#!/bin/sh
# Extreme HexaShield — macOS desktop agent installer
# Electron GUI app (optional): https://extremehexa.com/agents/desktop/
set -e

API_URL="${HEXASHIELD_API_URL:-https://extremehexa.com}"
C2_URL="${HEXASHIELD_C2_URL:-}"
LICENSE="${HEXASHIELD_LICENSE_KEY:-}"
INSTALL_DIR="${HEXASHIELD_INSTALL_DIR:-/usr/local/hexashield-agent}"
PLIST="/Library/LaunchDaemons/com.extreme.hexashield.agent.plist"

if [ "$(id -u)" -ne 0 ]; then
  echo "[!] Re-run as root: curl -fsSL $API_URL/agents/install-macos.sh | sudo HEXASHIELD_LICENSE_KEY=KEY sh"
  exit 1
fi

if [ -z "$LICENSE" ]; then
  echo "[!] Set HEXASHIELD_LICENSE_KEY before install."
  exit 1
fi

echo ""
echo "  ╔══════════════════════════════════════════════════════════╗"
echo "  ║         EXTREME HEXASHIELD — NEURAL FIREWALL SYSTEM      ║"
echo "  ║              Extreme Technology LTD · © 2026             ║"
echo "  ╚══════════════════════════════════════════════════════════╝"
echo ""
echo "[*] Extreme HexaShield Agent — macOS"
mkdir -p "$INSTALL_DIR"
curl -fsSL "$API_URL/agents/desktop_agent/agent.py" -o "$INSTALL_DIR/agent.py"
curl -fsSL "$API_URL/agents/desktop_agent/app_control.py" -o "$INSTALL_DIR/app_control.py"
curl -fsSL "$API_URL/agents/desktop_agent/file_guard.py" -o "$INSTALL_DIR/file_guard.py" 2>/dev/null || true
for mod in conn_monitor.py ioc_guard.py behavior_engine.py self_protection.py; do
  curl -fsSL "$API_URL/agents/desktop_agent/$mod" -o "$INSTALL_DIR/$mod" 2>/dev/null || true
done
chmod 755 "$INSTALL_DIR/agent.py" "$INSTALL_DIR/app_control.py"
[ -f "$INSTALL_DIR/file_guard.py" ] && chmod 755 "$INSTALL_DIR/file_guard.py"
for mod in conn_monitor.py ioc_guard.py behavior_engine.py self_protection.py; do
  [ -f "$INSTALL_DIR/$mod" ] && chmod 755 "$INSTALL_DIR/$mod"
done

PY=python3
command -v python3.11 >/dev/null && PY=python3.11
command -v python3.12 >/dev/null && PY=python3.12
command -v python3.13 >/dev/null && PY=python3.13

$PY -m pip install --quiet psutil requests websocket-client watchdog 2>/dev/null || \
  pip3 install --quiet psutil requests websocket-client watchdog

if curl -fsSL "$API_URL/agents/bin/HexaShield-Agent-macos-arm64" -o "$INSTALL_DIR/hexashield-agent-arm64" 2>/dev/null; then
  chmod 755 "$INSTALL_DIR/hexashield-agent-arm64"
fi
if curl -fsSL "$API_URL/agents/bin/HexaShield-Agent-macos-amd64" -o "$INSTALL_DIR/hexashield-agent-amd64" 2>/dev/null; then
  chmod 755 "$INSTALL_DIR/hexashield-agent-amd64"
fi
ARCH=$(uname -m)
if [ "$ARCH" = "arm64" ] && [ -f "$INSTALL_DIR/hexashield-agent-arm64" ]; then
  ln -sf hexashield-agent-arm64 "$INSTALL_DIR/hexashield-agent"
elif [ -f "$INSTALL_DIR/hexashield-agent-amd64" ]; then
  ln -sf hexashield-agent-amd64 "$INSTALL_DIR/hexashield-agent"
fi

cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.extreme.hexashield.agent</string>
  <key>ProgramArguments</key>
  <array>
    <string>$PY</string>
    <string>$INSTALL_DIR/agent.py</string>
  </array>
  <key>EnvironmentVariables</key>
  <dict>
    <key>HEXASHIELD_API_URL</key>
    <string>$API_URL</string>
    <key>HEXASHIELD_LICENSE_KEY</key>
    <string>$LICENSE</string>
$( [ -n "$C2_URL" ] && echo "    <key>HEXASHIELD_C2_URL</key>
    <string>$C2_URL</string>" )
  </dict>
  <key>RunAtLoad</key>
  <true/>
  <key>KeepAlive</key>
  <true/>
  <key>StandardOutPath</key>
  <string>/var/log/hexashield-agent.log</string>
  <key>StandardErrorPath</key>
  <string>/var/log/hexashield-agent.err</string>
</dict>
</plist>
EOF

chmod 644 "$PLIST"
launchctl bootout system/com.extreme.hexashield.agent 2>/dev/null || true
launchctl bootstrap system "$PLIST"
launchctl enable system/com.extreme.hexashield.agent
launchctl kickstart -k system/com.extreme.hexashield.agent

# Desktop Console (visible security dashboard)
GUI_DIR="$INSTALL_DIR/console"
mkdir -p "$GUI_DIR/ui" "/Library/Application Support/HexaShield"
chmod 775 "/Library/Application Support/HexaShield"
curl -fsSL "$API_URL/agents/desktop_gui/gui_launcher.py" -o "$GUI_DIR/gui_launcher.py"
curl -fsSL "$API_URL/agents/desktop_gui/state_paths.py" -o "$GUI_DIR/state_paths.py"
curl -fsSL "$API_URL/agents/desktop_gui/launch-macos.command" -o "$GUI_DIR/launch-macos.command"
for f in index.html styles.css app.js; do
  curl -fsSL "$API_URL/agents/desktop_gui/ui/$f" -o "$GUI_DIR/ui/$f"
done
chmod 755 "$GUI_DIR/gui_launcher.py" "$GUI_DIR/launch-macos.command"

CONSOLE_PLIST="/Library/LaunchAgents/com.extreme.hexashield.console.plist"
cat > "$CONSOLE_PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.extreme.hexashield.console</string>
  <key>ProgramArguments</key>
  <array>
    <string>$PY</string>
    <string>$GUI_DIR/gui_launcher.py</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>LimitToSessionType</key>
  <array><string>Aqua</string></array>
</dict>
</plist>
EOF
chmod 644 "$CONSOLE_PLIST"

echo "[+] Installed to $INSTALL_DIR — LaunchDaemon com.extreme.hexashield.agent loaded"
echo "[+] Desktop Console: $GUI_DIR/launch-macos.command (LaunchAgent at login)"