morphbox-start

#!/bin/bash
set -euo pipefail

# MorphBox Launcher - Simplified version

# Colors
GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

info() { echo -e "${GREEN}[INFO]${NC} $1"; }
error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
WEB_DIR="$SCRIPT_DIR/web"

# Load config from .morphbox.env if exists
if [[ -f "$SCRIPT_DIR/.morphbox.env" ]]; then
    source "$SCRIPT_DIR/.morphbox.env"
fi

# Default to local only
BIND_HOST="${MORPHBOX_HOST:-localhost}"
ACCESS_MODE="${MORPHBOX_BIND_MODE:-local}"
DEV_MODE=false
AUTH_ENABLED=false
TERMINAL_MODE=false
MORPHBOX_AUTH_USERNAME=""
MORPHBOX_AUTH_PASSWORD=""

# Apply bind mode
if [[ "$ACCESS_MODE" == "external" ]]; then
    BIND_HOST="0.0.0.0"
fi

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --external)
            BIND_HOST="0.0.0.0"
            ACCESS_MODE="external"
            shift
            ;;
        --local)
            BIND_HOST="localhost"
            ACCESS_MODE="local"
            shift
            ;;
        --vpn)
            # Auto-detect VPN interface IP
            VPN_IP=$(ip addr show | grep -E "tailscale0|tun0|utun|wg0" | grep "inet " | awk '{print $2}' | cut -d/ -f1 | head -n1)
            if [[ -n "$VPN_IP" ]]; then
                BIND_HOST="$VPN_IP"
                ACCESS_MODE="vpn"
                info "Detected VPN IP: $VPN_IP"
            else
                warn "No VPN interface detected, falling back to external mode"
                BIND_HOST="0.0.0.0"
                ACCESS_MODE="external"
            fi
            shift
            ;;
        --auth)
            AUTH_ENABLED=true
            shift
            ;;
        --terminal)
            TERMINAL_MODE=true
            shift
            ;;
        --dev)
            DEV_MODE=true
            shift
            ;;
        --help)
            echo "MorphBox Launcher"
            echo ""
            echo "Usage: $0 [OPTIONS]"
            echo ""
            echo "Options:"
            echo "  --local     Bind to localhost only (default)"
            echo "  --external  Bind to all interfaces (WARNING: exposes to network)"
            echo "  --vpn       Auto-detect and bind to VPN interface (Tailscale, WireGuard, etc.)"
            echo "  --terminal  Terminal mode - Claude Code only, no panels"
            echo "  --auth      Enable authentication (mandatory for --external, optional for --vpn)"
            echo "  --dev       Skip security warnings (development mode)"
            echo "  --help      Show this help message"
            echo ""
            echo "Examples:"
            echo "  $0              # Start locally (safe)"
            echo "  $0 --terminal   # Claude Code only mode"
            echo "  $0 --external   # Expose to network with mandatory auth"
            echo "  $0 --vpn       # Bind to VPN interface only"
            echo "  $0 --vpn --auth # VPN mode with authentication"
            echo "  $0 --external --dev   # External mode without prompts"
            exit 0
            ;;
        *)
            error "Unknown option: $1. Use --help for usage."
            ;;
    esac
done

# Check dependencies
if ! command -v node > /dev/null; then
    error "Node.js is not installed. Please install Node.js 18 or later"
fi

# Install dependencies if needed
if [[ ! -d "$WEB_DIR/node_modules" ]]; then
    info "Installing dependencies..."
    cd "$WEB_DIR" && npm install
fi

# Setup authentication
if [[ "$ACCESS_MODE" == "external" ]] || ([[ "$ACCESS_MODE" == "vpn" ]] && [[ "$AUTH_ENABLED" == "true" ]]); then
    # External mode always requires auth, VPN mode only if --auth is specified
    if [[ "$ACCESS_MODE" == "external" ]]; then
        AUTH_ENABLED=true
        export MORPHBOX_AUTH_MODE="external"
    else
        export MORPHBOX_AUTH_MODE="vpn"
    fi
    
    # Generate secure credentials if not provided
    if [[ -z "$MORPHBOX_AUTH_USERNAME" ]]; then
        export MORPHBOX_AUTH_USERNAME="admin"
    fi
    
    if [[ -z "$MORPHBOX_AUTH_PASSWORD" ]]; then
        # Generate a secure random password
        export MORPHBOX_AUTH_PASSWORD=$(openssl rand -base64 12)
        info "🔐 Generated authentication credentials:"
        info "   Username: $MORPHBOX_AUTH_USERNAME"
        info "   Password: $MORPHBOX_AUTH_PASSWORD"
        info "   Save these credentials - you'll need them to access MorphBox!"
    fi
    
    export MORPHBOX_AUTH_ENABLED="true"
else
    export MORPHBOX_AUTH_MODE="none"
    export MORPHBOX_AUTH_ENABLED="false"
fi

# Show security warning if external (unless in dev mode)
if [[ "$ACCESS_MODE" == "external" ]] && [[ "$DEV_MODE" != "true" ]]; then
    echo ""
    echo -e "${RED}████████████████████████████████████████████████████████████████${NC}"
    echo -e "${RED}█                                                              █${NC}"
    echo -e "${RED}█  🚨 EXTREME SECURITY WARNING - READ CAREFULLY! 🚨            █${NC}"
    echo -e "${RED}█                                                              █${NC}"
    echo -e "${RED}████████████████████████████████████████████████████████████████${NC}"
    echo ""
    warn "You are about to expose your ENTIRE DEVELOPMENT ENVIRONMENT to the network!"
    echo ""
    warn "This means ANYONE on your network can:"
    warn "  ❌ Execute ANY command on your system"
    warn "  ❌ Read, modify, or DELETE any accessible file"
    warn "  ❌ Steal your source code and secrets"
    warn "  ❌ Install malware or backdoors"
    warn "  ❌ Use your machine to attack others"
    echo ""
    warn "Authentication is enabled but is NOT sufficient protection!"
    echo ""
    warn "ONLY proceed if ALL of these are true:"
    warn "  ✅ You are on an isolated, air-gapped network"
    warn "  ✅ This machine contains NO sensitive data"
    warn "  ✅ This machine has NO production access"
    warn "  ✅ You understand and accept these risks"
    echo ""
    echo -e "${RED}If you're unsure, the answer is NO. Press 'n' to cancel.${NC}"
    echo ""
    read -p "Type 'I UNDERSTAND THE RISKS' to continue: " -r CONFIRM
    echo ""
    if [[ "$CONFIRM" != "I UNDERSTAND THE RISKS" ]]; then
        info "Aborted. Good choice! Use --vpn for safer remote access."
        exit 0
    fi
elif [[ "$ACCESS_MODE" == "vpn" ]]; then
    info "✅ VPN mode: MorphBox will only be accessible via VPN connection"
    info "Binding to: $BIND_HOST"
    if [[ "$AUTH_ENABLED" == "true" ]]; then
        info "🔐 Authentication is enabled for additional security"
    fi
fi

# Kill any existing processes
pkill -f "tsx.*websocket-server" 2>/dev/null || true
pkill -f "vite dev" 2>/dev/null || true

# Start Docker container if not running
info "Checking Docker container..."
if ! docker ps | grep -q morphbox-vm; then
    info "Starting MorphBox VM container..."
    cd "$SCRIPT_DIR/web/docker"
    docker compose up -d
    sleep 2
else
    info "MorphBox VM container already running"
fi

# Check for Claude updates in container
check_claude_updates() {
    info "Checking for Claude updates..."
    
    # Note: The container's entrypoint will handle auto-updates on startup
    # This function now just reports the current version
    
    # Wait a moment for the container's auto-update to complete
    sleep 3
    
    # Get current version
    CURRENT_VERSION=$(docker exec -u morphbox morphbox-vm claude --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "unknown")
    
    if [[ "$CURRENT_VERSION" != "unknown" ]]; then
        info "✅ Claude version: $CURRENT_VERSION (auto-updated on container start)"
        info "💾 Updates are persisted - no re-download needed on restart"
    else
        warn "Could not determine Claude version"
    fi
}

# Run update check
check_claude_updates

# Get local IP for external mode
if [[ "$ACCESS_MODE" == "external" ]]; then
    LOCAL_IP=$(hostname -I | awk '{print $1}')
    WS_URL="ws://${LOCAL_IP}:8009"
    WEB_URL="http://${LOCAL_IP}:8008"
else
    WS_URL="ws://localhost:8009"
    WEB_URL="http://localhost:8008"
fi

# Terminal mode - run Claude directly in terminal
if [[ "$TERMINAL_MODE" == "true" ]]; then
    info "Launching Claude in terminal mode..."
    
    # Get the current directory
    CURRENT_DIR=$(pwd)
    
    # Determine the working directory in the container
    # Check if we're in the morphbox project directory
    if [[ "$CURRENT_DIR" == "$SCRIPT_DIR"* ]]; then
        # We're inside the morphbox project, which is mounted at /workspace/morphbox
        RELATIVE_PATH="${CURRENT_DIR#$SCRIPT_DIR}"
        CONTAINER_PATH="/workspace/morphbox${RELATIVE_PATH}"
        info "Working in morphbox project directory"
    else
        # We're outside the morphbox project
        # Just start in the default workspace - user can navigate from there
        CONTAINER_PATH="/workspace"
        info "Starting in default workspace directory"
        info "Note: Current directory ($CURRENT_DIR) is not directly accessible"
        info "You can navigate to /workspace/morphbox for the morphbox project"
    fi
    
    echo ""
    
    # Run Claude directly in the Docker container
    # Note: Not using --continue flag in terminal mode so it starts fresh
    docker exec -it \
        -u morphbox \
        -w "$CONTAINER_PATH" \
        -e "TERM=xterm-256color" \
        -e "ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}" \
        morphbox-vm \
        bash -c "claude || bash"
    
    # Exit after Claude exits
    exit 0
fi

# Start servers for web mode
cd "$WEB_DIR"

# Check if we should use production build (which has proper port fallback)
if [[ "$DEV_MODE" != "true" ]] && [[ -f "$WEB_DIR/build/handler.js" ]]; then
    info "Starting MorphBox in production mode (with automatic port fallback)..."
    
    # Start production server which handles both web and websocket
    MORPHBOX_HOST="$BIND_HOST" \
    MORPHBOX_AUTH_MODE="$MORPHBOX_AUTH_MODE" \
    MORPHBOX_AUTH_ENABLED="$MORPHBOX_AUTH_ENABLED" \
    MORPHBOX_AUTH_USERNAME="$MORPHBOX_AUTH_USERNAME" \
    MORPHBOX_AUTH_PASSWORD="$MORPHBOX_AUTH_PASSWORD" \
    npm start > "$SCRIPT_DIR/web.log" 2>&1 &
    WEB_PID=$!
    
    # Production server starts websocket internally, so we don't need separate process
    WS_PID=$WEB_PID
else
    # Development mode - use separate processes
    info "Starting MorphBox in development mode..."
    
    # Start WebSocket server
    info "Starting WebSocket server..."
    MORPHBOX_HOST="$BIND_HOST" \
    MORPHBOX_AUTH_MODE="$MORPHBOX_AUTH_MODE" \
    MORPHBOX_AUTH_ENABLED="$MORPHBOX_AUTH_ENABLED" \
    MORPHBOX_AUTH_USERNAME="$MORPHBOX_AUTH_USERNAME" \
    MORPHBOX_AUTH_PASSWORD="$MORPHBOX_AUTH_PASSWORD" \
    npm run dev:ws > "$SCRIPT_DIR/websocket.log" 2>&1 &
    WS_PID=$!
    
    # Wait for WebSocket server
    sleep 2
    
    # Start SvelteKit web server
    info "Starting MorphBox web interface..."
    MORPHBOX_HOST="$BIND_HOST" \
    MORPHBOX_AUTH_MODE="$MORPHBOX_AUTH_MODE" \
    MORPHBOX_AUTH_ENABLED="$MORPHBOX_AUTH_ENABLED" \
    MORPHBOX_AUTH_USERNAME="$MORPHBOX_AUTH_USERNAME" \
    MORPHBOX_AUTH_PASSWORD="$MORPHBOX_AUTH_PASSWORD" \
    npm run dev -- --host "$BIND_HOST" > "$SCRIPT_DIR/web.log" 2>&1 &
    WEB_PID=$!
fi

# Wait for web server
sleep 3

# Try to detect actual ports from logs
ACTUAL_WEB_PORT=8008
ACTUAL_WS_PORT=8009

if [[ -f "$SCRIPT_DIR/web.log" ]]; then
    # Try to extract port from production server log or vite log
    DETECTED_PORT=$(grep -oE "(Running on|Network:).*:([0-9]+)" "$SCRIPT_DIR/web.log" | tail -1 | grep -oE "[0-9]+$")
    if [[ -n "$DETECTED_PORT" ]]; then
        ACTUAL_WEB_PORT=$DETECTED_PORT
    fi
fi

if [[ -f "$SCRIPT_DIR/websocket.log" ]]; then
    # Extract websocket port from log
    DETECTED_WS_PORT=$(grep -oE "WebSocket server running on.*:([0-9]+)" "$SCRIPT_DIR/websocket.log" | tail -1 | grep -oE "[0-9]+$")
    if [[ -n "$DETECTED_WS_PORT" ]]; then
        ACTUAL_WS_PORT=$DETECTED_WS_PORT
    fi
fi

# Update URLs with actual ports
if [[ "$ACCESS_MODE" == "external" ]]; then
    LOCAL_IP=$(hostname -I | awk '{print $1}')
    WS_URL="ws://${LOCAL_IP}:${ACTUAL_WS_PORT}"
    WEB_URL="http://${LOCAL_IP}:${ACTUAL_WEB_PORT}"
else
    WS_URL="ws://localhost:${ACTUAL_WS_PORT}"
    WEB_URL="http://localhost:${ACTUAL_WEB_PORT}"
fi

info "MorphBox is running!"
echo ""
if [[ "$TERMINAL_MODE" == "true" ]]; then
    info "🖥️  Terminal Mode - Claude Code only (no panels)"
fi
if [[ "$DEV_MODE" == "true" ]]; then
    info "Development mode enabled (warnings disabled)"
fi
if [[ "$ACCESS_MODE" == "external" ]]; then
    echo -e "${BLUE}External Access Enabled:${NC}"
    info "- Web interface: $WEB_URL"
    info "- Also accessible at: http://${BIND_HOST}:${ACTUAL_WEB_PORT}"
    info "- WebSocket server: $WS_URL"
    echo ""
    warn "Remember to configure firewall rules if needed"
else
    info "- Web interface: $WEB_URL"
    info "- WebSocket server: $WS_URL"
fi
info ""
info "Press Ctrl+C to stop all services"

# Cleanup function
cleanup() {
    # Prevent multiple cleanup calls
    if [[ -f /tmp/morphbox-cleanup.lock ]]; then
        return
    fi
    touch /tmp/morphbox-cleanup.lock
    
    echo ""
    info "Stopping MorphBox..."
    
    # Kill child processes first
    [[ -n "$WS_PID" ]] && kill $WS_PID 2>/dev/null || true
    [[ -n "$WEB_PID" ]] && kill $WEB_PID 2>/dev/null || true
    
    # Give processes a moment to exit gracefully
    sleep 0.5
    
    # Force kill any remaining processes
    pkill -f "tsx.*websocket-server" 2>/dev/null || true
    pkill -f "vite dev" 2>/dev/null || true
    pkill -f "node server.js" 2>/dev/null || true
    
    # Automatically stop Docker container
    if docker ps | grep -q morphbox-vm; then
        info "Stopping Docker container..."
        # Use the correct docker-compose.yml path
        docker compose -f "$SCRIPT_DIR/web/docker/docker-compose.yml" down 2>/dev/null || true
    fi
    
    # Clean up lock file
    rm -f /tmp/morphbox-cleanup.lock
    
    info "MorphBox stopped"
    exit 0
}

# Set up signal handler
trap 'cleanup' SIGINT SIGTERM

# Wait for child processes instead of looping with sleep
# This allows signals to be handled immediately
wait $WEB_PID $WS_PID 2>/dev/null

# If we get here, a process exited unexpectedly
warn "Server process stopped unexpectedly"
cleanup