<#
  build-wireproxy.ps1 - reproducibly build wireproxy-awg.exe from a pinned, audited commit.
  Output: wireproxy-awg.exe in the repo root (embedded into ClaudeProxy.exe by build-native.ps1).
  Uses a portable Go toolchain in a temp cache (does not touch the system Go).
#>
$ErrorActionPreference = 'Stop'
$root = Split-Path -Parent $MyInvocation.MyCommand.Path
$out = Join-Path $root 'wireproxy-awg.exe'

# pinned, audited source
$repo = 'https://github.com/artem-russkikh/wireproxy-awg.git'
$commit = '5d12c1937a72591342f1c78bc92a8e50e7ee92bb'   # v1.0.17
$goVer = 'go1.26.5'

$cache = Join-Path $env:TEMP 'claude-proxy-gobuild'
New-Item -ItemType Directory -Force -Path $cache | Out-Null
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

# portable Go
$goExe = Join-Path $cache 'goroot\go\bin\go.exe'
if (-not (Test-Path $goExe)) {
  Write-Host "Fetching portable $goVer..." -ForegroundColor Cyan
  $zip = Join-Path $cache 'go.zip'
  Invoke-WebRequest "https://go.dev/dl/$goVer.windows-amd64.zip" -OutFile $zip -UseBasicParsing
  Expand-Archive $zip -DestinationPath (Join-Path $cache 'goroot') -Force
  Remove-Item $zip
}

# fetch the exact pinned commit
$src = Join-Path $cache 'wireproxy-awg'
if (Test-Path $src) { Remove-Item $src -Recurse -Force }
New-Item -ItemType Directory -Force -Path $src | Out-Null
Push-Location $src
try {
  git init -q
  git remote add origin $repo
  git fetch -q --depth 1 origin $commit
  git checkout -q FETCH_HEAD
  $head = (git rev-parse HEAD).Trim()
  if ($head -ne $commit) { throw "commit mismatch: got $head, expected $commit" }
  Write-Host "Source pinned at $commit" -ForegroundColor DarkGray

  $env:GOROOT = Join-Path $cache 'goroot\go'
  $env:GOPATH = Join-Path $cache 'gopath'
  $env:GOCACHE = Join-Path $cache 'gocache'
  $env:GOTOOLCHAIN = 'local'
  $env:GOOS = 'windows'; $env:GOARCH = 'amd64'; $env:CGO_ENABLED = '0'
  Write-Host "Building wireproxy-awg.exe..." -ForegroundColor Cyan
  & $goExe build -trimpath -ldflags '-s -w' -o $out ./cmd/wireproxy
  if ($LASTEXITCODE -ne 0) { throw "go build failed ($LASTEXITCODE)" }
}
finally { Pop-Location }

$sz = [math]::Round((Get-Item $out).Length / 1MB, 1)
Write-Host "OK: $out ($sz MB)" -ForegroundColor Green