#!/usr/bin/env bash
#
# OpenEng Terminal Engine - one-line installer (Linux & macOS; Windows via WSL / Git Bash).
#
# Downloads a prebuilt `openeng-terminal` engine binary from openeng.app and installs it.
# This is the LOCAL engine that terminal.openeng.app drives over a sealed, end-to-end-encrypted channel. It runs
# all PTY/command execution on your machine; its only cloud call is authenticating you.
# No source code, no Rust toolchain, no model download - just the binary.
#
#   curl -fsSL https://openeng.app/engine/terminal/install.sh | bash
#
# Tunables (environment):
#   OPENENG_TERMINAL_URL  base URL for binaries  (default: https://openeng.app/engine/terminal/bin)
#   OPENENG_BIN_DIR       install directory      (default: ~/.local/bin)
#
# NOTE: keep this script pure ASCII (macOS bash 3.2 + set -u).
#
set -eu

if [ -t 1 ]; then
  esc=$(printf '\033')
  BLUE="${esc}[36m"; GRN="${esc}[32m"; RED="${esc}[31m"; DIM="${esc}[2m"; NC="${esc}[0m"
else
  BLUE=''; GRN=''; RED=''; DIM=''; NC=''
fi
say()  { printf "${BLUE}==>${NC} %s\n" "$1"; }
ok()   { printf "${GRN}ok:${NC} %s\n" "$1"; }
warn() { printf "${RED}!${NC} %s\n" "$1" >&2; }
die()  { printf "${RED}error: %s${NC}\n" "$1" >&2; exit 1; }
have() { command -v "$1" >/dev/null 2>&1; }

OPENENG_TERMINAL_URL="${OPENENG_TERMINAL_URL:-https://openeng.app/engine/terminal/bin}"
OPENENG_BIN_DIR="${OPENENG_BIN_DIR:-$HOME/.local/bin}"

printf "${BLUE}+--- OpenEng Terminal Engine installer --------+${NC}\n"

# -- detect platform ---------------------------------------------------------
os="$(uname -s 2>/dev/null || echo unknown)"
arch="$(uname -m 2>/dev/null || echo unknown)"
case "$os" in
  Linux)  OS=linux ;;
  Darwin) OS=darwin ;;
  MINGW*|MSYS*|CYGWIN*)
    die "Windows shell detected. Use PowerShell or WSL." ;;
  *) die "unsupported OS '${os}'." ;;
esac
case "$arch" in
  x86_64|amd64)  ARCH=x86_64 ;;
  arm64|aarch64) ARCH=aarch64 ;;
  *) die "unsupported architecture '${arch}'." ;;
esac
ASSET="openeng-terminal-${OS}-${ARCH}"
URL="${OPENENG_TERMINAL_URL}/${ASSET}"

# -- prerequisites -----------------------------------------------------------
have curl || die "curl is required."

# -- download ----------------------------------------------------------------
say "Downloading openeng-terminal (${OS}/${ARCH}) ..."
TMP="$(mktemp 2>/dev/null || echo "${TMPDIR:-/tmp}/openeng-terminal.$$")"
curl -fSL --proto '=https' --tlsv1.2 "$URL" -o "$TMP" \
  || die "could not download ${URL} -- no terminal engine binary published for ${OS}/${ARCH} yet."

# A static host may answer a missing file with its SPA/HTML page (HTTP 200). Real
# binaries never start with '<', so reject an HTML page up front.
if [ "$(head -c 1 "$TMP" 2>/dev/null)" = "<" ]; then
  rm -f "$TMP"
  die "no terminal engine binary published for ${OS}/${ARCH} yet (the URL returned a web page)."
fi

# -- verify checksum (enforced only if a real .sha256 is published) ----------
if curl -fsSL "${URL}.sha256" -o "${TMP}.sha256" 2>/dev/null; then
  WANT="$(cut -d' ' -f1 < "${TMP}.sha256" 2>/dev/null || echo)"
  rm -f "${TMP}.sha256"
  if printf '%s' "$WANT" | grep -Eq '^[0-9a-fA-F]{64}$'; then
    if   have sha256sum; then GOT="$(sha256sum "$TMP" | cut -d' ' -f1)"
    elif have shasum;    then GOT="$(shasum -a 256 "$TMP" | cut -d' ' -f1)"
    else GOT=""; fi
    if [ -n "$GOT" ] && [ "$GOT" != "$WANT" ]; then
      rm -f "$TMP"; die "checksum mismatch for ${ASSET} (got ${GOT}, want ${WANT})."
    fi
    [ -n "$GOT" ] && ok "checksum verified"
  fi
fi

chmod 0755 "$TMP"
if [ "$OS" = "darwin" ]; then xattr -d com.apple.quarantine "$TMP" >/dev/null 2>&1 || true; fi
# Sanity: the engine binary runs (it prints usage on --help).
"$TMP" --help >/dev/null 2>&1 || { rm -f "$TMP"; die "the downloaded engine did not run (wrong platform or corrupt download)."; }

# -- install on PATH ---------------------------------------------------------
mkdir -p "$OPENENG_BIN_DIR"
mv -f "$TMP" "$OPENENG_BIN_DIR/openeng-terminal"
chmod 0755 "$OPENENG_BIN_DIR/openeng-terminal"
# The beta engine is UNSIGNED (ad-hoc on macOS). Strip the quarantine attribute from the installed
# binary so macOS Gatekeeper runs it with no "unidentified developer" prompt (curl sets no quarantine,
# but a proxy/AV might — do it defensively so the user never has a permission problem).
if [ "$OS" = "darwin" ]; then xattr -dr com.apple.quarantine "$OPENENG_BIN_DIR/openeng-terminal" >/dev/null 2>&1 || true; fi
ok "installed ${OPENENG_BIN_DIR}/openeng-terminal"

case ":$PATH:" in
  *":$OPENENG_BIN_DIR:"*) ;;
  *)
    LINE="export PATH=\"$OPENENG_BIN_DIR:\$PATH\""
    for rc in "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.profile"; do
      if [ -f "$rc" ] && ! grep -qF "$OPENENG_BIN_DIR" "$rc" 2>/dev/null; then
        printf '\n# OpenEng Terminal Engine\n%s\n' "$LINE" >> "$rc"
      fi
    done
    warn "Added ${OPENENG_BIN_DIR} to your shell rc - run \`${LINE}\` or open a new terminal." ;;
esac

mkdir -p "$HOME/.openeng"
ok "agent root at ${HOME}/.openeng"

printf "\n"
ok "Done. Start it:  ${BLUE}openeng-terminal serve --oauth=<key>${NC}   ${DIM}(copy the one-time key from terminal.openeng.app)${NC}"