#!/bin/bash
# Start Claude Code behind the gate (KOHEN "Claude Code behind the gate").
# The courtyard key is read from the keys file at launch and never written anywhere else.
#
# Fallback (2026-10-15): before launching, probe the gate. If bikoret.ch or
# the pod is down, say so and start DIRECT to Anthropic instead
# (claude-direct), unless BIKORET_STRICT=1 — then refuse, so a session that
# must be examined is never silently unexamined.
GATE="https://bikoret.ch/gate/anthropic"
code=$(curl -sS -m 6 -o /dev/null -w '%{http_code}' -X POST "$GATE/v1/messages" \
       -H 'content-type: application/json' -d '{}' 2>/dev/null)
case "$code" in
  401|400|422) ;;   # the gate answered: it is up (it refuses an unkeyed/empty request)
  *)
    echo "bikoret gate not answering (HTTP ${code:-000}) — see: curl -s https://bikoret.ch/kodesh/health" >&2
    if [ "${BIKORET_STRICT:-0}" = "1" ]; then
      echo "BIKORET_STRICT=1: refusing to start unexamined" >&2; exit 1
    fi
    echo "starting DIRECT to Anthropic (claude-direct); re-run claude-bikoret when the gate is back" >&2
    exec "$HOME/.local/bin/claude-direct" "$@"
    ;;
esac
KEY=$(awk '$1=="courtyard"{print $2}' "$HOME/.config/shorashim/api_keys")
[ -n "$KEY" ] || { echo "no courtyard key in ~/.config/shorashim/api_keys" >&2; exit 1; }
export ANTHROPIC_BASE_URL="$GATE"
export ANTHROPIC_CUSTOM_HEADERS="X-Bikoret-Key: $KEY"
exec claude "$@"