#!/bin/sh
set -eu

# The mounted Pi configuration contains credentials and must stay read-only. Pi's auth storage
# takes a lock beside auth.json, so seed a writable per-container copy before the app starts.
# That lets ModelRuntime read and refresh credentials without ever mutating the host mount.
if [ -d /run/pi-agent-config ]; then
	mkdir -p "$HOME/.pi/agent"
	cp -a /run/pi-agent-config/. "$HOME/.pi/agent/"
	chmod -R u+rwX "$HOME/.pi/agent"
fi

exec "$@"