setup.bat

@echo off
setlocal enabledelayedexpansion

:: ============================================================
::  HumWatch — One-Click Setup
::  Run this once on a new machine. No admin required for setup.
::  (Admin only needed at runtime for hardware sensor access.)
:: ============================================================

title HumWatch Setup
color 0E
echo.
echo   =============================================
echo    HumWatch Setup
echo    What hums beneath the shell.
echo   =============================================
echo.

:: Determine project root (where this .bat lives)
set "ROOT=%~dp0"
set "ROOT=%ROOT:~0,-1%"

:: ----- 1. Find Python -----
echo [1/6] Checking for Python...
where python3 >nul 2>&1
if %errorlevel%==0 (
    set "PY=python3"
    goto :found_python
)
where python >nul 2>&1
if %errorlevel%==0 (
    set "PY=python"
    goto :found_python
)
where py >nul 2>&1
if %errorlevel%==0 (
    set "PY=py -3"
    goto :found_python
)

echo.
echo   [ERROR] Python not found!
echo   Install Python 3.10+ from https://python.org
echo   Make sure "Add to PATH" is checked during install.
echo.
pause
exit /b 1

:found_python
for /f "tokens=*" %%i in ('%PY% --version 2^>^&1') do set "PY_VER=%%i"
echo   Found: %PY_VER%

:: ----- 2. Create virtual environment -----
echo.
echo [2/6] Setting up virtual environment...
if exist "%ROOT%\venv\Scripts\activate.bat" (
    echo   venv already exists, skipping creation.
) else (
    %PY% -m venv "%ROOT%\venv"
    if %errorlevel% neq 0 (
        echo   [ERROR] Failed to create venv. Make sure python3-venv is installed.
        pause
        exit /b 1
    )
    echo   Created venv/
)

:: Activate venv
call "%ROOT%\venv\Scripts\activate.bat"

:: ----- 3. Install hash locked dependencies -----
echo.
echo [3/6] Installing Python dependencies...
"%ROOT%\venv\Scripts\python.exe" -m pip install --require-hashes --disable-pip-version-check --no-input -r "%ROOT%\requirements.txt"
if errorlevel 1 (
    echo.
    echo   [ERROR] Hash locked dependency installation failed. Setup stopped.
    echo.
    pause
    exit /b 1
)

:: ----- 4. Download LibreHardwareMonitor DLLs -----
echo.
echo [4/6] Downloading and verifying LibreHardwareMonitor...
set "HUMWATCH_SETUP_ROOT=%ROOT%"
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
    "$ErrorActionPreference='Stop'; Set-StrictMode -Version Latest; " ^
    "$root=$env:HUMWATCH_SETUP_ROOT; $verify=Join-Path $root 'scripts\verify-downloads.ps1'; $manifest=Join-Path $root 'scripts\asset-versions.ps1'; $lib=Join-Path $root 'lib'; " ^
    "$zip=Join-Path $env:TEMP 'humwatch-lhm.zip'; $ext=Join-Path $env:TEMP 'humwatch-lhm-extract'; " ^
    "try { " ^
    "  $primary=Join-Path $lib 'LibreHardwareMonitorLib.dll'; $hid=Join-Path $lib 'HidSharp.dll'; " ^
    "  if (Test-Path -LiteralPath $primary -PathType Leaf) { " ^
    "    if (-not (Test-Path -LiteralPath $hid -PathType Leaf)) { throw 'Existing LHM installation is incomplete' }; " ^
    "    & $verify -Manifest $manifest -AssetName 'lhm-lib' -Path $primary; if ($LASTEXITCODE -ne 0) { throw 'Existing LibreHardwareMonitorLib.dll failed verification' }; " ^
    "    & $verify -Manifest $manifest -AssetName 'lhm-hidsharp' -Path $hid; if ($LASTEXITCODE -ne 0) { throw 'Existing HidSharp.dll failed verification' }; " ^
    "    Write-Host '  Existing LHM files verified.'; " ^
    "  } else { " ^
    "    . $manifest; $assets=@($AssetManifest | Where-Object { $_.Name -eq 'lhm' }); if ($assets.Count -ne 1) { throw 'The LHM asset manifest entry is not unique' }; $asset=$assets[0]; " ^
    "    Invoke-WebRequest -Uri $asset.Url -OutFile $zip -UseBasicParsing -TimeoutSec 60; " ^
    "    & $verify -Manifest $manifest -AssetName 'lhm' -Path $zip; if ($LASTEXITCODE -ne 0) { throw 'The LHM archive failed verification' }; " ^
    "    if (Test-Path -LiteralPath $ext) { Remove-Item -LiteralPath $ext -Recurse -Force }; Expand-Archive -LiteralPath $zip -DestinationPath $ext -Force; " ^
    "    $lhmFile=Get-ChildItem -LiteralPath $ext -Recurse -Filter 'LibreHardwareMonitorLib.dll' | Select-Object -First 1; $hidFile=Get-ChildItem -LiteralPath $ext -Recurse -Filter 'HidSharp.dll' | Select-Object -First 1; " ^
    "    if (-not $lhmFile -or -not $hidFile) { throw 'The verified LHM archive is missing required DLLs' }; " ^
    "    & $verify -Manifest $manifest -AssetName 'lhm-lib' -Path $lhmFile.FullName; if ($LASTEXITCODE -ne 0) { throw 'LibreHardwareMonitorLib.dll failed verification' }; " ^
    "    & $verify -Manifest $manifest -AssetName 'lhm-hidsharp' -Path $hidFile.FullName; if ($LASTEXITCODE -ne 0) { throw 'HidSharp.dll failed verification' }; " ^
    "    New-Item -ItemType Directory -Path $lib -Force | Out-Null; Copy-Item -LiteralPath $lhmFile.FullName -Destination $primary -Force; Copy-Item -LiteralPath $hidFile.FullName -Destination $hid -Force; " ^
    "    Write-Host '  LHM files downloaded, verified, and installed.'; " ^
    "  } " ^
    "} catch { Write-Host '  [ERROR] LibreHardwareMonitor verification failed. Setup stopped.' -ForegroundColor Red; exit 1 } finally { " ^
    "  Remove-Item -LiteralPath $zip,$ext -Recurse -Force -ErrorAction SilentlyContinue " ^
    "}"
set "LHM_VERIFY_EXIT=%errorlevel%"
set "HUMWATCH_SETUP_ROOT="
if not "%LHM_VERIFY_EXIT%"=="0" (
    echo.
    echo   [ERROR] LibreHardwareMonitor was not installed after verified checks.
    pause
    exit /b 1
)

:: ----- 5. Verify installation -----
echo.
echo [5/6] Verifying installation...
echo.
python -m agent.verify
set "VERIFY_EXIT=%errorlevel%"
echo.

if %VERIFY_EXIT% equ 2 (
    color 0C
    echo   [!] Verification found ERRORS — see above.
    echo   Fix the issues before running HumWatch.
) else if %VERIFY_EXIT% equ 1 (
    color 0E
    echo   [i] Verification passed with warnings.
    echo   HumWatch will run, but some features may be limited.
) else (
    color 0A
    echo   [+] All checks passed.
)
echo.

:: ----- 6. Background service -----
echo.
echo   =============================================
echo   [6/6] Windows Background Service
echo   =============================================
echo.
echo   HumWatch can run as a Windows service that:
echo     - Starts automatically on every reboot
echo     - Runs silently in the background (no window)
echo     - Auto-restarts if it crashes
echo.
set /p INSTALL_SVC="   Install as a background service? (Y/n): "
if /i "%INSTALL_SVC%"=="n" goto :skip_service
if /i "%INSTALL_SVC%"=="no" goto :skip_service

:: Need admin for hardened service provisioning — auto-elevate
echo.
echo   [*] Installing background service (needs admin)...
echo   A UAC prompt may appear — click Yes to allow.
echo.
if not exist "%ROOT%\venv\Scripts\python.exe" (
    echo.
    echo   [ERROR] Source Python runtime not found. Run setup again before service provisioning.
    echo.
    pause
    exit /b 1
)
if not exist "%ROOT%\tools\nssm.exe" (
    echo.
    echo   [ERROR] NSSM is required for source installs. Place nssm.exe in tools before service provisioning.
    echo.
    pause
    exit /b 1
)
echo   [*] Provisioning protected runtime state and service paths...
set "HUMWATCH_SETUP_ROOT=%ROOT%"
powershell -NoProfile -Command "$hardenerArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', ('\"{0}\"' -f (Join-Path $env:HUMWATCH_SETUP_ROOT 'installer\service-setup.ps1')), '-Action', 'install', '-AppDir', ('\"{0}\"' -f $env:HUMWATCH_SETUP_ROOT), '-NssmPath', ('\"{0}\"' -f (Join-Path $env:HUMWATCH_SETUP_ROOT 'tools\nssm.exe')), '-PythonPath', ('\"{0}\"' -f (Join-Path $env:HUMWATCH_SETUP_ROOT 'venv\Scripts\python.exe')), '-ProvisioningScript', ('\"{0}\"' -f (Join-Path $env:HUMWATCH_SETUP_ROOT 'scripts\provision-security.ps1')), '-FirewallPort', '9100', '-FirewallProfiles', 'Domain,Private', '-FullSensorMode'); $hardener = Start-Process -FilePath powershell.exe -Verb RunAs -PassThru -ArgumentList $hardenerArgs; $hardener.WaitForExit(); exit $hardener.ExitCode"
set "HARDENER_EXIT=%errorlevel%"
set "HUMWATCH_SETUP_ROOT="
if not "%HARDENER_EXIT%"=="0" (
    echo.
    echo   [ERROR] Protected service provisioning failed. The service was not left configured for production use.
    echo.
    pause
    exit /b 1
)
goto :done

:skip_service
echo.
echo   Skipped service install. To run manually:
echo.
echo     run.bat              (as Administrator for full sensors)
echo     run-no-admin.bat     (without admin, psutil-only)
echo.
echo   To install as a service later:
echo     Run setup.bat, with tools\nssm.exe present, and choose the service option.
echo.

:done
echo.
echo   =============================================
echo    Setup Complete!
echo    Dashboard: https://localhost:9100
echo    Trust the HumWatch certificate before remote access.
echo   =============================================
echo.
pause