install.sh

#!/usr/bin/env bash
set -euo pipefail

adapter_root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
devkit_root="${DEVKIT_ROOT:-}"
config_path="${CODEX_CONFIG:-$HOME/.codex/config.toml}"
hooks_path="${CODEX_HOOKS:-$HOME/.codex/hooks.json}"
check=0
health=0
uninstall=0
force=0

usage() {
  cat <<USAGE
usage: install.sh [--devkit PATH] [--config PATH] [--hooks PATH] [--check] [--health] [--uninstall] [--force]

Options:
  --check       Print the planned install target without changing files.
  --health      Validate devkit-codex install state and dependencies.
  --uninstall   Remove devkit-codex-owned Codex config/hooks entries.
  --force       Back up and replace a non-devkit hooks file during install.
USAGE
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --devkit)
      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
      devkit_root="$2"; shift 2
      ;;
    --config)
      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
      config_path="$2"; shift 2
      ;;
    --hooks)
      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
      hooks_path="$2"; shift 2
      ;;
    --check) check=1; shift ;;
    --health) health=1; shift ;;
    --uninstall) uninstall=1; shift ;;
    --force) force=1; shift ;;
    -h|--help) usage; exit 0 ;;
    *) printf 'unknown arg: %s\n' "$1" >&2; exit 2 ;;
  esac
done

if [[ -z "$devkit_root" ]]; then
  here="$(pwd)"
  while [[ "$here" != / ]]; do
    if [[ -x "$here/bin/devkit" && -d "$here/workflows" && -d "$here/hooks" ]]; then
      devkit_root="$here"
      break
    fi
    here="$(dirname "$here")"
  done
fi

if [[ -z "$devkit_root" || ! -x "$devkit_root/bin/devkit" ]]; then
  if [[ "$uninstall" -eq 0 && "$health" -eq 0 ]]; then
    printf 'devkit root not found; pass --devkit /path/to/devkit\n' >&2
    exit 1
  fi
fi

shell_quote() {
  printf '%q' "$1"
}

toml_quote() {
  local value="$1"
  value=${value//\\/\\\\}
  value=${value//\"/\\\"}
  printf '"%s"' "$value"
}

is_devkit_hooks_file() {
  [[ -f "$hooks_path" ]] && grep -q 'devkit-codex enforcement stack\|devkit Codex enforcement stack' "$hooks_path"
}

remove_devkit_config() {
  local source="$1"
  local dest="$2"
  awk '
    /^\[/ {
      in_devkit=($0 == "[mcp_servers.devkit]")
      if (in_devkit) next
    }
    in_devkit { next }
    { print }
  ' "$source" > "$dest"
}

backup_once() {
  local path="$1"
  [[ -e "$path" ]] || return 0
  [[ -e "$path.bak" ]] && return 0
  cp "$path" "$path.bak"
}

temp_for_path() {
  local path="$1"
  mktemp "$(dirname "$path")/.${path##*/}.XXXXXX"
}

health_check() {
  local failures=0

  printf 'devkit-codex health\n'

  if command -v jq >/dev/null 2>&1; then
    printf 'ok: jq found\n'
  else
    printf 'fail: jq not found\n'
    failures=$((failures + 1))
  fi

  if [[ -n "$devkit_root" && -x "$devkit_root/bin/devkit" ]]; then
    printf 'ok: devkit executable: %s\n' "$devkit_root/bin/devkit"
  else
    printf 'fail: devkit executable not found; pass --devkit /path/to/devkit\n'
    failures=$((failures + 1))
  fi

  if [[ -f "$config_path" ]] && grep -q '^\[mcp_servers\.devkit\]$' "$config_path"; then
    printf 'ok: Codex config has mcp_servers.devkit: %s\n' "$config_path"
  else
    printf 'warn: Codex config missing mcp_servers.devkit: %s\n' "$config_path"
  fi

  if is_devkit_hooks_file; then
    if jq . "$hooks_path" >/dev/null 2>&1; then
      printf 'ok: Codex hooks are devkit-owned and valid JSON: %s\n' "$hooks_path"
    else
      printf 'fail: Codex hooks are devkit-owned but invalid JSON: %s\n' "$hooks_path"
      failures=$((failures + 1))
    fi
  elif [[ -f "$hooks_path" ]]; then
    printf 'warn: Codex hooks file exists but is not devkit-owned: %s\n' "$hooks_path"
  else
    printf 'warn: Codex hooks file missing: %s\n' "$hooks_path"
  fi

  for script in hooks/codex-hook.sh hooks/codex-slash-commands.sh hooks/codex-permission-guard.sh codex/agent-prompt.sh; do
    if [[ -x "$adapter_root/$script" ]]; then
      printf 'ok: executable adapter script: %s\n' "$script"
    else
      printf 'fail: adapter script is not executable: %s\n' "$script"
      failures=$((failures + 1))
    fi
  done

  return "$failures"
}

render_hooks() {
  local hook_cmd slash_cmd perm_cmd description
  hook_cmd="DEVKIT_ROOT=$(shell_quote "$devkit_root") bash $(shell_quote "$adapter_root/hooks/codex-hook.sh")"
  slash_cmd="DEVKIT_ROOT=$(shell_quote "$devkit_root") bash $(shell_quote "$adapter_root/hooks/codex-slash-commands.sh")"
  perm_cmd="DEVKIT_ROOT=$(shell_quote "$devkit_root") bash $(shell_quote "$adapter_root/hooks/codex-permission-guard.sh")"
  description="devkit-codex enforcement stack. Generated by devkit-codex install.sh."

  jq -n \
    --arg description "$description" \
    --arg hook "$hook_cmd" \
    --arg slash "$slash_cmd" \
    --arg perm "$perm_cmd" \
    '{
      description: $description,
      hooks: {
        UserPromptSubmit: [
          {
            hooks: [
              {
                type: "command",
                command: $slash,
                statusMessage: "Checking devkit command...",
                timeout: 5
              }
            ]
          }
        ],
        PreToolUse: [
          {
            matcher: "Bash",
            hooks: [
              {type: "command", command: ($hook + " safety-check.sh"), timeout: 5},
              {type: "command", command: ($hook + " audit-trail.sh"), timeout: 5},
              {type: "command", command: ($hook + " pr-gate.sh"), timeout: 5},
              {type: "command", command: ($hook + " devkit-guard.sh"), timeout: 5}
            ]
          },
          {
            matcher: "apply_patch",
            hooks: [
              {type: "command", command: ($hook + " safety-check.sh"), timeout: 5},
              {type: "command", command: ($hook + " security-patterns.sh"), timeout: 5},
              {type: "command", command: ($hook + " devkit-guard.sh"), timeout: 5}
            ]
          },
          {
            matcher: "mcp__devkit__advance",
            hooks: [
              {type: "command", command: ($hook + " devkit-guard.sh"), timeout: 5}
            ]
          }
        ],
        PermissionRequest: [
          {
            hooks: [
              {type: "command", command: $perm, timeout: 5}
            ]
          }
        ],
        PostToolUse: [
          {
            matcher: "Bash",
            hooks: [
              {type: "command", command: ($hook + " post-validate.sh"), timeout: 10}
            ]
          },
          {
            matcher: "apply_patch",
            hooks: [
              {type: "command", command: ($hook + " post-validate.sh"), timeout: 10},
              {type: "command", command: ($hook + " lang-review.sh"), timeout: 10},
              {type: "command", command: ($hook + " slop-detect.sh"), timeout: 10}
            ]
          }
        ],
        Stop: [
          {
            hooks: [
              {type: "command", command: ($hook + " stop-gate.sh"), timeout: 10},
              {type: "command", command: ($hook + " devkit-stop-guard.sh"), timeout: 10}
            ]
          }
        ]
      }
    }'
}

if [[ "$health" -eq 1 ]]; then
  health_check
  exit $?
fi

if [[ "$check" -eq 1 ]]; then
  printf 'Would install devkit-codex.\n'
  printf 'Devkit: %s\n' "$devkit_root"
  printf 'Config: %s\n' "$config_path"
  printf 'Hooks:  %s\n' "$hooks_path"
  exit 0
fi

if [[ "$uninstall" -eq 1 ]]; then
  changed=0
  if [[ -f "$config_path" ]]; then
    tmp="$(temp_for_path "$config_path")"
    remove_devkit_config "$config_path" "$tmp"
    if ! cmp -s "$config_path" "$tmp"; then
      backup_once "$config_path"
      mv -f "$tmp" "$config_path"
      changed=1
    else
      rm -f "$tmp"
    fi
  fi

  if is_devkit_hooks_file; then
    backup_once "$hooks_path"
    rm -f "$hooks_path"
    changed=1
  elif [[ -f "$hooks_path" ]]; then
    printf 'left non-devkit hooks file unchanged: %s\n' "$hooks_path"
  fi

  if [[ "$changed" -eq 1 ]]; then
    printf 'Uninstalled devkit-codex.\nConfig: %s\nHooks:  %s\n' "$config_path" "$hooks_path"
  else
    printf 'devkit-codex was not installed.\nConfig: %s\nHooks:  %s\n' "$config_path" "$hooks_path"
  fi
  exit 0
fi

if ! command -v jq >/dev/null 2>&1; then
  printf 'jq is required to install devkit-codex\n' >&2
  exit 1
fi

mkdir -p "$(dirname "$config_path")" "$(dirname "$hooks_path")"

if [[ -f "$hooks_path" ]] && ! is_devkit_hooks_file; then
  if [[ "$force" -ne 1 ]]; then
    printf 'existing hooks file is not devkit-owned: %s; rerun with --force\n' "$hooks_path" >&2
    exit 1
  fi
  backup_once "$hooks_path"
fi

if [[ -f "$config_path" ]]; then
  tmp="$(mktemp)"
  remove_devkit_config "$config_path" "$tmp.base"
  awk '
    BEGIN { in_devkit=0; in_features=0; hooks_seen=0 }
    /^\[/ {
      if (in_features && !hooks_seen) print "hooks = true"
      in_features=($0 == "[features]")
      if (in_features) hooks_seen=0
    }
    in_features && $0 ~ /^[[:space:]]*(hooks|codex_hooks)[[:space:]]*=/ {
      if (!hooks_seen) print "hooks = true"
      hooks_seen=1
      next
    }
    { print }
    END { if (in_features && !hooks_seen) print "hooks = true" }
  ' "$tmp.base" > "$tmp"
  rm -f "$tmp.base"
else
  tmp="$(mktemp)"
  printf '[features]\nhooks = true\n' > "$tmp"
fi
config_tmp="$(temp_for_path "$config_path")"
if ! {
  awk 'NF { blank=0; print; next } !blank { print; blank=1 }' "$tmp"
  printf '\n[mcp_servers.devkit]\n'
  printf 'command = %s\n' "$(toml_quote "$devkit_root/bin/devkit")"
  printf 'args = ["mcp"]\n'
  printf 'env = { CLAUDE_PLUGIN_ROOT = %s }\n' "$(toml_quote "$devkit_root")"
} > "$config_tmp"; then
  rm -f "$tmp" "$config_tmp"
  exit 1
fi
mv -f "$config_tmp" "$config_path"
rm -f "$tmp"

hooks_tmp="$(temp_for_path "$hooks_path")"
if ! render_hooks > "$hooks_tmp"; then
  rm -f "$hooks_tmp"
  exit 1
fi
mv -f "$hooks_tmp" "$hooks_path"
chmod 600 "$config_path" "$hooks_path"

printf 'Installed devkit-codex.\nDevkit: %s\nConfig: %s\nHooks:  %s\n' "$devkit_root" "$config_path" "$hooks_path"