install.sh

#!/usr/bin/env bash
set -euo pipefail
umask 022
shopt -s lastpipe 2>/dev/null || true

VERSION="${VERSION:-}"
OWNER="${OWNER:-Dicklesworthstone}"
REPO="${REPO:-coding_agent_session_search}"
FALLBACK_VERSION="${FALLBACK_VERSION:-}"
DEST_DEFAULT="$HOME/.local/bin"
DEST="${DEST:-$DEST_DEFAULT}"
EASY=0
QUIET=0
VERIFY=0
QUICKSTART=0
FROM_SOURCE=0
# Linux prebuilt binaries are cross-built with `cargo zigbuild --target
# <arch>-unknown-linux-gnu.2.28`, so their glibc ABI floor is PINNED at 2.28
# rather than inherited from whatever the build host happens to run. This value
# must track the floor actually measured on the shipped artifacts:
#
#   objdump -p cass | grep -oE 'GLIBC_[0-9]+\.[0-9]+' | sort -uV | tail -1
#
# v0.8.0 measures GLIBC_2.28 on both linux/amd64 and linux/arm64. It was 2.38
# here while the binaries were built natively, which was both too high (it
# refused Debian 12 / Ubuntu 22.04 / RHEL 9 / Amazon Linux 2023, whose glibc
# runs 2.34-2.36 and which the artifacts actually support) and too low (a
# native build on the current 2.43 hosts needs GLIBC_2.43 for acosf/asinf/
# coshf/log10f/sinhf, so 2.38-2.42 hosts passed this probe and then failed at
# load). Probed below.
MIN_GLIBC="2.28"
CHECKSUM="${CHECKSUM:-}"
CHECKSUM_URL="${CHECKSUM_URL:-}"
ARTIFACT_URL="${ARTIFACT_URL:-}"
TMP_ROOT=""
LOCK_FILE=""

log() { [ "$QUIET" -eq 1 ] && return 0; echo -e "$@"; }
info() { log "\033[0;34m→\033[0m $*"; }
ok() { log "\033[0;32m✓\033[0m $*"; }
warn() { [ "$QUIET" -eq 1 ] && return 0; echo -e "\033[1;33m⚠\033[0m $*" >&2; }
err() { echo -e "\033[0;31m✗\033[0m $*" >&2; }

strip_url_suffix() {
  local value="$1"
  value="${value%%\#*}"
  value="${value%%\?*}"
  printf '%s' "$value"
}

artifact_name_from_url() {
  basename "$(strip_url_suffix "$1")"
}

sibling_url() {
  local url="$1"
  local sibling="$2"
  local base
  base="$(strip_url_suffix "$url")"
  printf '%s/%s' "${base%/*}" "$sibling"
}

is_valid_sha256() {
  printf '%s' "$1" | grep -Eq '^[0-9a-fA-F]{64}$'
}

resolve_tmp_root() {
  local candidate
  if [ -n "${TMPDIR:-}" ] && [ "${TMPDIR}" != "/tmp" ]; then
    if [ -d "${TMPDIR}" ] && [ -w "${TMPDIR}" ] && [ -x "${TMPDIR}" ]; then
      printf '%s' "${TMPDIR}"
      return 0
    fi
    warn "Ignoring TMPDIR=${TMPDIR} because it is not an accessible directory"
  fi

  for candidate in "/data/tmp" "/var/tmp" "/tmp"; do
    [ -n "$candidate" ] || continue
    if [ -d "$candidate" ] && [ -w "$candidate" ] && [ -x "$candidate" ]; then
      printf '%s' "$candidate"
      return 0
    fi
  done

  err "Could not find a writable temporary directory. Set TMPDIR to a writable path and retry."
  exit 1
}

checksum_matches() {
  local file="$1"
  local expected actual status
  expected=$(printf '%s' "$CHECKSUM" | tr '[:upper:]' '[:lower:]')

  if command -v sha256sum >/dev/null 2>&1; then
    echo "$expected  $file" | sha256sum -c - >/dev/null 2>&1
    status=$?
    if [ "$status" -eq 0 ]; then
      return 0
    fi
    if [ "$status" -ne 127 ]; then
      return "$status"
    fi
  fi

  if command -v shasum >/dev/null 2>&1; then
    actual=$(shasum -a 256 "$file" | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
    [ "$actual" = "$expected" ]
    return $?
  fi

  if command -v openssl >/dev/null 2>&1; then
    actual=$(openssl dgst -sha256 "$file" | awk '{print $NF}' | tr '[:upper:]' '[:lower:]')
    [ "$actual" = "$expected" ]
    return $?
  fi

  err "No SHA-256 verification tool found (need sha256sum, shasum, or openssl)"
  exit 1
}

# Member-safety check for archive validation. Its job is path-traversal /
# zip-slip defense: reject absolute paths and any ".." path component.
# It deliberately does NOT restrict membership to the binary name. The
# installer extracts to a temp dir and copies ONLY the binary to the
# destination (see `install -m 0755 "$BIN" ...`), so benign siblings bundled
# alongside the binary (README.md, LICENSE, CHANGELOG, future docs, ...) are
# harmless and must be allowed. A binary-name allow-list breaks every time
# packaging adds a sibling file — exactly the v0.6.15+ regression in cass#299
# where release tarballs began bundling README.md + LICENSE.
archive_member_path_safe() {
  local member
  member="${1#./}"

  [ -n "$member" ] || return 1

  case "$member" in
    /*) return 1 ;;          # absolute path
  esac
  case "/$member/" in
    */../*) return 1 ;;      # any ".." path component (../x, a/../b, x/..)
  esac

  return 0
}

archive_member_is_installable_binary() {
  local member
  member="${1#./}"

  case "$member" in
    cass|coding-agent-search)
      [ "${INSTALL_BASENAME:-cass}" != "cass.exe" ] && return 0 ;;
    cass.exe|coding-agent-search.exe)
      [ "${INSTALL_BASENAME:-cass}" = "cass.exe" ] && return 0 ;;
  esac

  if [ -n "$TARGET" ]; then
    case "$member" in
      "cass-${TARGET}/cass"|"cass-${TARGET}/coding-agent-search")
        [ "${INSTALL_BASENAME:-cass}" != "cass.exe" ] && return 0 ;;
      "cass-${TARGET}/cass.exe"|"cass-${TARGET}/coding-agent-search.exe")
        [ "${INSTALL_BASENAME:-cass}" = "cass.exe" ] && return 0 ;;
    esac
  fi

  return 1
}

validate_archive_members() {
  local archive="$1"
  local member_list="$TMP/archive-members.txt"
  local metadata_list="$TMP/archive-metadata.txt"
  local member
  local metadata
  local entry_type
  local saw_binary=0

  case "$TAR" in
    *.zip)
      unzip -Z1 "$archive" > "$member_list"
      unzip -Z -l "$archive" > "$metadata_list"
      ;;
    *.tar.gz)
      tar -tzf "$archive" > "$member_list"
      tar -tvzf "$archive" > "$metadata_list"
      ;;
    *.tar.xz)
      tar -tJf "$archive" > "$member_list"
      tar -tvJf "$archive" > "$metadata_list"
      ;;
    *)
      tar -tf "$archive" > "$member_list"
      tar -tvf "$archive" > "$metadata_list"
      ;;
  esac || { err "Could not list archive members"; exit 1; }

  if [ ! -s "$member_list" ]; then
    err "Archive is empty"
    exit 1
  fi

  while IFS= read -r member; do
    [ -n "$member" ] || continue
    if ! archive_member_path_safe "$member"; then
      err "Unsafe archive member: $member"
      exit 1
    fi
    if archive_member_is_installable_binary "$member"; then
      saw_binary=1
    fi
  done < "$member_list"

  # A safe-looking member name is not enough. Tar and Unix-origin zip files
  # can encode symlinks, hard links, devices, FIFOs, or sockets. Extracting
  # those entries before selecting the binary can escape the temporary tree or
  # create filesystem objects the installer never intended. Official release
  # archives contain only regular files (and, if packaging grows, directories),
  # so fail closed on every other entry type.
  if [[ "$TAR" == *.zip ]]; then
    if grep -Eq '^[lbcpso][rwxStTs-]{9}[[:space:]]' "$metadata_list"; then
      err "Archive contains a link or special filesystem entry"
      exit 1
    fi
  else
    while IFS= read -r metadata; do
      [ -n "$metadata" ] || continue
      entry_type="${metadata:0:1}"
      case "$entry_type" in
        -|d) ;;
        *)
          err "Archive contains unsupported entry type: $entry_type"
          exit 1
          ;;
      esac
    done < "$metadata_list"
  fi

  if [ "$saw_binary" -ne 1 ]; then
    err "Archive does not contain a cass binary"
    exit 1
  fi
}

resolve_version() {
  if [ -n "$VERSION" ]; then return 0; fi
  local latest=""
  if command -v curl >/dev/null 2>&1; then
    # Try 1: Fetch latest release tag from GitHub API
    latest=$(curl -fsSL "https://api.github.com/repos/$OWNER/$REPO/releases/latest" 2>/dev/null \
      | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
    # Try 2: If no releases exist, fall back to latest git tag (sorted by version)
    if [ -z "$latest" ]; then
      warn "No GitHub releases found; falling back to latest git tag"
      latest=$(curl -fsSL "https://api.github.com/repos/$OWNER/$REPO/tags?per_page=1" 2>/dev/null \
        | grep '"name"' | head -1 | sed 's/.*"name": *"\([^"]*\)".*/\1/')
    fi
  fi
  if [ -n "$latest" ]; then
    VERSION="$latest"
    info "Using latest version: $VERSION"
  elif [ -n "$FALLBACK_VERSION" ]; then
    VERSION="$FALLBACK_VERSION"
    info "Using fallback version: $VERSION"
  else
    err "Could not determine latest version. Pass --version <tag> explicitly."
    exit 1
  fi
}

maybe_add_path() {
  case ":$PATH:" in
    *:"$DEST":*) return 0;;
    *)
      if [ "$EASY" -eq 1 ]; then
        UPDATED=0
        for rc in "$HOME/.zshrc" "$HOME/.bashrc"; do
          if [ -e "$rc" ] && [ -w "$rc" ]; then
            if ! grep -F "$DEST" "$rc" >/dev/null 2>&1; then
              echo "export PATH=\"$DEST:\$PATH\"" >> "$rc"
            fi
            UPDATED=1
          fi
        done
        if [ "$UPDATED" -eq 1 ]; then
          warn "PATH updated in ~/.zshrc/.bashrc; restart shell to use cass"
        else
          warn "Add $DEST to PATH to use cass"
        fi
      else
        warn "Add $DEST to PATH to use cass"
      fi
    ;;
  esac
}

ensure_rust() {
  local source_dir="$1"

  if [ "${RUSTUP_INIT_SKIP:-0}" != "0" ]; then
    info "Skipping repository toolchain bootstrap (RUSTUP_INIT_SKIP set)"
    return 0
  fi

  # Prefer an existing rustup installation even when the current shell has not
  # picked up ~/.cargo/bin yet. The checkout's rust-toolchain.toml is the sole
  # source of truth for the compiler channel and required components.
  if ! command -v rustup >/dev/null 2>&1 && [ -x "$HOME/.cargo/bin/rustup" ]; then
    export PATH="$HOME/.cargo/bin:$PATH"
  fi
  if command -v rustup >/dev/null 2>&1 \
    && (unset RUSTUP_TOOLCHAIN; cd "$source_dir" && rustup show active-toolchain >/dev/null 2>&1); then
    return 0
  fi

  if [ "$EASY" -ne 1 ]; then
    if [ -t 0 ]; then
      echo -n "Install the repository-pinned Rust toolchain via rustup? (y/N): "
      read -r ans
      case "$ans" in
        y|Y) :;;
        *) err "The repository-pinned Rust toolchain is required for a source build"; return 1;;
      esac
    fi
  fi

  if ! command -v rustup >/dev/null 2>&1; then
    info "Installing rustup (without an unrelated default toolchain)"
    curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
      | sh -s -- -y --default-toolchain none --profile minimal
    export PATH="$HOME/.cargo/bin:$PATH"
  fi

  info "Installing the Rust toolchain pinned by rust-toolchain.toml"
  (unset RUSTUP_TOOLCHAIN; cd "$source_dir" && rustup toolchain install)
}

usage() {
  cat <<EOFU
Usage: install.sh [--version vX.Y.Z] [--dest DIR] [--system] [--easy-mode] [--verify] [--quickstart] \
                  [--artifact-url URL] [--checksum HEX] [--checksum-url URL] [--from-source] [--quiet]
EOFU
}

require_option_value() {
  if [ "$#" -ge 2 ]; then
    case "$2" in
      ""|-h|-q|--*) :;;
      *) return 0;;
    esac
  fi
  err "$1 requires a value"
  usage >&2
  exit 2
}

while [ $# -gt 0 ]; do
  case "$1" in
    --version) require_option_value "$@"; VERSION="$2"; shift 2;;
    --dest) require_option_value "$@"; DEST="$2"; shift 2;;
    --system) DEST="/usr/local/bin"; shift;;
    --easy-mode) EASY=1; shift;;
    --verify) VERIFY=1; shift;;
    --quickstart) QUICKSTART=1; shift;;
    --artifact-url) require_option_value "$@"; ARTIFACT_URL="$2"; shift 2;;
    --checksum) require_option_value "$@"; CHECKSUM="$2"; shift 2;;
    --checksum-url) require_option_value "$@"; CHECKSUM_URL="$2"; shift 2;;
    --from-source) FROM_SOURCE=1; shift;;
    --quiet|-q) QUIET=1; shift;;
    -h|--help) usage; exit 0;;
    --*) err "Unknown option: $1"; usage >&2; exit 2;;
    *) err "Unexpected argument: $1"; usage >&2; exit 2;;
  esac
done

resolve_version

mkdir -p "$DEST"
TMP_ROOT="$(resolve_tmp_root)"
LOCK_FILE="${TMP_ROOT%/}/coding-agent-search-install.lock"
if [ "${TMPDIR:-}" != "$TMP_ROOT" ]; then
  export TMPDIR="$TMP_ROOT"
fi
if [ "$TMP_ROOT" != "/tmp" ]; then
  info "Using temporary workspace under $TMP_ROOT"
fi
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m)
case "$ARCH" in
  x86_64|amd64) ARCH="amd64" ;;
  arm64|aarch64) ARCH="arm64" ;;
  *) warn "Unknown arch $ARCH, using as-is" ;;
esac

# cass#308 retired the prebuilt Microsoft ONNX Runtime. Every supported release
# artifact now uses pure-Rust inference with runtime-dispatched SIMD, so this
# installer has no AVX2 probe and never selects a separate `-baseline` asset.
# `--artifact-url` remains an explicit custom-artifact override only.

TARGET=""
EXT="tar.gz"
NO_PREBUILT_REASON=""
case "${OS}-${ARCH}" in
  linux-amd64) TARGET="linux-amd64" ;;
  linux-arm64) TARGET="linux-arm64" ;;
  darwin-amd64) NO_PREBUILT_REASON="Intel macOS release binaries are not published" ;;
  darwin-arm64) TARGET="darwin-arm64" ;;
  mingw*-amd64|msys*-amd64|cygwin*-amd64)
    TARGET="windows-amd64"
    EXT="zip"
    ;;
  *) :;;
esac
INSTALL_BASENAME="cass"
case "$TARGET" in
  windows-amd64) INSTALL_BASENAME="cass.exe" ;;
esac

# Prefer prebuilt artifact when we know the target or the caller supplied a direct URL.
# glibc probe (WS-G.2): a prebuilt Linux binary on a host older than
# MIN_GLIBC fails at load time with a linker error after a successful-looking
# install. Detect it here and take the source route instead. An explicit
# --artifact-url is honored as written (the operator asked for that file).
last_major_minor_in_line() {
  # Print the LAST `<digits>.<digits>` token of the first line of $1, or
  # nothing. Builtins only: no pipeline, so nothing can close early.
  local first="${1%%$'\n'*}" rest version=""
  rest="$first"
  while [[ "$rest" =~ ([0-9]+\.[0-9]+)(.*) ]]; do
    version="${BASH_REMATCH[1]}"
    rest="${BASH_REMATCH[2]}"
  done
  printf '%s' "$version"
}
host_glibc_version() {
  # GH #444: `ldd --version` is a shell script on glibc that prints its banner
  # with several separate writes. The old `ldd | head -n 1 | grep | tail`
  # pipeline let `head` close its end after the first line, `ldd` then took
  # SIGPIPE (exit 141), and `set -o pipefail` turned that race into an
  # installer failure roughly half the time. Capture the whole banner once
  # (no early-closing reader), then parse it in-process; fall back to
  # `getconf GNU_LIBC_VERSION` when ldd is absent or prints nothing usable
  # (e.g. musl's ldd, which prints usage to stderr and exits non-zero).
  local banner="" version=""
  banner=$(LC_ALL=C ldd --version 2>/dev/null) || banner=""
  version=$(last_major_minor_in_line "$banner")
  if [ -z "$version" ]; then
    banner=$(LC_ALL=C getconf GNU_LIBC_VERSION 2>/dev/null) || banner=""
    version=$(last_major_minor_in_line "$banner")
  fi
  printf '%s' "$version"
}
glibc_at_least() {
  # $1 = required, $2 = host; true when host >= required (numeric major.minor)
  req_major=${1%%.*}; req_minor=${1#*.}
  host_major=${2%%.*}; host_minor=${2#*.}
  [ "$host_major" -gt "$req_major" ] 2>/dev/null && return 0
  [ "$host_major" -eq "$req_major" ] 2>/dev/null && [ "$host_minor" -ge "$req_minor" ] 2>/dev/null
}
if [ "$FROM_SOURCE" -eq 0 ] && [ -z "$ARTIFACT_URL" ]; then
  case "$TARGET" in
    linux-*musl*) : ;;
    linux-*)
      HOST_GLIBC=$(host_glibc_version)
      if [ -n "$HOST_GLIBC" ] && ! glibc_at_least "$MIN_GLIBC" "$HOST_GLIBC"; then
        warn "Host glibc ${HOST_GLIBC} is older than ${MIN_GLIBC}, which the prebuilt Linux binary requires; falling back to build-from-source (pass --artifact-url to force a prebuilt artifact)"
        FROM_SOURCE=1
      fi
      ;;
    *) : ;;
  esac
fi
TAR=""
URL=""
if [ "$FROM_SOURCE" -eq 0 ]; then
  if [ -n "$ARTIFACT_URL" ]; then
    TAR=$(artifact_name_from_url "$ARTIFACT_URL")
    URL="$ARTIFACT_URL"
  elif [ -n "$TARGET" ]; then
    TAR="cass-${TARGET}.${EXT}"
    URL="https://github.com/${OWNER}/${REPO}/releases/download/${VERSION}/${TAR}"
  else
    if [ -n "$NO_PREBUILT_REASON" ]; then
      warn "$NO_PREBUILT_REASON; falling back to build-from-source"
    else
      warn "No prebuilt artifact for ${OS}/${ARCH}; falling back to build-from-source"
    fi
    FROM_SOURCE=1
  fi
fi

# Cross-platform locking using mkdir (atomic on all POSIX systems including macOS)
# flock is Linux-only and doesn't exist on macOS
LOCK_DIR="${LOCK_FILE}.d"
LOCKED=0
if mkdir "$LOCK_DIR" 2>/dev/null; then
  LOCKED=1
  # Store PID for stale lock detection
  echo $$ > "$LOCK_DIR/pid"
else
  # Check if existing lock is stale (process no longer running)
  if [ -f "$LOCK_DIR/pid" ]; then
    OLD_PID=$(cat "$LOCK_DIR/pid" 2>/dev/null || echo "")
    if [ -n "$OLD_PID" ] && ! kill -0 "$OLD_PID" 2>/dev/null; then
      # Stale lock, remove and retry
      rm -rf "$LOCK_DIR"
      if mkdir "$LOCK_DIR" 2>/dev/null; then
        LOCKED=1
        echo $$ > "$LOCK_DIR/pid"
      fi
    fi
  fi
  if [ "$LOCKED" -eq 0 ]; then
    err "Another installer is running (lock $LOCK_DIR)"
    exit 1
  fi
fi

cleanup() {
  rm -rf "$TMP"
  if [ "$LOCKED" -eq 1 ]; then rm -rf "$LOCK_DIR"; fi
}

TMP=$(mktemp -d "${TMP_ROOT%/}/cass-install.XXXXXX")
trap cleanup EXIT

if [ "$FROM_SOURCE" -eq 0 ]; then
  info "Downloading $URL"
  if ! curl -fsSL "$URL" -o "$TMP/$TAR"; then
    if [ -n "$ARTIFACT_URL" ]; then
      err "Could not download explicitly requested artifact: $ARTIFACT_URL"
      exit 1
    fi
    warn "Artifact download failed; falling back to build-from-source"
    FROM_SOURCE=1
  fi
fi

if [ "$FROM_SOURCE" -eq 1 ]; then
  info "Building from source (requires git and the repository-pinned Rust toolchain)"
  git clone --depth 1 --branch "$VERSION" "https://github.com/${OWNER}/${REPO}.git" "$TMP/src"
  ensure_rust "$TMP/src"
  (unset RUSTUP_TOOLCHAIN; cd "$TMP/src" && cargo build --locked --release)
  BIN="$TMP/src/target/release/$INSTALL_BASENAME"
  if [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; then
    BIN="$TMP/src/target/release/cass"
  fi
  if [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; then
    BIN="$TMP/src/target/release/cass.exe"
  fi
  [ -f "$BIN" ] && [ -x "$BIN" ] || { err "Build failed"; exit 1; }
  install -m 0755 "$BIN" "$DEST/$INSTALL_BASENAME"
  ok "Installed to $DEST/$INSTALL_BASENAME (source build)"
  maybe_add_path
  if [ "$VERIFY" -eq 1 ]; then
    if ! "$DEST/$INSTALL_BASENAME" --version; then
      err "Self-test failed: $DEST/$INSTALL_BASENAME --version exited non-zero"
      exit 1
    fi
    ok "Self-test complete"
  fi
  if [ "$QUICKSTART" -eq 1 ]; then info "Running index --full (quickstart)"; "$DEST/$INSTALL_BASENAME" index --full || warn "index --full failed"; fi
  ok "Done. Run: cass"
  exit 0
fi

if [ -z "$CHECKSUM" ]; then
  [ -z "$CHECKSUM_URL" ] && CHECKSUM_URL="$(sibling_url "$URL" "${TAR}.sha256")"
  CHECKSUM_FILE="$TMP/checksum.sha256"
  SUMS_URL="$(sibling_url "$URL" "SHA256SUMS.txt")"
  SUMS_URL_ALT="$(sibling_url "$URL" "SHA256SUMS")"
  for TRY_URL in "$CHECKSUM_URL" "$SUMS_URL" "$SUMS_URL_ALT"; do
    [ -n "$TRY_URL" ] || continue
    info "Fetching checksum from ${TRY_URL}"
    if ! curl -fsSL "$TRY_URL" -o "$CHECKSUM_FILE"; then
      warn "Could not fetch checksum from ${TRY_URL}; trying next source..."
      continue
    fi

    if [ "$TRY_URL" = "$SUMS_URL" ] || [ "$TRY_URL" = "$SUMS_URL_ALT" ]; then
      CHECKSUM=$(awk -v tb="$TAR" '$2 == tb {print $1; exit}' "$CHECKSUM_FILE")
    else
      # Per-file checksum assets are expected to contain only the requested hash line.
      CHECKSUM=$(awk '{print $1}' "$CHECKSUM_FILE")
    fi

    if is_valid_sha256 "$CHECKSUM"; then
      break
    fi

    CHECKSUM=""
    warn "Checksum data from ${TRY_URL} did not contain a valid entry for ${TAR}; trying next source..."
  done
  if [ -z "$CHECKSUM" ]; then err "Checksum required and could not be resolved"; exit 1; fi
fi

checksum_matches "$TMP/$TAR" || { err "Checksum mismatch"; exit 1; }
ok "Checksum verified"

validate_archive_members "$TMP/$TAR"
ok "Archive layout verified"

info "Extracting"
case "$TAR" in
  *.zip) unzip -q "$TMP/$TAR" -d "$TMP" ;;
  *.tar.gz) tar -xzf "$TMP/$TAR" -C "$TMP" ;;
  *.tar.xz) tar -xJf "$TMP/$TAR" -C "$TMP" ;;
  *) tar -xf "$TMP/$TAR" -C "$TMP" ;;
esac
BIN="$TMP/$INSTALL_BASENAME"
if { [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; } && [ -n "$TARGET" ]; then
  BIN="$TMP/cass-${TARGET}/$INSTALL_BASENAME"
fi
if { [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; } && [ "$INSTALL_BASENAME" != "cass.exe" ]; then
  BIN=$(find "$TMP" -maxdepth 3 -type f -name "cass" -perm -111 | head -n 1)
fi
if { [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; } && [ "$INSTALL_BASENAME" = "cass.exe" ] && [ -f "$TMP/cass.exe" ]; then
  BIN="$TMP/cass.exe"
fi
if { [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; } && [ "$INSTALL_BASENAME" = "cass.exe" ] && [ -n "$TARGET" ] && [ -f "$TMP/cass-${TARGET}/cass.exe" ]; then
  BIN="$TMP/cass-${TARGET}/cass.exe"
fi
if { [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; } && [ "$INSTALL_BASENAME" = "cass.exe" ]; then
   BIN=$(find "$TMP" -maxdepth 3 -type f -name "coding-agent-search.exe" -perm -111 | head -n 1)
   if [ -f "$BIN" ] && [ -x "$BIN" ]; then
      warn "Found 'coding-agent-search.exe' binary instead of 'cass.exe'; installing it as 'cass.exe'"
   fi
fi
if { [ ! -f "$BIN" ] || [ ! -x "$BIN" ]; } && [ "$INSTALL_BASENAME" != "cass.exe" ]; then
   BIN=$(find "$TMP" -maxdepth 3 -type f -name "coding-agent-search" -perm -111 | head -n 1)
   if [ -f "$BIN" ] && [ -x "$BIN" ]; then
      warn "Found 'coding-agent-search' binary instead of 'cass'; installing as 'cass'"
   fi
fi

[ -f "$BIN" ] && [ -x "$BIN" ] || { err "Binary not found in archive"; exit 1; }
install -m 0755 "$BIN" "$DEST/$INSTALL_BASENAME"
ok "Installed to $DEST/$INSTALL_BASENAME"
maybe_add_path

if [ "$VERIFY" -eq 1 ]; then
  if ! "$DEST/$INSTALL_BASENAME" --version; then
    err "Self-test failed: $DEST/$INSTALL_BASENAME --version exited non-zero"
    exit 1
  fi
  ok "Self-test complete"
fi

if [ "$QUICKSTART" -eq 1 ]; then
  info "Running index --full (quickstart)"
  "$DEST/$INSTALL_BASENAME" index --full || warn "index --full failed"
fi

ok "Done. Run: cass"
info "Tip: If installed via Homebrew, update with: brew upgrade cass"