install

#!/bin/sh
# Installs browse: downloads the browse binary for this computer from Anomaly's release service into ~/.local/bin
# ($XDG_BIN_HOME when set), then hands over to `browse install`, which does the rest (PATH, your agents, pairing with your
# browser). Served at https://opencode.ai/browse/install. Platform detection follows opencode's installer.
set -eu
APP=browse

MUTED='\033[0;2m'
RED='\033[0;31m'
NC='\033[0m'

usage() {
    cat <<EOF
browse installer

Usage: install [options] [browse install options]

Options:
    -h, --help              Display this help message
    -v, --version <version> Install a specific version from npm (e.g., 0.0.7)
        --channel <channel> Install the latest version on a release channel:
                            stable (default), beta or dev. \`latest\` means stable
    -b, --binary <path>     Install from a local binary instead of downloading
        --no-setup          Only install the binary; don't run \`browse install\`

Anything else goes to \`browse install\`, e.g. --remote, --agent claude or --no-modify-path.

Examples:
    curl -fsSL https://opencode.ai/browse/install | bash
    curl -fsSL https://opencode.ai/browse/install | bash -s -- --remote
    curl -fsSL https://opencode.ai/browse/install | bash -s -- --channel dev
    curl -fsSL https://opencode.ai/browse/install | bash -s -- --version 0.0.7
EOF
}

fail() {
    printf '%b\n' "${RED}browse: $*${NC}" >&2
    exit 1
}

# Compare hashes as hex: sha512sum, shasum and openssl print hex, while turning hex back into base64 would need xxd.
# base64_hex <base64>: decode to lowercase hex, or print nothing when <base64> is not base64. GNU and busybox base64 use
# -d; macOS uses -D.
base64_hex() {
    encoded=$1
    # Check the alphabet first: malformed integrity is reported as such, not as a missing base64 tool.
    case "$encoded" in *=) encoded=${encoded%=} ;; esac
    case "$encoded" in *=) encoded=${encoded%=} ;; esac
    case "$encoded" in
        "" | *[!A-Za-z0-9+/]*) return 0 ;;
    esac
    # Probe the flag with a known-valid value: malformed input can't tell a bad flag from bad data.
    if printf 'Zg==' | base64 -d >/dev/null 2>&1; then
        printf '%s' "$1" | base64 -d 2>/dev/null | od -A n -v -t x1 | tr -d ' \t\r\n'
    elif printf 'Zg==' | base64 -D >/dev/null 2>&1; then
        printf '%s' "$1" | base64 -D 2>/dev/null | od -A n -v -t x1 | tr -d ' \t\r\n'
    elif command -v openssl >/dev/null 2>&1; then
        printf '%s' "$1" | openssl base64 -d -A 2>/dev/null | od -A n -v -t x1 | tr -d ' \t\r\n'
    else
        fail "base64 or openssl is required to verify $package@$specific_version; nothing was installed"
    fi
}

# field <key> <json>: the first value of <key> in <json>.
field() {
    case "$2" in
        *"\"$1\":"*) printf '%s' "${2#*\""$1"\":}" | sed -e 's/^"//' -e 's/[",}].*//' ;;
    esac
}

requested_version=${VERSION:-}
version_option=false
channel=stable
no_setup=false
binary_path=""
# Consume the installer's options, rotating setup arguments to the end without splitting or evaluating them.
remaining=$#
while [ "$remaining" -gt 0 ]; do
    remaining=$((remaining - 1))
    case "$1" in
        -h|--help)
            usage
            exit 0
            ;;
        -v|--version)
            if [ "$remaining" -gt 0 ]; then
                requested_version="$2"
                version_option=true
                remaining=$((remaining - 1))
                shift 2
            else
                printf '%b\n' "${RED}Error: --version requires a version argument${NC}"
                exit 1
            fi
            ;;
        --channel)
            if [ "$remaining" -gt 0 ] && [ -n "${2:-}" ]; then
                channel="$2"
                remaining=$((remaining - 1))
                shift 2
            else
                printf '%b\n' "${RED}Error: --channel requires a tag${NC}"
                exit 1
            fi
            ;;
        -b|--binary)
            if [ "$remaining" -gt 0 ] && [ -n "${2:-}" ]; then
                binary_path="$2"
                remaining=$((remaining - 1))
                shift 2
            else
                printf '%b\n' "${RED}Error: --binary requires a path argument${NC}"
                exit 1
            fi
            ;;
        --no-setup)
            no_setup=true
            shift
            ;;
        *)
            set -- "$@" "$1"
            shift
            ;;
    esac
done

# `latest` was the npm tag and is now an alias for the release service's stable channel.
case "$channel" in
    latest) channel=stable ;;
    stable | beta | dev) ;;
    *) fail "unknown channel $channel (stable, beta or dev)" ;;
esac

# A bare `--version v` (or VERSION=v) would otherwise fall through to the channel install with no version.
if [ -z "${requested_version#v}" ] && { [ -n "$requested_version" ] || [ "$version_option" = "true" ]; }; then
    fail "--version needs a version, e.g. 0.0.14"
fi
requested_version="${requested_version#v}"

INSTALL_DIR=${XDG_BIN_HOME:-$HOME/.local/bin}
# XDG paths must be absolute; a relative one would put browse in the current directory.
case "$INSTALL_DIR" in
    /*) ;;
    *) INSTALL_DIR=$HOME/.local/bin ;;
esac
mkdir -p "$INSTALL_DIR"

raw_os=$(uname -s)
os=$(echo "$raw_os" | tr '[:upper:]' '[:lower:]')
case "$raw_os" in
  Darwin*) os="darwin" ;;
  Linux*) os="linux" ;;
  MINGW*|MSYS*|CYGWIN*) os="windows" ;;
esac
installed_binary="$APP"
if [ "$os" = "windows" ]; then
    installed_binary="$APP.exe"
fi

if [ -n "$binary_path" ]; then
    if [ ! -f "$binary_path" ]; then
        printf '%b\n' "${RED}Error: Binary not found at ${binary_path}${NC}"
        exit 1
    fi
    specific_version="local"
else
    arch=$(uname -m)
    if [ "$arch" = "aarch64" ]; then
      arch="arm64"
    fi
    if [ "$arch" = "x86_64" ]; then
      arch="x64"
    fi

    if [ "$os" = "darwin" ] && [ "$arch" = "x64" ]; then
      rosetta_flag=$(sysctl -n sysctl.proc_translated 2>/dev/null || echo 0)
      if [ "$rosetta_flag" = "1" ]; then
        arch="arm64"
      fi
    fi

    # Git Bash and MSYS2 run as emulated x64 on Windows ARM64, so `uname -m` reports x86_64.
    # The host CPU still shows in the `uname -s` suffix and in PROCESSOR_IDENTIFIER.
    if [ "$os" = "windows" ] && [ "$arch" = "x64" ]; then
      case "$raw_os:${PROCESSOR_IDENTIFIER:-}" in *-ARM64:*|*:ARM*) arch="arm64" ;; esac
    fi

    combo="$os-$arch"
    case "$combo" in
      linux-x64|linux-arm64|darwin-x64|darwin-arm64|windows-x64|windows-arm64)
        ;;
      *)
        printf '%b\n' "${RED}Unsupported OS/Arch: $os/$arch${NC}"
        exit 1
        ;;
    esac

    is_musl=false
    if [ "$os" = "linux" ]; then
      if [ -f /etc/alpine-release ]; then
        is_musl=true
      fi

      if command -v ldd >/dev/null 2>&1; then
        if ldd --version 2>&1 | grep -qi musl; then
          is_musl=true
        fi
      fi
    fi

    needs_baseline=false
    if [ "$arch" = "x64" ]; then
      if [ "$os" = "linux" ]; then
        if ! grep -qwi avx2 /proc/cpuinfo 2>/dev/null; then
          needs_baseline=true
        fi
      fi

      if [ "$os" = "darwin" ]; then
        avx2=$(sysctl -n hw.optional.avx2_0 2>/dev/null || echo 0)
        if [ "$avx2" != "1" ]; then
          needs_baseline=true
        fi
      fi

      if [ "$os" = "windows" ]; then
        ps="(Add-Type -MemberDefinition \"[DllImport(\"\"kernel32.dll\"\")] public static extern bool IsProcessorFeaturePresent(int ProcessorFeature);\" -Name Kernel32 -Namespace Win32 -PassThru)::IsProcessorFeaturePresent(40)"
        out=""
        if command -v powershell.exe >/dev/null 2>&1; then
          out=$(powershell.exe -NoProfile -NonInteractive -Command "$ps" 2>/dev/null || true)
        elif command -v pwsh >/dev/null 2>&1; then
          out=$(pwsh -NoProfile -NonInteractive -Command "$ps" 2>/dev/null || true)
        fi
        out=$(echo "$out" | tr -d '\r' | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
        if [ "$out" != "true" ] && [ "$out" != "1" ]; then
          needs_baseline=true
        fi
      fi
    fi

    # Windows ARM64 runs the x64 build.
    if [ "$os" = "windows" ] && [ "$arch" = "arm64" ]; then
      arch="x64"
    fi

    target="$os-$arch"
    if [ "$needs_baseline" = "true" ]; then
      target="$target-baseline"
    fi
    if [ "$is_musl" = "true" ]; then
      target="$target-musl"
    fi

    if ! command -v tar >/dev/null 2>&1; then
        printf '%b\n' "${RED}Error: 'tar' is required but not installed.${NC}"
        exit 1
    fi

    package="@opencode/browse-$target"
    encoded="@opencode%2fbrowse-$target"
    # A pinned version comes from npm: the release service has one current release per channel and no version lookup.
    if [ -n "$requested_version" ]; then
        specific_version=$requested_version
        tmp_dir="${TMPDIR:-/tmp}/browse_install_$$"
        mkdir -p "$tmp_dir"
        # The pinned flow owns this directory until it execs `browse install` below, which a trap can't cross. Remove it
        # on every other exit, including failures inside command substitutions and failed metadata reads. tmp_dir is set
        # before the trap, so it can only ever remove this run's directory.
        trap 'rm -rf "$tmp_dir"' EXIT
        trap 'exit 130' INT
        trap 'exit 143' TERM
        trap 'exit 129' HUP
        metadata_file="$tmp_dir/npm-metadata.json"
        # Keep the version metadata: its dist.integrity is the tarball's SHA-512. Without whitespace, every field this
        # needs is a plain "key":value pair (URLs, hashes and versions have no spaces).
        http_status=$(curl -s -o "$metadata_file" -w "%{http_code}" "https://registry.npmjs.org/$encoded/$specific_version" || true)
        if [ "$http_status" = "404" ]; then
            rm -rf "$tmp_dir"
            printf '%b\n' "${RED}Error: browse ${specific_version} is not available for $target${NC}"
            printf '%b\n' "${MUTED}Available versions: https://www.npmjs.com/package/$package?activeTab=versions${NC}"
            exit 1
        fi
        if [ "$http_status" != "200" ]; then
            rm -rf "$tmp_dir"
            printf '%b\n' "${RED}Failed to fetch package information${NC}"
            exit 1
        fi
        metadata=$(tr -d ' \t\r\n' <"$metadata_file")
        case "$metadata" in
            *'"dist":{'*) ;;
            *) rm -rf "$tmp_dir"; fail "$package@$specific_version has no dist metadata; nothing was installed" ;;
        esac
        dist_json="${metadata#*\"dist\":\{}"
        integrity=$(field integrity "$dist_json")
        case "$integrity" in
            sha512-*) ;;
            *) rm -rf "$tmp_dir"; fail "$package@$specific_version has no published SHA-512 integrity; nothing was installed" ;;
        esac
        expected_sha512=$(base64_hex "${integrity#sha512-}")
        if [ -z "$expected_sha512" ]; then
            rm -rf "$tmp_dir"
            fail "$package@$specific_version has an invalid SHA-512 integrity; nothing was installed"
        fi
        case "$expected_sha512" in
            *[!0123456789abcdef]*)
                rm -rf "$tmp_dir"
                fail "$package@$specific_version has an invalid SHA-512 integrity; nothing was installed"
                ;;
        esac
        if [ "${#expected_sha512}" -ne 128 ]; then
            rm -rf "$tmp_dir"
            fail "$package@$specific_version has an invalid SHA-512 integrity; nothing was installed"
        fi
        filename="browse-$target-$specific_version.tgz"
        url="https://registry.npmjs.org/$package/-/$filename"
    fi
fi

print_message() (
    level=$1
    message=$2
    color=""

    case $level in
        info) color="${NC}" ;;
        warning) color="${NC}" ;;
        error) color="${RED}" ;;
    esac

    printf '%b\n' "${color}${message}${NC}"
)

sha256_file() {
    if command -v sha256sum >/dev/null 2>&1; then
        sha256sum "$1" | cut -d ' ' -f 1
    elif command -v shasum >/dev/null 2>&1; then
        shasum -a 256 "$1" | cut -d ' ' -f 1
    else
        fail "sha256sum or shasum is required to verify the download"
    fi
}

sha512_file() {
    if command -v sha512sum >/dev/null 2>&1; then
        sha512sum <"$1" | cut -d ' ' -f 1
    elif command -v shasum >/dev/null 2>&1; then
        shasum -a 512 <"$1" | cut -d ' ' -f 1
    elif command -v openssl >/dev/null 2>&1; then
        # openssl's stdin form is `(stdin)= <hex>` or `SHA2-512(stdin)= <hex>`.
        openssl dgst -sha512 <"$1" | sed 's/^.*= *//'
    else
        fail "sha512sum, shasum or openssl is required to verify $package@$specific_version; nothing was installed"
    fi
}

# The release service's target name: npm says darwin, the service says macos.
service_target() {
    case "$1" in
        darwin-*) printf '%s' "macos-${1#darwin-}" ;;
        *) printf '%s' "$1" ;;
    esac
}

download_npm() (
    print_message info "\n${MUTED}Installing ${NC}browse ${MUTED}version: ${NC}$specific_version"

    for delay in 0 15 30 60 75; do
        if [ "$delay" != 0 ]; then
            print_message warning "The $specific_version tarball isn't available yet; retrying in ${delay}s." >&2
            sleep "$delay"
        fi
        ret=0
        http_status=$(curl -f -# -L -w '%{http_code}' -o "$tmp_dir/$filename" "$url") || ret=$?
        { [ "$ret" = 22 ] && [ "$http_status" = 404 ]; } || break
    done
    # A pin must never silently install another version. Only fall back within the requested release channel.
    if [ "$ret" = 22 ] && [ "$http_status" = 404 ] && [ -z "$requested_version" ] && { [ "$channel" = latest ] || [ "$channel" = dev ]; }; then
        pattern='[0-9]+\.[0-9]+\.[0-9]+'
        if [ "$channel" = dev ]; then pattern="${pattern}"'-dev\.[0-9]+(\.[0-9]+)?'; fi
        # The platform manifests contain only browse versions. Sort numeric components (including dev run/rerun).
        curl -fsSL -H 'Accept: application/vnd.npm.install-v1+json' "https://registry.npmjs.org/$encoded" -o "$tmp_dir/versions.json"
        previous=$(tr ',' '\n' <"$tmp_dir/versions.json" |
            sed -nE "s/.*\"version\":[[:space:]]*\"($pattern)\".*/\\1/p" |
            LC_ALL=C sort -u -t . -k1,1nr -k2,2nr -k3,3nr -k4,4nr -k5,5nr |
            awk -v current="$specific_version" 'prev == current {print} {prev=$0}')
        if [ -n "$previous" ]; then
            print_message warning "browse $specific_version is still unavailable; falling back to $previous ($channel)." >&2
            ret=0
            curl -f -# -L -o "$tmp_dir/$filename" "${url%/*}/browse-$target-$previous.tgz" || ret=$?
        fi
    fi
    # curl exits 23 when it cannot write the file, usually because the temporary directory is full.
    if [ "$ret" -eq 23 ]; then
        print_message error "Could not write the download to $tmp_dir. Make sure it has enough free space, or set TMPDIR to another directory, then try again." >&2
    fi
    if [ "$ret" -ne 0 ]; then
        rm -rf "$tmp_dir"
        exit "$ret"
    fi

    actual_sha512=$(sha512_file "$tmp_dir/$filename")
    if [ "$actual_sha512" != "$expected_sha512" ]; then
        rm -rf "$tmp_dir"
        fail "checksum mismatch for $package@$specific_version ($filename): expected $expected_sha512, got $actual_sha512; nothing was installed"
    fi

    tar -xzf "$tmp_dir/$filename" -C "$tmp_dir"
    test -f "$tmp_dir/package/bin/$installed_binary" || fail "$filename has no package/bin/$installed_binary"
    # Replace by rename, so a relay still running the old binary keeps its file.
    mv "$tmp_dir/package/bin/$installed_binary" "$INSTALL_DIR/$installed_binary.new"
    chmod 755 "$INSTALL_DIR/$installed_binary.new"
    mv -f "$INSTALL_DIR/$installed_binary.new" "$INSTALL_DIR/$installed_binary"
    rm -rf "$tmp_dir"
)

# The channel's current release from the Anomaly release service (https://anoma.ly/release, anomalyco/release
# docs/protocol.md). The manifest names the file for this target; its size and SHA-256 must match before it is used.
download_release() (
    service="${OPENCODE_BROWSER_RELEASE_SERVICE:-https://anoma.ly/release}"
    service="${service%/}"
    case "$service" in
        */release) origin="${service%/release}" ;;
        *) fail "OPENCODE_BROWSER_RELEASE_SERVICE must end in /release, not $service" ;;
    esac
    service_target_name=$(service_target "$target")
    tmp_dir="${TMPDIR:-/tmp}/browse_install_$$"
    mkdir -p "$tmp_dir"

    # The version isn't known before the manifest, so the manifest request names the tool instead.
    curl -fsSL -A "browse/$channel/install" -o "$tmp_dir/manifest.json" "$service/browse/cli/$channel.json" ||
        fail "no $channel release at $service/browse/cli/$channel.json"
    # The manifest is JSON; without whitespace, every field this needs is a plain "key":value pair (URLs, hashes and
    # versions have no spaces).
    manifest=$(tr -d ' \t\r\n' <"$tmp_dir/manifest.json")
    if [ "$(field app "$manifest")" != browse ] || [ "$(field artifact "$manifest")" != cli ] ||
        [ "$(field channel "$manifest")" != "$channel" ]; then
        fail "$service/browse/cli/$channel.json is not browse's $channel CLI manifest"
    fi
    release_json="${manifest#*\"release\":}"
    specific_version=$(field version "$release_json")
    [ -n "$specific_version" ] || fail "the $channel release has no version"
    targets="${release_json#*\"targets\":}"
    target_json="${targets#*\""$service_target_name"\":\{}"
    [ "$target_json" != "$targets" ] || fail "the $channel release has no $service_target_name build"
    target_json="${target_json%%\}*}"
    url=$(field url "$target_json")
    expected_sha=$(field sha256 "$target_json")
    expected_size=$(field size "$target_json")
    case "$url" in
        /*) url="$origin$url" ;;
        *) fail "unexpected download URL $url" ;;
    esac
    filename="${url##*/}"

    print_message info "\n${MUTED}Installing ${NC}browse ${MUTED}version: ${NC}$specific_version ${MUTED}($channel)${NC}"
    curl -f -# -L -A "browse/$channel/$specific_version/cli" -o "$tmp_dir/$filename" "$url" || exit $?
    actual_sha=$(sha256_file "$tmp_dir/$filename")
    if [ -z "$expected_sha" ] || [ "$expected_sha" != "$actual_sha" ]; then
        fail "checksum mismatch for $filename (expected ${expected_sha:-none}, got $actual_sha)"
    fi
    actual_size=$(wc -c <"$tmp_dir/$filename" | tr -d ' ')
    if [ -n "$expected_size" ] && [ "$expected_size" != "$actual_size" ]; then
        fail "size mismatch for $filename (expected $expected_size, got $actual_size)"
    fi

    tar -xzf "$tmp_dir/$filename" -C "$tmp_dir"
    test -f "$tmp_dir/package/bin/$installed_binary" || fail "$filename has no package/bin/$installed_binary"
    # Replace by rename, so a relay still running the old binary keeps its file.
    mv "$tmp_dir/package/bin/$installed_binary" "$INSTALL_DIR/$installed_binary.new"
    chmod 755 "$INSTALL_DIR/$installed_binary.new"
    mv -f "$INSTALL_DIR/$installed_binary.new" "$INSTALL_DIR/$installed_binary"
    rm -rf "$tmp_dir"
)

install_from_binary() {
    print_message info "\n${MUTED}Installing ${NC}browse ${MUTED}from: ${NC}$binary_path"
    cp "$binary_path" "$INSTALL_DIR/$installed_binary.new"
    chmod 755 "$INSTALL_DIR/$installed_binary.new"
    mv -f "$INSTALL_DIR/$installed_binary.new" "$INSTALL_DIR/$installed_binary"
}

if [ -n "$binary_path" ]; then
    install_from_binary
elif [ -n "$requested_version" ]; then
    download_npm
else
    download_release
fi

if [ "$no_setup" = "true" ]; then
    print_message info "\n${MUTED}Run ${NC}$INSTALL_DIR/$installed_binary install ${MUTED}to add browse to your agents and pair it with your browser.${NC}"
    exit 0
fi

echo ""
# `curl | sh` feeds this script through stdin, so give `browse install` the terminal for its agent picker. An agent
# running this has no terminal: install then sets up the agent that ran it.
if [ -t 1 ] && { : </dev/tty; } 2>/dev/null; then
    # Bun on macOS can poll the pty slave, but not the /dev/tty alias.
    { tty_path=$(tty <&3 2>/dev/null) || tty_path=/dev/tty; } 3<&1
    exec "$INSTALL_DIR/$installed_binary" install "$@" <"$tty_path"
fi
exec "$INSTALL_DIR/$installed_binary" install "$@"