freecode-sh 0.1.0-alpha.12 → 0.1.0-alpha.18

package/install.ps1

@@ -0,0 +1,653 @@
+#Requires -Version 5.1
+
+<#
+.SYNOPSIS
+Installs the Free Code native Windows alpha without administrator access.
+
+.EXAMPLE
+irm https://freecode.sh/install.ps1 | iex
+
+.EXAMPLE
+.\install.ps1 -Version 0.1.0-alpha.1 -NoModifyPath
+#>
+
+[CmdletBinding()]
+param(
+  [string]$Version,
+  [string]$Channel,
+  [string]$BaseUrl,
+  [string]$ChannelBaseUrl,
+  [string]$ArchivePath,
+  [string]$ChecksumPath,
+  [string]$ManifestPath,
+  [Alias('InstallRoot')]
+  [string]$InstallDir,
+  [switch]$AllowUnsigned,
+  [switch]$NoModifyPath,
+  [switch]$Rollback,
+  [switch]$Uninstall
+)
+
+Set-StrictMode -Version 2.0
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+
+$Product = 'freecode-sh'
+$Target = 'windows-x64'
+$AssetName = 'freecode-windows-x64.zip'
+$LauncherRelativePath = 'bin/freecode.exe'
+$InterfaceRelativePath = 'libexec/freecode/freecode-tui.exe'
+$EngineRelativePath = 'libexec/freecode/freecode-engine.exe'
+$DefaultBaseUrl = 'https://releases.freecode.sh/releases'
+$DefaultChannelBaseUrl = 'https://releases.freecode.sh/channels'
+$ReleaseSigningModulusBase64 = '8so4sWArOV0GXihYvoSoxDLI1yMoILnVfCjYQwe4CKQ9EC10JV30cntMJZWXvXZS6STqQGIjyWisa6Op4nIdOuXKDjaEcQIeftgZBzzyGrMmAMC3W57VAi3d+w/F2XnkXBaH3NOphfftF6Fxt3Q02CxN3PjuuFaOGytKsYF5uDLCvEb+MpzJlD3HZoBzhhMCAoY6wmCdlgaDxD20UFdyEigF5wwpcUWpYmbYMFp+6SLe/Fi8IrYirwiCv5eLur6PzFFcwFrJgUeZAdxmGuM8eJzZlc7mK0+gzi8KpC2FZ9eOx1SafPE4An4+u8rZ7WA1Qk5eCAhNU9lm+JAeeKcCXzhQpPUafybJg75dIbIayOC3tf5mn+X+Vl5+uY19nT2qcJsjgUeIcqbMs9FGXiIA2G292N5WppyiDcx8yAIG6rOrAUGzHMYCrhvxQLAx2KP5QfC53VZ3La7yZOATY5icF78qSSBrKDrT42vinbosbX++Wr34YB6pXhiZF6jHPHrx'
+$ReleaseSigningExponentBase64 = 'AQAB'
+
+function Fail([string]$Message) {
+  throw "freecode installer: $Message"
+}
+
+function Get-EnvironmentValue([string]$Name) {
+  return [Environment]::GetEnvironmentVariable($Name, 'Process')
+}
+
+if (-not $Version) { $Version = Get-EnvironmentValue 'FREECODE_INSTALL_VERSION' }
+if (-not $Channel) {
+  $Channel = Get-EnvironmentValue 'FREECODE_INSTALL_CHANNEL'
+  if (-not $Channel) { $Channel = 'alpha' }
+}
+if (-not $BaseUrl) {
+  $BaseUrl = Get-EnvironmentValue 'FREECODE_INSTALL_BASE_URL'
+  if (-not $BaseUrl) { $BaseUrl = $DefaultBaseUrl }
+}
+if (-not $ChannelBaseUrl) {
+  $ChannelBaseUrl = Get-EnvironmentValue 'FREECODE_CHANNEL_BASE_URL'
+  if (-not $ChannelBaseUrl) { $ChannelBaseUrl = $DefaultChannelBaseUrl }
+}
+
+$testReleaseModulus = Get-EnvironmentValue 'FREECODE_TEST_RELEASE_PUBLIC_KEY_MODULUS'
+$testReleaseExponent = Get-EnvironmentValue 'FREECODE_TEST_RELEASE_PUBLIC_KEY_EXPONENT'
+if ($testReleaseModulus -or $testReleaseExponent) {
+  $testBaseUri = $null
+  if (
+    -not $testReleaseModulus -or
+    -not $testReleaseExponent -or
+    -not [Uri]::TryCreate($BaseUrl, [UriKind]::Absolute, [ref]$testBaseUri) -or
+    $testBaseUri.Scheme -ne 'http' -or
+    -not $testBaseUri.IsLoopback
+  ) {
+    Fail 'the test release key override is permitted only with a loopback HTTP release URL'
+  }
+  $ReleaseSigningModulusBase64 = $testReleaseModulus
+  $ReleaseSigningExponentBase64 = $testReleaseExponent
+}
+if (-not $InstallDir) {
+  $InstallDir = Get-EnvironmentValue 'FREECODE_INSTALL_ROOT'
+  if (-not $InstallDir) {
+    if (-not $env:LOCALAPPDATA) { Fail 'LOCALAPPDATA is required' }
+    $InstallDir = Join-Path $env:LOCALAPPDATA 'Freecode'
+  }
+}
+if ((Get-EnvironmentValue 'FREECODE_ALLOW_UNSIGNED_INSTALL') -eq 'true') {
+  $AllowUnsigned = $true
+}
+if ((Get-EnvironmentValue 'FREECODE_INSTALL_EMBEDDED') -eq 'true') {
+  $NoModifyPath = $true
+}
+
+$InstallDir = [IO.Path]::GetFullPath($InstallDir)
+$VersionsDir = Join-Path $InstallDir 'versions'
+$BinDir = Join-Path $InstallDir 'bin'
+$CurrentVersionPath = Join-Path $InstallDir 'current-version'
+$PreviousVersionPath = Join-Path $InstallDir 'previous-version'
+$MarkerPath = Join-Path $InstallDir '.freecode-install.json'
+$ShimPath = Join-Path $BinDir 'freecode.cmd'
+
+function Assert-SafeInstallRoot {
+  if ($InstallDir.IndexOfAny([char[]]@('"', '%', '!', "`r", "`n", ';')) -ge 0) {
+    Fail 'the install directory contains characters that cannot be represented safely in the command shim'
+  }
+  $comparison = [StringComparison]::OrdinalIgnoreCase
+  $driveRoot = [IO.Path]::GetPathRoot($InstallDir)
+  $unsafeRoots = @($driveRoot, $env:USERPROFILE, $env:LOCALAPPDATA) | Where-Object { $_ }
+  foreach ($unsafe in $unsafeRoots) {
+    if ([string]::Equals($InstallDir.TrimEnd('\'), ([IO.Path]::GetFullPath($unsafe)).TrimEnd('\'), $comparison)) {
+      Fail "refusing to use a broad install directory: $InstallDir"
+    }
+  }
+}
+
+function Assert-Version([string]$Value) {
+  if ($Value -notmatch '^\d+\.\d+\.\d+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$') {
+    Fail "invalid release version: $Value"
+  }
+}
+
+function Assert-Channel([string]$Value) {
+  if ($Value -notmatch '^[0-9A-Za-z][0-9A-Za-z._-]*$') {
+    Fail "invalid release channel: $Value"
+  }
+}
+
+function Receive-File([string]$Uri, [string]$Destination) {
+  try {
+    Invoke-WebRequest -UseBasicParsing -Uri $Uri -OutFile $Destination
+  } catch {
+    Fail "could not download $Uri ($($_.Exception.Message))"
+  }
+}
+
+function Read-Json([string]$Path, [string]$Description) {
+  try {
+    return Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+  } catch {
+    Fail "$Description is not valid JSON"
+  }
+}
+
+function Get-Sha256Hex([string]$Path) {
+  $stream = [IO.File]::OpenRead($Path)
+  $sha256 = [Security.Cryptography.SHA256]::Create()
+  try {
+    return ([BitConverter]::ToString($sha256.ComputeHash($stream))).Replace('-', '').ToLowerInvariant()
+  } finally {
+    $sha256.Dispose()
+    $stream.Dispose()
+  }
+}
+
+function Enter-InstallLock {
+  $normalizedInstallDir = $InstallDir.TrimEnd('\').ToUpperInvariant()
+  $sha256 = [Security.Cryptography.SHA256]::Create()
+  try {
+    $digest = $sha256.ComputeHash([Text.Encoding]::UTF8.GetBytes($normalizedInstallDir))
+  } finally {
+    $sha256.Dispose()
+  }
+  $mutexName = "Local\FreeCodeInstall-$(([BitConverter]::ToString($digest)).Replace('-', ''))"
+  $mutex = [Threading.Mutex]::new($false, $mutexName)
+  $acquired = $false
+  try {
+    try {
+      $acquired = $mutex.WaitOne(0)
+      if (-not $acquired) {
+        Write-Host 'Waiting for another Free Code setup to finish...'
+        $acquired = $mutex.WaitOne([TimeSpan]::FromMinutes(5))
+      }
+    } catch [Threading.AbandonedMutexException] {
+      $acquired = $true
+    }
+    if (-not $acquired) {
+      Fail 'timed out waiting for another Free Code setup to finish'
+    }
+    return $mutex
+  } catch {
+    $mutex.Dispose()
+    throw
+  }
+}
+
+function Exit-InstallLock([Threading.Mutex]$Mutex) {
+  try {
+    $Mutex.ReleaseMutex()
+  } finally {
+    $Mutex.Dispose()
+  }
+}
+
+function Assert-ReleaseManifestSignature([string]$ManifestPath, [string]$SignaturePath, [string]$Description) {
+  if (-not (Test-Path -LiteralPath $SignaturePath -PathType Leaf)) {
+    Fail "$Description does not have a valid Free Code release signature"
+  }
+  $rsa = [Security.Cryptography.RSA]::Create()
+  try {
+    $parameters = New-Object Security.Cryptography.RSAParameters
+    $parameters.Modulus = [Convert]::FromBase64String($ReleaseSigningModulusBase64)
+    $parameters.Exponent = [Convert]::FromBase64String($ReleaseSigningExponentBase64)
+    $rsa.ImportParameters($parameters)
+    $valid = $rsa.VerifyData(
+      [IO.File]::ReadAllBytes($ManifestPath),
+      [IO.File]::ReadAllBytes($SignaturePath),
+      [Security.Cryptography.HashAlgorithmName]::SHA256,
+      [Security.Cryptography.RSASignaturePadding]::Pkcs1
+    )
+  } catch {
+    $valid = $false
+  } finally {
+    $rsa.Dispose()
+  }
+  if (-not $valid) {
+    Fail "$Description does not have a valid Free Code release signature"
+  }
+}
+
+function Get-Asset($Manifest, [string]$Description) {
+  if (-not $Manifest.version) { Fail "$Description does not contain a version" }
+  if (-not $Manifest.assets) { Fail "$Description does not contain release assets" }
+  $property = $Manifest.assets.PSObject.Properties[$Target]
+  if (-not $property) { Fail "$Description does not contain a $Target asset" }
+  return $property.Value
+}
+
+function Assert-PayloadContract($Manifest, [string]$Description) {
+  $payload = $null
+  $payloads = Get-OptionalProperty $Manifest 'payloads'
+  if ($payloads) {
+    $targetPayload = $payloads.PSObject.Properties[$Target]
+    if ($targetPayload) { $payload = $targetPayload.Value }
+  }
+  if (-not $payload) { $payload = Get-OptionalProperty $Manifest 'payload' }
+  if (
+    -not $payload -or
+    [string](Get-OptionalProperty $payload 'launcher') -ne $LauncherRelativePath -or
+    [string](Get-OptionalProperty $payload 'interface') -ne $InterfaceRelativePath -or
+    [string](Get-OptionalProperty $payload 'engine') -ne $EngineRelativePath
+  ) {
+    Fail "$Description does not declare the expected $Target payload paths"
+  }
+}
+
+function Get-OptionalProperty($Object, [string]$Name) {
+  if (-not $Object) { return $null }
+  $property = $Object.PSObject.Properties[$Name]
+  if (-not $property) { return $null }
+  return $property.Value
+}
+
+function Test-UnsignedAsset($Security) {
+  return (Get-OptionalProperty $Security 'testUnsigned') -eq $true
+}
+
+function Assert-WindowsAssetSecurity($Asset, [string]$Description) {
+  $security = Get-OptionalProperty $Asset 'security'
+  if ($security -and (Test-UnsignedAsset $security)) {
+    if (-not $AllowUnsigned) {
+      Fail "$Description is an unsigned test artifact; rerun with -AllowUnsigned only on a trusted test PC"
+    }
+    return
+  }
+  if (
+    -not $security -or
+    $security.windowsAuthenticodeSigned -ne $true -or
+    $security.timestamped -ne $true -or
+    -not $security.publisher
+  ) {
+    Fail "$Description is not marked as Authenticode signed and timestamped"
+  }
+}
+
+function Assert-ZipPaths([string]$Archive, [string]$Destination) {
+  Add-Type -AssemblyName System.IO.Compression.FileSystem
+  $root = [IO.Path]::GetFullPath($Destination).TrimEnd('\') + '\'
+  $zip = [IO.Compression.ZipFile]::OpenRead($Archive)
+  try {
+    foreach ($entry in $zip.Entries) {
+      $name = $entry.FullName.Replace('\', '/')
+      if (
+        [string]::IsNullOrWhiteSpace($name) -or
+        $name.StartsWith('/') -or
+        $name -match '^[A-Za-z]:' -or
+        ($name.Split('/') -contains '..')
+      ) {
+        Fail "release archive contains an unsafe path: $name"
+      }
+      $destinationPath = [IO.Path]::GetFullPath((Join-Path $Destination $name))
+      if (-not $destinationPath.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) {
+        Fail "release archive escapes the staging directory: $name"
+      }
+    }
+  } finally {
+    $zip.Dispose()
+  }
+}
+
+function Get-RequiredExecutables([string]$Root) {
+  return @(
+    (Join-Path $Root $LauncherRelativePath),
+    (Join-Path $Root $InterfaceRelativePath),
+    (Join-Path $Root $EngineRelativePath)
+  )
+}
+
+function Assert-CompleteInstall([string]$Root) {
+  foreach ($executable in Get-RequiredExecutables $Root) {
+    if (-not (Test-Path -LiteralPath $executable -PathType Leaf)) {
+      Fail "release is missing required executable: $executable"
+    }
+  }
+}
+
+function Assert-BundleIntegrity([string]$Root, [string]$CandidateVersion) {
+  $bundlePath = Join-Path $Root 'libexec\freecode\bundle-manifest.json'
+  $bundle = Read-Json $bundlePath 'bundle manifest'
+  if ([string]$bundle.version -ne $CandidateVersion) {
+    Fail "bundle manifest version $($bundle.version) does not match $CandidateVersion"
+  }
+  if (-not $bundle.payload) { Fail 'bundle manifest does not contain payload checksums' }
+  $rootPrefix = [IO.Path]::GetFullPath($Root).TrimEnd('\') + '\'
+  foreach ($property in $bundle.payload.PSObject.Properties) {
+    $name = $property.Name.Replace('\', '/')
+    if ($name.StartsWith('/') -or $name -match '^[A-Za-z]:' -or ($name.Split('/') -contains '..')) {
+      Fail "bundle manifest contains an unsafe path: $name"
+    }
+    $path = [IO.Path]::GetFullPath((Join-Path $Root $name))
+    if (-not $path.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase)) {
+      Fail "bundle manifest path escapes the install root: $name"
+    }
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { Fail "bundle payload is missing $name" }
+    $actual = Get-Sha256Hex $path
+    if ($actual -ne [string]$property.Value) { Fail "bundle payload checksum failed for $name" }
+  }
+}
+
+function Assert-Signatures([string]$Root, $Security) {
+  if ((Test-UnsignedAsset $Security) -and $AllowUnsigned) {
+    Write-Warning 'Installing an unsigned draft Windows artifact for testing. Do not redistribute this build.'
+    return
+  }
+  foreach ($executable in Get-RequiredExecutables $Root) {
+    $signature = Get-AuthenticodeSignature -LiteralPath $executable
+    if ([string]$signature.Status -ne 'Valid') {
+      Fail "Authenticode verification failed for $executable ($($signature.Status))"
+    }
+    if (-not $signature.SignerCertificate -or $signature.SignerCertificate.Subject -ne $Security.publisher) {
+      $actual = if ($signature.SignerCertificate) { $signature.SignerCertificate.Subject } else { 'missing' }
+      Fail "unexpected Authenticode publisher for $executable (expected $($Security.publisher), received $actual)"
+    }
+    if (-not $signature.TimeStamperCertificate) {
+      Fail "trusted timestamp is missing from $executable"
+    }
+  }
+}
+
+function Write-TextAtomically([string]$Path, [string]$Text) {
+  $temporary = "$Path.$([Guid]::NewGuid().ToString('N')).tmp"
+  [IO.File]::WriteAllText($temporary, $Text, [Text.UTF8Encoding]::new($false))
+  if (Test-Path -LiteralPath $Path) {
+    $backup = "$Path.$([Guid]::NewGuid().ToString('N')).bak"
+    try {
+      [IO.File]::Replace($temporary, $Path, $backup, $true)
+    } finally {
+      Remove-Item -LiteralPath $backup -Force -ErrorAction SilentlyContinue
+      Remove-Item -LiteralPath $temporary -Force -ErrorAction SilentlyContinue
+    }
+  } else {
+    [IO.File]::Move($temporary, $Path)
+  }
+}
+
+function Write-CommandShim {
+  New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
+  if ((Test-Path -LiteralPath $ShimPath) -and (Get-Item -LiteralPath $ShimPath).PSIsContainer) {
+    Fail "refusing to replace directory at $ShimPath"
+  }
+  $shim = @"
+@echo off
+setlocal
+set "FREECODE_VERSION="
+set /p FREECODE_VERSION=<"$CurrentVersionPath"
+if not defined FREECODE_VERSION (
+  echo Free Code is not activated. Re-run install.ps1. 1>&2
+  exit /b 1
+)
+"$VersionsDir\%FREECODE_VERSION%\bin\freecode.exe" %*
+"@
+  Write-TextAtomically $ShimPath ($shim -replace "`n", "`r`n")
+}
+
+function Set-UserPath([bool]$Add) {
+  $userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
+  $entries = @($userPath -split ';' | Where-Object { $_ })
+  $comparison = [StringComparer]::OrdinalIgnoreCase
+  $matches = @($entries | Where-Object { $comparison.Equals($_.TrimEnd('\'), $BinDir.TrimEnd('\')) })
+  if ($Add) {
+    if ($matches.Count -eq 0) {
+      $updated = (@($entries) + $BinDir) -join ';'
+      [Environment]::SetEnvironmentVariable('Path', $updated, 'User')
+      Write-Host "Added $BinDir to your user PATH."
+    }
+    if (-not (@($env:Path -split ';') | Where-Object { $comparison.Equals($_.TrimEnd('\'), $BinDir.TrimEnd('\')) })) {
+      $env:Path = "$BinDir;$env:Path"
+    }
+  } elseif ($matches.Count -gt 0) {
+    $updated = @($entries | Where-Object { -not $comparison.Equals($_.TrimEnd('\'), $BinDir.TrimEnd('\')) }) -join ';'
+    [Environment]::SetEnvironmentVariable('Path', $updated, 'User')
+  }
+}
+
+function Test-VersionHealth([string]$CandidateVersion) {
+  $launcher = Join-Path (Join-Path $VersionsDir $CandidateVersion) $LauncherRelativePath
+  $versionOutput = @(& $launcher --version 2>&1)
+  $versionExit = $LASTEXITCODE
+  $versionOutput | ForEach-Object { Write-Host $_ }
+  if ($versionExit -ne 0 -or $versionOutput.Count -eq 0 -or [string]$versionOutput[0] -ne "freecode-sh $CandidateVersion") {
+    return $false
+  }
+  $doctorOutput = @(& $launcher doctor 2>&1)
+  $doctorExit = $LASTEXITCODE
+  $doctorOutput | ForEach-Object { Write-Host $_ }
+  return $doctorExit -eq 0
+}
+
+function Invoke-Uninstall {
+  if (-not (Test-Path -LiteralPath $MarkerPath -PathType Leaf)) {
+    Fail "refusing to remove an unrecognized directory without $MarkerPath"
+  }
+  $marker = Read-Json $MarkerPath 'install marker'
+  if ($marker.product -ne $Product -or $marker.installDir -ne $InstallDir) {
+    Fail 'install marker does not match this Free Code installation'
+  }
+  if (-not $NoModifyPath) { Set-UserPath $false }
+  Remove-Item -LiteralPath $InstallDir -Recurse -Force
+  Write-Host "Free Code was removed from $InstallDir."
+}
+
+function Invoke-Rollback {
+  if (-not (Test-Path -LiteralPath $PreviousVersionPath -PathType Leaf)) {
+    Fail 'there is no previous Free Code version to restore'
+  }
+  $previous = (Get-Content -LiteralPath $PreviousVersionPath -Raw).Trim()
+  Assert-Version $previous
+  $previousRoot = Join-Path $VersionsDir $previous
+  Assert-CompleteInstall $previousRoot
+  Assert-BundleIntegrity $previousRoot $previous
+  $metadataPath = Join-Path $previousRoot 'release-metadata.json'
+  $metadata = Read-Json $metadataPath 'stored release metadata'
+  Assert-WindowsAssetSecurity $metadata.asset 'stored release metadata'
+  Assert-Signatures $previousRoot $metadata.asset.security
+  $current = if (Test-Path -LiteralPath $CurrentVersionPath) { (Get-Content -LiteralPath $CurrentVersionPath -Raw).Trim() } else { '' }
+  Write-TextAtomically $CurrentVersionPath "$previous`n"
+  if (-not (Test-VersionHealth $previous)) {
+    if ($current) { Write-TextAtomically $CurrentVersionPath "$current`n" }
+    Fail 'the previous version failed its health check; activation was restored'
+  }
+  if ($current) { Write-TextAtomically $PreviousVersionPath "$current`n" }
+  Write-CommandShim
+  Write-Host "Rolled back Free Code to $previous."
+}
+
+Assert-SafeInstallRoot
+Assert-Channel $Channel
+
+$localInputs = @(@($ArchivePath, $ChecksumPath, $ManifestPath) | Where-Object { $_ })
+if ($localInputs.Count -ne 0 -and $localInputs.Count -ne 3) {
+  Fail '-ArchivePath, -ChecksumPath, and -ManifestPath must be provided together'
+}
+if ($localInputs.Count -eq 3 -and -not $Version) {
+  Fail '-Version is required when installing local candidate files'
+}
+
+if ($Uninstall -and $Rollback) { Fail '-Uninstall and -Rollback cannot be used together' }
+if ($Uninstall) {
+  $operationMutex = Enter-InstallLock
+  try {
+    Invoke-Uninstall
+  } finally {
+    Exit-InstallLock $operationMutex
+  }
+  exit 0
+}
+if ($Rollback) {
+  $operationMutex = Enter-InstallLock
+  try {
+    Invoke-Rollback
+  } finally {
+    Exit-InstallLock $operationMutex
+  }
+  exit 0
+}
+
+$architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
+if ($architecture -ne 'AMD64') {
+  Fail "this beta supports only Windows x64 (detected $architecture)"
+}
+
+# Windows PowerShell 5.1 may otherwise negotiate an obsolete TLS version.
+if ([Net.ServicePointManager]::SecurityProtocol -band [Net.SecurityProtocolType]::Tls12) {
+  [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+} else {
+  [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+}
+
+$BaseUrl = $BaseUrl.TrimEnd('/')
+$ChannelBaseUrl = $ChannelBaseUrl.TrimEnd('/')
+$TemporaryDir = Join-Path ([IO.Path]::GetTempPath()) "freecode-install-$([Guid]::NewGuid().ToString('N'))"
+$StageDir = $null
+$InstallMutex = $null
+New-Item -ItemType Directory -Path $TemporaryDir -Force | Out-Null
+
+try {
+  if (-not $Version) {
+    $channelPath = Join-Path $TemporaryDir 'channel.json'
+    $channelSignaturePath = Join-Path $TemporaryDir 'channel.json.sig'
+    Write-Host "Resolving Free Code channel $Channel..."
+    Receive-File "$ChannelBaseUrl/$Channel.json" $channelPath
+    Receive-File "$ChannelBaseUrl/$Channel.json.sig" $channelSignaturePath
+    Assert-ReleaseManifestSignature $channelPath $channelSignaturePath "channel $Channel"
+    $channelManifest = Read-Json $channelPath "channel $Channel"
+    if ($channelManifest.channel -ne $Channel) { Fail "channel manifest identifies $($channelManifest.channel), expected $Channel" }
+    Assert-PayloadContract $channelManifest "channel $Channel"
+    $channelAsset = Get-Asset $channelManifest "channel $Channel"
+    Assert-WindowsAssetSecurity $channelAsset "channel $Channel"
+    $Version = [string]$channelManifest.version
+  }
+  Assert-Version $Version
+
+  $downloadedArchivePath = Join-Path $TemporaryDir $AssetName
+  $downloadedChecksumPath = "$downloadedArchivePath.sha256"
+  $downloadedManifestPath = Join-Path $TemporaryDir 'release-manifest.json'
+  $downloadedSignaturePath = "$downloadedManifestPath.sig"
+  if ($localInputs.Count -eq 3) {
+    Write-Host "Loading local Free Code $Version candidate files..."
+    Copy-Item -LiteralPath ([IO.Path]::GetFullPath($ArchivePath)) -Destination $downloadedArchivePath
+    Copy-Item -LiteralPath ([IO.Path]::GetFullPath($ChecksumPath)) -Destination $downloadedChecksumPath
+    Copy-Item -LiteralPath ([IO.Path]::GetFullPath($ManifestPath)) -Destination $downloadedManifestPath
+    $localSignaturePath = "$([IO.Path]::GetFullPath($ManifestPath)).sig"
+    if (Test-Path -LiteralPath $localSignaturePath -PathType Leaf) {
+      Copy-Item -LiteralPath $localSignaturePath -Destination $downloadedSignaturePath
+    }
+  } else {
+    $releaseRoot = "$BaseUrl/v$Version"
+    Write-Host "Downloading Free Code $Version for Windows x64..."
+    Receive-File "$releaseRoot/$AssetName" $downloadedArchivePath
+    Receive-File "$releaseRoot/$AssetName.sha256" $downloadedChecksumPath
+    Receive-File "$releaseRoot/release-manifest.json" $downloadedManifestPath
+    Receive-File "$releaseRoot/release-manifest.json.sig" $downloadedSignaturePath
+  }
+
+  $manifest = Read-Json $downloadedManifestPath "release $Version"
+  $asset = Get-Asset $manifest "release $Version"
+  $localUnsignedOverride = $localInputs.Count -eq 3 -and $AllowUnsigned -and (Test-UnsignedAsset $asset.security)
+  if (-not $localUnsignedOverride) {
+    Assert-ReleaseManifestSignature $downloadedManifestPath $downloadedSignaturePath "release $Version"
+  }
+  if ([string]$manifest.version -ne $Version) {
+    Fail "release manifest version $($manifest.version) does not match requested version $Version"
+  }
+  if ($manifest.channel -ne $Channel) { Fail "release manifest channel $($manifest.channel) does not match $Channel" }
+  Assert-PayloadContract $manifest "release $Version"
+  Assert-WindowsAssetSecurity $asset "release $Version"
+  if ($asset.archive -ne $AssetName) { Fail "release manifest names unexpected asset $($asset.archive)" }
+
+  $checksumLine = (Get-Content -LiteralPath $downloadedChecksumPath | Select-Object -First 1)
+  if ($checksumLine -notmatch '^([a-fA-F0-9]{64})\s{1,2}(\*?)([^\s]+)$') {
+    Fail 'release checksum file is malformed'
+  }
+  $expectedChecksum = $Matches[1].ToLowerInvariant()
+  if ($Matches[3] -ne $AssetName) { Fail "checksum file names unexpected asset $($Matches[3])" }
+  if ([string]$asset.sha256 -ne $expectedChecksum) { Fail 'release manifest and checksum file disagree' }
+  $actualChecksum = Get-Sha256Hex $downloadedArchivePath
+  if ($actualChecksum -ne $expectedChecksum) { Fail "checksum verification failed for $AssetName" }
+
+  $InstallMutex = Enter-InstallLock
+  New-Item -ItemType Directory -Path $VersionsDir -Force | Out-Null
+  $versionRoot = Join-Path $VersionsDir $Version
+  $newInstall = -not (Test-Path -LiteralPath $versionRoot)
+  if ($newInstall) {
+    $StageDir = Join-Path $InstallDir ".install-$Version-$([Guid]::NewGuid().ToString('N'))"
+    New-Item -ItemType Directory -Path $StageDir -Force | Out-Null
+    Assert-ZipPaths $downloadedArchivePath $StageDir
+    [IO.Compression.ZipFile]::ExtractToDirectory($downloadedArchivePath, $StageDir)
+    Assert-CompleteInstall $StageDir
+    Assert-BundleIntegrity $StageDir $Version
+    Assert-Signatures $StageDir $asset.security
+    @{
+      schemaVersion = 1
+      product = $Product
+      version = $Version
+      asset = $asset
+    } | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath (Join-Path $StageDir 'release-metadata.json') -Encoding UTF8
+    Move-Item -LiteralPath $StageDir -Destination $versionRoot
+    $StageDir = $null
+  } else {
+    Assert-CompleteInstall $versionRoot
+    Assert-BundleIntegrity $versionRoot $Version
+    $storedMetadata = Read-Json (Join-Path $versionRoot 'release-metadata.json') 'stored release metadata'
+    if (
+      [string]$storedMetadata.version -ne $Version -or
+      [string]$storedMetadata.asset.sha256 -ne [string]$asset.sha256 -or
+      [string](Get-OptionalProperty $storedMetadata.asset.security 'publisher') -ne [string](Get-OptionalProperty $asset.security 'publisher') -or
+      [bool](Test-UnsignedAsset $storedMetadata.asset.security) -ne [bool](Test-UnsignedAsset $asset.security)
+    ) {
+      Fail "existing version metadata does not match the verified release manifest for $Version"
+    }
+    Assert-Signatures $versionRoot $asset.security
+  }
+
+  New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
+  @{
+    schemaVersion = 1
+    product = $Product
+    installDir = $InstallDir
+    binDir = $BinDir
+  } | ConvertTo-Json | Set-Content -LiteralPath $MarkerPath -Encoding UTF8
+
+  $previous = if (Test-Path -LiteralPath $CurrentVersionPath) { (Get-Content -LiteralPath $CurrentVersionPath -Raw).Trim() } else { '' }
+  if ($previous -and $previous -ne $Version) { Write-TextAtomically $PreviousVersionPath "$previous`n" }
+  Write-TextAtomically $CurrentVersionPath "$Version`n"
+  Write-CommandShim
+
+  if (-not (Test-VersionHealth $Version)) {
+    if ($previous) {
+      Write-TextAtomically $CurrentVersionPath "$previous`n"
+    } else {
+      Remove-Item -LiteralPath $CurrentVersionPath -Force -ErrorAction SilentlyContinue
+    }
+    if ($newInstall) { Remove-Item -LiteralPath $versionRoot -Recurse -Force -ErrorAction SilentlyContinue }
+    Fail 'Free Code health checks failed; restored the previous activation'
+  }
+
+  if (-not $NoModifyPath) { Set-UserPath $true }
+  Write-Host ''
+  Write-Host "Free Code $Version installed successfully."
+  Write-Host "Command: $ShimPath"
+  Write-Host 'Open a new terminal, then run: freecode doctor'
+} finally {
+  if ($StageDir -and (Test-Path -LiteralPath $StageDir)) {
+    Remove-Item -LiteralPath $StageDir -Recurse -Force -ErrorAction SilentlyContinue
+  }
+  if ($InstallMutex) {
+    Exit-InstallLock $InstallMutex
+  }
+  Remove-Item -LiteralPath $TemporaryDir -Recurse -Force -ErrorAction SilentlyContinue
+}