entrypoint.sh

#!/bin/bash
set -e

configure_output_routing() {
if [ "${AWF_CAPTURE_COMMAND_OUTPUT:-}" = "1" ]; then
  # Preserve the container streams for command bytes and keep AWF setup
  # diagnostics out of both captured streams.
  exec 3>&1 4>&2
  exec >/dev/null 2>&1
  return
fi
if [ "${AWF_COMMAND_STDOUT_ONLY:-}" != "1" ]; then
  return
fi
# Keep entrypoint diagnostics off the command's stdout. File descriptor 3
# preserves the original stdout exclusively for the user command.
exec 3>&1
exec 1>&2
}

run_command_with_stdout() {
if [ "${AWF_CAPTURE_COMMAND_OUTPUT:-}" = "1" ]; then
  "$@" >&3 2>&4 3>&- 4>&-
elif [ "${AWF_COMMAND_STDOUT_ONLY:-}" = "1" ]; then
  "$@" >&3 3>&-
else
  "$@"
fi
}

print_banner() {
echo "[entrypoint] Agentic Workflow Firewall - Agent Container"
echo "[entrypoint] =================================="
}

setup_user_identity() {
# Adjust awfuser UID/GID to match host user at runtime
# This ensures file ownership is correct regardless of whether using GHCR images or local builds
HOST_UID=${AWF_USER_UID:-$(id -u awfuser)}
HOST_GID=${AWF_USER_GID:-$(id -g awfuser)}
CURRENT_UID=$(id -u awfuser)
CURRENT_GID=$(id -g awfuser)

# Validate UID/GID values to prevent security issues
if ! [[ "$HOST_UID" =~ ^[0-9]+$ ]]; then
  echo "[entrypoint][ERROR] Invalid AWF_USER_UID: must be numeric"
  exit 1
fi

if ! [[ "$HOST_GID" =~ ^[0-9]+$ ]]; then
  echo "[entrypoint][ERROR] Invalid AWF_USER_GID: must be numeric"
  exit 1
fi

# Prevent setting UID/GID to 0 (root) which defeats the privilege drop
if [ "$HOST_UID" -eq 0 ]; then
  echo "[entrypoint][ERROR] Invalid AWF_USER_UID: cannot be 0 (root)"
  exit 1
fi

if [ "$HOST_GID" -eq 0 ]; then
  echo "[entrypoint][ERROR] Invalid AWF_USER_GID: cannot be 0 (root)"
  exit 1
fi

if [ "$CURRENT_UID" != "$HOST_UID" ] || [ "$CURRENT_GID" != "$HOST_GID" ]; then
  echo "[entrypoint] Adjusting awfuser UID:GID from $CURRENT_UID:$CURRENT_GID to $HOST_UID:$HOST_GID"
  
  # Check if target GID is already in use by another group
  EXISTING_GROUP=$(getent group "$HOST_GID" 2>/dev/null | cut -d: -f1 || true)
  if [ -n "$EXISTING_GROUP" ] && [ "$EXISTING_GROUP" != "awfuser" ]; then
    echo "[entrypoint][WARN] Target GID $HOST_GID is already used by group '$EXISTING_GROUP'. Skipping GID change."
  else
    # Change GID first (must be done before UID change)
    if ! groupmod -g "$HOST_GID" awfuser 2>/dev/null; then
      echo "[entrypoint][ERROR] Failed to change GID of awfuser to $HOST_GID"
      exit 1
    fi
  fi
  
  # Check if target UID is already in use by another user
  EXISTING_USER=$(getent passwd "$HOST_UID" 2>/dev/null | cut -d: -f1 || true)
  if [ -n "$EXISTING_USER" ] && [ "$EXISTING_USER" != "awfuser" ]; then
    echo "[entrypoint][WARN] Target UID $HOST_UID is already used by user '$EXISTING_USER'. Skipping UID change."
  else
    # Change UID
    if ! usermod -u "$HOST_UID" awfuser 2>/dev/null; then
      echo "[entrypoint][ERROR] Failed to change UID of awfuser to $HOST_UID"
      exit 1
    fi
  fi
  
  # Fix ownership of awfuser's home directory
  chown -R awfuser:awfuser /home/awfuser 2>/dev/null || true
  echo "[entrypoint] UID/GID adjustment complete"
fi
}

configure_dns() {
# Configure DNS to use only Docker's embedded DNS (127.0.0.11)
# Docker embedded DNS handles all name resolution:
# - Container names (e.g., squid-proxy) → resolved directly
# - External domains → forwarded to upstream DNS servers configured via docker-compose dns: field
# No external DNS servers are listed in resolv.conf to prevent DNS-based data exfiltration
echo "[entrypoint] Configuring DNS..."
if [ -f /etc/resolv.conf ]; then
  # Backup original resolv.conf
  cp /etc/resolv.conf /etc/resolv.conf.orig

  if [ "$AWF_DOH_ENABLED" = "true" ] && [ -n "$AWF_DOH_PROXY_IP" ]; then
    # DNS-over-HTTPS mode: use DoH proxy as the DNS resolver
    {
      echo "# Generated by awf entrypoint (DNS-over-HTTPS mode)"
      echo "# Docker embedded DNS for service name resolution (squid-proxy, etc.)"
      echo "nameserver 127.0.0.11"
      echo "# DNS-over-HTTPS proxy for encrypted internet domain resolution"
      echo "nameserver $AWF_DOH_PROXY_IP"
      echo "options ndots:0"
    } > /etc/resolv.conf
    echo "[entrypoint] DNS configured with Docker embedded DNS (127.0.0.11) and DoH proxy ($AWF_DOH_PROXY_IP)"
  else
    # Simplified security model: Docker embedded DNS only
    # Docker embedded DNS at 127.0.0.11 handles all resolution
    # It forwards to upstream servers configured via docker-compose dns: field
    # No external DNS servers listed to prevent DNS-based data exfiltration
    {
      echo "# Generated by awf entrypoint"
      echo "# Docker embedded DNS handles all resolution (forwards to upstream via docker-compose dns: config)"
      echo "nameserver 127.0.0.11"
      echo "options ndots:0"
    } > /etc/resolv.conf
    echo "[entrypoint] DNS configured with Docker embedded DNS (127.0.0.11) only"
  fi
fi
}

configure_ssl_certs() {
# Update CA certificates if SSL Bump is enabled
# The CA certificate is mounted at /usr/local/share/ca-certificates/awf-ca.crt
if [ "${AWF_SSL_BUMP_ENABLED}" = "true" ]; then
  echo "[entrypoint] SSL Bump mode detected - updating CA certificates..."
  if [ -f /usr/local/share/ca-certificates/awf-ca.crt ]; then
    update-ca-certificates 2>/dev/null
    AWF_CA_PATH="/usr/local/share/ca-certificates/awf-ca.crt"
    # Set NODE_EXTRA_CA_CERTS so Node.js tools (Yarn 4, Corepack, npm) trust the AWF CA.
    # Node.js uses its own CA bundle, not the system CA store updated by update-ca-certificates.
    export NODE_EXTRA_CA_CERTS="$AWF_CA_PATH"
    # SSL_CERT_FILE is respected by curl, git, Python requests, Ruby, and most
    # OpenSSL-based tools that don't use the system CA store updated above.
    export SSL_CERT_FILE="$AWF_CA_PATH"
    export REQUESTS_CA_BUNDLE="$AWF_CA_PATH"
    echo "[entrypoint] CA certificates updated for SSL Bump"
    echo "[entrypoint] NODE_EXTRA_CA_CERTS set to $NODE_EXTRA_CA_CERTS"
    echo "[entrypoint] ⚠️  WARNING: HTTPS traffic will be intercepted for URL inspection"
  else
    echo "[entrypoint][WARN] SSL Bump enabled but CA certificate not found"
  fi
fi
}

wait_for_iptables() {
# Wait for iptables init container to complete setup
# The awf-iptables-init container shares our network namespace and runs
# setup-iptables.sh, then writes a ready signal file. This ensures the agent
# container NEVER needs NET_ADMIN capability.
#
# In network-isolation (topology) mode there is no iptables-init container —
# egress is enforced by Docker network topology — so skip the handshake.
# Likewise for runtimes whose network stack can't be governed by host-netns
# iptables (e.g. gVisor's isolated netstack): AWF_SKIP_IPTABLES_INIT is set and
# egress relies on the HTTP_PROXY/HTTPS_PROXY env vars instead.
if [ "${AWF_NETWORK_ISOLATION:-}" = "1" ] || [ "${AWF_SKIP_IPTABLES_INIT:-}" = "1" ]; then
  echo "[entrypoint] iptables-init skipped (proxy-based egress): skipping init container wait"
else
  echo "[entrypoint] Waiting for iptables initialization from init container..."
  INIT_TIMEOUT=300  # 300 * 0.1s = 30 seconds
  INIT_ELAPSED=0
  INIT_SIGNAL_DIR="${AWF_INIT_SIGNAL_DIR:-/run/awf-init}"
  LEGACY_INIT_SIGNAL_DIR="/tmp/awf-init"
  while [ ! -f "${INIT_SIGNAL_DIR}/ready" ] && [ ! -f "${LEGACY_INIT_SIGNAL_DIR}/ready" ]; do
    if [ "$INIT_ELAPSED" -ge "$INIT_TIMEOUT" ]; then
      echo "[entrypoint][ERROR] Timed out waiting for iptables init container after 30s"
      if [ -f "${INIT_SIGNAL_DIR}/output.log" ]; then
        echo "[entrypoint] Init container output:"
        cat "${INIT_SIGNAL_DIR}/output.log"
      elif [ -f "${LEGACY_INIT_SIGNAL_DIR}/output.log" ]; then
        echo "[entrypoint] Init container output:"
        cat "${LEGACY_INIT_SIGNAL_DIR}/output.log"
      else
        echo "[entrypoint] No init container output log found"
      fi
      exit 1
    fi
    sleep 0.1
    INIT_ELAPSED=$((INIT_ELAPSED + 1))
  done
  echo "[entrypoint] iptables initialization complete"
fi
}

check_service_health() {
# Run API proxy health checks (verifies credential isolation and connectivity)
# This must run AFTER iptables setup (which allows api-proxy traffic) but BEFORE user command
# If health check fails, the script exits with non-zero code and prevents agent from running
/usr/local/bin/api-proxy-health-check.sh || exit 1

# Run CLI proxy liveness check (fail-fast when DIFC proxy / Docker is unavailable)
# This prevents unbounded in-agent retries on connection-refused errors (e.g. when
# awmg-cli-proxy is not running).  Must run BEFORE the user command so the agent
# never starts into a broken proxy environment.
if [ -n "$AWF_CLI_PROXY_URL" ]; then
  echo "[entrypoint] Checking CLI proxy liveness at $AWF_CLI_PROXY_URL..."
  # Extract host and port from the URL (format: http://IP:PORT)
  CLI_PROXY_HOST=$(echo "$AWF_CLI_PROXY_URL" | sed -E 's|^https?://([^:/]+).*|\1|')
  CLI_PROXY_PORT=$(echo "$AWF_CLI_PROXY_URL" | sed -E 's|^https?://[^:]+:([0-9]+).*|\1|')
  if timeout 5 bash -c "cat < /dev/null > /dev/tcp/${CLI_PROXY_HOST}/${CLI_PROXY_PORT}" 2>/dev/null; then
    echo "[entrypoint] ✓ CLI proxy is reachable at $AWF_CLI_PROXY_URL"
  else
    echo "[entrypoint][ERROR] CLI proxy at $AWF_CLI_PROXY_URL is not reachable"
    echo "[entrypoint][ERROR] The DIFC proxy (awmg-cli-proxy) may be unavailable or Docker may be down"
    echo "[entrypoint][ERROR] Failing fast to prevent unbounded in-agent retries on connection-refused errors"
    exit 1
  fi
fi
}

configure_claude_api_key() {
# Configure Claude Code API key helper
# This ensures the apiKeyHelper is properly configured in the config files
# The config files must exist before Claude Code starts for authentication to work
# We write to BOTH paths for compatibility:
#   - ~/.claude.json (legacy path, used by older Claude Code versions)
#   - ~/.claude/settings.json (used by Claude Code v2.1.81+)
# In chroot mode, we write to /host$HOME/... so files are accessible after chroot
if [ -n "$CLAUDE_CODE_API_KEY_HELPER" ]; then
  echo "[entrypoint] Claude Code API key helper configured: $CLAUDE_CODE_API_KEY_HELPER"

  # In chroot mode, write to /host path so files are accessible after chroot transition
  if [ "${AWF_CHROOT_ENABLED}" = "true" ]; then
    LEGACY_CONFIG_FILE="/host$HOME/.claude.json"
    SETTINGS_DIR="/host$HOME/.claude"
  else
    LEGACY_CONFIG_FILE="$HOME/.claude.json"
    SETTINGS_DIR="$HOME/.claude"
  fi
  SETTINGS_FILE="$SETTINGS_DIR/settings.json"

  # Helper: write or validate apiKeyHelper in a config file
  write_api_key_helper() {
    local config_file="$1"
    local label="$2"

    if [ -f "$config_file" ]; then
      if grep -q '"apiKeyHelper"' "$config_file"; then
        CONFIGURED_HELPER=$(grep -o '"apiKeyHelper":"[^"]*"' "$config_file" | cut -d'"' -f4)
        if [ "$CONFIGURED_HELPER" != "$CLAUDE_CODE_API_KEY_HELPER" ]; then
          # Overwrite stale path (e.g. a previous run's chroot-adjusted path)
          echo "[entrypoint] Updating apiKeyHelper in $label (was: $CONFIGURED_HELPER)"
          if AWF_CONFIG_FILE="$config_file" AWF_KEY_HELPER="$CLAUDE_CODE_API_KEY_HELPER" \
             node -e "
               const fs = require('fs');
               const f = process.env.AWF_CONFIG_FILE;
               const obj = JSON.parse(fs.readFileSync(f, 'utf8'));
               obj.apiKeyHelper = process.env.AWF_KEY_HELPER;
               fs.writeFileSync(f, JSON.stringify(obj) + '\n');
             " 2>/dev/null; then
            chmod 666 "$config_file"
            echo "[entrypoint] ✓ Updated apiKeyHelper in $label"
          else
            echo "{\"apiKeyHelper\":\"$CLAUDE_CODE_API_KEY_HELPER\"}" > "$config_file"
            chmod 666 "$config_file"
            echo "[entrypoint] ✓ Wrote apiKeyHelper to $label (overwrite fallback)"
          fi
        else
          echo "[entrypoint] ✓ $label apiKeyHelper validated"
        fi
      else
        echo "[entrypoint] $label exists but missing apiKeyHelper, merging..."
        # Use node to safely add apiKeyHelper to existing JSON without losing other fields
        # (e.g. hasCompletedOnboarding, session tokens, user preferences)
        if AWF_CONFIG_FILE="$config_file" AWF_KEY_HELPER="$CLAUDE_CODE_API_KEY_HELPER" \
           node -e "
             const fs = require('fs');
             const file = process.env.AWF_CONFIG_FILE;
             const helper = process.env.AWF_KEY_HELPER;
             let obj = {};
             try { obj = JSON.parse(fs.readFileSync(file, 'utf8')); } catch(e) {}
             obj.apiKeyHelper = helper;
             fs.writeFileSync(file, JSON.stringify(obj) + '\n');
           " 2>/dev/null; then
          chmod 666 "$config_file"
          echo "[entrypoint] ✓ Merged apiKeyHelper into $label"
        else
          # Fallback if node is unavailable or the file is not valid JSON
          echo "{\"apiKeyHelper\":\"$CLAUDE_CODE_API_KEY_HELPER\"}" > "$config_file"
          chmod 666 "$config_file"
          echo "[entrypoint] ✓ Wrote apiKeyHelper to $label (overwrite fallback)"
        fi
      fi
    else
      echo "[entrypoint] Creating $label with apiKeyHelper..."
      echo "{\"apiKeyHelper\":\"$CLAUDE_CODE_API_KEY_HELPER\"}" > "$config_file"
      chmod 666 "$config_file"
      echo "[entrypoint] ✓ Created $label with apiKeyHelper: $CLAUDE_CODE_API_KEY_HELPER"
    fi
  }

  # Write to legacy path (~/.claude.json)
  write_api_key_helper "$LEGACY_CONFIG_FILE" "$LEGACY_CONFIG_FILE"

  # Write to settings path (~/.claude/settings.json) for Claude Code v2.1.81+
  mkdir -p "$SETTINGS_DIR"
  chmod 777 "$SETTINGS_DIR" 2>/dev/null || true
  write_api_key_helper "$SETTINGS_FILE" "$SETTINGS_FILE"
fi
}

configure_jvm_proxy() {
# Pre-seed JVM build tool proxy configuration
# Java build tools (Maven, Gradle, sbt) do not honor HTTP_PROXY/HTTPS_PROXY env vars
# and need explicit proxy configuration files
if [ -n "$HTTP_PROXY" ]; then
  # Determine proxy host and port for JVM tools.
  # Prefer SQUID_PROXY_HOST/SQUID_PROXY_PORT (set by docker-manager.ts) over parsing HTTP_PROXY,
  # since HTTP_PROXY parsing is brittle (doesn't handle https://, credentials, IPv6, etc.)
  if [ -n "$SQUID_PROXY_HOST" ] && [ -n "$SQUID_PROXY_PORT" ]; then
    PROXY_HOST="$SQUID_PROXY_HOST"
    PROXY_PORT="$SQUID_PROXY_PORT"
  else
    # Fallback: extract from HTTP_PROXY (format: http://HOST:PORT)
    PROXY_HOST="${HTTP_PROXY#http://}"
    PROXY_HOST="${PROXY_HOST#https://}"
    PROXY_HOST="${PROXY_HOST#*@}"       # strip credentials if present
    PROXY_PORT="${PROXY_HOST##*:}"      # extract port after last colon
    PROXY_HOST="${PROXY_HOST%:*}"       # strip port
    PROXY_PORT="${PROXY_PORT:-3128}"    # default port
  fi

  # Determine path prefix for config files (chroot-aware, same pattern as .claude.json)
  if [ "${AWF_CHROOT_ENABLED}" = "true" ]; then
    JVM_HOME_PREFIX="/host${HOME}"
  else
    JVM_HOME_PREFIX="${HOME}"
  fi

  echo "[entrypoint] Pre-seeding JVM build tool proxy configuration (${PROXY_HOST}:${PROXY_PORT})..."

  # Maven proxy config (~/.m2/settings.xml)
  # Only create if the file does not already exist, to avoid clobbering user-provided settings
  if ! mkdir -p "${JVM_HOME_PREFIX}/.m2" 2>/dev/null || [ ! -w "${JVM_HOME_PREFIX}/.m2" ]; then
    echo "[entrypoint] ⚠ Cannot write ${JVM_HOME_PREFIX}/.m2 (read-only home); skipping Maven proxy config"
  elif [ ! -f "${JVM_HOME_PREFIX}/.m2/settings.xml" ]; then
    if cat > "${JVM_HOME_PREFIX}/.m2/settings.xml" << MAVEN_EOF
<settings>
  <proxies>
    <proxy>
      <id>awf-http</id>
      <active>true</active>
      <protocol>http</protocol>
      <host>${PROXY_HOST}</host>
      <port>${PROXY_PORT}</port>
    </proxy>
    <proxy>
      <id>awf-https</id>
      <active>true</active>
      <protocol>https</protocol>
      <host>${PROXY_HOST}</host>
      <port>${PROXY_PORT}</port>
    </proxy>
  </proxies>
</settings>
MAVEN_EOF
    then
      chown awfuser:awfuser "${JVM_HOME_PREFIX}/.m2/settings.xml" 2>/dev/null || true
      echo "[entrypoint] ✓ Created Maven proxy config (${JVM_HOME_PREFIX}/.m2/settings.xml)"
    else
      echo "[entrypoint] ⚠ Failed to write ${JVM_HOME_PREFIX}/.m2/settings.xml; skipping Maven proxy config"
    fi
  else
    echo "[entrypoint] ✓ Maven settings.xml already exists, skipping proxy config creation"
  fi

  # Gradle proxy config (~/.gradle/gradle.properties)
  # Only create if the file does not already exist, to avoid clobbering user-provided settings
  # (e.g., org.gradle.jvmargs, build cache settings, private repo credentials)
  if ! mkdir -p "${JVM_HOME_PREFIX}/.gradle" 2>/dev/null || [ ! -w "${JVM_HOME_PREFIX}/.gradle" ]; then
    echo "[entrypoint] ⚠ Cannot write ${JVM_HOME_PREFIX}/.gradle (read-only home); skipping Gradle proxy config"
  elif [ ! -f "${JVM_HOME_PREFIX}/.gradle/gradle.properties" ]; then
    if cat > "${JVM_HOME_PREFIX}/.gradle/gradle.properties" << GRADLE_EOF
systemProp.http.proxyHost=${PROXY_HOST}
systemProp.http.proxyPort=${PROXY_PORT}
systemProp.https.proxyHost=${PROXY_HOST}
systemProp.https.proxyPort=${PROXY_PORT}
GRADLE_EOF
    then
      chown awfuser:awfuser "${JVM_HOME_PREFIX}/.gradle/gradle.properties" 2>/dev/null || true
      echo "[entrypoint] ✓ Created Gradle proxy config (${JVM_HOME_PREFIX}/.gradle/gradle.properties)"
    else
      echo "[entrypoint] ⚠ Failed to write ${JVM_HOME_PREFIX}/.gradle/gradle.properties; skipping Gradle proxy config"
    fi
  else
    echo "[entrypoint] ✓ Gradle gradle.properties already exists, skipping proxy config creation"
  fi

  # sbt/JVM proxy config via JAVA_TOOL_OPTIONS
  # This covers sbt and any JVM tool that reads standard system properties
  # Also set nonProxyHosts from NO_PROXY to prevent JVM tools from proxying localhost traffic
  NON_PROXY_RAW="${NO_PROXY:-${no_proxy:-}}"
  JVM_PROXY_FLAGS="-Dhttp.proxyHost=${PROXY_HOST} -Dhttp.proxyPort=${PROXY_PORT} -Dhttps.proxyHost=${PROXY_HOST} -Dhttps.proxyPort=${PROXY_PORT}"
  if [ -n "$NON_PROXY_RAW" ]; then
    # Convert comma-separated NO_PROXY to Java's pipe-separated nonProxyHosts format
    NON_PROXY_HOSTS=$(printf '%s' "$NON_PROXY_RAW" | tr ',' '|' | tr -d ' ')
    JVM_PROXY_FLAGS="${JVM_PROXY_FLAGS} -Dhttp.nonProxyHosts=${NON_PROXY_HOSTS} -Dhttps.nonProxyHosts=${NON_PROXY_HOSTS}"
    echo "[entrypoint] ✓ Set JAVA_TOOL_OPTIONS with proxy and nonProxyHosts flags"
  else
    echo "[entrypoint] ✓ Set JAVA_TOOL_OPTIONS with proxy flags"
  fi
  export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS:-} ${JVM_PROXY_FLAGS}"
fi
}

warn_codex_auto_model() {
if [ -z "${OPENAI_BASE_URL:-}" ]; then
  return
fi

local CODEX_MODEL="${GH_AW_MODEL_AGENT_CODEX:-}"
if [ -z "${CODEX_MODEL}" ]; then
  return
fi

local ENGINE_NAME="${GH_AW_AWF_ENGINE_NAME:-${GH_AW_ENGINE_ID:-}}"
case "${ENGINE_NAME}:${CODEX_MODEL}" in
  [Cc][Oo][Dd][Ee][Xx]:[Aa][Uu][Tt][Oo])
    echo "[entrypoint][WARN] Codex model 'auto' is not supported with AWF api-proxy/API-key routing."
    echo "[entrypoint][WARN] Codex resolves 'auto' through ChatGPT-authenticated remote model metadata; API-key auth cannot access that catalog."
    echo "[entrypoint][WARN] Set an explicit Codex model in workflow frontmatter (for example, model: gpt-5-codex) before running under AWF."
    ;;
esac
}

log_environment_details() {
# Print proxy environment
echo "[entrypoint] Proxy configuration:"
echo "[entrypoint]   HTTP_PROXY=$HTTP_PROXY"
echo "[entrypoint]   HTTPS_PROXY=$HTTPS_PROXY"

# Print network information
echo "[entrypoint] Network information:"
echo "[entrypoint]   IP address: $(hostname -I)"
echo "[entrypoint]   Hostname: $(hostname)"

# Configure git safe directories for awfuser
# Use runuser instead of su to avoid PAM session issues
runuser -u awfuser -- git config --global --add safe.directory '*' 2>/dev/null || true

echo "[entrypoint] =================================="
}

determine_capabilities_to_drop() {
# Determine which capabilities to drop
# - CAP_NET_ADMIN is NOT present (never granted to agent container - iptables setup
#   is handled by the separate awf-iptables-init container)
# - CAP_SYS_CHROOT is dropped when chroot mode is enabled (prevents user code from using chroot)
# - CAP_SYS_ADMIN is dropped when chroot mode is enabled (was needed for mounting procfs)
if [ "${AWF_CHROOT_ENABLED}" = "true" ]; then
  CAPS_TO_DROP="cap_sys_chroot,cap_sys_admin"
  echo "[entrypoint] Chroot mode enabled - dropping CAP_SYS_CHROOT and CAP_SYS_ADMIN"
else
  # In non-chroot mode, no capabilities need to be dropped
  # NET_ADMIN is never granted (init container handles iptables)
  # SYS_CHROOT and SYS_ADMIN are only needed/dropped in chroot mode
  CAPS_TO_DROP=""
  echo "[entrypoint] No capabilities to drop (NET_ADMIN never granted to agent)"
fi
}

# Function to unset sensitive tokens from the entrypoint's environment
# This prevents tokens from being accessible via /proc/1/environ after the agent has started
unset_sensitive_tokens() {
  # List of sensitive token environment variables (matches one-shot-token library defaults)
  local SENSITIVE_TOKENS=(
    # GitHub tokens
    "COPILOT_GITHUB_TOKEN"
    "GITHUB_TOKEN"
    "GH_TOKEN"
    "GITHUB_API_TOKEN"
    "GITHUB_PAT"
    "GH_ACCESS_TOKEN"
    "GITHUB_PERSONAL_ACCESS_TOKEN"
    # OpenAI tokens
    "OPENAI_API_KEY"
    "OPENAI_KEY"
    # Anthropic/Claude tokens
    "ANTHROPIC_API_KEY"
    "ANTHROPIC_AUTH_TOKEN"
    "CLAUDE_API_KEY"
    "CLAUDE_CODE_OAUTH_TOKEN"
    # Codex tokens
    "CODEX_API_KEY"
    # Copilot BYOK provider tokens
    "COPILOT_PROVIDER_API_KEY"
  )

  echo "[entrypoint] Unsetting sensitive tokens from parent shell environment..." >&2
  for token in "${SENSITIVE_TOKENS[@]}"; do
    if [ -n "${!token}" ]; then
      unset "$token"
      echo "[entrypoint] Unset $token from /proc/1/environ" >&2
    fi
  done
}

# Space-separated list of gh-aw handoff subdirectory names; names must not
# contain spaces because relax_gh_aw_shared_permissions iterates by word.
GH_AW_HOST_HANDOFF_DIRS="memory-validation"

# Relax permissions on host-shared gh-aw scratch handoff directories after the
# agent command has finished.
#
# AWF remaps the agent's UID/GID to match the host user (see
# setup_user_identity), so new files the agent creates under /tmp/gh-aw
# ordinarily belong to that same host user. However this function runs as a
# defense-in-depth measure for cases where the effective UID/GID still ends
# up mismatched from whatever identity a later host-side step runs as (for
# example gh-aw's post-agent validateMemoryStep, which writes a validation
# marker under /tmp/gh-aw/memory-validation after the container has exited).
# Without this, that step can fail with EACCES even though the directory
# tree looks otherwise fine.
#
# We only add the group-write bit (not world-writable), and only to the shared
# handoff root plus known host-side handoff subdirectories, to avoid materially
# widening access on multi-user self-hosted runners or payload-bearing audit
# files elsewhere in the gh-aw tree. Combined with the ownership transfer
# already performed before the command ran, this covers the common case where
# the host step shares the same primary group as the mapped agent user.
#
# This must run here (as root, still in the container's own filesystem view)
# rather than after the `chroot ... capsh` invocation in run_chroot_command,
# because that invocation ends with `exec capsh`, which replaces the chroot
# shell's process image entirely — any code placed after it in
# run_chroot_command would never execute.
relax_gh_aw_shared_permissions() {
  local gh_aw_dir=""
  if [ -e /host/tmp/gh-aw ] || [ -L /host/tmp/gh-aw ]; then
    gh_aw_dir="/host/tmp/gh-aw"
  elif [ -e /tmp/gh-aw ] || [ -L /tmp/gh-aw ]; then
    gh_aw_dir="/tmp/gh-aw"
  else
    return 0
  fi

  if ! relax_gh_aw_handoff_dir "${gh_aw_dir}"; then
    return 0
  fi

  local handoff_subdir
  for handoff_subdir in ${GH_AW_HOST_HANDOFF_DIRS}; do
    relax_gh_aw_handoff_dir "${gh_aw_dir}/${handoff_subdir}"
  done
  return 0
}

relax_gh_aw_handoff_dir() {
  local handoff_dir="$1"
  if [ ! -e "${handoff_dir}" ]; then
    return 0
  fi
  if [ ! -d "${handoff_dir}" ] || [ -L "${handoff_dir}" ]; then
    echo "[entrypoint][WARN] Skipping unsafe gh-aw handoff path ${handoff_dir}" >&2
    return 1
  fi
  if chmod g+rwx "${handoff_dir}" 2>/dev/null; then
    echo "[entrypoint] Relaxed ${handoff_dir} group permissions for host-side post-processing" >&2
    return 0
  else
    echo "[entrypoint][WARN] Failed to relax ${handoff_dir} group permissions" >&2
    return 1
  fi
}

# Run a command with signal handling, one-shot token protection, and clean exit.
# Usage: run_agent_with_token_protection <command> [args...]
# The command is launched in the background so that sensitive tokens can be unset
# from the parent shell's environment once the agent has had time to cache them.
run_agent_with_token_protection() {
  # Setup signal handler to forward signals to agent process and perform cleanup
  cleanup_and_exit() {
    SIGNAL="$1"
    EXIT_CODE=143
    if [ "$SIGNAL" = "INT" ]; then
      EXIT_CODE=130  # Standard exit code for SIGINT
    fi

    trap - TERM INT

    if [ -n "$AGENT_PID" ]; then
      kill "-$SIGNAL" "$AGENT_PID" 2>/dev/null || true
      wait "$AGENT_PID" 2>/dev/null || true
    fi

    relax_gh_aw_shared_permissions
    exit "$EXIT_CODE"
  }
  trap 'cleanup_and_exit TERM' TERM
  trap 'cleanup_and_exit INT' INT

  # SECURITY: Run agent command in background, then unset tokens from parent shell
  # This prevents tokens from being accessible via /proc/1/environ after agent starts
  # The one-shot-token library caches tokens in the agent process, so agent can still read them
  "$@" &
  AGENT_PID=$!

  # Wait for agent to initialize and cache tokens (up to 1 second)
  # The one-shot-token LD_PRELOAD library caches tokens in ~100ms during process init.
  # Poll every 100ms so fast commands (e.g. 'echo ok') don't pay the full wait.
  for _i in 1 2 3 4 5 6 7 8 9 10; do
    kill -0 "$AGENT_PID" 2>/dev/null || break
    sleep 0.1
  done

  # Unset all sensitive tokens from parent shell environment
  unset_sensitive_tokens

  # Wait for agent command to complete and capture its exit code
  EXIT_CODE=0
  wait "$AGENT_PID" || EXIT_CODE=$?
  trap - TERM INT
  relax_gh_aw_shared_permissions
  exit $EXIT_CODE
}

log_execution_context() {
echo "[entrypoint] Switching to awfuser (UID: $(id -u awfuser), GID: $(id -g awfuser))"
echo "[entrypoint] Executing command: $@"
echo ""
}


# ---------------------------------------------------------------------------
# Chroot setup helpers — called from run_chroot_command()
# ---------------------------------------------------------------------------

mount_host_procfs() {
  # Mount a container-scoped procfs at /host/proc
  # This provides dynamic /proc/self/exe resolution (required by .NET CLR, JVM, and other
  # runtimes that read /proc/self/exe to find themselves). A static bind mount of /proc/self
  # always resolves to the parent shell's exe, causing runtime failures.
  # Security: This procfs is container-scoped (only shows container processes, not host).
  # SYS_ADMIN capability (required for mount) is dropped before user code runs.
  # SECURITY: hidepid=2 prevents awfuser from reading other processes' /proc/[pid]/environ,
  # which is critical because PID 1 (entrypoint) may briefly hold auth tokens before
  # unset_sensitive_tokens() clears them. Without hidepid=2, the agent could race to read
  # /proc/1/environ and extract credentials. Also blocks access via /dev/fd → /proc/self/fd
  # symlink traversal paths.
  mkdir -p /host/proc
  if mount -t proc -o nosuid,nodev,noexec,hidepid=2 proc /host/proc; then
    echo "[entrypoint] Mounted procfs at /host/proc (nosuid,nodev,noexec,hidepid=2)"
  else
    echo "[entrypoint][ERROR] Failed to mount procfs at /host/proc"
    echo "[entrypoint][ERROR] This is required for Java, .NET, and other runtimes that read /proc/self/exe"
    echo "[entrypoint][ERROR] Ensure the container has SYS_ADMIN capability (it will be dropped before user code runs)"
    exit 1
  fi
}

mount_host_cgroupfs() {
  # Bind-mount the container's own (real, pre-chroot) cgroup subtree at /host/sys/fs/cgroup,
  # read-only, so pids.max/pids.current (and other cgroup limits) are visible to tools
  # running inside the chroot.
  #
  # Without this, /host/sys/fs/cgroup only shows whatever the host's read-only bind mount of
  # /sys exposes (from the "system" mount policy), which is the host's raw cgroupfs view, not
  # the container's own delegated cgroup. That view is typically unreadable/misleading from
  # inside an unprivileged container, so tools like the JVM can't discover the real pids
  # ceiling and size thread pools accordingly, leading to confusing
  # "unable to create native thread" / "Cannot create worker GC thread" failures instead of a
  # clear signal that the process ceiling was hit. See: --pids-limit (default 1000).
  #
  # This is best-effort: if the bind mount fails (e.g. cgroup not delegated, unsupported
  # runtime), we continue without it rather than aborting the whole command.
  mkdir -p /host/sys/fs/cgroup
  if mount --bind /sys/fs/cgroup /host/sys/fs/cgroup 2>/dev/null; then
    if mount -o remount,ro,bind /host/sys/fs/cgroup 2>/dev/null; then
      echo "[entrypoint] Bind-mounted container cgroup subtree at /host/sys/fs/cgroup (ro)"
    else
      echo "[entrypoint][WARN] Could not remount /host/sys/fs/cgroup read-only; removing mount"
      if umount /host/sys/fs/cgroup 2>/dev/null; then
        echo "[entrypoint][WARN] pids.max/pids.current will not be visible inside the sandbox"
      else
        echo "[entrypoint][ERROR] Could not remove writable cgroup mount; refusing to start sandbox command"
        exit 1
      fi
    fi
  else
    echo "[entrypoint][WARN] Could not bind-mount cgroup subtree at /host/sys/fs/cgroup"
    echo "[entrypoint][WARN] pids.max/pids.current will not be visible inside the sandbox"
  fi
}

copy_preload_libs() {
  # Copy one-shot-token library to host filesystem for LD_PRELOAD in chroot
  # This prevents tokens from being read multiple times by malicious code
  # Staged under /run/awf-lib, which lives on the container's own writable
  # rootfs. /tmp cannot be used: it is bind-mounted from the host and
  # filesystem.allowWrite may narrow it to read-only, which would silently
  # disable this protection.
  # Sets ONE_SHOT_TOKEN_LIB (empty string if unavailable or incompatible)
  ONE_SHOT_TOKEN_LIB=""
  if [ -f /usr/local/lib/one-shot-token.so ]; then
    # Create the library directory on the container rootfs (always writable)
    if mkdir -p /host/run/awf-lib 2>/dev/null; then
      # Copy the library and verify it exists after copying
      if cp /usr/local/lib/one-shot-token.so /host/run/awf-lib/one-shot-token.so 2>/dev/null && \
         [ -f /host/run/awf-lib/one-shot-token.so ]; then
        # Probe compatibility with the host's dynamic linker before committing to LD_PRELOAD.
        # Run the probe inside chroot /host so the ELF interpreter and all library paths
        # (e.g. /lib/ld-musl-*.so.1 on Alpine) resolve against the host filesystem, not
        # the container's.  This avoids false negatives where the container's glibc
        # interpreter would accept the .so even though the host loader cannot.
        if chroot /host /bin/sh -c 'LD_PRELOAD=/run/awf-lib/one-shot-token.so /bin/true' 2>/dev/null; then
          ONE_SHOT_TOKEN_LIB="/run/awf-lib/one-shot-token.so"
          echo "[entrypoint] One-shot token library copied to chroot at ${ONE_SHOT_TOKEN_LIB}"
        else
          echo "[entrypoint][WARN] one-shot-token.so failed to load on host dynamic linker (host libc incompatibility, e.g. musl/Alpine)"
          echo "[entrypoint][WARN] Token protection will be disabled (tokens may be readable multiple times)"
          rm -f /host/run/awf-lib/one-shot-token.so 2>/dev/null || true
        fi
      else
        # The library exists but could not be staged. Continuing would silently
        # drop a security control, so fail closed instead.
        echo "[entrypoint][ERROR] Could not copy one-shot-token library to /run/awf-lib" >&2
        echo "[entrypoint][ERROR] Refusing to start without one-shot token protection" >&2
        exit 1
      fi
    else
      echo "[entrypoint][ERROR] Could not create /run/awf-lib directory" >&2
      echo "[entrypoint][ERROR] Refusing to start without one-shot token protection" >&2
      exit 1
    fi
  fi
}

copy_browser_libs() {
  # Stage the Chromium/Playwright runtime shared libraries baked into the image
  # (containers/agent/Dockerfile: BROWSER_PKGS) so they are visible inside the
  # chroot. Installing the packages into the image's /usr is not sufficient on
  # its own: AWF_CHROOT_ENABLED=true chroots to /host, and buildSystemMounts()
  # bind-mounts the runner's own /usr, /lib, etc. over the image's, shadowing
  # anything installed in this layer.
  #
  # The Dockerfile records the manifest of .so files owned by those packages
  # (including their transitive dependencies, e.g. fontconfig/freetype/harfbuzz)
  # at /usr/local/share/awf/browser-libs.manifest. We copy each one, preserving
  # its original directory structure, under /run/awf-lib/browser-libs -- which
  # lives on the container's own writable rootfs (not bind-mounted) -- and point
  # LD_LIBRARY_PATH at the resulting directories.
  #
  # Sets BROWSER_LD_LIBRARY_PATH (empty string if unavailable or nothing to stage).
  BROWSER_LD_LIBRARY_PATH=""
  MANIFEST="/usr/local/share/awf/browser-libs.manifest"
  if [ -s "$MANIFEST" ]; then
    STAGE_ROOT="/host/run/awf-lib/browser-libs"
    if mkdir -p "$STAGE_ROOT" 2>/dev/null; then
      LIB_DIRS=""
      while IFS= read -r lib; do
        [ -z "$lib" ] && continue
        [ -f "$lib" ] || continue
        dest="${STAGE_ROOT}${lib}"
        dest_dir="$(dirname "$dest")"
        if mkdir -p "$dest_dir" 2>/dev/null && cp -a "$lib" "$dest" 2>/dev/null; then
          rel_dir="$(dirname "$lib")"
          case " $LIB_DIRS " in
            *" $rel_dir "*) ;;
            *) LIB_DIRS="$LIB_DIRS $rel_dir" ;;
          esac
        else
          echo "[entrypoint][WARN] Could not stage browser runtime library $lib" >&2
        fi
      done < "$MANIFEST"
      if [ -n "$LIB_DIRS" ]; then
        for rel_dir in $LIB_DIRS; do
          BROWSER_LD_LIBRARY_PATH="${BROWSER_LD_LIBRARY_PATH:+$BROWSER_LD_LIBRARY_PATH:}/run/awf-lib/browser-libs${rel_dir}"
        done
        echo "[entrypoint] Chromium/Playwright runtime libraries staged for chroot at ${STAGE_ROOT}"
      fi
    else
      echo "[entrypoint][WARN] Could not create ${STAGE_ROOT}; Chromium/Playwright browsers may fail to launch" >&2
    fi
  fi
}

copy_agent_helper_scripts() {
  # Copy get-claude-key.sh and gh CLI proxy wrapper to chroot-accessible paths.
  # Both scripts are baked into the Docker image but shadowed by host bind mounts
  # inside chroot. They are copied to /run/awf-lib/ -- on the container's own
  # writable rootfs, not the host-bound /tmp which filesystem.allowWrite may
  # narrow to read-only -- so they remain accessible after the chroot activates.
  # Sets CHROOT_KEY_HELPER; may update AWF_HOST_PATH.

  # Copy get-claude-key.sh to chroot-accessible path
  # The script is baked into the Docker image at /usr/local/bin/, but the chroot
  # bind-mounts the host's /usr (read-only), shadowing the container's copy.
  # We must copy it to /run/awf-lib/ (container rootfs) before the chroot activates.
  CHROOT_KEY_HELPER=""
  if [ -n "$CLAUDE_CODE_API_KEY_HELPER" ] && [ -f "$CLAUDE_CODE_API_KEY_HELPER" ]; then
    if mkdir -p /host/run/awf-lib 2>/dev/null; then
      CHROOT_KEY_HELPER="/run/awf-lib/$(basename "$CLAUDE_CODE_API_KEY_HELPER")"
      if cp "$CLAUDE_CODE_API_KEY_HELPER" "/host${CHROOT_KEY_HELPER}" 2>/dev/null && \
         chmod +x "/host${CHROOT_KEY_HELPER}" 2>/dev/null; then
        echo "[entrypoint] Claude key helper copied to chroot at ${CHROOT_KEY_HELPER}"
        # Update apiKeyHelper in config files to use the chroot-accessible path
        for cfg in "/host$HOME/.claude.json" "/host$HOME/.claude/settings.json"; do
          if [ -f "$cfg" ] && grep -q '"apiKeyHelper"' "$cfg" 2>/dev/null; then
            if AWF_CFG="$cfg" AWF_NEW="$CHROOT_KEY_HELPER" \
               node -e "
                 const fs = require('fs');
                 const f = process.env.AWF_CFG;
                 const obj = JSON.parse(fs.readFileSync(f, 'utf8'));
                 obj.apiKeyHelper = process.env.AWF_NEW;
                 fs.writeFileSync(f, JSON.stringify(obj) + '\n');
               " 2>/dev/null; then
              echo "[entrypoint] ✓ Updated apiKeyHelper path in $cfg"
            fi
          fi
        done
        CLAUDE_CODE_API_KEY_HELPER="$CHROOT_KEY_HELPER"
      else
        echo "[entrypoint][WARN] Could not copy get-claude-key.sh to chroot"
        echo "[entrypoint][WARN] Claude Code API key helper may not work in chroot mode"
        CHROOT_KEY_HELPER=""
      fi
    fi
  fi

  # Activate gh CLI proxy wrapper when CLI proxy sidecar is enabled.
  # The wrapper at /usr/local/bin/gh-cli-proxy-wrapper.sh (baked into the image)
  # is copied to /run/awf-lib/gh so it is accessible inside the chroot at a
  # location that takes precedence over the host's /usr/bin/gh mount.
  if [ -n "$AWF_CLI_PROXY_URL" ] && [ -f /usr/local/bin/gh-cli-proxy-wrapper.sh ]; then
    if mkdir -p /host/run/awf-lib 2>/dev/null && \
       cp /usr/local/bin/gh-cli-proxy-wrapper.sh /host/run/awf-lib/gh 2>/dev/null && \
       chmod +x /host/run/awf-lib/gh 2>/dev/null; then
      # The chroot will see this as /run/awf-lib/gh (the /host prefix is the bind mount)
      echo "[entrypoint] gh CLI proxy wrapper installed at /run/awf-lib/gh (inside chroot)"
      # Prepend /run/awf-lib to PATH so the wrapper takes precedence over host gh
      export AWF_HOST_PATH="/run/awf-lib:${AWF_HOST_PATH:-$PATH}"
    else
      # The CLI proxy is enabled, so an unwrapped gh would bypass credential
      # mediation entirely. Fail closed rather than silently downgrade.
      echo "[entrypoint][ERROR] Could not install gh CLI proxy wrapper at /run/awf-lib/gh" >&2
      echo "[entrypoint][ERROR] Refusing to start with an unmediated gh CLI" >&2
      exit 1
    fi
  fi

}

copy_dind_runner_binary() {
  # In split-filesystem DinD setups with --docker-host-path-prefix pointing at
  # a shared /tmp root, docker-manager stages the invoking CLI binary under
  # /tmp/awf-runner-bin/<name>. Copy it into /run/awf-lib so the chrooted PATH
  # can resolve the expected command name (copilot, claude, etc.) without
  # requiring manual bootstrap copies into the daemon's /usr/local/bin.
  # Sets STAGED_RUNNER_BINARY_CHROOT; may update AWF_HOST_PATH.
  STAGED_RUNNER_BINARY_CHROOT=""
  if [ -n "${AWF_STAGED_RUNNER_BINARY_NAME:-}" ]; then
    if [[ ! "${AWF_STAGED_RUNNER_BINARY_NAME}" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]*$ ]]; then
      echo "[entrypoint][WARN] Ignoring invalid AWF_STAGED_RUNNER_BINARY_NAME=${AWF_STAGED_RUNNER_BINARY_NAME}"
    elif [ -f "/tmp/awf-runner-bin/${AWF_STAGED_RUNNER_BINARY_NAME}" ]; then
      if mkdir -p /host/run/awf-lib 2>/dev/null; then
        if cp "/tmp/awf-runner-bin/${AWF_STAGED_RUNNER_BINARY_NAME}" "/host/run/awf-lib/${AWF_STAGED_RUNNER_BINARY_NAME}" 2>/dev/null && \
           chmod +x "/host/run/awf-lib/${AWF_STAGED_RUNNER_BINARY_NAME}" 2>/dev/null; then
          STAGED_RUNNER_BINARY_CHROOT="/run/awf-lib/${AWF_STAGED_RUNNER_BINARY_NAME}"
          case ":${AWF_HOST_PATH:-$PATH}:" in
            *":/run/awf-lib:"*) ;;
            *) export AWF_HOST_PATH="/run/awf-lib:${AWF_HOST_PATH:-$PATH}" ;;
          esac
          echo "[entrypoint] Runner binary staged for chroot at ${STAGED_RUNNER_BINARY_CHROOT}"
        else
          echo "[entrypoint][WARN] Could not stage runner binary ${AWF_STAGED_RUNNER_BINARY_NAME} into chroot"
        fi
      fi
    fi
  fi

  # When chroot.binariesSourcePath is configured, the firewall mounts the runner-bin
  # overlay at /host/tmp/awf-runner-bin (inside chroot: /tmp/awf-runner-bin).
  # Prepend it to AWF_HOST_PATH so the chrooted PATH resolves runner-installed binaries
  # (e.g. copilot, claude) even when they are absent from /usr/local/bin in the staged
  # host filesystem. This is the primary mechanism for ARC/DinD runners where the
  # runner-installed binaries live on the runner's /tmp emptyDir, not in /usr.
  if [ -d /host/tmp/awf-runner-bin ]; then
    case ":${AWF_HOST_PATH:-$PATH}:" in
      *":/tmp/awf-runner-bin:"*) ;;
      *) export AWF_HOST_PATH="/tmp/awf-runner-bin:${AWF_HOST_PATH:-$PATH}" ;;
    esac
    echo "[entrypoint] Runner binaries overlay detected at /tmp/awf-runner-bin; prepended to PATH"
  fi
}

resolve_chroot_binary_path() {
  # Resolve a binary name to a chroot-absolute path by searching the same
  # directories the chroot PATH will contain: $GITHUB_PATH entries (written by
  # setup-* actions, including tool-cache activations), AWF_HOST_PATH, the
  # AWF-staged binary directories, and the standard system directories.
  # Prints the chroot path on success; returns 1 when the binary is not found.
  local name="$1"
  local search_path=""
  local entry=""

  if [ -n "${GITHUB_PATH:-}" ] && [ -f "/host${GITHUB_PATH}" ]; then
    while IFS= read -r entry; do
      entry="${entry%$'\r'}"  # strip trailing CR (Windows-style CRLF files)
      [ -z "${entry}" ] && continue
      search_path="${search_path}${entry}:"
    done < "/host${GITHUB_PATH}"
  fi
  if [ -n "${AWF_HOST_PATH:-}" ]; then
    search_path="${search_path}${AWF_HOST_PATH}:"
  fi
  search_path="${search_path}/tmp/awf-runner-bin:/run/awf-lib:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

  local dir=""
  local IFS=':'
  for dir in ${search_path}; do
    case "${dir}" in
      /*) ;;
      *) continue ;;
    esac
    if [ -f "/host${dir}/${name}" ] && [ -x "/host${dir}/${name}" ]; then
      printf '%s\n' "${dir}/${name}"
      return 0
    fi
  done
  return 1
}

prepare_usr_local_bin_overlay() {
  # Stage a writable replacement for the chroot's /usr/local/bin.
  #
  # The host /usr tree is bind-mounted read-only at /host/usr, so a missing
  # /usr/local/bin/<tool> entry cannot simply be created. Instead we bind-mount
  # the original directory to a second location that stays reachable inside the
  # chroot (a unique /tmp/awf-usr-local-bin-orig-XXXXXX directory, read-only) and
  # build a symlink farm in /tmp/awf-usr-local-bin-XXXXXX that mirrors every
  # existing entry. The farm is later bind-mounted over /host/usr/local/bin so
  # both the original binaries and the AWF-created shims resolve.
  #
  # Sets USR_LOCAL_BIN_OVERLAY_DIR, USR_LOCAL_BIN_ORIG_DIR and
  # USR_LOCAL_BIN_OVERLAY_READY=1 on success. No host filesystem content is
  # modified.
  if [ "${USR_LOCAL_BIN_OVERLAY_READY}" = "1" ]; then
    return 0
  fi
  if [ ! -d /host/usr/local/bin ]; then
    return 1
  fi
  # Unique staging directories per container run: a fixed name could be reused
  # by a concurrent AWF container or left stale by a previous run on the same
  # host /tmp, which would shadow /usr/local/bin with outdated symlinks.
  local overlay_host_dir="" orig_host_dir=""
  overlay_host_dir="$(mktemp -d /host/tmp/awf-usr-local-bin-XXXXXX 2>/dev/null || true)"
  orig_host_dir="$(mktemp -d /host/tmp/awf-usr-local-bin-orig-XXXXXX 2>/dev/null || true)"
  if [ -z "${overlay_host_dir}" ] || [ -z "${orig_host_dir}" ]; then
    rmdir "${overlay_host_dir:-/nonexistent}" "${orig_host_dir:-/nonexistent}" 2>/dev/null || true
    return 1
  fi
  USR_LOCAL_BIN_OVERLAY_DIR="${overlay_host_dir#/host}"
  USR_LOCAL_BIN_ORIG_DIR="${orig_host_dir#/host}"
  if ! mount --bind /host/usr/local/bin "/host${USR_LOCAL_BIN_ORIG_DIR}" 2>/dev/null; then
    rmdir "${overlay_host_dir}" "${orig_host_dir}" 2>/dev/null || true
    USR_LOCAL_BIN_OVERLAY_DIR=""
    USR_LOCAL_BIN_ORIG_DIR=""
    return 1
  fi
  # Install the teardown here — from this point on there is a bind mount and two
  # staging directories that must be removed however the container exits.
  trap cleanup_usr_local_bin_overlay EXIT
  USR_LOCAL_BIN_OVERLAY_READY=1
  mount -o remount,ro,bind "/host${USR_LOCAL_BIN_ORIG_DIR}" 2>/dev/null || \
    echo "[entrypoint][WARN] Could not remount ${USR_LOCAL_BIN_ORIG_DIR} read-only"

  populate_usr_local_bin_farm
  chown 0:0 "/host${USR_LOCAL_BIN_OVERLAY_DIR}" 2>/dev/null || true
  chmod 0755 "/host${USR_LOCAL_BIN_OVERLAY_DIR}" 2>/dev/null || true
  return 0
}

populate_usr_local_bin_farm() {
  # Mirror every entry of the real /usr/local/bin into the staging farm as a
  # symlink. Uses USR_LOCAL_BIN_OVERLAY_DIR / USR_LOCAL_BIN_ORIG_DIR.
  local entry="" base="" real="" target=""
  # Iterate the original directory (the overlay is not mounted yet) so relative
  # symlinks resolve against their real location rather than the staging path.
  # The dotfile globs are required as well: * skips hidden entries, which would
  # otherwise disappear from /usr/local/bin once the overlay is activated.
  for entry in /host/usr/local/bin/* /host/usr/local/bin/.[!.]* /host/usr/local/bin/..?*; do
    [ -e "${entry}" ] || continue
    base="$(basename "${entry}")"
    real="$(readlink -f "${entry}" 2>/dev/null || true)"
    [ -z "${real}" ] && continue
    case "${real}" in
      /host/usr/local/bin/*)
        # Regular file living directly in /usr/local/bin — point at the
        # read-only copy of the original directory.
        target="${USR_LOCAL_BIN_ORIG_DIR}/${real#/host/usr/local/bin/}"
        ;;
      /host/*)
        # Symlink into another host location — use the resolved chroot path so
        # relative symlinks do not break when re-rooted.
        target="${real#/host}"
        ;;
      *) continue ;;
    esac
    ln -sfn "${target}" "/host${USR_LOCAL_BIN_OVERLAY_DIR}/${base}" 2>/dev/null || true
  done
}

cleanup_usr_local_bin_overlay() {
  # Tear down the /usr/local/bin overlay. Installed as an EXIT trap in the
  # container's root shell: the chroot shell exec's capsh, so its own EXIT trap
  # never fires, and the unmounts need CAP_SYS_ADMIN, which is dropped before the
  # user command runs.
  #
  # Order matters: the farm has to be unmounted from /usr/local/bin before its
  # symlinks are deleted, and the mirrored original directory has to be unmounted
  # before its (now empty) mountpoint can be removed. Only symlinks are deleted —
  # the mirrored directory is a read-only bind mount of the real /usr/local/bin
  # and must never have its contents removed.
  [ "${USR_LOCAL_BIN_OVERLAY_READY:-0}" = "1" ] || return 0
  if [ "${USR_LOCAL_BIN_OVERLAY_MOUNTED:-0}" = "1" ]; then
    umount /host/usr/local/bin 2>/dev/null || \
      echo "[entrypoint][WARN] Could not unmount the /usr/local/bin overlay"
    USR_LOCAL_BIN_OVERLAY_MOUNTED=0
  fi
  find "/host${USR_LOCAL_BIN_OVERLAY_DIR}" -maxdepth 1 -type l -delete 2>/dev/null || true
  umount "/host${USR_LOCAL_BIN_ORIG_DIR}" 2>/dev/null || \
    echo "[entrypoint][WARN] Could not unmount ${USR_LOCAL_BIN_ORIG_DIR}"
  rmdir "/host${USR_LOCAL_BIN_OVERLAY_DIR}" "/host${USR_LOCAL_BIN_ORIG_DIR}" 2>/dev/null || true
  USR_LOCAL_BIN_OVERLAY_READY=0
}

ensure_usr_local_bin_shims() {
  # Some agentic harnesses spawn their CLI through a hardcoded absolute path
  # (e.g. gh-aw's Copilot engine uses /usr/local/bin/copilot) instead of a PATH
  # lookup. Their installers can skip creating that file — a Copilot CLI
  # tool-cache hit only exports the cache directory to PATH/GITHUB_PATH — which
  # makes the harness fail immediately with `spawn /usr/local/bin/copilot ENOENT`.
  #
  # AWF_ENSURE_USR_LOCAL_BIN holds a comma-separated list of binary names that
  # must be reachable at /usr/local/bin/<name> inside the chroot. For each
  # missing name we resolve the real binary via PATH/GITHUB_PATH and create the
  # expected symlink, so AWF no longer depends on upstream tool-cache behavior.
  # The staging directories live in /tmp and are root-owned (0755), so the
  # unprivileged chroot user cannot inject binaries into them. They are unmounted
  # and removed by cleanup_usr_local_bin_overlay() on container exit.
  USR_LOCAL_BIN_OVERLAY_DIR=""
  USR_LOCAL_BIN_ORIG_DIR=""
  USR_LOCAL_BIN_OVERLAY_READY=0
  USR_LOCAL_BIN_OVERLAY_MOUNTED=0

  [ -z "${AWF_ENSURE_USR_LOCAL_BIN:-}" ] && return 0

  local name="" resolved="" created=0
  local names=()
  IFS=',' read -r -a names <<< "${AWF_ENSURE_USR_LOCAL_BIN}"
  for name in "${names[@]}"; do
    [ -z "${name}" ] && continue
    if [[ ! "${name}" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]*$ ]]; then
      echo "[entrypoint][WARN] Ignoring invalid AWF_ENSURE_USR_LOCAL_BIN entry: ${name}"
      continue
    fi
    if [ -e "/host/usr/local/bin/${name}" ]; then
      continue
    fi
    resolved="$(resolve_chroot_binary_path "${name}" || true)"
    if [ -z "${resolved}" ]; then
      echo "[entrypoint][WARN] /usr/local/bin/${name} is missing and '${name}' could not be resolved from PATH/GITHUB_PATH"
      continue
    fi
    echo "[entrypoint] /usr/local/bin/${name} is missing; resolved '${name}' at ${resolved}"
    if ln -sfn "${resolved}" "/host/usr/local/bin/${name}" 2>/dev/null; then
      echo "[entrypoint] Created /usr/local/bin/${name} -> ${resolved}"
    elif prepare_usr_local_bin_overlay && \
         ln -sfn "${resolved}" "/host${USR_LOCAL_BIN_OVERLAY_DIR}/${name}" 2>/dev/null; then
      created=1
      echo "[entrypoint] Staged /usr/local/bin/${name} -> ${resolved} (read-only /usr overlay)"
    else
      echo "[entrypoint][WARN] Could not create /usr/local/bin/${name}; harnesses using that hardcoded path may fail"
    fi
  done

  if [ "${created}" = "1" ]; then
    if mount --bind "/host${USR_LOCAL_BIN_OVERLAY_DIR}" /host/usr/local/bin 2>/dev/null; then
      USR_LOCAL_BIN_OVERLAY_MOUNTED=1
      mount -o remount,ro,bind /host/usr/local/bin 2>/dev/null || \
        echo "[entrypoint][WARN] Could not remount /host/usr/local/bin read-only"
      echo "[entrypoint] Activated /usr/local/bin overlay with AWF-created shims"
    else
      echo "[entrypoint][WARN] Could not activate /usr/local/bin overlay; hardcoded-path spawns may fail"
    fi
  fi
}

copy_awf_ca_cert() {
  # Copy AWF CA certificate to chroot-accessible path for ssl-bump TLS trust.
  # NODE_EXTRA_CA_CERTS points to /usr/local/share/ca-certificates/awf-ca.crt which
  # is a Docker volume mount on the container's overlay filesystem. After chroot /host,
  # this path is inaccessible. Copy to /run/awf-lib/ (container rootfs) and update the
  # env var so Node.js (Claude Code), curl, git, Python, etc. trust the Squid CA.
  # Sets AWF_CA_CHROOT; exports NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, REQUESTS_CA_BUNDLE.
  AWF_CA_CHROOT=""
  if [ "${AWF_SSL_BUMP_ENABLED}" = "true" ] && [ -f /usr/local/share/ca-certificates/awf-ca.crt ]; then
    if mkdir -p /host/run/awf-lib 2>/dev/null; then
      if cp /usr/local/share/ca-certificates/awf-ca.crt /host/run/awf-lib/awf-ca.crt 2>/dev/null && \
         [ -f /host/run/awf-lib/awf-ca.crt ]; then
        AWF_CA_CHROOT="/run/awf-lib/awf-ca.crt"
        export NODE_EXTRA_CA_CERTS="$AWF_CA_CHROOT"
        # SSL_CERT_FILE is respected by curl, git, Python requests, Ruby, and most
        # OpenSSL-based tools. This ensures non-Node.js tools also trust the AWF CA.
        export SSL_CERT_FILE="$AWF_CA_CHROOT"
        export REQUESTS_CA_BUNDLE="$AWF_CA_CHROOT"
        echo "[entrypoint] AWF CA certificate copied to chroot at $AWF_CA_CHROOT"
        echo "[entrypoint] NODE_EXTRA_CA_CERTS updated to $AWF_CA_CHROOT"
        echo "[entrypoint] SSL_CERT_FILE updated to $AWF_CA_CHROOT"
      else
        echo "[entrypoint][WARN] Could not copy AWF CA certificate to chroot — ssl-bump TLS may fail"
      fi
    else
      echo "[entrypoint][WARN] Could not create /host/run/awf-lib for CA cert — ssl-bump TLS may fail in chroot"
    fi
  fi
}

copy_system_ca_bundle() {
  # Detect and copy the host system CA bundle to a chroot-accessible path.
  # On Amazon Linux / RHEL-family systems, the CA bundle often lives under
  # /etc/pki/. This function finds the system bundle and, when it is not already
  # accessible in the chroot, copies it to /run/awf-lib/ so TLS works regardless
  # of distro.
  #
  # In SSL Bump mode, the AWF CA must remain the active trust bundle for MITM
  # proxy validation. We only append the system bundle to that staged AWF CA.
  SYSTEM_CA_CHROOT=""

  if [ "${AWF_SSL_BUMP_ENABLED}" = "true" ]; then
    if [ -z "$AWF_CA_CHROOT" ] || [ ! -f "/host${AWF_CA_CHROOT}" ]; then
      echo "[entrypoint][WARN] SSL Bump enabled but chroot AWF CA bundle is unavailable — preserving existing TLS env vars"
      return
    fi

    # SSL Bump already configured TLS env vars; detect system bundle and append
    # it to the AWF CA so tools trust both the AWF proxy CA AND the upstream CAs.
    local SYSTEM_BUNDLE=""
    for candidate in \
      /host/etc/ssl/certs/ca-certificates.crt \
      /host/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
      /host/etc/pki/tls/certs/ca-bundle.crt \
      /host/etc/pki/tls/cert.pem \
      /host/etc/ssl/cert.pem; do
      if [ -s "$candidate" ]; then
        SYSTEM_BUNDLE="$candidate"
        break
      fi
    done
    if [ -n "$SYSTEM_BUNDLE" ]; then
      # Append system bundle to the AWF CA cert so both are trusted
      if { printf '\n'; cat "$SYSTEM_BUNDLE"; } >> "/host${AWF_CA_CHROOT}" 2>/dev/null; then
        echo "[entrypoint] System CA bundle ($SYSTEM_BUNDLE) appended to AWF CA cert"
      fi
    fi
    return
  fi

  # No SSL Bump — detect and expose the system CA bundle for chroot.
  local SYSTEM_BUNDLE=""
  for candidate in \
    /host/etc/ssl/certs/ca-certificates.crt \
    /host/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
    /host/etc/pki/tls/certs/ca-bundle.crt \
    /host/etc/pki/tls/cert.pem \
    /host/etc/ssl/cert.pem; do
    if [ -s "$candidate" ]; then
      SYSTEM_BUNDLE="$candidate"
      break
    fi
  done

  if [ -z "$SYSTEM_BUNDLE" ]; then
    echo "[entrypoint][WARN] No system CA bundle found — TLS may fail inside chroot"
    return
  fi

  # Check if the bundle is already accessible inside the chroot via existing mounts.
  # AWF mounts the common CA roots under /etc/ssl, /etc/ca-certificates, and the
  # RHEL/Amazon Linux CA roots under /etc/pki/ca-trust/extracted and /etc/pki/tls/certs.
  local CHROOT_RELATIVE="${SYSTEM_BUNDLE#/host}"
  case "$CHROOT_RELATIVE" in
    /etc/ssl/*|/etc/ca-certificates/*|/etc/pki/ca-trust/extracted/*|/etc/pki/tls/certs/*)
      # Already accessible via existing bind mounts
      export SSL_CERT_FILE="$CHROOT_RELATIVE"
      export NODE_EXTRA_CA_CERTS="$CHROOT_RELATIVE"
      export REQUESTS_CA_BUNDLE="$CHROOT_RELATIVE"
      export CURL_CA_BUNDLE="$CHROOT_RELATIVE"
      export GIT_SSL_CAINFO="$CHROOT_RELATIVE"
      echo "[entrypoint] System CA bundle found at $CHROOT_RELATIVE (already accessible in chroot)"
      return
      ;;
  esac

  # Bundle is not accessible in chroot. Copy it.
  if mkdir -p /host/run/awf-lib 2>/dev/null; then
    if cp "$SYSTEM_BUNDLE" /host/run/awf-lib/system-ca-certificates.crt 2>/dev/null && \
       [ -s /host/run/awf-lib/system-ca-certificates.crt ]; then
      local CA_PATH="/run/awf-lib/system-ca-certificates.crt"
      SYSTEM_CA_CHROOT="$CA_PATH"
      export SSL_CERT_FILE="$CA_PATH"
      export NODE_EXTRA_CA_CERTS="$CA_PATH"
      export REQUESTS_CA_BUNDLE="$CA_PATH"
      export CURL_CA_BUNDLE="$CA_PATH"
      export GIT_SSL_CAINFO="$CA_PATH"
      echo "[entrypoint] System CA bundle copied from $SYSTEM_BUNDLE to $CA_PATH"
    else
      echo "[entrypoint][WARN] Could not copy system CA bundle to chroot — TLS may fail"
    fi
  else
    echo "[entrypoint][WARN] Could not create /host/run/awf-lib for system CA bundle"
  fi
}

check_chroot_prereqs() {
  # Verify prerequisites for chroot execution: glibc-based host, capsh, and bash.
  # Each check fails fast with exit 1 on failure.

  # Chroot mode currently requires a glibc-based host userspace.
  # Alpine/musl hosts do not provide a compatible capsh/bash toolchain.
  if [ -f /host/etc/alpine-release ] || \
     compgen -G '/host/lib/ld-musl-*.so.1' >/dev/null || \
     compgen -G '/host/usr/lib/ld-musl-*.so.1' >/dev/null; then
    echo "[entrypoint][ERROR] AWF chroot mode requires a glibc-based daemon host (Ubuntu/Debian/RHEL-family)."
    echo "[entrypoint][ERROR] Detected Alpine/musl host filesystem under /host."
    echo "[entrypoint][ERROR] Alpine/musl daemon hosts are not currently supported in chroot mode."
    exit 1
  fi

  # Verify capsh is available on the host (required for privilege drop)
  # Use -x file tests instead of command -v to avoid /dev/null redirects
  # (gVisor mounts /dev read-only inside chroots, breaking >/dev/null)
  if ! chroot /host /bin/sh -c '[ -x /usr/sbin/capsh ] || [ -x /usr/bin/capsh ]'; then
    echo "[entrypoint][ERROR] capsh not found on host system"
    echo "[entrypoint][ERROR] Install capsh (Debian/Ubuntu: libcap2-bin; RHEL/Fedora: libcap)"
    exit 1
  fi

  # Verify bash is available on the host (required by chroot execution chain)
  if ! chroot /host /bin/sh -c '[ -x /bin/bash ]'; then
    echo "[entrypoint][ERROR] /bin/bash not found on host system"
    echo "[entrypoint][ERROR] AWF chroot mode requires bash on the daemon host"
    exit 1
  fi
}

setup_chroot_etc() {
  # Configure the chroot's /etc files and synthesize user identity.
  # Sets: RESOLV_MODIFIED, RESOLV_CREATED, RESOLV_BACKUP, HOSTS_MODIFIED,
  #       HOST_USER, HOST_USER_UID, HOST_USER_GID,
  #       CAPSH_IDENTITY_ARGS, CHROOT_HOME_OVERRIDE, CHROOT_USER_OVERRIDE.

  # Backup and copy container's resolv.conf to host (preserves AWF DNS configuration)
  # This ensures DNS queries inside the chroot use the configured DNS servers
  # NOTE: We backup the host's original resolv.conf and set up a trap to restore it
  RESOLV_BACKUP="/host/etc/resolv.conf.awf-backup-$$"
  RESOLV_MODIFIED=false
  RESOLV_CREATED=false
  if [ -f /host/etc/resolv.conf ]; then
    # File exists: backup original and replace with AWF DNS configuration
    if cp /host/etc/resolv.conf "$RESOLV_BACKUP" 2>/dev/null; then
      if cp /etc/resolv.conf /host/etc/resolv.conf.awf 2>/dev/null; then
        mv /host/etc/resolv.conf.awf /host/etc/resolv.conf 2>/dev/null && RESOLV_MODIFIED=true
        echo "[entrypoint] DNS configuration copied to chroot (backup at $RESOLV_BACKUP)"
      else
        echo "[entrypoint][WARN] Could not copy DNS configuration to chroot"
      fi
    else
      echo "[entrypoint][WARN] Could not backup host resolv.conf, skipping DNS override"
    fi
  else
    # File doesn't exist: selective /etc mounts don't include resolv.conf
    # Create it from the container's resolv.conf (which has AWF DNS config)
    if cp /etc/resolv.conf /host/etc/resolv.conf 2>/dev/null; then
      RESOLV_CREATED=true
      echo "[entrypoint] DNS configuration created in chroot (/host/etc/resolv.conf)"
    else
      echo "[entrypoint][WARN] Could not create DNS configuration in chroot"
    fi
  fi

  # Inject host.docker.internal into chroot's /etc/hosts when host access is enabled
  # Docker adds this to the container's /etc/hosts via extra_hosts, but the chroot
  # uses a separate hosts file that doesn't have it. The container's /etc/hosts has
  # the correct mapping, so we copy it to the chroot's /etc/hosts.
  HOSTS_MODIFIED=false
  if [ "${AWF_ENABLE_HOST_ACCESS}" = "1" ]; then
    HOST_DOCKER_ENTRY=$(grep "host.docker.internal" /etc/hosts 2>/dev/null | head -1 || true)
    if [ -n "$HOST_DOCKER_ENTRY" ] && ! grep -q "host.docker.internal" /host/etc/hosts 2>/dev/null; then
      if echo "$HOST_DOCKER_ENTRY" >> /host/etc/hosts 2>/dev/null; then
        HOSTS_MODIFIED=true
        echo "[entrypoint] Added host.docker.internal to chroot /etc/hosts"
      else
        echo "[entrypoint][WARN] Could not add host.docker.internal to chroot /etc/hosts"
      fi
    fi
  fi

  # Find the user name on the host system by UID
  # This allows us to run as the same user inside the chroot
  HOST_USER_UID="${AWF_CHROOT_IDENTITY_UID:-${AWF_USER_UID:-1000}}"
  HOST_USER_GID="${AWF_CHROOT_IDENTITY_GID:-${AWF_USER_GID:-${HOST_USER_UID}}}"
  HOST_USER=$(chroot /host getent passwd "${HOST_USER_UID}" 2>/dev/null | cut -d: -f1 || echo "")
  CAPSH_IDENTITY_ARGS=""
  CHROOT_HOME_OVERRIDE="${AWF_CHROOT_IDENTITY_HOME:-}"
  CHROOT_USER_OVERRIDE="${AWF_CHROOT_IDENTITY_USER:-}"
  if [ -z "${HOST_USER}" ]; then
    # User not found in chroot's /etc/passwd (common on ARC-DinD Alpine daemons).
    # Synthesize minimal identity files so the agent can resolve its own UID/GID.
    HOST_USER="runner"
    if [ -f /host/etc/passwd ] && grep -q "^${HOST_USER}:" /host/etc/passwd 2>/dev/null; then
      HOST_USER="runner-${HOST_USER_UID}"
      local_user_suffix=1
      while grep -q "^${HOST_USER}:" /host/etc/passwd 2>/dev/null; do
        HOST_USER="runner-${HOST_USER_UID}-${local_user_suffix}"
        local_user_suffix=$((local_user_suffix + 1))
      done
    fi
    echo "[entrypoint] User with UID ${HOST_USER_UID} not found in chroot — synthesizing identity files"

    # Determine the user's home directory (default to /home/runner)
    SYNTH_HOME="${AWF_HOST_HOME:-/home/${HOST_USER}}"
    SYNTH_GROUP_NAME="${HOST_USER}"
    if [ -f /host/etc/group ] && grep -q "^${SYNTH_GROUP_NAME}:" /host/etc/group 2>/dev/null; then
      SYNTH_GROUP_NAME="runner-${HOST_USER_GID}"
      local_group_suffix=1
      while grep -q "^${SYNTH_GROUP_NAME}:" /host/etc/group 2>/dev/null; do
        SYNTH_GROUP_NAME="runner-${HOST_USER_GID}-${local_group_suffix}"
        local_group_suffix=$((local_group_suffix + 1))
      done
    fi

    # Synthesize /etc/passwd entry if missing
    if ! grep -q "^[^:]*:[^:]*:${HOST_USER_UID}:" /host/etc/passwd 2>/dev/null; then
      PASSWD_ENTRY="${HOST_USER}:x:${HOST_USER_UID}:${HOST_USER_GID}:GitHub Actions Runner:${SYNTH_HOME}:/bin/bash"
      # Append to existing file or create new one
      if [ -f /host/etc/passwd ]; then
        if echo "${PASSWD_ENTRY}" >> /host/etc/passwd 2>/dev/null; then
          echo "[entrypoint] Appended ${HOST_USER} (UID ${HOST_USER_UID}) to /host/etc/passwd"
        else
          # /host/etc is read-only (e.g. ARC/DinD with tmpfs-backed daemon root).
          # Copy the existing file to a writable tmpfs location, append the new entry,
          # then bind-mount the copy over the read-only original.  SYS_ADMIN is still
          # available at this point (it is dropped by capsh before user code runs).
          SYNTH_ETC_DIR="/tmp/awf-etc"
          if mkdir -p "${SYNTH_ETC_DIR}" 2>/dev/null \
            && cp /host/etc/passwd "${SYNTH_ETC_DIR}/passwd" 2>/dev/null \
            && echo "${PASSWD_ENTRY}" >> "${SYNTH_ETC_DIR}/passwd" 2>/dev/null \
            && chmod 644 "${SYNTH_ETC_DIR}/passwd" 2>/dev/null \
            && mount --bind "${SYNTH_ETC_DIR}/passwd" /host/etc/passwd 2>/dev/null; then
            echo "[entrypoint] Bind-mounted synthesized /host/etc/passwd over read-only original"
          else
            echo "[entrypoint][WARN] Could not write or bind-mount /host/etc/passwd — identity resolution may fail"
          fi
        fi
      else
        # Create minimal passwd with root and the runner user
        if printf '%s\n' "root:x:0:0:root:/root:/bin/bash" "nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin" "${PASSWD_ENTRY}" > /host/etc/passwd 2>/dev/null; then
          chmod 644 /host/etc/passwd 2>/dev/null
          echo "[entrypoint] Created /host/etc/passwd with ${HOST_USER} (UID ${HOST_USER_UID})"
        else
          echo "[entrypoint][WARN] Could not create /host/etc/passwd — identity resolution may fail"
        fi
      fi
    fi

    # Synthesize /etc/group entry if missing
    if ! grep -q "^[^:]*:[^:]*:${HOST_USER_GID}:" /host/etc/group 2>/dev/null; then
      GROUP_ENTRY="${SYNTH_GROUP_NAME}:x:${HOST_USER_GID}:"
      if [ -f /host/etc/group ]; then
        if echo "${GROUP_ENTRY}" >> /host/etc/group 2>/dev/null; then
          echo "[entrypoint] Appended group ${SYNTH_GROUP_NAME} (GID ${HOST_USER_GID}) to /host/etc/group"
        else
          # /host/etc is read-only — same bind-mount fallback as for passwd above.
          SYNTH_ETC_DIR="/tmp/awf-etc"
          if mkdir -p "${SYNTH_ETC_DIR}" 2>/dev/null \
            && cp /host/etc/group "${SYNTH_ETC_DIR}/group" 2>/dev/null \
            && echo "${GROUP_ENTRY}" >> "${SYNTH_ETC_DIR}/group" 2>/dev/null \
            && chmod 644 "${SYNTH_ETC_DIR}/group" 2>/dev/null \
            && mount --bind "${SYNTH_ETC_DIR}/group" /host/etc/group 2>/dev/null; then
            echo "[entrypoint] Bind-mounted synthesized /host/etc/group over read-only original"
          else
            echo "[entrypoint][WARN] Could not write or bind-mount /host/etc/group — identity resolution may fail"
          fi
        fi
      else
        if printf '%s\n' "root:x:0:" "nobody:x:65534:" "${GROUP_ENTRY}" > /host/etc/group 2>/dev/null; then
          chmod 644 /host/etc/group 2>/dev/null
          echo "[entrypoint] Created /host/etc/group with group ${SYNTH_GROUP_NAME} (GID ${HOST_USER_GID})"
        else
          echo "[entrypoint][WARN] Could not create /host/etc/group"
        fi
      fi
    fi

    # Synthesize /etc/hosts if it doesn't exist (DinD Alpine daemon may not have one)
    if [ ! -f /host/etc/hosts ]; then
      if printf '%s\n' "127.0.0.1 localhost" "::1 localhost ip6-localhost ip6-loopback" > /host/etc/hosts 2>/dev/null; then
        chmod 644 /host/etc/hosts 2>/dev/null
        echo "[entrypoint] Created minimal /host/etc/hosts"
      fi
    fi

    HOST_USER=$(chroot /host getent passwd "${HOST_USER_UID}" 2>/dev/null | cut -d: -f1 || echo "")
    if [ -n "${HOST_USER}" ]; then
      CAPSH_IDENTITY_ARGS="--user=${HOST_USER}"
      echo "[entrypoint] Running as synthesized host user: ${HOST_USER} (UID: ${HOST_USER_UID})"
    else
      CAPSH_IDENTITY_ARGS="--gid=${HOST_USER_GID} --uid=${HOST_USER_UID} --groups=${HOST_USER_GID}"
      if [ -z "${CHROOT_HOME_OVERRIDE}" ]; then
        CHROOT_HOME_OVERRIDE="${SYNTH_HOME}"
      fi
      echo "[entrypoint][WARN] Proceeding with numeric UID/GID fallback (${HOST_USER_UID}:${HOST_USER_GID})"
    fi
  else
    CAPSH_IDENTITY_ARGS="--user=${HOST_USER}"
    echo "[entrypoint] Running as host user: ${HOST_USER} (UID: ${HOST_USER_UID})"
  fi

  if [ -z "${CHROOT_USER_OVERRIDE}" ] && [ -n "${HOST_USER}" ]; then
    CHROOT_USER_OVERRIDE="${HOST_USER}"
  fi
}

build_path_script() {
  # Generate the shell script executed inside the chroot that sets up PATH and
  # toolchain environment variables before running the user command.
  # Uses SCRIPT_FILE (must be set in the calling scope); writes to /host${SCRIPT_FILE}.
  # CHROOT_HOME_OVERRIDE and CHROOT_USER_OVERRIDE must be set before calling.
  # Arguments: "$@" — the command to run inside the chroot.

  # Use host's actual PATH if provided, otherwise construct a default
  # This ensures we use the same Python/Node/Go versions as the host
  if [ -n "${AWF_HOST_PATH}" ]; then
    echo "[entrypoint] Using host PATH for chroot"
    cat > "/host${SCRIPT_FILE}" << AWFEOF
#!/bin/bash
# Use the host's actual PATH (passed via AWF_HOST_PATH)
export PATH="${AWF_HOST_PATH}"
AWFEOF
    # Add CARGO_HOME/bin to PATH if provided (for Rust/Cargo on GitHub Actions)
    if [ -n "${AWF_CARGO_HOME}" ]; then
      echo "[entrypoint] Adding CARGO_HOME/bin to PATH: ${AWF_CARGO_HOME}/bin"
      echo "export PATH=\"${AWF_CARGO_HOME}/bin:\$PATH\"" >> "/host${SCRIPT_FILE}"
      echo "export CARGO_HOME=\"${AWF_CARGO_HOME}\"" >> "/host${SCRIPT_FILE}"
      # Also set RUSTUP_HOME if provided (needed for rustc to find toolchain)
      if [ -n "${AWF_RUSTUP_HOME}" ]; then
        echo "[entrypoint] Setting RUSTUP_HOME: ${AWF_RUSTUP_HOME}"
        echo "export RUSTUP_HOME=\"${AWF_RUSTUP_HOME}\"" >> "/host${SCRIPT_FILE}"
      fi
    else
      # Fallback: detect Cargo from default location if CARGO_HOME not provided
      # This ensures Rust binaries work even when CARGO_HOME env var is not set
      echo "# Add Cargo bin for Rust if it exists (fallback when CARGO_HOME not provided)" >> "/host${SCRIPT_FILE}"
      echo "[ -d \"\$HOME/.cargo/bin\" ] && export PATH=\"\$HOME/.cargo/bin:\$PATH\"" >> "/host${SCRIPT_FILE}"
    fi
    # Add JAVA_HOME/bin to PATH if provided (for Java on GitHub Actions)
    # Also set LD_LIBRARY_PATH to include Java's lib directory for libjli.so
    if [ -n "${AWF_JAVA_HOME}" ]; then
      echo "[entrypoint] Adding JAVA_HOME/bin to PATH: ${AWF_JAVA_HOME}/bin"
      echo "export PATH=\"${AWF_JAVA_HOME}/bin:\$PATH\"" >> "/host${SCRIPT_FILE}"
      echo "export JAVA_HOME=\"${AWF_JAVA_HOME}\"" >> "/host${SCRIPT_FILE}"
      # Java needs LD_LIBRARY_PATH to find libjli.so and other shared libs
      echo "export LD_LIBRARY_PATH=\"${AWF_JAVA_HOME}/lib:${AWF_JAVA_HOME}/lib/server:\$LD_LIBRARY_PATH\"" >> "/host${SCRIPT_FILE}"
    fi
    # Add DOTNET_ROOT to PATH if provided (for .NET on GitHub Actions)
    if [ -n "${AWF_DOTNET_ROOT}" ]; then
      echo "[entrypoint] Adding DOTNET_ROOT to PATH: ${AWF_DOTNET_ROOT}"
      echo "export PATH=\"${AWF_DOTNET_ROOT}:\$PATH\"" >> "/host${SCRIPT_FILE}"
      echo "export DOTNET_ROOT=\"${AWF_DOTNET_ROOT}\"" >> "/host${SCRIPT_FILE}"
    fi
    # Add GOROOT/bin to PATH if provided (required for Go on GitHub Actions with trimmed binaries)
    # This ensures the correct Go version is found even if AWF_HOST_PATH has wrong ordering
    if [ -n "${AWF_GOROOT}" ]; then
      echo "[entrypoint] Adding GOROOT/bin to PATH: ${AWF_GOROOT}/bin"
      echo "export PATH=\"${AWF_GOROOT}/bin:\$PATH\"" >> "/host${SCRIPT_FILE}"
      echo "export GOROOT=\"${AWF_GOROOT}\"" >> "/host${SCRIPT_FILE}"
    fi
    # Add BUN_INSTALL/bin to PATH if provided (for Bun on GitHub Actions)
    # Bun must be pre-installed on the host because it crashes inside chroot (restricted /proc)
    if [ -n "${AWF_BUN_INSTALL}" ]; then
      echo "[entrypoint] Adding BUN_INSTALL/bin to PATH: ${AWF_BUN_INSTALL}/bin"
      echo "export PATH=\"${AWF_BUN_INSTALL}/bin:\$PATH\"" >> "/host${SCRIPT_FILE}"
      echo "export BUN_INSTALL=\"${AWF_BUN_INSTALL}\"" >> "/host${SCRIPT_FILE}"
    fi
  else
    echo "[entrypoint] Constructing default PATH for chroot"
    cat > "/host${SCRIPT_FILE}" << 'AWFEOF'
#!/bin/bash
# Set comprehensive PATH for host binaries
# Include standard paths plus tool cache locations (GitHub Actions)
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Prepend entries from $GITHUB_PATH file (written by setup-* actions) so they
# take priority over the hostedtoolcache scan below.  This replicates what the
# Actions runner normally does with GITHUB_PATH, preserving the version chosen
# by setup-ruby / setup-python / setup-node / etc.
if [ -n "${GITHUB_PATH}" ] && [ -f "${GITHUB_PATH}" ]; then
  _github_path_prefix=""
  while IFS= read -r _gp_entry; do
    _gp_entry="${_gp_entry%$'\r'}"  # strip trailing CR (Windows-style CRLF files)
    [ -z "${_gp_entry}" ] && continue
    _github_path_prefix="${_github_path_prefix}${_gp_entry}:"
  done < "${GITHUB_PATH}"
  [ -n "${_github_path_prefix}" ] && export PATH="${_github_path_prefix}${PATH}"
fi
# Dynamically scan toolcache roots for all installed tool bin directories.
# This covers tools installed by setup-* actions on both hosted runners
# (/opt/hostedtoolcache) and self-hosted runners ($HOME/work/_tool).
# Append (not prepend) so that $GITHUB_PATH entries and standard paths above
# retain priority; discovered toolcache dirs serve as fallbacks only.
append_toolcache_bins() {
  local toolcache_root="$1"
  if [ ! -d "${toolcache_root}" ]; then
    return
  fi
  for tool_dir in "${toolcache_root}"/*/; do
    for version_dir in "$tool_dir"*/; do
      for arch_dir in "$version_dir"*/; do
        if [ -d "${arch_dir}bin" ]; then
          case ":${PATH}:" in
            *":${arch_dir}bin:"*) ;;
            *) export PATH="${PATH}:${arch_dir}bin" ;;
          esac
        fi
      done
    done
  done
}
append_toolcache_bins "/opt/hostedtoolcache"
append_toolcache_bins "${HOME}/work/_tool"
# Add user's local bin if it exists
[ -d "$HOME/.local/bin" ] && export PATH="$HOME/.local/bin:$PATH"
# Add Cargo bin for Rust (common in development)
[ -d "$HOME/.cargo/bin" ] && export PATH="$HOME/.cargo/bin:$PATH"
AWFEOF
    # Add GOROOT/bin to PATH if provided (required for Go on GitHub Actions with trimmed binaries)
    # This ensures the correct Go version is found even if PATH has wrong ordering
    if [ -n "${AWF_GOROOT}" ]; then
      echo "[entrypoint] Adding GOROOT/bin to PATH: ${AWF_GOROOT}/bin"
      echo "export PATH=\"${AWF_GOROOT}/bin:\$PATH\"" >> "/host${SCRIPT_FILE}"
      echo "export GOROOT=\"${AWF_GOROOT}\"" >> "/host${SCRIPT_FILE}"
    fi
  fi
  # Configure npm global prefix to a writable directory (since /usr is read-only)
  # Preserve user-provided NPM_CONFIG_PREFIX if already set
  echo 'if [ -z "${NPM_CONFIG_PREFIX:-}" ]; then' >> "/host${SCRIPT_FILE}"
  echo '  export NPM_CONFIG_PREFIX="$HOME/.npm-global"' >> "/host${SCRIPT_FILE}"
  echo 'fi' >> "/host${SCRIPT_FILE}"
  echo 'mkdir -p "$NPM_CONFIG_PREFIX/bin" 2>/dev/null' >> "/host${SCRIPT_FILE}"
  echo 'export PATH="$NPM_CONFIG_PREFIX/bin:$PATH"' >> "/host${SCRIPT_FILE}"
  if [ "${AWF_REQUIRE_NODE:-}" = "1" ]; then
    cat >> "/host${SCRIPT_FILE}" << 'AWFEOF'
if [ -n "${GH_AW_NODE_BIN:-}" ] && [ -x "${GH_AW_NODE_BIN}" ]; then
  echo "[entrypoint] Node.js available via GH_AW_NODE_BIN: ${GH_AW_NODE_BIN}"
elif command -v node >/dev/null 2>&1; then
  echo "[entrypoint] Node.js available on PATH: $(command -v node)"
else
  echo "[entrypoint][ERROR] Copilot CLI requires Node.js, but 'node' is not available inside AWF chroot." >&2
  echo "[entrypoint][ERROR] Ensure Node.js is installed on the runner and reachable from PATH inside the chroot." >&2
  echo "[entrypoint][ERROR] If using setup-node or nvm, verify the install path is present and bind-mounted into /host." >&2
  echo "[entrypoint][ERROR] Example locations include /opt/hostedtoolcache/..., $HOME/work/_tool/..., and $HOME/.nvm/..." >&2
  echo "[entrypoint][ERROR] GH_AW_NODE_BIN=${GH_AW_NODE_BIN:-<unset>}" >&2
  echo "[entrypoint][ERROR] PATH=$PATH" >&2
  exit 127
fi
AWFEOF
  fi
  # If AWF_PREFLIGHT_BINARY is set, verify the named binary is reachable inside the
  # chroot before exec'ing the user command. This provides a fast, human-readable
  # diagnostic when the runner slot lacks the binary (e.g. codex not installed).
  if [ -n "${AWF_PREFLIGHT_BINARY:-}" ]; then
    # Validate the binary name: must start with an alphanumeric char or underscore,
    # then contain only [a-zA-Z0-9_.-] — prevents option injection (e.g. "-v")
    # and shell meta-characters in the generated chroot startup script.
    if [[ "${AWF_PREFLIGHT_BINARY}" =~ ^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$ ]]; then
      # Use "command -v -- <binary>" so the name is never parsed as an option.
      printf 'if ! command -v -- %s >/dev/null 2>&1; then\n' "${AWF_PREFLIGHT_BINARY}" >> "/host${SCRIPT_FILE}"
      printf '  echo "[entrypoint][ERROR] Required binary '"'"'%s'"'"' is not available inside AWF chroot." >&2\n' "${AWF_PREFLIGHT_BINARY}" >> "/host${SCRIPT_FILE}"
      printf '  echo "[entrypoint][ERROR] Ensure '"'"'%s'"'"' is installed on the runner and present in a PATH directory bind-mounted into /host." >&2\n' "${AWF_PREFLIGHT_BINARY}" >> "/host${SCRIPT_FILE}"
      printf '  echo "[entrypoint][ERROR] Standard bind-mounted PATH directories: /tmp/awf-runner-bin, /usr/local/bin, /usr/bin, /bin, /opt." >&2\n' >> "/host${SCRIPT_FILE}"
      printf '  exit 127\n' >> "/host${SCRIPT_FILE}"
      printf 'fi\n' >> "/host${SCRIPT_FILE}"
    else
      echo "[entrypoint][WARN] AWF_PREFLIGHT_BINARY='${AWF_PREFLIGHT_BINARY}' contains unsafe characters; skipping preflight check." >&2
    fi
  fi
  # Apply explicit chroot identity overrides inside the script runtime (after
  # capsh user-switch) so capsh does not clobber HOME/USER/LOGNAME.
  if [ -n "${CHROOT_HOME_OVERRIDE}" ]; then
    printf 'export HOME=%q\n' "${CHROOT_HOME_OVERRIDE}" >> "/host${SCRIPT_FILE}"
  fi
  if [ -n "${CHROOT_USER_OVERRIDE}" ]; then
    printf 'export USER=%q\n' "${CHROOT_USER_OVERRIDE}" >> "/host${SCRIPT_FILE}"
    printf 'export LOGNAME=%q\n' "${CHROOT_USER_OVERRIDE}" >> "/host${SCRIPT_FILE}"
  fi
  # Append the actual command arguments
  # Docker CMD passes commands as ['/bin/bash', '-c', 'command_string'].
  # Instead of writing the full [bash, -c, cmd] via printf '%q' (which creates
  # a nested bash -c layer), extract the command string and write it directly.
  # This eliminates an extra bash process layer that causes /proc/self/exe to
  # resolve as /bin/bash for runtimes like Java and .NET that check their own
  # process identity via /proc/self/exe.
  # Trust assumption: $3 comes from Docker CMD set by docker-manager.ts using
  # the user's own --allow-domains command. No additional sanitization needed.
  # We use $# -eq 3 (not -ge 3) intentionally: extra args beyond the command
  # string indicate a non-standard invocation that should fall back to printf.
  if [ "$1" = "/bin/bash" ] && [ "$2" = "-c" ] && [ $# -eq 3 ] && [ -n "$3" ]; then
    printf '%s\n' "$3" >> "/host${SCRIPT_FILE}"
  else
    printf '%q ' "$@" >> "/host${SCRIPT_FILE}"
    echo "" >> "/host${SCRIPT_FILE}"
  fi
  chmod +x "/host${SCRIPT_FILE}"
}

run_chroot_command() {
# If chroot mode is enabled, run user command INSIDE the chroot /host
# This provides transparent host binary access - user command sees host filesystem as /
  echo "[entrypoint] Chroot mode: running command inside host filesystem (/host)"

  mount_host_procfs
  mount_host_cgroupfs
  check_chroot_prereqs
  copy_preload_libs
  copy_browser_libs
  copy_agent_helper_scripts
  copy_dind_runner_binary
  ensure_usr_local_bin_shims
  copy_awf_ca_cert
  copy_system_ca_bundle
  setup_chroot_etc

  # Determine working directory inside the chroot
  # AWF_WORKDIR is set by docker-manager.ts (containerWorkDir or HOME)
  # For chroot mode, paths like /home/user stay the same (no /host prefix)
  CONTAINER_WORKDIR="${AWF_WORKDIR:-${HOME:-/}}"
  if [ -n "${CONTAINER_WORKDIR}" ] && [ "${CONTAINER_WORKDIR#/host}" != "${CONTAINER_WORKDIR}" ]; then
    # Strip /host prefix if present (for paths that include it)
    CHROOT_WORKDIR="${CONTAINER_WORKDIR#/host}"
    [ -z "${CHROOT_WORKDIR}" ] && CHROOT_WORKDIR="/"
  else
    # Use the path as-is (normal paths like /home/user, /tmp, etc.)
    CHROOT_WORKDIR="${CONTAINER_WORKDIR}"
  fi
  echo "[entrypoint] Chroot working directory: ${CHROOT_WORKDIR}"

  # Validate working directory exists in chroot
  if [ ! -d "/host${CHROOT_WORKDIR}" ]; then
    echo "[entrypoint][WARN] Working directory ${CHROOT_WORKDIR} does not exist on host, will use /"
  fi

  # Write the command to a temporary script file in the chroot
  # This avoids complex quoting issues with nested shells.
  # It lives under /run rather than /tmp because filesystem.allowWrite can
  # narrow the /tmp bind to read-only, which would make this write fail. /run
  # inside the chroot is the container's own writable rootfs, so it is always
  # writable regardless of the host write policy.
  mkdir -p /host/run 2>/dev/null || true
  SCRIPT_FILE="/run/awf-cmd-$$.sh"
  build_path_script "$@"

  # Execute inside chroot:
  # 1. chroot /host - filesystem root becomes host's /
  # 2. cd to the working directory
  # 3. Drop capabilities (NET_ADMIN and SYS_CHROOT)
  # 4. Run as the mapped user using capsh --user
  # 5. Clean up the script file and restore resolv.conf
  #
  # Note: We use capsh inside the chroot because it handles the privilege drop
  # and user switch atomically. The host must have capsh installed.

  # Build cleanup command that restores resolv.conf if it was modified
  # The backup path uses the chroot perspective (no /host prefix)
  CLEANUP_CMD="rm -f ${SCRIPT_FILE}"
  if [ "$RESOLV_MODIFIED" = "true" ]; then
    # Convert backup path from container perspective (/host/etc/...) to chroot perspective (/etc/...)
    CHROOT_RESOLV_BACKUP="${RESOLV_BACKUP#/host}"
    CLEANUP_CMD="${CLEANUP_CMD}; mv '${CHROOT_RESOLV_BACKUP}' /etc/resolv.conf 2>/dev/null || true"
    echo "[entrypoint] DNS configuration will be restored on exit"
  elif [ "$RESOLV_CREATED" = "true" ]; then
    # File was created by us; remove it on exit to leave no trace
    CLEANUP_CMD="${CLEANUP_CMD}; rm -f /etc/resolv.conf 2>/dev/null || true"
    echo "[entrypoint] DNS configuration will be removed on exit"
  fi
  if [ "$HOSTS_MODIFIED" = "true" ]; then
    # Remove the specific host.docker.internal line we added (runs inside chroot perspective)
    # Use a precise pattern to avoid accidentally removing unrelated entries
    CLEANUP_CMD="${CLEANUP_CMD}; sed -i '/^[0-9.]\\+[[:space:]]\\+host\\.docker\\.internal\$/d' /etc/hosts 2>/dev/null || true"
    echo "[entrypoint] host.docker.internal will be removed from /etc/hosts on exit"
  fi
  # Clean up /run/awf-lib if anything was copied (one-shot-token, CA cert, key helper, browser libs)
  if [ -n "${ONE_SHOT_TOKEN_LIB}" ] || [ -n "${AWF_CA_CHROOT}" ] || [ -n "${SYSTEM_CA_CHROOT}" ] || [ -n "${CHROOT_KEY_HELPER}" ] || [ -n "${STAGED_RUNNER_BINARY_CHROOT}" ] || [ -n "${BROWSER_LD_LIBRARY_PATH}" ]; then
    CLEANUP_CMD="${CLEANUP_CMD}; rm -rf /run/awf-lib 2>/dev/null || true"
  fi
  # NOTE: the /usr/local/bin overlay is torn down by cleanup_usr_local_bin_overlay(),
  # which is installed as an EXIT trap in the container's root shell — the chroot
  # shell exec's capsh below, so its EXIT trap never fires, and the bind mounts
  # must be unmounted with the capabilities the chroot user no longer has.

  # Transfer ownership of gh-aw config directories to the chroot user.
  # On self-hosted runners these directories are created by the host-side
  # gh-aw tooling as root, so the unprivileged chroot user cannot access them.
  # We use chown (not chmod a+rwX) to avoid making these dirs world-writable,
  # which would be a security risk on multi-user self-hosted runners.
  if [ -d /host/tmp/gh-aw ]; then
    if chown -R "${HOST_UID}:${HOST_GID}" /host/tmp/gh-aw 2>/dev/null; then
      echo "[entrypoint] Transferred /host/tmp/gh-aw ownership to chroot user (${HOST_UID}:${HOST_GID})"
    else
      echo "[entrypoint][WARN] Failed to transfer /host/tmp/gh-aw ownership to chroot user"
    fi
  fi
  # Handle safe-outputs directory (path varies by gh-aw version)
  if [ -n "${GH_AW_SAFE_OUTPUTS:-}" ]; then
    _so_dir="/host$(dirname "$GH_AW_SAFE_OUTPUTS")"
    if [ -d "$_so_dir" ]; then
      if chown -R "${HOST_UID}:${HOST_GID}" "$_so_dir" 2>/dev/null; then
        echo "[entrypoint] Transferred $_so_dir ownership to chroot user (${HOST_UID}:${HOST_GID})"
      else
        echo "[entrypoint][WARN] Failed to transfer $_so_dir ownership to chroot user"
      fi
    fi
  fi

  # Ensure ~/.gemini exists and is owned by the chroot user — only when Gemini is in use.
  # If Docker created this directory as root:root (because it did not exist on the
  # host at container start time), the Gemini CLI cannot write its project registry
  # (atomic rename of projects.json.tmp → projects.json fails with ENOENT).
  # AWF pre-creates this directory host-side in writeConfigs(), but on first run or
  # after a previous failed run the directory may still be root-owned.
  # We fix ownership here (as root, before privilege drop) as a defense-in-depth measure.
  # Skip entirely in non-Gemini runs (e.g. Copilot-only) to avoid spurious log entries.
  if [ -n "${AWF_GEMINI_ENABLED}" ]; then
    GEMINI_DIR="/host${HOME}/.gemini"
    mkdir -p "${GEMINI_DIR}" 2>/dev/null || true
    if chown "${HOST_UID}:${HOST_GID}" "${GEMINI_DIR}" 2>/dev/null; then
      echo "[entrypoint] Ensured ~/.gemini ownership for chroot user (${HOST_UID}:${HOST_GID})"
    else
      echo "[entrypoint][WARN] Could not set ~/.gemini ownership to chroot user (${HOST_UID}:${HOST_GID})"
    fi
  fi

  # Build LD_PRELOAD command for one-shot token protection
  LD_PRELOAD_CMD=""
  if [ -n "${ONE_SHOT_TOKEN_LIB}" ]; then
    LD_PRELOAD_CMD="export LD_PRELOAD=${ONE_SHOT_TOKEN_LIB};"
  fi

  # Build LD_LIBRARY_PATH command so Chromium/Playwright can resolve the
  # staged browser runtime libraries (see copy_browser_libs above).
  LD_LIBRARY_PATH_CMD=""
  if [ -n "${BROWSER_LD_LIBRARY_PATH}" ]; then
    LD_LIBRARY_PATH_CMD="export LD_LIBRARY_PATH=${BROWSER_LD_LIBRARY_PATH}\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH};"
  fi

  run_command_with_stdout run_agent_with_token_protection chroot /host /bin/bash -c "
    cd '${CHROOT_WORKDIR}' 2>/dev/null || cd / 2>/dev/null || true
    trap '${CLEANUP_CMD}' EXIT
    ${LD_PRELOAD_CMD}
    ${LD_LIBRARY_PATH_CMD}
    exec capsh --drop=${CAPS_TO_DROP} ${CAPSH_IDENTITY_ARGS} -- -c 'exec ${SCRIPT_FILE}'
  "
}

run_non_chroot_command() {
  # Original behavior - run in container filesystem
  # Drop capabilities and privileges, then execute the user command

  # Activate gh CLI proxy wrapper in non-chroot mode.
  # Copy the wrapper to /run/awf-lib/gh so it takes precedence over
  # the system gh at /usr/bin/gh (since /run/awf-lib is prepended to PATH).
  if [ -n "$AWF_CLI_PROXY_URL" ] && [ -f /usr/local/bin/gh-cli-proxy-wrapper.sh ]; then
    mkdir -p /run/awf-lib
    if cp /usr/local/bin/gh-cli-proxy-wrapper.sh /run/awf-lib/gh 2>/dev/null && \
       chmod +x /run/awf-lib/gh 2>/dev/null; then
      export PATH="/run/awf-lib:${PATH}"
      echo "[entrypoint] gh CLI proxy wrapper installed at /run/awf-lib/gh"
    else
      # The CLI proxy is enabled, so an unwrapped gh would bypass credential
      # mediation entirely. Fail closed rather than silently downgrade.
      echo "[entrypoint][ERROR] Could not install gh CLI proxy wrapper at /run/awf-lib/gh" >&2
      echo "[entrypoint][ERROR] Refusing to start with an unmediated gh CLI" >&2
      exit 1
    fi
  fi

  # This prevents malicious code from modifying iptables rules or using chroot
  # Security note: capsh --drop removes capabilities from the bounding set,
  # preventing any process (even if it escalates to root) from acquiring them
  # The order of operations:
  # 1. capsh drops capabilities from the bounding set (cannot be regained)
  # 2. gosu switches to awfuser (drops root privileges)
  # 3. Execute the user command (NOT using exec, so we can unset tokens after)
  #
  # Enable one-shot token protection - tokens are cached in memory and
  # unset from the environment so /proc/self/environ is cleared
  export LD_PRELOAD=/usr/local/lib/one-shot-token.so

  if [ -n "$CAPS_TO_DROP" ]; then
    run_command_with_stdout run_agent_with_token_protection capsh --drop=$CAPS_TO_DROP -- -c "exec gosu awfuser $(printf '%q ' "$@")"
  else
    # No capabilities to drop - just switch to unprivileged user
    run_command_with_stdout run_agent_with_token_protection gosu awfuser "$@"
  fi
}

main() {
configure_output_routing
print_banner
setup_user_identity
configure_dns
configure_ssl_certs
wait_for_iptables
check_service_health
configure_claude_api_key
configure_jvm_proxy
warn_codex_auto_model
log_environment_details
determine_capabilities_to_drop
log_execution_context "$@"
if [ -n "${AWF_AGENT_RUNTIME_START_FILE:-}" ] && [ ! -f "$AWF_AGENT_RUNTIME_START_FILE" ]; then
  runtime_dir="$(dirname "$AWF_AGENT_RUNTIME_START_FILE")"
  runtime_started_at_ms="$(date +%s%3N)"
  if mkdir -p "$runtime_dir" &&
    [[ "$runtime_started_at_ms" =~ ^[0-9]+$ ]] &&
    printf '%s\n' "$runtime_started_at_ms" > "$AWF_AGENT_RUNTIME_START_FILE" &&
    chmod 0444 "$AWF_AGENT_RUNTIME_START_FILE" &&
    chmod 0555 "$runtime_dir"; then
    echo "[entrypoint] Agent runtime start recorded for timeout steering"
  else
    echo "[entrypoint][WARN] Could not record agent runtime start for timeout steering"
  fi
fi
if [ "${AWF_CHROOT_ENABLED}" = "true" ]; then
  run_chroot_command "$@"
else
  run_non_chroot_command "$@"
fi
}

if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
main "$@"
fi