#!/usr/bin/env bash
# install-larry.sh — bootstrap Larry-Anywhere on a fresh remote shell.
# No root, no package install, no sudo. Writes only into $LARRY_HOME.
#
# Usage:
#   curl -fsSL <BASE_URL>/install-larry.sh | bash
#
# Or with explicit base URL:
#   LARRY_BASE_URL=https://example.com/larry-anywhere bash install-larry.sh
#
# Env vars:
#   LARRY_HOME       install location  (default: $HOME/.larry)
#   LARRY_BASE_URL   where to fetch files from (no trailing slash)
#   LARRY_BIN_DIR    where to symlink the `larry` command (default: $HOME/bin)
set -eu

LARRY_HOME="${LARRY_HOME:-$HOME/.larry}"
# Canonical hosting (v0.7.4): self-hosted Gitea at git.bjnoela.com is the
# single source.  The v0.7.2 GitHub fallback was removed after the GitHub
# mirror was made private (anonymous raw fetches now 401/403, so the
# fallback was functionally broken).  Override LARRY_BASE_URL via env if you
# fork or mirror elsewhere.
#
# IMPORTANT: the Gitea repo must be PUBLIC for unauthenticated raw-URL reads
# to succeed.  If the install fetch fails, set LARRY_BASE_URL to a reachable
# mirror or check repo visibility on git.bjnoela.com.
LARRY_BASE_URL="${LARRY_BASE_URL:-https://git.bjnoela.com/bryan/cloverleaf-larry/raw/branch/main}"
LARRY_BIN_DIR="${LARRY_BIN_DIR:-$HOME/bin}"

C_RESET=$'\033[0m'; C_BOLD=$'\033[1m'; C_GREEN=$'\033[32m'
C_YELLOW=$'\033[33m'; C_RED=$'\033[31m'; C_CYAN=$'\033[36m'

say()  { printf '%s%sinstall-larry>%s %s\n' "$C_CYAN" "$C_BOLD" "$C_RESET" "$*"; }
ok()   { printf '  %s✓%s %s\n' "$C_GREEN" "$C_RESET" "$*"; }
warn() { printf '  %s!%s %s\n' "$C_YELLOW" "$C_RESET" "$*"; }
die()  { printf '%serror:%s %s\n' "$C_RED" "$C_RESET" "$*" >&2; exit 1; }

# ─────────────────────────────────────────────────────────────────────────────
# Detect platform
# ─────────────────────────────────────────────────────────────────────────────
UNAME_S="$(uname -s 2>/dev/null || echo unknown)"
PLATFORM=""
case "$UNAME_S" in
  Linux*)        PLATFORM="linux" ;;
  Darwin*)       PLATFORM="darwin" ;;
  CYGWIN*|MINGW*|MSYS*) PLATFORM="windows-cygwin" ;;  # MobaXterm lives here
  *)             PLATFORM="unknown" ;;
esac

ARCH="$(uname -m 2>/dev/null || echo unknown)"
case "$ARCH" in
  x86_64|amd64) ARCH_NORM="amd64" ;;
  aarch64|arm64) ARCH_NORM="arm64" ;;
  i?86)         ARCH_NORM="i386" ;;
  *)            ARCH_NORM="$ARCH" ;;
esac

say "platform: $PLATFORM/$ARCH_NORM  •  LARRY_HOME=$LARRY_HOME"

# ─────────────────────────────────────────────────────────────────────────────
# Check required commands
# ─────────────────────────────────────────────────────────────────────────────
command -v bash >/dev/null 2>&1 || die "bash not found"
command -v curl >/dev/null 2>&1 || die "curl not found"

# ─────────────────────────────────────────────────────────────────────────────
# Make dirs
# ─────────────────────────────────────────────────────────────────────────────
mkdir -p "$LARRY_HOME"/{agents,sessions,bin,lib} || die "cannot create $LARRY_HOME"
chmod 700 "$LARRY_HOME" 2>/dev/null || true
ok "created $LARRY_HOME"

# ─────────────────────────────────────────────────────────────────────────────
# Fetch the scripts. If LARRY_BASE_URL is not set, try to detect being run
# from a local checkout (sibling files present) — copy locally instead.
# ─────────────────────────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd)" || SCRIPT_DIR=""

# v0.7.4 single-source: install-larry.sh is the FIRST contact with the
# origin — it runs before larry.sh exists, so it must succeed in one shot.
# No fallback; if $LARRY_BASE_URL is unreachable we die with a clear error
# telling the user to verify the URL or set an alternate mirror.

fetch() {
  # $1 = remote relative path, $2 = local destination
  if [ -n "$LARRY_BASE_URL" ]; then
    say "fetching $1"
    if curl -fsSL --max-time 30 "$LARRY_BASE_URL/$1" -o "$2" 2>/dev/null && [ -s "$2" ]; then
      ok "$2"
      return 0
    fi
    rm -f "$2"
    die "install failed: cannot reach LARRY_BASE_URL=$LARRY_BASE_URL (fetching $1) — verify the URL or set LARRY_BASE_URL to a reachable mirror"
  elif [ -n "$SCRIPT_DIR" ] && [ -f "$SCRIPT_DIR/$1" ]; then
    cp "$SCRIPT_DIR/$1" "$2" && ok "copied $1 (local)"
  else
    die "no LARRY_BASE_URL set and $1 not found in script dir"
  fi
}

fetch larry.sh                       "$LARRY_HOME/larry.sh"
fetch larry-tunnel.sh                "$LARRY_HOME/larry-tunnel.sh"
fetch agents/larry.md                "$LARRY_HOME/agents/larry.md"
fetch agents/clover.md               "$LARRY_HOME/agents/clover.md"
fetch agents/cloverleaf-cheatsheet.md "$LARRY_HOME/agents/cloverleaf-cheatsheet.md"
fetch agents/regress.md              "$LARRY_HOME/agents/regress.md"
fetch larry-rollback.sh              "$LARRY_HOME/larry-rollback.sh"
fetch larry-auth.sh                  "$LARRY_HOME/larry-auth.sh"
fetch lib/oauth.sh                   "$LARRY_HOME/lib/oauth.sh"
fetch lib/ssh-helper.sh              "$LARRY_HOME/lib/ssh-helper.sh"
fetch lib/lessons.sh                 "$LARRY_HOME/lib/lessons.sh"
fetch lib/hl7-sanitize.sh            "$LARRY_HOME/lib/hl7-sanitize.sh"
fetch lib/hl7-desanitize.sh          "$LARRY_HOME/lib/hl7-desanitize.sh"
fetch lib/each.sh                    "$LARRY_HOME/lib/each.sh"
fetch lib/each-site.sh               "$LARRY_HOME/lib/each-site.sh"
fetch lib/len2nl.sh                  "$LARRY_HOME/lib/len2nl.sh"
fetch lib/csv-to-table.sh            "$LARRY_HOME/lib/csv-to-table.sh"
fetch lib/table-to-csv.sh            "$LARRY_HOME/lib/table-to-csv.sh"
fetch lib/nc-engine.sh               "$LARRY_HOME/lib/nc-engine.sh"
fetch lib/nc-status.sh               "$LARRY_HOME/lib/nc-status.sh"
fetch lib/nc-table.sh                "$LARRY_HOME/lib/nc-table.sh"
fetch lib/nc-xlate.sh                "$LARRY_HOME/lib/nc-xlate.sh"
fetch lib/nc-smat-diff.sh            "$LARRY_HOME/lib/nc-smat-diff.sh"
fetch lib/nc-create-thread.sh        "$LARRY_HOME/lib/nc-create-thread.sh"
fetch lib/nc-tclgen.sh               "$LARRY_HOME/lib/nc-tclgen.sh"
fetch lib/nc-parse.sh                "$LARRY_HOME/lib/nc-parse.sh"
fetch lib/nc-inbound.sh              "$LARRY_HOME/lib/nc-inbound.sh"
fetch lib/nc-make-jump.sh            "$LARRY_HOME/lib/nc-make-jump.sh"
fetch lib/hl7-field.sh               "$LARRY_HOME/lib/hl7-field.sh"
fetch lib/hl7-schema.sh              "$LARRY_HOME/lib/hl7-schema.sh"
fetch lib/nc-msgs.sh                 "$LARRY_HOME/lib/nc-msgs.sh"
fetch lib/nc-document.sh             "$LARRY_HOME/lib/nc-document.sh"
fetch lib/nc-diff-interface.sh       "$LARRY_HOME/lib/nc-diff-interface.sh"
fetch lib/nc-find.sh                 "$LARRY_HOME/lib/nc-find.sh"
fetch lib/nc-insert-protocol.sh      "$LARRY_HOME/lib/nc-insert-protocol.sh"
fetch lib/hl7-diff.sh                "$LARRY_HOME/lib/hl7-diff.sh"
fetch lib/nc-regression.sh           "$LARRY_HOME/lib/nc-regression.sh"
fetch lib/journal.sh                 "$LARRY_HOME/lib/journal.sh"
fetch VERSION                        "$LARRY_HOME/VERSION"
fetch MANUAL.md                      "$LARRY_HOME/MANUAL.md"
chmod +x "$LARRY_HOME/larry.sh" "$LARRY_HOME/larry-tunnel.sh" "$LARRY_HOME/larry-rollback.sh" "$LARRY_HOME/larry-auth.sh" "$LARRY_HOME/lib/"*.sh

# ─────────────────────────────────────────────────────────────────────────────
# jq fallback — download static binary into $LARRY_HOME/bin/ if missing
# ─────────────────────────────────────────────────────────────────────────────
if ! command -v jq >/dev/null 2>&1 && [ ! -x "$LARRY_HOME/bin/jq" ]; then
  say "jq not found — fetching static binary into $LARRY_HOME/bin/jq"
  JQ_BASE="https://github.com/jqlang/jq/releases/download/jq-1.7.1"
  JQ_URL=""
  case "$PLATFORM/$ARCH_NORM" in
    linux/amd64)         JQ_URL="$JQ_BASE/jq-linux-amd64" ;;
    linux/arm64)         JQ_URL="$JQ_BASE/jq-linux-arm64" ;;
    linux/i386)          JQ_URL="$JQ_BASE/jq-linux-i386" ;;
    darwin/amd64)        JQ_URL="$JQ_BASE/jq-macos-amd64" ;;
    darwin/arm64)        JQ_URL="$JQ_BASE/jq-macos-arm64" ;;
    windows-cygwin/amd64) JQ_URL="$JQ_BASE/jq-windows-amd64.exe" ;;
    windows-cygwin/i386)  JQ_URL="$JQ_BASE/jq-windows-i386.exe" ;;
    *) warn "no jq binary known for $PLATFORM/$ARCH_NORM — install jq manually" ;;
  esac
  if [ -n "$JQ_URL" ]; then
    local_jq="$LARRY_HOME/bin/jq"
    case "$PLATFORM" in windows-cygwin) local_jq="$LARRY_HOME/bin/jq.exe" ;; esac
    if curl -fsSL --max-time 60 "$JQ_URL" -o "$local_jq"; then
      chmod +x "$local_jq"
      ok "jq -> $local_jq"
    else
      warn "could not download jq from $JQ_URL"
    fi
  fi
else
  ok "jq available"
fi

# ─────────────────────────────────────────────────────────────────────────────
# Drop a `larry` shim onto PATH (best-effort)
# ─────────────────────────────────────────────────────────────────────────────
mkdir -p "$LARRY_BIN_DIR" 2>/dev/null || true
if [ -d "$LARRY_BIN_DIR" ] && [ -w "$LARRY_BIN_DIR" ]; then
  cat > "$LARRY_BIN_DIR/larry" <<EOF
#!/usr/bin/env bash
# Auto-generated by install-larry.sh
export LARRY_HOME="${LARRY_HOME}"
exec "${LARRY_HOME}/larry.sh" "\$@"
EOF
  chmod +x "$LARRY_BIN_DIR/larry"
  ok "shim: $LARRY_BIN_DIR/larry"
  case ":$PATH:" in
    *":$LARRY_BIN_DIR:"*) : ;;
    *) warn "$LARRY_BIN_DIR is not on PATH — add 'export PATH=\"$LARRY_BIN_DIR:\$PATH\"' to your shell rc" ;;
  esac
else
  warn "cannot write to $LARRY_BIN_DIR — invoke larry directly as: $LARRY_HOME/larry.sh"
fi

# ─────────────────────────────────────────────────────────────────────────────
# v0.8.2 — optional PHI Presidio sidecar (free-text NER).
# Closes V1 from Vera's PHI-leak audit. Opt-in install; larry runs in
# v0.8.1 mode (rule-pack only) on hosts where this isn't installed.
# We probe for python3 + pip, then offer the install. Skip silently if
# python3 isn't available — keeps the install one-shot on raw MobaXterm
# where Python may not be present.
# ─────────────────────────────────────────────────────────────────────────────
if command -v python3 >/dev/null 2>&1; then
  PYV=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")' 2>/dev/null || echo "")
  case "$PYV" in
    3.9|3.10|3.11|3.12|3.13|3.14|3.15) PY_OK=1 ;;
    *) PY_OK=0 ;;
  esac
  if [ "${PY_OK:-0}" = "1" ]; then
    say "v0.8.2: Presidio PHI sidecar is available (python $PYV detected)"
    echo "  Presidio provides free-text NER (names, addresses, dates in prose)"
    echo "  that the regex tiers miss. Install adds presidio_analyzer +"
    echo "  presidio_anonymizer + fastapi + uvicorn + spaCy en_core_web_sm"
    echo "  to a dedicated virtualenv at $LARRY_HOME/phi-venv (~400MB on disk,"
    echo "  ~250MB RAM resident when running). One-time cost; tier-5 NER"
    echo "  then runs on every prompt with ~20ms latency."
    echo ""
    # Heuristic: if stdin is a TTY, prompt. Otherwise (curl|bash pipe), skip.
    INSTALL_PHI=""
    if [ -t 0 ]; then
      printf 'install Presidio sidecar now? [y/N]: '
      read -r INSTALL_PHI </dev/tty || INSTALL_PHI=""
    else
      echo "  (non-interactive install — skip; rerun installer with TTY or set"
      echo "   LARRY_INSTALL_PHI=1 to enable. To install manually later:"
      echo "     python3 -m venv $LARRY_HOME/phi-venv"
      echo "     $LARRY_HOME/phi-venv/bin/pip install presidio_analyzer presidio_anonymizer fastapi uvicorn"
      echo "     $LARRY_HOME/phi-venv/bin/python -m spacy download en_core_web_sm)"
      INSTALL_PHI="${LARRY_INSTALL_PHI:-n}"
    fi
    case "${INSTALL_PHI:-}" in
      y|Y|yes|YES|1)
        say "installing Presidio sidecar to $LARRY_HOME/phi-venv (this takes 2-5 minutes)..."
        if python3 -m venv "$LARRY_HOME/phi-venv" >/dev/null 2>&1; then
          if "$LARRY_HOME/phi-venv/bin/pip" install --quiet \
               presidio_analyzer presidio_anonymizer fastapi uvicorn >/dev/null 2>&1; then
            if "$LARRY_HOME/phi-venv/bin/python" -m spacy download en_core_web_sm \
                 >/dev/null 2>&1; then
              ok "Presidio sidecar installed (venv: $LARRY_HOME/phi-venv)"
              # Set LARRY_PHI_VENV in the shim so larry auto-uses it.
              if [ -f "$LARRY_BIN_DIR/larry" ]; then
                sed -i.bak "s|^exec \"|export LARRY_PHI_VENV=\"$LARRY_HOME/phi-venv\"\nexec \"|" \
                  "$LARRY_BIN_DIR/larry" 2>/dev/null || true
                rm -f "$LARRY_BIN_DIR/larry.bak"
              fi
            else
              warn "spaCy en_core_web_sm download failed; sidecar will not start until model is present"
            fi
          else
            warn "pip install failed; Presidio sidecar not available on this host (larry runs in v0.8.1 mode)"
          fi
        else
          warn "python3 -m venv failed; cannot install Presidio (larry runs in v0.8.1 mode)"
        fi
        ;;
      *)
        ok "skipped Presidio install — larry runs in v0.8.1 mode (rule-pack auto-PHI only)"
        ;;
    esac
  else
    warn "python3 detected but version ($PYV) is not 3.9+; Presidio sidecar requires 3.9+"
    warn "larry runs in v0.8.1 mode (rule-pack auto-PHI only) on this host"
  fi
else
  case "$PLATFORM" in
    windows-cygwin)
      warn "python3 not detected on Cygwin/MobaXterm. v0.8.2 Presidio sidecar SKIPPED."
      warn "Bryan's accepted tradeoff: MobaXterm stays on v0.8.1 + prompt nudges."
      ;;
    *)
      warn "python3 not on PATH; Presidio sidecar skipped (larry runs in v0.8.1 mode)"
      ;;
  esac
fi

# ─────────────────────────────────────────────────────────────────────────────
# Done
# ─────────────────────────────────────────────────────────────────────────────
echo ""
say "install complete (no system changes were made; everything lives under $LARRY_HOME)"
say "origin (single-source, v0.7.4): $LARRY_BASE_URL"
echo ""
echo "Next steps:"
echo "  1) export ANTHROPIC_API_KEY=sk-ant-...   (or larry will prompt on first run)"
echo "  2) larry                                  (or $LARRY_HOME/larry.sh)"
echo "  3) larry /path/to/cloverleaf/site_root   (to start with a working dir)"
echo ""
echo "Reverse SSH tunnel (optional, run in another shell or backgrounded):"
echo "  $LARRY_HOME/larry-tunnel.sh --serveo                          # zero-config"
echo "  $LARRY_HOME/larry-tunnel.sh --hop=user@bjnoela.com:22         # your hop"
echo ""