install.sh

#!/usr/bin/env bash

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

info() {
  printf "${BLUE}==>${NC} %s\n" "$1"
}

success() {
  printf "${GREEN}==>${NC} %s\n" "$1"
}

warn() {
  printf "${YELLOW}==>${NC} %s\n" "$1"
}

error() {
  printf "${RED}==>${NC} %s\n" "$1" >&2
}

DOTFILES_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/managed-configs.sh
source "$DOTFILES_DIR/lib/managed-configs.sh"

usage() {
  cat <<'EOF'
Usage: ./install.sh [phase]

Phases (installed in this order):
  base      Homebrew bootstrap; blocks everything else
  terminal  Ghostty + CLI tools via brew bundle + zsh/starship configs
  ai        cliproxyapi (brew service + config) + agent rules + Claude Code
            and Pi config + skills via npx skills
  all       base -> terminal -> ai (default)

Completed phases are recorded in ~/.local/state/dotfiles/phases/. Running
terminal or ai alone re-verifies the base toolchain first and aborts if it
is missing.
EOF
}

PHASE_ARG="${1:-all}"
case "$PHASE_ARG" in
  base|terminal|ai|all) ;;
  -h|--help)
    usage
    exit 0
    ;;
  *)
    usage >&2
    error "Unknown phase: $PHASE_ARG"
    exit 1
    ;;
esac

STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/phases"
mkdir -p "$STATE_DIR"

mark_phase_done() {
  date '+%Y-%m-%dT%H:%M:%S%z' > "$STATE_DIR/$1"
}

phase_marked_done() {
  [ -f "$STATE_DIR/$1" ]
}

base_satisfied() {
  command -v brew >/dev/null 2>&1
}

require_base() {
  local next_phase="$1"

  if base_satisfied; then
    # The state marker records history; live detection is what actually gates.
    phase_marked_done base || mark_phase_done base
    return 0
  fi
  error "Base phase is incomplete (Homebrew missing); run ./install.sh base before $next_phase"
  exit 1
}

RSYNC_EXCLUDES=(
  '--exclude=.git/'
  '--exclude=node_modules/'
  '--exclude=.DS_Store'
  '--exclude=*.log'
  '--exclude=*.swp'
  '--exclude=*.swo'
  '--exclude=*~'
  '--exclude=.#*'
)

DIFF_EXCLUDES=(
  '-x' '.git'
  '-x' 'node_modules'
  '-x' '.DS_Store'
  '-x' '*.log'
  '-x' '*.swp'
  '-x' '*.swo'
  '-x' '*~'
  '-x' '.#*'
)

TMP_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/dotfiles-install.XXXXXX")"

cleanup() {
  rm -rf "$TMP_ROOT"
}
trap cleanup EXIT

BACKUP_ROOT="$HOME/.dotfiles-backups/$(date +%Y%m%d%H%M%S)-$$"
backup_created=0

# Keep the launching stdin available for prompts even inside redirected loops.
exec 3<&0

is_expected_repository_link() {
  local target="$1"
  local source="$2"

  [ -L "$target" ] && [ -e "$target" ] && [ "$target" -ef "$source" ]
}

directory_is_equal() {
  diff -qr "${DIFF_EXCLUDES[@]}" "$1" "$2" >/dev/null 2>&1
}

show_file_diff() {
  local source="$1"
  local target="$2"

  diff -u --label "local: $target" --label "repo:  $source" "$target" "$source" || true
}

show_directory_diff() {
  local source="$1"
  local target="$2"

  diff -ru "${DIFF_EXCLUDES[@]}" "$target" "$source" || true
}

validate_repository_source() {
  local source="$1"
  local expected_type="$2"

  if [ -L "$source" ]; then
    error "Repository source must not be a symlink: $source"
    return 1
  fi

  case "$expected_type" in
    file)
      [ -f "$source" ] || {
        error "Missing repository file: $source"
        return 1
      }
      ;;
    directory)
      [ -d "$source" ] || {
        error "Missing repository directory: $source"
        return 1
      }
      ;;
    *)
      error "Unknown managed path type: $expected_type"
      return 1
      ;;
  esac
}

backup_program_paths() {
  local manifest="$1"
  local selected_program="$2"
  local target_path backup_path

  while IFS='|' read -r _ entry_program _ _ local_path _; do
    [ "$entry_program" = "$selected_program" ] || continue
    target_path="$HOME/$local_path"

    if [ -e "$target_path" ] || [ -L "$target_path" ]; then
      backup_path="$BACKUP_ROOT/$selected_program/$local_path"
      mkdir -p "$(dirname "$backup_path")" || return 1
      mv "$target_path" "$backup_path" || return 1
      backup_created=1
      printf '  Backed up %s -> %s\n' "$target_path" "$backup_path"
    fi
  done < "$manifest"
}

copy_managed_path() {
  local source="$1"
  local target="$2"
  local expected_type="$3"
  local parent temporary

  parent="$(dirname "$target")"
  mkdir -p "$parent" || return 1

  case "$expected_type" in
    file)
      temporary="$(mktemp "$parent/.dotfiles-install.XXXXXX")" || return 1
      if ! cp -p "$source" "$temporary"; then
        rm -f -- "$temporary"
        return 1
      fi
      if ! mv -f "$temporary" "$target"; then
        rm -f -- "$temporary"
        return 1
      fi
      ;;
    directory)
      temporary="$(mktemp -d "$parent/.dotfiles-install.XXXXXX")" || return 1
      if ! rsync -a "${RSYNC_EXCLUDES[@]}" "$source/" "$temporary/"; then
        rm -rf -- "$temporary"
        return 1
      fi
      if ! mv "$temporary" "$target"; then
        rm -rf -- "$temporary"
        return 1
      fi
      ;;
  esac
}

stage_program_paths() {
  local manifest="$1"
  local selected_program="$2"
  local staging_root="$3"
  local repository_path local_path expected_type

  mkdir -p "$staging_root" || return 1
  while IFS='|' read -r _ entry_program _ repository_path local_path expected_type; do
    [ "$entry_program" = "$selected_program" ] || continue
    copy_managed_path \
      "$DOTFILES_DIR/$repository_path" \
      "$staging_root/$local_path" \
      "$expected_type" || return 1
  done < "$manifest"
}

install_staged_program_paths() {
  local manifest="$1"
  local selected_program="$2"
  local staging_root="$3"
  local local_path expected_type

  while IFS='|' read -r _ entry_program _ _ local_path expected_type; do
    [ "$entry_program" = "$selected_program" ] || continue
    copy_managed_path \
      "$staging_root/$local_path" \
      "$HOME/$local_path" \
      "$expected_type" || return 1
  done < "$manifest"
}

snapshot_existing_program_paths() {
  local manifest="$1"
  local selected_program="$2"
  local originals_log="$3"
  local local_path target_path

  : > "$originals_log" || return 1
  while IFS='|' read -r _ entry_program _ _ local_path _; do
    [ "$entry_program" = "$selected_program" ] || continue
    target_path="$HOME/$local_path"
    if [ -e "$target_path" ] || [ -L "$target_path" ]; then
      printf '%s\n' "$local_path" >> "$originals_log" || return 1
    fi
  done < "$manifest"
}

rollback_program_paths() {
  local manifest="$1"
  local selected_program="$2"
  local originals_log="$3"
  local rollback_mode="$4"
  local discard_root="$TMP_ROOT/rollback-discard/$selected_program"
  local local_path target_path backup_path discard_path
  local had_original backup_exists target_exists
  local rollback_failed=0

  while IFS='|' read -r _ entry_program _ _ local_path _; do
    [ "$entry_program" = "$selected_program" ] || continue
    target_path="$HOME/$local_path"
    backup_path="$BACKUP_ROOT/$selected_program/$local_path"

    had_original=0
    backup_exists=0
    target_exists=0
    grep -Fqx "$local_path" "$originals_log" && had_original=1
    { [ -e "$backup_path" ] || [ -L "$backup_path" ]; } && backup_exists=1
    { [ -e "$target_path" ] || [ -L "$target_path" ]; } && target_exists=1

    if [ "$rollback_mode" = 'install' ] && [ "$target_exists" -eq 1 ]; then
      discard_path="$discard_root/$local_path"
      if ! mkdir -p "$(dirname "$discard_path")" || ! mv "$target_path" "$discard_path"; then
        error "Rollback could not clear newly installed path: $target_path"
        rollback_failed=1
        continue
      fi
      target_exists=0
    fi

    if [ "$backup_exists" -eq 1 ]; then
      if [ "$target_exists" -eq 1 ]; then
        error "Rollback target is unexpectedly occupied: $target_path"
        rollback_failed=1
        continue
      fi
      if ! mkdir -p "$(dirname "$target_path")" || ! mv "$backup_path" "$target_path"; then
        error "Rollback could not restore original path: $target_path"
        rollback_failed=1
      fi
    elif [ "$had_original" -eq 1 ] && [ "$target_exists" -eq 0 ]; then
      error "Rollback could not find the original path or its backup: $target_path"
      rollback_failed=1
    fi
  done < "$manifest"

  [ "$rollback_failed" -eq 0 ]
}

deploy_program_transaction() {
  local manifest="$1"
  local selected_program="$2"
  local label="$3"
  local staging_root="$TMP_ROOT/staged/$selected_program"
  local originals_log="$TMP_ROOT/originals.$selected_program"
  local local_path

  info "Preparing full managed set for $label"
  if ! stage_program_paths "$manifest" "$selected_program" "$staging_root"; then
    error "$label could not be prepared; local configuration was not changed"
    return 1
  fi

  if ! snapshot_existing_program_paths "$manifest" "$selected_program" "$originals_log"; then
    error "$label local state could not be recorded; local configuration was not changed"
    return 1
  fi

  if ! backup_program_paths "$manifest" "$selected_program"; then
    error "$label backup failed; restoring any paths already moved"
    rollback_program_paths "$manifest" "$selected_program" "$originals_log" backup ||
      error "$label rollback was incomplete; inspect $BACKUP_ROOT/$selected_program"
    return 1
  fi

  if ! install_staged_program_paths "$manifest" "$selected_program" "$staging_root"; then
    error "$label installation failed; restoring the previous local configuration"
    rollback_program_paths "$manifest" "$selected_program" "$originals_log" install ||
      error "$label rollback was incomplete; inspect $BACKUP_ROOT/$selected_program"
    return 1
  fi

  while IFS='|' read -r _ entry_program _ _ local_path _; do
    [ "$entry_program" = "$selected_program" ] || continue
    success "Copied $HOME/$local_path"
  done < "$manifest"
}

deploy_phase_configs() {
  local phase="$1"
  local manifest="$TMP_ROOT/manifest.$phase"
  local programs="$TMP_ROOT/programs.$phase"
  local states="$TMP_ROOT/states.$phase"
  local decisions="$TMP_ROOT/decisions.$phase"

  managed_entries | awk -F '|' -v p="$phase" '$1 == p' > "$manifest"
  [ -s "$manifest" ] || return 0
  awk -F '|' '!seen[$2]++ { print $2 "|" $3 }' "$manifest" > "$programs"

  if grep -q '|directory$' "$manifest" && ! command -v rsync >/dev/null 2>&1; then
    error "rsync is required to copy managed directories"
    exit 1
  fi

  info "Comparing repository configuration with local configuration"
  while IFS='|' read -r program label; do
    group_missing=0
    group_legacy_links=0
    group_conflict=0

    printf '\n%s:\n' "$label"
    while IFS='|' read -r _ entry_program _ repository_path local_path expected_type; do
      [ "$entry_program" = "$program" ] || continue

      source_path="$DOTFILES_DIR/$repository_path"
      target_path="$HOME/$local_path"
      validate_repository_source "$source_path" "$expected_type"

      if [ ! -e "$target_path" ] && [ ! -L "$target_path" ]; then
        printf '  [missing] %s\n' "$target_path"
        group_missing=1
        continue
      fi

      if [ -L "$target_path" ]; then
        if is_expected_repository_link "$target_path" "$source_path"; then
          printf '  [legacy repository link] %s\n' "$target_path"
          group_legacy_links=1
        else
          printf '  [conflicting symlink] %s -> %s\n' "$target_path" "$(readlink "$target_path" 2>/dev/null || printf '?')"
          group_conflict=1
        fi
        continue
      fi

      case "$expected_type" in
        file)
          if [ ! -f "$target_path" ]; then
            printf '  [type conflict] expected file: %s\n' "$target_path"
            group_conflict=1
          elif cmp -s "$source_path" "$target_path"; then
            printf '  [same] %s\n' "$target_path"
          else
            printf '  [different] %s\n' "$target_path"
            show_file_diff "$source_path" "$target_path"
            group_conflict=1
          fi
          ;;
        directory)
          if [ ! -d "$target_path" ]; then
            printf '  [type conflict] expected directory: %s\n' "$target_path"
            group_conflict=1
          elif directory_is_equal "$source_path" "$target_path"; then
            printf '  [same] %s\n' "$target_path"
          else
            printf '  [different] %s\n' "$target_path"
            show_directory_diff "$source_path" "$target_path"
            group_conflict=1
          fi
          ;;
      esac
    done < "$manifest"

    if [ "$group_conflict" -eq 1 ]; then
      printf '%s|%s|conflict\n' "$program" "$label" >> "$states"
    elif [ "$group_missing" -eq 1 ] || [ "$group_legacy_links" -eq 1 ]; then
      printf '%s|%s|automatic\n' "$program" "$label" >> "$states"
    else
      printf '%s|%s|same\n' "$program" "$label" >> "$states"
    fi
  done < "$programs"

  printf '\n'
  info "Decisions are per program: every managed path in a group is kept or replaced together"
  while IFS='|' read -r program label state; do
    case "$state" in
      same)
        info "$label: already matches the repository"
        printf '%s|skip\n' "$program" >> "$decisions"
        ;;
      automatic)
        info "$label: no conflicting local config; installing the full managed set automatically"
        printf '%s|deploy\n' "$program" >> "$decisions"
        ;;
      conflict)
        printf 'Replace ALL managed %s paths with the repository set?\n' "$label"
        printf '  y = backup existing files, then overwrite every managed path in this group\n'
        printf '  N = leave the entire group unchanged (including any still-missing paths) [y/N] '
        if ! IFS= read -r answer <&3; then
          printf '\n' >&2
          error "No answer available; no files changed"
          exit 1
        fi
        case "$answer" in
          y|Y|yes|YES|Yes)
            printf '%s|deploy\n' "$program" >> "$decisions"
            ;;
          *)
            info "$label: entire managed set left unchanged (including any missing paths)"
            printf '%s|skip\n' "$program" >> "$decisions"
            ;;
        esac
        ;;
    esac
  done < "$states"

  while IFS='|' read -r program action; do
    [ "$action" = 'deploy' ] || continue

    label="$(awk -F '|' -v selected="$program" '$1 == selected { print $2; exit }' "$programs")"
    info "Installing full managed set for $label"
    deploy_program_transaction "$manifest" "$program" "$label"
  done < "$decisions"
}

install_homebrew() {
  if command -v brew >/dev/null 2>&1; then
    info "Homebrew already installed: $(command -v brew)"
    return 0
  fi

  info "Installing Homebrew via the official installer"
  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" <&3

  local brew_path
  for brew_path in /opt/homebrew/bin/brew /usr/local/bin/brew; do
    if [ -x "$brew_path" ]; then
      eval "$("$brew_path" shellenv)"
      break
    fi
  done

  if ! command -v brew >/dev/null 2>&1; then
    error "Homebrew installation did not complete"
    exit 1
  fi
}

install_ghostty() {
  if [ -d /Applications/Ghostty.app ] ||
    [ -d "$HOME/Applications/Ghostty.app" ] ||
    brew list --cask ghostty >/dev/null 2>&1; then
    info "Ghostty already installed"
    return 0
  fi
  info "Installing Ghostty"
  brew install --cask ghostty
}

install_skills() {
  local skills_file="$DOTFILES_DIR/ai/skills.txt"
  local line count=0
  local -a args

  if [ ! -f "$skills_file" ]; then
    info "No skills manifest (ai/skills.txt); skipping skills"
    return 0
  fi

  while IFS= read -r line || [ -n "$line" ]; do
    line="${line%%#*}"
    line="${line#"${line%%[![:space:]]*}"}"
    line="${line%"${line##*[![:space:]]}"}"
    [ -n "$line" ] || continue

    if ! command -v npx >/dev/null 2>&1; then
      error "npx is required to install skills; install Node.js first (e.g. brew install node)"
      exit 1
    fi

    read -r -a args <<< "$line"
    info "Installing skills: npx skills add ${args[*]}"
    npx skills add "${args[@]}" <&3
    count=$((count + 1))
  done < "$skills_file"

  if [ "$count" -eq 0 ]; then
    info "ai/skills.txt has no entries; nothing to install"
  fi
}

ensure_claude_dependencies() {
  if command -v jq >/dev/null 2>&1; then
    info "Claude Code statusline dependency available: $(command -v jq)"
    return 0
  fi

  info "Installing jq for the Claude Code statusline"
  brew install jq
}

CLIPROXYAPI_CONF_TEMPLATE='ai/cliproxyapi/cliproxyapi.conf.template'
CLIPROXY_PASSWORD_FINGERPRINT_FILE="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/cliproxyapi/management-password.sha256"

ensure_cliproxy_credentials() {
  if [ -e "$CLIPROXY_CREDENTIALS_FILE" ] || [ -L "$CLIPROXY_CREDENTIALS_FILE" ]; then
    if [ -L "$CLIPROXY_CREDENTIALS_FILE" ] || [ ! -f "$CLIPROXY_CREDENTIALS_FILE" ]; then
      error "Credentials path must be a regular file, not a symlink: $CLIPROXY_CREDENTIALS_FILE"
      return 1
    fi
    chmod 600 "$CLIPROXY_CREDENTIALS_FILE"
    return 0
  fi

  info "Generating private credentials file $CLIPROXY_CREDENTIALS_FILE"
  mkdir -p "$(dirname "$CLIPROXY_CREDENTIALS_FILE")"
  (
    umask 077
    {
      printf '# Local CLIProxyAPI credentials. Keep this file private.\n'
      printf "CLIPROXY_MANAGEMENT_PASSWORD='%s'\n" "$(openssl rand -hex 24)"
      printf "CLIPROXY_API_KEY='sk-local-%s'\n" "$(openssl rand -hex 24)"
    } > "$CLIPROXY_CREDENTIALS_FILE"
  )
}

cliproxy_management_password_fingerprint() {
  local password
  password="$(credential_value CLIPROXY_MANAGEMENT_PASSWORD)" || return 1
  printf '%s' "$password" | openssl dgst -sha256 | awk '{ print $NF }'
}

cliproxy_management_password_is_applied() {
  local fingerprint="$1"

  [ -f "$CLIPROXY_PASSWORD_FINGERPRINT_FILE" ] &&
    [ ! -L "$CLIPROXY_PASSWORD_FINGERPRINT_FILE" ] &&
    grep -Fqx -- "$fingerprint" "$CLIPROXY_PASSWORD_FINGERPRINT_FILE"
}

record_cliproxy_management_password_fingerprint() {
  local fingerprint="$1"
  local state_dir temporary

  state_dir="$(dirname "$CLIPROXY_PASSWORD_FINGERPRINT_FILE")"
  mkdir -p "$state_dir"
  chmod 700 "$state_dir"
  temporary="$(mktemp "$state_dir/.management-password.XXXXXX")"
  chmod 600 "$temporary"
  printf '%s\n' "$fingerprint" > "$temporary"
  mv -f "$temporary" "$CLIPROXY_PASSWORD_FINGERPRINT_FILE"
}

# cliproxyapi hashes a plaintext management password into secret-key on
# startup, so that line can never match the freshly rendered template
# byte-for-byte; compare everything else.
cliproxy_conf_matches() {
  cmp -s \
    <(sed 's/^\([[:space:]]*secret-key:\).*/\1/' "$1") \
    <(sed 's/^\([[:space:]]*secret-key:\).*/\1/' "$2")
}

redact_cliproxy_conf() {
  awk '
    /^[[:space:]]*secret-key:/ {
      sub(/:.*/, ": \"<redacted>\"")
      print
      next
    }
    /^api-keys:/ {
      if ($0 ~ /\[/) {
        sub(/:.*/, ": [\"<redacted>\"]")
        in_api_keys = 0
      } else {
        in_api_keys = 1
      }
      print
      next
    }
    in_api_keys {
      if ($0 ~ /^[^[:space:]#]/) {
        in_api_keys = 0
      } else if ($0 ~ /^[[:space:]]*-[[:space:]]*/) {
        match($0, /^[[:space:]]*/)
        print substr($0, 1, RLENGTH) "- \"<redacted>\""
        next
      }
    }
    /^[[:space:]]*-[[:space:]]*api-key:/ {
      sub(/api-key:.*/, "api-key: \"<redacted>\"")
      print
      next
    }
    { print }
  ' "$1"
}

show_cliproxy_conf_diff() {
  local rendered="$1"
  local installed="$2"

  diff -u \
    --label "local: $installed (secrets redacted)" \
    --label "repo:  $CLIPROXYAPI_CONF_TEMPLATE (rendered, secrets redacted)" \
    <(redact_cliproxy_conf "$installed") \
    <(redact_cliproxy_conf "$rendered") || true
}

cliproxyapi_service_state() {
  brew services list | awk '$1 == "cliproxyapi" { print $2; exit }'
}

install_cliproxyapi() {
  if brew list --formula cliproxyapi >/dev/null 2>&1; then
    info "cliproxyapi already installed"
  else
    info "Installing cliproxyapi"
    brew install cliproxyapi
  fi

  local conf_target rendered backup_path state password_fingerprint
  local deployed=0 password_changed=1
  conf_target="$(brew --prefix)/etc/cliproxyapi.conf"
  rendered="$TMP_ROOT/cliproxyapi.conf.rendered"

  if ! render_template_file "$DOTFILES_DIR/$CLIPROXYAPI_CONF_TEMPLATE" "$rendered"; then
    warn "cliproxyapi.conf not deployed: cannot render $CLIPROXYAPI_CONF_TEMPLATE"
    error "Complete $CLIPROXY_CREDENTIALS_FILE and export OPENCODE_GO_API_KEY, then re-run ./install.sh ai"
    return 1
  fi

  password_fingerprint="$(cliproxy_management_password_fingerprint)"
  if cliproxy_management_password_is_applied "$password_fingerprint"; then
    password_changed=0
  fi

  if [ ! -e "$conf_target" ] && [ ! -L "$conf_target" ]; then
    install -m 600 "$rendered" "$conf_target"
    success "Installed $conf_target"
    deployed=1
  elif cliproxy_conf_matches "$rendered" "$conf_target"; then
    if [ "$password_changed" -eq 1 ]; then
      info "CLIProxyAPI management password changed; deploying the rendered config"
      install -m 600 "$rendered" "$conf_target"
      success "Installed $conf_target"
      deployed=1
    else
      info "cliproxyapi.conf already matches the repository template"
    fi
  else
    printf 'cliproxyapi.conf differs from the rendered repository template:\n'
    show_cliproxy_conf_diff "$rendered" "$conf_target"
    printf 'Replace %s with the rendered repository template? [y/N] ' "$conf_target"
    if ! IFS= read -r answer <&3; then
      printf '\n' >&2
      error "No answer available; cliproxyapi.conf left unchanged"
      exit 1
    fi
    case "$answer" in
      y|Y|yes|YES|Yes)
        backup_path="$BACKUP_ROOT/cliproxyapi/cliproxyapi.conf"
        mkdir -p "$(dirname "$backup_path")"
        cp -p "$conf_target" "$backup_path"
        backup_created=1
        printf '  Backed up %s -> %s\n' "$conf_target" "$backup_path"
        install -m 600 "$rendered" "$conf_target"
        success "Installed $conf_target"
        deployed=1
        ;;
      *)
        info "cliproxyapi.conf left unchanged"
        ;;
    esac
  fi

  state="$(cliproxyapi_service_state)"
  if [ "$deployed" -eq 1 ]; then
    info "Restarting cliproxyapi service"
    brew services restart cliproxyapi
    record_cliproxy_management_password_fingerprint "$password_fingerprint"
  elif [ "$state" != 'started' ]; then
    info "Starting cliproxyapi service"
    brew services start cliproxyapi
  else
    info "cliproxyapi service already running"
  fi
}

install_phase_base() {
  printf '\n'
  info "Phase base: Homebrew bootstrap"
  install_homebrew
  deploy_phase_configs base
  mark_phase_done base
  success "Phase base complete"
}

install_phase_terminal() {
  require_base terminal
  printf '\n'
  info "Phase terminal: Ghostty + CLI tools + shell configs"
  install_ghostty
  info "Installing Homebrew dependencies from terminal/Brewfile"
  brew bundle --file="$DOTFILES_DIR/terminal/Brewfile"
  deploy_phase_configs terminal
  mark_phase_done terminal
  success "Phase terminal complete"
}

install_phase_ai() {
  require_base ai
  printf '\n'
  info "Phase ai: cliproxyapi + agent rules + Claude Code/Pi config + skills"
  ensure_cliproxy_credentials
  install_cliproxyapi
  ensure_claude_dependencies
  deploy_phase_configs ai
  install_skills
  mark_phase_done ai
  success "Phase ai complete"
}

case "$PHASE_ARG" in
  all)
    install_phase_base
    install_phase_terminal
    install_phase_ai
    ;;
  base)
    install_phase_base
    ;;
  terminal)
    install_phase_terminal
    ;;
  ai)
    install_phase_ai
    ;;
esac

exec 3<&-

if [ "$backup_created" -eq 1 ]; then
  info "Previous local files saved under $BACKUP_ROOT"
fi
success "Requested installation finished ($PHASE_ARG)"