macOS Deployment via Post-install Script

#!/bin/bash
set -euo pipefail

BOOTSTRAP_TOKEN="your-bootstrap-token-here"

# How to deliver the token to the agent. Default "file_drop" is recommended.
#   - "file_drop": write a token file under the console user's
#                  ~/Library/Application Support/com.pult.agent/. The Pult Agent
#                  watches that directory and consumes the file on launch. Works
#                  even when no user is logged in at script run time, as long
#                  as the user's home directory exists.
#   - "cli":       call `pult-agent --bootstrap-token` as the console user,
#                  writing directly to the user's Keychain. Requires an active,
#                  interactive user session at script run time.
TOKEN_DELIVERY="file_drop"

AGENT_PATH="/Applications/Pult Agent.app/Contents/MacOS/pult-agent"
APP_NAME="Pult Agent"

CONSOLE_USER="$(/usr/bin/stat -f%Su /dev/console)"
if [[ -z "${CONSOLE_USER}" || "${CONSOLE_USER}" == "root" ]]; then
    echo "No interactive console user detected. Exiting (nothing to do)."
    exit 1
fi
CONSOLE_UID="$(/usr/bin/id -u "${CONSOLE_USER}")"

deliver_via_file() {
    local user_home
    user_home="$(/usr/bin/dscl . -read "/Users/${CONSOLE_USER}" NFSHomeDirectory \
        | /usr/bin/awk '{print $2}')"

    local dir="${user_home}/Library/Application Support/com.pult.agent"
    local file="${dir}/BOOTSTRAP_TOKEN"

    /usr/bin/sudo -u "${CONSOLE_USER}" /bin/mkdir -p "${dir}"
    /usr/bin/sudo -u "${CONSOLE_USER}" /usr/bin/tee "${file}" >/dev/null <<<"${BOOTSTRAP_TOKEN}"
    /bin/chmod 0600 "${file}"

    echo "[file_drop] token written to ${file}"
}

deliver_via_cli() {
    if [[ ! -x "${AGENT_PATH}" ]]; then
        echo "Agent binary not found or not executable: ${AGENT_PATH}"
        exit 1
    fi

    /bin/launchctl asuser "${CONSOLE_UID}" \
        /usr/bin/sudo -Hu "${CONSOLE_USER}" \
        "${AGENT_PATH}" --bootstrap-token "${BOOTSTRAP_TOKEN}"

    /bin/launchctl asuser "${CONSOLE_UID}" \
        /usr/bin/sudo -Hu "${CONSOLE_USER}" \
        "${AGENT_PATH}" --reload-bootstrap-token

    echo "[cli] token written to Keychain via pult-agent --bootstrap-token"
}

case "${TOKEN_DELIVERY}" in
    file_drop) deliver_via_file ;;
    cli)       deliver_via_cli ;;
    *)
        echo "unknown TOKEN_DELIVERY: ${TOKEN_DELIVERY}"
        exit 1
        ;;
esac

# Best-effort: launch the agent in the console user's context so the token is
# consumed immediately. If the agent is already running, this is a no-op.
/bin/launchctl asuser "${CONSOLE_UID}" \
    /usr/bin/sudo -Hu "${CONSOLE_USER}" /usr/bin/open -a "${APP_NAME}" || true

exit 0