#Requires -RunAsAdministrator
<#
  setup-windows-with-uac.ps1
  Elevated portion of the Windows provisioning. Invoked by setup-windows.bat
  via Start-Process -Verb RunAs, or run manually from an Administrator prompt.

  What this installs / configures:
    - OpenSSH Client capability (the ssh.exe rsync shells out to, and the
      System32 libcrypto.dll the release's own ssh.exe links against)
    - ssh-agent set to automatic + started
    - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22
    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine
      PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this
      architecture
    - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,
      Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)
    - Windows Driver Kit 10.0.26100

  Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:
    Professional : https://aka.ms/vs/17/release/vs_professional.exe
    Enterprise   : https://aka.ms/vs/17/release/vs_enterprise.exe
#>

$ErrorActionPreference = 'Stop'

function Write-Step([string]$Msg) {
    Write-Host "`n==> $Msg" -ForegroundColor Cyan
}

function Assert-ExitCode([int]$Code, [string]$Step) {
    # 0 = success, 3010 = success + reboot required
    if ($Code -notin @(0, 3010)) {
        throw "$Step failed with exit code $Code"
    }
    if ($Code -eq 3010) {
        Write-Host "    [reboot required after $Step]" -ForegroundColor Yellow
    }
}

function Show-VsSetupLogs {
    # The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because
    # this script runs elevated, that %TEMP% belongs to the elevated user and is
    # readable here even when it is NOT readable by the non-elevated caller. Fold
    # only the NEWEST installer + bootstrapper log into the transcript (the setup
    # engine log is where per-component / product errors actually appear) and
    # keep it short so the transcript stays readable.
    Write-Host "`n==> Collecting VS Installer logs from $env:TEMP" -ForegroundColor Cyan
    $recent = Get-ChildItem $env:TEMP -Filter 'dd_*.log' -ErrorAction SilentlyContinue |
              Where-Object { $_.LastWriteTime -gt (Get-Date).AddMinutes(-15) }
    $picks = @()
    $picks += $recent | Where-Object { $_.Name -like 'dd_installer_*'    } | Sort-Object LastWriteTime | Select-Object -Last 1
    $picks += $recent | Where-Object { $_.Name -like 'dd_bootstrapper_*' } | Sort-Object LastWriteTime | Select-Object -Last 1
    $picks = $picks | Where-Object { $_ }
    if (-not $picks) {
        Write-Host '    (no VS Installer logs modified in the last 15 minutes)' -ForegroundColor Yellow
        return
    }
    foreach ($l in $picks) {
        Write-Host "`n----- $($l.Name) (tail) -----" -ForegroundColor Yellow
        Get-Content $l.FullName -Tail 40
    }
}

function Invoke-VsModify {
    # Run one VS install/modify pass for a named group of components. Splitting
    # the install into separate passes makes it obvious WHICH group fails: each
    # call prints its label and exit code before Assert-ExitCode throws.
    param(
        [string]   $Label,
        [string[]] $Ids
    )
    Write-Step "VS2022: $Label"
    $addStr = ($Ids | ForEach-Object { "--add $_" }) -join ' '
    # --installPath must be quoted: it contains spaces ("C:\Program Files\...").
    # Windows PowerShell 5.1's Start-Process does not quote array elements, so we
    # hand-build a single string. Component IDs / flags have no spaces.
    $common = '--includeRecommended --quiet --norestart --wait'
    if ($script:InstallPath) {
        $argString = "modify --installPath `"$script:InstallPath`" $addStr $common --force"
    } else {
        # No existing install yet -> this first pass performs the base install.
        $argString = "$addStr $common"
    }
    Write-Host "    > $script:VsBootstrapper $argString" -ForegroundColor DarkGray
    $p = Start-Process -FilePath $script:VsBootstrapper -ArgumentList $argString -Wait -PassThru -NoNewWindow
    Write-Host "    exit code: $($p.ExitCode)"
    Assert-ExitCode $p.ExitCode "VS2022 ($Label)"

    # After the first (fresh) install, re-detect the install path so subsequent
    # passes use `modify`.
    if (-not $script:InstallPath -and (Test-Path $script:VsWhere)) {
        $script:InstallPath = & $script:VsWhere -products '*' -property installationPath -format value |
                              Select-Object -First 1
    }
}

# ---------------------------------------------------------------------------
# This runs in a separate elevated window that closes the moment it exits, so
# the non-elevated caller (setup-windows.bat) can't see what happened. Mirror
# all output to a log next to the script and exit with a real code so the
# caller can detect success/failure and show the log.
# ---------------------------------------------------------------------------
$LogFile  = Join-Path $PSScriptRoot 'setup-windows-uac.log'
$ExitCode = 0
try { Start-Transcript -Path $LogFile -Force | Out-Null } catch {}

try {

# ---------------------------------------------------------------------------
# Base tools via winget
# ---------------------------------------------------------------------------

# ---------------------------------------------------------------------------
# OpenSSH Client
#
# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent
# from some Server images. Two things below want it: rsync does not speak ssh
# itself, it execs an ssh binary, and the release's own ssh.exe links against the
# libcrypto.dll this capability puts in System32. It also owns the ssh-agent
# service configured next, so a missing client is why that step would fail.
#
# Non-fatal, like the server half below: a box that cannot have it should still
# finish provisioning.
# ---------------------------------------------------------------------------
Write-Step 'OpenSSH Client'
try {
    $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' |
            Select-Object -First 1
    if (-not $sshc) {
        Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.'
    } elseif ($sshc.State -eq 'Installed') {
        Write-Host "    OK: $($sshc.Name) already installed"
    } else {
        Write-Host "    Installing $($sshc.Name) ..."
        $r = Add-WindowsCapability -Online -Name $sshc.Name
        if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Client]' -ForegroundColor Yellow }
    }
} catch {
    Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)"
}

# ---------------------------------------------------------------------------
# SSH agent
# ---------------------------------------------------------------------------
Write-Step 'Enabling ssh-agent'
Set-Service -Name ssh-agent -StartupType Automatic
if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent }

# ---------------------------------------------------------------------------
# OpenSSH Server (sshd)
#
# Used to reach the test VMs (VirtualBox) from the host: remote shell plus the
# transport rsync rides on when seeding test data in. Ships with Windows 10
# 1809+ / Windows 11 as an on-demand capability, so no third-party install.
#
# The capability normally adds the "OpenSSH Server (sshd)" inbound firewall
# rule; we verify and create it if missing (it is absent on some images).
#
# Non-fatal: a box that can't run sshd should still finish provisioning.
# ---------------------------------------------------------------------------
Write-Step 'OpenSSH Server (sshd)'
try {
    $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' |
            Select-Object -First 1
    if (-not $sshd) {
        Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.'
    } else {
        if ($sshd.State -ne 'Installed') {
            Write-Host "    Installing $($sshd.Name) ..."
            $r = Add-WindowsCapability -Online -Name $sshd.Name
            if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Server]' -ForegroundColor Yellow }
        } else {
            Write-Host "    OK: $($sshd.Name) already installed"
        }

        Set-Service -Name sshd -StartupType Automatic
        if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd }
        Write-Host '    sshd: Automatic + running'

        # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and
        # bridged adapters are frequently classified Public, and the capability's
        # own rule is Private-only on some images, which is what leaves a plainly
        # running sshd plainly unreachable.
        #
        # OpenSSH-Server-In-TCP is the name the capability itself uses, so this
        # WIDENS that rule rather than adding a second one next to it. Creating
        # our own under a different name would leave the narrow rule in place and
        # the box still unreachable on a Public-classified adapter; creating one
        # under the same name would collide. Adopt it if present, create it if not.
        $ruleName = 'OpenSSH-Server-In-TCP'
        if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) {
            Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any
            Write-Host "    Widened firewall rule $ruleName to all profiles"
        } else {
            New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' `
                -Enabled True -Direction Inbound -Protocol TCP -Action Allow `
                -LocalPort 22 -Profile Any | Out-Null
            Write-Host "    Added firewall rule $ruleName (TCP 22, all profiles)"
        }
    }
} catch {
    Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)"
}

# ---------------------------------------------------------------------------
# rsync for Windows (github.com/nuket/rsync-windows)
#
# Windows' OpenSSH ships the transport only - no rsync - so pushing test data
# from a Linux box needs an rsync.exe on the Windows side.
#
# The release is one zip per architecture - rsync-windows-x64.zip and
# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the
# licence texts under exactly those names. Both exes are installed, together:
# rsync.exe prefers an ssh.exe in its own directory, and the release's build is
# what makes a push FROM this box run at line rate. The ssh.exe Windows ships
# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the
# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same
# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits
# ahead of C:\Tools\rsync on the machine PATH.
#
# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability
# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses
# AES-NI. No copy of it ships in the zip, so where the capability is missing we
# unpack rsync alone rather than an ssh.exe that will not start.
#
# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is
# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes
# the client-side --rsync-path escape hatch painful to quote. Added to the
# MACHINE PATH so it resolves for every account, including the non-interactive
# sshd session, which builds its environment from the machine + user registry
# PATH rather than from a login shell.
#
# Non-fatal: a download failure only warns.
# ---------------------------------------------------------------------------
Write-Step 'rsync for Windows'
$RsyncRepo  = 'nuket/rsync-windows'
$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' }
# The /releases/latest/download/ redirect rather than the API: unauthenticated
# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a
# shared NAT can genuinely exhaust, and the redirect costs none of that budget.
# To hold a box on a known build, pin the tag instead:
#     .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset
$RsyncUrl   = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset"
$RsyncDir   = 'C:\Tools\rsync'
try {
    New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null
    $RsyncExe = Join-Path $RsyncDir 'rsync.exe'

    # Does the release's ssh.exe have the libcrypto it needs? Decided before the
    # download so the answer can also gate what comes out of the zip.
    $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll'
    $WantSsh   = Test-Path $SysCrypto
    if (-not $WantSsh) {
        Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH."
    } else {
        $v = (Get-Item $SysCrypto).VersionInfo.FileVersion
        if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') {
            Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start."
        }
    }

    # Download and unpack beside the targets, not over them, so an interrupted
    # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch
    # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive
    # refuses any other extension outright ("*.download is not a supported
    # archive file format"), where PowerShell 7 just reads the file.
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset"
    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing
    Write-Host "    Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)"

    # Verify against the .sha256 published beside it. Same origin, so this is an
    # integrity check on the transfer rather than a defence against a hostile
    # release - but a truncated or proxy-mangled download is the failure that
    # actually happens, and it fails here instead of mid-transfer later.
    #
    # -OutFile, not .Content: GitHub serves the .sha256 as
    # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather
    # than a string for any non-text content type, so .Content would compare the
    # first BYTE against the hash and fail on every correct download.
    $tmpSha = "$tmpZip.sha256"
    Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing
    $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower()
    Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue
    $got  = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower()
    if ($want -and $want -ne $got) {
        Remove-Item $tmpZip -Force
        throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got"
    }
    Write-Host "    SHA-256 verified: $got"

    # Unpack to a scratch directory and move out the files we asked for, rather
    # than expanding straight over the install directory: the zip is the unit
    # that was checksummed, and this way a future release adding something to it
    # cannot quietly drop that something onto the machine PATH.
    $unpack = Join-Path $RsyncDir '.unpack'
    if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack }
    Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force
    Remove-Item $tmpZip -Force
    foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') {
        $src = Join-Path $unpack $f
        if (-not (Test-Path $src)) { continue }
        if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue }
        Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force
    }
    Remove-Item -Recurse -Force $unpack
    Write-Host "    Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })"

    # Machine PATH (HKLM environment). Idempotent: only appends if absent.
    $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')
    if (-not $m) { $m = '' }
    if (($m -split ';') -notcontains $RsyncDir) {
        $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir }
        [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')
        Write-Host "    Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)."
        # sshd caches the environment it was started with, so an already-running
        # service would not see the new PATH until restarted.
        if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') {
            Restart-Service sshd
            Write-Host '    Restarted sshd so it inherits the updated machine PATH.'
        }
    } else {
        Write-Host "    OK: $RsyncDir already in the machine PATH"
    }

    & $RsyncExe --version | Select-Object -First 1
} catch {
    Write-Warning "rsync install failed: $($_.Exception.Message)"
    Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually"
    Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together."
}

# ---------------------------------------------------------------------------
# Visual Studio 2022 Community
# ---------------------------------------------------------------------------
$TempDir = Join-Path $env:TEMP 'dev_install'
New-Item -ItemType Directory -Force -Path $TempDir | Out-Null

# Component IDs split into independent groups so each can be installed in its
# own pass. The base group is the known-good set; Clang and the Windows XP
# toolset are layered on afterwards so a failure clearly identifies the culprit.
# Component reference: https://learn.microsoft.com/visualstudio/install/workload-component-id-vs-community
$BaseComponents = @(
    # Core C++ desktop workload
    'Microsoft.VisualStudio.Workload.NativeDesktop'

    # Spectre-mitigated MSVC runtime libs
    'Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre'
    'Microsoft.VisualStudio.Component.VC.Runtimes.ARM64.Spectre'

    # Spectre-mitigated ATL (needed for many driver/COM projects)
    'Microsoft.VisualStudio.Component.VC.ATL.Spectre'

    # Windows 11 SDK — build number must match the WDK below
    'Microsoft.VisualStudio.Component.Windows11SDK.26100'

    # WDK Visual Studio extension (VSIX). The silent wdksetup.exe /quiet does NOT
    # install this (it only prompts interactively), so it must be added here.
    'Component.Microsoft.Windows.DriverKit'
)

# Clang/LLVM toolset (ClangCL, used in CMakePresets.json). Two parts: the Clang
# compiler itself, plus the MSBuild integration providing the "ClangCL" toolset.
$ClangComponents = @(
    'Microsoft.VisualStudio.Component.VC.Llvm.Clang'
    'Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset'
)

# Windows XP targeting (v141_xp toolset, used in CMakePresets.json). The v141
# (VS2017) build tools provide the 14.16 compiler that the XP toolset wraps;
# WinXP layers the XP-compatible CRT/SDK on top of it.
$XpComponents = @(
    'Microsoft.VisualStudio.Component.VC.v141.x86.x64'
    'Microsoft.VisualStudio.Component.WinXP'
)

# Detect an existing VS install via vswhere (ships with the VS Installer).
# These are referenced by Invoke-VsModify via $script: scope.
$VsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
$InstallPath = $null
if (Test-Path $VsWhere) {
    $InstallPath = & $VsWhere -products '*' -property installationPath -format value |
                   Select-Object -First 1
}

Write-Step 'Downloading VS2022 Community bootstrapper'
$VsInstallerUrl = 'https://aka.ms/vs/17/release/vs_community.exe'
$VsBootstrapper = Join-Path $TempDir 'vs_community.exe'
Invoke-WebRequest -Uri $VsInstallerUrl -OutFile $VsBootstrapper -UseBasicParsing

# Install in three sequential passes. The base set is installed first (this is
# the configuration that previously worked); Clang and the XP toolset are added
# afterwards. If one fails, its label pinpoints which group is responsible.
Invoke-VsModify -Label 'base toolset + workload' -Ids $BaseComponents
Invoke-VsModify -Label 'Clang / LLVM'            -Ids $ClangComponents
Invoke-VsModify -Label 'Windows XP (v141 + WinXP)' -Ids $XpComponents

# ---------------------------------------------------------------------------
# Verify the v141 / XP toolset actually landed. Earlier runs silently skipped
# it and the failure only surfaced at build time, so check on disk and fail
# loudly here instead.
# ---------------------------------------------------------------------------
Write-Step 'Verifying v141 / XP toolset'
$InstallPath = & $VsWhere -products '*' -property installationPath -format value |
               Select-Object -First 1
$V141 = if ($InstallPath) {
    Get-ChildItem (Join-Path $InstallPath 'VC\Tools\MSVC') -Directory -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -like '14.16.*' } | Select-Object -First 1
}
if ($V141) {
    Write-Host "    OK: v141 toolset present ($($V141.Name))" -ForegroundColor Green
} else {
    Write-Warning 'v141 (14.16.x) toolset NOT found - the XP build presets will fail.'
    Write-Warning 'Add it via Visual Studio Installer > Modify > Individual components:'
    Write-Warning '  - MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16)'
    Write-Warning '  - C++ Windows XP Support for VS 2017 (v141) tools'
}

# ---------------------------------------------------------------------------
# Windows Driver Kit (WDK 10.0.26100)
# Build 26100 matches the Windows 11 SDK installed above.
# Provides IddCx (iddcx.h / iddcx.lib) and UMDF 2.x for Indirect Display Drivers.
# linkid=2335869 -> WDK 26100.6584 (per Microsoft "Other WDK Downloads").
# ---------------------------------------------------------------------------
$WdkVersion = '10.0.26100'
$WdkInstalledRoot = (Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots' `
                        -ErrorAction SilentlyContinue).WdkBinRootVersioned

if ($WdkInstalledRoot -and $WdkInstalledRoot -match [regex]::Escape($WdkVersion)) {
    # Re-running wdksetup.exe for an already-present version returns exit code
    # 2008 (maintenance mode / nothing to do), which is not a real failure.
    Write-Step "WDK $WdkVersion already installed - skipping ($WdkInstalledRoot)"
} else {
    Write-Step 'Downloading WDK installer'
    $WdkUrl       = 'https://go.microsoft.com/fwlink/?linkid=2335869'
    $WdkInstaller = Join-Path $TempDir 'wdksetup.exe'
    Invoke-WebRequest -Uri $WdkUrl -OutFile $WdkInstaller -UseBasicParsing

    Write-Step 'Installing WDK'
    $proc = Start-Process -FilePath $WdkInstaller -ArgumentList '/quiet /norestart' -Wait -PassThru -NoNewWindow
    Write-Host "    WDK installer exit code: $($proc.ExitCode)"
    if ($proc.ExitCode -eq 2008) {
        # 2008 = the WDK is already present; the installer has nothing to do.
        Write-Host '    [WDK already installed (exit 2008) - treating as success]' -ForegroundColor Yellow
    } else {
        Assert-ExitCode $proc.ExitCode 'WDK'
    }
}

# ---------------------------------------------------------------------------
# Windows Performance Toolkit (xperf / WPA / wpr) -- ETW CPU + loader profiling,
# used by the perf/ measurement scripts. WPT is an OPTIONAL Windows SDK feature
# that the VS "Windows 11 SDK" component does NOT select, so a fresh box lacks it.
# The Windows ADK bundles WPT and winget owns the (versioned) download URL, so it
# is the most reliable source. Idempotent (skips if xperf is already present in
# either the SDK or ADK location) and non-fatal so it never aborts provisioning.
# Lighter alternative if you don't want the full ADK: install the Windows SDK's
# "Windows Performance Toolkit" optional feature via winsdksetup.exe /features
# OptionId.WindowsPerformanceToolkit.
# ---------------------------------------------------------------------------
Write-Step 'Windows Performance Toolkit (xperf / WPA)'
$wptRoots = @(
    (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),
    (Join-Path $env:ProgramFiles          'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),
    (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit\xperf.exe')
)
$xperf = $wptRoots | Where-Object { Test-Path $_ } | Select-Object -First 1
if ($xperf) {
    Write-Host "    OK: WPT already present ($xperf)" -ForegroundColor Green
} else {
    try {
        winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity `
            --accept-source-agreements --accept-package-agreements
        Write-Host '    Windows ADK (includes Windows Performance Toolkit) installed.'
    } catch {
        Write-Warning "WPT install failed: $($_.Exception.Message)"
        Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the'
        Write-Warning 'Windows SDK "Windows Performance Toolkit" optional feature.'
    }
}

# ---------------------------------------------------------------------------
Write-Host "`nAll done." -ForegroundColor Green
Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'

}
catch {
    $ExitCode = 1
    Write-Host "`n==> SETUP FAILED: $($_.Exception.Message)" -ForegroundColor Red
    if ($_.ScriptStackTrace) { Write-Host $_.ScriptStackTrace -ForegroundColor DarkGray }
    # Only fold in the VS Installer logs when a VS step actually failed; for other
    # steps (e.g. WDK) those logs are stale and misleading, so the message above
    # is what matters.
    if ($_.Exception.Message -match 'VS2022') {
        try { Show-VsSetupLogs } catch {}
    }
}
finally {
    try { Stop-Transcript | Out-Null } catch {}

    # This log was created by the elevated (admin) process, so by default the
    # non-elevated caller can't delete it (their token has Administrators marked
    # deny-only). Grant BUILTIN\Users Modify rights so the user account that runs
    # setup-windows.bat can remove the log later. S-1-5-32-545 is the well-known
    # Users SID, used here so this is locale-independent.
    try {
        if (Test-Path $LogFile) {
            $usersSid = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-545')
            $acl  = Get-Acl -Path $LogFile
            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
                        $usersSid, 'Modify', 'Allow')
            $acl.AddAccessRule($rule)
            Set-Acl -Path $LogFile -AclObject $acl
        }
    } catch {
        Write-Host "    [warning] could not relax ACL on $LogFile : $($_.Exception.Message)" -ForegroundColor Yellow
    }
}

exit $ExitCode