install.sh

#!/bin/sh
set -e

# CreateOS CLI installer
# Usage:
#   curl -sfL https://raw.githubusercontent.com/NodeOps-app/createos-cli/main/install.sh | sh -
#
# Environment variables:
#   CREATEOS_VERSION      Pin a specific version (e.g. v1.2.3). Defaults to latest stable.
#   CREATEOS_CHANNEL      Set to "nightly" to install the nightly build.
#   CREATEOS_INSTALL_DIR  Override install directory. Defaults to /usr/local/bin.

GITHUB_REPO="NodeOps-app/createos-cli"
BINARY_NAME="createos"

# ---------------------------------------------------------------------------
# Colours (suppressed when not a TTY)
# ---------------------------------------------------------------------------
if [ -t 1 ]; then
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[0;33m'
    CYAN='\033[0;36m'
    BOLD='\033[1m'
    RESET='\033[0m'
else
    RED='' GREEN='' YELLOW='' CYAN='' BOLD='' RESET=''
fi

info()    { printf "${CYAN}[createos]${RESET} %s\n" "$*"; }
success() { printf "${GREEN}[createos]${RESET} %s\n" "$*"; }
warn()    { printf "${YELLOW}[createos]${RESET} %s\n" "$*" >&2; }
fatal()   { printf "${RED}[createos] error:${RESET} %s\n" "$*" >&2; exit 1; }

# ---------------------------------------------------------------------------
# Detect OS
# ---------------------------------------------------------------------------
detect_os() {
    OS="$(uname -s)"
    case "${OS}" in
        Linux)  OS="linux" ;;
        Darwin) OS="darwin" ;;
        *)      fatal "Unsupported operating system: ${OS}. Only Linux and macOS are supported." ;;
    esac
}

# ---------------------------------------------------------------------------
# Detect architecture
# ---------------------------------------------------------------------------
detect_arch() {
    ARCH="$(uname -m)"
    case "${ARCH}" in
        x86_64 | amd64)          ARCH="amd64" ;;
        aarch64 | arm64 | armv8) ARCH="arm64" ;;
        *) fatal "Unsupported architecture: ${ARCH}. Only x86_64 and arm64 are supported." ;;
    esac
}

# ---------------------------------------------------------------------------
# Prompt for channel if not set and stdin is a TTY
# ---------------------------------------------------------------------------
prompt_channel() {
    # Already set via env — skip prompt
    if [ -n "${CREATEOS_CHANNEL:-}" ]; then
        return
    fi
    # Pinned version set — stable implied, skip prompt
    if [ -n "${CREATEOS_VERSION:-}" ]; then
        CREATEOS_CHANNEL="stable"
        return
    fi
    # Non-interactive (piped): default to stable silently
    if [ ! -t 0 ]; then
        CREATEOS_CHANNEL="stable"
        return
    fi

    printf "\n${BOLD}  Which release channel would you like to install?${RESET}\n\n"
    printf "    ${BOLD}1) stable${RESET}  — official releases, production-ready (recommended)\n"
    printf "    ${BOLD}2) nightly${RESET} — built daily from main, may contain unreleased features\n\n"
    printf "  Enter 1 or 2 [default: 1]: "

    read -r CHOICE </dev/tty
    case "${CHOICE}" in
        2) CREATEOS_CHANNEL="nightly" ;;
        *) CREATEOS_CHANNEL="stable"  ;;
    esac
    printf "\n"
}

# ---------------------------------------------------------------------------
# Resolve the download version
# ---------------------------------------------------------------------------
resolve_version() {
    CHANNEL="${CREATEOS_CHANNEL:-stable}"

    if [ "${CHANNEL}" = "nightly" ]; then
        VERSION="nightly"
        info "Channel: nightly"
        return
    fi

    if [ -n "${CREATEOS_VERSION:-}" ]; then
        VERSION="${CREATEOS_VERSION}"
        info "Version: ${VERSION} (pinned)"
        return
    fi

    info "Fetching latest stable release..."
    LATEST_URL="https://api.github.com/repos/${GITHUB_REPO}/releases/latest"
    if command -v curl > /dev/null 2>&1; then
        RELEASE_JSON="$(curl -fsSL --retry 3 "${LATEST_URL}" 2>&1)" || {
            fatal "No stable release found. If you want the nightly build, run:\n  curl -sfL https://raw.githubusercontent.com/${GITHUB_REPO}/main/install.sh | CREATEOS_CHANNEL=nightly sh -"
        }
        VERSION="$(printf '%s' "${RELEASE_JSON}" | grep '"tag_name"' | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')"
    elif command -v wget > /dev/null 2>&1; then
        RELEASE_JSON="$(wget -qO- "${LATEST_URL}")" || {
            fatal "No stable release found. If you want the nightly build, run:\n  curl -sfL https://raw.githubusercontent.com/${GITHUB_REPO}/main/install.sh | CREATEOS_CHANNEL=nightly sh -"
        }
        VERSION="$(printf '%s' "${RELEASE_JSON}" | grep '"tag_name"' | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')"
    else
        fatal "curl or wget is required to download createos."
    fi

    [ -n "${VERSION}" ] || fatal "Could not determine the latest version. Check your internet connection."

    # Validate format to guard against tampered API responses
    case "${VERSION}" in
        v[0-9]*.[0-9]*.[0-9]*) ;;
        *) fatal "Unexpected version format received: '${VERSION}'. Aborting." ;;
    esac

    info "Latest version: ${VERSION}"
}

# ---------------------------------------------------------------------------
# Build asset names and URLs
# ---------------------------------------------------------------------------
build_urls() {
    ASSET="${BINARY_NAME}-${OS}-${ARCH}"
    CHECKSUM_ASSET="${ASSET}.sha256"

    if [ "${VERSION}" = "nightly" ]; then
        BASE_URL="https://github.com/${GITHUB_REPO}/releases/download/nightly"
    else
        BASE_URL="https://github.com/${GITHUB_REPO}/releases/download/${VERSION}"
    fi

    BINARY_URL="${BASE_URL}/${ASSET}"
    CHECKSUM_URL="${BASE_URL}/${CHECKSUM_ASSET}"
}

# ---------------------------------------------------------------------------
# Resolve install directory (prefer /usr/local/bin, fall back to ~/.local/bin)
# ---------------------------------------------------------------------------
resolve_install_dir() {
    if [ -n "${CREATEOS_INSTALL_DIR:-}" ]; then
        INSTALL_DIR="${CREATEOS_INSTALL_DIR}"
        return
    fi

    if [ -w "/usr/local/bin" ]; then
        INSTALL_DIR="/usr/local/bin"
    elif [ "$(id -u)" = "0" ]; then
        INSTALL_DIR="/usr/local/bin"
    else
        INSTALL_DIR="${HOME}/.local/bin"
        mkdir -p "${INSTALL_DIR}"
        # Warn if not on PATH
        case ":${PATH}:" in
            *":${INSTALL_DIR}:"*) ;;
            *) warn "${INSTALL_DIR} is not in your PATH. Add it: export PATH=\"\$HOME/.local/bin:\$PATH\"" ;;
        esac
    fi
}

# ---------------------------------------------------------------------------
# Download helpers (curl or wget)
# ---------------------------------------------------------------------------

# download_silent: no progress output — used for small files (checksums, API calls)
download_silent() {
    URL="$1"
    DEST="$2"
    if command -v curl > /dev/null 2>&1; then
        curl -fsSL --retry 3 --retry-delay 2 -o "${DEST}" "${URL}"
    elif command -v wget > /dev/null 2>&1; then
        wget -qO "${DEST}" "${URL}"
    else
        fatal "curl or wget is required."
    fi
}

# download_progress: shows progress bar — used for the binary
download_progress() {
    URL="$1"
    DEST="$2"
    if command -v curl > /dev/null 2>&1; then
        curl -fL --retry 3 --retry-delay 2 --progress-bar -o "${DEST}" "${URL}"
    elif command -v wget > /dev/null 2>&1; then
        wget --show-progress -qO "${DEST}" "${URL}" 2>&1
    else
        fatal "curl or wget is required."
    fi
}

# ---------------------------------------------------------------------------
# Verify SHA256 checksum
# ---------------------------------------------------------------------------
verify_checksum() {
    BINARY_PATH="$1"
    EXPECTED="$2"

    # Validate expected hash is a 64-char hex string before trusting it
    case "${EXPECTED}" in
        [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\
[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\
[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\
[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\
[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\
[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\
[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\
[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]) ;;
        *) fatal "Checksum file contains unexpected content — aborting." ;;
    esac

    if command -v sha256sum > /dev/null 2>&1; then
        ACTUAL="$(sha256sum "${BINARY_PATH}" | awk '{print $1}')"
    elif command -v shasum > /dev/null 2>&1; then
        ACTUAL="$(shasum -a 256 "${BINARY_PATH}" | awk '{print $1}')"
    else
        fatal "sha256sum or shasum is required to verify the download. Please install one and retry."
    fi

    if [ "${ACTUAL}" != "${EXPECTED}" ]; then
        fatal "Checksum mismatch — the download may be corrupted or tampered with.\n  expected: ${EXPECTED}\n  got:      ${ACTUAL}"
    fi

    success "Checksum verified."
}

# ---------------------------------------------------------------------------
# Install
# ---------------------------------------------------------------------------
install_binary() {
    INSTALL_PATH="${INSTALL_DIR}/${BINARY_NAME}"
    TMP_DIR="$(mktemp -d)"
    TMP_BINARY="${TMP_DIR}/${ASSET}"
    TMP_CHECKSUM="${TMP_DIR}/${CHECKSUM_ASSET}"

    trap 'rm -rf "${TMP_DIR}"' EXIT

    info "Downloading ${ASSET}..."
    download_progress "${BINARY_URL}" "${TMP_BINARY}" \
        || fatal "Failed to download binary from ${BINARY_URL}"

    download_silent "${CHECKSUM_URL}" "${TMP_CHECKSUM}" \
        || fatal "Failed to download checksum from ${CHECKSUM_URL}"

    EXPECTED_HASH="$(cat "${TMP_CHECKSUM}" | tr -d '[:space:]')"
    verify_checksum "${TMP_BINARY}" "${EXPECTED_HASH}"

    chmod 755 "${TMP_BINARY}"

    # Use sudo only if we need it
    if [ -w "${INSTALL_DIR}" ]; then
        mv "${TMP_BINARY}" "${INSTALL_PATH}"
    else
        info "Root access required to install to ${INSTALL_DIR}."
        sudo mv "${TMP_BINARY}" "${INSTALL_PATH}"
    fi
}

# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------
main() {
    printf "\n${BOLD}  CreateOS CLI Installer${RESET}\n\n"

    detect_os
    detect_arch
    prompt_channel
    resolve_version
    build_urls
    resolve_install_dir

    info "OS: ${OS} / Arch: ${ARCH}"
    info "Install directory: ${INSTALL_DIR}"

    install_binary

    success "createos ${VERSION} installed to ${INSTALL_DIR}/${BINARY_NAME}"
    printf "\n  Run ${CYAN}createos --help${RESET} to get started.\n\n"
}

main