#!/bin/sh
# The aurora installer — served as https://get.<domain>/committee
# (bridge ROADMAP Phase 1.5; trigger fired 2026-08-25: the first operator
# who isn't the author). Piping to sh is a choice; reading first is the
# offer — this file is served text/plain for exactly that.
#
# Installs the OPERATOR-MACHINE toolchain (the pieces that run beside YOUR
# coding seat, never on the server that served this script):
#   aurora-bridge   the run spawner/executor (serve, work, orders, login)
#   aurora-agent    the board CLI — the opencode plugin drives it for every
#                   board act (claims, completions, reviews); must be on
#                   PATH for any stint to bootstrap
#   aurora-witness  optional: the L2/L3 workspace-attestation daemon —
#                   installed when the host publishes it, skipped (named)
#                   when not
#   opencode-aurora the opencode PLUGIN (personas, commands, board tools)
#                   — extracted to ~/.local/share/aurora/opencode-aurora;
#                   binaries without it spawn sessions that do nothing.
#                   Two follow-ups are yours (printed at the end): run its
#                   dependency install once, and reference it from your
#                   project's opencode.json
#
# Everything is sha256-verified against the host's checksums.txt — no
# checksum, no install. Binaries go to ~/.local/bin; NO sudo, no system
# paths. Narrow with AURORA_INSTALL_ONLY="aurora-bridge" (comma-separated
# component names).
set -eu

BASE="${AURORA_GET_BASE:-https://get.acoord.se}"
DEST="${AURORA_INSTALL_DIR:-$HOME/.local/bin}"
ONLY="${AURORA_INSTALL_ONLY:-}"

os="$(uname -s | tr '[:upper:]' '[:lower:]')"
arch="$(uname -m)"
case "$os" in
  linux|darwin) ;;
  *) echo "install: unsupported OS '$os' — build from source instead (cargo build --release)" >&2; exit 1 ;;
esac
case "$arch" in
  x86_64|amd64) arch="x86_64" ;;
  aarch64|arm64) arch="aarch64" ;;
  *) echo "install: unsupported arch '$arch' — build from source instead" >&2; exit 1 ;;
esac

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

echo "install: fetching checksums from ${BASE}"
curl -fsSL "${BASE}/checksums.txt" -o "${tmp}/checksums.txt" || {
  echo "install: checksums.txt missing on the host — refusing to install unverified binaries" >&2
  exit 1
}

wanted() { # wanted <component> — honor AURORA_INSTALL_ONLY when set
  [ -z "$ONLY" ] && return 0
  case ",$ONLY," in *",$1,"*) return 0 ;; *) return 1 ;; esac
}

installed=""
fetch_one() { # fetch_one <component> <required?>
  name="$1"; required="$2"
  wanted "$name" || { echo "install: $name skipped (AURORA_INSTALL_ONLY)"; return 0; }
  artifact="${name}-${os}-${arch}"
  if ! curl -fsSL "${BASE}/bin/${artifact}" -o "${tmp}/${artifact}" 2>/dev/null; then
    if [ "$required" = "yes" ]; then
      echo "install: no prebuilt ${name} for ${os}/${arch} at ${BASE}/bin/ —" >&2
      echo "         the operator may not have published this platform yet (release-to-get.sh" >&2
      echo "         runs per-platform). Fallback: build from source." >&2
      exit 1
    fi
    echo "install: ${name} not published for ${os}/${arch} — skipped (optional; needed only at protection levels L2/L3)"
    return 0
  fi
  expected="$(grep " ${artifact}\$" "${tmp}/checksums.txt" | cut -d' ' -f1)"
  if [ -z "$expected" ]; then
    echo "install: no checksum entry for ${artifact} — refusing" >&2
    exit 1
  fi
  if command -v sha256sum >/dev/null 2>&1; then
    actual="$(sha256sum "${tmp}/${artifact}" | cut -d' ' -f1)"
  else
    actual="$(shasum -a 256 "${tmp}/${artifact}" | cut -d' ' -f1)"
  fi
  if [ "$expected" != "$actual" ]; then
    echo "install: CHECKSUM MISMATCH for ${artifact} (expected ${expected}, got ${actual}) — refusing" >&2
    exit 1
  fi
  mkdir -p "$DEST"
  install -m 0755 "${tmp}/${artifact}" "${DEST}/${name}"
  installed="${installed} ${name}"
}

fetch_one aurora-bridge yes
fetch_one aurora-agent yes
fetch_one aurora-witness no

# The opencode plugin: a tarball, not a binary — verified the same way,
# extracted beside the data dir. An upgrade REPLACES the directory (your
# node_modules goes with it — re-run the dependency install after).
PLUGIN_DIR="${AURORA_PLUGIN_DIR:-$HOME/.local/share/aurora/opencode-aurora}"
plugin_installed=""
if wanted "opencode-aurora"; then
  artifact="plugin/opencode-aurora.tgz"
  if ! curl -fsSL "${BASE}/${artifact}" -o "${tmp}/plugin.tgz" 2>/dev/null; then
    echo "install: the opencode plugin is not published at ${BASE}/plugin/ —" >&2
    echo "         binaries alone cannot run a stint (the plugin carries the personas +" >&2
    echo "         board tools). Ask the operator for a full release-to-get.sh publish." >&2
    exit 1
  fi
  expected="$(grep " ${artifact}\$" "${tmp}/checksums.txt" | cut -d' ' -f1)"
  if [ -z "$expected" ]; then
    echo "install: no checksum entry for ${artifact} — refusing" >&2
    exit 1
  fi
  if command -v sha256sum >/dev/null 2>&1; then
    actual="$(sha256sum "${tmp}/plugin.tgz" | cut -d' ' -f1)"
  else
    actual="$(shasum -a 256 "${tmp}/plugin.tgz" | cut -d' ' -f1)"
  fi
  if [ "$expected" != "$actual" ]; then
    echo "install: CHECKSUM MISMATCH for ${artifact} (expected ${expected}, got ${actual}) — refusing" >&2
    exit 1
  fi
  mkdir -p "${tmp}/plugin-x"
  tar xzf "${tmp}/plugin.tgz" -C "${tmp}/plugin-x"
  rm -rf "$PLUGIN_DIR"
  mkdir -p "$(dirname "$PLUGIN_DIR")"
  mv "${tmp}/plugin-x/package" "$PLUGIN_DIR"
  plugin_installed="yes"
  installed="${installed} opencode-aurora"
fi

version="$(curl -fsSL "${BASE}/version.json" 2>/dev/null | tr -d ' \n' | sed -n 's/.*"version":"\([^"]*\)".*/\1/p')" || version=""
echo "install: done${version:+ (${version})} →${installed}"

case ":$PATH:" in
  *":$DEST:"*) ;;
  *) echo "note: ${DEST} is not on your PATH — add it (e.g. export PATH=\"\$PATH:${DEST}\")" ;;
esac

echo
echo "Next, on THIS machine (everything runs beside YOUR coding seat):"
if [ -n "$plugin_installed" ]; then
  echo "  1. cd ${PLUGIN_DIR} && npm install     # once per install/upgrade (bun install works too)"
  echo "  2. in the PROJECT repo your agents will work in:"
  echo "       aurora-agent init --opencode       # writes the plugin line into its opencode.json"
  echo "     (or by hand: { \"plugin\": [\"file://${PLUGIN_DIR}/src/index.ts\"] })"
  echo "  3. make the commands + personas discoverable in that repo (F-48 preflight checks this):"
  echo "       ln -s ${PLUGIN_DIR}/command \$REPO/.opencode/command"
  echo "       ln -s ${PLUGIN_DIR}/agent   \$REPO/.opencode/agent"
  echo "     (or install them globally under ~/.config/opencode/{command,agent})"
  echo "  4. opencode --version must be ≥ 1.18.23 (below it, serve's /command 500s opaquely)"
  echo "  5. aurora-bridge login                  # browser SSO + 2FA against the board"
  echo "  6. PORT=8790 aurora-bridge serve"
  echo "     (options + env vars: ${PLUGIN_DIR}/README.md)"
else
  echo "  aurora-bridge login          # browser SSO + 2FA against the board"
  echo "  PORT=8790 aurora-bridge serve"
fi
echo "The plugin drives aurora-agent (on PATH) for every board act."
echo "Runs preflight all of this (F-48) — a missing piece is a named refusal, not a silent dud."