#!/bin/sh
# ArgusRed installer — downloads the latest release binary over HTTPS.
#
# Usage:
#   curl -fsSL https://argusred.com/install | sh
#
# This script uses plain HTTPS downloads (no git, no Homebrew, no GitHub
# credentials), so it will never trigger a macOS keychain / git-credential
# prompt. It downloads the published release tarball from the public
# CosineAI/argusred-dist repo, verifies its SHA-256 checksum, and installs the
# `argusred` binary into a directory on your PATH.
#
# Environment overrides:
#   ARGUSRED_INSTALL_DIR   install location (default: /usr/local/bin, falling
#                          back to ~/.local/bin when not writable)
#   ARGUSRED_VERSION       specific release tag to install (default: latest)

set -eu

DIST_REPO="CosineAI/argusred-dist"
RELEASE_BASE="https://github.com/${DIST_REPO}/releases"

red()   { printf '\033[31m%s\033[0m\n' "$1"; }
green() { printf '\033[32m%s\033[0m\n' "$1"; }
bold()  { printf '\033[1m%s\033[0m\n' "$1"; }
info()  { printf '  %s\n' "$1"; }
die()   { red "error: $1" >&2; exit 1; }

# ---- preflight ------------------------------------------------------------
command -v curl >/dev/null 2>&1 || die "curl is required but not installed."

OS="$(uname -s)"
ARCH="$(uname -m)"

case "${OS}" in
  Darwin)
    case "${ARCH}" in
      arm64|aarch64) PLATFORM="darwin-arm64" ;;
      x86_64)
        die "ArgusRed ships Apple Silicon (arm64) macOS builds only. Detected Intel (x86_64); Intel/Rosetta builds are coming soon." ;;
      *) die "Unsupported macOS architecture: ${ARCH}." ;;
    esac
    ;;
  Linux)
    case "${ARCH}" in
      x86_64|amd64)  PLATFORM="linux-amd64" ;;
      aarch64|arm64) PLATFORM="linux-arm64" ;;
      *) die "Unsupported Linux architecture: ${ARCH}." ;;
    esac
    ;;
  *) die "Unsupported OS: ${OS}. ArgusRed ships macOS (arm64) and Linux (amd64/arm64) builds." ;;
esac

ASSET="argusred-${PLATFORM}.tar.gz"

# ---- resolve download URLs ------------------------------------------------
VERSION="${ARGUSRED_VERSION:-latest}"
if [ "${VERSION}" = "latest" ]; then
  URL="${RELEASE_BASE}/latest/download/${ASSET}"
  SUM_URL="${RELEASE_BASE}/latest/download/${ASSET}.sha256"
else
  URL="${RELEASE_BASE}/download/${VERSION}/${ASSET}"
  SUM_URL="${RELEASE_BASE}/download/${VERSION}/${ASSET}.sha256"
fi

bold "Installing ArgusRed (${PLATFORM}, ${VERSION})"

# ---- download -------------------------------------------------------------
TMP="$(mktemp -d)"
trap 'rm -rf "${TMP}"' EXIT

info "Downloading ${ASSET}..."
curl -fsSL "${URL}" -o "${TMP}/${ASSET}" || die "download failed: ${URL}"

# ---- verify checksum ------------------------------------------------------
if curl -fsSL "${SUM_URL}" -o "${TMP}/${ASSET}.sha256" 2>/dev/null; then
  EXPECTED="$(awk '{print $1}' "${TMP}/${ASSET}.sha256")"
  if command -v shasum >/dev/null 2>&1; then
    ACTUAL="$(shasum -a 256 "${TMP}/${ASSET}" | awk '{print $1}')"
  elif command -v sha256sum >/dev/null 2>&1; then
    ACTUAL="$(sha256sum "${TMP}/${ASSET}" | awk '{print $1}')"
  else
    ACTUAL=""
  fi
  if [ -n "${ACTUAL}" ]; then
    [ "${EXPECTED}" = "${ACTUAL}" ] || die "checksum mismatch (expected ${EXPECTED}, got ${ACTUAL})."
    info "Checksum verified."
  else
    info "No SHA-256 tool found; skipping checksum verification."
  fi
else
  info "No checksum file published; skipping verification."
fi

# ---- unpack ---------------------------------------------------------------
tar -xzf "${TMP}/${ASSET}" -C "${TMP}"
[ -f "${TMP}/argusred" ] || die "archive did not contain the argusred binary."
chmod 0755 "${TMP}/argusred"

# On macOS, strip the quarantine attribute so Gatekeeper doesn't block the
# (not-yet-notarized) binary. No-op elsewhere / if the attribute is absent.
if [ "${OS}" = "Darwin" ]; then
  xattr -dr com.apple.quarantine "${TMP}/argusred" 2>/dev/null || true
fi

# ---- choose install dir ---------------------------------------------------
# Honor an explicit ARGUSRED_INSTALL_DIR exactly (create it if missing); only
# the default location auto-falls-back to a user-writable dir when not writable.
if [ -n "${ARGUSRED_INSTALL_DIR:-}" ]; then
  INSTALL_DIR="${ARGUSRED_INSTALL_DIR}"
  mkdir -p "${INSTALL_DIR}" 2>/dev/null \
    || die "cannot create ARGUSRED_INSTALL_DIR: ${INSTALL_DIR}"
  [ -w "${INSTALL_DIR}" ] \
    || die "ARGUSRED_INSTALL_DIR is not writable: ${INSTALL_DIR}"
else
  INSTALL_DIR="/usr/local/bin"
  # /usr/local/bin commonly needs sudo; prefer a user-writable fallback.
  if [ ! -d "${INSTALL_DIR}" ] || [ ! -w "${INSTALL_DIR}" ]; then
    INSTALL_DIR="${HOME}/.local/bin"
    mkdir -p "${INSTALL_DIR}"
  fi
fi

install -m 0755 "${TMP}/argusred" "${INSTALL_DIR}/argusred" 2>/dev/null \
  || { mkdir -p "${INSTALL_DIR}" && cp "${TMP}/argusred" "${INSTALL_DIR}/argusred" && chmod 0755 "${INSTALL_DIR}/argusred"; }

green "Installed argusred -> ${INSTALL_DIR}/argusred"

# ---- PATH hint + next steps ----------------------------------------------
case ":${PATH}:" in
  *":${INSTALL_DIR}:"*) ON_PATH=1 ;;
  *) ON_PATH=0 ;;
esac

echo
bold "Next steps"
if [ "${ON_PATH}" -eq 0 ]; then
  info "Add ArgusRed to your PATH (then restart your shell):"
  info "  echo 'export PATH=\"${INSTALL_DIR}:\$PATH\"' >> ~/.zshrc"
  info "Then run:"
  info "  argusred"
else
  info "Run ArgusRed:"
  info "  argusred"
fi
info "On first launch ArgusRed opens your browser to sign in with Cosine."
echo
info "Update later by re-running this installer."