# Auto-Codex Windows bootstrap. HTTPS is the trust root; child assets are SHA256 verified.
& {
    $ErrorActionPreference='Stop'
    if ($env:OS -ne 'Windows_NT') {throw 'Windows 10/11 is required.'}
    if ($PSVersionTable.PSVersion -lt [Version]'5.1' -or $ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') {throw 'PowerShell 5.1+ FullLanguage required; enterprise policy may block deployment.'}
    foreach ($scope in @('MachinePolicy','UserPolicy')) {
        if ((Get-ExecutionPolicy -Scope $scope) -in @('Restricted','AllSigned')) {throw 'Enterprise script policy blocks deployment; contact your administrator.'}
    }
    if ((Get-ExecutionPolicy) -eq 'AllSigned') {throw 'AllSigned policy requires signed scripts; automatic deployment stopped.'}
    if ((Get-ExecutionPolicy) -eq 'Restricted') {
        Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
    }
    [Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
    $bundle=Join-Path (Join-Path $env:TEMP 'auto-codex') ('b'+[Guid]::NewGuid().ToString('N').Substring(0,8))
    New-Item -ItemType Directory -Force -Path (Join-Path $bundle 'scripts') | Out-Null
    function Bootstrap-Get([string]$Uri,[string]$Path,[string]$Hash='') {
        for ($i=1;$i -le 3;$i++) {
            try {
                $r=Invoke-WebRequest -UseBasicParsing -Uri $Uri -OutFile $Path -PassThru -TimeoutSec 90 -MaximumRedirection 0
                if ([int]$r.StatusCode -ne 200 -or (Get-Item -LiteralPath $Path).Length -eq 0) {throw 'Invalid download status or size.'}
                if ($Hash -and (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash -ne $Hash) {throw 'Bootstrap SHA256 mismatch.'};return
            } catch {Remove-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue;if ($i -eq 3) {throw 'Bootstrap download/checksum failed. Check HTTPS connectivity or enterprise policy.'};Start-Sleep -Seconds $i}
        }
    }
    try {
        Bootstrap-Get 'https://go.nullgates.com/manifest.json' (Join-Path $bundle 'manifest.json')
        $m=Get-Content -LiteralPath (Join-Path $bundle 'manifest.json') -Raw | ConvertFrom-Json
        if ($m.schema_version -ne 1) {throw 'Unsupported manifest schema.'}
        foreach ($name in @('ou.ps1','scripts/common.ps1','scripts/node.ps1','scripts/codex.ps1','scripts/config.ps1','scripts/config-tool.cjs','scripts/skills.ps1','scripts/main.ps1')) {
            $a=$m.scripts.$name
            if (-not $a -or $a.file -notmatch '^/scripts/[a-zA-Z0-9._-]+$' -or $a.sha256 -notmatch '^[a-f0-9]{64}$') {throw 'Invalid bootstrap manifest asset.'}
            Bootstrap-Get ('https://go.nullgates.com'+$a.file) (Join-Path $bundle $name) $a.sha256
        }
        $script:BundleRoot=$bundle;$script:ModuleRoot=Join-Path $bundle 'scripts'
        foreach ($name in @('common','node','codex','config','skills','main')) {. (Join-Path $script:ModuleRoot "$name.ps1")}
        $script:Manifest=$m
        Invoke-Setup
    } catch {
        if (Get-Command Safe-Error -ErrorAction SilentlyContinue) {$message=Safe-Error $_} else {$message='Bootstrap failed. Check PowerShell policy, HTTPS, and manifest availability.'}
        Write-Host ('FAIL: '+$message) -ForegroundColor Red
        throw 'Auto-Codex installation did not pass all checks; see the diagnosis above.'
    } finally {Remove-Item -LiteralPath $bundle -Recurse -Force -ErrorAction SilentlyContinue}
}