pipeline {
  agent { label 'kt-node-agent' }

  options {
    buildDiscarder(logRotator(numToKeepStr: '30', artifactNumToKeepStr: '30'))
    disableConcurrentBuilds()
    skipDefaultCheckout(true)
    timestamps()
    timeout(time: 30, unit: 'MINUTES')
  }

  parameters {
    booleanParam(name: 'RUN_CODEX_AUDIT', defaultValue: false, description: 'When true, allow the optional Codex workspace-write audit after the default dry-run audit.')
    string(name: 'CONFIRM_CODEX_WORKSPACE_WRITE', defaultValue: '', description: 'Type RUN_CODEX_WORKSPACE_WRITE_AUDIT to confirm Codex may run with a workspace-write sandbox.')
  }

  environment {
    KT_WORKFLOW_DIR = '/vol1/docker/kt-codex/workspace/KT/mcp/ktWorkflow'
    KT_ARTIFACT_ROOT = '/vol1/docker/kt-codex/artifacts'
    KT_WORKFLOW_RUNNER_IMAGE = 'kt-jenkins-node-agent:current'
  }

  stages {
    stage('ktWorkflow upstream audit dry-run') {
      steps {
        sh '''
          set -e
          docker run --rm \
            -e KT_WORKFLOW_DIR="$KT_WORKFLOW_DIR" \
            -e KT_ARTIFACT_ROOT="$KT_ARTIFACT_ROOT" \
            -e CODEX_HOME=/vol1/docker/kt-codex/home/.codex \
            -e COREPACK_HOME=/vol1/docker/kt-codex/runtime/corepack \
            -v /vol1/docker/kt-codex:/vol1/docker/kt-codex \
            --entrypoint bash "$KT_WORKFLOW_RUNNER_IMAGE" -lc '
              set -e
              source /vol1/docker/kt-codex/runtime/nvm/nvm.sh
              corepack prepare pnpm@10.28.2 --activate
              pnpm --dir "$KT_WORKFLOW_DIR" run napcat-upstream-audit -- \
                --artifact-root "$KT_ARTIFACT_ROOT/napcat-upstream-sync/dry-run"
            '
        '''
      }
    }

    stage('ktWorkflow upstream audit with Codex') {
      when {
        expression { return params.RUN_CODEX_AUDIT }
      }
      steps {
        script {
          if (params.CONFIRM_CODEX_WORKSPACE_WRITE != 'RUN_CODEX_WORKSPACE_WRITE_AUDIT') {
            error('CONFIRM_CODEX_WORKSPACE_WRITE must equal RUN_CODEX_WORKSPACE_WRITE_AUDIT before Codex workspace-write audit runs.')
          }
        }
        sh '''
          set -e
          docker run --rm \
            -e KT_WORKFLOW_DIR="$KT_WORKFLOW_DIR" \
            -e KT_ARTIFACT_ROOT="$KT_ARTIFACT_ROOT" \
            -e CODEX_HOME=/vol1/docker/kt-codex/home/.codex \
            -e COREPACK_HOME=/vol1/docker/kt-codex/runtime/corepack \
            -v /vol1/docker/kt-codex:/vol1/docker/kt-codex \
            --entrypoint bash "$KT_WORKFLOW_RUNNER_IMAGE" -lc '
              set -e
              source /vol1/docker/kt-codex/runtime/nvm/nvm.sh
              corepack prepare pnpm@10.28.2 --activate
              pnpm --dir "$KT_WORKFLOW_DIR" run napcat-upstream-audit -- \
                --execute \
                --use-codex \
                --artifact-root "$KT_ARTIFACT_ROOT/napcat-upstream-sync/codex"
            '
        '''
      }
    }
  }

  post {
    always {
      sh '''
        set +e
        docker run --rm \
          -e KT_ARTIFACT_ROOT="$KT_ARTIFACT_ROOT" \
          -e WORKSPACE="$WORKSPACE" \
          -v /vol1/docker/kt-codex:/vol1/docker/kt-codex \
          -v kt-node-agent-workdir:/home/jenkins/agent \
          --entrypoint bash "$KT_WORKFLOW_RUNNER_IMAGE" -lc '
            set +e
            rm -rf "$WORKSPACE/artifacts"
            mkdir -p "$WORKSPACE/artifacts/napcat-upstream-sync"
            cp -a "$KT_ARTIFACT_ROOT/napcat-upstream-sync/." "$WORKSPACE/artifacts/napcat-upstream-sync/" 2>/dev/null || true
          '
      '''
      archiveArtifacts artifacts: 'artifacts/napcat-upstream-sync/**', allowEmptyArchive: true, fingerprint: false
    }
  }
}