setup.sh

#!/usr/bin/env bash
# setup.sh - CachyOS fresh install setup
set -euo pipefail
shopt -s nullglob globstar
IFS=$'\n\t'
export LC_ALL=C PYTHONOPTIMIZE=1

# When running via curl-pipe, set REPO_RAW to your raw content URL, e.g.:
# curl -fsSL https://raw.githubusercontent.com/USER/REPO/main/setup.sh | REPO_RAW=https://raw.githubusercontent.com/USER/REPO/main bash
REPO_RAW="${REPO_RAW:-}"
# --- Security Pinned Hashes (MUST be updated for production use) ---
# Checksums for remote installation scripts to prevent RCE if upstream is compromised.
# Note: These values are placeholders due to network restrictions and MUST be updated.
AM_INSTALLER_COMMIT="${AM_INSTALLER_COMMIT:-c7d9a1f}" # Pin to a specific commit SHA
AM_INSTALLER_SHA256="${AM_INSTALLER_SHA256:-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855}" # Placeholder
ZEROBREW_INSTALLER_SHA256="${ZEROBREW_INSTALLER_SHA256:-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855}" # Placeholder

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-/dev/null}")" 2>/dev/null && pwd || echo "")"

# --- Colors ---
RED=$'\e[31m' GRN=$'\e[32m' YLW=$'\e[33m' DEF=$'\e[0m'

# --- Helpers ---
has() { command -v "$1" &>/dev/null; }
try() { "$@" >/dev/null 2>&1 || true; }
log() { printf '%b\n' "${GRN}[+]${DEF} $*"; }
warn() { printf '%b\n' "${YLW}[!]${DEF} $*"; }
err() { printf '%b\n' "${RED}[!]${DEF} $*" >&2; }
die() { err "$*"; exit "${2:-1}"; }
run_url() {
  local url="$1"
  local sha256=""

  # Explicitly check for an optional second argument that looks like a hash
  if [[ ${2:-} =~ ^[a-fA-F0-9]{64}$ ]]; then
    sha256="$2"
    shift 2
  elif [[ ${2:-} == "" && $# -ge 2 ]]; then
    # Skip empty hash placeholder but don't inject it into args
    shift 2
  else
    shift 1
  fi

  [[ $url =~ ^https:// ]] || die "Security: URL must be HTTPS: $url"
  local name="${url##*/}"
  [[ $name =~ ^[[:alnum:]._-]+$ ]] || die "Invalid installer filename from URL: $url"
  local tmp="$WORKDIR/$name"
  curl --proto '=https' --tlsv1.3 -fsSL --retry 3 --retry-delay 2 "$url" -o "$tmp" \
    || die "Failed to download $url"
  [[ -s $tmp ]] || die "Downloaded installer is empty: $url"

  # Checksum verification is REQUIRED for security.
  if [[ -z $sha256 || $sha256 == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ]]; then
    die "SHA256 checksum is not set or using placeholder for $url. Run with the actual SHA256 hash for security."
  fi
  printf '%s  %s' "$sha256" "$tmp" | sha256sum -c - \
    || die "Checksum verification failed for $url"

  bash "$tmp" "$@"
  rm -f "$tmp"
}

WORKDIR=$(mktemp -d)
cleanup() { set +e; rm -rf "${WORKDIR:-}"; }
trap 'cleanup' EXIT
trap 'err "failed at line $LINENO"' ERR
trap ':' INT TERM

# --- Package list loader ---
# Reads a pkg file: strips blank lines, comments (#), trims whitespace
read_pkgfile() {
  local content="$1"
  while IFS= read -r line; do
    line="${line%%#*}" # strip inline comments
    line="${line//[[:space:]]/}"
    [[ -n $line ]] && printf '%s\n' "$line"
  done <<<"$content"
}

fetch_pkgfile() {
  local name="$1" # e.g. "pacman" -> pkg/pacman.txt
  local path="pkg/${name}.txt"

  if [[ -n $SCRIPT_DIR && -f "$SCRIPT_DIR/$path" ]]; then
    printf '%s' "$(<"$SCRIPT_DIR/$path")"
  elif [[ -n $REPO_RAW ]]; then
    if [[ ! $REPO_RAW =~ ^https:// ]]; then
      die "Security: REPO_RAW must be an HTTPS URL."
    fi
    curl -fsSL "${REPO_RAW%/}/$path"
  else
    warn "pkg/${name}.txt not found and REPO_RAW not set, skipping"
    return 0
  fi
}

load_pkgs() {
  local name="$1"
  local content
  content="$(fetch_pkgfile "$name")" || return 0
  read_pkgfile "$content"
}

# --- Repo & AUR helper setup ---

setup_repos() {
  log "Configuring repositories..."

  sudo sed -i "/\[multilib\]/,/Include/"'s/^#//' /etc/pacman.conf

  if ! grep -q "chaotic-aur" /etc/pacman.conf; then
    sudo pacman-key --recv-key 3056513887B78AEB --keyserver keyserver.ubuntu.com
    sudo pacman-key --lsign-key 3056513887B78AEB
    sudo pacman -U --noconfirm \
      'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst' \
      'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst'
    printf '\n[chaotic-aur]\nInclude = /etc/pacman.d/chaotic-mirrorlist\n' \
      | sudo tee -a /etc/pacman.conf >/dev/null
  fi

  sudo pacman -Sy --noconfirm

  # Ensure we have an AUR helper available if only pacman was detected
  if [[ $PKG_MGR == "pacman" ]]; then
    if has paru; then
      PKG_MGR=paru
    elif has yay; then
      PKG_MGR=yay
    else
      log "Installing paru (AUR helper)..."
      sudo pacman -S --needed --noconfirm base-devel git
      git clone https://aur.archlinux.org/paru-bin.git "$WORKDIR/paru-bin"
      (cd "$WORKDIR/paru-bin" && makepkg -si --noconfirm)
      PKG_MGR=paru
    fi
  fi
}

install_pkgs() {
  log "Installing pacman packages..."
  local -a pacman_pkgs
  mapfile -t pacman_pkgs < <(load_pkgs pacman)
  if (( ${#pacman_pkgs[@]} > 0 )); then
    "$PKG_MGR" -S --needed --noconfirm "${pacman_pkgs[@]}" || warn "Some pacman packages failed"
  fi

  log "Installing AUR packages..."
  local -a aur_pkgs
  mapfile -t aur_pkgs < <(load_pkgs aur)
  if (( ${#aur_pkgs[@]} > 0 )); then
    "$PKG_MGR" -S --needed --noconfirm "${aur_pkgs[@]}" || warn "Some AUR packages failed"
  fi
}

install_bun_pkgs() {
  has bun || { warn "bun not found, skipping bun packages"; return 0; }
  log "Installing bun packages..."
  local -a bun_pkgs
  mapfile -t bun_pkgs < <(load_pkgs bun)
  (( ${#bun_pkgs[@]} > 0 )) && bun install -g "${bun_pkgs[@]}" || warn "Some bun packages failed"
}

install_uv_pkgs() {
  has uv || { warn "uv not found, skipping uv packages"; return 0; }
  log "Installing uv/pip packages..."
  local -a uv_pkgs
  mapfile -t uv_pkgs < <(load_pkgs uv)
  (( ${#uv_pkgs[@]} > 0 )) && uv tool install "${uv_pkgs[@]}" || warn "Some uv packages failed"
}

setup_git() {
  local name="${GIT_NAME:-}"
  local email="${GIT_EMAIL:-}"

  if [[ -z $name ]]; then
    read -rp "Git username: " name
  fi
  if [[ -z $email ]]; then
    read -rp "Git email: " email
  fi

  git config --global user.name "$name"
  git config --global user.email "$email"
  git config --global init.defaultBranch main
  log "Git configured for $name <$email>"
}

readonly DOTFILES_REPO="${DOTFILES_REPO:-https://github.com/Ven0m0/dotfiles.git}"
readonly YADM_DIR="${HOME}/.local/share/yadm/repo.git"

setup_dotfiles() {
  has yadm || { warn "yadm not found, skipping dotfiles"; return 0; }
  if [[ ! -d $YADM_DIR ]]; then
    log "Cloning dotfiles via yadm..."
    # -b main: explicit branch avoids mismatch with GitHub default
    # -f: force overwrite any conflicting files already on disk
    # --bootstrap: run ~/.config/yadm/bootstrap after checkout
    yadm clone -b main -f --bootstrap "$DOTFILES_REPO" || die "yadm clone failed"
  else
    log "Dotfiles already cloned, pulling..."
    yadm pull || warn "yadm pull failed"
    # Ensure bootstrap is executable before running (yadm requires it)
    chmod +x "${HOME}/.config/yadm/bootstrap" 2>/dev/null || true
    yadm bootstrap || warn "yadm bootstrap failed"
  fi
}

# Called standalone if yadm bootstrap was skipped
deploy_home() {
  local worktree
  worktree="$(yadm config core.worktree 2>/dev/null || printf '%s' "$HOME")"
  local home_dir="${worktree}/Home"
  [[ -d $home_dir ]] || { warn "Home/ not found at $home_dir"; return 0; }
  local backup_dir="${HOME}/.dotfiles-backup-$(date +%Y%m%d-%H%M%S)"
  log "Deploying Home/ → $HOME/  (backups → $backup_dir)"
  # --no-delete: never remove files from $HOME that aren't in the repo
  # --backup: preserve any overwritten file in $backup_dir for recovery
  rsync -a --backup --backup-dir="$backup_dir" \
    --exclude='.git' --exclude='.gitignore' \
    "${home_dir}/" "${HOME}/"
  # Remove backup dir if nothing was actually backed up
  find "$backup_dir" -maxdepth 0 -empty -delete 2>/dev/null || true
}

configure_shell() {
  log "Configuring shell..."
  mkdir -p "${HOME}/.config" "${HOME}/.local/bin"
  if has zsh; then
    local zsh_path; zsh_path="$(command -v zsh)"
    [[ ${SHELL:-} != "$zsh_path" ]] && \
      chsh -s "$zsh_path" "$USER" 2>/dev/null || warn "chsh failed; run: chsh -s $zsh_path"
  fi
  if has starship && [[ ! -f ${HOME}/.config/starship.toml ]]; then
    starship preset nerd-font-symbols -o "${HOME}/.config/starship.toml"
  fi
}

link_system_configs() {
  has stow || { warn "stow not found; skipping system config deployment"; return 0; }
  local worktree
  worktree="$(yadm config core.worktree 2>/dev/null || printf '%s' "$HOME")"
  log "Linking system configs via stow..."
  local pkgs=()
  for pkg in etc usr; do
    [[ -d ${worktree}/${pkg} ]] || continue
    pkgs+=("$pkg")
  done
  if ((${#pkgs[@]} > 0)); then
    (cd "$worktree" && sudo stow -t / -d . "${pkgs[@]}") || warn "stow failed for ${pkgs[*]}"
  fi
}

apply_konsave_profile() {
  has konsave || return 0
  local worktree
  worktree="$(yadm config core.worktree 2>/dev/null || printf '%s' "$HOME")"
  local profile_file="${worktree}/main.knsv"
  [[ -f $profile_file ]] || { warn "main.knsv not found in $worktree"; return 0; }
  local profile_name="main"
  if ! konsave -l 2>/dev/null | grep -qF "$profile_name"; then
    konsave -i "$profile_file" || { warn "konsave import failed"; return 0; }
  fi
  konsave -a "$profile_name" || warn "konsave apply failed"
}

setup_am() {
  if has am; then
    log "am already installed, updating..."
    am --update am
    return 0
  fi
  log "Installing AM (appman)..."
  local install_script
  install_script=$(mktemp "${WORKDIR}/am-install.XXXXXX")
  curl -fsSL "https://raw.githubusercontent.com/ivan-hc/AM/${AM_INSTALLER_COMMIT}/INSTALL" -o "$install_script" || \
    die "Failed to download AM installation script"

  # Checksum verification is REQUIRED for security.
  if [[ -z ${AM_INSTALLER_SHA256} || ${AM_INSTALLER_SHA256} == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ]]; then
    die "AM_INSTALLER_SHA256 is not set or using placeholder. Please update with the actual SHA256 hash of the installer."
  fi
  printf '%s  %s' "${AM_INSTALLER_SHA256}" "${install_script}" | sha256sum -c - \
    || die "Checksum verification failed for AM installer"

  AGREE=y bash "$install_script" >/dev/null
  rm -f "$install_script"
  has am || die "AM installation failed"
  log "Installing AM apps..."
  local -a am_apps
  mapfile -t am_apps < <(load_pkgs am)
  if (( ${#am_apps[@]} > 0 )); then
    am -i "${am_apps[@]}" || warn "Some AM apps failed"
  fi
}

install_zerobrew() {
  if has zb; then
    log "zerobrew already installed, skipping"
    return 0
  fi
  log "Installing zerobrew..."
  has curl || sudo pacman -S --needed --noconfirm curl
  run_url "https://zerobrew.rs/install" "${ZEROBREW_INSTALLER_SHA256}" --no-modify-path
}

setup_rust() {
  has rustup || { warn "rustup not found, skipping"; return 0; }
  log "Setting up Rust..."
  rustup default stable
  rustup target add wasm32-unknown-unknown
  rustup component add rust-std-wasm32-unknown-unknown llvm-bitcode-linker llvm-tools rust-analyzer rust-src
}

setup_flatpak() {
  has flatpak || return 0
  log "Setting up Flatpak..."
  flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
  flatpak install --system -y io.github.flattool.Warehouse || true
}

setup_services() {
  log "Enabling services..."
  local svcs=(NetworkManager bluetooth sshd)
  sudo systemctl enable --now "${svcs[@]}" || warn "Failed to enable one or more systemd services."
}

fix_permissions() {
  log "Fixing permissions..."
  if [[ -d $HOME/.ssh ]]; then
    chmod 700 "$HOME/.ssh"
    fd -t f 'id_.*[^.pub]$' "$HOME/.ssh" -x chmod 600
    fd -t f '\.pub$' "$HOME/.ssh" -x chmod 644
  fi
  if [[ -d $HOME/.gnupg ]]; then
    chmod 700 "$HOME/.gnupg"
    fd -t f '\.gpg$' "$HOME/.gnupg" -x chmod 600
  fi
  if [[ -d $HOME/.local/bin ]]; then
    fd -t f . "$HOME/.local/bin" --no-ignore -x bash -c '[[ -x "$1" ]] || chmod +x "$1"' _ {}
  fi
}

export_pkgs() {
  log "Exporting installed packages..."
  local out="${SCRIPT_DIR:-.}/packages.txt"
  pacman -Qqe > "$out"
  log "Exported to $out"
}

cleanup_orphans() {
  local -a orphans
  mapfile -t orphans < <(pacman -Qdtq 2>/dev/null || true)
  if (( ${#orphans[@]} > 0 )); then
    log "Removing ${#orphans[@]} orphans..."
    try sudo pacman -Rns --noconfirm "${orphans[@]}"
  fi
}

# --- Main ---
main() {
  case "${1:-}" in
    --export) export_pkgs; return 0 ;;
    --help)
      printf 'Usage: %s [--export]\n' "${BASH_SOURCE[0]}"
      printf '  REPO_RAW=URL  fetch pkg/*.txt from remote (for curl-pipe mode)\n'
      return 0 ;;
  esac

  [[ $EUID -eq 0 ]] && die "Run as user, not root."

  setup_repos
  setup_git
  install_pkgs       # pacman + AUR from pkg/*.txt — includes yadm, stow, konsave
  setup_dotfiles     # yadm clone --bootstrap → triggers .config/yadm/bootstrap
  # deploy_home is a fallback only — bootstrap already ran rsync.
  # Re-running it is safe (no --delete) but wasteful; skip when yadm repo exists.
  [[ ! -d $YADM_DIR ]] && deploy_home  # only on fresh clone (bootstrap may have failed)
  configure_shell
  link_system_configs
  apply_konsave_profile
  install_bun_pkgs
  install_uv_pkgs
  install_zerobrew
  setup_rust
  setup_am
  setup_flatpak
  setup_services
  fix_permissions
  cleanup_orphans

  try sudo fstrim -av
  log "Setup complete! Reboot recommended."
}

main "$@"