install.sh

#!/usr/bin/env bash
# ZeroPath coding-agent installer.
#
# Configures ZeroPath security scanning for the AI coding agents present on
# this machine (Claude Code, OpenAI Codex, Cursor). For each detected agent it
# registers the ZeroPath MCP server (so the agent can scan code it writes via
# the On-Demand Code Scan API), installs deterministic stop hooks where the
# agent supports them, and adds rules/guidance directing the agent to use
# them. Docs: https://zeropath.com/docs/developer-tools/coding-agents/overview
# (source: https://github.com/ZeroPathAI/agent_install).
#
# Usage:
#   curl -fsSL https://raw.githubusercontent.com/ZeroPathAI/agent_install/main/install.sh | bash
#   ./install.sh [--agents claude,codex,cursor] [--token-id ID --token-secret SECRET]
#                [--org-id ORG] [--base-url URL] [--no-hooks] [--no-mcp] [--no-rules]
#
# Credentials resolution order: flags, ZEROPATH_API_TOKEN_ID/SECRET env vars,
# existing ~/.config/zeropath/credentials.json, interactive prompt.
set -euo pipefail

RAW_BASE="${ZEROPATH_AGENT_INSTALL_RAW_BASE:-https://raw.githubusercontent.com/ZeroPathAI/agent_install/main}"
CLI_RELEASE_BASE="${ZEROPATH_CLI_RELEASE_BASE:-https://github.com/ZeroPathAI/zeropath-cli/releases/latest/download}"
MCP_SERVER_SOURCE="${ZEROPATH_MCP_SERVER_SOURCE:-git+https://github.com/ZeroPathAI/zeropath-mcp-server}"

ZEROPATH_HOME="${ZEROPATH_HOME:-$HOME/.zeropath}"
CREDENTIALS_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/zeropath/credentials.json"

AGENTS=""
TOKEN_ID="${ZEROPATH_API_TOKEN_ID:-}"
TOKEN_SECRET="${ZEROPATH_API_TOKEN_SECRET:-}"
ORG_ID="${ZEROPATH_ORG_ID:-}"
BASE_URL="${ZEROPATH_BASE_URL:-}"
INSTALL_MCP=true
INSTALL_HOOKS=true
INSTALL_RULES=true
INSTALL_CLI=true

usage() { sed -n '2,18p' "$0" 2>/dev/null || true; }

while [ $# -gt 0 ]; do
  case "$1" in
    --agents) AGENTS="$2"; shift 2 ;;
    --token-id) TOKEN_ID="$2"; shift 2 ;;
    --token-secret) TOKEN_SECRET="$2"; shift 2 ;;
    --org-id) ORG_ID="$2"; shift 2 ;;
    --base-url) BASE_URL="$2"; shift 2 ;;
    --no-mcp) INSTALL_MCP=false; shift ;;
    --no-hooks) INSTALL_HOOKS=false; shift ;;
    --no-rules) INSTALL_RULES=false; shift ;;
    --no-cli) INSTALL_CLI=false; shift ;;
    -h|--help) usage; exit 0 ;;
    *) echo "error: unknown flag $1" >&2; usage >&2; exit 1 ;;
  esac
done

log()  { printf '\033[1;32m==>\033[0m %s\n' "$*"; }
warn() { printf '\033[1;33mwarning:\033[0m %s\n' "$*" >&2; }
die()  { printf '\033[1;31merror:\033[0m %s\n' "$*" >&2; exit 1; }

command -v curl >/dev/null || die "curl is required"
command -v python3 >/dev/null || die "python3 is required (used for JSON config merging and the hook scripts)"

# ---------------------------------------------------------------------------
# Locate support files: prefer a local checkout (running ./install.sh from the
# repo), fall back to downloading from the repo's raw URL (curl | bash).
# ---------------------------------------------------------------------------
SCRIPT_DIR=""
if [ -n "${BASH_SOURCE[0]:-}" ] && [ -f "${BASH_SOURCE[0]}" ]; then
  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
fi

fetch_support_file() { # $1: repo-relative path, $2: destination
  if [ -n "$SCRIPT_DIR" ] && [ -f "$SCRIPT_DIR/$1" ]; then
    cp "$SCRIPT_DIR/$1" "$2"
  else
    curl -fsSL "$RAW_BASE/$1" -o "$2"
  fi
}

# ---------------------------------------------------------------------------
# Agent detection
# ---------------------------------------------------------------------------
detect_agent() {
  case "$1" in
    claude) command -v claude >/dev/null || [ -d "$HOME/.claude" ] ;;
    codex)  command -v codex  >/dev/null || [ -d "$HOME/.codex" ] ;;
    cursor) [ -d "$HOME/.cursor" ] || command -v cursor >/dev/null || command -v cursor-agent >/dev/null ;;
    *) return 1 ;;
  esac
}

if [ -z "$AGENTS" ]; then
  for candidate in claude codex cursor; do
    if detect_agent "$candidate"; then AGENTS="${AGENTS:+$AGENTS,}$candidate"; fi
  done
  [ -n "$AGENTS" ] || die "no supported agents detected (claude, codex, cursor). Use --agents to force."
  log "Detected agents: $AGENTS"
else
  log "Configuring agents: $AGENTS"
fi

want_agent() { case ",$AGENTS," in *",$1,"*) return 0 ;; *) return 1 ;; esac; }

# ---------------------------------------------------------------------------
# ZeroPath CLI binary
# ---------------------------------------------------------------------------
mkdir -p "$ZEROPATH_HOME/bin" "$ZEROPATH_HOME/hooks" "$ZEROPATH_HOME/rules" \
         "$ZEROPATH_HOME/logs" "$ZEROPATH_HOME/cache"

CLI_PATH="$ZEROPATH_HOME/bin/zeropath"
if $INSTALL_CLI; then
  case "$(uname -s)-$(uname -m)" in
    Linux-x86_64)            CLI_ASSET="zeropath-linux" ;;
    Darwin-arm64)            CLI_ASSET="zeropath-macos-arm64" ;;
    Darwin-x86_64)           CLI_ASSET="zeropath-macos" ;;
    *) die "unsupported platform $(uname -s)/$(uname -m); install the zeropath CLI manually and re-run with --no-cli" ;;
  esac
  log "Installing zeropath CLI ($CLI_ASSET) to $CLI_PATH"
  curl -fsSL "$CLI_RELEASE_BASE/$CLI_ASSET" -o "$CLI_PATH.tmp"
  chmod +x "$CLI_PATH.tmp"
  mv "$CLI_PATH.tmp" "$CLI_PATH"
elif [ ! -x "$CLI_PATH" ] && ! command -v zeropath >/dev/null; then
  warn "zeropath CLI not found; stop hooks will be skipped until it is installed"
fi

# ---------------------------------------------------------------------------
# Credentials
# ---------------------------------------------------------------------------
if [ -z "$TOKEN_ID" ] && [ -f "$CREDENTIALS_FILE" ]; then
  TOKEN_ID="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("clientId",""))' "$CREDENTIALS_FILE")"
  TOKEN_SECRET="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("clientSecret",""))' "$CREDENTIALS_FILE")"
  [ -n "$TOKEN_ID" ] && log "Reusing credentials from $CREDENTIALS_FILE"
fi

if [ -z "$TOKEN_ID" ] || [ -z "$TOKEN_SECRET" ]; then
  if [ -e /dev/tty ]; then
    echo "A ZeroPath API token is required (dashboard: Settings -> API Tokens)."
    printf 'API token ID: '; read -r TOKEN_ID < /dev/tty
    printf 'API token secret: '; read -rs TOKEN_SECRET < /dev/tty; echo
  fi
  [ -n "$TOKEN_ID" ] && [ -n "$TOKEN_SECRET" ] || \
    die "no credentials. Pass --token-id/--token-secret or set ZEROPATH_API_TOKEN_ID/ZEROPATH_API_TOKEN_SECRET."
fi

if [ -x "$CLI_PATH" ]; then
  log "Storing credentials via 'zeropath auth' ($CREDENTIALS_FILE)"
  "$CLI_PATH" auth "$TOKEN_ID" "$TOKEN_SECRET" >/dev/null
fi

# ---------------------------------------------------------------------------
# Shared config + hook/rule payloads
# ---------------------------------------------------------------------------
if [ ! -f "$ZEROPATH_HOME/config.env" ]; then
  log "Writing default hook settings to $ZEROPATH_HOME/config.env"
  cat > "$ZEROPATH_HOME/config.env" <<EOF
# ZeroPath coding-agent integration settings. See
# https://zeropath.com/docs/developer-tools/coding-agents/configuration
ZEROPATH_BLOCKING_STOP_HOOKS=false
ZEROPATH_HOOK_SEVERITY_THRESHOLD=high
ZEROPATH_HOOK_TIMEOUT_SECONDS=240
ZEROPATH_HOOK_MAX_BLOCKS_PER_SESSION=3
ZEROPATH_HOOKS_DISABLED=false
${BASE_URL:+ZEROPATH_BASE_URL=$BASE_URL}
EOF
fi

log "Installing hook scripts to $ZEROPATH_HOME/hooks"
for f in zeropath_hook.py claude-stop-hook.sh cursor-stop-hook.sh; do
  fetch_support_file "hooks/$f" "$ZEROPATH_HOME/hooks/$f"
done
chmod +x "$ZEROPATH_HOME/hooks/"*.sh
fetch_support_file "rules/cursor-rule.mdc" "$ZEROPATH_HOME/rules/cursor-rule.mdc"
fetch_support_file "scripts/zeropath-cursor-rules" "$ZEROPATH_HOME/bin/zeropath-cursor-rules"
chmod +x "$ZEROPATH_HOME/bin/zeropath-cursor-rules"

if $INSTALL_MCP && ! command -v uvx >/dev/null; then
  warn "uvx (from uv) is not installed; the ZeroPath MCP server is launched with uvx."
  warn "Install it with: curl -LsSf https://astral.sh/uv/install.sh | sh"
fi

# Environment passed to the MCP server by every agent.
mcp_env_json() {
  python3 - "$TOKEN_ID" "$TOKEN_SECRET" "$ORG_ID" "$BASE_URL" <<'PY'
import json, sys
token_id, token_secret, org_id, base_url = sys.argv[1:5]
env = {"ZEROPATH_TOKEN_ID": token_id, "ZEROPATH_TOKEN_SECRET": token_secret}
if org_id: env["ZEROPATH_ORG_ID"] = org_id
if base_url: env["ZEROPATH_BASE_URL"] = base_url
print(json.dumps(env))
PY
}
MCP_ENV_JSON="$(mcp_env_json)"

# Insert or replace a marker-delimited managed block in a markdown file.
write_managed_block() { # $1: target file, $2: source file with block body
  TARGET="$1" SOURCE="$2" python3 <<'PY'
import os
begin, end = "<!-- BEGIN ZEROPATH AGENT INTEGRATION -->", "<!-- END ZEROPATH AGENT INTEGRATION -->"
target, source = os.environ["TARGET"], os.environ["SOURCE"]
block = begin + "\n" + open(source, encoding="utf-8").read().strip() + "\n" + end
existing = open(target, encoding="utf-8").read() if os.path.isfile(target) else ""
if begin in existing and end in existing:
    head, _, rest = existing.partition(begin)
    _, _, tail = rest.partition(end)
    updated = head + block + tail
else:
    updated = existing.rstrip() + ("\n\n" if existing.strip() else "") + block + "\n"
os.makedirs(os.path.dirname(target), exist_ok=True)
open(target, "w", encoding="utf-8").write(updated)
PY
}

# ---------------------------------------------------------------------------
# Claude Code
# ---------------------------------------------------------------------------
configure_claude() {
  log "Configuring Claude Code"
  if $INSTALL_MCP; then
    # User-scope MCP servers live in ~/.claude.json under "mcpServers".
    TARGET="$HOME/.claude.json" MCP_ENV="$MCP_ENV_JSON" MCP_SOURCE="$MCP_SERVER_SOURCE" python3 <<'PY'
import json, os
path = os.environ["TARGET"]
config = json.load(open(path)) if os.path.isfile(path) else {}
config.setdefault("mcpServers", {})["zeropath"] = {
    "type": "stdio",
    "command": "uvx",
    "args": ["--from", os.environ["MCP_SOURCE"], "zeropath-mcp-server"],
    "env": json.loads(os.environ["MCP_ENV"]),
}
json.dump(config, open(path, "w"), indent=2)
print(f"  MCP server 'zeropath' registered in {path}")
PY
  fi
  if $INSTALL_HOOKS; then
    TARGET="$HOME/.claude/settings.json" HOOK="$ZEROPATH_HOME/hooks/claude-stop-hook.sh" python3 <<'PY'
import json, os
path, hook_command = os.environ["TARGET"], os.environ["HOOK"]
os.makedirs(os.path.dirname(path), exist_ok=True)
settings = json.load(open(path)) if os.path.isfile(path) else {}
stop_hooks = settings.setdefault("hooks", {}).setdefault("Stop", [])
entry = {"hooks": [{"type": "command", "command": hook_command, "timeout": 300}]}
already = any("zeropath" in json.dumps(matcher) for matcher in stop_hooks)
if not already:
    stop_hooks.append(entry)
json.dump(settings, open(path, "w"), indent=2)
print(f"  Stop hook registered in {path}" + (" (already present)" if already else ""))
PY
  fi
  if $INSTALL_RULES; then
    RULE_TMP="$(mktemp)"
    fetch_support_file "rules/claude-memory.md" "$RULE_TMP"
    write_managed_block "$HOME/.claude/CLAUDE.md" "$RULE_TMP"
    rm -f "$RULE_TMP"
    echo "  Guidance block written to ~/.claude/CLAUDE.md"
  fi
}

# ---------------------------------------------------------------------------
# OpenAI Codex
# ---------------------------------------------------------------------------
configure_codex() {
  log "Configuring Codex"
  if $INSTALL_MCP; then
    TARGET="$HOME/.codex/config.toml" MCP_ENV="$MCP_ENV_JSON" MCP_SOURCE="$MCP_SERVER_SOURCE" python3 <<'PY'
import json, os
path = os.environ["TARGET"]
os.makedirs(os.path.dirname(path), exist_ok=True)
existing = open(path, encoding="utf-8").read() if os.path.isfile(path) else ""
if "[mcp_servers.zeropath]" in existing:
    print(f"  MCP server 'zeropath' already present in {path}")
else:
    env = json.loads(os.environ["MCP_ENV"])
    lines = ["", "[mcp_servers.zeropath]",
             'command = "uvx"',
             f'args = ["--from", "{os.environ["MCP_SOURCE"]}", "zeropath-mcp-server"]',
             "", "[mcp_servers.zeropath.env]"]
    lines += [f'{key} = "{value}"' for key, value in env.items()]
    with open(path, "a", encoding="utf-8") as handle:
        handle.write("\n".join(lines) + "\n")
    print(f"  MCP server 'zeropath' registered in {path}")
PY
  fi
  if $INSTALL_RULES; then
    RULE_TMP="$(mktemp)"
    fetch_support_file "rules/codex-agents.md" "$RULE_TMP"
    write_managed_block "$HOME/.codex/AGENTS.md" "$RULE_TMP"
    rm -f "$RULE_TMP"
    echo "  Guidance block written to ~/.codex/AGENTS.md"
  fi
  # Codex lifecycle hooks are not available cross-platform, so scanning relies
  # on the MCP tools plus the AGENTS.md guidance above.
}

# ---------------------------------------------------------------------------
# Cursor
# ---------------------------------------------------------------------------
configure_cursor() {
  log "Configuring Cursor"
  if $INSTALL_MCP; then
    TARGET="$HOME/.cursor/mcp.json" MCP_ENV="$MCP_ENV_JSON" MCP_SOURCE="$MCP_SERVER_SOURCE" python3 <<'PY'
import json, os
path = os.environ["TARGET"]
os.makedirs(os.path.dirname(path), exist_ok=True)
config = json.load(open(path)) if os.path.isfile(path) else {}
config.setdefault("mcpServers", {})["zeropath"] = {
    "command": "uvx",
    "args": ["--from", os.environ["MCP_SOURCE"], "zeropath-mcp-server"],
    "env": json.loads(os.environ["MCP_ENV"]),
}
json.dump(config, open(path, "w"), indent=2)
print(f"  MCP server 'zeropath' registered in {path}")
PY
  fi
  if $INSTALL_HOOKS; then
    TARGET="$HOME/.cursor/hooks.json" HOOK="$ZEROPATH_HOME/hooks/cursor-stop-hook.sh" python3 <<'PY'
import json, os
path, hook_command = os.environ["TARGET"], os.environ["HOOK"]
os.makedirs(os.path.dirname(path), exist_ok=True)
config = json.load(open(path)) if os.path.isfile(path) else {}
config.setdefault("version", 1)
stop_hooks = config.setdefault("hooks", {}).setdefault("stop", [])
if not any("zeropath" in json.dumps(hook) for hook in stop_hooks):
    stop_hooks.append({"command": hook_command})
json.dump(config, open(path, "w"), indent=2)
print(f"  stop hook registered in {path} (observational; Cursor hooks are beta)")
PY
  fi
  if $INSTALL_RULES; then
    echo "  Cursor rules are per-project: run 'zeropath-cursor-rules' inside each"
    echo "  project to install .cursor/rules/zeropath.mdc ($ZEROPATH_HOME/bin is not on PATH by default)."
  fi
}

if want_agent claude; then configure_claude; fi
if want_agent codex; then configure_codex; fi
if want_agent cursor; then configure_cursor; fi

# ---------------------------------------------------------------------------
# Summary
# ---------------------------------------------------------------------------
log "Done. Verify the integration:"
if want_agent claude; then echo "  - Claude Code: run /mcp (expect a 'zeropath' server); 'claude --debug' shows the Stop hook firing."; fi
if want_agent codex;  then echo "  - Codex: run /mcp in the TUI, or check ~/.codex/config.toml for [mcp_servers.zeropath]."; fi
if want_agent cursor; then echo "  - Cursor: Settings -> MCP should list 'zeropath'; run zeropath-cursor-rules in each project."; fi
echo "  - End-to-end: '$CLI_PATH scan-code --diff --caller agent' in a repo with uncommitted changes."
echo "  - Blocking mode: set ZEROPATH_BLOCKING_STOP_HOOKS=true in $ZEROPATH_HOME/config.env"