install.sh

#!/usr/bin/env bash
set -euo pipefail

STACK_VERSION="0.1.0"
REPO_URL="${HERMES_MEMORY_STACK_REPO:-https://github.com/yelixir-dev/hermes-memory-stack}"
RAW_TARBALL_URL="${HERMES_MEMORY_STACK_TARBALL:-https://github.com/yelixir-dev/hermes-memory-stack/archive/refs/heads/main.tar.gz}"
NOTEBOOKLM_SOURCE_PACK_BUILDER_GIT_URL="${NOTEBOOKLM_SOURCE_PACK_BUILDER_GIT_URL:-https://github.com/yelixir-dev/notebooklm-source-pack-builder.git}"
NOTEBOOKLM_SOURCE_PACK_BUILDER_REF="${NOTEBOOKLM_SOURCE_PACK_BUILDER_REF:-main}"
HERMES_HOME="${HERMES_HOME:-$HOME/.hermes}"
CONFIG_FILE="$HERMES_HOME/config.yaml"
ENV_FILE="$HERMES_HOME/.env"
SCRIPT_SOURCE="${BASH_SOURCE[0]:-$0}"
SCRIPT_DIR="$(cd "$(dirname "$SCRIPT_SOURCE")" 2>/dev/null && pwd || pwd)"
PAYLOAD_TMP=""
INPUT_FD=0
NONINTERACTIVE=0

# Keep installer output plain ASCII. Some minimal terminals render ANSI escape
# sequences literally, which looks broken in one-command installs.
BOLD=''; GREEN=''; YELLOW=''; RED=''; NC=''

log() { printf '%s\n' "==> $*"; }
warn() { printf '%s\n' "WARN: $*"; }
fail() { printf '%s\n' "ERROR: $*" >&2; exit 1; }
need_cmd() { command -v "$1" >/dev/null 2>&1; }

is_env_name() {
  [[ "$1" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]
}

ask_env_name() {
  local __var="$1" prompt="$2" default="$3" reply
  while true; do
    prompt_read reply "$prompt [$default]: "
    reply="${reply:-$default}"
    if is_env_name "$reply"; then
      printf -v "$__var" '%s' "$reply"
      return 0
    fi
    warn "Use a valid environment variable name: letters, numbers, and underscores; not starting with a number."
  done
}

cleanup() {
  [[ -n "$PAYLOAD_TMP" && -d "$PAYLOAD_TMP" ]] && rm -rf "$PAYLOAD_TMP"
  return 0
}
trap cleanup EXIT

setup_input() {
  if [[ -t 0 ]]; then
    INPUT_FD=0
  elif [[ -e /dev/tty ]] && { exec 3</dev/tty; } 2>/dev/null; then
    INPUT_FD=3
  else
    NONINTERACTIVE=1
    warn "No interactive terminal detected; using default choices. For the wizard, run from an interactive terminal."
  fi
}

prompt_read() {
  local __var="$1" prompt="$2" value=""
  if [[ "$NONINTERACTIVE" == "1" ]]; then
    printf -v "$__var" '%s' ""
    return 0
  fi
  if [[ "$INPUT_FD" == "0" ]]; then
    read -r -p "$prompt" value || true
  else
    printf '%s' "$prompt" > /dev/tty
    IFS= read -r -u "$INPUT_FD" value || true
  fi
  printf -v "$__var" '%s' "$value"
}

ensure_payload() {
  if [[ -d "$SCRIPT_DIR/skills" && -f "$SCRIPT_DIR/scripts/patch-config.py" ]]; then
    return 0
  fi
  log "Fetching installer payload from $REPO_URL"
  need_cmd curl || fail "curl is required for one-command install. Use git clone mode instead."
  need_cmd tar || fail "tar is required for one-command install. Use git clone mode instead."
  PAYLOAD_TMP="$(mktemp -d)"
  curl -fsSL "$RAW_TARBALL_URL" | tar -xz -C "$PAYLOAD_TMP"
  SCRIPT_DIR="$(find "$PAYLOAD_TMP" -maxdepth 1 -type d -name 'hermes-memory-stack-*' | head -1)"
  [[ -n "$SCRIPT_DIR" && -d "$SCRIPT_DIR/skills" ]] || fail "Could not locate installer payload after download."
}

ask_yn() {
  local prompt="$1" default="${2:-y}" reply suffix="[Y/n]"
  [[ "$default" == "n" ]] && suffix="[y/N]"
  prompt_read reply "$prompt $suffix "
  reply="${reply:-$default}"
  [[ "$reply" =~ ^[Yy]$ ]]
}

ask_choice() {
  local prompt="$1" max="$2" default="$3" reply
  while true; do
    prompt_read reply "$prompt [$default] "
    reply="${reply:-$default}"
    if [[ "$reply" =~ ^[0-9]+$ ]] && (( reply >= 1 && reply <= max )); then
      printf '%s' "$reply"
      return 0
    fi
    warn "Choose 1-$max."
  done
}

run_cli_with_user_input() {
  # Subcommands like `hermes mcp add` may ask their own follow-up questions.
  # Under `curl | bash`, child stdin is the piped script unless we explicitly
  # attach /dev/tty, which makes those prompts instantly cancel on EOF.
  if [[ "$NONINTERACTIVE" == "1" ]]; then
    printf '\n' | "$@"
  elif [[ -e /dev/tty ]]; then
    "$@" < /dev/tty
  else
    "$@"
  fi
}

append_env_if_missing() {
  local key="$1" value="${2:-}"
  is_env_name "$key" || { warn "Invalid env var name '$key'; skipping .env placeholder."; return 1; }
  mkdir -p "$(dirname "$ENV_FILE")"
  touch "$ENV_FILE"
  chmod 600 "$ENV_FILE" || true
  if ! awk -F= -v key="$key" '$1 == key { found=1 } END { exit found ? 0 : 1 }' "$ENV_FILE"; then
    printf '\n%s=%s\n' "$key" "$value" >> "$ENV_FILE"
  fi
}

banner() {
cat <<'BANNER'
Hermes Memory Stack Installer

Installs an optional, layered memory/input stack for Hermes Agent:
  - skills: reusable procedures and policy
  - Axiom Perception MCP: procedural/UI execution pattern cache
  - llmwiki: shared agent knowledge base, optional LLM/embedding modes
  - Hindsight config helpers: personal memory backend routing
  - semble_rs: optional code exploration/log digest CLI
  - NotebookLM: optional external source-grounded research workspace

No API keys, OAuth tokens, Google cookies, or personal memory are bundled.
BANNER
}

ensure_python_yaml() {
  if python3 - <<'PY' >/dev/null 2>&1
import yaml
PY
  then
    return 0
  fi
  warn "PyYAML is required for config patching but is not available for python3."
  if python3 -m pip --version >/dev/null 2>&1 && ask_yn "Install PyYAML with python3 -m pip install --user PyYAML?" n; then
    python3 -m pip install --user PyYAML || warn "PyYAML install failed; config patching may be skipped."
  else
    warn "Skipping PyYAML install. Config patching will be skipped unless PyYAML is installed manually."
  fi
}

check_prereqs() {
  log "Checking prerequisites"
  need_cmd hermes || fail "Hermes CLI not found. Install Hermes first: https://hermes-agent.nousresearch.com/docs"
  ensure_python_yaml
  mkdir -p "$HERMES_HOME"
  if [[ -f "$CONFIG_FILE" ]]; then
    local backup="$CONFIG_FILE.bak.$(date +%Y%m%d-%H%M%S)"
    cp "$CONFIG_FILE" "$backup"
    log "Backed up config: $backup"
  else
    warn "No config.yaml found at $CONFIG_FILE; Hermes may not be set up yet."
  fi
  touch "$ENV_FILE" && chmod 600 "$ENV_FILE" || true
}

install_skills() {
  log "Installing Hermes skills"
  local dest="$HERMES_HOME/skills"
  mkdir -p "$dest"
  local skill src target backup
  for src in "$SCRIPT_DIR/skills/"*; do
    [[ -d "$src" ]] || continue
    skill="$(basename "$src")"
    target="$dest/$skill"
    if [[ -e "$target" ]]; then
      backup="$target.bak.$(date +%Y%m%d-%H%M%S)"
      mv "$target" "$backup"
      log "Backed up existing skill: $backup"
    fi
    cp -R "$src" "$target"
    log "Installed skill: $target"
  done
}

configure_hindsight() {
  if python3 "$SCRIPT_DIR/scripts/patch-config.py" --detect-gpt-oauth >/dev/null 2>&1; then
    cat <<'EOF'

Detected default Hermes model/provider: GPT OAuth (openai-codex).
The installer can connect Hindsight local-embedded memory to the same current GPT OAuth bearer token.
This copies the local OAuth access token into ~/.hermes/.env and the Hindsight embedded-daemon env file.
No token is committed or bundled; rerun this step after re-authentication if the token expires.
EOF
    if ask_yn "Use the existing GPT OAuth connection for Hindsight LLM calls?" n; then
      python3 "$SCRIPT_DIR/scripts/patch-config.py" --hindsight-mode gpt-oauth-reuse --hindsight-auth-json "$HERMES_HOME/auth.json" || warn "GPT OAuth reuse patch skipped."
      return 0
    fi
  fi

  cat <<'EOF'

Hindsight / Hermes memory routing
  [1] Keep existing Hermes memory/Hindsight settings
  [2] Reuse an existing Hermes OAuth/provider/bridge where possible
  [3] Configure an OpenAI-compatible endpoint via env template
  [4] Skip memory routing changes
EOF
  local c; c=$(ask_choice "Choose Hindsight mode" 4 1); echo
  case "$c" in
    1|4) log "Leaving memory config unchanged." ;;
    2)
      warn "OAuth/provider reuse is provider-specific. If GPT OAuth is the default provider, rerun with its token available and accept the GPT OAuth reuse prompt."
      append_env_if_missing HINDSIGHT_LLM_API_KEY ""
      python3 "$SCRIPT_DIR/scripts/patch-config.py" --hindsight-mode oauth-reuse || warn "Config patch skipped."
      ;;
    3)
      prompt_read hs_url "OpenAI-compatible base URL (e.g. http://127.0.0.1:4000/v1): "
      prompt_read hs_model "Model for memory extraction/recall: "
      ask_env_name hs_key "Env var name for API key" "HINDSIGHT_LLM_API_KEY"
      append_env_if_missing "$hs_key" ""
      python3 "$SCRIPT_DIR/scripts/patch-config.py" --hindsight-mode openai-compatible --hindsight-base-url "$hs_url" --hindsight-model "$hs_model" --hindsight-key-env "$hs_key" || warn "Config patch skipped."
      ;;
  esac
}

install_llmwiki() {
  cat <<'EOF'

llmwiki mode
  [1] Skip llmwiki
  [2] API-free markdown/wiki mode only
  [3] External OpenAI-compatible extraction only
  [4] Local/OAuth bridge extraction only
  [5] Hybrid: extraction endpoint + embedding endpoint
EOF
  local c; c=$(ask_choice "Choose llmwiki mode" 5 1); echo
  [[ "$c" == "1" ]] && { warn "Skipping llmwiki."; return 0; }
  if need_cmd npm; then
    log "Installing llm-wiki-compiler with npm"
    npm install -g llm-wiki-compiler || warn "npm global install failed. Install llmwiki manually."
  else
    warn "npm not found; llmwiki CLI install skipped."
  fi
  case "$c" in
    2) log "Selected API-free llmwiki mode." ;;
    3|4|5)
      prompt_read ex_url "Extraction base URL (OpenAI-compatible, optional): "
      prompt_read ex_model "Extraction model (optional): "
      ask_env_name ex_key "Extraction API key env var" "LLMWIKI_API_KEY"
      append_env_if_missing "$ex_key" ""
      if [[ "$c" == "5" ]]; then
        prompt_read emb_url "Embedding base URL (OpenAI-compatible): "
        prompt_read emb_model "Embedding model: "
        ask_env_name emb_key "Embedding API key env var" "LLMWIKI_EMBEDDINGS_API_KEY"
        append_env_if_missing "$emb_key" ""
        python3 "$SCRIPT_DIR/scripts/write-llmwiki-env-shim.py" --extraction-url "$ex_url" --extraction-model "$ex_model" --extraction-key-env "$ex_key" --embedding-url "$emb_url" --embedding-model "$emb_model" --embedding-key-env "$emb_key" || warn "llmwiki shim creation skipped."
      else
        python3 "$SCRIPT_DIR/scripts/write-llmwiki-env-shim.py" --extraction-url "$ex_url" --extraction-model "$ex_model" --extraction-key-env "$ex_key" || warn "llmwiki shim creation skipped."
      fi
      ;;
  esac
}

install_axiom() {
  if ! ask_yn "Install/register Axiom Perception MCP?" y; then warn "Skipping Axiom."; return 0; fi
  if ! need_cmd uvx; then
    warn "uvx not found; skipping Axiom MCP registration. Install uv first, then run: hermes mcp add perception --command uvx --args axiom-perception-mcp"
    return 0
  fi
  if hermes mcp list 2>/dev/null | grep -qi "perception"; then
    log "MCP server 'perception' already appears configured."
  else
    run_cli_with_user_input hermes mcp add perception --command uvx --args axiom-perception-mcp || warn "Automatic MCP add failed. Add manually: hermes mcp add perception --command uvx --args axiom-perception-mcp"
  fi
}

install_semble() {
  if ! ask_yn "Install optional semble_rs code search/log digest CLI?" n; then warn "Skipping semble_rs."; return 0; fi
  if ! need_cmd cargo; then warn "cargo not found. Install Rust via rustup first: https://rustup.rs/"; return 0; fi
  cargo install --git https://github.com/johunsang/semble_rs --locked --force || warn "semble_rs install failed."
  mkdir -p "$HOME/.local/bin"
  ln -sf "$HOME/.cargo/bin/semble_rs" "$HOME/.local/bin/semble_rs" || true
}

install_notebooklm_inventory_sync() {
  if ! command -v notebooklm >/dev/null 2>&1; then
    warn "NotebookLM CLI not available; inventory sync skipped."
    return 0
  fi
  if ! ask_yn "Set up optional NotebookLM → llmwiki inventory sync?" y; then
    warn "Skipping NotebookLM inventory sync."
    return 0
  fi
  mkdir -p "$HERMES_HOME/scripts"
  cp "$SCRIPT_DIR/scripts/sync-notebooklm-inventory.py" "$HERMES_HOME/scripts/sync_notebooklm_inventory.py"
  cp "$SCRIPT_DIR/scripts/install-notebooklm-inventory-sync.sh" "$HERMES_HOME/scripts/install_notebooklm_inventory_sync.sh"
  chmod +x "$HERMES_HOME/scripts/sync_notebooklm_inventory.py" "$HERMES_HOME/scripts/install_notebooklm_inventory_sync.sh" || true

  if notebooklm auth check --test --json >/dev/null 2>&1; then
    "$HERMES_HOME/scripts/install_notebooklm_inventory_sync.sh" || warn "NotebookLM inventory cron setup skipped."
  else
    cat <<EOF
NotebookLM inventory sync helper installed but not activated yet.
After manual browser login, run:
  notebooklm login
  notebooklm auth check --test --json
  $HERMES_HOME/scripts/install_notebooklm_inventory_sync.sh
EOF
  fi
}

install_or_update_notebooklm_source_pack_builder() {
  if ! need_cmd uv; then
    warn "uv not found; cannot install/update NotebookLM Source Pack Builder from GitHub. Install uv first: https://docs.astral.sh/uv/"
    return 1
  fi

  local sha_file="$HERMES_HOME/notebooklm-source-packs/source-pack-builder.${NOTEBOOKLM_SOURCE_PACK_BUILDER_REF}.sha"
  local remote_sha="" current_sha=""
  mkdir -p "$(dirname "$sha_file")"

  if need_cmd git; then
    remote_sha="$(git ls-remote "$NOTEBOOKLM_SOURCE_PACK_BUILDER_GIT_URL" "refs/heads/$NOTEBOOKLM_SOURCE_PACK_BUILDER_REF" 2>/dev/null | awk '{print $1}' | head -1 || true)"
  fi
  [[ -f "$sha_file" ]] && current_sha="$(tr -d '[:space:]' < "$sha_file" || true)"

  if need_cmd nlm-pack && [[ -n "$remote_sha" && "$remote_sha" == "$current_sha" ]]; then
    log "NotebookLM Source Pack Builder is already up to date from GitHub ($NOTEBOOKLM_SOURCE_PACK_BUILDER_REF ${remote_sha:0:12})."
    return 0
  fi

  if need_cmd nlm-pack && [[ -z "$remote_sha" ]]; then
    warn "Could not check GitHub for Source Pack Builder updates; keeping existing nlm-pack."
    return 0
  fi

  log "Installing/updating NotebookLM Source Pack Builder from GitHub: $NOTEBOOKLM_SOURCE_PACK_BUILDER_GIT_URL@$NOTEBOOKLM_SOURCE_PACK_BUILDER_REF"
  uv tool install "git+$NOTEBOOKLM_SOURCE_PACK_BUILDER_GIT_URL@$NOTEBOOKLM_SOURCE_PACK_BUILDER_REF" --force || {
    warn "Source Pack Builder GitHub install/update failed."
    return 1
  }
  [[ -n "$remote_sha" ]] && printf '%s\n' "$remote_sha" > "$sha_file"
}

install_notebooklm_source_pack_sync() {
  if ! command -v notebooklm >/dev/null 2>&1; then
    warn "NotebookLM CLI not available; source-pack helper skipped."
    return 0
  fi
  cat <<'EOF'

NotebookLM source-pack automation is a second-level opt-in path.
It depends on the independent Source Pack Builder CLI (`nlm-pack`) and is only for public docs/source roots by default.
EOF
  if ! ask_yn "Install optional NotebookLM source-pack helper?" n; then
    warn "Skipping NotebookLM source-pack helper."
    return 0
  fi

  mkdir -p "$HERMES_HOME/scripts" "$HERMES_HOME/notebooklm-source-packs/examples"
  cp "$SCRIPT_DIR/scripts/install-notebooklm-source-pack-sync.sh" "$HERMES_HOME/scripts/install_notebooklm_source_pack_sync.sh"
  cp "$SCRIPT_DIR/config/notebooklm-source-pack.example.yaml" "$HERMES_HOME/notebooklm-source-packs/examples/notebooklm-source-pack.example.yaml"
  chmod +x "$HERMES_HOME/scripts/install_notebooklm_source_pack_sync.sh" || true

  if ! install_or_update_notebooklm_source_pack_builder; then
    cat <<EOF
NotebookLM source-pack helper files were installed, but cron was not activated because the GitHub-based Source Pack Builder install/update did not complete.
Install/update the independent Source Pack Builder from GitHub first, then copy and edit the example config:
  uv tool install "git+$NOTEBOOKLM_SOURCE_PACK_BUILDER_GIT_URL@$NOTEBOOKLM_SOURCE_PACK_BUILDER_REF" --force
  mkdir -p ~/.notebooklm-source-packs/hermes-agent-docs
  cp $HERMES_HOME/notebooklm-source-packs/examples/notebooklm-source-pack.example.yaml ~/.notebooklm-source-packs/hermes-agent-docs/config.yaml
  # edit notebooklm.notebook_id manually
Then run after NotebookLM auth succeeds:
  notebooklm login
  notebooklm auth check --test --json
  NOTEBOOKLM_SOURCE_PACK_NAME=hermes-agent-docs NOTEBOOKLM_SOURCE_PACK_CONFIG=~/.notebooklm-source-packs/hermes-agent-docs/config.yaml $HERMES_HOME/scripts/install_notebooklm_source_pack_sync.sh
EOF
    return 0
  fi

  if notebooklm auth check --test --json >/dev/null 2>&1; then
    cat <<EOF
NotebookLM source-pack helper installed but not activated automatically.
Copy and edit the example config first, including an explicit notebooklm.notebook_id, then run:
  mkdir -p ~/.notebooklm-source-packs/hermes-agent-docs
  cp $HERMES_HOME/notebooklm-source-packs/examples/notebooklm-source-pack.example.yaml ~/.notebooklm-source-packs/hermes-agent-docs/config.yaml
  # edit notebooklm.notebook_id manually
  notebooklm auth check --test --json
  NOTEBOOKLM_SOURCE_PACK_NAME=hermes-agent-docs NOTEBOOKLM_SOURCE_PACK_CONFIG=~/.notebooklm-source-packs/hermes-agent-docs/config.yaml $HERMES_HOME/scripts/install_notebooklm_source_pack_sync.sh
EOF
  else
    cat <<EOF
NotebookLM source-pack helper installed but not activated yet.
After manual browser login and source-pack config editing, run:
  notebooklm login
  notebooklm auth check --test --json
  mkdir -p ~/.notebooklm-source-packs/hermes-agent-docs
  cp $HERMES_HOME/notebooklm-source-packs/examples/notebooklm-source-pack.example.yaml ~/.notebooklm-source-packs/hermes-agent-docs/config.yaml
  # edit notebooklm.notebook_id manually
  NOTEBOOKLM_SOURCE_PACK_NAME=hermes-agent-docs NOTEBOOKLM_SOURCE_PACK_CONFIG=~/.notebooklm-source-packs/hermes-agent-docs/config.yaml $HERMES_HOME/scripts/install_notebooklm_source_pack_sync.sh
EOF
  fi
}

install_notebooklm() {
  cat <<'EOF'

NotebookLM integration is optional.
It requires a Google account and browser login, and uses Google's external service.
It is NOT required for this memory stack.
EOF
  if ! ask_yn "Install optional NotebookLM CLI support?" n; then warn "Skipping NotebookLM."; return 0; fi
  need_cmd uv || { warn "uv not found. Install uv first: https://docs.astral.sh/uv/"; return 0; }
  uv tool install 'notebooklm-py[cookies,browser]' --force || warn "notebooklm-py install failed."
  need_cmd uvx && uvx --from playwright playwright install chromium || true
  cat <<'EOF'

Manual NotebookLM login step:
  notebooklm login

After browser login, verify:
  notebooklm auth check --test --json
  notebooklm list --json
EOF
  install_notebooklm_inventory_sync
  install_notebooklm_source_pack_sync
}

configure_auxiliary() {
  if ! ask_yn "Configure Hermes auxiliary routing template?" n; then warn "Skipping auxiliary routing changes."; return 0; fi
  cat <<'EOF'
Auxiliary routing mode:
  [1] Keep existing
  [2] Use named custom provider for helper tasks
EOF
  local c; c=$(ask_choice "Choose auxiliary mode" 2 1); echo
  [[ "$c" == "1" ]] && return 0
  prompt_read aux_provider "Custom provider reference (e.g. custom:My LiteLLM): "
  prompt_read aux_model "Fast/cheap model for helper tasks: "
  python3 "$SCRIPT_DIR/scripts/patch-config.py" --aux-provider "$aux_provider" --aux-model "$aux_model" || warn "Auxiliary patch skipped."
}

smoke_test() {
  log "Running smoke tests"
  hermes config check || warn "hermes config check reported issues."
  hermes mcp list 2>/dev/null || true
  command -v llmwiki >/dev/null 2>&1 && llmwiki --help >/dev/null 2>&1 || true
  command -v semble_rs >/dev/null 2>&1 && semble_rs --help >/dev/null 2>&1 || true
  command -v notebooklm >/dev/null 2>&1 && notebooklm --version || true
}

main() {
  banner
  setup_input
  ensure_payload
  check_prereqs
  install_skills
  configure_hindsight
  install_llmwiki
  install_axiom
  install_semble
  install_notebooklm
  configure_auxiliary
  smoke_test
  cat <<EOF

${BOLD}Done.${NC}

Next steps:
  1. Fill any blank API keys in: $ENV_FILE
  2. If NotebookLM was installed, run: notebooklm login
  3. If NotebookLM inventory sync was selected after login, run: $HERMES_HOME/scripts/install_notebooklm_inventory_sync.sh
  4. If NotebookLM source-pack helper was selected, install/configure nlm-pack, edit the example config, then run: $HERMES_HOME/scripts/install_notebooklm_source_pack_sync.sh
  5. Restart Hermes/gateway if config changed: hermes gateway restart
  6. In a new Hermes session, load: /skill hermes-memory-stack

EOF
}
main "$@"