#!/usr/bin/env bash
#
# install-launchagent.sh — run any command as a per-user LaunchAgent, so it starts
# when you log in and (optionally) is restarted by launchd whenever it exits.
#
# It writes ~/Library/LaunchAgents/<label>.plist, validates it, and loads it with
#   launchctl bootstrap gui/<uid> <plist>
# replacing an older copy with `launchctl bootout` first.
#
# Safe by default: without --apply it prints the plist and the launchctl commands
# it WOULD run. Idempotent: if the installed plist is identical and loaded, it does
# nothing. Replaced or uninstalled plists are backed up, never deleted.
#
# Usage:
#   ./install-launchagent.sh --label com.example.ai-worker [options] -- /path/to/program [args...]
#   ./install-launchagent.sh --label com.example.ai-worker --uninstall [--apply]

set -euo pipefail

readonly SCRIPT_NAME="${0##*/}"
readonly VERSION="1.0.0"

APPLY=0
UNINSTALL=0
LABEL=""
WORKDIR="$HOME"
INTERVAL=""
LOG_DIR=""
ENV_VARS=()
PROGRAM_ARGS=()
DEFAULT_PATH="$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"

usage() {
  cat <<EOF
$SCRIPT_NAME $VERSION — install a command as a macOS LaunchAgent.

Usage:
  $SCRIPT_NAME --label LABEL [options] -- PROGRAM [ARGS...]
  $SCRIPT_NAME --label LABEL --uninstall [--apply]

Options:
  --label LABEL      Reverse-DNS job name, e.g. com.example.ai-worker (required).
  --apply            Actually write the plist and load it. Default is a dry run.
  --dry-run          Explicitly request a dry run (the default).
  --uninstall        Unload the agent and move its plist to a backup folder.
  --workdir DIR      Working directory for the job (absolute path).
                     Default: your home folder.
  --interval SECS    Run every SECS seconds instead of keeping it alive 24/7.
  --log-dir DIR      Where stdout/stderr go (absolute path).
                     Default: ~/Library/Logs/LABEL
  --env KEY=VALUE    Extra environment variable for the job. Repeatable.
                     PATH defaults to Homebrew + ~/.local/bin + system paths.
  -h, --help         Show this help and exit.
  -V, --version      Print the version and exit.

Everything after '--' is the command. Use an absolute path: launchd does not use
your shell's PATH to find the program.

Examples:
  # Keep a Cursor self-hosted worker running 24/7 in a project folder
  $SCRIPT_NAME --label com.example.cursor-worker --workdir "\$HOME/code/my-project" \\
    -- "\$HOME/.local/bin/agent" worker start --name your-mac-mini

  # Run the health check every hour and keep its output in a log
  $SCRIPT_NAME --label com.example.health-check --interval 3600 \\
    -- "\$HOME/bin/health-check.sh" --no-color

  # Remove it again
  $SCRIPT_NAME --label com.example.cursor-worker --uninstall --apply
EOF
}

die() {
  printf 'error: %s\n' "$*" >&2
  exit 2
}

log() { printf '%s\n' "$*"; }

parse_args() {
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --label)
        [[ $# -ge 2 ]] || die "--label needs a value"
        LABEL=$2
        shift
        ;;
      --apply) APPLY=1 ;;
      --dry-run) APPLY=0 ;;
      --uninstall) UNINSTALL=1 ;;
      --workdir)
        [[ $# -ge 2 ]] || die "--workdir needs a directory"
        WORKDIR=$2
        shift
        ;;
      --interval)
        [[ $# -ge 2 ]] || die "--interval needs a number of seconds"
        [[ $2 =~ ^[1-9][0-9]*$ ]] || die "--interval must be a positive whole number of seconds, got '$2'"
        INTERVAL=$2
        shift
        ;;
      --log-dir)
        [[ $# -ge 2 ]] || die "--log-dir needs a directory"
        LOG_DIR=$2
        shift
        ;;
      --env)
        [[ $# -ge 2 ]] || die "--env needs KEY=VALUE"
        [[ $2 =~ ^[A-Za-z_][A-Za-z0-9_]*=.*$ ]] || die "--env must look like KEY=VALUE, got '$2'"
        ENV_VARS+=("$2")
        shift
        ;;
      -h | --help)
        usage
        exit 0
        ;;
      -V | --version)
        printf '%s %s\n' "$SCRIPT_NAME" "$VERSION"
        exit 0
        ;;
      --)
        shift
        PROGRAM_ARGS=("$@")
        break
        ;;
      *) die "unknown option '$1' (try --help; put the command after '--')" ;;
    esac
    shift
  done

  [[ -n $LABEL ]] || die "--label is required (e.g. --label com.example.ai-worker)"
  [[ $LABEL =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || die "label may only contain letters, digits, '.', '_' and '-'"
  if ((!UNINSTALL)) && ((${#PROGRAM_ARGS[@]} == 0)); then
    die "no command given; put it after '--' (e.g. -- /opt/homebrew/bin/node server.js)"
  fi
  LOG_DIR=${LOG_DIR:-"$HOME/Library/Logs/$LABEL"}
  [[ $WORKDIR == /* ]] || die "--workdir must be an absolute path (launchd does not expand ~ or relative paths), got '$WORKDIR'"
  [[ $LOG_DIR == /* ]] || die "--log-dir must be an absolute path (launchd does not expand ~ or relative paths), got '$LOG_DIR'"
}

# sed rather than ${var//&/...}: bash 5.2 treats '&' in the replacement as the match.
xml_escape() {
  printf '%s' "$1" | sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g' \
    -e 's/"/\&quot;/g' -e "s/'/\&apos;/g"
}

render_plist() {
  local arg kv has_path=0
  cat <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Generated by $SCRIPT_NAME $VERSION. Re-run the script to change it. -->
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>$(xml_escape "$LABEL")</string>
  <key>ProgramArguments</key>
  <array>
EOF
  for arg in "${PROGRAM_ARGS[@]}"; do
    printf '    <string>%s</string>\n' "$(xml_escape "$arg")"
  done
  cat <<EOF
  </array>
  <key>WorkingDirectory</key>
  <string>$(xml_escape "$WORKDIR")</string>
  <key>RunAtLoad</key>
  <true/>
EOF
  if [[ -n $INTERVAL ]]; then
    cat <<EOF
  <key>StartInterval</key>
  <integer>$INTERVAL</integer>
EOF
  else
    cat <<EOF
  <key>KeepAlive</key>
  <true/>
  <key>ThrottleInterval</key>
  <integer>30</integer>
EOF
  fi
  cat <<EOF
  <key>ProcessType</key>
  <string>Standard</string>
  <key>StandardOutPath</key>
  <string>$(xml_escape "$LOG_DIR/stdout.log")</string>
  <key>StandardErrorPath</key>
  <string>$(xml_escape "$LOG_DIR/stderr.log")</string>
  <key>EnvironmentVariables</key>
  <dict>
EOF
  for kv in "${ENV_VARS[@]+"${ENV_VARS[@]}"}"; do
    [[ ${kv%%=*} == "PATH" ]] && has_path=1
    printf '    <key>%s</key>\n    <string>%s</string>\n' "$(xml_escape "${kv%%=*}")" "$(xml_escape "${kv#*=}")"
  done
  if ((!has_path)); then
    printf '    <key>PATH</key>\n    <string>%s</string>\n' "$(xml_escape "$DEFAULT_PATH")"
  fi
  cat <<EOF
  </dict>
</dict>
</plist>
EOF
}

validate_plist() {
  local file=$1
  if command -v plutil >/dev/null 2>&1; then
    plutil -lint "$file" >/dev/null || die "generated plist failed 'plutil -lint'"
  elif command -v xmllint >/dev/null 2>&1; then
    xmllint --noout "$file" || die "generated plist is not well-formed XML"
  fi
}

is_loaded() {
  launchctl print "$DOMAIN/$LABEL" >/dev/null 2>&1
}

backup_file() {
  local file=$1 dest
  dest="$BACKUP_DIR/$(basename "$file").$(date +%Y%m%d-%H%M%S)"
  mkdir -p "$BACKUP_DIR"
  mv "$file" "$dest"
  log "  backed up old plist to $dest"
}

do_uninstall() {
  log "Uninstall $LABEL"
  if is_loaded; then
    if ((APPLY)); then
      launchctl bootout "$DOMAIN/$LABEL" || true
      log "  unloaded: launchctl bootout $DOMAIN/$LABEL"
    else
      log "  would run: launchctl bootout $DOMAIN/$LABEL"
    fi
  else
    log "  [ok] not loaded"
  fi
  if [[ -e $PLIST ]]; then
    if ((APPLY)); then
      backup_file "$PLIST"
    else
      log "  would move $PLIST to $BACKUP_DIR/"
    fi
  else
    log "  [ok] no plist at $PLIST"
  fi
  ((APPLY)) || log "Dry run complete. Re-run with --apply to uninstall."
}

do_install() {
  local program=${PROGRAM_ARGS[0]} resolved
  if [[ $program != /* ]]; then
    resolved=$(type -P "$program" 2>/dev/null || true)
    if [[ $resolved == /* ]]; then
      log "note: using absolute path $resolved for '$program' (launchd ignores your shell PATH)"
      PROGRAM_ARGS[0]=$resolved
    else
      die "'$program' is not an absolute path and was not found in PATH"
    fi
  elif [[ ! -x $program ]]; then
    log "warning: $program does not exist or is not executable yet; the job will fail until it is"
  fi
  [[ -d $WORKDIR ]] || log "warning: working directory $WORKDIR does not exist yet"

  local tmp
  tmp=$(mktemp "${TMPDIR:-/tmp}/launchagent.XXXXXX")
  TMP_PLIST=$tmp
  trap 'rm -f "$TMP_PLIST"' EXIT
  render_plist >"$tmp"
  validate_plist "$tmp"

  log "Install $LABEL -> $PLIST"
  if [[ -e $PLIST ]] && cmp -s "$tmp" "$PLIST" && is_loaded; then
    log "  [ok] already installed with identical settings and loaded. Nothing to do."
    return 0
  fi

  if ((!APPLY)); then
    log ""
    log "---- plist that would be written ----"
    cat "$tmp"
    log "-------------------------------------"
    log ""
    [[ -e $PLIST ]] && log "  would back up existing $PLIST to $BACKUP_DIR/"
    is_loaded && log "  would run: launchctl bootout $DOMAIN/$LABEL"
    log "  would run: launchctl enable $DOMAIN/$LABEL"
    log "  would run: launchctl bootstrap $DOMAIN $PLIST"
    log ""
    log "Dry run complete. Re-run with --apply to install."
    return 0
  fi

  mkdir -p "$(dirname "$PLIST")" "$LOG_DIR"
  if is_loaded; then
    launchctl bootout "$DOMAIN/$LABEL" || true
    log "  unloaded previous version"
  fi
  [[ -e $PLIST ]] && backup_file "$PLIST"
  cp "$tmp" "$PLIST"
  chmod 644 "$PLIST"
  launchctl enable "$DOMAIN/$LABEL"
  # Right after a bootout, launchd can briefly refuse with "Bootstrap failed: 5"; retry a few times.
  local attempt
  for attempt in 1 2 3; do
    if launchctl bootstrap "$DOMAIN" "$PLIST"; then
      break
    elif ((attempt == 3)); then
      die "launchctl bootstrap failed; check the plist with: plutil -lint $PLIST"
    fi
    sleep 2
  done
  log "  loaded: launchctl bootstrap $DOMAIN $PLIST"
  log "Done. Check it with: launchctl print $DOMAIN/$LABEL | head -n 30"
  log "Logs: $LOG_DIR/stdout.log and stderr.log"
}

main() {
  parse_args "$@"
  if [[ $(uname -s) != "Darwin" ]]; then
    die "this script only runs on macOS (uname reports '$(uname -s)')"
  fi

  DOMAIN="gui/$(id -u)"
  PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
  BACKUP_DIR="$HOME/Library/Application Support/mac-ai-server/launchagent-backups"

  if ((APPLY)); then
    log "Mode: APPLY"
  else
    log "Mode: DRY RUN — nothing will be changed."
  fi

  if ((UNINSTALL)); then
    do_uninstall
  else
    do_install
  fi
}

main "$@"