install-git-commit-ai.sh

#!/usr/bin/env bash
#
# Sets up AI-generated git commit messages with mittwald AI: installs cmai,
# configures it and installs a prepare-commit-msg hook into the git template
# directory.
#
# Runs with bash 3.2 or later on Linux, macOS and Windows (Git Bash).
#
# Everything runs from main() at the end of the file, so that a partially
# downloaded script (curl | bash) does nothing.

set -euo pipefail

# cmai is third-party code. The installer downloads the latest version, checks
# the script for unexpected content (see cmai_script_findings) and installs the
# script itself. No downloaded code runs during the installation.
# CMAI_REPO, CMAI_BIN_DIR and CMAI_KEYCHAIN_ENTRY can be set in the
# environment. The tests use them to stay inside a sandbox.
CMAI_REPO="${CMAI_REPO:-https://github.com/mrgoonie/cmai.git}"
CMAI_INSTALL_DIR="${HOME}/git-commit-ai"
# Options that this installer and the hook need. Older cmai versions lack them.
CMAI_REQUIRED_OPTIONS=(--message-only --print-config --use-custom --clear-model-options --max-output-tokens --extra-body)
CMAI_CONFIG_DIR="${HOME}/.config/git-commit-ai"
# On Linux and macOS, the hook lives here once. The template directory and the
# repositories link to it, so that an update of the hook reaches all of them.
# `git init` and `git clone` copy the link from the template directory.
HOOK_SOURCE="${CMAI_INSTALL_DIR}/prepare-commit-msg"
# How deep the installer looks for repositories below a directory of --repos.
REPO_SEARCH_DEPTH=5

# The system keychain keeps the API key if a keychain exists and the installed
# cmai takes the key from the environment variable CMAI_API_KEY. The hook finds
# the name of the keychain entry in KEYCHAIN_FILE. Without a keychain, the key
# stays in the key file of cmai, which only the user can read.
KEYCHAIN_ENTRY="${CMAI_KEYCHAIN_ENTRY:-git-commit-ai}"
KEYCHAIN_ACCOUNT='api-key'
KEYCHAIN_LABEL='mittwald AI API key (git-commit-ai)'
KEYCHAIN_FILE="${CMAI_CONFIG_DIR}/keychain"

# Hosts that the cmai script names today. Another host is a finding.
CMAI_KNOWN_HOSTS=' openrouter.ai localhost 127.0.0.1 github.com my-api.com '
# Constructs that cmai has no need for, as "description|extended regex".
WORD_START='(^|[^[:alnum:]_.-])'
WORD_END='([^[:alnum:]_-]|$)'
CMAI_UNEXPECTED_PATTERNS=(
  "runs generated code (eval)|${WORD_START}eval${WORD_END}"
  "decodes hidden data|${WORD_START}(base64|xxd|uudecode|openssl)${WORD_END}"
  "opens a raw network connection|/dev/(tcp|udp)/"
  "starts a tool that cmai does not need|${WORD_START}(sudo|wget|nc|ncat|netcat|socat|ssh|scp|sftp|telnet|python[0-9.]*|perl|ruby|php|crontab|nohup|setsid|disown|chattr|mkfifo)${WORD_END}"
  "pipes data into a shell|\\|[[:space:]]*(ba|z|da)?sh${WORD_END}"
  "runs a command string in a shell|${WORD_START}(ba|z|da)?sh[[:space:]]+-c${WORD_END}"
  "loads another script|${WORD_START}source[[:space:]]"
  "names a sensitive file|\\.ssh|authorized_keys|\\.gnupg|\\.aws|\\.netrc|\\.git-credentials|_history|\\.bashrc|\\.bash_profile|\\.profile|\\.zshrc|/etc/(passwd|shadow)|/proc/"
  "changes the git configuration|${WORD_START}git[[:space:]]+(config|remote)${WORD_END}|credential"
  "deletes directories|${WORD_START}rm[[:space:]]+-[[:alpha:]]*[rR]"
  "contains encoded text|\\\\x[0-9a-fA-F]{2}|\\\\[0-7]{3}"
  "starts a background process|[^&]&[[:space:]]*\$"
)

AI_BASE_URL='https://llm.aihosting.mittwald.de/v1'
AI_MODEL='Qwen3.8-27B-NVFP4'
AI_MAX_OUTPUT_TOKENS=32768
AI_EXTRA_BODY='{"chat_template_kwargs":{"enable_thinking":false}}'

# Every hook written by this installer contains one of these two texts.
HOOK_SIGNATURE='Installed by install-git-commit-ai.sh'
HOOK_SIGNATURE_OLD='cmai --message-only'

hook_content() {
  cat <<'HOOK_EOF'
#!/usr/bin/env bash
#
# prepare-commit-msg hook: puts a commit message generated by cmai at the top
# of the message that git opens in the editor.
# Installed by install-git-commit-ai.sh (https://github.com/mittwald/ai-developer-tools).
#
# The hook never blocks a commit. If the generation fails, the hook reports the
# reason and git opens the editor without a generated message.
#
# Runs with bash 3.2 or later on Linux, macOS and Windows (Git for Windows).

MSG_FILE="${1:-}"
SOURCE="${2:-}"   # empty for a plain `git commit`; else message, template, merge, squash or commit

MAX_ATTEMPTS=3
TIMEOUT_SECONDS=30            # limit of the first attempt
TIMEOUT_INCREASE_PERCENT=50   # growth of the limit after each timeout: 30s, 45s, 68s
KILL_AFTER_SECONDS=2          # time for cmai to stop before the hook kills it
KEYCHAIN_SECONDS=10           # limit for reading the API key from the system keychain

# The installer writes the name of the keychain entry to this file when it
# stores the API key in the system keychain.
KEYCHAIN_FILE="${HOME}/.config/git-commit-ai/keychain"
KEYCHAIN_ACCOUNT='api-key'

case "${SOURCE}" in
  message|merge|squash|template|commit) exit 0 ;;
esac
[ -n "${MSG_FILE}" ] || exit 0

# Status texts with a remark, as "text|remark". While cmai runs, the line
# shows "1/3 <text>...". When cmai is done, it becomes "<text>... <remark>".
# ASCII only, no line longer than 72 (text and remark together).
MESSAGES=(
  'Asking the diff what it did this time|It confessed.'
  'Translating your changes into human|Fluent now.'
  'Teaching the model to say "fix" politely|Manners acquired.'
  'Squinting at your staged changes|Eyes adjusted.'
  'Pretending this was the plan all along|Nobody suspects a thing.'
  'Turning chaos into Conventional Commits|Order restored!'
  'Finding a nicer word for "oops"|Found one.'
  'Counting the files you swear you never touched|Your secret is safe.'
  'Blaming the previous commit|Case closed.'
  'Resisting the urge to write "misc changes"|Resisted!'
  'Consulting the commit message oracle|The oracle has spoken.'
  'Reading your diff so the reviewers can skim it|Skimmable now.'
  'Making "wip" sound professional|Very professional.'
  'Flipping a coin between feat and fix|It landed.'
  'Brewing a fresh subject line|Served hot!'
  'Squeezing three hours into seventy characters|Squeezed.'
  'Looking for the why behind the what|Found the why.'
  'Polishing the imperative mood|Shiny!'
  'Negotiating with the linter in advance|Deal signed.'
  'Hiding the evidence of trial and error|No evidence left.'
  'Asking the GPUs for their honest opinion|They approve.'
  'Convincing the model that the tabs were intended|Convinced.'
  'Composing a haiku, then deleting it|It was beautiful.'
  'Removing "finally works" from the draft|And it finally works.'
  'Inventing a scope that sounds official|Very official.'
  'Giving your typo fix the gravitas it deserves|Gravitas applied.'
  'Checking whether this counts as a refactor|The verdict is in.'
  'Skipping the part where it says "stuff"|Stuff skipped.'
  'Writing history, one line at a time|History written.'
  'Explaining it to your future self|Future you says thanks!'
  'Dressing up the diff for code review|Looking sharp!'
  'Rounding "quick fix" up to "improvement"|Rounded up.'
  'Decoding what "temp2_final" was supposed to mean|Decoded, mostly.'
  'Warming up the tokens|Nice and toasty.'
  'Deciding this is definitely not a breaking change|Probably.'
  'Searching for a verb that is not "update"|Verb found!'
  'Reticulating commit splines|Splines reticulated.'
  'Fitting an epic into the subject line|It fits!'
  'Taking credit for what the compiler made you do|Credit taken.'
  'Preparing your alibi for git blame|Alibi airtight.'
  'Asking mittwald AI very nicely|It said yes!'
  'Thinking in German, answering in English|Fertig. Done.'
  'Making the changelog proud|The changelog is beaming.'
  'Distilling your diff into one honest sentence|Mostly honest.'
  'Arguing with itself about the scope|It won.'
  'Promising the reviewers it is a small change|Pinky promise.'
  'Steering clear of "various improvements"|Steered clear.'
  'Reading between the hunks|Read it all.'
  'Editing the swear words out of the summary|Squeaky clean.'
  'Trusting that the tests passed|Fingers crossed!'
)
FRAMES_PER_SECOND=20
MESSAGE_FRAMES=60   # frames until the next text, about 3 seconds

# On a terminal, the status is one line that is rewritten in place.
if [ -t 2 ] && [ "${TERM:-dumb}" != "dumb" ]; then
  LIVE=1
else
  LIVE=0
fi
if [ "${LIVE}" -eq 1 ] && [ -z "${NO_COLOR:-}" ]; then
  COLOR=1
  C_DIM=$'\033[2m'
  C_FAINT=$'\033[0;2;38;2;80;80;80m'   # the slash of the attempt counter
  C_RED=$'\033[31m'
  C_RESET=$'\033[0m'
else
  COLOR=0
  C_DIM=''
  C_FAINT=''
  C_RED=''
  C_RESET=''
fi

# Colors of the status text (24-bit): mittwald blue, purple, salmon and rose.
# The colors flow through the letters. The part of the text that shows the
# elapsed share of the time limit is bold and in full color, the rest is muted.
# The attempt counter in front of the text stays dim, in the color of the theme.
GRADIENT_STOPS=(75 56 232  155 110 216  231 160 134  182 117 133)
GRADIENT_SIZE=60    # color steps of one cycle through all stops
MUTED_GRAY=125      # the muted colors are a mix with this gray
MUTED_PERCENT=62
BRIGHT=()
MUTED=()

# Fills BRIGHT and MUTED with one escape sequence per color step.
build_gradient() {
  local stops=$(( ${#GRADIENT_STOPS[@]} / 3 ))
  local step segment from to position ease channel value bright muted
  for ((step = 0; step < GRADIENT_SIZE; step++)); do
    segment=$(( step * stops / GRADIENT_SIZE ))
    from=$(( segment * 3 ))
    to=$(( (from + 3) % ${#GRADIENT_STOPS[@]} ))
    position=$(( step * stops % GRADIENT_SIZE * 1000 / GRADIENT_SIZE ))
    ease=$(( position * position * (3000 - 2 * position) / 1000000 ))
    bright=''
    muted=''
    for channel in 0 1 2; do
      value=$(( GRADIENT_STOPS[from + channel] + (GRADIENT_STOPS[to + channel] - GRADIENT_STOPS[from + channel]) * ease / 1000 ))
      bright+=";${value}"
      muted+=";$(( value + (MUTED_GRAY - value) * MUTED_PERCENT / 100 ))"
    done
    BRIGHT[step]=$'\033'"[0;1;38;2${bright}m"
    MUTED[step]=$'\033'"[0;38;2${muted}m"
  done
}

# Draws the status line. $1 = attempt counter such as 1/3 (empty for none),
# $2 = text, $3 = frame number, $4 = number of text characters in full color.
draw() {
  local text="$2"
  local length=${#2}
  local line=''
  local i step
  if [ "${COLOR}" -eq 1 ]; then
    if [ -n "$1" ]; then
      line="${C_DIM}${1%%/*}${C_FAINT}/${C_DIM}${1#*/} "
    fi
    for ((i = 0; i < length; i++)); do
      step=$(( (i * GRADIENT_SIZE / length + GRADIENT_SIZE - $3 * 2 % GRADIENT_SIZE) % GRADIENT_SIZE ))
      if [ "${i}" -lt "$4" ]; then
        line+="${BRIGHT[step]}${text:i:1}"
      else
        line+="${MUTED[step]}${text:i:1}"
      fi
    done
    line+="${C_RESET}"
  else
    line="${1:+$1 }${text}"
  fi
  printf '\r%s\033[K' "${line}" >&2
}

# Replaces the status line with the status text in full color and the remark
# that says that cmai is done. $1 = index in MESSAGES, $2 = frame number.
finish_done() {
  local text="${MESSAGES[$1]%%|*}..."
  local remark="${MESSAGES[$1]#*|}"
  if [ "${LIVE}" -eq 1 ]; then
    draw '' "${text}" "$2" "${#text}"
    printf ' %s\n' "${remark}" >&2
  else
    printf '%s %s\n' "${text}" "${remark}" >&2
  fi
}

# Replaces the status line with a final line. $1 = color, $2 = text.
finish() {
  if [ "${LIVE}" -eq 1 ]; then
    printf '\r\033[K' >&2
  fi
  printf '%s%s%s\n' "$1" "$2" "${C_RESET}" >&2
}

# Prints the last lines of cmai output. Control characters are removed, so that
# text from the API cannot send escape sequences to the terminal.
cmai_output() {
  local file
  for file in "${ERR_FILE}" "${OUT_FILE}"; do
    [ -s "${file}" ] || continue
    LC_ALL=C tr -d '\000-\010\013-\037\177' < "${file}" |
      grep -v '^[[:space:]]*$' | tail -n 3 | cut -c 1-300 | sed 's/^/  /'
    return
  done
}

# Reports why there is no generated message. $1 = reason, $2 = "details" to add
# the cmai output.
fail() {
  finish "${C_RED}" "No commit message generated: $1"
  if [ "${2:-}" = details ]; then
    cmai_output >&2
    if [ -n "${keychain_error}" ]; then
      printf '  %s\n' "${keychain_error}" >&2
    fi
  fi
  exit 0
}

# Prints the PowerShell script that prints a generic credential from the
# Windows Credential Manager. The name of the credential is in the environment
# variable CMAI_KEYCHAIN_TARGET.
windows_credential_script() {
  cat <<'POWERSHELL_EOF'
$ErrorActionPreference = 'Stop'
Add-Type -TypeDefinition @'
using System;
using System.Runtime.InteropServices;
public static class CmaiCredential {
  [StructLayout(LayoutKind.Sequential)]
  struct Credential {
    public uint Flags; public uint Type; public IntPtr TargetName; public IntPtr Comment;
    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
    public uint BlobSize; public IntPtr Blob; public uint Persist; public uint AttributeCount;
    public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
  }
  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
  static extern bool CredReadW(string target, uint type, uint flags, out IntPtr credential);
  [DllImport("advapi32.dll")]
  static extern void CredFree(IntPtr credential);
  public static string Read(string target) {
    IntPtr pointer;
    if (!CredReadW(target, 1, 0, out pointer)) { return null; }
    try {
      Credential credential = (Credential)Marshal.PtrToStructure(pointer, typeof(Credential));
      return Marshal.PtrToStringUni(credential.Blob, (int)credential.BlobSize / 2);
    } finally { CredFree(pointer); }
  }
}
'@
$secret = [CmaiCredential]::Read($env:CMAI_KEYCHAIN_TARGET)
if ($null -eq $secret) { exit 1 }
[Console]::Out.Write($secret)
POWERSHELL_EOF
}

# Prints the API key from the system keychain. $1 = name of the keychain entry.
keychain_get() {
  local script
  case "${OSTYPE:-}" in
    darwin*)
      security find-generic-password -s "$1" -a "${KEYCHAIN_ACCOUNT}" -w
      ;;
    msys*|cygwin*)
      # -EncodedCommand takes the script as base64 of UTF-16, which needs no quoting.
      script="$(windows_credential_script | iconv -f UTF-8 -t UTF-16LE | base64 | tr -d '\r\n')"
      CMAI_KEYCHAIN_TARGET="$1" MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*' \
        powershell.exe -NoProfile -NonInteractive -EncodedCommand "${script}"
      ;;
    *)
      secret-tool lookup service "$1" account "${KEYCHAIN_ACCOUNT}"
      ;;
  esac
}

keychain_error=''

# git starts hooks with its own PATH, which can lack the directory of cmai.
CMAI="$(command -v cmai 2>/dev/null)" || CMAI="${HOME}/git-commit-ai/git-commit.sh"
[ -x "${CMAI}" ] || fail "cmai not found"

WORK_DIR="$(mktemp -d 2>/dev/null)" || fail "mktemp failed"
OUT_FILE="${WORK_DIR}/out"
ERR_FILE="${WORK_DIR}/err"
child=''

tick() {
  sleep 0.05 2>/dev/null || sleep 1
}

# Sends a signal to cmai and to the processes that cmai started. $1 = signal.
signal_cmai() {
  kill "-$1" -- "-${child}" 2>/dev/null || kill "-$1" "${child}" 2>/dev/null
}

# Runs from the EXIT trap.
# shellcheck disable=SC2329
cleanup() {
  [ -n "${child}" ] && signal_cmai TERM
  rm -f "${OUT_FILE}" "${ERR_FILE}"
  rmdir "${WORK_DIR}" 2>/dev/null
}
trap cleanup EXIT
# cmai runs in its own process group, so Ctrl-C does not reach cmai. The hook
# exits instead, and cleanup stops cmai.
trap '[ "${LIVE}" -eq 1 ] && printf "%s\n" "${C_RESET}" >&2; exit 130' INT
trap 'exit 143' TERM HUP

if [ "${COLOR}" -eq 1 ]; then
  build_gradient
fi

# The key goes to cmai in the environment and never touches the disk. A cmai
# version that cannot take the key from the environment uses its own key file.
api_key=''
if [ -s "${KEYCHAIN_FILE}" ]; then
  IFS= read -r keychain_entry < "${KEYCHAIN_FILE}"
  IFS= read -r -t "${KEYCHAIN_SECONDS}" api_key < <(keychain_get "${keychain_entry}" 2>/dev/null)
  api_key="${api_key%$'\r'}"
  if [ -z "${api_key}" ]; then
    keychain_error='The API key could not be read from the system keychain. Re-run the installer to store the key again.'
  fi
fi

attempts=0
exitcode=0
while [ "${attempts}" -lt "${MAX_ATTEMPTS}" ]; do
  attempts=$((attempts + 1))
  message_start=$((RANDOM % ${#MESSAGES[@]}))
  message_index="${message_start}"
  started="${SECONDS}"
  timed_out=0
  frame=0
  text=''
  # With job control, cmai gets its own process group. The hook can then stop
  # cmai together with the curl process that cmai started.
  set -m
  CMAI_API_KEY="${api_key}" "${CMAI}" --message-only > "${OUT_FILE}" 2> "${ERR_FILE}" < /dev/null &
  child=$!
  set +m
  if [ "${LIVE}" -eq 0 ]; then
    printf '%s/%s %s...\n' "${attempts}" "${MAX_ATTEMPTS}" "${MESSAGES[message_start]%%|*}" >&2
  fi

  while kill -0 "${child}" 2>/dev/null; do
    elapsed=$((SECONDS - started))
    if [ "${elapsed}" -ge "${TIMEOUT_SECONDS}" ]; then
      timed_out=1
      signal_cmai TERM
      grace=$((KILL_AFTER_SECONDS * FRAMES_PER_SECOND))
      while [ "${grace}" -gt 0 ] && kill -0 "${child}" 2>/dev/null; do
        tick
        grace=$((grace - 1))
      done
      signal_cmai KILL
      break
    fi
    if [ "${LIVE}" -eq 1 ]; then
      if [ $((frame % MESSAGE_FRAMES)) -eq 0 ]; then
        # Every MESSAGE_FRAMES frames the next text; the integer division is intended.
        # shellcheck disable=SC2017
        message_index=$(( (message_start + frame / MESSAGE_FRAMES * 7) % ${#MESSAGES[@]} ))
        text="${MESSAGES[message_index]%%|*}..."
      fi
      draw "${attempts}/${MAX_ATTEMPTS}" "${text}" "${frame}" "$((elapsed * ${#text} / TIMEOUT_SECONDS))"
    fi
    frame=$((frame + 1))
    tick
  done
  wait "${child}" 2>/dev/null; exitcode=$?
  child=''

  if [ "${timed_out}" -eq 0 ]; then
    break
  fi
  if [ "${attempts}" -ge "${MAX_ATTEMPTS}" ]; then
    fail "cmai timed out after ${TIMEOUT_SECONDS}s (attempt ${attempts}/${MAX_ATTEMPTS})" details
  fi
  [ "${LIVE}" -eq 1 ] || printf 'Timed out after %ss\n' "${TIMEOUT_SECONDS}" >&2
  TIMEOUT_SECONDS=$((TIMEOUT_SECONDS + (TIMEOUT_SECONDS * TIMEOUT_INCREASE_PERCENT + 99) / 100))
done

[ "${exitcode}" -eq 0 ] || fail "cmai failed (exit ${exitcode})" details
# jq for Windows ends lines with a carriage return.
COMMIT_MSG="$(tr -d '\r' < "${OUT_FILE}")"
[ -n "${COMMIT_MSG}" ] || fail "cmai returned an empty message" details

if { printf '%s\n' "${COMMIT_MSG}"; cat "${MSG_FILE}"; } > "${MSG_FILE}.tmp" &&
  mv "${MSG_FILE}.tmp" "${MSG_FILE}"; then
  finish_done "${message_index}" "${frame}"
else
  rm -f "${MSG_FILE}.tmp"
  fail "could not write ${MSG_FILE}"
fi
exit 0
HOOK_EOF
}

VIM_SNIPPET='" abort git commit when quitting with :q or :q!
augroup GitCommitAbort
  autocmd!
  autocmd FileType gitcommit cnoreabbrev <buffer> q! cq
  autocmd FileType gitcommit cnoreabbrev <buffer> q  cq
augroup END'

# Vim loads defaults.vim (syntax, filetype detection) only while no vimrc
# exists. A new vimrc keeps the defaults with these lines.
# shellcheck disable=SC2016
VIM_DEFAULTS_SNIPPET='" keep the Vim defaults, which Vim skips as soon as a vimrc exists
if filereadable(expand("$VIMRUNTIME/defaults.vim"))
  unlet! skip_defaults_vim
  source $VIMRUNTIME/defaults.vim
endif'

PLATFORM=''            # linux, macos or windows
non_interactive=0
tmp_dir=''
cmai_path=''           # the cmai script in use
downloaded_script=''
cmai_is_latest=0       # 1 if the installed cmai is the same as the latest one
cmai_api_key=''        # the key that the user gave in step 2
keychain_api_key=''    # the key, if the system keychain keeps it
template_dir=''
hook_path=''
repo_dirs=()           # the directories of --repos

setup_colors() {
  if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
    C_RESET=$'\033[0m'
    C_BOLD=$'\033[1m'
    C_ITALIC=$'\033[3m'
    C_DIM=$'\033[2m'
    C_RED=$'\033[31m'
    C_GREEN=$'\033[32m'
    C_YELLOW=$'\033[33m'
    C_BLUE=$'\033[34m'
    C_CYAN=$'\033[36m'
    C_CODE=$'\033[95m'
  else
    C_RESET=''
    C_BOLD=''
    C_ITALIC=''
    C_DIM=''
    C_RED=''
    C_GREEN=''
    C_YELLOW=''
    C_BLUE=''
    C_CYAN=''
    C_CODE=''
  fi
}

usage() {
  echo "Usage: install-git-commit-ai.sh [--non-interactive] [--repos DIR]..."
  echo
  echo "  --non-interactive  Do not prompt; accept the default answer of every step."
  echo "                     The default keeps an existing hook from another source"
  echo "                     and does not install a cmai script with unexpected content."
  echo "  --repos DIR        Look for repositories in DIR (can repeat). A repository"
  echo "                     with a copy of the hook from this installer gets a link to"
  echo "                     the hook instead (on Windows: the current hook). The"
  echo "                     repository in the current directory is always checked."
  echo "  -h, --help         Show this help"
  echo
  echo "Environment:"
  echo "  MITTWALD_AI_API_KEY  API key to store, instead of typing it"
  echo "  CMAI_BIN_DIR         Directory on the PATH for the cmai command"
  echo "                       (default: /usr/local/bin, on Windows ~/bin)"
  echo
  echo "Pass options through a pipe with: curl ... | bash -s -- --non-interactive"
}

parse_args() {
  while [ "$#" -gt 0 ]; do
    case "$1" in
      --non-interactive) non_interactive=1 ;;
      --repos)
        if [ "$#" -lt 2 ] || [ -z "$2" ]; then
          echo "${C_RED}ERROR:${C_RESET} --repos needs a directory" >&2
          usage >&2
          exit 1
        fi
        repo_dirs+=("$2")
        shift
        ;;
      -h|--help) usage; exit 0 ;;
      *)
        echo "${C_RED}ERROR:${C_RESET} unknown option: $1" >&2
        usage >&2
        exit 1
        ;;
    esac
    shift
  done
}

cleanup() {
  if [ -n "${tmp_dir}" ]; then
    rm -rf "${tmp_dir}"
  fi
}

is_interactive() {
  [ "${non_interactive}" -eq 0 ] && { [ -t 0 ] || [ -t 1 ]; }
}

code() {
  printf '%s%s%s' "${C_CODE}" "$1" "${C_RESET}"
}

dim_output() {
  sed "s/^/    ${C_DIM}/; s/\$/${C_RESET}/"
}

heading() {
  printf '\n%sStep %s:%s %s\n' "${C_BOLD}${C_CYAN}" "$1" "${C_RESET}" "$2"
}

# Shows a command or an action before it runs.
action() {
  echo "  ${C_ITALIC}${C_BLUE}>${C_RESET}${C_ITALIC} $1${C_RESET}"
}

warning() {
  echo "  ${C_YELLOW}${C_BOLD}WARNING:${C_RESET}${C_YELLOW} $1${C_RESET}"
}

error() {
  echo "  ${C_RED}ERROR:${C_RESET} $1" >&2
}

die() {
  error "$1"
  exit 1
}

abort() {
  echo "  ${C_RED}Aborting.${C_RESET}"
  exit 1
}

# Asks a yes/no question. $1 = question, $2 = default answer (y or n).
ask() {
  local question="$1"
  local default="$2"
  local hint='[y/N]'
  local answer=''
  if [ "${default}" = y ]; then
    hint='[Y/n]'
  fi
  printf '  %s%s %s:%s ' "${C_BOLD}${C_BLUE}" "${question}" "${hint}" "${C_RESET}"
  if is_interactive; then
    read -r answer < /dev/tty || true
  elif [ "${default}" = y ]; then
    echo 'Y'
  else
    echo 'N'
  fi
  if [ -z "${answer}" ]; then
    answer="${default}"
  fi
  case "${answer}" in
    y|Y|yes|Yes|YES) return 0 ;;
    *) return 1 ;;
  esac
}

prompt_step() {
  heading "$1" "$2"
  echo
  ask "Run this step?" y
}

# Reads the API key without echo, so that the key does not stay on the screen
# or in the terminal scrollback.
prompt_api_key() {
  printf '  %s%s:%s ' "${C_BOLD}${C_BLUE}" "$1" "${C_RESET}"
  cmai_api_key=''
  if is_interactive; then
    read -r -s cmai_api_key < /dev/tty || true
  fi
  echo
}

# The tilde in the next two functions is literal text, as git config stores it.
# shellcheck disable=SC2088
to_tilde_path() {
  local p="$1"
  if [ "$p" = "$HOME" ]; then
    printf '~'
  elif [ "${p#"$HOME"/}" != "$p" ]; then
    printf '~/%s' "${p#"$HOME"/}"
  else
    printf '%s' "$p"
  fi
}

# shellcheck disable=SC2088
resolve_template_dir() {
  local p="$1"
  case "$p" in
    "~") printf '%s\n' "${HOME}" ;;
    "~/"*) printf '%s/%s\n' "${HOME}" "${p#"~/"}" ;;
    *) printf '%s\n' "$p" ;;
  esac
}

# True for /dir and for C:/dir, the form in which git for Windows stores paths.
is_absolute_path() {
  case "$1" in
    /*|[A-Za-z]:[/\\]*) return 0 ;;
    *) return 1 ;;
  esac
}

prompt_template_dir() {
  local initial="$1"
  local input=''
  local resolved=''

  while true; do
    if is_interactive && [ "${BASH_VERSINFO[0]}" -ge 4 ]; then
      printf '  %sTemplate directory:%s ' "${C_BOLD}${C_BLUE}" "${C_RESET}"
      read -r -e -i "${initial}" input < /dev/tty || true
    elif is_interactive; then
      # bash 3.2 (macOS) cannot put the default into the input line.
      printf '  %sTemplate directory [%s]:%s ' "${C_BOLD}${C_BLUE}" "${initial}" "${C_RESET}"
      read -r input < /dev/tty || true
    else
      printf '  %sTemplate directory:%s %s\n' "${C_BOLD}${C_BLUE}" "${C_RESET}" "$(code "${initial}")"
      input="${initial}"
    fi

    [ -z "${input}" ] && input="${initial}"
    resolved="$(resolve_template_dir "${input}")"
    if ! is_absolute_path "${resolved}"; then
      error "template directory must be an absolute path."
      if is_interactive; then
        continue
      fi
      return 1
    fi

    template_dir="${resolved}"
    return 0
  done
}

warn_template_dir_not_global() {
  echo
  warning "template directory is not configured globally."
  echo "  ${C_YELLOW}The template will not be found automatically.${C_RESET}"
}

# Old cmai versions take an unknown option as the API key and then run
# `git add .`. The check therefore reads the cmai script and does not run it.
cmai_is_current() {
  local option
  cmai_path="$(find_cmai)" || return 1
  [ -r "${cmai_path}" ] || return 1
  for option in "${CMAI_REQUIRED_OPTIONS[@]}"; do
    grep -qF -e "${option})" "${cmai_path}" || return 1
  done
}

# Prints the cmai script in use: the command on the PATH, or else the installed
# copy. The hook looks for cmai in the same order.
find_cmai() {
  hash -r
  if command -v cmai 2>/dev/null; then
    return 0
  fi
  if [ -x "${CMAI_INSTALL_DIR}/git-commit.sh" ]; then
    printf '%s\n' "${CMAI_INSTALL_DIR}/git-commit.sh"
    return 0
  fi
  return 1
}

# True if a cmai script takes the API key from the environment. $1 = script.
cmai_reads_key_from_environment() {
  grep -qF -e 'CMAI_API_KEY' "$1"
}

# Prints one line for each thing in a downloaded cmai script that does not look
# like cmai. $1 = script file. The script is read and parsed, but not run.
# These checks are heuristics: they catch a wrong, broken or crudely modified
# script, but they cannot prove that a script is harmless.
cmai_script_findings() {
  local file="$1"
  local option entry line host

  head -n 1 "${file}" | grep -qE '^#!(/usr)?/bin/(env )?bash' || echo "is not a bash script"
  bash -n "${file}" 2>/dev/null || echo "has a syntax error"
  for option in "${CMAI_REQUIRED_OPTIONS[@]}"; do
    grep -qF -e "${option})" "${file}" || echo "lacks the option ${option}"
  done
  [ "$(wc -c < "${file}")" -le 200000 ] || echo "is larger than expected"
  if ! awk 'length($0) > 1000 { exit 1 }' "${file}"; then
    echo "has very long lines"
  fi
  line="$(LC_ALL=C grep -n -m 1 '[^[:print:][:space:]]' "${file}" | cut -d: -f1 || true)"
  if [ -n "${line}" ]; then
    echo "contains non-ASCII or control characters (line ${line})"
  fi
  for entry in "${CMAI_UNEXPECTED_PATTERNS[@]}"; do
    line="$(LC_ALL=C grep -nE -m 1 -e "${entry#*|}" "${file}" | cut -d: -f1 || true)"
    if [ -n "${line}" ]; then
      echo "${entry%%|*} (line ${line})"
    fi
  done
  while IFS= read -r host; do
    case "${CMAI_KNOWN_HOSTS}" in
      *" ${host} "*) ;;
      *) echo "names the unknown host ${host}" ;;
    esac
  done < <(LC_ALL=C grep -oE 'https?://[^/"'"'"' )]+' "${file}" | sed 's|.*://||; s|:.*||' | sort -u)
  return 0
}

# Writes a cmai setting. The file is private from the moment it is created.
write_cmai_setting() {
  local file="${CMAI_CONFIG_DIR}/$1"
  (
    umask 077
    mkdir -p "${CMAI_CONFIG_DIR}" && printf '%s\n' "$2" > "${file}"
  ) && chmod 700 "${CMAI_CONFIG_DIR}" && chmod 600 "${file}"
}

keychain_title() {
  case "${PLATFORM}" in
    macos) printf 'macOS Keychain' ;;
    windows) printf 'Windows Credential Manager' ;;
    *) printf 'system keyring' ;;
  esac
}

# Runs a command with a time limit of 20 seconds and with the stdin of the
# caller. A keychain tool can wait for a dialog that nobody sees, for example
# in an SSH session or without a default keychain.
limited() {
  local pid
  local started="${SECONDS}"
  "$@" <&0 &
  pid=$!
  while kill -0 "${pid}" 2>/dev/null; do
    if [ $((SECONDS - started)) -ge 20 ]; then
      kill "${pid}" 2>/dev/null
      wait "${pid}" 2>/dev/null || true
      return 124
    fi
    sleep 0.1 2>/dev/null || sleep 1
  done
  wait "${pid}"
}

# True if this system has a keychain that the installer can use.
keychain_exists() {
  local problem default_keychain
  local status=0
  case "${PLATFORM}" in
    macos)
      command -v security >/dev/null 2>&1 || return 1
      # security prints the default keychain as a path in quotes. Without that
      # keychain, every other security command opens a dialog and waits.
      default_keychain="$(limited security default-keychain 2>/dev/null | sed -e 's/^[[:space:]]*"//' -e 's/"[[:space:]]*$//')" || return 1
      [ -n "${default_keychain}" ] && [ -e "${default_keychain}" ]
      ;;
    windows)
      command -v powershell.exe >/dev/null 2>&1 && command -v iconv >/dev/null 2>&1 &&
        command -v base64 >/dev/null 2>&1
      ;;
    *)
      command -v secret-tool >/dev/null 2>&1 || return 1
      # Without a Secret Service (server, SSH session), secret-tool reports an error.
      problem="$(limited secret-tool lookup service "${KEYCHAIN_ENTRY}" account "${KEYCHAIN_ACCOUNT}" 2>&1 >/dev/null)" || status=$?
      [ -z "${problem}" ] && [ "${status}" -le 1 ]
      ;;
  esac
}

# Prints the PowerShell script that writes, reads or deletes a generic
# credential in the Windows Credential Manager. The action and its values are
# in the environment variables CMAI_KEYCHAIN_ACTION, _TARGET, _USER and _SECRET.
windows_credential_script() {
  cat <<'POWERSHELL_EOF'
$ErrorActionPreference = 'Stop'
Add-Type -TypeDefinition @'
using System;
using System.ComponentModel;
using System.Runtime.InteropServices;
using System.Text;
public static class CmaiCredential {
  [StructLayout(LayoutKind.Sequential)]
  struct Credential {
    public uint Flags; public uint Type; public IntPtr TargetName; public IntPtr Comment;
    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
    public uint BlobSize; public IntPtr Blob; public uint Persist; public uint AttributeCount;
    public IntPtr Attributes; public IntPtr TargetAlias; public IntPtr UserName;
  }
  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
  static extern bool CredReadW(string target, uint type, uint flags, out IntPtr credential);
  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
  static extern bool CredWriteW(ref Credential credential, uint flags);
  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
  static extern bool CredDeleteW(string target, uint type, uint flags);
  [DllImport("advapi32.dll")]
  static extern void CredFree(IntPtr credential);
  public static string Read(string target) {
    IntPtr pointer;
    if (!CredReadW(target, 1, 0, out pointer)) { return null; }
    try {
      Credential credential = (Credential)Marshal.PtrToStructure(pointer, typeof(Credential));
      return Marshal.PtrToStringUni(credential.Blob, (int)credential.BlobSize / 2);
    } finally { CredFree(pointer); }
  }
  public static void Write(string target, string user, string secret) {
    byte[] blob = Encoding.Unicode.GetBytes(secret);
    Credential credential = new Credential();
    credential.Type = 1;     // generic credential
    credential.Persist = 2;  // kept for this user on this computer
    credential.TargetName = Marshal.StringToCoTaskMemUni(target);
    credential.UserName = Marshal.StringToCoTaskMemUni(user);
    credential.BlobSize = (uint)blob.Length;
    credential.Blob = Marshal.AllocCoTaskMem(blob.Length);
    try {
      Marshal.Copy(blob, 0, credential.Blob, blob.Length);
      if (!CredWriteW(ref credential, 0)) { throw new Win32Exception(Marshal.GetLastWin32Error()); }
    } finally {
      Marshal.FreeCoTaskMem(credential.TargetName);
      Marshal.FreeCoTaskMem(credential.UserName);
      Marshal.FreeCoTaskMem(credential.Blob);
    }
  }
  public static void Delete(string target) { CredDeleteW(target, 1, 0); }
}
'@
switch ($env:CMAI_KEYCHAIN_ACTION) {
  'write' { [CmaiCredential]::Write($env:CMAI_KEYCHAIN_TARGET, $env:CMAI_KEYCHAIN_USER, $env:CMAI_KEYCHAIN_SECRET) }
  'read' {
    $secret = [CmaiCredential]::Read($env:CMAI_KEYCHAIN_TARGET)
    if ($null -eq $secret) { exit 1 }
    [Console]::Out.Write($secret)
  }
  'delete' { [CmaiCredential]::Delete($env:CMAI_KEYCHAIN_TARGET) }
}
POWERSHELL_EOF
}

# Runs the credential script. $1 = action, $2 = secret for the action write.
run_windows_credential() {
  local script
  # -EncodedCommand takes the script as base64 of UTF-16, which needs no quoting.
  script="$(windows_credential_script | iconv -f UTF-8 -t UTF-16LE | base64 | tr -d '\r\n')" || return 1
  # Git Bash rewrites arguments and variables that look like a path. The
  # MSYS settings keep the script and a secret that starts with a slash as they are.
  CMAI_KEYCHAIN_ACTION="$1" CMAI_KEYCHAIN_TARGET="${KEYCHAIN_ENTRY}" CMAI_KEYCHAIN_USER="${KEYCHAIN_ACCOUNT}" \
    CMAI_KEYCHAIN_SECRET="${2:-}" MSYS2_ENV_CONV_EXCL='CMAI_KEYCHAIN_SECRET' \
    MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*' \
    limited powershell.exe -NoProfile -NonInteractive -EncodedCommand "${script}"
}

# Stores the secret $1 in the system keychain. The secret goes to the keychain
# tool on stdin or in the environment and never as a command argument, because
# other local users can read the arguments of a running process.
keychain_set() {
  case "${PLATFORM}" in
    macos)
      # `security -i` reads its command from stdin. Its quoting is simple, so
      # only a secret without quote, backslash and space goes this way.
      case "$1" in
        *[!A-Za-z0-9._~+/=:@%-]*) return 1 ;;
      esac
      printf 'add-generic-password -U -s "%s" -a "%s" -l "%s" -w "%s"\n' \
        "${KEYCHAIN_ENTRY}" "${KEYCHAIN_ACCOUNT}" "${KEYCHAIN_LABEL}" "$1" | limited security -i >/dev/null
      ;;
    windows)
      run_windows_credential write "$1" >/dev/null
      ;;
    *)
      printf '%s' "$1" | limited secret-tool store --label="${KEYCHAIN_LABEL}" \
        service "${KEYCHAIN_ENTRY}" account "${KEYCHAIN_ACCOUNT}"
      ;;
  esac
}

# Prints the secret from the system keychain.
keychain_get() {
  case "${PLATFORM}" in
    macos)
      limited security find-generic-password -s "${KEYCHAIN_ENTRY}" -a "${KEYCHAIN_ACCOUNT}" -w 2>/dev/null
      ;;
    windows)
      run_windows_credential read 2>/dev/null | tr -d '\r'
      ;;
    *)
      limited secret-tool lookup service "${KEYCHAIN_ENTRY}" account "${KEYCHAIN_ACCOUNT}" 2>/dev/null
      ;;
  esac
}

keychain_delete() {
  case "${PLATFORM}" in
    macos)
      limited security delete-generic-password -s "${KEYCHAIN_ENTRY}" -a "${KEYCHAIN_ACCOUNT}" >/dev/null 2>&1
      ;;
    windows)
      run_windows_credential delete >/dev/null 2>&1
      ;;
    *)
      limited secret-tool clear service "${KEYCHAIN_ENTRY}" account "${KEYCHAIN_ACCOUNT}" 2>/dev/null
      ;;
  esac
}

# Prints the editor command that git starts for a commit message.
detect_editor() {
  local editor
  editor="$(git var GIT_EDITOR 2>/dev/null || true)"
  if [ -z "${editor}" ]; then
    editor="${VISUAL:-${EDITOR:-}}"
  fi
  printf '%s' "${editor}"
}

# Prints vim, nvim or other for an editor command. Follows symbolic links such
# as the Debian `editor` alternative.
editor_kind() {
  local command_name="${1%% *}"
  local resolved
  resolved="$(command -v -- "${command_name}" 2>/dev/null || true)"
  if [ -n "${resolved}" ]; then
    resolved="$(readlink -f -- "${resolved}" 2>/dev/null || printf '%s' "${resolved}")"
  fi
  case "$(basename -- "${resolved:-${command_name}}")" in
    nvim*) echo nvim ;;
    vim*|gvim*|vi|view) echo vim ;;
    *) echo other ;;
  esac
}

# Prints the config file that Vim or Neovim loads at startup. Fails for Neovim
# with init.lua, because init.lua cannot take the Vim script snippet as it is.
editor_config_path() {
  local config_home="${XDG_CONFIG_HOME:-${HOME}/.config}"
  local candidate
  if [ "$1" = nvim ]; then
    [ ! -f "${config_home}/nvim/init.lua" ] || return 1
    printf '%s\n' "${config_home}/nvim/init.vim"
    return 0
  fi
  # Vim loads only the first vimrc that exists, so a new ~/.vimrc would hide
  # an existing vimrc at one of the other locations.
  for candidate in "${HOME}/.vimrc" "${HOME}/.vim/vimrc" "${config_home}/vim/vimrc"; do
    if [ -f "${candidate}" ]; then
      printf '%s\n' "${candidate}"
      return 0
    fi
  done
  printf '%s\n' "${HOME}/.vimrc"
}

print_snippet() {
  local line
  while IFS= read -r line; do
    printf '  %s%s%s%s\n' "${C_ITALIC}" "${C_CODE}" "${line}" "${C_RESET}"
  done <<< "$1"
}

detect_platform() {
  case "${OSTYPE:-}" in
    linux*) PLATFORM=linux ;;
    darwin*) PLATFORM=macos ;;
    msys*|cygwin*) PLATFORM=windows ;;
    *)
      echo "${C_RED}This installer supports Linux, macOS and Windows (Git Bash). Aborting without changes.${C_RESET}" >&2
      exit 1
      ;;
  esac
}

platform_title() {
  case "${PLATFORM}" in
    macos) printf 'macOS' ;;
    windows) printf 'Windows' ;;
    *) printf 'Linux' ;;
  esac
}

check_requirements() {
  local tool hint
  local missing=()

  # cmai needs curl and jq to call the API.
  for tool in git curl jq; do
    command -v "${tool}" >/dev/null 2>&1 || missing+=("${tool}")
  done
  if [ "${#missing[@]}" -gt 0 ]; then
    case "${PLATFORM}" in
      macos) hint="brew install ${missing[*]}" ;;
      windows) hint="winget install jqlang.jq (then open a new Git Bash window)" ;;
      *) hint="sudo apt install ${missing[*]}, or the package manager of your distribution" ;;
    esac
    echo "${C_RED}ERROR:${C_RESET} required but not found in PATH: ${missing[*]}. Aborting without changes." >&2
    echo "Install with, for example: ${hint}" >&2
    exit 1
  fi
}

# Downloads the latest cmai into a temporary directory and checks the script.
# Sets downloaded_script. Fails if the user does not accept a script with
# unexpected content.
# Downloads the latest cmai into a temporary directory and sets
# downloaded_script. Returns 1 if the download fails.
fetch_cmai() {
  local src_dir

  if ! command -v mktemp >/dev/null 2>&1; then
    error "mktemp is required to install $(code "cmai")."
    echo "  ${C_RED}Please install $(code "cmai")${C_RED} manually first. Aborting.${C_RESET}" >&2
    exit 1
  fi
  tmp_dir="$(mktemp -d)"
  src_dir="${tmp_dir}/cmai"
  downloaded_script="${src_dir}/git-commit.sh"

  action "$(code "git clone --depth 1 ${CMAI_REPO} ${src_dir}")"
  if ! git clone --quiet --depth 1 --template= "${CMAI_REPO}" "${src_dir}" < /dev/null 2>&1 | dim_output ||
    [ ! -f "${downloaded_script}" ]; then
    return 1
  fi
}

# Checks the downloaded cmai and shows what the check found. Returns 1 if the
# script has unexpected content.
check_downloaded_cmai() {
  local findings finding commit

  commit="$(git -C "$(dirname "${downloaded_script}")" log -1 --format='%h from %cd' --date=short 2>/dev/null || true)"
  action "Checking $(code "git-commit.sh") (commit ${commit:-unknown}) for unexpected content"
  findings="$(cmai_script_findings "${downloaded_script}")"
  if [ -z "${findings}" ]; then
    echo "    ${C_DIM}Nothing unexpected found.${C_RESET}"
    return 0
  fi
  echo
  warning "the downloaded $(code "cmai")${C_YELLOW} script does not look as expected. The script:"
  while IFS= read -r finding; do
    echo "    ${C_YELLOW}- ${finding}${C_RESET}"
  done <<< "${findings}"
  echo "  ${C_YELLOW}Review ${CMAI_REPO%.git} before you continue.${C_RESET}"
  echo
  return 1
}

download_cmai() {
  if ! fetch_cmai; then
    die "failed to download $(code "cmai"). Please install it manually first and re-run this script. Aborting."
  fi
  check_downloaded_cmai || ask "Install this script anyway?" n
}

remove_download() {
  action "Removing $(code "${tmp_dir}")"
  rm -rf "${tmp_dir}"
  tmp_dir=''
}

# Installs the downloaded script with the layout of the cmai install script: a
# copy in the home directory and the cmai command in a directory on the PATH.
install_downloaded_cmai() {
  local target="${CMAI_INSTALL_DIR}/git-commit.sh"

  action "$(code "mkdir -p ${CMAI_INSTALL_DIR}")"
  action "$(code "cp ${downloaded_script} ${target}")"
  if ! mkdir -p "${CMAI_INSTALL_DIR}" || ! cp "${downloaded_script}" "${target}" || ! chmod +x "${target}"; then
    die "failed to copy $(code "cmai") to $(code "${CMAI_INSTALL_DIR}"). Aborting."
  fi
  if ! link_cmai "${target}"; then
    warning "could not put $(code "cmai")${C_YELLOW} on the PATH. The hook works without it."
    echo "  ${C_YELLOW}To run cmai yourself, use${C_RESET} $(code "$(to_tilde_path "${target}")")${C_YELLOW}.${C_RESET}"
  fi
  remove_download

  if ! cmai_is_current; then
    error "failed to install $(code "cmai")."
    if command -v cmai >/dev/null 2>&1; then
      echo "  ${C_RED}$(command -v cmai) comes first on the PATH and is an older version.${C_RESET}" >&2
    fi
    echo "  ${C_RED}Please fix this and re-run this script. Aborting.${C_RESET}" >&2
    exit 1
  fi
  echo "  ${C_GREEN}Done.${C_RESET}"
}

step_install_cmai() {
  local title

  if cmai_is_current; then
    heading 1 "Install $(code "cmai")"
    echo
    echo "  $(code "cmai") ${C_GREEN}is already installed.${C_RESET}"
    update_installed_cmai
    update_cmai_for_keychain
    return 0
  fi

  if find_cmai >/dev/null 2>&1; then
    title="Update $(code "cmai") (the installed version lacks options that this setup needs)"
  else
    title="Install $(code "cmai")"
  fi
  if ! prompt_step 1 "${title}"; then
    abort
  fi
  if ! download_cmai; then
    echo "  ${C_RED}$(code "cmai")${C_RED} was not installed. Aborting.${C_RESET}"
    exit 1
  fi
  install_downloaded_cmai
}

# Updates a cmai that this installer (or the install script of cmai) installed
# to the latest version, if the latest version differs and the content check
# finds nothing. cmai has no version number, so a different script counts as a
# newer one. A cmai from another source stays as it is. A failed download keeps
# the installed cmai.
update_installed_cmai() {
  local installed="${CMAI_INSTALL_DIR}/git-commit.sh"

  if [ ! -f "${installed}" ] || ! cmp -s "${cmai_path}" "${installed}"; then
    echo "  ${C_DIM}$(code "${cmai_path}")${C_DIM} is not from this installer and is not updated.${C_RESET}"
    return 0
  fi
  echo
  echo "  Looking for a newer $(code "cmai")."
  if ! fetch_cmai; then
    warning "failed to download $(code "cmai")${C_YELLOW}. Keeping the installed cmai."
    remove_download
    return 0
  fi
  if cmp -s "${downloaded_script}" "${installed}"; then
    cmai_is_latest=1
    echo "  $(code "cmai") ${C_GREEN}is the latest version.${C_RESET}"
    remove_download
    return 0
  fi
  echo "  A newer $(code "cmai") is available."
  if ! check_downloaded_cmai; then
    echo "  ${C_YELLOW}Keeping the installed cmai.${C_RESET}"
    remove_download
    return 0
  fi
  if ! ask "Update cmai?" y; then
    echo "  ${C_YELLOW}Keeping the installed cmai.${C_RESET}"
    remove_download
    return 0
  fi
  install_downloaded_cmai
  cmai_is_latest=1
}

# The system keychain can keep the API key only if cmai takes the key from the
# environment. If the installed cmai cannot do that, a newer one may.
update_cmai_for_keychain() {
  if cmai_reads_key_from_environment "${cmai_path}" || ! keychain_exists; then
    return 0
  fi
  echo
  echo "  The installed cmai cannot take the API key from the $(keychain_title)."
  if [ "${cmai_is_latest}" -eq 1 ]; then
    echo "  ${C_YELLOW}The latest cmai cannot do this either. The API key stays in a file that only you can read.${C_RESET}"
    return 0
  fi
  if ! ask "Look for a newer cmai?" y; then
    return 0
  fi
  if ! download_cmai; then
    echo "  ${C_YELLOW}Keeping the installed cmai.${C_RESET}"
    remove_download
  elif cmai_reads_key_from_environment "${downloaded_script}"; then
    install_downloaded_cmai
  else
    echo "  ${C_YELLOW}The latest cmai cannot do this either. The API key stays in a file that only you can read.${C_RESET}"
    remove_download
  fi
}

# Prints the directory that gets the cmai command.
cmai_bin_dir() {
  if [ -n "${CMAI_BIN_DIR:-}" ]; then
    printf '%s\n' "${CMAI_BIN_DIR}"
  elif [ "${PLATFORM}" = windows ]; then
    # Git Bash has ~/bin on its PATH.
    printf '%s\n' "${HOME}/bin"
  else
    printf '%s\n' '/usr/local/bin'
  fi
}

# Puts cmai on the PATH. $1 = installed script. Needs sudo only if the
# directory is not writable.
link_cmai() {
  local target="$1"
  local bin_dir link
  bin_dir="$(cmai_bin_dir)"
  link="${bin_dir}/cmai"

  if [ "${link}" -ef "${target}" ]; then
    echo "    ${C_DIM}${link} already points to ${target}.${C_RESET}"
  elif [ "${PLATFORM}" = windows ]; then
    # Git Bash needs special rights for a symbolic link, so the command is a copy.
    action "$(code "cp ${target} ${link}")"
    mkdir -p "${bin_dir}" && cp "${target}" "${link}"
  elif mkdir -p "${bin_dir}" 2>/dev/null && [ -w "${bin_dir}" ]; then
    action "$(code "ln -sf ${target} ${link}")"
    ln -sf "${target}" "${link}"
  elif command -v sudo >/dev/null 2>&1; then
    if [ ! -d "${bin_dir}" ]; then
      action "$(code "sudo mkdir -p ${bin_dir}")"
      sudo mkdir -p "${bin_dir}" < /dev/null || return 1
    fi
    action "$(code "sudo ln -sf ${target} ${link}")"
    sudo ln -sf "${target}" "${link}" < /dev/null
  else
    error "$(code "${bin_dir}") is not writable and $(code "sudo") was not found."
    return 1
  fi
}

step_api_key() {
  local prompt='API key (optional, input is hidden)'

  heading 2 "Configure API key for $(code "cmai")"
  echo
  if [ -s "${CMAI_CONFIG_DIR}/config" ] || [ -s "${KEYCHAIN_FILE}" ]; then
    echo "  ${C_GREEN}An API key is already stored.${C_RESET}"
    prompt='New API key (empty keeps the stored key, input is hidden)'
  fi
  if [ -n "${MITTWALD_AI_API_KEY:-}" ]; then
    echo "  ${C_GREEN}Found key in${C_RESET} $(code "MITTWALD_AI_API_KEY")${C_GREEN}.${C_RESET}"
    if ask "Use key from MITTWALD_AI_API_KEY" y; then
      cmai_api_key="${MITTWALD_AI_API_KEY}"
    else
      prompt_api_key "${prompt}"
    fi
  else
    prompt_api_key "${prompt}"
  fi
  # A pasted key can carry spaces or a line end.
  cmai_api_key="${cmai_api_key//[[:space:]]/}"
}

# Stores the API key from step 2. The key goes into the system keychain where
# that is possible, and a key that is in the key file of cmai moves there too.
# Otherwise the key is in the key file, which only the user can read.
store_api_key() {
  local key="${cmai_api_key}"
  local key_file="${CMAI_CONFIG_DIR}/config"
  local question
  local can_use_keychain=0

  question="Store the API key in the $(keychain_title)?"
  if cmai_reads_key_from_environment "${cmai_path}" && keychain_exists; then
    can_use_keychain=1
    if [ -z "${key}" ] && [ -s "${key_file}" ]; then
      key="$(cat "${key_file}")"
      question="Move the stored API key into the $(keychain_title)?"
    fi
  elif [ -z "${key}" ] && [ -s "${KEYCHAIN_FILE}" ]; then
    # The key is in the keychain, but this cmai cannot take it from there.
    key="$(keychain_get || true)"
    cmai_api_key="${key}"
  fi

  if [ -z "${key}" ]; then
    if [ -s "${KEYCHAIN_FILE}" ]; then
      keychain_api_key="$(keychain_get || true)"
      echo "  ${C_GREEN}Keeping the API key in the $(keychain_title).${C_RESET}"
    elif [ -s "${key_file}" ]; then
      echo "  ${C_GREEN}Keeping the stored API key.${C_RESET}"
    else
      echo "  ${C_YELLOW}No API key set. Re-run this installer to store a key later.${C_RESET}"
    fi
    return 0
  fi

  if [ "${can_use_keychain}" -eq 1 ] && ask "${question}" y; then
    action "Storing API key in the $(keychain_title)"
    if keychain_set "${key}" && [ "$(keychain_get || true)" = "${key}" ]; then
      if ! write_cmai_setting keychain "${KEYCHAIN_ENTRY}"; then
        die "failed to write $(code "${KEYCHAIN_FILE}"). Aborting."
      fi
      if [ -e "${key_file}" ]; then
        action "Removing $(code "$(to_tilde_path "${key_file}")")"
        rm -f "${key_file}"
      fi
      keychain_api_key="${key}"
      return 0
    fi
    warning "could not store the API key in the $(keychain_title). The key goes into a file."
  fi

  if [ -n "${cmai_api_key}" ]; then
    action "Writing API key to $(code "$(to_tilde_path "${key_file}")") (only you can read this file)"
    if ! write_cmai_setting config "${key}"; then
      die "failed to store the API key. Aborting."
    fi
  else
    echo "  ${C_GREEN}Keeping the stored API key.${C_RESET}"
  fi
  if [ -e "${KEYCHAIN_FILE}" ]; then
    keychain_delete || true
    rm -f "${KEYCHAIN_FILE}"
  fi
}

step_configure_cmai() {
  local preview_cmd
  local cmai_cmd=("${cmai_path}" --clear-model-options
                  --use-custom "${AI_BASE_URL}"
                  --model "${AI_MODEL}"
                  --temperature 0.7
                  --top-p 0.8
                  --presence-penalty 1.5
                  --max-output-tokens "${AI_MAX_OUTPUT_TOKENS}"
                  --extra-body "${AI_EXTRA_BODY}"
                  --print-config)

  if ! prompt_step 3 "Configure $(code "cmai") to use mittwald AI"; then
    abort
  fi

  store_api_key

  preview_cmd="cmai --clear-model-options
         --use-custom \"${AI_BASE_URL}\"
         --model      \"${AI_MODEL}\"
         --temperature 0.7
         --top-p 0.8
         --presence-penalty 1.5
         --max-output-tokens ${AI_MAX_OUTPUT_TOKENS}
         --extra-body '${AI_EXTRA_BODY}'
         --print-config"
  action "$(code "${preview_cmd}")"
  # With the key from the keychain in the environment, cmai reports the key as set.
  if ! CMAI_API_KEY="${keychain_api_key}" "${cmai_cmd[@]}" < /dev/null 2>&1 | dim_output; then
    die "failed to configure $(code "cmai"). Aborting."
  fi
  # cmai exits on --print-config before persisting --max-output-tokens, so save it directly.
  if ! write_cmai_setting max_output_tokens "${AI_MAX_OUTPUT_TOKENS}"; then
    die "failed to store the output token limit. Aborting."
  fi
  echo "  ${C_GREEN}Done.${C_RESET}"
}

step_template_dir() {
  local existing_dir resolved_existing_dir hooks_path

  existing_dir="$(git config --global --get init.templatedir || true)"
  heading 4 "Configure template directory"
  echo
  if [ -n "${existing_dir}" ]; then
    resolved_existing_dir="$(resolve_template_dir "${existing_dir}")"
    printf '  %sTemplate directory:%s %s\n' "${C_BOLD}" "${C_RESET}" "$(code "${existing_dir}")"
    if ask "Use configured directory" y; then
      if ! is_absolute_path "${resolved_existing_dir}"; then
        error "configured template directory must be an absolute path."
        if ! prompt_template_dir "${HOME}/.git-templates"; then
          abort
        fi
        warn_template_dir_not_global
      else
        template_dir="${resolved_existing_dir}"
      fi
    else
      if ! prompt_template_dir "${existing_dir}"; then
        abort
      fi
      if [ "${template_dir}" != "${resolved_existing_dir}" ]; then
        warn_template_dir_not_global
      fi
    fi
  else
    if ! prompt_template_dir "${HOME}/.git-templates"; then
      abort
    fi
    action "Creating $(code "${template_dir}")"
    if ! mkdir -p "${template_dir}"; then
      die "failed to create $(code "${template_dir}"). Aborting."
    fi
    # The form ~/dir is the same on every system, also for git on Windows.
    action "$(code "git config --global init.templatedir '$(to_tilde_path "${template_dir}")'")"
    git config --global init.templatedir "$(to_tilde_path "${template_dir}")"
  fi

  hooks_path="$(git config --global --get core.hooksPath || git config --system --get core.hooksPath || true)"
  if [ -n "${hooks_path}" ]; then
    echo
    warning "$(code "core.hooksPath")${C_YELLOW} is set to $(code "${hooks_path}")${C_YELLOW}."
    echo "  ${C_YELLOW}Git then ignores the hooks of a repository, so the hook from the template will not run.${C_RESET}"
  fi
}

# True if the hooks are links to HOOK_SOURCE. Windows has no symbolic links
# without extra rights, so there the template and each repository keep a copy.
links_hooks() {
  [ "${PLATFORM}" != windows ]
}

# True if $1 is a link to HOOK_SOURCE.
is_hook_link() {
  [ -L "$1" ] && [ "$(readlink "$1")" = "${HOOK_SOURCE}" ]
}

# True if $1 is a hook from this installer, also an older one.
is_installer_hook() {
  grep -qF -e "${HOOK_SIGNATURE}" -e "${HOOK_SIGNATURE_OLD}" "$1" 2>/dev/null
}

# True if the hook $1 needs no change.
hook_is_current() {
  if links_hooks; then
    is_hook_link "$1" && [ "$(cat "${HOOK_SOURCE}" 2>/dev/null)" = "$(hook_content)" ]
  else
    [ ! -L "$1" ] && [ "$(cat "$1" 2>/dev/null)" = "$(hook_content)" ]
  fi
}

# Writes HOOK_SOURCE. A commit that runs the hook meanwhile reads the old or
# the new file, never a partly written one.
write_hook_source() {
  local tmp_hook="${HOOK_SOURCE}.tmp.$$"
  action "Writing $(code "$(to_tilde_path "${HOOK_SOURCE}")")"
  if mkdir -p "${CMAI_INSTALL_DIR}" &&
    hook_content > "${tmp_hook}" &&
    chmod +x "${tmp_hook}" &&
    mv -f "${tmp_hook}" "${HOOK_SOURCE}"; then
    return 0
  fi
  rm -f "${tmp_hook}"
  return 1
}

# Puts the hook at $1: a link to HOOK_SOURCE, or on Windows a copy.
# $2 = quiet: do not show the action.
place_hook() {
  local target="$1"
  local quiet="${2:-}"
  if links_hooks; then
    [ -n "${quiet}" ] || action "$(code "ln -sf $(to_tilde_path "${HOOK_SOURCE}") $(to_tilde_path "${target}")")"
    rm -f "${target}" && ln -s "${HOOK_SOURCE}" "${target}"
  else
    [ -n "${quiet}" ] || action "Writing $(code "$(to_tilde_path "${target}")")"
    rm -f "${target}" && hook_content > "${target}" && chmod +x "${target}"
  fi
}

step_install_hook() {
  local hook_dir="${template_dir}/hooks"
  local display_hook_path title

  hook_path="${hook_dir}/prepare-commit-msg"
  display_hook_path="$(to_tilde_path "${hook_path}")"
  if links_hooks; then
    title="Link $(code "${display_hook_path}") to $(code "$(to_tilde_path "${HOOK_SOURCE}")")"
  else
    title="Write $(code "${display_hook_path}")"
  fi

  if hook_is_current "${hook_path}"; then
    heading 5 "${title}"
    echo
    echo "  $(code "${hook_path}") ${C_GREEN}is already up to date.${C_RESET}"
    return 0
  elif [ ! -e "${hook_path}" ] && [ ! -L "${hook_path}" ]; then
    if ! prompt_step 5 "${title}"; then
      abort
    fi
  elif is_hook_link "${hook_path}" || is_installer_hook "${hook_path}"; then
    if links_hooks; then
      title="Update the hook and link $(code "${display_hook_path}") to $(code "$(to_tilde_path "${HOOK_SOURCE}")")"
    else
      title="Update $(code "${display_hook_path}")"
    fi
    if ! prompt_step 5 "${title}"; then
      abort
    fi
  else
    # A hook from another source. It is not replaced without an explicit yes.
    heading 5 "${title}"
    echo
    warning "$(code "${hook_path}")${C_YELLOW} already exists and was not written by this installer."
    echo "  ${C_YELLOW}Overwriting removes your existing hook.${C_RESET}"
    echo
    if ! ask "Overwrite the existing hook?" n; then
      echo "  ${C_YELLOW}Kept the existing hook. The commit message hook is not installed.${C_RESET}"
      echo "  ${C_RED}To install it, move the existing hook away or merge both by hand, then re-run this script. Aborting.${C_RESET}"
      exit 1
    fi
  fi

  if ! mkdir -p "${hook_dir}"; then
    die "failed to create $(code "${hook_dir}"). Aborting."
  fi
  if links_hooks && ! write_hook_source; then
    die "failed to write $(code "${HOOK_SOURCE}"). Aborting."
  fi
  if ! place_hook "${hook_path}"; then
    die "failed to write $(code "${hook_path}"). Aborting."
  fi
  echo "  ${C_GREEN}Done.${C_RESET}"
}

# Prints the hooks directory of the repository in the current directory and of
# each repository in the directories of --repos, each once. A repository with
# its own core.hooksPath keeps its hooks and is left out.
find_repo_hook_dirs() {
  local dir git_path repo common_dir
  {
    git rev-parse --show-toplevel 2>/dev/null || true
    for dir in ${repo_dirs[@]+"${repo_dirs[@]}"}; do
      dir="$(resolve_template_dir "${dir}")"
      [ -d "${dir}" ] || continue
      find "${dir}" -maxdepth "${REPO_SEARCH_DEPTH}" \( -name node_modules -o -name vendor \) -prune \
        -o -name .git -prune -print 2>/dev/null |
        while IFS= read -r git_path; do
          dirname "${git_path}"
        done
    done
  } | while IFS= read -r repo; do
    [ -n "${repo}" ] || continue
    if git -C "${repo}" config --local --get core.hooksPath >/dev/null 2>&1; then
      continue
    fi
    # Worktrees and submodules resolve to the git directory that keeps the hooks.
    common_dir="$(cd "${repo}" 2>/dev/null && cd "$(git rev-parse --git-common-dir 2>/dev/null)" 2>/dev/null && pwd)" ||
      continue
    printf '%s/hooks\n' "${common_dir}"
  done | sort -u
}

# The number of repositories that step 6 lists by name.
REPO_LIST_LIMIT=10

step_link_repos() {
  local hooks_dir hook title
  local linked=0
  local shown=0
  local failed=0
  local candidates=()

  if links_hooks; then
    title="Link the hook in your repositories"
  else
    title="Update the hook in your repositories"
  fi

  while IFS= read -r hooks_dir; do
    hook="${hooks_dir}/prepare-commit-msg"
    if hook_is_current "${hook}"; then
      linked=$((linked + 1))
    elif is_hook_link "${hook}" || is_installer_hook "${hook}"; then
      candidates+=("${hook}")
    fi
  done < <(find_repo_hook_dirs)

  heading 6 "${title}"
  echo
  if [ "${#candidates[@]}" -eq 0 ]; then
    if [ "${#repo_dirs[@]}" -eq 0 ] && [ "${linked}" -eq 0 ]; then
      echo "  No repository to check. Pass $(code "--repos DIR") to look for repositories in DIR."
    elif links_hooks; then
      echo "  ${C_GREEN}No repository has an old copy of the hook${C_RESET} (${linked} linked)."
    else
      echo "  ${C_GREEN}No repository has an old copy of the hook${C_RESET} (${linked} up to date)."
    fi
    return 0
  fi

  if links_hooks; then
    echo "  These repositories have a copy of the hook from this installer. A link"
    echo "  instead of the copy gets them every future update of the hook:"
  else
    echo "  These repositories have an old copy of the hook from this installer:"
  fi
  echo
  for hook in "${candidates[@]}"; do
    if [ "${shown}" -ge "${REPO_LIST_LIMIT}" ]; then
      echo "  ... and $((${#candidates[@]} - shown)) more"
      break
    fi
    echo "  $(code "$(to_tilde_path "${hook}")")"
    shown=$((shown + 1))
  done
  echo
  if ! ask "Run this step?" y; then
    echo "  ${C_YELLOW}Skipped.${C_RESET}"
    return 0
  fi
  if links_hooks; then
    action "$(code "ln -sf $(to_tilde_path "${HOOK_SOURCE}") <repository>/.git/hooks/prepare-commit-msg")"
  else
    action "Writing $(code "<repository>/.git/hooks/prepare-commit-msg")"
  fi
  for hook in "${candidates[@]}"; do
    if ! place_hook "${hook}" quiet; then
      warning "failed to write $(code "${hook}")${C_YELLOW}."
      failed=$((failed + 1))
    fi
  done
  echo "  ${C_GREEN}Done${C_RESET} ($((${#candidates[@]} - failed)) of ${#candidates[@]} repositories)."
}

step_editor() {
  local editor kind config_path display_config_path
  local new_file_content=''

  editor="$(detect_editor)"
  kind="$(editor_kind "${editor}")"

  if [ "${kind}" = other ]; then
    heading 7 "Check how your editor aborts a commit"
    echo
    echo "  ${C_YELLOW}Editor does not look like Vim (git uses${C_RESET} $(code "${editor:-no editor}")${C_YELLOW}).${C_RESET}"
    echo
    echo "  ${C_YELLOW}${C_BOLD}BE CAREFUL when using other editors:${C_RESET}"
    echo "  ${C_YELLOW}If you intend to abort the commit, first comment out the${C_RESET}"
    echo "  ${C_YELLOW}generated commit message, otherwise the commit WILL proceed.${C_RESET}"
    return 0
  fi

  if ! config_path="$(editor_config_path "${kind}")"; then
    heading 7 "Abort commit on :q! (only for Vim users)"
    echo
    echo "  ${C_YELLOW}Neovim uses${C_RESET} $(code "init.lua")${C_YELLOW} here, so this script cannot add the snippet.${C_RESET}"
    echo "  ${C_YELLOW}To abort a commit on :q, add the snippet by hand, for example inside${C_RESET} $(code "vim.cmd([[ ... ]])")${C_YELLOW}:${C_RESET}"
    echo
    print_snippet "${VIM_SNIPPET}"
    return 0
  fi
  display_config_path="$(to_tilde_path "${config_path}")"

  heading 7 "Append snippet to $(code "${display_config_path}") to abort commit on :q! (only for Vim users)"
  echo
  if [ -f "${config_path}" ] && grep -q 'augroup GitCommitAbort' "${config_path}"; then
    echo "  ${C_GREEN}Snippet is already present in${C_RESET} $(code "${config_path}")${C_GREEN}; no change needed.${C_RESET}"
    return 0
  fi

  if [ -f "${config_path}" ]; then
    echo "  Will append the following to $(code "${config_path}"):"
  else
    echo "  Will create $(code "${config_path}") with the following content:"
    if [ "${kind}" = vim ]; then
      new_file_content="${VIM_DEFAULTS_SNIPPET}"$'\n\n'
    fi
  fi
  echo
  print_snippet "${new_file_content}${VIM_SNIPPET}"
  echo
  echo "  ${C_YELLOW}${C_BOLD}INFO:${C_RESET}${C_YELLOW} This helps prevent accidentally committing a generated message.${C_RESET}"
  echo
  if ! ask "Run this step?" n; then
    echo "  ${C_YELLOW}Skipped.${C_RESET}"
    return 0
  fi

  if [ -f "${config_path}" ]; then
    action "Appending snippet to $(code "${config_path}")"
    # Start on a new line, also when the file does not end with one.
    if [ -n "$(tail -c 1 "${config_path}")" ]; then
      printf '\n' >> "${config_path}"
    fi
    printf '\n%s\n' "${VIM_SNIPPET}" >> "${config_path}"
  else
    action "Creating $(code "${config_path}")"
    mkdir -p "$(dirname "${config_path}")"
    printf '%s\n' "${new_file_content}${VIM_SNIPPET}" > "${config_path}"
  fi
  echo "  ${C_GREEN}Done.${C_RESET}"
}

step_manual() {
  heading 8 "Manual action required"
  echo
  echo "  ${C_BOLD}Run $(code "git init")${C_BOLD} in each repository where you want this hook template to apply.${C_RESET}"
  echo
  echo "  $(code "git init") does not replace a hook that a repository already has."
  if links_hooks; then
    echo "  To link the hook in such a repository, run this command in the repository:"
    echo
    echo "  $(code "ln -sf $(to_tilde_path "${HOOK_SOURCE}") \"\$(git rev-parse --git-path hooks)/prepare-commit-msg\"")"
  else
    echo "  To update the hook of such a repository, run this command in the repository:"
    echo
    echo "  $(code "cp $(to_tilde_path "${hook_path}") \"\$(git rev-parse --git-path hooks)/\"")"
  fi
  echo
  echo "  To do this for all repositories in a directory that have a copy of the"
  echo "  hook from this installer, run the installer again with $(code "--repos DIR")."
  echo
}

main() {
  setup_colors
  parse_args "$@"
  detect_platform
  check_requirements
  trap cleanup EXIT

  echo "${C_GREEN}Installer is running on $(platform_title).${C_RESET}"
  echo "${C_DIM}All changes will be shown before they are applied.${C_RESET}"

  step_install_cmai
  step_api_key
  step_configure_cmai
  step_template_dir
  step_install_hook
  step_link_repos
  step_editor
  step_manual
}

# Runs main, unless another script sources this file to use its functions.
if [ "${BASH_SOURCE[0]:-$0}" = "$0" ]; then
  main "$@"
fi