#! /usr/bin/env sh

_new_tmp="$(mktemp --directory -t landrun_fish_XXXXX)"
trap 'rm --recursive "$_new_tmp"' EXIT

# NOTE: We need to keep the XDG_RUNTIME_DIR, as pam_systemd sets it only once upon login. <2026-08-25>
landrun \
    --env XDG_RUNTIME_DIR \
    --env NIX_SHELL_LEVEL \
    --env TERM \
    --env SHLVL \
    --env IN_DIRENV_SANDBOX=true \
    --env TMPDIR="$_new_tmp" \
    --rox /nix/store \
    --rx /run/wrappers/bin/sudo \
    --rw "$_new_tmp" \
    --ro /etc/ \
    --ro /proc/ \
    --rw /dev/ \
    --rw "$XDG_RUNTIME_DIR" \
    --rw "$HOME/.cache" \
    --ro "$HOME/.local/share/nix/trusted-settings.json" \
    --rw "$HOME/.local/share/nix/repl-history" \
    --rw "$HOME/.local/share/ssh/known_hosts" \
    --ro "$HOME/.local/share/ssh/id_ed25519.pub" \
    --rw "$HOME/.local/share/task/" \
    --rw "$HOME/.local/share/nvim/" \
    --rw "$HOME/.local/state/nvim/" \
    --rw "$HOME/.local/share/cargo/" \
    --rw "$HOME/.local/share/ctpv/" \
    --rw "$HOME/.local/share/direnv/" \
    --rw "$HOME/.local/share/lf/" \
    --ro "$HOME/.config/fish/" \
    --ro "$HOME/.config/task/" \
    --ro "$HOME/.config/nvim/" \
    --ro "$HOME/.config/turtle/" \
    --ro "$HOME/.config/git/" \
    --rwx "$PWD" \
    --connect-tcp 80 \
    --connect-tcp 22 \
    --connect-tcp 443 \
    -- fish --login "$@"

# vim: ft=sh