#!/bin/sh
# Bridge1 installer — served at https://bridge1.ai/install.sh
#
#   curl -fsSL https://bridge1.ai/install.sh | sh
#
# WHY THIS EXISTS, and it is not "because a one-liner is trendy":
#
# macOS applies `com.apple.quarantine` to files downloaded by a BROWSER. A
# quarantined app that is not notarized triggers Gatekeeper's dialog — the one
# reading "Apple could not verify Bridge1 is free of malware that may harm your
# Mac or compromise your privacy", whose default, blue, most-prominent button is
# "Move to Trash". A user pressing Return deletes the app.
#
# curl does NOT set that flag. Verified directly (2026-08-31): the same DMG
# fetched with curl carries only `com.apple.provenance`, the .app inside carries
# no xattrs at all, and it launches with no dialog — identical ad-hoc signature,
# no warning. The variable was never the signature. It is the quarantine flag.
#
# So this is a real fix available today, not a workaround for one coming later.
# Apple notarization is in progress (Developer ID for Dojoit, Inc.); when it
# lands the browser download stops warning too, and this script stays because it
# is a better install for a developer audience regardless.
#
# POSIX sh on purpose: runs under whatever /bin/sh a user has.
set -eu

DMG_URL="${BRIDGE1_DMG_URL:-https://bridge1.ai/download/macos-dmg}"
TARGET_DIR="${BRIDGE1_TARGET_DIR:-/Applications}"
APP_NAME="Bridge1.app"

say()  { printf '  %s\n' "$1"; }
fail() { printf '\n  error: %s\n\n' "$1" >&2; exit 1; }

WORK=""
MOUNT=""
cleanup() {
	# Detach BEFORE removing the workdir; a mounted image holds the file open.
	[ -n "$MOUNT" ] && hdiutil detach "$MOUNT" -quiet >/dev/null 2>&1 || true
	[ -n "$WORK" ] && rm -rf "$WORK" || true
}
trap cleanup EXIT INT TERM

printf '\n  Bridge1 installer\n\n'

[ "$(uname -s)" = "Darwin" ] || fail "Bridge1 is macOS-only today. Windows and Linux are architected in but not built yet."

if [ "$(uname -m)" != "arm64" ]; then
	say "note: this Mac is $(uname -m), not Apple Silicon."
	say "Bridge1 runs local models; on Intel it will be slow or unable to load the catalog."
fi

# Refuse to replace a RUNNING app. Copying over a running bundle corrupts it,
# and Bridge1 holds child engine processes that must shut down cleanly.
if pgrep -x "Bridge1" >/dev/null 2>&1; then
	fail "Bridge1 is running. Quit it first (it needs to shut its model processes down cleanly), then re-run this."
fi

WORK="$(mktemp -d)"
DMG="$WORK/Bridge1.dmg"

say "Downloading Bridge1..."
curl -fL --progress-bar --proto '=https' --tlsv1.2 --retry 3 --connect-timeout 20 -o "$DMG" "$DMG_URL" \
	|| fail "download failed from $DMG_URL"

BYTES=$(wc -c < "$DMG" | tr -d ' ')
[ "$BYTES" -gt 1000000 ] || fail "downloaded file is only $BYTES bytes — that is not a Bridge1 disk image."
say "Downloaded $((BYTES / 1024 / 1024)) MB."

# Integrity: verify against the published checksum when one exists. Releases
# before 2026-08-31 did not publish one, so this is best-effort rather than
# mandatory -- and it says which of the two happened instead of implying a check
# ran when it did not.
SUMS="$(curl -fsSL --proto '=https' --max-time 20 "${DMG_URL}.sha256" 2>/dev/null || true)"
if [ -n "$SUMS" ]; then
	WANT="$(printf '%s' "$SUMS" | awk '{print $1}')"
	GOT="$(shasum -a 256 "$DMG" | awk '{print $1}')"
	[ "$WANT" = "$GOT" ] || fail "checksum mismatch. expected $WANT, got $GOT. Not installing."
	say "Checksum verified."
else
	say "No published checksum for this release — integrity rests on HTTPS alone."
fi

say "Mounting..."
MOUNT="$(hdiutil attach -nobrowse -readonly "$DMG" 2>/dev/null | grep -o '/Volumes/.*' | head -1)"
[ -n "$MOUNT" ] || fail "could not mount the disk image."

SRC="$MOUNT/$APP_NAME"
[ -d "$SRC" ] || fail "$APP_NAME not found inside the disk image."

[ -w "$TARGET_DIR" ] || fail "$TARGET_DIR is not writable by $(whoami). Re-run with a writable BRIDGE1_TARGET_DIR, or grant access."

if [ -d "$TARGET_DIR/$APP_NAME" ]; then
	say "Replacing the existing install..."
	rm -rf "$TARGET_DIR/$APP_NAME" || fail "could not remove the existing $APP_NAME."
fi

say "Installing to $TARGET_DIR..."
# -R preserves the bundle; -p preserves modes. Do NOT use `mv` across a mount.
cp -Rp "$SRC" "$TARGET_DIR/" || fail "copy failed."

# Prove the install rather than assuming cp succeeded quietly.
[ -x "$TARGET_DIR/$APP_NAME/Contents/MacOS/app" ] || fail "installed bundle looks wrong — no executable at Contents/MacOS/app."

VER="$(defaults read "$TARGET_DIR/$APP_NAME/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null || echo unknown)"

printf '\n  Installed Bridge1 %s to %s\n\n' "$VER" "$TARGET_DIR"
say "Open it from Applications, or:  open -a Bridge1"
say "Then point your coding tool at the gateway:  http://127.0.0.1:54321"
printf '\n'