# rmt.k5csh.com  —  MeshAgent installer bootstrap
$meshUrl = 'https://mc.k5csh.com/meshagents?id=4&meshid=Wml4qVGdvRgcJJPFHSmUt8dn5fEHFdXqMh$OfHIEEuO3Z$H6cD9ewsVurLg06tni&installflags=0'

$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    Start-Process powershell -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -Command "irm https://rmt.k5csh.com | iex"'
    return
}

[Net.ServicePointManager]::SecurityProtocol = 3072

# Extract the unique meshid string parameter from the URL
$targetMeshID = $null
if ($meshUrl -match 'meshid=([^&]+)') {
    $targetMeshID = $Matches[1].Trim()
}

$agentDir = "C:\Program Files\Mesh Agent"
$agentExe = Join-Path $agentDir "MeshAgent.exe"
$regPath = "HKLM:\SOFTWARE\MeshAgentBootstrap"
$skipInstall = $false

# Read the tracking state from the local registry
$storedMeshID = $null
if (Test-Path $regPath) {
    $storedMeshID = (Get-ItemProperty -Path $regPath -Name "CurrentMeshID" -ErrorAction SilentlyContinue).CurrentMeshID
}

if (Test-Path $agentExe) {
    cls
    Write-Host "Agent is already installed."
    Write-Host " -  Verifying deployment state tracking..."
    
    if ($storedMeshID -and $targetMeshID -and ($storedMeshID -eq $targetMeshID)) {
        Write-Host "ID matches stored configuration "
        Write-Host " - ID: ($storedMeshID)."
        Write-Host " - Skipping install."
        $skipInstall = $true
    } else {
        Write-Host "ID change detected or state untracked. "
        Write-Host " - Performing clean redeployment..."
        Start-Process $agentExe -ArgumentList '-fulluninstall' -Wait
        Start-Sleep -Seconds 3
        if (Get-Service -Name "Mesh Agent" -ErrorAction SilentlyContinue) {
            Stop-Service -Name "Mesh Agent" -Force -ErrorAction SilentlyContinue
            Start-Sleep -Seconds 2
        }
        
        if (Test-Path $regPath) { Remove-Item -Path $regPath -Force -Recurse -ErrorAction SilentlyContinue }
    }
}

if (-not $skipInstall) {
    cls
    Write-Host "Downloading and deploying instance..."
    $exe = Join-Path $env:TEMP 'meshagent.exe'
    (New-Object Net.WebClient).DownloadFile($meshUrl, $exe)
    Start-Process $exe -ArgumentList '-fullinstall' -Wait
    
    if ($targetMeshID) {
        if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null }
        Set-ItemProperty -Path $regPath -Name "CurrentMeshID" -Value $targetMeshID -Force | Out-Null
        Write-Host "Deployment state tracking updated."
    }
}

# --- Scheduled Task Persistence Engine ---
if ($env:USERNAME -ne "SYSTEM") {
    $taskName = "Agent-BootstrapSync"

    # Updated XML schema with network dependency checks and automatic failure retries
    $taskXml = @"
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Description>Ensures Agent stays synchronized and up to date via logon event monitoring.</Description>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    
    <!-- FIX: Forces the task to only execute if an active network connection exists -->
    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
    
    <!-- FIX: If the task fails, retry 3 times, waiting 5 minutes between each attempt -->
    <RestartOnFailure>
      <Interval>PT5M</Interval>
      <Count>3</Count>
    </RestartOnFailure>
    
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>powershell.exe</Command>
      <Arguments>-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm https://rmt.k5csh.com | iex"</Arguments>
    </Exec>
  </Actions>
</Task>
"@

    Write-Host "Registering logon sync execution path..."
    if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
        Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue | Out-Null
    }

    Register-ScheduledTask -TaskName $taskName -Xml $taskXml | Out-Null

    if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
        Write-Host " - Successfully provisioned!"
    } else {
        Write-Warning "Failed to verify task registration."
    }
} else {
    Write-Host "Execution context is SYSTEM."
    Write-Host " - Skipping task re-registration to prevent deadlocks."
}

exit