#!/bin/sh
# privatae-bastion installer (macOS / Linux).
#
# On your own computer:   curl -fsSL https://privatae.ai/bastion/install.sh | sh
# It installs the bastion for the WHOLE MACHINE, as a system service (systemd on
# Linux, launchd on macOS), so that no program running as you, an AI agent
# included, can stop it or change what it allows. sudo asks for your password
# once. Your own computer is the default ("personal": one Host at most, chosen at
# the machine), and your account opens the console without sudo:
# privatae-bastion ui. It watches the AI agents on the machine at once; no Host is
# needed.
#
# On a server:   curl -fsSL https://privatae.ai/bastion/install.sh | sudo sh
# Run as root, it installs the SHARED bastion (several Hosts, the first one paired
# is in charge), as before:   sudo -H privatae-bastion pair <token>
#
# --just-me installs it for your own account only, with no sudo. Any program
# running as you can then stop it; the installer says so. Without sudo, or when
# sudo refuses, that is what it falls back to, and it says that too.
# --personal / --shared choose the kind of machine (also spelled --local /
# --networked, their earlier names).
#
# PRIVATAE_PAIR_CODE='<code>' pairs as well, with the code from your Host's "Set
# up a bastion" card, and starts the bastion so it serves now and after a
# restart. The one line the card gives is
#   curl -fsSL https://privatae.ai/bastion/install.sh | PRIVATAE_PAIR_CODE='skp_…' sh
#
set -e
# The pairing code comes from the environment, never from an argument: an
# argument sits in this shell's command line for the whole install, where any
# user of this machine can read it with ps, and one at the same address could
# redeem it first. A process's environment is readable only by its owner and
# root. It is read here, before this script starts any program, and unset at
# once, so no program it starts inherits it. Never echoed: it holds the token.
pair_code=${PRIVATAE_PAIR_CODE-}
pair_given=${PRIVATAE_PAIR_CODE+1}
unset PRIVATAE_PAIR_CODE
if [ -n "$pair_given" ]; then
  # skp_ and base64url: anything else is a line that lost part of the code.
  case "$pair_code" in
    skp_*[!A-Za-z0-9_-]* | skp_) pair_code="" ;;
    skp_?*) ;;
    *) pair_code="" ;;
  esac
  if [ -z "$pair_code" ]; then
    echo "ERROR: PRIVATAE_PAIR_CODE is not a pairing code. Copy the whole line from your Host's card again (the code starts skp_). Nothing was installed." >&2
    exit 2
  fi
fi
# dl.privatae.ai, not privatae.ai/bastion: the download host is served from each
# edge's OWN local disk, so installs survive losing the platform datacentre, and
# DNS points it at the edge with the bandwidth for an install wave (~15MB a
# binary, and the primary sustains roughly 25x what the secondary does).
# Deliberately NOT env-overridable: the digest is checked against the manifest
# from this same base, so anything that can redirect the base can redirect both
# and the verification buys nothing. Hardcoded is the point.
base="https://dl.privatae.ai"
os=$(uname -s | tr '[:upper:]' '[:lower:]')
arch=$(uname -m); case "$arch" in x86_64|amd64) arch=amd64;; aarch64|arm64) arch=arm64;; esac

if [ "$(id -u)" = 0 ]; then bindir=/usr/local/bin; root=1; else bindir="${HOME}/.local/bin"; root=0; mkdir -p "$bindir"; fi
bin="$bindir/privatae-bastion"

# As root the default is the NETWORKED bastion: a root-owned service, anchored to
# the host it is first paired with, so every terminal and every write waits for the
# person's approval and every later host for the anchor's. A server left in local
# mode would serve its host with no approval at all. --local keeps a root install
# local (one host, the pairing's caps are the authorization); run as your own user
# it is always local. --networked is accepted and is the root default.
networked=0
local=0
just_me=0
code_on_stdin=0
for a in "$@"; do
  case "$a" in
    --networked|--shared) networked=1 ;;
    --local|--personal) local=1 ;;
    --just-me) just_me=1 ;;
    # Internal: the whole-machine step this script runs through sudo
    # (elevate_whole_machine) hands the pairing code on standard input, never
    # in its arguments.
    --pair-code-on-stdin) code_on_stdin=1 ;;
    # An unknown argument is never echoed: it may be a pairing code given in
    # the wrong place, and a log of the failed install must not hold it.
    *) echo "ERROR: unknown option. This installer takes --personal, --shared or --just-me; a pairing code goes in PRIVATAE_PAIR_CODE, as your Host's card shows. Nothing was installed." >&2; exit 2 ;;
  esac
done
if [ "$networked" = 1 ] && [ "$local" = 1 ]; then
  echo "ERROR: --shared and --personal contradict each other; pass one" >&2; exit 2
fi
if [ "$just_me" = 1 ] && [ "$(id -u)" = 0 ]; then
  echo "ERROR: --just-me installs the bastion for your own account; run it without sudo. Nothing was installed." >&2; exit 2
fi
if [ "$just_me" = 1 ] && [ "$networked" = 1 ]; then
  echo "ERROR: a shared machine's bastion runs for the whole machine; --just-me and --shared contradict each other" >&2; exit 2
fi
if [ "$code_on_stdin" = 1 ]; then
  if [ "$(id -u)" != 0 ] || [ -n "$pair_given" ]; then
    echo "ERROR: unknown option. Nothing was installed." >&2; exit 2
  fi
  IFS= read -r pair_code || true
  pair_given=1
  case "$pair_code" in
    skp_*[!A-Za-z0-9_-]* | skp_) pair_code="" ;;
    skp_?*) ;;
    *) pair_code="" ;;
  esac
  [ -n "$pair_code" ] || { echo "ERROR: the pairing code did not arrive. Nothing was installed." >&2; exit 2; }
fi
asked_networked=$networked

# paired_local DIR...: 0 when one of these state folders holds a pairing and
# its mode is not networked (no mode.json reads as local, mode.go boxMode).
# The service's own folder goes first.
paired_local() {
  for d in "$@"; do
    [ -d "$d" ] || continue
    if [ -f "$d/mode.json" ] && grep -q '"networked"' "$d/mode.json"; then return 1; fi
    [ -f "$d/config.json" ] && return 0
    for f in "$d"/pairings/*.json; do [ -f "$f" ] && return 0; done
  done
  return 1
}

# pair_as ROOT OS BIN ARGS...: run the bastion as the state it serves. As
# root that is the service's HOME (the unit's /root, launchd's /var/root),
# whatever HOME `sudo` left behind; as yourself it is your own.
pair_as() {
  pa_root=$1; pa_os=$2; shift 2
  if [ "$pa_root" = 1 ]; then
    if [ "$pa_os" = darwin ]; then HOME=/var/root "$@"; else HOME=/root "$@"; fi
  else
    "$@"
  fi
}

# bastion_copy PID: 0 when PID is a process of this user running a program
# named privatae-bastion, from any path, including one replaced on disk since
# it started. A process that has exited, or another user's, is not.
bastion_copy() {
  [ -O "/proc/$1" ] || return 1
  bc_exe=$(readlink "/proc/$1/exe" 2>/dev/null) || return 1
  case "${bc_exe##*/}" in
    "privatae-bastion" | "privatae-bastion (deleted)") return 0 ;;
  esac
  return 1
}

# stop_user_copies: stop every copy of this user's bastion (Linux), as
# install.ps1 does on Windows: one left running in a terminal, from an older
# install or another path. `run` holds the machine's run lock, so the copy the
# service starts would only wait behind it, and that copy never reads the new
# pairing; an older build would fail on 127.0.0.1:7878 and restart for ever.
# Asked to stop, then killed after 10 seconds. Says on stderr how many.
stop_user_copies() {
  suc_pids=""
  for suc_d in /proc/[0-9]*; do
    suc_pid=${suc_d#/proc/}
    bastion_copy "$suc_pid" || continue
    kill "$suc_pid" 2>/dev/null && suc_pids="$suc_pids $suc_pid"
  done
  [ -n "$suc_pids" ] || return 0
  set -- $suc_pids
  echo "Stopped $# copy(ies) of the bastion running outside its service (a terminal, or another install)." >&2
  for suc_i in 1 2 3 4 5 6 7 8 9 10; do
    suc_left=""
    for suc_pid in $suc_pids; do bastion_copy "$suc_pid" && suc_left="$suc_left $suc_pid"; done
    [ -n "$suc_left" ] || return 0
    sleep 1
  done
  for suc_pid in $suc_left; do kill -9 "$suc_pid" 2>/dev/null || true; done
}

# user_unit_stays_up: 0 when the user unit privatae-bastion is running and
# has kept the same process across a few seconds, longer than its
# RestartSec, so a copy that fails at start and is restarted is caught.
# Otherwise says what systemd shows, on stderr.
user_unit_stays_up() {
  sleep 1
  uu_first=$(systemctl --user show -p MainPID --value privatae-bastion 2>/dev/null) || uu_first=""
  sleep 4
  uu_pid=$(systemctl --user show -p MainPID --value privatae-bastion 2>/dev/null) || uu_pid=""
  uu_state=$(systemctl --user show -p ActiveState --value privatae-bastion 2>/dev/null) || uu_state=""
  uu_sub=$(systemctl --user show -p SubState --value privatae-bastion 2>/dev/null) || uu_sub=""
  if [ "$uu_state" = active ] && [ "$uu_sub" = running ] && [ -n "$uu_pid" ] && [ "$uu_pid" != 0 ] && [ "$uu_pid" = "$uu_first" ]; then
    return 0
  fi
  echo "The bastion's user service privatae-bastion is not staying up (systemd shows it ${uu_state:-unknown}/${uu_sub:-unknown}, and it has restarted)." >&2
  echo "Its log says why:  journalctl --user -u privatae-bastion" >&2
  return 1
}

# start_bastion BIN ROOT OS: start, or restart, the bastion so it serves every
# pairing now and starts again by itself. A running bastion reads a new
# pairing at its next start, so a restart is what a fresh pairing needs.
# Prints one plain sentence saying how it will run.
start_bastion() {
  sb_bin=$1; sb_root=$2; sb_os=$3
  if [ "$sb_root" = 1 ] && [ "$sb_os" = linux ] && command -v systemctl >/dev/null 2>&1; then
    systemctl restart privatae-bastion || return 1
    echo "The bastion runs as the system service privatae-bastion, and starts at boot."
    return 0
  fi
  if [ "$sb_root" = 1 ] && [ "$sb_os" = darwin ] && [ -f /Library/LaunchDaemons/ai.privatae.bastion.plist ]; then
    /bin/launchctl kickstart -k system/ai.privatae.bastion || return 1
    echo "The bastion runs as the system service ai.privatae.bastion, and starts at boot."
    return 0
  fi
  if [ "$sb_root" != 1 ] && [ "$sb_os" = linux ] && command -v systemctl >/dev/null 2>&1 && systemctl --user show-environment >/dev/null 2>&1; then
    # A systemd user unit: yours, no root. It starts when you sign in; with
    # lingering on, at boot and after you sign out as well.
    sb_dir="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
    mkdir -p "$sb_dir"
    cat > "$sb_dir/privatae-bastion.service" <<UNIT
[Unit]
Description=Privatae bastion - watches the AI agents in this account
[Service]
Type=simple
ExecStart=$sb_bin run
Restart=always
RestartSec=2
[Install]
WantedBy=default.target
UNIT
    systemctl --user daemon-reload && systemctl --user enable privatae-bastion >/dev/null 2>&1 || return 1
    # Its own copy first, then every other: what is left running after this
    # is only what the unit starts.
    systemctl --user stop privatae-bastion >/dev/null 2>&1 || true
    stop_user_copies
    systemctl --user restart privatae-bastion || return 1
    user_unit_stays_up || return 1
    if loginctl enable-linger "$(id -un)" >/dev/null 2>&1; then
      echo "The bastion runs as your systemd user service privatae-bastion, and starts at boot."
    else
      echo "The bastion runs as your systemd user service privatae-bastion while you are signed in."
      echo "To keep it running at boot and after you sign out:  sudo loginctl enable-linger $(id -un)"
    fi
    return 0
  fi
  if [ "$sb_root" != 1 ] && [ "$sb_os" = darwin ]; then
    # A LaunchAgent: yours, no root, started each time you log in.
    sb_plist="$HOME/Library/LaunchAgents/ai.privatae.bastion.user.plist"
    mkdir -p "$HOME/Library/LaunchAgents"
    cat > "$sb_plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>ai.privatae.bastion.user</string>
  <key>ProgramArguments</key><array><string>$sb_bin</string><string>run</string></array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
</dict>
</plist>
PLIST
    /bin/launchctl bootout "gui/$(id -u)/ai.privatae.bastion.user" >/dev/null 2>&1 || true
    /bin/launchctl bootstrap "gui/$(id -u)" "$sb_plist" || return 1
    echo "The bastion runs as your LaunchAgent ai.privatae.bastion.user, and starts each time you log in."
    return 0
  fi
  # No service manager this script can use: run it now, detached, once every
  # other copy of it has stopped (stop_user_copies says why).
  if [ "$sb_os" = linux ] && [ "$sb_root" != 1 ]; then stop_user_copies; fi
  nohup "$sb_bin" run >/dev/null 2>&1 &
  sb_pid=$!
  sleep 3
  if [ "$sb_os" = linux ] && ! bastion_copy "$sb_pid"; then
    echo "The bastion stopped as soon as it started. Run it in a terminal to see why:  $sb_bin run" >&2
    return 1
  fi
  echo "The bastion is running, until this machine restarts. Start it again with:  $sb_bin run"
}

# record_owner BIN ROOT OS: run through sudo from a person's account on their
# own computer, record that account as the machine's owner, whose own account
# then opens the console without sudo (privatae-bastion ui). SUDO_UID is set by
# sudo itself. Not on a shared machine: there the console stays the
# administrator's (sudo -H privatae-bastion ui), so no agent running as the
# account that ran sudo can reach it. A second administrator's reinstall leaves
# the first owner in place; the bastion says so.
record_owner() {
  ro_bin=$1; ro_root=$2; ro_os=$3
  [ "$ro_root" = 1 ] || return 0
  [ "$networked" != 1 ] || return 0
  case "${SUDO_UID-}" in ""|0|*[!0-9]*) return 0 ;; esac
  pair_as "$ro_root" "$ro_os" "$ro_bin" approvals-owner --account "$SUDO_UID" </dev/null || \
    echo "NOTE: your account was not recorded as this machine's owner (the reason is above); open the console with: sudo -H privatae-bastion ui" >&2
}

# whole_machine_next BIN: what to do next on a person's own computer, the
# bastion installed for the whole machine and no Host connected.
whole_machine_next() {
  echo "The bastion runs for the whole machine and starts at boot. It is watching the AI agents on this computer now; no Host is needed."
  echo "  Open its console:      privatae-bastion ui"
  case "$(uname -s)" in
    Darwin) wmn_state="/var/root/Library/Application Support/privatae-bastion" ;;
    *) wmn_state=/root/.config/privatae-bastion ;;
  esac
  [ -f "$wmn_state/machine-factor/stepup.json" ] && return 0
  echo "  Set up your code, to stop an agent or answer what agents ask (an authenticator app on your phone):"
  echo "                         sudo -H privatae-bastion stepup-enroll --machine"
}

# pair_and_start BIN CODE ROOT OS: pair with CODE, handed to `pair -` on
# standard input and never as an argument, where the process list would show
# it. Then start the bastion and show its status. `pair` exits 3 when this
# machine is already paired with that Host, which is success here too.
pair_and_start() {
  ps_bin=$1; ps_code=$2; ps_root=$3; ps_os=$4
  ps_rc=0
  printf '%s\n' "$ps_code" | pair_as "$ps_root" "$ps_os" "$ps_bin" pair - || ps_rc=$?
  case "$ps_rc" in
    0) ps_done="This machine is paired." ;;
    3) ps_done="This machine was already paired with this Host; nothing changed there." ;;
    *) echo "ERROR: pairing did not finish (the reason is above). The bastion is installed; nothing else changed." >&2
       return 1 ;;
  esac
  ps_how=$(start_bastion "$ps_bin" "$ps_root" "$ps_os") || {
    echo "ERROR: $ps_done But the bastion did not start. Start it with:  $ps_bin run" >&2
    return 1
  }
  sleep 2
  pair_as "$ps_root" "$ps_os" "$ps_bin" status || true
  echo ""
  echo "$ps_done $ps_how"
}

# whole_machine_script is what the whole-machine step runs as root: this same
# installer, fetched by root from the one place it is published. A script
# piped to sh cannot hand itself on, and a copy this account wrote would be a
# file this account could change before root ran it. Hardcoded, like $base.
whole_machine_script="https://privatae.ai/bastion/install.sh"

# account_install_paired: 0 when this account already has a bastion of its own
# that is paired. An upgrade keeps it where it is: moved to the whole machine,
# its pairings would stay behind in this account.
account_install_paired() {
  case "$(uname -s)" in
    Darwin) aip_dir="${HOME}/Library/Application Support/privatae-bastion" ;;
    *) aip_dir="${XDG_CONFIG_HOME:-$HOME/.config}/privatae-bastion" ;;
  esac
  [ -f "$aip_dir/config.json" ] && return 0
  for aip_f in "$aip_dir"/pairings/*.json; do [ -f "$aip_f" ] && return 0; done
  return 1
}

# elevate_whole_machine: install for the whole machine through sudo. Returns 3
# when sudo is missing or refuses (no admin rights, no terminal to ask on, a
# wrong password): nothing was installed. Otherwise the root step's own exit
# status. The pairing code reaches the root step on standard input, never in
# an argument, where the process list would show it.
elevate_whole_machine() {
  command -v sudo >/dev/null 2>&1 || return 3
  echo "Installing the bastion for the whole machine, so that no program running as you, an AI agent included, can stop it or change what it allows."
  echo "sudo asks for your password once."
  # `sudo true`, not `sudo -v`: -v asks for a password unless every sudo rule
  # of the account is NOPASSWD (sudoers verifypw), so an account that may run
  # anything without one was asked anyway, and fell back to itself where no
  # terminal could answer.
  sudo -p '[bastion] sudo password for %u: ' true </dev/null || return 3
  ew_kind=--personal
  [ "$networked" = 1 ] && ew_kind=--shared
  # -H and curl -q: root's step reads nothing from this account's home. A sudo
  # configured to keep HOME (env_keep) would otherwise have root's curl
  # read this account's ~/.curlrc, which can point the fetch at another server
  # (resolve, proxy) and switch off its certificate check: a file this account
  # can change, deciding what root runs.
  ew_cmd='f=$(mktemp) || exit 1; if curl -q -fsSL "$1" -o "$f"; then shift; /bin/sh "$f" "$@"; rc=$?; else echo "ERROR: could not fetch $1. Nothing was installed." >&2; rc=1; fi; rm -f "$f"; exit $rc'
  ew_rc=0
  if [ -n "$pair_code" ]; then
    printf '%s\n' "$pair_code" | sudo -H /bin/sh -c "$ew_cmd" sh "$whole_machine_script" "$ew_kind" --pair-code-on-stdin || ew_rc=$?
  else
    sudo -H /bin/sh -c "$ew_cmd" sh "$whole_machine_script" "$ew_kind" </dev/null || ew_rc=$?
  fi
  # 3 means sudo refused (above); the root step's own failure is never read
  # as that.
  [ "$ew_rc" = 3 ] && ew_rc=1
  return "$ew_rc"
}

# account_copy_cleanup: what an earlier install for this account alone left
# that would run a second bastion beside the machine's: its unit or LaunchAgent
# and its program. Its state, pairings included, stays in the account. Reached
# when that install held no pairing, or when the machine already has a
# bastion for the whole machine, beside which it could not run anyway.
account_copy_cleanup() {
  acc_unit="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user/privatae-bastion.service"
  if [ -f "$acc_unit" ]; then
    systemctl --user disable --now privatae-bastion >/dev/null 2>&1 || true
    rm -f "$acc_unit"
    systemctl --user daemon-reload >/dev/null 2>&1 || true
    echo "Removed this account's own bastion service; the machine's replaces it."
  fi
  acc_plist="$HOME/Library/LaunchAgents/ai.privatae.bastion.user.plist"
  if [ -f "$acc_plist" ]; then
    /bin/launchctl bootout "gui/$(id -u)/ai.privatae.bastion.user" >/dev/null 2>&1 || true
    rm -f "$acc_plist"
    echo "Removed this account's own bastion LaunchAgent; the machine's replaces it."
  fi
  if [ -f "$HOME/.local/bin/privatae-bastion" ] && [ ! -L "$HOME/.local/bin/privatae-bastion" ]; then
    rm -f "$HOME/.local/bin/privatae-bastion"
    echo "Removed $HOME/.local/bin/privatae-bastion, an earlier copy that would come first on PATH."
  fi
  if [ "$(uname -s)" = Linux ]; then stop_user_copies; fi
}

# machine_install_present: 0 when this machine's bastion is already installed
# for the whole machine. A second one for an account beside it would only be
# refused (the bastion's own guard), so none is installed.
machine_install_present() {
  case "$(uname -s)" in
    Darwin) [ -f /Library/LaunchDaemons/ai.privatae.bastion.plist ] ;;
    *) [ -f /etc/systemd/system/privatae-bastion.service ] ;;
  esac
}

# Not root: the whole machine, through sudo, unless this account's own bastion
# is asked for (--just-me) or is already paired. Where sudo cannot be used,
# this account, and the installer says what that means; but never beside a
# bastion installed for the whole machine.
kept_account=0
fell_back=0
if [ "$root" != 1 ] && [ "$just_me" = 1 ] && machine_install_present; then
  echo "ERROR: this machine's bastion is installed for the whole machine, and a second one for your account would be refused beside it. Its console opens from its owner's account with: privatae-bastion ui. Nothing was installed." >&2
  exit 1
fi
if [ "$root" != 1 ] && [ "$just_me" != 1 ]; then
  if account_install_paired && ! machine_install_present; then
    kept_account=1
  else
    ew_rc=0
    elevate_whole_machine || ew_rc=$?
    case "$ew_rc" in
      0) account_copy_cleanup; exit 0 ;;
      3) if machine_install_present; then
           echo "ERROR: this machine's bastion is installed for the whole machine, and updating it needs an account that may use sudo, in a terminal. Nothing was installed." >&2
           exit 1
         fi
         fell_back=1
         echo "sudo could not be used here, so the bastion is installed for your account only." >&2 ;;
      *) exit "$ew_rc" ;;
    esac
  fi
fi

if [ "$root" = 1 ] && [ "$local" != 1 ]; then
  case "$(uname -s)" in
    Linux) if command -v systemctl >/dev/null 2>&1; then networked=1; fi ;;
    Darwin) networked=1 ;;
  esac
fi
# A reinstall (an upgrade) of a machine already paired in local mode keeps
# local mode unless --networked is passed. Switched by default, its pairing
# would sit on an unanchored networked machine, which refuses every op until
# claim-anchor is run, and `pair` would accept a second host.
kept_local=0
if [ "$networked" = 1 ] && [ "$asked_networked" != 1 ]; then
  case "$(uname -s)" in
    Darwin) state_dirs="/var/root/Library/Application Support/privatae-bastion|${HOME}/Library/Application Support/privatae-bastion" ;;
    *) state_dirs="/root/.config/privatae-bastion|${XDG_CONFIG_HOME:-$HOME/.config}/privatae-bastion" ;;
  esac
  if paired_local "${state_dirs%%|*}" "${state_dirs#*|}"; then networked=0; kept_local=1; fi
fi
if [ "$networked" = 1 ] && [ "$root" != 1 ]; then
  echo "ERROR: --networked needs root — a networked bastion is a root-owned service (run with sudo)" >&2; exit 1
fi

key="$os-$arch"
tmp=$(mktemp); man=$(mktemp); vdir=$(mktemp -d)
# Any exit before the final mv must leave nothing behind and install nothing:
# this script is piped to `sudo sh`, so a partial run is a root-privileged
# partial install.
trap 'rm -f "$tmp" "$man"; rm -rf "$vdir"' EXIT INT TERM

die() { echo "ERROR: $*" >&2; exit 1; }

# Pick the digest tool ONCE, here — not inside the command substitution that
# computes the hash. `exit` inside `$(...)` only leaves the subshell, so a
# missing-tool check there would print an error and then carry on installing
# an unverified binary, which is the exact failure this whole change exists to
# prevent. Linux ships sha256sum; macOS ships shasum. Neither: refuse.
if command -v sha256sum >/dev/null 2>&1; then SHACMD="sha256sum"
elif command -v shasum >/dev/null 2>&1; then SHACMD="shasum -a 256"
else die "no sha256sum or shasum on this system — cannot verify the download, refusing to install"
fi
sha_of() { $SHACMD "$1" | cut -d' ' -f1; }

# ── the release signature ──────────────────────────────────────────────────
#
# The manifest names each binary's digest, and the download is checked against
# it. The manifest itself is signed with a release key whose public half is
# pinned here, the same keys a running bastion checks every update with
# (client-go/release_sign.go productionReleaseKeys; install_sig_sh_test.go
# holds the two to each other). So a copy of this script read on GitHub and run
# from there as root, or with --just-me, installs only a release we signed
# (possibly an older one), whatever the download host serves. Run without
# sudo, the copy does not install for the whole machine itself: its root step
# fetches this installer from the website again (whole_machine_script) and
# runs that. The signature is over one statement, as verifyReleaseSignature
# builds it: privatae-release-signature-v1, the kind, the version, and the
# manifest's sha256, a line each; it sits beside the manifest at
# version.json.<the first 16 hex of that sha256>.sig, in base64.
#
# Checked with an openssl that does Ed25519 (OpenSSL 3, on most Linux; the
# openssl@3 Homebrew installs on a Mac). A probe signature made for this tells
# "this openssl cannot check" from "the signature is wrong": the first prints a
# note and keeps the digest check alone, which is what the script did before;
# the second refuses to install.
RELEASE_KEYS='MCowBQYDK2VwAyEAtWOyZm38DwTwbawSnvExQG/CQsVJBKYWc46arCBZj9E= MCowBQYDK2VwAyEACKL+J0VSdqrfY4AmxChvylJ1ha4e8GvcrYF2o17Ah+g='
SIG_PROBE_KEY='MCowBQYDK2VwAyEA1TRy5NeI2n7tieFf6cHe5VE69SV0XL7Vx4k6EwFlFFk='
SIG_PROBE_SIG='Do3fnwjyv8QgR+9sJcc0A3Sr0XzSKqBW8DK8kzaJL29tS8KxuStc2tp+HheJvoGwXmrH2kg7YN+yDLKVDnDqDQ=='

# release_signature_check <manifest> <empty scratch dir>: returns when the
# manifest's signature verifies, or when no openssl here can check one (said);
# exits when it does not verify.
release_signature_check() {
  rs_man=$1 rs_dir=$2
  rs_pem() { printf -- '-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----\n' "$1" > "$2"; }
  rs_ssl=""
  rs_pem "$SIG_PROBE_KEY" "$rs_dir/probe.pem"
  printf 'privatae-installer-probe-v1\n' > "$rs_dir/probe.msg"
  printf 'privatae-installer-probe-v0\n' > "$rs_dir/probe.other"
  # The probe signature must verify over its message and not over another: an
  # openssl that passes every signature is no check, and is set aside like one
  # that cannot check, never taken for one.
  for c in openssl /opt/homebrew/opt/openssl@3/bin/openssl /usr/local/opt/openssl@3/bin/openssl; do
    command -v "$c" >/dev/null 2>&1 || continue
    printf '%s' "$SIG_PROBE_SIG" | "$c" base64 -d -A -out "$rs_dir/probe.sig" 2>/dev/null || continue
    if "$c" pkeyutl -verify -pubin -inkey "$rs_dir/probe.pem" -rawin -in "$rs_dir/probe.msg" \
        -sigfile "$rs_dir/probe.sig" >/dev/null 2>&1 &&
      ! "$c" pkeyutl -verify -pubin -inkey "$rs_dir/probe.pem" -rawin -in "$rs_dir/probe.other" \
        -sigfile "$rs_dir/probe.sig" >/dev/null 2>&1; then
      rs_ssl=$c; break
    fi
  done
  if [ -z "$rs_ssl" ]; then
    echo "NOTE: no openssl here can check an Ed25519 signature, so the release's signature is not checked;"
    echo "      the download is still checked against the manifest's digest, fetched over HTTPS."
    if [ "$os" = darwin ]; then
      echo "      To check the signature too, install OpenSSL 3 (brew install openssl@3) and run this again."
    else
      echo "      To check the signature too, install OpenSSL 3 from your distribution and run this again."
    fi
    return 0
  fi
  rs_sum=$(sha_of "$rs_man")
  case "$rs_sum" in *[!0-9a-f]* | "") die "cannot take the manifest's digest — refusing to install unverified" ;; esac
  rs_ver=$(sed -n 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$rs_man" | head -n 1)
  case "$rs_ver" in
    "" | *[!0-9A-Za-z.+-]*) die "the manifest names no usable version — refusing to install unverified" ;;
  esac
  rs_short=$(printf '%s' "$rs_sum" | cut -c1-16)
  curl -fsSL --max-filesize 4096 "$base/version.json.$rs_short.sig" -o "$rs_dir/sig.b64" \
    || die "cannot fetch the release's signature ($base/version.json.$rs_short.sig) — refusing to install unverified"
  tr -d ' \r\n' < "$rs_dir/sig.b64" | "$rs_ssl" base64 -d -A -out "$rs_dir/sig" 2>/dev/null \
    || die "the release's signature is malformed — refusing to install"
  [ "$(wc -c < "$rs_dir/sig" | tr -d ' ')" = 64 ] || die "the release's signature is malformed — refusing to install"
  printf 'privatae-release-signature-v1\nbastion\n%s\n%s\n' "$rs_ver" "$rs_sum" > "$rs_dir/statement"
  for k in $RELEASE_KEYS; do
    rs_pem "$k" "$rs_dir/key.pem"
    if "$rs_ssl" pkeyutl -verify -pubin -inkey "$rs_dir/key.pem" -rawin -in "$rs_dir/statement" \
        -sigfile "$rs_dir/sig" >/dev/null 2>&1; then
      echo "Release signature verified (version $rs_ver)."
      return 0
    fi
  done
  die "the release's signature does not verify against the pinned release keys — refusing to install"
}

echo "Fetching manifest..."
curl -fsSL "$base/version.json" -o "$man" || die "cannot fetch $base/version.json — refusing to install unverified"
release_signature_check "$man" "$vdir"

# Pull this platform's expected digest out of version.json without needing jq or
# python (neither is guaranteed on a clean macOS or a minimal container): find the
# stanza for our key, then take the quoted value on its "sha256" line.
expected=$(awk -v k="\"$key\"" '
  index($0, k) { f = 1 }
  f && /"sha256"/ { n = split($0, a, "\""); print a[n-1]; exit }
' "$man")
case "$expected" in
  *[!0-9a-f]* | "") die "manifest has no usable sha256 for $key — refusing to install unverified" ;;
esac
[ ${#expected} -eq 64 ] || die "manifest sha256 for $key is malformed — refusing to install unverified"

# Take the URL FROM THE MANIFEST, never build one. The manifest's url now carries
# ?v=<version>, which is what stops Cloudflare handing back the PREVIOUS release's
# binary against the CURRENT release's digest — a stale cache that surfaces as
# "checksum MISMATCH" and reads like a corrupt or tampered download. Same awk
# shape as the digest read above (no jq, no python on a clean macOS). Falls back
# to the constructed path for a manifest that predates the field.
url=$(awk -v k="\"$key\"" '
  index($0, k) { f = 1 }
  f && /"url"/ { n = split($0, a, "\""); print a[n-1]; exit }
' "$man")
case "$url" in
  https://*) ;;
  *) url="$base/dl/privatae-bastion-$key" ;;
esac

echo "Downloading privatae-bastion ($key)..."
curl -fsSL "$url" -o "$tmp" || die "download failed for $key"

actual=$(sha_of "$tmp")
if [ "$actual" != "$expected" ]; then
  die "checksum MISMATCH for privatae-bastion-$key
  expected $expected
  actual   $actual
The downloaded binary is not the one the platform published. Nothing was installed."
fi
echo "Checksum verified ($expected)."

darwin_service=0
if [ "$os" = darwin ] && [ "$root" = 1 ]; then
  # The launchd daemon runs this program as root, so only root may be able to
  # replace it: a root-owned folder, not /usr/local/bin, which a common package
  # manager hands to the signed-in user on many Macs. `service install` checks
  # the whole path and refuses otherwise.
  darwin_service=1
  appdir="/Library/Application Support/privatae"
  mkdir -p "$appdir/bin"
  chown root:wheel "$appdir" "$appdir/bin"
  chmod 755 "$appdir" "$appdir/bin"
  bin="$appdir/bin/privatae-bastion"
fi

chmod +x "$tmp"
mv "$tmp" "$bin"
if [ "$darwin_service" = 1 ]; then
  chown root:wheel "$bin"
  chmod 755 "$bin"
  # The command people type still works: a link on PATH to the real program.
  # -n replaces an existing link instead of following it: /usr/local/bin may
  # belong to the signed-in user, who could otherwise point the name at a
  # directory and have this root shell create the link inside it.
  mkdir -p /usr/local/bin && ln -sfn "$bin" /usr/local/bin/privatae-bastion
fi
echo "Installed: $bin"

if [ "$os" = linux ] && [ "$root" = 1 ] && command -v systemctl >/dev/null 2>&1; then
  # This unit has NO User= line: the service runs as root. Measured on real
  # installs: `ps` shows root running the bastion, and every such install came
  # from this same script. `run` itself needs no root — the
  # tunnel is userspace — but the networked bastion's ops (observe:*, session:*)
  # do, and a root install is what makes claim-anchor's root check mean
  # something. A single-user machine that wants the local, non-root shape runs
  # the installer WITHOUT sudo and gets the --user path below instead.
  cat > /etc/systemd/system/privatae-bastion.service <<UNIT
[Unit]
Description=Privatae bastion - watches the AI agents on this machine
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
# Runs as root on purpose (no User=): the networked bastion's ops need it and the
# anchor claim is root-proved. HOME=/root puts the state under /root/.config.
Environment=HOME=/root
ExecStart=$bin run
Restart=always
RestartSec=2
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
UNIT
  systemctl daemon-reload
  if [ "$networked" = 1 ]; then
    # The mode is box state under the same HOME the unit uses, written by the
    # binary itself so the path is resolved exactly one way.
    HOME=/root "$bin" set-mode networked || die "could not set networked mode"
  fi
  systemctl enable privatae-bastion >/dev/null 2>&1 || true
  # restart, not start: a reinstall must run the new program.
  systemctl restart privatae-bastion >/dev/null 2>&1 || true
  record_owner "$bin" "$root" "$os"
  echo ""
  if [ -n "$pair_code" ]; then
    :
  elif [ "$networked" = 1 ]; then
    echo "Networked bastion. Pair it with YOUR host; the first host paired becomes its anchor:"
    echo "  sudo -H privatae-bastion pair <token>"
    echo "Then enrol your second factor, so you can approve here:"
    echo "  sudo -H privatae-bastion stepup-enroll"
    echo "Every terminal and write waits for your approval, and every later host for your host's."
    echo "(Already paired before this install? Anchor with: sudo -H privatae-bastion claim-anchor)"
  elif [ "$kept_local" = 1 ]; then
    echo "This machine is already paired as a LOCAL bastion, and reinstalling keeps it local."
    echo "To make it a networked server, anchored to the host it serves:"
    echo "  sudo -H privatae-bastion set-mode networked"
    echo "  sudo -H privatae-bastion claim-anchor"
    echo "  sudo -H privatae-bastion stepup-enroll"
    echo "  sudo systemctl restart privatae-bastion"
  else
    whole_machine_next "$bin"
    echo "  Connect a Host, if you run one (optional):  sudo -H privatae-bastion pair <token>"
  fi
elif [ "$darwin_service" = 1 ]; then
  # The mode is box state under root's home, where the daemon keeps its state
  # (the daemon's HOME is /var/root), written by the binary itself so the path
  # is resolved exactly one way. Before the service starts, so its first run
  # already sees it.
  if [ "$networked" = 1 ]; then
    HOME=/var/root "$bin" set-mode networked || die "could not set networked mode"
  fi
  "$bin" service install || die "could not register the system service"
  record_owner "$bin" "$root" "$os"
  echo ""
  if [ -z "$pair_code" ] && [ "$networked" != 1 ]; then
    whole_machine_next "$bin"
  elif [ -z "$pair_code" ]; then
  echo "Networked bastion, running as a system service (launchd, as root)."
  echo "Pair it with YOUR host; the first host paired becomes its anchor:"
  # The full path, not the name on PATH: /usr/local/bin may belong to the
  # signed-in user, who could point the link at their own program, and this
  # line is run as root.
  echo "  sudo -H '$bin' pair <token>"
  echo "Then enrol your second factor, so you can approve here:"
  echo "  sudo -H '$bin' stepup-enroll"
  echo "Every terminal and write waits for your approval, and every later host for your host's."
  echo "(Already paired before this install? Anchor with: sudo -H '$bin' claim-anchor)"
  fi
elif [ "$networked" = 1 ]; then
  die "--networked needs a system service manager: systemd on Linux, launchd on macOS"
else
  case ":$PATH:" in *":$bindir:"*) ;; *) echo "Add to PATH:  export PATH=\"\$PATH:$bindir\"" ;; esac
  echo ""
  if [ "$kept_account" = 1 ]; then
    echo "This account's own bastion is already paired, so it stays installed for this account."
    echo "To move it to the whole machine: disconnect its Host (privatae-bastion unpair <host>), run this"
    echo "installer again, and connect the Host again with: sudo -H privatae-bastion pair <token>"
  fi
  echo "WARNING: installed for your account only. Any program running as you, an AI agent included, can stop"
  echo "  the bastion or change what it allows."
  if [ "$just_me" = 1 ]; then
    echo "  To install it for the whole machine instead, run this installer again without --just-me."
  elif [ "$fell_back" = 1 ]; then
    echo "  To install it for the whole machine, run this installer again in a terminal, from an account that may use sudo."
  fi
  if [ -z "$pair_code" ]; then
    if start_how=$(start_bastion "$bin" "$root" "$os"); then
      echo "$start_how"
      echo "It is watching the AI agents in this account now; no Host is needed. Open its console:  $bin ui"
    else
      echo "Start it with:  $bin run" >&2
    fi
    echo "Connect a Host, if you run one (optional):  $bin pair <token>"
  fi
fi
if [ -n "$pair_code" ]; then
  echo ""
  pair_and_start "$bin" "$pair_code" "$root" "$os" || exit 1
fi
echo "privatae-bastion is free software under the GNU GPL v3 or later: https://privatae.ai/bastion/LICENSE.txt"