#!/bin/bash
# Installs or updates Claude Check (claude检测.app):
#   curl -fsSL https://check.flowsrun.com/install.sh | bash
#
# The app is ad-hoc signed, not notarized. Files fetched with curl carry no quarantine flag, so
# Gatekeeper does not stop the first launch; a .dmg from a browser would need "Open Anyway".
#
# CLAUDE_CHECK_URL and CLAUDE_CHECK_INSTALL_DIR override the download and the target folder (used by tests).
set -euo pipefail

URL="${CLAUDE_CHECK_URL:-https://check.flowsrun.com/download/ClaudeCheck-arm64.zip}"
APP="claude检测.app"
ID=com.claudecheck.app

if [ "$(uname -s)" != "Darwin" ] || [ "$(uname -m)" != "arm64" ]; then
    echo "Claude Check is built for Apple Silicon Macs only." >&2
    exit 1
fi

# /Applications needs an admin account; others get ~/Applications, which Spotlight and Launchpad see too.
if [ -n "${CLAUDE_CHECK_INSTALL_DIR:-}" ]; then
    dir="$CLAUDE_CHECK_INSTALL_DIR"
elif [ -w /Applications ]; then
    dir=/Applications
else
    dir="$HOME/Applications"
fi
mkdir -p "$dir"
dest="$dir/$APP"

if pgrep -f "$dest/Contents/MacOS/" >/dev/null 2>&1; then
    echo "Claude Check is running. Quit it (⌘Q), then run this again." >&2
    exit 1
fi

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

echo "Downloading Claude Check…"
curl -fL --progress-bar "$URL" -o "$tmp/app.zip"
# ditto keeps symlinks and the signature intact; unzip may not.
ditto -xk "$tmp/app.zip" "$tmp/out"
# A truncated or tampered download fails here rather than at launch.
if [ "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$tmp/out/$APP/Contents/Info.plist" 2>/dev/null)" != "$ID" ] \
    || ! codesign --verify --deep --strict "$tmp/out/$APP" 2>/dev/null; then
    echo "The download is damaged (signature check failed). Try again." >&2
    exit 1
fi
xattr -dr com.apple.quarantine "$tmp/out/$APP" 2>/dev/null || true
version="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$tmp/out/$APP/Contents/Info.plist")"

rm -rf "$dest"
mv "$tmp/out/$APP" "$dest"
echo "Installed Claude Check $version to $dest"
echo "Open it from Launchpad or Spotlight, or run: open \"$dest\""