#!/bin/sh
set -eu

base_url='https://ouragentsync.com'
release_keys='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPxW973Ks6h77+/RlvYy7Fx6voux4iT/M3CVb7K/4FQY armslength release signing key 2026-09-29
'
release_version='v0.28.22'

fail() {
	echo "bridge installer: $*" >&2
	exit 1
}

[ -n "${HOME:-}" ] || fail "HOME is not set"
[ -n "$release_version" ] || fail "Server release version is unknown; Refusing to install. Use an installer from a released server."

assert_current_release() {
	# Capture the command status before parsing its multiline banner.
	banner=$("$1" version </dev/null) || fail "bridge version command failed at $1; Refusing to install."
	banner=$(printf '%s\n' "$banner" | head -n 1 | tr -d '\r')
	[ "$banner" = "bridge $release_version" ] || fail "Release version mismatch at $1: got '$banner', server requires bridge $release_version. Possible stale cache or downgrade; Refusing to install. Fetch a fresh installer from $base_url and retry."
}

os_name=$(uname -s 2>/dev/null || true)
case "$os_name" in
	Linux)
		os=linux
		;;
	Darwin)
		os=darwin
		;;
	*)
		fail "unsupported operating system: $os_name"
		;;
esac

arch_name=$(uname -m 2>/dev/null || true)
case "$arch_name" in
	x86_64|amd64)
		arch=amd64
		;;
	arm64|aarch64)
		arch=arm64
		;;
	*)
		fail "unsupported CPU architecture: $arch_name"
		;;
esac

file="bridge-$os-$arch"
tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/bridge-install.XXXXXX") || fail "failed to create temp dir"
trap 'rm -rf "$tmp_dir"' EXIT HUP INT TERM
cache_bust=${tmp_dir##*/}

bin_path="$tmp_dir/$file"
sums_path="$tmp_dir/SHA256SUMS"

download() {
	url=$1
	out=$2
	if command -v curl >/dev/null 2>&1; then
		curl -fsSL -H 'Cache-Control: no-cache' "$url?installer=$cache_bust" -o "$out" || fail "download failed: $url"
	else
		fail "curl is required to download bridge"
	fi
}

download "$base_url/download/$file" "$bin_path"
download "$base_url/download/SHA256SUMS" "$sums_path"
sig_path="$tmp_dir/SHA256SUMS.sig"
download "$base_url/download/SHA256SUMS.sig" "$sig_path"
[ -n "$release_keys" ] || fail "no release key pinned"

# Prefer the previously installed binary; never fall back after a verify failure.
install_dir="$HOME/.local/bin"
install_path="$install_dir/bridge"
legacy_refusal() {
 installed_version=$(printf '%s\n' "$installed_banner" | sed 's/\r$//;s/^bridge //')
 fail "Your installed bridge ($installed_version) predates signed releases, so it cannot check this download. To upgrade you must accept a one-time trust step: remove $old_bridge and re-run the installer, which then trusts this download as a first install. Only do this if you got this installer from $base_url over HTTPS. Refusing to install."
}
if [ -e "$install_path" ] || [ -L "$install_path" ]; then
 old_bridge="$install_path"
else
 old_bridge=$(command -v bridge || true)
fi
# cli/command.go's VersionOutput prints "bridge <version>" first on all OSes;
# cli/version.go supplies two/three-part release and package stamps or devel
# identities. Older unstamped Version implementations can also print unknown.
# Untagged build-release builds stamp a hash; packages use 0.0.0-g<hash>.
bridge_banner_pattern='^bridge (v?[0-9]+\.[0-9]+(\.[0-9]+)?(-[0-9]+-g[0-9a-f]+)?(-dirty)?|devel(-[0-9a-f]+)?(-dirty)?|unknown|[0-9a-f]+(-dirty)?|0\.0\.0-g[0-9a-f]{7,40}(-dirty)?)$'
# Probe an unknown command only once. iproute2's bridge is not our verifier.
if [ -n "$old_bridge" ]; then
 installed_banner=$("$old_bridge" version </dev/null 2>/dev/null | head -n 1 | tr -d '\r') || installed_banner=
 if ! printf '%s\n' "$installed_banner" | grep -Eq "$bridge_banner_pattern"; then
  [ "$old_bridge" != "$install_path" ] || fail "Unrecognized program at $install_path; Refusing to install. It does not identify itself as armslength. If you put it there, move it aside and re-run this installer."
  echo "Ignoring an unrelated 'bridge' command at $old_bridge (not armslength)."
  old_bridge=
 fi
fi
if [ -n "$old_bridge" ]; then
 capability=$("$old_bridge" release verify-capability </dev/null 2>/dev/null) || legacy_refusal
 [ "$capability" = "release-verify-v1" ] || legacy_refusal
 "$old_bridge" release verify --installer-keys "$release_keys" "$sums_path" "$sig_path" "$bin_path" </dev/null || fail "release signature verification failed; Refusing to install"
fi

expected=$(awk -v wanted="$file" '
	$2 == wanted || $2 == "*" wanted { print $1; found=1; exit }
	END { if (!found) exit 1 }
' "$sums_path") || fail "checksum for $file not found in SHA256SUMS"

if command -v sha256sum >/dev/null 2>&1; then
	actual=$(sha256sum "$bin_path" | awk '{print $1}')
elif command -v shasum >/dev/null 2>&1; then
	actual=$(shasum -a 256 "$bin_path" | awk '{print $1}')
else
	fail "sha256sum or shasum is required to verify bridge"
fi

expected=$(printf '%s' "$expected" | tr 'A-F' 'a-f')
actual=$(printf '%s' "$actual" | tr 'A-F' 'a-f')

if [ "$actual" != "$expected" ]; then
	fail "CHECKSUM MISMATCH for $file. Expected $expected, got $actual. Refusing to install."
fi

if [ -z "$old_bridge" ]; then
 echo "WARNING: No existing bridge found at the install path or on PATH. Bootstrap: trusting the downloaded binary to verify itself; a tampered binary could lie." >&2
 chmod 0755 "$bin_path"
 "$bin_path" release verify --installer-keys "$release_keys" "$sums_path" "$sig_path" "$bin_path" || fail "release signature verification failed; Refusing to install"
fi

# SHA256SUMS authenticates the binary whose banner supplies the release version.
# Require the server's exact release even on first install or ALLOW_DOWNGRADE=1;
# this also refuses every release below the rendered version without new keys.
chmod 0755 "$bin_path"
assert_current_release "$bin_path"

# Compare authenticated binaries before replacing the install target. Numeric tags
# and git-describe distance are ordered; ambiguous/dev versions require opt-in.
if [ -n "$old_bridge" ] && [ "${ALLOW_DOWNGRADE:-0}" != 1 ]; then
 old_version=$("$old_bridge" version </dev/null) || fail "installed bridge version failed"
 chmod 0755 "$bin_path"
 new_version=$("$bin_path" version) || fail "candidate bridge version failed"
 # `bridge version` prints several lines. Stock macOS awk refuses a -v value
 # that contains a newline, so pass only the first line, without a CR.
 old_version=$(printf '%s\n' "$old_version" | head -n 1 | tr -d '\r')
 new_version=$(printf '%s\n' "$new_version" | head -n 1 | tr -d '\r')
 awk -v old="$old_version" -v new="$new_version" '
 function parse(s, out, line, n, a, dotted, i) {
  split(s, line, "\n"); s=line[1]; sub(/\r$/, "", s)
  if (s !~ /^bridge v?[0-9]+\.[0-9]+(\.[0-9]+)?(-[0-9]+-g[0-9a-f]+)?$/) return 0
  sub(/^bridge v?/, "", s); n=split(s,a,/-/); split(a[1],dotted,/\./)
  out[1]=dotted[1]; out[2]=dotted[2]; out[3]=dotted[3]; out[4]=(n>1 ? a[2] : "0")
  # Force lexical comparison after length comparison; never round through doubles.
  for(i=1;i<=4;i++) { sub(/^0+/, "", out[i]); out[i]="x" out[i] }
  return 1
 }
 BEGIN {
  if (!parse(old,o) || !parse(new,n)) exit 2
  for (i=1;i<=4;i++) {
   if(length(n[i])<length(o[i])) exit 1; if(length(n[i])>length(o[i])) exit 0
   if(n[i]<o[i]) exit 1; if(n[i]>o[i]) exit 0
  }
 }' || fail "Older or unorderable bridge version; Refusing to install. To override: curl -fsSL $base_url/install.sh | ALLOW_DOWNGRADE=1 sh"
fi
mkdir -p "$install_dir"
tmp_install="$install_dir/.bridge-install.$$"
cp "$bin_path" "$tmp_install"
chmod 0755 "$tmp_install"
mv "$tmp_install" "$install_path"
assert_current_release "$install_path"

echo "Installed bridge to $install_path"
case ":${PATH:-}:" in
	*:"$install_dir":*)
		;;
	*)
		echo "PATH hint: add $install_dir to PATH, then open a new shell."
		;;
esac
echo "Check:"
if [ "$(command -v bridge || true)" = "$install_path" ]; then
 echo "  bridge doctor"
 next_command="  bridge start"
else
 quoted_install_path=$(printf '%s' "$install_path" | sed "s/'/'\\\\''/g")
 printf "  '%s' doctor\n" "$quoted_install_path"
 echo "In this window 'bridge' is not this program; use the full path above for every bridge command. Opening a new terminal or logging in again may still select the other program; keep using the full path until PATH selects this installation."
 next_command="  '$quoted_install_path' start"
fi
echo "Next:"
echo "$next_command"
echo "  bridge start is the guided setup: it walks you through joining, your AI tools and the safety code."

# Hand-off to the guided setup. Everything above verified the binary; this runs
# THAT binary by its absolute path (never `bridge` from PATH, which may be another
# program), only for a person at a terminal: stdout is a terminal and /dev/tty
# can be read, because under curl | sh stdin is this script. BRIDGE_NO_START=1
# skips it. A setup that stops early does not fail the install.
if [ "${BRIDGE_NO_START:-}" != 1 ] && [ -t 1 ] && [ -r /dev/tty ]; then
 echo "Starting the guided setup now (set BRIDGE_NO_START=1 to skip)."
 "$install_path" start </dev/tty || echo "The guided setup stopped. Run the Next: command above to pick it up again."
fi