install.sh

#!/usr/bin/env bash
# dev-team installer (Linux/macOS) — prerequisite checker + optional config apply.
# The agentic dev team is all-cloud: no local model backend to install. It needs
# OMP + git; a few skills optionally use gh / semgrep / docker / python3.
# Flags: --apply-config (append config.snippet.yml), --no-update (no-op), -y.
set -euo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
APPLY=0; INSECURE_TLS=0
for a in "$@"; do case "$a" in
  --apply-config) APPLY=1 ;; --no-update) ;; -y|--yes) ;; --insecure-tls) INSECURE_TLS=1 ;; --ca-file=*) CA_FILE="${a#*=}" ;;
  -h|--help) sed -n '2,6p' "$0"; exit 0 ;;
  *) echo "unknown arg: $a" >&2; exit 2 ;;
esac; done

say()  { printf '\n\033[1m==> %s\033[0m\n' "$*"; }
ok()   { printf '\033[32m  ok\033[0m %s\n' "$*"; }
warn() { printf '\033[33m  ! %s\033[0m\n' "$*" >&2; }
have() { command -v "$1" >/dev/null 2>&1; }
run()  { eval "$@"; }
# Corporate TLS-intercepting proxy (Zscaler / Trend Micro under WSL): opt-in
# bypass of cert verification for curl/wget (incl. piped installers), git, node/bun.
enable_insecure_tls() {
  warn "Insecure TLS: certificate verification DISABLED for this run (corporate MITM proxy)."
  export GIT_SSL_NO_VERIFY=true NODE_TLS_REJECT_UNAUTHORIZED=0 NPM_CONFIG_STRICT_SSL=false \
         RUSTUP_USE_CURL=1 CARGO_HTTP_CHECK_REVOKE=false OMP_INSECURE_TLS=1
  local d; d="$(mktemp -d 2>/dev/null || echo "/tmp/omp-tls.$$")"; mkdir -p "$d"
  printf 'insecure\n' > "$d/.curlrc"; printf 'check_certificate = off\n' > "$d/.wgetrc"
  export CURL_HOME="$d" WGETRC="$d/.wgetrc"
}
{ [ "${INSECURE_TLS:-0}" = 1 ] || [ -n "${OMP_INSECURE_TLS:-}" ]; } && enable_insecure_tls
# Corporate root CA (optional): trust a custom CA this run (node/bun/git/curl/Go).
CA_FILE="${CA_FILE:-${OMP_CA_FILE:-}}"
if [ -n "$CA_FILE" ] && [ -f "$CA_FILE" ]; then
  export OMP_CA_FILE="$CA_FILE" NODE_EXTRA_CA_CERTS="$CA_FILE" SSL_CERT_FILE="$CA_FILE" CURL_CA_BUNDLE="$CA_FILE" GIT_SSL_CAINFO="$CA_FILE" REQUESTS_CA_BUNDLE="$CA_FILE"
  warn "Trusting corporate CA: $CA_FILE"
fi

# --- Required: OMP ----------------------------------------------------------
if have omp; then ok "omp ($(omp --version 2>/dev/null | head -1))"
else
  say "Installing latest OMP"
  run "curl -fsSL https://omp.sh/install | sh"
fi

# --- Required: git ----------------------------------------------------------
say "Checking prerequisites"
if have git; then ok "git ($(git --version | awk '{print $3}'))"; else warn "git missing — required for branch-workflow / /pr"; fi

# --- Optional tools used by some skills -------------------------------------
for t in gh semgrep docker python3; do
  if have "$t"; then ok "$t (optional)"; else warn "$t not found (optional — used by some skills)"; fi
done

# --- Optionally apply the config snippet ------------------------------------
CFG="$HOME/.omp/agent/config.yml"
if [ "$APPLY" = 1 ]; then
  say "Appending config.snippet.yml to $CFG"
  mkdir -p "$(dirname "$CFG")"; touch "$CFG"
  if grep -q "dev-team —" "$CFG" 2>/dev/null; then echo "  (already present — skipping)"
  else { echo ""; cat "$HERE/config.snippet.yml"; } >> "$CFG"; echo "  appended."; fi
fi

# --- Load the guard/routing extensions --------------------------------------
# OMP does NOT load extension modules (package.json `omp.extensions`) from
# marketplace cache installs, so the blocking guards + model-routing would
# otherwise never run. Mirror them into OMP's native user-extension dir.
if [ -d "$HERE/extensions" ]; then
  DEST="$HOME/.omp/agent/extensions/dev-team"
  rm -rf "$DEST"; mkdir -p "$DEST"; cp -R "$HERE/extensions" "$DEST/"
  [ -f "$HERE/package.json" ] && cp "$HERE/package.json" "$DEST/"
  say "guards + model-routing loaded into $DEST"
fi

say "dev-team ready. Restart omp, then drive the workflow: /specs -> /plan -> /build -> /pr."