install.ps1

#!/usr/bin/env pwsh
# CAPA Installer Script for Windows
# Licensed under the MIT license
#
# NOTE: This installer is fetched over HTTPS but is not signed. For air-gapped
# or high-security environments, download install.ps1 + SHA256SUMS manually and
# verify before running.

param(
    [string]$InstallDir = "",
    [switch]$NoModifyPath = $false,
    [switch]$Verbose = $false,
    [switch]$Quiet = $false,
    [switch]$Help = $false
)

$ErrorActionPreference = "Stop"

# Constants
$APP_NAME = "capa"
$GITHUB_REPO = "infragate/capa"
$FALLBACK_VERSION = "1.0.0"  # Fallback version if API request fails

# Environment variable overrides
if ($env:CAPA_INSTALL_DIR) {
    $InstallDir = $env:CAPA_INSTALL_DIR
}
if ($env:CAPA_NO_MODIFY_PATH -eq "1") {
    $NoModifyPath = $true
}
if ($env:CAPA_UNMANAGED_INSTALL) {
    $NoModifyPath = $true
}
if ($env:CAPA_PRINT_VERBOSE -eq "1") {
    $Verbose = $true
}
if ($env:CAPA_PRINT_QUIET -eq "1") {
    $Quiet = $true
}

# Colors
$ColorReset = "`e[0m"
$ColorRed = "`e[31m"
$ColorGreen = "`e[32m"
$ColorYellow = "`e[33m"
$ColorBlue = "`e[34m"

function Show-Usage {
    Write-Host @"
capa-installer.ps1

The installer for CAPA (Capabilities Package Manager)

This script installs the CAPA binary to:
    `$env:CAPA_INSTALL_DIR (if set)
    `$env:LOCALAPPDATA\Programs\capa (default)

It will then add that directory to your PATH environment variable.

USAGE:
    .\install.ps1 [OPTIONS]
    
    Or via web:
    powershell -ExecutionPolicy ByPass -c "irm https://capa.infragate.ai/install.ps1 | iex"

OPTIONS:
    -InstallDir <DIR>
            Install to a custom directory

    -NoModifyPath
            Don't configure the PATH environment variable

    -Verbose
            Enable verbose output

    -Quiet
            Disable progress output

    -Help
            Print help information

ENVIRONMENT VARIABLES:
    CAPA_INSTALL_DIR        Custom installation directory
    CAPA_NO_MODIFY_PATH     Set to 1 to skip PATH modification
    CAPA_UNMANAGED_INSTALL  Set to 1 for CI/unmanaged installs
    CAPA_PRINT_VERBOSE      Set to 1 for verbose output
    CAPA_PRINT_QUIET        Set to 1 for quiet output

EXAMPLES:
    # Install with defaults
    irm https://capa.infragate.ai/install.ps1 | iex

    # Install to custom directory
    `$env:CAPA_INSTALL_DIR="C:\Tools"; irm https://capa.infragate.ai/install.ps1 | iex

    # Install without modifying PATH
    powershell -c "irm https://capa.infragate.ai/install.ps1 | iex" -NoModifyPath
"@
}

function Write-Info {
    param([string]$Message)
    if (-not $Quiet) {
        Write-Host "${ColorBlue}INFO${ColorReset}: $Message"
    }
}

function Write-Success {
    param([string]$Message)
    if (-not $Quiet) {
        Write-Host "${ColorGreen}✓${ColorReset} $Message"
    }
}

function Write-Warning {
    param([string]$Message)
    if (-not $Quiet) {
        Write-Host "${ColorYellow}WARN${ColorReset}: $Message" -ForegroundColor Yellow
    }
}

function Write-Error-Custom {
    param([string]$Message)
    if (-not $Quiet) {
        Write-Host "${ColorRed}ERROR${ColorReset}: $Message" -ForegroundColor Red
    }
    exit 1
}

function Write-Verbose-Custom {
    param([string]$Message)
    if ($Verbose) {
        Write-Host $Message
    }
}

function Get-LatestVersion {
    try {
        if ($Verbose) {
            Write-Host "Fetching latest release version from GitHub..."
        }
        $apiUrl = "https://api.github.com/repos/$GITHUB_REPO/releases/latest"
        $response = Invoke-RestMethod -Uri $apiUrl -UseBasicParsing -ErrorAction Stop
        $version = $response.tag_name -replace '^v', ''
        if ($Verbose) {
            Write-Host "Latest version: $version"
        }
        return $version
    }
    catch {
        if (-not $Quiet) {
            Write-Host "${ColorYellow}WARN${ColorReset}: Failed to fetch latest version from GitHub API" -ForegroundColor Yellow
            Write-Host "${ColorYellow}WARN${ColorReset}: Falling back to version $FALLBACK_VERSION" -ForegroundColor Yellow
        }
        return $FALLBACK_VERSION
    }
}

function Get-Architecture {
    $arch = $env:PROCESSOR_ARCHITECTURE
    $arch64 = $env:PROCESSOR_ARCHITEW6432
    
    if ($arch64) {
        $arch = $arch64
    }
    
    switch ($arch) {
        "AMD64" { return "x86_64-pc-windows-msvc" }
        # ARM64: no native binary is shipped (bun-windows-arm64 compile target
        # is unstable). Fall back to the x64 build, which Windows on ARM runs
        # transparently via Prism emulation.
        "ARM64" { return "x86_64-pc-windows-msvc" }
        "x86" { return "i686-pc-windows-msvc" }
        default {
            Write-Error-Custom "Unsupported architecture: $arch"
        }
    }
}

function Get-InstallDirectory {
    if ($InstallDir) {
        return $InstallDir
    }
    
    $localAppData = $env:LOCALAPPDATA
    if (-not $localAppData) {
        Write-Error-Custom "Could not determine installation directory (LOCALAPPDATA not set)"
    }
    
    return Join-Path $localAppData "Programs\capa"
}

function Test-InPath {
    param([string]$Directory)
    
    $pathDirs = $env:PATH -split ";"
    foreach ($dir in $pathDirs) {
        if ($dir -eq $Directory) {
            return $true
        }
    }
    return $false
}

function Add-ToPath {
    param([string]$Directory)
    
    if ($NoModifyPath) {
        return
    }
    
    if (Test-InPath $Directory) {
        Write-Verbose-Custom "Directory already in PATH"
        return
    }
    
    try {
        Write-Info "Adding $Directory to PATH..."
        
        # Get current user PATH
        $userPath = [Environment]::GetEnvironmentVariable("PATH", "User")
        
        # Add directory if not present
        if ($userPath -notlike "*$Directory*") {
            $newPath = "$Directory;$userPath"
            [Environment]::SetEnvironmentVariable("PATH", $newPath, "User")
            
            # Update current session
            $env:PATH = "$Directory;$env:PATH"
            
            Write-Success "Added to PATH"
        }
    }
    catch {
        Write-Warning "Failed to add to PATH: $_"
        Write-Host "You may need to add $Directory to your PATH manually"
    }
}

function Install-Capa {
    # Fetch the latest version
    $APP_VERSION = Get-LatestVersion
    
    $bannerInner = 39
    $bannerTitle = "  CAPA Installer v$APP_VERSION"
    $bannerPad = [Math]::Max(1, $bannerInner - $bannerTitle.Length)
    $bannerSpaces = " " * $bannerPad
    Write-Host ""
    Write-Host "${ColorGreen}╔═══════════════════════════════════════╗${ColorReset}"
    Write-Host "${ColorGreen}║${bannerTitle}${bannerSpaces}║${ColorReset}"
    Write-Host "${ColorGreen}╚═══════════════════════════════════════╝${ColorReset}"
    Write-Host ""
    
    # Detect architecture
    Write-Info "Detecting platform..."
    $arch = Get-Architecture
    Write-Success "Detected: $arch"
    
    # Get installation directory
    $installDir = Get-InstallDirectory
    Write-Info "Installation directory: $installDir"
    
    # Create installation directory
    if (-not (Test-Path $installDir)) {
        Write-Info "Creating installation directory..."
        New-Item -ItemType Directory -Path $installDir -Force | Out-Null
    }
    
    # Determine binary name
    $binaryName = "capa-$arch.exe"
    $downloadUrl = "https://github.com/$GITHUB_REPO/releases/download/v$APP_VERSION/$binaryName"
    $destPath = Join-Path $installDir "capa.exe"
    # Download to temp first so we can replace the running exe when upgrading (fixes #19)
    $tempPath = Join-Path $env:TEMP "capa-$APP_VERSION-$arch.exe"
    
    Write-Info "Downloading CAPA..."
    Write-Verbose-Custom "URL: $downloadUrl"
    
    try {
        $ProgressPreference = 'SilentlyContinue'
        Invoke-WebRequest -Uri $downloadUrl -OutFile $tempPath -UseBasicParsing
        Write-Success "Downloaded CAPA binary"
    }
    catch {
        Write-Error-Custom "Failed to download CAPA from $downloadUrl`n$_"
    }

    # Verify binary integrity against release checksums
    Write-Info "Verifying download integrity..."
    $checksumsUrl = "https://github.com/$GITHUB_REPO/releases/download/v$APP_VERSION/SHA256SUMS.txt"
    $checksumsPath = Join-Path $env:TEMP "capa-SHA256SUMS.txt"

    try {
        Invoke-WebRequest -Uri $checksumsUrl -OutFile $checksumsPath -UseBasicParsing
    }
    catch {
        Remove-Item -LiteralPath $tempPath -Force -ErrorAction SilentlyContinue
        Write-Error-Custom "Failed to download SHA256SUMS.txt from $checksumsUrl`n$_"
    }

    $computedHash = (Get-FileHash $tempPath -Algorithm SHA256).Hash.ToLower()
    $expectedLine = Get-Content $checksumsPath | Where-Object { $_ -match (' ' + [regex]::Escape($binaryName) + '$') } | Select-Object -First 1
    Remove-Item -LiteralPath $checksumsPath -Force -ErrorAction SilentlyContinue

    if (-not $expectedLine) {
        Remove-Item -LiteralPath $tempPath -Force -ErrorAction SilentlyContinue
        Write-Error-Custom "No checksum found for $binaryName in SHA256SUMS.txt"
    }

    $expectedHash = ($expectedLine -split '\s+')[0].ToLower()
    if ($computedHash -ne $expectedHash) {
        Remove-Item -LiteralPath $tempPath -Force -ErrorAction SilentlyContinue
        Write-Error-Custom "Checksum verification failed for $binaryName (expected $expectedHash, got $computedHash)"
    }
    Write-Success "Verified binary integrity"
    
    # Replace existing binary (fixes #19). On Windows a running .exe is locked
    # and cannot be overwritten, but it *can* be renamed within the same
    # directory while it runs (the OS keeps the file handle regardless of name).
    # So move the old binary aside first — that frees $destPath — then drop the
    # new binary in. This makes the upgrade succeed even if the previous capa
    # process hasn't fully exited yet, instead of relying on a timing race.
    $backupPath = "$destPath.old"
    if (Test-Path $destPath) {
        # Remove any leftover backup from a prior upgrade (best-effort; harmless
        # if it's still locked — it'll be cleaned on the next run).
        if (Test-Path $backupPath) {
            Remove-Item -LiteralPath $backupPath -Force -ErrorAction SilentlyContinue
        }
        try {
            Move-Item -Path $destPath -Destination $backupPath -Force
        }
        catch {
            # Rename of a locked exe normally succeeds; if it somehow didn't,
            # fall through and let the retry loop attempt a direct replace.
            Write-Verbose-Custom "Could not rename existing binary aside: $_"
        }
    }

    # Move the new binary into place. If the rename above succeeded, $destPath is
    # free and this lands on the first try. The retry loop is a fallback for the
    # rare case the destination is still occupied (e.g. rename failed).
    $replaceOk = $false
    $maxRetries = 5
    $retryDelaySeconds = 2
    for ($attempt = 1; $attempt -le $maxRetries; $attempt++) {
        try {
            Move-Item -Path $tempPath -Destination $destPath -Force
            $replaceOk = $true
            break
        }
        catch {
            if ($_.Exception.Message -match 'being used by another process' -and $attempt -lt $maxRetries) {
                Write-Info "File in use; retrying in ${retryDelaySeconds}s ($attempt/$maxRetries)..."
                Start-Sleep -Seconds $retryDelaySeconds
            }
            else {
                Remove-Item -LiteralPath $tempPath -Force -ErrorAction SilentlyContinue
                # Restore the original binary if we renamed it aside but couldn't
                # install the new one, so the user isn't left without a capa.exe.
                if ((-not (Test-Path $destPath)) -and (Test-Path $backupPath)) {
                    Move-Item -Path $backupPath -Destination $destPath -Force -ErrorAction SilentlyContinue
                }
                Write-Error-Custom "Could not replace $destPath. Close any process using it and run the installer again, or run: capa upgrade"
            }
        }
    }

    if (-not $replaceOk) {
        exit 1
    }

    # New binary is in place; clean up the old one. This will fail silently if
    # the previous capa process is still running (the file stays locked) — the
    # leftover .old is then removed by the next upgrade.
    if (Test-Path $backupPath) {
        Remove-Item -LiteralPath $backupPath -Force -ErrorAction SilentlyContinue
    }

    Write-Success "Installed CAPA to $destPath"
    
    # Add to PATH
    Add-ToPath $installDir
    
    # Print success message
    Write-Host ""
    Write-Host "${ColorGreen}╔═══════════════════════════════════════╗${ColorReset}"
    Write-Host "${ColorGreen}║  CAPA installed successfully! 🎉      ║${ColorReset}"
    Write-Host "${ColorGreen}╚═══════════════════════════════════════╝${ColorReset}"
    Write-Host ""
    Write-Host "To get started, run:"
    Write-Host "  ${ColorBlue}capa init${ColorReset}     # Initialize a new project"
    Write-Host "  ${ColorBlue}capa --help${ColorReset}   # Show all commands"
    Write-Host ""
    
    if (-not $NoModifyPath) {
        Write-Host "${ColorYellow}Note:${ColorReset} You may need to restart your terminal for PATH changes to take effect."
        Write-Host ""
    }
    
    Write-Host "Documentation: https://github.com/$GITHUB_REPO"
    Write-Host ""
}

# Main execution
try {
    if ($Help) {
        Show-Usage
        exit 0
    }
    
    Install-Capa
}
catch {
    Write-Error-Custom "Installation failed: $_"
}