#!/bin/sh
# Outreach2day MCP installer for macOS and Linux.
#
#   curl -fsSL https://outreach2day.com/install | sh
#   curl -fsSL https://outreach2day.com/install | sh -s -- --client cursor --dry-run
#
# Read it before you run it:  curl -fsSL https://outreach2day.com/install | less
#
# What this file does:
#   1. Looks for Node.js 18 or newer (node on your PATH).
#   2. Writes the installer at the bottom of this file (plain JavaScript, between the O2D_INSTALLER_JS markers) to a
#      temp file and runs it with node. It adds the MCP server "outreach2day" (https://public.outreach2day.com/mcp)
#      to Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI and Codex CLI when it finds them,
#      backing up each config file first and keeping every other server in it. It is the same code as
#      packages/mcp-installer/install.mjs in the site repo.
#   3. Without Node it can still set up Claude Code (claude mcp add). The other clients need Node, or the manual
#      steps at https://outreach2day.com/mcp.
# No API key by default: each client signs in to Outreach2day (OAuth) on first use. API key mode (headless / CI,
# clients without OAuth): --use-key (asked in the terminal without echo) or --key <key> / O2D_API_KEY; the key is
# sent only to public.outreach2day.com. Options: --client <ids>, --use-key, --key <key>, --dry-run, --uninstall,
# --yes, --no-verify, --help.
#
# Generated by packages/mcp-installer/build.mjs from wrappers/install.sh + install.mjs. Edit those, not public/install.

set -u

MCP_URL="https://public.outreach2day.com/mcp"
API_KEYS_URL="https://app.outreach2day.com/login?returnTo=%2Fapi-keys"
DOCS_URL="https://outreach2day.com/mcp"

node_ok() {
  command -v node >/dev/null 2>&1 &&
    node -e 'process.exit(+process.versions.node.split(".")[0] >= 18 ? 0 : 1)' >/dev/null 2>&1
}

# A terminal to ask questions on, even when this script itself arrives through a pipe (curl | sh).
has_tty() {
  (exec </dev/tty) 2>/dev/null
}

main() {
  if node_ok; then
    dir=$(mktemp -d "${TMPDIR:-/tmp}/outreach2day-install.XXXXXX") || exit 1
    trap 'rm -rf "$dir"' EXIT
    trap 'rm -rf "$dir"; exit 130' INT TERM
    installer_js >"$dir/install.mjs"
    if has_tty; then
      O2D_INSTALLER_WRAPPED=1 node "$dir/install.mjs" "$@" </dev/tty
    else
      O2D_INSTALLER_WRAPPED=1 node "$dir/install.mjs" "$@" </dev/null
    fi
    exit $?
  fi
  without_node "$@"
}

# No Node.js: Claude Code only, through its own CLI.
without_node() {
  echo "Outreach2day MCP installer"
  echo "Node.js 18+ was not found, so only Claude Code can be set up from here (claude mcp add)."
  echo "For Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI or Codex, install Node.js (https://nodejs.org) and run this again, or follow $DOCS_URL"
  echo
  key="${O2D_API_KEY:-}"
  use_key="${O2D_USE_KEY:-}"
  [ "$use_key" = "0" ] && use_key=
  clients="${O2D_CLIENT:-}"
  uninstall="${O2D_UNINSTALL:-}"
  dry="${O2D_DRY_RUN:-}"
  verify=1
  while [ $# -gt 0 ]; do
    case "$1" in
      --key) key="${2:-}"; shift ;;
      --key=*) key="${1#--key=}" ;;
      --use-key | --api-key) use_key=1 ;;
      --client | --clients) clients="${2:-}"; shift ;;
      --client=* | --clients=*) clients="${1#*=}" ;;
      --uninstall | --remove) uninstall=1 ;;
      --dry-run) dry=1 ;;
      --no-verify) verify= ;;
      --yes | -y) ;;
      --help | -h) echo "Options without Node.js: --use-key, --key <key>, --uninstall, --dry-run, --no-verify. Full options need Node.js 18+."; exit 0 ;;
      *) echo "Option $1 needs Node.js 18+."; exit 2 ;;
    esac
    shift
  done
  case ",$clients," in
    ",,") ;;
    *,claude-code,* | *,claude,* | *,all,*) ;;
    *) echo "The clients you picked ($clients) need Node.js 18+ for this installer."; exit 1 ;;
  esac
  if ! command -v claude >/dev/null 2>&1; then
    echo "Claude Code (the claude command) was not found either. Install Node.js 18+ and run this again, or follow $DOCS_URL"
    exit 1
  fi

  if [ -n "$uninstall" ]; then
    if [ -n "$dry" ]; then echo "Would run: claude mcp remove outreach2day -s user"; exit 0; fi
    claude mcp remove outreach2day -s user && echo "Removed outreach2day from Claude Code."
    exit $?
  fi

  if [ -z "$key" ] && [ -z "$use_key" ]; then
    # OAuth: the URL only. Claude Code asks you to sign in (/mcp → Authenticate).
    if [ -n "$dry" ]; then echo "Would run: claude mcp add --transport http -s user outreach2day $MCP_URL"; exit 0; fi
    claude mcp remove outreach2day -s user >/dev/null 2>&1 || true
    if claude mcp add --transport http -s user outreach2day "$MCP_URL" >/dev/null 2>&1; then
      echo "Claude Code: added outreach2day (user scope). No API key needed: you sign in to Outreach2day from Claude Code."
    else
      echo "Claude Code: claude mcp add failed. Add it by hand: $DOCS_URL/claude"
      exit 1
    fi
    echo
    echo "Next: start Claude Code, run /mcp, pick outreach2day, choose Authenticate (or run: claude mcp login outreach2day)."
    echo "Then ask: \"Check my Outreach2day account status\""
    echo "Headless or CI use: run again with --use-key. Undo: curl -fsSL https://outreach2day.com/install | sh -s -- --uninstall"
    exit 0
  fi

  if [ -z "$key" ]; then
    if ! has_tty; then
      echo "--use-key needs a terminal to ask for the key. Create a key at $API_KEYS_URL, then run:"
      echo "  curl -fsSL https://outreach2day.com/install | O2D_API_KEY=ot2d_... sh"
      exit 2
    fi
    echo "API key mode. Create a key here: $API_KEYS_URL"
    printf "Paste your API key (input is hidden): " >/dev/tty
    trap 'stty echo </dev/tty 2>/dev/null; exit 130' INT TERM
    stty -echo </dev/tty 2>/dev/null
    IFS= read -r key </dev/tty || key=""
    stty echo </dev/tty 2>/dev/null
    printf "\n" >/dev/tty
  fi
  key=$(printf '%s' "$key" | tr -d '[:space:]')
  key="${key#Bearer}"
  case "$key" in
    "" | *[!A-Za-z0-9_-]*) echo "That does not look like an API key (it should start with ot2d_). Nothing changed."; exit 2 ;;
  esac
  if [ ${#key} -lt 8 ]; then echo "That API key is too short. Nothing changed."; exit 2; fi

  # The config names $OUTREACH2DAY_API_KEY (Claude Code expands ${VAR} in headers); the key itself goes only to
  # ~/.config/outreach2day/env (0600), loaded from your shell profile. Same files as the Node installer.
  env_file="${XDG_CONFIG_HOME:-$HOME/.config}/outreach2day/env"
  case "$(basename "${SHELL:-sh}")" in
    zsh) profile="${ZDOTDIR:-$HOME}/.zshrc" ;;
    bash) profile="$HOME/.bashrc" ;;
    *) profile="$HOME/.profile" ;;
  esac
  if [ -n "$dry" ]; then
    echo "Would write: $env_file (0600, the key) and a line in $profile that loads it"
    echo "Would run: claude mcp add --transport http -s user outreach2day $MCP_URL --header 'Authorization: Bearer \${OUTREACH2DAY_API_KEY}'"
    exit 0
  fi
  mkdir -p "$(dirname "$env_file")" || exit 1
  (umask 077 && printf "# Outreach2day MCP API key, written by https://outreach2day.com/install (--use-key / --key).\nexport OUTREACH2DAY_API_KEY='%s'\n" "$key" >"$env_file") || exit 1
  chmod 600 "$env_file"
  if ! grep -q '# >>> outreach2day mcp >>>' "$profile" 2>/dev/null; then
    printf '\n# >>> outreach2day mcp >>>\n[ -f "%s" ] && . "%s"\n# <<< outreach2day mcp <<<\n' "$env_file" "$env_file" >>"$profile"
  fi
  echo "API key: saved to $env_file (readable only by you), loaded from $profile."
  claude mcp remove outreach2day -s user >/dev/null 2>&1 || true
  if claude mcp add --transport http -s user outreach2day "$MCP_URL" --header 'Authorization: Bearer ${OUTREACH2DAY_API_KEY}' >/dev/null 2>&1; then
    echo "Claude Code: added outreach2day (user scope). Its config names OUTREACH2DAY_API_KEY; the key itself is not in it."
  else
    echo "Claude Code: claude mcp add failed. Add it by hand: $DOCS_URL/claude"
    exit 1
  fi

  if [ -n "$verify" ] && command -v curl >/dev/null 2>&1; then
    # The header comes from stdin (-H @-), so the key is not in the process list.
    code=$(printf 'Authorization: Bearer %s\n' "$key" | curl -s -o /dev/null -w '%{http_code}' -X POST "$MCP_URL" \
      -H @- -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
      -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"outreach2day-installer","version":"sh"}}}' 2>/dev/null)
    case "$code" in
      200) echo "Server check: $MCP_URL answered." ;;
      404) echo "Server check: $MCP_URL did not answer (HTTP 404)."
           echo "  The config is in place. Try again in a few minutes or write to support@outreach2day.com." ;;
      401 | 403) echo "Server check: the server rejected this key (HTTP $code). Create a new key at $API_KEYS_URL" ;;
      *) echo "Server check: no answer from $MCP_URL (HTTP $code). The config is written; try again in a minute." ;;
    esac
  fi
  echo
  echo "Next: open a new terminal (it loads OUTREACH2DAY_API_KEY), start Claude Code, run /mcp, then ask: \"Check my Outreach2day account status\""
  echo "Undo: curl -fsSL https://outreach2day.com/install | sh -s -- --uninstall (with Node.js it also removes $env_file)"
}

installer_js() {
  cat <<'O2D_INSTALLER_JS'
#!/usr/bin/env node
// Outreach2day MCP installer.
//
// Adds the hosted Outreach2day MCP server (https://public.outreach2day.com/mcp, Streamable HTTP) to the MCP clients on
// this machine, under the server name "outreach2day".
//
// The same file runs behind every entry point:
//   curl -fsSL https://outreach2day.com/install | sh          public/install (POSIX sh wrapper, runs this with node)
//   irm https://outreach2day.com/install.ps1 | iex            public/install.ps1 (PowerShell wrapper)
//   node install.mjs                                          from a checkout (the npm package outreach2day-mcp is not
//                                                             published: `npx -y outreach2day-mcp` returns 404)
//
// Default: OAuth. No API key is asked for or stored. Each client gets the server URL only and signs in to
// Outreach2day itself on first use (the server answers an anonymous request with 401 + WWW-Authenticate
// resource_metadata; OAuth 2.1 with PKCE and dynamic client registration). Per client (checked 29.09.2026):
//   Claude Code     `claude mcp add --transport http -s user outreach2day <url>`; sign in: /mcp → Authenticate, or
//                   `claude mcp login outreach2day`                          https://code.claude.com/docs/en/mcp
//   Claude Desktop  nothing is written: remote servers are custom connectors (Customize → Connectors → Add custom
//                   connector), claude_desktop_config.json is for local servers. The installer prints the Add to Claude
//                   link (CLAUDE_CONNECT_URL), which opens that dialog with the name and URL filled in
//                   https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp
//   Cursor          ~/.cursor/mcp.json, mcpServers.outreach2day = { url }       https://cursor.com/docs/context/mcp
//   VS Code         <user dir>/Code/User/mcp.json, servers.outreach2day = { type: "http", url }
//                   (MCP authorization with dynamic client registration)  https://code.visualstudio.com/updates/v1_101
//   Windsurf        now Devin Desktop: $XDG_CONFIG_HOME/devin/mcp_config.json or ~/.config/devin/mcp_config.json
//                   (Windows: %APPDATA%\devin\mcp_config.json), mcpServers.outreach2day = { serverUrl }; also
//                   ~/.codeium/windsurf/mcp_config.json when that directory exists (older Windsurf builds)
//                                                                    https://docs.devin.ai/desktop/cascade/mcp
//   Gemini CLI      ~/.gemini/settings.json, mcpServers.outreach2day = { httpUrl }; sign in: /mcp auth outreach2day
//                                                                    https://geminicli.com/docs/tools/mcp-server/
//   Codex CLI       ~/.codex/config.toml, [mcp_servers.outreach2day] url; sign in: codex mcp login outreach2day
//                                                                    https://learn.chatgpt.com/docs/extend/mcp?surface=cli
//
// API key mode (--key, --use-key or O2D_API_KEY): for headless / CI use and clients without OAuth. The key is written
// to one place only, ~/.config/outreach2day/env (0600, loaded by your shell profile; Windows: a user environment
// variable). The client configs name the variable and never hold the key:
//   Claude Code     --header "Authorization: Bearer ${OUTREACH2DAY_API_KEY}" (Claude Code expands ${VAR} in headers)
//   Cursor, VS Code, Windsurf   headers.Authorization = "Bearer ${env:OUTREACH2DAY_API_KEY}"
//   Gemini CLI      headers.Authorization = "Bearer ${OUTREACH2DAY_API_KEY}"
//   Codex CLI       bearer_token_env_var = "OUTREACH2DAY_API_KEY"
//   Claude Desktop  no key mode: the connector signs in. An mcp-remote entry from 0.1.0 is left alone until --uninstall.
// Running again without a key switches the entries back to OAuth and removes the key file once nothing reads it.
//
// Safety rules this file keeps:
//   - The server URL is pinned to https://public.outreach2day.com/mcp (a local http://127.0.0.1 / localhost server is
//     allowed for testing only). A key is sent only to public.outreach2day.com.
//   - A key is never printed: every line of output goes through redact().
//   - A config file is backed up next to itself (<file>.outreach2day-backup-<time>) before it is changed; other
//     servers and settings in it are kept. A file that does not parse is left alone.
//   - Re-running is safe: an entry that is already right is left untouched (no write, no backup).
//   - No dependencies: Node 18+ standard library only.

import { spawn, spawnSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import readline from "node:readline";
import { fileURLToPath } from "node:url";

// The installer version. The single source: build.mjs copies it into package.json (outreach2day-mcp) and --check
// fails when they differ. Kept in step with the MCP server and its registry entry (com.outreach2day/mcp).
export const VERSION = "1.0.0";
export const SERVER_NAME = "outreach2day";
export const MCP_URL = "https://public.outreach2day.com/mcp";
export const API_BASE = "https://public.outreach2day.com";
/** The app's API keys page (backend src/api/public_api.py PUBLIC_API_KEYS_URL). */
export const API_KEYS_URL = "https://app.outreach2day.com/login?returnTo=%2Fapi-keys";
export const SCRIPT_URL = "https://outreach2day.com/install";
export const SCRIPT_URL_PS1 = "https://outreach2day.com/install.ps1";
export const DOCS_URL = "https://outreach2day.com/mcp";
export const ENV_VAR = "OUTREACH2DAY_API_KEY";
export const FIRST_PROMPT = "Check my Outreach2day account status";
/** Add to Claude: opens claude.ai's Add custom connector dialog with the name and URL filled in (claude.ai, Desktop, mobile). */
export const CLAUDE_CONNECT_URL = `https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Outreach2day&connectorUrl=${encodeURIComponent(MCP_URL)}`;
const BLOCK_START = "# >>> outreach2day mcp >>>";
const BLOCK_END = "# <<< outreach2day mcp <<<";
const KEY_RE = /^[A-Za-z0-9_-]{8,512}$/;

// ---------------------------------------------------------------------------------------------------------------
// Output. Every line goes through redact(), so a key can not reach the terminal even by mistake.

const SECRETS = new Set();
export function addSecret(s) {
  if (s) SECRETS.add(s);
}
export function redact(text) {
  let s = String(text);
  for (const k of SECRETS) s = s.split(k).join(`${k.slice(0, 5)}…(hidden)`);
  return s;
}
let OUT = (s) => process.stdout.write(s);
export function setOutput(fn) {
  OUT = fn;
}
const color = !process.env.NO_COLOR && process.stdout.isTTY;
const c = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
const bold = c(1);
const dim = c(2);
const green = c(32);
const yellow = c(33);
const red = c(31);
function say(line = "") {
  OUT(redact(line) + "\n");
}

// ---------------------------------------------------------------------------------------------------------------
// Context: everything that touches the machine, so tests can run every client against a temp HOME.

export function which(cmd, env = process.env, platform = process.platform) {
  const sep = platform === "win32" ? ";" : ":";
  const dirs = (env.PATH ?? env.Path ?? "").split(sep).filter(Boolean);
  const exts = platform === "win32" ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
  for (const d of dirs)
    for (const e of exts) {
      const p = path.join(d, cmd + e);
      try {
        if (!fs.statSync(p).isFile()) continue;
        if (platform !== "win32") fs.accessSync(p, fs.constants.X_OK);
        return p;
      } catch {
        /* not here */
      }
    }
  return null;
}

/** Runs a command without a shell; .cmd/.bat shims on Windows go through cmd.exe with quoted arguments. */
export function runCommand(file, args, env = process.env) {
  let r;
  if (process.platform === "win32" && /\.(cmd|bat)$/i.test(file)) {
    const q = (a) => `"${String(a).replace(/"/g, '""')}"`;
    r = spawnSync(env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${[q(file), ...args.map(q)].join(" ")}"`], { encoding: "utf8", env, timeout: 120000, windowsVerbatimArguments: true });
  } else {
    r = spawnSync(file, args, { encoding: "utf8", env, timeout: 120000 });
  }
  return { code: r.status ?? (r.error ? 127 : 1), stdout: r.stdout ?? "", stderr: `${r.stderr ?? ""}${r.error ? r.error.message : ""}` };
}

export function makeCtx(o = {}) {
  const env = o.env ?? process.env;
  const platform = o.platform ?? process.platform;
  return {
    env,
    platform,
    home: o.home ?? os.homedir(),
    serverUrl: o.serverUrl ?? MCP_URL,
    dryRun: !!o.dryRun,
    now: o.now ?? new Date(),
    nodePath: o.nodePath ?? process.execPath,
    /** Where macOS apps are looked up for detection (tests pass []). */
    applications: o.applications ?? ["/Applications", path.join(o.home ?? os.homedir(), "Applications")],
    which: o.which ?? ((cmd) => which(cmd, env, platform)),
    run: o.run ?? ((file, args) => runCommand(file, args, env)),
  };
}

const exists = (p) => {
  try {
    fs.statSync(p);
    return true;
  } catch {
    return false;
  }
};
export const tilde = (ctx, p) => (p.startsWith(ctx.home + path.sep) ? "~" + p.slice(ctx.home.length) : p);

/** Per-user app config dir: ~/Library/Application Support, %APPDATA%, or $XDG_CONFIG_HOME / ~/.config. */
export function appConfigDir(ctx) {
  if (ctx.platform === "darwin") return path.join(ctx.home, "Library", "Application Support");
  if (ctx.platform === "win32") return ctx.env.APPDATA ?? path.join(ctx.home, "AppData", "Roaming");
  return ctx.env.XDG_CONFIG_HOME ?? path.join(ctx.home, ".config");
}
const xdgConfig = (ctx) => (ctx.platform !== "win32" && ctx.env.XDG_CONFIG_HOME) || path.join(ctx.home, ".config");
const appInstalled = (ctx, mac) => ctx.platform === "darwin" && ctx.applications.some((d) => exists(path.join(d, mac)));

export function isAllowedServerUrl(u) {
  if (u === MCP_URL) return true;
  try {
    const x = new URL(u);
    return (x.protocol === "http:" || x.protocol === "https:") && (x.hostname === "127.0.0.1" || x.hostname === "localhost");
  } catch {
    return false;
  }
}

/** "Bearer ot2d_x", spaces and newlines around a pasted key → "ot2d_x". Returns null when it is not a key. */
export function cleanKey(raw) {
  const k = String(raw ?? "").trim().replace(/^Bearer\s+/i, "").trim();
  return KEY_RE.test(k) ? k : null;
}

// ---------------------------------------------------------------------------------------------------------------
// JSON / JSONC files (VS Code and Gemini CLI allow comments and trailing commas).

export function parseJsonc(text) {
  const src = text.replace(/^/, "");
  if (src.trim() === "") return { value: {}, lossy: false };
  try {
    return { value: JSON.parse(src), lossy: false };
  } catch {
    /* try JSONC */
  }
  let out = "";
  let inStr = false;
  for (let i = 0; i < src.length; i++) {
    const ch = src[i];
    const nx = src[i + 1];
    if (inStr) {
      out += ch;
      if (ch === "\\") out += src[++i] ?? "";
      else if (ch === '"') inStr = false;
      continue;
    }
    if (ch === '"') {
      inStr = true;
      out += ch;
    } else if (ch === "/" && nx === "/") {
      while (i < src.length && src[i] !== "\n") i++;
      out += "\n";
    } else if (ch === "/" && nx === "*") {
      const end = src.indexOf("*/", i + 2);
      i = end < 0 ? src.length : end + 1;
    } else out += ch;
  }
  let res = "";
  inStr = false;
  for (let i = 0; i < out.length; i++) {
    const ch = out[i];
    if (inStr) {
      res += ch;
      if (ch === "\\") res += out[++i] ?? "";
      else if (ch === '"') inStr = false;
      continue;
    }
    if (ch === '"') inStr = true;
    if (ch === ",") {
      let k = i + 1;
      while (k < out.length && /\s/.test(out[k])) k++;
      if (out[k] === "}" || out[k] === "]") continue;
    }
    res += ch;
  }
  return { value: JSON.parse(res), lossy: true };
}

function detectIndent(text) {
  const m = /\n([ \t]+)\S/.exec(text);
  if (!m) return 2;
  return m[1][0] === "\t" ? "\t" : Math.min(m[1].length, 8);
}

export function deepEqual(a, b) {
  if (a === b) return true;
  if (typeof a !== "object" || typeof b !== "object" || !a || !b || Array.isArray(a) !== Array.isArray(b)) return false;
  const ka = Object.keys(a);
  const kb = Object.keys(b);
  return ka.length === kb.length && ka.every((k) => deepEqual(a[k], b[k]));
}

function readText(file) {
  try {
    return { text: fs.readFileSync(file, "utf8") };
  } catch (e) {
    if (e.code === "ENOENT") return { text: null };
    return { error: `cannot read ${file}: ${e.message}` };
  }
}

/**
 * Plan a change to one JSON config: set `doc[root].outreach2day = entry`, or delete it when entry is null.
 * Returns { status: added|updated|unchanged|removed|absent|failed, file, text?, existed?, lossy?, error? }.
 */
export function planJson(file, root, entry) {
  const r = readText(file);
  if (r.error) return { status: "failed", file, error: r.error };
  let doc = {};
  let lossy = false;
  let indent = 2;
  if (r.text != null) {
    try {
      ({ value: doc, lossy } = parseJsonc(r.text));
    } catch {
      return { status: "failed", file, error: "the file is not valid JSON, so it was left alone" };
    }
    if (!doc || typeof doc !== "object" || Array.isArray(doc)) return { status: "failed", file, error: "the file is not a JSON object, so it was left alone" };
    indent = detectIndent(r.text);
  }
  const servers = doc[root];
  if (servers !== undefined && (servers === null || typeof servers !== "object" || Array.isArray(servers)))
    return { status: "failed", file, error: `"${root}" in the file is not an object, so it was left alone` };
  const had = !!servers && Object.prototype.hasOwnProperty.call(servers, SERVER_NAME);
  const eol = r.text && r.text.includes("\r\n") ? "\r\n" : "\n";
  const write = (next) => (JSON.stringify(next, null, indent) + "\n").replace(/\n/g, eol);
  if (entry === null) {
    if (!had) return { status: "absent", file };
    const nextServers = { ...servers };
    delete nextServers[SERVER_NAME];
    return { status: "removed", file, text: write({ ...doc, [root]: nextServers }), existed: true, lossy };
  }
  if (had && deepEqual(servers[SERVER_NAME], entry)) return { status: "unchanged", file };
  return { status: had ? "updated" : "added", file, text: write({ ...doc, [root]: { ...(servers ?? {}), [SERVER_NAME]: entry } }), existed: r.text != null, lossy };
}

// ---------------------------------------------------------------------------------------------------------------
// Codex config.toml: one [mcp_servers.outreach2day] table, replaced as a whole; everything else is kept as text.

const TOML_HEADER = /^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*(#.*)?$/;
const ourTable = (name) => {
  const n = name.replace(/["']/g, "").replace(/\s+/g, "");
  return n === `mcp_servers.${SERVER_NAME}` || n.startsWith(`mcp_servers.${SERVER_NAME}.`);
};

/** Our table. withKey: Codex reads the key from $OUTREACH2DAY_API_KEY; without it Codex signs in with OAuth. */
export function codexBlock(url, withKey = false) {
  const lines = [`[mcp_servers.${SERVER_NAME}]`, `url = "${url}"`];
  if (withKey) lines.push(`bearer_token_env_var = "${ENV_VAR}"`);
  return lines;
}

export function planToml(file, url, remove, withKey = false) {
  const r = readText(file);
  if (r.error) return { status: "failed", file, error: r.error };
  const text = r.text ?? "";
  const eol = text.includes("\r\n") ? "\r\n" : "\n";
  const kept = [];
  const ours = [];
  let inOurs = false;
  for (const line of text.split(/\r?\n/)) {
    const m = TOML_HEADER.exec(line);
    if (m) inOurs = ourTable(m[1]);
    (inOurs ? ours : kept).push(line);
  }
  const found = ours.length > 0;
  const rest = kept.join(eol).replace(/\s+$/, "");
  if (remove) {
    if (!found) return { status: "absent", file };
    return { status: "removed", file, text: rest ? rest + eol : "", existed: true };
  }
  const block = codexBlock(url, withKey);
  const current = ours.map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
  if (found && deepEqual(current, block)) return { status: "unchanged", file };
  return { status: found ? "updated" : "added", file, text: (rest ? rest + eol + eol : "") + block.join(eol) + eol, existed: r.text != null };
}

// ---------------------------------------------------------------------------------------------------------------
// Writing: back up, write to a temp file next to the target, rename. Symlinked configs are written through.

const stamp = (d) => d.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");

export function applyPlan(ctx, plan, { secret = false } = {}) {
  if (!("text" in plan) || ctx.dryRun) return plan;
  let target = plan.file;
  try {
    target = fs.realpathSync(plan.file);
  } catch {
    /* new file */
  }
  let mode = secret ? 0o600 : 0o644;
  if (plan.existed) {
    const backup = `${target}.outreach2day-backup-${stamp(ctx.now)}`;
    fs.copyFileSync(target, backup);
    if (ctx.platform !== "win32") fs.chmodSync(backup, 0o600);
    plan.backup = backup;
    mode = secret ? 0o600 : fs.statSync(target).mode & 0o777;
  }
  fs.mkdirSync(path.dirname(target), { recursive: true });
  const tmp = `${target}.outreach2day-tmp-${process.pid}`;
  fs.writeFileSync(tmp, plan.text, { mode });
  if (ctx.platform !== "win32") fs.chmodSync(tmp, mode);
  fs.renameSync(tmp, target);
  return plan;
}

// ---------------------------------------------------------------------------------------------------------------
// Key for Codex and Gemini CLI: an env file sourced from the shell profile (Windows: user environment variable).

export function envFiles(ctx) {
  const dir = path.join(xdgConfig(ctx), "outreach2day");
  return { env: path.join(dir, "env"), fish: path.join(xdgConfig(ctx), "fish", "conf.d", "outreach2day.fish") };
}

export function profileFiles(ctx) {
  const shell = path.basename(ctx.env.SHELL ?? "");
  if (shell === "zsh") return [path.join(ctx.env.ZDOTDIR ?? ctx.home, ".zshrc")];
  if (shell === "bash") return ctx.platform === "darwin" ? [path.join(ctx.home, ".bash_profile"), path.join(ctx.home, ".bashrc")] : [path.join(ctx.home, ".bashrc")];
  if (shell === "fish") return [];
  return [path.join(ctx.home, ".profile")];
}

const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;

function profileBlock(ctx, envFile) {
  const rel = envFile.startsWith(ctx.home + path.sep) ? `$HOME/${path.relative(ctx.home, envFile).split(path.sep).join("/")}` : envFile;
  return [BLOCK_START, `[ -f "${rel}" ] && . "${rel}"`, BLOCK_END];
}

/** Text of `file` with our block set (lines) or removed (null). */
export function withBlock(text, lines) {
  const src = text ?? "";
  const eol = src.includes("\r\n") ? "\r\n" : "\n";
  const all = src.split(/\r?\n/);
  const s = all.indexOf(BLOCK_START);
  const e = s < 0 ? -1 : all.indexOf(BLOCK_END, s);
  const without = s < 0 || e < 0 ? all : [...all.slice(0, s), ...all.slice(e + 1)];
  let body = without.join(eol).replace(/\s+$/, "");
  if (lines) body = (body ? body + eol + eol : "") + lines.join(eol);
  return body ? body + eol : "";
}

/** Plans for the env store. key=null removes it. */
export function planEnvStore(ctx, key) {
  if (ctx.platform === "win32") return [{ status: key ? "setenv" : "unsetenv", file: `user environment variable ${ENV_VAR}`, windows: true, label: "API key" }];
  const { env, fish } = envFiles(ctx);
  const plans = [];
  const one = (file, text) => {
    const r = readText(file);
    if (r.error) return { status: "failed", file, error: r.error };
    if (text === null) return r.text == null ? { status: "absent", file } : { status: "removed", file, remove: true };
    if (r.text === text) return { status: "unchanged", file };
    return { status: r.text == null ? "added" : "updated", file, text, existed: r.text != null };
  };
  const header = `# Outreach2day MCP API key, written by ${SCRIPT_URL} (--use-key / --key). The MCP client configs name ${ENV_VAR}; the key itself is only here.\n`;
  plans.push({ ...one(env, key ? `${header}export ${ENV_VAR}=${shq(key)}\n` : null), secret: true, label: "API key file" });
  if (path.basename(ctx.env.SHELL ?? "") === "fish" || exists(fish)) plans.push({ ...one(fish, key ? `${header}set -gx ${ENV_VAR} ${shq(key)}\n` : null), secret: true, label: "API key (fish)" });
  for (const prof of profileFiles(ctx)) {
    const r = readText(prof);
    if (r.error) {
      plans.push({ status: "failed", file: prof, error: r.error, label: "Shell profile" });
      continue;
    }
    const next = withBlock(r.text, key ? profileBlock(ctx, env) : null);
    if ((r.text ?? "") === next) plans.push({ status: key ? "unchanged" : "absent", file: prof, label: "Shell profile" });
    else plans.push({ status: key ? (r.text == null ? "added" : "updated") : "removed", file: prof, text: next, existed: r.text != null, label: "Shell profile" });
  }
  return plans;
}

function applyEnvStore(ctx, plans, key) {
  for (const p of plans) {
    if (ctx.dryRun || p.status === "failed") continue;
    if (p.windows) {
      const r = key ? ctx.run("setx", [ENV_VAR, key]) : ctx.run("reg", ["delete", "HKCU\\Environment", "/v", ENV_VAR, "/f"]);
      if (r.code !== 0 && key) {
        p.status = "failed";
        p.error = redact(r.stderr || r.stdout).trim();
      }
    } else if (p.remove) {
      const backup = `${p.file}.outreach2day-backup-${stamp(ctx.now)}`;
      if (!p.secret) fs.copyFileSync(p.file, backup);
      fs.rmSync(p.file, { force: true });
    } else applyPlan(ctx, p, { secret: p.secret });
  }
  return plans;
}

// ---------------------------------------------------------------------------------------------------------------
// Clients.

/** Key mode: configs name the variable; the key itself lives only in the env store. */
const ENV_REF = "${" + ENV_VAR + "}"; // Claude Code, Gemini CLI
const ENV_REF_VSC = "${env:" + ENV_VAR + "}"; // Cursor, VS Code, Windsurf
const authRef = (ref) => ({ Authorization: `Bearer ${ref}` });

function claudeUserConfig(ctx) {
  return path.join(ctx.env.CLAUDE_CONFIG_DIR ?? ctx.home, ".claude.json");
}

export function claudeDesktopConfig(ctx) {
  return path.join(appConfigDir(ctx), "Claude", "claude_desktop_config.json");
}

export function vscodeConfigs(ctx) {
  const base = appConfigDir(ctx);
  const dirs = [path.join(base, "Code", "User"), path.join(base, "Code - Insiders", "User")];
  const found = dirs.filter(exists);
  return (found.length ? found : [dirs[0]]).map((d) => path.join(d, "mcp.json"));
}

const codexConfig = (ctx) => path.join(ctx.env.CODEX_HOME ?? path.join(ctx.home, ".codex"), "config.toml");

/** Devin Desktop (Windsurf's new name) keeps its MCP servers here; older Windsurf builds in ~/.codeium/windsurf. */
export function devinConfigDir(ctx) {
  return ctx.platform === "win32" ? path.join(appConfigDir(ctx), "devin") : path.join(xdgConfig(ctx), "devin");
}
const windsurfLegacyDir = (ctx) => path.join(ctx.home, ".codeium", "windsurf");
/** The Devin Desktop file always; the old Windsurf file only when that directory exists. */
export function windsurfConfigs(ctx) {
  const files = [path.join(devinConfigDir(ctx), "mcp_config.json")];
  if (exists(windsurfLegacyDir(ctx))) files.push(path.join(windsurfLegacyDir(ctx), "mcp_config.json"));
  return files;
}

/**
 * id, display name, aliases for --client, detect(), and files() + entry() for JSON clients.
 * entry(ctx, withKey): false → the OAuth entry (URL only); true → the entry reads the key from $OUTREACH2DAY_API_KEY.
 * gui: an app that reads $OUTREACH2DAY_API_KEY only when started from a shell that has it (key mode).
 * signIn: the next step after an OAuth install. restart: the next step after an API-key install. nextName: the label
 * of that line when it differs from name.
 * oauthDoc: the client's documentation for remote MCP servers with OAuth.
 */
export const CLIENTS = [
  {
    id: "claude-code",
    name: "Claude Code",
    aliases: ["claude", "claudecode"],
    signIn: `Start Claude Code, run /mcp, pick ${SERVER_NAME}, choose Authenticate (or run: claude mcp login ${SERVER_NAME}).`,
    restart: `Open a new terminal (it loads ${ENV_VAR}), start Claude Code and run /mcp to see outreach2day.`,
    oauthDoc: "https://code.claude.com/docs/en/mcp",
    detect: (ctx) => !!ctx.which("claude"),
  },
  {
    id: "claude-desktop",
    name: "Claude Desktop",
    aliases: ["claude", "desktop"],
    // Claude Desktop takes remote servers as custom connectors (your Claude account), not from its config file.
    connector: true,
    // Next-step label: one connector covers Claude Desktop, claude.ai and the mobile apps.
    nextName: "Claude Desktop and claude.ai",
    signIn: `open ${CLAUDE_CONNECT_URL}, click Add, then Connect and sign in with your Outreach2day account`,
    restart: `open ${CLAUDE_CONNECT_URL}, click Add, then Connect and sign in with your Outreach2day account (Claude Desktop takes no API key)`,
    oauthDoc: "https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp",
    detect: (ctx) => appInstalled(ctx, "Claude.app") || exists(path.dirname(claudeDesktopConfig(ctx))),
    files: (ctx) => [claudeDesktopConfig(ctx)],
    root: "mcpServers",
  },
  {
    id: "cursor",
    name: "Cursor",
    aliases: [],
    signIn: `Reload Cursor, open Cursor Settings → MCP and sign in to ${SERVER_NAME} when Cursor asks.`,
    restart: `Quit Cursor and start it from a new terminal (cursor .) so it sees ${ENV_VAR}, then check Settings, MCP.`,
    oauthDoc: "https://cursor.com/docs/context/mcp",
    detect: (ctx) => exists(path.join(ctx.home, ".cursor")) || appInstalled(ctx, "Cursor.app") || !!ctx.which("cursor"),
    files: (ctx) => [path.join(ctx.home, ".cursor", "mcp.json")],
    root: "mcpServers",
    gui: "cursor",
    entry: (ctx, withKey) => (withKey ? { url: ctx.serverUrl, headers: authRef(ENV_REF_VSC) } : { url: ctx.serverUrl }),
  },
  {
    id: "vscode",
    name: "VS Code",
    aliases: ["vs-code", "code", "copilot", "github-copilot"],
    signIn: `Reload VS Code, run "MCP: List Servers", start ${SERVER_NAME} and allow the sign-in when VS Code asks.`,
    restart: `Quit VS Code and start it from a new terminal (code .) so it sees ${ENV_VAR}, then open Copilot Chat in agent mode.`,
    oauthDoc: "https://code.visualstudio.com/updates/v1_101",
    detect: (ctx) => exists(path.join(appConfigDir(ctx), "Code", "User")) || exists(path.join(appConfigDir(ctx), "Code - Insiders", "User")) || !!ctx.which("code"),
    files: vscodeConfigs,
    root: "servers",
    gui: "code",
    entry: (ctx, withKey) => (withKey ? { type: "http", url: ctx.serverUrl, headers: authRef(ENV_REF_VSC) } : { type: "http", url: ctx.serverUrl }),
  },
  {
    id: "windsurf",
    name: "Windsurf",
    aliases: ["devin", "devin-desktop"],
    signIn: `Reload Windsurf or Devin Desktop (Cascade, MCP servers, Refresh) and sign in to ${SERVER_NAME} when asked.`,
    restart: `Quit Windsurf or Devin Desktop and start it from a new terminal so it sees ${ENV_VAR}, then Cascade, MCP servers, Refresh.`,
    oauthDoc: "https://docs.devin.ai/desktop/cascade/mcp",
    detect: (ctx) =>
      exists(devinConfigDir(ctx)) ||
      !!ctx.which("devin") ||
      appInstalled(ctx, "Devin.app") ||
      appInstalled(ctx, "Devin Desktop.app") ||
      exists(windsurfLegacyDir(ctx)) ||
      appInstalled(ctx, "Windsurf.app") ||
      !!ctx.which("windsurf"),
    files: windsurfConfigs,
    root: "mcpServers",
    gui: "windsurf",
    entry: (ctx, withKey) => (withKey ? { serverUrl: ctx.serverUrl, headers: authRef(ENV_REF_VSC) } : { serverUrl: ctx.serverUrl }),
  },
  {
    id: "gemini",
    name: "Gemini CLI",
    aliases: ["gemini-cli"],
    signIn: `Start gemini and run /mcp auth ${SERVER_NAME}.`,
    restart: `Open a new terminal (it loads ${ENV_VAR}), start gemini and run /mcp.`,
    oauthDoc: "https://geminicli.com/docs/tools/mcp-server/",
    detect: (ctx) => exists(path.join(ctx.home, ".gemini")) || !!ctx.which("gemini"),
    files: (ctx) => [path.join(ctx.home, ".gemini", "settings.json")],
    root: "mcpServers",
    entry: (ctx, withKey) => (withKey ? { httpUrl: ctx.serverUrl, headers: authRef(ENV_REF) } : { httpUrl: ctx.serverUrl }),
  },
  {
    id: "codex",
    name: "Codex CLI",
    aliases: ["codex-cli", "openai-codex", "chatgpt"],
    signIn: `Run: codex mcp login ${SERVER_NAME}`,
    restart: `Open a new terminal (it loads ${ENV_VAR}), then run codex mcp list.`,
    oauthDoc: "https://learn.chatgpt.com/docs/extend/mcp?surface=cli",
    detect: (ctx) => !!ctx.which("codex") || exists(path.dirname(codexConfig(ctx))),
    files: (ctx) => [codexConfig(ctx)],
  },
];

export function resolveClients(spec) {
  const out = [];
  for (const raw of String(spec).split(",").map((s) => s.trim().toLowerCase()).filter(Boolean)) {
    if (raw === "all") return CLIENTS.map((x) => x.id);
    const hits = CLIENTS.filter((x) => x.id === raw || x.aliases.includes(raw));
    if (!hits.length) throw new UsageError(`unknown client "${raw}". Use one of: ${CLIENTS.map((x) => x.id).join(", ")} (or all).`);
    for (const h of hits) if (!out.includes(h.id)) out.push(h.id);
  }
  return out;
}

class UsageError extends Error {}

/** The server entry as Claude Code keeps it in ~/.claude.json (user scope). */
export function claudeCodeEntry(ctx, withKey) {
  return withKey ? { type: "http", url: ctx.serverUrl, headers: authRef(ENV_REF) } : { type: "http", url: ctx.serverUrl };
}

/** Claude Code: through its own CLI, so the entry lands where Claude Code keeps it (user scope). */
function runClaudeCode(ctx, withKey, uninstall) {
  const bin = ctx.which("claude");
  const file = claudeUserConfig(ctx);
  if (!bin) return [{ status: "failed", file, error: "the claude command is not on PATH. Install Claude Code, or run this again with --client to skip it." }];
  const want = claudeCodeEntry(ctx, withKey);
  let current;
  try {
    current = JSON.parse(fs.readFileSync(file, "utf8"))?.mcpServers?.[SERVER_NAME];
  } catch {
    current = undefined;
  }
  if (uninstall) {
    if (!current) return [{ status: "absent", file, note: "user scope" }];
    if (ctx.dryRun) return [{ status: "removed", file, command: `claude mcp remove ${SERVER_NAME} -s user` }];
    const r = ctx.run(bin, ["mcp", "remove", SERVER_NAME, "-s", "user"]);
    return [r.code === 0 ? { status: "removed", file } : { status: "failed", file, error: redact(r.stderr || r.stdout).trim() }];
  }
  // Claude Code may add fields of its own (an empty headers object, oauth settings); compare what we set.
  const same =
    current &&
    current.type === want.type &&
    current.url === want.url &&
    (withKey ? deepEqual(current.headers, want.headers) : !current.headers || Object.keys(current.headers).length === 0);
  if (same) return [{ status: "unchanged", file }];
  const addArgs = ["mcp", "add", "--transport", "http", "-s", "user", SERVER_NAME, ctx.serverUrl];
  if (withKey) addArgs.push("--header", `Authorization: Bearer ${ENV_REF}`);
  const status = current ? "updated" : "added";
  if (ctx.dryRun) return [{ status, file, command: `claude ${addArgs.map((a) => (/[\s$]/.test(a) ? `'${a}'` : a)).join(" ")}` }];
  if (current) ctx.run(bin, ["mcp", "remove", SERVER_NAME, "-s", "user"]);
  const r = ctx.run(bin, addArgs);
  if (r.code !== 0) return [{ status: "failed", file, error: redact(r.stderr || r.stdout).trim() || `claude mcp add exited with ${r.code}` }];
  return [{ status, file }];
}

/**
 * Install or uninstall one client. withKey: key mode (the entry reads $OUTREACH2DAY_API_KEY), false for OAuth.
 * Returns one result per file it touched. No API key is ever written into a client's config.
 */
export function runClient(ctx, client, withKey, { uninstall = false } = {}) {
  if (client.id === "claude-code") return runClaudeCode(ctx, withKey, uninstall);
  if (client.id === "codex") {
    const plan = planToml(client.files(ctx)[0], ctx.serverUrl, uninstall, withKey);
    return [safeApply(ctx, plan)];
  }
  if (client.connector && !uninstall) {
    // Claude Desktop takes remote servers as custom connectors (OAuth) in the app; its config file is not touched. An
    // entry from an earlier installer version (mcp-remote with a key) is left alone and pointed out.
    const file = client.files(ctx)[0];
    let had = false;
    try {
      had = !!parseJsonc(fs.readFileSync(file, "utf8")).value?.[client.root]?.[SERVER_NAME];
    } catch {
      had = false;
    }
    return [{ status: "connector", note: "add it as a custom connector, see Next", warn: had ? `${tilde(ctx, file)} still has an API-key entry from an earlier install; remove it with --uninstall --client ${client.id} once the connector works` : undefined }];
  }
  return client.files(ctx).map((file) => {
    const plan = planJson(file, client.root, uninstall ? null : client.entry(ctx, withKey));
    return safeApply(ctx, plan);
  });
}

function safeApply(ctx, plan) {
  if (plan.status === "failed") return plan;
  try {
    return applyPlan(ctx, plan);
  } catch (e) {
    return { status: "failed", file: plan.file, error: e.message };
  }
}

/** Does this client's config have our entry that reads $OUTREACH2DAY_API_KEY? */
function usesEnv(ctx, client) {
  if (client.connector) return false;
  const text = readText(client.id === "claude-code" ? claudeUserConfig(ctx) : client.files(ctx)[0]).text ?? "";
  return text.includes(ENV_VAR) && (client.id === "codex" ? /\[\s*mcp_servers\.outreach2day\s*\]/.test(text) : text.includes(`"${SERVER_NAME}"`));
}

// ---------------------------------------------------------------------------------------------------------------
// Network checks (both optional: --no-verify skips them, and a network error only warns).

export async function verifyKey(key, fetchImpl = globalThis.fetch) {
  try {
    const res = await fetchImpl(`${API_BASE}/workspaces`, { headers: { Authorization: `Bearer ${key}`, Accept: "application/json" }, signal: AbortSignal.timeout(15000) });
    let count;
    if (res.ok) {
      const body = await res.json().catch(() => null);
      const list = Array.isArray(body) ? body : Array.isArray(body?.items) ? body.items : Array.isArray(body?.workspaces) ? body.workspaces : null;
      count = list?.length;
    }
    return { status: res.status, count };
  } catch (e) {
    return { status: 0, error: e.message };
  }
}

function parseRpc(text) {
  const t = text.trim();
  if (t.startsWith("{")) return JSON.parse(t);
  const data = t
    .split(/\r?\n/)
    .filter((l) => l.startsWith("data:"))
    .map((l) => l.slice(5).trim())
    .pop();
  return data ? JSON.parse(data) : null;
}

/**
 * initialize + tools/list against the MCP endpoint. { status, tools?, server?, oauth?, error? }
 * key = null: an anonymous request; the server should answer 401 and point to its OAuth metadata (oauth: true).
 */
export async function checkServer(url, key, fetchImpl = globalThis.fetch) {
  const headers = { "Content-Type": "application/json", Accept: "application/json, text/event-stream" };
  if (key) headers.Authorization = `Bearer ${key}`;
  const call = (body, extra = {}) => fetchImpl(url, { method: "POST", headers: { ...headers, ...extra }, body: JSON.stringify(body), signal: AbortSignal.timeout(15000) });
  try {
    const init = await call({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "outreach2day-installer", version: VERSION } } });
    if (!init.ok) {
      await init.body?.cancel?.().catch(() => {});
      return { status: init.status, oauth: /resource_metadata=/i.test(init.headers?.get?.("www-authenticate") ?? "") };
    }
    const session = init.headers.get("mcp-session-id");
    const initBody = parseRpc(await init.text());
    const extra = session ? { "Mcp-Session-Id": session } : {};
    const version = initBody?.result?.protocolVersion;
    if (version) extra["MCP-Protocol-Version"] = version;
    try {
      const n = await call({ jsonrpc: "2.0", method: "notifications/initialized" }, extra);
      await n.body?.cancel?.().catch(() => {});
      const list = await call({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, extra);
      const tools = list.ok ? parseRpc(await list.text())?.result?.tools?.length : undefined;
      return { status: init.status, tools, server: initBody?.result?.serverInfo?.name };
    } catch {
      return { status: init.status, server: initBody?.result?.serverInfo?.name };
    }
  } catch (e) {
    return { status: 0, error: e.message };
  }
}

// ---------------------------------------------------------------------------------------------------------------
// Terminal input. The key prompt reads raw keystrokes and echoes nothing.

function hasTty() {
  return !!process.stdin.isTTY;
}

function askLine(question) {
  return new Promise((resolve) => {
    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
    rl.question(question, (a) => {
      rl.close();
      resolve(a);
    });
  });
}

function askHidden(question) {
  return new Promise((resolve, reject) => {
    const stdin = process.stdin;
    OUT(question);
    let buf = "";
    stdin.setRawMode(true);
    stdin.resume();
    stdin.setEncoding("utf8");
    const done = (err) => {
      stdin.setRawMode(false);
      stdin.pause();
      stdin.removeListener("data", onData);
      OUT("\n");
      if (err) reject(err);
      else resolve(buf);
    };
    const onData = (chunk) => {
      for (const ch of chunk) {
        if (ch === "\r" || ch === "\n") return done();
        if (ch === "\u0003") return done(Object.assign(new Error("cancelled"), { code: "CANCELLED" }));
        if (ch === "\u0004") return done();
        if (ch === "\u007f" || ch === "\b") buf = buf.slice(0, -1);
        else if (ch >= " ") buf += ch;
      }
    };
    stdin.on("data", onData);
  });
}

function openBrowser(url, platform = process.platform) {
  try {
    const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd.exe", ["/c", "start", "", url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => {}).unref();
    return true;
  } catch {
    return false;
  }
}

// ---------------------------------------------------------------------------------------------------------------
// CLI.

export const HELP = `Outreach2day MCP installer ${VERSION}

Adds the Outreach2day MCP server (${MCP_URL}) to the MCP clients on this computer:
Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI, Codex CLI.
No API key needed: each client signs in to Outreach2day (OAuth) on first use, and the
installer prints the sign-in step for each one at the end.

  curl -fsSL ${SCRIPT_URL} | sh                  macOS, Linux
  irm ${SCRIPT_URL_PS1} | iex              Windows PowerShell

Options (after "sh -s --" for curl | sh, e.g. curl -fsSL ${SCRIPT_URL} | sh -s -- --dry-run):
  --client <ids>   only these clients, comma-separated: ${CLIENTS.map((x) => x.id).join(", ")}, or all.
                   Default: every client found on this computer.
  --use-key        use an API key instead of OAuth; you are asked for it (input hidden).
  --key <key>      use this API key instead of OAuth. Safer: --use-key, or set O2D_API_KEY.
                   API keys are for headless / CI use and clients without OAuth.
  --dry-run        show what would change, write nothing.
  --uninstall      remove the outreach2day server from the clients (backups are kept).
  --yes, -y        do not ask for confirmation.
  --no-verify      skip the server check (offline).
  --help, --version

Environment (for irm | iex, which passes no arguments): O2D_CLIENT, O2D_DRY_RUN=1, O2D_UNINSTALL=1, O2D_YES=1,
O2D_USE_KEY=1, O2D_API_KEY (API key mode).

API keys: ${API_KEYS_URL}
Manual setup for each client: ${DOCS_URL}
Read the script before running it: curl -fsSL ${SCRIPT_URL} | less
`;

const on = (v) => !!v && v !== "0";

export function parseArgs(argv, env = process.env) {
  const o = {
    // Only O2D_API_KEY selects key mode. OUTREACH2DAY_API_KEY is what an earlier key install exports from your shell
    // profile; it must not keep you on keys when you run this again for OAuth.
    key: env.O2D_API_KEY || "",
    keyFromEnv: !!env.O2D_API_KEY,
    useKey: on(env.O2D_USE_KEY),
    client: env.O2D_CLIENT || "",
    dryRun: on(env.O2D_DRY_RUN),
    uninstall: on(env.O2D_UNINSTALL),
    yes: on(env.O2D_YES),
    verify: true,
    serverUrl: env.O2D_SERVER_URL || MCP_URL,
    help: false,
    version: false,
  };
  const a = [...argv];
  const val = (name, inline) => {
    if (inline !== undefined) return inline;
    const v = a.shift();
    if (v === undefined || v.startsWith("--")) throw new UsageError(`${name} needs a value`);
    return v;
  };
  while (a.length) {
    const raw = a.shift();
    const [flag, inline] = raw.startsWith("--") && raw.includes("=") ? [raw.slice(0, raw.indexOf("=")), raw.slice(raw.indexOf("=") + 1)] : [raw, undefined];
    if (flag === "--key") {
      o.key = val(flag, inline);
      o.keyFromEnv = false;
    } else if (flag === "--use-key" || flag === "--api-key") o.useKey = true;
    else if (flag === "--client" || flag === "--clients") o.client = val(flag, inline);
    else if (flag === "--dry-run") o.dryRun = true;
    else if (flag === "--uninstall" || flag === "--remove") o.uninstall = true;
    else if (flag === "--yes" || flag === "-y") o.yes = true;
    else if (flag === "--no-verify") o.verify = false;
    else if (flag === "--server-url") o.serverUrl = val(flag, inline);
    else if (flag === "--help" || flag === "-h") o.help = true;
    else if (flag === "--version" || flag === "-v") o.version = true;
    else throw new UsageError(`unknown option ${raw}. Run with --help.`);
  }
  if (!isAllowedServerUrl(o.serverUrl)) throw new UsageError(`--server-url must be ${MCP_URL} (or a local http://127.0.0.1 server for testing).`);
  return o;
}

const LABEL = {
  added: green("added    "),
  updated: green("updated  "),
  unchanged: dim("unchanged"),
  removed: green("removed  "),
  absent: dim("not there"),
  failed: red("FAILED   "),
  setenv: green("set      "),
  unsetenv: green("removed  "),
  connector: yellow("connector"),
};
const WOULD = { added: "would add", updated: "would update", removed: "would remove", setenv: "would set", unsetenv: "would remove" };

function printResult(ctx, name, r) {
  const status = ctx.dryRun && WOULD[r.status] ? yellow(WOULD[r.status].padEnd(12)) : (LABEL[r.status] ?? r.status).padEnd(color ? 18 : 9) + "   ";
  const where = r.file ? tilde(ctx, r.file) : "";
  say(`  ${name.padEnd(15)} ${status} ${where}${r.note ? dim(where ? ` (${r.note})` : r.note) : ""}`);
  if (r.backup) say(dim(`  ${"".padEnd(15)} backup: ${tilde(ctx, r.backup)}`));
  if (r.lossy && r.text) say(yellow(`  ${"".padEnd(15)} comments or trailing commas in this file were dropped; the backup keeps them`));
  if (r.command) say(dim(`  ${"".padEnd(15)} ${r.command}`));
  if (r.warn) say(yellow(`  ${"".padEnd(15)} ${r.warn}`));
  if (r.error) say(red(`  ${"".padEnd(15)} ${r.error}`));
}

/** Ask for the key (hidden). Returns the key, or an exit code. */
async function promptKey(ctx, askKey) {
  say();
  say(`API key mode. Create a key here: ${API_KEYS_URL}`);
  for (let tries = 0; tries < 5; tries++) {
    let raw;
    try {
      raw = await askKey(tries === 0 ? "Paste your API key (input is hidden), or press Enter to open that page: " : "Paste your API key (hidden): ");
    } catch {
      say("Cancelled. Nothing changed.");
      return 130;
    }
    if (!raw.trim()) {
      say(openBrowser(API_KEYS_URL, ctx.platform) ? "Opened the API keys page in your browser. Create a key, copy it, and paste it here." : `Open ${API_KEYS_URL}, create a key and paste it here.`);
      continue;
    }
    const key = cleanKey(raw);
    if (key) {
      say(`Key received (${key.slice(0, 5)}…, ${key.length} characters).`);
      return key;
    }
    say(yellow("That does not look like an API key (it should start with ot2d_). Try again."));
  }
  say("No key. Nothing changed.");
  return 2;
}

/** The installer. Returns the exit code. `io` lets tests pass a fetch stub and answers. */
export async function main(argv = process.argv.slice(2), io = {}) {
  let o;
  try {
    o = parseArgs(argv, io.env ?? process.env);
  } catch (e) {
    if (e instanceof UsageError) {
      say(red(`outreach2day installer: ${e.message}`));
      return 2;
    }
    throw e;
  }
  if (o.help) {
    OUT(HELP);
    return 0;
  }
  if (o.version) {
    say(VERSION);
    return 0;
  }
  const ctx = makeCtx({ ...(io.ctx ?? {}), dryRun: o.dryRun, serverUrl: o.serverUrl });
  const fetchImpl = io.fetch ?? globalThis.fetch;
  const interactive = io.interactive ?? hasTty();
  const ask = io.ask ?? askLine;
  const askKey = io.askHidden ?? askHidden;

  say(bold(`Outreach2day MCP installer ${VERSION}`) + (o.dryRun ? yellow("  (dry run: nothing is written)") : ""));
  say(dim(`Server ${ctx.serverUrl}. Script: ${SCRIPT_URL} (read it: curl -fsSL ${SCRIPT_URL} | less)`));
  say();

  let ids;
  try {
    ids = o.client ? resolveClients(o.client) : CLIENTS.filter((x) => x.detect(ctx)).map((x) => x.id);
  } catch (e) {
    say(red(e.message));
    return 2;
  }
  const chosen = CLIENTS.filter((x) => ids.includes(x.id));
  if (!chosen.length) {
    say("No supported MCP client found on this computer (Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI, Codex CLI).");
    say(`Pick one with --client, e.g. --client cursor, or follow the manual steps: ${DOCS_URL}`);
    return 1;
  }
  say(`${o.client ? "Clients" : "Found"}: ${chosen.map((x) => x.name).join(", ")}`);
  const names = chosen.map((x) => x.name).join(", ");

  // Uninstall needs no key.
  if (o.uninstall) {
    if (interactive && !o.yes && !o.dryRun) {
      const a = (await ask(`Remove outreach2day from ${names}? [Y/n] `)).trim().toLowerCase();
      if (a && a !== "y" && a !== "yes") return say("Nothing changed."), 0;
    }
    say();
    let failed = false;
    for (const cl of chosen)
      for (const r of runClient(ctx, cl, null, { uninstall: true })) {
        failed ||= r.status === "failed";
        printResult(ctx, cl.name, r);
      }
    failed ||= cleanEnvStore(ctx);
    say();
    say(failed ? red("Some clients could not be changed; see above.") : "Done. Restart the clients to drop the server.");
    if (!failed) {
      say(`  Sign-ins (OAuth) end there too. An API key, if you made one, still works; revoke it on the API keys page: ${API_KEYS_URL}`);
      if (chosen.some((x) => x.connector)) say("  Claude Desktop: remove the Outreach2day connector under Customize → Connectors if you added one.");
    }
    say(dim("  The backups (*.outreach2day-backup-*) keep the old entries, API keys included; delete them once you no longer need them."));
    return failed ? 1 : 0;
  }

  // Mode: OAuth (default, no key) or API key (--key / O2D_API_KEY / --use-key / "k" at the prompt).
  let key = null;
  if (o.key) {
    key = cleanKey(o.key);
    if (!key) {
      say(red(`That API key does not look right. Keys start with ot2d_ and are created at ${API_KEYS_URL}`));
      return 2;
    }
    say(`API key mode: key from ${o.keyFromEnv ? "O2D_API_KEY" : "--key"}.`);
  } else if (o.useKey) {
    if (!interactive) {
      say(red("--use-key needs a terminal to ask for the key. Pass it as O2D_API_KEY instead, or run without --use-key to sign in with OAuth."));
      return 2;
    }
    const k = await promptKey(ctx, askKey);
    if (typeof k === "number") return k;
    key = k;
  } else {
    say("Sign-in: OAuth. No API key needed; each client asks you to sign in to Outreach2day on first use.");
  }

  if (key) {
    addSecret(key);
    addSecret(`Bearer ${key}`);
    if (!key.startsWith("ot2d_")) say(yellow("Note: Outreach2day keys start with ot2d_. Using this one anyway."));
    if (o.verify && ctx.serverUrl === MCP_URL) {
      const v = await verifyKey(key, fetchImpl);
      if (v.status === 200) say(`Key checked: valid${v.count != null ? ` (${v.count} workspace${v.count === 1 ? "" : "s"})` : ""}.`);
      else if (v.status === 401 || v.status === 403) {
        say(red(`The API rejected this key (HTTP ${v.status}). Create a new one at ${API_KEYS_URL} and run this again.`));
        return 1;
      } else say(yellow(`Could not check the key (${v.status ? `HTTP ${v.status}` : v.error}). Continuing.`));
    }
  }

  if (interactive && !o.yes && !o.dryRun) {
    const q = key ? `Add outreach2day to ${names}? [Y/n] ` : `Add outreach2day to ${names}? [Y/n, k = use an API key instead] `;
    const a = (await ask(q)).trim().toLowerCase();
    if (!key && (a === "k" || a === "key")) {
      const k = await promptKey(ctx, askKey);
      if (typeof k === "number") return k;
      key = k;
      addSecret(key);
      addSecret(`Bearer ${key}`);
    } else if (a && a !== "y" && a !== "yes") return say("Nothing changed."), 0;
  }

  say();
  const results = [];
  for (const cl of chosen)
    for (const r of runClient(ctx, cl, !!key)) {
      results.push({ cl, r });
      printResult(ctx, cl.name, r);
    }
  if (key) {
    const envUsers = chosen.filter((x) => !x.connector && results.some(({ cl, r }) => cl === x && r.status !== "failed"));
    if (envUsers.length)
      for (const p of applyEnvStore(ctx, planEnvStore(ctx, key), key)) {
        results.push({ cl: {}, r: p });
        printResult(ctx, p.label, p);
      }
  } else if (cleanEnvStore(ctx)) results.push({ cl: {}, r: { status: "failed" } });
  const failed = results.filter(({ r }) => r.status === "failed");
  const ok = results.filter(({ r }) => r.status !== "failed");

  // Server check.
  say();
  if (o.verify) {
    const s = await checkServer(ctx.serverUrl, key, fetchImpl);
    if (s.status === 200) say(green(`Server check: ${ctx.serverUrl} answered${s.tools != null ? `, ${s.tools} tools` : ""}.`));
    else if (!key && s.status === 401 && s.oauth) say(green(`Server check: ${ctx.serverUrl} is up and asks for sign-in (OAuth).`));
    else if (s.status === 404)
      say(
        yellow(`Server check: ${ctx.serverUrl} did not answer (HTTP 404).`) +
          "\n  The config above is in place. Try again in a few minutes or write to support@outreach2day.com.",
      );
    else if (key && (s.status === 401 || s.status === 403)) say(red(`Server check: the MCP server rejected this key (HTTP ${s.status}). Create a new key at ${API_KEYS_URL}.`));
    else say(yellow(`Server check: no answer from ${ctx.serverUrl} (${s.status ? `HTTP ${s.status}` : s.error}). The config is written; try your client in a minute.`));
  }

  // Summary.
  if (ctx.dryRun) {
    say();
    say(yellow("Dry run: nothing was written. Run again without --dry-run to apply."));
  }
  const touched = chosen.filter((x) => results.some(({ cl, r }) => cl === x && r.status !== "failed" && r.status !== "absent"));
  if (!ctx.dryRun && touched.length) {
    say();
    say(bold(key ? "Next" : "Next: sign in from each client"));
    for (const cl of touched) say(`  ${cl.nextName ?? cl.name}: ${key ? cl.restart : cl.signIn}`);
    say(`  Then ask: ${bold(`"${FIRST_PROMPT}"`)}`);
    if (key) {
      const store = ok.find(({ r }) => r.label === "API key file" || r.windows);
      say(dim(`  The configs name ${ENV_VAR}; the key itself is only in ${store ? tilde(ctx, store.r.file) : "your environment"}${store && !store.r.windows ? " (readable only by you)" : ""}.`));
    } else say(dim(`  No API key was stored. Headless or CI use: run again with --use-key. Setup per client: ${DOCS_URL}`));
    say(dim(`  Undo: ${ctx.platform === "win32" ? `$env:O2D_UNINSTALL = "1"; irm ${SCRIPT_URL_PS1} | iex` : `curl -fsSL ${SCRIPT_URL} | sh -s -- --uninstall`}`));
  }
  if (failed.length) {
    say();
    say(red(`${failed.length} change${failed.length === 1 ? "" : "s"} failed; see above. Manual setup: ${DOCS_URL}`));
    return 1;
  }
  return 0;
}

/** Remove the key file and profile block when no Codex / Gemini CLI entry reads $OUTREACH2DAY_API_KEY. Returns failed. */
function cleanEnvStore(ctx) {
  if (CLIENTS.some((x) => usesEnv(ctx, x))) return false;
  let failed = false;
  const plans = planEnvStore(ctx, null).filter((p) => p.status !== "absent" && !(p.windows && !ctx.env[ENV_VAR]));
  for (const p of applyEnvStore(ctx, plans, null)) {
    failed ||= p.status === "failed";
    printResult(ctx, p.label, p);
  }
  return failed;
}

// Run when executed directly (node install.mjs or the sh / PowerShell wrappers), not when a
// test imports it.
const direct = (() => {
  try {
    return fs.realpathSync(process.argv[1] ?? "") === fs.realpathSync(fileURLToPath(import.meta.url)) || process.env.O2D_INSTALLER_WRAPPED === "1";
  } catch {
    return process.env.O2D_INSTALLER_WRAPPED === "1";
  }
})();
if (direct) {
  main().then(
    (code) => process.exit(code),
    (e) => {
      say(red(`outreach2day installer: ${e?.message ?? e}`));
      process.exit(1);
    },
  );
}
O2D_INSTALLER_JS
}

main "$@"