#!/usr/bin/env bash
# Seed the nix store on first start, then run the agent.
#
# The firmware-SBOM pipeline drives a real `nix` build (tramiton NixBackend).
# The image ships the store as a bootstrap tarball rather than baking /nix, so a
# persistent /nix volume (mounted empty on first deploy) gets populated once and
# then survives redeploys. Seeding is best-effort: if it fails, the agent still
# starts and firmware SBOMs fall back to analysis-only.
if [ ! -e /nix/store ]; then
  echo "agent-entrypoint: seeding /nix store from image bootstrap..."
  mkdir -p /nix
  if tar -C / -xzf /opt/nix-bootstrap.tar.gz; then
    echo "agent-entrypoint: /nix store seeded."
  else
    echo "agent-entrypoint: WARN nix seed failed; firmware SBOM will use analysis-only fallback."
  fi
fi

exec compliance-agent "$@"