#!/bin/sh
# Cybee installer — one command, no account, no card.
#
#   curl -sSf https://get.cybee.dev | sh                       # new org (auto-named; rename later)
#   curl -sSf https://get.cybee.dev | sh -s -- --name "Acme"   # new org with a name
#   curl -sSf https://get.cybee.dev | sh -s -- --join <TOKEN>   # join an existing org (teammate)
#
# With no --join, this creates a fresh organization for you and prints your admin token — save
# it; it is how you manage the fleet from your AI assistant. Read this script: https://get.cybee.dev
set -eu

BACKEND="https://api.cybee.dev"
CONTENT="https://content.cybee.dev"
MCP="https://mcp.cybee.dev/mcp"
JOIN=""
NAME=""

while [ $# -gt 0 ]; do
  case "$1" in
    --join) JOIN="$2"; shift 2 ;;
    --name) NAME="$2"; shift 2 ;;
    --backend) BACKEND="$2"; shift 2 ;;
    *) echo "unknown option: $1" >&2; exit 2 ;;
  esac
done

if [ "$(uname -s)" != "Darwin" ]; then
  echo "cybee: macOS only for now (Windows/Linux coming)." >&2; exit 1
fi

# Extract a prefixed token (cyk_/cyj_/cya_) from a JSON blob without needing jq.
extract() { printf '%s' "$1" | grep -oE "\"$2\":\"[^\"]+\"" | head -1 | sed -E "s/.*:\"([^\"]+)\"/\1/"; }

ADMIN_TOKEN=""
if [ -z "$JOIN" ]; then
  # New organization. Auto-named unless --name given; you can rename later.
  [ -n "$NAME" ] || NAME="New org $(date +%Y-%m-%d)"
  echo "==> creating your Cybee organization"
  RESP="$(curl -fsS -X POST "$BACKEND/v1/org" -H 'content-type: application/json' -d "{\"name\":\"$NAME\"}")"
  ADMIN_TOKEN="$(extract "$RESP" admin_token)"
  JOIN="$(extract "$RESP" join_token)"
  [ -n "$JOIN" ] && [ -n "$ADMIN_TOKEN" ] || { echo "cybee: could not create org (backend response: $RESP)" >&2; exit 3; }
fi

ARCH="$(uname -m)"
PKG_URL="$CONTENT/mac/cybee-$ARCH.pkg"
TMP="$(mktemp -d)"; PKG="$TMP/cybee.pkg"

echo "==> downloading Cybee ($ARCH)"
curl -fSL "$PKG_URL" -o "$PKG"

echo "==> verifying Apple signature & notarization"
spctl -a -vv -t install "$PKG" 2>&1 | grep -qi accepted || { echo "cybee: package not notarized — aborting." >&2; exit 3; }

# Stash enrolment inputs for the agent daemon.
sudo mkdir -p /var/db/cybee
printf '%s' "$JOIN"    | sudo tee /var/db/cybee/join_token  >/dev/null
printf '%s' "$BACKEND" | sudo tee /var/db/cybee/backend_url >/dev/null
sudo chmod 600 /var/db/cybee/join_token

echo "==> installing (you may be asked for your password)"
sudo installer -pkg "$PKG" -target /
rm -rf "$TMP"

echo
echo "==> Cybee installed."
echo "  1. System Settings → Privacy & Security → Allow the Cybee system extension."
echo "  2. System Settings → Privacy & Security → Full Disk Access → enable Cybee."
echo "  3. Check it:  sudo cybee status"
if [ -n "$ADMIN_TOKEN" ]; then
  echo
  echo "  SAVE THIS — your admin token (shown once). It manages your whole fleet:"
  echo "    $ADMIN_TOKEN"
  echo
  echo "  Connect your AI assistant to manage the fleet from chat:"
  echo "    claude mcp add --transport http cybee $MCP --header \"Authorization: Bearer $ADMIN_TOKEN\""
  echo
  echo "  Add teammates' machines with:"
  echo "    curl -sSf https://get.cybee.dev | sh -s -- --join $JOIN"
fi
echo
echo "Remove any time:  sudo cybee uninstall"