# sov.gg - one-step setup of the sov MCP server for Claude Code on Windows.
# Installs Claude Code (if missing), then adds the "sov" MCP server and asks for your Authentik token.
# No administrator rights are needed. Read it before you run it; it is short.
$ErrorActionPreference = 'Stop'
$McpUrl = 'https://mcp.sov.gg/mcp'
$ScriptUrl = 'https://mcp.sov.gg/connect/setup.ps1'   # kept for reference; the script no longer re-launches itself

function Pause-Exit([int]$code) {
    Write-Host ''
    Read-Host 'Press Enter to close' | Out-Null
    exit $code
}

# Windows PowerShell 5.1 does not use TLS 1.2 by default, which claude.ai requires.
try { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 } catch { }

function Find-Claude {
    $c = Get-Command claude -ErrorAction SilentlyContinue
    if ($c) { return $c.Source }
    foreach ($p in @((Join-Path $env:USERPROFILE '.local\bin\claude.exe'), (Join-Path $env:LOCALAPPDATA 'Microsoft\WinGet\Links\claude.exe'))) {
        if (Test-Path -LiteralPath $p) { return $p }
    }
    return $null
}

try {
    Write-Host ''
    Write-Host "sov.gg MCP setup for $env:USERNAME  (no administrator rights needed)" -ForegroundColor Cyan

    # 1. Claude Code (Anthropic's own installer; Git for Windows is optional, so it is not installed here).
    $claude = Find-Claude
    if ($claude) {
        Write-Host "[1/2] Claude Code is already installed: $claude"
    } else {
        Write-Host '[1/2] Installing Claude Code (the installer prints nothing while it downloads; this takes a minute)...'
        $ErrorActionPreference = 'Continue'
        try {
            $text = (Invoke-WebRequest -UseBasicParsing -Uri 'https://claude.ai/install.ps1' -ErrorAction Stop).Content
            if ($text -isnot [string]) { $text = [Text.Encoding]::UTF8.GetString($text) }
            if ($text -match '<!DOCTYPE|<html') { throw 'claude.ai returned a web page instead of the installer (blocked by a proxy, firewall, or region).' }
            # Run it in its own PowerShell: the installer may call exit, which must not end this script.
            $inst = Join-Path $env:TEMP 'claude-install.ps1'
            Set-Content -LiteralPath $inst -Value $text -Encoding UTF8
            & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $inst
            Remove-Item -LiteralPath $inst -Force -ErrorAction SilentlyContinue
        } catch {
            Write-Warning "The Claude Code installer failed: $($_.Exception.Message)"
        }
        $ErrorActionPreference = 'Stop'
        $claude = Find-Claude
        if (-not $claude -and (Get-Command winget -ErrorAction SilentlyContinue)) {
            Write-Host 'Trying winget instead (Anthropic.ClaudeCode)...'
            $ErrorActionPreference = 'Continue'
            winget install --id Anthropic.ClaudeCode -e --accept-package-agreements --accept-source-agreements
            $ErrorActionPreference = 'Stop'
            $env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [Environment]::GetEnvironmentVariable('Path', 'User')
            $claude = Find-Claude
        }
        if (-not $claude) {
            throw ('Claude Code did not install. Run  irm https://claude.ai/install.ps1 | iex  in a normal PowerShell window and read the error it prints; ' +
                   'https://code.claude.com/docs/en/troubleshoot-install matches each error to a fix. Then run this script again.')
        }
        Write-Host "Installed: $claude" -ForegroundColor Green
    }
    # Make "claude" work in this window and in new ones.
    $dir = Split-Path -Parent $claude
    if (($env:Path -split ';') -notcontains $dir) { $env:Path += ';' + $dir }
    $userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
    if (($userPath -split ';') -notcontains $dir) { [Environment]::SetEnvironmentVariable('Path', ($userPath.TrimEnd(';') + ';' + $dir), 'User') }

    # 2. The MCP server, with the token typed here (hidden).
    Write-Host '[2/2] Adding the sov MCP server.'
    Write-Host ''
    Write-Host 'Paste your Authentik token (Authentik > User Settings > Tokens). Typing is hidden.'
    Write-Host 'Press Enter with nothing typed to sign in through the browser instead.'
    $secure = Read-Host 'Token' -AsSecureString
    $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
    try { $token = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr) }
    finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr) }

    # Remove any earlier "sov" first. On a first run there is none, and claude says so on stderr ("No MCP server
    # found with name: sov"); Windows PowerShell 5.1 treats native stderr as fatal under 'Stop', so relax it here.
    $ErrorActionPreference = 'Continue'
    & $claude mcp remove sov --scope user *> $null
    $global:LASTEXITCODE = 0
    if ($token) {
        $token = $token.Trim()
        try {
            $body = '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"sov-setup","version":"1"}}}'
            Invoke-WebRequest -UseBasicParsing -Method Post -Uri $McpUrl -Body $body -ContentType 'application/json' `
                -Headers @{ Authorization = "Bearer $token"; Accept = 'application/json, text/event-stream' } -ErrorAction Stop | Out-Null
            Write-Host 'The gateway accepted the token.' -ForegroundColor Green
        } catch {
            $code = 0
            if ($_.Exception.Response) { $code = [int]$_.Exception.Response.StatusCode }
            if ($code -eq 401 -or $code -eq 403) {
                Write-Warning "The gateway refused this token (HTTP $code). It may have expired (tokens made in User Settings last about 30 minutes) or you are not in the ai-agent-read group. Adding it anyway; run this script again with a fresh token if it does not work."
            } else {
                Write-Warning "Could not check the token against the gateway ($($_.Exception.Message)). Adding it anyway."
            }
        }
        & $claude mcp add --transport http --scope user sov $McpUrl --header "Authorization: Bearer $token"
    } else {
        & $claude mcp add --transport http --scope user sov $McpUrl
    }
    if ($LASTEXITCODE -ne 0) { throw 'claude mcp add failed (see above).' }
    $token = $null

    Write-Host ''
    Write-Host 'Done.' -ForegroundColor Green
    if (-not $secure.Length) {
        Write-Host 'Start Claude Code (type: claude), run /mcp, pick sov and choose Authenticate.'
    } else {
        Write-Host 'Start Claude Code (type: claude) and ask it to call the whoami tool on sov.'
    }
    Pause-Exit 0
} catch {
    Write-Host ''
    Write-Host "Setup stopped: $($_.Exception.Message)" -ForegroundColor Red
    Pause-Exit 1
}