#Requires -RunAsAdministrator
<#
  setup-windows-with-uac.ps1
  Elevated portion of the Windows provisioning. Invoked by setup-windows.bat
  via Start-Process -Verb RunAs, or run manually from an Administrator prompt.

  What this installs / configures:
    - OpenSSH Client capability (the ssh.exe rsync shells out to, and the
      System32 libcrypto.dll the release's own ssh.exe links against)
    - ssh-agent set to automatic + started
    - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22
    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine
      PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this
      architecture
    - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,
      Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)
    - Windows Driver Kit 10.0.26100
    - Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer
      (wpa.exe) - on the machine PATH
    - ETW collection rights for one ordinary account: Performance Log Users
      membership plus the "Profile system performance" user right, so xperf and
      wpr run WITHOUT elevation

  Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:
    Professional : https://aka.ms/vs/17/release/vs_professional.exe
    Enterprise   : https://aka.ms/vs/17/release/vs_enterprise.exe
#>

param(
    # Account to be granted non-elevated ETW collection rights (see the "ETW
    # collection rights" step at the bottom). Defaults to the interactive
    # console user, but setup-windows.bat passes it explicitly: with
    # over-the-shoulder elevation THIS script runs as the administrator whose
    # credentials went into the UAC prompt, not as the user who started the
    # batch file, so $env:USERNAME here is the wrong answer.
    #
    # Pass an empty string to skip the group membership (the user right is still
    # granted to the group, so adding an account later is one command).
    [string] $TraceUser = '',

    # Do the ETW rights step and nothing else. That step is seconds of registry
    # and LSA work with no downloads, where a full run is dominated by the three
    # Visual Studio passes, which take minutes even when they have nothing to do.
    # It is why the ETW step runs FIRST: -EtwRightsOnly is then just an early
    # exit rather than a set of guards down the rest of the script.
    [switch] $EtwRightsOnly
)

$ErrorActionPreference = 'Stop'

function Write-Step([string]$Msg) {
    Write-Host "`n==> $Msg" -ForegroundColor Cyan
}

function Assert-ExitCode([int]$Code, [string]$Step) {
    # 0 = success, 3010 = success + reboot required
    if ($Code -notin @(0, 3010)) {
        throw "$Step failed with exit code $Code"
    }
    if ($Code -eq 3010) {
        Write-Host "    [reboot required after $Step]" -ForegroundColor Yellow
    }
}

# ---------------------------------------------------------------------------
# User rights assignment (LSA account rights)
#
# Windows has no built-in cmdlet for "grant this SID this privilege". The two
# ways to script it are secedit (export the whole USER_RIGHTS area to an INF,
# edit one line, re-import) and the LSA API. The API is used here because it is
# surgical: LsaAddAccountRights adds exactly one right to exactly one SID and is
# a no-op when it is already held, where a secedit round-trip re-applies every
# user right on the box to fix one of them. The GUI equivalent, for a human, is
#     secpol.msc > Local Policies > User Rights Assignment
#
# The type is compiled on first use; C# 5 only, since Windows PowerShell 5.1's
# Add-Type compiles with the in-box CodeDom compiler.
# ---------------------------------------------------------------------------
function Initialize-LsaRightsType {
    if ('LsaRights' -as [type]) { return }
    Add-Type -TypeDefinition @'
using System;
using System.ComponentModel;
using System.Runtime.InteropServices;

public static class LsaRights
{
    [StructLayout(LayoutKind.Sequential)]
    private struct LSA_UNICODE_STRING
    {
        public ushort Length;
        public ushort MaximumLength;
        public IntPtr Buffer;
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct LSA_OBJECT_ATTRIBUTES
    {
        public int Length;
        public IntPtr RootDirectory;
        public IntPtr ObjectName;
        public uint Attributes;
        public IntPtr SecurityDescriptor;
        public IntPtr SecurityQualityOfService;
    }

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern uint LsaOpenPolicy(IntPtr systemName,
        ref LSA_OBJECT_ATTRIBUTES objectAttributes, uint desiredAccess, out IntPtr policyHandle);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern uint LsaAddAccountRights(IntPtr policyHandle, byte[] accountSid,
        LSA_UNICODE_STRING[] userRights, uint countOfRights);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern uint LsaEnumerateAccountRights(IntPtr policyHandle, byte[] accountSid,
        out IntPtr userRights, out uint countOfRights);

    [DllImport("advapi32.dll")]
    private static extern uint LsaClose(IntPtr policyHandle);

    [DllImport("advapi32.dll")]
    private static extern uint LsaFreeMemory(IntPtr buffer);

    [DllImport("advapi32.dll")]
    private static extern int LsaNtStatusToWinError(uint status);

    private const uint POLICY_VIEW_LOCAL_INFORMATION = 0x00000001;
    private const uint POLICY_CREATE_ACCOUNT         = 0x00000010;
    private const uint POLICY_LOOKUP_NAMES           = 0x00000800;

    // Returned by LsaEnumerateAccountRights when the SID holds no rights at all,
    // which is an empty list rather than an error.
    private const uint STATUS_OBJECT_NAME_NOT_FOUND  = 0xC0000034;

    private static IntPtr OpenPolicy()
    {
        LSA_OBJECT_ATTRIBUTES attrs = new LSA_OBJECT_ATTRIBUTES();
        attrs.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES));
        IntPtr handle;
        uint status = LsaOpenPolicy(IntPtr.Zero, ref attrs,
            POLICY_VIEW_LOCAL_INFORMATION | POLICY_CREATE_ACCOUNT | POLICY_LOOKUP_NAMES, out handle);
        if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }
        return handle;
    }

    public static string[] Get(byte[] sid)
    {
        IntPtr policy = OpenPolicy();
        try
        {
            IntPtr rights;
            uint count;
            uint status = LsaEnumerateAccountRights(policy, sid, out rights, out count);
            if (status == STATUS_OBJECT_NAME_NOT_FOUND) { return new string[0]; }
            if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }
            try
            {
                string[] result = new string[count];
                int stride = Marshal.SizeOf(typeof(LSA_UNICODE_STRING));
                for (int i = 0; i < count; i++)
                {
                    LSA_UNICODE_STRING s = (LSA_UNICODE_STRING)Marshal.PtrToStructure(
                        new IntPtr(rights.ToInt64() + (long)i * stride), typeof(LSA_UNICODE_STRING));
                    result[i] = Marshal.PtrToStringUni(s.Buffer, s.Length / 2);
                }
                return result;
            }
            finally { LsaFreeMemory(rights); }
        }
        finally { LsaClose(policy); }
    }

    public static void Add(byte[] sid, string right)
    {
        IntPtr policy = OpenPolicy();
        try
        {
            LSA_UNICODE_STRING[] rights = new LSA_UNICODE_STRING[1];
            rights[0].Buffer = Marshal.StringToHGlobalUni(right);
            // Length counts BYTES and excludes the terminator; MaximumLength includes it.
            rights[0].Length = (ushort)(right.Length * 2);
            rights[0].MaximumLength = (ushort)(right.Length * 2 + 2);
            try
            {
                uint status = LsaAddAccountRights(policy, sid, rights, 1);
                if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }
            }
            finally { Marshal.FreeHGlobal(rights[0].Buffer); }
        }
        finally { LsaClose(policy); }
    }
}
'@
}

function Get-SidBytes([string]$Sid) {
    $s = New-Object System.Security.Principal.SecurityIdentifier($Sid)
    $bytes = New-Object byte[] $s.BinaryLength
    $s.GetBinaryForm($bytes, 0)
    return ,$bytes
}

function Get-AccountRight([string]$Sid) {
    Initialize-LsaRightsType
    return [LsaRights]::Get((Get-SidBytes $Sid))
}

function Grant-AccountRight([string]$Sid, [string]$Right) {
    Initialize-LsaRightsType
    [LsaRights]::Add((Get-SidBytes $Sid), $Right)
}

# ---------------------------------------------------------------------------
# ETW provider-GUID access control
#
# ETW keeps a security descriptor per provider GUID under
# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security, and EventAccessControl is
# the documented way to edit one. Editing the registry value directly would work
# too - it is a self-relative SD in a REG_BINARY - but the API takes the SID and
# the rights mask and leaves the descriptor's shape to Windows.
# ---------------------------------------------------------------------------
function Initialize-EtwAclType {
    if ('EtwAcl' -as [type]) { return }
    Add-Type -TypeDefinition @'
using System;
using System.Runtime.InteropServices;

public static class EtwAcl
{
    // ULONG EventAccessControl(LPGUID, ULONG Operation, PSID, ULONG Rights, BOOLEAN AllowOrDeny)
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern uint EventAccessControl(ref Guid guid, uint operation, byte[] sid,
        uint rights, [MarshalAs(UnmanagedType.U1)] bool allowOrDeny);

    // ULONG EventAccessQuery(LPGUID, PSECURITY_DESCRIPTOR, PULONG BufferSize)
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern uint EventAccessQuery(ref Guid guid, byte[] buffer, ref uint bufferSize);
}
'@
}

# The rights a session controller needs, from evntrace.h:
#   0x0001 WMIGUID_QUERY               0x0100 TRACELOG_ACCESS_KERNEL_LOGGER
#   0x0020 TRACELOG_CREATE_REALTIME    0x0200 TRACELOG_LOG_EVENT
#   0x0040 TRACELOG_CREATE_ONDISK      0x0400 TRACELOG_ACCESS_REALTIME
#   0x0080 TRACELOG_GUID_ENABLE        0x0800 TRACELOG_REGISTER_GUIDS
# TRACELOG_ACCESS_KERNEL_LOGGER is the one that names the NT Kernel Logger
# specifically; the rest are what any controller needs to create a session,
# write it to disk and enable providers on it.
#
# READ_CONTROL (0x20000) and SYNCHRONIZE (0x100000) go with them - the SYSTEM and
# Administrators entries on this GUID carry 0x120FFF. Without READ_CONTROL the
# group cannot read the descriptor back, which makes EventAccessQuery useless as
# a check on whether the grant landed: it answers "access denied" either way.
$EtwControllerRights = 0x120FE1

function Grant-EtwGuidAccess([string]$Guid, [string]$Sid, [uint32]$Rights) {
    Initialize-EtwAclType
    $g = [Guid]$Guid
    # Operation 2 = EventSecurityAddDACL: add one ACE and leave every existing
    # one in place. EventSecuritySetDACL (0) would REPLACE the descriptor, which
    # on the kernel logger means removing the entries Windows itself relies on.
    $rc = [EtwAcl]::EventAccessControl([ref]$g, 2, (Get-SidBytes $Sid), $Rights, $true)
    if ($rc -ne 0) { throw (New-Object System.ComponentModel.Win32Exception([int]$rc)) }
}

function Get-EtwGuidSddl([string]$Guid) {
    Initialize-EtwAclType
    $g = [Guid]$Guid
    $size = [uint32]0
    [void][EtwAcl]::EventAccessQuery([ref]$g, $null, [ref]$size)
    if ($size -eq 0) { return $null }
    $buf = New-Object byte[] $size
    if ([EtwAcl]::EventAccessQuery([ref]$g, $buf, [ref]$size) -ne 0) { return $null }
    return (New-Object System.Security.AccessControl.RawSecurityDescriptor($buf, 0)).GetSddlForm('Access')
}

function Show-VsSetupLogs {
    # The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because
    # this script runs elevated, that %TEMP% belongs to the elevated user and is
    # readable here even when it is NOT readable by the non-elevated caller. Fold
    # only the NEWEST installer + bootstrapper log into the transcript (the setup
    # engine log is where per-component / product errors actually appear) and
    # keep it short so the transcript stays readable.
    Write-Host "`n==> Collecting VS Installer logs from $env:TEMP" -ForegroundColor Cyan
    $recent = Get-ChildItem $env:TEMP -Filter 'dd_*.log' -ErrorAction SilentlyContinue |
              Where-Object { $_.LastWriteTime -gt (Get-Date).AddMinutes(-15) }
    $picks = @()
    $picks += $recent | Where-Object { $_.Name -like 'dd_installer_*'    } | Sort-Object LastWriteTime | Select-Object -Last 1
    $picks += $recent | Where-Object { $_.Name -like 'dd_bootstrapper_*' } | Sort-Object LastWriteTime | Select-Object -Last 1
    $picks = $picks | Where-Object { $_ }
    if (-not $picks) {
        Write-Host '    (no VS Installer logs modified in the last 15 minutes)' -ForegroundColor Yellow
        return
    }
    foreach ($l in $picks) {
        Write-Host "`n----- $($l.Name) (tail) -----" -ForegroundColor Yellow
        Get-Content $l.FullName -Tail 40
    }
}

function Invoke-VsModify {
    # Run one VS install/modify pass for a named group of components. Splitting
    # the install into separate passes makes it obvious WHICH group fails: each
    # call prints its label and exit code before Assert-ExitCode throws.
    param(
        [string]   $Label,
        [string[]] $Ids
    )
    Write-Step "VS2022: $Label"
    $addStr = ($Ids | ForEach-Object { "--add $_" }) -join ' '
    # --installPath must be quoted: it contains spaces ("C:\Program Files\...").
    # Windows PowerShell 5.1's Start-Process does not quote array elements, so we
    # hand-build a single string. Component IDs / flags have no spaces.
    $common = '--includeRecommended --quiet --norestart --wait'
    if ($script:InstallPath) {
        $argString = "modify --installPath `"$script:InstallPath`" $addStr $common --force"
    } else {
        # No existing install yet -> this first pass performs the base install.
        $argString = "$addStr $common"
    }
    Write-Host "    > $script:VsBootstrapper $argString" -ForegroundColor DarkGray
    $p = Start-Process -FilePath $script:VsBootstrapper -ArgumentList $argString -Wait -PassThru -NoNewWindow
    Write-Host "    exit code: $($p.ExitCode)"
    Assert-ExitCode $p.ExitCode "VS2022 ($Label)"

    # After the first (fresh) install, re-detect the install path so subsequent
    # passes use `modify`.
    if (-not $script:InstallPath -and (Test-Path $script:VsWhere)) {
        $script:InstallPath = & $script:VsWhere -products '*' -property installationPath -format value |
                              Select-Object -First 1
    }
}

# ---------------------------------------------------------------------------
# This runs in a separate elevated window that closes the moment it exits, so
# the non-elevated caller (setup-windows.bat) can't see what happened. Mirror
# all output to a log next to the script and exit with a real code so the
# caller can detect success/failure and show the log.
# ---------------------------------------------------------------------------
$LogFile  = Join-Path $PSScriptRoot 'setup-windows-uac.log'
$ExitCode = 0
try { Start-Transcript -Path $LogFile -Force | Out-Null } catch {}

try {

# ---------------------------------------------------------------------------
# ETW collection rights for an ordinary account
#
# Out of the box, xperf and wpr only work elevated. THREE separate things stand
# in a standard user's way, and each has its own error:
#
#     xperf -on base         -> "NT Kernel Logger: Access is denied. (0x5)"
#     wpr -start GeneralProfile
#                            -> "Failed to enable the policy to profile system
#                                performance."  (0xc5585011)
#
# 1. Creating or controlling ANY event tracing session - even a user-mode one
#    naming a single provider - is checked against the security descriptor ETW
#    keeps per provider GUID under
#    HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The DEFAULT descriptor
#    grants the session-control rights (TRACELOG_CREATE_ONDISK,
#    TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to
#    SYSTEM, Administrators, the service accounts, and BUILTIN\Performance Log
#    Users - and to nobody else. That group is the supported hook; its own
#    description says members "may ... enable trace providers, and collect event
#    traces".
#
# 2. Switching on the kernel/system trace provider on top of that needs the
#    SeSystemProfilePrivilege user right ("Profile system performance"), held by
#    default only by Administrators and NT SERVICE\WdiServiceHost. That is the
#    one wpr names in its error.
#
# 3. The kernel logger is not covered by that default descriptor. Its own GUID -
#    SystemTraceControlGuid, the session both `xperf -on` and wpr drive - carries
#    an explicit descriptor that does not mention Performance Log Users, so 1 and
#    2 are not enough by themselves. Measured on this box with both in place: a
#    user-mode session starts (exit 0) and the account holds the privilege, and
#    `xperf -on base` still answers "NT Kernel Logger: Access is denied" while
#    wpr's error changes from the policy message above to a bare 0x80070005.
#    Even READING that descriptor comes back access-denied, which is the tell. So
#    add an ACE for the group with EventAccessControl; TRACELOG_ACCESS_KERNEL_LOGGER
#    is the right that names this particular session.
#
# The privilege and the ACE both go to the GROUP, and the account then goes into
# the group: membership alone becomes the switch, and enabling the next account
# is one `net localgroup` away with no policy or registry edit.
#
# What this costs, stated plainly: a member of that group can capture
# system-wide kernel traces - process, image, file and registry activity across
# every account on the box, paths and command lines included. That is what the
# group is for, and it is the price of collecting a trace without a UAC prompt.
#
# Deliberately NOT granted: SeDebugPrivilege. xperf needs it for neither CPU
# sampling nor walking stacks in your own processes, and it is equivalent to
# handing out administrator.
#
# THIS ONLY HELPS A NON-ADMIN ACCOUNT. Both a privilege and a group membership
# are baked into the access token at LOGON, and UAC hands an administrator a
# filtered token that keeps just five harmless privileges - so an admin's
# ordinary shell still cannot trace, however the policy reads. Running as a
# standard user is what makes this work.
#
# For the same reason 1 and 2 do not take effect in an already-open session: the
# account has to sign out and back in. Any NEW logon does it - an ssh login into
# this box is one, which is the quick way to check without dropping the desktop.
# The ACE in 3 is machine state rather than token state, so a logon does nothing
# for it. ETW reads these descriptors into a cache, so a REBOOT is what is
# expected to put the change into effect: with the ACE written and readable in
# the descriptor, xperf -on base was still answering "Access is denied" from a
# fresh shell on the running system. So on a first run, plan on both - a new
# logon for 1 and 2, a reboot for 3.
#
# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain
# user. This step is only about collection.
# ---------------------------------------------------------------------------
Write-Step 'ETW collection rights (non-elevated xperf / wpr)'
$PerfLogUsersSid = 'S-1-5-32-559'   # BUILTIN\Performance Log Users
# SystemTraceControlGuid: the NT Kernel Logger / system session that xperf -on
# and wpr both drive. Fixed by contract, from evntrace.h.
$SystemTraceControlGuid = '9e814aad-3204-11d2-9a82-006008a86939'
try {
    # --- The user right, granted to the group ---
    $existing = Get-AccountRight $PerfLogUsersSid
    if ($existing -contains 'SeSystemProfilePrivilege') {
        Write-Host '    OK: Performance Log Users already holds SeSystemProfilePrivilege'
    } else {
        Grant-AccountRight $PerfLogUsersSid 'SeSystemProfilePrivilege'
        Write-Host '    Granted SeSystemProfilePrivilege ("Profile system performance") to Performance Log Users'
    }

    # --- The kernel logger's own descriptor ---
    # Safe to repeat: a second ACE for the same SID unions to the same access.
    # Kept in its own try so that a failure here still leaves the group
    # membership below to be done - user-mode sessions work without it.
    #
    # ETW reads these descriptors out of the registry into a cache, so a REBOOT
    # is what puts a change here into effect - not a new logon, which is what the
    # group membership and the privilege need. Both, on a first run.
    try {
        Grant-EtwGuidAccess $SystemTraceControlGuid $PerfLogUsersSid $EtwControllerRights
        Write-Host ("    Granted Performance Log Users the controller rights (0x{0:X4}, TRACELOG_ACCESS_KERNEL_LOGGER included) on SystemTraceControlGuid" -f $EtwControllerRights)
        $sddl = Get-EtwGuidSddl $SystemTraceControlGuid
        if ($sddl) { Write-Host "    kernel logger DACL is now $sddl" -ForegroundColor DarkGray }
    } catch {
        Write-Warning "Could not add the ACE on SystemTraceControlGuid: $($_.Exception.Message)"
        Write-Warning 'xperf -on will keep answering "NT Kernel Logger: Access is denied."'
    }

    # --- The membership ---
    # Fall back to the console user when the caller did not name one: with
    # over-the-shoulder elevation that is the person who started
    # setup-windows.bat, which is who wants to trace.
    $target = $TraceUser
    if (-not $target) {
        $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName
        if ($target) { Write-Host "    No -TraceUser given; using the console user $target" }
    }

    if (-not $target) {
        Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'
        Write-Warning 'The user right is in place, so this is the only step left:'
        Write-Warning '    net localgroup "Performance Log Users" DOMAIN\user /add'
    } else {
        # Resolve to a SID first: it validates the name, and it is what the
        # membership check compares, so a member spelled ".\claude" in one place
        # and "LATISLAB\claude" in another is still recognised as the same account.
        $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(
                        [System.Security.Principal.SecurityIdentifier])

        # By SID, never by name: "Performance Log Users" is localised, and
        # Get-LocalGroup -SID is how this stays correct on a non-English box.
        $group = Get-LocalGroup -SID $PerfLogUsersSid

        # Get-LocalGroupMember throws on a group holding a SID that no longer
        # resolves (a known Windows 10 bug), so a failure to READ the membership
        # must not stop us from writing it - fall through and let the add report.
        $already = $false
        try {
            $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |
                         Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0
        } catch {
            Write-Host "    (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray
        }

        if ($already) {
            Write-Host "    OK: $target is already in $($group.Name)"
        } else {
            try {
                Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value
            } catch {
                # "already a member" is only reachable when the enumeration above
                # failed, and is not an error. Matched on the type NAME rather
                # than in a typed catch clause: catch types are resolved when the
                # script is PARSED, before the LocalAccounts module has been
                # autoloaded, so naming the type there is a parse error that
                # would take the whole script down.
                if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }
            }
            Write-Host "    Added $target to $($group.Name)"
        }

        Write-Host ''
        Write-Host "    $target must sign out and back in for the group and the privilege," -ForegroundColor Yellow
        Write-Host '    and the box must be REBOOTED for the kernel logger ACE (ETW caches it).' -ForegroundColor Yellow
        Write-Host '    Then, from that account (NOT elevated):' -ForegroundColor Yellow
        Write-Host '        whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow
        Write-Host '        xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow
    }
} catch {
    Write-Warning "ETW rights setup failed: $($_.Exception.Message)"
    Write-Warning 'Grant them by hand: secpol.msc > Local Policies > User Rights Assignment >'
    Write-Warning '"Profile system performance" > add Performance Log Users, then'
    Write-Warning '    net localgroup "Performance Log Users" <user> /add'
}

if ($EtwRightsOnly) {
    # `exit` inside the try still runs the finally below, so the transcript is
    # stopped and the log is left readable by the non-elevated caller.
    Write-Host "`n-EtwRightsOnly: skipping the installs." -ForegroundColor Green
    exit 0
}


# ---------------------------------------------------------------------------
# Base tools via winget
# ---------------------------------------------------------------------------

# ---------------------------------------------------------------------------
# OpenSSH Client
#
# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent
# from some Server images. Two things below want it: rsync does not speak ssh
# itself, it execs an ssh binary, and the release's own ssh.exe links against the
# libcrypto.dll this capability puts in System32. It also owns the ssh-agent
# service configured next, so a missing client is why that step would fail.
#
# Non-fatal, like the server half below: a box that cannot have it should still
# finish provisioning.
# ---------------------------------------------------------------------------
Write-Step 'OpenSSH Client'
try {
    $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' |
            Select-Object -First 1
    if (-not $sshc) {
        Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.'
    } elseif ($sshc.State -eq 'Installed') {
        Write-Host "    OK: $($sshc.Name) already installed"
    } else {
        Write-Host "    Installing $($sshc.Name) ..."
        $r = Add-WindowsCapability -Online -Name $sshc.Name
        if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Client]' -ForegroundColor Yellow }
    }
} catch {
    Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)"
}

# ---------------------------------------------------------------------------
# SSH agent
# ---------------------------------------------------------------------------
Write-Step 'Enabling ssh-agent'
Set-Service -Name ssh-agent -StartupType Automatic
if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent }

# ---------------------------------------------------------------------------
# OpenSSH Server (sshd)
#
# Used to reach the test VMs (VirtualBox) from the host: remote shell plus the
# transport rsync rides on when seeding test data in. Ships with Windows 10
# 1809+ / Windows 11 as an on-demand capability, so no third-party install.
#
# The capability normally adds the "OpenSSH Server (sshd)" inbound firewall
# rule; we verify and create it if missing (it is absent on some images).
#
# Non-fatal: a box that can't run sshd should still finish provisioning.
# ---------------------------------------------------------------------------
Write-Step 'OpenSSH Server (sshd)'
try {
    $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' |
            Select-Object -First 1
    if (-not $sshd) {
        Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.'
    } else {
        if ($sshd.State -ne 'Installed') {
            Write-Host "    Installing $($sshd.Name) ..."
            $r = Add-WindowsCapability -Online -Name $sshd.Name
            if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Server]' -ForegroundColor Yellow }
        } else {
            Write-Host "    OK: $($sshd.Name) already installed"
        }

        Set-Service -Name sshd -StartupType Automatic
        if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd }
        Write-Host '    sshd: Automatic + running'

        # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and
        # bridged adapters are frequently classified Public, and the capability's
        # own rule is Private-only on some images, which is what leaves a plainly
        # running sshd plainly unreachable.
        #
        # OpenSSH-Server-In-TCP is the name the capability itself uses, so this
        # WIDENS that rule rather than adding a second one next to it. Creating
        # our own under a different name would leave the narrow rule in place and
        # the box still unreachable on a Public-classified adapter; creating one
        # under the same name would collide. Adopt it if present, create it if not.
        $ruleName = 'OpenSSH-Server-In-TCP'
        if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) {
            Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any
            Write-Host "    Widened firewall rule $ruleName to all profiles"
        } else {
            New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' `
                -Enabled True -Direction Inbound -Protocol TCP -Action Allow `
                -LocalPort 22 -Profile Any | Out-Null
            Write-Host "    Added firewall rule $ruleName (TCP 22, all profiles)"
        }
    }
} catch {
    Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)"
}

# ---------------------------------------------------------------------------
# rsync for Windows (github.com/nuket/rsync-windows)
#
# Windows' OpenSSH ships the transport only - no rsync - so pushing test data
# from a Linux box needs an rsync.exe on the Windows side.
#
# The release is one zip per architecture - rsync-windows-x64.zip and
# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the
# licence texts under exactly those names. Both exes are installed, together:
# rsync.exe prefers an ssh.exe in its own directory, and the release's build is
# what makes a push FROM this box run at line rate. The ssh.exe Windows ships
# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the
# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same
# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits
# ahead of C:\Tools\rsync on the machine PATH.
#
# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability
# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses
# AES-NI. No copy of it ships in the zip, so where the capability is missing we
# unpack rsync alone rather than an ssh.exe that will not start.
#
# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is
# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes
# the client-side --rsync-path escape hatch painful to quote. Added to the
# MACHINE PATH so it resolves for every account, including the non-interactive
# sshd session, which builds its environment from the machine + user registry
# PATH rather than from a login shell.
#
# Non-fatal: a download failure only warns.
# ---------------------------------------------------------------------------
Write-Step 'rsync for Windows'
$RsyncRepo  = 'nuket/rsync-windows'
$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' }
# The /releases/latest/download/ redirect rather than the API: unauthenticated
# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a
# shared NAT can genuinely exhaust, and the redirect costs none of that budget.
# To hold a box on a known build, pin the tag instead:
#     .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset
$RsyncUrl   = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset"
$RsyncDir   = 'C:\Tools\rsync'
try {
    New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null
    $RsyncExe = Join-Path $RsyncDir 'rsync.exe'

    # Does the release's ssh.exe have the libcrypto it needs? Decided before the
    # download so the answer can also gate what comes out of the zip.
    $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll'
    $WantSsh   = Test-Path $SysCrypto
    if (-not $WantSsh) {
        Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH."
    } else {
        $v = (Get-Item $SysCrypto).VersionInfo.FileVersion
        if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') {
            Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start."
        }
    }

    # Download and unpack beside the targets, not over them, so an interrupted
    # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch
    # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive
    # refuses any other extension outright ("*.download is not a supported
    # archive file format"), where PowerShell 7 just reads the file.
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset"
    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing
    Write-Host "    Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)"

    # Verify against the .sha256 published beside it. Same origin, so this is an
    # integrity check on the transfer rather than a defence against a hostile
    # release - but a truncated or proxy-mangled download is the failure that
    # actually happens, and it fails here instead of mid-transfer later.
    #
    # -OutFile, not .Content: GitHub serves the .sha256 as
    # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather
    # than a string for any non-text content type, so .Content would compare the
    # first BYTE against the hash and fail on every correct download.
    $tmpSha = "$tmpZip.sha256"
    Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing
    $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower()
    Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue
    $got  = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower()
    if ($want -and $want -ne $got) {
        Remove-Item $tmpZip -Force
        throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got"
    }
    Write-Host "    SHA-256 verified: $got"

    # Unpack to a scratch directory and move out the files we asked for, rather
    # than expanding straight over the install directory: the zip is the unit
    # that was checksummed, and this way a future release adding something to it
    # cannot quietly drop that something onto the machine PATH.
    $unpack = Join-Path $RsyncDir '.unpack'
    if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack }
    Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force
    Remove-Item $tmpZip -Force
    foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') {
        $src = Join-Path $unpack $f
        if (-not (Test-Path $src)) { continue }
        if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue }
        Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force
    }
    Remove-Item -Recurse -Force $unpack
    Write-Host "    Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })"

    # Machine PATH (HKLM environment). Idempotent: only appends if absent.
    $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')
    if (-not $m) { $m = '' }
    if (($m -split ';') -notcontains $RsyncDir) {
        $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir }
        [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')
        Write-Host "    Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)."
        # sshd caches the environment it was started with, so an already-running
        # service would not see the new PATH until restarted.
        if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') {
            Restart-Service sshd
            Write-Host '    Restarted sshd so it inherits the updated machine PATH.'
        }
    } else {
        Write-Host "    OK: $RsyncDir already in the machine PATH"
    }

    & $RsyncExe --version | Select-Object -First 1
} catch {
    Write-Warning "rsync install failed: $($_.Exception.Message)"
    Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually"
    Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together."
}

# ---------------------------------------------------------------------------
# Visual Studio 2022 Community
# ---------------------------------------------------------------------------
$TempDir = Join-Path $env:TEMP 'dev_install'
New-Item -ItemType Directory -Force -Path $TempDir | Out-Null

# Component IDs split into independent groups so each can be installed in its
# own pass. The base group is the known-good set; Clang and the Windows XP
# toolset are layered on afterwards so a failure clearly identifies the culprit.
# Component reference: https://learn.microsoft.com/visualstudio/install/workload-component-id-vs-community
$BaseComponents = @(
    # Core C++ desktop workload
    'Microsoft.VisualStudio.Workload.NativeDesktop'

    # Spectre-mitigated MSVC runtime libs
    'Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre'
    'Microsoft.VisualStudio.Component.VC.Runtimes.ARM64.Spectre'

    # Spectre-mitigated ATL (needed for many driver/COM projects)
    'Microsoft.VisualStudio.Component.VC.ATL.Spectre'

    # Windows 11 SDK — build number must match the WDK below
    'Microsoft.VisualStudio.Component.Windows11SDK.26100'

    # WDK Visual Studio extension (VSIX). The silent wdksetup.exe /quiet does NOT
    # install this (it only prompts interactively), so it must be added here.
    'Component.Microsoft.Windows.DriverKit'
)

# Clang/LLVM toolset (ClangCL, used in CMakePresets.json). Two parts: the Clang
# compiler itself, plus the MSBuild integration providing the "ClangCL" toolset.
$ClangComponents = @(
    'Microsoft.VisualStudio.Component.VC.Llvm.Clang'
    'Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset'
)

# Windows XP targeting (v141_xp toolset, used in CMakePresets.json). The v141
# (VS2017) build tools provide the 14.16 compiler that the XP toolset wraps;
# WinXP layers the XP-compatible CRT/SDK on top of it.
$XpComponents = @(
    'Microsoft.VisualStudio.Component.VC.v141.x86.x64'
    'Microsoft.VisualStudio.Component.WinXP'
)

# Detect an existing VS install via vswhere (ships with the VS Installer).
# These are referenced by Invoke-VsModify via $script: scope.
$VsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
$InstallPath = $null
if (Test-Path $VsWhere) {
    $InstallPath = & $VsWhere -products '*' -property installationPath -format value |
                   Select-Object -First 1
}

Write-Step 'Downloading VS2022 Community bootstrapper'
$VsInstallerUrl = 'https://aka.ms/vs/17/release/vs_community.exe'
$VsBootstrapper = Join-Path $TempDir 'vs_community.exe'
Invoke-WebRequest -Uri $VsInstallerUrl -OutFile $VsBootstrapper -UseBasicParsing

# Install in three sequential passes. The base set is installed first (this is
# the configuration that previously worked); Clang and the XP toolset are added
# afterwards. If one fails, its label pinpoints which group is responsible.
Invoke-VsModify -Label 'base toolset + workload' -Ids $BaseComponents
Invoke-VsModify -Label 'Clang / LLVM'            -Ids $ClangComponents
Invoke-VsModify -Label 'Windows XP (v141 + WinXP)' -Ids $XpComponents

# ---------------------------------------------------------------------------
# Verify the v141 / XP toolset actually landed. Earlier runs silently skipped
# it and the failure only surfaced at build time, so check on disk and fail
# loudly here instead.
# ---------------------------------------------------------------------------
Write-Step 'Verifying v141 / XP toolset'
$InstallPath = & $VsWhere -products '*' -property installationPath -format value |
               Select-Object -First 1
$V141 = if ($InstallPath) {
    Get-ChildItem (Join-Path $InstallPath 'VC\Tools\MSVC') -Directory -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -like '14.16.*' } | Select-Object -First 1
}
if ($V141) {
    Write-Host "    OK: v141 toolset present ($($V141.Name))" -ForegroundColor Green
} else {
    Write-Warning 'v141 (14.16.x) toolset NOT found - the XP build presets will fail.'
    Write-Warning 'Add it via Visual Studio Installer > Modify > Individual components:'
    Write-Warning '  - MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16)'
    Write-Warning '  - C++ Windows XP Support for VS 2017 (v141) tools'
}

# ---------------------------------------------------------------------------
# Windows Driver Kit (WDK 10.0.26100)
# Build 26100 matches the Windows 11 SDK installed above.
# Provides IddCx (iddcx.h / iddcx.lib) and UMDF 2.x for Indirect Display Drivers.
# linkid=2335869 -> WDK 26100.6584 (per Microsoft "Other WDK Downloads").
# ---------------------------------------------------------------------------
$WdkVersion = '10.0.26100'
$WdkInstalledRoot = (Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots' `
                        -ErrorAction SilentlyContinue).WdkBinRootVersioned

if ($WdkInstalledRoot -and $WdkInstalledRoot -match [regex]::Escape($WdkVersion)) {
    # Re-running wdksetup.exe for an already-present version returns exit code
    # 2008 (maintenance mode / nothing to do), which is not a real failure.
    Write-Step "WDK $WdkVersion already installed - skipping ($WdkInstalledRoot)"
} else {
    Write-Step 'Downloading WDK installer'
    $WdkUrl       = 'https://go.microsoft.com/fwlink/?linkid=2335869'
    $WdkInstaller = Join-Path $TempDir 'wdksetup.exe'
    Invoke-WebRequest -Uri $WdkUrl -OutFile $WdkInstaller -UseBasicParsing

    Write-Step 'Installing WDK'
    $proc = Start-Process -FilePath $WdkInstaller -ArgumentList '/quiet /norestart' -Wait -PassThru -NoNewWindow
    Write-Host "    WDK installer exit code: $($proc.ExitCode)"
    if ($proc.ExitCode -eq 2008) {
        # 2008 = the WDK is already present; the installer has nothing to do.
        Write-Host '    [WDK already installed (exit 2008) - treating as success]' -ForegroundColor Yellow
    } else {
        Assert-ExitCode $proc.ExitCode 'WDK'
    }
}

# ---------------------------------------------------------------------------
# Windows Performance Toolkit: xperf, wpr, and Windows Performance Analyzer
# (wpa.exe) -- ETW CPU + loader profiling and the GUI that reads the traces.
#
# WPA is NOT a Visual Studio component and has no relationship to VS's own
# Performance Profiler (a separate, .diagsession-based tool that cannot open an
# .etl). It ships in exactly two places: as an optional FEATURE of the Windows
# SDK ("Windows Performance Toolkit", OptionId.WindowsPerformanceToolkit), and
# in the Windows ADK, which bundles the same toolkit. Whether the SDK install
# that Visual Studio performs happens to select that feature varies with the VS
# and SDK version - when it does, WPT lands in
# %ProgramFiles(x86)%\Windows Kits\10\Windows Performance Toolkit and the SDK
# puts that directory on the machine PATH itself - so this step DETECTS first
# and only falls back to installing the ADK (winget owns the versioned download
# URL, which makes it the reliable source) when nothing is there. That fallback
# is a large download; to install just the toolkit instead, run the standalone
# SDK setup with
#     winsdksetup.exe /features OptionId.WindowsPerformanceToolkit /q
#
# There is also a newer WPA in the Microsoft Store (`winget install --id
# 9N0W1B2BXGNZ --source msstore`), which updates independently of the SDK. It is
# not installed here: the Store package needs an interactive, signed-in session,
# which is exactly what this elevated, unattended half does not have.
#
# Idempotent and non-fatal - it never aborts provisioning.
# ---------------------------------------------------------------------------
Write-Step 'Windows Performance Toolkit (xperf / wpr / WPA)'
$WptDirs = @(
    (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit'),
    (Join-Path $env:ProgramFiles        'Windows Kits\10\Windows Performance Toolkit'),
    (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit')
)
function Find-WptDir { $script:WptDirs | Where-Object { Test-Path (Join-Path $_ 'xperf.exe') } | Select-Object -First 1 }

$WptDir = Find-WptDir
if ($WptDir) {
    Write-Host "    OK: WPT already present ($WptDir)" -ForegroundColor Green
} else {
    try {
        winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity `
            --accept-source-agreements --accept-package-agreements
        Write-Host '    Windows ADK (includes Windows Performance Toolkit) installed.'
        $WptDir = Find-WptDir
    } catch {
        Write-Warning "WPT install failed: $($_.Exception.Message)"
        Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the'
        Write-Warning 'Windows SDK "Windows Performance Toolkit" optional feature.'
    }
}

if ($WptDir) {
    # Report what actually landed. wpa.exe is the piece people come looking for
    # and it is the one that is absent if a trimmed toolkit ever shows up.
    foreach ($tool in 'xperf.exe', 'wpr.exe', 'wpa.exe', 'wpaexporter.exe') {
        $p = Join-Path $WptDir $tool
        if (Test-Path $p) {
            Write-Host "    $tool $((Get-Item $p).VersionInfo.ProductVersion)"
        } else {
            Write-Warning "$tool is missing from $WptDir"
        }
    }

    # The WPT installer normally adds this to the machine PATH itself (and the
    # Start Menu gets "Windows Kits > Windows Performance Toolkit" shortcuts for
    # WPA and WPR). Re-assert it anyway: on the machine PATH rather than a user
    # one so it also resolves for the non-interactive sshd sessions this box is
    # driven through, which build their environment from the registry PATH.
    # Compared trailing-backslash-insensitively - the installer's own entry has
    # one, and adding a second spelling of the same directory is just noise.
    $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')
    if (-not $m) { $m = '' }
    $have = ($m -split ';') | Where-Object { $_.TrimEnd('\') -eq $WptDir.TrimEnd('\') }
    if ($have) {
        Write-Host "    OK: $WptDir already in the machine PATH"
    } else {
        $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $WptDir } else { $WptDir }
        [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')
        Write-Host "    Added $WptDir to the machine PATH (restart shells to pick it up)."
    }
}


# ---------------------------------------------------------------------------
Write-Host "`nAll done." -ForegroundColor Green
Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'

}
catch {
    $ExitCode = 1
    Write-Host "`n==> SETUP FAILED: $($_.Exception.Message)" -ForegroundColor Red
    if ($_.ScriptStackTrace) { Write-Host $_.ScriptStackTrace -ForegroundColor DarkGray }
    # Only fold in the VS Installer logs when a VS step actually failed; for other
    # steps (e.g. WDK) those logs are stale and misleading, so the message above
    # is what matters.
    if ($_.Exception.Message -match 'VS2022') {
        try { Show-VsSetupLogs } catch {}
    }
}
finally {
    try { Stop-Transcript | Out-Null } catch {}

    # This log was created by the elevated (admin) process, so by default the
    # non-elevated caller can't delete it (their token has Administrators marked
    # deny-only). Grant BUILTIN\Users Modify rights so the user account that runs
    # setup-windows.bat can remove the log later. S-1-5-32-545 is the well-known
    # Users SID, used here so this is locale-independent.
    try {
        if (Test-Path $LogFile) {
            $usersSid = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-545')
            $acl  = Get-Acl -Path $LogFile
            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
                        $usersSid, 'Modify', 'Allow')
            $acl.AddAccessRule($rule)
            Set-Acl -Path $LogFile -AclObject $acl
        }
    } catch {
        Write-Host "    [warning] could not relax ACL on $LogFile : $($_.Exception.Message)" -ForegroundColor Yellow
    }
}

exit $ExitCode