#!/usr/bin/env bash
#
# hermes — launch a Goose session pre-wired with the homelab persona,
# OpenRouter (Nous Hermes) provider, and the homelab MCP server.
#
# See operations/hermes-agent.md for the full onboarding flow.

set -euo pipefail

die() { echo "hermes: $*" >&2; exit 1; }

command -v goose >/dev/null \
    || die "goose binary not found — re-run bootstrap.sh with --with-hermes"
command -v homelab >/dev/null \
    || die "homelab CLI not found — is this client bootstrapped?"

# Decrypt OpenRouter API key.
# `homelab secret` re-execs via sudo for non-root users (age key is 0600 root).
SECRET_YAML=$(homelab secret openrouter-api-key 2>&1) || \
    die "could not decrypt secrets/openrouter-api-key.yaml — this host probably
isn't a recipient yet. See operations/hermes-agent.md ('Granting the OpenRouter
key to a new host'). sops output:
${SECRET_YAML}"

API_KEY=$(printf '%s' "$SECRET_YAML" | python3 -c \
    'import sys, yaml; print(yaml.safe_load(sys.stdin)["api_key"])')

case "$API_KEY" in
    PLACEHOLDER_*|"")
        die "openrouter-api-key.yaml still contains the placeholder; operator
must run \`sops secrets/openrouter-api-key.yaml\` on hubris to insert a real
\`sk-or-...\` key and push the change." ;;
esac

export OPENROUTER_API_KEY="$API_KEY"
exec goose session "$@"