"
echo "  1. Create the '${CODER_USER}' user with homelab group membership"
if [[ -n "$PRIMARY_HOME" ]]; then
echo "  2. Lock down ${PRIMARY_HOME} (chmod 700)"
else
echo "  2. (skip — no PRIMARY_USER set)"
fi
echo "  3. Install Podman + crun for rootless containers (with GPU ACLs if AMD GPU present)"
echo "  3.5 Install Rust ecosystem (rustup + cratedex)"
echo "  4. Install Node.js (via nvm)"
echo "  5. Install Python ecosystem (uv + ruff + qt-mcp)"
echo "  6. Configure gh CLI with a fine-grained PAT"
echo "  7. Install agent CLIs (Claude Code native, OpenAI Codex, Google Gemini)"
echo "  8. Set up MCP server config and CLAUDE.md"
echo "  9. Create workspace directory"
echo " 10. Configure SSH keys, API keys & authenticate agents"
echo " 10.6 Set up Ollama LLM inference (Podman + ROCm GPU)"
echo " 11. Run verification checks"
echo ""

if ! confirm "Proceed?"; then
    info "Aborted."
    exit 0
fi

# ---------------------------------------------------------------------------
# Step 1: Create coder user
# ---------------------------------------------------------------------------

step "Creating '${CODER_USER}' user"

# Ensure homelab group exists
groupadd -f homelab

if id "$CODER_USER" &>/dev/null; then
    info "User '${CODER_USER}' already exists"
    if ! id -nG "$CODER_USER" | grep -qw homelab; then
        usermod -aG homelab "$CODER_USER"
        info "Added ${CODER_USER} to homelab group"
    fi
else
    useradd -m -s /bin/bash -G homelab "$CODER_USER"
    info "Created user '${CODER_USER}' (groups: homelab)"
fi

# Allow the primary user to read/navigate the coder home directory by adding
# them to the coder group. The coder home is 750 (rwxr-x---), so group members
# get read + execute. The reverse is NOT true — coder cannot read PRIMARY_HOME
# (chmod 700 in step 2).
if [[ -n "$PRIMARY_USER" ]]; then
    if id -nG "$PRIMARY_USER" 2>/dev/null | grep -qw "$CODER_USER"; then
        info "${PRIMARY_USER} already in ${CODER_USER} group"
    else
        usermod -aG "$CODER_USER" "$PRIMARY_USER"
        info "Added ${PRIMARY_USER} to ${CODER_USER} group (read access to ${CODER_HOME})"
    fi
fi

# Ensure coder home is 750 (owner: full, group: read+exec, others: none)
chmod 750 "${CODER_HOME}"

# Explicitly ensure coder is NOT in docker or sudo groups
for dangerous_group in docker sudo; do
    if id -nG "$CODER_USER" 2>/dev/null | grep -qw "$dangerous_group"; then
        gpasswd -d "$CODER_USER" "$dangerous_group" 2>/dev/null || true
        warn "Removed ${CODER_USER} from '${dangerous_group}' group (security policy)"
    fi
done

# ---------------------------------------------------------------------------
# Step 2: Lock down primary user's home directory
# ---------------------------------------------------------------------------

step "Locking down primary user home"

if [[ -n "$PRIMARY_HOME" && -d "$PRIMARY_HOME" ]]; then
    current_mode="$(stat -c '%a' "$PRIMARY_HOME" 2>/dev/null || true)"
    if [[ "$current_mode" == "700" ]]; then
        info "${PRIMARY_HOME} already mode 700"
    else
        chmod 700 "$PRIMARY_HOME"
        info "${PRIMARY_HOME} set to mode 700 (was ${current_mode})"
    fi
elif [[ -n "$PRIMARY_HOME" ]]; then
    warn "${PRIMARY_HOME} does not exist — skipping"
else
    info "No PRIMARY_USER set — skipping home lockdown"
fi

# ---------------------------------------------------------------------------
# Step 3: Install Podman
# ---------------------------------------------------------------------------

step "Installing Podman (rootless containers)"

export DEBIAN_FRONTEND=noninteractive

if ! command -v podman &>/dev/null; then
    apt-get update -y
    apt-get install -y --no-install-recommends podman slirp4netns uidmap
    info "Podman installed"
else
    info "Podman already installed: $(podman --version)"
fi

# Enable linger so coder's systemd user services survive logout
loginctl enable-linger "$CODER_USER"
info "Enabled loginctl linger for ${CODER_USER}"

# Install crun — required for --group-add keep-groups in rootless containers.
# runc does not support the run.oci.keep_original_groups annotation that
# preserves host supplementary groups inside user namespaces.
if ! command -v crun &>/dev/null; then
    apt-get install -y --no-install-recommends crun
    info "crun installed"
else
    info "crun already installed: $(crun --version | head -1)"
fi

# Configure Podman for coder user: crun runtime + cgroupfs cgroup manager.
# cgroupfs avoids the dependency on systemd --user which can be unreliable
# in SSH/sudo sessions. events_logger=file avoids journald permission issues.
_coder_containers_dir="${CODER_HOME}/.config/containers"
mkdir -p "$_coder_containers_dir"
cat > "${_coder_containers_dir}/containers.conf" << 'CONTAINERS_CONF'
[engine]
runtime = "crun"
cgroup_manager = "cgroupfs"
events_logger = "file"
CONTAINERS_CONF
chown -R "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.config"
info "Podman configured for ${CODER_USER} (crun + cgroupfs)"

# GPU access for rootless Podman (AMD ROCm).
# In rootless Podman, host GIDs (render, video) can't cross the user namespace
# boundary. Device ACLs grant access by UID instead, which works with
# --userns=keep-id since the container process retains the host UID.
if [[ -e /dev/kfd && -d /dev/dri ]]; then
    _has_render_node=false
    for _rn in /dev/dri/renderD*; do
        [[ -e "$_rn" ]] && _has_render_node=true && break
    done

    if [[ "$_has_render_node" == "true" ]]; then
        info "AMD GPU detected — configuring device ACLs for ${CODER_USER}"

        if ! command -v setfacl &>/dev/null; then
            apt-get install -y --no-install-recommends acl
        fi

        # Set ACLs on GPU compute devices
        setfacl -m "u:${CODER_USER}:rw" /dev/kfd
        for _rn in /dev/dri/renderD*; do
            setfacl -m "u:${CODER_USER}:rw" "$_rn"
        done
        info "GPU device ACLs set for ${CODER_USER}"

        # Persist ACLs across reboots via udev rule
        _udev_rule="/etc/udev/rules.d/99-gpu-${CODER_USER}.rules"
        cat > "$_udev_rule" << UDEV_GPU
# Grant ${CODER_USER} access to AMD GPU for rootless Podman (ROCm)
KERNEL=="kfd", SUBSYSTEM=="kfd", RUN+="/usr/bin/setfacl -m u:${CODER_USER}:rw /dev/kfd"
KERNEL=="renderD[0-9]*", SUBSYSTEM=="drm", RUN+="/usr/bin/setfacl -m u:${CODER_USER}:rw /dev/dri/%k"
UDEV_GPU
        info "Udev rule installed: ${_udev_rule}"

        # Auto-detect HSA_OVERRIDE_GFX_VERSION from KFD topology
        if [[ -z "${HSA_OVERRIDE_GFX_VERSION:-}" ]]; then
            for _props in /sys/class/kfd/kfd/topology/nodes/*/properties; do
                [[ -f "$_props" ]] || continue
                _gfx_ver="$(awk '/^gfx_target_version/ {print $2}' "$_props" 2>/dev/null || true)"
                [[ -n "$_gfx_ver" && "$_gfx_ver" != "0" ]] || continue
                HSA_OVERRIDE_GFX_VERSION="$(printf '%d.%d.%d' \
                    "$((_gfx_ver / 10000))" \
                    "$(((_gfx_ver / 100) % 100))" \
                    "$((_gfx_ver % 100))")"
                break
            done
        fi

        if [[ -n "${HSA_OVERRIDE_GFX_VERSION:-}" ]]; then
            info "HSA_OVERRIDE_GFX_VERSION=${HSA_OVERRIDE_GFX_VERSION} (auto-detected)"
        else
            warn "Could not detect HSA_OVERRIDE_GFX_VERSION — set manually if ROCm fails"
        fi
    fi
else
    info "No AMD GPU detected — skipping GPU ACL setup"
fi

# ---------------------------------------------------------------------------
# Step 3.5: Install Rust ecosystem (rustup + cratedex)
# ---------------------------------------------------------------------------

step "Installing Rust ecosystem for ${CODER_USER}"

# Ensure build dependencies are present (rustup needs curl, cratedex needs cc/pkg-config)
if ! command -v cc &>/dev/null; then
    apt-get install -y --no-install-recommends build-essential pkg-config libssl-dev
fi

# Install rustup + stable toolchain
if run_as_coder 'command -v rustup' &>/dev/null; then
    info "rustup already installed: $(run_as_coder 'rustup --version 2>/dev/null')"
else
    info "Installing rustup + stable toolchain..."
    run_as_coder 'curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --no-modify-path'
    # Ensure .cargo/env is sourced from .profile
    if ! grep -qs 'cargo/env' "${CODER_HOME}/.profile" 2>/dev/null; then
        cat >> "${CODER_HOME}/.profile" <<'EOF'

# Added by setup-coder.sh: Rust toolchain
if [ -f "$HOME/.cargo/env" ]; then
  . "$HOME/.cargo/env"
fi
EOF
        chown "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.profile"
    fi
    info "rustup + stable toolchain installed"
fi

# Install cratedex (Rust docs MCP server)
if run_as_coder '. "$HOME/.cargo/env" && command -v cratedex' &>/dev/null; then
    info "cratedex already installed: $(run_as_coder '. "$HOME/.cargo/env" && cratedex --version 2>/dev/null' || echo 'unknown')"
else
    info "Installing cratedex (this may take a few minutes)..."
    run_as_coder '. "$HOME/.cargo/env" && cargo install cratedex'
    info "cratedex installed"
fi

# Install system-level cratedex.service via cratedex's built-in installer.
# This handles copying the binary, generating the unit file with correct paths
# (home dir, toolchain, etc.), and enabling the service.
if [[ -f /etc/systemd/system/cratedex.service ]] \
    && grep -q "User=${CODER_USER}" /etc/systemd/system/cratedex.service; then
    info "cratedex.service already installed (User=${CODER_USER})"
else
    info "Installing cratedex systemd service (User=${CODER_USER})..."
    "${CODER_HOME}/.cargo/bin/cratedex" install-service --system --run-as "${CODER_USER}"
fi

# Ensure it's enabled and running
systemctl enable cratedex.service 2>/dev/null || true
if systemctl is-active --quiet cratedex.service; then
    info "cratedex.service is running"
else
    systemctl start cratedex.service
    info "cratedex.service started"
fi

# ---------------------------------------------------------------------------
# Step 4: Install Node.js via nvm
# ---------------------------------------------------------------------------

step "Installing Node.js (nvm) for ${CODER_USER}"

NVM_VERSION="v0.40.1"
NVM_INSTALL_URL="https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh"

# Ensure dependencies are present before we try to bootstrap nvm.
if ! command -v curl &>/dev/null; then
    apt-get install -y --no-install-recommends curl ca-certificates
fi
if ! command -v git &>/dev/null; then
    apt-get install -y --no-install-recommends git
fi

# Do not treat "node exists" as success; later steps assume nvm exists.
if run_as_coder 'export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ]' &>/dev/null; then
    info "nvm already installed for ${CODER_USER}"
else
    info "Installing nvm (${NVM_VERSION})..."
    # nvm's install script may exit non-zero due to a sourcing issue in
    # non-interactive login shells. Tolerate that and verify separately.
    run_as_coder 'export NVM_DIR="$HOME/.nvm" && curl -fsSL "'"${NVM_INSTALL_URL}"'" | bash' || true

    # If ~/.nvm exists but is missing nvm.sh, the installer can think it is
    # "already installed" and skip cloning. Repair by doing a fresh clone.
    if ! run_as_coder 'export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ]'; then
        warn "nvm appears partially installed for ${CODER_USER} — attempting repair"
        # Use absolute paths instead of run_as_coder to avoid sudo -i
        # escaping issues with compound commands (&&) in nested shells.
        rm -rf "${CODER_HOME}/.nvm"
        sudo -u "$CODER_USER" git clone https://github.com/nvm-sh/nvm.git "${CODER_HOME}/.nvm"
        sudo -u "$CODER_USER" git -C "${CODER_HOME}/.nvm" checkout "${NVM_VERSION}"
    fi

    if ! run_as_coder 'export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ]'; then
        err "nvm installation failed — nvm.sh not found at \$HOME/.nvm/nvm.sh for ${CODER_USER}"
        run_as_coder 'export NVM_DIR="$HOME/.nvm" && echo "Debug: HOME=$HOME NVM_DIR=$NVM_DIR" && ls -la "$NVM_DIR" 2>/dev/null || true' >&2 || true
        exit 1
    fi
fi

if run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && command -v node' &>/dev/null; then
    info "Node.js already available for ${CODER_USER}: $(run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && node --version')"
else
    run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && nvm install --lts'
    info "Node.js installed: $(run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && node --version')"
fi

# ---------------------------------------------------------------------------
# Step 5: Install Python ecosystem (uv + ruff + qt-mcp)
# ---------------------------------------------------------------------------

step "Installing Python ecosystem for ${CODER_USER}"

if ! command -v python3 &>/dev/null; then
    apt-get install -y --no-install-recommends python3 python3-venv
    info "Python3 installed"
else
    info "Python3 already available: $(python3 --version)"
fi

if run_as_coder 'command -v uv' &>/dev/null; then
    info "uv already available: $(run_as_coder 'uv --version')"
else
    run_as_coder 'curl -LsSf https://astral.sh/uv/install.sh | sh'
    info "uv installed"
fi

# ruff — fast Python linter/formatter
if run_as_coder '$HOME/.local/bin/uv tool list 2>/dev/null | grep -q ruff'; then
    info "ruff already installed"
else
    run_as_coder '$HOME/.local/bin/uv tool install ruff'
    info "ruff installed"
fi

# qt-mcp — Qt/PySide6 desktop app inspection (MCP server)
if run_as_coder '$HOME/.local/bin/uv tool list 2>/dev/null | grep -q qt-mcp'; then
    info "qt-mcp already installed"
else
    # Try PyPI first; fall back to AITOOLS source if available
    if run_as_coder '$HOME/.local/bin/uv tool install qt-mcp' 2>/dev/null; then
        info "qt-mcp installed (PyPI)"
    elif [[ -n "${AITOOLS_DIR:-}" && -d "${AITOOLS_DIR}/qt-mcp" ]]; then
        # Install from local source — copy to a temp dir readable by coder
        _qtmcp_tmp="/tmp/qt-mcp-install-$$"
        cp -r "${AITOOLS_DIR}/qt-mcp" "$_qtmcp_tmp"
        chown -R "${CODER_USER}:${CODER_USER}" "$_qtmcp_tmp"
        run_as_coder "\$HOME/.local/bin/uv tool install '${_qtmcp_tmp}'"
        rm -rf "$_qtmcp_tmp"
        info "qt-mcp installed (from AITOOLS)"
    else
        warn "qt-mcp not available on PyPI yet and AITOOLS_DIR not set — install later: uv tool install qt-mcp"
    fi
fi

# ---------------------------------------------------------------------------
# Step 6: Configure gh CLI
# ---------------------------------------------------------------------------

step "Configuring GitHub CLI"

if ! command -v gh &>/dev/null; then
    info "Installing gh CLI..."
    if ! command -v curl &>/dev/null; then
        apt-get install -y --no-install-recommends curl
    fi
    curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
        | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
    chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
        > /etc/apt/sources.list.d/github-cli.list
    apt-get update -y
    apt-get install -y gh
    info "gh CLI installed"
else
    info "gh CLI already installed: $(gh --version | head -1)"
fi

if run_as_coder 'gh auth status' &>/dev/null 2>&1; then
    info "gh CLI already authenticated for ${CODER_USER}"
else
    echo ""
    echo -e "${YELLOW}GitHub authentication for the ${CODER_USER} user:${NC}"
    echo ""
    echo "  Create a fine-grained PAT at: https://github.com/settings/personal-access-tokens/new"
    echo "  Scope it to ONLY the repos the ${CODER_USER} user needs access to."
    echo "  Required permissions: Contents (read/write), Pull requests (read/write)"
    echo ""
    if [[ "${ASSUME_YES}" == "true" ]]; then
        warn "Skipping gh auth in non-interactive mode. Run manually:"
        warn "  sudo -u ${CODER_USER} -i gh auth login --with-token"
    else
        echo -en "${YELLOW}Paste the fine-grained PAT (or press Enter to skip): ${NC}"
        read -r -s pat
        echo ""
        if [[ -n "$pat" ]]; then
            echo "$pat" | run_as_coder 'gh auth login --with-token'
            info "gh CLI authenticated for ${CODER_USER}"
        else
            warn "Skipped gh auth. Configure later: sudo -u ${CODER_USER} -i gh auth login"
        fi
    fi
fi

# Export GITHUB_PERSONAL_ACCESS_TOKEN so Podman can forward it to MCP containers
if run_as_coder 'gh auth status' &>/dev/null 2>&1; then
    _gh_token="$(run_as_coder 'gh auth token' 2>/dev/null || true)"
    if [[ -n "$_gh_token" ]]; then
        _coder_set_env GITHUB_PERSONAL_ACCESS_TOKEN "$_gh_token"
        info "GITHUB_PERSONAL_ACCESS_TOKEN set from gh auth token"
    fi
fi

# Pull GitHub MCP server image for Podman-based MCP
run_as_coder 'podman pull ghcr.io/github/github-mcp-server:latest'
info "GitHub MCP server image pulled"

# ---------------------------------------------------------------------------
# Step 7: Install Agent CLIs
# ---------------------------------------------------------------------------

step "Installing agent CLIs"

_ensure_local_bin_on_path() {
    # Claude Code's native installer places the binary in ~/.local/bin by default.
    # Ensure that is on PATH for login shells.
    local profile="${CODER_HOME}/.profile"
    if [[ ! -f "$profile" ]]; then
        touch "$profile"
        chown "${CODER_USER}:${CODER_USER}" "$profile"
    fi
    if ! grep -qs 'HOME/.local/bin' "$profile"; then
        cat >> "$profile" <<'EOF'

# Added by setup-coder.sh: ensure user-local binaries are discoverable
if [ -d "$HOME/.local/bin" ]; then
  PATH="$HOME/.local/bin:$PATH"
fi
EOF
        chown "${CODER_USER}:${CODER_USER}" "$profile"
    fi
}

_install_npm_cli() {
    local bin="$1"
    local pkg="$2"
    local label="$3"
    if run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && command -v '"${bin}"'' &>/dev/null; then
        info "${label} already installed"
    else
        run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && npm i -g '"${pkg}"''
        info "${label} installed"
    fi
}

# Anthropic: Claude Code (native installer; npm installation is deprecated)
_ensure_local_bin_on_path
if run_as_coder 'command -v claude' &>/dev/null; then
    info "Claude Code CLI already installed"
else
    run_as_coder 'curl -fsSL https://claude.ai/install.sh | bash'
    if run_as_coder 'command -v claude' &>/dev/null; then
        info "Claude Code CLI installed (native)"
    else
        err "Claude Code CLI install failed — 'claude' not found on PATH for ${CODER_USER}"
        run_as_coder 'ls -la "$HOME/.local/bin" 2>/dev/null || true' >&2 || true
        exit 1
    fi
fi

# OpenAI: Codex CLI (open source)
_install_npm_cli "codex" "@openai/codex" "OpenAI Codex CLI"

# Google: Gemini CLI (open source)
_install_npm_cli "gemini" "@google/gemini-cli" "Google Gemini CLI"

# ---------------------------------------------------------------------------
# Step 8: MCP server config + CLAUDE.md
# ---------------------------------------------------------------------------

step "Configuring MCP servers and CLAUDE.md"

mkdir -p "${CODER_HOME}/.claude"
chown "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.claude"

# MCP servers — written to ~/.claude.json (Claude Code's global config)
# Uses python3 to merge mcpServers into existing ~/.claude.json (or create it)
_claude_json="${CODER_HOME}/.claude.json"
_mcp_payload=$(cat << 'MCP_JSON'
{
  "cratedex": {
    "type": "http",
    "url": "http://127.0.0.1:3737/mcp"
  },
  "coder": {
    "type": "stdio",
    "command": "node",
    "args": ["CODER_HOME_PLACEHOLDER/tools/coder/bin/coder-mcp.js"]
  },
  "qt-mcp": {
    "type": "stdio",
    "command": "CODER_HOME_PLACEHOLDER/.local/bin/uvx",
    "args": ["qt-mcp"]
  },
  "github": {
    "type": "stdio",
    "command": "podman",
    "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"]
  }
}
MCP_JSON
)
_mcp_payload="${_mcp_payload//CODER_HOME_PLACEHOLDER/${CODER_HOME}}"

python3 -c "
import json, sys, os
path = sys.argv[1]
servers = json.loads(sys.argv[2])
data = {}
if os.path.isfile(path):
    with open(path) as f:
        data = json.load(f)
data['mcpServers'] = servers
with open(path, 'w') as f:
    json.dump(data, f, indent=2)
    f.write('\n')
" "$_claude_json" "$_mcp_payload"

chown "${CODER_USER}:${CODER_USER}" "$_claude_json"
info "MCP servers written to ${_claude_json}"

# Gemini CLI MCP settings — ~/.gemini/settings.json
mkdir -p "${CODER_HOME}/.gemini"
chown "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.gemini"
cat > "${CODER_HOME}/.gemini/settings.json" << GEMINI_MCP
{
  "mcpServers": {
    "github": {
      "command": "podman",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"]
    }
  }
}
GEMINI_MCP
chown "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.gemini/settings.json"
info "MCP server config written to ${CODER_HOME}/.gemini/settings.json"

# Codex CLI MCP settings — ~/.codex/config.toml
mkdir -p "${CODER_HOME}/.codex"
chown "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.codex"
cat > "${CODER_HOME}/.codex/config.toml" << CODEX_MCP
[mcp_servers.github]
command = "podman"
args = ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"]
env_vars = ["GITHUB_PERSONAL_ACCESS_TOKEN"]
CODEX_MCP
chown "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.codex/config.toml"
info "MCP server config written to ${CODER_HOME}/.codex/config.toml"

# Register MCP servers as discoverable services
if [[ -d "${HOMELAB_DIR}/services" ]]; then
    cat > "${HOMELAB_DIR}/services/cargo-mcp.svc" << SVC_CARGO
name=cargo-mcp
type=systemd
unit=cratedex.service
port=3737
url=http://127.0.0.1:3737
description=Rust documentation & diagnostics (MCP)
SVC_CARGO

    cat > "${HOMELAB_DIR}/services/qt-mcp.svc" << SVC_QT
name=qt-mcp
type=stdio
url=tcp://localhost:9142
description=Qt/PySide6 app inspection (MCP, stdio)
SVC_QT

    cat > "${HOMELAB_DIR}/services/coder.svc" << SVC_CODER
name=coder
type=stdio
url=stdio://${CODER_HOME}/tools/coder/bin/coder-mcp.js
description=Multi-agent coding workflow (MCP, stdio)
SVC_CODER

    cat > "${HOMELAB_DIR}/services/github-mcp.svc" << SVC_GITHUB
name=github-mcp
type=stdio
url=podman://ghcr.io/github/github-mcp-server
description=GitHub API tools (MCP, stdio via Podman)
SVC_GITHUB

    cat > "${HOMELAB_DIR}/services/ollama.svc" << SVC_OLLAMA
name=ollama
type=systemd
unit=ollama.service
user=${CODER_USER}
port=11434
route=llm
url=http://127.0.0.1:11434
description=LLM inference with GPU (Podman Quadlet + ROCm)
SVC_OLLAMA

    chown root:homelab "${HOMELAB_DIR}/services"/{cargo-mcp,qt-mcp,coder,github-mcp,ollama}.svc
    chmod 664 "${HOMELAB_DIR}/services"/{cargo-mcp,qt-mcp,coder,github-mcp,ollama}.svc
    info "Registered MCP services in ${HOMELAB_DIR}/services/"
else
    warn "Services directory not found — run setup-homelab.sh first"
fi

# ---------------------------------------------------------------------------
# Step 9: CLAUDE.md for coder user (templated with actual values)
# ---------------------------------------------------------------------------

cat > "${CODER_HOME}/.claude/CLAUDE.md" << CODER_CLAUDE_MD
# Coder Agent Environment

You are running as the \`${CODER_USER}\` user on ${HOSTNAME_SHORT} (${LAN_IP:-unknown}), an isolated
account for AI coding agents.

## Security Boundaries

- You do NOT have access to \`${PRIMARY_HOME:-/home/primary-user}\` (permission denied)
- You are NOT in the docker or sudo groups
- Use **Podman** (rootless) for containers, NOT Docker
- Your GitHub token is a fine-grained PAT scoped to specific repos only
- Do not attempt privilege escalation or access other users' data

## MCP Servers

### cargo-mcp — Rust documentation & diagnostics
- HTTP transport: \`127.0.0.1:3737\` (shared service, runs as ${PRIMARY_USER:-system})
- \`register_project\` first, then \`search_docs\`, \`get_diagnostics\`, \`list_crates\`

### coder — Multi-agent coding workflow
- stdio MCP: \`node ${CODER_HOME}/tools/coder/bin/coder-mcp.js\`
- Pipeline: list_issues -> draft_issue -> create_plan -> implement -> review_and_test -> create_pr
- \`coder_auto\` for autonomous batch processing

### qt-mcp — Qt/PySide6 desktop app inspection
- stdio MCP: \`uvx qt-mcp\`
- Target app must have probe installed: \`QT_MCP_PROBE=1 python -m your_app\`
- \`qt_snapshot\` first (get widget tree + refs), then interact via refs

### github — GitHub API tools
- stdio MCP via Podman: \`podman run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server\`
- Tools: issues, pull_requests, repos, code search, users, and more
- Your token is a fine-grained PAT scoped to specific repos only

## Homelab CLI

Expose dev servers on the LAN through Traefik reverse proxy:

\`\`\`bash
homelab dev up <name> <port> --ttl 4h    # route name.${DOMAIN} -> localhost:port
homelab dev down <name>                   # remove route
homelab dev ps                            # list active routes
homelab ls --json                         # JSON output for parsing
\`\`\`

**Always use \`homelab dev up\` with a \`--ttl\`** so routes auto-expire.
Do not use \`homelab add\` directly — prefer \`dev up\` which sets owner and TTL.

## Service Discovery

Discover registered services (Ollama, MCP servers, etc.):

\`\`\`bash
homelab svc ls                           # list services + live status
homelab svc ls --json                    # JSON output
homelab svc info <name>                  # full service metadata
homelab svc start <name>                 # start a service
homelab svc stop <name>                  # stop a service
homelab svc log <name>                   # follow service logs
\`\`\`

### Ollama (LLM inference)

Ollama provides local LLM inference with AMD ROCm GPU acceleration via Podman:

- **API**: \`http://localhost:11434\`
- **LAN**: \`https://llm.${DOMAIN}\`
- **Service**: \`systemctl status ollama\` / \`journalctl -u ollama -f\`
- **Models**: \`curl -s localhost:11434/api/tags | jq\`
- **Pull model**: \`curl -X POST localhost:11434/api/pull -d '{"name":"qwen2.5-coder:7b"}'\`

## Containers

Use Podman for any container needs:

\`\`\`bash
podman run --rm -p 3000:3000 my-image     # rootless, no daemon
podman build -t my-image .
\`\`\`

Do NOT use \`docker\` commands — you don't have Docker access.

## Coding Conventions

- Working directory: \`~/workspace/\`
- Use conventional commits (feat:, fix:, refactor:, etc.)
- Run tests before creating PRs
- Keep branches short-lived, one feature per branch
CODER_CLAUDE_MD
chown "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.claude/CLAUDE.md"
info "CLAUDE.md written to ${CODER_HOME}/.claude/CLAUDE.md"

# ---------------------------------------------------------------------------
# Step 10: Create workspace directory
# ---------------------------------------------------------------------------

step "Creating workspace"

mkdir -p "${CODER_HOME}/workspace" "${CODER_HOME}/tools"
chown -R "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/workspace" "${CODER_HOME}/tools"
info "Created ${CODER_HOME}/workspace/ and ${CODER_HOME}/tools/"

# ---------------------------------------------------------------------------
# Step 10.5: Install coder-mcp (multi-agent workflow tool)
# ---------------------------------------------------------------------------

step "Installing coder-mcp"

if [[ -n "${AITOOLS_DIR}" && -d "${AITOOLS_DIR}/coder" ]]; then
    _coder_src="${AITOOLS_DIR}/coder"
    _coder_dst="${CODER_HOME}/tools/coder"

    if [[ -f "${_coder_dst}/bin/coder-mcp.js" && -f "${_coder_dst}/node_modules/.package-lock.json" ]]; then
        info "coder-mcp already installed at ${_coder_dst}"
    else
        info "Copying coder from ${_coder_src} → ${_coder_dst}"
        rm -rf "${_coder_dst}"
        mkdir -p "${_coder_dst}"

        # Copy source files (exclude node_modules, .git, test fixtures)
        # Use tar pipe to avoid rsync dependency
        tar -C "${_coder_src}" --exclude='node_modules' --exclude='.git' --exclude='test' \
            -cf - . | tar -C "${_coder_dst}" -xf -

        chown -R "${CODER_USER}:${CODER_USER}" "${_coder_dst}"

        info "Running npm install for coder-mcp..."
        run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && cd ~/tools/coder && npm install --omit=dev'
        info "coder-mcp installed"
    fi
else
    warn "AITOOLS_DIR not set or ${AITOOLS_DIR:-}/coder not found"
    warn "Set AITOOLS_DIR=/path/to/AITOOLS or copy coder manually to ${CODER_HOME}/tools/coder/"
fi

# ---------------------------------------------------------------------------
# Step 10.6: Ollama (LLM inference via Podman with GPU)
# ---------------------------------------------------------------------------

step "Setting up Ollama (Podman Quadlet + ROCm GPU)"

# Pull ollama:rocm image for coder user
if run_as_coder 'podman image exists ollama/ollama:rocm' &>/dev/null; then
    info "ollama:rocm image already available"
else
    info "Pulling ollama:rocm image (this may take a while)..."
    run_as_coder 'podman pull docker.io/ollama/ollama:rocm'
    info "ollama:rocm image pulled"
fi

# Create model storage directory
mkdir -p "${CODER_HOME}/.ollama/models"
chown -R "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.ollama"

# Build Quadlet GPU directives
_ollama_devices=""
_ollama_podman_args=""
_ollama_gpu_env=""
if [[ -e /dev/kfd ]] && getfacl /dev/kfd 2>/dev/null | grep -q "user:${CODER_USER}:rw"; then
    _ollama_devices="AddDevice=/dev/kfd"
    for _rn in /dev/dri/renderD*; do
        [[ -e "$_rn" ]] && _ollama_devices="${_ollama_devices}
AddDevice=${_rn}"
    done
    _ollama_podman_args="PodmanArgs=--runtime=crun --group-add keep-groups --userns=keep-id"
    if [[ -n "${HSA_OVERRIDE_GFX_VERSION:-}" ]]; then
        _ollama_gpu_env="Environment=HSA_OVERRIDE_GFX_VERSION=${HSA_OVERRIDE_GFX_VERSION}"
    fi
    info "GPU passthrough enabled"
else
    _ollama_podman_args="PodmanArgs=--runtime=crun --userns=keep-id"
    warn "No GPU ACLs for ${CODER_USER} — Ollama will run CPU-only"
fi

# Remove old system-level ollama.service if present (migrated to Quadlet)
if [[ -f /etc/systemd/system/ollama.service ]]; then
    systemctl stop ollama.service 2>/dev/null || true
    systemctl disable ollama.service 2>/dev/null || true
    rm -f /etc/systemd/system/ollama.service
    systemctl daemon-reload
    info "Removed old system-level ollama.service (migrated to Quadlet)"
fi

# Write Quadlet file for Ollama (standalone — not in the homelab pod)
_quadlet_dir="${CODER_HOME}/.config/containers/systemd"
mkdir -p "$_quadlet_dir"

cat > "${_quadlet_dir}/ollama.container" << OLLAMA_QUADLET
[Unit]
Description=Ollama LLM inference (Podman, ROCm GPU)
After=network-online.target
Wants=network-online.target

[Container]
Image=docker.io/ollama/ollama:rocm
ContainerName=ollama
${_ollama_podman_args}
${_ollama_devices}
${_ollama_gpu_env}
Environment=OLLAMA_KEEP_ALIVE=5m
Environment=OLLAMA_MODELS=/ollama/models
Volume=${CODER_HOME}/.ollama:/ollama
PublishPort=127.0.0.1:11434:11434

[Install]
WantedBy=default.target
OLLAMA_QUADLET

chown -R "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.config"
info "ollama.container Quadlet written"

# Reload and start
systemctl --user -M "${CODER_USER}@" daemon-reload
systemctl --user -M "${CODER_USER}@" enable ollama.service 2>/dev/null || true
if systemctl --user -M "${CODER_USER}@" is-active --quiet ollama.service 2>/dev/null; then
    info "ollama.service is running"
else
    # Check if port 11434 is already in use
    if ss -tlnp 2>/dev/null | grep -q ':11434 '; then
        warn "Port 11434 already in use — ollama.service enabled but not started"
        warn "Stop the existing Ollama then: systemctl --user -M ${CODER_USER}@ start ollama.service"
    else
        systemctl --user -M "${CODER_USER}@" start ollama.service
        sleep 3
        if systemctl --user -M "${CODER_USER}@" is-active --quiet ollama.service 2>/dev/null; then
            info "ollama.service started"
        else
            warn "ollama.service failed to start — check: journalctl --user-unit ollama.service -M ${CODER_USER}@"
        fi
    fi
fi

# ---------------------------------------------------------------------------
# Step 11: API keys & agent authentication
# ---------------------------------------------------------------------------

step "Configuring SSH, API keys & authenticating agents"

# Variables shared between SSH authorized_keys and git signing steps
_pub_keys=()
_default_key=""
_selected_key=""

# --- SSH authorized keys (allow login to coder from primary user's key) ---
if [[ -n "${PRIMARY_HOME:-}" && -d "${PRIMARY_HOME}/.ssh" ]]; then
    mapfile -t _pub_keys < <(find "${PRIMARY_HOME}/.ssh" -maxdepth 1 -name "*.pub" -type f 2>/dev/null | sort)

    if [[ ${#_pub_keys[@]} -gt 0 ]]; then
        # Smart default: prefer hardware security keys > ed25519 > ecdsa > rsa
        _default_key=""
        for _prio in "sk-" "ssh-ed25519" "ecdsa-sha2" "ssh-rsa"; do
            for _k in "${_pub_keys[@]}"; do
                if awk '{print $1}' "$_k" 2>/dev/null | grep -q "^${_prio}"; then
                    _default_key="$_k"
                    break 2
                fi
            done
        done
        [[ -z "$_default_key" ]] && _default_key="${_pub_keys[0]}"

        echo ""
        info "SSH public keys in ${PRIMARY_HOME}/.ssh:"
        for i in "${!_pub_keys[@]}"; do
            _kname="$(basename "${_pub_keys[$i]}")"
            _ktype="$(awk '{print $1}' "${_pub_keys[$i]}" 2>/dev/null)"
            _mark=""
            [[ "${_pub_keys[$i]}" == "$_default_key" ]] && _mark=" ${GREEN}(recommended)${NC}"
            printf "  %d) %s  [%s]%b\n" "$((i + 1))" "$_kname" "$_ktype" "$_mark"
        done
        echo ""

        _selected_key=""
        if [[ "${ASSUME_YES}" == "true" ]]; then
            _selected_key="$_default_key"
            info "Auto-selecting $(basename "$_default_key")"
        elif confirm "Copy an SSH key to ${CODER_USER}'s authorized_keys?"; then
            if [[ ${#_pub_keys[@]} -eq 1 ]]; then
                _selected_key="${_pub_keys[0]}"
            else
                # Find the 1-based index of the recommended key
                _default_idx=1
                for i in "${!_pub_keys[@]}"; do
                    [[ "${_pub_keys[$i]}" == "$_default_key" ]] && _default_idx=$((i + 1))
                done
                echo -en "${YELLOW}Which key? [${_default_idx}]: ${NC}"
                read -r _choice
                _choice="${_choice:-$_default_idx}"
                _idx=$((_choice - 1))
                if [[ $_idx -ge 0 && $_idx -lt ${#_pub_keys[@]} ]]; then
                    _selected_key="${_pub_keys[$_idx]}"
                else
                    warn "Invalid choice — using recommended key"
                    _selected_key="$_default_key"
                fi
            fi
        fi

        if [[ -n "$_selected_key" ]]; then
            mkdir -p "${CODER_HOME}/.ssh"
            _key_content="$(cat "$_selected_key")"
            if grep -qF "$_key_content" "${CODER_HOME}/.ssh/authorized_keys" 2>/dev/null; then
                info "Key already in ${CODER_USER}'s authorized_keys"
            else
                echo "$_key_content" >> "${CODER_HOME}/.ssh/authorized_keys"
                info "$(basename "$_selected_key") → ${CODER_HOME}/.ssh/authorized_keys"
            fi
            chown -R "${CODER_USER}:${CODER_USER}" "${CODER_HOME}/.ssh"
            chmod 700 "${CODER_HOME}/.ssh"
            chmod 600 "${CODER_HOME}/.ssh/authorized_keys"
        fi
    else
        info "No SSH public keys found in ${PRIMARY_HOME}/.ssh"
    fi
else
    info "No primary user SSH directory — skipping SSH key setup"
fi

# --- Git identity (--global defaults; override per-repo with git config user.name/email) ---
_current_git_name="$(sudo -Hu "$CODER_USER" git config --global user.name 2>/dev/null || true)"
_current_git_email="$(sudo -Hu "$CODER_USER" git config --global user.email 2>/dev/null || true)"

if [[ -n "$_current_git_name" && -n "$_current_git_email" ]]; then
    info "Git identity: ${_current_git_name} <${_current_git_email}>"
else
    # Smart defaults: try primary user's git config, then fall back
    _git_name_default=""
    _git_email_default=""
    if [[ -n "${PRIMARY_HOME:-}" && -f "${PRIMARY_HOME}/.gitconfig" ]]; then
        _git_name_default="$(git config --file "${PRIMARY_HOME}/.gitconfig" user.name 2>/dev/null || true)"
        _git_email_default="$(git config --file "${PRIMARY_HOME}/.gitconfig" user.email 2>/dev/null || true)"
    fi
    _git_name_default="${_git_name_default:-${CODER_USER}}"
    _git_email_default="${_git_email_default:-${CODER_USER}@${HOSTNAME_SHORT}}"

    echo ""
    info "Git identity for ${CODER_USER} (set --global; override per-repo anytime)"
    if [[ "${ASSUME_YES}" == "true" ]]; then
        _git_name="$_git_name_default"
        _git_email="$_git_email_default"
    else
        echo -en "${YELLOW}Git author name [${_git_name_default}]: ${NC}"
        read -r _git_name
        _git_name="${_git_name:-$_git_name_default}"
        echo -en "${YELLOW}Git author email [${_git_email_default}]: ${NC}"
        read -r _git_email
        _git_email="${_git_email:-$_git_email_default}"
    fi
    sudo -Hu "$CODER_USER" git config --global user.name "$_git_name"
    sudo -Hu "$CODER_USER" git config --global user.email "$_git_email"
    info "Git identity: ${_git_name} <${_git_email}>"
fi

# --- SSH commit signing ---
# Only offer when SSH public keys were discovered from the primary user
if [[ ${#_pub_keys[@]} -gt 0 ]]; then
    _current_signing_key="$(sudo -Hu "$CODER_USER" git config --global user.signingkey 2>/dev/null || true)"

    if [[ -n "$_current_signing_key" ]]; then
        info "SSH signing already configured: ${_current_signing_key}"
    else
        echo ""
        info "SSH commit signing verifies commits with your SSH key"
        info "Requires agent forwarding when working as ${CODER_USER}: ssh -A ${CODER_USER}@${HOSTNAME_SHORT}"

        _sign_with=""
        _sign_key_default="${_selected_key:-$_default_key}"

        if [[ "${ASSUME_YES}" == "true" ]]; then
            _sign_with="$_sign_key_default"
        elif confirm "Enable SSH commit signing?"; then
            if [[ ${#_pub_keys[@]} -eq 1 ]]; then
                _sign_with="${_pub_keys[0]}"
            else
                info "Available keys:"
                _sign_default_idx=1
                for i in "${!_pub_keys[@]}"; do
                    _kname="$(basename "${_pub_keys[$i]}")"
                    _ktype="$(awk '{print $1}' "${_pub_keys[$i]}" 2>/dev/null)"
                    _mark=""
                    if [[ "${_pub_keys[$i]}" == "$_sign_key_default" ]]; then
                        _mark=" ${GREEN}(recommended)${NC}"
                        _sign_default_idx=$((i + 1))
                    fi
                    printf "  %d) %s  [%s]%b\n" "$((i + 1))" "$_kname" "$_ktype" "$_mark"
                done
                echo -en "${YELLOW}Which key for signing? [${_sign_default_idx}]: ${NC}"
                read -r _sign_choice
                _sign_choice="${_sign_choice:-$_sign_default_idx}"
                _sign_idx=$((_sign_choice - 1))
                if [[ $_sign_idx -ge 0 && $_sign_idx -lt ${#_pub_keys[@]} ]]; then
                    _sign_with="${_pub_keys[$_sign_idx]}"
                else
                    warn "Invalid choice — using recommended key"
                    _sign_with="$_sign_key_default"
                fi
            fi
        fi

        if [[ -n "$_sign_with" ]]; then
            # Copy public key to coder's .ssh so git can reference it
            _sign_basename="$(basename "$_sign_with")"
            _coder_sign_key="${CODER_HOME}/.ssh/${_sign_basename}"
            mkdir -p "${CODER_HOME}/.ssh"
            cp "$_sign_with" "$_coder_sign_key"
            chown "${CODER_USER}:${CODER_USER}" "$_coder_sign_key"
            chmod 644 "$_coder_sign_key"

            sudo -Hu "$CODER_USER" git config --global gpg.format ssh
            sudo -Hu "$CODER_USER" git config --global user.signingkey "$_coder_sign_key"
            sudo -Hu "$CODER_USER" git config --global commit.gpgsign true
            sudo -Hu "$CODER_USER" git config --global tag.gpgsign true
            info "SSH signing enabled: ${_sign_basename} → commits & tags"
        fi
    fi
fi

# Helper: find an env var from the current env or the primary user's dotfiles.
# sudo strips most env vars, so we fall back to grepping the caller's shell rc
# files (which the script can read as root).
_find_key() {
    local name="$1"
    # 1. Check current (root) environment
    local val="${!name:-}"
    if [[ -n "$val" ]]; then printf '%s' "$val"; return 0; fi
    # 2. Fall back to primary user's dotfiles
    [[ -n "${PRIMARY_HOME:-}" ]] || return 1
    local line="" f
    for f in .bashrc .zshrc .profile .bash_profile; do
        [[ -f "${PRIMARY_HOME}/$f" ]] || continue
        line="$(grep -m1 "^export ${name}=" "${PRIMARY_HOME}/$f" 2>/dev/null || true)"
        [[ -n "$line" ]] && break
    done
    [[ -n "$line" ]] || return 1
    val="${line#export ${name}=}"
    # Strip surrounding quotes
    val="${val#\"}" ; val="${val%\"}"
    val="${val#\'}" ; val="${val%\'}"
    printf '%s' "$val"
}

# --- GEMINI_API_KEY (needed by coder MCP for plan review) ---
_resolved_gemini="$(_find_key GEMINI_API_KEY || true)"

if _coder_has_env GEMINI_API_KEY; then
    info "GEMINI_API_KEY already in ${CODER_USER}'s .bashrc"
elif [[ -n "$_resolved_gemini" ]]; then
    info "Found GEMINI_API_KEY in your environment"
    if [[ "${ASSUME_YES}" == "true" ]] || confirm "Copy GEMINI_API_KEY to ${CODER_USER}'s .bashrc?"; then
        _coder_set_env GEMINI_API_KEY "$_resolved_gemini"
        info "GEMINI_API_KEY → ${CODER_HOME}/.bashrc"
    fi
elif [[ "${ASSUME_YES}" != "true" ]]; then
    echo -en "${YELLOW}Paste GEMINI_API_KEY (or Enter to skip): ${NC}"
    read -r _gemini_key
    if [[ -n "$_gemini_key" ]]; then
        _coder_set_env GEMINI_API_KEY "$_gemini_key"
        info "GEMINI_API_KEY → ${CODER_HOME}/.bashrc"
    else
        warn "Skipped GEMINI_API_KEY — set later in ${CODER_HOME}/.bashrc"
    fi
else
    warn "GEMINI_API_KEY not found — set later in ${CODER_HOME}/.bashrc"
fi

# --- Claude Code (browser-based OAuth — requires Max/Pro/Team subscription) ---
# Auth check: credentials file contains an OAuth access token
_claude_authed=false
if [[ -f "${CODER_HOME}/.claude/.credentials.json" ]] \
    && grep -q '"accessToken"' "${CODER_HOME}/.claude/.credentials.json" 2>/dev/null; then
    _claude_authed=true
fi

echo ""
if [[ "$_claude_authed" == "true" ]]; then
    info "Claude Code already authenticated for ${CODER_USER}"
elif [[ "${ASSUME_YES}" != "true" ]]; then
    echo -e "${CYAN}Claude Code uses browser-based login (Claude Max/Pro/Team subscription).${NC}"
    if confirm "Authenticate Claude Code as ${CODER_USER} now?"; then
        info "Launching Claude Code — complete the browser login, then type /exit to return"
        sudo -u "$CODER_USER" -i claude || true
        echo ""
    else
        info "Authenticate later: sudo -u ${CODER_USER} -i claude"
    fi
else
    warn "Claude Code not authenticated — run later: sudo -u ${CODER_USER} -i claude"
fi

# --- OpenAI Codex (browser-based auth — requires ChatGPT Plus/Pro subscription) ---
# Auth check: "codex login status" exits 0 when logged in, or check for auth file
_codex_authed=false
if run_as_coder 'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && codex login status' &>/dev/null; then
    _codex_authed=true
elif [[ -f "${CODER_HOME}/.codex/auth.json" ]]; then
    _codex_authed=true
fi

echo ""
if [[ "$_codex_authed" == "true" ]]; then
    info "OpenAI Codex already authenticated for ${CODER_USER}"
elif [[ "${ASSUME_YES}" != "true" ]]; then
    echo -e "${CYAN}OpenAI Codex uses browser-based login (ChatGPT Plus/Pro subscription).${NC}"
    if confirm "Authenticate OpenAI Codex as ${CODER_USER} now?"; then
        info "Launching Codex — complete the login, then press Ctrl+C to return"
        # codex is installed via nvm/npm, and Ubuntu's .bashrc bails for non-interactive
        # shells (case $- guard), so nvm is never sourced by "sudo -i". Source it explicitly.
        sudo -Hu "$CODER_USER" bash -lc \
            'export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && cd "$HOME" && codex' || true
        echo ""
    else
        info "Authenticate later: sudo -u ${CODER_USER} -i codex"
    fi
else
    warn "OpenAI Codex not authenticated — run later: sudo -u ${CODER_USER} -i codex"
fi

# ---------------------------------------------------------------------------
# Step 12: Verification
# ---------------------------------------------------------------------------

step "Verification"

PASS=0
FAIL=0

check() {
    local desc="$1"
    shift
    if "$@" &>/dev/null; then
        info "PASS: ${desc}"
        (( PASS++ ))
    else
        err  "FAIL: ${desc}"
        (( FAIL++ ))
    fi
}

# Isolation: one-way visibility — primary can read coder's home, not vice versa
if [[ -n "$PRIMARY_HOME" && -d "$PRIMARY_HOME" ]]; then
    check "${CODER_USER} cannot read ${PRIMARY_HOME}" \
        bash -c "! sudo -u ${CODER_USER} ls ${PRIMARY_HOME} 2>/dev/null"
fi

if [[ -n "$PRIMARY_USER" ]]; then
    check "${PRIMARY_USER} is in ${CODER_USER} group (can read ${CODER_HOME})" \
        bash -c "id -nG ${PRIMARY_USER} | grep -qw ${CODER_USER}"
fi

check "${CODER_HOME} is mode 750" \
    bash -c "[ \"\$(stat -c '%a' ${CODER_HOME})\" = '750' ]"

# Group membership
check "${CODER_USER} is in homelab group" \
    bash -c "id -nG ${CODER_USER} | grep -qw homelab"

check "${CODER_USER} is NOT in docker group" \
    bash -c "! id -nG ${CODER_USER} | grep -qw docker"

check "${CODER_USER} is NOT in sudo group" \
    bash -c "! id -nG ${CODER_USER} | grep -qw sudo"

# Podman
check "podman is installed" \
    command -v podman

check "${CODER_USER} can run podman" \
    sudo -u "${CODER_USER}" -i podman --version

# Rust ecosystem
check "${CODER_USER} has rustup" \
    bash -c "sudo -Hu ${CODER_USER} bash -lc '. \"\$HOME/.cargo/env\" && rustup --version'"

check "${CODER_USER} has cargo" \
    bash -c "sudo -Hu ${CODER_USER} bash -lc '. \"\$HOME/.cargo/env\" && cargo --version'"

check "cratedex binary at /usr/local/bin" \
    test -x /usr/local/bin/cratedex

check "cratedex.service is active" \
    systemctl is-active --quiet cratedex.service

# Python ecosystem
check "${CODER_USER} has ruff" \
    test -x "${CODER_HOME}/.local/bin/ruff"

# Node.js
check "${CODER_USER} has node" \
    bash -c "sudo -u ${CODER_USER} -i bash -c 'export NVM_DIR=\"\$HOME/.nvm\" && . \"\$NVM_DIR/nvm.sh\" && node --version'"

# Agent CLIs
check "${CODER_USER} has Claude Code CLI" \
    bash -c "sudo -u ${CODER_USER} -i bash -c 'command -v claude'"

check "${CODER_USER} has OpenAI Codex CLI" \
    bash -c "sudo -u ${CODER_USER} -i bash -c 'export NVM_DIR=\"\$HOME/.nvm\" && . \"\$NVM_DIR/nvm.sh\" && command -v codex'"

check "${CODER_USER} has Google Gemini CLI" \
    bash -c "sudo -u ${CODER_USER} -i bash -c 'export NVM_DIR=\"\$HOME/.nvm\" && . \"\$NVM_DIR/nvm.sh\" && command -v gemini'"

# MCP tools
check "coder-mcp installed" \
    test -f "${CODER_HOME}/tools/coder/bin/coder-mcp.js"

check "github-mcp image available" \
    run_as_coder 'podman image exists ghcr.io/github/github-mcp-server'

# crun
check "crun is installed" \
    command -v crun

# GPU (conditional)
if [[ -e /dev/kfd ]]; then
    check "GPU ACL: ${CODER_USER} can access /dev/kfd" \
        bash -c "getfacl /dev/kfd 2>/dev/null | grep -q 'user:${CODER_USER}:rw'"
    check "GPU udev rule installed" \
        test -f "/etc/udev/rules.d/99-gpu-${CODER_USER}.rules"
fi

# Ollama
check "ollama:rocm image available" \
    run_as_coder 'podman image exists ollama/ollama:rocm'

check "ollama.container Quadlet installed" \
    test -f "${CODER_HOME}/.config/containers/systemd/ollama.container"

# Workspace
check "workspace directory exists" \
    test -d "${CODER_HOME}/workspace"

# Config files
check "Claude MCP settings exist" \
    test -f "${CODER_HOME}/.claude.json"

check "Gemini MCP settings exist" \
    test -f "${CODER_HOME}/.gemini/settings.json"

check "Codex MCP settings exist" \
    test -f "${CODER_HOME}/.codex/config.toml"

check "CLAUDE.md exists" \
    test -f "${CODER_HOME}/.claude/CLAUDE.md"

# Git identity
check "${CODER_USER} has git identity" \
    run_as_coder 'git config --global user.name'

# SSH (only verify if the user opted in)
if [[ -f "${CODER_HOME}/.ssh/authorized_keys" ]]; then
    check "${CODER_USER} has SSH authorized_keys" \
        test -s "${CODER_HOME}/.ssh/authorized_keys"
fi

echo ""
info "Results: ${PASS} passed, ${FAIL} failed"

if (( FAIL > 0 )); then
    warn "Some checks failed — review the output above."
    exit 1
fi

# ---------------------------------------------------------------------------
# Done
# ---------------------------------------------------------------------------

step "Setup complete!"

echo ""
echo "  The '${CODER_USER}' user is ready."
echo ""
echo "  To switch to the ${CODER_USER} user:"
echo "    sudo -u ${CODER_USER} -i"
echo ""
echo "  To run Claude Code as ${CODER_USER}:"
echo "    sudo -u ${CODER_USER} -i claude"
echo ""
echo "  To run OpenAI Codex as ${CODER_USER}:"
echo "    sudo -u ${CODER_USER} -i codex"
echo ""
echo "  To run Google Gemini as ${CODER_USER}:"
echo "    sudo -u ${CODER_USER} -i gemini"
echo ""
echo "  To expose a dev server:"
echo "    sudo -u ${CODER_USER} -i homelab dev up myapp 3000 --ttl 4h"
echo ""
echo "  Workspace: ${CODER_HOME}/workspace/"
echo "  MCP config (Claude):  ${CODER_HOME}/.claude.json"
echo "  MCP config (Gemini):  ${CODER_HOME}/.gemini/settings.json"
echo "  MCP config (Codex):   ${CODER_HOME}/.codex/config.toml"
echo "  Agent instructions: ${CODER_HOME}/.claude/CLAUDE.md"
echo ""