install

#!/usr/bin/env bash
set -euo pipefail
APP=iris

MUTED='\033[0;2m'
RED='\033[0;31m'
ORANGE='\033[38;5;214m'
CYAN='\033[0;36m'
GREEN='\033[0;32m'
NC='\033[0m' # No Color

usage() {
    cat <<EOF
IRIS Installer — CLI, SDK, Desktop App, Bridge, Docker Sandbox, Remotion

Usage: install [options]

Installs:
  1. IRIS CLI    — AI coding agent (terminal)
  2. IRIS SDK     — CLI tools & PHP SDK
  3. IRIS App     — Desktop application (macOS)
  4. MCP Config   — Agent tool integration (scaffolded for future use)
  5. Agent Bridge — Hive compute node + session bridge
  6. Docker Sandbox — Sandboxed container for AI agent development
  7. Remotion     — Video & image generation compositions (lazy-installed)

Options:
    -h, --help              Display this help message
    -v, --version <version> Install a specific IRIS CLI version (see the releases page)
    -b, --binary <path>     Install IRIS CLI from a local binary
        --no-modify-path    Don't modify shell config files (.zshrc, .bashrc, etc.)
        --skip-sdk          Skip SDK/CLI installation
        --skip-app          Skip desktop app installation
        --skip-mcp          Skip MCP config scaffolding
        --skip-bridge       Skip Coding Agent Bridge installation
        --skip-sandbox      Skip Docker Sandbox installation
        --skip-remotion     Skip Remotion video framework installation
        --api-url <url>     Set IRIS API URL (default: https://freelabel.net)
        --token <token>     Pre-seed SDK token (skip interactive auth). On Linux this also makes the
                            machine a Hive node: systemd unit, first heartbeat, then success.
                            Or set IRIS_SDK_TOKEN in the environment to keep it out of argv.
        --user-id <id>      Pre-seed user ID (used with --token)
        --only-code         Only install IRIS CLI (skip SDK, app, MCP, bridge, sandbox)

Examples:
    curl -fsSL https://heyiris.io/install-code | bash
    curl -fsSL https://heyiris.io/install-code | bash -s -- --version <version>
    curl -fsSL https://heyiris.io/install-code | bash -s -- --only-code
    curl -fsSL https://heyiris.io/install-code | bash -s -- --skip-app
    curl -fsSL https://heyiris.io/install-code | bash -s -- --api-url https://custom.example.com
    curl -fsSL https://heyiris.io/install-code | bash -s -- --token api_token_xxx --user-id 42
    curl -fsSL https://heyiris.io/install-code | IRIS_SDK_TOKEN=api_token_xxx bash
EOF
}

# ─── Install beacon (#179077) ─────────────────────────────────────────────────
# Anonymous, metadata-only, fire-and-forget. Nothing about an install ATTEMPT
# reached us before this: the CLI beacon needs a token, and there is no token
# until after iris-login — which happens after the install. So a failed install
# looked exactly like nobody trying.
#
# Never blocks (3s timeout, backgrounded) and never fails the install — the `||
# true` is load-bearing under `set -e`. Opt out with IRIS_TELEMETRY=0.
IRIS_BEACON_URL="https://heyiris.io/api/v6/telemetry/install"
IRIS_INSTALLER_VERSION="2026-08-06"

send_install_beacon() {
    case "${IRIS_TELEMETRY:-}" in 0|off|false) return 0 ;; esac
    command -v curl >/dev/null 2>&1 || return 0

    local event_type="$1" step="${2:-}" reason="${3:-}"
    local os arch has_git has_node
    os=$(uname -s 2>/dev/null | tr '[:upper:]' '[:lower:]')
    arch=$(uname -m 2>/dev/null)
    has_git=$(command -v git >/dev/null 2>&1 && echo true || echo false)
    has_node=$(command -v node >/dev/null 2>&1 && echo true || echo false)

    # Metadata only — no paths, no hostname, no username.
    local payload
    payload=$(printf '{"event_type":"%s","os":"%s","arch":"%s","installer_version":"%s","shell":"bash","has_git":%s,"has_node":%s,"step":"%s","reason":"%s"}' \
        "$event_type" "$os" "$arch" "$IRIS_INSTALLER_VERSION" "$has_git" "$has_node" "$step" "$(printf '%s' "$reason" | tr -d '"\\' | cut -c1-200)")

    (curl -fsS -m 3 -X POST -H 'Content-Type: application/json' -d "$payload" "$IRIS_BEACON_URL" >/dev/null 2>&1 &) || true
    return 0
}

requested_version=${VERSION:-}
no_modify_path=false
binary_path=""
skip_sdk=false
skip_app=false
skip_mcp=false
skip_agents_md=false
only_docs_mode=false
skip_bridge=false
skip_sandbox=false
skip_remotion=false
iris_api_url="https://freelabel.net"
pre_token="${IRIS_SDK_TOKEN:-}"
pre_user_id="${IRIS_USER_ID:-}"

while [[ $# -gt 0 ]]; do
    case "$1" in
        -h|--help)
            usage
            exit 0
            ;;
        -v|--version)
            if [[ -n "${2:-}" ]]; then
                requested_version="$2"
                shift 2
            else
                echo -e "${RED}Error: --version requires a version argument${NC}"
                exit 1
            fi
            ;;
        -b|--binary)
            if [[ -n "${2:-}" ]]; then
                binary_path="$2"
                shift 2
            else
                echo -e "${RED}Error: --binary requires a path argument${NC}"
                exit 1
            fi
            ;;
        --no-modify-path)
            no_modify_path=true
            shift
            ;;
        --skip-sdk)
            skip_sdk=true
            shift
            ;;
        --skip-app)
            skip_app=true
            shift
            ;;
        --skip-mcp)
            skip_mcp=true
            shift
            ;;
        --skip-agents-md)
            skip_agents_md=true
            shift
            ;;
        --skip-bridge)
            skip_bridge=true
            shift
            ;;
        --skip-sandbox)
            skip_sandbox=true
            shift
            ;;
        --skip-remotion)
            skip_remotion=true
            shift
            ;;
        --api-url)
            if [[ -n "${2:-}" ]]; then
                iris_api_url="$2"
                shift 2
            else
                echo -e "${RED}Error: --api-url requires a URL argument${NC}"
                exit 1
            fi
            ;;
        --token)
            if [[ -n "${2:-}" ]]; then
                pre_token="$2"
                shift 2
            else
                echo -e "${RED}Error: --token requires a token argument${NC}"
                exit 1
            fi
            ;;
        --user-id)
            if [[ -n "${2:-}" ]]; then
                pre_user_id="$2"
                shift 2
            else
                echo -e "${RED}Error: --user-id requires an ID argument${NC}"
                exit 1
            fi
            ;;
        --only-code)
            skip_sdk=true
            skip_app=true
            skip_mcp=true
            skip_agents_md=true
            skip_bridge=true
            skip_sandbox=true
            skip_remotion=true
            shift
            ;;
        --only-docs)
            # Re-fetch the IRIS scaffold (AGENTS.md + how-to/ recipes) only.
            # Use this to update docs without reinstalling the binary.
            skip_sdk=true
            skip_app=true
            skip_mcp=true
            skip_agents_md=false
            skip_bridge=true
            skip_sandbox=true
            skip_remotion=true
            only_docs_mode=true
            shift
            ;;
        *)
            echo -e "${ORANGE}Warning: Unknown option '$1'${NC}" >&2
            shift
            ;;
    esac
done

# Validate --api-url is a proper URL (prevents injection into docker-compose YAML)
if ! [[ "$iris_api_url" =~ ^https?://[a-zA-Z0-9._-]+(:[0-9]+)?(/.*)?$ ]]; then
    echo -e "${RED}Error: --api-url must be a valid HTTP(S) URL${NC}"
    exit 1
fi

# Linux package installs below run under sudo. With a token the run is unattended (#192964 R3:
# one command, nothing typed after it), so sudo must fail rather than stop to ask for a password.
# As root, no sudo at all: a minimal image may not have it.
pkg_sudo() {
    if [ "$(id -u)" = "0" ]; then "$@"
    elif [ -n "$pre_token" ]; then sudo -n "$@"
    else sudo "$@"
    fi
}

# ─── Pre-flight: verify required utilities ────────────────────────────────────
_missing_required=""
for _cmd in curl grep sed mktemp chmod mkdir; do
    command -v "$_cmd" >/dev/null 2>&1 || _missing_required="$_missing_required $_cmd"
done
if [ -n "$_missing_required" ]; then
    echo -e "${RED}Missing required utilities:${NC}$_missing_required"
    echo -e "${MUTED}These are usually built into your OS. On macOS, try running ${NC}xcode-select --install"
    echo -e "${MUTED}On Linux: ${NC}sudo apt install coreutils curl"
    exit 1
fi

# macOS version check — the IRIS binary is compiled with Bun and uses
# LC_DYLD_CHAINED_FIXUPS (load command 0x80000034) for faster startup.
# This load command was introduced in macOS 12 (Monterey). Older macOS
# versions will install successfully but crash at runtime with:
#   dyld: cannot load 'iris' (load command 0x80000034 is unknown)
#   Abort trap: 6
# Detect this BEFORE downloading so the user gets a clear explanation.
if [ "$(uname -s)" = "Darwin" ]; then
    _macos_version=$(sw_vers -productVersion 2>/dev/null || echo "")
    _macos_major=$(echo "$_macos_version" | cut -d. -f1)
    if [ -n "$_macos_major" ] && [ "$_macos_major" -lt 12 ] 2>/dev/null; then
        echo -e "${RED}════════════════════════════════════════════════════════════════${NC}"
        echo -e "${RED}  ⚠  macOS Version Warning${NC}"
        echo -e "${RED}════════════════════════════════════════════════════════════════${NC}"
        echo -e "${ORANGE}Your macOS version:${NC} $_macos_version"
        echo -e "${ORANGE}IRIS CLI requires:${NC}  macOS 12 (Monterey) or later"
        echo -e ""
        echo -e "${MUTED}The binary will install and authenticate, but will fail to${NC}"
        echo -e "${MUTED}run with this error:${NC}"
        echo -e "${MUTED}  ${NC}dyld: cannot load 'iris' (load command 0x80000034 is unknown)"
        echo -e "${MUTED}  ${NC}Abort trap: 6"
        echo -e ""
        echo -e "${MUTED}This is because IRIS is compiled with Bun, which uses Mach-O${NC}"
        echo -e "${MUTED}features only available on macOS 12 and later.${NC}"
        echo -e ""
        echo -e "${MUTED}Options:${NC}"
        echo -e "${MUTED}  1. Upgrade macOS:${NC} https://support.apple.com/macos/upgrade"
        echo -e "${MUTED}  2. Report the issue:${NC} https://github.com/FREELABEL/iris-opencode/issues"
        echo -e "${RED}════════════════════════════════════════════════════════════════${NC}"
        echo -e ""
        echo -e "${MUTED}Continuing install anyway in 5 seconds (Ctrl-C to abort)...${NC}"
        sleep 5
    fi
fi

# ─── Dependency bootstrap ────────────────────────────────────────────────────
# MUST run before every dep check below. The unzip pre-flight, the tmux check,
# install_bridge and install_remotion all branch on `command -v brew|node`, so
# bootstrapping Homebrew at the END of this script (where it used to live) meant
# a clean macOS box silently skipped the daemon, the bridge and Remotion.

# Can we reach the terminal even though stdin is the curl pipe?
IRIS_TTY=false
if [ -e /dev/tty ] && (echo "" > /dev/tty) 2>/dev/null; then
    IRIS_TTY=true
fi

# Pick up an installed-but-unshimmed brew (common on fresh Apple Silicon)
if ! command -v brew >/dev/null 2>&1; then
    for _brew_path in /opt/homebrew/bin/brew /usr/local/bin/brew /home/linuxbrew/.linuxbrew/bin/brew; do
        if [ -x "$_brew_path" ]; then eval "$("$_brew_path" shellenv)" || true; break; fi
    done
fi

if [ "$(uname)" = "Darwin" ] && ! command -v brew >/dev/null 2>&1; then
    echo -e "${CYAN}→${NC} Installing Homebrew (needed for tmux, Node.js and the Hive daemon)..."
    if [ "$IRIS_TTY" = "true" ]; then
        # Read the sudo password from the terminal, NOT the curl pipe. Without
        # this redirect Homebrew aborts with "stdin is not a TTY".
        /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" < /dev/tty || true
    else
        # No terminal at all — use Homebrew's own non-interactive mode. Needs
        # passwordless sudo; degrade gracefully rather than aborting the install.
        NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" || true
    fi
    for _brew_path in /opt/homebrew/bin/brew /usr/local/bin/brew; do
        if [ -x "$_brew_path" ]; then eval "$("$_brew_path" shellenv)" || true; break; fi
    done
    if command -v brew >/dev/null 2>&1; then
        echo -e "${GREEN}✓${NC} Homebrew installed"
    else
        echo -e "${ORANGE}⚠${NC} Homebrew install failed — tmux, Node.js and the daemon will be skipped."
        echo -e "${MUTED}  Install it from https://brew.sh, then re-run this installer.${NC}"
    fi
fi

# Node.js — required by install_bridge (Agent Bridge + Hive daemon) and
# install_remotion, both of which run long before the old end-of-script block.
if ! command -v node >/dev/null 2>&1; then
    echo -e "${CYAN}→${NC} Installing Node.js (required by the Agent Bridge and Remotion)..."
    if command -v brew >/dev/null 2>&1; then
        brew install node >/dev/null 2>&1 || true
    elif command -v apt-get >/dev/null 2>&1; then
        pkg_sudo apt-get install -y nodejs npm >/dev/null 2>&1 || true
    elif command -v dnf >/dev/null 2>&1; then
        pkg_sudo dnf install -y nodejs npm >/dev/null 2>&1 || true
    fi
    if command -v node >/dev/null 2>&1; then
        echo -e "${GREEN}✓${NC} Node.js installed: $(node -v 2>/dev/null || echo unknown)"
    else
        echo -e "${ORANGE}⚠${NC} Node.js unavailable — Agent Bridge and Remotion will be skipped."
        echo -e "${MUTED}  Install it from https://nodejs.org, then re-run this installer.${NC}"
    fi
fi

# Soft pre-flight: warn (don't exit) about commands the binary install needs
_missing_soft=""
for _cmd in unzip; do
    command -v "$_cmd" >/dev/null 2>&1 || _missing_soft="$_missing_soft $_cmd"
done
if [ -n "$_missing_soft" ]; then
    echo -e "${ORANGE}Warning:${NC} missing soft dependencies:$_missing_soft"
    echo -e "${MUTED}The IRIS installer needs these to extract the binary. Attempting auto-install...${NC}"
    if command -v brew >/dev/null 2>&1; then
        for _pkg in $_missing_soft; do brew install "$_pkg" >/dev/null 2>&1 || true; done
    elif command -v apt-get >/dev/null 2>&1; then
        pkg_sudo apt-get install -y $_missing_soft >/dev/null 2>&1 || true
    else
        echo -e "${ORANGE}Could not auto-install. Please install manually:${NC}$_missing_soft"
        echo -e "${MUTED}On macOS without Homebrew, first run:${NC}"
        echo -e "  /bin/bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\""
        echo -e "${MUTED}Then re-run this installer.${NC}"
        exit 1
    fi
    # Re-check
    for _cmd in $_missing_soft; do
        if ! command -v "$_cmd" >/dev/null 2>&1; then
            echo -e "${RED}Auto-install of $_cmd failed.${NC} Please install it manually and re-run."
            exit 1
        fi
    done
    echo -e "${GREEN}✓${NC} Auto-installed:$_missing_soft"
fi

# ─── tmux (required for Hive session persistence) ─────────────────────────
if ! command -v tmux >/dev/null 2>&1; then
    echo -e "${MUTED}Installing tmux (required for Hive compute sessions)...${NC}"
    if command -v brew >/dev/null 2>&1; then
        # `|| true` matters: set -e is on, so a failed brew install would
        # otherwise abort the whole installer here.
        brew install tmux >/dev/null 2>&1 || true
    elif command -v apt-get >/dev/null 2>&1; then
        pkg_sudo apt-get install -y tmux >/dev/null 2>&1 || true
    elif command -v dnf >/dev/null 2>&1; then
        pkg_sudo dnf install -y tmux >/dev/null 2>&1 || true
    elif command -v pacman >/dev/null 2>&1; then
        pkg_sudo pacman -S --noconfirm tmux >/dev/null 2>&1 || true
    else
        echo -e "${ORANGE}Could not auto-install tmux.${NC}"
        echo -e "${MUTED}Install manually: brew install tmux (macOS) or sudo apt install tmux (Linux)${NC}"
        echo -e "${MUTED}The IRIS Hive daemon requires tmux for session persistence.${NC}"
    fi
    if command -v tmux >/dev/null 2>&1; then
        echo -e "${GREEN}✓${NC} tmux installed: $(tmux -V 2>/dev/null || echo 'unknown version')"
    fi
else
    # Version check — require tmux >= 3.0 for wait-for support
    _tmux_ver=$(tmux -V 2>/dev/null | grep -oE '[0-9]+\.[0-9]+' | head -1)
    _tmux_major=$(echo "$_tmux_ver" | cut -d. -f1)
    if [ -n "$_tmux_major" ] && [ "$_tmux_major" -lt 3 ] 2>/dev/null; then
        echo -e "${ORANGE}tmux $_tmux_ver found but 3.0+ recommended for full Hive features.${NC}"
        echo -e "${MUTED}Upgrade: brew install tmux (macOS) or sudo apt install tmux (Linux)${NC}"
    fi
fi

INSTALL_DIR=$HOME/.iris/bin
mkdir -p "$INSTALL_DIR"

# Platform detection runs UNCONDITIONALLY, before the --binary branch.
#
# It used to live inside the `else` below — i.e. only on the download path. The desktop app
# installs the CLI from its BUNDLED sidecar, so it always passes --binary, always took the
# `if` branch, and never set os/arch. The tmux and Node sections further down then hit
# `node-v$NODE_VERSION-$os-$arch` under `set -u` and died with:
#
#     line 461: os: unbound variable
#
# So the app's install path was broken 100% of the time while the curl-pipe path was fine —
# and a bare-machine test of the curl path passes cleanly right next to it. Detection is
# cheap, has no side effects, and every later section wants it, so it belongs out here where
# both branches get it. (Originally 1afe66dc77; re-applied after this file was restored, because
# a wholesale restore drops it exactly the way the wholesale replacement dropped the funnel.)
raw_os=$(uname -s)
os=$(echo "$raw_os" | tr '[:upper:]' '[:lower:]')
case "$raw_os" in
  Darwin*) os="darwin" ;;
  Linux*) os="linux" ;;
  MINGW*|MSYS*|CYGWIN*) os="windows" ;;
esac

arch=$(uname -m)
if [[ "$arch" == "aarch64" ]]; then
  arch="arm64"
fi
if [[ "$arch" == "x86_64" ]]; then
  arch="x64"
fi

if [ "$os" = "darwin" ] && [ "$arch" = "x64" ]; then
  rosetta_flag=$(sysctl -n sysctl.proc_translated 2>/dev/null || echo 0)
  if [ "$rosetta_flag" = "1" ]; then
    arch="arm64"
  fi
fi

# If --binary is provided, skip all download/detection logic
if [ -n "$binary_path" ]; then
    if [ ! -f "$binary_path" ]; then
        echo -e "${RED}Error: Binary not found at ${binary_path}${NC}"
        exit 1
    fi
    specific_version="local"
else
    combo="$os-$arch"
    case "$combo" in
      linux-x64|linux-arm64|darwin-x64|darwin-arm64|windows-x64)
        ;;
      *)
        echo -e "${RED}Unsupported OS/Arch: $os/$arch${NC}"
        echo -e "${MUTED}Supported: linux-x64, linux-arm64, darwin-x64, darwin-arm64, windows-x64${NC}"
        exit 1
        ;;
    esac

    archive_ext=".zip"
    if [ "$os" = "linux" ]; then
      archive_ext=".tar.gz"
    fi

    is_musl=false
    if [ "$os" = "linux" ]; then
      if [ -f /etc/alpine-release ]; then
        is_musl=true
      fi

      if command -v ldd >/dev/null 2>&1; then
        if ldd --version 2>&1 | grep -qi musl; then
          is_musl=true
        fi
      fi
    fi

    needs_baseline=false
    if [ "$arch" = "x64" ]; then
      if [ "$os" = "linux" ]; then
        if ! grep -qi avx2 /proc/cpuinfo 2>/dev/null; then
          needs_baseline=true
        fi
      fi

      if [ "$os" = "darwin" ]; then
        # AVX2 sysctl key has changed across macOS versions. Check both
        # variants and only flag as missing if BOTH return 0/missing.
        avx2_a=$(sysctl -n hw.optional.avx2_0 2>/dev/null || echo 0)
        avx2_b=$(sysctl -n hw.optional.avx2 2>/dev/null || echo 0)
        if [ "$avx2_a" != "1" ] && [ "$avx2_b" != "1" ]; then
          needs_baseline=true
        fi
      fi
    fi

    target="$os-$arch"
    if [ "$needs_baseline" = "true" ]; then
      target="$target-baseline"
    fi
    if [ "$is_musl" = "true" ]; then
      target="$target-musl"
    fi

    filename="$APP-$target$archive_ext"

    # Verify the requested asset actually exists in the GitHub release. If
    # the baseline build is missing (no baseline artifacts published for this
    # version), fall back to the standard build with a clear warning. This
    # protects against asset-name mismatches and macOS AVX2 detection quirks
    # where a Mac actually supports AVX2 but the sysctl key differs.
    if [ "$needs_baseline" = "true" ] && [ -z "$requested_version" ]; then
      _probe_url="https://github.com/FREELABEL/iris-opencode/releases/latest/download/$filename"
      if ! curl -fsSL --head --max-time 8 "$_probe_url" >/dev/null 2>&1; then
        _fallback_filename="$APP-$os-$arch$archive_ext"
        if [ "$is_musl" = "true" ]; then
          _fallback_filename="$APP-$os-$arch-musl$archive_ext"
        fi
        echo -e "${ORANGE}Warning:${NC} baseline build ($filename) not published for this release."
        echo -e "${MUTED}Falling back to standard build: ${NC}$_fallback_filename"
        echo -e "${MUTED}If this binary crashes with 'Illegal instruction', your CPU likely lacks AVX2.${NC}"
        echo -e "${MUTED}In that case, please file an issue: ${NC}https://github.com/FREELABEL/iris-opencode/issues"
        filename="$_fallback_filename"
        target="$os-$arch"
        [ "$is_musl" = "true" ] && target="$target-musl"
      fi
    fi


    if [ "$os" = "linux" ]; then
        if ! command -v tar >/dev/null 2>&1; then
             echo -e "${RED}Error: 'tar' is required but not installed.${NC}"
             echo -e "${MUTED}Install with: sudo apt install tar${NC}"
             exit 1
        fi
    else
        if ! command -v unzip >/dev/null 2>&1; then
            echo -e "${RED}Error: 'unzip' is required but not installed.${NC}"
            echo -e "${MUTED}Install with: brew install unzip (macOS) or sudo apt install unzip (Linux)${NC}"
            exit 1
        fi
    fi

    send_install_beacon "install_start"

    if [ -z "$requested_version" ]; then
        # Do NOT use /releases/latest. TWO release series share this repo — `v*` for this CLI
        # and `desktop-v*` for the Tauri desktop app — and GitHub's "latest" is simply the most
        # recently published NON-prerelease of either. On 2026-08-27, promoting
        # desktop-v1.18.28 made /releases/latest return that tag; it has no bare `v` prefix, so
        # the parse below produced an empty string and EVERY `curl | bash` install died with
        # "Failed to fetch version information". The desktop app's release cadence must not be
        # able to break the CLI installer.
        #
        # Ask for the highest release in THIS series instead. The `"v[0-9]` anchor is what
        # excludes desktop-v*: after `"tag_name": "` that tag begins with `d`, not `v`.
        # HIGHEST, not first-listed (#188596): GitHub lists a release by its tag's commit date, so
        # v1.5.0 (the v2 engine, tagged on an older commit) sat below v1.3.355 and fresh installs
        # got v1. A field-wise numeric sort, because macOS's sort has no -V on older releases.
        specific_version=$(curl -s "https://api.github.com/repos/FREELABEL/iris-opencode/releases?per_page=100" \
            | sed -n 's/.*"tag_name": *"v\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\)".*/\1/p' \
            | sort -t. -k1,1n -k2,2n -k3,3n | tail -1) || true

        if [[ -z "$specific_version" ]]; then
            # Last resort: the redirect target of /releases/latest/download still resolves by
            # ASSET NAME, so it can land on a valid CLI release even when the API parse failed.
            specific_version=$(curl -sI "https://github.com/FREELABEL/iris-opencode/releases/latest/download/$filename" \
                | sed -n 's|.*/releases/download/v\([0-9][^/]*\)/.*|\1|p' | head -1) || true
        fi

        url="https://github.com/FREELABEL/iris-opencode/releases/download/v${specific_version}/$filename"

        if [[ -z "$specific_version" ]]; then
            echo -e "${RED}Failed to fetch version information${NC}"
            echo -e "${MUTED}Check your internet connection or install a specific version:${NC}"
            # Do NOT name a version here. This line used to say 1.1.6 — an ancient build —
            # and on 2026-08-27 a client followed it verbatim and installed that, because a
            # hardcoded example in an error message reads as a recommendation. Point at the
            # list instead, which cannot go stale.
            echo -e "${MUTED}  Pick a version from https://github.com/FREELABEL/iris-opencode/releases${NC}"
            echo -e "${MUTED}  curl -fsSL https://heyiris.io/install-code | bash -s -- --version <version>${NC}"
            exit 1
        fi
    else
        # Strip leading 'v' if present
        requested_version="${requested_version#v}"
        url="https://github.com/FREELABEL/iris-opencode/releases/download/v${requested_version}/$filename"
        specific_version=$requested_version

        # Verify the release exists before downloading
        http_status=$(curl -sI -o /dev/null -w "%{http_code}" "https://github.com/FREELABEL/iris-opencode/releases/tag/v${requested_version}")
        if [ "$http_status" = "404" ]; then
            echo -e "${RED}Error: Release v${requested_version} not found${NC}"
            echo -e "${MUTED}Available releases: https://github.com/FREELABEL/iris-opencode/releases${NC}"
            exit 1
        fi
    fi
fi

print_message() {
    local level=$1
    local message=$2
    local color=""

    case $level in
        info) color="${NC}" ;;
        warning) color="${NC}" ;;
        error) color="${RED}" ;;
    esac

    echo -e "${color}${message}${NC}"
}

check_version() {
    if [ -f "$INSTALL_DIR/iris" ]; then
        print_message info "${MUTED}Updating IRIS CLI to ${NC}$specific_version${MUTED}...${NC}"
    fi
}

unbuffered_sed() {
    if echo | sed -u -e "" >/dev/null 2>&1; then
        sed -nu "$@"
    elif echo | sed -l -e "" >/dev/null 2>&1; then
        sed -nl "$@"
    else
        local pad="$(printf "\n%512s" "")"
        sed -ne "s/$/\\${pad}/" "$@"
    fi
}

print_progress() {
    local bytes="$1"
    local length="$2"
    [ "$length" -gt 0 ] || return 0

    local width=50
    local percent=$(( bytes * 100 / length ))
    [ "$percent" -gt 100 ] && percent=100
    local on=$(( percent * width / 100 ))
    local off=$(( width - on ))

    local filled=$(printf "%*s" "$on" "")
    filled=${filled// /■}
    local empty=$(printf "%*s" "$off" "")
    empty=${empty// /･}

    printf "\r${ORANGE}%s%s %3d%%${NC}" "$filled" "$empty" "$percent" >&4
}

download_with_progress() {
    local url="$1"
    local output="$2"

    if [ -t 2 ]; then
        exec 4>&2
    else
        exec 4>/dev/null
    fi

    local tmp_dir=${TMPDIR:-/tmp}
    local basename="${tmp_dir}/iris_install_$$"
    local tracefile="${basename}.trace"

    rm -f "$tracefile"
    mkfifo "$tracefile"

    # Hide cursor
    printf "\033[?25l" >&4

    trap "trap - RETURN; rm -f \"$tracefile\"; printf '\033[?25h' >&4; exec 4>&-" RETURN

    (
        curl --trace-ascii "$tracefile" -s -L -o "$output" "$url"
    ) &
    local curl_pid=$!

    unbuffered_sed \
        -e 'y/ACDEGHLNORTV/acdeghlnortv/' \
        -e '/^0000: content-length:/p' \
        -e '/^<= recv data/p' \
        "$tracefile" | \
    {
        local length=0
        local bytes=0

        while IFS=" " read -r -a line; do
            [ "${#line[@]}" -lt 2 ] && continue
            local tag="${line[0]} ${line[1]}"

            if [ "$tag" = "0000: content-length:" ]; then
                length="${line[2]}"
                length=$(echo "$length" | tr -d '\r')
                bytes=0
            elif [ "$tag" = "<= recv" ]; then
                local size="${line[3]}"
                bytes=$(( bytes + size ))
                if [ "$length" -gt 0 ]; then
                    print_progress "$bytes" "$length"
                fi
            fi
        done
    }

    wait $curl_pid
    local ret=$?
    echo "" >&4
    return $ret
}

download_and_install() {
    print_message info "\n${MUTED}Installing ${NC}IRIS CLI ${MUTED}version: ${NC}$specific_version"
    local tmp_dir
    tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/iris_install_XXXXXX")

    if [[ "$os" == "windows" ]] || ! [ -t 2 ]; then
        # Non-TTY or Windows: use standard curl progress
        curl -# -L -o "$tmp_dir/$filename" "$url"
    elif ! download_with_progress "$url" "$tmp_dir/$filename"; then
        # Custom progress failed — only fallback if file wasn't already downloaded
        if [ ! -s "$tmp_dir/$filename" ]; then
            curl -# -L -o "$tmp_dir/$filename" "$url"
        fi
    fi

    # Verify the download succeeded and isn't an HTML error page
    if [ ! -s "$tmp_dir/$filename" ]; then
        echo -e "${RED}Error: Download failed — file is empty${NC}"
        echo -e "${MUTED}The binary for your platform (${target}) may not be available in this release.${NC}"
        echo -e "${MUTED}Check available assets: https://github.com/FREELABEL/iris-opencode/releases/tag/v${specific_version}${NC}"
        rm -rf "$tmp_dir"
        exit 1
    fi

    # Check if we got an HTML error page instead of a real binary
    if head -c 15 "$tmp_dir/$filename" | grep -qi '<!doctype\|<html'; then
        echo -e "${RED}Error: Download returned an error page instead of the binary${NC}"
        echo -e "${MUTED}The binary for your platform (${target}) is not available in release v${specific_version}.${NC}"
        echo -e "${MUTED}Check available assets: https://github.com/FREELABEL/iris-opencode/releases/tag/v${specific_version}${NC}"
        rm -rf "$tmp_dir"
        exit 1
    fi

    # Verify the download against the checksum published beside it (#185158).
    #
    # The two guards above catch an EMPTY file and an HTML error page. Neither can see a
    # download that succeeded and is simply the wrong or altered bytes, and `set -euo
    # pipefail` cannot either: it only catches what makes a tool exit non-zero. Measured
    # on a deliberately undersized volume, unzip returns 50 and nothing installs -- that
    # path is fine. A complete transfer of the wrong build exits 0 everywhere.
    #
    # Not hypothetical in this repo: the desktop app shipped its own opencode sidecar as
    # `iris` for two weeks (#183738), and nothing between the release and the user asked
    # what the bytes were.
    #
    # A MISSING checksum is reported, not silently skipped. Releases before this existed
    # have none, so failing closed would break every install of an older version -- but a
    # skip nobody is told about is how "verified" quietly becomes decorative. Say which
    # one happened.
    checksum_url="${url}.sha256"
    if curl -fsSL --max-time 30 -o "$tmp_dir/$filename.sha256" "$checksum_url" 2>/dev/null \
       && [ -s "$tmp_dir/$filename.sha256" ]; then
        _sum_cmd=""
        if command -v sha256sum >/dev/null 2>&1; then _sum_cmd="sha256sum"
        elif command -v shasum >/dev/null 2>&1; then _sum_cmd="shasum -a 256"; fi
    
        if [ -z "$_sum_cmd" ]; then
            echo -e "${ORANGE}Warning: a checksum was published but neither sha256sum nor shasum is installed.${NC}"
            echo -e "${MUTED}  The download was NOT verified. Install coreutils to enable this check.${NC}"
        else
            # The published file holds the basename, so verify from inside tmp_dir.
            _want=$(cut -d" " -f1 < "$tmp_dir/$filename.sha256" | tr -d "[:space:]")
            _got=$(cd "$tmp_dir" && $_sum_cmd "$filename" | cut -d" " -f1 | tr -d "[:space:]")
            if [ -z "$_want" ] || [ -z "$_got" ]; then
                echo -e "${RED}Error: could not compute or read a checksum (want='${_want}' got='${_got}').${NC}"
                echo -e "${MUTED}  Refusing to install unverified bytes. Re-run to try again.${NC}"
                rm -rf "$tmp_dir"
                exit 1
            fi
            if [ "$_want" != "$_got" ]; then
                echo -e "${RED}Error: CHECKSUM MISMATCH - refusing to install.${NC}"
                echo -e "${MUTED}  expected ${_want}${NC}"
                echo -e "${MUTED}  actual   ${_got}${NC}"
                echo -e "${MUTED}  These bytes are not the ones this release published. Do not use them.${NC}"
                echo -e "${MUTED}  Retry the install; if it persists, report it with the two digests above.${NC}"
                rm -rf "$tmp_dir"
                exit 1
            fi
            echo -e "${MUTED}  checksum verified (sha256 ${_got})${NC}"
        fi
    else
        echo -e "${MUTED}  no checksum published for this release - integrity NOT verified${NC}"
    fi

    if [ "$os" = "linux" ]; then
        tar -xzf "$tmp_dir/$filename" -C "$tmp_dir"
    else
        unzip -q "$tmp_dir/$filename" -d "$tmp_dir"
    fi

    mv "$tmp_dir/iris" "$INSTALL_DIR"
    chmod 755 "${INSTALL_DIR}/iris"
    # Ad-hoc sign on macOS so Gatekeeper doesn't SIGKILL the binary (exit 137)
    if [ "$(uname -s)" = "Darwin" ] && command -v codesign >/dev/null 2>&1; then
        codesign --force --deep --sign - "${INSTALL_DIR}/iris" 2>/dev/null || true
    fi
    rm -rf "$tmp_dir"
    # Ask the path what it is now. See verify_installed_cli above for why a copy that
    # exited 0 is not evidence that the product is installed.
    verify_installed_cli || exit 1
}

# ─── Post-install read-back: did we install THE PRODUCT, or just a file? ──────
#
# A GREEN EXIT IS NOT A LANDING. Until 2026-09-13 nothing in this script ever ran the
# binary it had just written, so "IRIS CLI installed" was a claim about a copy operation,
# not about a working CLI. Three ways that goes wrong, none of which the old checks could
# see:
#
#   1. `codesign ... || true` above. If ad-hoc signing fails on macOS, Gatekeeper SIGKILLs
#      the binary on every run (exit 137) — and the `|| true` is deliberate, so the failure
#      is invisible. The user gets an `iris` that dies instantly and an installer that said
#      it succeeded.
#   2. The release can serve the WRONG binary. Nothing published is checksummed (there are
#      zero sha/sig assets on the release), so a complete download of the wrong build
#      installs silently. This is not hypothetical: the desktop app shipped its own
#      opencode sidecar as `iris` for two weeks (#183738, #184861).
#   3. `check_version()` tests `[ -f "$INSTALL_DIR/iris" ]`. A 216-module platform CLI and a
#      core-only sidecar are the same answer to that question.
#
# The desktop app grew exactly this read-back in cli.rs (`cli_state()`) when the sidecar bug
# was fixed. The installer — which is what EVERY new user runs — did not get it. This closes
# that asymmetry.
#
# Matched on stdout AND stderr joined, on purpose: the real CLI prints help to stdout and
# the upstream sidecar prints it to stderr, so a stdout-only check would pass today for a
# reason unrelated to what is being asked.
verify_installed_cli() {
    local bin="${INSTALL_DIR}/iris"

    if [ ! -x "$bin" ]; then
        echo -e "${RED}Install failed:${NC} nothing executable at $bin"
        echo -e "${MUTED}  The copy step reported success but left no runnable binary.${NC}"
        return 1
    fi

    local help rc
    help="$("$bin" --help 2>&1 </dev/null || true)"
    rc=$?

    # 137 = SIGKILL, which on macOS is Gatekeeper rejecting an unsigned binary. Name it,
    # because "it just quits" sends people to the wrong place entirely.
    if [ -z "$help" ]; then
        echo -e "${RED}Install failed:${NC} the installed binary produced no output at all."
        if [ "$(uname -s)" = "Darwin" ]; then
            echo -e "${MUTED}  On macOS this is usually Gatekeeper killing an unsigned binary (SIGKILL/137).${NC}"
            echo -e "${MUTED}  Try: codesign --force --deep --sign - \"$bin\"${NC}"
        fi
        return 1
    fi

    # Two independent markers, so renaming one command group cannot condemn a healthy install.
    # Here-strings, not `echo | grep -q`: under `set -o pipefail` grep -q exits on its first match,
    # echo can then die of SIGPIPE, and the pipeline FAILS on a correct binary. Measured: 1 in 30
    # runs on a fresh Ubuntu VM, which aborted a whole install (#192964 R3).
    if grep -qi atlas <<<"$help" && grep -qi bloq <<<"$help"; then
        return 0
    fi

    echo -e "${RED}Install failed:${NC} the binary at $bin runs, but it is NOT the IRIS platform CLI."
    echo -e "${MUTED}  It is missing the platform command surface (no atlas, no bloq).${NC}"
    echo -e "${MUTED}  This is almost always the desktop app's bundled sidecar written over your CLI.${NC}"
    echo -e "${MUTED}  Report it against bug #183738 and do not use this binary.${NC}"
    return 1
}

install_from_binary() {
    print_message info "\n${MUTED}Installing ${NC}IRIS CLI ${MUTED}from: ${NC}$binary_path"
    cp "$binary_path" "${INSTALL_DIR}/iris"
    chmod 755 "${INSTALL_DIR}/iris"
    # Ad-hoc sign on macOS so Gatekeeper doesn't SIGKILL the binary (exit 137)
    if [ "$(uname -s)" = "Darwin" ] && command -v codesign >/dev/null 2>&1; then
        codesign --force --deep --sign - "${INSTALL_DIR}/iris" 2>/dev/null || true
    fi
    # --binary is the flag that caused #183738: the desktop app pointed it at its own
    # opencode sidecar and overwrote the product on every launch. The app no longer passes
    # it, but the flag still exists and anyone can hand it the wrong file — so this path
    # needs the read-back MORE than the download path, not less.
    verify_installed_cli || exit 1
}

if [ "$only_docs_mode" = "true" ]; then
    print_message info "${MUTED}Mode: --only-docs (refreshing IRIS docs, skipping binary install)${NC}"
    # Skip binary install. The --only-docs flag also disables every other
    # component except 4b (scaffold_iris_docs), so the script flows naturally
    # through the rest, runs 4b, and exits at the bottom.
elif [ -n "$binary_path" ]; then
    install_from_binary
else
    check_version
    download_and_install
fi


# ─── PATH setup (env file pattern, like Rust/Bun) ────────────────────────────
# Create ~/.iris/env — a single sourceable file that sets up PATH.
# Then add `source ~/.iris/env` to the user's shell config.

IRIS_ENV_FILE="$HOME/.iris/env"

current_shell=$(basename "$SHELL")

if [ "$current_shell" = "fish" ]; then
    cat > "$IRIS_ENV_FILE" << 'ENVF'
# IRIS CLI PATH setup (sourced by your shell config)
if not contains "$HOME/.iris/bin" $PATH
    set -gx PATH "$HOME/.iris/bin" $PATH
end
ENVF
else
    cat > "$IRIS_ENV_FILE" << 'ENVF'
# IRIS CLI PATH setup (sourced by your shell config)
case ":${PATH}:" in
    *:"$HOME/.iris/bin":*) ;;
    *) export PATH="$HOME/.iris/bin:$PATH" ;;
esac
ENVF
fi

# Source it now so iris works in the current session
. "$IRIS_ENV_FILE"

# Add source line to shell config (if not already there)
if [[ "$no_modify_path" != "true" ]]; then
    XDG_CONFIG_HOME=${XDG_CONFIG_HOME:-$HOME/.config}

    # Which files get the source line. EVERY one listed, not the first that exists (#184675).
    # The old loop stopped at ~/.zshrc, which only INTERACTIVE zsh reads — so `zsh -c`, login
    # shells, launchd, cron and GUI-launched MCP clients never had iris on PATH. ~/.zshenv is
    # read by every zsh. For bash: ~/.bashrc (interactive) plus the login file — but never create
    # ~/.bash_profile beside an existing ~/.profile, which would stop bash reading ~/.profile.
    # Files marked "!" are created if missing; the rest are only written if they already exist.
    case $current_shell in
        fish) config_files="!$HOME/.config/fish/config.fish" ;;
        zsh)  config_files="!$HOME/.zshenv $HOME/.zshrc" ;;
        bash)
            if [[ -f "$HOME/.bash_profile" ]]; then login_file="$HOME/.bash_profile"; else login_file="$HOME/.profile"; fi
            config_files="!$HOME/.bashrc !$login_file" ;;
        *)    config_files="!$HOME/.profile $HOME/.bashrc" ;;
    esac

    if [ "$current_shell" = "fish" ]; then
        source_line="source \"$IRIS_ENV_FILE\""
    else
        source_line=". \"$HOME/.iris/env\""
    fi

    for entry in $config_files; do
        config_file="${entry#!}"
        if [[ ! -f "$config_file" ]]; then
            [[ "$entry" == !* ]] || continue
            mkdir -p "$(dirname "$config_file")" 2>/dev/null
            touch "$config_file" 2>/dev/null || continue
        fi
        if ! grep -q "\.iris/env" "$config_file" 2>/dev/null; then
            echo "" >> "$config_file"
            echo "# IRIS CLI" >> "$config_file"
            echo "$source_line" >> "$config_file"
        fi
    done
fi

# Persist a directory on PATH for FUTURE shells by appending to ~/.iris/env — the one
# sourceable file the block above already wired into the user's shell config.
#
# #184930: install_node used to end with `add_to_path "$config_file" ... 2>/dev/null || true`.
# No function of that name has ever existed in this script — grep found exactly one hit in
# 3,011 lines, the call itself — and the redirect swallowed "command not found". So a fresh
# install put Node on PATH for the installer's own session and nowhere else: the daemon then
# died on the next reboot with `node` not found, while `iris-daemon start` still reported
# success. ("$config_file" was also unbound under `set -u` whenever --no-modify-path was
# passed, so the dead call had a second way to fail.)
#
# Appending here rather than editing .zshrc again on purpose: a second writer to shell
# configs is how the first one stops being trustworthy. One mechanism, one file.
persist_path_in_iris_env() {
    local dir="$1"

    if [ ! -f "$IRIS_ENV_FILE" ]; then
        print_message warning "Could not put $dir on PATH: $IRIS_ENV_FILE is missing."
        print_message info "  Add this to your shell config by hand: export PATH=\"$dir:\$PATH\""
        return 1
    fi

    if grep -qF "$dir" "$IRIS_ENV_FILE" 2>/dev/null; then
        return 0
    fi

    if [ "$current_shell" = "fish" ]; then
        {
            printf '\n'
            printf 'if not contains "%s" $PATH\n' "$dir"
            printf '    set -gx PATH "%s" $PATH\n' "$dir"
            printf 'end\n'
        } >> "$IRIS_ENV_FILE" 2>/dev/null || true
    else
        {
            printf '\n'
            printf 'case ":${PATH}:" in\n'
            printf '    *:"%s":*) ;;\n' "$dir"
            printf '    *) export PATH="%s:$PATH" ;;\n' "$dir"
            printf 'esac\n'
        } >> "$IRIS_ENV_FILE" 2>/dev/null || true
    fi

    # Read it back. The append is the claim; this is the observation.
    if ! grep -qF "$dir" "$IRIS_ENV_FILE" 2>/dev/null; then
        print_message warning "Could not write PATH setup to $IRIS_ENV_FILE."
        print_message info "  Add this to your shell config by hand: export PATH=\"$dir:\$PATH\""
        return 1
    fi

    # --no-modify-path means nothing sources ~/.iris/env automatically, so the line above
    # is inert for new shells. Say so rather than letting the user find out at reboot.
    if [ "$no_modify_path" = "true" ]; then
        print_message warning "--no-modify-path: $dir is on PATH for this session only."
        print_message info "  Add \`. \"$IRIS_ENV_FILE\"\` to your shell config to make it permanent."
        return 1
    fi

    return 0
}

# ─── Node.js ──────────────────────────────────────────────────────────────────
#
# The Hive bridge/daemon needs Node. This script never installed it, never checked for it,
# and never mentioned it — `grep -ic node install` returned 0 — so the dependency surfaced
# later, from a different component, as "bridge daemon still needs installing" with no hint
# that Node was the reason.
#
# What a client actually did on a new Mac, 2026-08-30, after this script said SUCCESS:
#   try brew -> "no pre-built node for this setup" -> download the official binary by hand
#   -> permission error writing under /usr/local -> node finally detected -> re-run installer
# Six improvised steps on a paid product, for a dependency we know we need.
#
# Deliberately NOT brew: it is absent on plenty of Macs, and "no pre-built bottle for this
# setup" is precisely what sent that user to a manual download. The official tarball works
# everywhere and pins the version.
#
# Deliberately into $HOME: the permission error above came from targeting a system path.
# Nothing here needs sudo, and an installer that asks for it on first run is one people quit.
NODE_VERSION="22.11.0"
NODE_ROOT="$HOME/.iris/runtime"
NODE_HOME="$NODE_ROOT/node-v$NODE_VERSION-$os-$arch"

node_ok() {
    command -v node >/dev/null 2>&1 || return 1
    # v18 is the floor the bridge needs; an ancient node is worse than none because it fails
    # deep inside npm rather than here.
    node_major=$(node -p "process.versions.node.split('.')[0]" 2>/dev/null || echo 0)
    [ "$node_major" -ge 18 ] 2>/dev/null
}

install_node() {
    case "$os" in
        darwin|linux) ;;
        *) print_message warning "Skipping Node install on $os — install Node 18+ manually."; return 1 ;;
    esac

    if [ -x "$NODE_HOME/bin/node" ]; then
        export PATH="$NODE_HOME/bin:$PATH"
        # Re-runs land here. Persist on this path too: otherwise a second install over an
        # already-unpacked Node leaves future shells exactly as broken as the first one did.
        if node_ok; then
            persist_path_in_iris_env "$NODE_HOME/bin" || true
            return 0
        fi
    fi

    node_url="https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$os-$arch.tar.gz"
    print_message info "${MUTED}Installing Node ${NC}v$NODE_VERSION${MUTED} (needed by the Hive bridge)${NC}"

    mkdir -p "$NODE_ROOT" || { print_message warning "Could not create $NODE_ROOT"; return 1; }
    node_tmp=$(mktemp -d) || return 1
    if ! curl -fsSL "$node_url" -o "$node_tmp/node.tar.gz"; then
        print_message warning "Could not download Node from $node_url"
        rm -rf "$node_tmp"; return 1
    fi
    if ! tar -xzf "$node_tmp/node.tar.gz" -C "$NODE_ROOT"; then
        print_message warning "Could not unpack Node"
        rm -rf "$node_tmp"; return 1
    fi
    rm -rf "$node_tmp"

    export PATH="$NODE_HOME/bin:$PATH"
    if ! persist_path_in_iris_env "$NODE_HOME/bin"; then
        print_message warning "  Until then the Hive daemon will die on reboot: node will not be on PATH."
    fi
    node_ok
}

if node_ok; then
    print_message info "${MUTED}Node ${NC}$(node -v)${MUTED} already present${NC}"
elif install_node; then
    print_message info "${MUTED}Node ${NC}$(node -v)${MUTED} installed${NC}"
else
    # Fail LOUDLY rather than succeeding into a broken bridge. The whole reason this section
    # exists is that a missing dependency used to be discovered by a later, unrelated error.
    print_message warning "Node 18+ could not be installed automatically."
    print_message warning "The Hive bridge/daemon will not work until Node is available."
    print_message info "  Install it from https://nodejs.org and re-run this installer."
fi

# tmux — the daemon runs agent sessions inside it (173 references in the bridge).
# Same failure as Node: never installed, never checked, and the daemon does not test for it
# either — it simply exits code 1. A client hit this on 2026-08-31 immediately after the Node
# fix and had to read daemon logs to discover the cause.
#
# Unlike Node there is no official static tarball, so brew is the only sane automatic route.
# When brew is absent we FAIL LOUDLY naming tmux, rather than leaving a daemon that exits 1
# with no reason given.
ensure_tmux() {
    command -v tmux >/dev/null 2>&1 && return 0
    case "$os" in darwin|linux) ;; *) return 1 ;; esac
    if command -v brew >/dev/null 2>&1; then
        print_message info "${MUTED}Installing ${NC}tmux${MUTED} (needed by the Hive daemon)${NC}"
        brew install tmux >/dev/null 2>&1 || true
        command -v tmux >/dev/null 2>&1 && return 0
    fi
    if command -v apt-get >/dev/null 2>&1; then
        pkg_sudo apt-get install -y tmux >/dev/null 2>&1 || true
        command -v tmux >/dev/null 2>&1 && return 0
    fi
    return 1
}

if ensure_tmux; then
    print_message info "${MUTED}tmux ${NC}$(tmux -V 2>/dev/null | awk '{print $2}')${MUTED} present${NC}"
else
    print_message warning "tmux is not installed — the Hive daemon will exit immediately without it."
    print_message info "  macOS:  brew install tmux"
    print_message info "  Linux:  sudo apt-get install tmux"
fi

if [ -n "${GITHUB_ACTIONS-}" ] && [ "${GITHUB_ACTIONS}" == "true" ]; then
    echo "$INSTALL_DIR" >> $GITHUB_PATH
    print_message info "Added $INSTALL_DIR to \$GITHUB_PATH"
fi

# Add to PATH for current session
export PATH="$INSTALL_DIR:$PATH"

send_install_beacon "install_success" "cli"
print_message info "\n${GREEN}[1/7]${NC} IRIS CLI ${MUTED}..........................${NC} ${GREEN}installed${NC}"

# ─── Component 2: IRIS SDK / CLI ─────────────────────────────────────────────

install_sdk() {
    # SDK commands are now built into IRIS CLI (Node.js CLI) — no PHP required.
    # Preserve any existing .env from previous PHP SDK installs (contains auth tokens).
    local sdk_dir="$HOME/.iris/sdk"
    if [ -f "$sdk_dir/.env" ]; then
        mkdir -p "$sdk_dir"
    fi

    print_message info "${GREEN}[2/7]${NC} IRIS SDK ${MUTED}...........................${NC} ${GREEN}built-in${NC} ${MUTED}(no PHP required)${NC}"
}

if [ "$skip_sdk" = "false" ]; then
    install_sdk
else
    print_message info "${MUTED}[2/7] IRIS SDK .............................. skipped${NC}"
fi

# ─── Component 3: IRIS Desktop App ───────────────────────────────────────────

install_desktop_app() {
    # Desktop app is macOS only for now (Nativefier produces .app bundles)
    if [ "${os:-}" != "darwin" ]; then
        print_message info "${MUTED}[3/7] IRIS App .............................. skipped (macOS only)${NC}"
        return 0
    fi

    print_message info "${MUTED}Installing IRIS Desktop App...${NC}"

    local app_dir="$HOME/Applications"
    local app_path="$app_dir/IRIS.app"

    # Skip if already installed
    if [ -d "$app_path" ] || [ -d "/Applications/IRIS.app" ]; then
        print_message info "${GREEN}[3/7]${NC} IRIS App ${MUTED}...........................${NC} ${GREEN}already installed${NC}"
        return 0
    fi

    # Download the desktop app zip from GitHub releases
    local app_url="https://github.com/FREELABEL/iris-opencode/releases/latest/download/IRIS-app-darwin-${arch}.zip"
    local tmp_dir
    tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/iris_app_XXXXXX")

    if curl -sL --fail -o "$tmp_dir/IRIS-app.zip" "$app_url" 2>/dev/null; then
        mkdir -p "$app_dir"
        unzip -q "$tmp_dir/IRIS-app.zip" -d "$app_dir" 2>/dev/null || true
        rm -rf "$tmp_dir"

        if [ -d "$app_path" ]; then
            print_message info "${GREEN}[3/7]${NC} IRIS App ${MUTED}...........................${NC} ${GREEN}installed${NC}"
            print_message info "${MUTED}      Installed to ${NC}~/Applications/IRIS.app"
        else
            print_message info "${MUTED}[3/7] IRIS App .............................. download available at heyiris.io${NC}"
        fi
    else
        rm -rf "$tmp_dir"
        print_message info "${MUTED}[3/7] IRIS App .............................. download available at ${NC}https://heyiris.io/download"
    fi
}

if [ "$skip_app" = "false" ]; then
    install_desktop_app
else
    print_message info "${MUTED}[3/7] IRIS App .............................. skipped${NC}"
fi

# ─── Component 4: MCP Configuration Scaffold ─────────────────────────────────

scaffold_mcp_config() {
    local iris_config_dir="$HOME/.iris"
    local mcp_config="$iris_config_dir/mcp.json"
    local iris_bin="$HOME/.iris/bin/iris"

    mkdir -p "$iris_config_dir"

    # Reference scaffold (kept for documentation / manual setups). The real
    # wiring happens below via `iris mcp install`, which registers the server
    # into the MCP clients that actually consume it.
    if [ ! -f "$mcp_config" ]; then
        cat > "$mcp_config" << 'MCPEOF'
{
  "mcpServers": {
    "iris-local": {
      "_comment": "Local IRIS tools — filesystem, SDK, project setup",
      "command": "iris",
      "args": ["mcp", "serve"],
      "enabled": true
    },
    "iris-platform": {
      "_comment": "Remote IRIS platform — agents, integrations, workflows",
      "type": "remote",
      "url": "https://heyiris.io/api/mcp",
      "enabled": false
    }
  }
}
MCPEOF
    fi

    # Bug #150264: actually REGISTER the server into detected MCP clients
    # (Claude Code, Claude Desktop, Cursor, opencode) with an absolute binary
    # path, so GUI-launched clients (no login shell) can resolve it. Without
    # this, ~/.iris/mcp.json is a dead file no client reads.
    if [ -x "$iris_bin" ]; then
        if "$iris_bin" mcp install >/dev/null 2>&1; then
            print_message info "${GREEN}[4/7]${NC} MCP Config ${MUTED}.........................${NC} ${GREEN}registered with clients${NC}"
            print_message info "${MUTED}      Verify with ${NC}iris mcp list${MUTED} · restart your editor to load IRIS tools${NC}"
            return 0
        fi
    fi

    # Fallback: binary missing or registration failed — scaffold only.
    print_message info "${GREEN}[4/7]${NC} MCP Config ${MUTED}.........................${NC} ${GREEN}scaffolded${NC}"
    print_message info "${MUTED}      Run ${NC}iris mcp install${MUTED} to register IRIS with your editor${NC}"
}

if [ "$skip_mcp" = "false" ]; then
    scaffold_mcp_config
else
    print_message info "${MUTED}[4/7] MCP Config ............................ skipped${NC}"
fi

# ─── Component 4b: IRIS docs scaffold (AGENTS.md + how-to/ recipes) ─────────
#
# Fetches the manifest + scaffold files from the public iris-code repo and
# writes them under ~/.iris/. The agent reads ~/.iris/AGENTS.md every session
# (see packages/opencode/src/session/system.ts) and uses ~/.iris/how-to/*.md
# as on-demand recipes for IRIS-specific workflows.
#
# Source of truth: https://github.com/FREELABEL/iris-opencode/tree/dev/scaffold/
# Updating recipes is a PR against that directory — no binary release needed.

# Base URL for fetching scaffold files. Defaults to GitHub raw (always works
# since the repo is public). When heyiris.io/docs/scaffold/ is verified to
# serve these files, flip this single constant to switch to the brand URL.
IRIS_SCAFFOLD_BASE_URL="${IRIS_SCAFFOLD_BASE_URL:-https://raw.githubusercontent.com/FREELABEL/iris-opencode/main/scaffold}"

# Embedded fallback AGENTS.md — used only when both the network fetch and the
# heyiris.io fallback fail. Bare-minimum identity so the agent still knows it
# is IRIS even on an air-gapped install.
write_embedded_fallback_agents_md() {
    local dest="$1"
    cat > "$dest" << 'EMBEDDEDEOF'
# IRIS CLI (offline fallback)

You are running inside the IRIS CLI — an AI coding assistant from the IRIS
platform (heyiris.io). The full rule file and how-to recipes could not be
fetched from GitHub during install (likely a network issue). To get them:

  1. Restore network access
  2. Run: ~/.iris/bin/iris install --only-docs
     (or re-run the original install command)

## Commands you can use right now

- `iris-login` — authenticate
- `iris-daemon start|stop|status` — local Hive daemon
- `iris hive` — distributed compute mesh
- `iris platform-*` — chat, agents, leads, workflows, bloqs, pages, contracts
- `iris mcp serve` — expose IRIS as an MCP server
- `iris --help` — full command tree

By default, assume the user is working in their own project, not on IRIS
source code. Read existing code before suggesting changes.
EMBEDDEDEOF
}

# Fetch a single file from $IRIS_SCAFFOLD_BASE_URL/$1 to $2.
# Returns 0 on success, 1 on failure.
fetch_scaffold_file() {
    local src="$1"
    local dest="$2"
    local url="${IRIS_SCAFFOLD_BASE_URL}/${src}"
    local tmp
    tmp=$(mktemp 2>/dev/null) || return 1

    if curl -fsSL --max-time 15 "$url" -o "$tmp" 2>/dev/null; then
        # sanity-check: file is non-empty
        if [ -s "$tmp" ]; then
            mkdir -p "$(dirname "$dest")"
            mv "$tmp" "$dest"
            return 0
        fi
    fi
    rm -f "$tmp"
    return 1
}

# Parse the JSON manifest with a 3-tier fallback chain (jq → python3 → sed).
# Echoes one "src|dest" pair per line.
parse_manifest_entries() {
    local manifest="$1"

    if command -v jq >/dev/null 2>&1; then
        jq -r '.files[] | "\(.src)|\(.dest)"' "$manifest"
        return $?
    fi

    if command -v python3 >/dev/null 2>&1; then
        python3 -c "
import json, sys
with open('$manifest') as f:
    data = json.load(f)
for entry in data.get('files', []):
    print(f\"{entry['src']}|{entry['dest']}\")
" 2>/dev/null
        return $?
    fi

    # Last-resort sed parser. Assumes manifest.json is pretty-printed (it is).
    # Pulls "src": "..." and "dest": "..." pairs in order.
    awk '
        /"src"[[:space:]]*:/ {
            match($0, /"src"[[:space:]]*:[[:space:]]*"[^"]*"/)
            s = substr($0, RSTART, RLENGTH)
            sub(/.*: *"/, "", s); sub(/"$/, "", s)
            src = s
        }
        /"dest"[[:space:]]*:/ {
            match($0, /"dest"[[:space:]]*:[[:space:]]*"[^"]*"/)
            d = substr($0, RSTART, RLENGTH)
            sub(/.*: *"/, "", d); sub(/"$/, "", d)
            print src "|" d
        }
    ' "$manifest"
}

scaffold_iris_docs() {
    local iris_dir="$HOME/.iris"
    local manifest_local="$iris_dir/.manifest.json"
    mkdir -p "$iris_dir"

    print_message info "${MUTED}      Fetching scaffold from ${NC}${IRIS_SCAFFOLD_BASE_URL}"

    # Step 1: fetch the manifest
    if ! fetch_scaffold_file "manifest.json" "$manifest_local"; then
        print_message warning "${ORANGE}[4b]${NC}  IRIS Docs ${MUTED}..........................${NC} ${ORANGE}fetch failed${NC}"
        print_message info "${MUTED}      Writing embedded fallback AGENTS.md${NC}"
        write_embedded_fallback_agents_md "$iris_dir/AGENTS.md"
        bridge_legacy_agents_md "$iris_dir/AGENTS.md"
        return 0
    fi

    # Step 2: parse manifest and fetch each file
    local total=0
    local fetched=0
    local failed=0

    while IFS='|' read -r src dest; do
        [ -z "$src" ] && continue
        total=$((total + 1))
        local target="$iris_dir/$dest"

        if fetch_scaffold_file "$src" "$target"; then
            fetched=$((fetched + 1))
        else
            failed=$((failed + 1))
            print_message warning "${MUTED}      ✗ ${NC}$src${MUTED} → fetch failed${NC}"
        fi
    done < <(parse_manifest_entries "$manifest_local")

    if [ "$total" -eq 0 ]; then
        print_message warning "${ORANGE}[4b]${NC}  IRIS Docs ${MUTED}..........................${NC} ${ORANGE}manifest empty${NC}"
        write_embedded_fallback_agents_md "$iris_dir/AGENTS.md"
        bridge_legacy_agents_md "$iris_dir/AGENTS.md"
        return 0
    fi

    # Step 3: ensure AGENTS.md exists no matter what (use embedded if fetch failed)
    if [ ! -f "$iris_dir/AGENTS.md" ]; then
        write_embedded_fallback_agents_md "$iris_dir/AGENTS.md"
    fi

    # Step 4: dual-write bridge — also copy AGENTS.md to the legacy opencode XDG
    # path so binaries that predate the ~/.iris/AGENTS.md reader (system.ts
    # GLOBAL_RULE_FILES update) still pick up IRIS identity. New binaries prefer
    # ~/.iris/AGENTS.md and treat this copy as a no-op fallback. Safe to remove
    # once all clients are on the new binary release.
    bridge_legacy_agents_md "$iris_dir/AGENTS.md"

    print_message info "${GREEN}[4b]${NC}  IRIS Docs ${MUTED}..........................${NC} ${GREEN}${fetched}/${total} files${NC}"
    print_message info "${MUTED}      Installed at ${NC}~/.iris/AGENTS.md${MUTED} + ${NC}~/.iris/how-to/"
}

# Bridge the IRIS AGENTS.md to the legacy opencode XDG location used by older
# binaries. Only overwrites if the legacy file is missing OR was written by a
# previous IRIS install (detected by an "IRIS CLI" marker line). NEVER clobbers
# a user's hand-written customization.
bridge_legacy_agents_md() {
    local src="$1"
    [ -f "$src" ] || return 0

    local legacy_dir="${XDG_CONFIG_HOME:-$HOME/.config}/opencode"
    local legacy_file="$legacy_dir/AGENTS.md"

    if [ -f "$legacy_file" ] && ! grep -q "IRIS CLI" "$legacy_file" 2>/dev/null; then
        # User-customized file (no IRIS marker) — leave it alone
        print_message info "${MUTED}      Legacy XDG AGENTS.md is user-customized; not overwriting${NC}"
        return 0
    fi

    mkdir -p "$legacy_dir"
    cp "$src" "$legacy_file"
    print_message info "${MUTED}      Bridged to ${NC}$legacy_file${MUTED} (for legacy binaries)${NC}"
}

if [ "$skip_agents_md" = "false" ]; then
    scaffold_iris_docs
else
    print_message info "${MUTED}[4b]  IRIS Docs ........................... skipped${NC}"
fi

# ─── Component 5: Coding Agent Bridge + Hive Daemon ─────────────────────────

# ─── Fetch the daemon source WITHOUT git ─────────────────────────────────────
#
# Git was a hard prerequisite and only ever moved bytes: clone on install, pull on
# update. Nothing read the history. A client without Git got no Hive node at all.
#
# Git IS still needed at RUNTIME by two features (reference-repo indexing and
# exchange/bounty tasks) — those name it themselves when it is missing. This only
# stops it blocking an install that would otherwise work.
#
# Stages into a temp dir and only then moves into place, so a failed download leaves
# an existing install exactly as it was. The old code `rm -rf`'d first and re-cloned,
# which turned a network blip into a wiped node_modules.
BRIDGE_FETCH_ERROR=""
fetch_daemon_source() {
    fetch_repo_archive \
        "${IRIS_DAEMON_ARCHIVE_URL:-https://github.com/FREELABEL/iris-daemon/archive/refs/heads/main.tar.gz}" \
        "$1" "daemon.js"
}

# url, dest, sentinel — the file that must exist in the archive for it to be the
# right thing. A 200 that serves an error page is still a 200.
fetch_repo_archive() {
    local url="$1"
    local dest="$2"
    local sentinel="$3"
    local tmp; tmp="$(mktemp -d 2>/dev/null)" || { BRIDGE_FETCH_ERROR="could not create a temp directory"; return 1; }
    BRIDGE_FETCH_ERROR=""

    if ! curl -fsSL --max-time 180 "$url" -o "$tmp/daemon.tar.gz" 2>/dev/null; then
        BRIDGE_FETCH_ERROR="could not download $url"
        rm -rf "$tmp"; return 1
    fi
    if ! tar -xzf "$tmp/daemon.tar.gz" -C "$tmp" 2>/dev/null; then
        BRIDGE_FETCH_ERROR="the downloaded archive could not be extracted"
        rm -rf "$tmp"; return 1
    fi

    # GitHub wraps the tree in one <repo>-<branch> directory.
    local root; root="$(find "$tmp" -mindepth 1 -maxdepth 1 -type d | head -1)"
    # A 200 that serves an error page is still a 200. Refuse anything that is not the
    # daemon rather than overwriting a working install with it.
    if [ -z "$root" ] || [ ! -f "$root/$sentinel" ]; then
        BRIDGE_FETCH_ERROR="the downloaded archive has no $sentinel — refusing to overwrite the install"
        rm -rf "$tmp"; return 1
    fi

    # The exact commit this archive is: GitHub writes it into the tar header (comment=<sha>).
    # Without it a tarball install reports "commit unknown", and an old .git kept from a clone
    # install reports a STALE commit (#191480). `|| true`: set -euo pipefail, and head closes early.
    local commit; commit="$( (gzip -dc "$tmp/daemon.tar.gz" 2>/dev/null | head -c 4096 | LC_ALL=C grep -aoE 'comment=[0-9a-f]{40}' | head -1 | cut -d= -f2) || true)"
    [ -n "$commit" ] && printf '%s\n' "$commit" > "$root/.iris-commit"

    mkdir -p "$dest"
    # Remove only what the repo owns. node_modules, logs, .git from older clone-based
    # installs, and .env belong to the machine.
    local keep
    for entry in "$dest"/* "$dest"/.[!.]*; do
        [ -e "$entry" ] || continue
        keep=0
        case "$(basename "$entry")" in
            node_modules|daemon.log|bridge.log|test-results|.git|.env) keep=1 ;;
        esac
        [ "$keep" -eq 1 ] || rm -rf "$entry"
    done

    cp -R "$root"/. "$dest"/ 2>/dev/null || { BRIDGE_FETCH_ERROR="could not copy the daemon into $dest"; rm -rf "$tmp"; return 1; }
    rm -rf "$tmp"
    return 0
}

install_bridge() {
    # Requires Node.js
    if ! command -v node >/dev/null 2>&1; then
        print_message info "${MUTED}[5/7] Agent Bridge .......................... skipped (Node.js not found)${NC}"
        print_message info "${MUTED}      Install Node.js to enable: ${NC}https://nodejs.org"
        return 0
    fi

    print_message info "${MUTED}Installing IRIS Bridge + Hive Daemon...${NC}"

    local bridge_dir="$HOME/.iris/bridge"
    local bridge_updated=false

    # NO GIT — one path for install and update.
    #
    # This was three paths: `git pull`, a `rm -rf` + re-clone when the pull failed, and
    # another `rm -rf` + re-clone when daemon.js still held a stale DigitalOcean URL.
    # Each `rm -rf "$bridge_dir"` also destroyed node_modules and daemon.log, so the
    # recovery path was the expensive one. And the whole thing needed Git, which was
    # only ever moving bytes — nothing read the history.
    if [ -f "$bridge_dir/daemon.js" ]; then
        bridge_updated=true
        print_message info "${MUTED}Bridge already installed, updating...${NC}"
    fi

    if ! fetch_daemon_source "$bridge_dir"; then
        print_message info "${MUTED}[5/7] Agent Bridge .......................... could not download${NC}"
        print_message info "${MUTED}      ${NC}${BRIDGE_FETCH_ERROR:-the daemon archive could not be downloaded}"
        return 0
    fi

    if ! (cd "$bridge_dir" && npm install --production --silent 2>/dev/null); then
        if [ "$(uname -s)" = "Linux" ]; then
            # #192964 R3, measured on a fresh Ubuntu 24.04 cloud image: node-pty has no linux-x64
            # prebuild, so npm falls back to node-gyp, which needs make/g++ — absent on a fresh VM.
            # npm then installs NOTHING: no pusher-js, no express. The daemon heartbeats once (the
            # hub shows it "online") and then fails every cloud connect on "Cannot find module
            # 'pusher-js'", without ever serving /health. Retry without install scripts: every
            # package lands, and only native builds are skipped. node-pty's one user
            # (daemon/ssh-share.js) falls back to a plain shell without it.
            print_message warning "${ORANGE}npm install failed (a native module could not be built — no compiler here). Retrying without native builds...${NC}"
            (cd "$bridge_dir" && npm install --production --silent --ignore-scripts 2>/dev/null) || {
                print_message warning "${ORANGE}npm install had issues — bridge may need manual setup${NC}"
            }
        else
            print_message warning "${ORANGE}npm install had issues — bridge may need manual setup${NC}"
        fi
    fi
    if [ ! -d "$bridge_dir/node_modules/dotenv" ]; then
        print_message warning "${ORANGE}Bridge dependencies incomplete. Run: cd ~/.iris/bridge && npm install${NC}"
    fi

    # Create bridgectl convenience script
    cat > "$bridge_dir/bridgectl" << 'BCTL'
#!/usr/bin/env bash
BRIDGE_DIR="$(cd "$(dirname "$0")" && pwd)"
case "${1:-status}" in
    start)
        PID=$(lsof -ti :3200 2>/dev/null || true)
        if [ -n "$PID" ]; then echo "Bridge already running (PID: $PID)"; exit 0; fi
        nohup node "$BRIDGE_DIR/index.js" > "$BRIDGE_DIR/bridge.log" 2>&1 &
        sleep 2
        if curl -s "http://localhost:3200/health" > /dev/null 2>&1; then
            echo "Bridge started on http://localhost:3200 (PID: $!)"
        else
            echo "Failed to start. Check: cat $BRIDGE_DIR/bridge.log"; exit 1
        fi ;;
    stop)
        PID=$(lsof -ti :3200 2>/dev/null || true)
        if [ -n "$PID" ]; then kill "$PID" 2>/dev/null; echo "Stopped (PID: $PID)"
        else echo "Not running"; fi ;;
    restart) "$0" stop; sleep 1; "$0" start ;;
    status)
        if curl -s "http://localhost:3200/health" > /dev/null 2>&1; then
            echo "Running (PID: $(lsof -ti :3200 2>/dev/null || true))"
        else echo "Not running"; fi ;;
    logs) tail -f "$BRIDGE_DIR/bridge.log" ;;
    *) echo "Usage: iris-bridge {start|stop|restart|status|logs}" ;;
esac
BCTL
    chmod 755 "$bridge_dir/bridgectl"

    # iris-daemon control script: use the one that ships IN the daemon archive.
    #
    # This used to write its own ~260-line copy here, over the real one. The two drifted — the copy
    # still minted node keys through a different endpoint with no machine fingerprint after the
    # daemon became the one writer of the node key (#185896), so every install silently undid it.
    # One daemonctl, owned by FREELABEL/iris-daemon.
    if [ ! -f "$bridge_dir/daemonctl" ]; then
        print_message error "Daemon archive is missing daemonctl — the download is incomplete. Re-run the installer."
    fi
    chmod 755 "$bridge_dir/daemonctl"

    # Symlink both CLIs into the iris bin directory
    ln -sf "$bridge_dir/bridgectl" "$INSTALL_DIR/iris-bridge"
    ln -sf "$bridge_dir/daemonctl" "$INSTALL_DIR/iris-daemon"

    # ── macOS LaunchAgent: auto-start daemon on login ──
    #
    # #184931: this block used to finish with `launchctl load "$plist_dest" 2>/dev/null || true`
    # and the summary below printed "Auto-start: enabled (starts on login)" unconditionally.
    # A client whose clone shipped without installers/macos/ was told auto-start was enabled
    # for a plist that was never written and a job launchd had never heard of. The defect is
    # a status line that cannot say "no"; the discarded stderr only hid it.
    local autostart_ok="false"
    local autostart_reason=""

    if [ "$(uname)" = "Darwin" ]; then
        local plist_name="io.heyiris.daemon.plist"
        local plist_label="io.heyiris.daemon"
        local plist_src="$bridge_dir/installers/macos/$plist_name"
        local plist_dest="$HOME/Library/LaunchAgents/$plist_name"
        local wrapper_src="$bridge_dir/installers/macos/iris-daemon-wrapper.sh"
        local wrapper_dest="$HOME/.iris/iris-daemon-wrapper.sh"
        local lc_err=""

        # Copy and configure wrapper script
        if [ -f "$wrapper_src" ]; then
            cp "$wrapper_src" "$wrapper_dest"
            # Point wrapper to ~/.iris/bridge (where main installer puts daemon)
            sed -i '' "s|DAEMON_DIR=\"\${IRIS_DIR}/daemon\"|DAEMON_DIR=\"\${IRIS_DIR}/bridge\"|g" "$wrapper_dest" 2>/dev/null || true
            chmod 755 "$wrapper_dest"
        fi

        if ! command -v launchctl >/dev/null 2>&1; then
            autostart_reason="launchctl not found"
        elif [ ! -f "$plist_src" ]; then
            # This is the case that printed "enabled" for a client in the bug report.
            autostart_reason="plist template missing from this build ($plist_src)"
        elif [ ! -f "$wrapper_src" ]; then
            autostart_reason="daemon wrapper missing from this build ($wrapper_src)"
        else
            mkdir -p "$HOME/Library/LaunchAgents" 2>/dev/null || true

            # Install plist with HOME path substitution
            if ! sed "s|__HOME__|$HOME|g" "$plist_src" > "$plist_dest" 2>/dev/null; then
                autostart_reason="could not write $plist_dest"
            else
                # Also fix daemon path to bridge
                sed -i '' "s|/.iris/daemon|/.iris/bridge|g" "$plist_dest" 2>/dev/null || true

                if command -v plutil >/dev/null 2>&1 && ! plutil -lint "$plist_dest" >/dev/null 2>&1; then
                    autostart_reason="generated plist is malformed ($plist_dest)"
                else
                    # bootout first: `bootstrap` refuses a label that is already loaded.
                    launchctl bootout "gui/$(id -u)/$plist_label" 2>/dev/null \
                      || launchctl unload "$plist_dest" 2>/dev/null || true

                    # bootout RETURNS BEFORE launchd has finished tearing the job down. A bootstrap
                    # straight after it fails ("Bootstrap failed: 5: Input/output error") while the
                    # dying job is still listed — so the check below passed, this printed "enabled",
                    # and the daemon was gone a second later. Reproduced on a re-install 2026-10-27.
                    for _w in 1 2 3 4 5 6 7 8 9 10; do
                        launchctl print "gui/$(id -u)/$plist_label" >/dev/null 2>&1 || break
                        sleep 1
                    done

                    # Keep stderr. "Load failed: 5: Input/output error" is the whole diagnosis,
                    # and 2>/dev/null is what made this bug invisible for as long as it was.
                    # -w on the legacy fallback so a previously-disabled job is re-enabled.
                    for _b in 1 2 3; do
                        if lc_err=$(launchctl bootstrap "gui/$(id -u)" "$plist_dest" 2>&1); then lc_err=""; break; fi
                        sleep 1
                    done
                    if [ -n "$lc_err" ]; then lc_err=$(launchctl load -w "$plist_dest" 2>&1) || true; fi

                    # Ask launchd what it has, rather than trusting the exit code: legacy
                    # `launchctl load` returns 0 for jobs it never actually registered. A label in
                    # the list is not enough either (see above) — it must have a PID.
                    sleep 2
                    local lc_pid; lc_pid="$(launchctl list 2>/dev/null | awk -v l="$plist_label" '$3 == l { print $1 }')"
                    if [ -n "$lc_pid" ] && [ "$lc_pid" != "-" ]; then
                        autostart_ok="true"
                    else
                        autostart_reason="launchd did not register $plist_label"
                        if [ -n "$lc_err" ]; then
                            autostart_reason="$autostart_reason — $(printf '%s' "$lc_err" | head -1)"
                        fi
                    fi
                fi
            fi
        fi
    fi

    # ── Install Playwright browser for SOM automation ──
    if command -v npx >/dev/null 2>&1; then
        print_message info "${MUTED}      Installing browser automation runtime...${NC}"
        (cd "$bridge_dir" && npx playwright install chromium 2>/dev/null) || {
            print_message info "${MUTED}      Playwright browser install deferred — run: cd ~/.iris/bridge && npx playwright install chromium${NC}"
        }
    fi

    if [ "$bridge_updated" = "true" ]; then
        print_message info "${GREEN}[5/7]${NC} Agent Bridge ${MUTED}.......................${NC} ${GREEN}updated${NC}"
    else
        print_message info "${GREEN}[5/7]${NC} Agent Bridge ${MUTED}.......................${NC} ${GREEN}installed${NC}"
    fi
    print_message info "${MUTED}      Bridge:  ${NC}iris-bridge start|stop|status"
    print_message info "${MUTED}      Daemon:  ${NC}iris-daemon start|stop|status|register${MUTED} (Hive compute node)${NC}"
    if [ "$(uname)" = "Darwin" ]; then
        if [ "$autostart_ok" = "true" ]; then
            print_message info "${MUTED}      Auto-start: ${NC}enabled${MUTED} (starts on login)${NC}"
        else
            # Deliberately a warning, not a failure: the CLI is fully usable without the
            # daemon — only Hive compute needs it — so aborting the install would be worse
            # than saying plainly that this one piece did not get set up.
            print_message warning "      Auto-start: ${ORANGE}not enabled${NC} — ${autostart_reason:-unknown reason}"
            print_message info "${MUTED}      Start the daemon yourself when you need it: ${NC}iris-daemon start"
        fi
    fi
}

if [ "$skip_bridge" = "false" ]; then
    install_bridge
else
    print_message info "${MUTED}[5/7] Agent Bridge .......................... skipped${NC}"
fi

# ─── iris-login: standalone auth command (always installed) ───────────────────
cat > "$INSTALL_DIR/iris-login" << 'IRISLOGIN'
#!/usr/bin/env bash
set -euo pipefail
CYAN='\033[0;36m'; GREEN='\033[0;32m'; RED='\033[0;31m'; MUTED='\033[0;2m'; NC='\033[0m'
IRIS_DIR="$HOME/.iris"
SDK_ENV="$IRIS_DIR/sdk/.env"
CONFIG_JSON="$IRIS_DIR/config.json"
API_BASE="https://raichu.heyiris.io"

# JSON helpers — must be defined before whoami/token blocks that use them
json_field() {
    local json="$1" field="$2"
    if command -v jq >/dev/null 2>&1; then
        echo "$json" | jq -r "(.\"$field\" // .data.\"$field\") // empty" 2>/dev/null || echo ""
    elif command -v python3 >/dev/null 2>&1; then
        echo "$json" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$field', d.get('data',{}).get('$field','')))" 2>/dev/null || echo ""
    else
        echo "$json" | sed -n "s/.*\"$field\"[[:space:]]*:[[:space:]]*\"\{0,1\}\([^\",$}]*\)\"\{0,1\}.*/\1/p" | head -1
    fi
}

json_nested() {
    local json="$1" path="$2"
    if command -v jq >/dev/null 2>&1; then
        echo "$json" | jq -r ".$path // empty" 2>/dev/null || echo ""
    elif command -v python3 >/dev/null 2>&1; then
        echo "$json" | python3 -c "
import sys,json
d=json.load(sys.stdin)
for k in '$path'.split('.'):
    d=d.get(k,'') if isinstance(d,dict) else ''
print(d)" 2>/dev/null || echo ""
    else echo ""; fi
}

register_hive() {
    # The daemon is the ONE writer of the node key (#185896): it enrolls this machine itself using
    # the account this login just saved. All login does is wake it if it is not already online.
    # (This used to mint a key itself — via a proxy endpoint, no machine fingerprint, and a `>` that
    # truncated config.json — and a key minted here could be one the hub did not know.)
    if curl -s --max-time 3 http://localhost:3200/health 2>/dev/null | grep -q '"node_id":"'; then
        return 0
    fi
    if [ -x "$HOME/.iris/bin/iris-daemon" ]; then
        "$HOME/.iris/bin/iris-daemon" restart >/dev/null 2>&1 || true
        echo -e "  ${GREEN}Hive: this machine is connecting — it will show online in a minute.${NC}"
    fi
    return 0
}

# Parse flags
PRE_TOKEN="" ; PRE_USER_ID="" ; ACTION=""
while [ $# -gt 0 ]; do
    case "$1" in
        --token)  PRE_TOKEN="$2"; shift 2 ;;
        --user-id) PRE_USER_ID="$2"; shift 2 ;;
        --help|-h) echo "Usage: iris-login [whoami|--token TOKEN --user-id ID]"; exit 0 ;;
        whoami|status) ACTION="whoami"; shift ;;
        *) shift ;;
    esac
done

# ─── whoami subcommand ────────────────────────────────────────────────────
if [ "$ACTION" = "whoami" ]; then
    if [ ! -f "$SDK_ENV" ]; then
        echo -e "${RED}Not authenticated.${NC} Run ${CYAN}iris-login${NC} to log in."
        exit 1
    fi
    TOKEN=$(grep IRIS_API_KEY "$SDK_ENV" 2>/dev/null | cut -d= -f2)
    USERID=$(grep IRIS_USER_ID "$SDK_ENV" 2>/dev/null | cut -d= -f2)
    if [ -z "$TOKEN" ]; then
        echo -e "${RED}No token found.${NC} Run ${CYAN}iris-login${NC} to authenticate."
        exit 1
    fi
    # Fetch user info from API
    # /api/v1/cli/auth/me, not /api/v1/me: that route does not exist (404), so whoami showed no
    # email and --token always failed (#187775). It answers {user_id, email, subscription_active}.
    ME_RESP=$(printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s --max-time 10 -H @- -H "Accept: application/json" \
        "$API_BASE/api/v1/cli/auth/me" 2>/dev/null || echo '{}')
    ME_NAME=$(json_field "$ME_RESP" "full_name")
    ME_EMAIL=$(json_field "$ME_RESP" "email")
    ME_ID=$(json_field "$ME_RESP" "user_id")
    if [ -z "$ME_ID" ] || [ "$ME_ID" = "" ]; then
        ME_ID="$USERID"
    fi
    echo -e ""
    echo -e "${GREEN}Authenticated${NC}"
    [ -n "$ME_NAME" ] && echo -e "  ${MUTED}Name:${NC}   $ME_NAME"
    [ -n "$ME_EMAIL" ] && echo -e "  ${MUTED}Email:${NC}  $ME_EMAIL"
    [ -n "$ME_ID" ] && echo -e "  ${MUTED}ID:${NC}     $ME_ID"
    echo -e "  ${MUTED}Token:${NC}  ${TOKEN:0:12}..."
    exit 0
fi

# ─── Scripted auth (--token flag) ──────────────────────────────────────────
if [ -n "$PRE_TOKEN" ]; then
    # Validate token format (must be non-empty, at least 20 chars)
    if [ ${#PRE_TOKEN} -lt 20 ]; then
        echo -e "${RED}Invalid token — must be at least 20 characters.${NC}"
        echo -e "${MUTED}Get your token from: ${NC}${CYAN}https://web.heyiris.io/settings/api-keys${NC}"
        exit 1
    fi
    # Validate token against API
    echo -e "${MUTED}  Validating token...${NC}"
    VALIDATE_RESP=$(printf 'Authorization: Bearer %s\n' "$PRE_TOKEN" | curl -s --max-time 10 -H @- -H "Accept: application/json" \
        "$API_BASE/api/v1/cli/auth/me" 2>/dev/null || echo '{}')
    VALIDATE_ID=$(json_field "$VALIDATE_RESP" "user_id")
    if [ -z "$VALIDATE_ID" ] || [ "$VALIDATE_ID" = "" ] || [ "$VALIDATE_ID" = "null" ]; then
        echo -e "${RED}Token validation failed — API rejected the token.${NC}"
        echo -e "${MUTED}Check that the token is correct and not expired.${NC}"
        exit 1
    fi
    # Auto-resolve user ID from API if not provided
    if [ -z "$PRE_USER_ID" ] || [ "$PRE_USER_ID" = "0" ]; then
        PRE_USER_ID="$VALIDATE_ID"
    fi
    mkdir -p "$IRIS_DIR/sdk"
    cat > "$SDK_ENV" << ENVFILE
IRIS_ENV=production
IRIS_API_KEY=$PRE_TOKEN
IRIS_USER_ID=${PRE_USER_ID:-0}
IRIS_DEFAULT_MODEL=gpt-4o-mini
ENVFILE
    chmod 600 "$SDK_ENV"
    echo -e "${GREEN}Authenticated via token.${NC}"
    register_hive "$PRE_TOKEN" "${PRE_USER_ID:-0}" || true
    exit 0
fi

# ─── Already authenticated? ───────────────────────────────────────────────
if [ -f "$SDK_ENV" ]; then
    existing=$(grep IRIS_API_KEY "$SDK_ENV" 2>/dev/null | cut -d= -f2)
    if [ -n "$existing" ]; then
        echo -e "${GREEN}Already authenticated.${NC}"
        echo -e "${MUTED}Token:${NC} ${existing:0:12}..."
        echo -e "${MUTED}To re-authenticate, delete ~/.iris/sdk/.env and run ${NC}iris-login${MUTED} again.${NC}"
        exit 0
    fi
fi

# ─── Interactive email→code flow ──────────────────────────────────────────
echo -e ""
echo -e "${CYAN}IRIS Login${NC}"
echo -e ""
echo -n "  Email: "
# Prefer the terminal over stdin — stdin is the script itself when this is
# reached via a pipe (curl | bash), which made the prompt unanswerable.
if [ -e /dev/tty ] && (echo "" > /dev/tty) 2>/dev/null; then
    read -r USER_EMAIL < /dev/tty || USER_EMAIL=""
else
    read -r USER_EMAIL || USER_EMAIL=""
fi
if [ -z "$USER_EMAIL" ]; then echo -e "${MUTED}Cancelled.${NC}"; exit 0; fi
if ! echo "$USER_EMAIL" | grep -qE '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'; then
    echo -e "${RED}  Invalid email format.${NC}"
    exit 1
fi

echo -e "${MUTED}  Sending verification code...${NC}"
SEND_RESP=$(curl -s --max-time 15 -X POST "$API_BASE/api/v1/auth/send-login-code" \
    -H "Content-Type: application/json" -H "Accept: application/json" \
    --data-raw "{\"email\": \"$(echo "$USER_EMAIL" | sed 's/[\"\\]/\\&/g')\", \"method\": \"with_login_code\", \"expiration_minutes\": 30, \"auto_create\": true}" 2>/dev/null || echo '{"success":false,"error":"Network error — check your connection"}')
SEND_OK=$(json_field "$SEND_RESP" "success")
if [ "$SEND_OK" != "True" ] && [ "$SEND_OK" != "true" ]; then
    SEND_ERR=$(json_field "$SEND_RESP" "error")
    [ -z "$SEND_ERR" ] && SEND_ERR="Unknown error"
    echo -e "${RED}  Failed to send code:${NC} $SEND_ERR"
    echo -e "  ${MUTED}Sign up at:${NC} ${CYAN}https://web.heyiris.io/login/register${NC}"
    exit 1
fi
IS_NEW=$(json_nested "$SEND_RESP" "data.new_account")
if [ "$IS_NEW" = "True" ] || [ "$IS_NEW" = "true" ]; then
    echo -e "${GREEN}  Account created!${NC} Check your inbox."
else
    echo -e "${GREEN}  Code sent!${NC} Check your inbox."
fi
echo -n "  Enter the 6-digit code: "
if [ -e /dev/tty ] && (echo "" > /dev/tty) 2>/dev/null; then
    read -r CODE < /dev/tty || CODE=""
else
    read -r CODE || CODE=""
fi
# Strip all whitespace (spaces, tabs, non-breaking spaces from email copy-paste)
CODE=$(echo "$CODE" | tr -d '[:space:]')
if [ -z "$CODE" ]; then echo -e "${MUTED}Cancelled.${NC}"; exit 0; fi

echo -e "${MUTED}  Verifying...${NC}"
LOGIN_RESP=$(curl -s --max-time 15 -w '\n{"_http_status":%{http_code}}' -X POST "$API_BASE/api/v1/auth/login-with-code" \
    -H "Content-Type: application/json" -H "Accept: application/json" \
    --data-raw "{
        \"email\": \"$(echo "$USER_EMAIL" | sed 's/[\"\\]/\\&/g')\",
        \"login_code\": \"$CODE\",
        \"generate_sdk_token\": true,
        \"sdk_token_name\": \"IRIS CLI\",
        \"sdk_token_expires_days\": 365,
        \"generate_dashboard_url\": true
    }" 2>/dev/null || echo '{"success":false,"error":"Network error — check your connection"}')
LOGIN_OK=$(json_field "$LOGIN_RESP" "success")
if [ "$LOGIN_OK" != "True" ] && [ "$LOGIN_OK" != "true" ]; then
    LOGIN_ERR=$(json_field "$LOGIN_RESP" "error")
    [ -z "$LOGIN_ERR" ] && LOGIN_ERR="Code may have expired"
    echo -e "${RED}  Login failed:${NC} $LOGIN_ERR"
    echo -e "  ${MUTED}Run ${NC}${CYAN}iris-login${NC}${MUTED} to try again.${NC}"
    exit 1
fi

SDK_TOKEN=$(json_nested "$LOGIN_RESP" "data.sdk_token.key")
USER_ID=$(json_nested "$LOGIN_RESP" "data.user.id")
DASHBOARD=$(json_nested "$LOGIN_RESP" "data.dashboard_url")

if [ -z "$SDK_TOKEN" ] || [ -z "$USER_ID" ]; then
    echo -e "${RED}  Auth succeeded but token wasn't generated. Try again or visit ${CYAN}https://web.heyiris.io${NC}"
    exit 1
fi

mkdir -p "$IRIS_DIR/sdk"
cat > "$SDK_ENV" << ENVFILE
IRIS_ENV=production
IRIS_API_KEY=$SDK_TOKEN
IRIS_USER_ID=$USER_ID
IRIS_DEFAULT_MODEL=gpt-4o-mini
ENVFILE
chmod 600 "$SDK_ENV"

echo -e "${GREEN}  Authenticated!${NC}"
[ -n "$DASHBOARD" ] && echo -e "  ${MUTED}Dashboard:${NC} ${CYAN}${DASHBOARD}${NC}"

register_hive "$SDK_TOKEN" "$USER_ID" || true

echo -e ""
echo -e "${MUTED}Next: ${NC}iris-daemon start${MUTED} to join the Hive compute network${NC}"
echo -e "${MUTED}  Or: ${NC}iris-onboard${MUTED} to start the AI assistant${NC}"
IRISLOGIN
chmod 755 "$INSTALL_DIR/iris-login"

# ─── iris-deps: lazy installer for IRIS ecosystem dependencies ────────────────
# Standalone command at ~/.iris/bin/iris-deps that installs system dependencies
# (brew, node, php, git, docker, unzip, jq, iterm, chrome, vscode, etc.) on
# demand. Auto-bootstraps Homebrew first if missing. Idempotent: every operation
# checks if the dep is already installed and skips with a green check.
#
# USAGE:
#   iris-deps brew node php          # install specific deps
#   iris-deps all                    # install full IRIS ecosystem
#   iris-deps --list                 # list available packages
#   iris-deps --help

cat > "$INSTALL_DIR/iris-deps" << 'IRISDEPS'
#!/usr/bin/env bash
# iris-deps — install IRIS ecosystem dependencies on demand
# Part of the IRIS CLI install. See: https://heyiris.io/docs

set -e

# ── Colors ────────────────────────────────────────────────────────────────────
if [ -t 1 ]; then
    GREEN='\033[0;32m'; RED='\033[0;31m'; ORANGE='\033[0;33m'
    CYAN='\033[0;36m';  MUTED='\033[0;2m'; NC='\033[0m'
else
    GREEN=''; RED=''; ORANGE=''; CYAN=''; MUTED=''; NC=''
fi

OS=$(uname -s)
ARCH=$(uname -m)

print_help() {
    cat <<HELP
${CYAN}iris-deps${NC} — install IRIS ecosystem dependencies

USAGE:
  iris-deps <pkg> [<pkg>...]    Install one or more packages
  iris-deps all                 Install full IRIS ecosystem (brew + git + node + php + unzip + jq + python3 + docker)
  iris-deps --list              Show all available packages
  iris-deps --help              Show this help

PACKAGES:
  ${GREEN}Required:${NC}
    brew       Homebrew package manager (bootstraps everything else)
    git        Git version control
    unzip      Archive extractor (needed by IRIS installer)
    jq         JSON parser (used by manifest fetch)
    python3    Python 3 (manifest parser fallback)

  ${GREEN}Recommended:${NC}
    node       Node.js + npm (latest LTS)
    php        PHP 8.3 (legacy CLI commands)
    docker     Docker Desktop (for sandboxes & local services)

  ${GREEN}macOS-only apps:${NC}
    iterm      iTerm2
    chrome     Google Chrome
    vscode     Visual Studio Code

EXAMPLES:
  iris-deps brew                Install Homebrew (if missing)
  iris-deps node php git        Install Node, PHP, and Git
  iris-deps all                 Install the full IRIS ecosystem
HELP
}

# ── Detection helpers ─────────────────────────────────────────────────────────
is_installed() {
    case "$1" in
        brew)    command -v brew >/dev/null 2>&1 ;;
        node)    command -v node >/dev/null 2>&1 ;;
        npm)     command -v npm >/dev/null 2>&1 ;;
        php)     command -v php >/dev/null 2>&1 ;;
        git)     command -v git >/dev/null 2>&1 ;;
        docker)  command -v docker >/dev/null 2>&1 ;;
        unzip)   command -v unzip >/dev/null 2>&1 ;;
        jq)      command -v jq >/dev/null 2>&1 ;;
        python3) command -v python3 >/dev/null 2>&1 ;;
        iterm)   [ -d "/Applications/iTerm.app" ] ;;
        chrome)  [ -d "/Applications/Google Chrome.app" ] ;;
        vscode)  [ -d "/Applications/Visual Studio Code.app" ] || command -v code >/dev/null 2>&1 ;;
        *)       return 1 ;;
    esac
}

show_version() {
    case "$1" in
        brew)    brew --version 2>/dev/null | head -1 ;;
        node)    echo "node $(node --version 2>/dev/null)" ;;
        npm)     echo "npm $(npm --version 2>/dev/null)" ;;
        php)     php --version 2>/dev/null | head -1 ;;
        git)     git --version 2>/dev/null ;;
        docker)  docker --version 2>/dev/null ;;
        unzip)   unzip -v 2>/dev/null | head -1 ;;
        jq)      echo "jq $(jq --version 2>/dev/null)" ;;
        python3) python3 --version 2>/dev/null ;;
        *)       echo "(installed)" ;;
    esac
}

# ── Brew bootstrap (the foundation for everything else on macOS) ─────────────
install_brew() {
    if [ "$OS" != "Darwin" ] && [ "$OS" != "Linux" ]; then
        echo -e "${RED}✗${NC} Homebrew install not supported on $OS"
        return 1
    fi
    echo -e "${CYAN}→${NC} Installing Homebrew (you may be prompted for your password)..."
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" || {
        echo -e "${RED}✗${NC} Homebrew install failed. See https://brew.sh for manual instructions."
        return 1
    }

    # Add brew to PATH for the current session (Apple Silicon vs Intel)
    if [ -f /opt/homebrew/bin/brew ]; then
        eval "$(/opt/homebrew/bin/brew shellenv)"
    elif [ -f /usr/local/bin/brew ]; then
        eval "$(/usr/local/bin/brew shellenv)"
    elif [ -f /home/linuxbrew/.linuxbrew/bin/brew ]; then
        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
    fi
}

ensure_brew() {
    is_installed brew && return 0
    install_brew
}

# ── Per-package install ───────────────────────────────────────────────────────
install_pkg() {
    local pkg="$1"

    if is_installed "$pkg"; then
        echo -e "${GREEN}✓${NC} $pkg already installed ${MUTED}($(show_version "$pkg"))${NC}"
        return 0
    fi

    echo -e "${CYAN}→${NC} Installing $pkg..."

    case "$pkg" in
        brew)
            install_brew
            ;;
        node|npm)
            ensure_brew && brew install node
            ;;
        php)
            ensure_brew && brew install php
            ;;
        git)
            ensure_brew && brew install git
            ;;
        docker)
            if [ "$OS" = "Darwin" ]; then
                ensure_brew && brew install --cask docker
            elif [ "$OS" = "Linux" ]; then
                curl -fsSL https://get.docker.com | sh
            fi
            ;;
        unzip)
            if [ "$OS" = "Darwin" ]; then
                ensure_brew && brew install unzip
            elif [ "$OS" = "Linux" ] && command -v apt-get >/dev/null 2>&1; then
                sudo apt-get install -y unzip
            fi
            ;;
        jq)
            ensure_brew && brew install jq
            ;;
        python3)
            ensure_brew && brew install python3
            ;;
        iterm)
            [ "$OS" != "Darwin" ] && { echo -e "${RED}✗${NC} iTerm is macOS-only"; return 1; }
            ensure_brew && brew install --cask iterm2
            ;;
        chrome)
            [ "$OS" != "Darwin" ] && { echo -e "${RED}✗${NC} chrome cask is macOS-only"; return 1; }
            ensure_brew && brew install --cask google-chrome
            ;;
        vscode)
            ensure_brew && brew install --cask visual-studio-code
            ;;
        *)
            echo -e "${RED}✗${NC} Unknown package: $pkg"
            echo -e "${MUTED}Run ${NC}iris-deps --list${MUTED} to see available packages.${NC}"
            return 1
            ;;
    esac

    if is_installed "$pkg"; then
        echo -e "${GREEN}✓${NC} $pkg installed ${MUTED}($(show_version "$pkg"))${NC}"
    else
        echo -e "${RED}✗${NC} $pkg install failed"
        return 1
    fi
}

# ── Main ──────────────────────────────────────────────────────────────────────
ALL_PKGS="brew git unzip jq python3 node php docker"
LIST_PKGS="brew git unzip jq python3 node php docker iterm chrome vscode"

case "${1:-}" in
    ""|--help|-h)
        print_help
        exit 0
        ;;
    --list)
        echo "$LIST_PKGS"
        exit 0
        ;;
    all)
        echo -e "${CYAN}Installing the full IRIS ecosystem...${NC}"
        for p in $ALL_PKGS; do install_pkg "$p" || true; done
        echo
        echo -e "${GREEN}✓ Done.${NC} Run ${CYAN}iris-deps --list${NC} to see optional macOS apps (iterm, chrome, vscode)."
        ;;
    *)
        for p in "$@"; do install_pkg "$p"; done
        ;;
esac
IRISDEPS
chmod 755 "$INSTALL_DIR/iris-deps"

# ─── Component 6: Docker Agent Sandbox ────────────────────────────────────────

install_docker_sandbox() {
    # Check if Docker is installed
    if ! command -v docker >/dev/null 2>&1; then
        print_message info "${MUTED}[6/7] Docker Sandbox ........................ skipped (Docker not found)${NC}"
        print_message info "${MUTED}      Install Docker to enable: ${NC}https://docs.docker.com/get-docker/"
        return 0
    fi

    # Check if Docker daemon is running
    if ! docker info >/dev/null 2>&1; then
        print_message info "${MUTED}[6/7] Docker Sandbox ........................ skipped (Docker not running)${NC}"
        print_message info "${MUTED}      Start Docker Desktop and re-run the installer${NC}"
        return 0
    fi

    print_message info "${MUTED}Setting up Docker Agent Sandbox...${NC}"

    local sandbox_dir="$HOME/.iris/sandbox"
    local workspace_dir="$sandbox_dir/workspace"
    local key_file="$sandbox_dir/.api-key"

    mkdir -p "$workspace_dir"

    # Generate API key if not already present
    local api_key
    if [ -f "$key_file" ]; then
        api_key=$(cat "$key_file")
    else
        api_key=$(openssl rand -hex 16 2>/dev/null || python3 -c "import secrets; print(secrets.token_hex(16))" 2>/dev/null || head -c 32 /dev/urandom | xxd -p | head -c 32)
        echo -n "$api_key" > "$key_file"
        chmod 600 "$key_file"
    fi

    # Pull the pre-built Docker image (show progress)
    print_message info "${MUTED}  Pulling agent sandbox image...${NC}"
    if ! docker pull ghcr.io/freelabel/iris-agent:latest; then
        print_message info "${MUTED}[6/7] Docker Sandbox ........................ image not yet available${NC}"
        print_message info "${MUTED}      Image will be available soon at ${NC}ghcr.io/freelabel/iris-agent:latest"
        return 0
    fi

    # Write docker-compose.yml for the sandbox (localhost-only port binding)
    cat > "$sandbox_dir/docker-compose.yml" << COMPOSEEOF
services:
  iris-agent:
    image: ghcr.io/freelabel/iris-agent:latest
    container_name: iris-sandbox
    restart: unless-stopped
    ports:
      - "127.0.0.1:3201:3200"
    volumes:
      - ./workspace:/data/workspace
      - iris-sandbox-data:/data
    environment:
      - BRIDGE_API_KEY=${api_key}
      - IRIS_API_URL=${iris_api_url}
      - OLLAMA_HOST=http://host.docker.internal:11434
    extra_hosts:
      - "host.docker.internal:host-gateway"

volumes:
  iris-sandbox-data:
COMPOSEEOF
    chmod 600 "$sandbox_dir/docker-compose.yml"

    # Create iris-sandbox CLI
    cat > "$INSTALL_DIR/iris-sandbox" << 'SANDBOXEOF'
#!/usr/bin/env bash
SANDBOX_DIR="$HOME/.iris/sandbox"
COMPOSE_FILE="$SANDBOX_DIR/docker-compose.yml"

if [ ! -f "$COMPOSE_FILE" ]; then
    echo "Sandbox not installed. Run the IRIS installer first:"
    echo "  curl -fsSL https://heyiris.io/install-code | bash"
    exit 1
fi

case "${1:-help}" in
    start)
        echo "Starting IRIS Agent Sandbox..."
        docker compose -f "$COMPOSE_FILE" up -d
        sleep 3
        if curl -s "http://localhost:3201/health" > /dev/null 2>&1; then
            echo "Sandbox running at http://localhost:3201"
            echo "Workspace mounted at ~/.iris/sandbox/workspace/"
        else
            echo "Container started but health check pending. Check: iris-sandbox logs"
        fi
        ;;
    stop)
        echo "Stopping IRIS Agent Sandbox..."
        docker compose -f "$COMPOSE_FILE" down
        echo "Stopped."
        ;;
    restart)
        docker compose -f "$COMPOSE_FILE" restart
        echo "Restarted."
        ;;
    status)
        if docker compose -f "$COMPOSE_FILE" ps --status running 2>/dev/null | grep -q iris-sandbox; then
            echo "Running"
            if curl -s "http://localhost:3201/health" > /dev/null 2>&1; then
                curl -s "http://localhost:3201/health" | python3 -m json.tool 2>/dev/null || curl -s "http://localhost:3201/health"
            fi
        else
            echo "Not running. Start with: iris-sandbox start"
        fi
        ;;
    logs)
        docker compose -f "$COMPOSE_FILE" logs -f
        ;;
    shell)
        echo "Entering sandbox container..."
        docker compose -f "$COMPOSE_FILE" exec iris-agent /bin/bash
        ;;
    api-key)
        if [ -f "$SANDBOX_DIR/.api-key" ]; then
            cat "$SANDBOX_DIR/.api-key"
            echo ""
        else
            echo "No API key found."
        fi
        ;;
    update)
        echo "Pulling latest sandbox image..."
        docker pull ghcr.io/freelabel/iris-agent:latest
        docker compose -f "$COMPOSE_FILE" up -d --force-recreate
        echo "Updated and restarted."
        ;;
    reset)
        echo "This will delete all sandbox data (workspace files are preserved)."
        echo -n "Are you sure? [y/N] "
        read -r confirm
        if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then
            docker compose -f "$COMPOSE_FILE" down -v
            echo "Sandbox data reset. Workspace files in ~/.iris/sandbox/workspace/ are preserved."
        else
            echo "Cancelled."
        fi
        ;;
    help|*)
        echo "IRIS Agent Sandbox"
        echo ""
        echo "Usage: iris-sandbox <command>"
        echo ""
        echo "Commands:"
        echo "  start     Start the sandbox container"
        echo "  stop      Stop the sandbox container"
        echo "  restart   Restart the sandbox container"
        echo "  status    Show sandbox status and health"
        echo "  logs      Follow sandbox logs"
        echo "  shell     Open a shell inside the sandbox"
        echo "  api-key   Display the bridge API key"
        echo "  update    Pull latest image and restart"
        echo "  reset     Delete sandbox data (preserves workspace files)"
        echo ""
        echo "Workspace: ~/.iris/sandbox/workspace/"
        echo "Config:    ~/.iris/sandbox/docker-compose.yml"
        ;;
esac
SANDBOXEOF
    chmod 755 "$INSTALL_DIR/iris-sandbox"

    print_message info "${GREEN}[6/7]${NC} Docker Sandbox ${MUTED}.....................${NC} ${GREEN}installed${NC}"
    print_message info "${MUTED}      Start with: ${NC}iris-sandbox start"
    print_message info "${MUTED}      Workspace:  ${NC}~/.iris/sandbox/workspace/"
    print_message info "${MUTED}      Commands:   ${NC}iris-sandbox start|stop|shell|logs|status|update"
}

if [ "$skip_sandbox" = "false" ]; then
    install_docker_sandbox
else
    print_message info "${MUTED}[6/7] Docker Sandbox ........................ skipped${NC}"
fi

# ─── Component 7: Remotion Video Framework (Lazy-Installed) ─────────────────

install_remotion() {
    # Requires Node.js (for npx remotion)
    if ! command -v node >/dev/null 2>&1; then
        print_message info "${MUTED}[7/7] Remotion ............................. skipped (Node.js not found)${NC}"
        return 0
    fi

    local remotion_dir="$HOME/.iris/remotion"

    if [ -d "$remotion_dir" ] && [ -f "$remotion_dir/package.json" ]; then
        if fetch_repo_archive "https://github.com/FREELABEL/iris-remotion/archive/refs/heads/main.tar.gz" "$remotion_dir" "package.json"; then
            print_message info "${MUTED}      Compositions updated from upstream${NC}"
        fi
    else
        # Fresh fetch (source only — NO npm install, that's lazy). No git needed.
        if fetch_repo_archive "https://github.com/FREELABEL/iris-remotion/archive/refs/heads/main.tar.gz" "$remotion_dir" "package.json"; then
            : # success
        else
            print_message info "${MUTED}[7/7] Remotion ............................. could not download${NC}"
            print_message info "${MUTED}      Retry with: ${NC}iris node install --remotion"
            return 0
        fi
    fi

    # FFmpeg advisory (not a blocker — stills work without it)
    if ! command -v ffmpeg >/dev/null 2>&1; then
        print_message info "${MUTED}      Note: FFmpeg not found — video renders need it (brew install ffmpeg)${NC}"
    fi

    # Create iris-remotion wrapper script with lazy npm install
    cat > "$INSTALL_DIR/iris-remotion" << 'REMOTIONEOF'
#!/usr/bin/env bash
set -euo pipefail
REMOTION_DIR="$HOME/.iris/remotion"

# Verify source exists
if [ ! -f "$REMOTION_DIR/package.json" ]; then
    echo "Remotion not found. Run: curl -fsSL https://heyiris.io/install-code | bash"
    exit 1
fi

# LAZY INSTALL: first-use npm install (~700MB, one-time)
if [ ! -d "$REMOTION_DIR/node_modules" ]; then
    echo "First run — installing Remotion dependencies (~2 min, one-time)..."
    echo ""
    (cd "$REMOTION_DIR" && npm install 2>&1) || {
        echo "npm install failed. Try manually: cd ~/.iris/remotion && npm install"
        exit 1
    }
    echo ""
    echo "Remotion ready."
fi

# FFmpeg warning for video renders
case "${1:-}" in
    render)
        if ! command -v ffmpeg >/dev/null 2>&1; then
            echo "Warning: FFmpeg not found — video rendering requires it."
            echo "  macOS:  brew install ffmpeg"
            echo "  Linux:  sudo apt install ffmpeg"
            echo ""
        fi
        ;;
esac

# Dispatch subcommand
case "${1:-help}" in
    render)
        shift
        cd "$REMOTION_DIR" && npx remotion render "$@"
        ;;
    still)
        shift
        cd "$REMOTION_DIR" && npx remotion still "$@"
        ;;
    preview|studio)
        shift
        cd "$REMOTION_DIR" && npx remotion studio "$@"
        ;;
    list|compositions)
        cd "$REMOTION_DIR" && npx remotion compositions
        ;;
    init)
        echo "Installing/repairing Remotion dependencies..."
        cd "$REMOTION_DIR" && npm install
        echo "Done."
        ;;
    update)
        echo "Updating Remotion compositions..."
        OLD_HASH=""
        if [ -f "$REMOTION_DIR/package.json" ]; then
            OLD_HASH=$(md5 -q "$REMOTION_DIR/package.json" 2>/dev/null || md5sum "$REMOTION_DIR/package.json" 2>/dev/null | cut -d' ' -f1 || echo "")
        fi
        # No git. Stage into a temp dir, verify it is really the compositions, then
        # swap — so a failed download leaves the working copy alone. node_modules and
        # any local renders are preserved.
        TMP=$(mktemp -d) || { echo "could not create a temp directory"; exit 1; }
        if ! curl -fsSL --max-time 180 "https://github.com/FREELABEL/iris-remotion/archive/refs/heads/main.tar.gz" -o "$TMP/r.tar.gz" 2>/dev/null; then
            echo "Could not download the compositions. Check your connection and retry."
            rm -rf "$TMP"; exit 1
        fi
        tar -xzf "$TMP/r.tar.gz" -C "$TMP" 2>/dev/null || { echo "The download could not be extracted."; rm -rf "$TMP"; exit 1; }
        SRC=$(find "$TMP" -mindepth 1 -maxdepth 1 -type d | head -1)
        if [ -z "$SRC" ] || [ ! -f "$SRC/package.json" ]; then
            echo "That download was not the Remotion compositions — leaving your copy alone."
            rm -rf "$TMP"; exit 1
        fi
        for entry in "$REMOTION_DIR"/* "$REMOTION_DIR"/.[!.]*; do
            [ -e "$entry" ] || continue
            case "$(basename "$entry")" in
                node_modules|out|renders|.env|.git) ;;
                *) rm -rf "$entry" ;;
            esac
        done
        cp -R "$SRC"/. "$REMOTION_DIR"/ 2>/dev/null || { echo "Could not update $REMOTION_DIR"; rm -rf "$TMP"; exit 1; }
        rm -rf "$TMP"
        NEW_HASH=$(md5 -q "$REMOTION_DIR/package.json" 2>/dev/null || md5sum "$REMOTION_DIR/package.json" 2>/dev/null | cut -d' ' -f1 || echo "")
        if [ -d "$REMOTION_DIR/node_modules" ] && [ "$OLD_HASH" != "$NEW_HASH" ]; then
            echo "Dependencies changed — reinstalling..."
            (cd "$REMOTION_DIR" && npm install)
        fi
        echo "Compositions updated."
        ;;
    carousel)
        shift
        # Usage: iris-remotion carousel <props.json> [output-dir]
        PROPS_FILE="$1"
        OUTPUT_DIR="${2:-./carousel-$(date +%Y%m%d-%H%M%S)}"
        if [ -z "$PROPS_FILE" ] || [ ! -f "$PROPS_FILE" ]; then
            echo "Usage: iris-remotion carousel <props.json> [output-dir]"
            echo "  props.json must contain { \"brand\": ..., \"slides\": [ ... 9 slide objects ... ] }"
            exit 1
        fi
        mkdir -p "$OUTPUT_DIR"
        PROPS_JSON=$(cat "$PROPS_FILE")
        for i in 0 1 2 3 4 5 6 7 8; do
            echo "Rendering CarouselSlide$i..."
            SLIDE_PROPS=$(printf '%s' "$PROPS_JSON" | node -e "let p=JSON.parse(require('fs').readFileSync(0,'utf8'));p.slideIndex=$i;process.stdout.write(JSON.stringify(p))")
            (cd "$REMOTION_DIR" && npx remotion still "CarouselSlide$i" "$OUTPUT_DIR/slide-$i.png" --props "$SLIDE_PROPS") || exit 1
        done
        echo "Done. 9 slides saved to: $OUTPUT_DIR"
        ;;
    help|--help|-h|*)
        echo "IRIS Remotion — Video & image generation"
        echo ""
        echo "Usage: iris-remotion <command> [options]"
        echo ""
        echo "Commands:"
        echo "  render <comp> [output] [--props '{}']  Render a video (MP4)"
        echo "  still  <comp> [output] [--props '{}']  Render a still image (PNG)"
        echo "  carousel <props.json> [output-dir]      Batch-render 9 carousel slides"
        echo "  preview                                 Open Remotion Studio in browser"
        echo "  list                                    List available compositions"
        echo "  init                                    (Re)install dependencies"
        echo "  update                                  Update compositions from upstream"
        echo ""
        echo "Examples:"
        echo "  iris-remotion still SocialPostStill out.png --props '{\"brand\":\"freelabel\"}'"
        echo "  iris-remotion render BrandIntro out.mp4 --props '{\"brand\":\"beatbox\"}'"
        echo "  iris-remotion carousel ./client.json ./out/client-carousel"
        echo "  iris-remotion preview"
        echo "  iris-remotion list"
        ;;
esac
REMOTIONEOF
    chmod 755 "$INSTALL_DIR/iris-remotion"

    print_message info "${GREEN}[7/7]${NC} Remotion ${MUTED}............................${NC} ${GREEN}registered${NC} ${MUTED}(deps install on first use)${NC}"
    print_message info "${MUTED}      Render:   ${NC}iris-remotion render|still|preview|list"
    print_message info "${MUTED}      Update:   ${NC}iris-remotion update"
}

if [ "$skip_remotion" = "false" ]; then
    install_remotion
else
    print_message info "${MUTED}[7/7] Remotion ............................. skipped${NC}"
fi

# ─── Download onboarding docs for the AI agent ───────────────────────────────

install_docs() {
    local docs_dir="$HOME/.iris/docs"
    mkdir -p "$docs_dir"

    if curl -sL --fail -o "$docs_dir/onboarding.md" "https://heyiris.io/docs/onboarding.md" 2>/dev/null; then
        print_message info "${GREEN}  +  ${NC} Docs ${MUTED}..................................${NC} ${GREEN}downloaded${NC}"
    else
        # Write a fallback stub so references to this file don't break
        cat > "$docs_dir/onboarding.md" << 'DOCEOF'
# IRIS Onboarding

For full documentation visit: https://heyiris.io/developer

## Quick Commands
- `iris agent:create` — Create an AI agent
- `iris automation` — Build a multi-agent workflow
- `iris pages create` — Create a web page
- `iris chat` — Chat with an agent
- `iris leads` — Manage leads & CRM
- `iris articles` — Generate content
- `iris recruit` — Recruitment tools
- `iris schedule` — Schedule recurring jobs
- `iris integrations` — Manage integrations
DOCEOF
        print_message info "${MUTED}  +   Docs ...................................... ${NC}offline fallback created"
    fi
}

install_docs

# ─── Summary Banner ──────────────────────────────────────────────────────────

echo -e ""
echo -e "${CYAN}██╗██████╗ ██╗███████╗${NC}    ${MUTED} ██████╗██╗     ██╗${NC}"
echo -e "${CYAN}██║██╔══██╗██║██╔════╝${NC}    ${MUTED}██╔════╝██║     ██║${NC}"
echo -e "${CYAN}██║██████╔╝██║███████╗${NC}    ${MUTED}██║     ██║     ██║${NC}"
echo -e "${CYAN}██║██╔══██╗██║╚════██║${NC}    ${MUTED}██║     ██║     ██║${NC}"
echo -e "${CYAN}██║██║  ██║██║███████║${NC}    ${MUTED}╚██████╗███████╗██║${NC}"
echo -e "${CYAN}╚═╝╚═╝  ╚═╝╚═╝╚══════╝${NC}    ${MUTED} ╚═════╝╚══════╝╚═╝${NC}"
echo -e ""
echo -e "${MUTED}IRIS CLI includes free AI models.${NC}"
echo -e ""
echo -e "${MUTED}Installed to:${NC}   ~/.iris/"
echo -e "${MUTED}  bin/iris       ${NC}IRIS CLI (AI coding agent)"
echo -e "${MUTED}  sdk/            ${NC}SDK commands built-in (no PHP required)"
if [ "$skip_mcp" = "false" ] && [ -f "$HOME/.iris/mcp.json" ]; then
echo -e "${MUTED}  mcp.json        ${NC}MCP server config (ready for setup)"
fi
if [ "$skip_bridge" = "false" ] && [ -f "$HOME/.iris/bridge/index.js" ]; then
echo -e "${MUTED}  bridge/          ${NC}Hive Compute Node + Session Bridge"
fi
if [ "$skip_sandbox" = "false" ] && [ -f "$HOME/.iris/sandbox/docker-compose.yml" ]; then
echo -e "${MUTED}  sandbox/         ${NC}Docker Agent Sandbox (iris-sandbox start|stop|shell)"
fi
if [ "$skip_remotion" = "false" ] && [ -f "$HOME/.iris/remotion/package.json" ]; then
echo -e "${MUTED}  remotion/        ${NC}Video & graphics (iris-remotion render|still|preview)"
fi
echo -e ""
echo -e "${MUTED}For more information visit ${NC}https://heyiris.io/developer"
echo -e ""

# ─── macOS: Homebrew + iTerm2 ────────────────────────────────────────────────
# IRIS renders best in iTerm2. Auto-install the full terminal stack so new
# users get a great experience without multiple prompts.
if [ "$(uname)" = "Darwin" ] && [ -e /dev/tty ] && (echo "" > /dev/tty) 2>/dev/null; then
    _needs_brew=false
    _needs_iterm=false
    if ! command -v brew >/dev/null 2>&1; then _needs_brew=true; fi
    if ! [ -d "/Applications/iTerm.app" ]; then _needs_iterm=true; fi

    if [ "$_needs_brew" = "true" ] || [ "$_needs_iterm" = "true" ]; then
        echo -e "${CYAN}→${NC} Setting up the recommended terminal environment..."
        if [ "$_needs_brew" = "true" ] && [ "$_needs_iterm" = "true" ]; then
            echo -e "${MUTED}  This will install Homebrew + iTerm2 for the best IRIS experience.${NC}"
        elif [ "$_needs_brew" = "true" ]; then
            echo -e "${MUTED}  This will install Homebrew (package manager for macOS tools).${NC}"
        else
            echo -e "${MUTED}  This will install iTerm2 (Apple Terminal has rendering issues with IRIS).${NC}"
        fi
        echo -n "  Continue? [Y/n] "
        read -r _env_answer < /dev/tty || _env_answer=""

        if [ "$_env_answer" != "n" ] && [ "$_env_answer" != "N" ]; then
            # Step 1: Homebrew
            if [ "$_needs_brew" = "true" ]; then
                # Normally already handled by the bootstrap at the top; this is
                # the fallback path. Redirect stdin to the terminal so Homebrew
                # can prompt for sudo instead of failing on the curl pipe.
                echo -e "${CYAN}→${NC} Installing Homebrew..."
                /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" < /dev/tty || true
                if [ -f /opt/homebrew/bin/brew ]; then
                    eval "$(/opt/homebrew/bin/brew shellenv)"
                elif [ -f /usr/local/bin/brew ]; then
                    eval "$(/usr/local/bin/brew shellenv)"
                fi
            fi

            # Step 2: iTerm2
            if [ "$_needs_iterm" = "true" ] && command -v brew >/dev/null 2>&1; then
                echo -e "${CYAN}→${NC} Installing iTerm2..."
                brew install --cask iterm2 2>/dev/null && \
                    echo -e "${GREEN}✓${NC} iTerm2 installed — launch it from Applications for the best experience" || \
                    echo -e "${ORANGE}⚠${NC} iTerm2 install failed — install later: brew install --cask iterm2"
            fi
        fi
    fi
fi

# ─── Authentication ───────────────────────────────────────────────────────────
# Handle ALL auth in bash (where keyboard works via /dev/tty).
# Then force-launch the agent post-auth — no user input needed in the TUI.

AUTH_SUCCESS=false
USER_ID=""
SDK_TOKEN=""
DASHBOARD_URL=""
USER_EMAIL=""

# Helper: parse JSON (jq → python3 → sed fallback)
json_field() {
    local json="$1" field="$2"
    if command -v jq >/dev/null 2>&1; then
        echo "$json" | jq -r "(.\"$field\" // .data.\"$field\") // empty" 2>/dev/null || echo ""
    elif command -v python3 >/dev/null 2>&1; then
        echo "$json" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$field', d.get('data',{}).get('$field','')))" 2>/dev/null || echo ""
    else
        echo "$json" | sed -n "s/.*\"$field\"[[:space:]]*:[[:space:]]*\"\{0,1\}\([^\",$}]*\)\"\{0,1\}.*/\1/p" | head -1
    fi
}

json_nested() {
    local json="$1" path="$2"
    if command -v jq >/dev/null 2>&1; then
        echo "$json" | jq -r ".$path // empty" 2>/dev/null || echo ""
    elif command -v python3 >/dev/null 2>&1; then
        echo "$json" | python3 -c "
import sys,json
d=json.load(sys.stdin)
keys='$path'.split('.')
for k in keys:
    if isinstance(d,dict): d=d.get(k,'')
    else: d=''
print(d)" 2>/dev/null || echo ""
    else
        echo ""
    fi
}

# ─── Linux: a machine joins the Hive in ONE command (#192964 W3, #187775, #191476) ──────────
#
#   curl -fsSL https://heyiris.io/install-code | bash -s -- --token <t>
#   curl -fsSL https://heyiris.io/install-code | IRIS_SDK_TOKEN=<t> bash      (token kept out of argv)
#
# On Linux this used to sign in and then print "Next: iris-daemon start". Nothing supervised the
# daemon, nothing started it at boot, ~/.iris/bin was not on PATH for non-interactive shells, and
# with --token alone IRIS_USER_ID was written as 0, which the daemon reads as "not signed in" and
# never enrolls. A fresh VM therefore never appeared in `iris hive nodes list`.
#
# Now, on Linux with a token: resolve the account, put the CLIs on PATH, hand the daemon to systemd
# (`iris-daemon supervise`: a user unit plus linger, or a system unit as root), then wait until the
# HUB has seen this machine's first heartbeat. Success is printed only after that. On any failure
# the installer exits non-zero and prints the daemon's last log lines.
#
# THE TOKEN NEVER GOES ON A COMMAND LINE (#192131). Every request that carries it reads the
# Authorization header from stdin (`curl -H @-`), so it does not show in `ps` on this machine.
#
# Each step is a function so install-linux-enroll.test.ts can run it against stubbed systemctl,
# loginctl, curl and daemonctl. Those stubs cannot see a real systemd or a real reboot, so
# script/hive-r3-vm-join.sh checks both on a fresh VM.
IRIS_AUTH_API="${IRIS_AUTH_API:-https://raichu.heyiris.io}"
IRIS_ENROLL_TIMEOUT="${IRIS_ENROLL_TIMEOUT:-90}"
IRIS_DAEMON_LOG_DIR="${IRIS_DAEMON_LOG_DIR:-$HOME/.iris/logs}"

# GET with the bearer token read from stdin, never argv. $1 = token, $2 = URL.
# `|| true`: this runs inside $(…) under set -euo pipefail, where a network blip must be an empty
# answer the caller handles, not the installer dying mid-step.
curl_with_token() {
    printf 'Authorization: Bearer %s\n' "$1" \
        | curl -s --max-time 15 -H @- -H 'Accept: application/json' "$2" 2>/dev/null || true
}

# Run a command as root: directly when we are root, through passwordless sudo otherwise. Never
# prompts — the one command must not need anything typed after it.
as_root() {
    if [ "$(id -u)" = "0" ]; then "$@"; return; fi
    command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null && sudo -n "$@"
}

# One field of a JSON document on stdin, with node (the daemon's runtime, so it is here).
# $1 = a JS expression over `d`, e.g. `d.user_id`.
# Values the expression needs come in through the environment (J_*), never spliced into the code.
json_eval() {
    node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{const e=process.env;const d=JSON.parse(s);const v=('"$1"');if(v!==undefined&&v!==null)process.stdout.write(String(v))}catch(x){}})' || true
}

# The account id behind a token, from the hub. Empty when the token is rejected.
resolve_account_user_id() {
    curl_with_token "$1" "$IRIS_AUTH_API/api/v1/cli/auth/me" | json_eval 'd.user_id || (d.data && d.data.user_id) || ""'
}

# #187775 (b): ~/.iris/bin is on PATH only for shells that source ~/.iris/env. `ssh host iris …`,
# cron and systemd do not. Symlink the CLIs into /usr/local/bin when this account may write there.
# Never replaces a real file someone else put there.
link_bins_into_usr_local() {
    local dir="${IRIS_USR_LOCAL_BIN:-/usr/local/bin}" linked="" b src dest
    for b in iris iris-daemon iris-login; do
        src="$INSTALL_DIR/$b"; dest="$dir/$b"
        [ -e "$src" ] || continue
        if [ -e "$dest" ] && [ ! -L "$dest" ]; then
            print_message warning "  PATH: $dest exists and is not ours — left alone"
            continue
        fi
        if [ -w "$dir" ]; then
            ln -sf "$src" "$dest" 2>/dev/null && linked="$linked $b"
        elif as_root ln -sf "$src" "$dest" 2>/dev/null; then
            linked="$linked $b"
        fi
    done
    if [ -n "$linked" ]; then
        print_message info "${MUTED}  PATH: linked${NC}$linked${MUTED} into $dir (works in non-interactive shells)${NC}"
    else
        print_message warning "  PATH: $dir is not writable — non-interactive shells need: export PATH=\"$INSTALL_DIR:\$PATH\""
    fi
}

# The user's systemd manager must be running for `systemctl --user` to work. With nobody logged in
# (cloud-init, `sudo -u`, a bare `ssh host cmd`), enabling linger is what starts it.
ensure_user_manager() {
    local uid; uid="$(id -u)"
    local user; user="$(id -un)"
    if [ "$(loginctl show-user "$user" -p Linger --value 2>/dev/null)" != "yes" ]; then
        loginctl enable-linger "$user" 2>/dev/null || as_root loginctl enable-linger "$user" 2>/dev/null || true
    fi
    if [ "$(loginctl show-user "$user" -p Linger --value 2>/dev/null)" != "yes" ]; then
        ENROLL_ERROR="could not enable linger for $user — without it the daemon stops at logout and does not start at boot. Ask an admin to run: sudo loginctl enable-linger $user"
        return 1
    fi
    export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$uid}"
    local i
    for i in $(seq 1 20); do
        systemctl --user show-environment >/dev/null 2>&1 && return 0
        sleep 1
    done
    ENROLL_ERROR="the systemd user manager for $user did not come up ($XDG_RUNTIME_DIR)"
    return 1
}

# Hand the daemon to systemd. daemonctl owns the unit (one writer — iris-daemon supervise): a
# user unit + linger for a normal account, a system unit when run as root.
supervise_daemon() {
    local daemonctl="$INSTALL_DIR/iris-daemon"
    if [ ! -x "$daemonctl" ]; then
        ENROLL_ERROR="the Hive daemon was not installed (${BRIDGE_FETCH_ERROR:-see the Agent Bridge step above})"
        return 1
    fi
    if [ ! -d "${IRIS_SYSTEMD_RUN_DIR:-/run/systemd/system}" ]; then
        # A container or a non-systemd init. Run it, and say plainly that nothing restarts it.
        print_message warning "  systemd is not running here — starting the daemon UNSUPERVISED (it will not survive a reboot)"
        "$daemonctl" start || { ENROLL_ERROR="iris-daemon start failed"; return 1; }
        ENROLL_SUPERVISOR="none (no systemd)"
        return 0
    fi
    if [ "$(id -u)" != "0" ]; then
        ensure_user_manager || return 1
    fi
    if ! "$daemonctl" supervise; then
        ENROLL_ERROR="iris-daemon supervise failed"
        return 1
    fi
    # Observe, do not trust the exit code: the unit must be enabled, so it comes back at boot.
    if [ "$(id -u)" = "0" ] && systemctl is-enabled --quiet iris-daemon.service 2>/dev/null; then
        ENROLL_SUPERVISOR="systemd system unit iris-daemon.service (enabled at boot)"
    elif systemctl --user is-enabled --quiet iris-daemon.service 2>/dev/null; then
        ENROLL_SUPERVISOR="systemd user unit iris-daemon.service + linger (enabled at boot)"
    else
        ENROLL_ERROR="the daemon started, but no enabled iris-daemon.service unit was found — it would not survive a reboot"
        return 1
    fi
    return 0
}

# This node's id, from the local daemon once it has enrolled.
local_node_id() {
    { curl -s --max-time 3 "http://127.0.0.1:${IRIS_BRIDGE_PORT:-3200}/health" 2>/dev/null || true; } \
        | json_eval 'd.node_id || (d.daemon && d.daemon.node_id) || ""'
}

# The ids of every node the hub lists for this account, one per line.
hub_node_ids() {
    curl_with_token "$1" "$iris_api_url/api/v6/nodes/?user_id=$2" \
        | json_eval '(d.nodes||[]).map(n=>n.id).join("\n")'
}

# "<connection_status> <last_heartbeat_at> <fresh>" for one node, as the HUB sees it. fresh=1 when
# that heartbeat is no older than J_SINCE (epoch seconds, less 10 s for clock skew).
hub_node_state() {
    curl_with_token "$1" "$iris_api_url/api/v6/nodes/?user_id=$2" \
        | J_ID="$3" J_SINCE="${4:-0}" json_eval '(()=>{const n=(d.nodes||[]).find(n=>n.id===e.J_ID);if(!n)return "";const hb=n.last_heartbeat_at||"";const t=Date.parse(hb);return n.connection_status+" "+(hb||"-")+" "+(t>=(Number(e.J_SINCE)-10)*1000?1:0)})()'
}

# #191476: success means the hub saw a heartbeat from THIS daemon — not that a process exists.
# $1 token, $2 user id, $3 epoch the daemon was (re)started, $4 node ids listed before that.
# A node that is new to the account counts as soon as it is online. One that was listed before (a
# re-install) must show a heartbeat from after the restart, or the success would be the old
# daemon's. Sets ENROLL_NODE_ID / ENROLL_HEARTBEAT.
wait_for_first_heartbeat() {
    local token="$1" uid="$2" since="$3" known="$4"
    local deadline=$(( $(date +%s) + IRIS_ENROLL_TIMEOUT ))
    local id="" state=""
    while [ "$(date +%s)" -lt "$deadline" ]; do
        [ -n "$id" ] || id="$(local_node_id)"
        if [ -n "$id" ]; then
            state="$(hub_node_state "$token" "$uid" "$id" "$since")"
            case "$state" in
                "online "*)
                    if [ "${state##* }" = "1" ] || ! printf '%s\n' "$known" | grep -qxF "$id"; then
                        ENROLL_NODE_ID="$id"; ENROLL_HEARTBEAT="$(printf '%s' "$state" | cut -d' ' -f2)"
                        return 0
                    fi ;;
            esac
        fi
        sleep 3
    done
    if [ -z "$id" ]; then
        ENROLL_ERROR="the daemon never reported a node id on /health within ${IRIS_ENROLL_TIMEOUT}s — it did not enroll"
    else
        ENROLL_ERROR="node $id never showed a new heartbeat at the hub within ${IRIS_ENROLL_TIMEOUT}s (last seen: ${state:-not listed})"
    fi
    return 1
}

print_daemon_log_tail() {
    local f
    for f in "$IRIS_DAEMON_LOG_DIR/daemon.stderr.log" "$IRIS_DAEMON_LOG_DIR/daemon.stdout.log"; do
        [ -s "$f" ] || continue
        echo -e "${MUTED}  ── last lines of $f ──${NC}" >&2
        tail -n 25 "$f" >&2
    done
    if command -v journalctl >/dev/null 2>&1; then
        if [ "$(id -u)" = "0" ]; then
            journalctl -u iris-daemon.service -n 15 --no-pager 2>/dev/null >&2 || true
        else
            journalctl --user -u iris-daemon.service -n 15 --no-pager 2>/dev/null >&2 || true
        fi
    fi
}

# The whole step. Exits the installer non-zero on failure.
linux_join_hive() {
    local token="$1" uid="$2"
    ENROLL_ERROR=""; ENROLL_SUPERVISOR=""; ENROLL_NODE_ID=""; ENROLL_HEARTBEAT=""
    print_message info "${CYAN}→${NC} Joining the Hive (Linux, --token)"
    link_bins_into_usr_local
    local known since
    known="$(hub_node_ids "$token" "$uid")"
    since="$(date +%s)"
    if supervise_daemon && wait_for_first_heartbeat "$token" "$uid" "$since" "$known"; then
        print_message info "${GREEN}✓ Hive: $(hostname 2>/dev/null) is ONLINE${NC} ${MUTED}— node ${ENROLL_NODE_ID}, first heartbeat at the hub ${ENROLL_HEARTBEAT}${NC}"
        print_message info "${MUTED}  Supervised by: ${NC}${ENROLL_SUPERVISOR}"
        return 0
    fi
    echo -e "${RED}✗ Hive: this machine did NOT come online.${NC} ${ENROLL_ERROR}" >&2
    print_daemon_log_tail
    echo -e "${MUTED}  Diagnose: ${NC}iris-daemon status${MUTED}   ${NC}iris-daemon doctor" >&2
    exit 1
}

# ─── Pre-seeded token (non-interactive auth) ────────────────────────────────
if [ -n "$pre_token" ] && [ "$os" = "linux" ] && { [ -z "$pre_user_id" ] || [ "$pre_user_id" = "0" ]; }; then
    # The daemon treats IRIS_USER_ID=0 as "not signed in" and never enrolls. Ask the hub whose
    # token this is. (Linux only: macOS/Windows behave exactly as before.)
    if command -v node >/dev/null 2>&1; then
        pre_user_id="$(resolve_account_user_id "$pre_token")"
    fi
    if [ -z "$pre_user_id" ]; then
        echo -e "${RED}✗ The token was rejected by the hub (or the hub could not be reached).${NC}" >&2
        echo -e "${MUTED}  Get a token from: ${NC}https://web.heyiris.io/settings/api-keys" >&2
        exit 1
    fi
fi
if [ -n "$pre_token" ]; then
    mkdir -p "$HOME/.iris/sdk"
    cat > "$HOME/.iris/sdk/.env" << ENVFILE
# IRIS SDK Configuration
# Pre-seeded by installer
# Date: $(date '+%Y-%m-%d %H:%M:%S')

IRIS_ENV=production
IRIS_API_KEY=$pre_token
IRIS_USER_ID=${pre_user_id:-0}
IRIS_DEFAULT_MODEL=gpt-4o-mini
ENVFILE
    chmod 600 "$HOME/.iris/sdk/.env"
    SDK_TOKEN="$pre_token"
    USER_ID="${pre_user_id:-0}"
    AUTH_SUCCESS=true
    echo -e "  ${GREEN}Authenticated via pre-seeded token${NC}"

    # No node registration here: the daemon enrolls this machine itself from the account just
    # saved — it is the ONE writer of the node key (#185896). This block minted keys through a
    # different endpoint, with no machine fingerprint, and truncated config.json with `>`.
fi

# Linux + token = "make this machine a Hive node now". --skip-bridge / --only-code opt out.
# IRIS_JOIN_HIVE=0 opts out too (an image build that must not enroll the build machine).
if [ -n "$pre_token" ] && [ "$os" = "linux" ] && [ "$skip_bridge" = "false" ] && [ "${IRIS_JOIN_HIVE:-1}" != "0" ]; then
    linux_join_hive "$pre_token" "$pre_user_id"
fi

tty_available=false
if [ -e /dev/tty ] && (echo "" > /dev/tty) 2>/dev/null; then
    tty_available=true
fi

if [ "$tty_available" = "true" ] && [ -z "$pre_token" ] && [ "$AUTH_SUCCESS" != "true" ]; then
    echo -e ""
    echo -e "${CYAN}Let's get you set up!${NC}"
    echo -e ""
    echo -n "  Enter your email (or press Enter to skip): "
    read -r USER_EMAIL < /dev/tty || USER_EMAIL=""

    if [ -z "$USER_EMAIL" ]; then
        echo -e "${MUTED}  Skipping authentication. Run ${NC}iris-login${MUTED} later to connect your account.${NC}"
    elif ! [[ "$USER_EMAIL" =~ ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]]; then
        echo -e "${RED}  Invalid email format.${NC} Run ${NC}iris-login${MUTED} later to authenticate.${NC}"
        USER_EMAIL=""
    fi

    if [ -n "$USER_EMAIL" ]; then
        echo -e ""
        echo -e "${MUTED}  Sending verification code to ${NC}${USER_EMAIL}${MUTED}...${NC}"

        SEND_RESPONSE=$(curl -s --max-time 15 -X POST https://raichu.heyiris.io/api/v1/auth/send-login-code \
            -H "Content-Type: application/json" \
            -H "Accept: application/json" \
            --data-raw "{\"email\": \"$(echo "$USER_EMAIL" | sed 's/[\"\\]/\\&/g')\", \"method\": \"with_login_code\", \"expiration_minutes\": 30, \"auto_create\": true}" 2>/dev/null || echo '{"success":false,"error":"Network error"}')

        SEND_SUCCESS=$(json_field "$SEND_RESPONSE" "success")
        IS_NEW_ACCOUNT=$(json_nested "$SEND_RESPONSE" "data.new_account")

        if [ "$SEND_SUCCESS" = "True" ] || [ "$SEND_SUCCESS" = "true" ]; then
            if [ "$IS_NEW_ACCOUNT" = "True" ] || [ "$IS_NEW_ACCOUNT" = "true" ]; then
                echo -e "${GREEN}  Account created!${NC} Verification code sent to your inbox."
            else
                echo -e "${GREEN}  Code sent!${NC} Check your inbox (valid for 30 minutes)."
            fi
            echo -e ""
            echo -n "  Enter the 6-digit code: "
            read -r VERIFY_CODE < /dev/tty || VERIFY_CODE=""
            # Strip all whitespace (spaces, tabs, non-breaking spaces from email copy-paste)
            VERIFY_CODE=$(echo "$VERIFY_CODE" | tr -d '[:space:]')

            # Validate code format
            if [ -n "$VERIFY_CODE" ] && ! [[ "$VERIFY_CODE" =~ ^[0-9]{4,8}$ ]]; then
                echo -e "${RED}  Invalid code format. Must be 4-8 digits.${NC}"
                VERIFY_CODE=""
            fi

            if [ -n "$VERIFY_CODE" ]; then
                echo -e ""
                echo -e "${MUTED}  Verifying...${NC}"

                LOGIN_RESPONSE=$(curl -s --max-time 15 -X POST https://raichu.heyiris.io/api/v1/auth/login-with-code \
                    -H "Content-Type: application/json" \
                    -H "Accept: application/json" \
                    --data-raw "{
                        \"email\": \"$(echo "$USER_EMAIL" | sed 's/[\"\\]/\\&/g')\",
                        \"login_code\": \"$VERIFY_CODE\",
                        \"generate_sdk_token\": true,
                        \"sdk_token_name\": \"IRIS CLI\",
                        \"sdk_token_expires_days\": 365,
                        \"generate_dashboard_url\": true
                    }" 2>/dev/null || echo '{"success":false,"error":"Network error"}')

                LOGIN_SUCCESS=$(json_field "$LOGIN_RESPONSE" "success")

                if [ "$LOGIN_SUCCESS" = "True" ] || [ "$LOGIN_SUCCESS" = "true" ]; then
                    SDK_TOKEN=$(json_nested "$LOGIN_RESPONSE" "data.sdk_token.key")
                    USER_ID=$(json_nested "$LOGIN_RESPONSE" "data.user.id")
                    DASHBOARD_URL=$(json_nested "$LOGIN_RESPONSE" "data.dashboard_url")

                    if [ -n "$SDK_TOKEN" ] && [ -n "$USER_ID" ]; then
                        # Write SDK credentials
                        mkdir -p "$HOME/.iris/sdk"
                        cat > "$HOME/.iris/sdk/.env" << ENVFILE
# IRIS SDK Configuration
# Generated by IRIS CLI installer
# Date: $(date '+%Y-%m-%d %H:%M:%S')

IRIS_ENV=production
IRIS_API_KEY=$SDK_TOKEN
IRIS_USER_ID=$USER_ID
IRIS_DEFAULT_MODEL=gpt-4o-mini
ENVFILE
                        chmod 600 "$HOME/.iris/sdk/.env"
                        AUTH_SUCCESS=true
                        echo -e "${GREEN}  Authenticated!${NC}"
                        if [ -n "$DASHBOARD_URL" ]; then
                            echo -e "  ${MUTED}Dashboard:${NC} ${CYAN}${DASHBOARD_URL}${NC}"
                        fi

                        # No node registration here: the daemon enrolls this machine itself from the account just
                        # saved — it is the ONE writer of the node key (#185896). This block minted keys through a
                        # different endpoint, with no machine fingerprint, and truncated config.json with `>`.
                    else
                        # Login succeeded but SDK token wasn't generated
                        AUTH_SUCCESS=true
                        echo -e "${GREEN}  Authenticated!${NC}"
                        echo -e "${MUTED}  SDK token will be configured on first run.${NC}"
                    fi
                else
                    ERROR_MSG=$(json_field "$LOGIN_RESPONSE" "error")
                    echo -e "${RED}  Login failed: ${ERROR_MSG:-Invalid code or network error}${NC}"
                    echo -e "${MUTED}  The code may have expired. Run ${NC}iris-login${MUTED} to try again.${NC}"
                fi
            fi
        else
            ERROR_MSG=$(json_field "$SEND_RESPONSE" "error")
            echo -e "${RED}  Could not send code: ${ERROR_MSG:-Unknown error}${NC}"
            echo -e "${MUTED}  If this persists, sign up at: ${NC}${CYAN}https://web.heyiris.io/login/register${NC}"
        fi
    fi
    echo -e ""
fi

# ─── Subscription gate (Stripe paywall for un-subscribed users) ─────────────
# After identity is established (email/code or pre-seeded), check whether the
# user has an active subscription. If not, route them through Stripe checkout
# via the device-code flow. Existing customers skip this entirely — they're
# done in ~10 seconds.
if [ "$AUTH_SUCCESS" = "true" ] && [ -n "$SDK_TOKEN" ] && [ "$tty_available" = "true" ]; then
    # The header comes from stdin, not argv, so the token is not in `ps` (#192131).
    SUB_RESPONSE=$(printf 'Authorization: Bearer %s\n' "$SDK_TOKEN" | curl -s --max-time 10 -w '\n%{http_code}' \
        -H @- \
        "https://raichu.heyiris.io/api/v1/cli/auth/me" 2>/dev/null || printf '\n0')
    SUB_STATUS=$(printf '%s' "$SUB_RESPONSE" | tail -n1)
    SUB_BODY=$(printf '%s' "$SUB_RESPONSE" | sed '$d')

    SUB_ACTIVE="unknown"
    if [ "$SUB_STATUS" = "200" ]; then
        # subscription_active is a JSON boolean. Don't use json_field — its jq
        # path uses `// empty` which treats `false` as missing and returns "".
        # Extract directly so we get the literal "true"/"false" string.
        if command -v jq >/dev/null 2>&1; then
            SUB_ACTIVE=$(echo "$SUB_BODY" | jq -r '.subscription_active' 2>/dev/null)
        elif command -v python3 >/dev/null 2>&1; then
            SUB_ACTIVE=$(echo "$SUB_BODY" | python3 -c 'import sys,json;print(str(json.load(sys.stdin).get("subscription_active","unknown")).lower())' 2>/dev/null)
        else
            SUB_ACTIVE=$(echo "$SUB_BODY" | grep -oE '"subscription_active"[[:space:]]*:[[:space:]]*(true|false)' | grep -oE 'true|false' | head -1)
        fi
    fi

    # Only paywall if we got a definitive "no". Network errors / unknown state
    # let the user through (don't block on infra issues).
    if [ "$SUB_ACTIVE" = "false" ] || [ "$SUB_ACTIVE" = "False" ] || [ "$SUB_ACTIVE" = "0" ]; then
        if command -v uuidgen >/dev/null 2>&1; then
            DEVICE_ID=$(uuidgen | tr '[:upper:]' '[:lower:]')
        elif [ -r /proc/sys/kernel/random/uuid ]; then
            DEVICE_ID=$(cat /proc/sys/kernel/random/uuid)
        elif command -v python3 >/dev/null 2>&1; then
            DEVICE_ID=$(python3 -c 'import uuid;print(uuid.uuid4())')
        else
            DEVICE_ID=$(od -An -N16 -tx1 /dev/urandom 2>/dev/null | tr -d ' \n' | sed 's/\(........\)\(....\)\(....\)\(....\)\(............\)/\1-\2-\3-\4-\5/')
        fi

        if [ -n "$DEVICE_ID" ]; then
            PRICING_URL="https://web.heyiris.io/pricing?source=cli&device_id=$DEVICE_ID"

            echo -e ""
            echo -e "${CYAN}One more step — pick a plan${NC}"
            echo -e "  ${MUTED}You're authenticated as${NC} ${USER_EMAIL:-your account}${MUTED}, but you don't have an active subscription yet.${NC}"
            echo -e "  ${MUTED}Visit:${NC} ${CYAN}${PRICING_URL}${NC}"
            echo -e ""
        fi
    elif [ "$SUB_ACTIVE" = "true" ] || [ "$SUB_ACTIVE" = "True" ] || [ "$SUB_ACTIVE" = "1" ]; then
        echo -e "  ${MUTED}Active subscription detected — skipping payment step.${NC}"
    fi
fi

# ─── Build post-auth prompt ──────────────────────────────────────────────────

DASHBOARD="${DASHBOARD_URL:-https://web.heyiris.io}"

if [ "$AUTH_SUCCESS" = "true" ]; then
    ONBOARDING_PROMPT="You are the IRIS onboarding assistant. The user is authenticated as $USER_EMAIL (user ID: $USER_ID). Auth is DONE -- do NOT run auth steps, do NOT read .env files, do NOT use curl. Use the IRIS CLI (the 'iris' command).

RULES:
- NEVER use curl or call APIs directly. Only CLI commands.
- NEVER guess or hallucinate URLs. Page URLs follow the format: https://heyiris.io/p/{slug} (NOT subdomains). Always read the URL from CLI output.
- When a CLI command produces output, READ it carefully and use the exact values shown. Do not make up IDs, URLs, or status values.
- At the END of EVERY response, always include these links in a clean ASCII table like this:

  ┌──────────────────────────────────────────────────────────────┐
  │  Dashboard   $DASHBOARD
  │  Discover    https://web.heyiris.io/discover
  │  Discord     https://discord.com/invite/Vmfrqmdkps
  │  Docs        https://heyiris.io/developer
  │  Desktop     ~/Applications/IRIS.app (run: open ~/Applications/IRIS.app)
  └──────────────────────────────────────────────────────────────┘

- After building something, tell them they can also manage it from the web dashboard or the IRIS Desktop App.

FIRST, run these quick commands to understand the user's environment:
   git config --global user.name 2>/dev/null; git config --global user.email 2>/dev/null
   ls -d ~/Sites/*/ ~/Projects/*/ ~/Code/*/ ~/Developer/*/ 2>/dev/null | head -15
   which node python3 docker 2>/dev/null
Use what you learn to personalize your greeting. If the scan finds nothing, proceed with the standard greeting.

THEN present these choices:

Welcome to IRIS! Here's what you can build:

1. An AI Agent
   - Chat-powered assistant with 17+ integrations (Gmail, Slack, Google Drive, Calendar, and more)
   - Attach files (PDF, CSV, DOCX) for automatic knowledge retrieval (RAG) — your agent learns your content
   - Connect to voice AI (VAPI) for phone calls, schedule recurring tasks, and share publicly via URL

2. A Multi-Agent Workflow
   - Chain multiple AI agents into automated pipelines with human approval steps
   - Generate content at scale: articles from YouTube videos, newsletters from research, legal demand packages
   - Real-time progress tracking with background queue processing — set it and let it run

3. A Web Page
   - Design and publish a landing page using the drag-and-drop page composer
   - AI-assisted layout suggestions and content generation
   - Publish instantly to a public URL — no hosting setup required

4. Something else — here's what else IRIS can do:
   - Lead management & CRM: track leads, tasks, deliverables, invoices with Stripe payments
   - Knowledge bases (Bloqs): intelligent containers that auto-vectorize your content for semantic search
   - KB management: create lists, add items, move items between lists (Kanban), search content
   - Sync with cloud: import from Google Drive / Dropbox, export content to cloud storage
   - Recruitment tools: parse job descriptions, generate boolean search queries, score candidates with AI
   - Content generation: articles from 6 source types (video, topic, webpage, RSS, notes, draft)
   - 17+ integrations: Google Suite, Slack, Discord, Mailjet, YouTube, ElevenLabs, Servis.ai, and more

Tell me what you'd like to build!

Wait for their answer. Based on what they pick, IMMEDIATELY run the corresponding command on the NEXT turn:

- Agent: Ask what it should do in one sentence, then run: iris agents create
- Multi-Agent Workflow: Ask what to automate in one sentence, then run: iris workflows list
- Web Page: Ask what the page is for, then run: iris pages create --slug SLUG --title 'TITLE' --template landing
  After creation, the public URL is shown in CLI output (freelabel.net/p/SLUG). Auto-publishes on create.
  To add more components: iris pages pull SLUG, edit pages/SLUG.json, iris pages push SLUG.
  Run: iris pages component-registry — to see ALL available component types.
  VALID component types (use ONLY these exact names): Hero, SiteNavigation, SiteFooter, AnnouncementBanner, TestimonialsSection, TeamSection, ContactSection, LogoMarquee, FeatureShowcase, ComparisonMatrix, ClientGrid, CareersListing, PortfolioGallery, ProductGrid, ServiceMenu, EventGrid, FundingTiers, BeforeAfter, MapSection, NewsletterSignup, StepWizard, FileUpload, ShoppingCart, OrderConfirmation.
  NEVER invent component types. If unsure, run: iris pages component-registry
- Knowledge base / RAG: Run: iris bloqs create
- List knowledge bases: Run: iris bloqs list
- Add content to KB: Run: iris bloqs ingest BLOQ_ID FILE_PATH
- Add text to KB: Run: iris bloqs add-item BLOQ_ID LIST_ID 'content'
- Lead management / CRM: Run: iris leads list
- Chat with an agent: Run: iris chat 'your message' --agent AGENT_ID
- Schedule a job: Run: iris schedules list
- Something else: Check iris --help for all available commands
- If the user asks about a specific project you found during scanning, help them set up IRIS for that project

After it is created, show:
- What was built and how to use it
- The exact CLI command to interact with it next
- Their dashboard: $DASHBOARD (they can manage everything from the web UI too)
- One suggested next step"
else
    ONBOARDING_PROMPT="You are the IRIS onboarding assistant. The user installed IRIS but is NOT authenticated yet.

IMPORTANT: You CANNOT run iris-login for the user — it requires interactive keyboard input. Instead, tell them to run it themselves.

RULES:
- NEVER use curl or call APIs directly.
- NEVER try to run iris-login — it needs interactive input you can't provide.

FIRST, run these quick commands to understand the user:
   git config --global user.name 2>/dev/null; git config --global user.email 2>/dev/null
   ls -d ~/Sites/*/ ~/Projects/*/ ~/Code/*/ ~/Developer/*/ 2>/dev/null | head -15
   which node python3 php docker 2>/dev/null
Use what you learn to personalize the greeting.

Then show this message:

Welcome to IRIS! Before we build anything, you need to authenticate.

Run this command (I can't do it for you — it needs your keyboard input):

    iris-login

This will:
  1. Ask for your email
  2. Send a verification code
  3. Save your API token locally
  4. Register this machine as a Hive compute node

Once you've run iris-login, come back here and tell me what you'd like to build:

  1. An AI Agent — chat assistant with 17+ integrations
  2. A Multi-Agent Workflow — automated pipelines with human approval
  3. A Web Page — drag-and-drop page composer, publish instantly
  4. Something else — CRM, knowledge bases, recruitment, content generation

Already have a token? You can also run: iris-login --token YOUR_TOKEN --user-id YOUR_ID

  ┌──────────────────────────────────────────────────────────────┐
  │  Dashboard   https://web.heyiris.io                         │
  │  Discover    https://web.heyiris.io/discover                │
  │  Discord     https://discord.com/invite/Vmfrqmdkps          │
  │  Docs        https://heyiris.io/developer                   │
  │  Desktop     ~/Applications/IRIS.app                        │
  └──────────────────────────────────────────────────────────────┘"
fi

# ─── Create iris-onboard launcher script ─────────────────────────────────────
# Write prompt to a file (keeps tokens out of ps output), then launch from file.

PROMPT_FILE="$HOME/.iris/.onboarding-prompt"
printf '%s' "$ONBOARDING_PROMPT" > "$PROMPT_FILE"
chmod 600 "$PROMPT_FILE"

cat > "$INSTALL_DIR/iris-onboard" << 'ONBOARD'
#!/usr/bin/env bash
cd "$HOME"
PROMPT_FILE="$HOME/.iris/.onboarding-prompt"
if [ -f "$PROMPT_FILE" ]; then
    exec "$HOME/.iris/bin/iris" -m opencode/big-pickle --prompt "$(cat "$PROMPT_FILE")"
else
    exec "$HOME/.iris/bin/iris" -m opencode/big-pickle
fi
ONBOARD
chmod 755 "$INSTALL_DIR/iris-onboard"

# ─── Next Steps ───────────────────────────────────────────────────────────────
# Direct run: exec iris. Piped from curl: copy to clipboard + instructions.

if [ -t 0 ]; then
    echo -e "${MUTED}Starting IRIS CLI...${NC}"
    echo -e ""
    cd "$HOME"
    exec "$INSTALL_DIR/iris" -m opencode/big-pickle --prompt "$(cat "$PROMPT_FILE")"
else
    echo -e ""
    if [ "$AUTH_SUCCESS" = "true" ] || ([ -f "$HOME/.iris/sdk/.env" ] && grep -q "IRIS_API_KEY=." "$HOME/.iris/sdk/.env" 2>/dev/null); then
        echo -e "  ${GREEN}Ready to go!${NC} To get started, run:"
        echo -e ""
        echo -e "    ${CYAN}source ~/.iris/env && iris-onboard${NC}"
        echo -e ""
        if command -v pbcopy &>/dev/null; then
            printf "%s" "source ~/.iris/env && iris-onboard" | pbcopy
            echo -e "  ${MUTED}(command copied to clipboard)${NC}"
            echo -e ""
        fi
    else
        echo -e "  ${GREEN}To get started, run:${NC}"
        echo -e ""
        echo -e "    ${CYAN}source ~/.iris/env && iris-login${NC}"
        echo -e ""
        if command -v pbcopy &>/dev/null; then
            printf "%s" "source ~/.iris/env && iris-login" | pbcopy
            echo -e "  ${MUTED}(command copied to clipboard)${NC}"
            echo -e ""
        fi
    fi
fi