# Setup.ps1 — Windows 自動部署完成後的 post-install 腳本
#
# 入口：unattend.xml 的 FirstLogonCommands 會把這份從 Ventoy USB（/ventoy/script/Setup.ps1）
# 複製到 C:\Scripts\Setup.ps1，然後以 Admin 帳號執行。
#
# Log: C:\Windows\Temp\setup.log（每段都寫 START/DONE/ERR）
#
# 順序：開頭先暫停 Windows Update（避免跟本腳本搶頻寬／CPU），
#       再做不需網路的本機設定（防火牆 / 註冊機碼 / Default profile），
#       接著等網路，跑下載安裝（OpenSSH FoD / KMS / winget / RemoveAI / Win11Debloat / Telegram），
#       結尾解除 WU 暫停並主動觸發掃描，這樣更新會排在所有 post-install 之後才開始下載。

$ErrorActionPreference = 'Continue'
$ProgressPreference = 'SilentlyContinue'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$LogFile = 'C:\Windows\Temp\setup.log'

# 內網 KMS 主機請改下面這列；保持空陣列就會用公開 KMS 清單輪流試
$InternalKmsServers = @()
$PublicKmsServers   = @('kms.digiboy.ir', 'kms8.msguides.com', 'kms.03k.org', 'kms.chinancce.com')

# 要批次移除的 UWP（與 windows-remote-toolkit/config/remove-apps-config.json 同步）
$UwpRemoveList = @(
  'Microsoft.BingNews','Microsoft.BingWeather','Microsoft.GetHelp',
  'Microsoft.MicrosoftSolitaireCollection','Microsoft.Todos','Microsoft.Windows.DevHome',
  'Microsoft.WindowsAlarms','Microsoft.WindowsCamera','Microsoft.WindowsFeedbackHub',
  'Microsoft.WindowsSoundRecorder','Microsoft.Xbox.TCUI','Microsoft.XboxGameCallableUI',
  'Microsoft.XboxIdentityProvider','Microsoft.XboxSpeechToTextOverlay','Microsoft.YourPhone',
  'Microsoft.ZuneMusic','MicrosoftCorporationII.QuickAssist',
  'MicrosoftWindows.Client.WebExperience','MicrosoftWindows.CrossDevice','MSTeams',
  'Microsoft.PowerAutomateDesktop','Microsoft.Windows.Photos'
)

# Win11Debloat 的設定（與 toolkit/config/win11debloat-config.json 同步）
# 改用 hashtable + ConvertTo-Json，避免 here-string 在某些 PowerShell 環境 parse 失敗
$Win11DebloatTweakNames = @(
  'RemoveApps','RemoveGamingApps','RemoveCommApps','RemoveW11Outlook',
  'DisableTelemetry','DisableSearchHistory','DisableBing','DisableStoreSearchSuggestions',
  'DisableSearchHighlights','DisableLockscreenTips','DisableSuggestions','DisableDesktopSpotlight',
  'DisableFindMyDevice','DisableEdgeAds','DisableBraveBloat','DisableSettings365Ads',
  'DisableSettingsHome','DisableCopilot','DisableRecall','DisableClickToDo',
  'DisableAISvcAutoStart','DisablePaintAI','DisableNotepadAI','DisableEdgeAI',
  'PreventUpdateAutoReboot','DisableModernStandbyNetworking','DisableDVR','DisableGameBarIntegration',
  'ShowHiddenFolders','ShowKnownFileExt','EnableDarkMode','TaskbarAlignLeft',
  'HideSearchTb','HideTaskview','HideChat','DisableWidgets','DisableStartRecommended',
  'Hide3dObjects','ExplorerToThisPC','HideGallery','DisableDragTray'
)
$Win11DebloatConfig = [ordered]@{
  Version = '1.0'
  Tweaks  = @($Win11DebloatTweakNames | ForEach-Object { [ordered]@{ Name = $_; Value = $true } })
  Deployment = @(
    [ordered]@{ Name = 'CreateRestorePoint';   Value = $true  },
    [ordered]@{ Name = 'RestartExplorer';      Value = $false },
    [ordered]@{ Name = 'AppRemovalScopeIndex'; Value = 0      }
  )
}
$Win11DebloatConfigJson = $Win11DebloatConfig | ConvertTo-Json -Depth 5

# ---- helpers ----

function Log {
  param([string]$msg)
  $line = '[{0}] {1}' -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $msg
  Add-Content -Path $LogFile -Value $line -Encoding UTF8
  Write-Host $line
}

function Section {
  param([string]$name, [scriptblock]$block)
  Log "=== $name START ==="
  try {
    & $block
    Log "=== $name DONE ==="
  } catch {
    Log "=== $name ERR: $($_.Exception.Message) ==="
  }
}

function Wait-Network {
  param([int]$timeoutSec = 60)
  $i = 0
  $max = [int]($timeoutSec / 2)
  while ($i -lt $max -and -not (Test-Connection 8.8.8.8 -Count 1 -Quiet -ErrorAction SilentlyContinue)) {
    Start-Sleep 2
    $i++
  }
  Log "Network wait: $($i*2)s"
}

function Set-RegValue {
  param([string]$Path, [string]$Name, $Value, [string]$Type = 'DWord')
  if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
  New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $Type -Force | Out-Null
}

# 開頭橫線（log 開始）
"`n========== Setup.ps1 starting at $(Get-Date -Format o) ==========" | Add-Content $LogFile -Encoding UTF8

# ---- Phase 1: 本機設定（不需網路）----

Section 'pause-windows-update' {
  # 設定官方暫停旗標：暫停 24 小時（Setup.ps1 結尾會主動清掉並觸發掃描）
  $now    = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
  $expiry = (Get-Date).ToUniversalTime().AddHours(24).ToString("yyyy-MM-ddTHH:mm:ssZ")
  $ux = 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings'
  Set-RegValue $ux 'PauseUpdatesStartTime'        $now    'String'
  Set-RegValue $ux 'PauseUpdatesExpiryTime'       $expiry 'String'
  Set-RegValue $ux 'PauseFeatureUpdatesStartTime' $now    'String'
  Set-RegValue $ux 'PauseFeatureUpdatesEndTime'   $expiry 'String'
  Set-RegValue $ux 'PauseQualityUpdatesStartTime' $now    'String'
  Set-RegValue $ux 'PauseQualityUpdatesEndTime'   $expiry 'String'
  Log "WU paused until $expiry (UTC)"

  # 停掉已啟動的 WU 相關服務，避免在 Setup.ps1 期間搶頻寬／CPU
  foreach ($svc in @('UsoSvc','wuauserv','BITS')) {
    Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue
  }
}

Section 'firewall-ssh-22' {
  Remove-NetFirewallRule -DisplayName 'SSH TCP 22 (Allow Inbound)' -ErrorAction SilentlyContinue
  New-NetFirewallRule -DisplayName 'SSH TCP 22 (Allow Inbound)' `
    -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow -Profile Any -Enabled True | Out-Null
  Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True
}

Section 'rdp-enable-3389' {
  Set-RegValue 'HKLM:\System\CurrentControlSet\Control\Terminal Server' 'fDenyTSConnections' 0
  Set-RegValue 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' 'UserAuthentication' 1
  Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue
}

Section 'icmp-echo-allow' {
  Remove-NetFirewallRule -DisplayName 'ICMPv4 Echo Request (Allow Inbound)' -ErrorAction SilentlyContinue
  New-NetFirewallRule -DisplayName 'ICMPv4 Echo Request (Allow Inbound)' `
    -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -Action Allow -Profile Any -Enabled True | Out-Null
  Get-NetFirewallRule -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Echo Request' } |
    Enable-NetFirewallRule -ErrorAction SilentlyContinue
}

Section 'winrm-enable' {
  Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
  Set-Service -Name WinRM -StartupType Automatic
  Start-Service -Name WinRM -ErrorAction SilentlyContinue
  cmd.exe /c 'winrm quickconfig -quiet -force'                              | Out-Null
  cmd.exe /c 'winrm set winrm/config/service/auth @{Basic="true"}'          | Out-Null
  cmd.exe /c 'winrm set winrm/config/service @{AllowUnencrypted="true"}'    | Out-Null
  cmd.exe /c 'winrm set winrm/config/client @{TrustedHosts="*"}'            | Out-Null
  Enable-NetFirewallRule -DisplayGroup 'Windows Remote Management' -ErrorAction SilentlyContinue
}

Section 'onedrive-remove' {
  Get-Process OneDrive -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
  foreach ($p in @("$env:SystemRoot\System32\OneDriveSetup.exe", "$env:SystemRoot\SysWOW64\OneDriveSetup.exe")) {
    if (Test-Path $p) { Start-Process $p -ArgumentList '/uninstall' -Wait -ErrorAction SilentlyContinue }
  }
  Remove-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDrive' -ErrorAction SilentlyContinue
  Remove-Item 'HKLM:\SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}' -Recurse -ErrorAction SilentlyContinue
  Remove-Item 'HKLM:\SOFTWARE\Wow6432Node\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}' -Recurse -ErrorAction SilentlyContinue
  Remove-Item -Path 'C:\OneDriveTemp', "$env:USERPROFILE\OneDrive", "$env:LOCALAPPDATA\Microsoft\OneDrive" -Recurse -Force -ErrorAction SilentlyContinue
}

Section 'cortana-websearch-off' {
  $k1 = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search'
  Set-RegValue $k1 'AllowCortana' 0
  Set-RegValue $k1 'DisableWebSearch' 1
  Set-RegValue $k1 'ConnectedSearchUseWeb' 0
  Set-RegValue $k1 'AllowSearchToUseLocation' 0

  $k2 = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer'
  Set-RegValue $k2 'DisableSearchBoxSuggestions' 1
}

# 把 UI / IME 預設套到 Default profile，新使用者首次登入會繼承
Section 'apply-ui-ime-default-profile' {
  $hivePath = 'C:\Users\Default\NTUSER.DAT'
  $mountKey = 'HKU\SetupDefault'
  reg.exe load $mountKey $hivePath | Out-Null
  try {
    $base = "Registry::$mountKey"

    $adv = "$base\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    Set-RegValue $adv 'HideFileExt' 0          # 顯示副檔名
    Set-RegValue $adv 'Hidden' 1               # 顯示隱藏檔
    Set-RegValue $adv 'TaskbarAl' 0            # 工作列靠左
    Set-RegValue $adv 'ShowTaskViewButton' 0   # 隱藏 Task View 按鈕
    Set-RegValue $adv 'LaunchTo' 1             # 開啟 This PC
    Set-RegValue $adv 'Start_TrackProgs' 0     # 不追蹤最近開啟的程式

    $theme = "$base\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize"
    Set-RegValue $theme 'AppsUseLightTheme' 0
    Set-RegValue $theme 'SystemUseLightTheme' 0

    # 工作列搜尋框：0=隱藏, 1=圖示, 2=框, 3=圖示+標籤
    $search = "$base\Software\Microsoft\Windows\CurrentVersion\Search"
    Set-RegValue $search 'SearchboxTaskbarMode' 0

    $cloud = "$base\Software\Policies\Microsoft\Windows\CloudContent"
    Set-RegValue $cloud 'DisableSpotlightCollectionOnDesktop' 1
    Set-RegValue $cloud 'DisableWindowsSpotlightFeatures' 1

    # 鍵盤排序：英文鍵盤排第一（預設英數），注音排第二
    $kbPre = "$base\Keyboard Layout\Preload"
    Set-RegValue $kbPre '1' '00000409' 'String'
    Set-RegValue $kbPre '2' '00000404' 'String'

    # CHT 注音：預設英數模式、關掉雲端候選與預測
    $cht = "$base\Software\Microsoft\InputMethod\Settings\CHT"
    Set-RegValue $cht 'Enable Default Input Mode' 0
    Set-RegValue $cht 'Enable Cand Predict' 0
    Set-RegValue $cht 'Enable Cloud Cand' 0
    Set-RegValue $cht 'Enable Cloud Input' 0

    # 把系統 Hotkey 切換鍵停掉（3 = 不指定鍵）
    $tg = "$base\Keyboard Layout\Toggle"
    Set-RegValue $tg 'Hotkey' '3' 'String'
    Set-RegValue $tg 'Language Hotkey' '3' 'String'
    Set-RegValue $tg 'Layout Hotkey' '3' 'String'
  } finally {
    [GC]::Collect()
    Start-Sleep 1
    reg.exe unload $mountKey | Out-Null
  }
}

Section 'hide-admin-account' {
  # 帳號 User 在 unattend.xml Order 3 已直接以大寫建立，這裡只負責把 Admin 從登入畫面藏掉
  $userListKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
  Set-RegValue $userListKey 'Admin' 0   # 0 = 從登入畫面隱藏（帳號仍存在仍可用）
}

# ---- Phase 2: 需要網路 ----

Section 'wait-network' { Wait-Network -timeoutSec 60 }

Section 'openssh-server-install' {
  Add-WindowsCapability -Online -Name 'OpenSSH.Server~~~~0.0.1.0' -ErrorAction Stop | Out-Null
  Set-Service sshd -StartupType Automatic
  Start-Service sshd
}

Section 'kms-activate' {
  $servers = @()
  if ($InternalKmsServers.Count -gt 0) { $servers += $InternalKmsServers }
  $servers += $PublicKmsServers
  $activated = $false
  foreach ($kms in $servers) {
    Log "Try KMS: $kms"
    cscript.exe //nologo C:\Windows\System32\slmgr.vbs /skms $kms | ForEach-Object { Log "  skms: $_" }
    $out = cscript.exe //nologo C:\Windows\System32\slmgr.vbs /ato 2>&1
    foreach ($line in $out) { Log "  ato : $line" }
    if ($out -match 'successful|成功') {
      Log "Activated via $kms"
      $activated = $true
      break
    }
  }
  if (-not $activated) { Log 'All KMS servers failed; remaining in grace period' }
}

Section 'winget-install-chrome' {
  $winget = (Get-Command winget -ErrorAction SilentlyContinue).Source
  if (-not $winget) { Log 'winget not found (Win10 沒裝 App Installer？)'; return }
  & $winget install --id Google.Chrome -e --silent `
    --accept-source-agreements --accept-package-agreements --scope machine 2>&1 |
    ForEach-Object { Log "  winget: $_" }
}

Section 'remove-windows-ai' {
  $sb = [scriptblock]::Create((Invoke-RestMethod 'https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1'))
  & $sb -nonInteractive -AllOptions -EnableLogging | Out-Null
}

Section 'win11debloat' {
  $work = Join-Path $env:TEMP 'win11debloat'
  $zip  = "$work.zip"
  if (Test-Path $work) { Remove-Item $work -Recurse -Force }
  Invoke-WebRequest -UseBasicParsing -Uri 'https://github.com/Raphire/Win11Debloat/archive/refs/heads/master.zip' -OutFile $zip
  Expand-Archive -Path $zip -DestinationPath $work -Force
  $dir = Get-ChildItem $work -Directory | Select-Object -First 1
  if (-not $dir) { throw 'Win11Debloat zip extracted but no inner dir' }
  $config = Join-Path $dir.FullName 'unattend-config.json'
  Set-Content -Path $config -Value $Win11DebloatConfigJson -Encoding UTF8
  & "$($dir.FullName)\Win11Debloat.ps1" -Silent -Config $config -NoRestartExplorer
}

Section 'remove-uwp-apps' {
  foreach ($name in $UwpRemoveList) {
    Get-AppxPackage -AllUsers -Name $name -ErrorAction SilentlyContinue | ForEach-Object {
      try {
        Remove-AppxPackage -AllUsers -Package $_.PackageFullName -ErrorAction Stop
        Log "Removed AppxPackage $name"
      } catch {
        Log "Skip AppxPackage $name : $($_.Exception.Message)"
      }
    }
    Get-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue |
      Where-Object { $_.DisplayName -eq $name } |
      ForEach-Object {
        try {
          Remove-AppxProvisionedPackage -Online -PackageName $_.PackageName -ErrorAction Stop | Out-Null
          Log "Removed Provisioned $name"
        } catch {
          Log "Skip Provisioned $name : $($_.Exception.Message)"
        }
      }
  }
}

Section 'install-telegram' {
  $p = Join-Path $env:TEMP 'tsetup.exe'
  Invoke-WebRequest -UseBasicParsing -Uri 'https://telegram.org/dl/desktop/win64' -OutFile $p
  $proc = Start-Process -FilePath $p -ArgumentList '/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART' -Wait -PassThru
  Log "Telegram installer exit code: $($proc.ExitCode)"
}

Section 'resume-and-trigger-windows-update' {
  # 清掉暫停旗標（pause-windows-update 設的那幾個值）
  $ux = 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings'
  foreach ($n in @('PauseUpdatesStartTime','PauseUpdatesExpiryTime',
                   'PauseFeatureUpdatesStartTime','PauseFeatureUpdatesEndTime',
                   'PauseQualityUpdatesStartTime','PauseQualityUpdatesEndTime')) {
    Remove-ItemProperty -Path $ux -Name $n -ErrorAction SilentlyContinue
  }

  # 確保服務可啟動
  foreach ($svc in @('BITS','wuauserv','UsoSvc')) {
    Start-Service -Name $svc -ErrorAction SilentlyContinue
  }

  # 通知 Update Orchestrator 重新讀設定，然後立即掃描／下載／安裝
  $uso = "$env:SystemRoot\System32\UsoClient.exe"
  if (Test-Path $uso) {
    & $uso RefreshSettings | Out-Null
    & $uso StartScan       | Out-Null
    & $uso StartDownload   | Out-Null
    & $uso StartInstall    | Out-Null
    Log 'WU resumed; UsoClient scan/download/install triggered'
  } else {
    # 後備：呼叫 COM 觸發掃描
    try {
      (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
      Log 'WU resumed; AutoUpdate.DetectNow triggered (COM fallback)'
    } catch {
      Log "WU resumed but trigger failed: $($_.Exception.Message)"
    }
  }
}

# 結尾：刪掉殘留的明碼回應檔
Section 'cleanup-unattend-files' {
  Remove-Item 'C:\Windows\Panther\unattend.xml' -Force -ErrorAction SilentlyContinue
  Remove-Item 'C:\Windows\Panther\Unattend\unattend.xml' -Force -ErrorAction SilentlyContinue
}

"========== Setup.ps1 finished at $(Get-Date -Format o) ==========" | Add-Content $LogFile -Encoding UTF8