#!/bin/sh
# consensor installer for Claude Code
# https://consensor.io/install  ·  built by Bluelabs Pty Ltd  ·  protected by HOURGLASS
#
# Read this before you run it. What it does, in order:
#   1. Checks the `claude` CLI is installed.
#   2. Backs up ~/.claude/settings.json and ~/.claude.json (timestamped, under
#      ~/.claude/consensor/backups/).
#   3. Adds the consensor connector:
#        claude mcp add --transport http consensor https://consensor.io/mcp --scope user
#      (skipped if a server named "consensor" already exists).
#   4. Merges a short list of recommended permission rules into
#      ~/.claude/settings.json. It only ADDS rules you don't already have;
#      a rule you already have, in any list, is left exactly where it is.
#   5. Asks (default: No) whether to install the optional timing add-on, a
#      status line script that sends five numbers (usage percentages, token
#      totals, cost) and a random install ID to consensor. Never prompts or code.
#   6. Prints the uninstall command. Running this installer again is safe.
#
# Non-interactive use: CONSENSOR_TIMING=yes|no  (default no when there is no terminal)
# shellcheck shell=sh
set -eu
umask 077

CONSENSOR_VERSION="0.129.0"
MCP_URL="${CONSENSOR_MCP_URL:-https://consensor.io/mcp}"
CLAUDE_DIR="${HOME}/.claude"
DIR="${CLAUDE_DIR}/consensor"
STATE="${DIR}/state"
SETTINGS="${CLAUDE_DIR}/settings.json"
CLAUDE_JSON="${HOME}/.claude.json"
# Literal "~": Claude Code runs the statusLine command through a shell, which expands it.
# shellcheck disable=SC2088
STATUSLINE_CMD="~/.claude/consensor/statusline.sh"

say() { printf '%s\n' "$*"; }
warn() { printf 'consensor: %s\n' "$*" >&2; }
die() { printf 'consensor: %s\n' "$*" >&2; exit 1; }

pick_interp() {
  if [ -n "${CONSENSOR_INTERP:-}" ]; then
    printf '%s' "$CONSENSOR_INTERP"
  elif command -v node >/dev/null 2>&1 && node -e '' >/dev/null 2>&1; then
    printf 'node'
  elif command -v python3 >/dev/null 2>&1 && python3 -c 'import json' >/dev/null 2>&1; then
    printf 'python'
  else
    printf 'none'
  fi
}

run_merge() {
  case "$INTERP" in
    node) node "${DIR}/lib/merge.cjs" "$@" ;;
    python) python3 "${DIR}/lib/merge.py" "$@" ;;
    *) return 2 ;;
  esac
}

ask_timing() {
  case "${CONSENSOR_TIMING:-}" in
    y|Y|yes|YES|Yes) return 0 ;;
    n|N|no|NO|No) return 1 ;;
  esac
  if (exec </dev/tty) 2>/dev/null; then
    printf 'Install the optional timing add-on? It sends only usage numbers, never prompts or code. [y/N] ' >/dev/tty
    answer=""
    read -r answer </dev/tty || answer=""
    case "$answer" in y|Y|yes|YES|Yes) return 0 ;; esac
  fi
  return 1
}

backup() {
  ts="$(date -u +%Y%m%dT%H%M%SZ)-$$"
  bdir="${DIR}/backups/${ts}"
  mkdir -p "$bdir"
  for f in "$SETTINGS" "$CLAUDE_JSON"; do
    name=$(basename "$f")
    if [ -f "$f" ]; then
      cp -p "$f" "${bdir}/${name}"
    else
      : > "${bdir}/${name}.absent"
    fi
  done
  if [ ! -f "${DIR}/backups/ORIGINAL" ]; then
    printf '%s\n' "$ts" > "${DIR}/backups/ORIGINAL"
  fi
  say "  backed up to ${bdir}"
}

write_files() {
  mkdir -p "${DIR}/lib" "$STATE" "${DIR}/backups"
  cat > "${DIR}/lib/merge.cjs" <<'CONSENSOR_EOF_MERGE_JS'
// consensor settings merge helper (node). Mirrors merge.py exactly.
// Installed as ~/.claude/consensor/lib/merge.cjs (the .cjs extension keeps it
// CommonJS even if a parent folder's package.json says "type": "module").
// Merges, never overwrites: a rule the user already has, in ANY list, is left alone.
"use strict";
const fs = require("fs");
const path = require("path");

const RULES = {
  allow: ["Read", "Edit", "Bash(git status:*)", "Bash(git diff:*)", "Bash(git log:*)", "Bash(npm run test:*)", "mcp__consensor__*"],
  ask: ["Bash(git push:*)", "Bash(wrangler deploy:*)"],
  deny: ["Bash(rm -rf:*)", "Read(./.env)", "Read(./.env.*)"],
};
const LISTS = ["allow", "ask", "deny"];

function load(file, fallback) {
  let text;
  try { text = fs.readFileSync(file, "utf8"); } catch (e) { if (e.code === "ENOENT") return fallback; throw e; }
  if (text.trim() === "") return fallback;
  const v = JSON.parse(text);
  if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error(file + " is not a JSON object");
  return v;
}
function save(file, obj) {
  const tmp = path.join(path.dirname(file), "." + path.basename(file) + ".consensor-tmp");
  fs.writeFileSync(tmp, JSON.stringify(obj, null, 2) + "\n", { mode: 0o600 });
  fs.renameSync(tmp, file);
}
function blankManifest() {
  return { version: 1, added: { allow: [], ask: [], deny: [] }, created: {}, statusLine: null, skipped: [] };
}
function same(a, b) { return JSON.stringify(a) === JSON.stringify(b); }

function apply(settingsFile, manifestFile) {
  const s = load(settingsFile, {});
  const m = load(manifestFile, blankManifest());
  if (s.permissions === undefined) { s.permissions = {}; m.created.permissions = true; }
  if (!s.permissions || typeof s.permissions !== "object" || Array.isArray(s.permissions)) throw new Error("permissions is not an object");
  for (const list of LISTS) {
    if (s.permissions[list] === undefined) { s.permissions[list] = []; m.created[list] = true; }
    if (!Array.isArray(s.permissions[list])) throw new Error("permissions." + list + " is not a list");
  }
  let added = 0;
  for (const list of LISTS) {
    for (const rule of RULES[list]) {
      const home = LISTS.find((l) => s.permissions[l].includes(rule));
      if (home === undefined) {
        s.permissions[list].push(rule);
        if (!m.added[list].includes(rule)) m.added[list].push(rule);
        added++;
      } else if (home !== list && !m.added[home].includes(rule)) {
        if (!m.skipped.includes(rule)) m.skipped.push(rule);
        process.stdout.write("  kept your rule: " + rule + " stays in " + home + "\n");
      }
    }
  }
  save(settingsFile, s);
  save(manifestFile, m);
  process.stdout.write("  permission rules added: " + added + "\n");
}

function statuslineSet(settingsFile, manifestFile, command) {
  const s = load(settingsFile, {});
  const m = load(manifestFile, blankManifest());
  const ours = { type: "command", command: command };
  if (s.statusLine !== undefined && !same(s.statusLine, ours)) {
    process.stdout.write("  you already have a statusLine; it was left unchanged\n");
    return 10;
  }
  s.statusLine = ours;
  m.statusLine = ours;
  save(settingsFile, s);
  save(manifestFile, m);
  return 0;
}

function revert(settingsFile, manifestFile) {
  const m = load(manifestFile, null);
  if (!m) return 0;
  let s;
  try { s = load(settingsFile, null); } catch (e) { process.stderr.write("  settings.json is not valid JSON; left unchanged\n"); return 3; }
  if (!s) return 0;
  const p = s.permissions;
  if (p && typeof p === "object" && !Array.isArray(p)) {
    for (const list of LISTS) {
      if (!Array.isArray(p[list])) continue;
      p[list] = p[list].filter((r) => !(m.added[list] || []).includes(r));
      if (m.created[list] && p[list].length === 0) delete p[list];
    }
    if (m.created.permissions && Object.keys(p).length === 0) delete s.permissions;
  }
  if (m.statusLine && same(s.statusLine, m.statusLine)) delete s.statusLine;
  save(settingsFile, s);
  if (Object.keys(s).length === 0) process.stdout.write("EMPTY\n");
  return 0;
}

function hasMcp(claudeJson, name) {
  let j;
  try { j = load(claudeJson, {}); } catch (e) { return 1; }
  return j.mcpServers && typeof j.mcpServers === "object" && Object.prototype.hasOwnProperty.call(j.mcpServers, name) ? 0 : 1;
}

function main(argv) {
  const [cmd, a, b, c] = argv;
  try {
    if (cmd === "apply") { apply(a, b); return 0; }
    if (cmd === "statusline-set") return statuslineSet(a, b, c);
    if (cmd === "revert") return revert(a, b);
    if (cmd === "has-mcp") return hasMcp(a, b);
    if (cmd === "selftest") return 0;
  } catch (e) {
    process.stderr.write("  consensor merge: " + e.message + "\n");
    return 3;
  }
  process.stderr.write("usage: merge.cjs apply|statusline-set|revert|has-mcp ...\n");
  return 2;
}
process.exitCode = main(process.argv.slice(2));
CONSENSOR_EOF_MERGE_JS
  cat > "${DIR}/lib/merge.py" <<'CONSENSOR_EOF_MERGE_PY'
# consensor settings merge helper (python3). Mirrors merge.js exactly.
# Merges, never overwrites: a rule the user already has, in ANY list, is left alone.
import json
import os
import sys

RULES = {
    "allow": ["Read", "Edit", "Bash(git status:*)", "Bash(git diff:*)", "Bash(git log:*)", "Bash(npm run test:*)", "mcp__consensor__*"],
    "ask": ["Bash(git push:*)", "Bash(wrangler deploy:*)"],
    "deny": ["Bash(rm -rf:*)", "Read(./.env)", "Read(./.env.*)"],
}
LISTS = ["allow", "ask", "deny"]


class Bad(Exception):
    pass


def load(path, fallback):
    try:
        with open(path, "r", encoding="utf-8") as f:
            text = f.read()
    except FileNotFoundError:
        return fallback
    if text.strip() == "":
        return fallback
    v = json.loads(text)
    if not isinstance(v, dict):
        raise Bad(path + " is not a JSON object")
    return v


def save(path, obj):
    tmp = os.path.join(os.path.dirname(path), "." + os.path.basename(path) + ".consensor-tmp")
    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
    with os.fdopen(fd, "w", encoding="utf-8") as f:
        f.write(json.dumps(obj, indent=2, ensure_ascii=False) + "\n")
    os.replace(tmp, path)


def blank_manifest():
    return {"version": 1, "added": {"allow": [], "ask": [], "deny": []}, "created": {}, "statusLine": None, "skipped": []}


def same(a, b):
    return json.dumps(a, sort_keys=False) == json.dumps(b, sort_keys=False)


def apply(settings_file, manifest_file):
    s = load(settings_file, {})
    m = load(manifest_file, blank_manifest())
    if "permissions" not in s:
        s["permissions"] = {}
        m["created"]["permissions"] = True
    if not isinstance(s["permissions"], dict):
        raise Bad("permissions is not an object")
    p = s["permissions"]
    for lst in LISTS:
        if lst not in p:
            p[lst] = []
            m["created"][lst] = True
        if not isinstance(p[lst], list):
            raise Bad("permissions." + lst + " is not a list")
    added = 0
    for lst in LISTS:
        for rule in RULES[lst]:
            home = next((l for l in LISTS if rule in p[l]), None)
            if home is None:
                p[lst].append(rule)
                if rule not in m["added"][lst]:
                    m["added"][lst].append(rule)
                added += 1
            elif home != lst and rule not in m["added"][home]:
                if rule not in m["skipped"]:
                    m["skipped"].append(rule)
                sys.stdout.write("  kept your rule: " + rule + " stays in " + home + "\n")
    save(settings_file, s)
    save(manifest_file, m)
    sys.stdout.write("  permission rules added: " + str(added) + "\n")
    return 0


def statusline_set(settings_file, manifest_file, command):
    s = load(settings_file, {})
    m = load(manifest_file, blank_manifest())
    ours = {"type": "command", "command": command}
    if "statusLine" in s and not same(s["statusLine"], ours):
        sys.stdout.write("  you already have a statusLine; it was left unchanged\n")
        return 10
    s["statusLine"] = ours
    m["statusLine"] = ours
    save(settings_file, s)
    save(manifest_file, m)
    return 0


def revert(settings_file, manifest_file):
    m = load(manifest_file, None)
    if not m:
        return 0
    try:
        s = load(settings_file, None)
    except (ValueError, Bad):
        sys.stderr.write("  settings.json is not valid JSON; left unchanged\n")
        return 3
    if s is None:
        return 0
    p = s.get("permissions")
    if isinstance(p, dict):
        for lst in LISTS:
            if not isinstance(p.get(lst), list):
                continue
            ours = m["added"].get(lst, [])
            p[lst] = [r for r in p[lst] if r not in ours]
            if m["created"].get(lst) and len(p[lst]) == 0:
                del p[lst]
        if m["created"].get("permissions") and len(p) == 0:
            del s["permissions"]
    if m.get("statusLine") and same(s.get("statusLine"), m["statusLine"]):
        del s["statusLine"]
    save(settings_file, s)
    if len(s) == 0:
        sys.stdout.write("EMPTY\n")
    return 0


def has_mcp(claude_json, name):
    try:
        j = load(claude_json, {})
    except (ValueError, Bad):
        return 1
    servers = j.get("mcpServers")
    return 0 if isinstance(servers, dict) and name in servers else 1


def main(argv):
    cmd = argv[0] if argv else ""
    try:
        if cmd == "apply":
            return apply(argv[1], argv[2])
        if cmd == "statusline-set":
            return statusline_set(argv[1], argv[2], argv[3])
        if cmd == "revert":
            return revert(argv[1], argv[2])
        if cmd == "has-mcp":
            return has_mcp(argv[1], argv[2])
        if cmd == "selftest":
            return 0
    except (ValueError, Bad, OSError) as e:
        sys.stderr.write("  consensor merge: " + str(e) + "\n")
        return 3
    sys.stderr.write("usage: merge.py apply|statusline-set|revert|has-mcp ...\n")
    return 2


if __name__ == "__main__":
    sys.exit(main(sys.argv[1:]))
CONSENSOR_EOF_MERGE_PY
  cat > "${DIR}/uninstall.sh" <<'CONSENSOR_EOF_UNINSTALL'
#!/bin/sh
# consensor uninstaller for Claude Code. Reverses install.sh.
#
#   sh ~/.claude/consensor/uninstall.sh                    reverse consensor's changes
#   sh ~/.claude/consensor/uninstall.sh --restore-backups  put ~/.claude/settings.json and
#                                                          ~/.claude.json back byte-for-byte
#                                                          as they were before the first install
#
# Default behaviour:
#   - settings.json: if it has not changed since consensor last touched it, the
#     pre-install backup is restored byte-for-byte. If you have edited it since,
#     only the rules and status line consensor added are removed; your edits stay.
#   - ~/.claude.json: `claude mcp remove consensor --scope user`, only if consensor
#     added it. (This file holds live Claude Code state, so it is not rolled back
#     unless you pass --restore-backups.)
#   - Before anything changes, the current files are snapshotted to
#     ~/.claude/consensor/backups/<time>-pre-uninstall/. Backups are kept.
# Safe to run more than once.
# shellcheck shell=sh
set -eu
umask 077

CLAUDE_DIR="${HOME}/.claude"
DIR="${CLAUDE_DIR}/consensor"
STATE="${DIR}/state"
SETTINGS="${CLAUDE_DIR}/settings.json"
CLAUDE_JSON="${HOME}/.claude.json"

say() { printf '%s\n' "$*"; }
warn() { printf 'consensor: %s\n' "$*" >&2; }

restore_file() {
  # restore_file <backup dir> <live path>
  name=$(basename "$2")
  if [ -f "$1/${name}" ]; then
    cp -p "$1/${name}" "$2"
    say "  restored $2 from backup"
  elif [ -f "$1/${name}.absent" ]; then
    rm -f "$2"
    say "  removed $2 (it did not exist before consensor)"
  else
    warn "no backup of $2 found in $1; left unchanged"
  fi
}

run_merge() {
  case "$INTERP" in
    node) node "${DIR}/lib/merge.cjs" "$@" ;;
    python) python3 "${DIR}/lib/merge.py" "$@" ;;
    *) return 2 ;;
  esac
}

main() {
  RESTORE=0
  for arg in "$@"; do
    case "$arg" in
      --restore-backups) RESTORE=1 ;;
      -h|--help) sed -n '2,20p' "$0"; exit 0 ;;
      *) warn "unknown option: $arg"; exit 2 ;;
    esac
  done

  if [ ! -d "$STATE" ] && [ ! -f "${DIR}/manifest.json" ]; then
    say "consensor is not installed (nothing to undo)."
    exit 0
  fi

  INTERP=$(cat "${DIR}/interp" 2>/dev/null || printf 'none')
  ORIG=""
  if [ -f "${DIR}/backups/ORIGINAL" ]; then
    ORIG="${DIR}/backups/$(cat "${DIR}/backups/ORIGINAL")"
  fi

  # Snapshot what is there now, before changing anything.
  snap="${DIR}/backups/$(date -u +%Y%m%dT%H%M%SZ)-$$-pre-uninstall"
  mkdir -p "$snap"
  for f in "$SETTINGS" "$CLAUDE_JSON"; do
    if [ -f "$f" ]; then cp -p "$f" "$snap/"; else : > "$snap/$(basename "$f").absent"; fi
  done
  say "Snapshot of current files: ${snap}"

  # settings.json
  unchanged=0
  if [ -f "${STATE}/settings.post.cksum" ] && [ -f "$SETTINGS" ]; then
    if [ "$(cksum < "$SETTINGS")" = "$(cat "${STATE}/settings.post.cksum")" ]; then unchanged=1; fi
  fi
  if [ -n "$ORIG" ] && { [ "$RESTORE" -eq 1 ] || [ "$unchanged" -eq 1 ]; }; then
    restore_file "$ORIG" "$SETTINGS"
  elif [ -f "$SETTINGS" ]; then
    out=""
    if out=$(run_merge revert "$SETTINGS" "${DIR}/manifest.json"); then
      say "  removed consensor's rules and status line from ${SETTINGS}; your other settings were kept"
      if [ "$out" = "EMPTY" ] && [ -n "$ORIG" ] && [ -f "${ORIG}/settings.json.absent" ]; then
        rm -f "$SETTINGS"
      fi
    else
      warn "could not edit ${SETTINGS}; restore it from ${ORIG:-the backups folder} if needed"
    fi
  fi

  # ~/.claude.json (the connector)
  if [ "$RESTORE" -eq 1 ] && [ -n "$ORIG" ]; then
    restore_file "$ORIG" "$CLAUDE_JSON"
  elif [ -f "${STATE}/mcp_added" ]; then
    if command -v claude >/dev/null 2>&1; then
      if claude mcp remove consensor --scope user >/dev/null 2>&1; then
        say "  removed the consensor connector"
      else
        say "  the consensor connector was already gone"
      fi
    else
      warn "'claude' not found; remove the connector with: claude mcp remove consensor --scope user"
    fi
  else
    say "  the consensor connector was there before install; left in place"
  fi

  for cmd in csyntax ccents csync csensai; do
    if [ -f "${STATE}/command_${cmd}" ]; then
      rm -f "${CLAUDE_DIR}/commands/${cmd}.md" "${STATE}/command_${cmd}"
      say "  removed the /${cmd} command"
    fi
  done
  rm -f "${DIR}/statusline.sh" "${DIR}/install_id" "${DIR}/interp" "${DIR}/last_post" \
        "${DIR}/manifest.json" "${DIR}/backups/ORIGINAL" "${DIR}/lib/merge.cjs" "${DIR}/lib/merge.py"
  rm -f "${STATE}/mcp_added" "${STATE}/timing" "${STATE}/settings.post.cksum"
  rmdir "${DIR}/lib" "$STATE" 2>/dev/null || true
  rm -f "${DIR}/uninstall.sh"

  say ""
  say "consensor has been removed. Backups are kept in ${DIR}/backups/"
  say "Delete them whenever you like:  rm -r ~/.claude/consensor"
}

main "$@"
CONSENSOR_EOF_UNINSTALL
  chmod 700 "${DIR}/uninstall.sh"
}

# The consensor commands for Claude Code (/csyntax, /ccents, /csync): plain command files, yours to edit.
# The uninstaller removes only the ones it wrote.
write_command() {
  mkdir -p "${CLAUDE_DIR}/commands"
  case "$1" in
    csyntax) cat > "${CLAUDE_DIR}/commands/csyntax.md" <<'CONSENSOR_EOF_CONSYNTAX'
---
description: Consensor Coder — say what you want built or changed; Claude plans it and hands the mechanical coding to consensor through HOURGLASS
argument-hint: <what you want built or changed>
allowed-tools: mcp__consensor__consensor_delegate_code, mcp__consensor__consensor_status, Read, Glob, Grep
---
Build this, using consensor (the consensor connector, tool consensor_delegate_code) as your second coder.

What I want: $ARGUMENTS

You plan it and you own the result. consensor does the mechanical parts. Method:
1. Work out what this needs: which files, what changes, what done looks like. Find the files yourself; do not ask me for paths.
2. Hand the mechanical, well-specified parts to consensor_delegate_code (a self-contained job with the files it needs, mode fast unless real reasoning is essential, and an honest expected_output_tokens). Keep the judgement calls, the design and the integration for yourself.
3. If the work is bigger than one call (more than about 8,000 tokens of output), write the integration contract first (names, ids, interfaces, events the parts share), split it into self-contained parts of 4,000 to 8,000 output tokens, put the contract in every part, and delegate the parts. Independent parts can go in parallel. If a result says CUT OFF, split that part again.
4. Review everything that comes back before using it: unsafe sinks (innerHTML, eval, document.write, shell strings), wrong imports, anything outside what was asked. Fix or drop those, and say what you changed.
5. Assemble, run the tests that exist, and show me the result in plain words: what was built, what consensor wrote, what you wrote or repaired.
6. End your reply with the consensor line from the last tool result, unchanged.
CONSENSOR_EOF_CONSYNTAX
      ;;
    ccents) cat > "${CLAUDE_DIR}/commands/ccents.md" <<'CONSENSOR_EOF_CONCENTS'
---
description: Consensor Monical — what consensor has saved you, in your own minutes or in Opus-level money
allowed-tools: mcp__consensor__consensor_status
---
Call consensor_status and report what consensor has saved, from the `chip` field of the result.

Rules:
1. If `chip.minutes` is present, the figures are minutes at MY OWN measured pace: report this week's minutes (`minutes.week`) and this month's (`minutes.month`), with the jobs completed. Say the pace and the window it was measured over.
2. If `chip.minutes` is null, report money instead: this week's and this month's Opus-level value (`money.week_opus_aud`, `money.month_opus_aud`) against what was paid (`money.week_paid_aud`, `money.month_paid_aud`), and say the basis (`money.basis`). Never convert to minutes yourself; consensor never uses a generic rate.
3. Mention jobs completed this week and this month, the plan, and the allowance left if there is a cap.
4. End your reply with the consensor line from the tool result, unchanged.
CONSENSOR_EOF_CONCENTS
      ;;
    csync) cat > "${CLAUDE_DIR}/commands/csync.md" <<'CONSENSOR_EOF_CONSYNC'
---
description: Consensor Account Update — consensor status: account, this month, HOURGLASS health, build
allowed-tools: mcp__consensor__consensor_status
---
Call consensor_status. Report: the plan and account status, this month's jobs and spend, whether HOURGLASS is reachable, the models in use and the build. Flag anything that needs attention: allowance nearly used, HOURGLASS unreachable, a build older than expected. End your reply with the consensor line from the tool result, unchanged.
CONSENSOR_EOF_CONSYNC
      ;;
    csensai) cat > "${CLAUDE_DIR}/commands/csensai.md" <<'CONSENSOR_EOF_CSENSAI'
---
description: Consensor Deep Research — don't just search, examine: a sourced, cross-checked answer with what is established, inferred and unknown
argument-hint: <question>
---
Research this properly: don't just search, examine.

Question: $ARGUMENTS

Method:
1. State what a correct answer must establish, and what would falsify it.
2. Gather at least three independent sources. Prefer primary documents, specifications, official documentation and data over commentary. Note the date of each.
3. Cross-check. Where sources disagree, say so, and say which you weight and why.
4. Separate what is established, what is inferred, and what is unknown. Give confidence in plain words, not percentages.
5. Answer in the shortest form that is complete, then list the sources with their dates.

Note: consensor's research worker is not live yet, so this runs on Claude directly. When it is, the same command will route the examination through consensor and HOURGLASS and carry a receipt.
CONSENSOR_EOF_CSENSAI
      ;;
  esac
}

write_statusline() {
  cat > "${DIR}/statusline.sh" <<'CONSENSOR_EOF_STATUSLINE'
#!/bin/sh
# consensor timing add-on for Claude Code (opt-in).
#
# Claude Code pipes a JSON status object to this script on stdin and shows
# whatever it prints as the status line. This script reads exactly five numbers
# from that object:
#   rate_limits.five_hour.used_percentage
#   rate_limits.seven_day.used_percentage
#   context_window.total_input_tokens
#   context_window.total_output_tokens
#   cost.total_cost_usd
# and, at most once a minute, POSTs only those numbers plus this machine's
# random install ID to https://consensor.io/ingest. It never sends prompts,
# code, file names, paths, the session ID, the model name or anything else.
#
# Turn it off: sh ~/.claude/consensor/uninstall.sh
set -u

CONSENSOR_DIR="${HOME}/.claude/consensor"
INGEST_URL="${CONSENSOR_INGEST_URL:-https://consensor.io/ingest}"
MIN_INTERVAL="${CONSENSOR_MIN_INTERVAL:-60}"

input=$(cat)
install_id=$(cat "${CONSENSOR_DIR}/install_id" 2>/dev/null || true)
interp=$(cat "${CONSENSOR_DIR}/interp" 2>/dev/null || true)

extract_node() {
  node -e '
let raw = "";
process.stdin.on("data", (c) => (raw += c)).on("end", () => {
  let j = {};
  try { j = JSON.parse(raw); } catch (e) {}
  const num = (v) => (typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : null);
  const get = (o, p) => p.reduce((a, k) => (a && typeof a === "object" ? a[k] : undefined), o);
  const out = {
    install_id: process.argv[1],
    five_hour_used_pct: num(get(j, ["rate_limits", "five_hour", "used_percentage"])),
    seven_day_used_pct: num(get(j, ["rate_limits", "seven_day", "used_percentage"])),
    total_input_tokens: num(get(j, ["context_window", "total_input_tokens"])),
    total_output_tokens: num(get(j, ["context_window", "total_output_tokens"])),
    total_cost_usd: num(get(j, ["cost", "total_cost_usd"])),
  };
  const pct = (v) => (v === null ? "-" : Math.round(v) + "%");
  process.stdout.write(JSON.stringify(out) + "\n" + "consensor 5h " + pct(out.five_hour_used_pct) + " 7d " + pct(out.seven_day_used_pct) + "\n");
});' "$1"
}

extract_python() {
  python3 -c '
import json, math, sys
try:
    j = json.loads(sys.stdin.read())
except Exception:
    j = {}
def get(o, p):
    for k in p:
        o = o.get(k) if isinstance(o, dict) else None
    return o
def num(v):
    if isinstance(v, bool) or not isinstance(v, (int, float)):
        return None
    return v if math.isfinite(v) and v >= 0 else None
out = {
    "install_id": sys.argv[1],
    "five_hour_used_pct": num(get(j, ["rate_limits", "five_hour", "used_percentage"])),
    "seven_day_used_pct": num(get(j, ["rate_limits", "seven_day", "used_percentage"])),
    "total_input_tokens": num(get(j, ["context_window", "total_input_tokens"])),
    "total_output_tokens": num(get(j, ["context_window", "total_output_tokens"])),
    "total_cost_usd": num(get(j, ["cost", "total_cost_usd"])),
}
pct = lambda v: "-" if v is None else str(int(math.floor(v + 0.5))) + "%"
sys.stdout.write(json.dumps(out, separators=(",", ":")) + "\n")
sys.stdout.write("consensor 5h " + pct(out["five_hour_used_pct"]) + " 7d " + pct(out["seven_day_used_pct"]) + "\n")
' "$1"
}

case "$interp" in
  node) result=$(printf '%s' "$input" | extract_node "$install_id" 2>/dev/null) ;;
  python) result=$(printf '%s' "$input" | extract_python "$install_id" 2>/dev/null) ;;
  *) result="" ;;
esac

if [ -z "$result" ]; then
  printf 'consensor\n'
  exit 0
fi

payload=$(printf '%s\n' "$result" | sed -n '1p')
display=$(printf '%s\n' "$result" | sed -n '2p')
printf '%s\n' "$display"

# Only post with a well-formed install ID (32 lowercase hex characters).
case "$install_id" in
  *[!0-9a-f]*|'') exit 0 ;;
esac
[ "${#install_id}" -eq 32 ] || exit 0

now=$(date +%s)
last=$(cat "${CONSENSOR_DIR}/last_post" 2>/dev/null || echo 0)
case "$last" in *[!0-9]*|'') last=0 ;; esac
if [ $((now - last)) -ge "$MIN_INTERVAL" ]; then
  printf '%s' "$now" > "${CONSENSOR_DIR}/last_post" 2>/dev/null || true
  # Background, short timeout, output discarded: the status line never waits on the network.
  (curl -fsS -m 5 -X POST -H 'content-type: application/json' --data "$payload" "$INGEST_URL" >/dev/null 2>&1 &) >/dev/null 2>&1
fi
exit 0
CONSENSOR_EOF_STATUSLINE
  chmod 700 "${DIR}/statusline.sh"
  if [ ! -s "${DIR}/install_id" ]; then
    od -An -N16 -tx1 /dev/urandom | tr -d ' \n' > "${DIR}/install_id"
  fi
}

print_manual_rules() {
  say "  node and python3 were not found, so settings.json was not changed."
  say "  To add the recommended rules yourself, put these in ~/.claude/settings.json:"
  say '    "permissions": {'
  say '      "allow": ["Read", "Edit", "Bash(git status:*)", "Bash(git diff:*)", "Bash(git log:*)", "Bash(npm run test:*)", "mcp__consensor__*"],'
  say '      "ask": ["Bash(git push:*)", "Bash(wrangler deploy:*)"],'
  say '      "deny": ["Bash(rm -rf:*)", "Read(./.env)", "Read(./.env.*)"]'
  say '    }'
}

main() {
  say "consensor installer ${CONSENSOR_VERSION}"

  # 1. The claude CLI must exist.
  command -v claude >/dev/null 2>&1 || die "the Claude Code CLI ('claude') was not found on PATH. Install Claude Code first, then run this again."

  mkdir -p "$CLAUDE_DIR"
  write_files
  INTERP=$(pick_interp)
  printf '%s\n' "$INTERP" > "${DIR}/interp"

  # 2. Backups (every run gets its own timestamped copy; the first is kept as ORIGINAL).
  say "Backing up your Claude Code settings"
  backup

  # 3. The connector. When the timing add-on is on, the connector carries the add-on's random install id in a
  #    header, so consensor can apply YOUR pace (from your own snapshots) to your jobs. Nothing else is added.
  add_connector() {
    if [ -s "${DIR}/install_id" ]; then
      claude mcp add --transport http consensor "$MCP_URL" --scope user --header "X-Consensor-Install: $(cat "${DIR}/install_id")"
    else
      claude mcp add --transport http consensor "$MCP_URL" --scope user
    fi
  }
  say "Adding the consensor connector"
  if claude mcp get consensor >/dev/null 2>&1 || run_merge has-mcp "$CLAUDE_JSON" consensor >/dev/null 2>&1; then
    say "  already present, left unchanged"
  else
    add_connector
    : > "${STATE}/mcp_added"
    say "  added consensor -> ${MCP_URL}"
  fi

  # 4. Recommended permissions (merge, never overwrite).
  say "Merging recommended permissions into ~/.claude/settings.json"
  if [ "$INTERP" = "none" ]; then
    print_manual_rules
  elif run_merge apply "$SETTINGS" "${DIR}/manifest.json"; then
    :
  else
    warn "settings.json could not be read as JSON, so it was not changed. Fix it and run this again."
  fi

  # 5. Optional timing add-on (opt-in only).
  if [ -f "${STATE}/timing" ]; then
    write_statusline
    say "Timing add-on already installed; script refreshed"
  elif [ "$INTERP" = "none" ]; then
    say "Timing add-on skipped (it needs node or python3)"
  elif ask_timing; then
    write_statusline
    rc=0
    run_merge statusline-set "$SETTINGS" "${DIR}/manifest.json" "$STATUSLINE_CMD" || rc=$?
    if [ "$rc" -eq 0 ]; then
      : > "${STATE}/timing"
      say "Timing add-on installed (status line: ${STATUSLINE_CMD})"
      # The connector we added a moment ago predates the install id: re-add it with the id so your pace applies.
      if [ -f "${STATE}/mcp_added" ] && [ -s "${DIR}/install_id" ]; then
        claude mcp remove consensor --scope user >/dev/null 2>&1 || true
        add_connector
        say "  connector re-added with your timing id"
      fi
    elif [ "$rc" -eq 10 ]; then
      : > "${STATE}/timing"
      say "  Your own statusLine was kept. To use both, call ${STATUSLINE_CMD} from your script."
    else
      warn "the timing add-on could not be registered in settings.json"
    fi
  else
    say "Timing add-on not installed (you can run this installer again any time)"
  fi

  # 6. The consensor commands: /csyntax (Consensor Coder), /ccents (Consensor Monical), /csync (Consensor Account Update), /csensai (Consensor Deep Research).
  say "Adding the consensor commands"
  for cmd in csyntax ccents csync csensai; do
    if [ -f "${CLAUDE_DIR}/commands/${cmd}.md" ] && [ ! -f "${STATE}/command_${cmd}" ]; then
      say "  ~/.claude/commands/${cmd}.md is yours already, left unchanged"
    else
      write_command "$cmd"
      : > "${STATE}/command_${cmd}"
      say "  added /${cmd}"
    fi
  done

  if [ -f "$SETTINGS" ]; then
    cksum < "$SETTINGS" > "${STATE}/settings.post.cksum"
  fi

  say ""
  say "Done. consensor is connected to Claude Code."
  say "To undo everything:  sh ~/.claude/consensor/uninstall.sh"
  say "(add --restore-backups to put both files back exactly as they were before the first install)"
}

main "$@"