[CmdletBinding()]
param(
    [string]$InstallRoot = (Join-Path $env:USERPROFILE 'wx-agent'),
    [string]$TaskName = 'WxAgent',
    [switch]$Start,
    [switch]$OpenBrowser,
    [switch]$PreventAutoLock,
    [string]$Token
)

$ErrorActionPreference = 'Stop'
$exe = Join-Path $InstallRoot 'WxAgent.Host.exe'
$config = Join-Path $InstallRoot 'service.json'
$credentials = Join-Path $InstallRoot 'credentials.json'
$data = Join-Path $InstallRoot 'data'
$url = 'http://127.0.0.1:5088/'

if (-not (Test-Path $exe)) { throw "WxAgent.Host.exe was not found under $InstallRoot. Publish/copy the application first." }
if ($TaskName -notmatch '^[A-Za-z0-9 ._-]{1,64}$') { throw 'TaskName contains unsupported characters.' }
New-Item -ItemType Directory -Force -Path $data | Out-Null

if ($PreventAutoLock) {
    powercfg /change monitor-timeout-ac 0
    powercfg /change standby-timeout-ac 0
    powercfg /change hibernate-timeout-ac 0
    powercfg /change monitor-timeout-dc 0
    powercfg /change standby-timeout-dc 0
    powercfg /change hibernate-timeout-dc 0
    powercfg /setacvalueindex SCHEME_CURRENT SUB_NONE CONSOLELOCK 0
    powercfg /setdcvalueindex SCHEME_CURRENT SUB_NONE CONSOLELOCK 0
    powercfg /setactive SCHEME_CURRENT
    New-Item -Path 'HKCU:\Control Panel\Desktop' -Force | Out-Null
    Set-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name ScreenSaveActive -Value 0
    Set-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name ScreenSaveTimeout -Value 0
    New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' -Force | Out-Null
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' -Name NoLockScreen -Type DWord -Value 1
}

function Write-Utf8Json([string]$Path, $Value) {
    $utf8 = New-Object System.Text.UTF8Encoding($false)
    [IO.File]::WriteAllText($Path, ($Value | ConvertTo-Json -Depth 8), $utf8)
}

function To-Hex([byte[]]$Bytes) { [BitConverter]::ToString($Bytes).Replace('-', '') }

$generatedToken = $null
if (-not (Test-Path $credentials)) {
    if ([string]::IsNullOrWhiteSpace($Token)) {
        $bytes = New-Object byte[] 32
        $rng = [Security.Cryptography.RandomNumberGenerator]::Create()
        try { $rng.GetBytes($bytes) } finally { $rng.Dispose() }
        $generatedToken = (To-Hex $bytes).ToLowerInvariant()
        $Token = $generatedToken
    }
    $sha = [Security.Cryptography.SHA256]::Create()
    try { $hash = To-Hex ($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($Token))).ToUpperInvariant() }
    finally { $sha.Dispose() }
    Write-Utf8Json $credentials @(@{
        PrincipalId = 'local-admin'
        TokenSha256 = $hash
        Permissions = @('read', 'content', 'manage')
        AccountIds = @()
    })
}

if (-not (Test-Path $config)) {
    Write-Utf8Json $config @{
        ListenUrl = 'http://127.0.0.1:5088'
        AllowExternal = $false
        AllowedHosts = @('127.0.0.1:5088', 'localhost:5088', '[::1]:5088')
        AllowedOrigins = @('http://127.0.0.1:5088', 'http://localhost:5088', 'http://[::1]:5088')
        CredentialFile = $credentials
        DataDirectory = $data
        QueueCapacity = 100
        ListenerSession = '文件传输助手'
        EnableListenerEvents = $false
    }
}

$user = $env:USERNAME
$action = New-ScheduledTaskAction -Execute $exe -Argument ('serve --config "{0}"' -f $config) -WorkingDirectory $InstallRoot
$trigger = New-ScheduledTaskTrigger -AtLogOn -User $user
$principal = New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited
$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero)
Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null

$desktop = [Environment]::GetFolderPath('Desktop')
$shell = New-Object -ComObject WScript.Shell
$startShortcut = Join-Path $desktop 'WxAgent-Start.lnk'
$link = $shell.CreateShortcut($startShortcut)
$link.TargetPath = Join-Path $env:SystemRoot 'System32\schtasks.exe'
$link.Arguments = "/run /tn `"$TaskName`""
$link.WorkingDirectory = $InstallRoot
$link.Description = 'Start WxAgent Desktop Agent'
$link.Save()

$openShortcut = Join-Path $desktop 'WxAgent.lnk'
$link = $shell.CreateShortcut($openShortcut)
$link.TargetPath = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
$command = "Start-ScheduledTask -TaskName '$TaskName'; Start-Sleep -Seconds 2; Start-Process '$url'"
$link.Arguments = "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command `"$command`""
$link.WorkingDirectory = $InstallRoot
$link.Description = 'Start WxAgent and open the web console'
$link.Save()

$urlShortcut = Join-Path $desktop 'WxAgent-Web.url'
[IO.File]::WriteAllText($urlShortcut, "[InternetShortcut]`r`nURL=$url`r`n", [Text.Encoding]::ASCII)

if ($Start) { Start-ScheduledTask -TaskName $TaskName }
if ($OpenBrowser) { Start-Process $url }

[pscustomobject]@{
    TaskName = $TaskName
    InstallRoot = $InstallRoot
    Url = $url
    Started = [bool]$Start
    PreventAutoLock = [bool]$PreventAutoLock
    TokenGenerated = [bool]$generatedToken
    Token = $generatedToken
} | Format-List