#!/usr/bin/env fish

# Select a nono profile from a trusted canonical-project map, then launch Pi in
# its own bounded cgroup. Unknown or invalid projects fail closed.
set -l resolver /home/jb/.local/bin/orca-nono-profile

if not test -x "$resolver"
    printf 'pi-orca: profile resolver is unavailable: %s\n' "$resolver" >&2
    exit 1
end

set -l profile ("$resolver" resolve "$PWD" 2>/dev/null)
if test $status -ne 0; or test -z "$profile"
    printf 'pi-orca: could not resolve a trusted profile for %s\n' "$PWD" >&2
    exit 1
end

if not /usr/bin/nono profile show "$profile" >/dev/null 2>&1
    printf 'pi-orca: resolved profile is unavailable: %s\n' "$profile" >&2
    exit 1
end

source /srv/data/code/harness-tools/scripts/pi-orca-runtime.fish
configure_pi_orca_runtime "$profile"

set -l node_executable "$pi_orca_node_executable"
set -l pi_agent_dir "$PI_CODING_AGENT_DIR"

if not test -x "$node_executable"
    printf 'pi-orca: Node runtime is unavailable: %s\n' "$node_executable" >&2
    exit 1
end
if not test -d "$pi_agent_dir"
    printf 'pi-orca: Pi agent directory is unavailable: %s\n' "$pi_agent_dir" >&2
    exit 1
end

set -lx ORCA_NONO_PROFILE "$profile"
set -lx PI_CODING_AGENT_DIR "$pi_agent_dir"

exec /usr/bin/systemd-run \
    --user \
    --scope \
    --collect \
    --quiet \
    --slice=orca-agents.slice \
    --property=CPUQuota=1600% \
    --property=MemoryHigh=48G \
    --property=MemoryMax=64G \
    --property=MemorySwapMax=8G \
    --property=TasksMax=8192 \
    --property=OOMPolicy=stop \
    -- /usr/bin/nono run --profile "$profile" -- "$node_executable" /home/jb/.bun/bin/pi $argv