param (
    [string]$NodeId = "",
    [string]$AuthToken = "",
    [string]$HubUrl = "",
    [string]$GrpcUrl = "",
    [string]$SecretKey = "",
    [string]$Tls = "false",
    [switch]$RegisterService = $false,
    [switch]$ForceFirewall = $false,
    [switch]$AutoRun = $true
)

$ErrorActionPreference = "Stop"

Write-Host "==========================================" -ForegroundColor Cyan
Write-Host "   CORTEX AGENT WINDOWS BOOTSTRAP        " -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Cyan

# 1. Check Python installation (defensively avoid Microsoft Store alias)
$pythonValid = $false
$TlsBool = ($Tls -eq "true" -or $Tls -eq "1" -or $Tls -eq "True")
try {
    # Check if python is in path and not the 0-byte executable from store
    $out = python --version 2>&1
    if ($out -like "*Python *") { $pythonValid = $true }
} catch { }

if (!$pythonValid) {
    Write-Host "[!] Python not found or invalid. Installing via winget..." -ForegroundColor Yellow
    winget install -e --id Python.Python.3.12 --accept-package-agreements --accept-source-agreements
    # Refresh PATH for the current session
    $env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User")
}

# 2. Verify Python version
$pyVer = python --version
Write-Host "[*] Found $pyVer"

# 3. Create working directory
$workDir = "C:\CortexAgent"
if (!(Test-Path $workDir)) {
    New-Item -ItemType Directory -Path $workDir
}
Set-Location $workDir

# 4. Download agent code from Hub
if ((-not $HubUrl) -or (-not $AuthToken)) {
    Write-Host "[!] Hub details missing. Will prompt for them later after basic setup." -ForegroundColor Yellow
} else {
    Write-Host "[*] Fetching agent source from Hub..." -ForegroundColor Cyan
    $downloadUrl = "$HubUrl/api/v1/agent/download"

    $tarPath = Join-Path $workDir "agent.tar.gz"
    $headers = @{"X-Agent-Token" = $AuthToken}
    
    try {
        $retries = 3
        $success = $false
        for ($i=1; $i -le $retries; $i++) {
            try {
                Write-Host "[*] Fetching agent source (Attempt $i/$retries)..." -ForegroundColor Gray
                if (Get-Command curl.exe -ErrorAction SilentlyContinue) {
                    curl.exe -L -k -H "X-Agent-Token: $AuthToken" "$downloadUrl" -o "$tarPath"
                } else {
                    Invoke-WebRequest -Uri $downloadUrl -Headers $headers -OutFile $tarPath -TimeoutSec 30
                }
                if (Test-Path $tarPath) { $success = $true; break }
            } catch {
                Write-Warning "Download attempt $i failed: $_"
                Start-Sleep -Seconds 2
            }
        }
        
        if (-not $success) { throw "All download attempts failed." }
        
        Write-Host "[+] Download complete. Extracting..." -ForegroundColor Green

        
        # Windows 10+ has tar.exe built-in.
        if (Get-Command tar -ErrorAction SilentlyContinue) {
            # M7: Use a temporary directory for extraction to avoid locking issues on existing files
            $extractTmp = Join-Path $workDir "extract_tmp"
            if (!(Test-Path $extractTmp)) { New-Item -ItemType Directory -Path $extractTmp | Out-Null }
            tar -xzf $tarPath -C $extractTmp --strip-components=1
            Move-Item -Path "$extractTmp\*" -Destination $workDir -Force -ErrorAction SilentlyContinue
            Remove-Item $extractTmp -Recurse -Force
        } else {
            Write-Warning "tar.exe not found. Attempting Expand-Archive (may only support .zip)."
        }
        Remove-Item $tarPath -ErrorAction SilentlyContinue
    } catch {
        Write-Warning "Failed to download code: $_"
        Write-Host "[!] Please ensure agent-node source is manually placed at $workDir" -ForegroundColor Yellow
    }
}

# 5. Setup Virtual Environment
Write-Host "[*] Creating Virtual Environment..."
if (!(Test-Path "venv")) {
    python -m venv venv
}
$pythonExe = Join-Path $workDir "venv\Scripts\python.exe"

# 6. Install Dependencies
Write-Host "[*] Installing Dependencies (this may take a minute on some storage)..." -ForegroundColor Cyan
& $pythonExe -m pip install --upgrade pip --quiet
& $pythonExe -m pip install -r requirements.txt --no-cache-dir --quiet
# Explicitly ensure critical mesh/windows dependencies are installed properly
& $pythonExe -m pip install watchdog pywinpty pypiwin32 protobuf==5.29.1 grpcio==1.80.0 --no-cache-dir --quiet

# 7. Post-Install Sanity Check (Crucial for NFS/Slow IO)
Write-Host "[*] Verifying critical libraries..." -ForegroundColor Cyan
$sanityCmd = "import google.protobuf; import grpc; import winpty; import watchdog; print('OK')"
$sanityRes = & $pythonExe -c $sanityCmd 2>&1
if ($sanityRes -notlike "*OK*") {
    Write-Host "[!] Sanity check failed: $sanityRes" -ForegroundColor Yellow
    Write-Host "[*] Attempting targeted repair of core namespaces..." -ForegroundColor Gray
    & $pythonExe -m pip install --force-reinstall --no-cache-dir protobuf==5.29.1 grpcio==1.80.0 --quiet
} else {
    Write-Host "[+] All core libraries verified." -ForegroundColor Green
}

# 8. Environment Setup
Write-Host "------------------------------------------"
Write-Host " Enter Agent Configuration Details:"

if ([string]::IsNullOrWhiteSpace($NodeId)) { $NodeId = Read-Host " AGENT_NODE_ID (e.g. pc-node-1)" }
if ([string]::IsNullOrWhiteSpace($AuthToken)) { $AuthToken = Read-Host " AGENT_AUTH_TOKEN" }
if ([string]::IsNullOrWhiteSpace($HubUrl)) { $HubUrl = Read-Host " HUB_URL (e.g. https://ai.jerxie.com)" }
if ([string]::IsNullOrWhiteSpace($GrpcUrl)) { $GrpcUrl = Read-Host " GRPC_ENDPOINT (e.g. ai.jerxie.com:443)" }
if ([string]::IsNullOrWhiteSpace($SecretKey)) { $SecretKey = Read-Host " AGENT_SECRET_KEY (optional)" }

$envFile = @"
AGENT_NODE_ID=$NodeId
AGENT_AUTH_TOKEN=$AuthToken
AGENT_HUB_URL=$HubUrl
GRPC_ENDPOINT=$GrpcUrl
AGENT_TLS_ENABLED=$($TlsBool.ToString().ToLower())
AGENT_SECRET_KEY=$SecretKey
PYTHONUTF8=1
"@
$envFile | Out-File -FilePath ".env" -Encoding ascii

# 8. Test Execution
Write-Host "[*] Bootstrap complete." -ForegroundColor Green
if ($AutoRun) {
    Write-Host "[⚡] Auto-starting Agent..." -ForegroundColor Cyan
    $env:PYTHONUTF8 = "1"
    Start-Process -FilePath $pythonExe -ArgumentList "src\agent_node\main.py" -WorkingDirectory $workDir -WindowStyle Hidden
} else {
    Write-Host "    To run manually: .\venv\Scripts\python.exe src\agent_node\main.py" -ForegroundColor Yellow
}

# 9. Optional Service Registration
if ($RegisterService) {
    Write-Host "[*] Registering Scheduled Task..."
    & $pythonExe install_service.py --name "CortexAgent" --run
} elseif ($NodeId -eq "" -or !$NodeId) {
    # Only ask if we are in interactive mode (no NodeId provided early)
    $ans = Read-Host "Would you like to register this as a startup task? (y/n)"
    if ($ans -eq "y") {
        & $pythonExe install_service.py --name "CortexAgent" --run
    }
}

# 10. Security & Firewall Check
Write-Host "------------------------------------------"
Write-Host "[*] Checking Windows Firewall status..." -ForegroundColor Cyan
$profiles = Get-NetFirewallProfile
$disabled = $profiles | Where-Object { $_.Enabled -eq "False" }

if ($disabled) {
    if ($ForceFirewall) {
        Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
        Write-Host "[+] Windows Firewall enabled." -ForegroundColor Green
    } elseif ($NodeId -eq "" -or !$NodeId) {
        $ans = Read-Host "[!] Warning: Firewall disabled. Enable it now? (y/n)"
        if ($ans -eq "y") {
            Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
        }
    }
}

# Add rule for Python communication
Write-Host "[*] Adding firewall exception for agent communication..."
if ($pythonExe -and (Test-Path $pythonExe)) {
    New-NetFirewallRule -DisplayName "Cortex Agent Communication" -Direction Outbound -Program $pythonExe -Action Allow -Description "Allows Cortex Agent to reach the Hub" -ErrorAction SilentlyContinue
    New-NetFirewallRule -DisplayName "Cortex Agent Communication" -Direction Inbound -Program $pythonExe -Action Allow -Description "Allows Cortex Agent Mesh Communication" -Profile Any -ErrorAction SilentlyContinue
}

Write-Host "=========================================="
Write-Host "   DONE! Check the Hub for node status.  " -ForegroundColor Cyan
Write-Host "=========================================="

