Power Codex — Downloads

#!/usr/bin/env bash
# Power Agents — one-line installer with a built-in dependency doctor.
#
# Downloads the latest host .vsix from neural-llm.com and installs it into your
# VS Code-compatible editor. Safe by design: HTTPS-only from the official origin,
# verifies the published SHA-256 when possible, validates the package, uses NO
# sudo, and makes no system changes beyond your editor's own extension directory.
# Before installing, it checks your environment and, when a dependency is missing
# or too old, either resolves what it safely can without sudo or prints the exact
# command for you to run. Inspect it first if you like:
#   curl -fsSL https://neural-llm.com/media/downloads/install.sh
#
# Product-parameterized (catalog whitelist). Usage:
#   curl -fsSL https://neural-llm.com/media/downloads/install.sh | bash -s -- power-claude
#   curl -fsSL https://neural-llm.com/media/downloads/install.sh | bash -s -- power-codex
#   PRODUCT=power-kimi bash install.sh
# Product is $1, else $PRODUCT, else power-claude (legacy default). Fails closed
# (exit 2) on an unknown product; downloads <product>-latest.vsix and verifies
# against /api/v1/<product>/manifest.json. Host CLI name (pc/pcodex/pg/pk) follows
# the product — never advertise `pc` for a Codex/Grok/Kimi install.
set -euo pipefail

PRODUCT="${1:-${PRODUCT:-power-claude}}"
case "$PRODUCT" in
	power-claude) CLI_BIN=pc ;;
	power-codex)  CLI_BIN=pcodex ;;
	power-grok)   CLI_BIN=pg ;;
	power-kimi)   CLI_BIN=pk ;;
	*) printf '\033[31m✗ Unknown product "%s" (expected one of: power-claude power-codex power-grok power-kimi).\033[0m\n' "$PRODUCT" >&2; exit 2 ;;
esac

ORIGIN="${NEURAL_LLM_ORIGIN:-https://neural-llm.com}"
VSIX="${PRODUCT}-latest.vsix"
URL="${ORIGIN}/?option=com_neurallicense&task=download.vsix&file=${VSIX}"
MANIFEST_URL="${ORIGIN}/api/v1/${PRODUCT}/manifest.json"

say()  { printf '%s\n' "$*"; }
ok()   { printf '\033[32m✓ %s\033[0m\n' "$*"; }
warn() { printf '\033[33m⚠ %s\033[0m\n' "$*" >&2; }
die()  { printf '\033[31m✗ %s\033[0m\n' "$*" >&2; exit 1; }

# Compare dotted versions: `ver_ge A B` is true when A >= B (semver-ish, numeric).
ver_ge() { [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]; }
# Lowest concrete version implied by an npm engines range (^1.106.0 → 1.106.0,
# >=20.0.0 → 20.0.0, 1.x → 1). Empty when the range carries no number.
range_floor() { printf '%s' "${1:-}" | grep -oE '[0-9]+(\.[0-9]+){0,2}' | head -n1; }
# First JSON string value for a key, from a flat object (no jq dependency).
json_str() { grep -oE "\"$2\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "$1" 2>/dev/null | head -n1 | sed -E 's/.*:[[:space:]]*"([^"]*)"/\1/'; }

# ── 1. Locate a VS Code-compatible CLI (no editor is launched — just its CLI). ──
# [host:grok-cli:1.0.5][brain:xai:grok-4.6][via:direct:xai][hurc:v0.12.2099] No CLI is no longer fatal: fall through and SAVE the .vsix (step 4) so
# headless/CI shells can still fetch a verified package.
CLI=""
for c in code cursor codium windsurf code-insiders; do
	if command -v "$c" >/dev/null 2>&1; then CLI="$c"; break; fi
done
if [ -n "$CLI" ]; then
	say "→ Editor CLI: $CLI"
else
	warn "No VS Code-compatible CLI on your PATH (code / cursor / codium / windsurf) — will download and verify the .vsix, then save it for manual install."
fi

# Editor version (first token that looks like a version on the --version output).
EDITOR_VERSION=""
if [ -n "$CLI" ]; then
	EDITOR_VERSION="$("$CLI" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)"
	[ -n "$EDITOR_VERSION" ] && say "→ Editor version: $EDITOR_VERSION"
fi

# ── 2. Download the latest .vsix to a private temp file (HTTPS forced). ─────────
TMP="$(mktemp "${TMPDIR:-/tmp}/${PRODUCT}-XXXXXX.vsix")" || die "Could not create a temp file."
PKG_JSON=""
trap 'rm -f "$TMP" "$PKG_JSON"' EXIT
say "↓ Downloading the latest ${PRODUCT}…"
curl -fSL --proto '=https' --tlsv1.2 "$URL" -o "$TMP" || die "Download failed from ${ORIGIN}."

# 2a. Sanity: non-empty + real .vsix (ZIP signature "PK").
[ -s "$TMP" ] || die "Downloaded file is empty."
case "$(head -c2 "$TMP")" in
	PK) ;;
	*) die "Downloaded file is not a valid .vsix package." ;;
esac

# 2b. Defense-in-depth: verify the published SHA-256 when a hashing tool exists.
SUMTOOL=()
if command -v sha256sum >/dev/null 2>&1; then
	SUMTOOL=(sha256sum)
elif command -v shasum >/dev/null 2>&1; then
	SUMTOOL=(shasum -a 256)
fi
if [ "${#SUMTOOL[@]}" -gt 0 ]; then
	EXPECTED="$(curl -fsSL --proto '=https' "$MANIFEST_URL" 2>/dev/null | tr ',' '\n' | grep -m1 '"vsix_sha256"' | grep -oE '[0-9a-f]{64}' || true)"
	if [ -n "$EXPECTED" ]; then
		ACTUAL="$("${SUMTOOL[@]}" "$TMP" | grep -oE '^[0-9a-f]{64}')"
		[ "$ACTUAL" = "$EXPECTED" ] || die "Checksum mismatch — refusing to install (expected ${EXPECTED}, got ${ACTUAL})."
		ok "SHA-256 verified."
	fi
fi

# ── 3. Dependency doctor — required deps block, feature-scoped deps only warn. ──
# Required engine versions are read FROM THE DOWNLOADED PACKAGE's package.json,
# so this can never drift from what the build actually requires.
if command -v unzip >/dev/null 2>&1; then
	PKG_JSON="$(mktemp "${TMPDIR:-/tmp}/pc-pkg-XXXXXX.json")" || PKG_JSON=""
	if [ -n "$PKG_JSON" ]; then
		unzip -p "$TMP" extension/package.json > "$PKG_JSON" 2>/dev/null || : > "$PKG_JSON"
	fi
fi

REQ_VSCODE=""; REQ_NODE=""; PKG_VERSION=""
if [ -n "$PKG_JSON" ] && [ -s "$PKG_JSON" ]; then
	REQ_VSCODE="$(range_floor "$(json_str "$PKG_JSON" vscode)")"
	REQ_NODE="$(range_floor "$(json_str "$PKG_JSON" node)")"
	PKG_VERSION="$(json_str "$PKG_JSON" version)"
fi

# 3a. REQUIRED: editor version must satisfy the extension's engines.vscode floor.
#     Catching it here turns the editor's cryptic "not compatible" install error
#     into a clear, actionable message — the #1 reason an install silently sticks
#     on an old build. Can't be auto-resolved without admin, so print the
#     fallback the user runs themselves rather than failing opaquely.
if [ -n "$REQ_VSCODE" ] && [ -n "$EDITOR_VERSION" ] && ! ver_ge "$EDITOR_VERSION" "$REQ_VSCODE"; then
	warn "Your editor is $EDITOR_VERSION but ${PRODUCT} ${PKG_VERSION:-(latest)} needs VS Code >= ${REQ_VSCODE}."
	say  "  Update your editor, then re-run this installer:"
	say  "    • VS Code:  Help → Check for Updates   (or: sudo apt-get update && sudo apt-get install --only-upgrade code)"
	say  "    • Cursor / VSCodium / Windsurf: update from the app, then re-run"
	say  "  Why this matters: installing into an older editor fails with a confusing"
	say  "  'not compatible' error and leaves you stuck on a previous version."
	die  "Editor too old for the current ${PRODUCT} build — update and re-run."
fi

# 3b. FEATURE-SCOPED: Node >= engines.node powers the host CLI ($CLI_BIN) and the
#     local rotation proxy. The EXTENSION installs and runs without it, so a missing /
#     old Node only DEGRADES those features — warn, print the fallback, continue
#     (partial install), and nudge toward the full experience.
NODE_OK=1
NODE_VERSION="$(command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -oE '[0-9]+(\.[0-9]+){0,2}' | head -n1 || true)"
if [ -n "$REQ_NODE" ]; then
	if [ -z "$NODE_VERSION" ]; then
		NODE_OK=0
		warn "Node.js (>= ${REQ_NODE}) was not found. The ${PRODUCT} extension will install fine; the '${CLI_BIN}' CLI and the local rotation proxy need Node."
	elif ! ver_ge "$NODE_VERSION" "$REQ_NODE"; then
		NODE_OK=0
		warn "Node.js $NODE_VERSION is older than the required ${REQ_NODE}. The extension installs; the '${CLI_BIN}' CLI / proxy need a newer Node."
	fi
	if [ "$NODE_OK" -eq 0 ]; then
		say "  Recommended (no sudo — per-user Node via nvm):"
		say "    curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash && nvm install ${REQ_NODE%%.*}"
		say "  Or system-wide (needs sudo):"
		say "    sudo apt-get install -y nodejs        # Debian/Ubuntu"
		say "    brew install node                     # macOS"
		say "  Continuing — the extension's core features work now; install Node to enable the CLI + proxy."
	else
		ok "Node.js $NODE_VERSION satisfies the CLI/proxy requirement (>= ${REQ_NODE})."
	fi
fi

# ── 4. Install into the editor (extension dir only — no sudo, no system changes). ─
#     No editor CLI on PATH → save the verified .vsix beside the caller instead.
if [ -z "$CLI" ]; then
	OUT="${PWD}/${VSIX}"
	mv "$TMP" "$OUT" || die "Could not save ${OUT}."
	trap 'rm -f "$PKG_JSON"' EXIT
	ok "Saved ${OUT}. Install it from your editor: Extensions view → … → Install from VSIX."
	[ "$NODE_OK" -eq 0 ] && warn "Reminder: install Node.js to unlock the '${CLI_BIN}' CLI and the local rotation proxy."
	exit 0
fi
say "⇪ Installing into $CLI…"
"$CLI" --install-extension "$TMP" --force || die "Your editor reported an install error."

ok "${PRODUCT} installed. Reload $CLI to activate it."
[ "$NODE_OK" -eq 0 ] && warn "Reminder: install Node.js to unlock the '${CLI_BIN}' CLI and the local rotation proxy."
exit 0