setup.sh

#!/usr/bin/env bash
set -euo pipefail

GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
BLUE='\033[0;34m'
NC='\033[0m'

ok()   { echo -e "${GREEN}✓${NC} $*"; }
warn() { echo -e "${YELLOW}!${NC} $*"; }
fail() { echo -e "${RED}✗${NC} $*"; }
info() { echo -e "  $*"; }
step() { echo -e "\n${BLUE}$*${NC}"; }

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
MODE="${1:-setup}"
OPEN_SETTINGS=false
INSTALL_OMNIPARSER=false
START_OMNIPARSER=false

for arg in "$@"; do
  case "$arg" in
    --doctor) MODE="doctor" ;;
    --open-settings) OPEN_SETTINGS=true ;;
    --install-omniparser) INSTALL_OMNIPARSER=true ;;
    --start-omniparser) START_OMNIPARSER=true ;;
    --help|-h)
      cat <<EOF
MacWright setup and permission doctor

Usage:
  ./setup.sh                         Install deps, build, run permission checks
  ./setup.sh --doctor                Run checks only; do not install/build
  ./setup.sh --open-settings         Open relevant macOS Privacy settings panes
  ./setup.sh --install-omniparser    Also run omniparser/setup.sh
  ./setup.sh --start-omniparser      Start OmniParser after setup/checks

Important:
  macOS permissions cannot be silently bypassed by scripts. You must manually
  approve Accessibility, Screen Recording, and app-specific Automation prompts.
  This script preflights, opens the right panes, and verifies readiness.
EOF
      exit 0
      ;;
  esac
done

open_privacy_pane() {
  local pane="$1"
  open "x-apple.systempreferences:com.apple.preference.security?$pane" >/dev/null 2>&1 || true
}

find_cmd() {
  local cmd="$1"
  if command -v "$cmd" >/dev/null 2>&1; then
    command -v "$cmd"
    return 0
  fi
  case "$cmd" in
    brew)
      for candidate in /opt/homebrew/bin/brew /usr/local/bin/brew; do
        if [ -x "$candidate" ]; then
          echo "$candidate"
          return 0
        fi
      done
      ;;
    cliclick)
      for candidate in /opt/homebrew/bin/cliclick /usr/local/bin/cliclick; do
        if [ -x "$candidate" ]; then
          echo "$candidate"
          return 0
        fi
      done
      ;;
  esac
  return 1
}

check_command() {
  local cmd="$1"
  local path
  if path="$(find_cmd "$cmd")"; then
    ok "$cmd found: $path"
    return 0
  fi
  fail "$cmd not found"
  return 1
}

check_accessibility() {
  # This asks System Events for process names. If the controlling terminal/app is
  # not approved under Accessibility, macOS returns an Apple Events/TCC error.
  if osascript -e 'tell application "System Events" to get name of first process' >/dev/null 2>&1; then
    ok "Accessibility permission works for this controlling app"
    return 0
  fi
  fail "Accessibility permission is missing for this controlling app"
  info "Required for: mouse, keyboard, scroll, drag, AX read/click, window control."
  info "Grant the app that launches MacWright: Terminal/iTerm/Ghostty/Claude Desktop/Hermes runner."
  return 1
}

check_screen_recording() {
  # screencapture may still create a file when permission is denied, but on modern
  # macOS it usually fails or captures unusable blank/desktop-only output. This is
  # a practical smoke check, not a private TCC database inspection.
  local tmp
  tmp="$(mktemp -t macwright-screen.XXXXXX).jpg"
  if /usr/sbin/screencapture -x -t jpg "$tmp" >/dev/null 2>&1 && [ -s "$tmp" ]; then
    ok "Screen capture command works"
    rm -f "$tmp"
    return 0
  fi
  rm -f "$tmp"
  fail "Screen Recording permission appears missing or screencapture failed"
  info "Required for: screenshot, screen_parse, visual verification, wait_for_change."
  info "Grant the app that launches MacWright under Screen Recording."
  return 1
}

check_mouse_keyboard() {
  local cliclick_bin
  if ! cliclick_bin="$(find_cmd cliclick)"; then
    fail "cliclick missing; mouse/keyboard primitives unavailable"
    info "Install with: brew install cliclick"
    return 1
  fi
  if "$cliclick_bin" p: >/dev/null 2>&1; then
    ok "cliclick can read mouse position: $cliclick_bin"
    return 0
  fi
  fail "cliclick failed; Accessibility permission is likely missing"
  return 1
}

check_node_build() {
  if [ ! -f "$SCRIPT_DIR/dist/index.js" ]; then
    fail "dist/index.js missing; run ./setup.sh to build"
    return 1
  fi
  ok "MacWright build artifact exists: $SCRIPT_DIR/dist/index.js"
}

check_omniparser() {
  if curl -fsS --max-time 2 http://127.0.0.1:8650/health >/dev/null 2>&1; then
    ok "OmniParser is running on http://127.0.0.1:8650"
    return 0
  fi
  warn "OmniParser is not running"
  info "Required only for: screen_parse visual UI detection."
  info "Start with: npm run omniparser:start"
  return 1
}

check_safari() {
  local dev=false
  if defaults read com.apple.Safari IncludeDevelopMenu 2>/dev/null | grep -q 1; then
    dev=true
  fi
  if [ "$dev" = true ]; then
    ok "Safari Develop menu is enabled"
  else
    warn "Safari Develop menu is not enabled"
    info "Optional. Needed for safari_js tools. Enable Safari > Settings > Advanced > Show features for web developers."
  fi
  info "Safari JavaScript from Apple Events still must be enabled manually: Safari > Develop > Allow JavaScript from Apple Events."
}

run_validation() {
  local failures=0

  step "Permission and capability checks"
  check_accessibility || failures=$((failures + 1))
  check_screen_recording || failures=$((failures + 1))
  check_mouse_keyboard || failures=$((failures + 1))
  check_node_build || failures=$((failures + 1))
  check_omniparser || true
  check_safari || true

  step "MacWright native MCP smoke test"
  if npm run test:macos-smoke; then
    ok "Native MCP smoke test passed"
  else
    failures=$((failures + 1))
    fail "Native MCP smoke test failed"
  fi

  if [ "$OPEN_SETTINGS" = true ] || [ "$failures" -gt 0 ]; then
    step "Opening macOS Privacy panes"
    info "You must manually enable permissions; scripts cannot silently grant them."
    info "After changing permissions, restart the controlling app before re-running ./setup.sh --doctor."
    open_privacy_pane Privacy_Accessibility
    open_privacy_pane Privacy_ScreenCapture
    open_privacy_pane Privacy_ListenEvent
    open_privacy_pane Privacy_Automation
  fi

  return "$failures"
}

cat <<'EOF'

MacWright Setup / Doctor
========================

macOS permissions cannot be bypassed silently. This script installs dependencies,
builds MacWright, opens the right Privacy panes when needed, and verifies whether
the current controlling app can actually automate the desktop.

EOF

cd "$SCRIPT_DIR"

if [ "$MODE" != "doctor" ]; then
  step "Dependency setup"
  cliclick_bin=""
  if cliclick_bin="$(find_cmd cliclick)"; then
    ok "cliclick is installed: $cliclick_bin"
  else
    warn "cliclick not found; installing via Homebrew"
    brew_bin=""
    if ! brew_bin="$(find_cmd brew)"; then
      fail "Homebrew not found. Install it first: https://brew.sh"
      exit 1
    fi
    "$brew_bin" install cliclick
    if cliclick_bin="$(find_cmd cliclick)"; then
      ok "cliclick installed: $cliclick_bin"
    else
      fail "cliclick install completed but binary was not found in PATH, /opt/homebrew/bin, or /usr/local/bin"
      exit 1
    fi
  fi

  if ! command -v node >/dev/null 2>&1; then
    fail "node is missing. Install Node.js >= 18 before continuing."
    exit 1
  fi
  ok "node $(node --version)"

  step "Install and build"
  npm install --silent
  npm run build
  ok "Build complete"
fi

if [ "$INSTALL_OMNIPARSER" = true ]; then
  step "OmniParser setup"
  if [ -x "$SCRIPT_DIR/omniparser/setup.sh" ]; then
    (cd "$SCRIPT_DIR/omniparser" && ./setup.sh)
    ok "OmniParser setup finished"
  else
    fail "omniparser/setup.sh not found or not executable"
  fi
fi

if [ "$START_OMNIPARSER" = true ]; then
  step "Starting OmniParser"
  npm run omniparser:start || warn "OmniParser start command returned non-zero"
fi

if run_validation; then
  step "Result"
  ok "MacWright is ready for native desktop automation from this controlling app."
else
  step "Result"
  warn "MacWright setup is incomplete. Grant the missing permissions, restart the controlling app, then run: ./setup.sh --doctor"
fi

step "MCP configuration"
cat <<JSON
Claude Desktop / generic MCP clients:
{
  "mcpServers": {
    "macwright": {
      "command": "node",
      "args": ["${SCRIPT_DIR}/dist/index.js"]
    }
  }
}

Hermes Agent (~/.hermes/config.yaml):
mcp_servers:
  macwright:
    command: "node"
    args: ["${SCRIPT_DIR}/dist/index.js"]
    timeout: 120
    connect_timeout: 30
JSON

echo ""