install.sh

#!/bin/sh
# icm installer - https://github.com/rtk-ai/icm
# Usage: curl -fsSL https://raw.githubusercontent.com/rtk-ai/icm/main/install.sh | sh

set -e

REPO="rtk-ai/icm"
BINARY_NAME="icm"
INSTALL_DIR="${HOME}/.local/bin"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

info() { printf "${GREEN}[INFO]${NC} %s\n" "$1"; }
warn() { printf "${YELLOW}[WARN]${NC} %s\n" "$1"; }
error() { printf "${RED}[ERROR]${NC} %s\n" "$1"; exit 1; }

detect_os() {
    case "$(uname -s)" in
        Darwin*) OS="darwin"; TARGET_SUFFIX="apple-darwin";;
        Linux*)  OS="linux";  TARGET_SUFFIX="unknown-linux-gnu";;
        MINGW*|MSYS*|CYGWIN*) OS="windows"; TARGET_SUFFIX="pc-windows-msvc";;
        *)       error "Unsupported OS: $(uname -s). icm supports macOS, Linux and Windows.";;
    esac
}

detect_arch() {
    case "$(uname -m)" in
        x86_64|amd64)  ARCH="x86_64";;
        arm64|aarch64) ARCH="aarch64";;
        *)             error "Unsupported architecture: $(uname -m)";;
    esac
}

get_latest_version() {
    VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
    if [ -z "$VERSION" ]; then
        error "Failed to get latest version"
    fi
}

install() {
    TARGET="${ARCH}-${TARGET_SUFFIX}"
    info "Detected: ${OS} ${ARCH}"
    info "Version: ${VERSION}"

    if [ "$OS" = "windows" ]; then
        EXT="zip"
        INSTALL_DIR="${LOCALAPPDATA:-$HOME}/icm/bin"
    else
        EXT="tar.gz"
    fi

    mkdir -p "$INSTALL_DIR"

    DOWNLOAD_URL="https://github.com/${REPO}/releases/download/${VERSION}/${BINARY_NAME}-${TARGET}.${EXT}"
    TEMP_DIR=$(mktemp -d)
    ARCHIVE="${TEMP_DIR}/${BINARY_NAME}.${EXT}"

    info "Downloading from: ${DOWNLOAD_URL}"
    if ! curl -fsSL "$DOWNLOAD_URL" -o "$ARCHIVE"; then
        error "Failed to download binary"
    fi

    # SHA256 checksum verification (mandatory for security)
    CHECKSUMS_URL="https://github.com/${REPO}/releases/download/${VERSION}/checksums.txt"
    CHECKSUMS_FILE="${TEMP_DIR}/checksums.txt"
    info "Downloading checksums: ${CHECKSUMS_URL}"
    if ! curl -fsSL "$CHECKSUMS_URL" -o "$CHECKSUMS_FILE"; then
        error "Failed to download checksums.txt (required for integrity verification)"
    fi

    ARCHIVE_NAME="${BINARY_NAME}-${TARGET}.${EXT}"
    EXPECTED_SHA=$(grep "  ${ARCHIVE_NAME}$" "$CHECKSUMS_FILE" | awk '{print $1}')
    if [ -z "$EXPECTED_SHA" ]; then
        error "No checksum found for ${ARCHIVE_NAME} in checksums.txt"
    fi

    # Compute actual SHA256 (shasum on macOS, sha256sum on Linux)
    if command -v sha256sum >/dev/null 2>&1; then
        ACTUAL_SHA=$(sha256sum "$ARCHIVE" | awk '{print $1}')
    elif command -v shasum >/dev/null 2>&1; then
        ACTUAL_SHA=$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')
    else
        error "Neither sha256sum nor shasum found — cannot verify integrity"
    fi

    if [ "$EXPECTED_SHA" != "$ACTUAL_SHA" ]; then
        error "SHA256 mismatch! Expected: ${EXPECTED_SHA}, got: ${ACTUAL_SHA}"
    fi
    info "SHA256 verified: ${ACTUAL_SHA}"

    info "Extracting..."
    if [ "$OS" = "windows" ]; then
        unzip -o "$ARCHIVE" -d "$TEMP_DIR"
        mv "${TEMP_DIR}/${BINARY_NAME}.exe" "${INSTALL_DIR}/"
    else
        tar -xzf "$ARCHIVE" -C "$TEMP_DIR"
        mv "${TEMP_DIR}/${BINARY_NAME}" "${INSTALL_DIR}/"
        chmod +x "${INSTALL_DIR}/${BINARY_NAME}"
    fi

    rm -rf "$TEMP_DIR"
    info "Successfully installed ${BINARY_NAME} to ${INSTALL_DIR}/${BINARY_NAME}"
}

verify() {
    if command -v "$BINARY_NAME" >/dev/null 2>&1; then
        info "Verification: $($BINARY_NAME --version)"
    else
        warn "Binary installed but not in PATH. Add ${INSTALL_DIR} to your PATH."
    fi
}

main() {
    info "Installing ${BINARY_NAME}..."
    detect_os
    detect_arch
    get_latest_version
    install
    verify
    echo ""
    info "Installation complete! Run '${BINARY_NAME} --help' to get started."
}

main