install.sh

#!/usr/bin/env bash
set -euo pipefail
umask 022
shopt -s lastpipe 2>/dev/null || true

VERSION="${VERSION:-}"
OWNER="${OWNER:-Dicklesworthstone}"
REPO="${REPO:-coding_agent_session_search}"
FALLBACK_VERSION="${FALLBACK_VERSION:-}"
DEST_DEFAULT="$HOME/.local/bin"
DEST="${DEST:-$DEST_DEFAULT}"
EASY=0
QUIET=0
VERIFY=0
QUICKSTART=0
FROM_SOURCE=0
CHECKSUM="${CHECKSUM:-}"
CHECKSUM_URL="${CHECKSUM_URL:-}"
ARTIFACT_URL="${ARTIFACT_URL:-}"
TMP_ROOT=""
LOCK_FILE=""

log() { [ "$QUIET" -eq 1 ] && return 0; echo -e "$@"; }
info() { log "\033[0;34m→\033[0m $*"; }
ok() { log "\033[0;32m✓\033[0m $*"; }
warn() { log "\033[1;33m⚠\033[0m $*"; }
err() { log "\033[0;31m✗\033[0m $*"; }

strip_url_suffix() {
  local value="$1"
  value="${value%%\#*}"
  value="${value%%\?*}"
  printf '%s' "$value"
}

artifact_name_from_url() {
  basename "$(strip_url_suffix "$1")"
}

sibling_url() {
  local url="$1"
  local sibling="$2"
  local base
  base="$(strip_url_suffix "$url")"
  printf '%s/%s' "${base%/*}" "$sibling"
}

is_valid_sha256() {
  printf '%s' "$1" | grep -Eq '^[0-9a-fA-F]{64}$'
}

resolve_tmp_root() {
  local candidate
  if [ -n "${TMPDIR:-}" ] && [ "${TMPDIR}" != "/tmp" ]; then
    if [ -d "${TMPDIR}" ] && [ -w "${TMPDIR}" ] && [ -x "${TMPDIR}" ]; then
      printf '%s' "${TMPDIR}"
      return 0
    fi
    warn "Ignoring TMPDIR=${TMPDIR} because it is not an accessible directory"
  fi

  for candidate in "/data/tmp" "/var/tmp" "/tmp"; do
    [ -n "$candidate" ] || continue
    if [ -d "$candidate" ] && [ -w "$candidate" ] && [ -x "$candidate" ]; then
      printf '%s' "$candidate"
      return 0
    fi
  done

  err "Could not find a writable temporary directory. Set TMPDIR to a writable path and retry."
  exit 1
}

checksum_matches() {
  local file="$1"
  local expected actual status
  expected=$(printf '%s' "$CHECKSUM" | tr '[:upper:]' '[:lower:]')

  if command -v sha256sum >/dev/null 2>&1; then
    echo "$expected  $file" | sha256sum -c - >/dev/null 2>&1
    status=$?
    if [ "$status" -eq 0 ]; then
      return 0
    fi
    if [ "$status" -ne 127 ]; then
      return "$status"
    fi
  fi

  if command -v shasum >/dev/null 2>&1; then
    actual=$(shasum -a 256 "$file" | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
    [ "$actual" = "$expected" ]
    return $?
  fi

  if command -v openssl >/dev/null 2>&1; then
    actual=$(openssl dgst -sha256 "$file" | awk '{print $NF}' | tr '[:upper:]' '[:lower:]')
    [ "$actual" = "$expected" ]
    return $?
  fi

  err "No SHA-256 verification tool found (need sha256sum, shasum, or openssl)"
  exit 1
}

# Member-safety check for archive validation. Its job is path-traversal /
# zip-slip defense ONLY: reject absolute paths and any ".." path component.
# It deliberately does NOT restrict membership to the binary name. The
# installer extracts to a temp dir and copies ONLY the binary to the
# destination (see `install -m 0755 "$BIN" ...`), so benign siblings bundled
# alongside the binary (README.md, LICENSE, CHANGELOG, future docs, ...) are
# harmless and must be allowed. A binary-name allow-list breaks every time
# packaging adds a sibling file — exactly the v0.6.15+ regression in cass#299
# where release tarballs began bundling README.md + LICENSE.
archive_member_path_safe() {
  local member
  member="${1#./}"

  [ -n "$member" ] || return 1

  case "$member" in
    /*) return 1 ;;          # absolute path
  esac
  case "/$member/" in
    */../*) return 1 ;;      # any ".." path component (../x, a/../b, x/..)
  esac

  return 0
}

archive_member_is_installable_binary() {
  local member
  member="${1#./}"

  case "$member" in
    cass|coding-agent-search)
      [ "${INSTALL_BASENAME:-cass}" != "cass.exe" ] && return 0 ;;
    cass.exe|coding-agent-search.exe)
      [ "${INSTALL_BASENAME:-cass}" = "cass.exe" ] && return 0 ;;
  esac

  if [ -n "$TARGET" ]; then
    case "$member" in
      "cass-${TARGET}/cass"|"cass-${TARGET}/coding-agent-search")
        [ "${INSTALL_BASENAME:-cass}" != "cass.exe" ] && return 0 ;;
      "cass-${TARGET}/cass.exe"|"cass-${TARGET}/coding-agent-search.exe")
        [ "${INSTALL_BASENAME:-cass}" = "cass.exe" ] && return 0 ;;
    esac
  fi

  return 1
}

validate_archive_members() {
  local archive="$1"
  local member_list="$TMP/archive-members.txt"
  local member
  local saw_binary=0

  case "$TAR" in
    *.zip) unzip -Z1 "$archive" > "$member_list" ;;
    *.tar.gz) tar -tzf "$archive" > "$member_list" ;;
    *.tar.xz) tar -tJf "$archive" > "$member_list" ;;
    *) tar -tf "$archive" > "$member_list" ;;
  esac || { err "Could not list archive members"; exit 1; }

  if [ ! -s "$member_list" ]; then
    err "Archive is empty"
    exit 1
  fi

  while IFS= read -r member; do
    [ -n "$member" ] || continue
    if ! archive_member_path_safe "$member"; then
      err "Unsafe archive member: $member"
      exit 1
    fi
    if archive_member_is_installable_binary "$member"; then
      saw_binary=1
    fi
  done < "$member_list"

  if [ "$saw_binary" -ne 1 ]; then
    err "Archive does not contain a cass binary"
    exit 1
  fi
}

resolve_version() {
  if [ -n "$VERSION" ]; then return 0; fi
  local latest=""
  if command -v curl >/dev/null 2>&1; then
    # Try 1: Fetch latest release tag from GitHub API
    latest=$(curl -fsSL "https://api.github.com/repos/$OWNER/$REPO/releases/latest" 2>/dev/null \
      | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
    # Try 2: If no releases exist, fall back to latest git tag (sorted by version)
    if [ -z "$latest" ]; then
      warn "No GitHub releases found; falling back to latest git tag"
      latest=$(curl -fsSL "https://api.github.com/repos/$OWNER/$REPO/tags?per_page=1" 2>/dev/null \
        | grep '"name"' | head -1 | sed 's/.*"name": *"\([^"]*\)".*/\1/')
    fi
  fi
  if [ -n "$latest" ]; then
    VERSION="$latest"
    info "Using latest version: $VERSION"
  elif [ -n "$FALLBACK_VERSION" ]; then
    VERSION="$FALLBACK_VERSION"
    info "Using fallback version: $VERSION"
  else
    err "Could not determine latest version. Pass --version <tag> explicitly."
    exit 1
  fi
}

maybe_add_path() {
  case ":$PATH:" in
    *:"$DEST":*) return 0;;
    *)
      if [ "$EASY" -eq 1 ]; then
        UPDATED=0
        for rc in "$HOME/.zshrc" "$HOME/.bashrc"; do
          if [ -e "$rc" ] && [ -w "$rc" ]; then
            if ! grep -F "$DEST" "$rc" >/dev/null 2>&1; then
              echo "export PATH=\"$DEST:\$PATH\"" >> "$rc"
            fi
            UPDATED=1
          fi
        done
        if [ "$UPDATED" -eq 1 ]; then
          warn "PATH updated in ~/.zshrc/.bashrc; restart shell to use cass"
        else
          warn "Add $DEST to PATH to use cass"
        fi
      else
        warn "Add $DEST to PATH to use cass"
      fi
    ;;
  esac
}

ensure_rust() {
  if [ "${RUSTUP_INIT_SKIP:-0}" != "0" ]; then
    info "Skipping rustup install (RUSTUP_INIT_SKIP set)"
    return 0
  fi
  # Require Rust 1.85+ (edition 2024 support) or any future major version (2.x+)
  if command -v cargo >/dev/null 2>&1 && rustc --version 2>/dev/null | grep -qE 'rustc ([2-9]+|1\.(8[5-9]|9[0-9]|[1-9][0-9]{2,}))\.'; then return 0; fi
  if [ "$EASY" -ne 1 ]; then
    if [ -t 0 ]; then
      echo -n "Install Rust stable via rustup? (y/N): "
      read -r ans
      case "$ans" in y|Y) :;; *) warn "Skipping rustup install"; return 0;; esac
    fi
  fi
  info "Installing rustup (stable)"
  curl -fsSL https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
  export PATH="$HOME/.cargo/bin:$PATH"
  rustup component add rustfmt clippy || true
}

usage() {
  cat <<EOFU
Usage: install.sh [--version vX.Y.Z] [--dest DIR] [--system] [--easy-mode] [--verify] [--quickstart] \
                  [--artifact-url URL] [--checksum HEX] [--checksum-url URL] [--quiet]
EOFU
}

while [ $# -gt 0 ]; do
  case "$1" in
    --version) VERSION="$2"; shift 2;;
    --dest) DEST="$2"; shift 2;;
    --system) DEST="/usr/local/bin"; shift;;
    --easy-mode) EASY=1; shift;;
    --verify) VERIFY=1; shift;;
    --quickstart) QUICKSTART=1; shift;;
    --artifact-url) ARTIFACT_URL="$2"; shift 2;;
    --checksum) CHECKSUM="$2"; shift 2;;
    --checksum-url) CHECKSUM_URL="$2"; shift 2;;
    --from-source) FROM_SOURCE=1; shift;;
    --quiet|-q) QUIET=1; shift;;
    -h|--help) usage; exit 0;;
    *) shift;;
  esac
done

resolve_version

mkdir -p "$DEST"
TMP_ROOT="$(resolve_tmp_root)"
LOCK_FILE="${TMP_ROOT%/}/coding-agent-search-install.lock"
if [ "${TMPDIR:-}" != "$TMP_ROOT" ]; then
  export TMPDIR="$TMP_ROOT"
fi
if [ "$TMP_ROOT" != "/tmp" ]; then
  info "Using temporary workspace under $TMP_ROOT"
fi
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m)
case "$ARCH" in
  x86_64|amd64) ARCH="amd64" ;;
  arm64|aarch64) ARCH="arm64" ;;
  *) warn "Unknown arch $ARCH, using as-is" ;;
esac

# cass#308 retired the prebuilt Microsoft ONNX Runtime. Every supported release
# artifact now uses pure-Rust inference with runtime-dispatched SIMD, so this
# installer has no AVX2 probe and never selects a separate `-baseline` asset.
# `--artifact-url` remains an explicit custom-artifact override only.

TARGET=""
EXT="tar.gz"
NO_PREBUILT_REASON=""
case "${OS}-${ARCH}" in
  linux-amd64) TARGET="linux-amd64" ;;
  linux-arm64) TARGET="linux-arm64" ;;
  darwin-amd64) NO_PREBUILT_REASON="Intel macOS release binaries are not published" ;;
  darwin-arm64) TARGET="darwin-arm64" ;;
  mingw*-amd64|msys*-amd64|cygwin*-amd64)
    TARGET="windows-amd64"
    EXT="zip"
    ;;
  *) :;;
esac
INSTALL_BASENAME="cass"
case "$TARGET" in
  windows-amd64) INSTALL_BASENAME="cass.exe" ;;
esac

# Prefer prebuilt artifact when we know the target or the caller supplied a direct URL.
TAR=""
URL=""
if [ "$FROM_SOURCE" -eq 0 ]; then
  if [ -n "$ARTIFACT_URL" ]; then
    TAR=$(artifact_name_from_url "$ARTIFACT_URL")
    URL="$ARTIFACT_URL"
  elif [ -n "$TARGET" ]; then
    TAR="cass-${TARGET}.${EXT}"
    URL="https://github.com/${OWNER}/${REPO}/releases/download/${VERSION}/${TAR}"
  else
    if [ -n "$NO_PREBUILT_REASON" ]; then
      warn "$NO_PREBUILT_REASON; falling back to build-from-source"
    else
      warn "No prebuilt artifact for ${OS}/${ARCH}; falling back to build-from-source"
    fi
    FROM_SOURCE=1
  fi
fi

# Cross-platform locking using mkdir (atomic on all POSIX systems including macOS)
# flock is Linux-only and doesn't exist on macOS
LOCK_DIR="${LOCK_FILE}.d"
LOCKED=0
if mkdir "$LOCK_DIR" 2>/dev/null; then
  LOCKED=1
  # Store PID for stale lock detection
  echo $$ > "$LOCK_DIR/pid"
else
  # Check if existing lock is stale (process no longer running)
  if [ -f "$LOCK_DIR/pid" ]; then
    OLD_PID=$(cat "$LOCK_DIR/pid" 2>/dev/null || echo "")
    if [ -n "$OLD_PID" ] && ! kill -0 "$OLD_PID" 2>/dev/null; then
      # Stale lock, remove and retry
      rm -rf "$LOCK_DIR"
      if mkdir "$LOCK_DIR" 2>/dev/null; then
        LOCKED=1
        echo $$ > "$LOCK_DIR/pid"
      fi
    fi
  fi
  if [ "$LOCKED" -eq 0 ]; then
    err "Another installer is running (lock $LOCK_DIR)"
    exit 1
  fi
fi

cleanup() {
  rm -rf "$TMP"
  if [ "$LOCKED" -eq 1 ]; then rm -rf "$LOCK_DIR"; fi
}

TMP=$(mktemp -d "${TMP_ROOT%/}/cass-install.XXXXXX")
trap cleanup EXIT

if [ "$FROM_SOURCE" -eq 0 ]; then
  info "Downloading $URL"
  if ! curl -fsSL "$URL" -o "$TMP/$TAR"; then
    warn "Artifact download failed; falling back to build-from-source"
    FROM_SOURCE=1
  fi
fi

if [ "$FROM_SOURCE" -eq 1 ]; then
  info "Building from source (requires git and a working Rust stable toolchain)"
  ensure_rust
  git clone --depth 1 --branch "$VERSION" "https://github.com/${OWNER}/${REPO}.git" "$TMP/src"
  (cd "$TMP/src" && cargo build --locked --release)
  BIN="$TMP/src/target/release/$INSTALL_BASENAME"
  if [ ! -x "$BIN" ]; then
    BIN="$TMP/src/target/release/cass"
  fi
  if [ ! -x "$BIN" ]; then
    BIN="$TMP/src/target/release/cass.exe"
  fi
  [ -x "$BIN" ] || { err "Build failed"; exit 1; }
  install -m 0755 "$BIN" "$DEST/$INSTALL_BASENAME"
  ok "Installed to $DEST/$INSTALL_BASENAME (source build)"
  maybe_add_path
  if [ "$VERIFY" -eq 1 ]; then "$DEST/$INSTALL_BASENAME" --version || true; ok "Self-test complete"; fi
  if [ "$QUICKSTART" -eq 1 ]; then info "Running index --full (quickstart)"; "$DEST/$INSTALL_BASENAME" index --full || warn "index --full failed"; fi
  ok "Done. Run: cass"
  exit 0
fi

if [ -z "$CHECKSUM" ]; then
  [ -z "$CHECKSUM_URL" ] && CHECKSUM_URL="$(sibling_url "$URL" "${TAR}.sha256")"
  CHECKSUM_FILE="$TMP/checksum.sha256"
  SUMS_URL="$(sibling_url "$URL" "SHA256SUMS.txt")"
  SUMS_URL_ALT="$(sibling_url "$URL" "SHA256SUMS")"
  for TRY_URL in "$CHECKSUM_URL" "$SUMS_URL" "$SUMS_URL_ALT"; do
    [ -n "$TRY_URL" ] || continue
    info "Fetching checksum from ${TRY_URL}"
    if ! curl -fsSL "$TRY_URL" -o "$CHECKSUM_FILE"; then
      warn "Could not fetch checksum from ${TRY_URL}; trying next source..."
      continue
    fi

    if [ "$TRY_URL" = "$SUMS_URL" ] || [ "$TRY_URL" = "$SUMS_URL_ALT" ]; then
      CHECKSUM=$(awk -v tb="$TAR" '$2 == tb {print $1; exit}' "$CHECKSUM_FILE")
    else
      # Per-file checksum assets are expected to contain only the requested hash line.
      CHECKSUM=$(awk '{print $1}' "$CHECKSUM_FILE")
    fi

    if is_valid_sha256 "$CHECKSUM"; then
      break
    fi

    CHECKSUM=""
    warn "Checksum data from ${TRY_URL} did not contain a valid entry for ${TAR}; trying next source..."
  done
  if [ -z "$CHECKSUM" ]; then err "Checksum required and could not be resolved"; exit 1; fi
fi

checksum_matches "$TMP/$TAR" || { err "Checksum mismatch"; exit 1; }
ok "Checksum verified"

validate_archive_members "$TMP/$TAR"
ok "Archive layout verified"

info "Extracting"
case "$TAR" in
  *.zip) unzip -q "$TMP/$TAR" -d "$TMP" ;;
  *.tar.gz) tar -xzf "$TMP/$TAR" -C "$TMP" ;;
  *.tar.xz) tar -xJf "$TMP/$TAR" -C "$TMP" ;;
  *) tar -xf "$TMP/$TAR" -C "$TMP" ;;
esac
BIN="$TMP/$INSTALL_BASENAME"
if [ ! -x "$BIN" ] && [ -n "$TARGET" ]; then
  BIN="$TMP/cass-${TARGET}/$INSTALL_BASENAME"
fi
if [ ! -x "$BIN" ] && [ "$INSTALL_BASENAME" != "cass.exe" ]; then
  BIN=$(find "$TMP" -maxdepth 3 -type f -name "cass" -perm -111 | head -n 1)
fi
if [ ! -x "$BIN" ] && [ "$INSTALL_BASENAME" = "cass.exe" ] && [ -f "$TMP/cass.exe" ]; then
  BIN="$TMP/cass.exe"
fi
if [ ! -x "$BIN" ] && [ "$INSTALL_BASENAME" = "cass.exe" ] && [ -n "$TARGET" ] && [ -f "$TMP/cass-${TARGET}/cass.exe" ]; then
  BIN="$TMP/cass-${TARGET}/cass.exe"
fi
if [ ! -x "$BIN" ] && [ "$INSTALL_BASENAME" = "cass.exe" ]; then
   BIN=$(find "$TMP" -maxdepth 3 -type f -name "coding-agent-search.exe" -perm -111 | head -n 1)
   if [ -x "$BIN" ]; then
      warn "Found 'coding-agent-search.exe' binary instead of 'cass.exe'; installing it as 'cass.exe'"
   fi
fi
if [ ! -x "$BIN" ] && [ "$INSTALL_BASENAME" != "cass.exe" ]; then
   BIN=$(find "$TMP" -maxdepth 3 -type f -name "coding-agent-search" -perm -111 | head -n 1)
   if [ -x "$BIN" ]; then
      warn "Found 'coding-agent-search' binary instead of 'cass'; installing as 'cass'"
   fi
fi

[ -x "$BIN" ] || { err "Binary not found in tar"; exit 1; }
install -m 0755 "$BIN" "$DEST/$INSTALL_BASENAME"
ok "Installed to $DEST/$INSTALL_BASENAME"
maybe_add_path

if [ "$VERIFY" -eq 1 ]; then
  "$DEST/$INSTALL_BASENAME" --version || true
  ok "Self-test complete"
fi

if [ "$QUICKSTART" -eq 1 ]; then
  info "Running index --full (quickstart)"
  "$DEST/$INSTALL_BASENAME" index --full || warn "index --full failed"
fi

ok "Done. Run: cass"
info "Tip: If installed via Homebrew, update with: brew upgrade cass"