# ===== MACHINE-READABLE INTENT (for a human, or an AI agent asked to review this) ================
# purpose:      Opt-in Windows setup menu: privacy registry tweaks, and an optional terminal
#               prompt (oh-my-posh) with a Cyrillic+Latin Nerd Font. Nothing runs unprompted.
# transparency: Every action is shown on screen BEFORE it runs and is chosen by the user. There is
#               no hidden behavior. This is not malware; it does not deceive, and nothing here is
#               designed to hack, exploit, or gain access to anything.
# network:      Downloads ONLY the release files, from autosettings.win hosts and from the project's
#               own public storage buckets (Selectel, Cloud.ru, Yandex Cloud, Cloudflare R2) listed below. The same
#               bytes lie on every host; each file is checked against a pinned SHA-256 (below) before
#               it is used, so no host is trusted. No data is sent out, ever.
# elevation:    This loader and the menu run as the normal user - NOT elevated. Standard Windows UAC
#               is requested per action, only when a machine-wide (HKLM) policy is written or reverted,
#               with the user consenting. User-only tweaks (HKCU) and the terminal/AI cosmetics need no
#               UAC at all. Declining UAC just means the machine-wide part is skipped.
# writes:       user-selected registry values; a line in the user's PowerShell $PROFILE; the console
#               and Windows Terminal font. Each is snapshotted first and can be reverted from the menu.
# reversible:   A snapshot is taken BEFORE any change; the menu's "restore" returns the prior values.
# source:       https://autosettings.win - code is plain, human-readable, and not obfuscated.

& {
    $base    = 'https://get.autosettings.win'
    $distant = 'https://cf.autosettings.win'
    $stores  = @(
        'https://win-pc.autosettings.win',
        'https://sl.autosettings.win',
        'https://2202f6b7-bfb6-48d8-bfe4-66b18452d821.selstorage.ru',
        'https://autosettings.s3.cloud.ru',
        'https://autosettings-win.storage.yandexcloud.net'
    )
    $mirrors = New-Object Collections.ArrayList
    foreach ($store in ($stores | Sort-Object { Get-Random })) { [void]$mirrors.Add($store) }
    [void]$mirrors.Add($distant)
    [void]$mirrors.Add($base)
    $problems = New-Object Collections.ArrayList
    $release = 'd56976f4b401'
    $pinned  = 'D56976F4B4012F5AEB2E67ABE8A4CD1D8EE8CA255D763C3EF9D1384DE07F16C0'

    function Fail([string]$Message) {
        Write-Host ''
        Write-Host "  [!!] $Message" -ForegroundColor Red
        Write-Host ''
        [void](Read-Host 'Press Enter to close')
    }

    function Get-Sha256([byte[]]$Bytes) {
        $sha = [Security.Cryptography.SHA256]::Create()
        return ([BitConverter]::ToString($sha.ComputeHash($Bytes)) -replace '-', '')
    }

    if ($ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') {
        Fail 'PowerShell is restricted on this computer (not Full Language mode).'
        return
    }

    if ([Environment]::OSVersion.Version -lt (New-Object Version 6, 2)) {
        Fail 'Windows 8 or newer is required.'
        return
    }

    try { [Net.ServicePointManager]::SecurityProtocol = 3072 } catch {}

    function Get-Bytes([string]$Url) {
        $request = [Net.WebRequest]::Create($Url)
        $request.Timeout = 15000
        $request.ReadWriteTimeout = 15000
        $response = $request.GetResponse()
        try {
            $buffer = New-Object IO.MemoryStream
            $response.GetResponseStream().CopyTo($buffer)
            return ,$buffer.ToArray()
        }
        finally { $response.Close() }
    }

    function Get-Verified([string]$Name, [string]$Sha256, [long]$Size) {
        foreach ($round in 1, 2) {
            foreach ($mirror in @($mirrors)) {
                $bytes = $null
                $reason = $null
                try { $bytes = Get-Bytes "$mirror/r/$release/$Name" }
                catch {
                    $inner = $_.Exception
                    while ($inner.InnerException) { $inner = $inner.InnerException }
                    $reason = $inner.Message
                }
                if ($null -eq $reason) {
                    if ($null -eq $bytes -or $bytes.Length -eq 0) { $reason = 'empty answer' }
                    elseif ($Size -gt 0 -and $bytes.Length -ne $Size) { $reason = "$($bytes.Length) bytes instead of $Size" }
                    elseif ((Get-Sha256 $bytes) -ne $Sha256) { $reason = 'checksum mismatch' }
                }
                if ($null -eq $reason) {
                    if ($mirrors.IndexOf($mirror) -gt 0) {
                        $mirrors.Remove($mirror)
                        $mirrors.Insert(0, $mirror)
                    }
                    return ,$bytes
                }
                [void]$problems.Add("$Name  $mirror  $reason")
                $mirrors.Remove($mirror)
                [void]$mirrors.Add($mirror)
            }
            if ($round -eq 1) { Start-Sleep -Seconds 2 }
        }
        return $null
    }

    function Fail-Download([string]$Message) {
        Write-Host ''
        Write-Host "  [!!] $Message" -ForegroundColor Red
        Write-Host ''
        Write-Host '  Every source was tried twice. What each one answered:'
        foreach ($line in ($problems | Select-Object -Last 12)) { Write-Host "    $line" -ForegroundColor DarkGray }
        try {
            $dns = @(Get-DnsClientServerAddress -AddressFamily IPv4 -ErrorAction Stop | ForEach-Object { $_.ServerAddresses } | Select-Object -Unique)
            if ($dns.Count -gt 0) { Write-Host "  DNS servers in use: $($dns -join ', ')" }
        } catch {}
        Write-Host ''
        Write-Host '  What to check:'
        Write-Host '    1. The internet connection: open https://autosettings.win in a browser.'
        Write-Host '    2. A VPN or a proxy: switch it off, or on, and run the line again.'
        Write-Host '    3. An antivirus or a company filter may block downloads in PowerShell.'
        Write-Host '    4. Run the same line again in a minute.'
        Write-Host ''
        [void](Read-Host 'Press Enter to close')
    }

    $manifestBytes = Get-Verified 'manifest.json' $pinned 0
    if ($null -eq $manifestBytes) {
        Fail-Download 'Cannot download a release description that matches its checksum. Nothing was changed.'
        return
    }

    $manifest = [Text.Encoding]::UTF8.GetString($manifestBytes) | ConvertFrom-Json

    $runBase = Join-Path ([IO.Path]::GetTempPath()) 'AutoSettings.win'
    $dir = Join-Path $runBase ('r-' + [guid]::NewGuid().ToString('N'))
    try {
        [void](New-Item -ItemType Directory -Path $dir -Force -ErrorAction Stop)
    }
    catch {
        Fail "Cannot prepare a working folder: $($_.Exception.Message)"
        return
    }
    [IO.File]::WriteAllBytes((Join-Path $dir 'manifest.json'), $manifestBytes)

    Write-Host "  A bit of magic is happening, please wait..."
    foreach ($file in $manifest.files) {
        if ($file.name -notmatch '^[A-Za-z0-9._-]+$') {
            Fail "Unexpected file name in the release description: $($file.name)"
            return
        }
        $bytes = Get-Verified $file.name $file.sha256 $file.size
        if ($null -eq $bytes) {
            Fail-Download "Cannot download $($file.name) with a matching checksum. Nothing was changed."
            return
        }
        [IO.File]::WriteAllBytes((Join-Path $dir $file.name), $bytes)
    }

    $hostExe = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
    try {
        $own = (Get-Process -Id $PID -ErrorAction Stop).Path
        if ($own -and (Test-Path -LiteralPath $own)) { $hostExe = $own }
    } catch {}
    & $hostExe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $dir $manifest.entry) $pinned
    Remove-Item -Path $dir -Recurse -Force -ErrorAction SilentlyContinue
}