#!/usr/bin/env bash
#
# Why won't Pixelix Ops open on this Mac?
#
#   curl -fsSL https://ops.pixelixmarketing.com/updates/diagnose-mac.sh | bash
#
# Reads only. Changes nothing. Print the output and send it over.

# It may be in either place: a standard user cannot write to /Applications,
# so the installer falls back to a per-user folder.
if [ -d "$HOME/Applications/Pixelix Ops.app" ] && [ ! -d "/Applications/Pixelix Ops.app" ]; then
  APP="$HOME/Applications/Pixelix Ops.app"
else
  APP="/Applications/Pixelix Ops.app"
fi
line() { printf '%s\n' "------------------------------------------------------------"; }

echo "PIXELIX OPS — MAC DIAGNOSTIC"
line
echo "macOS            : $(sw_vers -productVersion) ($(sw_vers -buildVersion))"
echo "processor        : $(uname -m)"
echo "model            : $(sysctl -n hw.model 2>/dev/null)"
echo "user             : $(whoami)"
echo "admin            : $(id -Gn | grep -qw admin && echo yes || echo no)"
line

if [ ! -d "$APP" ]; then
  echo "INSTALLED        : NO — nothing at $APP"
  echo
  echo "The installer never finished. Run it again and send what it prints:"
  echo "  curl -fsSL https://ops.pixelixmarketing.com/updates/install-mac.sh | bash"
  exit 0
fi

echo "installed        : yes"
echo "location         : $APP"
echo "/Applications    : $([ -w /Applications ] && echo writable || echo "NOT writable — standard user")"
echo "version          : $(defaults read "$APP/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null)"
echo "app built for    : $(file "$APP/Contents/MacOS/Pixelix Ops" 2>/dev/null | sed 's/.*: //')"
echo "owner            : $(stat -f '%Su:%Sg' "$APP")"
line

# The usual culprit. A browser or a chat app attaches this; curl does not.
Q=$(xattr -p com.apple.quarantine "$APP" 2>/dev/null)
if [ -n "$Q" ]; then
  echo "QUARANTINE       : PRESENT  <-- this is almost certainly the problem"
  echo "  flag           : $Q"
  echo "  flagged inside : $(xattr -lr "$APP" 2>/dev/null | grep -c quarantine) items"
  echo "  (the app came from a browser, AirDrop, Slack, Drive or a copied DMG,"
  echo "   not from the install command)"
else
  echo "quarantine       : none"
fi
line

echo "gatekeeper       : $(spctl --status 2>&1)"
echo "assessment       :"
spctl -a -vvv "$APP" 2>&1 | sed 's/^/  /'
echo "signature        :"
codesign -dv "$APP" 2>&1 | grep -Ei 'signature|identifier|teamident' | sed 's/^/  /'
line

# A managed Mac can refuse unsigned apps whatever the quarantine flag says,
# and that is the difference that makes one machine work and another not.
echo "config profiles  :"
profiles list -type configuration 2>/dev/null | sed 's/^/  /' | head -12
echo "MDM enrolled     : $(profiles status -type enrollment 2>/dev/null | tr '\n' ' ')"
line

echo "launch attempt   :"
open -a "$APP" 2>&1 | sed 's/^/  /' || true
sleep 3
if pgrep -f "/Pixelix Ops.app/Contents/MacOS/" >/dev/null 2>&1; then
  echo "  IT STARTED — the app is running now."
else
  echo "  did not start."
  echo "  most recent related log lines:"
  log show --last 3m --predicate 'eventMessage CONTAINS "Pixelix"' 2>/dev/null \
    | tail -12 | sed 's/^/    /'
fi
line
echo "Send everything above."