agentbox.sh

#!/bin/bash
# Agentbox Quick Connect Script
# Auto-generated by Oracle Cloud deployment

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

# Instance configuration - updated by provision-oci.sh
AGENTBOX_IP=""
AGENTBOX_USER="opc"
SSH_KEY="$HOME/.ssh/agentbox_key"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

usage() {
    cat << EOF
${CYAN}Agentbox - Oracle Cloud ARM Instance Manager${NC}

Usage: $0 <command> [options]

Remote operator commands:
  ${GREEN}ssh${NC}              Connect via SSH
  ${GREEN}vnc${NC}              Open VNC tunnel (localhost:5901)
  ${GREEN}browser${NC}          Open browser tunnels (VNC + Chrome DevTools)
  ${GREEN}code${NC}             Open code-server tunnel (localhost:8080)
  ${GREEN}api${NC}              Open Management API tunnel (localhost:9090)
  ${GREEN}all${NC}              Open all tunnels (VNC, code-server, API, CDP)
  ${GREEN}status${NC}           Check instance status
  ${GREEN}provision${NC}        Provision new instance [--target oci|fly|hetzner|bare] (default: oci)
  ${GREEN}ip${NC}               Show instance IP
  ${GREEN}setup${NC}            Run initial setup on instance
  ${GREEN}start-browser${NC}    Start visible browser on remote (for agent-browser)
  ${GREEN}backup${NC}           Backup named volumes and config to a tarball
  ${GREEN}restore${NC}          Restore named volumes and config from a tarball

Local lifecycle commands:
  ${GREEN}up${NC}               Start the Docker stack [--build: nix build + docker load first] [--registry: use AGENTBOX_IMAGE_REF from env]
  ${GREEN}down${NC}             Stop the Docker stack [--volumes: also remove volumes (confirms)]
  ${GREEN}build${NC}            Build the Nix image [--variant runtime|desktop|full]
  ${GREEN}rebuild${NC}          Full dev-loop cycle: down + build + up --build
  ${GREEN}logs${NC}             Follow logs [service: supervisorctl tail, else compose logs]
  ${GREEN}shell${NC}            Open shell in container [profile: zellij layout in that profile]
  ${GREEN}health${NC}           Show service health [--json: raw JSON output]

Options:
  -i, --ip IP      Override instance IP
  -h, --help       Show this help

Examples:
  $0 ssh                    # Connect via SSH
  $0 vnc                    # Start VNC tunnel, then connect to vnc://localhost:5901
  $0 all                    # Start all tunnels
  $0 provision --loop                   # OCI (default), keep retrying
  $0 provision --target oci --loop     # Explicit OCI target
  $0 provision --target bare --host ubuntu@192.168.1.10
  $0 backup                 # Create timestamped backup in ./backups/
  $0 backup --out /tmp/snap.tgz --include-secrets
  $0 restore ./backups/agentbox-backup-20260101T000000Z.tgz
  $0 restore ./backups/agentbox-backup-20260101T000000Z.tgz --force
  $0 up                     # Start stack, poll health, print summary
  $0 up --build             # Nix build + docker load, then start
  $0 up --registry          # Use AGENTBOX_IMAGE_REF from env (must be set; registry image)
  $0 down                   # Stop stack
  $0 down --volumes         # Stop stack and remove volumes (destructive, confirms)
  $0 build --variant full   # Build the full image without loading it
  $0 rebuild                # down + build + up (dev-loop iteration)
  $0 logs                   # Follow all service logs
  $0 logs management-api    # Follow a specific service via supervisorctl
  $0 shell                  # bash in the agentbox container
  $0 shell ruflo-orchestrator  # zellij layout for a profile
  $0 health                 # Pretty-print service health
  $0 health --json          # Raw JSON health response

EOF
}

check_ip() {
    if [[ -z "$AGENTBOX_IP" ]]; then
        # Try to read from cached IP
        if [[ -f /tmp/agentbox-ip.txt ]]; then
            AGENTBOX_IP=$(cat /tmp/agentbox-ip.txt)
        else
            echo -e "${RED}Error: No instance IP configured.${NC}"
            echo "Run: $0 provision"
            exit 1
        fi
    fi
}

cmd_ssh() {
    check_ip
    echo -e "${CYAN}Connecting to agentbox@${AGENTBOX_IP}...${NC}"
    ssh -i "$SSH_KEY" -o StrictHostKeyChecking=accept-new "$AGENTBOX_USER@$AGENTBOX_IP" "$@"
}

cmd_vnc() {
    check_ip
    echo -e "${CYAN}Starting VNC tunnel to ${AGENTBOX_IP}:5901...${NC}"
    echo -e "${GREEN}Connect to: vnc://localhost:5901${NC}"
    ssh -i "$SSH_KEY" -N -L 5901:localhost:5901 "$AGENTBOX_USER@$AGENTBOX_IP"
}

cmd_code() {
    check_ip
    echo -e "${CYAN}Starting code-server tunnel to ${AGENTBOX_IP}:8080...${NC}"
    echo -e "${GREEN}Open: http://localhost:8080${NC}"
    ssh -i "$SSH_KEY" -N -L 8080:localhost:8080 "$AGENTBOX_USER@$AGENTBOX_IP"
}

cmd_api() {
    check_ip
    echo -e "${CYAN}Starting Management API tunnel to ${AGENTBOX_IP}:9090...${NC}"
    echo -e "${GREEN}Open: http://localhost:9090${NC}"
    ssh -i "$SSH_KEY" -N -L 9090:localhost:9090 "$AGENTBOX_USER@$AGENTBOX_IP"
}

cmd_browser() {
    check_ip
    echo -e "${CYAN}Starting browser automation tunnels to ${AGENTBOX_IP}...${NC}"
    echo -e "${GREEN}VNC Desktop:     vnc://localhost:5901${NC}"
    echo -e "${GREEN}Chrome DevTools: http://localhost:9222${NC}"
    echo ""
    echo -e "${YELLOW}Usage:${NC}"
    echo "  1. Start browser on remote: $0 start-browser"
    echo "  2. Use agent-browser locally: agent-browser open https://example.com"
    echo ""
    ssh -i "$SSH_KEY" -o StrictHostKeyChecking=accept-new -N \
        -L 5901:localhost:5901 \
        -L 9222:localhost:9222 \
        "$AGENTBOX_USER@$AGENTBOX_IP"
}

cmd_all() {
    check_ip
    echo -e "${CYAN}Starting all tunnels to ${AGENTBOX_IP}...${NC}"
    echo -e "${GREEN}VNC Desktop:     vnc://localhost:5901${NC}"
    echo -e "${GREEN}code-server:     http://localhost:8080${NC}"
    echo -e "${GREEN}Management API:  http://localhost:9090${NC}"
    echo -e "${GREEN}Chrome DevTools: http://localhost:9222${NC}"
    echo ""
    ssh -i "$SSH_KEY" -o StrictHostKeyChecking=accept-new -N \
        -L 5901:localhost:5901 \
        -L 8080:localhost:8080 \
        -L 9090:localhost:9090 \
        -L 9222:localhost:9222 \
        "$AGENTBOX_USER@$AGENTBOX_IP"
}

cmd_status() {
    check_ip
    echo -e "${CYAN}Checking agentbox status...${NC}"
    ssh -i "$SSH_KEY" -o ConnectTimeout=5 "$AGENTBOX_USER@$AGENTBOX_IP" \
        "uptime && free -h && df -h / && docker ps 2>/dev/null | head -5 || true" 2>&1 || \
        echo -e "${RED}Instance unreachable${NC}"
}

cmd_ip() {
    check_ip
    echo "$AGENTBOX_IP"
}

cmd_provision() {
    local target="oci"
    local passthrough=()

    while [[ $# -gt 0 ]]; do
        case $1 in
            --target) target="$2"; shift 2 ;;
            *) passthrough+=("$1"); shift ;;
        esac
    done

    local provisioner="$SCRIPT_DIR/scripts/provision-${target}.sh"

    case "$target" in
        oci|fly|hetzner|bare) ;;
        *)
            echo -e "${RED}Unknown provisioning target: ${target}${NC}"
            echo "Available targets: oci, fly, hetzner, bare"
            echo "Usage: $0 provision [--target <target>] [target-specific options]"
            exit 1
            ;;
    esac

    if [[ ! -f "$provisioner" ]]; then
        echo -e "${RED}Provisioner not found: ${provisioner}${NC}"
        exit 1
    fi

    exec "$provisioner" "${passthrough[@]+"${passthrough[@]}"}"
}

cmd_start_browser() {
    check_ip
    echo -e "${CYAN}Starting visible browser on ${AGENTBOX_IP}...${NC}"
    ssh -i "$SSH_KEY" -o StrictHostKeyChecking=accept-new "$AGENTBOX_USER@$AGENTBOX_IP" \
        'export DISPLAY=:1; chromium --no-sandbox --remote-debugging-port=9222 --user-data-dir=$HOME/.config/chromium-automation --window-size=1920,1080 --disable-gpu &'
    echo -e "${GREEN}Browser started with Chrome DevTools on port 9222${NC}"
    echo ""
    echo "Now run: $0 browser"
    echo "Then:    agent-browser open https://example.com"
}

# ---------------------------------------------------------------------------
# backup / restore helpers
# ---------------------------------------------------------------------------

# Dump a single named Docker volume into a tar stream via a throw-away alpine
# helper container.  Caller receives the stream on stdout.
_volume_tar() {
    local volume_name="$1"
    docker run --rm \
        -v "${volume_name}:/data:ro" \
        alpine:3.20 \
        tar -C /data -cf - .
}

# Restore a tar stream (from stdin) into a named Docker volume.
_volume_untar() {
    local volume_name="$1"
    docker run --rm -i \
        -v "${volume_name}:/data" \
        alpine:3.20 \
        sh -c 'tar -C /data -xf -'
}

# Return 0 iff the agentbox.toml pods adapter is backed by local storage
# under /var/lib/solid (local-jss legacy stub or local-solid-rs first-class
# Rust server). Both use the same volume and must be captured in backups —
# omitting local-solid-rs was an operator-facing data-loss risk.
_solid_is_local() {
    local toml="${SCRIPT_DIR}/agentbox.toml"
    [[ -f "$toml" ]] && \
      grep -qE '^\s*pods\s*=\s*"(local-jss|local-solid-rs)"' "$toml"
}

cmd_backup() {
    local out="" include_secrets=0
    while [[ $# -gt 0 ]]; do
        case $1 in
            --out)       out="$2";        shift 2 ;;
            --include-secrets) include_secrets=1; shift ;;
            *) echo -e "${RED}Unknown backup option: $1${NC}"; exit 1 ;;
        esac
    done

    local timestamp
    timestamp=$(date -u +%Y%m%dT%H%M%SZ)

    if [[ -z "$out" ]]; then
        mkdir -p "${SCRIPT_DIR}/backups"
        out="${SCRIPT_DIR}/backups/agentbox-backup-${timestamp}.tgz"
    fi

    local work
    work=$(mktemp -d)
    trap 'rm -rf "$work"' EXIT

    echo -e "${CYAN}Backing up agentbox volumes and config...${NC}"

    # -- ruvector-data (always) -----------------------------------------------
    echo -e "  ${GREEN}+${NC} ruvector-data"
    mkdir -p "${work}/volumes/ruvector-data"
    _volume_tar agentbox-ruvector-data | tar -C "${work}/volumes/ruvector-data" -xf - 2>/dev/null || true

    # -- solid-data (when pods ∈ {local-jss, local-solid-rs}) -----------------
    # Both the legacy Python stub and the first-class solid-pod-rs Rust
    # server (ADR-010) store under /var/lib/solid. See docs/user/backup-restore.md.
    local solid_included=0
    if _solid_is_local; then
        echo -e "  ${GREEN}+${NC} solid-data"
        mkdir -p "${work}/volumes/solid-data"
        _volume_tar agentbox-solid-data | tar -C "${work}/volumes/solid-data" -xf - 2>/dev/null || true
        solid_included=1
    fi

    # -- sovereign-identities (only with --include-secrets) -------------------
    local secrets_included=0
    if [[ "$include_secrets" -eq 1 ]]; then
        echo -e "  ${YELLOW}+${NC} sovereign-identities (secrets included)"
        mkdir -p "${work}/volumes/sovereign-identities"
        _volume_tar agentbox-sovereign-identities | tar -C "${work}/volumes/sovereign-identities" -xf - 2>/dev/null || true
        secrets_included=1
    fi

    # -- agentbox.toml --------------------------------------------------------
    if [[ -f "${SCRIPT_DIR}/agentbox.toml" ]]; then
        echo -e "  ${GREEN}+${NC} agentbox.toml"
        cp "${SCRIPT_DIR}/agentbox.toml" "${work}/agentbox.toml"
    fi

    # -- supervisord.conf from running container (best-effort) ----------------
    if docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^agentbox$'; then
        echo -e "  ${GREEN}+${NC} supervisord.conf"
        docker cp agentbox:/etc/supervisord.conf "${work}/supervisord.conf" 2>/dev/null || true
    fi

    # -- workspace/profiles (bind-mount path) — exclude secrets by default ---
    local profiles_dir="${SCRIPT_DIR}/workspace/profiles"
    if [[ -d "$profiles_dir" ]]; then
        echo -e "  ${GREEN}+${NC} workspace/profiles (mgmt-keys $([ "$include_secrets" -eq 1 ] && echo 'INCLUDED' || echo 'excluded'))"
        if [[ "$include_secrets" -eq 1 ]]; then
            cp -a "$profiles_dir" "${work}/profiles"
        else
            # Exclude key/pem/env/mgmt-key files
            rsync -a \
                --exclude='*.key' \
                --exclude='*.pem' \
                --exclude='*.env' \
                --exclude='mgmt-key' \
                "${profiles_dir}/" "${work}/profiles/" 2>/dev/null || \
            tar -C "${profiles_dir}" \
                --exclude='*.key' --exclude='*.pem' --exclude='*.env' --exclude='mgmt-key' \
                -cf - . | tar -C "${work}/profiles" -xf - 2>/dev/null || true
        fi
    fi

    # -- MANIFEST.json --------------------------------------------------------
    local file_count total_size
    file_count=$(find "${work}" -type f | wc -l)
    total_size=$(du -sh "${work}" 2>/dev/null | cut -f1 || echo "unknown")

    cat > "${work}/MANIFEST.json" <<EOF
{
  "version": "1",
  "timestamp": "${timestamp}",
  "include_secrets": ${include_secrets},
  "solid_included": ${solid_included},
  "contents": {
    "ruvector_data": true,
    "solid_data": ${solid_included},
    "sovereign_identities": ${secrets_included},
    "agentbox_toml": $([ -f "${work}/agentbox.toml" ] && echo true || echo false),
    "supervisord_conf": $([ -f "${work}/supervisord.conf" ] && echo true || echo false),
    "profiles": $([ -d "${work}/profiles" ] && echo true || echo false)
  },
  "exclusions": {
    "default": ["*.key", "*.pem", "*.env", "mgmt-key", "sovereign-identities"],
    "secrets_flag_required": ["sovereign-identities", "mgmt-key"]
  }
}
EOF

    # Recount after manifest is written
    file_count=$(find "${work}" -type f | wc -l)

    # -- pack -----------------------------------------------------------------
    tar -C "${work}" -czf "${out}" .

    local archive_size
    archive_size=$(du -sh "${out}" 2>/dev/null | cut -f1 || echo "unknown")

    echo ""
    echo -e "${GREEN}Backup complete${NC}"
    echo -e "  Archive : ${out}"
    echo -e "  Files   : ${file_count}"
    echo -e "  Size    : ${archive_size}"
    echo -e "  Secrets : $([ "$include_secrets" -eq 1 ] && echo 'INCLUDED' || echo 'excluded (use --include-secrets to include)')"

    trap - EXIT
    rm -rf "$work"
}

cmd_restore() {
    local tarfile="" force=0
    while [[ $# -gt 0 ]]; do
        case $1 in
            --force) force=1; shift ;;
            -*)      echo -e "${RED}Unknown restore option: $1${NC}"; exit 1 ;;
            *)       tarfile="$1"; shift ;;
        esac
    done

    if [[ -z "$tarfile" ]]; then
        echo -e "${RED}Usage: $0 restore <tarfile> [--force]${NC}"
        exit 1
    fi

    if [[ ! -f "$tarfile" ]]; then
        echo -e "${RED}Archive not found: ${tarfile}${NC}"
        exit 1
    fi

    local work
    work=$(mktemp -d)
    trap 'rm -rf "$work"' EXIT

    # -- unpack ---------------------------------------------------------------
    echo -e "${CYAN}Unpacking archive...${NC}"
    tar -C "${work}" -xzf "${tarfile}"

    # -- validate manifest ----------------------------------------------------
    if [[ ! -f "${work}/MANIFEST.json" ]]; then
        echo -e "${RED}Invalid archive: missing MANIFEST.json${NC}"
        exit 1
    fi

    local manifest_ts manifest_version
    manifest_version=$(jq -r '.version // "unknown"' "${work}/MANIFEST.json")
    manifest_ts=$(jq -r '.timestamp // "unknown"'   "${work}/MANIFEST.json")

    echo -e "  Manifest version : ${manifest_version}"
    echo -e "  Backup timestamp : ${manifest_ts}"
    echo ""

    # -- confirm --------------------------------------------------------------
    if [[ "$force" -eq 0 ]]; then
        echo -e "${YELLOW}WARNING: This will overwrite the following named volumes:${NC}"
        jq -r '
          .contents | to_entries[]
          | select(.value == true)
          | "  - " + .key
        ' "${work}/MANIFEST.json"
        echo ""
        printf "Proceed? [y/N] "
        read -r answer
        case "$answer" in
            y|Y|yes|YES) ;;
            *) echo "Aborted."; exit 0 ;;
        esac
    fi

    # -- stop stack -----------------------------------------------------------
    echo -e "${CYAN}Stopping stack...${NC}"
    docker compose -f "${SCRIPT_DIR}/docker-compose.yml" down 2>/dev/null || true

    # -- restore volumes ------------------------------------------------------
    if [[ -d "${work}/volumes/ruvector-data" ]]; then
        echo -e "  ${GREEN}*${NC} Restoring ruvector-data"
        docker volume create agentbox-ruvector-data 2>/dev/null || true
        tar -C "${work}/volumes/ruvector-data" -cf - . | _volume_untar agentbox-ruvector-data
    fi

    if [[ -d "${work}/volumes/solid-data" ]]; then
        echo -e "  ${GREEN}*${NC} Restoring solid-data"
        docker volume create agentbox-solid-data 2>/dev/null || true
        tar -C "${work}/volumes/solid-data" -cf - . | _volume_untar agentbox-solid-data
    fi

    if [[ -d "${work}/volumes/sovereign-identities" ]]; then
        echo -e "  ${YELLOW}*${NC} Restoring sovereign-identities"
        docker volume create agentbox-sovereign-identities 2>/dev/null || true
        tar -C "${work}/volumes/sovereign-identities" -cf - . | _volume_untar agentbox-sovereign-identities
    fi

    # -- restore agentbox.toml ------------------------------------------------
    if [[ -f "${work}/agentbox.toml" ]]; then
        echo -e "  ${GREEN}*${NC} Restoring agentbox.toml"
        cp "${work}/agentbox.toml" "${SCRIPT_DIR}/agentbox.toml"
    fi

    # -- restore profiles (bind mount) ----------------------------------------
    if [[ -d "${work}/profiles" ]]; then
        local profiles_dest="${SCRIPT_DIR}/workspace/profiles"
        echo -e "  ${GREEN}*${NC} Restoring workspace/profiles"
        mkdir -p "${profiles_dest}"
        rsync -a "${work}/profiles/" "${profiles_dest}/" 2>/dev/null || \
        tar -C "${work}/profiles" -cf - . | tar -C "${profiles_dest}" -xf -
    fi

    # -- restart stack --------------------------------------------------------
    echo -e "${CYAN}Restarting stack...${NC}"
    docker compose -f "${SCRIPT_DIR}/docker-compose.yml" up -d

    echo ""
    echo -e "${GREEN}Restore complete.${NC}"

    trap - EXIT
    rm -rf "$work"
}

# ---------------------------------------------------------------------------
# local lifecycle commands
# ---------------------------------------------------------------------------

READY_URL="http://localhost:9090/ready"
LIVE_URL="http://localhost:9090/livez"
HEALTH_URL="http://localhost:9090/health"
COMPOSE_FILE="${SCRIPT_DIR}/docker-compose.yml"

cmd_up() {
    local do_build=0
    local do_registry=0
    local wait_live=0
    while [[ $# -gt 0 ]]; do
        case $1 in
            --build)     do_build=1;    shift ;;
            --registry)  do_registry=1; shift ;;
            --wait-live) wait_live=1;   shift ;;
            -h|--help)  echo "Usage: $0 up [--build | --registry] [--wait-live]"; return 0 ;;
            *) echo -e "${RED}Unknown option: $1${NC}"; exit 1 ;;
        esac
    done

    # Mutual exclusion
    if [[ "$do_build" -eq 1 && "$do_registry" -eq 1 ]]; then
        echo -e "${RED}ERROR: --build and --registry are mutually exclusive.${NC}"
        echo "Use --build to compile a local image, or --registry to use a pre-pulled registry image."
        exit 1
    fi

    if [[ "$do_build" -eq 1 ]]; then
        echo -e "${CYAN}Building Nix runtime image...${NC}"
        nix build .#runtime
        echo -e "${CYAN}Loading image into Docker...${NC}"
        docker load < result
        # Unset any pre-existing override so compose uses the default local tag
        unset AGENTBOX_IMAGE_REF
    fi

    if [[ "$do_registry" -eq 1 ]]; then
        if [[ -z "${AGENTBOX_IMAGE_REF:-}" ]]; then
            echo -e "${RED}ERROR: --registry requires AGENTBOX_IMAGE_REF to be set in the environment.${NC}"
            echo "Example: export AGENTBOX_IMAGE_REF=ghcr.io/dreamlab-ai/agentbox:latest"
            exit 1
        fi
    fi

    # Resolve the image reference that compose will actually use, mirroring the
    # shell-expansion default in the generated docker-compose.yml.
    local system_tag
    system_tag=$(docker version --format '{{.Server.Os}}/{{.Server.Arch}}' 2>/dev/null \
                 | sed 's|linux/amd64|x86_64-linux|;s|linux/arm64|aarch64-linux|' \
                 || echo "runtime")
    local resolved_ref="${AGENTBOX_IMAGE_REF:-agentbox:runtime-${system_tag}}"
    echo -e "${CYAN}using image: ${resolved_ref}${NC}"

    echo -e "${CYAN}Starting Docker stack...${NC}"
    docker compose -f "${COMPOSE_FILE}" up -d

    if [[ "$wait_live" -eq 1 ]]; then
        # Quick liveness-only wait — process alive and event loop responsive
        local live_deadline=$(( $(date +%s) + 30 ))
        local live_ok=0
        echo -e "${CYAN}Waiting for liveness at ${LIVE_URL}...${NC}"
        while [[ $(date +%s) -lt $live_deadline ]]; do
            if curl -sf "${LIVE_URL}" >/dev/null 2>&1; then
                live_ok=1
                break
            fi
            sleep 2
        done
        if [[ "$live_ok" -eq 0 ]]; then
            echo -e "${RED}ERROR: Liveness check timed out after 30s (${LIVE_URL}).${NC}"
            echo "Check logs with: $0 logs"
            exit 1
        fi
        echo -e "${GREEN}Process is live.${NC}"
        return 0
    fi

    # Full readiness wait — up to 120s (bootstrap + adapter connect can take time)
    local deadline=$(( $(date +%s) + 120 ))
    local ready=0
    echo -e "${CYAN}Waiting for /ready at ${READY_URL}...${NC}"
    while [[ $(date +%s) -lt $deadline ]]; do
        if curl -sf "${READY_URL}" >/dev/null 2>&1; then
            ready=1
            break
        fi
        sleep 2
    done

    if [[ "$ready" -eq 0 ]]; then
        echo -e "${RED}ERROR: Readiness check timed out after 120s (${READY_URL}).${NC}"
        echo "Check logs with: $0 logs"
        exit 1
    fi

    echo ""
    echo -e "${GREEN}Stack is up and ready.${NC}"
    echo -e "  ${GREEN}Management API :${NC} http://localhost:9090"
    echo -e "  ${GREEN}Prometheus     :${NC} http://localhost:9091/metrics"
    echo -e "  ${GREEN}Logs           :${NC} $0 logs"
    echo -e "  ${GREEN}Shell          :${NC} $0 shell"
}

cmd_down() {
    local remove_volumes=0
    while [[ $# -gt 0 ]]; do
        case $1 in
            --volumes) remove_volumes=1; shift ;;
            -h|--help) echo "Usage: $0 down [--volumes]"; return 0 ;;
            *) echo -e "${RED}Unknown option: $1${NC}"; exit 1 ;;
        esac
    done

    if [[ "$remove_volumes" -eq 1 ]]; then
        echo -e "${YELLOW}WARNING: --volumes will permanently delete all named volumes.${NC}"
        printf "Proceed? [y/N] "
        read -r answer
        case "$answer" in
            y|Y|yes|YES) ;;
            *) echo "Aborted."; exit 0 ;;
        esac
    fi

    local flags=""
    [[ "$remove_volumes" -eq 1 ]] && flags="-v"

    echo -e "${CYAN}Stopping Docker stack...${NC}"
    # shellcheck disable=SC2086
    docker compose -f "${COMPOSE_FILE}" down $flags

    echo ""
    echo -e "${GREEN}Stack stopped.${NC}"
    [[ "$remove_volumes" -eq 1 ]] && echo -e "  ${YELLOW}Named volumes removed.${NC}"
}

cmd_build() {
    local variant="runtime"
    while [[ $# -gt 0 ]]; do
        case $1 in
            --variant) variant="$2"; shift 2 ;;
            -h|--help) echo "Usage: $0 build [--variant runtime|desktop|full]"; return 0 ;;
            *) echo -e "${RED}Unknown option: $1${NC}"; exit 1 ;;
        esac
    done

    case "$variant" in
        runtime|desktop|full) ;;
        *) echo -e "${RED}Unknown variant: ${variant}. Use runtime, desktop, or full.${NC}"; exit 1 ;;
    esac

    echo -e "${CYAN}Building Nix image variant: ${variant}...${NC}"
    nix build ".#${variant}"

    local result_path
    result_path=$(readlink -f result 2>/dev/null || echo "./result")

    echo ""
    echo -e "${GREEN}Build complete.${NC}"
    echo -e "  Variant : ${variant}"
    echo -e "  Result  : ${result_path}"
    echo ""
    echo "To load into Docker:"
    echo "  docker load < result"
    echo "Or use: $0 up --build"
}

cmd_rebuild() {
    if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
        echo "Usage: $0 rebuild"
        echo "Equivalent to: down + build --variant runtime + up --build"
        return 0
    fi

    echo -e "${CYAN}=== Rebuild: stopping stack ===${NC}"
    cmd_down

    echo -e "${CYAN}=== Rebuild: building runtime image ===${NC}"
    cmd_build --variant runtime

    echo -e "${CYAN}=== Rebuild: starting stack ===${NC}"
    cmd_up --build
}

cmd_logs() {
    local service="${1:-}"
    if [[ "$service" == "-h" || "$service" == "--help" ]]; then
        echo "Usage: $0 logs [service]"
        return 0
    fi

    if [[ -z "$service" ]]; then
        docker compose -f "${COMPOSE_FILE}" logs -f --tail 100
        return
    fi

    # Try supervisorctl inside the running container first
    if docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^agentbox$'; then
        echo -e "${CYAN}Following supervisorctl log for: ${service}${NC}"
        docker exec agentbox supervisorctl tail -f "${service}" 2>/dev/null && return
        echo -e "${YELLOW}supervisorctl unavailable for '${service}', falling back to compose logs...${NC}"
    fi

    docker compose -f "${COMPOSE_FILE}" logs -f "${service}"
}

cmd_shell() {
    local profile="${1:-}"
    if [[ "$profile" == "-h" || "$profile" == "--help" ]]; then
        echo "Usage: $0 shell [profile]"
        return 0
    fi

    if [[ -z "$profile" ]]; then
        docker exec -it agentbox bash
        return
    fi

    # Try zellij layout for the profile; fall back to bash in the profile directory
    if docker exec agentbox which zellij >/dev/null 2>&1; then
        docker exec -it agentbox bash -c \
            "cd /workspace/profiles/${profile} && exec zellij --layout agentbox"
    else
        echo -e "${YELLOW}zellij not found in container; opening bash in profile directory.${NC}"
        docker exec -it agentbox bash -c "cd /workspace/profiles/${profile} && exec bash"
    fi
}

cmd_health() {
    local as_json=0
    while [[ $# -gt 0 ]]; do
        case $1 in
            --json) as_json=1; shift ;;
            -h|--help) echo "Usage: $0 health [--json]"; return 0 ;;
            *) echo -e "${RED}Unknown option: $1${NC}"; exit 1 ;;
        esac
    done

    local response
    response=$(curl -sf "${HEALTH_URL}" 2>/dev/null) || {
        echo -e "${RED}ERROR: Could not reach ${HEALTH_URL}${NC}"
        echo "Is the stack running? Try: $0 up"
        exit 1
    }

    if [[ "$as_json" -eq 1 ]]; then
        printf '%s\n' "$response"
        exit 0
    fi

    # Pretty-print; fall back gracefully if jq is absent
    if command -v jq >/dev/null 2>&1; then
        local degraded
        degraded=$(printf '%s' "$response" | jq -r '
            .services // {} | to_entries[] |
            select(.value.status == "degraded" or .value.status == "failed") |
            .key
        ' 2>/dev/null || true)

        echo -e "${CYAN}Agentbox service health${NC}"
        printf '%s' "$response" | jq -r '
            .adapters // {} | to_entries[] |
            "  adapter/\(.key): \(.value)"
        ' 2>/dev/null | while IFS= read -r line; do
            if printf '%s' "$line" | grep -qE '(degraded|failed)'; then
                echo -e "${RED}${line}${NC}"
            else
                echo -e "${GREEN}${line}${NC}"
            fi
        done

        if [[ -n "$degraded" ]]; then
            echo ""
            echo -e "${RED}Degraded/failed services: ${degraded}${NC}"
        fi

        # Show observability metrics endpoint from /v1/meta
        local meta_response metrics_endpoint
        meta_response=$(curl -sf "http://localhost:9090/v1/meta" 2>/dev/null) || true
        if [[ -n "$meta_response" ]]; then
            metrics_endpoint=$(printf '%s' "$meta_response" | jq -r '.observability.metrics_endpoint // empty' 2>/dev/null || true)
            if [[ -n "$metrics_endpoint" ]]; then
                echo ""
                echo -e "${CYAN}Metrics endpoint: ${metrics_endpoint}${NC}"
                # Print first 5 non-comment lines from the metrics endpoint
                local metrics_out
                metrics_out=$(curl -sf "${metrics_endpoint}" 2>/dev/null | grep -v '^#' | head -5 || true)
                if [[ -n "$metrics_out" ]]; then
                    echo -e "${YELLOW}Sample metrics (first 5 non-comment lines):${NC}"
                    while IFS= read -r mline; do
                        echo "  ${mline}"
                    done <<< "$metrics_out"
                fi
            fi
        fi

        [[ -n "$degraded" ]] && exit 1
    else
        echo -e "${YELLOW}Note: jq not found; showing raw response.${NC}"
        printf '%s\n' "$response"
    fi
}

cmd_setup() {
    check_ip
    echo -e "${CYAN}Running initial setup on agentbox...${NC}"

    # Copy setup script and run
    ssh -i "$SSH_KEY" -o StrictHostKeyChecking=accept-new "$AGENTBOX_USER@$AGENTBOX_IP" << 'SETUP_EOF'
#!/bin/bash
set -e

echo "=== Agentbox Initial Setup ==="

# Update system
sudo dnf update -y

# Install Docker
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
sudo systemctl enable --now docker
sudo usermod -aG docker $USER

# Install development tools
sudo dnf install -y git nodejs npm python3-pip zellij htop

# Install VNC stack
echo "Installing VNC desktop..."
sudo dnf install -y xorg-x11-server-Xvfb x11vnc openbox xterm chromium

# Install agent-browser and playwright
echo "Installing browser automation tools..."
sudo npm install -g agent-browser playwright
sudo npx playwright install chromium

# Create VNC startup script
cat > ~/start-vnc.sh << 'VNCSCRIPT'
#!/bin/bash
export DISPLAY=:1
rm -f /tmp/.X*-lock /tmp/.X11-unix/X* 2>/dev/null
Xvfb :1 -screen 0 4096x4096x24 -ac +extension GLX +render -noreset &
sleep 2
openbox &
x11vnc -display :1 -rfbport 5901 -forever -shared -nopw -xkb -localhost &
echo "VNC started on localhost:5901 (use SSH tunnel)"
VNCSCRIPT
chmod +x ~/start-vnc.sh

# Create browser startup script
cat > ~/start-browser.sh << 'BROWSERSCRIPT'
#!/bin/bash
export DISPLAY=:1
chromium --no-sandbox --remote-debugging-port=9222 \
  --user-data-dir=$HOME/.config/chromium-automation \
  --window-size=1920,1080 --disable-gpu "$@" &
echo "Browser started with CDP on port 9222"
BROWSERSCRIPT
chmod +x ~/start-browser.sh

# Open firewall ports (localhost only for VNC/CDP)
sudo firewall-cmd --permanent --add-port=22/tcp
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --permanent --add-port=9090/tcp
sudo firewall-cmd --reload

# Start VNC
~/start-vnc.sh

echo "=== Setup complete! ==="
echo ""
echo "VNC: Use SSH tunnel - ssh -L 5901:localhost:5901 $USER@hostname"
echo "Browser: ~/start-browser.sh, then agent-browser open <url>"
SETUP_EOF

    echo -e "${GREEN}Setup complete!${NC}"
}

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -i|--ip)
            AGENTBOX_IP="$2"
            shift 2
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        ssh|vnc|browser|code|api|all|status|ip|provision|setup|start-browser|backup|restore|up|down|build|rebuild|logs|shell|health)
            CMD="$1"
            shift
            break
            ;;
        *)
            echo -e "${RED}Unknown command: $1${NC}"
            usage
            exit 1
            ;;
    esac
done

# Execute command
case "${CMD:-}" in
    ssh)           cmd_ssh "$@" ;;
    vnc)           cmd_vnc ;;
    browser)       cmd_browser ;;
    code)          cmd_code ;;
    api)           cmd_api ;;
    all)           cmd_all ;;
    status)        cmd_status ;;
    ip)            cmd_ip ;;
    provision)     cmd_provision "$@" ;;
    setup)         cmd_setup ;;
    start-browser) cmd_start_browser ;;
    backup)        cmd_backup "$@" ;;
    restore)       cmd_restore "$@" ;;
    up)            cmd_up "$@" ;;
    down)          cmd_down "$@" ;;
    build)         cmd_build "$@" ;;
    rebuild)       cmd_rebuild "$@" ;;
    logs)          cmd_logs "$@" ;;
    shell)         cmd_shell "$@" ;;
    health)        cmd_health "$@" ;;
    *)             usage ;;
esac