#!/bin/sh
# Sous macOS installer. Readable source: https://sous.soundheart.io/install.sh
# Release URLs and checksums are pinned together; no downloaded shell is evaluated.
set -eu

main() {
    if [ "$(uname -s)" != Darwin ]; then
        echo 'Sous client currently supports macOS. No files were installed.' >&2
        return 1
    fi
    case "$(uname -m)" in
        arm64|aarch64)
            arch=arm64
            expected=31e3f355caef1e690fe88f63330d9b405d3ed1210df065f0164d51c866168d02
            ;;
        x86_64|amd64)
            arch=amd64
            expected=27dbb883edebb934989c314df81fad73d4165ba26da00f45182bd1be892d4e74
            ;;
        *) echo 'Unsupported Mac architecture. No files were installed.' >&2; return 1 ;;
    esac
    for tool in curl shasum tar mktemp; do
        command -v "$tool" >/dev/null 2>&1 || { echo "Missing system tool: $tool" >&2; return 1; }
    done
    explicit_hosts=false
    for arg in "$@"; do
        [ "$arg" != --hosts ] || explicit_hosts=true
    done
    if [ "$explicit_hosts" = false ]; then
        # stdin contains this script when piped; selections must come from the terminal.
        if ! ( : < /dev/tty ) 2>/dev/null; then
            echo 'No interactive terminal. Pass --hosts codex,claude,pi (or none):' >&2
            echo 'curl -fsSL https://sous.soundheart.io/install.sh | sh -s -- --hosts codex,claude,pi' >&2
            return 1
        fi
    fi
    umask 077
    work=$(mktemp -d "${TMPDIR:-/tmp}/sous-install.XXXXXXXX")
    trap 'rm -rf "$work"' EXIT
    trap 'exit 130' INT
    trap 'exit 143' HUP TERM
    version=0.1.0-preview.1
    package="sous-client-$version-darwin-$arch"
    echo "Downloading Sous $version for macOS ${arch}..."
    echo 'Developer preview: not yet Apple Developer ID signed or notarized.'
    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
        --tlsv1.2 --connect-timeout 15 --max-time 180 \
        --output "$work/client.tar.gz" "https://sous.soundheart.io/downloads/$version/$package.tar.gz"
    actual=$(shasum -a 256 "$work/client.tar.gz")
    actual=${actual%% *}
    if [ "$actual" != "$expected" ]; then
        echo 'Download checksum mismatch. Nothing was executed or installed.' >&2
        return 1
    fi
    tar -xzf "$work/client.tar.gz" -C "$work"
    [ -x "$work/$package/sous-agent" ] || { echo 'Client missing from verified release.' >&2; return 1; }
    echo 'Checksum verified. Starting setup...'
    if [ "$explicit_hosts" = true ]; then
        "$work/$package/sous-agent" install "$@" < /dev/null
    else
        "$work/$package/sous-agent" install "$@" < /dev/tty
    fi
}

# Defining the whole function before invoking it avoids running a truncated download.
main "$@"