# Serve the trap-sandbox gateway (port 4444) for remote/in-game attachment using
# repo-local .env secrets. Mirrors `opencode-serve`, but auth is optional: an unset
# SANDBOX_PASSWORD means the gateway runs with auth disabled (warn, do not fail).
[positional-arguments]
sandbox-serve *args:
    #!/usr/bin/env bash
    set -euo pipefail
    repo='{{justfile_directory()}}'
    if [ -f "$repo/.env" ]; then set -a; . "$repo/.env"; set +a; fi
    if [ -z "${SANDBOX_PASSWORD:-}" ]; then
        printf '%s\n' 'sandbox-serve: SANDBOX_PASSWORD unset in .env — gateway auth disabled' >&2
    fi
    export SANDBOX_PASSWORD="${SANDBOX_PASSWORD:-}"
    export OPENCODE_SERVER_PASSWORD="${OPENCODE_SERVER_PASSWORD:-}"
    export OPENCODE_URL="${OPENCODE_URL:-http://127.0.0.1:4242}"
    export SANDBOX_HOST="${SANDBOX_HOST:-0.0.0.0}"
    export SANDBOX_PORT="${SANDBOX_PORT:-4444}"
    exec npm run dev --prefix tools/trap-sandbox -- "$@"