#!/bin/bash
# Install lmcp on macOS via Homebrew.
#
# Pins to lua@5.4 (keg-only brew formula) to keep library paths aligned
# with the rest of the fleet (Arch/ALARM, Debian). Installs luasocket via
# luarocks into the user-local rocks tree (~/.luarocks/) and bakes the
# required LUA_PATH / LUA_CPATH into the LaunchAgent plist so the service
# can `require 'socket'`.
#
# Usage (from lmcp repo root):
#   ./scripts/lmcp-install-macos.sh
#
# Uninstall:
#   launchctl unload ~/Library/LaunchAgents/de.reauktion.marfrit.lmcp.plist
#   rm ~/Library/LaunchAgents/de.reauktion.marfrit.lmcp.plist
#   rm $(brew --prefix)/etc/lmcp/token

set -euo pipefail

# brew is only on PATH in login shells by default; source its env explicitly
# so this works under a plain non-login bash too.
if ! command -v brew >/dev/null 2>&1; then
    for candidate in /opt/homebrew/bin/brew /usr/local/bin/brew; do
        if [ -x "$candidate" ]; then
            eval "$("$candidate" shellenv)"
            break
        fi
    done
fi
command -v brew >/dev/null 2>&1 || { echo "error: Homebrew not found"; exit 1; }

REPO=${REPO:-$(cd "$(dirname "$0")/.." && pwd)}
for f in lmcp.lua json.lua server.lua example_server.lua; do
    [ -f "$REPO/$f" ] || { echo "error: $REPO/$f not found — run from lmcp repo root or set REPO="; exit 1; }
done

echo "==> brew install lua@5.4 luarocks"
brew install --quiet lua@5.4 luarocks

LUA54_PREFIX=$(brew --prefix lua@5.4)
LUA54=$LUA54_PREFIX/bin/lua5.4
BREW_PREFIX=$(brew --prefix)
[ -x "$LUA54" ] || { echo "error: $LUA54 missing after brew install"; exit 1; }

echo "==> luarocks install luasocket (user-local, pinned to lua@5.4)"
luarocks --lua-version 5.4 --lua-dir "$LUA54_PREFIX" install --local luasocket

LR_PATH=$(luarocks --lua-version 5.4 --lua-dir "$LUA54_PREFIX" path --lr-path)
LR_CPATH=$(luarocks --lua-version 5.4 --lua-dir "$LUA54_PREFIX" path --lr-cpath)
DEFAULT_LUA_P="$BREW_PREFIX/share/lua/5.4/?.lua;$BREW_PREFIX/share/lua/5.4/?/init.lua;$BREW_PREFIX/lib/lua/5.4/?.lua;$BREW_PREFIX/lib/lua/5.4/?/init.lua;./?.lua;./?/init.lua"
DEFAULT_LUA_CP="$BREW_PREFIX/lib/lua/5.4/?.so;./?.so"
FULL_LUA_P="$DEFAULT_LUA_P;$LR_PATH"
FULL_LUA_CP="$DEFAULT_LUA_CP;$LR_CPATH"

echo "==> install library files into $BREW_PREFIX/share/lua/5.4/"
install -d "$BREW_PREFIX/share/lua/5.4"
install -m 644 "$REPO/lmcp.lua"   "$BREW_PREFIX/share/lua/5.4/lmcp.lua"
install -m 644 "$REPO/json.lua"   "$BREW_PREFIX/share/lua/5.4/json.lua"
install -m 644 "$REPO/server.lua" "$BREW_PREFIX/share/lua/5.4/server.lua"
install -m 755 "$REPO/example_server.lua" "$BREW_PREFIX/bin/lmcp-example"

# Token: retain existing, mint new otherwise
TOKEN_FILE="$BREW_PREFIX/etc/lmcp/token"
install -d -m 755 "$BREW_PREFIX/etc/lmcp"
if [ -r "$TOKEN_FILE" ]; then
    TOKEN=$(cat "$TOKEN_FILE")
    echo "==> reusing token from $TOKEN_FILE"
else
    TOKEN=$(openssl rand -hex 32)
    umask 077
    printf '%s\n' "$TOKEN" > "$TOKEN_FILE"
    chmod 600 "$TOKEN_FILE"
    echo "==> minted new token, stored at $TOKEN_FILE (0600)"
fi

LABEL="de.reauktion.marfrit.lmcp"
PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
PORT="${LMCP_PORT:-8080}"
NAME="${LMCP_NAME:-$(hostname -s)-tools}"

echo "==> write LaunchAgent $PLIST"
mkdir -p "$HOME/Library/LaunchAgents"
cat > "$PLIST" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>$LABEL</string>
    <key>ProgramArguments</key>
    <array>
        <string>$LUA54</string>
        <string>$BREW_PREFIX/share/lua/5.4/server.lua</string>
    </array>
    <key>EnvironmentVariables</key>
    <dict>
        <key>LMCP_PORT</key>
        <string>$PORT</string>
        <key>LMCP_NAME</key>
        <string>$NAME</string>
        <key>LMCP_TOKEN</key>
        <string>$TOKEN</string>
        <key>LUA_PATH</key>
        <string>$FULL_LUA_P</string>
        <key>LUA_CPATH</key>
        <string>$FULL_LUA_CP</string>
    </dict>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <true/>
    <key>StandardOutPath</key>
    <string>/tmp/lmcp.log</string>
    <key>StandardErrorPath</key>
    <string>/tmp/lmcp.err</string>
</dict>
</plist>
PLIST
chmod 600 "$PLIST"  # plist contains token

echo "==> (re)load LaunchAgent"
launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"

sleep 2
echo "==> smoke test (unauth expected 401, Bearer expected 200)"
unauth=$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 -X POST "http://127.0.0.1:$PORT/mcp" \
     -H 'Content-Type: application/json' \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' || echo "000")
auth=$(curl -s --max-time 3 -X POST "http://127.0.0.1:$PORT/mcp" \
     -H "Authorization: Bearer $TOKEN" \
     -H 'Content-Type: application/json' \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' || true)

if [ "$unauth" = "401" ] && echo "$auth" | grep -q '"tools"'; then
    echo "OK — lmcp listening on :$PORT as $NAME, Bearer-gated"
else
    echo "smoke test failed (unauth=$unauth, auth body below)"
    echo "$auth" | head -c 500; echo
    tail -20 /tmp/lmcp.err 2>/dev/null || true
    exit 1
fi

cat <<INFO

Token: $TOKEN

Add to Claude Code ~/.claude.json on the client machine:

    "$NAME": {
        "type": "http",
        "url": "http://$(hostname -s).fritz.box:$PORT/mcp",
        "headers": { "Authorization": "Bearer $TOKEN" }
    }

(Use .fritz.box, .local, or the LAN IP depending on where the client lives.)
INFO