stack

#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

export DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
export PROJECTS_ROOT="$(dirname "$DIR")"
export HELIX_HOST_HOME="$DIR"
export TMUX_SESSION=${TMUX_SESSION:="helix"}
export WITH_RUNNER=${WITH_RUNNER:=""}
export WITH_DEMOS=${WITH_DEMOS:=""}
export STOP_KEYCLOAK=${STOP_KEYCLOAK:=""}
export STOP_POSTGRES=${STOP_POSTGRES:=""}
export STOP_PGVECTOR=${STOP_PGVECTOR:=""}
export WIPE_SLOTS=${WIPE_SLOTS:="0"}
export COMPOSE_PROFILES=${COMPOSE_PROFILES:=""}

# Desktop categories for build-sandbox
# Production desktops are always built; experimental require opt-in via EXPERIMENTAL_DESKTOPS
# Note: Using arrays because IFS is set to '\n\t' (no space splitting)
PRODUCTION_DESKTOPS=(sway ubuntu)
AVAILABLE_EXPERIMENTAL_DESKTOPS=(zorin xfce)
# EXPERIMENTAL_DESKTOPS can be set as space-separated string, converted to array below

# Configure host networking for Docker-in-Docker support
function setup_dev_networking() {
  echo "🌐 Configuring networking for Docker-in-Docker support..."

  # Check if already configured
  local NEEDS_SETUP=false

  if [[ $(cat /proc/sys/net/ipv4/conf/all/route_localnet 2>/dev/null) != "1" ]]; then
    NEEDS_SETUP=true
  fi

  if [[ "$NEEDS_SETUP" == "true" ]]; then
    # route_localnet: Allow 127.x.x.x addresses on non-loopback interfaces
    # Required for localhost:PORT forwarding to container networks via DNAT
    sudo sysctl -w net.ipv4.conf.all.route_localnet=1 >/dev/null 2>&1 || true
    sudo sysctl -w net.ipv4.conf.default.route_localnet=1 >/dev/null 2>&1 || true
    sudo sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true
    echo "✅ Docker-in-Docker networking configured (route_localnet, ip_forward)"
  else
    echo "✅ Docker-in-Docker networking already configured"
  fi

  # Also ensure inotify limits are sufficient for Zed file watching
  local CURRENT_WATCHES=$(cat /proc/sys/fs/inotify/max_user_watches 2>/dev/null || echo "0")
  local TARGET_WATCHES=1048576

  if [[ "$CURRENT_WATCHES" -lt "$TARGET_WATCHES" ]]; then
    echo "📁 Increasing inotify limits for Zed file watching..."
    sudo sysctl -w fs.inotify.max_user_watches=$TARGET_WATCHES >/dev/null 2>&1 || true
    sudo sysctl -w fs.inotify.max_user_instances=8192 >/dev/null 2>&1 || true
    echo "✅ inotify limits increased"
  fi
}

# Helper function to check for GPU and set appropriate runner profile
function setup_runner_profile() {
  export FORCE_CPU=${FORCE_CPU:=""}

  if [[ -n "$FORCE_CPU" ]]; then
    # Forced CPU mode
    echo "💻 FORCE_CPU is set, forcing CPU mode regardless of GPU detection"
    export RUNNER_CONTAINER="runner"
    export RUNNER_PROFILE="--profile runner"
    export DEV_CPU_ONLY_CMD="DEVELOPMENT_CPU_ONLY=true "
    export VLLM_ENV_VARS="VLLM_DEVICE=cpu VLLM_LOGGING_LEVEL=DEBUG"
  elif command -v nvidia-smi &> /dev/null && nvidia-smi &> /dev/null; then
    # NVIDIA GPU mode
    echo "🚀 NVIDIA GPU detected, using GPU support"
    export RUNNER_CONTAINER="runner_gpu"
    export RUNNER_PROFILE="--profile runner_gpu"
    export DEV_CPU_ONLY_CMD=""
    export VLLM_ENV_VARS=""
  elif [[ -e "/dev/kfd" ]] && [[ -d "/dev/dri" ]] && command -v lspci &> /dev/null && lspci | grep -iE "(VGA|3D|Display).*AMD" &> /dev/null; then
    # AMD GPU mode (ROCm)
    echo "🚀 AMD GPU detected (ROCm), using AMD GPU support"
    export RUNNER_CONTAINER="runner_gpu_amd"
    export RUNNER_PROFILE="--profile runner_gpu_amd"
    export DEV_CPU_ONLY_CMD=""
    export VLLM_ENV_VARS=""
  elif [[ -d "/dev/dri" ]] && command -v lspci &> /dev/null && lspci | grep -iE "(VGA|3D|Display).*(Intel|Iris)" &> /dev/null; then
    # Intel GPU mode - video encoding supported (QSV), but no GPU compute for LLM inference
    echo "🖥️ Intel GPU detected - sandbox/video encoding supported (QSV), external LLM recommended for AI inference"
    export RUNNER_CONTAINER="runner"
    export RUNNER_PROFILE="--profile runner"
    export DEV_CPU_ONLY_CMD="DEVELOPMENT_CPU_ONLY=true "
    export VLLM_ENV_VARS="VLLM_DEVICE=cpu VLLM_LOGGING_LEVEL=DEBUG"
  else
    # CPU mode (fallback)
    echo "❌ No supported GPU detected, running without GPU support"
    export RUNNER_CONTAINER="runner"
    export RUNNER_PROFILE="--profile runner"
    export DEV_CPU_ONLY_CMD="DEVELOPMENT_CPU_ONLY=true "
    export VLLM_ENV_VARS="VLLM_DEVICE=cpu VLLM_LOGGING_LEVEL=DEBUG"
  fi
}

# Helper function to determine sandbox service and container names based on COMPOSE_PROFILES
# Sets SANDBOX_SERVICE (docker-compose service name) and SANDBOX_CONTAINER (docker container name)
function get_sandbox_names() {
  local profile="${COMPOSE_PROFILES:-}"
  if [[ "$profile" == *"code-software"* ]]; then
    export SANDBOX_SERVICE="sandbox-software"
    export SANDBOX_CONTAINER="helix-sandbox-software-1"
  elif [[ "$profile" == *"code-amd-intel"* ]]; then
    export SANDBOX_SERVICE="sandbox-amd-intel"
    export SANDBOX_CONTAINER="helix-sandbox-amd-intel-1"
  else
    # Default to NVIDIA (code-nvidia profile)
    export SANDBOX_SERVICE="sandbox-nvidia"
    export SANDBOX_CONTAINER="helix-sandbox-nvidia-1"
  fi
}

# Helper function to detect GPU type and set appropriate sandbox profile
# Sets COMPOSE_PROFILES to include 'code-nvidia' (NVIDIA) or 'code-amd-intel' (AMD/Intel) if not already set
function setup_sandbox_profile() {
  # Check if COMPOSE_PROFILES was explicitly set to a non-empty value in environment
  # (empty string triggers auto-detection, non-empty respects user's choice)
  local env_was_set=""
  if [[ -n "${COMPOSE_PROFILES:-}" ]]; then
    env_was_set="true"
  fi

  # Load existing .env if present
  if [[ -f "$DIR/.env" ]]; then
    source "$DIR/.env"
  fi

  # Stop conflicting sandbox containers before starting
  # All sandbox variants use the same static IP (172.19.0.50), so only one can run at a time
  # Silently remove any sandbox containers that might conflict with the one we're about to start
  local current_profile="${COMPOSE_PROFILES:-}"
  if [[ "$current_profile" == *"code-software"* ]]; then
    # Starting software sandbox - stop GPU sandboxes
    docker rm -f helix-sandbox-nvidia-1 helix-sandbox-amd-intel-1 2>/dev/null || true
  elif [[ "$current_profile" == *"code-amd-intel"* ]]; then
    # Starting AMD/Intel sandbox - stop other sandboxes
    docker rm -f helix-sandbox-nvidia-1 helix-sandbox-software-1 2>/dev/null || true
  else
    # Starting NVIDIA sandbox (default) - stop other sandboxes
    docker rm -f helix-sandbox-software-1 helix-sandbox-amd-intel-1 2>/dev/null || true
  fi

  # If COMPOSE_PROFILES was set in environment before .env (even to empty), respect it
  if [[ "$env_was_set" == "true" ]]; then
    echo "🎮 Using COMPOSE_PROFILES from environment: '${COMPOSE_PROFILES:-<empty>}'"
    get_sandbox_names
    return
  fi

  # If COMPOSE_PROFILES is explicitly set in .env (even to empty), respect it
  if [[ -f "$DIR/.env" ]] && grep -q "^COMPOSE_PROFILES=" "$DIR/.env"; then
    echo "🎮 Using COMPOSE_PROFILES from .env: '${COMPOSE_PROFILES:-<empty>}'"
    get_sandbox_names
    return
  fi

  # Auto-detect GPU type
  local gpu_profile=""

  # Check for NVIDIA GPU first
  if command -v nvidia-smi &> /dev/null && nvidia-smi &> /dev/null; then
    gpu_profile="code-nvidia"
    echo "🎮 NVIDIA GPU detected, using 'code-nvidia' sandbox profile"
  # Check for AMD GPU (ROCm)
  elif [[ -e "/dev/kfd" ]] && [[ -d "/dev/dri" ]] && command -v lspci &> /dev/null && lspci | grep -iE "(VGA|3D|Display).*AMD" &> /dev/null; then
    gpu_profile="code-amd-intel"
    echo "🎮 AMD GPU detected (ROCm), using 'code-amd-intel' sandbox profile"
  # Check for Intel GPU (or generic /dev/dri)
  elif [[ -d "/dev/dri" ]] && [[ -n "$(ls -A /dev/dri 2>/dev/null)" ]]; then
    gpu_profile="code-amd-intel"  # Intel uses same profile as AMD (no nvidia runtime)
    echo "🎮 Intel/Generic GPU detected, using 'code-amd-intel' sandbox profile"
  else
    echo "⚠️  No GPU detected, sandbox features may not work"
    get_sandbox_names
    return
  fi

  # Add to COMPOSE_PROFILES if we detected a GPU
  if [[ -n "$gpu_profile" ]]; then
    if [[ -n "${COMPOSE_PROFILES:-}" ]]; then
      export COMPOSE_PROFILES="${COMPOSE_PROFILES},${gpu_profile}"
    else
      export COMPOSE_PROFILES="$gpu_profile"
    fi
    echo "📋 COMPOSE_PROFILES set to: $COMPOSE_PROFILES"
  fi

  # Set sandbox service/container names based on profile
  get_sandbox_names
}

function mock-runner() {
  echo "🔨 Building helix-runner binary for mock runner..."
  build-runner || return 1

  echo "🚀 Starting mock runner..."
  ./helix-runner \
    --mock-runner \
    --server-port 8090 \
    --api-host http://localhost:8080 \
    --api-token oh-hallo-insecure-token \
    --memory 24GB \
    --runner-id mock \
    --label gpu=4090 "$@"
}


function build() {
  # First detect GPU and set variables
  setup_runner_profile

  if [[ -n "$WITH_RUNNER" ]]; then
    # Check for Zed dependency and build if needed
    if [ ! -d "$PROJECTS_ROOT/zed" ]; then
      echo "❌ ERROR: Zed source code not found at $PROJECTS_ROOT/zed/"
      echo ""
      echo "The Zed runner requires the Zed source code to be checked out alongside Helix."
      echo ""
      echo "Please run:"
      echo "  cd .."
      echo "  git clone https://github.com/helixml/zed.git"
      echo "  cd helix"
      echo "  WITH_RUNNER=1 ./stack build"
      exit 1
    fi

    if [ ! -f "./zed-build/zed" ]; then
      echo "🔨 Zed binary not found, building automatically..."
      build-zed || {
        echo "❌ Failed to build Zed. Please check the error messages above."
        echo "Note: Rust/Cargo is required to build Zed. Install from: https://rustup.rs/"
        exit 1
      }
    fi

    echo "🔨 Building runner: $RUNNER_CONTAINER"
    docker compose -f docker-compose.dev.yaml --profile "$RUNNER_CONTAINER" build
    return
  fi

  if [[ -n "$WITH_DEMOS" ]]; then
    echo "🔨 Building demos"
    docker compose -f docker-compose.dev.yaml --profile demos build
    return
  fi

  # No profiles specified, just build everything
  echo "🔨 Building all services"
  docker compose -f docker-compose.dev.yaml build
}

function static-compile() {
  export CGO_ENABLED=0
  go build -ldflags '-extldflags "-static"' -o helix .
}

function build-runner() {
  echo "🔨 Building helix-runner binary..."
  export CGO_ENABLED=1
  local APP_VERSION=${APP_VERSION:-"v0.0.0+dev"}

  if go build -buildvcs=false -tags '!rocm' -ldflags '-s -w -X github.com/helixml/helix/api/pkg/data.Version='$APP_VERSION -o helix-runner ./runner-cmd/helix-runner; then
    echo "✅ Successfully built helix-runner binary"
  else
    echo "❌ Failed to build helix-runner binary"
    return 1
  fi
}

function build-runner-image() {
  echo "🐳 Building runner Docker image..."
  local IMAGE_TAG="${1:-test}"
  local APP_VERSION=$(git rev-parse HEAD 2>/dev/null || echo "v0.0.0+dev")
  # Base image tag - default to latest-empty for fast test builds (skips ~16GB download)
  # Use 'latest-small' for production builds that need full base image
  local BASE_TAG="${2:-latest-empty}"

  echo "  Output: registry.helixml.tech/helix/runner:$IMAGE_TAG"
  echo "  Base: registry.helixml.tech/helix/runner-base:$BASE_TAG"
  echo "  Version: $APP_VERSION"
  echo "  Note: ROCm vLLM build takes ~10 minutes"
  echo ""

  docker build \
    -f Dockerfile.runner \
    --build-arg TAG="$BASE_TAG" \
    --build-arg APP_VERSION="$APP_VERSION" \
    -t "registry.helixml.tech/helix/runner:$IMAGE_TAG" \
    .
}

function build-zed() {
  # ====================================================================
  # Build Zed inside Ubuntu 22.04 container for glibc 2.35 compatibility
  # ====================================================================
  # This produces a binary that works on Ubuntu 22.04+ (including 25.04)
  # Building in Docker ensures consistent, portable binaries regardless
  # of the host OS version.
  # ====================================================================
  echo "🔨 Building Zed with External WebSocket Thread Sync (Docker build)..."

  local ZED_SOURCE_DIR="$PROJECTS_ROOT/zed"
  local ZED_OUTPUT_DIR="./zed-build"
  local BUILD_TYPE="${1:-dev}"

  # Validate build type
  if [[ "$BUILD_TYPE" != "dev" && "$BUILD_TYPE" != "release" ]]; then
    echo "❌ Error: BUILD_TYPE must be 'dev' or 'release'"
    echo "Usage: ./stack build-zed [dev|release]"
    echo ""
    echo "Build types:"
    echo "  dev     - Fast incremental builds with debug symbols (default)"
    echo "  release - Optimized production builds (slower)"
    return 1
  fi

  # Check if Zed source directory exists
  if [ ! -d "$ZED_SOURCE_DIR" ]; then
    echo "❌ Zed source directory not found at: $ZED_SOURCE_DIR"
    echo "Expected directory structure:"
    echo "  helix/                 (current directory)"
    echo "  zed/                   (Zed fork with external_websocket_sync)"
    return 1
  fi

  # Check if external_websocket_sync exists in Zed source
  if [ ! -d "$ZED_SOURCE_DIR/crates/external_websocket_sync" ]; then
    echo "❌ external_websocket_sync crate not found in Zed source"
    echo "Make sure you're using the Zed fork with External WebSocket Thread Sync"
    return 1
  fi

  # Create output directory and ensure we own it
  # (Docker bind mounts may have created it as root on fresh installs)
  mkdir -p "$ZED_OUTPUT_DIR"
  if [ ! -w "$ZED_OUTPUT_DIR" ]; then
    echo "⚠️  $ZED_OUTPUT_DIR exists but is not writable"
    echo "   Fixing permissions..."
    sudo chown -R "$USER:$USER" "$ZED_OUTPUT_DIR"
  fi

  echo "🐳 Building Zed inside Ubuntu 22.04 container..."
  echo "   Source: $ZED_SOURCE_DIR"
  echo "   Output: $ZED_OUTPUT_DIR"
  echo "   Mode: $BUILD_TYPE"

  # Build the builder image if needed
  if ! docker image inspect zed-builder:ubuntu22 &> /dev/null; then
    echo "📦 Building zed-builder:ubuntu22 image (first time only, ~2-3 min)..."
    docker build -t zed-builder:ubuntu22 -f Dockerfile.zed-build .
    if [ $? -ne 0 ]; then
      echo "❌ Failed to build zed-builder:ubuntu22 image"
      return 1
    fi
  fi

  # Setup cargo cache for faster rebuilds
  # Note: We mount registry and git separately to avoid shadowing /root/.cargo/bin
  local CARGO_CACHE="$HOME/.cargo-docker-cache"
  mkdir -p "$CARGO_CACHE/registry" "$CARGO_CACHE/git"

  # Build command based on type
  # Use a separate target directory to avoid conflicts with host-compiled build scripts
  # (host build scripts link against glibc 2.39+ which doesn't exist in Ubuntu 22.04)
  local BUILD_CMD
  local BINARY_PATH
  local TARGET_DIR="target-ubuntu22"
  if [ "$BUILD_TYPE" = "release" ]; then
    echo "🔨 Building in release mode (optimized, stripped, slower build)..."
    BUILD_CMD="CARGO_TARGET_DIR=$TARGET_DIR RUSTFLAGS='-C link-arg=-s' cargo build --release --features external_websocket_sync"
    BINARY_PATH="$TARGET_DIR/release/zed"
  else
    echo "🔨 Building in dev mode (fast incremental builds with debug symbols)..."
    BUILD_CMD="CARGO_TARGET_DIR=$TARGET_DIR cargo build --features external_websocket_sync"
    BINARY_PATH="$TARGET_DIR/debug/zed"
  fi

  # Get absolute path to Zed source
  local ZED_ABS_PATH
  ZED_ABS_PATH=$(cd "$ZED_SOURCE_DIR" && pwd)

  # Get absolute path to output directory
  local OUTPUT_ABS_PATH
  OUTPUT_ABS_PATH=$(cd "$ZED_OUTPUT_DIR" && pwd)

  echo "🚀 Starting Docker build (this may take a while on first run)..."

  # Run build inside container
  # Mount:
  #   - Zed source at /zed
  #   - Cargo registry cache at /root/.cargo/registry (crates index and sources)
  #   - Cargo git cache at /root/.cargo/git (git dependencies)
  #   - Output directory at /output
  # Note: We don't mount the entire /root/.cargo to avoid shadowing the cargo binary
  docker run --rm \
    -v "$ZED_ABS_PATH:/zed" \
    -v "$CARGO_CACHE/registry:/root/.cargo/registry" \
    -v "$CARGO_CACHE/git:/root/.cargo/git" \
    -v "$OUTPUT_ABS_PATH:/output" \
    -w /zed \
    zed-builder:ubuntu22 \
    bash -c "$BUILD_CMD && cp $BINARY_PATH /output/zed.new && chmod +x /output/zed.new"

  if [ $? -ne 0 ]; then
    echo "❌ Docker build failed"
    return 1
  fi

  # Atomic rename (works even if old binary is in use)
  if [ -f "$ZED_OUTPUT_DIR/zed" ]; then
    mv "$ZED_OUTPUT_DIR/zed" "$ZED_OUTPUT_DIR/zed.old" 2>/dev/null || true
  fi
  mv "$ZED_OUTPUT_DIR/zed.new" "$ZED_OUTPUT_DIR/zed"
  rm -f "$ZED_OUTPUT_DIR/zed.old" 2>/dev/null || true

  # Verify the binary
  local BINARY_SIZE=$(du -h "$ZED_OUTPUT_DIR/zed" | cut -f1)

  echo "✅ Zed binary built successfully"
  echo "📦 Binary size: $BINARY_SIZE"
  echo "🎯 Compatible with: Ubuntu 22.04+ (glibc 2.35+)"

  # Verify external WebSocket sync is included
  if strings "$ZED_OUTPUT_DIR/zed" | grep -q "external_websocket_sync"; then
    echo "✅ External WebSocket Thread Sync detected in binary"
  else
    echo "⚠️  External WebSocket Thread Sync not clearly detectable (this might be normal)"
  fi

  # Note: Release builds are already stripped via RUSTFLAGS during compilation
  if [ "$BUILD_TYPE" = "release" ]; then
    echo "✅ Binary built with symbols stripped (via linker flags)"
  fi

  # Create test configuration
  cat > "$ZED_OUTPUT_DIR/test-settings.json" << EOF
{
  "external_websocket_sync": {
    "enabled": true,
    "server": {
      "enabled": true,
      "host": "127.0.0.1",
      "port": 3030
    },
    "websocket_sync": {
      "enabled": true,
      "external_url": "localhost:8080",
      "use_tls": false,
      "auto_reconnect": true
    }
  }
}
EOF

  echo "✅ Created test configuration: $ZED_OUTPUT_DIR/test-settings.json"
  echo "🎉 Zed build completed successfully!"
  echo ""
  echo "Next steps:"
  echo "  1. Test the binary: cd $ZED_OUTPUT_DIR && ./zed --version"
  echo "  2. Build Sway container with Zed: ./stack build-sway"
  echo "  3. Start services: ./stack start"
}

function start() {
  if tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
    echo "📺 Session $TMUX_SESSION already exists. Attaching..."
    sleep 1
    tmux -2 attach -t $TMUX_SESSION
    exit 0;
  fi

  # Check for Zed dependency and build if needed
  if [ ! -d "$PROJECTS_ROOT/zed" ]; then
    echo "❌ ERROR: Zed source code not found at $PROJECTS_ROOT/zed/"
    echo ""
    echo "The Zed runner requires the Zed source code to be checked out alongside Helix."
    echo ""
    echo "Please run:"
    echo "  cd $PROJECTS_ROOT"
    echo "  git clone https://github.com/helixml/zed.git"
    echo "  cd helix"
    echo "  ./stack start"
    exit 1
  fi

  if [ ! -f "./zed-build/zed" ]; then
    echo "🔨 Zed binary not found, building automatically..."
    build-zed || {
      echo "❌ Failed to build Zed. Please check the error messages above."
      exit 1
    }
  fi

  # Check if Wolf container exists, build if needed
  if ! docker image inspect wolf:helix-fixed &> /dev/null; then
    echo "🐺 Wolf container not found, building automatically..."
    build-wolf || {
      echo "❌ Failed to build Wolf. Please check the error messages above."
      exit 1
    }
  fi

  # Check if Moonlight Web container exists, build if needed
  if ! docker image inspect helix-moonlight-web:helix-fixed &> /dev/null; then
    echo "🌙 Moonlight Web container not found, building automatically..."
    build-moonlight-web || {
      echo "❌ Failed to build Moonlight Web. Please check the error messages above."
      exit 1
    }
  fi

  export MANUALRUN=1
  export LOG_LEVEL=debug

  # Configure host networking for Docker-in-Docker
  setup_dev_networking

  echo "🐳 Starting docker compose"

  # Setup runner profiles first
  setup_runner_profile

  # Setup sandbox profile based on GPU detection
  setup_sandbox_profile

  # Clean Wolf and Moonlight Web pairing state for fresh startup
  echo "🧹 Cleaning Wolf and Moonlight Web pairing state..."

  # Stop sandbox if running (Wolf + Moonlight Web are unified in sandbox now)
  docker compose -f docker-compose.dev.yaml stop "$SANDBOX_SERVICE" 2>/dev/null || true

  # Remove state files to force fresh pairing on startup
  # These are bind-mounted into the sandbox container
  rm -f "$DIR/wolf/config.toml" "$DIR/moonlight-web-config/data.json" 2>/dev/null || true
  echo "✅ Pairing state cleaned (will auto-pair on startup)"

  # Start services based on enabled profiles
  if [[ -n "$WITH_RUNNER" ]]; then
    if [[ -n "$WITH_DEMOS" ]]; then
      # Both runner and demos
      echo "🚀 Starting services with runner ($RUNNER_CONTAINER) and demos profiles"
      docker compose -f docker-compose.dev.yaml --profile "$RUNNER_CONTAINER" --profile demos up -d
    else
      # Just runner
      echo "🚀 Starting services with runner ($RUNNER_CONTAINER) profile"
      docker compose -f docker-compose.dev.yaml --profile "$RUNNER_CONTAINER" up -d
    fi
  elif [[ -n "$WITH_DEMOS" ]]; then
    # Just demos
    echo "🚀 Starting services with demos profile"
    docker compose -f docker-compose.dev.yaml --profile demos up -d
  else
    # No special profiles
    echo "🚀 Starting base services"
    docker compose -f docker-compose.dev.yaml up -d
  fi

  sleep 2

  # Wait for postgres to be ready before trying to wipe slots
  echo "⏳ Waiting for postgres to be ready..."
  timeout=60
  while ! docker compose -f docker-compose.dev.yaml exec postgres pg_isready -h localhost -p 5432 >/dev/null 2>&1; do
    timeout=$((timeout - 1))
    if [[ $timeout -eq 0 ]]; then
      echo "⚠️ Warning: Postgres not ready after 60 seconds, continuing anyway"
      break
    fi
    echo "⏳ Waiting for postgres... ($timeout seconds remaining)"
    sleep 1
  done

  # Check if WIPE_SLOTS is set and wipe slots if requested
  if [[ -n "$WIPE_SLOTS" ]]; then
    echo "🧹 WIPE_SLOTS is set, wiping slots from database..."
    if ! wipe-slots; then
      echo "⚠️ Warning: Failed to wipe slots, but continuing startup..."
    fi
  fi

  echo "📺 Creating tmux session $TMUX_SESSION with 3x2 grid layout + full-width hacking terminal..."
  tmux -2 new-session -d -s "$TMUX_SESSION"

  # Create a 3x2 grid layout with full-width hacking terminal at bottom
  # First create top and middle rows for logs
  tmux split-window -v -d
  tmux split-window -v -d

  # Split the top row into 3 columns (Frontend, API, Haystack)
  tmux select-pane -t 0
  tmux split-window -h -d
  tmux select-pane -t 1
  tmux split-window -h -d

  # Split the middle row into 3 columns (Zed Agent, Zed Process, GPU Runner)
  tmux select-pane -t 3
  tmux split-window -h -d
  tmux select-pane -t 4
  tmux split-window -h -d

  # Bottom pane (6) stays full-width for hacking terminal

  # Set pane titles and start processes in 3x2 + full-width layout
  # Top row (0-2): Frontend, API, Haystack
  tmux select-pane -t 0 -T "Frontend Logs"
  tmux send-keys -t 0 'docker compose -f docker-compose.dev.yaml logs -f frontend' C-m

  tmux select-pane -t 1 -T "API Logs"
  tmux send-keys -t 1 'docker compose -f docker-compose.dev.yaml logs -f api' C-m

  tmux select-pane -t 2 -T "Haystack Logs"
  tmux send-keys -t 2 'docker compose -f docker-compose.dev.yaml logs -f haystack' C-m

  # Middle row (3-5): Context-aware based on WITH_RUNNER
  if [[ -n "$WITH_RUNNER" ]]; then
    # WITH_RUNNER mode: Sandbox logs in pane 3
    tmux select-pane -t 3 -T "Sandbox Logs (Wolf + Moonlight)"
    tmux send-keys -t 3 "docker compose -f docker-compose.dev.yaml logs -f $SANDBOX_SERVICE" C-m

    tmux select-pane -t 4 -T "🔨 HACKING TERMINAL"
    tmux send-keys -t 4 'echo "🔨 Hacking terminal ready!" && echo "💡 Tip: Use this for development, debugging, and building"' C-m

    # GPU runner logs with air hot reloading
    tmux select-pane -t 5 -T "GPU Runner ($RUNNER_CONTAINER)"
    tmux send-keys -t 5 'echo "Monitoring GPU Runner logs (with air hot reloading)..." && sleep 3 && docker compose -f docker-compose.dev.yaml --profile '"$RUNNER_CONTAINER"' logs -f '"$RUNNER_CONTAINER" C-m
  else
    # WITHOUT_RUNNER mode: Unified sandbox logs (Wolf + Moonlight Web in one container)
    tmux select-pane -t 3 -T "Sandbox Logs (Wolf + Moonlight)"
    tmux send-keys -t 3 "docker compose -f docker-compose.dev.yaml logs -f $SANDBOX_SERVICE" C-m

    tmux select-pane -t 4 -T "🔨 HACKING TERMINAL"
    tmux send-keys -t 4 'echo "🔨 Hacking terminal ready!" && echo "💡 Tip: Use this for development, debugging, and building"' C-m

    # Middle right pane (5) - contextual based on demos
    if [[ -n "$WITH_DEMOS" ]]; then
      # Demos interactive session
      tmux select-pane -t 5 -T "Demos"
      tmux send-keys -t 5 'docker compose -f docker-compose.dev.yaml --profile demos exec demos bash' C-m
    else
      # Hacking terminal
      tmux select-pane -t 5 -T "🔨 HACKING TERMINAL"
      tmux send-keys -t 5 'echo "🔨 Hacking terminal ready!" && echo "💡 Tip: Use this for development, debugging, and building"' C-m
    fi
  fi

  # Bottom full-width pane (6) - HACKING TERMINAL! 🔨
  tmux select-pane -t 6 -T "🔨 HACKING TERMINAL"
  tmux send-keys -t 6 'echo "🔨 Full-width hacking terminal ready!" && echo "💡 Tip: Use this for development, debugging, and building"' C-m

  if [[ -n "$WITH_DEMOS" && -n "$WITH_RUNNER" ]]; then
    echo "Note: Both GPU runner and demos enabled - demos available in background. Run manually with: docker compose -f docker-compose.dev.yaml --profile demos exec demos bash"
  fi

  # Enable pane titles display
  tmux set-option -g pane-border-status top
  tmux set-option -g pane-border-format "#{pane_index}: #{pane_title}"

  # Make all panes equal size
  tmux select-layout even-horizontal
  tmux select-layout tiled

  tmux -2 attach-session -t $TMUX_SESSION
}

function stop() {
  echo "🛑 Stopping docker containers and tmux session..."

  # Clean up Wolf config and certificates to ensure fresh start next time
  if [ -f "wolf/config.toml" ]; then
    echo "🗑️  Removing Wolf config.toml (will be regenerated from template on next start)"
    rm -f wolf/config.toml
  fi
  if [ -f "wolf/cert.pem" ] || [ -f "wolf/key.pem" ]; then
    echo "🗑️  Removing Wolf SSL certificates (will be regenerated on next start)"
    rm -f wolf/cert.pem wolf/key.pem
  fi

  # Clean up Moonlight Web pairing data to ensure fresh pairing with Wolf's new certs
  if [ -f "moonlight-web-config/data.json" ]; then
    echo "🗑️  Removing Moonlight Web pairing data (will re-pair with Wolf on next start)"
    rm -f moonlight-web-config/data.json
  fi

  # Build exclude pattern for services that should not be stopped
  local exclude_services=()
  [[ -z "$STOP_KEYCLOAK" ]] && exclude_services+=("keycloak")
  [[ -z "$STOP_POSTGRES" ]] && exclude_services+=("postgres")
  [[ -z "$STOP_PGVECTOR" ]] && exclude_services+=("pgvector")

  # Setup runner profiles first
  setup_runner_profile

  if [[ ${#exclude_services[@]} -eq 0 ]]; then
    echo "🗑️ Removing all docker containers"

    # Stop containers based on enabled profiles
    if [[ -n "$WITH_RUNNER" ]]; then
      if [[ -n "$WITH_DEMOS" ]]; then
        # Both runner and demos
        echo "🔄 Stopping services with runner ($RUNNER_CONTAINER) and demos profiles"
        docker compose -f docker-compose.dev.yaml --profile "$RUNNER_CONTAINER" --profile demos down -t 1 || echo "⚠️  Some services may not exist"
      else
        # Just runner
        echo "🔄 Stopping services with runner ($RUNNER_CONTAINER) profile"
        docker compose -f docker-compose.dev.yaml --profile "$RUNNER_CONTAINER" down -t 1 || echo "⚠️  Some services may not exist"
      fi
    elif [[ -n "$WITH_DEMOS" ]]; then
      # Just demos
      echo "🔄 Stopping services with demos profile"
      docker compose -f docker-compose.dev.yaml --profile demos down -t 1 || echo "⚠️  Some services may not exist"
    else
      # Include all profiles when no environment variables are set
      echo "🔄 Stopping all services (all profiles)"
      docker compose -f docker-compose.dev.yaml --profile runner --profile runner_gpu --profile demos down -t 1 || echo "⚠️  Some services may not exist"
    fi
  else
    # Create exclude list for display and grep pattern
    local exclude_list=$(IFS=', '; echo "${exclude_services[*]}")
    local exclude_pattern=$(IFS='|'; echo "${exclude_services[*]}")
    echo "🗑️ Removing docker containers (except: $exclude_list)"

    # Get list of services to stop (excluding the ones we want to keep)
    if [[ -n "$WITH_RUNNER" ]]; then
      if [[ -n "$WITH_DEMOS" ]]; then
        echo "🔄 Stopping services with runner ($RUNNER_CONTAINER) and demos profiles (except: $exclude_list)"
        local services=$(docker compose -f docker-compose.dev.yaml --profile "$RUNNER_CONTAINER" --profile demos config --services 2>/dev/null | grep -v -E "$exclude_pattern" || true)
      else
        echo "🔄 Stopping services with runner ($RUNNER_CONTAINER) profile (except: $exclude_list)"
        local services=$(docker compose -f docker-compose.dev.yaml --profile "$RUNNER_CONTAINER" config --services 2>/dev/null | grep -v -E "$exclude_pattern" || true)
      fi
    elif [[ -n "$WITH_DEMOS" ]]; then
      echo "🔄 Stopping services with demos profile (except: $exclude_list)"
      local services=$(docker compose -f docker-compose.dev.yaml --profile demos config --services 2>/dev/null | grep -v -E "$exclude_pattern" || true)
    else
      echo "🔄 Stopping all services (all profiles, except: $exclude_list)"
      local services=$(docker compose -f docker-compose.dev.yaml --profile runner --profile runner_gpu --profile demos config --services 2>/dev/null | grep -v -E "$exclude_pattern" || true)
    fi

    # Stop only the non-excluded services
    if [[ -n "$services" ]]; then
      echo "🗑️ Going to remove containers: $(echo $services | tr '\n' ' ')"
      # Stop and remove containers using a while loop to avoid xargs command line length issues
      while IFS= read -r service; do
        if [[ -n "$service" ]]; then
          echo "🗑️ Stopping and removing: $service"
          docker compose -f docker-compose.dev.yaml stop "$service" 2>/dev/null && \
          docker compose -f docker-compose.dev.yaml rm -f "$service" 2>/dev/null || \
          echo "⚠️  Could not stop/remove $service"
        fi
      done <<< "$services"
    else
      echo "✨ No services to stop (all are excluded)"
    fi
  fi

  echo "📺 Stopping tmux session $TMUX_SESSION..."
  if tmux has-session -t $TMUX_SESSION 2>/dev/null; then
    tmux kill-session -t $TMUX_SESSION || echo "⚠️  Failed to kill tmux session, but continuing..."
  else
    echo "📺 Tmux session $TMUX_SESSION not found"
  fi

  echo "✨ Stop completed successfully!"
}

function up() {
  # Check if Wolf source code exists, if not clone it
  if [ ! -d "$PROJECTS_ROOT/wolf" ]; then
    echo "🐺 Wolf source code not found at $PROJECTS_ROOT/wolf/"
    echo "📥 Cloning Wolf repository..."
    git clone https://github.com/games-on-whales/wolf.git "$PROJECTS_ROOT/wolf"
    echo "✅ Wolf repository cloned successfully"
  fi

  # Setup sandbox profile based on GPU detection (if not already in .env)
  setup_sandbox_profile

  # Sandbox services are enabled via COMPOSE_PROFILES in .env or auto-detected above
  # Profile 'code-nvidia' = NVIDIA GPU, 'code-amd-intel' = AMD/Intel GPU

  docker compose -f docker-compose.dev.yaml up -d $@
}

function build-zed-agent() {
  echo "🔨 Building Zed agent Docker image..."

  # Build the Docker image using the Zed binary we built
  if [ ! -f "./zed-build/zed" ]; then
    echo "❌ Zed binary not found. Run './stack build-zed' first."
    return 1
  fi

  docker build -t helix-sway:latest -f Dockerfile.sway-helix .

  if [ $? -eq 0 ]; then
    echo "✅ Zed agent Docker image built successfully"
  else
    echo "❌ Failed to build Zed agent Docker image"
    return 1
  fi
}

function zed-agent-up() {
  echo "Starting Zed agent services..."

  # Build Zed if binary doesn't exist
  if [ ! -f "./zed-build/zed" ]; then
    echo "Zed binary not found, building first..."
    build-zed || return 1
  fi

  # Check if image doesn't exist
  if ! docker image inspect helix/zed-agent:latest &> /dev/null; then
    echo "Zed agent image not found, building first..."
    build-zed-agent || return 1
  fi

  docker compose -f docker-compose.zed-agent.yaml up -d

  echo "✅ Zed agent services started"
  echo "📋 Services running:"
  echo "  - Helix API: http://localhost:8080"
  echo "  - Zed HTTP API: http://localhost:3030"
  echo "  - VNC Web Client: http://localhost:6080"
  echo ""
  echo "🧪 Test commands:"
  echo "  curl http://localhost:8080/health    # Helix API"
  echo "  curl http://localhost:3030/health    # Zed integration API"
}

function zed-agent-down() {
  echo "Stopping Zed agent services..."
  docker compose -f docker-compose.zed-agent.yaml down
}

function zed-agent-logs() {
  docker compose -f docker-compose.zed-agent.yaml logs -f "${1:-zed-agent-runner}"
}

function rebuild() {
  docker compose -f docker-compose.dev.yaml up -d --build $@
}

# Helper function to build image tags string (commit hash + git tag if available)
function get_image_tags() {
  local OLD_IFS=$IFS
  IFS=' '  # Temporarily use space as IFS for proper word splitting

  local IMAGE_BASE=$1
  local COMMIT_HASH=$(git rev-parse --short HEAD)
  local GIT_TAG=$(git describe --exact-match --tags HEAD 2>/dev/null || echo "")

  local TAG_STRING="-t ${IMAGE_BASE}:${COMMIT_HASH}"

  if [ -n "$GIT_TAG" ]; then
    TAG_STRING="${TAG_STRING} -t ${IMAGE_BASE}:${GIT_TAG}"
    echo "🏷️  Git tag detected: ${GIT_TAG}" >&2
  fi

  printf "%s" "${TAG_STRING}"  # Use printf to avoid trailing newline issues

  IFS=$OLD_IFS
}

# Helper function to push all image tags
function push_image_tags() {
  local IMAGE_BASE=$1
  local COMMIT_HASH=$(git rev-parse --short HEAD)
  # Use exported GIT_TAG if available (from build-and-push-helix-code), otherwise detect from git
  local GIT_TAG="${GIT_TAG:-$(git describe --exact-match --tags HEAD 2>/dev/null || echo "")}"

  # Always push commit hash tag
  echo "📤 Pushing ${IMAGE_BASE}:${COMMIT_HASH}"
  if ! docker push "${IMAGE_BASE}:${COMMIT_HASH}"; then
    echo "⚠️  Failed to push ${IMAGE_BASE}:${COMMIT_HASH}"
    return 1
  fi

  # Also push git tag if available
  if [ -n "$GIT_TAG" ]; then
    echo "📤 Pushing ${IMAGE_BASE}:${GIT_TAG}"
    if ! docker push "${IMAGE_BASE}:${GIT_TAG}"; then
      echo "⚠️  Failed to push ${IMAGE_BASE}:${GIT_TAG}"
      return 1
    fi
  fi

  return 0
}

function build-wolf() {
  echo "🐺 Building Wolf container with latest source code..."

  # Check if Wolf source directory exists
  if [ ! -d "$PROJECTS_ROOT/wolf" ]; then
    echo "❌ ERROR: Wolf source code not found at $PROJECTS_ROOT/wolf/"
    echo ""
    echo "The Wolf integration requires the Wolf source code to be checked out alongside Helix."
    echo ""
    echo "Please run:"
    echo "  cd $PROJECTS_ROOT"
    echo "  git clone https://github.com/games-on-whales/wolf.git"
    echo "  cd helix"
    echo "  ./stack build-wolf"
    exit 1
  fi

  # Build Wolf container with image tags
  local COMMIT_HASH=$(git rev-parse --short HEAD)
  local GIT_TAG=$(git describe --exact-match --tags HEAD 2>/dev/null || echo "")

  echo "🔨 Building Wolf container from source..."
  cd "$PROJECTS_ROOT/wolf"

  if [ -n "$GIT_TAG" ]; then
    echo "🏷️  Git tag detected: ${GIT_TAG}"
    docker build -f docker/wolf.Dockerfile \
      -t wolf:helix-fixed \
      -t "registry.helixml.tech/helix/wolf:${COMMIT_HASH}" \
      -t "registry.helixml.tech/helix/wolf:${GIT_TAG}" \
      .
  else
    docker build -f docker/wolf.Dockerfile \
      -t wolf:helix-fixed \
      -t "registry.helixml.tech/helix/wolf:${COMMIT_HASH}" \
      .
  fi

  if [ $? -eq 0 ]; then
    echo "✅ Wolf container built successfully"
  else
    echo "❌ Failed to build Wolf container"
    cd - > /dev/null
    return 1
  fi
  cd - > /dev/null

  # Note: Wolf image is an intermediate build artifact, embedded in helix-sandbox
  # It's not pushed to registry separately - only the sandbox container is pushed
  # Wolf runs inside the sandbox container now, not as a standalone service
}

function build-qwen-code() {
  # ====================================================================
  # Build Qwen Code inside container for consistent, reproducible builds
  # ====================================================================
  # This avoids issues with host npm/node versions and husky prepare scripts.
  # The build produces a pre-bundled qwen-code that can be installed globally
  # in the sway container without triggering prepare hooks.
  # ====================================================================
  echo "📦 Building Qwen Code (containerized build)..."

  local QWEN_SOURCE_DIR="$PROJECTS_ROOT/qwen-code"
  local QWEN_OUTPUT_DIR="./qwen-code-build"

  # Check if qwen-code source directory exists
  if [ ! -d "$QWEN_SOURCE_DIR" ]; then
    echo "❌ qwen-code source directory not found at: $QWEN_SOURCE_DIR"
    echo "Clone it next to helix with: cd $PROJECTS_ROOT && git clone git@github.com:helixml/qwen-code.git"
    return 1
  fi

  # Get current qwen-code git commit hash
  local QWEN_CODE_HASH=$(cd "$QWEN_SOURCE_DIR" && git rev-parse HEAD)
  local SAVED_HASH=""
  if [ -f "$QWEN_OUTPUT_DIR/.git-commit-hash" ]; then
    SAVED_HASH=$(cat "$QWEN_OUTPUT_DIR/.git-commit-hash")
  fi

  # Check if we need to rebuild
  local NEEDS_REBUILD=false
  if [ ! -d "$QWEN_OUTPUT_DIR" ] || [ ! -f "$QWEN_OUTPUT_DIR/package.json" ]; then
    NEEDS_REBUILD=true
    echo "📦 qwen-code-build directory missing or incomplete"
  elif [ ! -d "$QWEN_OUTPUT_DIR/dist" ]; then
    NEEDS_REBUILD=true
    echo "📦 qwen-code dist directory missing (bundle not built)"
  elif [ "$QWEN_CODE_HASH" != "$SAVED_HASH" ]; then
    NEEDS_REBUILD=true
    echo "📦 qwen-code changed: ${SAVED_HASH:0:8} -> ${QWEN_CODE_HASH:0:8}"
  fi

  if [ "$NEEDS_REBUILD" != "true" ]; then
    echo "✅ Using existing qwen-code build at $QWEN_OUTPUT_DIR (${SAVED_HASH:0:8})"
    return 0
  fi

  echo "🐳 Building qwen-code inside Node.js 20 container..."
  echo "   Source: $QWEN_SOURCE_DIR"
  echo "   Output: $QWEN_OUTPUT_DIR"

  # Build the builder image if needed
  if ! docker image inspect qwen-code-builder:node20 &> /dev/null; then
    echo "📦 Building qwen-code-builder:node20 image (first time only)..."
    docker build -t qwen-code-builder:node20 -f Dockerfile.qwen-code-build .
    if [ $? -ne 0 ]; then
      echo "❌ Failed to build qwen-code-builder:node20 image"
      return 1
    fi
  fi

  # Setup npm cache for faster rebuilds
  local NPM_CACHE="$HOME/.npm-docker-cache"
  mkdir -p "$NPM_CACHE"

  # Create output directory
  mkdir -p "$QWEN_OUTPUT_DIR"
  if [ ! -w "$QWEN_OUTPUT_DIR" ]; then
    echo "⚠️  $QWEN_OUTPUT_DIR exists but is not writable"
    echo "   Fixing permissions..."
    sudo chown -R "$USER:$USER" "$QWEN_OUTPUT_DIR"
  fi

  # Get absolute paths
  local QWEN_ABS_PATH=$(cd "$QWEN_SOURCE_DIR" && pwd)
  local OUTPUT_ABS_PATH=$(cd "$QWEN_OUTPUT_DIR" && pwd)

  echo "🚀 Starting Docker build..."

  # Run build inside container
  # 1. npm ci --ignore-scripts: Install deps without running prepare hook
  # 2. npm run bundle: Build the dist/ directory manually
  # Then copy the required files to output
  docker run --rm \
    -v "$QWEN_ABS_PATH:/qwen-code:ro" \
    -v "$NPM_CACHE:/root/.npm" \
    -v "$OUTPUT_ABS_PATH:/output" \
    -w /build \
    qwen-code-builder:node20 \
    bash -c '
      set -e
      echo "📋 Copying source to build directory..."
      cp -r /qwen-code/. /build/

      echo "📦 Installing dependencies (skipping prepare scripts)..."
      npm ci --ignore-scripts

      echo "🔨 Building bundle..."
      npm run bundle

      echo "📤 Copying build artifacts to output..."
      # Copy everything needed for npm install -g
      cp -r package.json package-lock.json dist/ /output/
      # Copy packages directory (workspaces)
      cp -r packages/ /output/ 2>/dev/null || true
      # Copy node_modules (required for workspaces to work)
      cp -r node_modules/ /output/

      echo "✅ Build complete!"
    '

  if [ $? -ne 0 ]; then
    echo "❌ Docker build failed"
    return 1
  fi

  # Save the git commit hash for future change detection
  echo "$QWEN_CODE_HASH" > "$QWEN_OUTPUT_DIR/.git-commit-hash"

  echo "✅ qwen-code built successfully (${QWEN_CODE_HASH:0:8})"
  echo "📦 Output: $QWEN_OUTPUT_DIR"
}

function build-xfce() {
  echo "🖥️  Building custom XFCE container with passwordless sudo..."

  # Build the custom XFCE image
  echo "🔨 Building helix-xfce:latest container..."
  if docker build -f Dockerfile.xfce-helix -t helix-xfce:latest .; then
    echo "✅ XFCE container built successfully"
    echo "🖥️  Custom XFCE image ready: helix-xfce:latest"
    echo ""
    echo "Features added:"
    echo "  - Passwordless sudo for retro and user accounts"
    echo "  - Proper work directory permissions"
  else
    echo "❌ Failed to build XFCE container"
    exit 1
  fi
}

# Generic desktop build function - builds any desktop (sway, zorin, ubuntu)
# Uses Docker image hashes for content-addressable versioning
function build-desktop() {
  local DESKTOP_NAME="$1"

  if [ -z "$DESKTOP_NAME" ]; then
    echo "Usage: ./stack build-desktop <name>"
    echo "Available: sway, zorin, ubuntu, xfce"
    exit 1
  fi

  local DOCKERFILE="Dockerfile.${DESKTOP_NAME}-helix"
  local IMAGE_NAME="helix-${DESKTOP_NAME}"

  # Validate Dockerfile exists
  if [ ! -f "$DOCKERFILE" ]; then
    echo "❌ Dockerfile not found: $DOCKERFILE"
    exit 1
  fi

  echo "🖥️  Building ${DESKTOP_NAME} desktop container..."

  # Production mode: Always rebuild Zed from latest source in release mode
  if [ -n "${SKIP_DEV_RESTART:-}" ]; then
    echo "🔨 Production mode: Building fresh Zed release from latest source..."
    if ! build-zed release; then
      echo "❌ Failed to build Zed binary"
      exit 1
    fi
  # Dev mode: Only build if binary doesn't exist
  elif [ ! -f "./zed-build/zed" ]; then
    echo "❌ Zed binary not found. Building in release mode first..."
    if ! build-zed release; then
      echo "❌ Failed to build Zed binary"
      exit 1
    fi
  else
    echo "✅ Using existing Zed binary at ./zed-build/zed (dev mode)"
  fi

  # Build qwen-code using containerized build (avoids husky/prepare script issues)
  # This is used by ALL desktop images (sway, zorin, ubuntu, xfce)
  if ! build-qwen-code; then
    echo "❌ Failed to build qwen-code"
    exit 1
  fi

  # Get qwen-code hash for Docker cache busting
  local QWEN_CODE_HASH=$(cat "./qwen-code-build/.git-commit-hash" 2>/dev/null || echo "unknown")
  echo "📌 qwen-code commit: ${QWEN_CODE_HASH:0:8}"

  # Capture image hash BEFORE build to detect if it actually changed
  local IMAGE_HASH_BEFORE=$(docker images "${IMAGE_NAME}:latest" --format '{{.ID}}' 2>/dev/null || echo "")
  local COMMIT_HASH=$(git rev-parse --short HEAD)
  local GIT_TAG=$(git tag --points-at HEAD 2>/dev/null | head -1)

  # Build the desktop image
  # Use --provenance=false to get stable image IDs when layers are cached
  # (BuildKit attestation manifests change each build, causing ID changes)
  # Pass QWEN_CODE_HASH as build arg to bust cache when qwen-code changes
  echo "🔨 Building ${IMAGE_NAME}:latest..."

  # Registry tagging only for sway (primary production image)
  if [ "$DESKTOP_NAME" = "sway" ] && [ -n "$GIT_TAG" ]; then
    echo "🏷️  Git tag detected: ${GIT_TAG}"
    docker build --provenance=false -f "$DOCKERFILE" \
      --build-arg QWEN_CODE_HASH="${QWEN_CODE_HASH}" \
      -t "${IMAGE_NAME}:latest" \
      -t "${IMAGE_NAME}:${COMMIT_HASH}" \
      -t "registry.helixml.tech/helix/zed-agent:${COMMIT_HASH}" \
      -t "registry.helixml.tech/helix/zed-agent:${GIT_TAG}" \
      .
  elif [ "$DESKTOP_NAME" = "sway" ]; then
    docker build --provenance=false -f "$DOCKERFILE" \
      --build-arg QWEN_CODE_HASH="${QWEN_CODE_HASH}" \
      -t "${IMAGE_NAME}:latest" \
      -t "${IMAGE_NAME}:${COMMIT_HASH}" \
      -t "registry.helixml.tech/helix/zed-agent:${COMMIT_HASH}" \
      .
  else
    # Non-sway desktops: just latest and commit hash tags (also with qwen-code)
    docker build --provenance=false -f "$DOCKERFILE" \
      --build-arg QWEN_CODE_HASH="${QWEN_CODE_HASH}" \
      -t "${IMAGE_NAME}:latest" \
      -t "${IMAGE_NAME}:${COMMIT_HASH}" \
      .
  fi

  if [ $? -ne 0 ]; then
    echo "❌ Failed to build ${DESKTOP_NAME} container"
    exit 1
  fi

  # Capture image hash AFTER build
  local IMAGE_HASH_AFTER=$(docker images "${IMAGE_NAME}:latest" --format '{{.ID}}')

  # Get Docker image hash (content-addressable, survives save/load)
  local IMAGE_HASH_FULL=$(echo "$IMAGE_HASH_AFTER" | sed 's/sha256://')
  # Use first 6 chars as tag - avoids Docker showing just hash when tag matches image ID
  local IMAGE_TAG="${IMAGE_HASH_FULL:0:6}"

  echo "✅ ${DESKTOP_NAME} container built successfully"
  echo "📦 Image hash: ${IMAGE_HASH_FULL} (tag: ${IMAGE_TAG})"

  # Log image hash comparison for debugging cache behavior
  echo "🔍 Image cache check:"
  echo "   Before: ${IMAGE_HASH_BEFORE:-<not captured>}"
  echo "   After:  ${IMAGE_HASH_AFTER:-<not captured>}"
  if [ -f "sandbox-images/${IMAGE_NAME}.tar" ]; then
    echo "   Tarball: exists ($(du -h sandbox-images/${IMAGE_NAME}.tar | cut -f1))"
  else
    echo "   Tarball: missing"
  fi

  # Skip export if: image unchanged AND tarball exists
  if [ -n "$IMAGE_HASH_BEFORE" ] && [ "$IMAGE_HASH_BEFORE" = "$IMAGE_HASH_AFTER" ] && [ -f "sandbox-images/${IMAGE_NAME}.tar" ]; then
    local TARBALL_SIZE=$(du -h "sandbox-images/${IMAGE_NAME}.tar" | cut -f1)
    echo "✅ Image unchanged, tarball up-to-date: sandbox-images/${IMAGE_NAME}.tar ($TARBALL_SIZE) - skipping export"
    # Still transfer to sandbox if running (in case sandbox was restarted)
    if [ -z "${SKIP_DESKTOP_TRANSFER:-}" ]; then
      transfer-desktop-to-sandbox "$DESKTOP_NAME"
    fi
    return 0
  fi

  # Export tarball for embedding in sandbox
  # Include both :latest and :${IMAGE_TAG} tags so docker ps shows proper image names
  echo "📦 Exporting ${DESKTOP_NAME} tarball..."
  mkdir -p sandbox-images

  # Tag with IMAGE_TAG before saving (Wolf uses helix-${desktop}:${tag} to run containers)
  echo "🏷️  Tagging ${IMAGE_NAME}:latest as ${IMAGE_NAME}:${IMAGE_TAG}..."
  docker tag "${IMAGE_NAME}:latest" "${IMAGE_NAME}:${IMAGE_TAG}"

  # Save tarball with BOTH tags - this ensures docker ps shows the named image
  docker save "${IMAGE_NAME}:latest" "${IMAGE_NAME}:${IMAGE_TAG}" > "sandbox-images/${IMAGE_NAME}.tar"
  echo "${IMAGE_TAG}" > "sandbox-images/${IMAGE_NAME}.version"

  local TARBALL_SIZE=$(du -h "sandbox-images/${IMAGE_NAME}.tar" | cut -f1)
  echo "✅ Tarball created: sandbox-images/${IMAGE_NAME}.tar ($TARBALL_SIZE) tag=${IMAGE_TAG}"

  # Transfer to running sandbox (hot-reload in development)
  # Skip if SKIP_DESKTOP_TRANSFER is set (called from build-sandbox)
  if [ -z "${SKIP_DESKTOP_TRANSFER:-}" ]; then
    transfer-desktop-to-sandbox "$DESKTOP_NAME"
  fi
}

# Generic transfer function - transfers any desktop image to sandbox's dockerd
function transfer-desktop-to-sandbox() {
  local DESKTOP_NAME="$1"
  local IMAGE_NAME="helix-${DESKTOP_NAME}"

  if [ -z "$DESKTOP_NAME" ]; then
    echo "Usage: transfer-desktop-to-sandbox <name>"
    return 1
  fi

  # Determine correct sandbox service/container based on GPU profile
  if [[ -f "$DIR/.env" ]]; then
    source "$DIR/.env"
  fi
  get_sandbox_names

  # Check if sandbox container is running
  if ! docker compose -f docker-compose.dev.yaml ps "$SANDBOX_SERVICE" | grep -q "Up"; then
    echo "ℹ️  Sandbox container not running, skipping image transfer (will transfer on next start)"
    return 0
  fi

  # Check if image exists on host
  if ! docker images "${IMAGE_NAME}:latest" -q | grep -q .; then
    echo "⚠️  ${IMAGE_NAME}:latest not found on host, skipping transfer"
    return 0
  fi

  # Get image hash and commit hash for versioned tags
  local IMAGE_HASH_FULL=$(docker images "${IMAGE_NAME}:latest" --format '{{.ID}}' | sed 's/sha256://')
  # Use first 6 chars as tag - avoids Docker showing just hash when tag matches image ID
  local IMAGE_TAG="${IMAGE_HASH_FULL:0:6}"
  local COMMIT_HASH=$(git rev-parse --short HEAD)

  # CRITICAL: Create image tag on host - Wolf executor requests images by tag
  # The heartbeat reports the tag from the version file, and Wolf uses
  # helix-${desktop}:${tag} when creating containers. Without this tag, the
  # sandbox won't find the image and the container will fail to start.
  echo "🏷️  Tagging ${IMAGE_NAME}:latest as ${IMAGE_NAME}:${IMAGE_TAG} (for Wolf executor)..."
  docker tag "${IMAGE_NAME}:latest" "${IMAGE_NAME}:${IMAGE_TAG}"

  # Check if versioned tag exists locally
  local HAS_VERSIONED_TAG=""
  if docker images "${IMAGE_NAME}:${COMMIT_HASH}" -q | grep -q .; then
    HAS_VERSIONED_TAG="true"
  fi

  # Transfer image(s) to sandbox's dockerd
  # Always include the IMAGE_TAG since Wolf uses it to run containers
  local TRANSFER_SUCCESS=""
  if [ -n "$HAS_VERSIONED_TAG" ]; then
    # Transfer all tags: latest, commit hash, and image tag (Wolf uses helix-${desktop}:${tag})
    echo "📦 Transferring ${IMAGE_NAME}:latest, ${IMAGE_NAME}:${COMMIT_HASH}, and ${IMAGE_NAME}:${IMAGE_TAG} to sandbox's dockerd..."
    if docker save "${IMAGE_NAME}:latest" "${IMAGE_NAME}:${COMMIT_HASH}" "${IMAGE_NAME}:${IMAGE_TAG}" | docker exec -i "$SANDBOX_CONTAINER" docker load 2>/dev/null; then
      TRANSFER_SUCCESS="true"
      echo "✅ ${IMAGE_NAME} images transferred to sandbox's dockerd"
      echo "📦 Image tag: ${IMAGE_NAME}:${IMAGE_TAG}"
    fi
  else
    # Only :latest exists - transfer with image tag
    echo "📦 Transferring ${IMAGE_NAME}:latest and ${IMAGE_NAME}:${IMAGE_TAG} to sandbox's dockerd..."
    if docker save "${IMAGE_NAME}:latest" "${IMAGE_NAME}:${IMAGE_TAG}" | docker exec -i "$SANDBOX_CONTAINER" docker load 2>/dev/null; then
      echo "✅ ${IMAGE_NAME} images transferred to sandbox's dockerd"
      # Tag it with the commit hash inside sandbox for consistency
      echo "🏷️  Tagging ${IMAGE_NAME}:latest as ${IMAGE_NAME}:${COMMIT_HASH} inside sandbox..."
      docker exec "$SANDBOX_CONTAINER" docker tag "${IMAGE_NAME}:latest" "${IMAGE_NAME}:${COMMIT_HASH}"
      TRANSFER_SUCCESS="true"
      echo "📦 Image tag: ${IMAGE_NAME}:${IMAGE_TAG}"
    fi
  fi

  if [ -n "$TRANSFER_SUCCESS" ]; then
    # Version files are bind-mounted from host (updated by build-desktop)
    if [ -f "sandbox-images/${IMAGE_NAME}.version" ]; then
      echo "✅ Version file sandbox-images/${IMAGE_NAME}.version contains: $(cat sandbox-images/${IMAGE_NAME}.version)"
    fi
    # Restart heartbeat to pick up the new version immediately
    echo "🔄 Restarting heartbeat daemon to report new version..."
    docker exec "$SANDBOX_CONTAINER" pkill -f sandbox-heartbeat 2>/dev/null || true
    echo "✅ Image transferred and heartbeat restarted"
  else
    echo "ℹ️  Could not transfer image to sandbox (container may be starting/restarting)"
  fi
}

# Backward compatibility wrappers
function build-sway() {
  build-desktop sway
}

function transfer-sway-to-sandbox() {
  transfer-desktop-to-sandbox sway
}

function build-zorin() {
  build-desktop zorin
}

function transfer-zorin-to-sandbox() {
  transfer-desktop-to-sandbox zorin
}

function build-ubuntu() {
  build-desktop ubuntu
}

function transfer-ubuntu-to-sandbox() {
  transfer-desktop-to-sandbox ubuntu
}

function build-xfce() {
  build-desktop xfce
}

function transfer-xfce-to-sandbox() {
  transfer-desktop-to-sandbox xfce
}

function build-moonlight-web() {
  echo "🌙 Building Moonlight Web container..."

  # Check if moonlight-web source directory exists
  if [ ! -d "$PROJECTS_ROOT/moonlight-web-stream" ]; then
    echo "❌ ERROR: Moonlight Web source code not found at $PROJECTS_ROOT/moonlight-web-stream/"
    echo ""
    echo "The Moonlight Web integration requires the source code to be checked out alongside Helix."
    echo ""
    echo "Please run:"
    echo "  cd $PROJECTS_ROOT"
    echo "  git clone https://github.com/helixml/moonlight-web-stream.git"
    echo "  cd helix"
    echo "  ./stack build-moonlight-web"
    exit 1
  fi

  # Build Moonlight Web container with image tags (like Wolf)
  local COMMIT_HASH=$(git rev-parse --short HEAD)
  local GIT_TAG=$(git describe --exact-match --tags HEAD 2>/dev/null || echo "")

  # Determine build mode: always use release (fast, optimized)
  # Set BUILD_MODE=debug to override for debugging purposes
  local BUILD_MODE="${BUILD_MODE:-release}"
  if [ "$BUILD_MODE" = "release" ]; then
    echo "🔨 Building Moonlight Web container from source (RELEASE MODE)..."
  else
    echo "🔨 Building Moonlight Web container from source (DEBUG MODE)..."
  fi
  cd "$PROJECTS_ROOT/moonlight-web-stream"

  if [ -n "$GIT_TAG" ]; then
    echo "🏷️  Git tag detected: ${GIT_TAG}"
    docker build -f Dockerfile \
      --build-arg BUILD_MODE=$BUILD_MODE \
      -t helix-moonlight-web:helix-fixed \
      -t "registry.helixml.tech/helix/moonlight-web:${COMMIT_HASH}" \
      -t "registry.helixml.tech/helix/moonlight-web:${GIT_TAG}" \
      .
  else
    docker build -f Dockerfile \
      --build-arg BUILD_MODE=$BUILD_MODE \
      -t helix-moonlight-web:helix-fixed \
      -t "registry.helixml.tech/helix/moonlight-web:${COMMIT_HASH}" \
      .
  fi

  if [ $? -eq 0 ]; then
    echo "✅ Moonlight Web container built successfully"
  else
    echo "❌ Failed to build Moonlight Web container"
    cd - > /dev/null
    return 1
  fi
  cd - > /dev/null

  # Note: Moonlight Web image is an intermediate build artifact, embedded in helix-sandbox
  # It's not pushed to registry separately - only the sandbox container is pushed
  # Moonlight Web runs inside the sandbox container now, not as a standalone service
}

# Helper function to verify tarball exists after desktop build
function verify_tarball() {
  local desktop="$1"
  if [ ! -f "sandbox-images/helix-${desktop}.tar" ]; then
    echo "❌ sandbox-images/helix-${desktop}.tar not found after build"
    rm -f sandbox-images/helix-*.tar
    exit 1
  fi
  echo "✅ helix-${desktop}.tar ($(du -h sandbox-images/helix-${desktop}.tar | cut -f1)) version=$(cat sandbox-images/helix-${desktop}.version)"
}

function build-sandbox() {
  echo "📦 Building unified Helix Sandbox container (Wolf + Moonlight Web + RevDial + DinD)..."
  echo ""
  echo "This builds a unified container with:"
  echo "  • Wolf streaming platform (from ~/pm/wolf)"
  echo "  • Moonlight Web (from ~/pm/moonlight-web-stream)"
  echo "  • RevDial client (built from source)"
  echo "  • Docker-in-Docker with NVIDIA runtime"
  echo "  • Desktop images (pre-loaded into Wolf's dockerd)"
  echo "  • GOW base-app init system (cont-init.d + entrypoint.sh)"
  echo ""
  # Convert EXPERIMENTAL_DESKTOPS from space-separated string to array
  # This allows: EXPERIMENTAL_DESKTOPS="zorin xfce" ./stack build-sandbox
  local EXPERIMENTAL_DESKTOPS_ARR=()
  if [ -n "${EXPERIMENTAL_DESKTOPS:-}" ]; then
    # Use read with default IFS to split on spaces
    IFS=' ' read -ra EXPERIMENTAL_DESKTOPS_ARR <<< "$EXPERIMENTAL_DESKTOPS"
  fi

  echo "📋 Build configuration:"
  echo "   Production desktops: ${PRODUCTION_DESKTOPS[*]}"
  if [ ${#EXPERIMENTAL_DESKTOPS_ARR[@]} -gt 0 ]; then
    echo "   Experimental desktops: ${EXPERIMENTAL_DESKTOPS_ARR[*]}"
  else
    echo "   Experimental desktops: (none - set EXPERIMENTAL_DESKTOPS to enable)"
  fi
  echo ""

  local COMMIT_HASH=$(git rev-parse --short HEAD)
  # Use exported GIT_TAG if available (from build-and-push-helix-code), otherwise detect from git
  local GIT_TAG="${GIT_TAG:-$(git describe --exact-match --tags HEAD 2>/dev/null || echo "")}"

  # Step 0: Build Wolf and Moonlight Web (fast if unchanged due to Docker cache)
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📝 [0/6] Building Wolf and Moonlight Web dependencies..."
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

  # Build Wolf (skip container restart - we'll restart sandbox instead)
  echo "🐺 Building Wolf..."
  if ! SKIP_DEV_RESTART=1 build-wolf; then
    echo "❌ Failed to build Wolf"
    return 1
  fi

  # Build Moonlight Web (skip container restart - we'll restart sandbox instead)
  echo "🌙 Building Moonlight Web..."
  if ! SKIP_DEV_RESTART=1 build-moonlight-web; then
    echo "❌ Failed to build Moonlight Web"
    return 1
  fi
  echo ""

  # Step 1: Build Zed if needed (required for helix-sway and helix-zorin)
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📝 [1/6] Checking Zed binary..."
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  if [ ! -f "./zed-build/zed" ] || [ -n "${SKIP_DEV_RESTART:-}" ]; then
    echo "Building Zed in release mode..."
    if ! build-zed release; then
      echo "❌ Failed to build Zed"
      return 1
    fi
  else
    echo "✅ Using existing Zed binary"
  fi
  echo ""

  # Step 2: Build desktop images
  # Build production desktops (always)
  local STEP_NUM=2
  for desktop in "${PRODUCTION_DESKTOPS[@]}"; do
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    echo "📦 Building production desktop: helix-${desktop}..."
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    if ! SKIP_DESKTOP_TRANSFER=1 build-desktop "$desktop"; then
      echo "❌ Failed to build helix-${desktop}"
      return 1
    fi
    verify_tarball "$desktop"
    # Remove old compressed tarball if it exists (migrating to uncompressed)
    [ -f "sandbox-images/helix-${desktop}.tar.gz" ] && rm -f "sandbox-images/helix-${desktop}.tar.gz" "sandbox-images/helix-${desktop}.tar.gz.hash"
    echo ""
    STEP_NUM=$((STEP_NUM + 1))
  done

  # Build experimental desktops (only if requested)
  if [ ${#EXPERIMENTAL_DESKTOPS_ARR[@]} -gt 0 ]; then
    for desktop in "${EXPERIMENTAL_DESKTOPS_ARR[@]}"; do
      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
      echo "🧪 Building experimental desktop: helix-${desktop}..."
      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
      if ! SKIP_DESKTOP_TRANSFER=1 build-desktop "$desktop"; then
        echo "❌ Failed to build helix-${desktop}"
        return 1
      fi
      verify_tarball "$desktop"
      echo ""
      STEP_NUM=$((STEP_NUM + 1))
    done
  else
    echo "ℹ️  Experimental desktops skipped (set EXPERIMENTAL_DESKTOPS=\"zorin xfce\" to build)"
    echo ""
  fi

  # Build unified sandbox container with embedded tarballs
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📦 Building helix-sandbox container..."
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

  # Get image IDs to bust Docker cache when upstream images change
  # Without this, BuildKit caches the FROM layers even when wolf/moonlight-web are rebuilt
  local WOLF_IMAGE_ID=$(docker images wolf:helix-fixed -q)
  local MOONLIGHT_IMAGE_ID=$(docker images helix-moonlight-web:helix-fixed -q)
  echo "📦 Wolf image ID: ${WOLF_IMAGE_ID:-not found}"
  echo "📦 Moonlight Web image ID: ${MOONLIGHT_IMAGE_ID:-not found}"

  # Build sandbox with tarball embedded
  if [ -n "$GIT_TAG" ]; then
    echo "🏷️  Git tag detected: ${GIT_TAG}"
    docker build -f Dockerfile.sandbox \
      --build-arg WOLF_IMAGE_ID="${WOLF_IMAGE_ID}" \
      --build-arg MOONLIGHT_IMAGE_ID="${MOONLIGHT_IMAGE_ID}" \
      -t helix-sandbox:latest \
      -t "registry.helixml.tech/helix/helix-sandbox:${COMMIT_HASH}" \
      -t "registry.helixml.tech/helix/helix-sandbox:${GIT_TAG}" \
      .
  else
    docker build -f Dockerfile.sandbox \
      --build-arg WOLF_IMAGE_ID="${WOLF_IMAGE_ID}" \
      --build-arg MOONLIGHT_IMAGE_ID="${MOONLIGHT_IMAGE_ID}" \
      -t helix-sandbox:latest \
      -t "registry.helixml.tech/helix/helix-sandbox:${COMMIT_HASH}" \
      .
  fi

  if [ $? -ne 0 ]; then
    echo "❌ Failed to build helix-sandbox container"
    rm -f sandbox-images/helix-*.tar
    return 1
  fi

  # Keep tarballs for future builds (enables fast rebuilds when desktop images are cached)
  # Only cleanup on failure or when explicitly requested
  echo "✅ helix-sandbox container built successfully (kept tarballs for next build)"
  echo ""

  # Step 6: Restart sandbox and transfer fresh image
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📝 [6/6] Restarting sandbox container..."
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

  # Restart to pick up new image (handled by existing code below)

  # Push to registry in production mode
  if [ -n "${PUSH_TO_REGISTRY:-}" ]; then
    echo "📤 Pushing sandbox image to registry..."

    # Push helix-sandbox (contains Wolf + Moonlight Web + desktop tarballs)
    local SANDBOX_BASE="registry.helixml.tech/helix/helix-sandbox"
    if push_image_tags "$SANDBOX_BASE"; then
      echo "✅ Sandbox images pushed successfully"
    else
      echo "⚠️  Failed to push sandbox images"
      return 1
    fi

    echo "📦 Registry images pushed (desktop images are embedded, not pushed separately)"
  fi

  # Restart sandbox in dev mode
  if [ -z "${SKIP_DEV_RESTART:-}" ]; then
    # Determine correct sandbox service based on GPU profile
    if [[ -f "$DIR/.env" ]]; then
      source "$DIR/.env"
    fi
    get_sandbox_names
    echo "🔄 Restarting sandbox container ($SANDBOX_SERVICE) with updated image..."
    docker compose -f docker-compose.dev.yaml rm -f "$SANDBOX_SERVICE"
    docker compose -f docker-compose.dev.yaml up -d "$SANDBOX_SERVICE"

    echo "✅ Sandbox container rebuilt and restarted successfully"
  fi

  echo ""
  echo "📦 Unified sandbox ready: helix-sandbox:latest"
  echo ""
  echo "Components included:"
  echo "  • Wolf (streaming platform)"
  echo "  • Moonlight Web (WebRTC browser streaming)"
  echo "  • RevDial client (control plane connection)"
  echo "  • Docker-in-Docker (Wolf's isolated dockerd)"
  echo "  • Desktop images:"
  for desktop in "${PRODUCTION_DESKTOPS[@]}"; do
    if [ -f "sandbox-images/helix-${desktop}.tar" ]; then
      local size=$(du -h "sandbox-images/helix-${desktop}.tar" | cut -f1)
      echo "    - helix-${desktop} (production, $size)"
    fi
  done
  if [ ${#EXPERIMENTAL_DESKTOPS_ARR[@]} -gt 0 ]; then
    for desktop in "${EXPERIMENTAL_DESKTOPS_ARR[@]}"; do
      if [ -f "sandbox-images/helix-${desktop}.tar" ]; then
        local size=$(du -h "sandbox-images/helix-${desktop}.tar" | cut -f1)
        echo "    - helix-${desktop} (experimental, $size)"
      fi
    done
  fi
  echo ""
  echo "Services managed by GOW's init system:"
  echo "  • 04-start-dockerd.sh - starts Wolf's dockerd + loads desktop images"
  echo "  • 05-init-wolf-config.sh - initializes Wolf config"
  echo "  • 06-init-moonlight-config.sh - initializes Moonlight Web"
  echo "  • 07-start-moonlight-web.sh - starts Moonlight Web daemon"
  echo "  • 08-start-revdial-client.sh - starts RevDial daemon (if configured)"
  echo "  • startup-app.sh - starts Wolf as main process"
  echo ""
  echo "🎉 Sandbox build completed successfully!"
}

# NOTE: This function requires specific branches to be checked out in dependency repositories:
# - wolf: wolf-ui-working (adds client_unique_id for secure auto-join)
# - moonlight-web-stream: feature/kickoff (threads Wolf client_id through stack)
# - zed: feature/external-thread-sync (external agent WebSocket sync support)
# Verify branches before running: cd $PROJECTS_ROOT/wolf && git branch --show-current
function build-and-push-helix-code() {
  # Optional: pass a tag override as first argument to force tagging even if commit doesn't match
  local TAG_OVERRIDE="${1:-}"

  echo "🚀 Building and pushing Helix Code components for production deployment"
  echo "========================================================================"
  echo ""
  echo "Note: API and Frontend are built by CI - this builds Wolf, Zed Agent, Moonlight Web, and Sandbox"
  echo ""

  # Enable image pushing to registry for production builds
  export PUSH_TO_REGISTRY=1
  # Skip dev service restarts during production builds
  export SKIP_DEV_RESTART=1

  local COMMIT_HASH=$(git rev-parse --short HEAD)
  local GIT_TAG=$(git describe --exact-match --tags HEAD 2>/dev/null || echo "")
  local BUILD_START=$(date +%s)
  local FAILED_BUILDS=()

  # Allow tag override for building specific tags even if commit doesn't exactly match
  if [ -n "$TAG_OVERRIDE" ]; then
    echo "⚠️  Tag override: ${TAG_OVERRIDE} (ignoring git tag check)"
    GIT_TAG="$TAG_OVERRIDE"
  fi

  # Export GIT_TAG so build-sandbox and other functions can use it
  export GIT_TAG

  echo "📝 Commit hash: ${COMMIT_HASH}"
  if [ -n "$GIT_TAG" ]; then
    echo "🏷️  Git tag: ${GIT_TAG}"
  fi
  echo "📅 Build started: $(date)"
  echo ""

  # Track build status
  # Note: helix-sway (Zed agent) is built as part of build-sandbox, not separately
  local TOTAL_BUILDS=3
  local COMPLETED_BUILDS=0

  # 1. Build Wolf
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📦 [1/$TOTAL_BUILDS] Building Wolf streaming platform..."
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  if build-wolf; then
    echo "✅ Wolf built and pushed successfully"
    COMPLETED_BUILDS=$((COMPLETED_BUILDS + 1))
  else
    echo "❌ Failed to build Wolf"
    FAILED_BUILDS+=("wolf")
  fi
  echo ""

  # 2. Build Moonlight Web
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📦 [2/$TOTAL_BUILDS] Building Moonlight Web..."
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  if build-moonlight-web; then
    echo "✅ Moonlight Web built and pushed successfully"
    COMPLETED_BUILDS=$((COMPLETED_BUILDS + 1))
  else
    echo "❌ Failed to build Moonlight Web"
    FAILED_BUILDS+=("moonlight-web")
  fi
  echo ""

  # 3. Build unified Sandbox (Wolf + Moonlight Web + Sway/Zed + RevDial + DinD)
  # Note: This also builds helix-sway (Zed agent) and embeds it as a tarball
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📦 [3/$TOTAL_BUILDS] Building unified Sandbox container (includes Sway/Zed)..."
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  if build-sandbox; then
    echo "✅ Sandbox built and pushed successfully"
    COMPLETED_BUILDS=$((COMPLETED_BUILDS + 1))
  else
    echo "❌ Failed to build Sandbox"
    FAILED_BUILDS+=("sandbox")
  fi
  echo ""

  # Build summary
  local BUILD_END=$(date +%s)
  local BUILD_DURATION=$((BUILD_END - BUILD_START))
  local BUILD_MINUTES=$((BUILD_DURATION / 60))
  local BUILD_SECONDS=$((BUILD_DURATION % 60))

  echo "=========================================================================="
  echo "🎉 Build Summary"
  echo "=========================================================================="
  echo "📊 Completed: ${COMPLETED_BUILDS}/${TOTAL_BUILDS} builds"
  echo "⏱️  Duration: ${BUILD_MINUTES}m ${BUILD_SECONDS}s"
  echo "📝 Commit: ${COMMIT_HASH}"
  echo "🏷️  Registry: registry.helixml.tech/helix/"
  echo ""

  if [ ${#FAILED_BUILDS[@]} -eq 0 ]; then
    echo "✅ All images built and pushed successfully!"
    echo ""
    echo "📦 Production images ready (commit: ${COMMIT_HASH}):"
    echo "   • registry.helixml.tech/helix/helix-sandbox:${COMMIT_HASH}"
    echo ""
    echo "📝 Note: helix-sandbox contains Wolf + Moonlight Web + helix-sway (all embedded)"
    if [ -n "$GIT_TAG" ]; then
      echo ""
      echo "📦 Also tagged with git tag (${GIT_TAG}):"
      echo "   • registry.helixml.tech/helix/helix-sandbox:${GIT_TAG}"
    fi
    echo ""
    echo "🚀 Ready for production deployment!"
    echo ""
    echo "Note: API and Frontend images are built by CI and available at:"
    echo "   • registry.helixml.tech/helix/api:${COMMIT_HASH}"
    echo "   • registry.helixml.tech/helix/frontend:${COMMIT_HASH}"
    return 0
  else
    echo "⚠️  Some builds failed:"
    for failed in "${FAILED_BUILDS[@]}"; do
      echo "   ✗ ${failed}"
    done
    echo ""
    echo "Please review the errors above and retry failed builds individually."
    return 1
  fi
}

function db() {
  local subcommand="${1-cli}"
  shift
  local containername="${1-postgres}"
  shift
  if [[ "$subcommand" == "cli" ]]; then
    docker compose -f docker-compose.dev.yaml exec $containername psql --user postgres "$@"
  elif [[ "$subcommand" == "pipe" ]]; then
    docker compose -f docker-compose.dev.yaml exec -T $containername psql --user postgres "$@"
  fi
}

# Regenerate test mocks
function generate() {
  go generate ./...
}

function psql() {
  db cli postgres "$@"
}

function psql_pipe() {
  db pipe postgres "$@"
}

function pgvector() {
  db cli pgvector "$@"
}

function pgvector_pipe() {
  db pipe pgvector "$@"
}

function list-slots() {
  echo "SELECT * FROM runner_slots ORDER BY created DESC;" | db pipe postgres
}

function slots() {
  echo "Formatted view of all slots:"
  echo "SELECT
    id,
    runner_id,
    model,
    runtime,
    active,
    ready,
    status,
    created::timestamp(0) as created,
    updated::timestamp(0) as updated
  FROM runner_slots
  ORDER BY created DESC;" | db pipe postgres
}

function active-slots() {
  echo "Active slots only:"
  echo "SELECT
    id,
    runner_id,
    model,
    runtime,
    status,
    created::timestamp(0) as created
  FROM runner_slots
  WHERE active = true
  ORDER BY created DESC;" | db pipe postgres
}

function slot-stats() {
  echo "Slot statistics:"
  echo "SELECT
    runner_id,
    COUNT(*) as total_slots,
    COUNT(CASE WHEN active = true THEN 1 END) as active_slots,
    COUNT(CASE WHEN active = false THEN 1 END) as inactive_slots
  FROM runner_slots
  GROUP BY runner_id
  ORDER BY total_slots DESC;" | db pipe postgres
}

function wipe-slots() {
  echo "🧹 Wiping all slots from database..."
  echo "DELETE FROM runner_slots;" | db pipe postgres
  echo "✅ All slots have been deleted from the database."
}

function install() {
  go install ./api/..
}

function update_openapi() {
	echo "🔄 Installing swag..."
	go install github.com/swaggo/swag/cmd/swag@v1.16.4 || {
		echo "❌ Failed to install swag"
		return 1
	}

	echo "🔄 Generating swagger documentation..."
	swag init -g api/pkg/server/swagger.go \
		--parseDependency --parseInternal --parseDepth 3 \
		-o api/pkg/server || {
		echo "❌ CRITICAL: Swagger generation FAILED"
		echo "Check for ParseComment errors above"
		return 1
	}

	# Verify swagger files were created
	if [[ ! -f "api/pkg/server/swagger.json" ]]; then
		echo "❌ CRITICAL: swagger.json was not generated"
		return 1
	fi

	echo "✅ Swagger generated successfully"
	echo "📋 Copying swagger to frontend..."
	cp -r api/pkg/server/swagger.yaml frontend/swagger/ || {
		echo "❌ Failed to copy swagger.yaml"
		return 1
	}

	echo "🔄 Generating TypeScript client..."
	npx swagger-typescript-api@13.0.23 -p ./frontend/swagger/swagger.yaml -o ./frontend/src/api --axios -n api.ts || {
		echo "❌ TypeScript client generation FAILED"
		return 1
	}

	echo "✅ OpenAPI update complete"
}

function lint() {
        golangci-lint run
}

# Before running this, ensure Postgres port is open (5432) for local connections
# and that API server is stopped (if you started it with ./stack up)
function test-integration() {
  cd integration-test/api && go test -v "$@"
}

# Examples:
# Run all tests:                    ./stack test
# Run specific tests:               ./stack test ./api/pkg/oauth_test
# Run a single test:                ./stack test ./api/pkg/oauth_test -run TestOAuthAppIDPropagationProduction

function ollama-sync() {
  local OLLAMA_PATH="$PROJECTS_ROOT/ollama"
  local TARGET_DIR="api/pkg/ollamav11"

  # Check if we're in the right directory (should have api/ subdirectory)
  if [[ ! -d "api" ]]; then
    echo "Error: Must run from the root of the helix repository"
    echo "Expected to find 'api/' directory in current path"
    exit 1
  fi

  if [[ ! -d "$OLLAMA_PATH" ]]; then
    echo "Error: Ollama repository not found at $OLLAMA_PATH"
    echo "Expected ollama to be checked out as a sibling directory to helix"
    exit 1
  fi

  # Check that ollama is on a release tag
  echo "Checking Ollama version..."
  if [[ ! -d "$OLLAMA_PATH/.git" ]]; then
    echo "Error: $OLLAMA_PATH is not a git repository"
    exit 1
  fi

  local OLLAMA_TAG=$(cd "$OLLAMA_PATH" && git describe --exact-match --tags HEAD 2>/dev/null)
  if [[ -z "$OLLAMA_TAG" ]]; then
    local CURRENT_COMMIT=$(cd "$OLLAMA_PATH" && git rev-parse --short HEAD)
    echo "Error: Ollama is not checked out on a release tag"
    echo "Current commit: $CURRENT_COMMIT"
    echo "Please checkout a specific release tag (e.g., v0.11.4) before syncing"
    echo "Example: cd $OLLAMA_PATH && git checkout v0.11.4"
    exit 1
  fi

  echo "✅ Ollama is on release tag: $OLLAMA_TAG"
  echo "Syncing Ollama memory estimation files..."

  # Clean out target directory first to avoid stale files
  if [[ -d "$TARGET_DIR" ]]; then
    echo "Cleaning existing target directory..."
    rm -rf "$TARGET_DIR"
  fi

  # Create target directory
  mkdir -p "$TARGET_DIR"

  # Copy core memory estimation files
  echo "Copying memory estimation files..."
  cp "$OLLAMA_PATH/llm/memory.go" "$TARGET_DIR/"

  # Copy GGML/GGUF parsing files
  echo "Copying GGML/GGUF files..."
  cp -r "$OLLAMA_PATH/fs/ggml" "$TARGET_DIR/"
  cp -r "$OLLAMA_PATH/fs/gguf" "$TARGET_DIR/"

  # Copy supporting files
  echo "Copying supporting files..."
  cp -r "$OLLAMA_PATH/discover" "$TARGET_DIR/"
  cp "$OLLAMA_PATH/api/types.go" "$TARGET_DIR/api_types.go"
  cp "$OLLAMA_PATH/envconfig/config.go" "$TARGET_DIR/envconfig.go"
  cp "$OLLAMA_PATH/format/bytes.go" "$TARGET_DIR/format.go"
  cp -r "$OLLAMA_PATH/fs/util" "$TARGET_DIR/"

  # Transform imports to use local versions
  echo "Transforming imports for local use..."

  # Transform package declarations to avoid import cycle
  sed -i 's|package llm|package ollamav11|g' "$TARGET_DIR/memory.go"
  sed -i 's|package api|package ollamav11|g' "$TARGET_DIR/api_types.go"
  sed -i 's|package envconfig|package ollamav11|g' "$TARGET_DIR/envconfig.go"
  sed -i 's|package format|package ollamav11|g' "$TARGET_DIR/format.go"

  # Transform imports in memory.go - avoid self-imports by removing local package imports
  sed -i 's|"github.com/ollama/ollama/api"|.|g' "$TARGET_DIR/memory.go"
  sed -i 's|"github.com/ollama/ollama/discover"|"github.com/helixml/helix/api/pkg/ollamav11/discover"|g' "$TARGET_DIR/memory.go"
  sed -i 's|"github.com/ollama/ollama/envconfig"|.|g' "$TARGET_DIR/memory.go"
  sed -i 's|"github.com/ollama/ollama/format"|.|g' "$TARGET_DIR/memory.go"
  sed -i 's|"github.com/ollama/ollama/fs/ggml"|"github.com/helixml/helix/api/pkg/ollamav11/ggml"|g' "$TARGET_DIR/memory.go"

  # Remove the dot imports that were created (they'll use local functions)
  sed -i '/^\s*\.\s*$/d' "$TARGET_DIR/memory.go"

  # Transform imports in subdirectories
  find "$TARGET_DIR/ggml" -name "*.go" -exec sed -i 's|"github.com/ollama/ollama/fs/gguf"|"github.com/helixml/helix/api/pkg/ollamav11/gguf"|g' {} \;
  find "$TARGET_DIR/ggml" -name "*.go" -exec sed -i 's|"github.com/ollama/ollama/fs/util/bufioutil"|"github.com/helixml/helix/api/pkg/ollamav11/util/bufioutil"|g' {} \;
  find "$TARGET_DIR/gguf" -name "*.go" -exec sed -i 's|"github.com/ollama/ollama/fs/ggml"|"github.com/helixml/helix/api/pkg/ollamav11/ggml"|g' {} \;
  find "$TARGET_DIR/discover" -name "*.go" -exec sed -i 's|"github.com/ollama/ollama/envconfig"|"github.com/helixml/helix/api/pkg/ollamav11"|g' {} \;
  find "$TARGET_DIR/discover" -name "*.go" -exec sed -i 's|"github.com/ollama/ollama/format"|"github.com/helixml/helix/api/pkg/ollamav11"|g' {} \;

  echo "Import transformations complete. You can now create type adapters manually."

  # Create sync info file
  cat > "$TARGET_DIR/SYNC_INFO.md" << EOF
# Ollama Memory Estimation Sync

**Synced from:** $OLLAMA_PATH
**Ollama version:** $OLLAMA_TAG
**Sync date:** $(date -u +"%Y-%m-%d %H:%M:%S UTC")

## Files synced:
- llm/memory.go → memory.go
- fs/ggml/ → ggml/
- fs/gguf/ → gguf/
- discover/ → discover/
- api/types.go → api_types.go
- envconfig/config.go → envconfig.go
- format/bytes.go → format.go
- fs/util/ → util/

## Next steps:
1. Create type adapters to convert Helix types to Ollama types
2. Modify imports in copied files to use local versions
3. Use exact Ollama EstimateGPULayers function with adapted types

## Important:
This sync was done against Ollama $OLLAMA_TAG. If Ollama is updated,
re-run './stack ollama-sync' to get the latest memory estimation algorithms.
EOF

  echo "✅ Ollama files synced to $TARGET_DIR"
  echo "📄 See $TARGET_DIR/SYNC_INFO.md for details"
  echo ""
  echo "Next steps:"
  echo "1. Create type adapters in api/pkg/memory/ollama_wrapper.go"
  echo "2. Update imports in copied files to use local versions"
  echo "3. Test with exact Ollama memory estimation algorithm"
}

function test() {
  # Ingest env variables from .env file
  set -a
  source .env
  set +a

  # Check whether environment variables are set. If not, error
  if [[ -z "$TOGETHER_API_KEY" ]]; then
    echo "TOGETHER_API_KEY is not set"
    exit 1
  fi
  if [[ -z "$TOGETHER_BASE_URL" ]]; then
    echo "TOGETHER_BASE_URL is not set"
    exit 1
  fi

  # Ensure postgres, tika, typesense and chrome are running
  docker compose -f docker-compose.dev.yaml up -d postgres tika typesense chrome pgvector keycloak

  # Database config (running in a sidecar)
  export POSTGRES_USER=postgres
  export POSTGRES_PASSWORD=postgres
  export POSTGRES_DATABASE=postgres
  export POSTGRES_HOST=localhost

  export KEYCLOAK_USER=admin
  export KEYCLOAK_PASSWORD=oh-hallo-insecure-password

  export PGVECTOR_USER=postgres
  export PGVECTOR_PASSWORD=postgres
  export PGVECTOR_DATABASE=postgres
  export PGVECTOR_HOST=localhost
  export PGVECTOR_PORT=5433

  export TYPESENSE_URL=http://localhost:8108
  export TYPESENSE_API_KEY=typesense
  export TEXT_EXTRACTION_TIKA_URL=http://localhost:9998
  export RAG_CRAWLER_LAUNCHER_URL=http://localhost:7317

  # To debug test hangs, try this:
  # Run tests one at a time and show which test is running

  # If a test path is provided, run tests from that path,
  # otherwise run all tests
  if [[ $# -gt 0 ]]; then
    echo "Running tests from path: $1"
    go test -v -p 1 "$@" 2>&1 | sed -u 's/^/[TEST] /'
  else
    echo "Running all tests"
    go test -v -p 1 ./... 2>&1 | sed -u 's/^/[TEST] /'
  fi
}

function zed-test() {
  echo "Testing Zed with External WebSocket Thread Sync..."

  if [ ! -f "./zed-build/zed" ]; then
    echo "❌ Zed binary not found. Run: ./stack build-zed"
    return 1
  fi

  echo "🧪 Running basic tests..."

  # Test 1: Binary execution
  if ./zed-build/zed --version > /dev/null 2>&1; then
    echo "✅ Zed binary executes successfully"
  else
    echo "❌ Zed binary failed to execute"
    return 1
  fi

  # Test 2: Check for external sync feature
  if strings ./zed-build/zed | grep -q "external_websocket_sync"; then
    echo "✅ External WebSocket Thread Sync feature detected"
  else
    echo "⚠️  External WebSocket Thread Sync not clearly detectable"
  fi

  echo "🎉 Basic Zed tests passed!"
  echo ""
  echo "For full integration testing:"
  echo "  1. Start Zed: RUST_LOG=external_websocket_sync=debug ./zed-build/zed"
  echo "  2. Open a project folder"
  echo "  3. Test API: curl http://localhost:3030/health"
}

function help() {
  echo "Helix Stack Management Tool"
  echo ""
  echo "Available commands:"
  echo "  build              - Build docker containers (optionally with WITH_RUNNER or WITH_DEMOS)"
  echo "  build-runner       - Build the helix-runner binary locally"
  echo "  build-runner-image - Build the runner Docker image (includes ROCm vLLM)"
  echo "  static-compile     - Build static Go binary"
  echo "  start              - Start the development environment with tmux"
  echo "  stop               - Stop docker containers"
  echo "  mock-runner        - Start a mock runner for testing"
  echo "  up [services]      - Start specific docker services"
  echo "  rebuild [services] - Rebuild and start specific docker services"
  echo ""
  echo "Production build commands:"
  echo "  build-and-push-helix-code [tag] - Build ALL Helix Code images and push to registry (optional tag override)"
  echo "  build-sandbox      - Build unified sandbox container (Wolf + Moonlight Web + RevDial + DinD)"
  echo "  build-wolf         - Build Wolf container with latest source code"
  echo "  build-desktop <name> - Build desktop container (sway, zorin, ubuntu, xfce)"
  echo "  build-sway         - Build Sway+Zed container (alias for build-desktop sway)"
  echo "  build-zorin        - Build Zorin+Zed container (alias for build-desktop zorin)"
  echo "  build-ubuntu       - Build Ubuntu+Zed container (alias for build-desktop ubuntu)"
  echo "  build-xfce         - Build XFCE+Zed container (alias for build-desktop xfce)"
  echo "  build-moonlight-web - Build Moonlight Web container and push to registry"
  echo ""
  echo "Zed Agent commands:"
  echo "  build-zed [dev|release] - Build Zed binary in Docker (glibc 2.35 compatible)"
  echo "  build-zed-agent    - Build Zed agent Docker image"
  echo "  zed-agent-up       - Start Zed agent services"
  echo "  zed-agent-down     - Stop Zed agent services"
  echo "  zed-agent-logs [service] - View Zed agent logs"
  echo "  zed-test           - Test Zed binary functionality"
  echo ""
  echo "Database commands:"
  echo "  db [cli|pipe] [postgres|pgvector] - Access database"
  echo "  psql               - PostgreSQL CLI"
  echo "  pgvector           - PGVector CLI"
  echo "  list-slots         - List all runner slots"
  echo "  slots              - Formatted view of all slots"
  echo "  active-slots       - Show only active slots"
  echo "  slot-stats         - Show slot statistics"
  echo "  wipe-slots         - Delete all slots from database"
  echo ""
  echo "Development commands:"
  echo "  generate           - Generate test mocks"
  echo "  update_openapi     - Update OpenAPI documentation"
  echo "  lint               - Run linter"
  echo "  test [path]        - Run tests"
  echo "  test-integration   - Run integration tests"
  echo "  ollama-sync        - Sync Ollama memory estimation files"
  echo ""
  echo "Environment variables:"
  echo "  WITH_RUNNER=1      - Include runner containers"
  echo "  WITH_DEMOS=1       - Include demo containers"
  echo "  FORCE_CPU=1        - Force CPU-only mode"
  echo "  WIPE_SLOTS=1       - Wipe database slots on start"
  echo "  STOP_KEYCLOAK=1    - Stop Keycloak when stopping"
  echo "  STOP_POSTGRES=1    - Stop PostgreSQL when stopping"
  echo "  STOP_PGVECTOR=1    - Stop PGVector when stopping"
  echo "  EXPERIMENTAL_DESKTOPS=\"zorin xfce\" - Build experimental desktops in build-sandbox"
}

# Show help if no arguments provided
if [[ $# -eq 0 ]]; then
  help
  exit 0
fi

eval "$@"