Tencent News

import { existsSync } from "node:fs";
import { chmod, mkdir, rename, unlink } from "node:fs/promises";
import { createHash } from "node:crypto";

export const BASE_DOWNLOAD_URL = "https://mat1.gtimg.com/qqcdn/qqnews/cli/hub";
export const DEFAULT_CHECKSUM_URL = `${BASE_DOWNLOAD_URL}/checksums.txt`;

const SCRIPT_DIR = import.meta.dir.replaceAll("\\", "/");
export const SKILL_DIR = SCRIPT_DIR.replace(/\/[^/]+$/, "");

export function fail(msg: string): never {
  console.error(`Error: ${msg}`);
  process.exit(1);
}

export function normalizeApiKey(raw: string): string {
  let key = raw.trim();
  if ((key.startsWith('"') && key.endsWith('"')) || (key.startsWith("'") && key.endsWith("'"))) {
    key = key.slice(1, -1);
  }
  key = key.replace(/^api[\s_-]*key\s*[:=]\s*/i, "");
  return key.trim();
}

function formatError(error: unknown): string {
  return error instanceof Error ? error.message : String(error);
}

function parentDir(path: string): string {
  const normalized = path.replaceAll("\\", "/");
  const idx = normalized.lastIndexOf("/");
  if (idx === -1) return ".";
  if (idx === 0) return "/";
  return normalized.slice(0, idx);
}

function createTempSiblingPath(path: string, label: string): string {
  return `${path}.${label}.${process.pid}.${Date.now()}`;
}

async function cleanupFile(path: string) {
  await unlink(path).catch(() => {});
}

async function replaceFile(sourcePath: string, targetPath: string) {
  if (process.platform !== "win32") {
    await rename(sourcePath, targetPath);
    return;
  }

  if (!(await Bun.file(targetPath).exists())) {
    await rename(sourcePath, targetPath);
    return;
  }

  const backupPath = createTempSiblingPath(targetPath, "bak");
  await rename(targetPath, backupPath);
  try {
    await rename(sourcePath, targetPath);
  } catch (error) {
    await rename(backupPath, targetPath).catch(() => {});
    throw error;
  }
  await cleanupFile(backupPath);
}

interface CommandResult {
  stdout: string;
  stderr: string;
  exitCode: number;
  output: string;
}

async function runCommand(args: string[], description: string): Promise<CommandResult> {
  let proc: ReturnType<typeof Bun.spawn>;
  try {
    proc = Bun.spawn(args, { stdout: "pipe", stderr: "pipe" });
  } catch (error) {
    fail(`${description} failed to start: ${formatError(error)}`);
  }

  const stdoutPromise = new Response(proc.stdout).text();
  const stderrPromise = new Response(proc.stderr).text();
  const [stdout, stderr, exitCode] = await Promise.all([stdoutPromise, stderrPromise, proc.exited]);
  const output = (stdout + stderr).trim();
  return { stdout, stderr, exitCode, output };
}

async function runCommandOrFail(args: string[], description: string): Promise<string> {
  const { exitCode, output } = await runCommand(args, description);
  if (exitCode !== 0) {
    fail(`${description} failed with exit code ${exitCode}${output ? `: ${output}` : ""}`);
  }
  return output;
}

export interface PlatformInfo {
  os: string;
  arch: string;
  isWindows: boolean;
  cliFilename: string;
  cliPath: string;
  cliSource: "global" | "local" | "none";
  cliDownloadUrl: string;
}

export interface DetectPlatformOptions {
  preferGlobal?: boolean;
}

export function detectPlatform(options: DetectPlatformOptions = {}): PlatformInfo {
  const preferGlobal = options.preferGlobal ?? true;

  let os: string;
  switch (process.platform) {
    case "win32":  os = "windows"; break;
    case "darwin": os = "darwin";  break;
    case "linux":  os = "linux";   break;
    default: fail(`unsupported os: ${process.platform}`);
  }

  let arch: string;
  switch (process.arch) {
    case "arm64": arch = "arm64"; break;
    case "x64":   arch = "amd64"; break;
    default: fail(`unsupported architecture: ${process.arch}`);
  }

  const isWindows = os === "windows";
  const cliFilename = isWindows ? "tencent-news-cli.exe" : "tencent-news-cli";
  const localCliPath = `${SKILL_DIR}/${cliFilename}`;
  const cliDownloadUrl = `${BASE_DOWNLOAD_URL}/${os}-${arch}/${cliFilename}`;

  // Detect global CLI: use `where` on Windows, `which` on others
  let cliPath = localCliPath;
  let cliSource: "global" | "local" | "none" = "none";

  if (existsSync(localCliPath)) {
    cliPath = localCliPath;
    cliSource = "local";
  } else if (preferGlobal) {
    try {
      const whichCmd = isWindows ? "where" : "which";
      const proc = Bun.spawnSync([whichCmd, cliFilename], { stdout: "pipe", stderr: "pipe" });
      if (proc.exitCode === 0) {
        const globalPath = proc.stdout.toString().trim().split(/\r?\n/)[0];
        if (globalPath) {
          // Verify global CLI is functional by calling help
          const helpProc = Bun.spawnSync([globalPath, "help"], { stdout: "pipe", stderr: "pipe" });
          if (helpProc.exitCode === 0) {
            cliPath = globalPath;
            cliSource = "global";
          }
        }
      }
    } catch {
      // Ignore errors in global detection, fall through to local
    }
  }

  if (cliSource === "none") {
    cliPath = localCliPath;
  }

  return {
    os, arch, isWindows, cliFilename, cliPath, cliSource, cliDownloadUrl,
  };
}

export function getPlatformJson(p: PlatformInfo) {
  return {
    os: p.os,
    arch: p.arch,
    cliPath: p.cliPath,
    cliSource: p.cliSource,
  };
}

export async function downloadFile(url: string, outputPath: string) {
  const resp = await fetch(url);
  if (!resp.ok) fail(`download failed: ${resp.status} ${resp.statusText} from ${url}`);
  await mkdir(parentDir(outputPath), { recursive: true });
  await Bun.write(outputPath, resp);
}

export async function runCliVersion(cliPath: string): Promise<string> {
  if (!(await Bun.file(cliPath).exists())) fail(`cli not found at ${cliPath}`);
  if (process.platform !== "win32") {
    await chmod(cliPath, 0o755).catch(() => {});
  }
  return runCommandOrFail([cliPath, "version"], `${cliPath} version`);
}

export interface CliVersionInfo {
  current_version?: string;
  latest_version?: string;
  need_update?: boolean;
  release_notes?: string;
  download_urls?: Record<string, string>;
}

function getPlatformBinaryPath(downloadUrl: string): string {
  let parsedUrl: URL;
  try {
    parsedUrl = new URL(downloadUrl);
  } catch (error) {
    fail(`invalid download url for checksum verification: ${downloadUrl}: ${formatError(error)}`);
  }

  const segments = parsedUrl.pathname.split("/").filter(Boolean);
  if (segments.length < 2) {
    fail(`could not determine platform path from download url: ${downloadUrl}`);
  }

  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;
}

async function fetchChecksumForPlatform(checksumUrl: string, downloadUrl: string): Promise<string> {
  const platformBinaryPath = getPlatformBinaryPath(downloadUrl);
  const resp = await fetch(checksumUrl).catch((error: unknown) =>
    fail(`failed to fetch checksums from ${checksumUrl}: ${formatError(error)}`),
  );

  if (!resp.ok) {
    fail(`failed to fetch checksums from ${checksumUrl}: ${resp.status} ${resp.statusText}`);
  }

  const text = await resp.text().catch((error: unknown) =>
    fail(`failed to read checksums from ${checksumUrl}: ${formatError(error)}`),
  );

  for (const line of text.split("\n")) {
    const trimmed = line.trim();
    if (!trimmed) continue;
    // format: "<sha256>  <path>" (two spaces between hash and path)
    const match = trimmed.match(/^([0-9a-fA-F]{64})\s+(.+)$/);
    if (match) {
      const [, hash, filePath] = match;
      if (filePath === platformBinaryPath) {
        return hash.toLowerCase();
      }
    }
  }

  fail(`no matching checksum found for ${platformBinaryPath} in ${checksumUrl}`);
}

async function computeFileSha256(filePath: string): Promise<string> {
  const fileContent = await Bun.file(filePath).arrayBuffer();
  const hash = createHash("sha256");
  hash.update(Buffer.from(fileContent));
  return hash.digest("hex");
}

export function parseCliVersionJson(raw: string, context: string): CliVersionInfo {
  let parsed: unknown;
  try {
    parsed = JSON.parse(raw);
  } catch {
    fail(`${context} did not return valid JSON: ${raw || "(empty output)"}`);
  }

  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
    fail(`${context} did not return a JSON object: ${raw || "(empty output)"}`);
  }

  return parsed as CliVersionInfo;
}

export interface InstallCliResult {
  rawVersionOutput: string;
  versionInfo: CliVersionInfo;
}

export async function downloadAndInstallCli(
  downloadUrl: string,
  cliPath: string,
  checksumUrl: string,
): Promise<InstallCliResult> {
  const tempPath = createTempSiblingPath(cliPath, "download");
  try {
    await downloadFile(downloadUrl, tempPath);

    const expectedHash = await fetchChecksumForPlatform(checksumUrl, downloadUrl);
    const actualHash = await computeFileSha256(tempPath).catch((error: unknown) =>
      fail(`failed to compute sha256 for ${tempPath}: ${formatError(error)}`),
    );
    if (actualHash !== expectedHash) {
      fail(`checksum verification failed for ${downloadUrl}\n  expected: ${expectedHash}\n  actual:   ${actualHash}`);
    }
    console.error("Checksum verification passed.");

    const rawVersionOutput = await runCliVersion(tempPath);
    const versionInfo = parseCliVersionJson(rawVersionOutput, `${tempPath} version`);
    await replaceFile(tempPath, cliPath);
    if (process.platform !== "win32") {
      await chmod(cliPath, 0o755).catch(() => {});
    }
    return { rawVersionOutput, versionInfo };
  } finally {
    await cleanupFile(tempPath);
  }
}

function extractApiKey(output: string): string | null {
  const match = output.match(/API Key\s*:\s*(.+)$/m);
  if (!match) return null;
  const value = normalizeApiKey(match[1] || "");
  return value || null;
}

function includesMissingApiKeyMessage(output: string): boolean {
  return /未设置 API Key/i.test(output) || /not set/i.test(output);
}

async function ensureCliExecutable(cliPath: string): Promise<void> {
  if (!(await Bun.file(cliPath).exists())) fail(`cli not found at ${cliPath}`);
  if (process.platform !== "win32") {
    await chmod(cliPath, 0o755).catch(() => {});
  }
}

async function runCliCommand(p: PlatformInfo, args: string[]): Promise<CommandResult> {
  await ensureCliExecutable(p.cliPath);
  return runCommand([p.cliPath, ...args], `${p.cliPath} ${args.join(" ")}`);
}

export interface ApiKeyState {
  status: "configured" | "missing" | "error";
  present: boolean;
  error: string | null;
}

export async function getApiKeyState(p: PlatformInfo): Promise<ApiKeyState> {
  if (p.cliSource !== "global" && !(await Bun.file(p.cliPath).exists())) {
    return {
      status: "error",
      present: false,
      error: "CLI not found, cannot check API key.",
    };
  }

  const result = await runCliCommand(p, ["apikey-get"]);
  const rawOutput = result.output;

  if (result.exitCode === 0) {
    const key = extractApiKey(rawOutput);
    return {
      status: key ? "configured" : "error",
      present: !!key,
      error: key ? null : "CLI apikey-get succeeded, but API key could not be parsed from output.",
    };
  }

  if (includesMissingApiKeyMessage(rawOutput) || result.exitCode === 2) {
    return {
      status: "missing",
      present: false,
      error: null,
    };
  }

  return {
    status: "error",
    present: false,
    error: rawOutput || `apikey-get failed with exit code ${result.exitCode}.`,
  };
}

#!/bin/sh
set -e

# cli-state.sh — Output install state, version/update status, and API key status.
# Usage: sh scripts/cli-state.sh

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

# ── helpers ──────────────────────────────────────────────────────────
fail() { echo "Error: $1" >&2; exit 1; }

json_escape() {
  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g' | tr '\n' ' '
}

json_bool() {
  echo "$1" | grep "\"$2\"" | head -1 | sed 's/.*"'"$2"'"[[:space:]]*:[[:space:]]*\([a-z]*\).*/\1/'
}

# ── argument parsing ─────────────────────────────────────────────────
while [ $# -gt 0 ]; do
  case "$1" in
    help)
      echo "Usage: sh scripts/cli-state.sh"
      echo ""
      echo "Print install state, version/update status, and API key status."
      exit 0
      ;;
    *)
      fail "unknown argument: $1"
      ;;
  esac
  shift
done

# ── platform detection ───────────────────────────────────────────────
detect_os() {
  case "$(uname -s)" in
    Darwin) echo "darwin" ;;
    Linux)  echo "linux" ;;
    *)      fail "unsupported os: $(uname -s)" ;;
  esac
}

detect_arch() {
  case "$(uname -m)" in
    arm64|aarch64) echo "arm64" ;;
    x86_64|amd64)  echo "amd64" ;;
    *)             fail "unsupported architecture: $(uname -m)" ;;
  esac
}

OS="$(detect_os)"
ARCH="$(detect_arch)"
CLI_FILENAME="tencent-news-cli"
LOCAL_CLI_PATH="$SKILL_DIR/$CLI_FILENAME"

# ── cli detection: prefer skill-local install, fall back to global ───
CLI_SOURCE="none"
CLI_PATH=""

# Use local CLI first if already installed by the skill.
if [ -f "$LOCAL_CLI_PATH" ]; then
  CLI_PATH="$LOCAL_CLI_PATH"
  CLI_SOURCE="local"
fi

# Fall back to global CLI if local not found.
if [ -z "$CLI_PATH" ]; then
  GLOBAL_CLI_PATH="$(command -v "$CLI_FILENAME" 2>/dev/null || true)"
  if [ -n "$GLOBAL_CLI_PATH" ] && "$GLOBAL_CLI_PATH" help >/dev/null 2>&1; then
    CLI_PATH="$GLOBAL_CLI_PATH"
    CLI_SOURCE="global"
  fi
fi

if [ -n "$CLI_PATH" ]; then
  CLI_EXISTS="true"
else
  CLI_EXISTS="false"
  CLI_PATH="$LOCAL_CLI_PATH"
fi

# ── update check ────────────────────────────────────────────────────
UPDATE_NEED_UPDATE="null"
UPDATE_ERROR="null"

if [ "$CLI_EXISTS" = "true" ]; then
  chmod +x "$CLI_PATH" 2>/dev/null || true

  VERSION_OUTPUT="$("$CLI_PATH" version 2>&1)" && VERSION_EXIT=0 || VERSION_EXIT=$?

  if [ "$VERSION_EXIT" -eq 0 ]; then
    if echo "$VERSION_OUTPUT" | grep -q '"need_update"'; then
      NEED_UPDATE="$(json_bool "$VERSION_OUTPUT" "need_update")"
      case "$NEED_UPDATE" in
        true|false)
          UPDATE_NEED_UPDATE="$NEED_UPDATE"
          ;;
        *)
          UPDATE_ERROR="\"$(json_escape "$CLI_PATH version did not return valid need_update value: ${VERSION_OUTPUT:-"(empty output)"}")\""
          ;;
      esac
    else
      UPDATE_ERROR="\"$(json_escape "$CLI_PATH version did not return valid JSON: ${VERSION_OUTPUT:-"(empty output)"}")\""
    fi
  elif [ -n "$VERSION_OUTPUT" ]; then
    UPDATE_ERROR="\"$(json_escape "$VERSION_OUTPUT")\""
  else
    UPDATE_ERROR="\"$(json_escape "$CLI_PATH version failed with exit code $VERSION_EXIT.")\""
  fi
fi

# ── api key state ────────────────────────────────────────────────────
APIKEY_STATUS="error"
APIKEY_PRESENT="false"
APIKEY_ERROR="null"

if [ "$CLI_EXISTS" = "true" ]; then
  chmod +x "$CLI_PATH" 2>/dev/null || true
  APIKEY_OUTPUT="$("$CLI_PATH" apikey-get 2>&1)" && APIKEY_EXIT=0 || APIKEY_EXIT=$?

  if [ "$APIKEY_EXIT" -eq 0 ]; then
    # try to extract API Key value
    _key="$(echo "$APIKEY_OUTPUT" | grep -o 'API Key[[:space:]]*:[[:space:]]*.*' | sed 's/API Key[[:space:]]*:[[:space:]]*//' | tr -d '[:space:]')"
    # remove surrounding quotes if present
    _key="$(echo "$_key" | sed "s/^['\"]//; s/['\"]$//")"

    if [ -n "$_key" ]; then
      APIKEY_STATUS="configured"
      APIKEY_PRESENT="true"
    else
      APIKEY_STATUS="error"
      APIKEY_ERROR="\"CLI apikey-get succeeded, but API key could not be parsed from output.\""
    fi
  elif echo "$APIKEY_OUTPUT" | grep -qiE '未设置 API Key|not set' || [ "$APIKEY_EXIT" -eq 2 ]; then
    APIKEY_STATUS="missing"
  else
    APIKEY_STATUS="error"
    if [ -n "$APIKEY_OUTPUT" ]; then
      APIKEY_ERROR="\"$(json_escape "$APIKEY_OUTPUT")\""
    else
      APIKEY_ERROR="\"apikey-get failed with exit code ${APIKEY_EXIT}.\""
    fi
  fi
else
  APIKEY_STATUS="error"
  APIKEY_ERROR="\"CLI not found, cannot check API key.\""
fi

# ── output JSON ──────────────────────────────────────────────────────
cat <<EOF
{
  "platform": {
    "os": "$OS",
    "arch": "$ARCH",
    "cliPath": "$CLI_PATH",
    "cliSource": "$CLI_SOURCE"
  },
  "cliExists": $CLI_EXISTS,
  "update": {
    "needUpdate": $UPDATE_NEED_UPDATE,
    "error": $UPDATE_ERROR
  },
  "apiKey": {
    "status": "$APIKEY_STATUS",
    "present": $APIKEY_PRESENT,
    "error": $APIKEY_ERROR
  }
}
EOF

import {
  type PlatformInfo,
  detectPlatform, getPlatformJson, getApiKeyState,
  fail,
} from "./_common.ts";

if (process.argv[2] === "help") {
  console.log(
    "Usage: bun scripts/cli-state.ts\n\n" +
    "Print install state, version/update status, and API key status.",
  );
  process.exit(0);
}

const args = process.argv.slice(2);
if (args.length > 0) {
  fail(`unknown argument: ${args[0]}`);
}

const p = detectPlatform();
const cliExists = p.cliSource === "global" || await Bun.file(p.cliPath).exists();
const cliSource: PlatformInfo["cliSource"] = p.cliSource === "global" ? "global" : (cliExists ? "local" : "none");
const platform: PlatformInfo = { ...p, cliSource };

const update = {
  needUpdate: null as boolean | null,
  error: null as string | null,
};

if (cliExists) {
  try {
    const proc = Bun.spawnSync([platform.cliPath, "version"], { stdout: "pipe", stderr: "pipe" });
    const rawVersionOutput = (proc.stdout.toString() + proc.stderr.toString()).trim();

    if (proc.exitCode !== 0) {
      update.error = rawVersionOutput || `${platform.cliPath} version failed with exit code ${proc.exitCode}`;
    } else {
      let versionInfo: unknown;
      try {
        versionInfo = JSON.parse(rawVersionOutput);
      } catch {
        update.error = `${platform.cliPath} version did not return valid JSON: ${rawVersionOutput || "(empty output)"}`;
      }

      if (!update.error) {
        if (!versionInfo || typeof versionInfo !== "object" || Array.isArray(versionInfo)) {
          update.error = `${platform.cliPath} version did not return a JSON object: ${rawVersionOutput || "(empty output)"}`;
        } else {
          const parsed = versionInfo as {
            need_update?: unknown;
          };

          if (typeof parsed.need_update === "boolean") {
            update.needUpdate = parsed.need_update;
          } else {
            update.error = `${platform.cliPath} version did not return a valid need_update value: ${rawVersionOutput || "(empty output)"}`;
          }
        }
      }
    }
  } catch (error) {
    update.error = error instanceof Error ? error.message : String(error);
  }
}

console.log(JSON.stringify({
  platform: getPlatformJson(platform),
  cliExists,
  update,
  apiKey: await getApiKeyState(platform),
}, null, 2));

#!/bin/sh
set -e

# install-cli.sh — Download the current-platform CLI into the skill directory and verify it.
# Usage: sh scripts/install-cli.sh [--force]

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

BASE_DOWNLOAD_URL="https://mat1.gtimg.com/qqcdn/qqnews/cli/hub"
DEFAULT_CHECKSUM_URL="$BASE_DOWNLOAD_URL/checksums.txt"
FORCE_INSTALL="false"

# ── helpers ──────────────────────────────────────────────────────────
fail() { echo "Error: $1" >&2; exit 1; }

json_escape() {
  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g' | tr '\n' ' '
}

usage() {
  cat <<EOF
Usage: sh scripts/install-cli.sh [--force]

Download the current-platform CLI into the skill directory and verify it.
Use --force to install locally even if a global CLI is available.
EOF
}

compute_sha256() {
  if command -v sha256sum >/dev/null 2>&1; then
    sha256sum "$1" | cut -d' ' -f1
    return 0
  fi

  if command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | cut -d' ' -f1
    return 0
  fi

  return 1
}

extract_platform_path() {
  printf '%s\n' "$1" | awk -F/ '{ if (NF < 2) exit 1; print $(NF-1) "/" $NF }'
}

verify_checksum() {
  file_path="$1"
  checksum_url="$2"
  download_url="$3"

  if ! CHECKSUM_CONTENT="$(curl -fSL "$checksum_url" 2>/dev/null)"; then
    fail "failed to fetch checksums from $checksum_url"
  fi

  platform_path="$(extract_platform_path "$download_url")" || fail "failed to determine platform path from $download_url"
  EXPECTED_HASH="$(printf '%s\n' "$CHECKSUM_CONTENT" | awk -v p="$platform_path" '$2 == p { print $1; exit }')"

  if [ -z "$EXPECTED_HASH" ]; then
    fail "no matching checksum found for $platform_path in $checksum_url"
  fi

  ACTUAL_HASH="$(compute_sha256 "$file_path")" || fail "sha256sum or shasum is required for checksum verification"

  if [ "$ACTUAL_HASH" != "$EXPECTED_HASH" ]; then
    fail "checksum verification failed for $download_url
  expected: $EXPECTED_HASH
  actual:   $ACTUAL_HASH"
  fi

  echo "Checksum verification passed." >&2
}

while [ $# -gt 0 ]; do
  case "$1" in
    help|--help|-h)
      usage
      exit 0
      ;;
    --force)
      FORCE_INSTALL="true"
      ;;
    *)
      fail "unknown argument: $1"
      ;;
  esac
  shift
done

# ── platform detection ───────────────────────────────────────────────
detect_os() {
  case "$(uname -s)" in
    Darwin) echo "darwin" ;;
    Linux)  echo "linux" ;;
    *)      fail "unsupported os: $(uname -s)" ;;
  esac
}

detect_arch() {
  case "$(uname -m)" in
    arm64|aarch64) echo "arm64" ;;
    x86_64|amd64)  echo "amd64" ;;
    *)             fail "unsupported architecture: $(uname -m)" ;;
  esac
}

OS="$(detect_os)"
ARCH="$(detect_arch)"
CLI_FILENAME="tencent-news-cli"
LOCAL_CLI_PATH="$SKILL_DIR/$CLI_FILENAME"
DOWNLOAD_URL="$BASE_DOWNLOAD_URL/$OS-$ARCH/$CLI_FILENAME"
CLI_PATH="$LOCAL_CLI_PATH"

# ── check for global CLI first ──────────────────────────────────────
if [ "$FORCE_INSTALL" != "true" ] && [ ! -f "$LOCAL_CLI_PATH" ]; then
  GLOBAL_CLI_PATH="$(command -v "$CLI_FILENAME" 2>/dev/null || true)"
  if [ -n "$GLOBAL_CLI_PATH" ]; then
    # Verify global CLI is functional
    if "$GLOBAL_CLI_PATH" help >/dev/null 2>&1; then
      # Extract version info from global CLI
      RAW_VERSION_OUTPUT="$("$GLOBAL_CLI_PATH" version 2>&1)" || fail "global CLI version check failed: $RAW_VERSION_OUTPUT"
      echo "$RAW_VERSION_OUTPUT" | grep -q '"current_version"' || fail "global CLI version did not return valid JSON: $RAW_VERSION_OUTPUT"

      CURRENT_VERSION="$(echo "$RAW_VERSION_OUTPUT" | grep '"current_version"' | head -1 | sed 's/.*"current_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')"
      LATEST_VERSION="$(echo "$RAW_VERSION_OUTPUT" | grep '"latest_version"' | head -1 | sed 's/.*"latest_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')"

      if [ -n "$CURRENT_VERSION" ]; then
        CURRENT_VERSION_JSON="\"$CURRENT_VERSION\""
      else
        CURRENT_VERSION_JSON="null"
      fi

      if [ -n "$LATEST_VERSION" ]; then
        LATEST_VERSION_JSON="\"$LATEST_VERSION\""
      else
        LATEST_VERSION_JSON="null"
      fi

      RAW_ESCAPED="$(json_escape "$RAW_VERSION_OUTPUT")"

      cat <<EOF
{
  "installed": true,
  "source": "global",
  "platform": {
    "os": "$OS",
    "arch": "$ARCH",
    "cliPath": "$GLOBAL_CLI_PATH"
  },
  "downloadUrl": null,
  "currentVersion": $CURRENT_VERSION_JSON,
  "latestVersion": $LATEST_VERSION_JSON,
  "rawVersionOutput": "$RAW_ESCAPED",
  "note": "Using globally installed CLI. No download needed."
}
EOF
      exit 0
    fi
  fi
fi

# ── download and install ────────────────────────────────────────────
TEMP_PATH="${CLI_PATH}.download.$$.$( date +%s )"

cleanup() { rm -f "$TEMP_PATH"; }
trap cleanup EXIT

echo "Downloading CLI from $DOWNLOAD_URL ..." >&2
curl -fSL -o "$TEMP_PATH" "$DOWNLOAD_URL" || fail "download failed from $DOWNLOAD_URL"

verify_checksum "$TEMP_PATH" "$DEFAULT_CHECKSUM_URL" "$DOWNLOAD_URL"

chmod +x "$TEMP_PATH"

echo "Verifying CLI ..." >&2
RAW_VERSION_OUTPUT="$("$TEMP_PATH" version 2>&1)" || fail "version check failed: $RAW_VERSION_OUTPUT"

# basic JSON validation
echo "$RAW_VERSION_OUTPUT" | grep -q '"current_version"' || fail "version did not return valid JSON: $RAW_VERSION_OUTPUT"

# move to final location
mv -f "$TEMP_PATH" "$CLI_PATH"
chmod +x "$CLI_PATH"

# ── extract version fields ──────────────────────────────────────────
CURRENT_VERSION="$(echo "$RAW_VERSION_OUTPUT" | grep '"current_version"' | head -1 | sed 's/.*"current_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')"
LATEST_VERSION="$(echo "$RAW_VERSION_OUTPUT" | grep '"latest_version"' | head -1 | sed 's/.*"latest_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')"

# ── format nullable fields ──────────────────────────────────────────
if [ -n "$CURRENT_VERSION" ]; then
  CURRENT_VERSION_JSON="\"$CURRENT_VERSION\""
else
  CURRENT_VERSION_JSON="null"
fi

if [ -n "$LATEST_VERSION" ]; then
  LATEST_VERSION_JSON="\"$LATEST_VERSION\""
else
  LATEST_VERSION_JSON="null"
fi

# ── output JSON ──────────────────────────────────────────────────────
RAW_ESCAPED="$(json_escape "$RAW_VERSION_OUTPUT")"

cat <<EOF
{
  "installed": true,
  "source": "local",
  "platform": {
    "os": "$OS",
    "arch": "$ARCH",
    "cliPath": "$CLI_PATH"
  },
  "downloadUrl": "$DOWNLOAD_URL",
  "currentVersion": $CURRENT_VERSION_JSON,
  "latestVersion": $LATEST_VERSION_JSON,
  "rawVersionOutput": "$RAW_ESCAPED"
}
EOF

import {
  detectPlatform, downloadAndInstallCli, runCliVersion, parseCliVersionJson, fail,
  DEFAULT_CHECKSUM_URL,
} from "./_common.ts";

let forceInstall = false;
for (const arg of process.argv.slice(2)) {
  if (arg === "help" || arg === "--help" || arg === "-h") {
    console.log("Usage: bun scripts/install-cli.ts [--force]\n\nDownload the current-platform CLI into the skill directory and verify it.");
    process.exit(0);
  }

  if (arg === "--force") {
    forceInstall = true;
    continue;
  }

  fail(`unknown argument: ${arg}`);
}

const p = detectPlatform({ preferGlobal: !forceInstall });

// If global CLI is available, skip download
if (p.cliSource === "global") {
  const rawVersionOutput = await runCliVersion(p.cliPath);
  const versionInfo = parseCliVersionJson(rawVersionOutput, `${p.cliPath} version`);
  const currentVersion = versionInfo.current_version ?? null;
  const latestVersion = versionInfo.latest_version ?? null;

  console.log(JSON.stringify({
    installed: true,
    source: "global",
    platform: { os: p.os, arch: p.arch, cliPath: p.cliPath },
    downloadUrl: null,
    currentVersion,
    latestVersion,
    rawVersionOutput,
    note: "Using globally installed CLI. No download needed.",
  }, null, 2));
  process.exit(0);
}

const downloadUrl = p.cliDownloadUrl;

const { rawVersionOutput, versionInfo } = await downloadAndInstallCli(downloadUrl, p.cliPath, DEFAULT_CHECKSUM_URL);
const currentVersion = versionInfo.current_version ?? null;
const latestVersion = versionInfo.latest_version ?? null;

console.log(JSON.stringify({
  installed: true,
  source: "local",
  platform: { os: p.os, arch: p.arch, cliPath: p.cliPath },
  downloadUrl,
  currentVersion,
  latestVersion,
  rawVersionOutput,
}, null, 2));