# Copyright 2025-2026 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

EAPI=8

# NOTE: This package uses a pre-built crate tarball instead of listing individual
# crates in CRATES="". This approach is required because:
# 1. Codex has 800+ crate dependencies, which triggers Portage QA warnings:
#    "QA Notice: This package uses a very large number of CRATES. Please provide
#    a crate tarball instead and fetch it via SRC_URI."
# 2. Stricter ebuild QA checks (e.g., in CI pipelines) fail with too many crates.
#
# The crate tarball is auto-generated by GitHub Actions at:
#   https://github.com/gentoo-zh-drafts/codex/
# Workflow source code for auditing:
#   https://github.com/gentoo-zh-drafts/codex/blob/crate-dist/.github/workflows/crates.yml
# This allows anyone to review and verify the crate packaging process.
#
# ::stuff addendum -- the crate tarball is a THIRD-PARTY artefact and MUST be
# verified on every bump. gentoo-zh-drafts is neither openai nor Gentoo, and
# the vendored .cargo-checksum.json files carry an EMPTY "files" map: only the
# `package` sha256 is populated, so nothing in the build checks that the
# vendored sources actually correspond to it. A tarball could ship correct
# checksum stubs beside modified code and neither cargo nor portage would
# notice. The Manifest pins the bytes we already saw; it says nothing about
# whether they were honest the first time.
#
# Gate a bump on:
#   tar xJf "${DISTDIR}"/codex-rust-v${PV}-crates.tar.xz -C /tmp/cx
#   ~/Public/stuff-claude/bin/verify-crate-tarball.py \
#       <src>/codex-rs/Cargo.lock /tmp/cx/cargo_home/gentoo
# It downloads every crate from crates.io and compares byte for byte.
# 0.153.0: all 1218 crates matched, crate set equals Cargo.lock exactly.
# verified 2026-09-03
#
# Not switching to CRATES=: pkgcheck's TooManyCrates fires above 300 and is
# warning-level, which our CI (--exit GentooCI) treats as failure, and both the
# eclass and pkgcheck warn it degrades metadata handling at this size.
# Self-hosting is not free either -- pycargoebuild refuses workspace roots, so
# it cannot generate this tarball, and 127 MB per version against extra-stuff's
# 261 MB total would be disproportionate. Verification is the proportionate
# answer; revisit if a check ever fails or the publisher goes away.

CRATES="
"

declare -A GIT_CRATES=(
	[appcontainer_common]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/backends/appcontainer/common'
	[learning_mode_core]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/learning_mode_core'
	[learning_mode_windows]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/backends/learning_mode/windows'
	[mxc_config_contract]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/mxc_config_contract'
	[mxc_telemetry]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/mxc_telemetry'
	[process_security_environment_spec]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/generated/process_security_environment_specification'
	[sandbox_spec]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/generated/base_container_specification'
	[wxc_common]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/wxc_common'
	[crossterm]='https://github.com/openai-oss-forks/crossterm;45fecb9508105988f42fe6ff0441783ed3717f92;crossterm-%commit%'
	[nucleo-matcher]='https://github.com/helix-editor/nucleo;4253de9faabb4e5c6d81d946a5e35a90f87347ee;nucleo-%commit%/matcher'
	[nucleo]='https://github.com/helix-editor/nucleo;4253de9faabb4e5c6d81d946a5e35a90f87347ee;nucleo-%commit%'
	[runfiles]='https://github.com/dzbarsky/rules_rust;b56cbaa8465e74127f1ea216f813cd377295ad81;rules_rust-%commit%/rust/runfiles'
	[tokio-tungstenite]='https://github.com/openai-oss-forks/tokio-tungstenite;0e5b2d73aa18dd9f0a50ee9ff199d5aef7594186;tokio-tungstenite-%commit%'
	[tungstenite]='https://github.com/openai-oss-forks/tungstenite-rs;4fffad30fe373adbdcffab9545e9e9bf4f2fc19f;tungstenite-rs-%commit%'
)

RUST_MIN_VER="1.95.0"

# python3 .github/scripts/rusty_v8_bazel.py resolved-v8-crate-version
RUSTY_V8_TAG="150.4.0"

inherit cargo check-reqs toolchain-funcs

CHECKREQS_MEMORY="15G"
CHECKREQS_DISK_BUILD="20G"

DESCRIPTION="Codex CLI - OpenAI's AI-powered coding agent"
HOMEPAGE="https://github.com/openai/codex"

# The crate tarball URL uses ${PV} so it auto-updates when bumping versions.
# This tarball is generated by: https://github.com/gentoo-zh-drafts/codex/
# See .github/workflows/crates.yml for the generation process.
SRC_URI="
	https://github.com/openai/${PN}/archive/rust-v${PV}.tar.gz -> ${P}.tar.gz
	https://github.com/gentoo-zh-drafts/codex/releases/download/rust-v${PV}/codex-rust-v${PV}-crates.tar.xz
	amd64? (
		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/librusty_v8_release_x86_64-unknown-linux-musl.a.gz
			-> rusty_v8_${RUSTY_V8_TAG}_librusty_v8_release_x86_64-unknown-linux-musl.a.gz
		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/src_binding_release_x86_64-unknown-linux-musl.rs
			-> rusty_v8_${RUSTY_V8_TAG}_src_binding_release_x86_64-unknown-linux-musl.rs
	)
	arm64? (
		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/librusty_v8_release_aarch64-unknown-linux-musl.a.gz
			-> rusty_v8_${RUSTY_V8_TAG}_librusty_v8_release_aarch64-unknown-linux-musl.a.gz
		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/src_binding_release_aarch64-unknown-linux-musl.rs
			-> rusty_v8_${RUSTY_V8_TAG}_src_binding_release_aarch64-unknown-linux-musl.rs
	)
	${CARGO_CRATE_URIS}
"

S="${WORKDIR}/${PN}-rust-v${PV}/codex-rs"

LICENSE="Apache-2.0"
# Dependent crate licenses
LICENSE+="
	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD-2 BSD Boost-1.0
	CC0-1.0 CDLA-Permissive-2.0 ISC MIT MPL-2.0 Unicode-3.0 ZLIB
"
SLOT="0"
KEYWORDS="-* ~amd64 ~arm64"
# Tests fail due to ring crate conflicts with system OpenSSL
RESTRICT="test"

DEPEND="
	dev-libs/openssl:=
	sys-apps/dbus
"
RDEPEND="${DEPEND}"
BDEPEND="virtual/pkgconfig"

# rust does not use *FLAGS from make.conf, silence portage warning
QA_FLAGS_IGNORED="usr/bin/${PN}"

pkg_pretend() {
	check-reqs_pkg_pretend
}

pkg_setup() {
	check-reqs_pkg_setup
	rust_pkg_setup
	if tc-is-lto; then
		export CARGO_PROFILE_RELEASE_LTO=thin
	else
		export CARGO_PROFILE_RELEASE_LTO=false
	fi
}

gen_git_crate_dir() {
	# https://github.com/gentoo/gentoo/blob/b09dd88412fe2d5eee5a8891e08bfa2d67848da3/eclass/cargo.eclass#L442
	IFS=';' read -r crate_uri commit crate_dir <<<"${GIT_CRATES[$1]}"
	echo "${WORKDIR}/${crate_dir//%commit%/${commit}}"
}

src_prepare() {
	default

	# Fix tokio-tungstenite's git dependency on tungstenite
	sed -i '/^\[dependencies\.tungstenite\]/,/^$/{
		s|git = "https://github.com/openai-oss-forks/tungstenite-rs"|path = "'"$(gen_git_crate_dir tungstenite)"'"|
		/^rev = /d
	}' "$(gen_git_crate_dir tokio-tungstenite)/Cargo.toml" || die

	# Remove the [patch.crates-io] section and add path-based patches
	sed -i '/^\[patch\.crates-io\]/,/^$/d' "${S}/Cargo.toml" || die
	sed -i '/^\[patch\."ssh:\/\/git@github\.com/,/^$/d' "${S}/Cargo.toml" || die

	# Add new patch section with local paths
	cat >> "${S}/Cargo.toml" <<-EOF || die

	[patch.crates-io]
	crossterm = { path = "$(gen_git_crate_dir crossterm)" }
	tokio-tungstenite = { path = "$(gen_git_crate_dir tokio-tungstenite)" }
	tungstenite = { path = "$(gen_git_crate_dir tungstenite)" }
	EOF
}

src_compile() {
	local rusty_v8_triple
	use amd64 && rusty_v8_triple=x86_64-unknown-linux-musl
	use arm64 && rusty_v8_triple=aarch64-unknown-linux-musl

	# codex-core trait resolution overflows rustc's default 8MiB stack
	export RUST_MIN_STACK=16777216

	RUSTY_V8_ARCHIVE="${DISTDIR}/rusty_v8_${RUSTY_V8_TAG}_librusty_v8_release_${rusty_v8_triple}.a.gz" \
	RUSTY_V8_SRC_BINDING_PATH="${DISTDIR}/rusty_v8_${RUSTY_V8_TAG}_src_binding_release_${rusty_v8_triple}.rs" \
		cargo_src_compile \
			--bin codex \
			--bin codex-code-mode-host
}

src_install() {
	dobin "$(cargo_target_dir)/codex"
	dobin "$(cargo_target_dir)/codex-code-mode-host"
	einstalldocs
}