#!/bin/bash
# MausBot security kit installer (macOS). Read it before running it.
#   bash install.sh            -> guard + LuLu explainer
#   bash install.sh --guard    -> guard only
#   bash install.sh --explainer-> LuLu explainer only
# Run it from the folder that holds mausbot_guard.py, managed-settings.json, codex-requirements.toml and lulu_explain.py.
# The guard covers Claude Code (managed-settings.json) and Codex (/etc/codex/requirements.toml).
set -euo pipefail
cd "$(dirname "$0")"
MODE="${1:-all}"
STATE="$HOME/.openmausbot-security"; mkdir -p "$STATE"; chmod 700 "$STATE"
if [ "$MODE" != "--explainer" ]; then
  M="/Library/Application Support/ClaudeCode/managed-settings.json"
  if [ -f "$M" ]; then echo "You already have $M. Merge the PreToolUse hook from managed-settings.json into it by hand, then rerun with --explainer."; exit 1; fi
  echo "Installing the guard (asks for your Mac password once)..."
  sudo mkdir -p "/Library/Application Support/ClaudeCode/mausbot-guard"
  sudo cp mausbot_guard.py "/Library/Application Support/ClaudeCode/mausbot-guard/"
  sudo cp managed-settings.json "$M"
  sudo chown -R root:wheel "/Library/Application Support/ClaudeCode"
  sudo chmod 755 "/Library/Application Support/ClaudeCode" "/Library/Application Support/ClaudeCode/mausbot-guard"
  sudo chmod 644 "$M" "/Library/Application Support/ClaudeCode/mausbot-guard/mausbot_guard.py"
  [ -f "$STATE/known-recipients.txt" ] || printf '%s\n' "# Addresses (name@x.com), whole domains (@x.com) or phone numbers bots may message without asking." "# Add your own addresses and domains below. The guard's 'Always allow' button appends here." > "$STATE/known-recipients.txt"
  chmod 600 "$STATE/known-recipients.txt"
  C="/etc/codex/requirements.toml"
  if [ -f "$C" ]; then
    echo "You already have $C. Merge the [features] and [hooks] sections from codex-requirements.toml into it by hand to cover Codex."
  else
    sudo mkdir -p /etc/codex
    sudo cp codex-requirements.toml "$C"
    sudo chown root:wheel "$C"; sudo chmod 644 "$C"
    echo "Codex covered too (restart open Codex sessions)."
  fi
  echo "Guard installed. Edit $STATE/known-recipients.txt and add your own email addresses and domains."
fi
if [ "$MODE" != "--guard" ]; then
  mkdir -p "$STATE/lulu-explainer"; cp lulu_explain.py "$STATE/lulu-explainer/"
  P="$HOME/Library/LaunchAgents/com.openmausbot.lulu-explainer.plist"
  cat > "$P" <<PL
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>com.openmausbot.lulu-explainer</string>
  <key>ProgramArguments</key><array><string>/usr/bin/python3</string><string>-I</string><string>$STATE/lulu-explainer/lulu_explain.py</string></array>
  <key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ProcessType</key><string>Background</string>
</dict></plist>
PL
  launchctl bootout "gui/$(id -u)/com.openmausbot.lulu-explainer" 2>/dev/null || true
  launchctl bootstrap "gui/$(id -u)" "$P"
  echo "LuLu explainer running. Explanations appear as notifications; history in $STATE/lulu-explainer/history.log"
fi