#!/bin/sh
# Surplus Code (beta) installer: the native terminal app, including end-to-end encrypted runs on
# confidential tee/ models.
#
#   curl -fsSL https://surplusllm.com/install-cli.sh | sh
#
# What it does, and nothing else:
#   1. reads the current release from the Surplus API (latest.json: version and sha256 per platform)
#   2. downloads the binary for this OS and CPU and checks its sha256
#   3. installs it as ~/.local/bin/surplus-code
# It never edits your shell profile. An OpenCode launcher that install.sh put at surplus-code
# before is moved to surplus-opencode, not overwritten. Update later with `surplus-code update`.
# The app signs you in through the browser on first run.
#
# Env: SURPLUS_RELEASES_BASE (default below), SURPLUS_BIN_DIR (default ~/.local/bin).
set -eu

RELEASES="${SURPLUS_RELEASES_BASE:-https://api.surplusllm.com/api/releases/surplus-code}"
BIN_DIR="${SURPLUS_BIN_DIR:-$HOME/.local/bin}"
BIN_NAME="surplus-code"

ok() { printf '\033[32m✓\033[0m %s\n' "$*"; }
die() { printf '\033[31m✗\033[0m %s\n' "$*" >&2; exit 1; }

command -v curl >/dev/null 2>&1 || die "curl is required."

case "$(uname -s)" in
  Darwin) OS=darwin ;;
  Linux) OS=linux ;;
  *) die "This installer covers macOS and Linux. On Windows, in PowerShell: irm https://surplusllm.com/install-cli.ps1 | iex" ;;
esac
case "$(uname -m)" in
  arm64 | aarch64) ARCH=arm64 ;;
  x86_64 | amd64) ARCH=amd64 ;;
  *) die "No build for $(uname -m) yet." ;;
esac

if command -v shasum >/dev/null 2>&1; then
  sha256() { shasum -a 256 "$1" | cut -d' ' -f1; }
elif command -v sha256sum >/dev/null 2>&1; then
  sha256() { sha256sum "$1" | cut -d' ' -f1; }
else
  die "Need shasum or sha256sum to check the download."
fi

printf '\n  Surplus Code (beta)\n\n'

LATEST=$(curl -fsS "$RELEASES/latest.json") || die "Couldn't read the latest release."
# One "<os>-<arch>": { "path": …, "sha256": … } entry per line in latest.json (cli/scripts/release.sh).
ENTRY=$(printf '%s\n' "$LATEST" | grep "\"$OS-$ARCH\"") || die "No build for $OS-$ARCH in this release."
FILE=$(printf '%s' "$ENTRY" | sed -n -E 's/.*"path": *"([^"]+)".*/\1/p')
WANT=$(printf '%s' "$ENTRY" | sed -n -E 's/.*"sha256": *"([0-9a-f]{64})".*/\1/p')
VERSION=$(printf '%s\n' "$LATEST" | sed -n -E 's/.*"version": *"([^"]+)".*/\1/p')
[ -n "$FILE" ] && [ -n "$WANT" ] || die "The release manifest is malformed."
case "$FILE" in *..* | /*) die "The release manifest names an unexpected path." ;; esac

TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT
curl -fsSL "$RELEASES/$FILE" -o "$TMP/$BIN_NAME" || die "Download failed."
GOT=$(sha256 "$TMP/$BIN_NAME")
[ "$GOT" = "$WANT" ] || die "Checksum mismatch: expected $WANT, got $GOT. Nothing was installed."
ok "downloaded $VERSION for $OS-$ARCH, sha256 checked"

mkdir -p "$BIN_DIR"
chmod 755 "$TMP/$BIN_NAME"
# install.sh used to put an OpenCode launcher (a shell script) at this name: keep it, renamed.
if [ -f "$BIN_DIR/$BIN_NAME" ] && grep -q "exec opencode" "$BIN_DIR/$BIN_NAME" 2>/dev/null; then
  mv "$BIN_DIR/$BIN_NAME" "$BIN_DIR/surplus-opencode"
  ok "moved the OpenCode launcher to $BIN_DIR/surplus-opencode"
fi
mv "$TMP/$BIN_NAME" "$BIN_DIR/$BIN_NAME"
ok "installed $BIN_DIR/$BIN_NAME"

printf '\n'
case ":$PATH:" in
  *":$BIN_DIR:"*) ;;
  *) printf 'Add %s to your PATH:  export PATH="%s:$PATH"\n' "$BIN_DIR" "$BIN_DIR" ;;
esac
printf 'Run %s in any project. Pick a tee/ model (marked 🔒) for end-to-end encrypted runs.\n\n' "$BIN_NAME"