#Requires -Version 5
<#
  OpenEng AI Engine - one-line installer for Windows (PowerShell).

      irm https://openeng.app/engine/install.ps1 | iex

  The engine runs open-weight models on your machine and dials out to reach the
  web app (app.openeng.app) - it opens no inbound port and is not a server. One
  engine per machine. This script downloads the prebuilt `openeng.exe` engine
  binary, checksum-verifies it, installs it to a user directory, and adds that
  directory to your PATH. No source, no Rust toolchain, no build step.

  ── SAFETY INVARIANT — why this file exists and must be served as text/plain ──
  openeng.app is a single-page app behind a catch-all rewrite: a request for a
  MISSING path returns the SPA's index.html with HTTP 200 (not a 404). Two ways
  that bites an installer, both defended here:
    1. If this very file were missing, `irm .../install.ps1 | iex` would fetch
       the SPA HTML and execute it as PowerShell. Fix: this file exists AND
       firebase.json serves /engine/install.ps1 as text/plain.
    2. If the Windows binary is missing, a naive download would save the SPA
       HTML and try to run it. Fix: this script sniffs the PE 'MZ' magic and
       HTML markers and REFUSES to install or execute anything that is not a
       genuine native Windows executable.
  Hard rule: SPA HTML is NEVER written as a binary or piped into execution.

  Tunables (environment):
    OPENENG_ENGINE_URL  base URL for binaries  (default https://openeng.app/engine/bin)
    OPENENG_BIN_DIR     install directory      (default %LOCALAPPDATA%\Programs\OpenEng)
    OPENENG_NO_MODELS=1 skip the default model pull
#>

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# Self-context guard: this must run as PowerShell. If anything other than a real
# PowerShell script reached this point (e.g. HTML somehow piped to iex), bail
# loudly rather than limp on. (HTML is not valid PowerShell, so iex would throw
# before here; this is belt-and-suspenders for the "script's own context".)
if ($null -eq $PSVersionTable) {
  Write-Host "error: this installer must be run with PowerShell (irm ... | iex)." -ForegroundColor Red
  exit 1
}

# Force TLS 1.2+ (Windows PowerShell 5.1 still defaults to TLS 1.0).
try {
  [Net.ServicePointManager]::SecurityProtocol = `
    [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
} catch { }

function Write-Step($m) { Write-Host "==> $m" -ForegroundColor Cyan }
function Write-Ok($m)   { Write-Host "ok: $m"  -ForegroundColor Green }
function Write-Warn($m) { Write-Host "!   $m"  -ForegroundColor Yellow }
function Die($m)        { Write-Host "error: $m" -ForegroundColor Red; exit 1 }

$base   = if ($env:OPENENG_ENGINE_URL) { $env:OPENENG_ENGINE_URL } else { 'https://openeng.app/engine/bin' }
$binDir = if ($env:OPENENG_BIN_DIR)    { $env:OPENENG_BIN_DIR }    else { Join-Path $env:LOCALAPPDATA 'Programs\OpenEng' }
$asset  = 'openeng-windows-x86_64.exe'
$url    = "$base/$asset"
$dest   = Join-Path $binDir 'openeng.exe'

# The exact, actionable message shown until the native Windows binary publishes.
$wslMessage = "The native Windows build is coming soon — run OpenEng under WSL today: wsl bash -c 'curl -fsSL https://openeng.app/engine/install.sh | bash'"

function Show-WindowsComingSoon {
  # Print the actionable notice verbatim as its own clean line, then exit 0:
  # a missing native Windows binary is expected today, not a failure.
  Write-Host ""
  Write-Host $wslMessage -ForegroundColor Yellow
  exit 0
}

# Real Windows executables begin with the PE/DOS 'MZ' signature (0x4D 0x5A).
function Test-IsPeExecutable {
  param([byte[]]$Bytes)
  return ($Bytes -and $Bytes.Length -ge 2 -and $Bytes[0] -eq 0x4D -and $Bytes[1] -eq 0x5A)
}

# HTML sniff over the first bytes — catches the SPA index.html the catch-all
# rewrite returns for a missing path (which arrives with HTTP 200).
function Test-LooksLikeHtml {
  param([byte[]]$Bytes)
  if (-not $Bytes -or $Bytes.Length -eq 0) { return $false }
  $n = [Math]::Min($Bytes.Length, 512)
  $head = [System.Text.Encoding]::ASCII.GetString($Bytes, 0, $n).Trim().ToLowerInvariant()
  if ($head.StartsWith('<!doctype') -or $head.StartsWith('<html') -or
      $head.StartsWith('<head') -or $head.StartsWith('<body') -or $head.StartsWith('<!--')) { return $true }
  if ($head.StartsWith('<') -and ($head -match '<(html|head|body|title|script|meta|!doctype)')) { return $true }
  return $false
}

Write-Host "+--- OpenEng AI Engine installer (Windows) ---+" -ForegroundColor Cyan
Write-Step "Downloading $asset ..."

$tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("openeng-" + [System.IO.Path]::GetRandomFileName() + ".exe")
$bytes = $null
try {
  Invoke-WebRequest -Uri $url -OutFile $tmp -UseBasicParsing -MaximumRedirection 3 -TimeoutSec 120
  $bytes = [System.IO.File]::ReadAllBytes($tmp)
} catch {
  $status = $null
  try { $status = [int]$_.Exception.Response.StatusCode } catch { }
  Remove-Item $tmp -Force -ErrorAction SilentlyContinue
  if ($status -eq 404) {
    # Binary not published yet — the expected case today.
    Show-WindowsComingSoon
  }
  Die "could not download $url ($($_.Exception.Message))"
}

# THE GUARD: only a genuine native executable is ever installed. The catch-all
# rewrite hands back the SPA's HTML (HTTP 200) for a path with no file, so a
# missing binary shows up here as HTML / non-PE bytes — treat that as "not
# published yet" and point the user at WSL. SPA HTML is never run.
if ((Test-LooksLikeHtml $bytes) -or -not (Test-IsPeExecutable $bytes)) {
  Remove-Item $tmp -Force -ErrorAction SilentlyContinue
  Show-WindowsComingSoon
}

# Verify checksum — enforced only when a real .sha256 sidecar is published.
# (A missing sidecar also returns SPA HTML; its first token won't be 64 hex, so
# enforcement is simply skipped, exactly like the Linux/macOS install.sh.)
$shaText = $null
try {
  $shaText = (Invoke-WebRequest -Uri "$url.sha256" -UseBasicParsing -MaximumRedirection 3 -TimeoutSec 60).Content
} catch { $shaText = $null }
if ($shaText) {
  $want = (($shaText -split '\s+') | Select-Object -First 1).Trim().ToLowerInvariant()
  if ($want -match '^[0-9a-f]{64}$') {
    $got = (Get-FileHash -Algorithm SHA256 -Path $tmp).Hash.ToLowerInvariant()
    if ($got -ne $want) {
      Remove-Item $tmp -Force -ErrorAction SilentlyContinue
      Die "checksum mismatch for $asset (got $got, want $want)."
    }
    Write-Ok "checksum verified"
  }
}

# Install on PATH (user scope — no admin needed).
New-Item -ItemType Directory -Force -Path $binDir | Out-Null
Move-Item -Path $tmp -Destination $dest -Force
Write-Ok "installed $dest"

$userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
if (-not $userPath) { $userPath = '' }
$parts = @($userPath -split ';' | Where-Object { $_ -ne '' })
if ($parts -notcontains $binDir) {
  [Environment]::SetEnvironmentVariable('Path', (($parts + $binDir) -join ';'), 'User')
  $env:Path = "$env:Path;$binDir"
  Write-Warn "Added $binDir to your PATH — open a new terminal for it to take effect."
}

$agentRoot = Join-Path $env:USERPROFILE '.openeng'
New-Item -ItemType Directory -Force -Path $agentRoot | Out-Null
Write-Ok "agent root at $agentRoot"

# Default on-device chat model (best-effort; the engine also pulls what a config
# needs on `serve`). Skipped with OPENENG_NO_MODELS=1.
if ($env:OPENENG_NO_MODELS -eq '1') {
  Write-Step "skipping model pull (OPENENG_NO_MODELS=1) — serve downloads what a config needs"
} else {
  Write-Step "Pulling the default chat model (a few GB; can take a while)..."
  try {
    & $dest pull chat
    if ($LASTEXITCODE -ne 0) { Write-Warn "model pull did not finish — run 'openeng pull chat' later" }
  } catch {
    Write-Warn "model pull did not finish — run 'openeng pull chat' later"
  }
}

Write-Host ""
Write-Ok "Done. Start the engine:  openeng serve   (then open https://app.openeng.app — it connects automatically)"