Veil RC installer — virgin install + launch

install-rc.sh

#!/bin/bash
# install-rc.sh — Download latest Veil RC, clean install, and launch
# Usage: curl -fsSL https://gist.githubusercontent.com/sghael/GIST_ID/raw/install-rc.sh | bash
#    or: bash install-rc.sh [tag]       e.g. bash install-rc.sh v0.9.0-rc.5

set -euo pipefail

REPO="spectrumzero-dev/veil-app"
APP_SUPPORT="$HOME/Library/Application Support/com.spectrumzero.veil"
DEFAULTS_DOMAIN="com.spectrumzero.veil"
INSTALL_DIR="/Applications"
APP_NAME="Veil.app"

# --- Resolve tag ---
TAG="${1:-}"
if [[ -z "$TAG" ]]; then
    echo "Fetching latest pre-release tag..."
    TAG=$(gh release list --repo "$REPO" --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null)
    if [[ -z "$TAG" ]]; then
        echo "ERROR: Could not determine latest release. Pass a tag explicitly: bash install-rc.sh v0.9.0-rc.5"
        exit 1
    fi
fi
echo "==> Installing $TAG"

# --- Kill existing Veil ---
if pgrep -x "Veil" >/dev/null 2>&1; then
    echo "==> Killing running Veil..."
    killall Veil 2>/dev/null || true
    sleep 1
fi

# --- Virgin install: wipe all state ---
echo "==> Wiping previous state (virgin install)..."
defaults delete "$DEFAULTS_DOMAIN" 2>/dev/null || true
rm -rf "$APP_SUPPORT"
security delete-generic-password -s "$DEFAULTS_DOMAIN" 2>/dev/null || true

# Reset TCC entries (Full Disk Access, etc.) so the new binary starts clean.
# This prevents the "stale grant" issue where System Settings shows FDA as on
# but the new binary can't actually read TCC.db due to code signature mismatch.
tccutil reset SystemPolicyAllFiles "$DEFAULTS_DOMAIN" 2>/dev/null || true
echo "   Cleared: UserDefaults, Application Support, Keychain, TCC entries"

# --- Remove old app ---
if [[ -d "$INSTALL_DIR/$APP_NAME" ]]; then
    echo "==> Removing old $APP_NAME from $INSTALL_DIR..."
    rm -rf "$INSTALL_DIR/$APP_NAME"
fi

# --- Download ---
TMPDIR_DL=$(mktemp -d)
echo "==> Downloading $TAG..."
gh release download "$TAG" --repo "$REPO" --pattern "*.zip" --dir "$TMPDIR_DL"

ZIP_FILE=$(find "$TMPDIR_DL" -name "*.zip" -print -quit)
if [[ -z "$ZIP_FILE" ]]; then
    echo "ERROR: No zip found in release $TAG"
    rm -rf "$TMPDIR_DL"
    exit 1
fi

# --- Extract & install ---
echo "==> Extracting..."
ditto -x -k "$ZIP_FILE" "$TMPDIR_DL/extracted"

EXTRACTED_APP=$(find "$TMPDIR_DL/extracted" -maxdepth 2 -name "*.app" -print -quit)
if [[ -z "$EXTRACTED_APP" ]]; then
    echo "ERROR: No .app found in zip"
    rm -rf "$TMPDIR_DL"
    exit 1
fi

echo "==> Installing to $INSTALL_DIR/$APP_NAME..."
cp -R "$EXTRACTED_APP" "$INSTALL_DIR/$APP_NAME"

# --- Clear quarantine ---
xattr -cr "$INSTALL_DIR/$APP_NAME" 2>/dev/null || true

# --- Cleanup ---
rm -rf "$TMPDIR_DL"

# --- Launch ---
echo "==> Launching Veil..."
open "$INSTALL_DIR/$APP_NAME"

echo ""
echo "Done! Veil $TAG installed and launched."
echo "Look for the shield icon in your menu bar."