#Requires -Version 5.1
<#
  WKAI bootstrap — install.wkai.me 返回的极小引导脚本（唯一需人工审计的入口，保持简单）
  职责仅四件：定版本 → 下载 app 包 → 校验 SHA256 → 解压并移交 windows\install.ps1
  用法（用户只执行这一条）：  irm https://install.wkai.me | iex
#>
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# 这两项由发布流水线在生成 bootstrap 时注入。制品镜像在 wkai.me(Cloudflare，墙内可达)。
$AppVersion   = '0.1.2'
$AppZipUrl    = "https://install.wkai.me/dl/wkai-app-$AppVersion.zip"
$AppZipSha256 = 'TODO_CONFIRM'   # 发布时写死；未写死则仅告警

$Root    = 'C:\WKAI'
$AppDir  = Join-Path $Root "app\$AppVersion"
$Tmp     = Join-Path $env:TEMP "wkai-boot-$AppVersion"

Write-Host "WKAI bootstrap → v$AppVersion" -ForegroundColor Cyan
New-Item -ItemType Directory -Force -Path $Root, $Tmp | Out-Null

$zip = Join-Path $Tmp 'app.zip'
$old = $ProgressPreference; $ProgressPreference = 'SilentlyContinue'
try { Invoke-WebRequest -Uri $AppZipUrl -OutFile $zip -UseBasicParsing }
finally { $ProgressPreference = $old }

if ($AppZipSha256 -and $AppZipSha256 -notmatch 'TODO') {
    $actual = (Get-FileHash -Algorithm SHA256 -Path $zip).Hash.ToLowerInvariant()
    if ($actual -ne $AppZipSha256.ToLowerInvariant()) { throw "app zip SHA256 mismatch (expected $AppZipSha256, got $actual)" }
    Write-Host "  SHA256 verified" -ForegroundColor Green
} else {
    Write-Host "  SHA256 not pinned (dev) — skipping verify" -ForegroundColor Yellow
}

if (Test-Path $AppDir) { Remove-Item -Recurse -Force $AppDir }
New-Item -ItemType Directory -Force -Path $AppDir | Out-Null
Expand-Archive -Path $zip -DestinationPath $AppDir -Force
Remove-Item -Recurse -Force $Tmp -ErrorAction SilentlyContinue

# 指针指向当前激活版本（自更新/回滚时切换它）
$current = Join-Path $Root 'app\current'
Set-Content -Path (Join-Path $Root 'app\CURRENT.txt') -Value $AppVersion -Encoding ASCII

$installer = Join-Path $AppDir 'windows\install.ps1'
if (-not (Test-Path $installer)) { throw "installer not found in package: $installer" }

# 去除下载文件的 MOTW（Zone.Identifier）标记，避免 RemoteSigned/Restricted 策略拦截
Get-ChildItem $AppDir -Recurse -File | Unblock-File -ErrorAction SilentlyContinue

Write-Host "  handing off to installer..." -ForegroundColor Cyan
# 用 Bypass 子进程启动安装器，兼容学员机默认 Restricted 执行策略
& powershell -NoProfile -ExecutionPolicy Bypass -File $installer -Silent