bridgerator 1.0.8 → 1.1.1

package/install.ps1

@@ -1,107 +1,507 @@
 # Bridgerator installer for Windows (PowerShell 5.1+). Source: npm package "bridgerator" (https://www.npmjs.com/package/bridgerator)
 # Usage (one line, from your Bridgerator account page):
 #   & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1)))
-# A browser tab opens: sign in and confirm this computer — no key to paste. Run again to update
+# A browser tab opens: sign in and confirm this computer - no key to paste. Run again to update
 # (keeps the key and folders). Servers / headless PCs: add -Token <device key> from the account page.
-# What it does: installs Node.js LTS if missing (portable zip, no admin), installs the bridgerator npm package,
-# then runs `bridgerator.cmd setup` (pairing in the browser if there is no key yet, config + hidden autostart
-# at logon for THIS user, no admin rights),
+# What it does: downloads the signed Bridgerator app for Windows (bridgerator.exe + its files, no Node.js
+# needed) from bridgerator.recondeck.com, checks it (SHA256 from the download list, every file), puts it
+# into %LOCALAPPDATA%\Bridgerator\app, then runs `bridgerator.exe setup` (pairing in the browser if there
+# is no key yet, config + hidden autostart at logon for THIS user, no admin rights),
 # then opens the welcome page in the default browser (skip with -NoBrowser).
+# An older Bridgerator (npm package, 1.0.x) is replaced; its key and settings are kept.
+# -UseNpm: the npm package instead (installs Node.js 24 LTS if there is no Node.js 22+ - portable zip, no
+# admin - then the bridgerator package, SHA256-checked, no install scripts).
+# -NoTelemetry: no anonymous usage counts (see https://bridgerator.recondeck.com/privacy).
+# Works under the default Restricted execution policy: only built-in cmdlets and .NET are used.
 param(
   [string]$Token,
-  [string]$Package = 'https://bridgerator.recondeck.com/bridgerator.tgz',
+  [string]$Package,
+  [string]$Sha256,
+  [string]$AppZip,
   [string[]]$Allow,
   [string[]]$Deny,
-  [switch]$NoBrowser
+  [switch]$UseNpm,
+  [switch]$NoBrowser,
+  [switch]$NoTelemetry
 )
 $ErrorActionPreference = 'Stop'
-$paired = $Token -or (Test-Path (Join-Path $env:APPDATA 'Bridgerator\config.json'))
+# SHA256 of the bridgerator.tgz published next to this script (written by release.sh).
+$PackageSha256 = '990b1a9754310fcf75530ac6365f149843037adcff88cf7e33b4bed7e03ce211'
+# SHA256 of bridgerator-win.json, the Windows app download list published next to this script
+# (written by scripts/build-exe.mjs / release.sh). It names the zip per architecture and its SHA256.
+$WinManifestSha256 = '5ba96127dc260e8469a0cf2432a11963c11b96417131432e563fa56092cc949d'
+$Site = 'https://bridgerator.recondeck.com'
+# The npm package comes from the same site as this script (a staging copy rewrites only $Site / $Relay).
+$DefaultPackage = "$Site/bridgerator.tgz"
+if (-not $Package) { $Package = $DefaultPackage }
+# Relay for setup: always the relay of the site this script came from, so a PC paired elsewhere (staging)
+# moves here (its old key is rejected -> pairing again). A staging build rewrites both lines.
+$Relay = 'wss://mcp.bridgerator.recondeck.com/link'
+$Root = Join-Path $env:LOCALAPPDATA 'Bridgerator'
+$AppDir = Join-Path $Root 'app'
+$NpmPkg = Join-Path $env:APPDATA 'npm\node_modules\bridgerator'
+# The npm package: asked for (-UseNpm), or a package given (-Package <tgz>, as before 1.0.9).
+$npmMode = [bool]$UseNpm -or $PSBoundParameters.ContainsKey('Package')
+$firstInstall = -not (Test-Path (Join-Path $env:APPDATA 'Bridgerator\config.json'))
+$paired = $Token -or -not $firstInstall
+# All temporary files go here, never to %TEMP%: on a Cyrillic & co. user name %TEMP% is an 8.3 short
+# path (C:\Users\3C8A~1\...) that Move-Item / Remove-Item can't handle. Removed in the end, always.
+$Work = Join-Path $env:LOCALAPPDATA "Bridgerator\tmp-$([guid]::NewGuid().ToString('N'))"
+function Remove-Work { try { if ([IO.Directory]::Exists($Work)) { [IO.Directory]::Delete($Work, $true) } } catch {} }
+$NpmFlags = @('--no-audit', '--no-fund', '--update-notifier=false', '--loglevel=error')
+$Sys32 = Join-Path $env:SystemRoot 'System32'
 
-# Private Node.js (portable zip) used when there is none or it is older than 20; it goes FIRST on
-# the PATH so an old system Node does not shadow it.
+# Private Node.js (portable zip) used when there is no Node.js 22+; it goes FIRST on the PATH so an
+# old system Node does not shadow it.
 $NodeDir = Join-Path $env:LOCALAPPDATA 'Bridgerator\node'
 function Refresh-Path {
   $first = if (Test-Path (Join-Path $NodeDir 'node.exe')) { $NodeDir }
   $env:Path = (@($first, [Environment]::GetEnvironmentVariable('Path', 'Machine'), [Environment]::GetEnvironmentVariable('Path', 'User')) | Where-Object { $_ }) -join ';'
 }
+# Where a 1.0.x npm package can be: npm's usual global folder, or the installer's private Node.js (its
+# global folder is the Node folder itself). -> the package folders that exist.
+function Get-NpmBridges { @($NpmPkg, (Join-Path $NodeDir 'node_modules\bridgerator')) | Where-Object { [IO.File]::Exists((Join-Path $_ 'package.json')) } }
+# One spelling per folder: full path, / -> \, no trailing \ (except a drive root: C:\), 8.3 short parts (C:\Users\3C8A~1) made long.
+# npm's prefix and %APPDATA% can name the same folder differently; compared case-insensitively (Test-SamePath).
+function Get-LongPath([string]$p) {
+  $p = [IO.Path]::GetFullPath($p.Replace('/', '\')).TrimEnd('\')
+  if ($p -match '^[A-Za-z]:$') { $p += '\' } # a drive root keeps its \ (C: alone = that drive's current folder)
+  $parent = [IO.Path]::GetDirectoryName($p)
+  if (-not $parent -or -not $p.Contains('~')) { return $p }
+  $base = Get-LongPath $parent; $leaf = [IO.Path]::GetFileName($p)
+  # The file system answers a short name with the long one.
+  try { $hit = @([IO.Directory]::GetFileSystemEntries($base, $leaf)); if ($hit.Count -eq 1) { return $hit[0].TrimEnd('\') } } catch {}
+  return (Join-Path $base $leaf)
+}
+function Test-SamePath([string]$a, [string]$b) { $a -and $b -and [string]::Equals((Get-LongPath $a), (Get-LongPath $b), [StringComparison]::OrdinalIgnoreCase) }
+function Test-InFolder([string]$p, [string]$dir) { if (-not $p) { return $false }; $l = Get-LongPath $p; $d = Get-LongPath $dir; [string]::Equals($l, $d, [StringComparison]::OrdinalIgnoreCase) -or $l.StartsWith($d.TrimEnd('\') + '\', [StringComparison]::OrdinalIgnoreCase) }
+
+# User PATH through the registry: keeps it REG_EXPAND_SZ with %VARS% unexpanded.
+function Add-UserPath([string]$dir, [switch]$First) {
+  $k = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
+  $userPath = [string]$k.GetValue('Path', '', 'DoNotExpandEnvironmentNames')
+  $parts = @($userPath -split ';' | Where-Object { $_ })
+  $key = $dir.TrimEnd('\')
+  $keys = @($parts | ForEach-Object { [Environment]::ExpandEnvironmentVariables($_).TrimEnd('\') })
+  # -First: also moves an entry that is already there to the front (an older bridgerator.cmd must not shadow it).
+  if ($keys -notcontains $key -or ($First -and $keys[0] -ne $key)) {
+    $rest = @(for ($i = 0; $i -lt $parts.Count; $i++) { if ($keys[$i] -ne $key) { $parts[$i] } })
+    $new = if ($First) { @($dir) + $rest } else { $rest + @($dir) }
+    $k.SetValue('Path', ($new -join ';'), [Microsoft.Win32.RegistryValueKind]::ExpandString)
+    # Tell Explorer the environment changed (new windows see the new PATH).
+    [Environment]::SetEnvironmentVariable('BRIDGERATOR_PATH_REFRESH', '1', 'User'); [Environment]::SetEnvironmentVariable('BRIDGERATOR_PATH_REFRESH', $null, 'User')
+  }
+  $k.Close()
+}
+
+function Get-Sha256([string]$file) {
+  $f = [IO.File]::OpenRead($file)
+  try { -join ([Security.Cryptography.SHA256]::Create().ComputeHash($f) | ForEach-Object { $_.ToString('x2') }) } finally { $f.Close() }
+}
+
+# Same matcher as `bridgerator.cmd stop` (src/cli.mjs stopPs) - for versions that don't have `stop` yet:
+# this Windows session only; the autostart loop first, then node/bridgerator/rg running from the package
+# folder. $pkg = the package folder (npm: ...\node_modules\bridgerator; app: %LOCALAPPDATA%\Bridgerator\app),
+# $cmd = what runs its `stop` (bridgerator.cmd / bridgerator.exe).
+function Stop-Bridge([string]$pkgDir, [string]$cmd) {
+  $cli = Join-Path $pkgDir 'src\cli.mjs'
+  # Its own `stop` first; if that fails (e.g. node.exe of an npm install not found), the matcher below.
+  if ((Test-Path $cli) -and (Test-Path $cmd) -and ((Get-Content $cli -Raw) -match "cmd === 'stop'")) { & $cmd stop | Out-Null; if ($LASTEXITCODE -eq 0) { Stop-OurWebView; return } }
+  $me = (Get-Process -Id $PID).SessionId
+  $pkg = $pkgDir.ToLower().TrimEnd('\') + '\'
+  $vbs = (Join-Path $env:APPDATA 'Bridgerator\run-hidden.vbs').ToLower()
+  $all = @(Get-CimInstance Win32_Process -Filter "Name='wscript.exe' OR Name='node.exe' OR Name='bridgerator.exe' OR Name='rg.exe' OR Name='powershell.exe'" -ErrorAction SilentlyContinue |
+    Where-Object { $s = ("$($_.CommandLine) $($_.ExecutablePath)").ToLower().Replace('/', '\'); $_.SessionId -eq $me -and $_.ProcessId -ne $PID -and ($s.Contains($pkg) -or $s.Contains($vbs)) } |
+    Sort-Object { $_.Name -ne 'wscript.exe' })
+  $all | Where-Object { $_.Name -ne 'powershell.exe' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+  # The tray helper removes its icon itself once the bridge is gone (a kill leaves a ghost icon): 2 s, then the kill.
+  $tray = @($all | Where-Object { $_.Name -eq 'powershell.exe' }); $end = (Get-Date).AddSeconds(2)
+  while ($tray.Count -and (Get-Date) -lt $end -and @($tray | Where-Object { Get-Process -Id $_.ProcessId -ErrorAction SilentlyContinue }).Count) { Start-Sleep -Milliseconds 200 }
+  $tray | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+  Stop-OurWebView
+}
+# The old window's WebView2 processes (msedgewebview2.exe with our user data folder, this session): an
+# older `stop` leaves them running (V-8).
+function Stop-OurWebView {
+  $me = (Get-Process -Id $PID).SessionId
+  $wvd = ('--user-data-dir=' + (Join-Path $env:LOCALAPPDATA 'Bridgerator\webview')).ToLower()
+  $wv = @(Get-CimInstance Win32_Process -Filter "Name='msedgewebview2.exe'" -ErrorAction SilentlyContinue | Where-Object { $_.SessionId -eq $me }); $ids = @($wv | Where-Object { "$($_.CommandLine)".ToLower().Replace('"', '').Contains($wvd) } | ForEach-Object { $_.ProcessId })
+  $wv | Where-Object { $ids -contains $_.ProcessId -or $ids -contains $_.ParentProcessId } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+}
+
+# Back to the bridge that ran before (an update that failed must not leave the PC unreachable).
+function Start-OldBridge {
+  $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+  foreach ($n in @("Bridgerator-$sid", 'Bridgerator')) { & (Join-Path $Sys32 'schtasks.exe') /Run /TN $n 2>$null | Out-Null; if ($LASTEXITCODE -eq 0) { return } }
+}
 
 $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
-if ($admin) { Write-Warning "This window runs as Administrator. Bridgerator is installed for THIS Windows user only ($env:USERNAME), with this user's rights. To use it as another user, run the install command in that user's normal (not Administrator) PowerShell." }
+# Bridgerator runs with the rights of the signed-in user, never as Administrator.
+if ($admin) { Write-Host 'Run this in a normal (non-admin) PowerShell window: this one runs as Administrator.' -ForegroundColor Yellow; return }
 
 [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 $ProgressPreference = 'SilentlyContinue'
 
-# No winget on many clean Windows installs: take the official Node.js LTS zip into the user's
+# No winget on many clean Windows installs: take the official Node.js 24 LTS zip into the user's
 # profile (no admin rights), checked against nodejs.org SHASUMS256, and put it on the user PATH.
 function Install-PortableNode {
   $dir = $NodeDir
   $arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }
-  $rel = (Invoke-RestMethod 'https://nodejs.org/dist/index.json') | Where-Object { $_.lts -and ($_.files -contains "win-$arch-zip") } | Select-Object -First 1
-  if (-not $rel) { throw 'Could not find a Node.js LTS build. Install Node.js 20+ from https://nodejs.org and run this again.' }
+  $rel = (Invoke-RestMethod 'https://nodejs.org/dist/index.json') | Where-Object { $_.lts -and $_.version -like 'v24.*' -and ($_.files -contains "win-$arch-zip") } | Select-Object -First 1
+  if (-not $rel) { throw 'Could not find a Node.js 24 LTS build. Install Node.js 22+ from https://nodejs.org and run this again.' }
   $name = "node-$($rel.version)-win-$arch"
-  Write-Host "Node.js not found - downloading Node.js $($rel.version) into $dir ..."
-  $tmp = Join-Path $env:TEMP "bridgerator-$([guid]::NewGuid().ToString('N'))"
-  New-Item -ItemType Directory -Path $tmp | Out-Null
+  Write-Host "Downloading Node.js $($rel.version) for Bridgerator into $dir ..."
+  $tmp = Join-Path $Work 'node'
+  [void][IO.Directory]::CreateDirectory($tmp)
   try {
     $zip = Join-Path $tmp "$name.zip"
     Invoke-WebRequest "https://nodejs.org/dist/$($rel.version)/$name.zip" -OutFile $zip -UseBasicParsing
     $sums = (Invoke-WebRequest "https://nodejs.org/dist/$($rel.version)/SHASUMS256.txt" -UseBasicParsing).Content
     $want = ($sums -split "`n" | Where-Object { $_ -match "\s$name\.zip$" }) -replace '\s.*$', ''
-    $got = (Get-FileHash $zip -Algorithm SHA256).Hash
-    if (-not $want -or $got -ne $want.Trim().ToUpper()) { throw 'Node.js download failed the checksum check.' }
+    if (-not $want -or (Get-Sha256 $zip) -ne $want.Trim().ToLower()) { throw 'Node.js download failed the checksum check.' }
     Write-Host 'Node.js checksum OK (SHA256, nodejs.org)'
-    Expand-Archive $zip -DestinationPath $tmp -Force
-    if (Test-Path $dir) { Remove-Item $dir -Recurse -Force }
-    New-Item -ItemType Directory -Path (Split-Path $dir) -Force | Out-Null
-    Move-Item (Join-Path $tmp $name) $dir
-  } finally { Remove-Item $tmp -Recurse -Force -ErrorAction SilentlyContinue }
-  # User PATH through the registry: keeps it REG_EXPAND_SZ with %VARS% unexpanded.
-  $k = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
-  $userPath = [string]$k.GetValue('Path', '', 'DoNotExpandEnvironmentNames')
-  if (($userPath -split ';') -notcontains $dir) { $k.SetValue('Path', ((@($dir) + ($userPath -split ';')) | Where-Object { $_ }) -join ';', [Microsoft.Win32.RegistryValueKind]::ExpandString) }
-  $k.Close()
-  # Tell Explorer the environment changed (new windows see the new PATH).
-  [Environment]::SetEnvironmentVariable('BRIDGERATOR_PATH_REFRESH', '1', 'User'); [Environment]::SetEnvironmentVariable('BRIDGERATOR_PATH_REFRESH', $null, 'User')
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    [IO.Compression.ZipFile]::ExtractToDirectory($zip, $tmp)
+    # Everything running from the Node folder (the old bridge, its engine child) holds node.exe: matched by the folder itself.
+    if ([IO.Directory]::Exists($dir)) { Stop-Bridge $dir (Join-Path $dir 'bridgerator.cmd'); [IO.Directory]::Delete($dir, $true) }
+    [void][IO.Directory]::CreateDirectory((Split-Path $dir))
+    [IO.Directory]::Move((Join-Path $tmp $name), $dir)
+  } finally { try { [IO.Directory]::Delete($tmp, $true) } catch {} }
+  # npm's cache of this private Node.js: removed by `bridgerator.cmd uninstall --all` only if we created it.
+  $cache = Join-Path $env:LOCALAPPDATA 'npm-cache'
+  if (-not (Test-Path $cache)) { Set-Content -Path (Join-Path $env:LOCALAPPDATA 'Bridgerator\created-npm-cache') -Value $cache }
+  Add-UserPath $dir -First
   Refresh-Path
 }
 
-# A running bridge (and its engine / ripgrep children, the hidden autostart loop) locks the package
-# and the private Node.js files: stop them before updating.
-Get-CimInstance Win32_Process -Filter "Name='wscript.exe' OR Name='node.exe' OR Name='rg.exe'" -ErrorAction SilentlyContinue |
-  Where-Object { $s = "$($_.CommandLine) $($_.ExecutablePath)".Replace('/', '\'); $s -like '*\node_modules\bridgerator\*' -or $s -like '*\Bridgerator\run-hidden.vbs*' } |
-  Sort-Object { $_.Name -ne 'wscript.exe' } |
-  ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+# ---- The Windows app (default): bridgerator.exe + its files, no Node.js. LOGIC: critical-logic/install-release.md
+function Remove-UserPath([string]$dir) {
+  $k = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment', $true)
+  if (-not $k) { return }
+  try {
+    if ($null -ne $k.GetValue('Path')) {
+      $kind = $k.GetValueKind('Path'); $old = [string]$k.GetValue('Path', '', 'DoNotExpandEnvironmentNames')
+      $new = ($old -split ';' | Where-Object { $_ -and [Environment]::ExpandEnvironmentVariables($_).TrimEnd('\') -ne $dir.TrimEnd('\') }) -join ';'
+      if ($new -ne $old) { $k.SetValue('Path', $new, $kind) }
+    }
+  } finally { $k.Close() }
+}
+
+# An antivirus scan or the search indexer can hold a file for a moment.
+function Move-Dir([string]$from, [string]$to) {
+  for ($i = 1; ; $i++) { try { [IO.Directory]::Move($from, $to); return } catch { if ($i -ge 10) { throw }; Start-Sleep -Milliseconds 500 } }
+}
+function Remove-Dir([string]$dir) {
+  for ($i = 1; ; $i++) { try { if ([IO.Directory]::Exists($dir)) { [IO.Directory]::Delete($dir, $true) }; return } catch { if ($i -ge 10) { throw }; Start-Sleep -Milliseconds 500 } }
+}
+
+function Get-Arch {
+  $a = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
+  if ($a -eq 'ARM64') { 'arm64' } elseif ($a -eq 'AMD64') { 'x64' } else { $null }
+}
+
+# bridgerator-win.json (its own SHA256 already checked) -> the zip for this architecture.
+function Read-AppManifest([string]$file, [string]$arch) {
+  $m = [IO.File]::ReadAllText($file, [Text.Encoding]::UTF8) | ConvertFrom-Json
+  $e = $m.$arch
+  if (-not $e -or [string]$e.file -notmatch "^bridgerator-[0-9]+\.[0-9]+\.[0-9]+-win-$arch\.zip$" -or [string]$e.sha256 -notmatch '^[0-9a-f]{64}$' -or [string]$m.version -notmatch '^[0-9]+\.[0-9]+\.[0-9]+$') { throw "The Bridgerator download list has no build for this PC ($arch)." }
+  @{ file = [string]$e.file; sha256 = [string]$e.sha256; version = [string]$m.version; size = [long]$e.size }
+}
+
+# The unpacked app: every file of its SHA256SUMS.txt must match (an antivirus that removed or changed a
+# file shows here), then the new bridgerator.exe must start and name its version - all before the
+# running Bridgerator is touched.
+function Test-App([string]$dir, [string]$version) {
+  $sums = Join-Path $dir 'SHA256SUMS.txt'
+  if (-not [IO.File]::Exists($sums)) { throw 'The Bridgerator download is incomplete (no SHA256SUMS.txt).' }
+  $sha = [Security.Cryptography.SHA256]::Create(); $n = 0; $top = @{}
+  foreach ($line in [IO.File]::ReadAllLines($sums)) {
+    if (-not $line) { continue }
+    if ($line -notmatch '^([0-9a-f]{64}) \*([^:*?"<>|]+)$') { throw 'The Bridgerator file list is damaged.' }
+    $want = $Matches[1]; $rel = $Matches[2]
+    if ($rel.StartsWith('/') -or ($rel -split '/') -contains '..') { throw 'The Bridgerator file list is damaged.' }
+    $f = Join-Path $dir ($rel -replace '/', '\')
+    $h = $null
+    if ([IO.File]::Exists($f)) { $s = [IO.File]::OpenRead($f); try { $h = [BitConverter]::ToString($sha.ComputeHash($s)).Replace('-', '').ToLower() } finally { $s.Close() } }
+    if ($h -ne $want) { throw "A Bridgerator file failed the checksum check: $rel (an antivirus may have removed it)." }
+    if ($rel -notmatch '/') { $top[$rel] = $true }
+    $n++
+  }
+  # The folder goes FIRST on the user PATH: only listed files in its root (nothing extra can shadow a command).
+  foreach ($f in [IO.Directory]::GetFiles($dir)) { $nm = [IO.Path]::GetFileName($f); if ($nm -ne 'SHA256SUMS.txt' -and -not $top.ContainsKey($nm)) { throw "The Bridgerator download has an unexpected file: $nm." } }
+  if ($n -lt 100 -or -not [IO.File]::Exists((Join-Path $dir 'bridgerator.exe'))) { throw 'The Bridgerator download is incomplete.' }
+  $v = (& (Join-Path $dir 'bridgerator.exe') --version | Out-String).Trim()
+  if ($LASTEXITCODE -ne 0 -or -not $v -or ($version -and $v -ne $version)) { throw "The new Bridgerator did not start (answer: '$v'). An antivirus may block it - try again later, or run this command with -UseNpm." }
+  return $v
+}
+
+# Download + checks -> the checked app folder inside the work folder. Custom -AppZip (https or a local
+# file) only with its -Sha256; the default one by the download list whose SHA256 this script carries.
+function Get-App {
+  if ($AppZip) {
+    $want = $Sha256.Trim().ToLower(); $version = $null; $src = $AppZip
+  } else {
+    $mf = Join-Path $Work 'bridgerator-win.json'
+    Invoke-WebRequest "$Site/bridgerator-win.json" -OutFile $mf -UseBasicParsing
+    if ((Get-Sha256 $mf) -ne $WinManifestSha256) { throw 'The Bridgerator download list failed the checksum check - try again in a minute.' }
+    $arch = Get-Arch
+    $m = Read-AppManifest $mf $arch
+    $want = $m.sha256; $version = $m.version; $src = "$Site/$($m.file)"
+    Write-Host "Downloading Bridgerator $version for Windows ($arch, $([math]::Round($m.size / 1MB)) MB)..."
+  }
+  $zip = $src
+  if ($src -match '^https://') { $zip = Join-Path $Work 'app.zip'; Invoke-WebRequest $src -OutFile $zip -UseBasicParsing }
+  if ((Get-Sha256 $zip) -ne $want) { throw 'The Bridgerator download failed the checksum check - try again in a minute.' }
+  Write-Host 'Download checksum OK (SHA256). Unpacking and checking the files...'
+  $dir = Join-Path $Work 'app'
+  Add-Type -AssemblyName System.IO.Compression.FileSystem
+  [IO.Compression.ZipFile]::ExtractToDirectory($zip, $dir)
+  if ($zip -ne $src) { [IO.File]::Delete($zip) }
+  $v = Test-App $dir $version
+  Write-Host "Bridgerator $v checked."
+  return $dir
+}
+
+# Stops whatever Bridgerator runs (this app, or the npm package of 1.0.x) and puts the checked app in
+# place; the previous app folder stays as app.old-<guid> until the new one is set up. -> that folder or $null.
+function Switch-App([string]$new) {
+  $old = $null
+  try {
+    if ([IO.File]::Exists((Join-Path $AppDir 'bridgerator.exe'))) { Stop-Bridge $AppDir (Join-Path $AppDir 'bridgerator.exe') }
+    foreach ($p in Get-NpmBridges) { Stop-Bridge $p (Join-Path (Split-Path (Split-Path $p)) 'bridgerator.cmd') }
+    if ([IO.Directory]::Exists($AppDir)) { $o = Join-Path $Root "app.old-$([guid]::NewGuid().ToString('N'))"; Move-Dir $AppDir $o; $old = $o }
+  } catch { Start-OldBridge; throw }
+  try { Move-Dir $new $AppDir } catch { if ($old) { try { Move-Dir $old $AppDir } catch {} }; Start-OldBridge; throw }
+  return $old
+}
+
+# The npm package of Bridgerator 1.0.x after the move to the app (its key and settings stay in
+# %APPDATA%\Bridgerator), and the private Node.js its installer added (same rules as uninstall --all).
+function Remove-NpmBridge([string[]]$keep = @()) {
+  foreach ($p in Get-NpmBridges) {
+    # The package this run installed is never removed, however npm spells its folder.
+    if (@($keep | Where-Object { Test-SamePath $_ $p }).Count) { continue }
+    $npmDir = Split-Path (Split-Path $p)
+    try {
+      Remove-Dir $p
+      foreach ($n in 'bridgerator', 'bridgerator.cmd', 'bridgerator.ps1') { $f = Join-Path $npmDir $n; if ([IO.File]::Exists($f)) { [IO.File]::Delete($f) } }
+      Write-Host 'Removed the old Bridgerator npm package (key and settings kept).'
+    } catch { Write-Host "Could not remove the old Bridgerator npm package $p ($_) - it is not used any more." }
+  }
+  if (-not @($keep | Where-Object { Test-InFolder $_ $NodeDir }).Count) { Remove-PrivateNode }
+}
+
+# The private Node.js of an installer (folder, its PATH entry, npm's cache when we created it - marker file).
+function Remove-PrivateNode {
+  # Other global npm packages installed with it (not npm / corepack / Bridgerator): the folder stays.
+  $mods = Join-Path $NodeDir 'node_modules'
+  $foreign = @(if ([IO.Directory]::Exists($mods)) { [IO.Directory]::GetDirectories($mods) | ForEach-Object { [IO.Path]::GetFileName($_) } | Where-Object { @('npm', 'corepack', 'bridgerator', '.bin') -notcontains $_ } })
+  if ($foreign.Count) { Write-Host "Kept the Node.js the installer added ($NodeDir): other programs use it ($($foreign -join ', '))." }
+  elseif ([IO.Directory]::Exists($NodeDir)) {
+    try { Remove-UserPath $NodeDir; Remove-Dir $NodeDir; Write-Host "Removed the Node.js the installer added ($NodeDir)." } catch { Write-Host "Could not remove $NodeDir ($_) - it is not used any more." }
+  }
+  $marker = Join-Path $Root 'created-npm-cache'
+  if ([IO.File]::Exists($marker)) {
+    $c = ([IO.File]::ReadAllText($marker)).Trim()
+    if ($c -and $c.TrimEnd('\') -eq (Join-Path $env:LOCALAPPDATA 'npm-cache')) { try { Remove-Dir $c } catch { Write-Host "Could not remove npm's cache $c ($_)." } }
+    [IO.File]::Delete($marker)
+  }
+}
+
+# After `bridgerator.exe setup`: 0 = done (the old folder goes; the npm package of 1.0.x too); 3 = a clear
+# stop before anything changed (pairing code expired): the new app stays, the old link runs again; any
+# other failure puts the previous app folder back and starts it.
+function Complete-App([int]$rc, $old, [bool]$fromNpm) {
+  if ($rc -ne 0 -and $rc -ne 3) {
+    if ($old) {
+      try { Stop-Bridge $AppDir (Join-Path $AppDir 'bridgerator.exe'); Remove-Dir $AppDir; Move-Dir $old $AppDir } catch { Write-Host "Could not put the previous Bridgerator back ($_) - run this command again." }
+    }
+    Start-OldBridge; return
+  }
+  if ($old) { try { Remove-Dir $old } catch { Write-Host "Could not remove the previous app folder $old ($_)." } }
+  if ($rc -ne 0) { Start-OldBridge; return }
+  if ($fromNpm) { Remove-NpmBridge }
+}
+
+# One install at a time for this user (a second run would stop the first one's setup and roll it back).
+$lock = New-Object Threading.Mutex($false, "Local\Bridgerator-Install-$([Security.Principal.WindowsIdentity]::GetCurrent().User.Value)")
+$locked = $false
+try { $locked = $lock.WaitOne(0) } catch [Threading.AbandonedMutexException] { $locked = $true }
+if (-not $locked) { Write-Host 'Another Bridgerator install is running in another window - wait until it ends.' -ForegroundColor Yellow; $lock.Dispose(); return }
+$nodeFresh = $false
+# -UseNpm: a bridge this run stopped (the app, a 1.0.x in the other npm folder, the one npm replaces) runs again on any failure.
+$restartOld = $false
+function Undo-NpmRun {
+  # A Node.js this run put in goes again (folder, PATH entry, npm-cache marker).
+  if ($nodeFresh) { Stop-Bridge $NodeDir (Join-Path $NodeDir 'bridgerator.cmd'); Remove-PrivateNode }
+  if ($restartOld) { Start-OldBridge }
+}
+try {
+[void][IO.Directory]::CreateDirectory($Work)
+if ($npmMode) {
+# The package: downloaded, checked against the SHA256 above, installed without running any
+# install scripts of it or its dependencies (no telemetry, no downloads at install time).
+$tgz = $Package
+# The package is always checked: our default needs the hash written by release.sh, any other
+# package needs -Sha256; downloads only over https.
+if ($Package -match '^http://') { Write-Host 'The package address must start with https://' -ForegroundColor Yellow; return }
+if ($Package -ne $DefaultPackage -and -not $Sha256) { Write-Host 'A custom -Package needs its -Sha256 too.' -ForegroundColor Yellow; return }
+if ($Package -eq $DefaultPackage -and -not $Sha256 -and -not $PackageSha256) { Write-Host 'This copy of the installer has no package checksum - use the install command from your account page.' -ForegroundColor Yellow; return }
+$want = if ($Sha256) { $Sha256 } else { $PackageSha256 }
+$dl = $null
+if ($Package -match '^https://') {
+  $dl = Join-Path $Work 'bridgerator.tgz'
+  Invoke-WebRequest $Package -OutFile $dl -UseBasicParsing
+  $tgz = $dl
+}
+if ((Get-Sha256 $tgz) -ne $want.Trim().ToLower()) { throw 'The Bridgerator package failed the checksum check - try again in a minute.' }
+Write-Host 'Package checksum OK (SHA256)'
 
+# Node.js only after the package passed its check (a failed check must leave nothing behind).
 if (Test-Path (Join-Path $NodeDir 'node.exe')) { $env:Path = "$NodeDir;$env:Path" }
-if (-not (Get-Command node -ErrorAction SilentlyContinue)) { Install-PortableNode }
-$major = [int]((& node -v).TrimStart('v').Split('.')[0])
-if ($major -lt 20) {
-  Write-Host "Node.js $(& node -v) is too old (20+ needed) - Bridgerator gets its own copy, your Node.js stays as is."
+$major = 0
+if (Get-Command node -ErrorAction SilentlyContinue) { $major = [int]((& node -v).TrimStart('v').Split('.')[0]) }
+if ($major -lt 22) {
+  if ($major) { Write-Host "Node.js $(& node -v) is too old (22+ needed) - Bridgerator gets its own copy, your Node.js stays as is." }
+  $nodeFresh = -not [IO.Directory]::Exists($NodeDir)
   Install-PortableNode
 }
+# Whatever Node.js runs npm now: its folder stays (the private one is removed only when it is not in use).
+$nodeInUse = Split-Path ((Get-Command node -ErrorAction SilentlyContinue).Source)
 
-# The engine's PDF export brings puppeteer, whose postinstall downloads Chrome (~700 MB);
-# skipped here, PDF export fetches a browser itself the first time it is used.
+$prefix = (& npm.cmd prefix -g --update-notifier=false | Out-String).Trim()
 $env:PUPPETEER_SKIP_DOWNLOAD = '1'
-Write-Host "Installing Bridgerator from $Package - this takes 2-4 minutes, please wait..."
-& npm.cmd install -g $Package --no-audit --no-fund --loglevel=error
-if ($LASTEXITCODE -ne 0) { throw 'npm install failed' }
-Refresh-Path
+Write-Host 'Installing Bridgerator - this usually takes 2-6 minutes, please wait...'
+try {
+  # The running bridge keeps working during the update; only when a locked file blocks npm it is stopped.
+  & npm.cmd install -g $tgz --ignore-scripts @NpmFlags
+  if ($LASTEXITCODE -ne 0) {
+    Write-Host 'Retrying with the running Bridgerator stopped...'
+    $restartOld = $true; Stop-Bridge (Join-Path $prefix 'node_modules\bridgerator') (Join-Path $prefix 'bridgerator.cmd')
+    & npm.cmd install -g $tgz --ignore-scripts @NpmFlags
+    if ($LASTEXITCODE -ne 0) { throw 'npm could not install Bridgerator (its message is above). Check the internet connection - npm needs registry.npmjs.org - and run the install command again, or install without -UseNpm.' }
+  }
+} finally { if ($dl) { try { [IO.File]::Delete($dl) } catch {} } }
+# Back from the app to the npm package: the app stops now (one bridge per PC), its folder goes after setup.
+$dropApp = [IO.File]::Exists((Join-Path $AppDir 'bridgerator.exe'))
+if ($dropApp) { $restartOld = $true; Stop-Bridge $AppDir (Join-Path $AppDir 'bridgerator.exe') }
+# A 1.0.x package in the OTHER npm folder (npm's own / the private Node.js) stops too; it goes after setup.
+$newPkg = Join-Path $prefix 'node_modules\bridgerator'
+$keepNpm = @($newPkg, $nodeInUse)
+foreach ($p in Get-NpmBridges) { if (-not (Test-SamePath $p $newPkg)) { $restartOld = $true; Stop-Bridge $p (Join-Path (Split-Path (Split-Path $p)) 'bridgerator.cmd') } }
+} else {
+# The app: plain stops first (nothing downloaded yet), then download + every check (Get-App); the running
+# Bridgerator is stopped only right before setup (Switch-App).
+if ($AppZip -match '^http://') { Write-Host 'The app address must start with https://' -ForegroundColor Yellow; return }
+if ($AppZip -and -not $Sha256) { Write-Host 'A custom -AppZip needs its -Sha256 too.' -ForegroundColor Yellow; return }
+if (-not $AppZip -and -not $WinManifestSha256) { Write-Host 'This copy of the installer has no app checksum - use the install command from your account page.' -ForegroundColor Yellow; return }
+if (-not $AppZip -and -not (Get-Arch)) { Write-Host 'Bridgerator needs 64-bit Windows (x64 or ARM64).' -ForegroundColor Yellow; return }
+# A 1.0.x npm package (npm's folder or the private Node.js) or the old installer's private Node.js: removed after setup.
+$fromNpm = [bool](Get-NpmBridges) -or [IO.Directory]::Exists($NodeDir)
+$newApp = Get-App
+}
+
+# WebView2 runtime (the tray window). Usually part of Windows 11; if missing, Microsoft's Evergreen
+# bootstrapper is downloaded, its Authenticode signature checked (valid, signed by Microsoft
+# Corporation) and run per user without admin. Any failure only means the tray opens the account
+# page instead of its window.
+function Test-WebView2 {
+  foreach ($k in 'HKCU:\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}', 'HKLM:\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}') {
+    try { $pv = (Get-ItemProperty $k -ErrorAction Stop).pv; if ($pv -and $pv -ne '0.0.0.0') { return $true } } catch {}
+  }
+  return $false
+}
+function Test-MicrosoftSigned([string]$file) {
+  # Get-AuthenticodeSignature is not available under the Restricted policy: WinVerifyTrust directly.
+  Add-Type -TypeDefinition @'
+using System; using System.Runtime.InteropServices;
+public static class BrTrust {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] struct FileInfo { public int cbStruct; public string path; public IntPtr hFile; public IntPtr known; }
+  [StructLayout(LayoutKind.Sequential)] struct Data { public int cbStruct; public IntPtr policy; public IntPtr sip; public int ui; public int revocation; public int choice; public IntPtr file; public int action; public IntPtr state; public IntPtr url; public int prov; public int context; public IntPtr sig; }
+  [DllImport("wintrust.dll", CharSet = CharSet.Unicode)] static extern int WinVerifyTrust(IntPtr hwnd, ref Guid action, ref Data data);
+  public static int Verify(string path) {
+    var fi = new FileInfo { cbStruct = Marshal.SizeOf(typeof(FileInfo)), path = path };
+    IntPtr pfi = Marshal.AllocHGlobal(fi.cbStruct); Marshal.StructureToPtr(fi, pfi, false);
+    // WTD_REVOKE_WHOLECHAIN + WTD_REVOCATION_CHECK_CHAIN: a revoked certificate anywhere in the chain fails.
+    var d = new Data { cbStruct = Marshal.SizeOf(typeof(Data)), ui = 2, revocation = 1, choice = 1, file = pfi, action = 1, prov = 0x40 };
+    var g = new Guid("00AAC56B-CD44-11d0-8CC2-00C04FC295EE");
+    int r = WinVerifyTrust(new IntPtr(-1), ref g, ref d);
+    d.action = 2; WinVerifyTrust(new IntPtr(-1), ref g, ref d);
+    Marshal.FreeHGlobal(pfi); return r;
+  }
+}
+'@
+  if ([BrTrust]::Verify($file) -ne 0) { return $false }
+  $cert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 ([Security.Cryptography.X509Certificates.X509Certificate]::CreateFromSignedFile($file))
+  if ($cert.Subject -notmatch '(^|, )O=Microsoft Corporation(,|$)') { return $false }
+  # The chain must end in a Microsoft root and nothing in it may be revoked.
+  $chain = New-Object Security.Cryptography.X509Certificates.X509Chain
+  $chain.ChainPolicy.RevocationMode = 'Online'; $chain.ChainPolicy.RevocationFlag = 'EntireChain'
+  if (-not $chain.Build($cert)) { return $false }
+  $root = $chain.ChainElements[$chain.ChainElements.Count - 1].Certificate
+  return $root.Subject -match 'CN=Microsoft Root Certificate Authority' -and $root.Subject -match 'O=Microsoft Corporation'
+}
+if (-not (Test-WebView2)) {
+  try {
+    Write-Host 'Installing the Microsoft WebView2 runtime for the Bridgerator window...'
+    $wvb = Join-Path $Work 'MicrosoftEdgeWebview2Setup.exe'
+    Invoke-WebRequest 'https://go.microsoft.com/fwlink/p/?LinkId=2124703' -OutFile $wvb -UseBasicParsing
+    # Held open (others may only read) from the check until it has run: it can't be swapped in between.
+    $hold = [IO.File]::Open($wvb, 'Open', 'Read', 'Read')
+    try {
+      if (-not (Test-MicrosoftSigned $wvb)) { throw 'the WebView2 installer is not signed by Microsoft' }
+      $p = Start-Process -FilePath $wvb -ArgumentList '/silent', '/install' -Wait -PassThru
+    } finally { $hold.Dispose() }
+    if ($p.ExitCode -ne 0) { throw "exit code $($p.ExitCode)" }
+    # A policy / antivirus can block it while the bootstrapper still ends with 0.
+    if (-not (Test-WebView2)) { throw 'blocked on this PC' }
+  } catch { Write-Host "WebView2 runtime not installed ($_) - Bridgerator works anyway; its window opens the account page instead." -ForegroundColor Yellow }
+}
 
 $setupArgs = @('setup')
 if ($Token) { $setupArgs += @('--token', $Token) }
+if ($Relay) { $setupArgs += @('--relay', $Relay) }
 foreach ($a in $Allow) { $setupArgs += @('--allow', $a) }
 foreach ($d in $Deny) { $setupArgs += @('--deny', $d) }
-if (-not $paired) { Write-Host 'Next: a browser tab opens - sign in with the same account you use for Bridgerator and click "Connect this computer".' }
-& bridgerator.cmd @setupArgs
-if ($LASTEXITCODE -ne 0) { throw 'bridgerator setup failed' }
+if ($NoTelemetry) { $setupArgs += '--no-telemetry' }
+# Language of the window on a first config (setup keeps a language the person chose).
+$lang = if ([Globalization.CultureInfo]::CurrentUICulture.Name -like 'ru*' -or [Globalization.CultureInfo]::CurrentCulture.Name -like 'ru*') { 'ru' } else { 'en' }
+$setupArgs += @('--language', $lang)
+# The app: only now the running Bridgerator stops and the checked folder goes in place.
+if (-not $npmMode) { $oldApp = Switch-App $newApp }
+try {
+  # Called by full path (the PATH of this window may not have the folder yet); the folder goes on
+  # the user PATH so `bridgerator.cmd` works in new windows.
+  if ($npmMode) { Add-UserPath $prefix; $br = Join-Path $prefix 'bridgerator.cmd' } else { Add-UserPath $AppDir -First; $br = Join-Path $AppDir 'bridgerator.exe' }
+  Refresh-Path
+  if (-not $paired) { Write-Host 'Next: a browser tab opens - sign in with the same account you use for Bridgerator and click "Connect this computer".' }
+  & $br @setupArgs
+  $rc = $LASTEXITCODE
+} catch { if (-not $npmMode) { Complete-App 1 $oldApp $fromNpm }; throw }
+if (-not $npmMode) { Complete-App $rc $oldApp $fromNpm }
+elseif ($rc -eq 0) {
+  if ($dropApp) { try { Remove-Dir $AppDir; Remove-UserPath $AppDir } catch { Write-Host "Could not remove the Bridgerator app folder $AppDir ($_)." } }
+  Remove-NpmBridge $keepNpm
+}
+# 3 = stopped with a clear message already shown (pairing code expired, ...): no red error on top;
+# -UseNpm rolls back like a failure (fresh Node.js out, the stopped bridge back).
+if ($rc -eq 3) { if ($npmMode) { Undo-NpmRun }; return }
+if ($rc -ne 0) { throw 'bridgerator setup failed' }
 Write-Host 'Done. Bridgerator starts in the background in about 10 seconds. Check any time with: bridgerator.cmd status'
+Write-Host 'Open ChatGPT and say: Set up Bridgerator'
 
-# Next steps (connect ChatGPT, example prompts) on the welcome page; skipped for -NoBrowser and
-# non-interactive sessions (scheduled tasks, remote shells). Never fails the install.
-$welcome = 'https://bridgerator.recondeck.com/welcome/'
-if (-not $NoBrowser -and [Environment]::UserInteractive) {
-  try { Start-Process $welcome } catch { Write-Host "Next steps: $welcome" }
-} else {
-  Write-Host "Next steps: $welcome"
+# Next steps (connect ChatGPT, example prompts) on the welcome page of the site this script came from -
+# after the FIRST install only; skipped for -NoBrowser and non-interactive sessions. Russian Windows
+# (display language or regional format) gets the Russian page.
+$welcome = "$Site/$(if ($lang -eq 'ru') { 'ru/' })welcome/"
+if ($firstInstall) {
+  if (-not $NoBrowser -and [Environment]::UserInteractive) {
+    try { Start-Process $welcome } catch { Write-Host "Next steps: $welcome" }
+  } else {
+    Write-Host "Next steps: $welcome"
+  }
 }
+} catch {
+  if ($npmMode) { Undo-NpmRun }
+  throw
+} finally { Remove-Work; try { $lock.ReleaseMutex() } catch {}; $lock.Dispose() }