install

#!/usr/bin/env bash
# augur install script
# Usage: bash install

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
INSTALL_DIR="$HOME/.augur"

GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
CYAN='\033[0;36m'
BOLD='\033[1m'
RESET='\033[0m'

info()    { echo -e "${CYAN}[install]${RESET} $*"; }
success() { echo -e "${GREEN}[install]${RESET} $*"; }
warn()    { echo -e "${YELLOW}[install]${RESET} $*"; }
error()   { echo -e "${RED}[install]${RESET} $*" >&2; }

# Validate source files exist. VERSION is required: it is the single source of truth for
# the version number (`augur version`), so a checkout missing it is a broken install source.
for f in augur Dockerfile .dockerignore VERSION; do
    if [[ ! -f "$SCRIPT_DIR/$f" ]]; then
        error "$f not found in $SCRIPT_DIR"
        exit 1
    fi
done

# Copy files
info "Installing to $INSTALL_DIR..."
mkdir -p "$INSTALL_DIR"
cp "$SCRIPT_DIR/augur" "$INSTALL_DIR/augur"
cp "$SCRIPT_DIR/Dockerfile" "$INSTALL_DIR/Dockerfile"
# Ship the .dockerignore alongside the Dockerfile so the build context (~/.augur) stays
# tiny — otherwise the multi-GB VM images under ~/.augur/vms get swept into `augur build`.
cp "$SCRIPT_DIR/.dockerignore" "$INSTALL_DIR/.dockerignore"
chmod +x "$INSTALL_DIR/augur"

# Stamp the installed version. The NUMBER comes from the committed VERSION file (single
# source of truth — never derived from git tags). Git only adds dev-build traceability,
# mirroring augur_version(): a checkout whose HEAD is exactly the release tag records the
# bare number; any other checkout records <version>-dev+<sha>; a tarball (no git) records
# the number as-is. The running ~/.augur/augur has no git context, so we bake it in now.
ver="$(cat "$SCRIPT_DIR/VERSION" 2>/dev/null || true)"
if [[ -z "$ver" ]]; then
    ver="unknown"
elif [[ -e "$SCRIPT_DIR/.git" ]] \
     && git -C "$SCRIPT_DIR" rev-parse --git-dir >/dev/null 2>&1 \
     && ! git -C "$SCRIPT_DIR" describe --exact-match --tags HEAD 2>/dev/null | grep -qx "v$ver"; then
    ver="$ver-dev+$(git -C "$SCRIPT_DIR" rev-parse --short HEAD)"
fi
printf '%s\n' "$ver" > "$INSTALL_DIR/VERSION"
info "Recorded version $ver in $INSTALL_DIR/VERSION."

# Egress allowlist (three layers):
#   - augur.conf.default : augur-managed baseline. ALWAYS refreshed, so shipped domain
#                          updates (e.g. new Anthropic endpoints) reach every install.
#   - augur.conf         : the user's own global domains. NEVER clobbered; scaffolded once.
# Per-project domains live in each project's ./.augur/allowlist.conf.
if [[ -f "$SCRIPT_DIR/augur.conf" ]]; then
    cp "$SCRIPT_DIR/augur.conf" "$INSTALL_DIR/augur.conf.default"
    info "Refreshed managed baseline $INSTALL_DIR/augur.conf.default."
    if [[ ! -f "$INSTALL_DIR/augur.conf" ]]; then
        cat > "$INSTALL_DIR/augur.conf" <<'CONF'
# augur egress allowlist — your global additions
#
# augur ships a managed baseline (Anthropic, GitHub, Homebrew, …) in
# augur.conf.default, refreshed on every install. Add YOUR own always-on domains
# here; this file is never overwritten. Per-project domains go in ./.augur/allowlist.conf.
#
# Syntax (one pattern per line, '#' starts a comment):
#   example.com     exact host only (the apex). Does NOT match subdomains.
#   *.example.com   subdomains only (api.example.com yes; example.com no).
#   .example.com    the apex AND every subdomain.
CONF
        info "Scaffolded $INSTALL_DIR/augur.conf (add your own global domains here)."
    fi
fi
success "Files copied."

# Build the host egress proxy (augur-proxy). Needed for egress filtering in both
# container and macOS VM modes. A failure here is a warning — filtering is opt-in.
if command -v swift &>/dev/null && [[ -d "$SCRIPT_DIR/augur-proxy" ]]; then
    info "Building augur-proxy (egress filter)..."
    if (cd "$SCRIPT_DIR/augur-proxy" && swift build -c release) >/dev/null 2>&1; then
        proxy_bin="$(cd "$SCRIPT_DIR/augur-proxy" && swift build -c release --show-bin-path)/augur-proxy"
        cp "$proxy_bin" "$INSTALL_DIR/augur-proxy"
        # macOS: ad-hoc re-sign in place so an overwrite doesn't trip a stale AMFI cache
        # (no entitlements needed — augur-proxy does not touch Virtualization.framework).
        [[ "$(uname)" == "Darwin" ]] && codesign --force --sign - "$INSTALL_DIR/augur-proxy" 2>/dev/null || true
        success "augur-proxy installed to $INSTALL_DIR/augur-proxy"
    else
        warn "augur-proxy build failed — egress filtering will be unavailable until it builds."
    fi
else
    warn "Skipping augur-proxy build (needs Swift); egress filtering will be unavailable."
fi

# Build augur-gvproxy (the gvisor-tap-vsock fork) — only needed for the macOS VM
# egress datapath, and only buildable with a Go toolchain. A failure is a warning.
if [[ "$(uname)" == "Darwin" ]] && [[ -f "$SCRIPT_DIR/gvproxy/build.sh" ]]; then
    if command -v go &>/dev/null; then
        info "Building augur-gvproxy (macOS egress netstack)..."
        if bash "$SCRIPT_DIR/gvproxy/build.sh" "$INSTALL_DIR/augur-gvproxy" >/dev/null 2>&1; then
            success "augur-gvproxy installed to $INSTALL_DIR/augur-gvproxy"
        else
            warn "augur-gvproxy build failed — macOS egress filtering will be unavailable until it builds."
        fi
    else
        warn "Skipping augur-gvproxy build (needs Go); required for macOS egress filtering."
    fi
fi

# Build the macOS VM backend (augur-vm) when on macOS with a Swift toolchain.
# Container mode does not need this, so a failure here is only a warning.
if [[ "$(uname)" == "Darwin" ]]; then
    if command -v swift &>/dev/null && [[ -d "$SCRIPT_DIR/augur-vm" ]]; then
        info "Building augur-vm (macOS VM backend)..."
        if bash "$SCRIPT_DIR/augur-vm/scripts/build.sh" >/dev/null; then
            vm_bin="$(cd "$SCRIPT_DIR/augur-vm" && swift build -c release --show-bin-path)/augur-vm"
            cp "$vm_bin" "$INSTALL_DIR/augur-vm"
            # Re-sign in place at the destination. Overwriting an existing, already
            # validated binary on the same inode leaves a stale AMFI code-signing
            # cache, so the copy is SIGKILLed ("Killed: 9") on launch even though its
            # embedded signature looks intact. Re-signing the destination refreshes it.
            codesign --force --sign - \
                --entitlements "$SCRIPT_DIR/augur-vm/augur-vm.entitlements" \
                "$INSTALL_DIR/augur-vm"
            success "augur-vm installed to $INSTALL_DIR/augur-vm"
        else
            warn "augur-vm build failed — 'augur --macos' will be unavailable until it builds."
        fi
    else
        warn "Skipping augur-vm build (needs Swift + ./augur-vm); required for 'augur --macos'."
    fi
fi

# Add to PATH
SHELL_CONFIG=""
[[ -f "$HOME/.zshrc" ]]  && SHELL_CONFIG="$HOME/.zshrc"
[[ -z "$SHELL_CONFIG" ]] && [[ -f "$HOME/.bashrc" ]] && SHELL_CONFIG="$HOME/.bashrc"

if [[ -z "$SHELL_CONFIG" ]]; then
    warn "Neither ~/.zshrc nor ~/.bashrc found. Add $INSTALL_DIR to PATH manually."
elif grep -q 'export PATH=.*\.augur' "$SHELL_CONFIG" 2>/dev/null; then
    warn "PATH already configured in $SHELL_CONFIG"
else
    printf '\n# augur\nexport PATH="$HOME/.augur:$PATH"\n' >> "$SHELL_CONFIG"
    success "Added PATH entry to $SHELL_CONFIG"
fi

echo ""
success "Installation complete!"
echo ""
echo -e "  ${BOLD}Next steps:${RESET}"
echo -e "    1. ${CYAN}source ${SHELL_CONFIG:-~/.zshrc}${RESET}"
echo -e "    2. ${CYAN}augur build${RESET}"
echo -e "    3. ${CYAN}augur up${RESET} (in any project directory)"
echo ""