#!/bin/sh
# vault-mcp wrapper — what launchd (com.alexandria.vault-mcp) runs. Sources the off-repo
# secrets env (the seat Bearer values, e.g. VAULT_MCP_BEARER, live there — names-only in
# config), then execs the MCP server from the installed alexandria-vault package against
# this vault. The server binds 127.0.0.1 and wires Tailscale Serve itself for remote
# seats; it also owns git while it runs (vault-sync stands down on its heartbeat).
#   Override the env file with ALEXANDRIA_ENV=/path/to/alexandria.env
#   Search order (most findable first):
#     1. $ALEXANDRIA_ENV
#     2. ~/Library/Application Support/Alexandria/alexandria.env  <- default (via `alexandria secrets --set`)
#     3. ~/Alexandria-secrets/alexandria.env   <- legacy
#     4. ~/.config/alexandria/alexandria.env   <- legacy
ENVFILE=""
for f in "$ALEXANDRIA_ENV" "$HOME/Library/Application Support/Alexandria/alexandria.env" "$HOME/Alexandria-secrets/alexandria.env" "$HOME/.config/alexandria/alexandria.env"; do
  if [ -n "$f" ] && [ -f "$f" ]; then ENVFILE="$f"; break; fi
done
if [ -n "$ENVFILE" ]; then set -a; . "$ENVFILE"; set +a; fi
DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
# The server lives in the installed alexandria-vault package ([mcp] extra — docs/V3-PLAN.md
# §4 P3), not in the vault: run it from $ALEXANDRIA_PYTHON if set (e.g. in alexandria.env),
# else the app venv the installer maintains, else whatever python3 has the package.
VAULT=$(CDPATH= cd -- "$DIR/../../.." && pwd)
APP_PY="$HOME/Library/Application Support/Alexandria/app/.venv/bin/python3"
if [ -n "$ALEXANDRIA_PYTHON" ]; then PY="$ALEXANDRIA_PYTHON"
elif [ -x "$APP_PY" ]; then PY="$APP_PY"
else PY="python3"; fi
exec "$PY" -m alexandria_vault.mcp --vault "$VAULT" "$@"
