#!/bin/sh
set -eu
umask 077

OCTO_INSTALL_ORIGIN=${OCTO_INSTALL_ORIGIN:-'https://octo-cli.xuanli.ai'}
OCTO_SIGNED_INSTALL_SHA256='d569aac8f1517b89a076ae4db0eab05e92eeba1d20f2615e90197c84403ed4af'

fail() {
  printf 'Octo CLI 安装失败：%s\n' "$1" >&2
  exit 1
}

command -v curl >/dev/null 2>&1 || fail '缺少 curl。'
command -v tar >/dev/null 2>&1 || fail '缺少 tar。'
command -v openssl >/dev/null 2>&1 || fail '缺少 openssl。'

case "$OCTO_INSTALL_ORIGIN" in
  https://*) ;;
  http://127.0.0.1:*|http://localhost:*) ;;
  *) fail '安装源必须使用 HTTPS；仅本机测试允许 loopback HTTP。' ;;
esac

OCTO_SYSTEM=$(uname -s)
OCTO_MACHINE=$(uname -m)
if [ "$OCTO_SYSTEM" = 'Darwin' ] && [ "$OCTO_MACHINE" = 'x86_64' ]; then
  if [ "$(sysctl -in sysctl.proc_translated 2>/dev/null || true)" = '1' ]; then
    OCTO_MACHINE='arm64'
  fi
fi

OCTO_TEMP=$(mktemp -d "${TMPDIR:-/tmp}/octo-web-install.XXXXXX")
OCTO_MIRROR="$OCTO_TEMP/release"
OCTO_PAYLOAD="$OCTO_MIRROR/archive.part"
mkdir -p "$OCTO_MIRROR"
trap 'rm -rf -- "$OCTO_TEMP"' EXIT HUP INT TERM
: > "$OCTO_PAYLOAD"

hash_file() {
  if command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  elif command -v sha256sum >/dev/null 2>&1; then
    sha256sum "$1" | awk '{print $1}'
  else
    openssl dgst -sha256 "$1" | awk '{print $NF}'
  fi
}

download() {
  OCTO_NAME=$1
  OCTO_DESTINATION=$2
  case "$OCTO_INSTALL_ORIGIN" in
    https://*)
      curl --fail --location --silent --show-error --retry 3 \
        --proto '=https' --tlsv1.2 \
        "${OCTO_INSTALL_ORIGIN%/}/$OCTO_NAME" --output "$OCTO_DESTINATION"
      ;;
    *)
      curl --fail --location --silent --show-error --retry 3 \
        "${OCTO_INSTALL_ORIGIN%/}/$OCTO_NAME" --output "$OCTO_DESTINATION"
      ;;
  esac
}

download_chunk() {
  OCTO_CHUNK_NAME=$1
  OCTO_CHUNK_SHA256=$2
  OCTO_CHUNK_BYTES=$3
  OCTO_CHUNK_PATH="$OCTO_TEMP/$OCTO_CHUNK_NAME"
  printf '下载 %s...\n' "$OCTO_CHUNK_NAME"
  download "$OCTO_CHUNK_NAME" "$OCTO_CHUNK_PATH"
  OCTO_ACTUAL_BYTES=$(wc -c < "$OCTO_CHUNK_PATH" | tr -d '[:space:]')
  [ "$OCTO_ACTUAL_BYTES" = "$OCTO_CHUNK_BYTES" ] || fail "$OCTO_CHUNK_NAME 文件大小校验失败。"
  [ "$(hash_file "$OCTO_CHUNK_PATH")" = "$OCTO_CHUNK_SHA256" ] || fail "$OCTO_CHUNK_NAME SHA-256 校验失败。"
  cat "$OCTO_CHUNK_PATH" >> "$OCTO_PAYLOAD"
  rm -f -- "$OCTO_CHUNK_PATH"
}

case "$OCTO_SYSTEM/$OCTO_MACHINE" in
  Darwin/arm64|Darwin/aarch64)
    OCTO_ARCHIVE='octo-cli-0.1.0-darwin-arm64.tar.gz'
    OCTO_EXPECTED_BYTES='36056198'
    OCTO_EXPECTED_SHA256='f662cc04a95b360b4aac18628aa3c4c1fbcb9ab2dbb45aedba2fd631f68557a0'
    download_chunk 'octo-cli-0.1.0-darwin-arm64.tar.gz.part-000' '44f8624e54826d8aa03e8620bd42323f4b390b000f050a4f6fa19d9674df7826' '8388608'
    download_chunk 'octo-cli-0.1.0-darwin-arm64.tar.gz.part-001' '03974c456cc0711d54a0ec6129912e0ef089ecdc87f18e90c75fa169266b3a98' '8388608'
    download_chunk 'octo-cli-0.1.0-darwin-arm64.tar.gz.part-002' '125a1ca9dd31dcffdece777adb0ce7294e431a1e9f5171c7e0dd24814fb9f3c0' '8388608'
    download_chunk 'octo-cli-0.1.0-darwin-arm64.tar.gz.part-003' '7d07c1f08608dd7646984f22183747ad53a433b51f667a1daac44b26e2fbdc5f' '8388608'
    download_chunk 'octo-cli-0.1.0-darwin-arm64.tar.gz.part-004' 'ff25bde29ecedf8a03775e1df24b5f37ea98488fd11627516c1477c1c6ec3483' '2501766'
    ;;
  *) fail "当前发布不支持 $OCTO_SYSTEM/$OCTO_MACHINE。" ;;
esac

[ "$(wc -c < "$OCTO_PAYLOAD" | tr -d '[:space:]')" = "$OCTO_EXPECTED_BYTES" ] || fail '完整归档大小校验失败。'
[ "$(hash_file "$OCTO_PAYLOAD")" = "$OCTO_EXPECTED_SHA256" ] || fail '完整归档 SHA-256 校验失败。'
mv "$OCTO_PAYLOAD" "$OCTO_MIRROR/$OCTO_ARCHIVE"

download 'release-manifest.json' "$OCTO_MIRROR/release-manifest.json"
download 'release-manifest.sig' "$OCTO_MIRROR/release-manifest.sig"
download 'release-install.sh' "$OCTO_MIRROR/release-install.sh"
[ "$(hash_file "$OCTO_MIRROR/release-install.sh")" = "$OCTO_SIGNED_INSTALL_SHA256" ] || fail '签名安装器 SHA-256 校验失败。'

OCTO_ALLOW_FILE_RELEASES=1 sh "$OCTO_MIRROR/release-install.sh" \
  --base-url "file://$OCTO_MIRROR" \
  --with-agent-skill "$@"

printf '\nOcto CLI 0.1.0 安装完成。\n'
printf '运行：octo auth qr start --json\n'