#!/usr/bin/env bash
# Install tiered OpenSnitch dev-machine ruleset. Run: sudo bash ~/opensnitch-staging/install.sh
set -euo pipefail
RULES=/etc/opensnitchd/rules
STAGE="$(cd "$(dirname "$0")" && pwd)"

echo "== backing up current rules =="
ts=$(date +%Y%m%d-%H%M%S)
cp -a "$RULES" "/etc/opensnitchd/rules.bak-$ts"
echo "backup: /etc/opensnitchd/rules.bak-$ts"

echo "== removing blanket process allow-any rules (defeat rogue-agent detection) =="
rm -f "$RULES"/allow-always-simple-usr-bin-bun.json \
      "$RULES"/allow-always-simple-usr-bin-node.json \
      "$RULES"/allow-always-simple-usr-local-lib-node-modules-anthropic-ai-claude-code-bin-claude-exe.json

echo "== installing tiered rules =="
own=$(stat -c '%U:%G' "$RULES")
for f in "$STAGE"/0*.json; do
  install -m 0600 "$f" "$RULES/$(basename "$f")"
done
chown "$own" "$RULES"/0*.json 2>/dev/null || true

echo "== installed =="
ls -1 "$RULES"/*.json
echo "Rules hot-reload via fsnotify — no restart needed. Watch: opensnitch-ui or tail -f /var/log/opensnitchd.log"