#!/bin/sh
# Outreach2day MCP installer for macOS and Linux.
#
#   curl -fsSL https://outreach2day.com/install | sh
#   curl -fsSL https://outreach2day.com/install | sh -s -- --client cursor --dry-run
#
# Read it before you run it:  curl -fsSL https://outreach2day.com/install | less
#
# What this file does:
#   1. Looks for Node.js 18 or newer (node on your PATH).
#   2. Writes the installer at the bottom of this file (plain JavaScript, between the O2D_INSTALLER_JS markers) to a
#      temp file and runs it with node. It adds the MCP server "outreach2day" (https://public.outreach2day.com/mcp)
#      to Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI and Codex CLI when it finds them,
#      backing up each config file first and keeping every other server in it. It is the same code as
#      `npx -y outreach2day-mcp` (packages/mcp-installer/install.mjs in the site repo).
#   3. Without Node it can still set up Claude Code (claude mcp add). The other clients need Node, or the manual
#      steps at https://outreach2day.com/mcp.
# Nothing else is downloaded. The API key is read from the terminal without echo and is sent only to
# public.outreach2day.com. Options: --client <ids>, --key <key> (or O2D_API_KEY), --dry-run, --uninstall, --yes,
# --no-verify, --help.
#
# Generated by packages/mcp-installer/build.mjs from wrappers/install.sh + install.mjs. Edit those, not public/install.

set -u

MCP_URL="https://public.outreach2day.com/mcp"
API_KEYS_URL="https://app.outreach2day.com/login?returnTo=%2Fapi-keys"
DOCS_URL="https://outreach2day.com/mcp"

node_ok() {
  command -v node >/dev/null 2>&1 &&
    node -e 'process.exit(+process.versions.node.split(".")[0] >= 18 ? 0 : 1)' >/dev/null 2>&1
}

# A terminal to ask questions on, even when this script itself arrives through a pipe (curl | sh).
has_tty() {
  (exec </dev/tty) 2>/dev/null
}

main() {
  if node_ok; then
    dir=$(mktemp -d "${TMPDIR:-/tmp}/outreach2day-install.XXXXXX") || exit 1
    trap 'rm -rf "$dir"' EXIT
    trap 'rm -rf "$dir"; exit 130' INT TERM
    installer_js >"$dir/install.mjs"
    if has_tty; then
      O2D_INSTALLER_WRAPPED=1 node "$dir/install.mjs" "$@" </dev/tty
    else
      O2D_INSTALLER_WRAPPED=1 node "$dir/install.mjs" "$@" </dev/null
    fi
    exit $?
  fi
  without_node "$@"
}

# No Node.js: Claude Code only, through its own CLI.
without_node() {
  echo "Outreach2day MCP installer"
  echo "Node.js 18+ was not found, so only Claude Code can be set up from here (claude mcp add)."
  echo "For Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI or Codex, install Node.js (https://nodejs.org) and run this again, or follow $DOCS_URL"
  echo
  key="${O2D_API_KEY:-${OUTREACH2DAY_API_KEY:-}}"
  clients="${O2D_CLIENT:-}"
  uninstall="${O2D_UNINSTALL:-}"
  dry="${O2D_DRY_RUN:-}"
  verify=1
  while [ $# -gt 0 ]; do
    case "$1" in
      --key) key="${2:-}"; shift ;;
      --key=*) key="${1#--key=}" ;;
      --client | --clients) clients="${2:-}"; shift ;;
      --client=* | --clients=*) clients="${1#*=}" ;;
      --uninstall | --remove) uninstall=1 ;;
      --dry-run) dry=1 ;;
      --no-verify) verify= ;;
      --yes | -y) ;;
      --help | -h) echo "Options without Node.js: --key <key>, --uninstall, --dry-run, --no-verify. Full options need Node.js 18+."; exit 0 ;;
      *) echo "Option $1 needs Node.js 18+."; exit 2 ;;
    esac
    shift
  done
  case ",$clients," in
    ",,") ;;
    *,claude-code,* | *,claude,* | *,all,*) ;;
    *) echo "The clients you picked ($clients) need Node.js 18+ for this installer."; exit 1 ;;
  esac
  if ! command -v claude >/dev/null 2>&1; then
    echo "Claude Code (the claude command) was not found either. Install Node.js 18+ and run this again, or follow $DOCS_URL"
    exit 1
  fi

  if [ -n "$uninstall" ]; then
    if [ -n "$dry" ]; then echo "Would run: claude mcp remove outreach2day -s user"; exit 0; fi
    claude mcp remove outreach2day -s user && echo "Removed outreach2day from Claude Code."
    exit $?
  fi

  if [ -z "$key" ]; then
    if ! has_tty; then
      echo "No API key and no terminal to ask for one. Create a key at $API_KEYS_URL, then run:"
      echo "  curl -fsSL https://outreach2day.com/install | O2D_API_KEY=ot2d_... sh"
      exit 2
    fi
    echo "You need an Outreach2day API key. Create one here: $API_KEYS_URL"
    printf "Paste your API key (input is hidden): " >/dev/tty
    trap 'stty echo </dev/tty 2>/dev/null; exit 130' INT TERM
    stty -echo </dev/tty 2>/dev/null
    IFS= read -r key </dev/tty || key=""
    stty echo </dev/tty 2>/dev/null
    printf "\n" >/dev/tty
  fi
  key=$(printf '%s' "$key" | tr -d '[:space:]')
  key="${key#Bearer}"
  case "$key" in
    "" | *[!A-Za-z0-9_-]*) echo "That does not look like an API key (it should start with ot2d_). Nothing changed."; exit 2 ;;
  esac
  if [ ${#key} -lt 8 ]; then echo "That API key is too short. Nothing changed."; exit 2; fi

  if [ -n "$dry" ]; then
    echo "Would run: claude mcp add --transport http -s user outreach2day $MCP_URL --header \"Authorization: Bearer ot2d_…(hidden)\""
    exit 0
  fi
  claude mcp remove outreach2day -s user >/dev/null 2>&1 || true
  if claude mcp add --transport http -s user outreach2day "$MCP_URL" --header "Authorization: Bearer $key" >/dev/null 2>&1; then
    echo "Claude Code: added outreach2day (user scope). The key is stored in Claude Code's config (~/.claude.json)."
  else
    echo "Claude Code: claude mcp add failed. Add it by hand: $DOCS_URL/claude"
    exit 1
  fi

  if [ -n "$verify" ] && command -v curl >/dev/null 2>&1; then
    # The header comes from stdin (-H @-), so the key is not in the process list.
    code=$(printf 'Authorization: Bearer %s\n' "$key" | curl -s -o /dev/null -w '%{http_code}' -X POST "$MCP_URL" \
      -H @- -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
      -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"outreach2day-installer","version":"sh"}}}' 2>/dev/null)
    case "$code" in
      200) echo "Server check: $MCP_URL answered." ;;
      404) echo "Server check: the Outreach2day MCP server is not yet enabled for your workspace."
           echo "  The config is in place, so Claude Code connects as soon as it opens. You'll be notified; no need to run this again." ;;
      401 | 403) echo "Server check: the server rejected this key (HTTP $code). Create a new key at $API_KEYS_URL" ;;
      *) echo "Server check: no answer from $MCP_URL (HTTP $code). The config is written; try again in a minute." ;;
    esac
  fi
  echo
  echo "Next: start a new Claude Code session, run /mcp, then ask: \"Check my Outreach2day account status\""
  echo "Undo: curl -fsSL https://outreach2day.com/install | sh -s -- --uninstall"
}

installer_js() {
  cat <<'O2D_INSTALLER_JS'
#!/usr/bin/env node
// Outreach2day MCP installer.
//
// Adds the hosted Outreach2day MCP server (https://public.outreach2day.com/mcp, Streamable HTTP, API key in an
// Authorization header) to the MCP clients on this machine, under the server name "outreach2day".
//
// The same file runs behind every entry point:
//   curl -fsSL https://outreach2day.com/install | sh          public/install (POSIX sh wrapper, runs this with node)
//   irm https://outreach2day.com/install.ps1 | iex            public/install.ps1 (PowerShell wrapper)
//   npx -y outreach2day-mcp                                   npm package outreach2day-mcp (packages/mcp-installer)
//
// Per client (config formats from each client's docs, checked 28.09.2026):
//   Claude Code     `claude mcp add --transport http -s user outreach2day <url> --header "Authorization: Bearer <key>"`
//                   (the key ends up in ~/.claude.json, Claude Code's own config)
//   Claude Desktop  claude_desktop_config.json, mcpServers.outreach2day runs the mcp-remote bridge through npx;
//                   the key is in its env block (Claude Desktop takes remote servers in this file only via a bridge)
//   Cursor          ~/.cursor/mcp.json, mcpServers.outreach2day = { url, headers }
//   VS Code         <user dir>/Code/User/mcp.json, servers.outreach2day = { type: "http", url, headers }
//   Windsurf        ~/.codeium/windsurf/mcp_config.json, mcpServers.outreach2day = { serverUrl, headers }
//   Gemini CLI      ~/.gemini/settings.json, mcpServers.outreach2day = { httpUrl, headers } with the header read
//                   from $OUTREACH2DAY_API_KEY (Gemini CLI expands ${VAR} in settings.json)
//   Codex CLI       ~/.codex/config.toml, [mcp_servers.outreach2day] url + bearer_token_env_var = "OUTREACH2DAY_API_KEY"
//   For Gemini CLI and Codex the key goes to ~/.config/outreach2day/env (0600), loaded by your shell profile
//   (Windows: a user environment variable).
//
// Safety rules this file keeps:
//   - The server URL is pinned to https://public.outreach2day.com/mcp (a local http://127.0.0.1 / localhost server is
//     allowed for testing only). The key is sent only to public.outreach2day.com.
//   - The key is never printed: every line of output goes through redact().
//   - A config file is backed up next to itself (<file>.outreach2day-backup-<time>) before it is changed; other
//     servers and settings in it are kept. A file that does not parse is left alone.
//   - Re-running is safe: an entry that is already right is left untouched (no write, no backup).
//   - No dependencies: Node 18+ standard library only.

import { spawn, spawnSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import readline from "node:readline";
import { fileURLToPath } from "node:url";

export const VERSION = "0.1.0";
export const SERVER_NAME = "outreach2day";
export const MCP_URL = "https://public.outreach2day.com/mcp";
export const API_BASE = "https://public.outreach2day.com";
/** The app's API keys page (backend src/api/public_api.py PUBLIC_API_KEYS_URL). */
export const API_KEYS_URL = "https://app.outreach2day.com/login?returnTo=%2Fapi-keys";
export const SCRIPT_URL = "https://outreach2day.com/install";
export const SCRIPT_URL_PS1 = "https://outreach2day.com/install.ps1";
export const DOCS_URL = "https://outreach2day.com/mcp";
export const ENV_VAR = "OUTREACH2DAY_API_KEY";
export const FIRST_PROMPT = "Check my Outreach2day account status";
/** mcp-remote (the stdio-to-HTTP bridge Claude Desktop needs), pinned. */
export const MCP_REMOTE = "mcp-remote@0.14.3";
const BLOCK_START = "# >>> outreach2day mcp >>>";
const BLOCK_END = "# <<< outreach2day mcp <<<";
const KEY_RE = /^[A-Za-z0-9_-]{8,512}$/;

// ---------------------------------------------------------------------------------------------------------------
// Output. Every line goes through redact(), so a key can not reach the terminal even by mistake.

const SECRETS = new Set();
export function addSecret(s) {
  if (s) SECRETS.add(s);
}
export function redact(text) {
  let s = String(text);
  for (const k of SECRETS) s = s.split(k).join(`${k.slice(0, 5)}…(hidden)`);
  return s;
}
let OUT = (s) => process.stdout.write(s);
export function setOutput(fn) {
  OUT = fn;
}
const color = !process.env.NO_COLOR && process.stdout.isTTY;
const c = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
const bold = c(1);
const dim = c(2);
const green = c(32);
const yellow = c(33);
const red = c(31);
function say(line = "") {
  OUT(redact(line) + "\n");
}

// ---------------------------------------------------------------------------------------------------------------
// Context: everything that touches the machine, so tests can run every client against a temp HOME.

export function which(cmd, env = process.env, platform = process.platform) {
  const sep = platform === "win32" ? ";" : ":";
  const dirs = (env.PATH ?? env.Path ?? "").split(sep).filter(Boolean);
  const exts = platform === "win32" ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
  for (const d of dirs)
    for (const e of exts) {
      const p = path.join(d, cmd + e);
      try {
        if (!fs.statSync(p).isFile()) continue;
        if (platform !== "win32") fs.accessSync(p, fs.constants.X_OK);
        return p;
      } catch {
        /* not here */
      }
    }
  return null;
}

/** Runs a command without a shell; .cmd/.bat shims on Windows go through cmd.exe with quoted arguments. */
export function runCommand(file, args, env = process.env) {
  let r;
  if (process.platform === "win32" && /\.(cmd|bat)$/i.test(file)) {
    const q = (a) => `"${String(a).replace(/"/g, '""')}"`;
    r = spawnSync(env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${[q(file), ...args.map(q)].join(" ")}"`], { encoding: "utf8", env, timeout: 120000, windowsVerbatimArguments: true });
  } else {
    r = spawnSync(file, args, { encoding: "utf8", env, timeout: 120000 });
  }
  return { code: r.status ?? (r.error ? 127 : 1), stdout: r.stdout ?? "", stderr: `${r.stderr ?? ""}${r.error ? r.error.message : ""}` };
}

export function makeCtx(o = {}) {
  const env = o.env ?? process.env;
  const platform = o.platform ?? process.platform;
  return {
    env,
    platform,
    home: o.home ?? os.homedir(),
    serverUrl: o.serverUrl ?? MCP_URL,
    dryRun: !!o.dryRun,
    now: o.now ?? new Date(),
    nodePath: o.nodePath ?? process.execPath,
    /** Where macOS apps are looked up for detection (tests pass []). */
    applications: o.applications ?? ["/Applications", path.join(o.home ?? os.homedir(), "Applications")],
    which: o.which ?? ((cmd) => which(cmd, env, platform)),
    run: o.run ?? ((file, args) => runCommand(file, args, env)),
  };
}

const exists = (p) => {
  try {
    fs.statSync(p);
    return true;
  } catch {
    return false;
  }
};
export const tilde = (ctx, p) => (p.startsWith(ctx.home + path.sep) ? "~" + p.slice(ctx.home.length) : p);

/** Per-user app config dir: ~/Library/Application Support, %APPDATA%, or $XDG_CONFIG_HOME / ~/.config. */
export function appConfigDir(ctx) {
  if (ctx.platform === "darwin") return path.join(ctx.home, "Library", "Application Support");
  if (ctx.platform === "win32") return ctx.env.APPDATA ?? path.join(ctx.home, "AppData", "Roaming");
  return ctx.env.XDG_CONFIG_HOME ?? path.join(ctx.home, ".config");
}
const xdgConfig = (ctx) => (ctx.platform !== "win32" && ctx.env.XDG_CONFIG_HOME) || path.join(ctx.home, ".config");
const appInstalled = (ctx, mac) => ctx.platform === "darwin" && ctx.applications.some((d) => exists(path.join(d, mac)));

export function isAllowedServerUrl(u) {
  if (u === MCP_URL) return true;
  try {
    const x = new URL(u);
    return (x.protocol === "http:" || x.protocol === "https:") && (x.hostname === "127.0.0.1" || x.hostname === "localhost");
  } catch {
    return false;
  }
}

/** "Bearer ot2d_x", spaces and newlines around a pasted key → "ot2d_x". Returns null when it is not a key. */
export function cleanKey(raw) {
  const k = String(raw ?? "").trim().replace(/^Bearer\s+/i, "").trim();
  return KEY_RE.test(k) ? k : null;
}

// ---------------------------------------------------------------------------------------------------------------
// JSON / JSONC files (VS Code and Gemini CLI allow comments and trailing commas).

export function parseJsonc(text) {
  const src = text.replace(/^/, "");
  if (src.trim() === "") return { value: {}, lossy: false };
  try {
    return { value: JSON.parse(src), lossy: false };
  } catch {
    /* try JSONC */
  }
  let out = "";
  let inStr = false;
  for (let i = 0; i < src.length; i++) {
    const ch = src[i];
    const nx = src[i + 1];
    if (inStr) {
      out += ch;
      if (ch === "\\") out += src[++i] ?? "";
      else if (ch === '"') inStr = false;
      continue;
    }
    if (ch === '"') {
      inStr = true;
      out += ch;
    } else if (ch === "/" && nx === "/") {
      while (i < src.length && src[i] !== "\n") i++;
      out += "\n";
    } else if (ch === "/" && nx === "*") {
      const end = src.indexOf("*/", i + 2);
      i = end < 0 ? src.length : end + 1;
    } else out += ch;
  }
  let res = "";
  inStr = false;
  for (let i = 0; i < out.length; i++) {
    const ch = out[i];
    if (inStr) {
      res += ch;
      if (ch === "\\") res += out[++i] ?? "";
      else if (ch === '"') inStr = false;
      continue;
    }
    if (ch === '"') inStr = true;
    if (ch === ",") {
      let k = i + 1;
      while (k < out.length && /\s/.test(out[k])) k++;
      if (out[k] === "}" || out[k] === "]") continue;
    }
    res += ch;
  }
  return { value: JSON.parse(res), lossy: true };
}

function detectIndent(text) {
  const m = /\n([ \t]+)\S/.exec(text);
  if (!m) return 2;
  return m[1][0] === "\t" ? "\t" : Math.min(m[1].length, 8);
}

export function deepEqual(a, b) {
  if (a === b) return true;
  if (typeof a !== "object" || typeof b !== "object" || !a || !b || Array.isArray(a) !== Array.isArray(b)) return false;
  const ka = Object.keys(a);
  const kb = Object.keys(b);
  return ka.length === kb.length && ka.every((k) => deepEqual(a[k], b[k]));
}

function readText(file) {
  try {
    return { text: fs.readFileSync(file, "utf8") };
  } catch (e) {
    if (e.code === "ENOENT") return { text: null };
    return { error: `cannot read ${file}: ${e.message}` };
  }
}

/**
 * Plan a change to one JSON config: set `doc[root].outreach2day = entry`, or delete it when entry is null.
 * Returns { status: added|updated|unchanged|removed|absent|failed, file, text?, existed?, lossy?, error? }.
 */
export function planJson(file, root, entry) {
  const r = readText(file);
  if (r.error) return { status: "failed", file, error: r.error };
  let doc = {};
  let lossy = false;
  let indent = 2;
  if (r.text != null) {
    try {
      ({ value: doc, lossy } = parseJsonc(r.text));
    } catch {
      return { status: "failed", file, error: "the file is not valid JSON, so it was left alone" };
    }
    if (!doc || typeof doc !== "object" || Array.isArray(doc)) return { status: "failed", file, error: "the file is not a JSON object, so it was left alone" };
    indent = detectIndent(r.text);
  }
  const servers = doc[root];
  if (servers !== undefined && (servers === null || typeof servers !== "object" || Array.isArray(servers)))
    return { status: "failed", file, error: `"${root}" in the file is not an object, so it was left alone` };
  const had = !!servers && Object.prototype.hasOwnProperty.call(servers, SERVER_NAME);
  const eol = r.text && r.text.includes("\r\n") ? "\r\n" : "\n";
  const write = (next) => (JSON.stringify(next, null, indent) + "\n").replace(/\n/g, eol);
  if (entry === null) {
    if (!had) return { status: "absent", file };
    const nextServers = { ...servers };
    delete nextServers[SERVER_NAME];
    return { status: "removed", file, text: write({ ...doc, [root]: nextServers }), existed: true, lossy };
  }
  if (had && deepEqual(servers[SERVER_NAME], entry)) return { status: "unchanged", file };
  return { status: had ? "updated" : "added", file, text: write({ ...doc, [root]: { ...(servers ?? {}), [SERVER_NAME]: entry } }), existed: r.text != null, lossy };
}

// ---------------------------------------------------------------------------------------------------------------
// Codex config.toml: one [mcp_servers.outreach2day] table, replaced as a whole; everything else is kept as text.

const TOML_HEADER = /^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*(#.*)?$/;
const ourTable = (name) => {
  const n = name.replace(/["']/g, "").replace(/\s+/g, "");
  return n === `mcp_servers.${SERVER_NAME}` || n.startsWith(`mcp_servers.${SERVER_NAME}.`);
};

export function codexBlock(url) {
  return [`[mcp_servers.${SERVER_NAME}]`, `url = "${url}"`, `bearer_token_env_var = "${ENV_VAR}"`];
}

export function planToml(file, url, remove) {
  const r = readText(file);
  if (r.error) return { status: "failed", file, error: r.error };
  const text = r.text ?? "";
  const eol = text.includes("\r\n") ? "\r\n" : "\n";
  const kept = [];
  const ours = [];
  let inOurs = false;
  for (const line of text.split(/\r?\n/)) {
    const m = TOML_HEADER.exec(line);
    if (m) inOurs = ourTable(m[1]);
    (inOurs ? ours : kept).push(line);
  }
  const found = ours.length > 0;
  const rest = kept.join(eol).replace(/\s+$/, "");
  if (remove) {
    if (!found) return { status: "absent", file };
    return { status: "removed", file, text: rest ? rest + eol : "", existed: true };
  }
  const block = codexBlock(url);
  const current = ours.map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
  if (found && deepEqual(current, block)) return { status: "unchanged", file };
  return { status: found ? "updated" : "added", file, text: (rest ? rest + eol + eol : "") + block.join(eol) + eol, existed: r.text != null };
}

// ---------------------------------------------------------------------------------------------------------------
// Writing: back up, write to a temp file next to the target, rename. Symlinked configs are written through.

const stamp = (d) => d.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");

export function applyPlan(ctx, plan, { secret = false } = {}) {
  if (!("text" in plan) || ctx.dryRun) return plan;
  let target = plan.file;
  try {
    target = fs.realpathSync(plan.file);
  } catch {
    /* new file */
  }
  let mode = secret ? 0o600 : 0o644;
  if (plan.existed) {
    const backup = `${target}.outreach2day-backup-${stamp(ctx.now)}`;
    fs.copyFileSync(target, backup);
    if (ctx.platform !== "win32") fs.chmodSync(backup, 0o600);
    plan.backup = backup;
    mode = secret ? 0o600 : fs.statSync(target).mode & 0o777;
  }
  fs.mkdirSync(path.dirname(target), { recursive: true });
  const tmp = `${target}.outreach2day-tmp-${process.pid}`;
  fs.writeFileSync(tmp, plan.text, { mode });
  if (ctx.platform !== "win32") fs.chmodSync(tmp, mode);
  fs.renameSync(tmp, target);
  return plan;
}

// ---------------------------------------------------------------------------------------------------------------
// Key for Codex and Gemini CLI: an env file sourced from the shell profile (Windows: user environment variable).

export function envFiles(ctx) {
  const dir = path.join(xdgConfig(ctx), "outreach2day");
  return { env: path.join(dir, "env"), fish: path.join(xdgConfig(ctx), "fish", "conf.d", "outreach2day.fish") };
}

export function profileFiles(ctx) {
  const shell = path.basename(ctx.env.SHELL ?? "");
  if (shell === "zsh") return [path.join(ctx.env.ZDOTDIR ?? ctx.home, ".zshrc")];
  if (shell === "bash") return ctx.platform === "darwin" ? [path.join(ctx.home, ".bash_profile"), path.join(ctx.home, ".bashrc")] : [path.join(ctx.home, ".bashrc")];
  if (shell === "fish") return [];
  return [path.join(ctx.home, ".profile")];
}

const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;

function profileBlock(ctx, envFile) {
  const rel = envFile.startsWith(ctx.home + path.sep) ? `$HOME/${path.relative(ctx.home, envFile).split(path.sep).join("/")}` : envFile;
  return [BLOCK_START, `[ -f "${rel}" ] && . "${rel}"`, BLOCK_END];
}

/** Text of `file` with our block set (lines) or removed (null). */
export function withBlock(text, lines) {
  const src = text ?? "";
  const eol = src.includes("\r\n") ? "\r\n" : "\n";
  const all = src.split(/\r?\n/);
  const s = all.indexOf(BLOCK_START);
  const e = s < 0 ? -1 : all.indexOf(BLOCK_END, s);
  const without = s < 0 || e < 0 ? all : [...all.slice(0, s), ...all.slice(e + 1)];
  let body = without.join(eol).replace(/\s+$/, "");
  if (lines) body = (body ? body + eol + eol : "") + lines.join(eol);
  return body ? body + eol : "";
}

/** Plans for the env store. key=null removes it. */
export function planEnvStore(ctx, key) {
  if (ctx.platform === "win32") return [{ status: key ? "setenv" : "unsetenv", file: `user environment variable ${ENV_VAR}`, windows: true, label: "API key" }];
  const { env, fish } = envFiles(ctx);
  const plans = [];
  const one = (file, text) => {
    const r = readText(file);
    if (r.error) return { status: "failed", file, error: r.error };
    if (text === null) return r.text == null ? { status: "absent", file } : { status: "removed", file, remove: true };
    if (r.text === text) return { status: "unchanged", file };
    return { status: r.text == null ? "added" : "updated", file, text, existed: r.text != null };
  };
  const header = `# Outreach2day MCP API key, written by ${SCRIPT_URL}. Read by Codex (bearer_token_env_var) and Gemini CLI (settings.json).\n`;
  plans.push({ ...one(env, key ? `${header}export ${ENV_VAR}=${shq(key)}\n` : null), secret: true, label: "API key file" });
  if (path.basename(ctx.env.SHELL ?? "") === "fish" || exists(fish)) plans.push({ ...one(fish, key ? `${header}set -gx ${ENV_VAR} ${shq(key)}\n` : null), secret: true, label: "API key (fish)" });
  for (const prof of profileFiles(ctx)) {
    const r = readText(prof);
    if (r.error) {
      plans.push({ status: "failed", file: prof, error: r.error, label: "Shell profile" });
      continue;
    }
    const next = withBlock(r.text, key ? profileBlock(ctx, env) : null);
    if ((r.text ?? "") === next) plans.push({ status: key ? "unchanged" : "absent", file: prof, label: "Shell profile" });
    else plans.push({ status: key ? (r.text == null ? "added" : "updated") : "removed", file: prof, text: next, existed: r.text != null, label: "Shell profile" });
  }
  return plans;
}

function applyEnvStore(ctx, plans, key) {
  for (const p of plans) {
    if (ctx.dryRun || p.status === "failed") continue;
    if (p.windows) {
      const r = key ? ctx.run("setx", [ENV_VAR, key]) : ctx.run("reg", ["delete", "HKCU\\Environment", "/v", ENV_VAR, "/f"]);
      if (r.code !== 0 && key) {
        p.status = "failed";
        p.error = redact(r.stderr || r.stdout).trim();
      }
    } else if (p.remove) {
      const backup = `${p.file}.outreach2day-backup-${stamp(ctx.now)}`;
      if (!p.secret) fs.copyFileSync(p.file, backup);
      fs.rmSync(p.file, { force: true });
    } else applyPlan(ctx, p, { secret: p.secret });
  }
  return plans;
}

// ---------------------------------------------------------------------------------------------------------------
// Clients.

const header = (key) => ({ Authorization: `Bearer ${key}` });

function claudeUserConfig(ctx) {
  return path.join(ctx.env.CLAUDE_CONFIG_DIR ?? ctx.home, ".claude.json");
}

export function claudeDesktopConfig(ctx) {
  return path.join(appConfigDir(ctx), "Claude", "claude_desktop_config.json");
}

export function claudeDesktopEntry(ctx, key) {
  const win = ctx.platform === "win32";
  const nodeDir = path.dirname(ctx.nodePath);
  const npx = !win && exists(path.join(nodeDir, "npx")) ? path.join(nodeDir, "npx") : "npx";
  const args = ["-y", MCP_REMOTE, ctx.serverUrl, "--header", "Authorization:${O2D_AUTH}"];
  if (ctx.serverUrl.startsWith("http:")) args.push("--allow-http");
  const env = { O2D_AUTH: `Bearer ${key}` };
  // GUI apps on macOS do not get your shell PATH; without this npx (nvm, Homebrew) fails with "spawn npx ENOENT".
  if (!win) env.PATH = [...new Set([nodeDir, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"])].join(":");
  return { command: npx, args, env };
}

export function vscodeConfigs(ctx) {
  const base = appConfigDir(ctx);
  const dirs = [path.join(base, "Code", "User"), path.join(base, "Code - Insiders", "User")];
  const found = dirs.filter(exists);
  return (found.length ? found : [dirs[0]]).map((d) => path.join(d, "mcp.json"));
}

const codexConfig = (ctx) => path.join(ctx.env.CODEX_HOME ?? path.join(ctx.home, ".codex"), "config.toml");

/**
 * id, display name, aliases for --client, detect(), and files() + entry() for JSON clients.
 * keyIn: "config" (the key is written into the client's config) or "env" (the config names $OUTREACH2DAY_API_KEY).
 */
export const CLIENTS = [
  {
    id: "claude-code",
    name: "Claude Code",
    aliases: ["claude", "claudecode"],
    keyIn: "config",
    restart: "Start a new Claude Code session, then run /mcp to see outreach2day.",
    detect: (ctx) => !!ctx.which("claude"),
  },
  {
    id: "claude-desktop",
    name: "Claude Desktop",
    aliases: ["claude", "desktop"],
    keyIn: "config",
    restart: "Quit and reopen Claude Desktop.",
    detect: (ctx) => appInstalled(ctx, "Claude.app") || exists(path.dirname(claudeDesktopConfig(ctx))),
    files: (ctx) => [claudeDesktopConfig(ctx)],
    root: "mcpServers",
    entry: claudeDesktopEntry,
  },
  {
    id: "cursor",
    name: "Cursor",
    aliases: [],
    keyIn: "config",
    restart: "Reload Cursor, then check Settings, MCP.",
    detect: (ctx) => exists(path.join(ctx.home, ".cursor")) || appInstalled(ctx, "Cursor.app") || !!ctx.which("cursor"),
    files: (ctx) => [path.join(ctx.home, ".cursor", "mcp.json")],
    root: "mcpServers",
    entry: (ctx, key) => ({ url: ctx.serverUrl, headers: header(key) }),
  },
  {
    id: "vscode",
    name: "VS Code",
    aliases: ["vs-code", "code", "copilot", "github-copilot"],
    keyIn: "config",
    restart: "Reload VS Code, then open Copilot Chat in agent mode.",
    detect: (ctx) => exists(path.join(appConfigDir(ctx), "Code", "User")) || exists(path.join(appConfigDir(ctx), "Code - Insiders", "User")) || !!ctx.which("code"),
    files: vscodeConfigs,
    root: "servers",
    entry: (ctx, key) => ({ type: "http", url: ctx.serverUrl, headers: header(key) }),
  },
  {
    id: "windsurf",
    name: "Windsurf",
    aliases: [],
    keyIn: "config",
    restart: "Reload Windsurf (Cascade, MCP servers, Refresh).",
    detect: (ctx) => exists(path.join(ctx.home, ".codeium", "windsurf")) || appInstalled(ctx, "Windsurf.app") || !!ctx.which("windsurf"),
    files: (ctx) => [path.join(ctx.home, ".codeium", "windsurf", "mcp_config.json")],
    root: "mcpServers",
    entry: (ctx, key) => ({ serverUrl: ctx.serverUrl, headers: header(key) }),
  },
  {
    id: "gemini",
    name: "Gemini CLI",
    aliases: ["gemini-cli"],
    keyIn: "env",
    restart: `Open a new terminal (it loads ${ENV_VAR}), start gemini and run /mcp.`,
    detect: (ctx) => exists(path.join(ctx.home, ".gemini")) || !!ctx.which("gemini"),
    files: (ctx) => [path.join(ctx.home, ".gemini", "settings.json")],
    root: "mcpServers",
    entry: (ctx) => ({ httpUrl: ctx.serverUrl, headers: { Authorization: `Bearer \${${ENV_VAR}}` } }),
  },
  {
    id: "codex",
    name: "Codex CLI",
    aliases: ["codex-cli", "openai-codex", "chatgpt"],
    keyIn: "env",
    restart: `Open a new terminal (it loads ${ENV_VAR}), then run codex mcp list.`,
    detect: (ctx) => !!ctx.which("codex") || exists(path.dirname(codexConfig(ctx))),
    files: (ctx) => [codexConfig(ctx)],
  },
];

export function resolveClients(spec) {
  const out = [];
  for (const raw of String(spec).split(",").map((s) => s.trim().toLowerCase()).filter(Boolean)) {
    if (raw === "all") return CLIENTS.map((x) => x.id);
    const hits = CLIENTS.filter((x) => x.id === raw || x.aliases.includes(raw));
    if (!hits.length) throw new UsageError(`unknown client "${raw}". Use one of: ${CLIENTS.map((x) => x.id).join(", ")} (or all).`);
    for (const h of hits) if (!out.includes(h.id)) out.push(h.id);
  }
  return out;
}

class UsageError extends Error {}

/** Claude Code: through its own CLI, so the entry lands where Claude Code keeps it (user scope). */
function runClaudeCode(ctx, key, uninstall) {
  const bin = ctx.which("claude");
  const file = claudeUserConfig(ctx);
  if (!bin) return [{ status: "failed", file, error: "the claude command is not on PATH. Install Claude Code, or run this again with --client to skip it." }];
  const want = { type: "http", url: ctx.serverUrl, headers: header(key ?? "") };
  let current;
  try {
    current = JSON.parse(fs.readFileSync(file, "utf8"))?.mcpServers?.[SERVER_NAME];
  } catch {
    current = undefined;
  }
  if (uninstall) {
    if (!current) return [{ status: "absent", file, note: "user scope" }];
    if (ctx.dryRun) return [{ status: "removed", file, command: `claude mcp remove ${SERVER_NAME} -s user` }];
    const r = ctx.run(bin, ["mcp", "remove", SERVER_NAME, "-s", "user"]);
    return [r.code === 0 ? { status: "removed", file } : { status: "failed", file, error: redact(r.stderr || r.stdout).trim() }];
  }
  if (current && deepEqual(current, want)) return [{ status: "unchanged", file }];
  const addArgs = ["mcp", "add", "--transport", "http", "-s", "user", SERVER_NAME, ctx.serverUrl, "--header", `Authorization: Bearer ${key}`];
  const status = current ? "updated" : "added";
  if (ctx.dryRun) return [{ status, file, command: `claude ${addArgs.map((a) => (/\s/.test(a) ? JSON.stringify(a) : a)).join(" ")}` }];
  if (current) ctx.run(bin, ["mcp", "remove", SERVER_NAME, "-s", "user"]);
  const r = ctx.run(bin, addArgs);
  if (r.code !== 0) return [{ status: "failed", file, error: redact(r.stderr || r.stdout).trim() || `claude mcp add exited with ${r.code}` }];
  return [{ status, file }];
}

/** Install (key) or uninstall (key = null) one client. Returns one result per file it touched. */
export function runClient(ctx, client, key) {
  const uninstall = key === null;
  if (client.id === "claude-code") return runClaudeCode(ctx, key, uninstall);
  if (client.id === "codex") {
    const plan = planToml(client.files(ctx)[0], ctx.serverUrl, uninstall);
    return [safeApply(ctx, plan, false)];
  }
  return client.files(ctx).map((file) => {
    const plan = planJson(file, client.root, uninstall ? null : client.entry(ctx, key));
    return safeApply(ctx, plan, client.keyIn === "config");
  });
}

function safeApply(ctx, plan, secret) {
  if (plan.status === "failed") return plan;
  try {
    return applyPlan(ctx, plan, { secret });
  } catch (e) {
    return { status: "failed", file: plan.file, error: e.message };
  }
}

/** Does this client's config have our entry that reads $OUTREACH2DAY_API_KEY? */
function usesEnv(ctx, client) {
  const text = readText(client.files(ctx)[0]).text ?? "";
  return text.includes(ENV_VAR) && (client.id === "codex" ? /\[\s*mcp_servers\.outreach2day\s*\]/.test(text) : text.includes(`"${SERVER_NAME}"`));
}

// ---------------------------------------------------------------------------------------------------------------
// Network checks (both optional: --no-verify skips them, and a network error only warns).

export async function verifyKey(key, fetchImpl = globalThis.fetch) {
  try {
    const res = await fetchImpl(`${API_BASE}/workspaces`, { headers: { Authorization: `Bearer ${key}`, Accept: "application/json" }, signal: AbortSignal.timeout(15000) });
    let count;
    if (res.ok) {
      const body = await res.json().catch(() => null);
      const list = Array.isArray(body) ? body : Array.isArray(body?.items) ? body.items : Array.isArray(body?.workspaces) ? body.workspaces : null;
      count = list?.length;
    }
    return { status: res.status, count };
  } catch (e) {
    return { status: 0, error: e.message };
  }
}

function parseRpc(text) {
  const t = text.trim();
  if (t.startsWith("{")) return JSON.parse(t);
  const data = t
    .split(/\r?\n/)
    .filter((l) => l.startsWith("data:"))
    .map((l) => l.slice(5).trim())
    .pop();
  return data ? JSON.parse(data) : null;
}

/** initialize + tools/list against the MCP endpoint. { status, tools?, server?, error? } */
export async function checkServer(url, key, fetchImpl = globalThis.fetch) {
  const headers = { "Content-Type": "application/json", Accept: "application/json, text/event-stream", Authorization: `Bearer ${key}` };
  const call = (body, extra = {}) => fetchImpl(url, { method: "POST", headers: { ...headers, ...extra }, body: JSON.stringify(body), signal: AbortSignal.timeout(15000) });
  try {
    const init = await call({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "outreach2day-installer", version: VERSION } } });
    if (!init.ok) {
      await init.body?.cancel?.().catch(() => {});
      return { status: init.status };
    }
    const session = init.headers.get("mcp-session-id");
    const initBody = parseRpc(await init.text());
    const extra = session ? { "Mcp-Session-Id": session } : {};
    const version = initBody?.result?.protocolVersion;
    if (version) extra["MCP-Protocol-Version"] = version;
    try {
      const n = await call({ jsonrpc: "2.0", method: "notifications/initialized" }, extra);
      await n.body?.cancel?.().catch(() => {});
      const list = await call({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, extra);
      const tools = list.ok ? parseRpc(await list.text())?.result?.tools?.length : undefined;
      return { status: init.status, tools, server: initBody?.result?.serverInfo?.name };
    } catch {
      return { status: init.status, server: initBody?.result?.serverInfo?.name };
    }
  } catch (e) {
    return { status: 0, error: e.message };
  }
}

// ---------------------------------------------------------------------------------------------------------------
// Terminal input. The key prompt reads raw keystrokes and echoes nothing.

function hasTty() {
  return !!process.stdin.isTTY;
}

function askLine(question) {
  return new Promise((resolve) => {
    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
    rl.question(question, (a) => {
      rl.close();
      resolve(a);
    });
  });
}

function askHidden(question) {
  return new Promise((resolve, reject) => {
    const stdin = process.stdin;
    OUT(question);
    let buf = "";
    stdin.setRawMode(true);
    stdin.resume();
    stdin.setEncoding("utf8");
    const done = (err) => {
      stdin.setRawMode(false);
      stdin.pause();
      stdin.removeListener("data", onData);
      OUT("\n");
      if (err) reject(err);
      else resolve(buf);
    };
    const onData = (chunk) => {
      for (const ch of chunk) {
        if (ch === "\r" || ch === "\n") return done();
        if (ch === "\u0003") return done(Object.assign(new Error("cancelled"), { code: "CANCELLED" }));
        if (ch === "\u0004") return done();
        if (ch === "\u007f" || ch === "\b") buf = buf.slice(0, -1);
        else if (ch >= " ") buf += ch;
      }
    };
    stdin.on("data", onData);
  });
}

function openBrowser(url, platform = process.platform) {
  try {
    const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd.exe", ["/c", "start", "", url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => {}).unref();
    return true;
  } catch {
    return false;
  }
}

// ---------------------------------------------------------------------------------------------------------------
// CLI.

export const HELP = `Outreach2day MCP installer ${VERSION}

Adds the Outreach2day MCP server (${MCP_URL}) to the MCP clients on this computer:
Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI, Codex CLI.

  curl -fsSL ${SCRIPT_URL} | sh                  macOS, Linux
  irm ${SCRIPT_URL_PS1} | iex              Windows PowerShell
  npx -y outreach2day-mcp                                      anywhere with Node.js 18+

Options (after "sh -s --" for curl | sh, e.g. curl -fsSL ${SCRIPT_URL} | sh -s -- --dry-run):
  --client <ids>   only these clients, comma-separated: ${CLIENTS.map((x) => x.id).join(", ")}, or all.
                   Default: every client found on this computer.
  --key <key>      the API key. Safer: paste it when asked, or set O2D_API_KEY.
  --dry-run        show what would change, write nothing.
  --uninstall      remove the outreach2day server from the clients (backups are kept).
  --yes, -y        do not ask for confirmation.
  --no-verify      skip the key and server checks (offline).
  --help, --version

Environment (for irm | iex, which passes no arguments): O2D_API_KEY, O2D_CLIENT, O2D_DRY_RUN=1, O2D_UNINSTALL=1, O2D_YES=1.

API keys: ${API_KEYS_URL}
Manual setup for each client: ${DOCS_URL}
Read the script before running it: curl -fsSL ${SCRIPT_URL} | less
`;

export function parseArgs(argv, env = process.env) {
  const o = {
    key: env.O2D_API_KEY || env[ENV_VAR] || "",
    keyFromEnv: !!(env.O2D_API_KEY || env[ENV_VAR]),
    client: env.O2D_CLIENT || "",
    dryRun: !!env.O2D_DRY_RUN && env.O2D_DRY_RUN !== "0",
    uninstall: !!env.O2D_UNINSTALL && env.O2D_UNINSTALL !== "0",
    yes: !!env.O2D_YES && env.O2D_YES !== "0",
    verify: true,
    serverUrl: env.O2D_SERVER_URL || MCP_URL,
    help: false,
    version: false,
  };
  const a = [...argv];
  const val = (name, inline) => {
    if (inline !== undefined) return inline;
    const v = a.shift();
    if (v === undefined || v.startsWith("--")) throw new UsageError(`${name} needs a value`);
    return v;
  };
  while (a.length) {
    const raw = a.shift();
    const [flag, inline] = raw.startsWith("--") && raw.includes("=") ? [raw.slice(0, raw.indexOf("=")), raw.slice(raw.indexOf("=") + 1)] : [raw, undefined];
    if (flag === "--key") {
      o.key = val(flag, inline);
      o.keyFromEnv = false;
    } else if (flag === "--client" || flag === "--clients") o.client = val(flag, inline);
    else if (flag === "--dry-run") o.dryRun = true;
    else if (flag === "--uninstall" || flag === "--remove") o.uninstall = true;
    else if (flag === "--yes" || flag === "-y") o.yes = true;
    else if (flag === "--no-verify") o.verify = false;
    else if (flag === "--server-url") o.serverUrl = val(flag, inline);
    else if (flag === "--help" || flag === "-h") o.help = true;
    else if (flag === "--version" || flag === "-v") o.version = true;
    else throw new UsageError(`unknown option ${raw}. Run with --help.`);
  }
  if (!isAllowedServerUrl(o.serverUrl)) throw new UsageError(`--server-url must be ${MCP_URL} (or a local http://127.0.0.1 server for testing).`);
  return o;
}

const LABEL = {
  added: green("added    "),
  updated: green("updated  "),
  unchanged: dim("unchanged"),
  removed: green("removed  "),
  absent: dim("not there"),
  failed: red("FAILED   "),
  setenv: green("set      "),
  unsetenv: green("removed  "),
};
const WOULD = { added: "would add", updated: "would update", removed: "would remove", setenv: "would set", unsetenv: "would remove" };

function printResult(ctx, name, r) {
  const status = ctx.dryRun && WOULD[r.status] ? yellow(WOULD[r.status].padEnd(12)) : (LABEL[r.status] ?? r.status).padEnd(color ? 18 : 9) + "   ";
  const where = r.file ? tilde(ctx, r.file) : "";
  say(`  ${name.padEnd(15)} ${status} ${where}${r.note ? dim(` (${r.note})`) : ""}`);
  if (r.backup) say(dim(`  ${"".padEnd(15)} backup: ${tilde(ctx, r.backup)}`));
  if (r.lossy && r.text) say(yellow(`  ${"".padEnd(15)} comments or trailing commas in this file were dropped; the backup keeps them`));
  if (r.command) say(dim(`  ${"".padEnd(15)} ${r.command}`));
  if (r.error) say(red(`  ${"".padEnd(15)} ${r.error}`));
}

/** The installer. Returns the exit code. `io` lets tests pass a fetch stub and answers. */
export async function main(argv = process.argv.slice(2), io = {}) {
  let o;
  try {
    o = parseArgs(argv, io.env ?? process.env);
  } catch (e) {
    if (e instanceof UsageError) {
      say(red(`outreach2day installer: ${e.message}`));
      return 2;
    }
    throw e;
  }
  if (o.help) {
    OUT(HELP);
    return 0;
  }
  if (o.version) {
    say(VERSION);
    return 0;
  }
  const ctx = makeCtx({ ...(io.ctx ?? {}), dryRun: o.dryRun, serverUrl: o.serverUrl });
  const fetchImpl = io.fetch ?? globalThis.fetch;
  const interactive = io.interactive ?? hasTty();
  const ask = io.ask ?? askLine;
  const askKey = io.askHidden ?? askHidden;

  say(bold(`Outreach2day MCP installer ${VERSION}`) + (o.dryRun ? yellow("  (dry run: nothing is written)") : ""));
  say(dim(`Server ${ctx.serverUrl}. Script: ${SCRIPT_URL} (read it: curl -fsSL ${SCRIPT_URL} | less)`));
  say();

  let ids;
  try {
    ids = o.client ? resolveClients(o.client) : CLIENTS.filter((x) => x.detect(ctx)).map((x) => x.id);
  } catch (e) {
    say(red(e.message));
    return 2;
  }
  const chosen = CLIENTS.filter((x) => ids.includes(x.id));
  if (!chosen.length) {
    say("No supported MCP client found on this computer (Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI, Codex CLI).");
    say(`Pick one with --client, e.g. --client cursor, or follow the manual steps: ${DOCS_URL}`);
    return 1;
  }
  say(`${o.client ? "Clients" : "Found"}: ${chosen.map((x) => x.name).join(", ")}`);

  // Uninstall needs no key.
  if (o.uninstall) {
    if (interactive && !o.yes && !o.dryRun) {
      const a = (await ask(`Remove outreach2day from ${chosen.map((x) => x.name).join(", ")}? [Y/n] `)).trim().toLowerCase();
      if (a && a !== "y" && a !== "yes") return say("Nothing changed."), 0;
    }
    say();
    let failed = false;
    for (const cl of chosen)
      for (const r of runClient(ctx, cl, null)) {
        failed ||= r.status === "failed";
        printResult(ctx, cl.name, r);
      }
    // The key file goes when no remaining Codex / Gemini CLI entry reads it.
    const leftUsers = CLIENTS.filter((x) => x.keyIn === "env" && !chosen.includes(x) && usesEnv(ctx, x));
    if (!leftUsers.length)
      for (const p of applyEnvStore(ctx, planEnvStore(ctx, null).filter((p) => p.status !== "absent"), null)) {
        failed ||= p.status === "failed";
        printResult(ctx, p.label, p);
      }
    say();
    say(failed ? red("Some clients could not be changed; see above.") : "Done. Restart the clients to drop the server. The API key itself still works; revoke it on the API keys page if you no longer need it:");
    if (!failed) say(`  ${API_KEYS_URL}`);
    say(dim("  The backups (*.outreach2day-backup-*) keep the old entries, key included; delete them once you no longer need them."));
    return failed ? 1 : 0;
  }

  // The key: --key / O2D_API_KEY / OUTREACH2DAY_API_KEY, or a hidden prompt.
  let key = null;
  if (o.key) {
    key = cleanKey(o.key);
    if (!key) {
      say(red(`That API key does not look right. Keys start with ot2d_ and are created at ${API_KEYS_URL}`));
      return 2;
    }
    say(`API key: from ${o.keyFromEnv ? "the environment" : "--key"}.`);
  } else if (!interactive) {
    say(red("No API key and no terminal to ask for one."));
    say(`Create a key at ${API_KEYS_URL}, then run:`);
    say(`  curl -fsSL ${SCRIPT_URL} | O2D_API_KEY=ot2d_... sh`);
    return 2;
  } else {
    say();
    say(`You need an Outreach2day API key. Create one here: ${API_KEYS_URL}`);
    for (let tries = 0; tries < 5 && !key; tries++) {
      let raw;
      try {
        raw = await askKey(tries === 0 ? "Paste your API key (input is hidden), or press Enter to open that page: " : "Paste your API key (hidden): ");
      } catch {
        say("Cancelled. Nothing changed.");
        return 130;
      }
      if (!raw.trim()) {
        say(openBrowser(API_KEYS_URL, ctx.platform) ? "Opened the API keys page in your browser. Create a key, copy it, and paste it here." : `Open ${API_KEYS_URL}, create a key and paste it here.`);
        continue;
      }
      key = cleanKey(raw);
      if (!key) say(yellow("That does not look like an API key (it should start with ot2d_). Try again."));
      else say(`Key received (${key.slice(0, 5)}…, ${key.length} characters).`);
    }
    if (!key) return say("No key. Nothing changed."), 2;
  }
  addSecret(key);
  addSecret(`Bearer ${key}`);
  if (!key.startsWith("ot2d_")) say(yellow("Note: Outreach2day keys start with ot2d_. Using this one anyway."));

  if (o.verify && ctx.serverUrl === MCP_URL) {
    const v = await verifyKey(key, fetchImpl);
    if (v.status === 200) say(`Key checked: valid${v.count != null ? ` (${v.count} workspace${v.count === 1 ? "" : "s"})` : ""}.`);
    else if (v.status === 401 || v.status === 403) {
      say(red(`The API rejected this key (HTTP ${v.status}). Create a new one at ${API_KEYS_URL} and run this again.`));
      return 1;
    } else say(yellow(`Could not check the key (${v.status ? `HTTP ${v.status}` : v.error}). Continuing.`));
  }

  if (interactive && !o.yes && !o.dryRun) {
    const a = (await ask(`Add outreach2day to ${chosen.map((x) => x.name).join(", ")}? [Y/n] `)).trim().toLowerCase();
    if (a && a !== "y" && a !== "yes") return say("Nothing changed."), 0;
  }

  say();
  const results = [];
  for (const cl of chosen)
    for (const r of runClient(ctx, cl, key)) {
      results.push({ cl, r });
      printResult(ctx, cl.name, r);
    }
  const envUsers = chosen.filter((x) => x.keyIn === "env" && results.some(({ cl, r }) => cl === x && r.status !== "failed"));
  if (envUsers.length)
    for (const p of applyEnvStore(ctx, planEnvStore(ctx, key), key)) {
      results.push({ cl: { keyIn: "env" }, r: p });
      printResult(ctx, p.label, p);
    }
  const failed = results.filter(({ r }) => r.status === "failed");
  const ok = results.filter(({ r }) => r.status !== "failed");

  // Server check.
  say();
  if (o.verify) {
    const s = await checkServer(ctx.serverUrl, key, fetchImpl);
    if (s.status === 200) say(green(`Server check: ${ctx.serverUrl} answered${s.tools != null ? `, ${s.tools} tools` : ""}.`));
    else if (s.status === 404)
      say(
        yellow("Server check: the Outreach2day MCP server is not yet enabled for your workspace.") +
          "\n  The config above is in place, so your clients connect as soon as it opens. You'll be notified; no need to run this again.",
      );
    else if (s.status === 401 || s.status === 403) say(red(`Server check: the MCP server rejected this key (HTTP ${s.status}). Create a new key at ${API_KEYS_URL}.`));
    else say(yellow(`Server check: no answer from ${ctx.serverUrl} (${s.status ? `HTTP ${s.status}` : s.error}). The config is written; try your client in a minute.`));
  }

  // Summary.
  if (ctx.dryRun) {
    say();
    say(yellow("Dry run: nothing was written. Run again without --dry-run to apply."));
  }
  const touched = chosen.filter((x) => results.some(({ cl, r }) => cl === x && r.status !== "failed" && r.status !== "absent"));
  if (!ctx.dryRun && touched.length) {
    say();
    say(bold("Next"));
    for (const cl of touched) say(`  ${cl.name}: ${cl.restart}`);
    say(`  Then ask: ${bold(`"${FIRST_PROMPT}"`)}`);
    const inConfig = ok.filter(({ cl, r }) => cl.keyIn === "config" && r.file).map(({ r }) => tilde(ctx, r.file));
    if (inConfig.length) say(dim(`  The key is stored in plain text in ${[...new Set(inConfig)].join(", ")} (readable only by you). Keep these files out of git.`));
    say(dim(`  Undo: ${ctx.platform === "win32" ? `$env:O2D_UNINSTALL = "1"; irm ${SCRIPT_URL_PS1} | iex` : `curl -fsSL ${SCRIPT_URL} | sh -s -- --uninstall`}`));
  }
  if (failed.length) {
    say();
    say(red(`${failed.length} change${failed.length === 1 ? "" : "s"} failed; see above. Manual setup: ${DOCS_URL}`));
    return 1;
  }
  return 0;
}

// Run when executed directly (node install.mjs, npx outreach2day-mcp, or the sh / PowerShell wrappers), not when a
// test imports it.
const direct = (() => {
  try {
    return fs.realpathSync(process.argv[1] ?? "") === fs.realpathSync(fileURLToPath(import.meta.url)) || process.env.O2D_INSTALLER_WRAPPED === "1";
  } catch {
    return process.env.O2D_INSTALLER_WRAPPED === "1";
  }
})();
if (direct) {
  main().then(
    (code) => process.exit(code),
    (e) => {
      say(red(`outreach2day installer: ${e?.message ?? e}`));
      process.exit(1);
    },
  );
}
O2D_INSTALLER_JS
}

main "$@"