#!/usr/bin/env bash
#
# neuron-dev-setup / install.sh
# ─────────────────────────────────────────────────────────────────────────────
# One-command onboarding for the Neuron CORE dev stack on a fresh Mac.
#
# Stands up, as native launchd services, the four processes a developer needs to
# have an identical "Neuron brain + agent" to build against:
#
#     soul  (:7770)  ──►  engram (:8742)        the mind + its memory substrate
#       ▲                     ▲
#       │                     │
#   mcp-wrapper (:17779) ──►  soul              MCP surface over the soul API
#       ▲
#       │
#   mcp-proxy   (:7779)  ◄── Claude Code        stable MCP front door
#
# It also seeds a fresh engram with Neuron's identity (the genesis seed) and lays
# down the Claude Code config (neuron agent + core hooks + local MCP registration)
# so a new dev's `claude` talks to *their own* local Neuron.
#
# DESIGN RULES
#   * Idempotent: safe to re-run. Existing state is detected and reused.
#   * Templated: every path/port/user is derived from $HOME and config.env.
#     Nothing is hardcoded to another developer's machine.
#   * Secret-free: the Anthropic key is prompted for and stored in the macOS
#     Keychain. No key is ever written to a plist, this repo, or a logfile.
#
# USAGE
#   ./install.sh                 # full install
#   ./install.sh --dry-run       # print what would happen, touch nothing
#   ./install.sh --skip-build    # assume binaries already built (see --use-local)
#   ./install.sh --skip-services # lay down files but don't load LaunchAgents
#   ./install.sh --help
# ─────────────────────────────────────────────────────────────────────────────
set -euo pipefail

# ── Locate ourselves ─────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
TEMPLATES="${SCRIPT_DIR}/templates"

# ── Flags ────────────────────────────────────────────────────────────────────
DRY_RUN=0; SKIP_BUILD=0; SKIP_SERVICES=0; USE_LOCAL_BINARIES=0
for arg in "$@"; do
  case "$arg" in
    --dry-run)       DRY_RUN=1 ;;
    --skip-build)    SKIP_BUILD=1 ;;
    --skip-services) SKIP_SERVICES=1 ;;
    --use-local)     USE_LOCAL_BINARIES=1 ;;
    --help|-h)
      sed -n '2,40p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
      exit 0 ;;
    *) echo "unknown flag: $arg" >&2; exit 2 ;;
  esac
done

# ── Pretty logging ───────────────────────────────────────────────────────────
c_blue=$'\033[1;34m'; c_grn=$'\033[1;32m'; c_yel=$'\033[1;33m'; c_red=$'\033[1;31m'; c_off=$'\033[0m'
step() { echo "${c_blue}▶${c_off} $*"; }
ok()   { echo "${c_grn}✓${c_off} $*"; }
warn() { echo "${c_yel}!${c_off} $*"; }
die()  { echo "${c_red}✗ $*${c_off}" >&2; exit 1; }
run()  { if [ "$DRY_RUN" = 1 ]; then echo "   [dry-run] $*"; else eval "$*"; fi; }

# ── Load config ──────────────────────────────────────────────────────────────
if [ -f "${SCRIPT_DIR}/config.env" ]; then
  # shellcheck disable=SC1091
  source "${SCRIPT_DIR}/config.env"
else
  # shellcheck disable=SC1091
  source "${SCRIPT_DIR}/config.env.example"
  warn "No config.env found — using defaults from config.env.example."
fi

# Derived / defaulted values (never hardcode a home directory)
: "${NEURON_HOME:=${HOME}/.neuron}"
: "${DEV_ROOT:=${HOME}/Development/neuron-technologies}"
: "${SOUL_PORT:=7770}"; : "${ENGRAM_PORT:=8742}"; : "${WRAPPER_PORT:=17779}"; : "${PROXY_PORT:=7779}"
: "${ENGRAM_DATA_DIR:=${NEURON_HOME}/engram}"
: "${ENGRAM_API_KEY:=}"
: "${KEYCHAIN_SERVICE:=neuron-llm-0-key}"
: "${EL_TOOLCHAIN_SOURCE:=artifact-registry}"
: "${NEURON_REPO_BRANCH:=main}"

NEURON_REPO="${DEV_ROOT}/neuron"
ENGRAM_REPO="${DEV_ROOT}/engram"
FOUNDATION_REPO="${DEV_ROOT}/foundation"

SOUL_BIN="${NEURON_REPO}/dist/neuron"
ENGRAM_BIN="${ENGRAM_REPO}/dist/engram"
MCP_WRAPPER_BIN="${NEURON_REPO}/mcp-wrapper/dist/neuron-mcp-wrapper"
MCP_PROXY_BIN="${NEURON_REPO}/mcp-proxy/dist/neuron-mcp-proxy"
FORGE_BIN="${FOUNDATION_REPO}/forge/dist/forge"
GENESIS_SEED="${FOUNDATION_REPO}/forge/seeds/neuron-genesis-seed.json"

LAUNCHAGENTS="${HOME}/Library/LaunchAgents"
CLAUDE_DIR="${HOME}/.claude"

# Generate a local engram token if none was supplied.
if [ -z "${ENGRAM_API_KEY}" ]; then
  ENGRAM_API_KEY="ntn-dev-$(head -c8 /dev/urandom | xxd -p 2>/dev/null || echo local)"
fi

echo
echo "${c_blue}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
echo "${c_blue}  Neuron CORE dev stack installer${c_off}"
echo "${c_blue}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
echo "  user            : ${USER}"
echo "  NEURON_HOME     : ${NEURON_HOME}"
echo "  source repos    : ${DEV_ROOT}"
echo "  ports           : soul=${SOUL_PORT} engram=${ENGRAM_PORT} wrapper=${WRAPPER_PORT} proxy=${PROXY_PORT}"
echo "  dry-run         : ${DRY_RUN}"
echo

# render <template> <dest> — copy a template, substituting @@VARS@@ (no eval, sed-safe).
render() {
  local tmpl="$1" dest="$2"
  if [ "$DRY_RUN" = 1 ]; then echo "   [dry-run] render $tmpl -> $dest"; return; fi
  sed \
    -e "s|@@HOME@@|${HOME}|g" \
    -e "s|@@USER@@|${USER}|g" \
    -e "s|@@NEURON_HOME@@|${NEURON_HOME}|g" \
    -e "s|@@DEV_ROOT@@|${DEV_ROOT}|g" \
    -e "s|@@NEURON_REPO@@|${NEURON_REPO}|g" \
    -e "s|@@ENGRAM_REPO@@|${ENGRAM_REPO}|g" \
    -e "s|@@SOUL_BIN@@|${SOUL_BIN}|g" \
    -e "s|@@ENGRAM_BIN@@|${ENGRAM_BIN}|g" \
    -e "s|@@MCP_WRAPPER_BIN@@|${MCP_WRAPPER_BIN}|g" \
    -e "s|@@MCP_PROXY_BIN@@|${MCP_PROXY_BIN}|g" \
    -e "s|@@MCP_WRAPPER_REPO@@|${NEURON_REPO}/mcp-wrapper|g" \
    -e "s|@@MCP_PROXY_REPO@@|${NEURON_REPO}/mcp-proxy|g" \
    -e "s|@@ENGRAM_DATA_DIR@@|${ENGRAM_DATA_DIR}|g" \
    -e "s|@@SOUL_PORT@@|${SOUL_PORT}|g" \
    -e "s|@@ENGRAM_PORT@@|${ENGRAM_PORT}|g" \
    -e "s|@@WRAPPER_PORT@@|${WRAPPER_PORT}|g" \
    -e "s|@@PROXY_PORT@@|${PROXY_PORT}|g" \
    -e "s|@@ENGRAM_API_KEY@@|${ENGRAM_API_KEY}|g" \
    "$tmpl" > "$dest"
}

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 1 — Preflight
# ─────────────────────────────────────────────────────────────────────────────
step "Phase 1 — preflight checks"
[ "$(uname -s)" = "Darwin" ] || die "This installer targets macOS (launchd)."
[ "$(uname -m)" = "arm64" ]  || warn "Non-arm64 Mac: soul.c build flags assume Apple Silicon; review PHASE 3."

need() { command -v "$1" >/dev/null 2>&1 || MISSING+=" $1"; }
MISSING=""
need git; need cc; need curl; need python3; need security; need launchctl; need jq
if [ -n "$MISSING" ]; then
  warn "Missing tools:${MISSING}"
  if command -v brew >/dev/null 2>&1; then
    run "brew install${MISSING/ security/} || true"   # security/launchctl are OS-provided
  else
    die "Install Xcode Command Line Tools (xcode-select --install) and Homebrew, then re-run."
  fi
fi
# Runtime build deps used by the soul cc line (-lssl -lcrypto -lcurl).
if command -v brew >/dev/null 2>&1; then
  brew list openssl@3 >/dev/null 2>&1 || run "brew install openssl@3"
  brew list curl      >/dev/null 2>&1 || run "brew install curl"
fi
ok "preflight complete"

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 2 — Anthropic API key -> Keychain (prompt; never store in files)
# ─────────────────────────────────────────────────────────────────────────────
step "Phase 2 — Anthropic API key (Keychain)"
if security find-generic-password -a "$USER" -s "$KEYCHAIN_SERVICE" -w >/dev/null 2>&1; then
  ok "key already present in Keychain (service '${KEYCHAIN_SERVICE}') — leaving it"
elif [ -n "${ANTHROPIC_API_KEY:-}" ]; then
  run "security add-generic-password -a \"$USER\" -s \"$KEYCHAIN_SERVICE\" -w \"\$ANTHROPIC_API_KEY\" -U"
  ok "stored ANTHROPIC_API_KEY from environment into Keychain"
else
  if [ "$DRY_RUN" = 1 ]; then
    echo "   [dry-run] would prompt for Anthropic API key and store in Keychain"
  elif [ -t 0 ]; then
    echo "   Enter your Anthropic API key (input hidden). Get one at https://console.anthropic.com/"
    read -r -s -p "   ANTHROPIC_API_KEY: " _key; echo
    [ -n "$_key" ] || die "No key entered. Re-run when you have one."
    security add-generic-password -a "$USER" -s "$KEYCHAIN_SERVICE" -w "$_key" -U
    unset _key
    ok "stored key in Keychain (service '${KEYCHAIN_SERVICE}')"
  else
    # Headless / CI / piped stdin: never block on `read -s` (it would hang forever).
    die "No Anthropic API key and stdin is not a TTY (headless/CI). Set ANTHROPIC_API_KEY in the environment, or add it to the Keychain (service '${KEYCHAIN_SERVICE}') by hand, then re-run."
  fi
fi

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 3 — Fetch sources + build the four core binaries
# ─────────────────────────────────────────────────────────────────────────────
step "Phase 3 — source + build"
run "mkdir -p \"$DEV_ROOT\""

clone_or_pull() {
  local url="$1" dir="$2" branch="${3:-main}"
  if [ -d "$dir/.git" ]; then
    ok "repo present: $dir (pulling $branch)"; run "git -C \"$dir\" pull --ff-only --quiet || true"
  else
    step "cloning $url -> $dir"; run "git clone --branch \"$branch\" \"$url\" \"$dir\""
  fi
}

if [ "$SKIP_BUILD" = 1 ]; then
  warn "--skip-build: assuming binaries already exist at their dist/ paths"
elif [ "$USE_LOCAL_BINARIES" = 1 ]; then
  warn "--use-local: skipping clone/build; expecting prebuilt binaries in place"
else
  clone_or_pull "${NEURON_REPO_URL}"     "$NEURON_REPO"     "$NEURON_REPO_BRANCH"
  clone_or_pull "${ENGRAM_REPO_URL}"     "$ENGRAM_REPO"     "main"
  # NOTE: no foundation.git — that repo does not exist. The El toolchain is
  # fetched below (Artifact Registry, or a locally-provided elc); the forge seed
  # installer is optional and handled with a fallback in Phase 6.

  # ── El toolchain (needed to transpile .el -> .c for engram/wrapper/proxy) ──
  # soul does NOT need this: dist/soul.c is committed and compiled directly.
  EL_RUNTIME_DIR="${DEV_ROOT}/.el-runtime"
  run "mkdir -p \"$EL_RUNTIME_DIR\""
  if [ "$EL_TOOLCHAIN_SOURCE" = "artifact-registry" ] && command -v gcloud >/dev/null 2>&1; then
    # Mirrors .gitea/workflows/ci.yaml: pull el-runtime-c, el-runtime-h, el-elc.
    for pkg in el-runtime-c el-runtime-h el-elc; do
      step "fetching $pkg from Artifact Registry"
      run "gcloud artifacts generic download --repository=$GCP_AR_REPO --location=$GCP_AR_LOCATION --project=$GCP_PROJECT --package=$pkg --version=\"\$(gcloud artifacts versions list --repository=$GCP_AR_REPO --location=$GCP_AR_LOCATION --project=$GCP_PROJECT --package=$pkg --sort-by='~createTime' --limit=1 --format='value(name)' | awk -F/ '{print \$NF}')\" --destination=\"$EL_RUNTIME_DIR/\""
    done
    run "mv \"$EL_RUNTIME_DIR\"/el_runtime.c* \"$EL_RUNTIME_DIR/el_runtime.c\" 2>/dev/null || true"
    run "mv \"$EL_RUNTIME_DIR\"/el_runtime.h* \"$EL_RUNTIME_DIR/el_runtime.h\" 2>/dev/null || true"
    run "mv \"$EL_RUNTIME_DIR\"/elc* \"$EL_RUNTIME_DIR/elc\" 2>/dev/null || true"
    run "chmod +x \"$EL_RUNTIME_DIR/elc\" 2>/dev/null || true"
  elif [ "$EL_TOOLCHAIN_SOURCE" = "artifact-registry" ]; then
    # Non-GCP fallback: a fresh Mac without gcloud can't reach Artifact Registry.
    # Don't die — soul (from committed dist/soul.c) still builds below. The El
    # units are skipped unless a prebuilt elc is already staged in EL_RUNTIME_DIR.
    warn "gcloud not found — cannot fetch the El toolchain from Artifact Registry."
    warn "Continuing without it: soul will still build. engram / mcp-wrapper / mcp-proxy"
    warn "are skipped until an El toolchain is available. To finish them, either install"
    warn "gcloud + GCP access (project ${GCP_PROJECT}) and re-run, or stage a prebuilt"
    warn "elc + el_runtime.{c,h} in ${EL_RUNTIME_DIR} and set EL_TOOLCHAIN_SOURCE=local."
  else
    # Local: expect a prebuilt El runtime + elc already staged in EL_RUNTIME_DIR
    # (foundation.git no longer exists, so there is nothing to build from here).
    warn "EL_TOOLCHAIN_SOURCE=local: expecting el_runtime.{c,h} and elc already in ${EL_RUNTIME_DIR}"
  fi

  RT="$EL_RUNTIME_DIR"
  CFLAGS_SSL="-I$(brew --prefix openssl@3 2>/dev/null)/include"
  LDFLAGS_SSL="-L$(brew --prefix openssl@3 2>/dev/null)/lib"

  # Every native build links el_runtime.c. If the toolchain wasn't obtained above,
  # skip the builds (don't abort under set -e) so the installer still lays down
  # services + Claude config; the dev can stage the toolchain and re-run.
  if [ "$DRY_RUN" = 1 ] || [ -f "$RT/el_runtime.c" ]; then
    # ── soul: compile committed dist/soul.c directly (verified CI recipe) ──────
    step "building soul (dist/soul.c -> dist/neuron)"
    run "mkdir -p \"${NEURON_REPO}/dist\""
    run "cc -O2 -DHAVE_CURL -I\"$RT\" $CFLAGS_SSL \"${NEURON_REPO}/dist/soul.c\" \"$RT/el_runtime.c\" $LDFLAGS_SSL -lssl -lcrypto -lcurl -lpthread -lm -o \"$SOUL_BIN\""
    run "strip -S \"$SOUL_BIN\" 2>/dev/null || true"
    ok "soul built"

    # ── engram / mcp-wrapper / mcp-proxy: transpile .el -> .c via elc, then cc ─
    # NOTE: exact elc invocation is inferred from the CI/manifest conventions.
    #       Verify flags with Will if a build fails (see README OPEN QUESTIONS).
    build_el_unit() { # <src.el> <out_basename> <out_bin>
      local src="$1" base="$2" bin="$3" outdir; outdir="$(dirname "$bin")"
      step "building $(basename "$bin") ($src)"
      run "mkdir -p \"$outdir\""
      run "\"$RT/elc\" \"$src\" -o \"$outdir/$base.c\""
      run "cc -O2 -DHAVE_CURL -I\"$RT\" $CFLAGS_SSL \"$outdir/$base.c\" \"$RT/el_runtime.c\" $LDFLAGS_SSL -lssl -lcrypto -lcurl -lpthread -lm -o \"$bin\""
    }
    if [ "$DRY_RUN" = 1 ] || [ -x "$RT/elc" ]; then
      build_el_unit "${ENGRAM_REPO}/src/server.el"           "server" "$ENGRAM_BIN"
      build_el_unit "${NEURON_REPO}/mcp-wrapper/src/main.el" "main"   "$MCP_WRAPPER_BIN"
      build_el_unit "${NEURON_REPO}/mcp-proxy/src/main.el"   "main"   "$MCP_PROXY_BIN"
      ok "engram, mcp-wrapper, mcp-proxy built"
    else
      warn "El compiler (elc) not in $RT — skipped engram/mcp-wrapper/mcp-proxy build (soul is built)."
    fi
  else
    warn "El runtime (el_runtime.c) not in $RT — skipping native builds (soul, engram, wrapper, proxy)."
    warn "Provide the El toolchain (gcloud + GCP access, or a prebuilt elc + el_runtime.{c,h} in $RT), then re-run."
  fi
fi

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 4 — Lay down ~/.neuron (bin/, logs/, engram data dir)
# ─────────────────────────────────────────────────────────────────────────────
step "Phase 4 — ~/.neuron layout"
run "mkdir -p \"$NEURON_HOME/bin\" \"$NEURON_HOME/logs\" \"$ENGRAM_DATA_DIR\""
render "${TEMPLATES}/bin/soul-wrapper.sh.tmpl" "${NEURON_HOME}/bin/soul-wrapper.sh"
run "chmod +x \"${NEURON_HOME}/bin/soul-wrapper.sh\""
ok "~/.neuron ready (bin/soul-wrapper.sh, logs/, engram/)"

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 5 — Install + load the four core LaunchAgents
# ─────────────────────────────────────────────────────────────────────────────
step "Phase 5 — LaunchAgents"
run "mkdir -p \"$LAUNCHAGENTS\""
CORE_AGENTS=(ai.neuron.engram ai.neuron.soul ai.neuron.mcp-wrapper ai.neuron.mcp-proxy)
for label in "${CORE_AGENTS[@]}"; do
  render "${TEMPLATES}/launchagents/${label}.plist.tmpl" "${LAUNCHAGENTS}/${label}.plist"
  ok "wrote ${label}.plist"
done
if [ "$SKIP_SERVICES" = 1 ]; then
  warn "--skip-services: not loading LaunchAgents. Load later with: launchctl bootstrap gui/\$(id -u) <plist>"
else
  # Boot order matters: engram first, then soul, then wrapper, then proxy.
  for label in "${CORE_AGENTS[@]}"; do
    plist="${LAUNCHAGENTS}/${label}.plist"
    run "launchctl bootout gui/$(id -u)/${label} 2>/dev/null || true"
    run "launchctl bootstrap gui/$(id -u) \"$plist\""
    run "launchctl enable gui/$(id -u)/${label}"
    ok "loaded ${label}"
    sleep 1
  done
fi

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 6 — Seed a fresh engram with Neuron's identity (genesis seed)
# ─────────────────────────────────────────────────────────────────────────────
step "Phase 6 — engram identity seed"
# The genesis seed carries identity_nodes[] and edges[] with FIXED knowledge-node
# IDs (e.g. kn-efeb4a5b...). Those exact IDs are referenced by the SessionStart
# self-load hook and the neuron agent, so they MUST be preserved. `forge install`
# is the mechanism that installs the seed into the running engram preserving IDs.
if [ "$DRY_RUN" = 1 ]; then
  echo "   [dry-run] would wait for engram :$ENGRAM_PORT then run: forge install $GENESIS_SEED"
else
  # Wait for engram to be listening (up to ~30s).
  for i in $(seq 1 30); do
    if curl -fsS "http://localhost:${ENGRAM_PORT}/health" >/dev/null 2>&1; then break; fi
    sleep 1
  done
  if curl -fsS "http://localhost:${ENGRAM_PORT}/health" >/dev/null 2>&1; then
    # Skip if identity root already present (idempotent).
    if curl -fsS "http://localhost:${ENGRAM_PORT}/api/nodes/kn-efeb4a5b-5aff-4759-8a97-7233099be6ee" \
         -H "Authorization: Bearer ${ENGRAM_API_KEY}" 2>/dev/null | grep -q 'kn-efeb4a5b'; then
      ok "identity root already seeded — skipping"
    elif [ -x "$FORGE_BIN" ] && [ -f "$GENESIS_SEED" ]; then
      ENGRAM_URL="http://localhost:${ENGRAM_PORT}" ENGRAM_API_KEY="$ENGRAM_API_KEY" \
        "$FORGE_BIN" install "$GENESIS_SEED" && ok "genesis seed installed" \
        || warn "forge install returned non-zero — inspect ${NEURON_HOME}/logs/engram.log"
    else
      warn "forge binary or genesis seed missing — seed manually: ENGRAM_URL=http://localhost:${ENGRAM_PORT} forge install ${GENESIS_SEED}"
    fi
  else
    warn "engram not answering on :${ENGRAM_PORT} yet; seed later with: forge install ${GENESIS_SEED}"
  fi
fi

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 7 — Claude Code config (agent + core hooks + local MCP)
# ─────────────────────────────────────────────────────────────────────────────
step "Phase 7 — Claude Code config"
run "mkdir -p \"$CLAUDE_DIR/agents\" \"$CLAUDE_DIR/hooks\""

# 7a. neuron agent
run "cp \"${TEMPLATES}/claude/agents/neuron.md\" \"$CLAUDE_DIR/agents/neuron.md\""
ok "installed agent: ~/.claude/agents/neuron.md"

# 7b. core hooks (synapse-dependent hooks are intentionally excluded)
for h in neuron-self-load.sh neuron-agent-preamble.sh pre-compact.sh; do
  run "cp \"${TEMPLATES}/claude/hooks/$h\" \"$CLAUDE_DIR/hooks/$h\""
  run "chmod +x \"$CLAUDE_DIR/hooks/$h\""
done
ok "installed core hooks (self-load, agent-preamble, pre-compact)"

# 7c. local MCP registration -> mcp-proxy front door.
# Claude Code reads MCP servers from ~/.claude.json (the "mcpServers" key), NOT
# ~/.claude/mcp.json. Render a reference copy, then jq-merge just the "neuron"
# entry into ~/.claude.json so we preserve every other server and top-level key.
render "${TEMPLATES}/claude/mcp.json.tmpl" "${CLAUDE_DIR}/mcp.json.neuron"
CLAUDE_JSON="${HOME}/.claude.json"
if [ "$DRY_RUN" = 1 ]; then
  echo "   [dry-run] merge mcpServers.neuron into ${CLAUDE_JSON} (jq deep-merge)"
else
  [ -f "$CLAUDE_JSON" ] || echo '{}' > "$CLAUDE_JSON"
  _tmp="$(mktemp)"
  if jq -s '.[0] * .[1]' "$CLAUDE_JSON" "${CLAUDE_DIR}/mcp.json.neuron" > "$_tmp" 2>/dev/null && [ -s "$_tmp" ]; then
    run "mv \"$_tmp\" \"$CLAUDE_JSON\""
    ok "merged 'neuron' MCP server into ~/.claude.json (neuron -> http://127.0.0.1:${PROXY_PORT}/)"
  else
    rm -f "$_tmp"
    warn "could not jq-merge ~/.claude.json (invalid JSON?) — add 'neuron' from ~/.claude/mcp.json.neuron by hand"
  fi
fi

# 7d. settings hooks — merge the neuron hooks into any existing ~/.claude/settings.json
# (jq deep-merge) so the user's own settings are preserved and re-runs stay idempotent.
if [ -f "${CLAUDE_DIR}/settings.json" ]; then
  run "cp \"${TEMPLATES}/claude/settings.core.json\" \"${CLAUDE_DIR}/settings.core.json\""
  if [ "$DRY_RUN" = 1 ]; then
    echo "   [dry-run] merge neuron hooks from settings.core.json into ~/.claude/settings.json (jq)"
  else
    _tmp="$(mktemp)"
    # Drop the documentation-only "//..." keys before merging into the real file.
    if jq -s '.[0] * (.[1] | with_entries(select(.key | startswith("//") | not)))' \
         "${CLAUDE_DIR}/settings.json" "${TEMPLATES}/claude/settings.core.json" > "$_tmp" 2>/dev/null && [ -s "$_tmp" ]; then
      run "mv \"$_tmp\" \"${CLAUDE_DIR}/settings.json\""
      ok "merged neuron hooks into existing ~/.claude/settings.json"
    else
      rm -f "$_tmp"
      warn "could not jq-merge ~/.claude/settings.json — merge the 'hooks' block from settings.core.json by hand"
    fi
  fi
else
  run "cp \"${TEMPLATES}/claude/settings.core.json\" \"${CLAUDE_DIR}/settings.json\""
  ok "wrote ~/.claude/settings.json"
fi

# ─────────────────────────────────────────────────────────────────────────────
# PHASE 8 — Verify
# ─────────────────────────────────────────────────────────────────────────────
echo
step "Phase 8 — verification"
if [ "$DRY_RUN" = 1 ]; then
  echo "   [dry-run] would health-check :$SOUL_PORT :$ENGRAM_PORT :$WRAPPER_PORT :$PROXY_PORT"
else
  check() { # <name> <url>
    if curl -fsS --max-time 4 "$2" >/dev/null 2>&1; then ok "$1 healthy ($2)"; else warn "$1 NOT responding ($2)"; fi
  }
  sleep 3
  check "engram"      "http://localhost:${ENGRAM_PORT}/health"
  check "soul"        "http://localhost:${SOUL_PORT}/health"
  check "mcp-wrapper" "http://localhost:${WRAPPER_PORT}/health"
  check "mcp-proxy"   "http://localhost:${PROXY_PORT}/health"
fi

echo
echo "${c_grn}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
echo "${c_grn}  Neuron core dev stack install complete.${c_off}"
echo "${c_grn}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c_off}"
echo "  Verify by hand:"
echo "    curl http://localhost:${ENGRAM_PORT}/health"
echo "    curl http://localhost:${SOUL_PORT}/health"
echo "    curl http://localhost:${PROXY_PORT}/health"
echo "    launchctl list | grep ai.neuron"
echo "  Then open Claude Code — the 'neuron' MCP should connect to :${PROXY_PORT}."
echo "  Logs: ${NEURON_HOME}/logs/"
echo "  Uninstall: ./uninstall.sh"
echo