#!/bin/sh
# Straight Chaos agent installer.
#
#   curl -fsSL https://get.straightchaos.com | sh
#
# Optionally export SCA_TOKEN and SCA_CONTROL_PLANE first and this will also
# install + start the systemd service for you:
#
#   curl -fsSL https://get.straightchaos.com \
#     | SCA_TOKEN=sc_live_xxx SCA_CONTROL_PLANE=https://app.straightchaos.com sh
set -e

VERSION="${SCA_VERSION:-latest}"
BASE="${SCA_DOWNLOAD_BASE:-https://get.straightchaos.com}"
BIN_DIR="${SCA_BIN_DIR:-/usr/local/bin}"
BIN="$BIN_DIR/chaos"

case "$(uname -s)" in
  Linux)  os=linux ;;
  Darwin) os=darwin ;;
  *) echo "unsupported OS: $(uname -s) (Straight Chaos supports Linux and macOS)"; exit 1 ;;
esac
case "$(uname -m)" in
  x86_64|amd64)  arch=amd64 ;;
  aarch64|arm64) arch=arm64 ;;
  *) echo "unsupported architecture: $(uname -m)"; exit 1 ;;
esac

# When VERSION=latest, resolve the concrete version and download from the immutable
# per-version path (base/<version>/…). The mutable "latest/" binary object can be
# served stale from the CDN cache, a fresh SHA256SUMS paired with an older binary -
# which surfaces as a checksum mismatch. Per-version paths are written once.
if [ "$VERSION" = "latest" ]; then
  resolved="$(curl -fsSL "$BASE/latest/VERSION" 2>/dev/null | tr -d '[:space:]')"
  [ -n "$resolved" ] && VERSION="$resolved"
fi

echo "Installing chaos ($VERSION, $os/$arch)..."
tmp="$(mktemp)"
curl -fsSL "$BASE/$VERSION/chaos-$os-$arch" -o "$tmp"
chmod +x "$tmp"

# Install dir may not exist (e.g. /usr/local/bin on a fresh Apple Silicon Mac).
# Create it, then place the binary. Use sudo only when the dir isn't writable
# so `SCA_BIN_DIR=$HOME/.local/bin` works without a password prompt.
if [ -w "$BIN_DIR" ] || { [ ! -e "$BIN_DIR" ] && mkdir -p "$BIN_DIR" 2>/dev/null; }; then
  mkdir -p "$BIN_DIR"
  mv "$tmp" "$BIN"
else
  sudo mkdir -p "$BIN_DIR"
  sudo mv "$tmp" "$BIN"
fi
echo "Installed -> $BIN"

case ":$PATH:" in
  *":$BIN_DIR:"*) ;;
  *) echo "NOTE: $BIN_DIR is not on your PATH, add it, e.g.: export PATH=\"$BIN_DIR:\$PATH\"" ;;
esac

# macOS: the agent daemon's kernel faults (tc/iptables/eBPF) are Linux-only, but
# the AI-agent guardrail wrap mode (`chaos guard`) is fully supported. Point users
# at `chaos doctor` to see what's available, and skip the Linux service setup.
if [ "$os" = "darwin" ]; then
  echo
  echo "macOS: 'chaos guard' (AI-agent egress guardrails, faults, DLP, budgets) is fully supported."
  echo "Host-wide kernel fault injection is Linux-only. See what's available here:"
  echo "  chaos doctor"
  echo
  echo "Wrap an agent:  chaos guard --enforce --deny /secrets/ -- claude"
  exit 0
fi

command -v tc >/dev/null 2>&1 || \
  echo "WARNING: 'tc' (iproute2) not found. Install it before running real experiments (apt/yum install iproute2)."

if [ -n "$SCA_TOKEN" ] && [ -n "$SCA_CONTROL_PLANE" ]; then
  echo "Configuring systemd service..."
  sudo mkdir -p /etc/straightchaos
  sudo tee /etc/straightchaos/agent.env >/dev/null <<EOF
SCA_CONTROL_PLANE=$SCA_CONTROL_PLANE
SCA_TOKEN=$SCA_TOKEN
SCA_DEVICE=${SCA_DEVICE:-eth0}
EOF
  sudo chmod 600 /etc/straightchaos/agent.env
  curl -fsSL "$BASE/chaos-agent.service" | sudo tee /etc/systemd/system/chaos-agent.service >/dev/null
  sudo systemctl daemon-reload
  sudo systemctl enable --now chaos-agent
  echo "Service started. Check: systemctl status chaos-agent"
else
  echo
  echo "Next: connect this host to your control plane:"
  echo "  sudo chaos agent --control-plane <url> --token <token>"
fi