#!/bin/sh
# ==============================================================================
# Glueball (glueball.dev) — Rootless 1-Line CLI & Topbar Installer (v0.2.21)
# Usage: curl -fsSL https://glueball.dev/install | sh
# Axiom 1: Strictly rootless (uid != 0).
# Axiom 2: Fail-closed with actionable fix: lines.
# Axiom 5: Zero secrets written or read during installation.
# ==============================================================================
set -eu

if [ "$(id -u)" -eq 0 ]; then
  echo "error[Axiom-1]: glueball installer must run as an unprivileged user (uid != 0)." >&2
  echo "fix: run without sudo as your normal user: curl -fsSL https://glueball.dev/install | sh" >&2
  exit 1
fi

VERSION="${GLUON_VERSION:-v0.2.21}"
REPO="${GLUON_GITHUB_REPO:-solcito-stdios/muon-cloud}"
EDGE_ORIGIN="${GLUON_EDGE_ORIGIN:-https://glueball.dev}"
INSTALL_BIN="${GLUON_INSTALL_BIN:-$HOME/.local/bin}"
OS="$(uname -s)"
ARCH="$(uname -m)"

case "${OS}:${ARCH}" in
  Darwin:arm64|Darwin:aarch64) TARGET="aarch64-apple-darwin" ;;
  Darwin:x86_64)               TARGET="x86_64-apple-darwin" ;;
  Linux:aarch64|Linux:arm64)   TARGET="aarch64-unknown-linux-gnu" ;;
  Linux:x86_64|Linux:amd64)    TARGET="x86_64-unknown-linux-gnu" ;;
  *)
    echo "error[Axiom-2]: unsupported platform ${OS}/${ARCH}." >&2
    echo "fix: build from source with cargo install --path crates/cli" >&2
    exit 1
    ;;
esac

BUNDLE="gluon-client-${TARGET}.tar.gz"
TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/glueball-install.XXXXXX")"
cleanup() { rm -rf "${TMP_DIR}"; }
trap cleanup EXIT INT TERM

echo "==> Glueball CLI Installer (${VERSION} · ${TARGET} · uid=$(id -u))"
DOWNLOADED=0
if curl -fsSL "${EDGE_ORIGIN}/releases/${VERSION}/${BUNDLE}" -o "${TMP_DIR}/${BUNDLE}" 2>/dev/null && [ -s "${TMP_DIR}/${BUNDLE}" ]; then
  DOWNLOADED=1
fi
if [ "${DOWNLOADED}" -eq 0 ] && command -v gh >/dev/null 2>&1; then
  if gh release download "${VERSION}" -R "${REPO}" -p "${BUNDLE}" -D "${TMP_DIR}" --clobber >/dev/null 2>&1 || env -u GITHUB_TOKEN gh release download "${VERSION}" -R "${REPO}" -p "${BUNDLE}" -D "${TMP_DIR}" --clobber >/dev/null 2>&1; then
    DOWNLOADED=1
  fi
fi
if [ "${DOWNLOADED}" -eq 0 ]; then
  URL="https://github.com/${REPO}/releases/download/${VERSION}/${BUNDLE}"
  if ! curl -fsSL "${URL}" -o "${TMP_DIR}/${BUNDLE}"; then
    echo "error[Axiom-2]: failed to download ${BUNDLE} (${VERSION})." >&2
    echo "fix: authenticate gh (gh auth login) or download from ${EDGE_ORIGIN}/releases/${VERSION}/${BUNDLE}" >&2
    exit 1
  fi
fi

tar -xzf "${TMP_DIR}/${BUNDLE}" -C "${TMP_DIR}"
bash "${TMP_DIR}/install-client.sh" --bin-dir "${INSTALL_BIN}"
ln -sf "${INSTALL_BIN}/gluon" "${INSTALL_BIN}/gl"
ln -sf "${INSTALL_BIN}/gluon" "${INSTALL_BIN}/glueball"

echo ""
echo "Glueball CLI installed to ${INSTALL_BIN}/gluon (aliases: gl, glueball)"
echo "Next steps:"
echo "  1. export PATH=\"${INSTALL_BIN}:\$PATH\""
echo "  2. gluon login                                  # Device Flow against https://cp.glueball.dev + SSH key sync"
echo "  3. gluon doctor                                 # <2ms local 0600 & SSH verification"
echo "  4. gluon cs create <owner/repo> --branch main   # <1s isolated GitHub worktree subspace"
echo "  5. gluon cs code <subspace_id>                  # Open Subspace in Cursor / VS Code (or: gluon ssh <subspace_id>)"
echo "  6. gluon update                                 # Self-update CLI in place to the latest release"