bootstrap.sh

#!/usr/bin/env bash
# My-Utils Bootstrap - One-click dev environment setup
# Supports Linux + macOS.
#
# Usage:
#   ./bootstrap.sh --help
#   ./bootstrap.sh --yes
#   ./bootstrap.sh --new-mac --yes
#   ./bootstrap.sh --new-linux --yes
#   ./bootstrap.sh --force --yes
#   ./bootstrap.sh --tools packages --optional --yes
#   ./bootstrap.sh --tools hexo --yes
#   ./bootstrap.sh --tools env --yes
# Prefer the unified CLI: ./myu help

set -e
MY_UTILS_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
export MY_UTILS_ROOT
COMMON="$MY_UTILS_ROOT/common"

YES_MODE=false
FORCE_MODE=false
NEW_MAC=false
NEW_LINUX=false
OPTIONAL_BREW=false
SELECTED_TOOLS=()

STAMP_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/my-utils/bootstrap"

# Summary buckets (space-separated names)
SUMMARY_RAN=""
SUMMARY_SKIP_STAMP=""
SUMMARY_SKIP_DECLINE=""
SUMMARY_FAIL=""

usage() {
  cat <<EOF
My-Utils Bootstrap — one-click dev environment setup (Linux + macOS)

Usage:
  $0 [options]

Options:
  -h, --help              Show this help and exit
  -y, --yes               Run selected tools without prompting
  -f, --force             Ignore tool stamps; reinstall packages / re-link configs
  --new-mac               macOS new-machine init (CLT check + App Store hint + vault)
  --new-linux             Linux new-machine init (sudo/pkg check + vault restore)
  --optional              Also install common/Brewfile.optional (with packages)
  --tools T [T ...]       Run only these tools (default: all except env / hexo)
                          packages | links | misc | vimrc | cursor | env
                          | vault-backup | vault-restore | hexo

Tools:
  packages      Install system packages (apt/yum, or macOS Brewfile / brew)
  links         Symlink configs from link.ini into \$HOME
  misc          Oh My Zsh, fzf, uv, rustup default, brew login PATH, …
  vimrc         Vim plugins (vim-plug)
  cursor        Cursor config backup / symlink into cursor_bak/
  env           Privacy vault restore (alias of vault-restore)
  vault-restore Decrypt privacy/*.enc (prompt SYNC_ENV_KEY, ≥8 chars)
  vault-backup  Encrypt manifest sources → privacy/*.enc
  hexo          Opt-in: Node.js + hexo-cli (\$HOME/.npm-global; not in default set)

Tip: prefer the unified CLI \`./myu\` (see: ./myu help).

Idempotency (two layers + completeness):
  1) Per-tool stamps under \$XDG_STATE_HOME/my-utils/bootstrap/
     packages re-runs when Brewfile (+ optional) hash changes
     links re-runs when common/link.ini hash changes
     Stamp skip only if the tool also verifies as complete
  2) Per-item: already-installed / already-cloned skipped; missing or
     failed items are retried on the next ./myu setup (incremental)

Examples:
  $0 --help
  $0 --new-mac --yes
  $0 --new-linux --yes
  $0 --tools packages --optional --yes
  $0 --tools hexo --yes
  $0 --tools env --yes
  $0 --tools vault-backup --yes
  ./myu setup --new-mac --yes
  ./myu setup --new-linux --yes
  ./myu hexo --yes
  ./myu vault backup
  $0 --force --yes
EOF
}

while [[ $# -gt 0 ]]; do
  case $1 in
    --help|-h) usage; exit 0 ;;
    --yes|-y) YES_MODE=true; shift ;;
    --force|-f) FORCE_MODE=true; shift ;;
    --new-mac) NEW_MAC=true; shift ;;
    --new-linux) NEW_LINUX=true; shift ;;
    --optional) OPTIONAL_BREW=true; shift ;;
    --tools)
      shift
      while [[ $# -gt 0 && ! "$1" =~ ^-- ]]; do
        SELECTED_TOOLS+=("$1")
        shift
      done
      ;;
    *)
      echo "Unknown option: $1" >&2
      echo "" >&2
      usage >&2
      exit 1
      ;;
  esac
done

if [ "$NEW_MAC" = true ] && [ "$NEW_LINUX" = true ]; then
  echo "ERROR: use only one of --new-mac or --new-linux." >&2
  exit 1
fi

# Default one-shot: everything except optional env decrypt
ALL_TOOLS=(packages links misc vimrc cursor)

if [ ${#SELECTED_TOOLS[@]} -eq 0 ]; then
  SELECTED_TOOLS=("${ALL_TOOLS[@]}")
  # New machine: also offer privacy vault restore after links/misc
  if [ "$NEW_MAC" = true ] || [ "$NEW_LINUX" = true ]; then
    SELECTED_TOOLS+=(env)
  fi
fi

if [ "$FORCE_MODE" = true ]; then
  export MY_UTILS_FORCE=1
else
  unset MY_UTILS_FORCE 2>/dev/null || true
fi

if [ "$OPTIONAL_BREW" = true ]; then
  export MY_UTILS_BREW_OPTIONAL=1
else
  unset MY_UTILS_BREW_OPTIONAL 2>/dev/null || true
fi

file_sha256() {
  local f="$1"
  if [ ! -f "$f" ]; then
    echo "none"
    return 0
  fi
  if command -v shasum &>/dev/null; then
    shasum -a 256 "$f" | awk '{print $1}'
  elif command -v sha256sum &>/dev/null; then
    sha256sum "$f" | awk '{print $1}'
  else
    cksum "$f" | awk '{print $1"-"$2}'
  fi
}

stamp_path() {
  echo "$STAMP_DIR/$1.done"
}

packages_manifest_hash() {
  local h opt
  h="$(file_sha256 "$COMMON/Brewfile")"
  if [ "${MY_UTILS_BREW_OPTIONAL:-}" = "1" ] || [ "${MY_UTILS_BREW_OPTIONAL:-}" = "true" ]; then
    opt="$(file_sha256 "$COMMON/Brewfile.optional")"
    echo "${h}+optional:${opt}"
  else
    echo "$h"
  fi
}

links_manifest_hash() {
  file_sha256 "$COMMON/link.ini"
}

tool_stamp_valid() {
  local name="$1"
  local stamp want have
  stamp="$(stamp_path "$name")"
  [ -f "$stamp" ] || return 1
  case "$name" in
    packages)
      want="$(packages_manifest_hash)"
      have="$(grep -E '^brewfile_sha256=' "$stamp" 2>/dev/null | head -1 | cut -d= -f2-)"
      [ -n "$have" ] && [ "$have" = "$want" ]
      return $?
      ;;
    links)
      want="$(links_manifest_hash)"
      have="$(grep -E '^link_ini_sha256=' "$stamp" 2>/dev/null | head -1 | cut -d= -f2-)"
      [ -n "$have" ] && [ "$have" = "$want" ]
      return $?
      ;;
    *)
      return 0
      ;;
  esac
}

write_tool_stamp() {
  local name="$1"
  mkdir -p "$STAMP_DIR"
  {
    echo "ts=$(date +%Y-%m-%dT%H:%M:%S%z)"
    case "$name" in
      packages) echo "brewfile_sha256=$(packages_manifest_hash)" ;;
      links)    echo "link_ini_sha256=$(links_manifest_hash)" ;;
    esac
  } > "$(stamp_path "$name")"
}

# shellcheck source=/dev/null
. "$COMMON/bootstrap_verify.sh"

clear_tool_stamp() {
  rm -f "$(stamp_path "$1")"
}

ensure_macos_new_mac() {
  case "$(uname -s)" in
    Darwin*) ;;
    *)
      echo "ERROR: --new-mac is only supported on macOS (Darwin)." >&2
      exit 1
      ;;
  esac
  echo "New Mac prerequisites:"
  echo "  - Sign in to the Mac App Store (required for Brewfile mas entries)"
  echo "  - Network access for Homebrew / git clones"
  if ! xcode-select -p &>/dev/null; then
    echo "  - Xcode Command Line Tools: not found"
    echo "    Run: xcode-select --install"
    echo "    Then re-run this bootstrap after the installer finishes."
    exit 1
  fi
  echo "  - Xcode Command Line Tools: OK ($(xcode-select -p))"
  echo ""
}

ensure_linux_new_machine() {
  case "$(uname -s)" in
    Linux*) ;;
    *)
      echo "ERROR: --new-linux is only supported on Linux." >&2
      exit 1
      ;;
  esac
  echo "New Linux prerequisites:"
  echo "  - sudo for apt/dnf/yum (packages step; set MY_UTILS_ALLOW_SUDO=off to skip)"
  echo "  - Network access for git clones / uv / npm"
  if command -v apt-get &>/dev/null || command -v dnf &>/dev/null || command -v yum &>/dev/null; then
    echo "  - Package manager: OK"
  else
    echo "  - WARN: no apt/dnf/yum detected; packages step may fail"
  fi
  if [ "$(id -u)" -eq 0 ]; then
    echo "  - WARN: running as root; prefer a normal user + sudo"
  fi
  echo ""
}

run_tool() {
  local name="$1"
  case "$name" in
    packages)      "$COMMON/install_packages.sh" ;;
    links)         "$COMMON/create_links.sh" ;;
    misc)          "$COMMON/run_misc.sh" ;;
    vimrc)         "$COMMON/install_vim_plugins.sh" ;;
    cursor)        "$COMMON/cursor_config_link.sh" ;;
    hexo)          "$COMMON/run_hexo.sh" ;;
    env|vault-restore)
      # On failure, run_env_sync still stubs config/env.rc and refreshes links.
      if ! MY_UTILS_VAULT_ACTION=restore "$COMMON/run_env_sync.sh" restore; then
        echo "  WARN: vault restore reported errors; env.rc stub + links should already be applied"
      fi
      # Idempotent refresh (covers older run_env_sync without built-in links).
      "$COMMON/create_links.sh"
      ;;
    vault-backup)
      MY_UTILS_VAULT_ACTION=backup "$COMMON/run_env_sync.sh" backup
      ;;
    *)
      echo "Unknown tool: $name"
      return 1
      ;;
  esac
}

confirm() {
  if [ "$YES_MODE" = true ]; then
    return 0
  fi
  echo -n "$1 [y/N] "
  read -r r
  [[ "$r" =~ ^[yY] ]]
}

summary_add() {
  local bucket="$1" item="$2"
  case "$bucket" in
    ran) SUMMARY_RAN="$SUMMARY_RAN $item" ;;
    stamp) SUMMARY_SKIP_STAMP="$SUMMARY_SKIP_STAMP $item" ;;
    decline) SUMMARY_SKIP_DECLINE="$SUMMARY_SKIP_DECLINE $item" ;;
    fail) SUMMARY_FAIL="$SUMMARY_FAIL $item" ;;
  esac
}

print_summary() {
  echo ""
  echo "=== Bootstrap summary ==="
  echo "  Ran:              ${SUMMARY_RAN:- (none)}"
  echo "  Skipped (stamp):  ${SUMMARY_SKIP_STAMP:- (none)}"
  echo "  Skipped (decline):${SUMMARY_SKIP_DECLINE:- (none)}"
  echo "  Failed:           ${SUMMARY_FAIL:- (none)}"
  if [ -n "${SUMMARY_FAIL// }" ]; then
    echo "  Tip: re-run the same command (incremental retry), or:"
    echo "       ./bootstrap.sh --tools${SUMMARY_FAIL} --yes"
    echo "       ./myu setup --new-linux --yes   # or --new-mac"
  fi
  case "$(uname -s)" in
    Darwin*)
      echo "  Optional apps: ./bootstrap.sh --tools packages --optional --yes"
      echo "             or: brew bundle --file=$COMMON/Brewfile.optional"
      ;;
  esac
  echo "  Secrets vault:    ./myu vault restore     # or: ./bootstrap.sh --tools env"
  echo "  Vault backup:     ./myu vault backup"
  echo "  Hexo blog:        ./myu hexo --yes        # or: ./bootstrap.sh --tools hexo --yes"
  echo "  Reload shell:     exec \$SHELL"
}

if [ "$NEW_MAC" = true ]; then
  ensure_macos_new_mac
fi
if [ "$NEW_LINUX" = true ]; then
  ensure_linux_new_machine
fi

echo "=== My-Utils Bootstrap ==="
echo "Root: $MY_UTILS_ROOT"
echo "Tools: ${SELECTED_TOOLS[*]}"
[ "$FORCE_MODE" = true ] && echo "Mode: force (ignore stamps; reinstall/re-link)"
[ "$NEW_MAC" = true ] && echo "Mode: new-mac"
[ "$NEW_LINUX" = true ] && echo "Mode: new-linux"
[ "$OPTIONAL_BREW" = true ] && echo "Mode: optional Brewfile"
echo "Stamps: $STAMP_DIR"
echo ""

for tool in "${SELECTED_TOOLS[@]}"; do
  if ! confirm "Run $tool?"; then
    echo "  Skip $tool (declined)"
    summary_add decline "$tool"
    continue
  fi
  if [ "$FORCE_MODE" != true ] && tool_stamp_valid "$tool"; then
    if tool_is_complete "$tool"; then
      echo "  Skip $tool (stamp ok + complete; use --force to re-run)"
      summary_add stamp "$tool"
      continue
    fi
    echo "  Re-run $tool (stamp present but incomplete — incremental retry)"
    clear_tool_stamp "$tool"
  fi
  if run_tool "$tool"; then
    if tool_is_complete "$tool"; then
      write_tool_stamp "$tool"
      summary_add ran "$tool"
    else
      echo "  WARN: $tool finished but still incomplete; stamp not written (retry next run)"
      clear_tool_stamp "$tool"
      summary_add fail "$tool"
    fi
  else
    echo "  WARN: $tool failed; stamp not written (will retry on next run)"
    clear_tool_stamp "$tool"
    summary_add fail "$tool"
  fi
done

print_summary
echo ""
echo "=== Bootstrap complete ==="