install.sh

#!/usr/bin/env bash
# auditui install script — downloads the latest prebuilt binary for your
# platform from GitHub Releases, verifies the sha256, and installs to a
# PATH-reachable directory.
#
# Usage:
#   curl -fsSL https://github.com/rollysys/auditui/releases/latest/download/install.sh | bash
#
# Only hits github.com (and the objects.githubusercontent.com CDN that
# release-download URLs 302-redirect to). No raw.githubusercontent.com,
# no api.github.com — those are commonly blocked on corporate networks.
#
# Environment overrides:
#   PREFIX               install directory (default: $HOME/.local/bin)
#   TAG                  specific release tag (default: latest)
#   REPO                 owner/name (default: rollysys/auditui)
#   AUDITUI_SKIP_SKILL   set to 1 to skip the optional session-audit skill prompt
#   AUDITUI_INSTALL_SKILL set to 1 to install the skill non-interactively

set -euo pipefail

REPO="${REPO:-rollysys/auditui}"
PREFIX="${PREFIX:-$HOME/.local/bin}"
TAG="${TAG:-}"
BIN="auditui"

red()   { printf '\033[31m%s\033[0m\n' "$1" >&2; }
green() { printf '\033[32m%s\033[0m\n' "$1"; }
blue()  { printf '\033[34m%s\033[0m\n' "$1"; }

have() { command -v "$1" >/dev/null 2>&1; }

have curl || { red "curl is required but not found in PATH"; exit 1; }

os=$(uname -s)
arch=$(uname -m)
case "$os-$arch" in
    Darwin-arm64|Darwin-aarch64)
        target="aarch64-apple-darwin" ;;
    Linux-x86_64|Linux-amd64)
        # Statically-linked musl build: runs on any x86_64 Linux regardless
        # of glibc version (no GLIBC_2.3x dependency).
        target="x86_64-unknown-linux-musl" ;;
    Darwin-x86_64)
        red "Intel Mac (Darwin x86_64) — prebuilt binary not published."
        red "Please build from source:"
        red "  git clone https://github.com/$REPO && cd auditui && cargo build --release"
        exit 1 ;;
    Linux-aarch64|Linux-arm64)
        red "Linux aarch64 — prebuilt binary not published."
        red "Please build from source:"
        red "  git clone https://github.com/$REPO && cd auditui && cargo build --release"
        exit 1 ;;
    *)
        red "Unsupported platform: $os $arch"
        exit 1 ;;
esac

blue "[auditui] platform: $target"

if [ -z "$TAG" ]; then
    # Resolve latest tag without touching api.github.com:
    # `github.com/<repo>/releases/latest` 302-redirects to
    # `github.com/<repo>/releases/tag/<TAG>`. Follow with -L, discard the
    # body, print the final URL with `-w '%{url_effective}'`, and take the
    # basename.
    latest_url=$(curl -fsSL -o /dev/null -w '%{url_effective}' \
                    "https://github.com/$REPO/releases/latest")
    TAG="${latest_url##*/}"
    case "$TAG" in
        v*) ;;
        *)  red "could not resolve latest tag (got URL: $latest_url)"; exit 1 ;;
    esac
fi
blue "[auditui] tag:      $TAG"

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT

stem="${BIN}-${TAG}-${target}"
base_url="https://github.com/$REPO/releases/download/${TAG}"
tarball_url="${base_url}/${stem}.tar.gz"
sha_url="${tarball_url}.sha256"

blue "[auditui] download:  $tarball_url"
# `-#`: keep curl's simple progress bar for the tarball download so users
# on slow links see something happening. The SHA-256 sidecar is tiny
# (~80 bytes) and stays silent to avoid a half-second blip of progress UI.
curl -fL#  -o "$tmp/${stem}.tar.gz"        "$tarball_url"
curl -fsSL -o "$tmp/${stem}.tar.gz.sha256" "$sha_url"

blue "[auditui] verify sha256"
cd "$tmp"
if have shasum; then
    shasum -a 256 -c "${stem}.tar.gz.sha256" >/dev/null
elif have sha256sum; then
    sha256sum -c "${stem}.tar.gz.sha256" >/dev/null
else
    red "neither shasum nor sha256sum available; cannot verify download"
    exit 1
fi

blue "[auditui] extract + install → $PREFIX/$BIN"
tar -xzf "${stem}.tar.gz"
mkdir -p "$PREFIX"
install -m 0755 "${stem}/${BIN}" "$PREFIX/$BIN"

green "[auditui] installed $BIN $TAG → $PREFIX/$BIN"

# PATH hint
case ":$PATH:" in
    *":$PREFIX:"*) ;;
    *)
        echo ""
        blue "note: $PREFIX is not on your PATH. Add this to your shell rc:"
        echo "    export PATH=\"$PREFIX:\$PATH\""
        ;;
esac

echo ""
"$PREFIX/$BIN" --dry-run 2>&1 | head -1 | sed 's/^/[auditui] smoke: /' || true

# ---- optional: session-audit skill ----
# Teaches any agent (Claude Code / Codex / Qwen / SDK) how to read local
# agent session logs. Shipped inside the release tarball as
# `skills/session-audit/SKILL.md`; we just copy it out — no second network
# fetch, no raw.githubusercontent.com.
skill_dir="$HOME/.claude/skills/session-audit"
skill_src="$tmp/${stem}/skills/session-audit/SKILL.md"
install_skill=0

if [ -d "$skill_dir" ]; then
    :  # already installed, don't prompt
elif [ -n "${AUDITUI_SKIP_SKILL:-}" ]; then
    :  # user opted out entirely
elif [ ! -f "$skill_src" ]; then
    :  # this release predates the bundled skill — skip silently
elif [ "${AUDITUI_INSTALL_SKILL:-0}" = "1" ]; then
    install_skill=1
elif [ -e /dev/tty ]; then
    echo ""
    blue "Optional: install the 'session-audit' skill?"
    blue "  Teaches any Claude Code / Codex / Qwen / SDK agent how to read local"
    blue "  agent session logs (directory layout, JSONL schema, common recipes)."
    blue "  Single file, ~9 KB, installs to $skill_dir/SKILL.md"
    printf "  [y/N] "
    read -r ans </dev/tty || ans=""
    case "$ans" in
        y|Y|yes|Yes) install_skill=1 ;;
    esac
fi

if [ "$install_skill" = "1" ]; then
    blue "[auditui] installing session-audit skill → $skill_dir/SKILL.md"
    mkdir -p "$skill_dir"
    install -m 0644 "$skill_src" "$skill_dir/SKILL.md"
    green "[auditui] session-audit skill installed"
elif [ ! -d "$skill_dir" ] && [ -z "${AUDITUI_SKIP_SKILL:-}" ] && [ -f "$skill_src" ]; then
    echo ""
    blue "skipped session-audit skill. install later by re-running install.sh"
    blue "with AUDITUI_INSTALL_SKILL=1, or copy from a fresh tarball:"
    echo "    mkdir -p $skill_dir && cp <extracted>/skills/session-audit/SKILL.md \\"
    echo "        $skill_dir/SKILL.md"
fi