rebuild.ps1

# Ensure script is running as Administrator
function Assert-Admin {
    $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)) {
        Write-Host "🔒 Script not running as administrator. Restarting with elevated privileges..."
        $newProcess = Start-Process -FilePath "powershell.exe" -ArgumentList "-ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs -PassThru
        $newProcess.WaitForExit()
        exit
    }
}
Assert-Admin

# Transcript log next to the script for post-run troubleshooting
$logPath = Join-Path $PSScriptRoot ("rebuild-{0:yyyyMMdd-HHmmss}.log" -f (Get-Date))
try { Start-Transcript -Path $logPath -Force | Out-Null } catch {}

# Detect system architecture and role
$arch = (Get-CimInstance -ClassName Win32_OperatingSystem).OSArchitecture
$archType = if ($arch -like "*ARM64*") { "ARM64" } elseif ($arch -like "*64*") { "x64" } else { "Other" }

$deviceType = (Get-CimInstance -ClassName Win32_ComputerSystem).PCSystemType
$deviceRole = if ($deviceType -eq 1) { "Desktop" } else { "Laptop" }

Write-Host "🔍 System Context: Architecture = $archType | Device = $deviceRole"

# Set power plan based on device role
try {
    if ($deviceRole -eq "Desktop") {
        # Ultimate Performance is hidden by default; duplicate is a no-op if already present
        powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61 | Out-Null
        powercfg -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
        Write-Host "⚡ Power plan set to Ultimate Performance"
    } else {
        powercfg -setactive 381b4222-f694-41f0-9685-ff5bb260df2e
        Write-Host "🔋 Power plan set to Balanced"
    }
} catch {
    Write-Warning "❌ Failed to set power plan: $_"
}

# === Load App List from JSON and Filter ===
$appConfigPath = Join-Path -Path $PSScriptRoot -ChildPath "applications.json"
if (-Not (Test-Path $appConfigPath)) {
    Write-Error "❌ App configuration file not found at: $appConfigPath"
    exit 1
}
try {
    $rawAppList = Get-Content $appConfigPath -Raw | ConvertFrom-Json
    Write-Host "📦 Loaded $($rawAppList.Count) apps from configuration."
} catch {
    Write-Error "❌ Failed to parse applications.json: $_"
    exit 1
}

$filteredApps = $rawAppList | Where-Object {
    $_.ExcludeOn -notcontains $archType -and $_.ExcludeOn -notcontains $deviceRole
}

foreach ($app in $filteredApps) {
    Write-Host "📥 Installing $($app.Name)..."

    # Skip if already installed
    & winget list --id $app.Id -e --accept-source-agreements 2>$null | Out-Null
    if ($LASTEXITCODE -eq 0) {
        Write-Host "↪️  Already installed: $($app.Name)"
        continue
    }

    & winget install --id $app.Id -e --accept-source-agreements --accept-package-agreements
    # 0 = success, -1978335189 = no applicable update / already installed
    if ($LASTEXITCODE -eq 0 -or $LASTEXITCODE -eq -1978335189) {
        Write-Host "✅ Installed: $($app.Name)"
    } else {
        Write-Warning "❌ Failed to install $($app.Name) (winget exit code $LASTEXITCODE)"
    }
}

# === Communication Device Control ===
try {
    $audioPath = "HKCU:\Software\Microsoft\Multimedia\Audio"
    if (-not (Test-Path $audioPath)) {
        New-Item -Path $audioPath -Force | Out-Null
    }
    New-ItemProperty -Path $audioPath -Name "UserDuckingPreference" -PropertyType DWord -Value 3 -Force | Out-Null
    Write-Host "✅ Communication Device Control"
} catch {
    Write-Warning "❌ Communication Device Control: $_"
}

# === BypassPaywall Extension for Edge ===
# ForceList implies allow; no need for a separate AllowList entry.
try {
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist" /v "1" /t REG_SZ /d "lkbebcjgcmobigpeffafkodonchffocl" /f | Out-Null
    Write-Host "✅ BypassPaywall extension policy applied to Edge"
} catch {
    Write-Warning "❌ Failed to apply Edge extension policy: $_"
}

# === Windows App SelfHost Environment ===
try {
    reg add HKCU\Software\Microsoft\Windows365 /v Environment /t REG_DWORD /d 0 /f | Out-Null
    Write-Host "✅ Windows365 Environment set to SelfHost"
} catch {
    Write-Warning "❌ Failed to apply Windows App environment setting: $_"
}

# === Set GPU Preference for Plex ===
try {
    $appPath = "C:\Program Files\Plex\Plex\plex.exe"
    if (-not (Test-Path $appPath)) {
        Write-Host "↪️  Skipping Plex GPU preference (plex.exe not found at $appPath)"
    } else {
        $gpuRegPath = "HKCU:\Software\Microsoft\DirectX\UserGpuPreferences"
        if (-not (Test-Path $gpuRegPath)) {
            New-Item -Path $gpuRegPath -Force | Out-Null
        }

        Set-ItemProperty -Path $gpuRegPath -Name $appPath -Value "GpuPreference=2;" -Force

        $gpuValue = (Get-ItemProperty -Path $gpuRegPath -Name $appPath -ErrorAction Stop).$appPath
        if ($gpuValue -eq "GpuPreference=2;") {
            Write-Host "✅ GPU preference set to High Performance for $appPath"
        } else {
            Write-Warning "⚠️ Failed to validate GPU preference setting"
        }
    }
} catch {
    Write-Warning "❌ Error setting GPU preference: $_"
}

# === Disable Power Throttling ===
try {
    $powerThrottleKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerThrottling"
    if (-not (Test-Path $powerThrottleKey)) {
        New-Item -Path $powerThrottleKey -Force | Out-Null
    }

    New-ItemProperty -Path $powerThrottleKey -Name "PowerThrottlingOff" -Value 1 -PropertyType DWord -Force | Out-Null
    $throttleValue = (Get-ItemProperty -Path $powerThrottleKey -Name "PowerThrottlingOff" -ErrorAction Stop).PowerThrottlingOff
    if ($throttleValue -eq 1) {
        Write-Host "✅ Power throttling disabled system-wide"
    } else {
        Write-Warning "⚠️ Failed to validate PowerThrottlingOff setting"
    }
} catch {
    Write-Warning "❌ Error disabling power throttling: $_"
}

# === CredentialUIBroker WebAuthn workaround ===
$credFix = Join-Path $PSScriptRoot "credentialfix.ps1"
if (Test-Path $credFix) {
    try {
        & $credFix
        Write-Host "✅ CredentialUIBroker reset task installed"
    } catch {
        Write-Warning "❌ Failed to install CredentialUIBroker reset task: $_"
    }
}

Write-Host "`n🔄 A system reboot is recommended for all changes to take effect."

try { Stop-Transcript | Out-Null } catch {}