#!/usr/bin/env bash
# Verificate HELIX v1.8 — online installer + the installed `verificate` CLI.
#
#   Install:   curl -fsSL https://get.verificate.ai | sudo bash
#   Then:      sudo verificate refresh    (new/renewed license key — seconds, no re-download)
#              verificate status          (containers, health, license days remaining)
#   (One-shot refresh without the CLI: curl -fsSL https://get.verificate.ai | sudo bash -s refresh)
#
# A successful install copies this script to /usr/local/bin/verificate. Invoked by that name
# with no arguments it shows usage — it NEVER silently reinstalls (a bare re-install would
# consume an activation seat).
#
# What it does: verifies this host can actually run the bundle (Linux x86_64, AVX-512, RAM, disk,
# Docker), asks for your install key, activates against get.verificate.ai, downloads the licensed
# images + model with resume support, verifies every sha256, and starts the stack. After install
# the runtime is FULLY OFFLINE — nothing phones home; the signed license file enforces expiry
# locally. `refresh` swaps in a new license token without touching images or the model.
#
# Every failure is loud and specific. No silent fallbacks.
set -euo pipefail

VERIFICATE_OFFICIAL_URL="https://get.verificate.ai"
VERIFICATE_URL="${VERIFICATE_URL:-$VERIFICATE_OFFICIAL_URL}"
INSTALL_DIR="${VERIFICATE_INSTALL_DIR:-/opt/verificate-helix}"
INSTALLER_REV="2026-10-08"   # bump on every published change; printed by install/help
MIN_RAM_GB=80
MIN_DISK_GB=70

say()  { printf '\033[1;36m[verificate]\033[0m %s\n' "$*"; }
fail() { printf '\033[1;31m[verificate] ERROR:\033[0m %s\n' "$*" >&2; exit 1; }

# ---- helpers ---------------------------------------------------------------------------------------
need_cmd() { command -v "$1" >/dev/null 2>&1 || fail "'$1' is required but not installed$2"; }

json_get() {  # json_get <file> <dotted.path>  — python3 does the JSON heavy lifting (no jq dep)
  python3 - "$1" "$2" <<'PY'
import json, sys
obj = json.load(open(sys.argv[1]))
for part in sys.argv[2].split("."):
    obj = obj[int(part)] if isinstance(obj, list) else obj[part]
print(obj if not isinstance(obj, (dict, list)) else json.dumps(obj))
PY
}

prompt_key() {
  if [ -n "${VERIFICATE_INSTALL_KEY:-}" ]; then
    INSTALL_KEY="$VERIFICATE_INSTALL_KEY"
    return
  fi
  # curl|bash leaves stdin consumed by the pipe — read the key from the terminal directly.
  [ -r /dev/tty ] || fail "no terminal available to prompt for the key — set VERIFICATE_INSTALL_KEY instead"
  printf 'Enter your Verificate install key (vik-...): ' > /dev/tty
  read -r INSTALL_KEY < /dev/tty
  case "$INSTALL_KEY" in vik-*) ;; *) fail "that does not look like an install key (expected vik-...)" ;; esac
}

collect_hw() {
  ARCH="$(uname -m)"
  CPU_FLAGS="$(grep -m1 '^flags' /proc/cpuinfo | cut -d: -f2- || true)"
  RAM_GB=$(( $(grep -m1 MemTotal /proc/meminfo | awk '{print $2}') / 1048576 ))
  # Root-only install dir: downloaded artifacts sit here between sha256 verification and
  # docker load — no non-root user may have write (or even read) access in that window.
  mkdir -p "$INSTALL_DIR"
  chmod 700 "$INSTALL_DIR"
  DISK_GB=$(( $(df -Pk "$INSTALL_DIR" | awk 'NR==2{print $4}') / 1048576 ))
  # GPU is informational only (licensing never depends on it). Must never abort the install:
  # on a CPU-only host `command -v nvidia-smi` returns non-zero, and as collect_hw's last
  # statement that would make the function return non-zero and trip `set -e` at the call site
  # (the "nvidia-smi missing" failure). Guard it so the function always ends 0.
  GPU="none"
  if command -v nvidia-smi >/dev/null 2>&1; then
    GPU="$(nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1 || true)"
    [ -n "$GPU" ] || GPU="none"
  fi
  return 0
}

check_host() {
  # Everything trusted (artifact URLs AND their sha256s) comes from this server, so a silently
  # redirected VERIFICATE_URL = arbitrary root code execution. Overrides (staging tests) must be
  # explicit and acknowledged.
  if [ "$VERIFICATE_URL" != "$VERIFICATE_OFFICIAL_URL" ]; then
    [ "${VERIFICATE_URL_ACK:-}" = "1" ] || fail \
      "VERIFICATE_URL is overridden to '$VERIFICATE_URL' (official: $VERIFICATE_OFFICIAL_URL).
  If this is intentional (staging), re-run with VERIFICATE_URL_ACK=1. Otherwise your environment
  may be compromised — do NOT proceed."
    say "WARNING: using overridden server $VERIFICATE_URL (acknowledged)"
  fi
  [ "$(uname -s)" = "Linux" ] || fail "this installer supports Linux only (found $(uname -s))"
  [ "$ARCH" = "x86_64" ] || fail "x86_64 required (found $ARCH)"
  [ "$(id -u)" = "0" ] || fail "run as root: curl -fsSL $VERIFICATE_URL | sudo bash"
  need_cmd python3 " (apt/dnf install python3)"
  need_cmd curl ""
  echo "$CPU_FLAGS" | grep -qw avx512f || fail \
    "this CPU has no AVX-512. The HELIX v1.8 CPU engine is compiled for AVX-512 (AMD Zen4+/Intel
  Sapphire Rapids+) and would crash with an illegal instruction here. Contact info@verificate.ai
  about hardware options."
  [ "$RAM_GB" -ge "$MIN_RAM_GB" ] || fail "${RAM_GB} GiB RAM found; ${MIN_RAM_GB} GiB needed for the 120B model"
  [ "$DISK_GB" -ge "$MIN_DISK_GB" ] || fail "${DISK_GB} GiB free at $INSTALL_DIR; ${MIN_DISK_GB} GiB needed"
  if ! command -v docker >/dev/null 2>&1; then
    say "Docker not found — installing via get.docker.com (the only third-party step)..."
    curl -fsSL https://get.docker.com | sh || fail "Docker install failed — install Docker 24+ manually and re-run"
  fi
  docker compose version >/dev/null 2>&1 || fail "Docker Compose v2 plugin missing (docker-compose-plugin package)"
}

activate() {
  say "Activating against $VERIFICATE_URL ..."
  local req="$INSTALL_DIR/.activate-req.json" resp="$INSTALL_DIR/.activate-resp.json" http
  python3 - "$req" "$INSTALL_KEY" "$ARCH" "$RAM_GB" "$DISK_GB" "$GPU" "$CPU_FLAGS" <<'PY'
import json, sys
json.dump({"install_key": sys.argv[2],
           "hw": {"arch": sys.argv[3], "ram_gb": int(sys.argv[4]), "disk_gb": int(sys.argv[5]),
                  "gpu": sys.argv[6], "cpu_flags": sys.argv[7].strip()}}, open(sys.argv[1], "w"))
PY
  http=$(curl -sS -o "$resp" -w '%{http_code}' -H 'Content-Type: application/json' \
              --data-binary @"$req" "$VERIFICATE_URL/activate") || fail "cannot reach $VERIFICATE_URL"
  rm -f "$req"
  [ "$http" = "200" ] || fail "activation refused (HTTP $http): $(cat "$resp")"
  TIER=$(json_get "$resp" tier)
  say "Activated: tier=$TIER, expires $(date -u -d "@$(json_get "$resp" expires_at)" +%Y-%m-%d 2>/dev/null || json_get "$resp" expires_at)"
}

download_artifacts() {
  local resp="$INSTALL_DIR/.activate-resp.json" n i name url sha size f
  n=$(python3 -c "import json,sys; print(len(json.load(open(sys.argv[1]))['artifacts']))" "$resp")
  mkdir -p "$INSTALL_DIR/downloads"
  for i in $(seq 0 $((n - 1))); do
    name=$(json_get "$resp" "artifacts.$i.name")
    url=$(json_get  "$resp" "artifacts.$i.url")
    sha=$(json_get  "$resp" "artifacts.$i.sha256")
    size=$(json_get "$resp" "artifacts.$i.size")
    f="$INSTALL_DIR/downloads/$name"
    if [ -f "$f" ] && printf '%s  %s\n' "$sha" "$f" | sha256sum -c --quiet 2>/dev/null; then
      say "$name already downloaded and verified — skipping"
      continue
    fi
    # Re-install on the same host: the previous install MOVED the model to models/. Verifying the
    # 60 GB file there (a few minutes) beats re-downloading it (15 min on a fast link, hours on a slow one).
    case "$name" in *.gguf)
      if [ -f "$INSTALL_DIR/models/$name" ]; then
        say "$name found from a previous install — verifying sha256 (a few minutes)..."
        if printf '%s  %s\n' "$sha" "$INSTALL_DIR/models/$name" | sha256sum -c --quiet 2>/dev/null; then
          say "$name verified — reusing"
          continue
        fi
        say "$name in models/ does not match this release — re-downloading"
      fi ;;
    esac
    say "Downloading $name ($((size / 1048576)) MB, resumable)..."
    curl -fL --retry 5 --retry-all-errors -C - -o "$f" "$url" || fail "download of $name failed — re-run the installer to resume"
    printf '%s  %s\n' "$sha" "$f" | sha256sum -c --quiet || fail "sha256 MISMATCH on $name — corrupt or tampered download, re-run to retry"
    say "$name verified."
  done
}

# Resolve the uid:gid the proxy container ACTUALLY runs as. The compose file's `user:` wins over
# the image's USER, and image group ids are not stable across builds (the 1.8.1 proxy image's
# `helix` user is 10002:999, not 10002:10002). Hard-coding 10002 here was the bug behind the
# "license file unreadable -> 403 license_invalid" installs of Sept 2026: group 10002 got read
# access while the proxy ran with group 999. Ask the container; never assume.
proxy_identity() {
  local ids=""
  # A running proxy (refresh) answers directly; otherwise a throwaway container of the same
  # service (install — before first start). Both inherit the compose `user:` setting.
  ids=$( (cd "$INSTALL_DIR" && docker compose exec -T proxy sh -c 'echo "$(id -u):$(id -g)"') 2>/dev/null | tr -d '\r' | tail -1 ) || true
  case "$ids" in [0-9]*:[0-9]*) ;; *)
    ids=$( (cd "$INSTALL_DIR" && docker compose run --rm --no-deps -T --entrypoint /bin/sh proxy -c 'echo "$(id -u):$(id -g)"') 2>/dev/null | tr -d '\r' | tail -1 ) || true ;;
  esac
  case "$ids" in
    [0-9]*:[0-9]*) PROXY_UID="${ids%%:*}"; PROXY_GID="${ids##*:}" ;;
    *) fail "cannot determine the proxy container's uid:gid (got '$ids').
  Check: cd $INSTALL_DIR && docker compose run --rm --no-deps --entrypoint id proxy" ;;
  esac
}

# Make the license files readable by the proxy and nobody else: root-owned, group = the proxy's
# REAL group, dir 0750 / files 0640. Called at install and after every refresh.
grant_license_files() {
  proxy_identity
  chown root:"$PROXY_GID" "$INSTALL_DIR/license" "$INSTALL_DIR/license/license.vlt" "$INSTALL_DIR/license/license_pubkey.hex" \
    || fail "cannot grant the proxy (gid $PROXY_GID) access to the license files"
  chmod 0750 "$INSTALL_DIR/license" || fail "cannot set license directory permissions"
  chmod 0640 "$INSTALL_DIR/license/license.vlt" "$INSTALL_DIR/license/license_pubkey.hex" || fail "cannot set license file permissions"
  say "License files readable by the proxy (runs as ${PROXY_UID}:${PROXY_GID})"
}

# The clock high-water-mark lives on the `license_state` named volume (/var/lib/verificate-license).
# Docker creates named volumes root-owned and the proxy runs unprivileged on a read-only rootfs, so
# without this it cannot write clock.hwm and clock-rollback hardening degrades (service still works;
# the proxy logs a WARNING). chown needs CAP_CHOWN, which the hardened service drops (cap_drop ALL)
# — so a `docker compose run --user 0:0` of the service is root WITHOUT that capability and fails.
# Use a plain `docker run` of the same image on the same volume: no network, only the caps the
# chown needs. Best-effort by design: never abort the install here; print the manual fix instead.
grant_license_state_volume() {
  local cfg vol="" img=""
  if cfg=$( (cd "$INSTALL_DIR" && docker compose config --format json) 2>/dev/null ); then
    vol=$(printf '%s' "$cfg" | python3 -c 'import json,sys; print(json.load(sys.stdin)["volumes"]["license_state"]["name"])' 2>/dev/null || true)
    img=$(printf '%s' "$cfg" | python3 -c 'import json,sys; print(json.load(sys.stdin)["services"]["proxy"]["image"])' 2>/dev/null || true)
  fi
  [ -n "$vol" ] || vol=$(docker volume ls -q --filter label=com.docker.compose.volume=license_state 2>/dev/null | head -1 || true)
  [ -n "$img" ] || img=$(awk '/^  proxy:/{f=1} f && /image:/{print $2; exit}' "$INSTALL_DIR/docker-compose.yml" 2>/dev/null || true)
  if [ -n "$vol" ] && [ -n "$img" ] && docker run --rm --network none --user 0:0 \
        --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add DAC_OVERRIDE \
        --security-opt no-new-privileges:true -v "$vol:/var/lib/verificate-license" \
        --entrypoint /bin/sh "$img" -c "chown -R $PROXY_UID:$PROXY_GID /var/lib/verificate-license && chmod 0700 /var/lib/verificate-license" >/dev/null 2>&1; then
    say "License-state volume '$vol' owned by ${PROXY_UID}:${PROXY_GID}"
  else
    say "WARNING: could not pre-own the license-state volume (clock-rollback hardening degraded; service unaffected). Manual fix:"
    say "  docker run --rm --user 0:0 -v ${vol:-<project>_license_state}:/var/lib/verificate-license --entrypoint /bin/sh ${img:-verificate/helix-v18-proxy:1.8.1} -c 'chown -R ${PROXY_UID}:${PROXY_GID} /var/lib/verificate-license && chmod 0700 /var/lib/verificate-license' && cd $INSTALL_DIR && docker compose restart proxy"
  fi
}

# Parse the proxy's /health JSON -> "ok <days>" | "bad <code>" | "none" (bundle without licensing).
license_verdict() {
  printf '%s' "$1" | python3 -c '
import json, sys
l = (json.load(sys.stdin) or {}).get("license")
if l is None: print("none")
elif l.get("ok"): print("ok %s" % l.get("days_remaining"))
else: print("bad %s" % l.get("code"))' 2>/dev/null || echo "unparsable"
}

install_bundle() {
  local resp="$INSTALL_DIR/.activate-resp.json" d="$INSTALL_DIR/downloads"
  say "Loading Docker images..."
  local found_image=0 tarball
  for tarball in "$d"/*image*.tar.gz; do
    [ -e "$tarball" ] || break            # unexpanded glob = no matches
    found_image=1
    gunzip -c "$tarball" | docker load || fail "docker load failed for $tarball"
  done
  [ "$found_image" = "1" ] || fail "no *image*.tar.gz artifacts in the download set — the release bundle manifest is broken; contact info@verificate.ai"
  say "Installing bundle files..."
  tar -xzf "$d/compose-bundle.tar.gz" -C "$INSTALL_DIR" || fail "compose bundle extract failed"
  mkdir -p "$INSTALL_DIR/models" "$INSTALL_DIR/license"
  mv -f "$d"/*.gguf "$INSTALL_DIR/models/" 2>/dev/null || true
  # The bundle always ships a model — catch its absence NOW, not as an engine crash at first start.
  ls "$INSTALL_DIR/models/"*.gguf >/dev/null 2>&1 || fail "no model (.gguf) in the download set — the release bundle is broken; contact info@verificate.ai"
  umask 077
  json_get "$resp" license_token > "$INSTALL_DIR/license/license.vlt"
  json_get "$resp" license_pubkey_hex > "$INSTALL_DIR/license/license_pubkey.hex"
  {
    echo "VERIFICATE_API_KEY=$(json_get "$resp" runtime_api_key)"
    echo "VERIFICATE_LICENSE_PUBKEY=$(json_get "$resp" license_pubkey_hex)"
    echo "# Tuning (defaults shown; see CUSTOMER_RUNBOOK.md):"
    echo "#HELIX_THREADS=24"
    echo "#HELIX_PARALLEL=2"
    echo "#HELIX_CTX=8192"
    echo "#HELIX_HOST_PORT=8000"
  } > "$INSTALL_DIR/.env"
  chmod 600 "$INSTALL_DIR/.env"
  rm -f "$resp"          # contains the one-time runtime key — .env is now its only home
  # Create (do not start) the containers first: this materialises the networks and the
  # license_state volume, and lets us ask the proxy service who it runs as — THEN grant the
  # license files and the state volume to that identity, THEN start. The proxy never sees an
  # unreadable license, so there is no failed-first-start/restart dance to get wrong.
  say "Creating containers..."
  (cd "$INSTALL_DIR" && docker compose up --no-start) || fail "docker compose up --no-start failed"
  grant_license_files
  grant_license_state_volume
  say "Starting..."
  (cd "$INSTALL_DIR" && docker compose up -d) || fail "docker compose up failed"
}

wait_healthy() {
  say "Waiting for the engine to load the model (first start takes several minutes)..."
  local i out lic key http
  for i in $(seq 1 120); do
    if out=$(curl -sf http://127.0.0.1:8000/health 2>/dev/null); then
      # /health answers 200 as soon as the engine is ready EVEN IF the license is rejected (an
      # operator must be able to see "license_invalid" without an API key). So a healthy engine
      # is not a successful install — check the license verdict explicitly, then prove the API
      # with one real (tiny) completion, exactly what the customer does next.
      lic=$(license_verdict "$out")
      case "$lic" in
        ok*)  say "Engine HEALTHY, license OK (${lic#ok } days remaining)." ;;
        none) say "Engine HEALTHY (this bundle has no license enforcement)." ;;
        *)    fail "engine is healthy but the proxy REJECTS the license ($lic): $out
  Check: cd $INSTALL_DIR && docker compose logs proxy | grep -i license" ;;
      esac
      key=$(grep -m1 '^VERIFICATE_API_KEY=' "$INSTALL_DIR/.env" | cut -d= -f2-)
      http=$(curl -s -o /dev/null -w '%{http_code}' --max-time 180 http://127.0.0.1:8000/v1/chat/completions \
               -H "Authorization: Bearer $key" -H 'Content-Type: application/json' \
               -d '{"model":"gpt-oss-120b","max_tokens":4,"messages":[{"role":"user","content":"Say OK."}]}' || echo 000)
      if [ "$http" = "200" ]; then
        say "API verified: a real chat completion returned 200."
      else
        say "WARNING: test completion returned HTTP $http — check: cd $INSTALL_DIR && docker compose logs proxy"
      fi
      say "OpenAI-compatible API on http://127.0.0.1:8000"
      say 'Try:  curl -s http://127.0.0.1:8000/v1/chat/completions -H "Authorization: Bearer $(grep ^VERIFICATE_API_KEY '"$INSTALL_DIR"'/.env | cut -d= -f2)" -H "Content-Type: application/json" -d '"'"'{"model":"gpt-oss-120b","messages":[{"role":"user","content":"hello"}]}'"'"
      return 0
    fi
    sleep 10
  done
  fail "engine did not become healthy in 20 min — check: cd $INSTALL_DIR && docker compose logs"
}

install_cli() {
  # Install this script as the `verificate` command. Prefer the exact bytes that just ran
  # (file invocation); a piped run ($0 = "bash") re-downloads from the same server instead.
  local dest=/usr/local/bin/verificate src
  src="$(readlink -f "$0" 2>/dev/null || true)"
  if [ -n "$src" ] && [ -f "$src" ] && head -3 "$src" | grep -q "Verificate HELIX" \
     && [ "$src" != "$(readlink -f "$dest" 2>/dev/null || echo "$dest")" ]; then
    cp "$src" "$dest"
  elif ! curl -fsSL "$VERIFICATE_URL/install.sh" -o "$dest"; then
    # The runtime is already healthy at this point — losing the convenience CLI must not fail
    # the install, but it is warned about LOUDLY (re-run install later to retry, no seat used
    # once downloads are cached... a full re-run DOES use a seat; use the curl refresh form).
    say "WARNING: could not install the 'verificate' CLI at $dest — refresh via:"
    say "  curl -fsSL $VERIFICATE_OFFICIAL_URL | sudo bash -s refresh"
    return 0
  fi
  chmod 0755 "$dest"
  say "CLI installed: sudo verificate [refresh|status|help]"
}

do_status() {
  [ -d "$INSTALL_DIR" ] || fail "no installation found at $INSTALL_DIR — install with: curl -fsSL $VERIFICATE_OFFICIAL_URL | sudo bash"
  local port=8000
  [ -f "$INSTALL_DIR/.env" ] && port=$(grep -m1 '^HELIX_HOST_PORT=' "$INSTALL_DIR/.env" | cut -d= -f2 || true) && port="${port:-8000}"
  say "Containers ($INSTALL_DIR):"
  (cd "$INSTALL_DIR" && docker compose ps) || say "WARNING: docker unreachable — try: sudo verificate status"
  say "Health + license (proxy :$port):"
  local out
  if out=$(curl -sf "http://127.0.0.1:$port/health"); then
    echo "$out"
    case "$(license_verdict "$out")" in
      ok*)  say "License OK." ;;
      none) say "No license enforcement in this bundle." ;;
      bad*) say "WARNING: LICENSE REJECTED — the API returns 403 until fixed. Expired? 'sudo verificate refresh'. Unreadable? 'sudo verificate repair'. Details: cd $INSTALL_DIR && docker compose logs proxy | grep -i license" ;;
    esac
  else
    say "WARNING: proxy not answering on :$port — check: cd $INSTALL_DIR && docker compose logs proxy"
  fi
}

do_benchmark() {
  [ -d "$INSTALL_DIR" ] || fail "no installation found at $INSTALL_DIR — install first: curl -fsSL $VERIFICATE_OFFICIAL_URL | sudo bash"
  need_cmd python3 " (apt install python3)"
  local port=8000 key
  [ -f "$INSTALL_DIR/.env" ] && port=$(grep -m1 '^HELIX_HOST_PORT=' "$INSTALL_DIR/.env" | cut -d= -f2 || true) && port="${port:-8000}"
  key=$(grep -m1 '^VERIFICATE_API_KEY=' "$INSTALL_DIR/.env" | cut -d= -f2- || true)
  [ -n "$key" ] || fail "no VERIFICATE_API_KEY in $INSTALL_DIR/.env"
  curl -sf "http://127.0.0.1:$port/health" >/dev/null 2>&1 || fail "engine not ready on :$port — run 'verificate status' first"
  local streams="${1:-1,2,4}" secs="${VERIFICATE_BENCH_SECONDS:-40}"
  local out="$INSTALL_DIR/benchmark_$(hostname)_$(date -u +%Y%m%dT%H%M%SZ).json"
  say "Benchmarking on :$port (streams=$streams, ${secs}s each) — a few minutes..."
  local tmp; tmp="$(mktemp)"
  cat > "$tmp" <<'PY'
import argparse,json,statistics,threading,time,urllib.request
W=("system latency throughput bandwidth vector matrix decode prefill token cache memory "
   "channel socket thread core numa page fault stream batch slot ").split()
def prompt(n): return "Summarise the following notes. "+" ".join(W[i%len(W)] for i in range(n))
def one(base,key,p,mx,timeout=600):
    body=json.dumps({"model":"gpt-oss-120b","temperature":0,"max_tokens":mx,
                     "messages":[{"role":"user","content":p}]}).encode()
    req=urllib.request.Request(base+"/v1/chat/completions",data=body,
        headers={"Content-Type":"application/json","Authorization":"Bearer "+key})
    t0=time.monotonic()
    with urllib.request.urlopen(req,timeout=timeout) as r: resp=json.loads(r.read())
    dt=time.monotonic()-t0; u=resp.get("usage") or {}; tm=resp.get("timings") or {}
    return {"latency_s":round(dt,3),"completion_tokens":u.get("completion_tokens",0),
            "server_pred_per_s":tm.get("predicted_per_second")}
def retry(base,key,p,mx,n=3):
    e=None
    for _ in range(n):
        try: return one(base,key,p,mx)
        except Exception as ex: e=ex; time.sleep(2)
    raise SystemExit(f"server not responding: {e}")
def sweep(base,key,streams,secs,p,mx):
    dl=time.monotonic()+secs; res=[]; lk=threading.Lock()
    def w():
        while time.monotonic()<dl:
            try: r=one(base,key,p,mx)
            except Exception as ex:
                with lk: res.append({"error":str(ex)[:200]})
                time.sleep(1); continue
            with lk: res.append(r)
    t0=time.monotonic(); ts=[threading.Thread(target=w) for _ in range(streams)]
    [t.start() for t in ts]; [t.join() for t in ts]; wall=time.monotonic()-t0
    ok=[r for r in res if "error" not in r]; er=[r for r in res if "error" in r]
    tk=sum(r["completion_tokens"] for r in ok); lat=sorted(r["latency_s"] for r in ok)
    pr=[r["server_pred_per_s"] for r in ok if r.get("server_pred_per_s")]
    return {"streams":streams,"requests_ok":len(ok),"requests_err":len(er),
            "aggregate_output_tok_s":round(tk/wall,2) if wall else None,
            "per_request_decode_tok_s_mean":round(statistics.mean(pr),2) if pr else None,
            "latency_p50_s":lat[len(lat)//2] if lat else None,
            "latency_p95_s":lat[min(len(lat)-1,int(round(0.95*len(lat)))-1)] if lat else None}
a=argparse.ArgumentParser()
a.add_argument("--base",required=True); a.add_argument("--key",required=True)
a.add_argument("--out",required=True); a.add_argument("--streams",default="1,2,4"); a.add_argument("--seconds",type=int,default=40)
a=a.parse_args(); p=prompt(256)
[retry(a.base,a.key,p,64) for _ in range(2)]
hl=[retry(a.base,a.key,p,200) for _ in range(2)]
single=max((h["server_pred_per_s"] if h["server_pred_per_s"] else h["completion_tokens"]/h["latency_s"]) for h in hl)
out={"host_base":a.base,"headline_single_stream_tok_s":round(single,2),"sweep":[]}
for s in (int(x) for x in a.streams.split(",")):
    print(f"  running streams={s} ...",flush=True); out["sweep"].append(sweep(a.base,a.key,s,a.seconds,p,64)); time.sleep(10)
with open(a.out,"w") as f: json.dump(out,f,indent=1)
print(f"\n  headline single-stream decode: {out['headline_single_stream_tok_s']} tok/s\n")
print("  streams | agg tok/s | decode tok/s | p50 s | p95 s | ok | err")
for s in out["sweep"]:
    print(f"  {s['streams']:>7} | {str(s['aggregate_output_tok_s']):>9} | {str(s['per_request_decode_tok_s_mean']):>12} | "
          f"{str(s['latency_p50_s']):>5} | {str(s['latency_p95_s']):>5} | {s['requests_ok']:>2} | {s['requests_err']}")
PY
  python3 "$tmp" --base "http://127.0.0.1:$port" --key "$key" --out "$out" --streams "$streams" --seconds "$secs" || { rm -f "$tmp"; fail "benchmark failed"; }
  rm -f "$tmp"
  say "Saved: $out"
}

do_repair() {
  # Re-apply the license permissions to an existing install — fixes installs made with the
  # pre-2026-10-08 installer (hard-coded group 10002) without re-downloading or using a seat.
  [ -f "$INSTALL_DIR/license/license.vlt" ] || fail "no installation found at $INSTALL_DIR — run the installer first"
  say "Repairing license permissions..."
  grant_license_files
  grant_license_state_volume
  (cd "$INSTALL_DIR" && docker compose restart proxy >/dev/null 2>&1) || fail "docker compose restart proxy failed"
  sleep 3
  do_status
}

usage() {
  cat <<EOF
Verificate HELIX v1.8 (installer rev $INSTALLER_REV)
  sudo verificate install       install (prompts for a vik- install key; uses an activation seat)
  sudo verificate refresh       activate a new or renewed license key (seconds, no re-download)
  sudo verificate repair        re-apply license file/volume permissions and restart the proxy
  verificate status             containers, health, license days remaining
  verificate benchmark [S]      throughput sweep (default streams 1,2,4) -> prints a table + saves JSON
  verificate help               this text
EOF
}

do_refresh() {
  [ -d "$INSTALL_DIR/license" ] || fail "no installation found at $INSTALL_DIR — run the installer first"
  prompt_key
  say "Requesting a fresh license..."
  local resp="$INSTALL_DIR/.refresh-resp.json" http
  http=$(curl -sS -o "$resp" -w '%{http_code}' -H 'Content-Type: application/json' \
              -d "{\"install_key\":\"$INSTALL_KEY\"}" "$VERIFICATE_URL/refresh") || fail "cannot reach $VERIFICATE_URL"
  [ "$http" = "200" ] || fail "refresh refused (HTTP $http): $(cat "$resp")"
  umask 077
  json_get "$resp" license_token > "$INSTALL_DIR/license/license.vlt.new"
  mv -f "$INSTALL_DIR/license/license.vlt.new" "$INSTALL_DIR/license/license.vlt"   # atomic swap
  grant_license_files
  say "License refreshed: tier=$(json_get "$resp" tier), expires $(date -u -d "@$(json_get "$resp" expires_at)" +%Y-%m-%d 2>/dev/null || json_get "$resp" expires_at)"
  rm -f "$resp"
  # The proxy hot-reloads the token file on its next request — restart is belt-and-braces.
  (cd "$INSTALL_DIR" && docker compose restart proxy >/dev/null 2>&1) || true
  say "Done."
}

# ---- main ------------------------------------------------------------------------------------------
CMD="${1:-}"
if [ -z "$CMD" ]; then
  # Piped bootstrap ($0 = "bash") defaults to install; the installed CLI invoked bare shows
  # usage — never a silent reinstall (install consumes an activation seat).
  case "$(basename "$0")" in
    verificate) CMD=help ;;
    *) CMD=install ;;
  esac
fi
case "$CMD" in
  refresh)
    do_refresh
    ;;
  status)
    do_status
    ;;
  repair)
    do_repair
    ;;
  benchmark|bench)
    do_benchmark "${2:-}"
    ;;
  help|--help|-h)
    usage
    ;;
  install)
    say "Verificate HELIX v1.8 installer (rev $INSTALLER_REV)"
    collect_hw
    check_host
    prompt_key
    activate
    download_artifacts
    install_bundle
    wait_healthy
    install_cli
    say "Install complete. Next: 'verificate status' | 'sudo verificate refresh' | cd $INSTALL_DIR && docker compose [ps|logs|down|up -d]"
    ;;
  *)
    usage
    fail "unknown command '$CMD' (expected: install | refresh | repair | status | benchmark | help)"
    ;;
esac