#!/usr/bin/env bash
# Sheaf for NVIDIA OpenShell: the five-minute proof.
#
#   curl -sSf https://sheaf.one/openshell/quickstart.sh | bash
#
# What it does, on your machine, with your OpenShell:
#   1. creates a sandbox governed by the Sheaf policy (Sheaf is the agent's only tool endpoint);
#   2. shows the fence: Sheaf is reachable from inside, GitHub is not;
#   3. creates a Sheaf gate over an example tool server (three tools; pay_invoice is gated);
#   4. from inside the sandbox: lists the tools through Sheaf, makes a harmless call that goes straight
#      through, then a suspicious payment that Sheaf holds for a person.
# Nothing is installed on your machine beyond the sandbox. Delete it after with:
#   openshell sandbox delete sheaf-quickstart
#
# Needs: openshell (https://github.com/NVIDIA/OpenShell; Mac with Apple chip, or Linux with Docker), curl, python3 on the host.
set -euo pipefail
NAME=sheaf-quickstart
API=https://api.sheaf.one
say(){ printf '\n\033[1m%s\033[0m\n' "$*"; }
if ! command -v openshell >/dev/null; then
  cat <<'MSG'
OpenShell is not installed yet. It runs on a Mac with an Apple chip, or on Linux.
  1. On Linux, install Docker first: https://docs.docker.com/engine/install/
  2. Install OpenShell with NVIDIA's one line:
       curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
  3. Run this again.
On Windows or an Intel Mac, try Sheaf in your browser instead: https://sheaf.one/try
MSG
  exit 1
fi

say "1. A closed room for your agent, where Sheaf is the only door"
curl -sSfO https://sheaf.one/openshell/sheaf-policy.yaml
openshell sandbox delete $NAME >/dev/null 2>&1 || true
# OpenShell's default image has no curl, so the sandbox is built from one that does.
openshell sandbox create --name $NAME --from curlimages/curl:latest --policy sheaf-policy.yaml --no-auto-providers --detach -- sleep infinity >/dev/null
echo "created: $NAME (policy: sheaf-policy.yaml)"

say "2. Check the doors"
printf 'Sheaf, from inside the room:  '; openshell sandbox exec -n $NAME -- curl -s -o /dev/null -w '%{http_code}\n' $API/api/v1/plans </dev/null
printf 'GitHub, from inside the room: '; openshell sandbox exec -n $NAME -- curl -s -o /dev/null -w '%{http_code}\n' https://api.github.com/zen </dev/null || true
echo "(200 = the door is open. 000 = OpenShell kept the door shut.)"

say "3. Put Sheaf in front of some example tools"
DRAFT=$(curl -sSf -m 120 $API/api/v1/pod/draft -H 'Content-Type: application/json' -d '{"operation":"pay an invoice","endpoint":"pay_invoice"}')
GATE=$(python3 - "$DRAFT" <<'EOF'
import json,sys,urllib.request
d=json.loads(sys.argv[1])['draft']; pod={k:v for k,v in d.items() if k!='summary'}
body={"downstream":{"url":"https://api.sheaf.one/api/v1/example-mcp"},"downstreamAuth":"","gatedTools":["pay_invoice"],"operation":"pay an invoice","pod":pod}
req=urllib.request.Request("https://api.sheaf.one/api/v1/pod/gates", data=json.dumps(body).encode(), headers={"Content-Type":"application/json"})
print(urllib.request.urlopen(req, timeout=120).read().decode())
EOF
)
URL=$(python3 -c "import json,sys; print(json.loads(sys.argv[1])['mcpUrl'])" "$GATE")
KEY=$(python3 -c "import json,sys; print(json.loads(sys.argv[1])['apiKey'])" "$GATE")
echo "Sheaf checks: pay_invoice.   Goes straight through: lookup_invoice, send_receipt."

# the first request to a newly mapped host can land before OpenShell has finished mapping it: retry an empty reply
call(){ local out=""; for i in 1 2 3 4; do out=$(openshell sandbox exec -n $NAME -- curl -s -m 200 "$URL" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d "$1" </dev/null 2>/dev/null || true); [ -n "$out" ] && break; sleep 3; done; echo "$out"; }

say "4a. The agent asks which tools it has"
call '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | python3 -c "import json,sys; print([t['name'] for t in json.load(sys.stdin)['result']['tools']])"

say "4b. The agent looks up an invoice. Harmless, so it goes straight through"
call '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"lookup_invoice","arguments":{"invoiceId":"INV-1001"}}}' | python3 -c "import json,sys; print(json.load(sys.stdin)['result']['content'][0]['text'])"

say "4c. The agent tries a risky payment. Sheaf checks it (about 30 seconds)"
call '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"pay_invoice","arguments":{"amount":250000,"currency":"GBP","vendor":"EVIL Corp","po":"none"}}}' | python3 -c "import json,sys; print(json.load(sys.stdin)['result']['content'][0]['text'])"

say "Done."
echo "OpenShell kept the agent in its room: it could reach Sheaf and nothing else."
echo "Sheaf checked what it did: the harmless request went through, the risky payment was stopped for a person."
echo "To use Sheaf with your own agent, get a free key at https://sheaf.one/get-sheaf.html"
echo "To remove this test sandbox: openshell sandbox delete $NAME"