Claude Code: connect to DevGrail (MCP + login)

#!/usr/bin/env sh
set -eu
umask 077   # anything this script creates is owner-only by default

log()  { printf '[claude-setup] %s\n' "$*"; }
warn() { printf '[claude-setup] WARNING: %s\n' "$*" >&2; }
die()  { printf '[claude-setup] ERROR: %s\n' "$*" >&2; exit 1; }

CREDS_JSON="${CLAUDE_CODE_CREDENTIALS_JSON:-}"
OVERWRITE="${OVERWRITE_EXISTING_CREDENTIALS:-yes}"

[ -n "$CREDS_JSON" ] || die "no credentials JSON was supplied"
command -v claude >/dev/null 2>&1 \
    || die "the 'claude' CLI is not on PATH — run this in a workspace that has Claude Code installed"

if [ "$(id -u)" -eq 0 ]; then SUDO=""
elif command -v sudo >/dev/null 2>&1; then SUDO="sudo -n"
else SUDO=""
fi

# jq is optional: it only merges an existing ~/.claude.json and sanity-checks the
# credentials. Never fail the run over it — the login matters more.
# Note: this script body is piped to `sh -s` on stdin, so stdin IS the remaining
# script. Every installer gets </dev/null or a prompt would eat the script.
if ! command -v jq >/dev/null 2>&1; then
    log "jq not found; attempting install (optional)"
    export DEBIAN_FRONTEND=noninteractive
    if   command -v apt-get >/dev/null 2>&1; then $SUDO apt-get update -qq </dev/null && $SUDO apt-get install -y -qq jq </dev/null || true
    elif command -v dnf     >/dev/null 2>&1; then $SUDO dnf install -y jq </dev/null || true
    elif command -v yum     >/dev/null 2>&1; then $SUDO yum install -y jq </dev/null || true
    elif command -v apk     >/dev/null 2>&1; then $SUDO apk add --no-cache jq </dev/null || true
    elif command -v pacman  >/dev/null 2>&1; then $SUDO pacman -Sy --noconfirm jq </dev/null || true
    elif command -v zypper  >/dev/null 2>&1; then $SUDO zypper install -y jq </dev/null || true
    elif command -v brew    >/dev/null 2>&1; then brew install jq </dev/null || true
    fi
    command -v jq >/dev/null 2>&1 || warn "continuing without jq"
fi

# -- credentials ---------------------------------------------------------------
mkdir -p "$HOME/.claude"
CREDS="$HOME/.claude/.credentials.json"

if command -v jq >/dev/null 2>&1; then
    printf '%s' "$CREDS_JSON" | jq empty >/dev/null 2>&1 \
        || die "the supplied value is not valid JSON — paste the whole file contents, from '{' to '}'"
fi

if [ -f "$CREDS" ] && [ "$OVERWRITE" != "yes" ]; then
    log "$CREDS already exists and overwrite is off — leaving it alone"
else
    if [ -f "$CREDS" ]; then
        cp -p "$CREDS" "$CREDS.bak"
        log "backed up previous credentials to $CREDS.bak"
    fi
    # printf, not a heredoc: the value must land verbatim, with no shell expansion.
    printf '%s\n' "$CREDS_JSON" > "$CREDS"
    chmod 600 "$CREDS"
    log "wrote $CREDS (mode 600)"
fi

# -- skip the onboarding prompt ------------------------------------------------
CLAUDE_JSON="$HOME/.claude.json"
if [ ! -f "$CLAUDE_JSON" ]; then
    printf '%s\n' '{"hasCompletedOnboarding":true}' > "$CLAUDE_JSON"
    log "created $CLAUDE_JSON"
elif command -v jq >/dev/null 2>&1; then
    tmp="$CLAUDE_JSON.devgrail.tmp"   # same directory: atomic rename, no cross-device copy
    trap 'rm -f "$tmp"' EXIT
    jq '.hasCompletedOnboarding = true' "$CLAUDE_JSON" > "$tmp" \
        || die "jq failed to process $CLAUDE_JSON"
    [ -s "$tmp" ] || die "jq produced empty output for $CLAUDE_JSON — aborting to avoid data loss"
    cp -p "$CLAUDE_JSON" "$CLAUDE_JSON.bak"
    mv "$tmp" "$CLAUDE_JSON"
    trap - EXIT
    log "updated $CLAUDE_JSON (backup: $CLAUDE_JSON.bak)"
else
    warn "jq unavailable and $CLAUDE_JSON exists — left untouched; if Claude Code shows the onboarding prompt, set \"hasCompletedOnboarding\": true there by hand"
fi

log "done. Run 'claude' — it should start without asking you to log in."