#!/bin/bash
# nexus-docker.sh - Start Nexus services using Docker Compose
#
# Usage:
#   ./scripts/nexus-docker.sh                    # Start all services (detached)
#   ./scripts/nexus-docker.sh --build            # Rebuild images and start
#   ./scripts/nexus-docker.sh --stop             # Stop all services
#   ./scripts/nexus-docker.sh --restart          # Restart all services
#   ./scripts/nexus-docker.sh --logs             # View logs (follow mode)
#   ./scripts/nexus-docker.sh --status           # Check service status
#   ./scripts/nexus-docker.sh --clean            # Stop and remove all data (volumes)
#   ./scripts/nexus-docker.sh --init             # Initialize (clean + start; optional rebuild via --rebuild)
#   ./scripts/nexus-docker.sh --init --skip_permission  # Initialize with permissions disabled
#   ./scripts/nexus-docker.sh --init --rebuild   # Initialize + rebuild images (runtime + services)
#   ./scripts/nexus-docker.sh --init --yes       # Initialize without confirmation (CI)
#   ./scripts/nexus-docker.sh --env=production   # Use production environment files
#
# Services:
#   - postgres:    PostgreSQL database (port 5432)
#   - nexus:       Nexus RPC server (port 2026)
#   - langgraph:   LangGraph agent server (port 2024)
#   - frontend:    React web UI (port 5173)

set -e  # Exit on error

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
cd "$PROJECT_ROOT"

COMPOSE_FILE="dockerfiles/compose.yaml"
ENV_MODE="local"  # Default: local development
SKIP_PERMISSIONS=false  # Default: set up permissions
SKIP_CONFIRM=false  # Default: ask for confirmation on destructive operations
REBUILD=false  # Default: do NOT rebuild images during --init

# ============================================
# Banner
# ============================================

print_banner() {
cat << 'EOF'
╔═══════════════════════════════════════════╗
║   Nexus Docker Development Environment   ║
╚═══════════════════════════════════════════╝
EOF
echo ""
}

# ============================================
# Helper Functions
# ============================================

check_docker() {
    if ! command -v docker &> /dev/null; then
        echo "❌ Docker not found. Please install Docker:"
        echo "   https://docs.docker.com/get-docker/"
        exit 1
    fi

    # Use docker ps instead of docker info as it's more reliable
    # docker info can fail with permission errors even when Docker is running
    if ! docker ps > /dev/null 2>&1; then
        echo "❌ Docker is not running or not accessible"
        echo "   Please start Docker Desktop or Docker daemon"
        echo "   If Docker is running, check permissions on Docker socket"
        exit 1
    fi
}

check_env_file() {
    # Determine environment files based on ENV_MODE
    case "$ENV_MODE" in
        production)
            ENV_FILE=".env.production"
            ENV_SECRETS=".env.production.secrets"
            ;;
        *)
            # Local development (default)
            # Try .env first, then .env.example
            if [ -f ".env" ]; then
                ENV_FILE=".env"
            elif [ -f ".env.example" ]; then
                ENV_FILE=".env.example"
                echo "⚠️  Using .env.example (no .env found)"
                echo "   💡 Tip: Create .env for your personal config"
                echo "   Run: cp .env.example .env"
                echo ""
            else
                ENV_FILE=".env"
            fi
            ENV_SECRETS=""
            ;;
    esac

    echo "🎯 Environment mode: $ENV_MODE"
    echo "   Config file: $ENV_FILE"
    if [ -n "$ENV_SECRETS" ]; then
        echo "   Secrets file: $ENV_SECRETS"
    fi
    echo ""

    # Check main env file
    if [ ! -f "$ENV_FILE" ]; then
        echo "⚠️  Environment file not found: $ENV_FILE"
        echo ""

        if [ "$ENV_MODE" = "production" ]; then
            echo "❌ Production environment file missing!"
            echo "   Expected: $ENV_FILE"
            exit 1
        else
            echo "❌ No environment file found!"
            echo ""
            echo "To get started, create .env:"
            echo "   cp .env.example .env"
            echo ""
            echo "Then edit .env and add your API keys:"
            echo "   - ANTHROPIC_API_KEY (required for LangGraph)"
            echo "   - OPENAI_API_KEY (optional, for LangGraph)"
            echo ""
            echo "Or you can edit .env.example directly and the script will use it."
            exit 1
        fi
    fi

    # Load main env file
    set -a  # Auto-export all variables
    source "$ENV_FILE"
    set +a

    # Set default NEXUS_API_KEY if not provided (same as local-demo.sh)
    # This ensures docker-entrypoint.sh can use it to create/register the admin key
    if [ -z "${NEXUS_API_KEY:-}" ]; then
        NEXUS_API_KEY="sk-default_admin_dddddddd_eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
        export NEXUS_API_KEY
        echo "🔑 Using default admin API key (set NEXUS_API_KEY in .env to customize)"
    fi

    # Load secrets file if in production mode
    if [ "$ENV_MODE" = "production" ] && [ -n "$ENV_SECRETS" ]; then
        if [ -f "$ENV_SECRETS" ]; then
            echo "🔐 Loading production secrets from $ENV_SECRETS"
            set -a
            source "$ENV_SECRETS"
            set +a
        else
            echo "⚠️  Production secrets file not found: $ENV_SECRETS"
            echo "   This is OK for testing, but required for production deployment"
        fi
    fi
    echo ""
}

check_gcs_credentials() {
    echo "🔍 Checking for GCS credentials..."

    # Priority order for finding credentials:
    # 1. Existing ./gcs-credentials.json (check validity)
    # 2. GCS_CREDENTIALS_PATH environment variable (if set)
    # 3. ~/.config/gcloud/application_default_credentials.json (gcloud default)

    # Check if gcs-credentials.json exists (should be a service account key)
    if [ -f "./gcs-credentials.json" ]; then
        echo "✅ Found GCS credentials at: ./gcs-credentials.json"
        # Verify it's a service account key (not OAuth user credentials)
        if grep -q '"type": "service_account"' ./gcs-credentials.json 2>/dev/null; then
            echo "   ✓ Valid service account key detected"
        else
            echo "   ⚠️  Warning: Not a service account key (found OAuth user credentials)"
            echo "   Please replace with a service account key for better reliability"
        fi
    elif [ -n "$GCS_CREDENTIALS_PATH" ] && [ -f "$GCS_CREDENTIALS_PATH" ]; then
        echo "✅ Found GCS credentials at: $GCS_CREDENTIALS_PATH (from GCS_CREDENTIALS_PATH)"
        # Copy to local file for Docker mount
        cp "$GCS_CREDENTIALS_PATH" ./gcs-credentials.json
        echo "   Copied to ./gcs-credentials.json for Docker mount"
    elif [ -f "$HOME/.config/gcloud/application_default_credentials.json" ]; then
        echo "✅ Found GCS credentials at: ~/.config/gcloud/application_default_credentials.json"
        # Copy gcloud credentials to local file for Docker mount
        cp "$HOME/.config/gcloud/application_default_credentials.json" ./gcs-credentials.json
        echo "   Copied to ./gcs-credentials.json for Docker mount"
    else
        echo "⚠️  No GCS credentials found - GCS mounts will not work"
        echo "   Please create a service account key and save to ./gcs-credentials.json"
        echo "   Continuing without GCS support..."
        # Create empty placeholder to prevent mount errors
        touch ./gcs-credentials.json
    fi
    export GCS_CREDENTIALS_PATH="./gcs-credentials.json"
    echo ""
}

check_aws_credentials() {
    echo "🔍 Checking for AWS credentials..."

    # Priority order for finding credentials:
    # 1. AWS_CREDENTIALS_PATH environment variable (if set)
    # 2. ./aws-credentials (local file)
    # 3. ~/.aws/credentials (AWS default)

    if [ -n "$AWS_CREDENTIALS_PATH" ] && [ -f "$AWS_CREDENTIALS_PATH" ]; then
        echo "✅ Found AWS credentials at: $AWS_CREDENTIALS_PATH (from AWS_CREDENTIALS_PATH)"
    elif [ -f "./aws-credentials" ]; then
        echo "✅ Found AWS credentials at: ./aws-credentials"
        export AWS_CREDENTIALS_PATH="./aws-credentials"
    elif [ -f "$HOME/.aws/credentials" ]; then
        echo "✅ Found AWS credentials at: ~/.aws/credentials"
        export AWS_CREDENTIALS_PATH="$HOME/.aws/credentials"
    else
        echo "⚠️  No AWS credentials found - S3 mounts will not work"
        echo "   To set up: aws configure"
        echo "   Continuing without S3 support..."
        # Create empty placeholder to prevent mount errors
        touch ./aws-credentials
        export AWS_CREDENTIALS_PATH="./aws-credentials"
    fi

    # Also check for AWS config
    if [ -n "$AWS_CONFIG_PATH" ] && [ -f "$AWS_CONFIG_PATH" ]; then
        echo "✅ Found AWS config at: $AWS_CONFIG_PATH"
    elif [ -f "./aws-config" ]; then
        echo "✅ Found AWS config at: ./aws-config"
        export AWS_CONFIG_PATH="./aws-config"
    elif [ -f "$HOME/.aws/config" ]; then
        echo "✅ Found AWS config at: ~/.aws/config"
        export AWS_CONFIG_PATH="$HOME/.aws/config"
    else
        # Create empty placeholder to prevent mount errors
        touch ./aws-config
        export AWS_CONFIG_PATH="./aws-config"
    fi
    echo ""
}

check_frontend_repo() {
    echo "🔍 Checking for nexus-frontend repository..."

    # Clone to same level as nexus directory (not inside it)
    FRONTEND_DIR="$(cd "${PROJECT_ROOT}/.." && pwd)/nexus-frontend"

    if [ -d "$FRONTEND_DIR" ]; then
        echo "✅ Found nexus-frontend at: $FRONTEND_DIR"
    else
        echo "⚠️  nexus-frontend not found at: $FRONTEND_DIR"
        echo ""
        echo "Cloning nexus-frontend repository..."

        # Clone the repository
        git clone https://github.com/nexi-lab/nexus-frontend.git "$FRONTEND_DIR"

        if [ $? -eq 0 ]; then
            echo "✅ Successfully cloned nexus-frontend"
        else
            echo "❌ Failed to clone nexus-frontend"
            echo "   Please manually clone: git clone https://github.com/nexi-lab/nexus-frontend.git $FRONTEND_DIR"
            exit 1
        fi
    fi
    echo ""
}

show_services() {
    cat << EOF
📦 Services:
   • postgres    - PostgreSQL database (port 5432)
   • nexus       - Nexus RPC server (port 2026)
   • langgraph   - LangGraph agent (port 2024)
   • frontend    - React web UI (port 5173)
EOF
    echo ""
}

ensure_skills_available() {
    echo "📦 Ensuring default skills are available..."

    # Create nexus-data directory if it doesn't exist
    mkdir -p "./nexus-data/skills"

    # Source skills directory (from nexus repo)
    SKILLS_SOURCE="./data/skills"
    SKILLS_TARGET="./nexus-data/skills"

    # Check if skills exist in source
    if [ -d "$SKILLS_SOURCE" ] && [ "$(ls -A $SKILLS_SOURCE/*.skill 2>/dev/null | wc -l)" -gt 0 ]; then
        # Copy skills to target if they don't exist there
        if [ "$(ls -A $SKILLS_TARGET/*.skill 2>/dev/null | wc -l)" -eq 0 ]; then
            echo "  Copying skills from $SKILLS_SOURCE to $SKILLS_TARGET..."
            cp -r "$SKILLS_SOURCE"/*.skill "$SKILLS_TARGET/" 2>/dev/null || true
            if [ $? -eq 0 ]; then
                echo "  ✓ Skills copied successfully"
            else
                echo "  ⚠️  Failed to copy some skills (this is OK if they'll be created later)"
            fi
        else
            echo "  ✓ Skills already exist in nexus-data/skills/"
        fi
    else
        echo "  ⚠️  Skills not found in $SKILLS_SOURCE"
        echo "  This is OK - skills will be created by zip_default_skills.py if needed"
    fi
    echo ""
}

run_provisioning() {
    echo "📦 Running provisioning via API..."

    # Get the admin API key from the container (file first, then logs fallback)
    local API_KEY=""
    API_KEY=$(docker exec nexus-server cat /app/data/.admin-api-key 2>/dev/null || true)
    if [ -z "$API_KEY" ]; then
        API_KEY=$(docker logs nexus-server 2>&1 | grep "API Key:" | tail -1 | awk '{print $3}')
    fi

    if [ -z "$API_KEY" ]; then
        echo "⚠️  Could not retrieve admin API key; skipping provisioning"
        return
    fi

    # Provision admin user for default zone using API
    echo "  Calling provision_user API for admin@default..."
    local RESPONSE
    # Try API call first (requires valid API key); include headers so we can grep for HTTP/1.1 200 OK
    echo "  Attempting API call to provision_user with API key: $API_KEY on url: $NEXUS_URL"
    RESPONSE=$(curl -s -i -X POST "http://localhost:2026/api/nfs/provision_user" \
        -H "Authorization: Bearer ${API_KEY}" \
        -H "Content-Type: application/json" \
        -d '{
            "jsonrpc": "2.0",
            "id": 1,
            "method": "provision_user",
            "params": {
                "user_id": "admin",
                "email": "",
                "display_name": "Admin User",
                "zone_id": "default",
                "create_api_key": false,
                "create_agents": true,
                "import_skills": true
            }
        }' 2>&1)

    if echo "$RESPONSE" | grep -q "HTTP/1.1 200 OK"; then
        echo "✅ Provisioning completed successfully"
    else
        echo "❌ provision_user failed (did not see HTTP/1.1 200 OK)"
        echo "$RESPONSE"
        exit 1
    fi
}

clean_all_data() {
    # Utility function to clean all Nexus-related Docker resources
    # Args:
    #   $1: Whether to remove images (default: false)
    #   $2: Step prefix for logging (e.g., "Step 1/7:" or "Step 1/5:")

    local REMOVE_IMAGES="${1:-false}"
    local STEP_PREFIX="${2:-}"

    if [ -n "$STEP_PREFIX" ]; then
        STEP_PREFIX="$STEP_PREFIX "
    fi

    # Step 1: Remove sandbox containers
    echo "${STEP_PREFIX}Removing sandbox containers..."
    docker ps -a --filter "ancestor=nexus-sandbox:latest" -q | xargs -r docker rm -f 2>/dev/null || true

    # Step 2: Stop and remove all nexus-related containers (with graceful shutdown)
    echo "${STEP_PREFIX}Removing all nexus-related containers..."
    docker ps -a --filter "name=nexus" -q | xargs -r docker stop --timeout 30 2>/dev/null || true
    docker ps -a --filter "name=nexus" -q | xargs -r docker rm 2>/dev/null || true

    # Step 3: Stop and remove containers via docker-compose (this also removes volumes)
    echo "${STEP_PREFIX}Stopping docker-compose services..."
    docker compose -f "$COMPOSE_FILE" down -v --timeout 30 2>/dev/null || true

    # Step 4: Remove all volumes explicitly (including those with project prefixes)
    echo "${STEP_PREFIX}Removing all volumes (including PostgreSQL data)..."
    # Remove volumes by exact name
    docker volume rm postgres-data 2>/dev/null || true
    docker volume rm nexus-data 2>/dev/null || true
    # Remove volumes with project prefix (docker-compose may prefix volumes with project name)
    # Common patterns: nexus_postgres-data, demo_postgres-data, etc.
    # This ensures we catch volumes even if docker-compose used a project prefix
    docker volume ls -q | grep -E "(postgres-data|nexus-data)" | xargs -r docker volume rm 2>/dev/null || true

    # Step 5: Remove all nexus-related images (if requested)
    if [ "$REMOVE_IMAGES" = "true" ]; then
        echo "${STEP_PREFIX}Removing nexus-related images..."
        docker images -q --filter "reference=nexus-server:*" | xargs -r docker rmi -f 2>/dev/null || true
        docker images -q --filter "reference=nexus-langgraph:*" | xargs -r docker rmi -f 2>/dev/null || true
        docker images -q --filter "reference=nexus-frontend:*" | xargs -r docker rmi -f 2>/dev/null || true
        docker images -q --filter "reference=nexus-sandbox:*" | xargs -r docker rmi -f 2>/dev/null || true
    fi
}

# ============================================
# Commands
# ============================================

cmd_start() {
    print_banner
    check_docker
    check_env_file
    check_gcs_credentials
    check_aws_credentials
    check_frontend_repo

    echo "🧹 Cleaning up old sandbox containers..."
    docker ps -a --filter "ancestor=nexus-sandbox:latest" -q | xargs -r docker rm -f 2>/dev/null || true
    echo ""

    echo "🧹 Stopping and removing all existing Nexus containers..."
    # Stop and remove all containers with 'nexus' in the name (including manually started ones)
    # Use --timeout 30 to allow graceful shutdown (especially for LangGraph checkpoint saving)
    docker ps -a --filter "name=nexus" -q | xargs -r docker stop --timeout 30 2>/dev/null || true
    docker ps -a --filter "name=nexus" -q | xargs -r docker rm 2>/dev/null || true

    # Also use docker-compose down to clean up networks and volumes
    docker compose -f "$COMPOSE_FILE" down --timeout 30
    echo ""

    echo "🚀 Starting Nexus services..."
    echo ""
    show_services

    # Ensure skills are available in nexus-data directory
    ensure_skills_available

    # Start services in detached mode
    docker compose -f "$COMPOSE_FILE" up -d

    echo ""
    echo "✅ Services started!"
    echo ""
    cmd_status
    show_api_key
    cmd_urls
}

cmd_build() {
    print_banner
    check_docker
    check_env_file
    check_gcs_credentials
    check_aws_credentials
    check_frontend_repo

    echo "🔨 Building Docker images..."
    echo ""

    # Build base runtime image first
    echo "🔨 Building base runtime image for sandboxes..."
    ./dockerfiles/build.sh

    echo ""
    echo "🔨 Building template images from config..."
    # Use uv if available, otherwise skip template building
    if command -v uv &> /dev/null; then
        uv run python dockerfiles/build-templates.py
    else
        echo "⚠️  uv not found - skipping template image builds"
        echo "   Template images will be built on-demand when first used"
        echo "   To enable pre-building, install uv: curl -LsSf https://astral.sh/uv/install.sh | sh"
    fi

    echo ""
    echo "🔨 Building service images..."
    docker compose -f "$COMPOSE_FILE" build

    echo ""
    echo "✅ All images built successfully!"
    echo ""

    # Only stop containers after successful build
    echo "🧹 Cleaning up old sandbox containers..."
    docker ps -a --filter "ancestor=nexus-sandbox:latest" -q | xargs -r docker rm -f 2>/dev/null || true
    echo ""

    echo "🧹 Stopping and removing all existing Nexus containers..."
    # Stop and remove all containers with 'nexus' in the name (including manually started ones)
    # Use --timeout 30 to allow graceful shutdown (especially for LangGraph checkpoint saving)
    docker ps -a --filter "name=nexus" -q | xargs -r docker stop --timeout 30 2>/dev/null || true
    docker ps -a --filter "name=nexus" -q | xargs -r docker rm 2>/dev/null || true

    # Also use docker-compose down to clean up networks and volumes
    docker compose -f "$COMPOSE_FILE" down --timeout 30
    echo ""

    echo "🚀 Starting services with new images..."

    # Ensure skills are available in nexus-data directory
    ensure_skills_available

    docker compose -f "$COMPOSE_FILE" up -d

    echo ""
    cmd_status
    show_api_key
    cmd_urls
}

cmd_stop() {
    print_banner
    echo "🛑 Stopping Nexus services..."
    echo "   (Using 30s timeout for graceful shutdown - saves LangGraph checkpoints)"
    echo ""

    docker compose -f "$COMPOSE_FILE" down --timeout 30

    echo ""
    echo "✅ Services stopped gracefully!"
}

cmd_restart() {
    print_banner
    echo "🔄 Restarting Nexus services..."
    echo "   (Using 30s timeout for graceful shutdown - saves LangGraph checkpoints)"
    echo ""

    docker compose -f "$COMPOSE_FILE" restart --timeout 30

    echo ""
    echo "✅ Services restarted!"
    echo ""
    cmd_status
    show_api_key
    cmd_urls
}

cmd_logs() {
    check_docker

    echo "📋 Following logs (Ctrl+C to exit)..."
    echo ""

    docker compose -f "$COMPOSE_FILE" logs -f
}

cmd_status() {
    check_docker

    echo "📊 Service Status:"
    echo ""
    docker compose -f "$COMPOSE_FILE" ps
}

cmd_clean() {
    print_banner
    echo "⚠️  CLEAN MODE"
    echo ""
    echo "This will DELETE ALL data:"
    echo "  • All Docker containers (including sandbox containers)"
    echo "  • All Docker volumes (PostgreSQL data, Nexus data)"
    echo "  • All Docker images (nexus-server, nexus-langgraph, nexus-frontend)"
    echo "  • All Docker networks"
    echo ""

    if [ "$SKIP_CONFIRM" = false ]; then
        read -p "Are you sure you want to continue? [y/N] " -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            echo ""
            echo "❌ Clean cancelled"
            exit 0
        fi
    else
        echo "⚡ Skipping confirmation (--yes flag provided)"
    fi

    echo ""
    echo "🧹 Cleaning up..."
    clean_all_data "true" "  Step"
    echo ""
    echo "✅ Cleanup complete!"
}

cmd_init() {
    print_banner
    check_docker
    check_env_file
    check_gcs_credentials
    check_frontend_repo

    echo "🔧 INITIALIZATION MODE"
    echo ""
    echo "This will:"
    echo "  1. Clean all data (containers, volumes, sandboxes)"
    if [ "$REBUILD" = true ]; then
        echo "  2. Build base runtime image for sandboxes"
    else
        echo "  2. (Skip) Build base runtime image for sandboxes (use --rebuild to enable)"
    fi
    echo "  3. Build all template images from config (ml-heavy, web-dev, etc.)"
    if [ "$REBUILD" = true ]; then
        echo "  4. Rebuild all service Docker images"
    else
        echo "  4. (Skip) Rebuild all service Docker images (use --rebuild to enable)"
    fi
    echo "  5. Start all services fresh"
    if [ "$SKIP_PERMISSIONS" = true ]; then
        echo "  (Skipping permission setup and disabling runtime permission checks)"
    fi
    echo ""

    if [ "$SKIP_CONFIRM" = false ]; then
        read -p "Are you sure you want to continue? [y/N] " -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            echo ""
            echo "❌ Initialization cancelled"
            exit 0
        fi
    else
        echo "⚡ Skipping confirmation (--yes flag provided)"
    fi

    echo ""
    echo "🧹 Step 1/5: Cleaning all data..."
    clean_all_data "false" ""
    echo ""

    echo ""
    echo "🔨 Step 2/5: Building base runtime image for sandboxes..."
    if [ "$REBUILD" = true ]; then
        if [ -x "${PROJECT_ROOT}/dockerfiles/build.sh" ]; then
            "${PROJECT_ROOT}/dockerfiles/build.sh"
        else
            echo "⚠️  ${PROJECT_ROOT}/dockerfiles/build.sh not found or not executable; skipping"
        fi
    else
        echo "⏭️  Skipping runtime image rebuild (use --rebuild to enable)"
    fi

    echo ""
    echo "🔨 Step 3/5: Building template images from config..."
    # Use uv if available, otherwise skip template building
    if command -v uv &> /dev/null; then
        uv run python dockerfiles/build-templates.py
    else
        echo "⚠️  uv not found - skipping template image builds"
        echo "   Template images will be built on-demand when first used"
        echo "   To enable pre-building, install uv: curl -LsSf https://astral.sh/uv/install.sh | sh"
    fi

    echo ""
    echo "🔨 Step 4/5: Building service images..."
    if [ "$REBUILD" = true ]; then
        docker compose -f "$COMPOSE_FILE" build
    else
        echo "⏭️  Skipping service image rebuild (use --rebuild to enable)"
    fi

    echo ""
    echo "🚀 Step 5/5: Starting services..."

    # Ensure skills are available in nexus-data directory
    ensure_skills_available

    # Export SKIP_PERMISSIONS so Docker Compose can pass it to containers
    if [ "$SKIP_PERMISSIONS" = true ]; then
        export NEXUS_SKIP_PERMISSIONS=true
        export NEXUS_ENFORCE_PERMISSIONS=false
        echo "   (Skipping permission setup and disabling runtime permission checks)"
    fi
    docker compose -f "$COMPOSE_FILE" up -d

    echo ""
    echo "✅ Initialization complete!"
    echo ""
    cmd_status
    show_api_key
    run_provisioning
    cmd_urls
}

show_api_key() {
    echo ""
    echo "🔑 Retrieving admin API key..."
    echo ""

    # Wait a moment for container to fully initialize
    sleep 2

    # Try to get API key from container
    API_KEY=$(docker exec nexus-server cat /app/data/.admin-api-key 2>/dev/null || echo "")

    if [ -z "$API_KEY" ]; then
        # Fallback: try to extract from logs
        API_KEY=$(docker logs nexus-server 2>&1 | grep "API Key:" | tail -1 | awk '{print $3}')
    fi

    if [ -n "$API_KEY" ]; then
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo "ADMIN API KEY"
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo ""
        echo "  User:    admin"
        echo "  API Key: ${API_KEY}"
        echo ""
        echo "  To use this key:"
        echo "    export NEXUS_API_KEY='${API_KEY}'"
        echo "    export NEXUS_URL='http://localhost:2026'"
        echo ""
        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
        echo ""
    else
        echo "⚠️  Could not retrieve API key from container"
        echo "   Try: docker logs nexus-server | grep 'API Key:'"
        echo ""
    fi
}

cmd_urls() {
    cat << 'EOF'
╔═══════════════════════════════════════════════════════════════════╗
║                      🌐 Access URLs                              ║
╚═══════════════════════════════════════════════════════════════════╝

  🎨 Frontend:        http://localhost:5173
  🔧 Nexus API:       http://localhost:2026
  🔮 LangGraph:       http://localhost:2024
  🗄️  PostgreSQL:     localhost:5432

  📊 Health Checks:
     • Nexus:         curl http://localhost:2026/health
     • Frontend:      curl http://localhost:5173/health
     • LangGraph:     curl http://localhost:2024/ok

╔═══════════════════════════════════════════════════════════════════╗
║                      📚 Useful Commands                          ║
╚═══════════════════════════════════════════════════════════════════╝

  View logs:         ./scripts/nexus-docker.sh --logs
  Check status:      ./scripts/nexus-docker.sh --status
  Restart:           ./scripts/nexus-docker.sh --restart
  Stop:              ./scripts/nexus-docker.sh --stop

  Docker commands:
    All logs:        docker compose -f dockerfiles/compose.yaml logs -f
    Nexus logs:      docker logs -f nexus-server
    Frontend logs:   docker logs -f nexus-frontend
    LangGraph logs:  docker logs -f nexus-langgraph

  Shell access:
    Nexus:           docker exec -it nexus-server sh
    PostgreSQL:      docker exec -it nexus-postgres psql -U postgres -d nexus

EOF
}

# ============================================
# Main
# ============================================

# Parse flags and filter out non-command arguments
COMMAND=""
while [ $# -gt 0 ]; do
    case $1 in
        --env=*)
            ENV_MODE="${1#*=}"
            shift
            ;;
        --skip_permission)
            SKIP_PERMISSIONS=true
            shift
            ;;
        --rebuild)
            REBUILD=true
            shift
            ;;
        --yes|-y)
            SKIP_CONFIRM=true
            shift
            ;;
        --*)
            # This is a command argument
            if [ -z "$COMMAND" ]; then
                COMMAND="$1"
            fi
            shift
            ;;
        *)
            shift
            ;;
    esac
done

# Parse command arguments
if [ -z "$COMMAND" ]; then
    cmd_start
    exit 0
fi

case "$COMMAND" in
    --start)
        cmd_start
        ;;
    --build)
        cmd_build
        ;;
    --stop)
        cmd_stop
        ;;
    --restart)
        cmd_restart
        ;;
    --logs)
        cmd_logs
        ;;
    --status)
        print_banner
        cmd_status
        show_api_key
        cmd_urls
        ;;
    --clean)
        cmd_clean
        ;;
    --init)
        cmd_init
        ;;
    --help|-h)
        print_banner
        echo "Usage: $0 [OPTION] [--env=MODE] [--skip_permission] [--rebuild] [--yes]"
        echo ""
        echo "Options:"
        echo "  (none)          Start all services (detached)"
        echo "  --build         Rebuild images and start"
        echo "  --stop          Stop all services"
        echo "  --restart       Restart all services"
        echo "  --logs          View logs (follow mode)"
        echo "  --status        Check service status"
        echo "  --clean         Stop and remove all data (volumes)"
        echo "  --init          Initialize (clean + start; add --rebuild to rebuild images)"
        echo "  --env=MODE      Set environment mode (local|production)"
        echo "  --skip_permission  Skip permission setup and disable runtime checks (use with --init)"
        echo "  --rebuild       Rebuild runtime + service images (use with --init)"
        echo "  --yes, -y       Skip confirmation prompts (for CI/automation)"
        echo "  --help, -h      Show this help message"
        echo ""
        echo "Environment Modes:"
        echo "  local           Use .env or .env.example (default)"
        echo "  production      Use .env.production and .env.production.secrets"
        echo ""
        echo "Examples:"
        echo "  ./scripts/nexus-docker.sh                    # Start with local env"
        echo "  ./scripts/nexus-docker.sh --env=production   # Start with production env"
        echo "  ./scripts/nexus-docker.sh --build --env=production  # Rebuild with production env"
        echo "  ./scripts/nexus-docker.sh --init --skip_permission  # Initialize with permissions disabled"
        echo "  ./scripts/nexus-docker.sh --init --rebuild   # Initialize and rebuild images"
        echo "  ./scripts/nexus-docker.sh --init --yes       # Initialize without confirmation (CI)"
        echo ""
        show_services
        ;;
    *)
        echo "❌ Unknown option: $1"
        echo "Run '$0 --help' for usage information"
        exit 1
        ;;
esac
