#!/bin/sh
# Extreme HexaShield — Linux desktop agent installer
# Electron GUI app (optional): https://extremehexa.com/agents/desktop/
set -e

API_URL="${HEXASHIELD_API_URL:-https://extremehexa.com}"
C2_URL="${HEXASHIELD_C2_URL:-}"
LICENSE="${HEXASHIELD_LICENSE_KEY:-}"
INSTALL_DIR="${HEXASHIELD_INSTALL_DIR:-/opt/hexashield-agent}"
AGENT_USER="${SUDO_USER:-$USER}"

if [ "$(id -u)" -ne 0 ]; then
  echo "[!] Re-run as root: curl -fsSL $API_URL/agents/install-linux.sh | sudo HEXASHIELD_LICENSE_KEY=KEY sh"
  exit 1
fi

if [ -z "$LICENSE" ]; then
  echo "[!] Set HEXASHIELD_LICENSE_KEY before install."
  exit 1
fi

echo ""
echo "  ╔══════════════════════════════════════════════════════════╗"
echo "  ║         EXTREME HEXASHIELD — NEURAL FIREWALL SYSTEM      ║"
echo "  ║              Extreme Technology LTD · © 2026             ║"
echo "  ╚══════════════════════════════════════════════════════════╝"
echo ""
echo "[*] Extreme HexaShield Agent — Linux"
mkdir -p "$INSTALL_DIR"
curl -fsSL "$API_URL/agents/desktop_agent/agent.py" -o "$INSTALL_DIR/agent.py"
curl -fsSL "$API_URL/agents/desktop_agent/app_control.py" -o "$INSTALL_DIR/app_control.py"
curl -fsSL "$API_URL/agents/desktop_agent/file_guard.py" -o "$INSTALL_DIR/file_guard.py" 2>/dev/null || true
for mod in conn_monitor.py ioc_guard.py behavior_engine.py self_protection.py; do
  curl -fsSL "$API_URL/agents/desktop_agent/$mod" -o "$INSTALL_DIR/$mod" 2>/dev/null || true
done
chmod 755 "$INSTALL_DIR/agent.py" "$INSTALL_DIR/app_control.py"
[ -f "$INSTALL_DIR/file_guard.py" ] && chmod 755 "$INSTALL_DIR/file_guard.py"
for mod in conn_monitor.py ioc_guard.py behavior_engine.py self_protection.py; do
  [ -f "$INSTALL_DIR/$mod" ] && chmod 755 "$INSTALL_DIR/$mod"
done

PY=python3
command -v python3.11 >/dev/null && PY=python3.11
command -v python3.12 >/dev/null && PY=python3.12
command -v python3.13 >/dev/null && PY=python3.13

$PY -m pip install --quiet psutil requests websocket-client watchdog 2>/dev/null || \
  pip3 install --quiet psutil requests websocket-client watchdog

if [ -f "$API_URL/agents/bin/HexaShield-Agent-linux" ] 2>/dev/null; then
  :
fi
if curl -fsSL "$API_URL/agents/bin/HexaShield-Agent-linux" -o "$INSTALL_DIR/hexashield-agent" 2>/dev/null; then
  chmod 755 "$INSTALL_DIR/hexashield-agent"
fi

cat > /etc/systemd/system/hexashield-agent.service <<EOF
[Unit]
Description=Extreme HexaShield EDR Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=$AGENT_USER
Environment=HEXASHIELD_API_URL=$API_URL
Environment=HEXASHIELD_LICENSE_KEY=$LICENSE
$( [ -n "$C2_URL" ] && echo "Environment=HEXASHIELD_C2_URL=$C2_URL" )
ExecStart=$PY $INSTALL_DIR/agent.py
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable hexashield-agent.service
systemctl restart hexashield-agent.service

# Desktop Console (visible security dashboard)
GUI_DIR="$INSTALL_DIR/console"
mkdir -p "$GUI_DIR/ui" /var/lib/hexashield
chown root:"$AGENT_USER" /var/lib/hexashield 2>/dev/null || chmod 777 /var/lib/hexashield
chmod 775 /var/lib/hexashield 2>/dev/null || true
curl -fsSL "$API_URL/agents/desktop_gui/gui_launcher.py" -o "$GUI_DIR/gui_launcher.py"
curl -fsSL "$API_URL/agents/desktop_gui/state_paths.py" -o "$GUI_DIR/state_paths.py"
curl -fsSL "$API_URL/agents/desktop_gui/launch-linux.sh" -o "$GUI_DIR/launch-linux.sh"
for f in index.html styles.css app.js; do
  curl -fsSL "$API_URL/agents/desktop_gui/ui/$f" -o "$GUI_DIR/ui/$f"
done
chmod 755 "$GUI_DIR/gui_launcher.py" "$GUI_DIR/launch-linux.sh"

cat > /usr/share/applications/hexashield-console.desktop <<DESK
[Desktop Entry]
Name=HexaShield Console
Name[ar]=وحدة HexaShield
Comment=Extreme HexaShield Security Console
Exec=$PY $GUI_DIR/gui_launcher.py
Icon=security-high
Terminal=false
Type=Application
Categories=Security;System;
DESK
mkdir -p /etc/xdg/autostart
cp /usr/share/applications/hexashield-console.desktop /etc/xdg/autostart/

echo "[+] Installed to $INSTALL_DIR — service hexashield-agent active"
echo "[+] Desktop Console: $GUI_DIR/launch-linux.sh (autostart enabled)"
systemctl is-active hexashield-agent.service || true