#!/bin/sh
#
# ThreadBear installer — https://threadbear.dev
#
#   curl -fsSL https://threadbear.dev/install.sh | sh
#
# What this script does, and nothing more:
#   1. Confirms you are on macOS and picks the right architecture.
#   2. Resolves the latest published release of ericlitman/threadbear.
#   3. Downloads the archive and its published SHA-256 checksum.
#   4. Verifies the checksum BEFORE anything is extracted or executed.
#   5. Installs the binary to ~/.local/bin (no sudo, ever).
#   6. Hands off to `threadbear install`, which explains what it will change
#      and asks for one confirmation before it touches Codex or your LaunchAgent.
#
# It does not write outside ~/.local, does not need root, and does not configure
# anything on its own. Read it, then run it.

set -eu

REPO="ericlitman/threadbear"
BIN_DIR="${THREADBEAR_BIN_DIR:-$HOME/.local/bin}"
API="https://api.github.com/repos/$REPO/releases/latest"

# --- pretty output (degrades to plain text when not a tty) --------------------
if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
  B=$(printf '\033[1m'); DIM=$(printf '\033[2m'); R=$(printf '\033[0m')
  YEL=$(printf '\033[33m'); RED=$(printf '\033[31m'); GRN=$(printf '\033[32m')
else
  B=''; DIM=''; R=''; YEL=''; RED=''; GRN=''
fi

say()  { printf '%s\n' "$*"; }
step() { printf '%s==>%s %s\n' "$YEL" "$R" "$*"; }
die()  { printf '%s\n' "" >&2; printf '%serror:%s %s\n' "$RED" "$R" "$1" >&2; exit 1; }

printf '\n  %s🧵🐻 ThreadBear%s\n  %swrangle your Codex threads%s\n\n' "$B" "$R" "$DIM" "$R"

# --- platform ----------------------------------------------------------------
OS=$(uname -s)
[ "$OS" = "Darwin" ] || die "ThreadBear is macOS-only (it manages Codex Desktop and a LaunchAgent). Detected: $OS"

case $(uname -m) in
  arm64)  ARCH="arm64" ;;
  x86_64) ARCH="amd64" ;;
  *)      die "unsupported architecture: $(uname -m)" ;;
esac

for cmd in curl shasum tar mkdir; do
  command -v "$cmd" >/dev/null 2>&1 || die "required command not found: $cmd"
done

# --- resolve the latest release ---------------------------------------------
step "Looking for the latest release…"

HTTP_BODY=$(mktemp) || die "could not create a temp file"
CLEANUP_FILES="$HTTP_BODY"
# shellcheck disable=SC2064
trap 'rm -rf $CLEANUP_FILES' EXIT INT TERM

HTTP_CODE=$(curl -sSL -w '%{http_code}' -o "$HTTP_BODY" \
  -H 'Accept: application/vnd.github+json' "$API" 2>/dev/null || echo "000")

if [ "$HTTP_CODE" = "404" ]; then
  cat <<EOF

  ${B}ThreadBear v1 has not been published yet.${R}

  The site is live a little ahead of the binary. There is no release to
  install today, so this script is stopping rather than pretending otherwise.

  To hear about v1:
    ${B}https://github.com/$REPO${R}   (watch or star the repo)

EOF
  exit 1
fi

[ "$HTTP_CODE" = "200" ] || die "could not reach the GitHub release API (HTTP $HTTP_CODE). Check your connection and try again."

# Pull the tag without requiring jq.
VERSION=$(sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$HTTP_BODY" | head -n 1)
[ -n "$VERSION" ] || die "could not parse a release tag from the GitHub API response."

# Asset naming contract with the product repo's release workflow.
# If the release workflow changes these names, this script must change with it.
ASSET="threadbear_${VERSION#v}_darwin_${ARCH}.tar.gz"
BASE="https://github.com/$REPO/releases/download/$VERSION"

say "    found ${B}${VERSION}${R} (darwin/${ARCH})"

# --- download ----------------------------------------------------------------
TMP=$(mktemp -d) || die "could not create a temp directory"
CLEANUP_FILES="$HTTP_BODY $TMP"

step "Downloading $ASSET…"
curl -fsSL -o "$TMP/$ASSET" "$BASE/$ASSET" \
  || die "download failed: $BASE/$ASSET"

step "Downloading checksums…"
curl -fsSL -o "$TMP/checksums.txt" "$BASE/checksums.txt" \
  || die "could not download checksums.txt. Refusing to install an unverified binary."

# --- verify (before extracting anything) -------------------------------------
step "Verifying SHA-256…"
EXPECTED=$(grep " $ASSET\$" "$TMP/checksums.txt" | awk '{print $1}' | head -n 1)
[ -n "$EXPECTED" ] || die "no checksum published for $ASSET. Refusing to install."

ACTUAL=$(shasum -a 256 "$TMP/$ASSET" | awk '{print $1}')
if [ "$EXPECTED" != "$ACTUAL" ]; then
  die "checksum mismatch for $ASSET
    expected: $EXPECTED
    actual:   $ACTUAL
  The download does not match the published release. Nothing was installed."
fi
say "    ${GRN}ok${R} $ACTUAL"

# --- install -----------------------------------------------------------------
step "Installing to $BIN_DIR…"
tar -xzf "$TMP/$ASSET" -C "$TMP" || die "could not extract $ASSET"
[ -f "$TMP/threadbear" ] || die "archive did not contain a 'threadbear' binary"

mkdir -p "$BIN_DIR" || die "could not create $BIN_DIR"
chmod +x "$TMP/threadbear"
mv -f "$TMP/threadbear" "$BIN_DIR/threadbear" || die "could not install to $BIN_DIR"
say "    ${GRN}ok${R} $BIN_DIR/threadbear"

# --- PATH check --------------------------------------------------------------
case ":$PATH:" in
  *":$BIN_DIR:"*) ;;
  *)
    printf '\n  %swarning:%s %s is not on your PATH.\n' "$YEL" "$R" "$BIN_DIR"
    printf '  Add this to your shell profile:\n\n    export PATH="%s:$PATH"\n' "$BIN_DIR"
    ;;
esac

# --- hand off to the binary's own guided setup -------------------------------
cat <<EOF

  ${B}Installed.${R} Next, run the guided setup:

    ${B}threadbear install${R}

  It explains the product, the token model, the paths it uses, the LaunchAgent,
  and the control task, then asks once before changing anything.

EOF