#!/usr/bin/env bash
set -euo pipefail
command -v codex >/dev/null 2>&1 || {
  printf 'codex is not on PATH\n' >&2
  exit 127
}

run_root=/tmp/codex-work
mkdir -p "$run_root"
run_tmp=$(mktemp -d "$run_root/session-XXXXXXXX")
readonly run_tmp

cleanup() {
  run_status=$?
  trap - EXIT
  if rm -rf -- "$run_tmp"; then
    printf 'Cleaned session directory: %s\n' "$run_tmp" >&2
  else
    printf 'Cleanup failed: %s\n' "$run_tmp" >&2
    if [ "$run_status" -eq 0 ]; then
      run_status=1
    fi
  fi
  exit "$run_status"
}
trap cleanup EXIT

export TMPDIR="$run_tmp"
printf 'Session directory: %s\n' "$run_tmp" >&2
codex --no-daemon --sandbox workspace-write \
  --add-dir "$run_tmp" \
  -c "shell_environment_policy.set.TMPDIR=\"$run_tmp\"" \
  "$@"