#!/bin/sh
set -eu
umask 077

fail() { printf '%s\n' "$1" >&2; exit 1; }
[ "$(uname -s)" = Linux ] || fail '请在 Linux 主机上运行安装脚本'
[ "$(id -u)" -eq 0 ] || fail '请使用 sudo sh 执行安装；只读预检可下载包后运行 install.sh --check-only'
case "$(uname -m)" in
  x86_64|amd64) arch=amd64 ;;
  aarch64|arm64) arch=arm64 ;;
  *) fail "暂不支持 CPU 架构 $(uname -m)，支持 amd64 / arm64" ;;
esac
for tool in tar mktemp awk; do command -v "$tool" >/dev/null 2>&1 || fail "缺少命令: $tool"; done
if command -v curl >/dev/null 2>&1; then
  fetch() { curl --fail --location --retry 3 --connect-timeout 15 --max-time 900 "$1" --output "$2"; }
elif command -v wget >/dev/null 2>&1; then
  fetch() { wget --tries=3 --timeout=30 -O "$2" "$1"; }
else
  fail '缺少 curl 或 wget；请安装其中一个，或从其他机器下载离线包'
fi
if command -v sha256sum >/dev/null 2>&1; then
  checksum() { sha256sum "$1" | awk '{print $1}'; }
elif command -v shasum >/dev/null 2>&1; then
  checksum() { shasum -a 256 "$1" | awk '{print $1}'; }
elif command -v openssl >/dev/null 2>&1; then
  checksum() { openssl dgst -sha256 "$1" | awk '{print $NF}'; }
else
  fail '缺少 SHA-256 校验工具（sha256sum、shasum 或 openssl）'
fi
probe=/bin/true
[ -f "$probe" ] || probe=/usr/bin/true
work_dir=
trap '[ -z "$work_dir" ] || rm -rf "$work_dir"' EXIT
trap 'exit 1' HUP INT TERM
for root in "${MONKEYAI_TMPDIR:-/var/lib/monkeyai/tmp}" /opt/monkeyai/tmp; do
  case "$root" in /*) ;; *) fail 'MONKEYAI_TMPDIR 必须是绝对路径' ;; esac
  [ ! -L "$root" ] || continue
  mkdir -p "$root" 2>/dev/null || continue
  candidate=$(mktemp -d "$root/bootstrap.XXXXXX") || continue
  if cp "$probe" "$candidate/true" && chmod 700 "$candidate/true" && "$candidate/true" 2>/dev/null; then
    work_dir=$candidate
    break
  fi
  rm -rf "$candidate"
done
[ -n "$work_dir" ] || fail '找不到可执行的临时目录，请通过 MONKEYAI_TMPDIR 指定可写且允许执行的私有目录'
base="${MONKEYAI_RELEASE_URL:-https://release.monkeycode-ai.com/public/monkeyai/server}"
base=${base%/}
version=${MONKEYAI_VERSION:-}
if [ -z "$version" ]; then
  fetch "$base/latest.json" "$work_dir/latest.json" || fail "无法获取发布清单 $base/latest.json；若尚未发布 latest，请设置 MONKEYAI_VERSION 为已上传的固定版本后重试；也请检查网络或代理，断网环境请下载离线包及 .sha256"
  version=$(awk '/"version"[[:space:]]*:/ { line=$0; sub(/^.*"version"[[:space:]]*:[[:space:]]*"/, "", line); sub(/".*/, "", line); print line; exit }' "$work_dir/latest.json")
fi
case "$version" in ''|latest|[.-]*|*[!A-Za-z0-9_.-]*) fail '发布清单中的版本无效，请指定 MONKEYAI_VERSION' ;; esac
[ "${#version}" -le 128 ] || fail '版本号过长'
name="monkeyai-$version-online-linux-$arch.tgz"
printf '正在下载百智办公 %s（%s）…\n' "$version" "$arch"
fetch "$base/online/$name.sha256" "$work_dir/package.sha256" || fail "无法获取版本校验文件；断网环境请下载 $base/offline/monkeyai-$version-offline-linux-$arch.tgz"
want=$(awk 'NR==1 {print $1}' "$work_dir/package.sha256")
case "$want" in ''|*[!0-9a-f]*) fail '发布校验值无效' ;; esac
[ "${#want}" -eq 64 ] || fail '发布校验值长度无效'
if [ -f "$work_dir/latest.json" ]; then
  manifest_sum=$(awk -v wanted="$name" '
    /"name"[[:space:]]*:/ { line=$0; sub(/^.*"name"[[:space:]]*:[[:space:]]*"/, "", line); sub(/".*/, "", line); selected=(line==wanted) }
    selected && /"sha256"[[:space:]]*:/ { line=$0; sub(/^.*"sha256"[[:space:]]*:[[:space:]]*"/, "", line); sub(/".*/, "", line); print line; exit }
  ' "$work_dir/latest.json")
  [ "$manifest_sum" = "$want" ] || fail 'latest 清单与版本校验文件不一致，已停止安装'
fi
fetch "$base/online/$name" "$work_dir/package.tgz" || fail "下载失败；可改用 $base/offline/monkeyai-$version-offline-linux-$arch.tgz 离线包"
[ "$(checksum "$work_dir/package.tgz")" = "$want" ] || fail '安装包 SHA-256 校验失败，已停止安装'
mkdir "$work_dir/package"
tar -tzf "$work_dir/package.tgz" > "$work_dir/contents"
if awk '/^\// || /(^|\/)\.\.(\/|$)/ {bad=1} END {exit !bad}' "$work_dir/contents"; then fail '安装包包含非法路径'; fi
tar -xzf "$work_dir/package.tgz" -C "$work_dir/package"
set -- "$@"
package_entry=
for entry in "$work_dir"/package/*/install.sh; do
  [ -f "$entry" ] || continue
  [ -z "$package_entry" ] || fail '安装包包含多个安装入口'
  package_entry=$entry
done
[ -n "$package_entry" ] || fail '安装包结构无效'
export MONKEYAI_VERSION="$version"
if [ "$#" -eq 0 ] && ( : </dev/tty ) 2>/dev/null; then
  sh "$package_entry" </dev/tty
else
  sh "$package_entry" "$@"
fi