#!/usr/bin/env bash
# install-hooks.sh -- Installs AI Governance hooks into a Claude Code project
# Usage: ./install-hooks.sh [--profile minimal|standard|strict] [--project-dir /path]
#
# This is the entry point for hook installation. It:
# 1. Copies hook scripts to .claude/hooks/ (or project-specific location)
# 2. Registers hooks in settings.json
# 3. Creates governance config files
# 4. Makes all hooks executable
#
# Part of @connexum/ai-governance

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROFILE="${CXNI_HOOK_PROFILE:-standard}"
PROJECT_DIR="${1:-.}"
SETTINGS_FILE=""

# Parse arguments
while [[ $# -gt 0 ]]; do
  case "$1" in
    --profile) PROFILE="$2"; shift 2 ;;
    --project-dir) PROJECT_DIR="$2"; shift 2 ;;
    *) shift ;;
  esac
done

# Validate profile
case "$PROFILE" in
  minimal|standard|strict) ;;
  *)
    echo "Error: Invalid profile '$PROFILE'. Use: minimal, standard, strict" >&2
    exit 1
    ;;
esac

echo "Installing AI Governance hooks..."
echo "  Profile: $PROFILE"
echo "  Project: $PROJECT_DIR"

# Create directories
HOOKS_DIR="$PROJECT_DIR/.claude/hooks"
GOV_DIR="$PROJECT_DIR/.claude/governance"
AUDIT_DIR="$GOV_DIR/audit"
mkdir -p "$HOOKS_DIR" "$GOV_DIR" "$AUDIT_DIR" "$GOV_DIR/token-tracking" "$GOV_DIR/file-changes"

# Define hooks by profile
# Minimal: only critical security hooks
# Standard: security + audit (recommended)
# Strict: everything including budget gates and file boundaries

PRETOOL_HOOKS_MINIMAL=(
  "governance-file-shield.sh"
  "secret-leak-scanner.sh"
  "destructive-command-guard.sh"
)

PRETOOL_HOOKS_STANDARD=(
  "${PRETOOL_HOOKS_MINIMAL[@]}"
  "web-access-gate.sh"
)

PRETOOL_HOOKS_STRICT=(
  "${PRETOOL_HOOKS_STANDARD[@]}"
  "file-boundary-guard.sh"
  "cost-budget-gate.sh"
)

POSTTOOL_HOOKS_MINIMAL=()

POSTTOOL_HOOKS_STANDARD=(
  "audit-logger.sh"
)

POSTTOOL_HOOKS_STRICT=(
  "audit-logger.sh"
  "token-tracker.sh"
  "file-change-tracker.sh"
)

SESSION_HOOKS=(
  "governance-integrity-check.sh"
)

# Select hooks based on profile
case "$PROFILE" in
  minimal)
    PRETOOL_HOOKS=("${PRETOOL_HOOKS_MINIMAL[@]}")
    POSTTOOL_HOOKS=("${POSTTOOL_HOOKS_MINIMAL[@]+"${POSTTOOL_HOOKS_MINIMAL[@]}"}")
    ;;
  standard)
    PRETOOL_HOOKS=("${PRETOOL_HOOKS_STANDARD[@]}")
    POSTTOOL_HOOKS=("${POSTTOOL_HOOKS_STANDARD[@]}")
    ;;
  strict)
    PRETOOL_HOOKS=("${PRETOOL_HOOKS_STRICT[@]}")
    POSTTOOL_HOOKS=("${POSTTOOL_HOOKS_STRICT[@]}")
    ;;
esac

# Copy hooks
INSTALLED=0

for hook in "${PRETOOL_HOOKS[@]}"; do
  if [ -f "$SCRIPT_DIR/$hook" ]; then
    cp "$SCRIPT_DIR/$hook" "$HOOKS_DIR/$hook"
    chmod +x "$HOOKS_DIR/$hook"
    INSTALLED=$((INSTALLED + 1))
    echo "  Installed PreToolUse: $hook"
  fi
done

for hook in "${POSTTOOL_HOOKS[@]+"${POSTTOOL_HOOKS[@]}"}"; do
  if [ -n "$hook" ] && [ -f "$SCRIPT_DIR/$hook" ]; then
    cp "$SCRIPT_DIR/$hook" "$HOOKS_DIR/$hook"
    chmod +x "$HOOKS_DIR/$hook"
    INSTALLED=$((INSTALLED + 1))
    echo "  Installed PostToolUse: $hook"
  fi
done

for hook in "${SESSION_HOOKS[@]}"; do
  if [ -f "$SCRIPT_DIR/$hook" ]; then
    cp "$SCRIPT_DIR/$hook" "$HOOKS_DIR/$hook"
    chmod +x "$HOOKS_DIR/$hook"
    INSTALLED=$((INSTALLED + 1))
    echo "  Installed SessionStart: $hook"
  fi
done

# Create default governance config
if [ ! -f "$GOV_DIR/protected-files.conf" ]; then
  cat > "$GOV_DIR/protected-files.conf" << 'CONF'
# Protected files -- these cannot be modified by AI agents
# Add one pattern per line. Lines starting with # are comments.
SOUL.md
governance.md
GOVERNANCE_RULES.md
ROUTING_RULES.md
agent-web-permissions.md
web-interaction-security.md
CONF
  echo "  Created: protected-files.conf"
fi

# Create hook profile marker
echo "$PROFILE" > "$GOV_DIR/.hook-profile"

echo ""
echo "Installed $INSTALLED hooks ($PROFILE profile)."
echo ""
echo "Next steps:"
echo "  1. Register hooks in your Claude Code settings (see docs)"
echo "  2. Configure project-boundaries.conf if using strict profile"
echo "  3. Configure token-budget.json if using cost budget gate"
echo "  4. Run a session to verify hooks are active"
echo ""
echo "Runtime controls:"
echo "  CXNI_HOOK_PROFILE=minimal|standard|strict"
echo "  CXNI_DISABLED_HOOKS=comma,separated,hook,names"
echo "  # REMOVED: CXNI_MAINTENANCE_MODE bypass (security review 2026-04-17). Maintenance mode must not bypass enforcement."
