param(
    [string]$WorkspaceRoot = "/workspaces",
    [string]$StatePath = "/app/data/state.json"
)

$ErrorActionPreference = "Stop"

$root = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
$envPath = Join-Path $root ".env"

$secureToken = Read-Host "Telegram bot token" -AsSecureString
$tokenPtr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureToken)
try {
    $token = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($tokenPtr)
}
finally {
    if ($tokenPtr -ne [IntPtr]::Zero) {
        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($tokenPtr)
    }
}
$allowedIds = Read-Host "Allowed Telegram user ids (comma-separated; leave blank for /whoami only)"

@"
TELEGRAM_BOT_TOKEN=$token
ALLOWED_TELEGRAM_USER_IDS=$allowedIds
BOT_STATE_PATH=$StatePath
BOT_WORKSPACE_ROOT=$WorkspaceRoot
CODEX_BIN=codex
CODEX_TIMEOUT_SECONDS=1800
CODEX_READONLY_SANDBOX=read-only
CODEX_WRITE_SANDBOX=workspace-write
CODEX_RESUME_JSON_FLAG_STYLE=before_resume
ALLOW_PLAIN_TEXT=true
"@ | Set-Content -Path $envPath -Encoding UTF8

Write-Host "Wrote $envPath"