install.sh

#!/usr/bin/env bash
# OpenShell Control installer
# Development installer for the local OpenShell sandbox control dashboard.

set -euo pipefail
umask 077

GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'

APP_NAME="OpenShell Control"
ENV_FILE=".env.local"
OPEN_SHELL_CONTAINER_DEFAULT="openshell-cluster-nemoclaw"
MIN_NODE_MAJOR=20
PROJECT_VENV="${OPENSHELL_CONTROL_VENV:-$PWD/.venv}"

DO_BUILD=1
DO_START=0
DO_AUDIT=1
DO_CLEAN_NEXT=0
ALLOW_ROOT=0

usage() {
  cat <<EOF
${APP_NAME} installer

Usage:
  ./install.sh [options]

Options:
  --no-build      Install and configure without running npm run build
  --no-audit      Skip the non-blocking npm audit summary
  --clean-next    Remove .next after a successful build for a clean dev start
  --allow-root    Permit running as root
  --start         Start the development server after install
  --help          Show this help

This project is in development. The installer prepares a local dev/operator
environment; it is not a systemd/production service installer.

To install the OpenShell/NemoClaw versions validated with this dashboard, run:
  ./install_versioned_nemoclaw_openshell.sh
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --no-build)
      DO_BUILD=0
      shift
      ;;
    --no-audit)
      DO_AUDIT=0
      shift
      ;;
    --clean-next)
      DO_CLEAN_NEXT=1
      shift
      ;;
    --allow-root)
      ALLOW_ROOT=1
      shift
      ;;
    --start)
      DO_START=1
      shift
      ;;
    --help|-h)
      usage
      exit 0
      ;;
    *)
      echo -e "${RED}Unknown option: $1${NC}"
      usage
      exit 1
      ;;
  esac
done

log() {
  echo -e "${GREEN}==>${NC} $*"
}

warn() {
  echo -e "${YELLOW}WARN:${NC} $*"
}

fail() {
  echo -e "${RED}ERROR:${NC} $*" >&2
  exit 1
}

require_command() {
  command -v "$1" >/dev/null 2>&1 || fail "$1 is required but was not found."
}

optional_command() {
  if command -v "$1" >/dev/null 2>&1; then
    log "$2: $(command -v "$1")"
  else
    warn "$2 was not found. Related MCP servers can still be configured, but broker calls will fail until it is installed."
  fi
}

prepend_user_bin() {
  if [[ -n "${HOME:-}" && ":$PATH:" != *":$HOME/.local/bin:"* ]]; then
    export PATH="$HOME/.local/bin:$PATH"
  fi
}

prepend_virtualenv_bin() {
  if [[ -n "${VIRTUAL_ENV:-}" && -d "$VIRTUAL_ENV/bin" && ":$PATH:" != *":$VIRTUAL_ENV/bin:"* ]]; then
    export PATH="$VIRTUAL_ENV/bin:$PATH"
  fi
}

ensure_project_venv() {
  if [[ -n "${VIRTUAL_ENV:-}" ]]; then
    log "Using active Python virtual environment: $VIRTUAL_ENV"
    prepend_virtualenv_bin
    return
  fi

  require_command python3
  if [[ ! -x "$PROJECT_VENV/bin/python" ]]; then
    log "Creating Python virtual environment: $PROJECT_VENV"
    python3 -m venv "$PROJECT_VENV"
  else
    log "Using Python virtual environment: $PROJECT_VENV"
  fi

  export VIRTUAL_ENV="$PROJECT_VENV"
  prepend_virtualenv_bin
}

ensure_npx() {
  if command -v npx >/dev/null 2>&1; then
    log "npx MCP package runner: $(command -v npx)"
    return
  fi

  log "Installing npx MCP package runner with npm"
  npm install -g npx
  command -v npx >/dev/null 2>&1 || fail "npx installation completed, but npx is still not on PATH."
  log "npx MCP package runner: $(command -v npx)"
}

ensure_uvx() {
  ensure_project_venv
  if [[ -x "$VIRTUAL_ENV/bin/uvx" ]]; then
    log "uvx MCP package runner: $VIRTUAL_ENV/bin/uvx"
    return
  fi

  local venv_python="$VIRTUAL_ENV/bin/python"
  [[ -x "$venv_python" ]] || fail "Python is required in the virtual environment to install uvx."
  "$venv_python" -m pip --version >/dev/null 2>&1 || fail "pip is required in the virtual environment to install uvx."

  log "Installing uvx MCP package runner into virtual environment: $VIRTUAL_ENV"
  "$venv_python" -m pip install --upgrade uv
  prepend_virtualenv_bin
  [[ -x "$VIRTUAL_ENV/bin/uvx" ]] || fail "uvx installation completed, but uvx was not installed into the virtual environment."
  log "uvx MCP package runner: $VIRTUAL_ENV/bin/uvx"
}

port_owner() {
  local port="$1"
  if command -v lsof >/dev/null 2>&1; then
    lsof -nP -iTCP:"$port" -sTCP:LISTEN 2>/dev/null | awk 'NR == 2 {print $1 " pid=" $2}'
    return
  fi

  if command -v ss >/dev/null 2>&1; then
    ss -ltnp "sport = :$port" 2>/dev/null | awk 'NR == 2 {print $NF}'
    return
  fi
}

check_port() {
  local port="$1"
  local label="$2"
  local owner
  owner="$(port_owner "$port" || true)"
  if [[ -n "$owner" ]]; then
    warn "Port $port ($label) is already in use by $owner."
    warn "If you use --start, stop the existing process first or expect startup to fail."
  else
    log "Port $port ($label) is available"
  fi
}

find_openshell() {
  if command -v openshell >/dev/null 2>&1; then
    command -v openshell
  elif [[ -x "$HOME/.local/bin/openshell" ]]; then
    printf '%s\n' "$HOME/.local/bin/openshell"
  fi
}

find_nemoclaw_bin() {
  local candidate
  for candidate in \
    "$HOME/.local/bin/nemoclaw" \
    "$HOME/.nemoclaw/source/bin/nemoclaw.js" \
    "$HOME/NemoClaw/bin/nemoclaw.js" \
    "$HOME/nemoclaw/bin/nemoclaw.js" \
    "/opt/homebrew/bin/nemoclaw" \
    "/usr/local/bin/nemoclaw"
  do
    [[ -x "$candidate" || -f "$candidate" ]] && printf '%s\n' "$candidate" && return
  done
  local root nested
  for root in "$HOME"/* "$HOME"/.*; do
    [[ -d "$root" ]] || continue
    case "$(basename "$root")" in
      .|..|.cache|.npm|node_modules) continue ;;
    esac
    candidate="$root/bin/nemoclaw.js"
    [[ -x "$candidate" || -f "$candidate" ]] && printf '%s\n' "$candidate" && return
    for nested in "$root"/*; do
      [[ -d "$nested" ]] || continue
      case "$(basename "$nested")" in
        .git|.next|build|dist|node_modules) continue ;;
      esac
      candidate="$nested/bin/nemoclaw.js"
      [[ -x "$candidate" || -f "$candidate" ]] && printf '%s\n' "$candidate" && return
    done
  done
  command -v nemoclaw 2>/dev/null || true
}

find_nemoclaw_setup() {
  local candidate
  for candidate in \
    "$HOME/.nemoclaw/source/scripts/setup.sh" \
    "$HOME/NemoClaw/scripts/setup.sh" \
    "$HOME/nemoclaw/scripts/setup.sh"
  do
    [[ -f "$candidate" ]] && printf '%s\n' "$candidate" && return
  done
  local root nested
  for root in "$HOME"/* "$HOME"/.*; do
    [[ -d "$root" ]] || continue
    case "$(basename "$root")" in
      .|..|.cache|.npm|node_modules) continue ;;
    esac
    candidate="$root/scripts/setup.sh"
    [[ -f "$candidate" ]] && printf '%s\n' "$candidate" && return
    for nested in "$root"/*; do
      [[ -d "$nested" ]] || continue
      case "$(basename "$nested")" in
        .git|.next|build|dist|node_modules) continue ;;
      esac
      candidate="$nested/scripts/setup.sh"
      [[ -f "$candidate" ]] && printf '%s\n' "$candidate" && return
    done
  done
}

nemoclaw_cwd_for() {
  local path_value="$1"
  if [[ "$path_value" == "$HOME/.nemoclaw/source/"* ]]; then
    printf '%s\n' "$HOME/.nemoclaw/source"
  elif [[ "$path_value" == "$HOME/NemoClaw/"* ]]; then
    printf '%s\n' "$HOME/NemoClaw"
  elif [[ "$path_value" == "$HOME/nemoclaw/"* ]]; then
    printf '%s\n' "$HOME/nemoclaw"
  elif [[ -d "$HOME/.nemoclaw/source" ]]; then
    printf '%s\n' "$HOME/.nemoclaw/source"
  elif [[ -d "$HOME/NemoClaw" ]]; then
    printf '%s\n' "$HOME/NemoClaw"
  elif [[ -d "$HOME/nemoclaw" ]]; then
    printf '%s\n' "$HOME/nemoclaw"
  elif [[ -n "$path_value" ]]; then
    dirname "$(dirname "$path_value")"
  fi
}

node_major() {
  node -p "Number(process.versions.node.split('.')[0])"
}

random_token() {
  node -e "console.log(require('node:crypto').randomBytes(Number(process.argv[1])).toString('base64url'))" "$1"
}

upsert_env() {
  local key="$1"
  local value="$2"
  touch "$ENV_FILE"
  if grep -qE "^${key}=" "$ENV_FILE"; then
    return
  fi
  printf '%s=%s\n' "$key" "$value" >> "$ENV_FILE"
}

set_env() {
  local key="$1"
  local value="$2"
  [[ -n "$value" ]] || return
  touch "$ENV_FILE"
  if grep -qE "^${key}=" "$ENV_FILE"; then
    sed -i.bak -E "s|^${key}=.*$|${key}=${value}|" "$ENV_FILE"
    rm -f "$ENV_FILE.bak"
    return
  fi
  printf '%s=%s\n' "$key" "$value" >> "$ENV_FILE"
}

echo -e "${GREEN}=== ${APP_NAME} Installer ===${NC}"
echo "Development build: expect sharp edges; do not expose this UI broadly without hardening."
echo "This installs the dashboard only. For pinned OpenShell/NemoClaw dependencies, run ./install_versioned_nemoclaw_openshell.sh."
echo ""

if [[ "${EUID:-$(id -u)}" -eq 0 && "$ALLOW_ROOT" -ne 1 ]]; then
  fail "Refusing to run as root. Rerun as the dashboard user, or pass --allow-root if you really mean it."
fi

require_command node
require_command npm
require_command docker
prepend_user_bin

NODE_MAJOR="$(node_major)"
if [[ "$NODE_MAJOR" -lt "$MIN_NODE_MAJOR" ]]; then
  fail "Node.js ${MIN_NODE_MAJOR}+ is required. Found $(node -v)."
fi

log "Node $(node -v), npm $(npm -v)"
ensure_npx
ensure_uvx

if ! docker ps >/dev/null 2>&1; then
  fail "Docker is not reachable. Start Docker and rerun the installer."
fi
log "Docker is reachable: $(docker --version)"

OPENSHELL_BIN="$(find_openshell || true)"
if [[ -n "$OPENSHELL_BIN" ]]; then
  log "OpenShell CLI: $("$OPENSHELL_BIN" --version 2>/dev/null || echo "$OPENSHELL_BIN")"
  if "$OPENSHELL_BIN" sandbox list >/dev/null 2>&1; then
    log "OpenShell sandbox inventory command is reachable"
  else
    warn "OpenShell CLI exists, but 'openshell sandbox list' did not complete successfully."
    warn "The dashboard can install, but inventory and lifecycle operations may be degraded."
  fi
else
  warn "OpenShell CLI was not found on PATH or at ~/.local/bin/openshell."
  warn "Sandbox create/delete, policy grants, terminal, and dashboard proxy features require it."
fi

NEMOCLAW_BIN="$(find_nemoclaw_bin || true)"
NEMOCLAW_SETUP="$(find_nemoclaw_setup || true)"
NEMOCLAW_CWD="$(nemoclaw_cwd_for "${NEMOCLAW_BIN:-${NEMOCLAW_SETUP:-}}" || true)"

if [[ -n "$NEMOCLAW_BIN" ]]; then
  log "NemoClaw CLI: $NEMOCLAW_BIN"
else
  warn "NemoClaw CLI was not found. NemoClaw inventory and cleanup features will be degraded."
fi

if [[ -n "$NEMOCLAW_SETUP" ]]; then
  log "Legacy NemoClaw setup workflow: $NEMOCLAW_SETUP"
else
  log "Legacy NemoClaw setup workflow was not found; current installs use 'nemoclaw onboard'."
fi

check_port 3000 "dashboard HTTP"
check_port 3011 "operator terminal upstream"

if docker ps --format '{{.Names}}' | grep -Eq '^openshell-cluster-'; then
  log "OpenShell gateway container detected:"
  docker ps --format '  {{.Names}}\t{{.Image}}\t{{.Ports}}' | grep -E 'openshell-cluster-' || true
else
  warn "No openshell-cluster-* Docker container is currently running."
  warn "Install can continue, but the UI will show limited inventory until OpenShell is started."
fi

if [[ -f package-lock.json ]]; then
  log "Installing npm dependencies with npm ci"
  npm ci
else
  log "Installing npm dependencies with npm install"
  npm install
fi

if [[ "$DO_AUDIT" -eq 1 ]]; then
  log "Running non-blocking npm audit summary"
  if ! npm audit --audit-level=moderate; then
    warn "npm audit reported vulnerabilities. Review the output above before exposing this UI beyond a trusted LAN."
  fi
fi

if [[ ! -f "$ENV_FILE" ]]; then
  log "Creating $ENV_FILE"
  cat > "$ENV_FILE" <<EOF
# OpenShell Control local configuration
PORT=3000
NEXT_PUBLIC_DASHBOARD_PORT=3000
NEXT_PUBLIC_API_BASE=/api
NEXT_PUBLIC_ENABLE_SANDBOX_OPERATIONS=true
OPEN_SHELL_CONTAINER=${OPEN_SHELL_CONTAINER_DEFAULT}
OPENSHELL_GATEWAY=nemoclaw
OPENSHELL_CONTROL_CREATE_GPU_MODE=none
# For containerized CLI runs, when supported by the installed OpenShell/NemoClaw versions:
# OPENSHELL_GATEWAY_HOST=host.docker.internal
# OPENSHELL_GATEWAY_PORT=8080
# OPENSHELL_GATEWAY_URL=http://host.docker.internal:8080
# For reverse proxies, OpenClaw dashboard websockets use the same-origin proxy path by default.
# OPENCLAW_DASHBOARD_BASE_WS_URL=wss://control.example.com
# BASE_WS_URL=wss://control.example.com
# OPENCLAW_DASHBOARD_WS_PROXY_PORT=3001
EOF
else
  log "Keeping existing $ENV_FILE"
fi

upsert_env "PORT" "3000"
upsert_env "NEXT_PUBLIC_DASHBOARD_PORT" "3000"
upsert_env "NEXT_PUBLIC_API_BASE" "/api"
upsert_env "NEXT_PUBLIC_ENABLE_SANDBOX_OPERATIONS" "true"
upsert_env "OPEN_SHELL_CONTAINER" "$OPEN_SHELL_CONTAINER_DEFAULT"
upsert_env "OPENSHELL_GATEWAY" "nemoclaw"
upsert_env "OPENSHELL_CONTROL_CREATE_GPU_MODE" "none"
set_env "OPENSHELL_GATEWAY_HOST" "${OPENSHELL_GATEWAY_HOST:-}"
set_env "OPENSHELL_GATEWAY_PORT" "${OPENSHELL_GATEWAY_PORT:-}"
set_env "OPENSHELL_GATEWAY_URL" "${OPENSHELL_GATEWAY_URL:-}"
set_env "OPENSHELL_CONTROL_VENV" "${VIRTUAL_ENV:-$PROJECT_VENV}"
set_env "OPENSHELL_HOME" "${HOME:-}"
set_env "OPENSHELL_BIN" "${OPENSHELL_BIN:-}"
set_env "NEMOCLAW_BIN" "${NEMOCLAW_BIN:-}"
set_env "NEMOCLAW_SETUP" "${NEMOCLAW_SETUP:-}"
set_env "NEMOCLAW_CWD" "${NEMOCLAW_CWD:-}"
upsert_env "TERMINAL_SERVER_AUTOSTART" "true"
upsert_env "OPENSHELL_CONTROL_PASSWORD" "$(random_token 18)"
upsert_env "OPENSHELL_CONTROL_AUTH_SECRET" "$(random_token 32)"
upsert_env "OPENSHELL_CONTROL_RECOVERY_TOKEN" "$(random_token 18)"
upsert_env "MCP_BROKER_TOKEN_TTL_HOURS" "168"
upsert_env "MCP_BROKER_REQUEST_TIMEOUT_MS" "45000"

chmod 600 "$ENV_FILE" || true

if [[ "$DO_BUILD" -eq 1 ]]; then
  log "Running production build check"
  npm run build
  if [[ "$DO_CLEAN_NEXT" -eq 1 ]]; then
    rm -rf .next
    log "Removed production .next cache because --clean-next was requested"
  fi
fi

echo ""
echo -e "${GREEN}=== Installation Complete ===${NC}"
echo ""
echo "Local config: $ENV_FILE"
echo "Login password: read OPENSHELL_CONTROL_PASSWORD from $ENV_FILE"
echo "Recovery token: read OPENSHELL_CONTROL_RECOVERY_TOKEN from $ENV_FILE"
echo ""
echo "Start the development server:"
echo "  npm run dev"
echo ""
echo "This installer does not install or manage a systemd service."
echo ""
echo "Open:"
echo "  http://localhost:3000"
echo ""
echo "Ports used by default:"
echo "  3000  dashboard HTTP"
echo "  3011  operator terminal upstream"
echo "Optional legacy OpenClaw dashboard websocket sidecar: set OPENCLAW_DASHBOARD_WS_PROXY_PORT."
echo ""

if [[ "$DO_START" -eq 1 ]]; then
  log "Starting development server"
  exec npm run dev
fi