#!/usr/bin/env bash
# agentbox bootstrap. Serves from the short URL; contains NO secrets.
#   curl -fsSL https://ab.42b.eu | sudo AGENTBOX_TOKEN=<one-time token> bash
# Everything it runs is fetched from the manifest, which is verified against the pinned release key.
set -euo pipefail
BASE="${AGENTBOX_BASE:-https://ab.42b.eu}"
# pinned release public key (ssh-keygen -Y verify). Replace via publish.sh.
RELEASE_PUB='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKlDSypmiN165/pJL4CHsu4lNEg+66r43Yyju71gcGIR'
[ "$(id -u)" = 0 ] || { echo "run with sudo" >&2; exit 1; }
command -v ssh-keygen >/dev/null || { apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null; }
command -v curl >/dev/null || { apt-get update -qq && apt-get install -y -qq curl ca-certificates >/dev/null; }
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
curl -fsSL "$BASE/m" -o "$T/m"; curl -fsSL "$BASE/m.sig" -o "$T/m.sig"
printf 'release namespaces="agentbox" %s\n' "$RELEASE_PUB" >"$T/allowed"
ssh-keygen -Y verify -f "$T/allowed" -I release -n agentbox -s "$T/m.sig" <"$T/m" >/dev/null \
  || { echo "bootstrap: manifest signature INVALID, refusing to run anything" >&2; exit 1; }
while read -r sum name; do
  curl -fsSL "$BASE/f/$name" -o "$T/$name"
  echo "$sum  $T/$name" | sha256sum -c - >/dev/null || { echo "bootstrap: checksum mismatch for $name" >&2; exit 1; }
done <"$T/m"
chmod +x "$T"/*.sh
export SRC_DIR="$T"
bash "$T/agent-slim.sh"
if [ -n "${AGENTBOX_TOKEN:-}" ] || [ -f /var/lib/agentbox/config.json ]; then
  AGENTBOX_SERVER="${AGENTBOX_SERVER:-$BASE}" bash "$T/agent-connect.sh"
else
  echo "bootstrap: slimmed only (no AGENTBOX_TOKEN given, skipping enrolment)"
fi