install.sh

#!/usr/bin/env sh
#
# Scrapfly CLI installer.
#
# Usage:
#   curl -fsSL https://scrapfly.io/scrapfly-cli/install | sh
#   curl -fsSL https://scrapfly.io/scrapfly-cli/install | sh -s -- --version v0.1.0 --prefix /usr/local
#   curl -fsSL https://scrapfly.io/scrapfly-cli/install | SCRAPFLY_VERSION=v0.1.0 sh
#
# Flags / env:
#   --version <tag>      (or $SCRAPFLY_VERSION) pin a release. Default: latest.
#   --prefix <dir>       install dir for the binary. Default: /usr/local/bin
#                        (falls back to $HOME/.local/bin if not writable).
#   --dest   <path>      explicit file path for the binary (overrides --prefix).
#   --repo   <org/repo>  override the source repo. Default: scrapfly/scrapfly-cli.
#   --no-verify          skip sha256 checksum verification (not recommended).
#
# Artifacts expected in the release:
#   scrapfly-darwin-universal.tar.gz  (also amd64 / arm64)
#   scrapfly-linux-amd64.tar.gz       (also arm64)
#   scrapfly-windows-amd64.zip        (manual install on Windows)
#   checksums.txt                     (sha256 sums, one per asset)

set -eu

REPO="${REPO:-scrapfly/scrapfly-cli}"
VERSION="${SCRAPFLY_VERSION:-}"
PREFIX="${PREFIX:-/usr/local/bin}"
DEST=""
VERIFY=1

while [ "$#" -gt 0 ]; do
  case "$1" in
    --version)    VERSION="$2"; shift 2 ;;
    --prefix)     PREFIX="$2"; shift 2 ;;
    --dest)       DEST="$2"; shift 2 ;;
    --repo)       REPO="$2"; shift 2 ;;
    --no-verify)  VERIFY=0; shift ;;
    -h|--help)
      sed -n '3,23p' "$0"; exit 0 ;;
    *) echo "unknown flag: $1" >&2; exit 2 ;;
  esac
done

info()  { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
fatal() { printf '\033[1;31merror:\033[0m %s\n' "$*" >&2; exit 1; }

os=$(uname -s | tr '[:upper:]' '[:lower:]')
arch=$(uname -m)
case "$arch" in
  x86_64|amd64)  arch=amd64 ;;
  aarch64|arm64) arch=arm64 ;;
  *) fatal "unsupported CPU: $arch" ;;
esac

case "$os" in
  darwin) asset="scrapfly-darwin-universal.tar.gz" ;;
  linux)  asset="scrapfly-linux-${arch}.tar.gz" ;;
  *)      fatal "unsupported OS: $os (Windows users: download the .zip from GitHub Releases)" ;;
esac

if [ -z "$VERSION" ] || [ "$VERSION" = "latest" ]; then
  base="https://github.com/${REPO}/releases/latest/download"
  VERSION="latest"
else
  base="https://github.com/${REPO}/releases/download/${VERSION}"
fi
url="${base}/${asset}"
checksums_url="${base}/checksums.txt"

info "target: $os-$arch ($asset)"
info "source: $url"

fetch() {
  if command -v curl >/dev/null 2>&1; then
    curl -fsSL "$1" -o "$2"
  elif command -v wget >/dev/null 2>&1; then
    wget -qO "$2" "$1"
  else
    fatal "need curl or wget"
  fi
}

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT

fetch "$url" "$tmp/$asset"

if [ "$VERIFY" -eq 1 ]; then
  info "verifying sha256 against checksums.txt"
  if ! fetch "$checksums_url" "$tmp/checksums.txt"; then
    fatal "could not download checksums.txt from $checksums_url (use --no-verify to skip)"
  fi
  expected=$(awk -v f="$asset" '$2 == f {print $1; found=1; exit} END {if (!found) exit 1}' "$tmp/checksums.txt") \
    || fatal "no checksum entry for $asset in checksums.txt"
  if command -v sha256sum >/dev/null 2>&1; then
    actual=$(sha256sum "$tmp/$asset" | awk '{print $1}')
  elif command -v shasum >/dev/null 2>&1; then
    actual=$(shasum -a 256 "$tmp/$asset" | awk '{print $1}')
  else
    fatal "need sha256sum or shasum for verification (use --no-verify to skip)"
  fi
  [ "$actual" = "$expected" ] || fatal "checksum mismatch: expected $expected, got $actual"
  info "checksum ok"
fi

tar -xzf "$tmp/$asset" -C "$tmp"
binary="$tmp/scrapfly"
[ -f "$binary" ] || fatal "archive did not contain ./scrapfly"

# Resolve final path. --dest wins; otherwise fall back from --prefix to
# $HOME/.local/bin when the prefix isn't writable.
if [ -z "$DEST" ]; then
  DEST="$PREFIX/scrapfly"
  if ! ( [ -w "$PREFIX" ] || [ -w "$(dirname "$PREFIX")" ] ); then
    fallback="$HOME/.local/bin"
    info "$PREFIX not writable, falling back to $fallback"
    mkdir -p "$fallback"
    DEST="$fallback/scrapfly"
  fi
fi
mkdir -p "$(dirname "$DEST")"
mv "$binary" "$DEST"
chmod 0755 "$DEST"

info "installed: $DEST"
"$DEST" version || true

# macOS: say what Gatekeeper will make of this binary. The check asks Apple
# online (a bare binary carries no stapled ticket), so offline reads the same
# as a release older than 0.4.1, the first signed one. Report only: a curl
# download is never quarantined, so the binary runs either way.
if [ "$os" = "darwin" ] && command -v codesign >/dev/null 2>&1; then
  if codesign --verify --strict -R="notarized" --check-notarization "$DEST" >/dev/null 2>&1; then
    info "macOS: signed with a Developer ID and notarized by Apple"
  else
    info "macOS: Apple notarization not confirmed (release older than 0.4.1, or offline)."
    info "       if macOS blocks the binary: xattr -d com.apple.quarantine $DEST"
  fi
fi

case "$PATH" in
  *"$(dirname "$DEST")"*) ;;
  *) info "note: $(dirname "$DEST") is not on your PATH; add it to start using scrapfly." ;;
esac

cat <<'EOF'

next steps
  1. scrapfly config set-key scp-live-...
  2. teach your AI assistant (Claude Code, Cursor, Codex, Copilot, ...)
     how to drive Scrapfly:
       npx skills add scrapfly/scrapfly-cli

docs: https://scrapfly.io/docs
EOF