#!/bin/sh
# Hosted bootstrap for https://install.shakerscan.com
# Usage: curl -fsSL https://install.shakerscan.com | sh

set -eu

INSTALL_URL="https://install.shakerscan.com"
REPO_RAW_BASE="${SHAKERSCAN_RAW_BASE:-https://raw.githubusercontent.com/andriyze/shakerscan/main}"
INSTALL_DIR="${SHAKERSCAN_HOME:-$HOME/.shakerscan}"
BIN_DIR="${SHAKERSCAN_BIN_DIR:-$HOME/.local/bin}"
START_AFTER_INSTALL="${SHAKERSCAN_START:-1}"
REMOTE_ACCESS="${SHAKERSCAN_REMOTE:-0}"

say() {
    printf '%s\n' "$*"
}

fail() {
    say "Error: $*" >&2
    exit 1
}

have() {
    command -v "$1" >/dev/null 2>&1
}

run_sudo() {
    if [ "$(id -u)" -eq 0 ]; then
        "$@"
    elif have sudo; then
        sudo "$@"
    else
        return 1
    fi
}

detect_package_manager() {
    if have apt-get; then
        echo apt
    elif have dnf; then
        echo dnf
    elif have yum; then
        echo yum
    elif have pacman; then
        echo pacman
    elif have zypper; then
        echo zypper
    elif have apk; then
        echo apk
    else
        echo ""
    fi
}

install_bootstrap_deps() {
    missing=""
    for dep in bash curl; do
        if ! have "$dep"; then
            missing="$missing $dep"
        fi
    done

    if [ -z "$missing" ]; then
        return 0
    fi

    manager="$(detect_package_manager)"
    [ -n "$manager" ] || fail "missing required tools:$missing. Install bash and curl, then re-run $INSTALL_URL"

    say "Installing bootstrap tools:$missing"
    case "$manager" in
        apt)
            run_sudo apt-get update
            run_sudo apt-get install -y bash curl ca-certificates
            ;;
        dnf|yum)
            run_sudo "$manager" -y install bash curl ca-certificates
            ;;
        pacman)
            run_sudo pacman -Sy --needed --noconfirm bash curl ca-certificates
            ;;
        zypper)
            run_sudo zypper --non-interactive install bash curl ca-certificates
            ;;
        apk)
            run_sudo apk add bash curl ca-certificates
            ;;
        *)
            fail "unsupported package manager for bootstrap tools: $manager"
            ;;
    esac
}

download() {
    src="$1"
    dst="$2"
    tmp="${dst}.tmp"
    if ! curl -fsSL "$src" -o "$tmp"; then
        rm -f "$tmp"
        fail "failed to download $src"
    fi
    mv "$tmp" "$dst"
}

add_path_to_profile() {
    profile="$1"
    [ -n "$profile" ] || return 0

    if [ -f "$profile" ] && grep -F "# >>> shakerscan path >>>" "$profile" >/dev/null 2>&1 && grep -F "$BIN_DIR" "$profile" >/dev/null 2>&1; then
        return 0
    fi

    mkdir -p "$(dirname "$profile")"
    touch "$profile"
    {
        printf '\n'
        printf '%s\n' '# >>> shakerscan path >>>'
        printf '%s\n' 'case ":$PATH:" in'
        printf '  *":%s:"*) ;;\n' "$BIN_DIR"
        printf '  *) export PATH="%s:$PATH" ;;\n' "$BIN_DIR"
        printf '%s\n' 'esac'
        printf '%s\n' '# <<< shakerscan path <<<'
    } >> "$profile"
    say "Added $BIN_DIR to PATH in $profile"
}

install_path_profiles() {
    shell_name=""
    if [ -n "${SHELL:-}" ]; then
        shell_name="$(basename "$SHELL")"
    fi

    add_path_to_profile "$HOME/.profile"

    case "$shell_name" in
        bash)
            add_path_to_profile "$HOME/.bashrc"
            ;;
        zsh)
            add_path_to_profile "$HOME/.zshrc"
            ;;
        fish)
            fish_profile="$HOME/.config/fish/config.fish"
            if [ ! -f "$fish_profile" ] || ! grep -F "# >>> shakerscan path >>>" "$fish_profile" >/dev/null 2>&1 || ! grep -F "$BIN_DIR" "$fish_profile" >/dev/null 2>&1; then
                mkdir -p "$(dirname "$fish_profile")"
                touch "$fish_profile"
                {
                    printf '\n'
                    printf '%s\n' '# >>> shakerscan path >>>'
                    printf 'fish_add_path "%s"\n' "$BIN_DIR"
                    printf '%s\n' '# <<< shakerscan path <<<'
                } >> "$fish_profile"
                say "Added $BIN_DIR to PATH in $fish_profile"
            fi
            ;;
    esac

    if [ -f "$HOME/.bashrc" ] && [ "$shell_name" != "bash" ]; then
        add_path_to_profile "$HOME/.bashrc"
    fi

    if [ -f "$HOME/.zshrc" ] && [ "$shell_name" != "zsh" ]; then
        add_path_to_profile "$HOME/.zshrc"
    fi
}

PATH_NEEDS_ACTIVATION=0

install_command() {
    mkdir -p "$BIN_DIR"
    launcher="$BIN_DIR/shakerscan"
    cat > "$launcher" <<EOF
#!/bin/sh
exec "$INSTALL_DIR/scanner.sh" "\$@"
EOF
    chmod +x "$launcher"

    case ":$PATH:" in
        *":$BIN_DIR:"*) ;;
        *)
            PATH_NEEDS_ACTIVATION=1
            install_path_profiles
            ;;
    esac
}

# Prefer the bare shakerscan command only when it resolves to this install's
# launcher; otherwise fall back to the absolute path so copied commands work.
sk() {
    resolved="$(command -v shakerscan 2>/dev/null || true)"
    if [ "$resolved" = "$BIN_DIR/shakerscan" ]; then
        printf 'shakerscan'
    else
        printf '%s' "$BIN_DIR/shakerscan"
    fi
}

print_path_activation() {
    [ "$PATH_NEEDS_ACTIVATION" = "1" ] || return 0
    say "Activate the 'shakerscan' command in THIS terminal (new shells already have it):"
    say "  export PATH=\"$BIN_DIR:\$PATH\""
    say ""
}

print_next_steps() {
    say ""
    say "--------------------------------------------------------------"
    say "  ShakerScan is ready. Two ways to use it:"
    say "--------------------------------------------------------------"
    say ""
    print_path_activation
    say "1) Drive it with an AI agent (recommended) - just ask in plain English:"
    say "     $(sk) agent        # auto-detects codex, claude, or opencode"
    say ""
    say "   Then try asking:"
    say "     \"Scan https://example.com and summarize the findings\""
    say "     \"Show me active critical and high findings\""
    say "     \"Run a Deep Hunt on my authorized staging target\""
    say "     \"Red team my chatbot API with AI Gate smoke tests\""
    say ""
    say "2) Or run it yourself from the CLI:"
    say "     $(sk) scan https://example.com   # quick scan"
    say "     $(sk) status                     # what's running + UI/API URLs"
    say "     $(sk) stop                       # stop everything"
    say ""
    if [ "$REMOTE_ACCESS" = "1" ]; then
        say "   Remote mode is on - open the UI from your laptop using the URL printed above."
    else
        say "   Open the web UI in your browser:  http://localhost:3000"
        say "   (On a remote server? Re-run with:  $(sk) start --remote)"
    fi
    say ""
    say "Optional: for AI semantic judging, add AI_API_KEY to $INSTALL_DIR/.env"
    say "Docs & more commands:  $(sk) env   |   $INSTALL_DIR/README.md"
    say ""
}

say "ShakerScan installer"
say ""
say "Install directory: $INSTALL_DIR"
say "Command path:      $BIN_DIR/shakerscan"
say "Source:            $REPO_RAW_BASE"
say ""

install_bootstrap_deps

mkdir -p "$INSTALL_DIR/db" "$INSTALL_DIR/results" "$INSTALL_DIR/scripts" "$INSTALL_DIR/api"
mkdir -p "$INSTALL_DIR/skills/ai-security-session/agents" "$INSTALL_DIR/skills/ai-security-session/references"
mkdir -p "$INSTALL_DIR/skills/content-discovery/agents" "$INSTALL_DIR/skills/content-discovery/references"
mkdir -p "$INSTALL_DIR/skills/js-analyze/agents" "$INSTALL_DIR/skills/js-analyze/references"
mkdir -p "$INSTALL_DIR/skills/review-skills/agents"
mkdir -p "$INSTALL_DIR/skills/research-agent/agents"
mkdir -p "$INSTALL_DIR/skills/shakerscan/agents"
mkdir -p "$INSTALL_DIR/.claude/agents" "$INSTALL_DIR/.claude/commands" "$INSTALL_DIR/.claude/hooks"
touch "$INSTALL_DIR/.env"

say "Downloading ShakerScan runtime files..."
download "$REPO_RAW_BASE/scanner.sh" "$INSTALL_DIR/scanner.sh"
download "$REPO_RAW_BASE/docker-compose.release.yml" "$INSTALL_DIR/docker-compose.release.yml"
download "$REPO_RAW_BASE/db/init.sql" "$INSTALL_DIR/db/init.sql"
download "$REPO_RAW_BASE/VERSION" "$INSTALL_DIR/VERSION"
download "$REPO_RAW_BASE/README.md" "$INSTALL_DIR/README.md"
download "$REPO_RAW_BASE/AGENTS.md" "$INSTALL_DIR/AGENTS.md"
download "$REPO_RAW_BASE/CLAUDE.md" "$INSTALL_DIR/CLAUDE.md"
download "$REPO_RAW_BASE/scripts/shakerscan_mcp.py" "$INSTALL_DIR/scripts/shakerscan_mcp.py"
download "$REPO_RAW_BASE/scripts/local_planner_adapter.py" "$INSTALL_DIR/scripts/local_planner_adapter.py"
download "$REPO_RAW_BASE/scripts/planner_evals.py" "$INSTALL_DIR/scripts/planner_evals.py"
download "$REPO_RAW_BASE/api/command_arsenal.py" "$INSTALL_DIR/api/command_arsenal.py"
download "$REPO_RAW_BASE/skills/README.md" "$INSTALL_DIR/skills/README.md"
download "$REPO_RAW_BASE/skills/scanner-skill.md" "$INSTALL_DIR/skills/scanner-skill.md"
download "$REPO_RAW_BASE/skills/ai-security-session/SKILL.md" "$INSTALL_DIR/skills/ai-security-session/SKILL.md"
download "$REPO_RAW_BASE/skills/ai-security-session/agents/openai.yaml" "$INSTALL_DIR/skills/ai-security-session/agents/openai.yaml"
download "$REPO_RAW_BASE/skills/ai-security-session/references/api.md" "$INSTALL_DIR/skills/ai-security-session/references/api.md"
download "$REPO_RAW_BASE/skills/content-discovery/SKILL.md" "$INSTALL_DIR/skills/content-discovery/SKILL.md"
download "$REPO_RAW_BASE/skills/content-discovery/agents/openai.yaml" "$INSTALL_DIR/skills/content-discovery/agents/openai.yaml"
download "$REPO_RAW_BASE/skills/content-discovery/references/shakerscan.md" "$INSTALL_DIR/skills/content-discovery/references/shakerscan.md"
download "$REPO_RAW_BASE/skills/js-analyze/SKILL.md" "$INSTALL_DIR/skills/js-analyze/SKILL.md"
download "$REPO_RAW_BASE/skills/js-analyze/agents/openai.yaml" "$INSTALL_DIR/skills/js-analyze/agents/openai.yaml"
download "$REPO_RAW_BASE/skills/js-analyze/references/shakerscan.md" "$INSTALL_DIR/skills/js-analyze/references/shakerscan.md"
download "$REPO_RAW_BASE/skills/review-skills/SKILL.md" "$INSTALL_DIR/skills/review-skills/SKILL.md"
download "$REPO_RAW_BASE/skills/review-skills/agents/openai.yaml" "$INSTALL_DIR/skills/review-skills/agents/openai.yaml"
download "$REPO_RAW_BASE/skills/research-agent/SKILL.md" "$INSTALL_DIR/skills/research-agent/SKILL.md"
download "$REPO_RAW_BASE/skills/research-agent/agents/openai.yaml" "$INSTALL_DIR/skills/research-agent/agents/openai.yaml"
download "$REPO_RAW_BASE/skills/shakerscan/SKILL.md" "$INSTALL_DIR/skills/shakerscan/SKILL.md"
download "$REPO_RAW_BASE/skills/shakerscan/agents/openai.yaml" "$INSTALL_DIR/skills/shakerscan/agents/openai.yaml"
download "$REPO_RAW_BASE/.claude/agents/content-discovery-agent.md" "$INSTALL_DIR/.claude/agents/content-discovery-agent.md"
download "$REPO_RAW_BASE/.claude/agents/js-analysis-agent.md" "$INSTALL_DIR/.claude/agents/js-analysis-agent.md"
download "$REPO_RAW_BASE/.claude/agents/skills-reviewer.md" "$INSTALL_DIR/.claude/agents/skills-reviewer.md"
download "$REPO_RAW_BASE/.claude/commands/ai-gate.md" "$INSTALL_DIR/.claude/commands/ai-gate.md"
download "$REPO_RAW_BASE/.claude/commands/ai-security-session.md" "$INSTALL_DIR/.claude/commands/ai-security-session.md"
download "$REPO_RAW_BASE/.claude/commands/content-discovery.md" "$INSTALL_DIR/.claude/commands/content-discovery.md"
download "$REPO_RAW_BASE/.claude/commands/deep-hunt.md" "$INSTALL_DIR/.claude/commands/deep-hunt.md"
download "$REPO_RAW_BASE/.claude/commands/findings.md" "$INSTALL_DIR/.claude/commands/findings.md"
download "$REPO_RAW_BASE/.claude/commands/js-analyze.md" "$INSTALL_DIR/.claude/commands/js-analyze.md"
download "$REPO_RAW_BASE/.claude/commands/research.md" "$INSTALL_DIR/.claude/commands/research.md"
download "$REPO_RAW_BASE/.claude/commands/review-skills.md" "$INSTALL_DIR/.claude/commands/review-skills.md"
download "$REPO_RAW_BASE/.claude/commands/save-finding.md" "$INSTALL_DIR/.claude/commands/save-finding.md"
download "$REPO_RAW_BASE/.claude/commands/scan-full.md" "$INSTALL_DIR/.claude/commands/scan-full.md"
download "$REPO_RAW_BASE/.claude/commands/scan-smart.md" "$INSTALL_DIR/.claude/commands/scan-smart.md"
download "$REPO_RAW_BASE/.claude/commands/scan.md" "$INSTALL_DIR/.claude/commands/scan.md"
download "$REPO_RAW_BASE/.claude/commands/status.md" "$INSTALL_DIR/.claude/commands/status.md"
download "$REPO_RAW_BASE/.claude/commands/subdomains.md" "$INSTALL_DIR/.claude/commands/subdomains.md"
download "$REPO_RAW_BASE/.claude/commands/workers.md" "$INSTALL_DIR/.claude/commands/workers.md"
download "$REPO_RAW_BASE/.claude/hooks/session-start.sh" "$INSTALL_DIR/.claude/hooks/session-start.sh"
download "$REPO_RAW_BASE/.claude/settings.json" "$INSTALL_DIR/.claude/settings.json"
chmod +x "$INSTALL_DIR/scanner.sh"
chmod +x "$INSTALL_DIR/.claude/hooks/session-start.sh"

install_command

say ""
say "Installed ShakerScan to $INSTALL_DIR"
say ""

if [ "$START_AFTER_INSTALL" != "1" ]; then
    # Not auto-starting: show how to start, then the usage summary.
    say "Start the scanner when ready:"
    say "  $(sk) start            # local (UI stays on http://localhost:3000)"
    say "  $(sk) start --remote   # VPS access over Tailscale"
    print_next_steps
    say "Upgrade later by re-running:  curl -fsSL https://install.shakerscan.com | sh"
    exit 0
fi

say "Starting ShakerScan with latest Docker Hub images (the first pull may take several minutes)..."
say ""
cd "$INSTALL_DIR"
start_rc=0
if [ "$REMOTE_ACCESS" = "1" ]; then
    bash "$INSTALL_DIR/scanner.sh" start -y --remote || start_rc=$?
else
    bash "$INSTALL_DIR/scanner.sh" start -y || start_rc=$?
fi

if [ "$start_rc" -ne 0 ]; then
    say ""
    say "Startup did not finish cleanly (exit $start_rc)."
    say "Check what happened, then retry:"
    say "  $(sk) status"
    say "  $(sk) logs -f"
    say "  $(sk) start"
    exit "$start_rc"
fi

# scanner.sh prints health + UI/API URLs above; add the "what now" guidance last
# so it is the final thing on screen rather than a pull progress bar.
print_next_steps
say "Upgrade later by re-running:  curl -fsSL https://install.shakerscan.com | sh"