#!/bin/sh
# puq install script — downloads and installs the binary from the puq-ai/code release feed,
# verifying the SHA-256 against the release manifest. Places the binary under
# ~/.local/share/puq/versions/<version> and points ~/.local/bin/puq at it — the same layout
# `puq update` and the background updater manage (packages/coding-agent/src/cli/update-cli.ts),
# so a curl install and a later self-update interoperate without migration. A prior plain-file
# install (e.g. a hand-copied binary) is migrated into this layout automatically the next time
# it self-updates.
#
#   curl -fsSL https://github.com/puq-ai/code/releases/download/channels/install.sh | sh
#   curl -fsSL .../channels/install.sh | sh -s -- latest
#   curl -fsSL .../channels/install.sh | sh -s -- 1.2.3
#   ./install.sh latest
#
# Output: one "[n/7] ✓ …" line per finished stage (platform, version, manifest, download, SHA-256,
# install, smoke test); a failure names the stage it stopped at. When stderr is a terminal (and
# TERM isn't "dumb"), the running stage is animated in place on stderr — a spinner, and for the
# binary download a bar with percent, MB and current speed measured against the manifest's byte
# size, so curl and wget look the same. Anything else (CI logs, `2>file`) gets only the
# finished-stage lines: no \r frames end up in log files.
#
# Environment variables:
#   PUQ_CODE_INSTALL_DIR       launcher directory (default: ~/.local/bin)
#   PUQ_CODE_CODING_AGENT_DIR  settings directory (default: ~/.puq/agent)
#   PUQ_CODE_RELEASES_URL      feed base URL — for test/mirror purposes only
#                         (default: https://github.com/puq-ai/code/releases/download)
set -eu

BASE="${PUQ_CODE_RELEASES_URL:-https://github.com/puq-ai/code/releases/download}"
BASE="${BASE%/}"
INSTALL_DIR="${PUQ_CODE_INSTALL_DIR:-$HOME/.local/bin}"
AGENT_DIR="${PUQ_CODE_CODING_AGENT_DIR:-$HOME/.puq/agent}"
VERSIONS_DIR="$HOME/.local/share/puq/versions"
REQUEST="stable"
STEPS=7

usage() {
	cat <<'EOF'
Usage: install.sh [stable|latest|X.Y.Z] [--help]

  stable (default)   Install the stable channel (trails latest by roughly a week)
  latest             Install the latest channel
  X.Y.Z              Install a specific version
  --help             Show this help

Environment variables:
  PUQ_CODE_INSTALL_DIR, PUQ_CODE_CODING_AGENT_DIR, PUQ_CODE_RELEASES_URL
EOF
}

EXPLICIT_CHANNEL=""
case "${1:-}" in
	--help | -h)
		usage
		exit 0
		;;
	"") ;;
	latest | stable)
		REQUEST="$1"
		EXPLICIT_CHANNEL="$1"
		;;
	*)
		REQUEST="$1"
		;;
esac

# --- progress output ------------------------------------------------------------
step_no=0
step_label=""
spin=0
frame_text=""
bg_pid=""
live_err=""
tmp=""
link=""

# Live frames go to fd 3 (a copy of the terminal stderr), so a caller's `2>&1` capture — the
# smoke test reads `puq --version 2>&1` — never swallows them.
live=0
if [ -t 2 ] && [ "${TERM:-dumb}" != "dumb" ]; then
	live=1
	exec 3>&2
fi

clear_line() {
	if [ "$live" = 1 ]; then
		printf '\r\033[K' >&3
	fi
}

fail() {
	clear_line
	if [ "$step_no" -gt 0 ]; then
		echo "✗ [$step_no/$STEPS] $1" >&2
	else
		echo "✗ $1" >&2
	fi
	exit 1
}

# `rm -f` stays the single unconditional last command, never a guarded `[ -n "$x" ] && rm -f "$x"`:
# if that guard is false (nothing to clean up) it's *also* the trap's own exit status, and /bin/sh
# replaces a successful script's exit code with it — a real install would report failure. `rm -f`
# is always safe (empty string or an already-moved-away path is a no-op). The background download
# ignores SIGINT (POSIX: async lists in a non-interactive shell do), so it is killed explicitly.
trap 'clear_line; if [ -n "$bg_pid" ]; then kill "$bg_pid" 2>/dev/null || :; fi; rm -f "$tmp" "$link" "$live_err"' EXIT
# dash dies from an untrapped signal without running the EXIT trap; route Ctrl-C/TERM through
# `exit` so the partial download is still killed and removed.
trap 'clear_line; echo "✗ interrupted" >&2; exit 130' INT
trap 'exit 143' TERM HUP

if [ "$live" = 1 ]; then
	# run_live replays a backgrounded command's stderr from here once its frame is cleared.
	live_err=$(mktemp "${TMPDIR:-/tmp}/puq-code-install.XXXXXX" 2>/dev/null) || live=0
fi
if [ "$live" = 1 ]; then
	if sleep 0.1 2>/dev/null; then tick=0.1; else tick=1; fi
	# Keep the download frame on one row: a wrapped row can't be erased with \r.
	cols=$(stty size <&3 2>/dev/null | awk '{print $2}') || cols=""
	case "$cols" in
		"" | 0 | *[!0-9]*) cols=80 ;;
	esac
	bar_width=$((cols - 60))
	if [ "$bar_width" -gt 30 ]; then bar_width=30; fi
	if [ "$bar_width" -lt 10 ]; then bar_width=10; fi
fi

# frame <text> — redraws the current stage row with the next spinner glyph.
frame() {
	case $((spin % 10)) in
		0) g='⠋' ;;
		1) g='⠙' ;;
		2) g='⠹' ;;
		3) g='⠸' ;;
		4) g='⠼' ;;
		5) g='⠴' ;;
		6) g='⠦' ;;
		7) g='⠧' ;;
		8) g='⠇' ;;
		*) g='⠏' ;;
	esac
	spin=$((spin + 1))
	printf '\r\033[K[%d/%d] %s %s' "$step_no" "$STEPS" "$g" "$1" >&3
}

# step <label> — starts the next stage. A variable directly followed by a UTF-8 glyph is always
# braced ("${1}…"): macOS /bin/sh (bash 3.2) reads the glyph's bytes as part of the name.
step() {
	step_no=$((step_no + 1))
	step_label="$1"
	if [ "$live" = 1 ]; then
		frame "${1}…"
	fi
}

# ok <message> — finishes the current stage with a permanent line.
ok() {
	clear_line
	printf '[%d/%d] ✓ %s\n' "$step_no" "$STEPS" "$1"
}

warn() {
	clear_line
	printf '[%d/%d] ! %s\n' "$step_no" "$STEPS" "$1"
}

# Frame functions run in the current shell (not `$(…)`) and set $frame_text, so they can keep state
# between ticks — the download speed needs the previous sample.
step_text() {
	frame_text="${step_label}…"
}

# mb <bytes> — "142.0 MB".
mb() {
	t=$(($1 * 10 / 1048576))
	printf '%d.%d MB' $((t / 10)) $((t % 10))
}

# run_live <frame-fn> <cmd> [args…] — runs cmd and returns its exit status. On a terminal, cmd runs
# in the background while the frame <frame-fn> builds is redrawn every tick; its stderr is held back
# and replayed after the frame is cleared, so an error message never lands mid-frame. cmd must be an
# external command, not a shell function: `$!` has to be the process the EXIT trap kills.
run_live() {
	frame_fn=$1
	shift
	if [ "$live" = 0 ]; then
		"$@"
		return
	fi
	"$@" </dev/null 2>"$live_err" 3>&- &
	bg_pid=$!
	while kill -0 "$bg_pid" 2>/dev/null; do
		"$frame_fn"
		frame "$frame_text"
		sleep "$tick"
	done
	rc=0
	wait "$bg_pid" || rc=$?
	bg_pid=""
	if [ -s "$live_err" ]; then
		clear_line
		cat "$live_err" >&2
	fi
	return "$rc"
}

# Download frame: bar + percent against the manifest size; bytes only if the manifest has none.
# Speed is bytes over the last whole-second window; the first (partial) window only sets the mark.
download_frame() {
	got=0
	if [ -f "$tmp" ]; then
		got=$(wc -c <"$tmp" | tr -d ' ')
	fi
	now=$(date +%s)
	if [ "$now" -gt "$mark_time" ]; then
		if [ "$mark_ready" = 1 ]; then
			rate="  $(mb $(((got - mark_got) / (now - mark_time))))/s"
		fi
		mark_time=$now
		mark_got=$got
		mark_ready=1
	fi
	if [ "$size" -gt 0 ]; then
		pct=$((got * 100 / size))
		if [ "$pct" -gt 100 ]; then pct=100; fi
		filled=$((pct * bar_width / 100))
		bar=""
		i=0
		while [ "$i" -lt "$bar_width" ]; do
			if [ "$i" -lt "$filled" ]; then bar="${bar}█"; else bar="${bar}░"; fi
			i=$((i + 1))
		done
		frame_text="Downloading $bar $(printf '%3d' "$pct")%  $(mb "$got") / $(mb "$size")$rate"
	else
		frame_text="Downloading  $(mb "$got")$rate"
	fi
}

# --- 1. platform -----------------------------------------------------------
step "Detecting platform"
os=$(uname -s)
case "$os" in
	Darwin) os="darwin" ;;
	Linux) os="linux" ;;
	*) fail "unsupported operating system: $os (Windows: winget install Puq.Puq)" ;;
esac

arch=$(uname -m)
case "$arch" in
	arm64 | aarch64) arch="arm64" ;;
	x86_64 | amd64) arch="x64" ;;
	*) fail "unsupported architecture: $arch" ;;
esac
# Under Rosetta, uname reports x86_64; check the real hardware instead.
if [ "$os" = "darwin" ] && [ "$(sysctl -n hw.optional.arm64 2>/dev/null)" = "1" ]; then
	arch="arm64"
fi

if [ "$os" = "linux" ]; then
	if [ -f /etc/alpine-release ] || { command -v ldd >/dev/null 2>&1 && ldd --version 2>&1 | grep -qi musl; }; then
		fail "musl (Alpine) is not supported; glibc 2.31+ is required (verified on Debian 12 / Ubuntu 20.04+)."
	fi
fi

platform="$os-$arch"

# `$fetch <url> $to_file <dest|->`: a plain command prefix (word-split on purpose), not a function,
# so run_live backgrounds curl/wget itself — `$!` is the downloader, not a subshell whose
# SIGINT-immune child would outlive the EXIT trap's kill.
if command -v curl >/dev/null 2>&1; then
	downloader="curl"
	fetch="curl -fsSL --retry 3"
	to_file="-o"
elif command -v wget >/dev/null 2>&1; then
	downloader="wget"
	fetch="wget -q --tries=3"
	to_file="-O"
else
	fail "curl or wget is required; neither was found"
fi
ok "Platform: $platform (downloader: $downloader)"

# --- 2. version --------------------------------------------------------------
step "Resolving version"
case "$REQUEST" in
	latest | stable)
		version=$(run_live step_text $fetch "$BASE/channels/$REQUEST" $to_file -) || fail "could not read $REQUEST channel: $BASE"
		version_source="$REQUEST channel"
		;;
	*)
		version="$REQUEST"
		version_source="requested"
		;;
esac
echo "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$' || fail "invalid version: $version"
ok "Version: $version ($version_source)"

# --- 3. manifest ---------------------------------------------------------------
step "Fetching manifest"
# One line per platform (scripts/ci-release-manifest.ts writes the same shape): no jq required.
manifest=$(run_live step_text $fetch "$BASE/v$version/manifest.json" $to_file -) || fail "could not download manifest: v$version"
entry=$(echo "$manifest" | grep "\"$platform\"" || :)
checksum=$(echo "$entry" | sed -n 's/.*"checksum": *"\([0-9a-f]\{64\}\)".*/\1/p')
[ -n "$checksum" ] || fail "no $platform build for puq $version"
# Byte size drives the download percentage; a manifest without it still installs, bytes-only.
size=$(echo "$entry" | sed -n 's/.*"size": *\([0-9][0-9]*\).*/\1/p')
size=${size:-0}
if [ "$size" -gt 0 ]; then
	ok "Manifest: puq-$platform, $(mb "$size")"
else
	ok "Manifest: puq-$platform"
fi

# --- 4. download ---------------------------------------------------------------
step "Downloading puq-$platform"
mkdir -p "$VERSIONS_DIR" "$INSTALL_DIR"
# Download to a temp file in the same directory, then move into place: if the download stalls
# partway, the old puq remains, and a half-written file never gets the version name.
tmp="$VERSIONS_DIR/.$version.download.$$"
url="$BASE/v$version/puq-$platform"
dl_start=$(date +%s)
mark_time=$dl_start
mark_got=0
mark_ready=0
rate=""
run_live download_frame $fetch "$url" $to_file "$tmp" || fail "download failed: $url"
ok "Downloaded: $(mb "$(wc -c <"$tmp" | tr -d ' ')") in $(($(date +%s) - dl_start))s"

# --- 5. verify -----------------------------------------------------------------
step "Verifying SHA-256"
if command -v shasum >/dev/null 2>&1; then
	actual=$(run_live step_text shasum -a 256 "$tmp") || fail "could not hash the download"
elif command -v sha256sum >/dev/null 2>&1; then
	actual=$(run_live step_text sha256sum "$tmp") || fail "could not hash the download"
else
	actual=""
fi
actual=${actual%% *}
if [ -n "$actual" ]; then
	[ "$actual" = "$checksum" ] || fail "SHA256 verification failed (expected $checksum, got $actual) — the download may be corrupt."
	ok "SHA-256 verified"
else
	warn "no sha256 tool found, skipping integrity check"
fi

# --- 6. install: version directory + launcher symlink + settings directory -------
step "Installing"
chmod +x "$tmp"

# The binary is ad-hoc signed, not notarized. If the downloaded file has a quarantine flag,
# Gatekeeper says "developer cannot be verified"; remove the flag.
if [ "$os" = "darwin" ] && command -v xattr >/dev/null 2>&1; then
	xattr -d com.apple.quarantine "$tmp" 2>/dev/null || true
fi

# ~/.local/share/puq/versions/<version> plus a ~/.local/bin/puq symlink to it — the layout
# `puq update` and the background updater manage (update-cli.ts), so a later self-update
# reuses this file instead of re-downloading it. Swapping a symlink (never overwriting a
# file in place) means a running puq is never truncated mid-read ("text file busy" can't
# happen either — the new version gets a fresh inode).
mv -f "$tmp" "$VERSIONS_DIR/$version"
link="$INSTALL_DIR/.puq-code.link.$$"
ln -s "$VERSIONS_DIR/$version" "$link" || fail "symlink failed: is $INSTALL_DIR writable?"
mv -f "$link" "$INSTALL_DIR/puq"

seeded=""
mkdir -p "$AGENT_DIR/optimizer"
if [ ! -f "$AGENT_DIR/optimizer/config.json" ]; then
	printf '%s\n' '{"allowedPaths": []}' >"$AGENT_DIR/optimizer/config.json"
	seeded=1
fi
ok "Installed: $INSTALL_DIR/puq → $VERSIONS_DIR/$version"
if [ -n "$seeded" ]; then
	echo "      Optimizer setting: $AGENT_DIR/optimizer/config.json (no allowed paths — no code leaves your machine)"
fi

# --- 7. smoke test --------------------------------------------------------------
step "Checking the installed binary"
installed=$(run_live step_text "$INSTALL_DIR/puq" --version 2>&1) || fail "installed but not running: $installed"
case "$installed" in
	puq/*) ;;
	*) fail "unexpected version output: $installed" ;;
esac
[ "$installed" = "puq/$version" ] || fail "version mismatch: expected $version, got ${installed#puq/}"
ok "Runs: $installed"

if [ -n "$EXPLICIT_CHANNEL" ]; then
	PUQ_CODE_CODING_AGENT_DIR="$AGENT_DIR" "$INSTALL_DIR/puq" config set update.channel "$EXPLICIT_CHANNEL" >/dev/null 2>&1 \
		&& ok "Update channel: $EXPLICIT_CHANNEL" \
		|| echo "! could not save update.channel; run: puq config set update.channel $EXPLICIT_CHANNEL"
fi

echo
echo "✓ puq $version installed: $INSTALL_DIR/puq"

case ":$PATH:" in
	*":$INSTALL_DIR:"*) ;;
	*) echo "! $INSTALL_DIR is not in PATH: echo 'export PATH=\"$INSTALL_DIR:\$PATH\"' >> ~/.zshrc" ;;
esac

cat <<'EOF'

Next steps
  1. puq                     setup wizard on first launch
  2. /login puq              your puq token; also the Optimizer key
  3. /model                  choose role models
  4. /optimizer allow <path> you decide which paths the Optimizer can read; code never leaves while the list is empty
  5. /optimizer status       status: key, allowed paths, enabled features, spend
EOF