# install-hooks.ps1 -- Installs AI Governance hooks into a Claude Code project (Windows)
# Usage: pwsh install-hooks.ps1 [-Profile minimal|standard|strict] [-ProjectDir /path]
#
# This is the entry point for hook installation. It:
# 1. Copies hook scripts to .claude/hooks/ (or project-specific location)
# 2. Creates governance config files
# 3. Sets up directory structure
#
# Part of @connexum/ai-governance

param(
    [ValidateSet('minimal', 'standard', 'strict')]
    [string]$Profile = 'standard',

    [string]$ProjectDir = '.'
)

$ErrorActionPreference = 'Stop'

$scriptDir = $PSScriptRoot

Write-Host "Installing AI Governance hooks (PowerShell)..."
Write-Host "  Profile: $Profile"
Write-Host "  Project: $ProjectDir"

# Create directories
$hooksDir = Join-Path $ProjectDir '.claude/hooks'
$govDir = Join-Path $ProjectDir '.claude/governance'
$auditDir = Join-Path $govDir 'audit'
$tokenTrackDir = Join-Path $govDir 'token-tracking'
$fileChangesDir = Join-Path $govDir 'file-changes'

foreach ($dir in @($hooksDir, $govDir, $auditDir, $tokenTrackDir, $fileChangesDir)) {
    New-Item -ItemType Directory -Path $dir -Force | Out-Null
}

# Define hooks by profile
$preToolMinimal = @(
    'governance-file-shield.ps1'
    'secret-leak-scanner.ps1'
    'destructive-command-guard.ps1'
)

$preToolStandard = $preToolMinimal + @('web-access-gate.ps1')
$preToolStrict = $preToolStandard + @('file-boundary-guard.ps1', 'cost-budget-gate.ps1')

$postToolMinimal = @()
$postToolStandard = @('audit-logger.ps1')
$postToolStrict = @('audit-logger.ps1', 'token-tracker.ps1', 'file-change-tracker.ps1')

$sessionHooks = @('governance-integrity-check.ps1')

# Select hooks based on profile
switch ($Profile) {
    'minimal' {
        $preToolHooks = $preToolMinimal
        $postToolHooks = $postToolMinimal
    }
    'standard' {
        $preToolHooks = $preToolStandard
        $postToolHooks = $postToolStandard
    }
    'strict' {
        $preToolHooks = $preToolStrict
        $postToolHooks = $postToolStrict
    }
}

# Copy hooks
$installed = 0

foreach ($hook in $preToolHooks) {
    $source = Join-Path $scriptDir $hook
    if (Test-Path $source) {
        Copy-Item $source (Join-Path $hooksDir $hook) -Force
        $installed++
        Write-Host "  Installed PreToolUse: $hook"
    }
}

foreach ($hook in $postToolHooks) {
    $source = Join-Path $scriptDir $hook
    if (Test-Path $source) {
        Copy-Item $source (Join-Path $hooksDir $hook) -Force
        $installed++
        Write-Host "  Installed PostToolUse: $hook"
    }
}

foreach ($hook in $sessionHooks) {
    $source = Join-Path $scriptDir $hook
    if (Test-Path $source) {
        Copy-Item $source (Join-Path $hooksDir $hook) -Force
        $installed++
        Write-Host "  Installed SessionStart: $hook"
    }
}

# Copy shared utilities
$utilsSource = Join-Path $scriptDir 'hook-utils.ps1'
if (Test-Path $utilsSource) {
    Copy-Item $utilsSource (Join-Path $hooksDir 'hook-utils.ps1') -Force
}

# Copy wrapper
$wrapperSource = Join-Path $scriptDir 'hook-wrapper.ps1'
if (Test-Path $wrapperSource) {
    Copy-Item $wrapperSource (Join-Path $hooksDir 'hook-wrapper.ps1') -Force
}

# Create default governance config
$protectedConf = Join-Path $govDir 'protected-files.conf'
if (-not (Test-Path $protectedConf)) {
    @(
        '# Protected files -- these cannot be modified by AI agents'
        '# Add one pattern per line. Lines starting with # are comments.'
        'SOUL.md'
        'governance.md'
        'GOVERNANCE_RULES.md'
        'ROUTING_RULES.md'
        'agent-web-permissions.md'
        'web-interaction-security.md'
    ) | Set-Content $protectedConf
    Write-Host "  Created: protected-files.conf"
}

# Create hook profile marker
Set-Content (Join-Path $govDir '.hook-profile') $Profile

Write-Host ""
Write-Host "Installed $installed hooks ($Profile profile)."
Write-Host ""
Write-Host "Next steps:"
Write-Host "  1. Register hooks in your Claude Code settings (see docs)"
Write-Host "  2. Configure project-boundaries.conf if using strict profile"
Write-Host "  3. Configure token-budget.json if using cost budget gate"
Write-Host "  4. Run a session to verify hooks are active"
Write-Host ""
Write-Host "Runtime controls:"
Write-Host "  `$env:CXNI_HOOK_PROFILE = 'minimal|standard|strict'"
Write-Host "  `$env:CXNI_DISABLED_HOOKS = 'comma,separated,hook,names'"
Write-Host "  `$env:CXNI_MAINTENANCE_MODE = 'true'  (disables all blocking hooks)"
