#!/bin/sh
# Connect+ launcher — picks a working Chromium sandbox mode automatically.
DIR="$(dirname "$(readlink -f "$0")")"
FLAG=""
if [ -z "$SNAP" ] && [ -z "$FLATPAK_ID" ] && [ -z "$CONNECT_KEEP_SANDBOX" ]; then
  userns_ok=""
  if command -v unshare >/dev/null 2>&1; then
    unshare -Ur true 2>/dev/null && userns_ok=1
  elif [ "$(sysctl -n kernel.unprivileged_userns_clone 2>/dev/null)" != "0" ] && \
       [ "$(sysctl -n kernel.apparmor_restrict_unprivileged_userns 2>/dev/null)" != "1" ]; then
    userns_ok=1
  fi
  if [ -z "$userns_ok" ]; then
    sb="$DIR/chrome-sandbox"
    suid_ok=""
    if [ -u "$sb" ] && [ "$(stat -c %u "$sb" 2>/dev/null)" = "0" ]; then
      case ",$(findmnt -no OPTIONS -T "$DIR" 2>/dev/null | tr -d ' ')," in
        *,nosuid,*) ;;
        *) suid_ok=1 ;;
      esac
    fi
    [ -z "$suid_ok" ] && FLAG="--no-sandbox"
  fi
fi
exec "$DIR/connect-plus.bin" $FLAG "$@"
