install.sh

#!/bin/sh
# install.sh — installer, updater, and uninstaller for flashduty-runner.
#
# Usage (install or update):
#   curl -fsSL https://raw.githubusercontent.com/flashcatcloud/flashduty-runner/main/install.sh | sudo bash
#
# See https://github.com/flashcatcloud/flashduty-runner for documentation.

set -eu

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------

: "${REPO:=flashcatcloud/flashduty-runner}"
: "${INSTALL_DIR:=/usr/local/bin}"
: "${URL:=wss://api.flashcat.cloud/safari/environment/ws}"
: "${VERSION:=}"
: "${TOKEN:=}"
# When set, all release downloads are fetched from this prefix instead of
# github.com — the mirror must replicate GitHub's release layout
# (<MIRROR_URL>/releases/download/<tag>/<asset>) and expose a plain-text
# <MIRROR_URL>/releases/latest file containing the latest tag.
: "${MIRROR_URL:=}"
MIRROR_URL="${MIRROR_URL%/}"
if [ -n "$MIRROR_URL" ]; then
    case "$MIRROR_URL" in
        https://*) : ;;
        *) printf 'MIRROR_URL must use https:// scheme, got: %s\n' "$MIRROR_URL" >&2; exit 1 ;;
    esac
fi

BINARY_NAME="flashduty-runner"
CONFIG_DIR="/etc/flashduty-runner"
ENV_FILE="${CONFIG_DIR}/env"
STATE_DIR="/var/lib/flashduty-runner"
WORKSPACE_DIR="${STATE_DIR}/workspace"
# Runner-owned, writable dir for the bundled CLIs (fduty). MUST equal the
# runner's BundledToolsDir() at runtime: that defaults to <runner home>/bin, and
# the env file below points the runner home at WORKSPACE_DIR — so the runtime
# tools dir is "${WORKSPACE_DIR}/bin". It sits under ReadWritePaths=${STATE_DIR},
# so it stays writable with ProtectSystem=strict (no ~/.local/bin relocation).
BIN_DIR="${WORKSPACE_DIR}/bin"
# Runner's own executable lives in a writable dir so it can self-update in place
# (ProtectSystem=strict keeps /usr read-only; $STATE_DIR is in ReadWritePaths).
# This is distinct from $WORKSPACE_DIR/bin, which holds the bundled fduty CLI.
RUNNER_BIN_DIR="${STATE_DIR}/bin"
RUNNER_BIN="${RUNNER_BIN_DIR}/${BINARY_NAME}"
SERVICE_USER="flashduty"
UNIT_PATH="/etc/systemd/system/flashduty-runner.service"
LOCK_FILE="/var/lock/flashduty-runner-install.lock"

MODE="install"      # install | uninstall
PURGE="false"
NO_SERVICE="false"

TMPDIR_=""

# ---------------------------------------------------------------------------
# Logging
# ---------------------------------------------------------------------------

if [ -t 2 ]; then
    COLOR_RED="$(printf '\033[31m')"
    COLOR_YLW="$(printf '\033[33m')"
    COLOR_GRN="$(printf '\033[32m')"
    COLOR_RST="$(printf '\033[0m')"
else
    COLOR_RED=""
    COLOR_YLW=""
    COLOR_GRN=""
    COLOR_RST=""
fi

info() { printf '%s[info]%s %s\n' "$COLOR_GRN" "$COLOR_RST" "$*" >&2; }
warn() { printf '%s[warn]%s %s\n' "$COLOR_YLW" "$COLOR_RST" "$*" >&2; }
err()  { printf '%s[err ]%s %s\n' "$COLOR_RED" "$COLOR_RST" "$*" >&2; }

die() {
    code="$1"
    shift
    err "$*"
    exit "$code"
}

# ---------------------------------------------------------------------------
# Help
# ---------------------------------------------------------------------------

print_help() {
    cat <<'EOF'
flashduty-runner installer

USAGE:
    install.sh [FLAGS]

FLAGS:
    --token <value>       Auth token (written to env file on first install)
    --version <tag>       Pin a specific release tag (e.g. v0.0.5)
    --no-service          Install binary only, skip systemd unit / service user
    --uninstall           Stop service, remove binary + unit (keeps config)
    --purge               Uninstall and also remove config + state + user
    --help                Show this help

ENVIRONMENT:
    TOKEN                 Same as --token
    VERSION               Same as --version
    URL                   Runtime WebSocket URL (default: wss://api.flashcat.cloud/…)
    INSTALL_DIR           Binary install directory (default: /usr/local/bin)
    REPO                  GitHub owner/repo override (default: flashcatcloud/flashduty-runner)
    MIRROR_URL            Download release assets from this mirror prefix instead of github.com

EXAMPLES:
    curl -fsSL https://raw.githubusercontent.com/flashcatcloud/flashduty-runner/main/install.sh | sudo bash
    curl -fsSL https://raw.githubusercontent.com/flashcatcloud/flashduty-runner/main/install.sh | sudo TOKEN=wnt_xxx bash
    curl -fsSL https://raw.githubusercontent.com/flashcatcloud/flashduty-runner/main/install.sh | sudo bash -s -- --uninstall
EOF
}

# ---------------------------------------------------------------------------
# Argument parsing
# ---------------------------------------------------------------------------

parse_args() {
    while [ "$#" -gt 0 ]; do
        case "$1" in
            --help|-h)         print_help; exit 0 ;;
            --uninstall)       MODE="uninstall" ;;
            --purge)           MODE="uninstall"; PURGE="true" ;;
            --no-service)      NO_SERVICE="true" ;;
            --token)           shift; TOKEN="${1:-}" ;;
            --token=*)         TOKEN="${1#--token=}" ;;
            --version)         shift; VERSION="${1:-}" ;;
            --version=*)       VERSION="${1#--version=}" ;;
            *) die 1 "Unknown argument: $1. Run with --help for usage." ;;
        esac
        shift
    done
}

# ---------------------------------------------------------------------------
# Preconditions
# ---------------------------------------------------------------------------

require_root() {
    if [ "$(id -u)" -ne 0 ]; then
        die 3 "This script must run as root. Re-run via: curl -fsSL <url> | sudo bash"
    fi
}

require_cmd() {
    for c in "$@"; do
        if ! command -v "$c" >/dev/null 2>&1; then
            die 1 "Required command not found: $c. Please install it and retry."
        fi
    done
}

# ---------------------------------------------------------------------------
# Platform detection
# ---------------------------------------------------------------------------

OS=""
OS_TITLE=""
ARCH_GR=""
INIT=""

detect_platform() {
    uname_s="$(uname -s)"
    uname_m="$(uname -m)"

    case "$uname_s" in
        Linux)   OS="linux";  OS_TITLE="Linux" ;;
        Darwin)  OS="darwin"; OS_TITLE="Darwin" ;;
        *) die 2 "Unsupported OS: $uname_s. Supported: Linux, Darwin." ;;
    esac

    case "$uname_m" in
        x86_64|amd64)  ARCH_GR="x86_64" ;;
        arm64|aarch64) ARCH_GR="arm64" ;;
        *) die 2 "Unsupported architecture: $uname_m. Supported: x86_64, arm64." ;;
    esac
}

detect_init() {
    if [ "$OS" = "linux" ] && [ -d /run/systemd/system ]; then
        INIT="systemd"
    else
        INIT="none"
    fi
}

# ---------------------------------------------------------------------------
# Version resolution
# ---------------------------------------------------------------------------

resolve_version() {
    if [ -n "$VERSION" ]; then
        case "$VERSION" in
            v*) : ;;
            *) VERSION="v$VERSION" ;;
        esac
        info "Using pinned version: $VERSION"
        return
    fi

    if [ -n "$MIRROR_URL" ]; then
        info "Resolving latest release from mirror"
        if ! raw="$(curl --proto '=https' --tlsv1.2 -fsSL "${MIRROR_URL}/releases/latest")"; then
            die 5 "Could not fetch ${MIRROR_URL}/releases/latest (curl exit $?)"
        fi
        # Trim only leading/trailing whitespace — internal whitespace would
        # signal a corrupted pointer and should fail the regex check below
        # rather than be silently collapsed.
        VERSION="$(printf '%s' "$raw" | awk 'NR==1 {gsub(/^[[:space:]]+|[[:space:]]+$/, ""); print; exit}')"
    else
        info "Resolving latest release from github.com/${REPO}"
        effective="$(curl --proto '=https' --tlsv1.2 -fsSLI -o /dev/null -w '%{url_effective}' "https://github.com/${REPO}/releases/latest" || true)"
        VERSION="${effective##*/}"
        if [ "$VERSION" = "latest" ]; then VERSION=""; fi
    fi

    # Reject anything that doesn't look like a release tag. Two-stage check:
    # first reject characters outside the tag charset (path-traversal guard —
    # case glob's bare `*` would otherwise swallow slashes), then require the
    # leading 'v' + digit shape.
    case "$VERSION" in
        *[!A-Za-z0-9.+-]*) die 5 "Resolved version contains illegal characters: '${VERSION}'" ;;
    esac
    case "$VERSION" in
        v[0-9]*) : ;;
        *) die 5 "Resolved version is not a valid release tag: '${VERSION}'" ;;
    esac
    info "Latest version: $VERSION"
}

get_installed_version() {
    # Prefer the canonical path; fall back to the legacy ${INSTALL_DIR} location
    # so the "already up to date" short-circuit still works mid-migration.
    bin=""
    if [ -x "$RUNNER_BIN" ]; then
        bin="$RUNNER_BIN"
    elif [ -x "${INSTALL_DIR}/${BINARY_NAME}" ]; then
        bin="${INSTALL_DIR}/${BINARY_NAME}"
    fi
    if [ -n "$bin" ]; then
        # Output format: "flashduty-runner 0.0.5\n  Build Time: ...\n  Git Commit: ..."
        "$bin" version 2>/dev/null | awk 'NR==1 {print $2; exit}' || true
    fi
}

# ---------------------------------------------------------------------------
# Download + verify
# ---------------------------------------------------------------------------

sha256_of() {
    file="$1"
    if command -v sha256sum >/dev/null 2>&1; then
        sha256sum "$file" | awk '{print $1}'
    elif command -v shasum >/dev/null 2>&1; then
        shasum -a 256 "$file" | awk '{print $1}'
    else
        die 1 "Need sha256sum or shasum on PATH (install coreutils on Linux)."
    fi
}

download_and_verify() {
    asset="${BINARY_NAME}_${OS_TITLE}_${ARCH_GR}.tar.gz"
    if [ -n "$MIRROR_URL" ]; then
        base="${MIRROR_URL}/releases/download/${VERSION}"
    else
        base="https://github.com/${REPO}/releases/download/${VERSION}"
    fi

    TMPDIR_="$(mktemp -d 2>/dev/null || mktemp -d -t frdl)"
    trap 'rm -rf "$TMPDIR_"' EXIT INT TERM

    info "Downloading ${asset}"
    if ! curl --proto '=https' --tlsv1.2 -fsSL "${base}/${asset}" -o "${TMPDIR_}/${asset}"; then
        die 5 "Failed to download ${base}/${asset}"
    fi

    info "Downloading checksums.txt"
    if ! curl --proto '=https' --tlsv1.2 -fsSL "${base}/checksums.txt" -o "${TMPDIR_}/checksums.txt"; then
        die 5 "Failed to download ${base}/checksums.txt"
    fi

    # checksums.txt line format: "<sha256>  <filename>" (two-space separator from goreleaser).
    # Anchor the filename so e.g. "foo_${asset}" cannot false-match.
    expected="$(awk -v a="$asset" '$2 == a {print $1; exit}' "${TMPDIR_}/checksums.txt")"
    if [ -z "$expected" ]; then
        die 4 "Asset ${asset} not found in checksums.txt (wrong release or renamed asset)"
    fi
    actual="$(sha256_of "${TMPDIR_}/${asset}")"
    if [ "$actual" != "$expected" ]; then
        die 4 "Checksum mismatch for ${asset}: expected ${expected}, got ${actual}"
    fi
    info "Checksum OK"

    tar -xzf "${TMPDIR_}/${asset}" -C "${TMPDIR_}"
    if [ ! -x "${TMPDIR_}/${BINARY_NAME}" ]; then
        die 1 "Extracted tarball does not contain an executable ${BINARY_NAME}"
    fi
}

# ---------------------------------------------------------------------------
# Install steps
# ---------------------------------------------------------------------------

# Stop the running service (if any) before we swap the binary, so a crash+restart
# in the narrow window between mv and enable_and_start can't launch the new binary
# ahead of schedule. Must run on the update path; cheap no-op on fresh installs.
stop_service_if_running() {
    if [ "$INIT" = "systemd" ] && [ -f "$UNIT_PATH" ]; then
        if systemctl is-active --quiet flashduty-runner 2>/dev/null; then
            info "Stopping flashduty-runner before binary swap"
            systemctl stop flashduty-runner || true
        fi
    fi
}

install_binary() {
    mkdir -p "$RUNNER_BIN_DIR" "$INSTALL_DIR"

    # One-time layout migration: older installs put the real binary at
    # ${INSTALL_DIR}/${BINARY_NAME} (root-owned, on read-only /usr — cannot
    # self-update). If we still see a real file there (not our symlink), drop
    # its stale manual-update .bak so the new symlink can take over cleanly.
    if [ -f "${INSTALL_DIR}/${BINARY_NAME}" ] && [ ! -L "${INSTALL_DIR}/${BINARY_NAME}" ]; then
        rm -f "${INSTALL_DIR}/${BINARY_NAME}.bak" || true
    fi

    # Keep the previous canonical binary as a manual-update rollback. This is
    # separate from the self-update .bak (same name) — both live at
    # ${RUNNER_BIN}.bak and never coexist: install.sh runs while the service is
    # stopped, so there is no in-flight self-update to clobber.
    if [ -e "$RUNNER_BIN" ]; then
        mv -f "$RUNNER_BIN" "${RUNNER_BIN}.bak"
    fi
    install -m 0755 "${TMPDIR_}/${BINARY_NAME}" "$RUNNER_BIN"
    # Owned by the service user so the runner can replace it in place when
    # self-updating. ensure_workdir's recursive chown also covers this on the
    # service path; tolerate failure on the --no-service / darwin path.
    chown "$SERVICE_USER":"$SERVICE_USER" "$RUNNER_BIN" 2>/dev/null || true

    # /usr/local/bin/flashduty-runner is a root-owned symlink to the canonical
    # path so `flashduty-runner version` keeps working for humans; self-update
    # rewrites the symlink target's real file, never the link itself.
    ln -sfn "$RUNNER_BIN" "${INSTALL_DIR}/${BINARY_NAME}"
    info "Installed ${RUNNER_BIN} (symlinked from ${INSTALL_DIR}/${BINARY_NAME})"
}

ensure_user() {
    if id "$SERVICE_USER" >/dev/null 2>&1; then
        return
    fi
    info "Creating system user: ${SERVICE_USER}"
    if command -v useradd >/dev/null 2>&1; then
        useradd --system --home-dir "$STATE_DIR" --shell /usr/sbin/nologin "$SERVICE_USER"
    elif command -v adduser >/dev/null 2>&1; then
        # Alpine / busybox fallback.
        adduser -S -H -h "$STATE_DIR" -s /sbin/nologin "$SERVICE_USER"
    else
        die 1 "Neither useradd nor adduser available — cannot create service user"
    fi
}

ensure_workdir() {
    # Refuse to touch a pre-existing symlink — prevents a pre-staged /var/lib/flashduty-runner
    # → / symlink from turning our recursive chown into a full-FS chown.
    if [ -L "$STATE_DIR" ]; then
        die 1 "${STATE_DIR} is a symlink — refusing to chown through it."
    fi
    mkdir -p "$WORKSPACE_DIR" "$BIN_DIR" "$RUNNER_BIN_DIR"
    chown -R "$SERVICE_USER":"$SERVICE_USER" "$STATE_DIR" 2>/dev/null || true
    chmod 0750 "$STATE_DIR" "$WORKSPACE_DIR" "$BIN_DIR" "$RUNNER_BIN_DIR"
}

# stage_bundled_fduty stages the fduty CLI that ships inside the release tarball
# (extracted to $TMPDIR_ by download_and_verify) into dir, so the runner never
# has to curl|sh the CDN installer at boot. Best-effort: if the archive predates
# bundling (no fduty member), the runner falls back to its CDN install path at
# first run. The chown to the service user is tolerated-fail so the binary-only
# path (no service user) still works.
#
# Service installs stage into $BIN_DIR (the env-pinned runtime tools dir).
# Binary-only / darwin installs stage into $INSTALL_DIR instead: that is on the
# user's PATH and, on darwin, is the dir the runner's bundledFdutyNextToExe()
# probes (os.Executable() there resolves to the /usr/local/bin symlink, not its
# target) — so the runner self-stages it into the per-user tools dir at boot.
stage_bundled_fduty() {
    dir="$1"
    src="${TMPDIR_}/fduty"
    if [ ! -f "$src" ]; then
        info "Release archive has no bundled fduty; runner will provision it at first run"
        return
    fi
    install -m 0755 "$src" "${dir}/fduty"
    chown "$SERVICE_USER":"$SERVICE_USER" "${dir}/fduty" 2>/dev/null || true
    info "Installed bundled fduty: ${dir}/fduty"
}

# fduty_present reports whether a staged fduty already sits where this host's
# install path puts it (service → $BIN_DIR, binary-only → $INSTALL_DIR). Used to
# keep the "already up to date" short-circuit from declaring success while the
# bundled CLI is still missing — which would strand the runner exactly as a
# fresh install with the staging step skipped did.
fduty_present() {
    if [ "$NO_SERVICE" = "true" ] || [ "$OS" = "darwin" ]; then
        [ -x "${INSTALL_DIR}/fduty" ]
    else
        [ -x "${BIN_DIR}/fduty" ]
    fi
}

ensure_token() {
    # Already have a token in env file?  Leave it alone on update.
    if [ -f "$ENV_FILE" ] && grep -q '^FLASHDUTY_RUNNER_TOKEN=' "$ENV_FILE"; then
        return
    fi
    if [ -n "$TOKEN" ]; then
        return
    fi
    # Probe whether /dev/tty is actually openable. Mode bits alone aren't enough
    # (it exists as a device in containers without a tty, but open() returns ENXIO).
    # The subshell isolates the failing redirect from `set -e`.
    if ( : </dev/tty ) 2>/dev/null; then
        printf 'Enter Flashduty token: ' >/dev/tty
        old_stty=""
        # Restore terminal echo on Ctrl-C, otherwise the user is left with a silent shell.
        if command -v stty >/dev/null 2>&1; then
            old_stty="$(stty -g </dev/tty 2>/dev/null || true)"
            if [ -n "$old_stty" ]; then
                trap 'stty "$old_stty" </dev/tty 2>/dev/null || true; exit 130' INT TERM
            fi
            stty -echo </dev/tty 2>/dev/null || true
        fi
        IFS= read -r TOKEN </dev/tty || TOKEN=""
        if [ -n "$old_stty" ]; then
            stty "$old_stty" </dev/tty 2>/dev/null || true
            trap - INT TERM
        fi
        printf '\n' >/dev/tty
    fi
    if [ -z "$TOKEN" ]; then
        die 6 "Token is required. Set TOKEN=wnt_xxx before sudo, pass --token, or run the script from a terminal."
    fi
}

write_env_file() {
    mkdir -p "$CONFIG_DIR"
    chmod 0755 "$CONFIG_DIR"
    if [ -f "$ENV_FILE" ]; then
        info "Env file exists, leaving it unchanged: ${ENV_FILE}"
        return
    fi
    umask 077
    # Use printf (not heredoc) so shell metacharacters in $TOKEN / $URL stay literal.
    {
        printf '# Managed by install.sh on first install. Edit freely; updates will not overwrite this file.\n'
        printf 'FLASHDUTY_RUNNER_TOKEN=%s\n' "$TOKEN"
        printf 'FLASHDUTY_RUNNER_URL=%s\n' "$URL"
        printf 'FLASHDUTY_RUNNER_WORKSPACE=%s\n' "$WORKSPACE_DIR"
        printf 'FLASHDUTY_RUNNER_LOG_LEVEL=info\n'
        printf '# Auto-update is on by default: the runner upgrades itself when Flashduty\n'
        printf '# publishes a newer version. To pin this host to its installed version,\n'
        printf '# uncomment the next line (then: systemctl restart flashduty-runner).\n'
        printf '# FLASHDUTY_RUNNER_DISABLE_AUTO_UPDATE=true\n'
    } >"$ENV_FILE"
    chown 0:0 "$ENV_FILE" 2>/dev/null || true
    chmod 0600 "$ENV_FILE"
    info "Wrote env file: ${ENV_FILE}"
}

install_systemd_unit() {
    new_unit="${TMPDIR_}/flashduty-runner.service"
    cat >"$new_unit" <<EOF
[Unit]
Description=Flashduty Runner
Documentation=https://github.com/${REPO}
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=${SERVICE_USER}
Group=${SERVICE_USER}
EnvironmentFile=${ENV_FILE}
ExecStart=${RUNNER_BIN} run
Restart=always
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=${STATE_DIR}

[Install]
WantedBy=multi-user.target
EOF
    if [ -f "$UNIT_PATH" ] && cmp -s "$new_unit" "$UNIT_PATH"; then
        info "Systemd unit unchanged: ${UNIT_PATH}"
    else
        install -m 0644 -o 0 -g 0 "$new_unit" "$UNIT_PATH"
        info "Installed systemd unit: ${UNIT_PATH}"
        systemctl daemon-reload
    fi
}

enable_and_start() {
    # stop_service_if_running already handled any pre-existing instance before the swap.
    systemctl enable flashduty-runner >/dev/null 2>&1 || true
    systemctl start flashduty-runner

    # Give the process a moment to exec + either connect or crash, then check status.
    sleep 2
    if systemctl is-active --quiet flashduty-runner; then
        info "Service is active. Check status: systemctl status flashduty-runner"
    else
        warn "Service failed to start. Logs: journalctl -u flashduty-runner -n 50"
        warn "Previous binary preserved at ${RUNNER_BIN}.bak for rollback."
    fi
}

# ---------------------------------------------------------------------------
# Uninstall
# ---------------------------------------------------------------------------

uninstall() {
    info "Uninstalling flashduty-runner (purge=${PURGE})"
    if command -v systemctl >/dev/null 2>&1 && [ -f "$UNIT_PATH" ]; then
        systemctl stop flashduty-runner 2>/dev/null || true
        systemctl disable flashduty-runner 2>/dev/null || true
        rm -f "$UNIT_PATH"
        systemctl daemon-reload 2>/dev/null || true
    fi
    # Remove the canonical binary, its rollback copy, the self-update marker,
    # and the /usr/local/bin symlink (plus any legacy .bak left there).
    rm -f "$RUNNER_BIN" "${RUNNER_BIN}.bak" "${RUNNER_BIN_DIR}/upgrade.json"
    rm -f "${INSTALL_DIR}/${BINARY_NAME}" "${INSTALL_DIR}/${BINARY_NAME}.bak"
    if [ "$PURGE" = "true" ]; then
        rm -rf "$CONFIG_DIR" "$STATE_DIR"
        if id "$SERVICE_USER" >/dev/null 2>&1; then
            if command -v userdel >/dev/null 2>&1; then
                userdel "$SERVICE_USER" 2>/dev/null || true
            elif command -v deluser >/dev/null 2>&1; then
                deluser "$SERVICE_USER" 2>/dev/null || true
            fi
        fi
        info "Purge complete."
    else
        info "Uninstall complete. Config preserved at ${CONFIG_DIR}. Run with --purge to remove it."
    fi
}

# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------

do_install() {
    detect_platform
    detect_init
    require_cmd curl tar

    resolve_version
    installed="$(get_installed_version || true)"
    # A legacy install keeps the REAL binary at ${INSTALL_DIR} (not a symlink to
    # the writable ${RUNNER_BIN}). Such a runner cannot self-update — it can't
    # write /usr/local/bin under ProtectSystem=strict — so it must be migrated to
    # the new layout even when the version already matches, or it is stranded.
    needs_migration=false
    if [ -e "${INSTALL_DIR}/${BINARY_NAME}" ] && [ ! -L "${INSTALL_DIR}/${BINARY_NAME}" ]; then
        needs_migration=true
    elif [ ! -x "$RUNNER_BIN" ]; then
        needs_migration=true
    fi
    # Binary reports "0.0.5"; VERSION carries "v0.0.5" — strip the leading "v" for comparison.
    if [ -n "$installed" ] && [ "$installed" = "${VERSION#v}" ] && [ "$needs_migration" = "false" ] && fduty_present; then
        info "Already at ${VERSION}, nothing to do."
        return
    fi
    if [ "$needs_migration" = "true" ] && [ -n "$installed" ] && [ "$installed" = "${VERSION#v}" ]; then
        info "Already at ${VERSION} but on the legacy layout — migrating to the self-update layout."
    fi

    download_and_verify
    stop_service_if_running
    install_binary

    if [ "$NO_SERVICE" = "true" ] || [ "$OS" = "darwin" ]; then
        # Stage fduty next to the runner symlink: $INSTALL_DIR is on the user's
        # PATH and is the dir darwin's bundledFdutyNextToExe() probes, so a
        # manually-launched runner finds it without an env file or service user.
        stage_bundled_fduty "$INSTALL_DIR"
        info "Binary-only install complete."
        info "Start manually: ${INSTALL_DIR}/${BINARY_NAME} run --token <your-token>"
        return
    fi

    ensure_user
    ensure_workdir
    stage_bundled_fduty "$BIN_DIR"
    ensure_token
    write_env_file

    if [ "$INIT" = "systemd" ]; then
        install_systemd_unit
        enable_and_start
        info "Installed ${BINARY_NAME} ${VERSION}."
    else
        info "Systemd not detected. Binary installed at ${INSTALL_DIR}/${BINARY_NAME}."
        info "Start manually with 'flashduty-runner run' or wire it into your init system."
    fi
}

main() {
    parse_args "$@"
    require_root

    # Serialize concurrent installs. flock is optional; skip if absent.
    if command -v flock >/dev/null 2>&1; then
        mkdir -p "$(dirname "$LOCK_FILE")"
        exec 9>"$LOCK_FILE"
        if ! flock -n 9; then
            die 1 "Another install.sh is already running (lock: ${LOCK_FILE})"
        fi
    fi

    case "$MODE" in
        install)   do_install ;;
        uninstall) uninstall ;;
        *) die 1 "Unknown mode: $MODE" ;;
    esac
}

main "$@"