install.ps1

# Java Version Manager
# Copyright (C) 2026 DiamTek / Alexéy Shishkin
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.

[CmdletBinding()]
param(
    [switch]$Quiet,
    [switch]$Update,
    [string]$TargetDir,
    [string]$Branch,
    [string]$Channel = "Stable",
    [switch]$SkipIntegrity,
    [switch]$Offline,
    [string]$DistroDir
)

if (-not $PSBoundParameters.ContainsKey('Channel') -and $env:JVM_CHANNEL) {
    $Channel = $env:JVM_CHANNEL
}
if (-not $PSBoundParameters.ContainsKey('Branch') -and $env:JVM_BRANCH) {
    $Branch = $env:JVM_BRANCH
}

if ($Branch) {
    if ($Branch -notmatch '^[a-zA-Z0-9_.\-]+(/[a-zA-Z0-9_.\-]+)*$' -or $Branch -match '\.\.') {
        Write-Host "[ ERROR  ] Invalid branch or tag name: '$Branch'" -ForegroundColor Red
        exit 1
    }
}

$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'

if ($ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') {
    Write-Host "[ ERROR  ] PowerShell is operating in $($ExecutionContext.SessionState.LanguageMode) mode." -ForegroundColor Red
    Write-Host "           FullLanguage mode is required by DiamTek Java Version Manager installer" -ForegroundColor Yellow
    Write-Host "           to safely manage system environment variables, configure NTFS DACLs, and verify cryptography." -ForegroundColor Yellow
    exit 1
}

$isFullLanguage = $true
if ($isFullLanguage) {
    try {
        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072 -bor 12288
    } catch { Write-Verbose "TLS protocol configuration skipped: $($_.Exception.Message)" }

    try {
        if ([System.Net.WebRequest]::DefaultWebProxy) {
            [System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
        }
    } catch { Write-Verbose "DefaultWebProxy configuration skipped: $($_.Exception.Message)" }
}

# Ensure legacy or leaked proxy parameter defaults do not break PowerShell Core (CWE-754 / CWE-755)
if ($PSDefaultParameterValues.ContainsKey('Invoke-WebRequest:ProxyUseDefaultCredentials')) {
    $null = $PSDefaultParameterValues.Remove('Invoke-WebRequest:ProxyUseDefaultCredentials')
}
if ($PSDefaultParameterValues.ContainsKey('Invoke-RestMethod:ProxyUseDefaultCredentials')) {
    $null = $PSDefaultParameterValues.Remove('Invoke-RestMethod:ProxyUseDefaultCredentials')
}

$actionName = if ($Update) { "Updating" } else { "Installing" }
Write-Host "[ ACTION ] $actionName DiamTek Java Version Manager..." -ForegroundColor Cyan

function Update-Progress {
    param(
        [int]$Percent,
        [string]$Activity
    )
    if ($Quiet) { return }
    $clamped = [math]::Max(0, [math]::Min(100, $Percent))
    $barLength = 30
    $filled = [math]::Floor(($clamped / 100) * $barLength)
    $empty = $barLength - $filled
    $bar = ('=' * $filled) + (' ' * $empty)
    $paddedActivity = $Activity.PadRight(52)
    Write-Host ("`r[ ACTION ] [{0}] {1,3}%  {2}$([char]27)[K" -f $bar, $clamped, $paddedActivity) -NoNewline -ForegroundColor Cyan
}

function Get-FileSha256 {
    param([string]$Path)
    $sha256 = $null
    $stream = $null
    try {
        $sha256 = [System.Security.Cryptography.SHA256]::Create()
        $stream = [System.IO.File]::OpenRead((Resolve-Path -LiteralPath $Path))
        $hashBytes = $sha256.ComputeHash($stream)
        return ([System.BitConverter]::ToString($hashBytes) -replace '-','').ToLower()
    } finally {
        if ($null -ne $stream) { $stream.Close(); $stream.Dispose() }
        if ($null -ne $sha256) { $sha256.Dispose() }
    }
}

function Normalize-PathEntry([string]$p) {
    if (-not $p) { return "" }
    $clean = $p.Trim().Trim('`"').Trim("'").Trim()
    if ($clean.Length -gt 3) {
        return $clean.TrimEnd('\', '/')
    }
    return $clean
}

function Test-HasReparsePointInLineage([string]$TargetPath) {
    if ([string]::IsNullOrWhiteSpace($TargetPath)) { return $false }
    try {
        $curr = [System.IO.Path]::GetFullPath($TargetPath)
        $root = [System.IO.Path]::GetPathRoot($curr)
        while ($curr -and ($curr.TrimEnd('\') -ne $root.TrimEnd('\'))) {
            if (Test-Path -LiteralPath $curr) {
                $item = Get-Item -LiteralPath $curr -Force -ErrorAction Stop
                if ([bool]($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) { return $true }
            }
            $curr = Split-Path -Path $curr -Parent
        }
    } catch { return $true }
    return $false
}

function Initialize-SecureDirectory([string]$DirPath, [switch]$RestrictDacl) {
    if ([string]::IsNullOrWhiteSpace($DirPath)) { throw "Invalid directory path." }
    if (Test-HasReparsePointInLineage $DirPath) {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-59): Reparse point or symlink detected in directory lineage: $DirPath" -ForegroundColor Red
        exit 1
    }
    if (-not (Test-Path -LiteralPath $DirPath)) {
        New-Item -ItemType Directory -Path $DirPath -Force | Out-Null
    }
    if (Test-HasReparsePointInLineage $DirPath) {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-59): Post-creation reparse point detected at: $DirPath" -ForegroundColor Red
        exit 1
    }
    if ($RestrictDacl) {
        $icaclsBin = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) "icacls.exe"
        if (-not (Test-Path -LiteralPath $icaclsBin)) {
            Write-Host ""
            Write-Host "[ ERROR  ] Security policy violation (CWE-276): icacls.exe not found in System32 to enforce directory DACL." -ForegroundColor Red
            exit 1
        }
        & $icaclsBin $DirPath /inheritance:r /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" "$($env:USERNAME):(OI)(CI)F" *> $null
        if ($LASTEXITCODE -ne 0) {
            Write-Host ""
            Write-Host "[ ERROR  ] Security violation (CWE-276): Failed to apply restrictive DACL isolation on secure directory: $DirPath" -ForegroundColor Red
            Write-Host "           icacls.exe DACL restriction returned exit code $LASTEXITCODE" -ForegroundColor Yellow
            exit 1
        }
    }
}

# 1. Determine destination directory
Update-Progress -Percent 5 -Activity "Initializing environment..."

if ($TargetDir) {
    if ($TargetDir -match '\.\.') {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-22): TargetDir cannot contain '..' traversal sequences: $TargetDir" -ForegroundColor Red
        exit 1
    }
    if (Test-HasReparsePointInLineage $TargetDir) {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-59): TargetDir cannot be or traverse a reparse point: $TargetDir" -ForegroundColor Red
        exit 1
    }
}
$normTarget = if ($TargetDir) { [System.IO.Path]::GetFullPath($TargetDir) } else { $null }

if ($DistroDir) {
    if ($DistroDir -match '\.\.') {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-22): DistroDir cannot contain '..' traversal sequences: $DistroDir" -ForegroundColor Red
        exit 1
    }
    if (Test-HasReparsePointInLineage $DistroDir) {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-59): DistroDir cannot be or traverse a reparse point: $DistroDir" -ForegroundColor Red
        exit 1
    }
    if (-not (Test-Path -LiteralPath $DistroDir)) {
        Write-Host ""
        Write-Host "[ ERROR  ] Specified DistroDir does not exist: $DistroDir" -ForegroundColor Red
        exit 1
    }
    $DistroDir = (Resolve-Path -LiteralPath $DistroDir).Path
    $Offline = $true
}

$offlineSourceDir = if ($DistroDir) { $DistroDir } elseif ($PSScriptRoot -and (Test-Path -LiteralPath (Join-Path $PSScriptRoot "jvm.bat"))) { $PSScriptRoot } else { $null }

if ($Offline -and (-not $offlineSourceDir -or -not (Test-Path -LiteralPath (Join-Path $offlineSourceDir "jvm.bat")))) {
    Write-Host ""
    Write-Host "[ ERROR  ] Offline mode specified, but no local jvm.bat found in DistroDir or script directory." -ForegroundColor Red
    exit 1
}

if ($normTarget) {
    $installDir = $normTarget
} else {
    $installDir = "$env:LOCALAPPDATA\DiamTek\JVM\bin"
}

$repoRoot = if ($installDir.EndsWith("\bin", [StringComparison]::OrdinalIgnoreCase)) { Split-Path $installDir -Parent } else { $installDir }
$isDefaultAppDataRoot = $repoRoot.StartsWith("$env:LOCALAPPDATA\DiamTek", [StringComparison]::OrdinalIgnoreCase)
Initialize-SecureDirectory -DirPath $repoRoot -RestrictDacl:$isDefaultAppDataRoot
Initialize-SecureDirectory -DirPath $installDir -RestrictDacl:$isDefaultAppDataRoot
$batPath = Join-Path $installDir "jvm.bat"

if ($Offline) {
    $rawBranch = "offline"
} else {
    Update-Progress -Percent 15 -Activity "Resolving latest release from GitHub..."
    $rawBranch = if ($Branch) { $Branch } else { "" }
    if (-not $rawBranch) {
        if ($Channel -ne "Nightly") {
            $apiRes = $null; $sr = $null
            try {
                $apiReq = [Net.HttpWebRequest]::Create("https://api.github.com/repos/DiamTek/Java-Version-Manager-Windows/releases/latest")
                $apiReq.UserAgent = "DiamTek-JVM"
                $apiReq.Timeout = 3000
                $apiRes = $apiReq.GetResponse()
                $sr = New-Object System.IO.StreamReader($apiRes.GetResponseStream())
                $json = $sr.ReadToEnd()
                if ($json -match '"tag_name":\s*"([^"]+)"') {
                    $rawBranch = $matches[1]
                }
            } catch {
                Write-Verbose "GitHub API release lookup failed: $($_.Exception.Message)"
            } finally {
                if ($null -ne $sr) { $sr.Close(); $sr.Dispose() }
                if ($null -ne $apiRes) { $apiRes.Close() }
            }
            if (-not $rawBranch) {
                $redirRes = $null
                try {
                    $redirReq = [Net.HttpWebRequest]::Create("https://github.com/DiamTek/Java-Version-Manager-Windows/releases/latest")
                    $redirReq.AllowAutoRedirect = $false
                    $redirReq.UserAgent = "DiamTek-JVM"
                    $redirReq.Timeout = 4000
                    $redirRes = $redirReq.GetResponse()
                    $loc = $redirRes.GetResponseHeader("Location")
                    if ($loc -and $loc -match '/releases/tag/([^/]+)$') {
                        $rawBranch = $matches[1]
                    }
                } catch {
                    Write-Verbose "GitHub redirect tag lookup failed: $($_.Exception.Message)"
                } finally {
                    if ($null -ne $redirRes) { $redirRes.Close() }
                }
            }
        }
        if (-not $rawBranch) {
            $apiRes = $null; $sr = $null
            try {
                $apiReq = [Net.HttpWebRequest]::Create("https://api.github.com/repos/DiamTek/Java-Version-Manager-Windows/commits/main")
                $apiReq.UserAgent = "DiamTek-JVM"
                $apiReq.Timeout = 3000
                $apiRes = $apiReq.GetResponse()
                $sr = New-Object System.IO.StreamReader($apiRes.GetResponseStream())
                $json = $sr.ReadToEnd()
                if ($json -match '"sha":\s*"([0-9a-f]{40})"') {
                    $rawBranch = $matches[1]
                }
            } catch {
                $rawBranch = "HEAD"
                Write-Verbose "Falling back to HEAD branch ref: $($_.Exception.Message)"
            } finally {
                if ($null -ne $sr) { $sr.Close(); $sr.Dispose() }
                if ($null -ne $apiRes) { $apiRes.Close() }
            }
        }
    }
}

$cacheBuster = [DateTimeOffset]::UtcNow.Ticks
$noCacheHeaders = @{ 'Cache-Control' = 'no-cache'; 'Pragma' = 'no-cache' }
$url = "https://raw.githubusercontent.com/DiamTek/Java-Version-Manager-Windows/$rawBranch/jvm.bat?t=$cacheBuster"

Update-Progress -Percent 35 -Activity "Fetching core JVM engine..."
if ($Offline) {
    $offlineBatFile = Join-Path $offlineSourceDir "jvm.bat"
    if (Test-HasReparsePointInLineage $offlineBatFile) {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-59): Offline source jvm.bat is a reparse point." -ForegroundColor Red
        exit 1
    }
    $content = [System.IO.File]::ReadAllText($offlineBatFile)
} elseif (-not $Update -and $PSScriptRoot -and (Test-Path (Join-Path $PSScriptRoot "jvm.bat"))) {
    $content = [System.IO.File]::ReadAllText((Join-Path $PSScriptRoot "jvm.bat"))
} else {
    $content = $null
    # If on a tagged release on Stable channel, attempt direct release asset download to preserve exact binary layout
    if ($Channel -ne "Nightly" -and $rawBranch -match '^v?[0-9]') {
        $tempBatPath = "$batPath.tmp.$([System.IO.Path]::GetRandomFileName())"
        try {
            $relUrl = "https://github.com/DiamTek/Java-Version-Manager-Windows/releases/download/$rawBranch/jvm.bat"
            Invoke-WebRequest -Uri $relUrl -Headers $noCacheHeaders -OutFile $tempBatPath -UseBasicParsing -TimeoutSec 10
            if ((Test-Path -LiteralPath $tempBatPath) -and (Get-Item -LiteralPath $tempBatPath).Length -gt 0) {
                $content = [System.IO.File]::ReadAllText($tempBatPath)
            }
        } catch {
            Write-Verbose "Release asset download fallback triggered: $($_.Exception.Message)"
        } finally {
            if ($tempBatPath -and (Test-Path -LiteralPath $tempBatPath)) {
                Remove-Item -LiteralPath $tempBatPath -Force -ErrorAction SilentlyContinue
            }
        }
    }
    if (-not $content) {
        $apiRes = $null; $sr = $null
        try {
            $apiReq = [Net.HttpWebRequest]::Create("https://api.github.com/repos/DiamTek/Java-Version-Manager-Windows/contents/jvm.bat?ref=$rawBranch")
            $apiReq.Method = "GET"
            $apiReq.Timeout = 4000
            $apiReq.UserAgent = "DiamTek-JVM"
            $apiReq.Accept = "application/vnd.github.v3.raw"
            $apiReq.Headers.Add("Cache-Control", "no-cache")
            $apiReq.Headers.Add("Pragma", "no-cache")
            $apiRes = $apiReq.GetResponse()
            $sr = New-Object System.IO.StreamReader($apiRes.GetResponseStream())
            $content = $sr.ReadToEnd()
        } catch {
            try {
                $rawWget = Invoke-WebRequest -Uri $url -Headers $noCacheHeaders -UseBasicParsing -TimeoutSec 5
                $content = if ($rawWget.Content -is [byte[]]) { [System.Text.Encoding]::UTF8.GetString($rawWget.Content) } else { [string]$rawWget.Content }
            } catch {
                Write-Verbose "Raw GitHub download failed: $($_.Exception.Message)"
            }
        } finally {
            if ($null -ne $sr) { $sr.Close(); $sr.Dispose() }
            if ($null -ne $apiRes) { $apiRes.Close() }
        }
    }
}

# 2. Integrity Check
if (-not $content -or $content.Length -eq 0 -or $content -notmatch "rem END OF SCRIPT") {
    Write-Host ""
    Write-Host "[ ERROR  ] Download failed integrity check. File is empty or truncated." -ForegroundColor Red
    exit 1
}

# Fetch SHA256SUMS.txt if on Stable channel / tagged release
$shaHashMap = @{}
if ($Offline) {
    $offlineSums = if ($offlineSourceDir) { Join-Path $offlineSourceDir "SHA256SUMS.txt" } else { $null }
    $offlineManifest = if ($offlineSourceDir) { Join-Path $offlineSourceDir "distro-manifest.json" } else { $null }
    if ($offlineSums -and (Test-Path -LiteralPath $offlineSums)) {
        if (Test-HasReparsePointInLineage $offlineSums) {
            Write-Host ""
            Write-Host "[ ERROR  ] Security violation (CWE-59): Offline SHA256SUMS.txt is a reparse point." -ForegroundColor Red
            exit 1
        }
        try {
            $shaText = [System.IO.File]::ReadAllText($offlineSums)
            foreach ($sLine in ($shaText -split "`r?`n")) {
                if ($sLine -match '^([0-9a-fA-F]{64})\s+[\*]?(.+)$') {
                    $shaHashMap[$matches[2].Trim()] = $matches[1].ToLower()
                }
            }
        } catch {
            Write-Host ""
            Write-Host "[ ERROR  ] Security violation (CWE-354): Failed to parse offline SHA256SUMS.txt: $($_.Exception.Message)" -ForegroundColor Red
            exit 1
        }
    } elseif ($offlineManifest -and (Test-Path -LiteralPath $offlineManifest)) {
        if (Test-HasReparsePointInLineage $offlineManifest) {
            Write-Host ""
            Write-Host "[ ERROR  ] Security violation (CWE-59): Offline distro-manifest.json is a reparse point." -ForegroundColor Red
            exit 1
        }
        try {
            $manJson = Get-Content -LiteralPath $offlineManifest -Raw -Encoding UTF8 | ConvertFrom-Json
            if ($manJson.files) {
                foreach ($fProp in $manJson.files.PSObject.Properties) {
                    $shaHashMap[$fProp.Name] = [string]$fProp.Value.ToLower()
                }
            }
        } catch {
            Write-Host ""
            Write-Host "[ ERROR  ] Security violation (CWE-354): Malformed offline distro-manifest.json: $($_.Exception.Message)" -ForegroundColor Red
            exit 1
        }
    } elseif ($DistroDir -and (-not $SkipIntegrity)) {
        Write-Host ""
        Write-Host "[ ERROR  ] Security violation (CWE-494): DistroDir is missing distro-manifest.json and SHA256SUMS.txt." -ForegroundColor Red
        exit 1
    }
} elseif ($Channel -ne "Nightly" -and $rawBranch -match '^v?[0-9]') {
    try {
        $shaText = $null
        try {
            $resp = Invoke-WebRequest -Uri "https://github.com/DiamTek/Java-Version-Manager-Windows/releases/download/$rawBranch/SHA256SUMS.txt" -Headers $noCacheHeaders -UserAgent "DiamTek-JVM" -UseBasicParsing -TimeoutSec 5
            $shaText = if ($resp.Content -is [byte[]]) { [System.Text.Encoding]::UTF8.GetString($resp.Content) } else { [string]$resp.Content }
        } catch {
            try {
                $shaText = (Invoke-RestMethod -Uri "https://github.com/DiamTek/Java-Version-Manager-Windows/releases/download/$rawBranch/SHA256SUMS.txt" -Headers $noCacheHeaders -UserAgent "DiamTek-JVM" -TimeoutSec 5)
            } catch {
                try {
                    $relJson = (Invoke-RestMethod -Uri "https://api.github.com/repos/DiamTek/Java-Version-Manager-Windows/releases/tags/$rawBranch" -UserAgent "DiamTek-JVM")
                    $asset = $relJson.assets | Where-Object { $_.name -eq "SHA256SUMS.txt" } | Select-Object -First 1
                    if ($asset) {
                        $rawAsset = Invoke-WebRequest -Uri $asset.browser_download_url -UserAgent "DiamTek-JVM" -UseBasicParsing -TimeoutSec 5
                        $shaText = if ($rawAsset.Content -is [byte[]]) { [System.Text.Encoding]::UTF8.GetString($rawAsset.Content) } else { [string]$rawAsset.Content }
                    }
                } catch { Write-Verbose "Release asset SHA256SUMS lookup failed: $($_.Exception.Message)" }
            }
        }
        if ($shaText) {
            foreach ($sLine in ($shaText -split "`r?`n")) {
                if ($sLine -match '^([0-9a-fA-F]{64})\s+[\*]?(.+)$') {
                    $shaHashMap[$matches[2].Trim()] = $matches[1].ToLower()
                }
            }
        }
    } catch { Write-Verbose "SHA256SUMS parsing skipped: $($_.Exception.Message)" }
}

function Remove-ReparsePointOrFail([string]$FilePath) {
    if ([string]::IsNullOrWhiteSpace($FilePath)) { return }
    if (Test-HasReparsePointInLineage $FilePath) {
        if (Test-Path -LiteralPath $FilePath) {
            try {
                $item = Get-Item -LiteralPath $FilePath -Force -ErrorAction Stop
                if ([bool]($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
                    Remove-Item -LiteralPath $FilePath -Force -ErrorAction Stop
                }
            } catch { Write-Verbose "Could not remove existing reparse point at ${FilePath}: $($_.Exception.Message)" }
        }
        if (Test-HasReparsePointInLineage $FilePath) {
            Write-Host ""
            Write-Host "[ ERROR  ] Security violation (CWE-59): Reparse point or symlink detected at path: $FilePath" -ForegroundColor Red
            exit 1
        }
    }
}

function Invoke-TrustedGitHubDownload([string]$Uri, [string]$OutFile, [int]$MaxBytes = 5242880) {
    $allowedHosts = @('github.com', 'raw.githubusercontent.com', 'objects.githubusercontent.com', 'api.github.com', 'release-assets.githubusercontent.com', 'cdn.jsdelivr.net')
    $req = [System.Net.HttpWebRequest]::Create($Uri)
    $req.Method = "GET"
    $req.Timeout = 15000
    $req.ReadWriteTimeout = 15000
    $req.UserAgent = "DiamTek-JVM"
    $req.Headers.Add("Cache-Control", "no-cache")
    $req.Headers.Add("Pragma", "no-cache")
    $res = $null
    try {
        $res = $req.GetResponse()
        $finalUri = $res.ResponseUri
        if (-not $finalUri -or $finalUri.Scheme -ne 'https' -or ($allowedHosts -notcontains $finalUri.Host.ToLowerInvariant())) {
            throw "Security violation (CWE-601): Untrusted redirect host or scheme '$finalUri'"
        }
        if ($res.ContentLength -gt $MaxBytes) {
            throw "Security violation (CWE-400): Payload ContentLength ($($res.ContentLength)) exceeds ceiling ($MaxBytes bytes)"
        }
        $stream = $null
        $fs = $null
        $downloadOk = $false
        try {
            $stream = $res.GetResponseStream()
            $fs = [System.IO.File]::Open($OutFile, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
            $buf = New-Object byte[] 16384
            $total = 0
            while (($read = $stream.Read($buf, 0, $buf.Length)) -gt 0) {
                $total += $read
                if ($total -gt $MaxBytes) {
                    throw "Security violation (CWE-400): Stream exceeded $MaxBytes byte safety ceiling"
                }
                $fs.Write($buf, 0, $read)
            }
            $downloadOk = $true
        } finally {
            if ($null -ne $fs) { $fs.Close(); $fs.Dispose() }
            if ($null -ne $stream) { $stream.Close(); $stream.Dispose() }
            if (-not $downloadOk -and $OutFile -and (Test-Path -LiteralPath $OutFile)) {
                Remove-Item -LiteralPath $OutFile -Force -ErrorAction SilentlyContinue
            }
        }
    } finally {
        if ($null -ne $res) { $res.Close() }
    }
    return ((Test-Path -LiteralPath $OutFile) -and (Get-Item -LiteralPath $OutFile).Length -gt 0)
}

function Test-GitBlobSha1([string]$FilePath, [string]$RemoteRelPath, [string]$RefName) {
    $sha1 = $null
    try {
        $meta = Invoke-RestMethod -Uri "https://api.github.com/repos/DiamTek/Java-Version-Manager-Windows/contents/$RemoteRelPath`?ref=$RefName" -Headers $noCacheHeaders -UserAgent "DiamTek-JVM" -TimeoutSec 5
        if ($meta -and $meta.sha) {
            $expectedGitSha = ([string]$meta.sha).ToLower()
            $sha1 = [System.Security.Cryptography.SHA1]::Create()
            $rawBytes = [System.IO.File]::ReadAllBytes($FilePath)
            $rawText = [System.IO.File]::ReadAllText($FilePath, [System.Text.Encoding]::UTF8)
            $lfBytes = [System.Text.Encoding]::UTF8.GetBytes(($rawText -replace "`r`n", "`n"))
            foreach ($b in @($rawBytes, $lfBytes)) {
                $hdr = [System.Text.Encoding]::ASCII.GetBytes("blob $($b.Length)`0")
                $blob = New-Object byte[] ($hdr.Length + $b.Length)
                [Array]::Copy($hdr, 0, $blob, 0, $hdr.Length)
                [Array]::Copy($b, 0, $blob, $hdr.Length, $b.Length)
                $g = ([System.BitConverter]::ToString($sha1.ComputeHash($blob)) -replace '-', '').ToLower()
                if ($g -eq $expectedGitSha) { return $true }
            }
            return $false
        }
    } catch {
        Write-Verbose "Git blob SHA-1 lookup failed for ${RemoteRelPath}: $($_.Exception.Message)"
    } finally {
        if ($null -ne $sha1) { $sha1.Dispose() }
    }
    return $false
}

Update-Progress -Percent 50 -Activity "Sanitizing code format and encoding..."
$sanitizedContent = ($content -replace "`r?`n", "`r`n").Replace([char]160, ' ')

# Stage to an isolated temporary file first to prevent TOCTOU and avoid clobbering existing installation on failure (CWE-459 / CWE-460)
$stageBat = "$batPath.stage.$([Guid]::NewGuid().ToString('N')).tmp"
$batBackup = "$batPath.bak.$([Guid]::NewGuid().ToString('N')).tmp"
$installCommitted = $false
try {
    [System.IO.File]::WriteAllText($stageBat, $sanitizedContent, (New-Object System.Text.UTF8Encoding($false)))

    # Verify jvm.bat SHA256 integrity on the staged file
    $actualJvmHash = Get-FileSha256 -Path $stageBat
    if ($shaHashMap.ContainsKey("jvm.bat")) {
        $expectedJvmHash = $shaHashMap["jvm.bat"] -replace '^sha256:', ''
        if ($actualJvmHash -ne $expectedJvmHash) {
            Write-Host ""
            Write-Host "[ ERROR  ] Cryptographic integrity check failed for jvm.bat!" -ForegroundColor Red
            Write-Host "           Expected: $expectedJvmHash" -ForegroundColor Red
            Write-Host "           Computed: $actualJvmHash" -ForegroundColor Red
            Write-Host "           Installation aborted to prevent untrusted execution." -ForegroundColor Red
            Remove-Item -LiteralPath $stageBat -Force -ErrorAction SilentlyContinue
            exit 1
        }
    } elseif ($Offline) {
        Write-Verbose "Offline installation: Proceeding with local jvm.bat payload."
    } elseif ($Channel -ne "Nightly" -and $rawBranch -match '^v?[0-9]') {
        Write-Host ""
        Write-Host "[ ERROR  ] Cryptographic integrity manifest (SHA256SUMS.txt) required for official release $rawBranch on Stable channel." -ForegroundColor Red
        Write-Host "           Could not verify jvm.bat hash against release manifest. Aborting installation." -ForegroundColor Red
        Remove-Item -LiteralPath $stageBat -Force -ErrorAction SilentlyContinue
        exit 1
    } else {
        # Nightly or non-tagged release Git-blob SHA-1 integrity verification (CWE-494 / CWE-345)
        if ($SkipIntegrity) {
            Write-Host "[  WARN  ] Security notice: Skipping integrity verification per -SkipIntegrity flag." -ForegroundColor Yellow
        } else {
            $sha1 = $null
            $verifiedNightly = $false
            $nightlyErr = ""
            try {
                $meta = Invoke-RestMethod -Uri "https://api.github.com/repos/DiamTek/Java-Version-Manager-Windows/contents/jvm.bat?ref=$rawBranch" -Headers $noCacheHeaders -UserAgent "DiamTek-JVM" -TimeoutSec 5
                if ($meta -and $meta.sha) {
                    $expectedGitSha = ([string]$meta.sha).ToLower()
                    $sha1 = [System.Security.Cryptography.SHA1]::Create()
                    $rawBytes = [System.IO.File]::ReadAllBytes($stageBat)
                    $lfBytes = [System.Text.Encoding]::UTF8.GetBytes(($sanitizedContent -replace "`r`n", "`n"))
                    $matchedGit = $false
                    $computedGit = ""
                    foreach ($b in @($rawBytes, $lfBytes)) {
                        $hdr = [System.Text.Encoding]::ASCII.GetBytes("blob $($b.Length)`0")
                        $blob = New-Object byte[] ($hdr.Length + $b.Length)
                        [Array]::Copy($hdr, 0, $blob, 0, $hdr.Length)
                        [Array]::Copy($b, 0, $blob, $hdr.Length, $b.Length)
                        $g = ([System.BitConverter]::ToString($sha1.ComputeHash($blob)) -replace '-', '').ToLower()
                        if (-not $computedGit) { $computedGit = $g }
                        if ($g -eq $expectedGitSha) { $matchedGit = $true; break }
                    }
                    if ($matchedGit) {
                        $verifiedNightly = $true
                    } else {
                        Write-Host ""
                        Write-Host "[ ERROR  ] Cryptographic Git blob SHA-1 check failed for Nightly jvm.bat!" -ForegroundColor Red
                        Write-Host "           Expected Git Blob SHA: $expectedGitSha" -ForegroundColor Red
                        Write-Host "           Computed Git Blob SHA: $computedGit" -ForegroundColor Red
                        Remove-Item -LiteralPath $stageBat -Force -ErrorAction SilentlyContinue
                        exit 1
                    }
                } else {
                    $nightlyErr = "No Git blob SHA returned by GitHub API for ref '$rawBranch'."
                }
            } catch {
                $nightlyErr = $_.Exception.Message
            } finally {
                if ($null -ne $sha1) { $sha1.Dispose() }
            }

            if (-not $verifiedNightly) {
                Write-Host ""
                Write-Host "[ ERROR  ] Fail-closed integrity check (CWE-494): Failed to verify Nightly Git blob SHA-1 against GitHub tree." -ForegroundColor Red
                if ($nightlyErr) {
                    Write-Host "           Detail: $nightlyErr" -ForegroundColor Yellow
                }
                Write-Host "           Aborting installation to prevent unverified code execution." -ForegroundColor Red
                Write-Host "           Pass -SkipIntegrity if explicitly overriding in an air-gapped test environment." -ForegroundColor Yellow
                Remove-Item -LiteralPath $stageBat -Force -ErrorAction SilentlyContinue
                exit 1
            }
        }
    }

    # Move verified staged engine into place atomically after verifying target is not a symlink/reparse point
    Remove-ReparsePointOrFail -FilePath $batPath
    if (Test-Path -LiteralPath $batPath) {
        Copy-Item -LiteralPath $batPath -Destination $batBackup -Force -ErrorAction SilentlyContinue
    }
    Move-Item -LiteralPath $stageBat -Destination $batPath -Force

    Update-Progress -Percent 65 -Activity "Fetching documentation, license, & uninstaller..."
    Initialize-SecureDirectory -DirPath $repoRoot -RestrictDacl:$isDefaultAppDataRoot

    $companionFiles = @("LICENSE", "README.md", "uninstall.ps1", "assets/icon.ico", "assets/icon.png")
    foreach ($cf in $companionFiles) {
        $destFile = Join-Path $repoRoot ($cf -replace '/', '\')
        $destDir = Split-Path $destFile -Parent
        Initialize-SecureDirectory -DirPath $destDir -RestrictDacl:$isDefaultAppDataRoot
        Remove-ReparsePointOrFail -FilePath $destFile
        $localSource = if ($offlineSourceDir) {
            Join-Path $offlineSourceDir ($cf -replace '/', '\')
        } elseif ($PSScriptRoot) {
            Join-Path $PSScriptRoot ($cf -replace '/', '\')
        } else { $null }
        if ((-not $Update -or $Offline) -and $localSource -and (Test-Path -LiteralPath $localSource)) {
            if (Test-HasReparsePointInLineage $localSource) {
                Write-Host ""
                Write-Host "[ ERROR  ] Security violation (CWE-59): Companion file source is a reparse point: $localSource" -ForegroundColor Red
                exit 1
            }
            $baseName = Split-Path $destFile -Leaf
            if ($Offline -and $shaHashMap.ContainsKey($baseName) -and (-not $SkipIntegrity)) {
                $actualCfHash = Get-FileSha256 -Path $localSource
                $expectedCfHash = $shaHashMap[$baseName] -replace '^sha256:', ''
                if ($actualCfHash -ne $expectedCfHash) {
                    Write-Host ""
                    Write-Host "[ ERROR  ] Cryptographic integrity check failed for offline $baseName!" -ForegroundColor Red
                    exit 1
                }
            }
            Copy-Item -LiteralPath $localSource -Destination $destFile -Force
            if ($baseName -eq "uninstall.ps1") {
                $uninstShaFile = "$destFile.sha256"
                Remove-ReparsePointOrFail -FilePath $uninstShaFile
                [System.IO.File]::WriteAllText($uninstShaFile, (Get-FileSha256 -Path $destFile), (New-Object System.Text.UTF8Encoding($false)))
            }
        } elseif ($Offline) {
            if ((Split-Path $destFile -Leaf) -eq "uninstall.ps1" -and -not (Test-Path -LiteralPath $destFile)) {
                Write-Host ""
                Write-Host "[ ERROR  ] Offline installation missing uninstaller: $destFile" -ForegroundColor Red
                exit 1
            }
        } else {
            $downloadSuccess = $false
            $baseName = Split-Path $destFile -Leaf
            $stageCf = "$destFile.stage.$([Guid]::NewGuid().ToString('N')).tmp"
            try {
                if ($Channel -ne "Nightly" -and $rawBranch -match '^v?[0-9]' -and @("LICENSE", "README.md", "uninstall.ps1") -contains $baseName) {
                    try {
                        $relAssetUrl = "https://github.com/DiamTek/Java-Version-Manager-Windows/releases/download/$rawBranch/$baseName"
                        $downloadSuccess = Invoke-TrustedGitHubDownload -Uri $relAssetUrl -OutFile $stageCf
                    } catch { Write-Verbose "Release companion download failed for ${baseName}: $($_.Exception.Message)" }
                }
                if (-not $downloadSuccess) {
                    try {
                        $downloadSuccess = Invoke-TrustedGitHubDownload -Uri "https://raw.githubusercontent.com/DiamTek/Java-Version-Manager-Windows/$rawBranch/$cf`?t=$cacheBuster" -OutFile $stageCf
                    } catch {
                        if ($baseName -ne "uninstall.ps1") {
                            try {
                                $downloadSuccess = Invoke-TrustedGitHubDownload -Uri "https://raw.githubusercontent.com/DiamTek/Java-Version-Manager-Windows/HEAD/$cf`?t=$cacheBuster" -OutFile $stageCf
                            } catch {
                                if (-not (Test-Path -LiteralPath $destFile)) {
                                    Write-Host ""
                                    Write-Host "           [WARN] Could not fetch $cf. Proceeding anyway." -ForegroundColor Yellow
                                }
                            }
                        }
                    }
                }
                if ($downloadSuccess -and (Test-Path -LiteralPath $stageCf)) {
                    $verifiedCf = $true
                    if ($shaHashMap.ContainsKey($baseName)) {
                        $actualCfHash = Get-FileSha256 -Path $stageCf
                        $expectedCfHash = $shaHashMap[$baseName] -replace '^sha256:', ''
                        if ($actualCfHash -ne $expectedCfHash) {
                            $verifiedCf = $false
                            Write-Host ""
                            Write-Host "           [ ERROR  ] Integrity check failed for $baseName (SHA256 mismatch)!" -ForegroundColor Red
                            Write-Host "                      Expected: $expectedCfHash" -ForegroundColor Red
                            Write-Host "                      Computed: $actualCfHash" -ForegroundColor Red
                            Remove-Item -LiteralPath $stageCf -Force -ErrorAction SilentlyContinue
                            if ($baseName -eq "uninstall.ps1") {
                                Write-Host "           [ FATAL  ] Security-critical uninstaller failed integrity verification. Aborting." -ForegroundColor Red
                                exit 1
                            }
                        }
                    } elseif ($baseName -eq "uninstall.ps1" -and $Channel -ne "Nightly" -and $rawBranch -match '^v?[0-9]') {
                        $verifiedCf = $false
                        Remove-Item -LiteralPath $stageCf -Force -ErrorAction SilentlyContinue
                        Write-Host ""
                        Write-Host "           [ FATAL  ] Missing SHA-256 entry for security-critical uninstall.ps1 in release manifest. Aborting." -ForegroundColor Red
                        exit 1
                    } elseif ($baseName -eq "uninstall.ps1") {
                        if (-not (Test-GitBlobSha1 -FilePath $stageCf -RemoteRelPath $cf -RefName $rawBranch)) {
                            $verifiedCf = $false
                            Remove-Item -LiteralPath $stageCf -Force -ErrorAction SilentlyContinue
                            Write-Host ""
                            Write-Host "           [ FATAL  ] Cryptographic Git blob SHA-1 check failed for Nightly uninstall.ps1. Aborting." -ForegroundColor Red
                            exit 1
                        }
                    }
                    if ($verifiedCf -and (Test-Path -LiteralPath $stageCf)) {
                        Remove-ReparsePointOrFail -FilePath $destFile
                        Move-Item -LiteralPath $stageCf -Destination $destFile -Force
                        if ($baseName -eq "uninstall.ps1") {
                            $uninstShaFile = "$destFile.sha256"
                            Remove-ReparsePointOrFail -FilePath $uninstShaFile
                            [System.IO.File]::WriteAllText($uninstShaFile, (Get-FileSha256 -Path $destFile), (New-Object System.Text.UTF8Encoding($false)))
                        }
                    }
                }
            } finally {
                if ($stageCf -and (Test-Path -LiteralPath $stageCf)) {
                    Remove-Item -LiteralPath $stageCf -Force -ErrorAction SilentlyContinue
                }
            }
        }
    }
    $installCommitted = $true
} finally {
    if ($stageBat -and (Test-Path -LiteralPath $stageBat)) {
        Remove-Item -LiteralPath $stageBat -Force -ErrorAction SilentlyContinue
    }
    if (-not $installCommitted -and $batBackup -and (Test-Path -LiteralPath $batBackup)) {
        Move-Item -LiteralPath $batBackup -Destination $batPath -Force -ErrorAction SilentlyContinue
    }
    if ($batBackup -and (Test-Path -LiteralPath $batBackup)) {
        Remove-Item -LiteralPath $batBackup -Force -ErrorAction SilentlyContinue
    }
    Get-ChildItem -LiteralPath $repoRoot -Filter "*.stage.*.tmp" -Recurse -Force -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue
}
if ($installDir -ne $repoRoot) {
    $legacyUninstall = Join-Path $installDir "uninstall.ps1"
    if (Test-Path -LiteralPath $legacyUninstall) {
        Remove-Item -LiteralPath $legacyUninstall -Force -ErrorAction SilentlyContinue
    }
}
$channelFile = Join-Path $repoRoot "channel.txt"
Remove-ReparsePointOrFail -FilePath $channelFile
if (-not (Test-Path -LiteralPath $channelFile)) {
    $cVal = if ($Channel -eq "Nightly") { "NIGHTLY" } else { "STABLE" }
    [System.IO.File]::WriteAllText($channelFile, "$cVal`r`n", (New-Object System.Text.UTF8Encoding($false)))
}

$configFile = Join-Path $repoRoot "config.json"
Remove-ReparsePointOrFail -FilePath $configFile
if (-not (Test-Path -LiteralPath $configFile)) {
    $defaultCfg = [ordered]@{
        default_vendor    = "adoptium"
        mode              = "symlink"
        channel           = if ($Channel -eq "Nightly") { "nightly" } else { "stable" }
        auto_update_check = if ($Offline) { $false } else { $true }
        auto_switch       = $true
        color             = $true
        telemetry         = $false
        cache_size        = "2GB"
        retries           = 3
        timeout           = 15
        mirror            = ""
        offline_mode      = [bool]$Offline
    } | ConvertTo-Json -Depth 4
    [System.IO.File]::WriteAllText($configFile, "$defaultCfg`r`n", (New-Object System.Text.UTF8Encoding($false)))
} elseif ($Offline) {
    try {
        $cfgJson = Get-Content -LiteralPath $configFile -Raw -Encoding UTF8 | ConvertFrom-Json
        $cfgJson | Add-Member -NotePropertyName "offline_mode" -NotePropertyValue $true -Force
        $cfgJson.auto_update_check = $false
        [System.IO.File]::WriteAllText($configFile, ($cfgJson | ConvertTo-Json -Depth 4), (New-Object System.Text.UTF8Encoding($false)))
    } catch {
        Write-Verbose "Could not update offline_mode in existing config.json: $($_.Exception.Message)"
    }
}

$cacheDir = Join-Path $repoRoot "cache"
$cacheShaDir = Join-Path $cacheDir "sha256"
Initialize-SecureDirectory -DirPath $cacheDir -RestrictDacl:$isDefaultAppDataRoot
Initialize-SecureDirectory -DirPath $cacheShaDir -RestrictDacl:$isDefaultAppDataRoot
foreach ($subCache in @('jdk', 'maven', 'gradle', 'kotlin')) {
    Initialize-SecureDirectory -DirPath (Join-Path $cacheDir $subCache) -RestrictDacl:$isDefaultAppDataRoot
}

if ($Offline -and $offlineSourceDir) {
    $distroCache = Join-Path $offlineSourceDir "cache"
    if ((Test-Path -LiteralPath $distroCache) -and -not (Test-HasReparsePointInLineage $distroCache)) {
        Copy-Item -LiteralPath "$distroCache\*" -Destination $cacheDir -Recurse -Force -ErrorAction SilentlyContinue
    }
    $distroTools = Join-Path $offlineSourceDir "tools"
    if ((Test-Path -LiteralPath $distroTools) -and -not (Test-HasReparsePointInLineage $distroTools)) {
        $destInstalled = Join-Path $repoRoot "installed"
        Initialize-SecureDirectory -DirPath $destInstalled -RestrictDacl:$isDefaultAppDataRoot
        Copy-Item -LiteralPath "$distroTools\*" -Destination $destInstalled -Recurse -Force -ErrorAction SilentlyContinue
    }
    $distroPayloads = Join-Path $offlineSourceDir "payloads"
    if ((Test-Path -LiteralPath $distroPayloads) -and -not (Test-HasReparsePointInLineage $distroPayloads)) {
        $destBundled = Join-Path $repoRoot "bundled_jdks"
        Initialize-SecureDirectory -DirPath $destBundled -RestrictDacl:$isDefaultAppDataRoot
        if (Test-Path -LiteralPath (Join-Path $distroPayloads "java")) {
            Copy-Item -LiteralPath (Join-Path $distroPayloads "java") -Destination (Join-Path $destBundled "offline-distro") -Recurse -Force -ErrorAction SilentlyContinue
        }
    }
}

$ownershipFile = Join-Path $repoRoot "ownership.json"
try {
    $existingOwn = if (Test-Path -LiteralPath $ownershipFile) {
        Get-Content -LiteralPath $ownershipFile -Raw -Encoding UTF8 | ConvertFrom-Json
    } else { $null }
    $ownedPaths = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
    $ownedVars = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
    if ($existingOwn) {
        if ($existingOwn.path_entries) { foreach ($pe in $existingOwn.path_entries) { $null = $ownedPaths.Add($pe) } }
        if ($existingOwn.variables) { foreach ($v in $existingOwn.variables) { $null = $ownedVars.Add($v) } }
    }
    $null = $ownedPaths.Add((Normalize-PathEntry $installDir))
    $null = $ownedPaths.Add((Normalize-PathEntry (Join-Path $repoRoot "current\bin")))
    $null = $ownedVars.Add("JAVA_HOME")
    $ownObj = [ordered]@{
        version = "1.0.0"
        updated_at = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
        variables = @($ownedVars)
        path_entries = @($ownedPaths)
    }
    [System.IO.File]::WriteAllText($ownershipFile, ($ownObj | ConvertTo-Json -Depth 4), (New-Object System.Text.UTF8Encoding($false)))
} catch {
    Write-Verbose "Ownership tracking initialization warning: $($_.Exception.Message)"
}

# 3. Safe REG_EXPAND_SZ Path Injection
Update-Progress -Percent 80 -Activity "Configuring User PATH..."

$userPath = ""
$existingKind = [Microsoft.Win32.RegistryValueKind]::ExpandString
$envKey = $null
try {
    $envKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey("Environment")
    if ($null -ne $envKey) {
        $raw = $envKey.GetValue("Path", "", [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
        if ($null -ne $raw) { $userPath = [string]$raw }
        $existingKind = try { $envKey.GetValueKind("Path") } catch { [Microsoft.Win32.RegistryValueKind]::ExpandString }
    }
} catch {
    try {
        $userPath = (Get-ItemProperty -Path 'HKCU:\Environment' -Name 'Path' -ErrorAction SilentlyContinue).Path
    } catch { Write-Verbose "Fallback HKCU Path read skipped: $($_.Exception.Message)" }
} finally {
    if ($null -ne $envKey) { $envKey.Close() }
}

$pathArray = @($userPath -split ';' | Where-Object { $_ -ne '' } | ForEach-Object { Normalize-PathEntry $_ })
$normalizedInstallDir = Normalize-PathEntry $installDir

if ($normalizedInstallDir -notin $pathArray) {
    $newPathList = @()
    foreach ($p in ($pathArray + $normalizedInstallDir)) {
        if ($p -and ($newPathList -notcontains $p)) { $newPathList += $p }
    }
    $newPath = $newPathList -join ';'

    # Query Machine PATH to compute effective Combined PATH
    $machinePath = [Environment]::GetEnvironmentVariable('Path', 'Machine')
    $combinedLength = if ($machinePath) { $machinePath.Length + 1 + $newPath.Length } else { $newPath.Length }

    if ($combinedLength -gt 8191) {
        Write-Host ""
        Write-Host "[ ERROR  ] Combined PATH length ($combinedLength chars) exceeds Windows 8191-character limit!" -ForegroundColor Red
        Write-Host "           System PATH ($($machinePath.Length) chars) + User PATH ($($newPath.Length) chars)." -ForegroundColor Red
        Write-Host "           Modification aborted to prevent environment block corruption." -ForegroundColor Red
    } else {
        if ($combinedLength -gt 2048) {
            Write-Host ""
            Write-Host "[ WARNING] Combined PATH length ($combinedLength chars) exceeds 2048 characters (User: $($newPath.Length), System: $($machinePath.Length))." -ForegroundColor Yellow
            Write-Host "           Some legacy Win32 applications may truncate PATH." -ForegroundColor Yellow
        }

        # Preserve REG_SZ only if existing was String and no variable references exist; otherwise enforce ExpandString
        $targetKind = if ($existingKind -eq [Microsoft.Win32.RegistryValueKind]::String -and $newPath -notmatch '%') {
            [Microsoft.Win32.RegistryValueKind]::String
        } else {
            [Microsoft.Win32.RegistryValueKind]::ExpandString
        }

        try {
            Set-ItemProperty -Path 'HKCU:\Environment' -Name 'Path' -Value $newPath -Type $targetKind -Force
        } catch {
            [Microsoft.Win32.Registry]::SetValue("HKEY_CURRENT_USER\Environment", "Path", $newPath, $targetKind)
        }

        # Broadcast WM_SETTINGCHANGE safely
        try {
            if (-not ("Win32.NativeMethods" -as [type])) {
                $code = @'
[DllImport("user32.dll", SetLastError=true, CharSet=CharSet.Auto)]
public static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint Msg, UIntPtr wParam, string lParam, uint fuFlags, uint uTimeout, out UIntPtr lpdwResult);
'@
                Add-Type -MemberDefinition $code -Name NativeMethods -Namespace Win32 -ErrorAction SilentlyContinue
            }
            $HWND_BROADCAST = [IntPtr]0xFFFF
            $WM_SETTINGCHANGE = 0x001A
            $result = [UIntPtr]::Zero
            [Win32.NativeMethods]::SendMessageTimeout($HWND_BROADCAST, $WM_SETTINGCHANGE, [UIntPtr]::Zero, 'Environment', 2, 1000, [ref]$result) | Out-Null
        } catch { Write-Verbose "WM_SETTINGCHANGE broadcast skipped: $($_.Exception.Message)" }
    }
}

# 4. Install PowerShell Profile Hook natively
Update-Progress -Percent 90 -Activity "Configuring PowerShell profile..."
$profileCode = @'
# >>> jvm >>>
function jvm {
    $bat = '__FALLBACK_BAT__'
    if (-not (Test-Path -LiteralPath $bat)) {
        $bat = Get-Command jvm.bat -CommandType Application -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source -First 1
    }

    if (-not $bat -or -not (Test-Path -LiteralPath $bat)) {
        Write-Error "jvm: Java Version Manager is not installed or not in PATH. Please reinstall JVM or restart your terminal."
        return
    }

    # Handle UNC directory paths via pushd
    $isUnc = ($pwd.Provider.Name -eq 'FileSystem' -and $pwd.Path -like '\\*')
    if ($isUnc) {
        pushd -LiteralPath $pwd.Path
        try {
            & $bat @args
        } finally {
            popd
        }
    } else {
        & $bat @args
    }

    function Set-JvmVar {
        param([string]$Name, [string]$OldValue, [string]$NewValue)

        $allowedVars = @('JAVA_HOME', 'MAVEN_HOME', 'GRADLE_HOME', 'KOTLIN_HOME', 'SCALA_HOME', 'GROOVY_HOME', 'ANT_HOME', 'SBT_HOME', 'JBANG_HOME', 'QUARKUS_HOME', 'SPRING_HOME', 'MICRONAUT_HOME')
        if ($allowedVars -notcontains $Name) { return }

        if ($OldValue) { $OldValue = $OldValue.Trim('`"').TrimEnd('\') }
        if ($NewValue) { $NewValue = $NewValue.Trim('`"').TrimEnd('\') }

        # Validate NewValue is a genuine directory and contains no injection characters
        if (-not [string]::IsNullOrWhiteSpace($NewValue)) {
            if ($NewValue -match '[\0;&|<>`"\r\n\$%]') { return }
            if (-not (Test-Path -LiteralPath $NewValue -PathType Container)) { return }

            # Storage boundary enforcement
            $canonicalPath = (Resolve-Path -LiteralPath $NewValue -ErrorAction SilentlyContinue).Path
            $allowedRoots = @(
                "$env:LOCALAPPDATA\DiamTek\JVM",
                "$env:LOCALAPPDATA\JavaVersionManager",
                "$env:ProgramFiles\Java",
                "${env:ProgramFiles(x86)}\Java",
                "$env:USERPROFILE\.jdks"
            )
            $isAllowed = $false
            foreach ($root in $allowedRoots) {
                $normRoot = $root.TrimEnd('\')
                $rootPrefix = $normRoot + '\'
                if ($canonicalPath -and ($canonicalPath.Equals($normRoot, [StringComparison]::OrdinalIgnoreCase) -or $canonicalPath.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase))) {
                    $isAllowed = $true
                    break
                }
            }
            if (-not $isAllowed) { return }
        }

        # CLM-compliant environment update
        Set-Item -Path "env:$Name" -Value $NewValue -Force

        $parts = $env:Path -split ';' | Where-Object { $_ -ne '' }
        if (-not [string]::IsNullOrWhiteSpace($OldValue)) {
            $parts = $parts | Where-Object { $_.TrimEnd('\') -ne "$OldValue\bin" }
        }
        if (-not [string]::IsNullOrWhiteSpace($NewValue)) {
            $parts = $parts | Where-Object { $_.TrimEnd('\') -ne "$NewValue\bin" }
            $parts = @("$NewValue\bin") + $parts
        }
        $env:Path = $parts -join ';'
    }

    $sessionFile = Join-Path $env:LOCALAPPDATA 'DiamTek\JVM\temp\.jvm_session_target'
    if (Test-Path $sessionFile) {
        $lines = Get-Content $sessionFile -ErrorAction SilentlyContinue
        Remove-Item $sessionFile -Force -ErrorAction SilentlyContinue
        foreach ($line in $lines) {
            if ([string]::IsNullOrWhiteSpace($line)) { continue }
            if ($line -match '^([A-Za-z0-9_]+)=(.*)$') {
                $key = $matches[1]
                $val = $matches[2]
            } else {
                $key = 'JAVA_HOME'
                $val = $line
            }
            $old = (Get-Item -Path "env:$key" -ErrorAction SilentlyContinue).Value
            Set-JvmVar -Name $key -OldValue $old -NewValue $val
        }
    } else {
        foreach ($v in @('JAVA_HOME', 'MAVEN_HOME', 'GRADLE_HOME', 'KOTLIN_HOME', 'SCALA_HOME', 'GROOVY_HOME', 'ANT_HOME', 'SBT_HOME', 'JBANG_HOME', 'QUARKUS_HOME', 'SPRING_HOME', 'MICRONAUT_HOME')) {
            $old = (Get-Item -Path "env:$v" -ErrorAction SilentlyContinue).Value
            $new = (Get-ItemProperty -Path 'HKCU:\Environment' -Name $v -ErrorAction SilentlyContinue).$v
            if ([string]::IsNullOrEmpty($new)) {
                $new = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -Name $v -ErrorAction SilentlyContinue).$v
            }
            if ($old -eq $new) { continue }
            Set-JvmVar -Name $v -OldValue $old -NewValue $new
        }
    }
}

# --- Automatic Directory Environment Switching Hook ---
if (-not $global:__jvm_original_prompt) {
    $global:__jvm_original_prompt = $function:prompt
    $global:__jvm_prev_pwd = ''
    $global:__jvm_host_state = @{}
    
    function global:prompt {
        $curr = $pwd.Path
        if ($curr -ne $global:__jvm_prev_pwd) {
            $global:__jvm_prev_pwd = $curr
            $marker = $null
            if (Test-Path (Join-Path $curr '.jvm.toml')) { $marker = Join-Path $curr '.jvm.toml' }
            elseif (Test-Path (Join-Path $curr '.jvmrc')) { $marker = Join-Path $curr '.jvmrc' }
            elseif (Test-Path (Join-Path $curr '.java-version')) { $marker = Join-Path $curr '.java-version' }

            if ($marker) {
                if ($global:__jvm_host_state.Count -eq 0) {
                    $global:__jvm_host_state['JAVA_HOME'] = $env:JAVA_HOME
                    $global:__jvm_host_state['PATH'] = $env:Path
                }
                jvm --session
            } elseif ($global:__jvm_host_state.Count -gt 0) {
                # Restore previous host environment state upon leaving project boundaries
                if ($global:__jvm_host_state.ContainsKey('JAVA_HOME')) {
                    $env:JAVA_HOME = $global:__jvm_host_state['JAVA_HOME']
                }
                if ($global:__jvm_host_state.ContainsKey('PATH')) {
                    $env:Path = $global:__jvm_host_state['PATH']
                }
                $global:__jvm_host_state.Clear()
            }
        }
        if ($global:__jvm_original_prompt) { & $global:__jvm_original_prompt } else { "PS $pwd> " }
    }
}

if (Get-Command Register-ArgumentCompleter -ErrorAction SilentlyContinue) {
    Register-ArgumentCompleter -Native -CommandName @('jvm', 'jvm.bat', '.\jvm.bat') -ScriptBlock {
        param($wordToComplete, $commandAst, $cursorPosition)
        $subcommands = @(
            'list', 'ls', 'install', 'uninstall', 'rm', 'remove', 'use', 'default',
            'pin', 'local', 'current', 'status', 'info', 'whoami', 'which', 'path',
            'doctor', 'check', 'clean', 'prune', 'clear', 'update', 'self-update',
            'self-uninstall', 'open', 'home', 'exec', 'run', 'env', 'hook',
            'link', 'unlink', 'version', 'help', 'channel', 'lock', 'verify', 'transaction', 'txn',
            'config', 'project', 'cache', 'search', 'compare', 'list-remote',
            'why', 'explain', 'welcome', 'tutorial', 'report', 'support', 'vendor',
            'policy', 'freeze', 'thaw', 'aliases', 'ecosystem',
            'profile', 'profiles', 'snapshot', 'snapshots', 'bundle', 'bundles', 'distro', 'distribution'
        )
        $candidates = @('java', 'maven', 'gradle', 'kotlin', 'scala', 'groovy', 'ant', 'sbt', 'jbang', 'quarkus', 'spring', 'micronaut', 'mn')
        $vendors = @('adoptium', 'temurin', 'oracle', 'corretto', 'zulu', 'microsoft', 'graalvm', 'liberica', 'bellsoft', 'semeru', 'ibm', 'openj9', 'sapmachine', 'sap', 'mandrel', 'redhat-mandrel', 'dragonwell', 'alibaba', 'kona', 'tencent')
        $openTargets = @('home', 'dir', 'bin', 'config', 'cache', 'downloads', 'backup', 'backups', 'links', 'maven', 'gradle', 'kotlin', 'scala', 'groovy', 'ant', 'sbt', 'jbang', 'quarkus', 'spring', 'micronaut', 'mn')
        $hookTargets = @('install', 'status', 'check', 'remove', 'uninstall', 'cmd')
        $flags = @(
            '--vendor', '--symlink', '--registry', '--legacy', '--session', '--global',
            '--skip-checksum', '--no-verify', '--latest', '--yes', '-y', '--no-color',
            '--offline', '--json', '--no-lock', '--locked', '-l',
            '--check', '--diff', '--update', '--fix', '--dry-run',
            '--quiet', '-q', '--verbose',
            '--channel', '-c', '--nightly', '--stable', '--security', '--bundle', '--mirror',
            '--short', '--numeric', '--bin', '--stats', '--rollback', '--history', '--report',
            '--freeze', '--thaw', '--sign', '--verify',
            '--secret', '--key-file', '--include-payloads',
            '--desc', '--out', '--distro-dir',
            '--java', '--maven', '--gradle', '--kotlin', '--scala', '--groovy', '--ant', '--sbt', '--jbang', '--quarkus', '--spring', '--micronaut', '--mn',
            '--timings', '--version', '-v', '--help', '-h'
        )

        $elements = @($commandAst.CommandElements | ForEach-Object { $_.Extent.Text })
        $count = $elements.Count
        $prev = if ($wordToComplete -and $count -ge 2) { $elements[-2] } elseif (-not $wordToComplete -and $count -ge 1) { $elements[-1] } else { '' }

        $completions = @()
        if ($prev -in @('--vendor')) {
            $completions = $vendors
        } elseif ($prev -in @('channel', '--channel')) {
            $completions = @('stable', 'nightly')
        } elseif ($prev -in @('open', 'home')) {
            $completions = $openTargets
        } elseif ($prev -in @('hook')) {
            $completions = $hookTargets
        } elseif ($prev -in @('policy')) {
            $completions = @('show', 'check')
        } elseif ($prev -in @('aliases')) {
            $completions = @('--install')
        } elseif ($prev -in @('help')) {
            $completions = $subcommands
        } elseif ($prev -in @('profile', 'profiles')) {
            $completions = @('create', 'use', 'activate', 'list', 'ls', 'show', 'clone', 'delete', 'rm')
        } elseif ($prev -in @('snapshot', 'snapshots')) {
            $completions = @('create', 'restore', 'list', 'ls', 'delete', 'rm')
        } elseif ($prev -in @('bundle', 'bundles')) {
            $completions = @('create', 'inspect', 'install', 'list', 'ls')
        } elseif ($prev -in @('distro', 'distribution')) {
            $completions = @('create')
        } elseif ($prev -in @('lock')) {
            $completions = @('check', 'diff', 'update', 'sign', 'verify', 'freeze', 'thaw')
        } elseif ($prev -in @('use', 'default', 'pin', 'local', 'uninstall', 'rm', 'remove', 'which', 'path')) {
            $installed = @()
            $linksDir = "$env:LOCALAPPDATA\JavaVersionManager\links"
            if (Test-Path -LiteralPath $linksDir) {
                $installed += @(Get-ChildItem -LiteralPath $linksDir -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Name)
            }
            $jdksDir = "$env:USERPROFILE\.jdks"
            if (Test-Path -LiteralPath $jdksDir) {
                $installed += @(Get-ChildItem -LiteralPath $jdksDir -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Name)
            }
            $completions = @($installed | Select-Object -Unique) + $candidates
        } elseif ($wordToComplete -like '-*') {
            $completions = $flags
        } else {
            $completions = $subcommands + $candidates + $flags
        }

        $completions | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
            [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
        }
    }
}
# <<< jvm <<<
'@

$batPathEscaped = $batPath.Replace("'", "''")
$profileCode = $profileCode.Replace('__FALLBACK_BAT__', $batPathEscaped)

$userProfile = [Environment]::GetFolderPath('UserProfile')
$myDocs = [Environment]::GetFolderPath('MyDocuments')
$regDocs = (Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' -Name 'Personal' -ErrorAction SilentlyContinue).Personal
$expandedDocs = if ($regDocs) { [System.Environment]::ExpandEnvironmentVariables($regDocs) } else { $null }

$profiles = @(
    $PROFILE,
    (Join-Path $userProfile 'Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'),
    (Join-Path $userProfile 'Documents\PowerShell\Microsoft.PowerShell_profile.ps1'),
    (Join-Path $myDocs 'WindowsPowerShell\Microsoft.PowerShell_profile.ps1'),
    (Join-Path $myDocs 'PowerShell\Microsoft.PowerShell_profile.ps1')
)
if ($expandedDocs) {
    $profiles += (Join-Path $expandedDocs 'WindowsPowerShell\Microsoft.PowerShell_profile.ps1')
    $profiles += (Join-Path $expandedDocs 'PowerShell\Microsoft.PowerShell_profile.ps1')
}
$profiles = $profiles | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -Unique

$utf8NoBom = New-Object System.Text.UTF8Encoding($false)
foreach ($p in $profiles) {
    if ([string]::IsNullOrWhiteSpace($p)) { continue }
    $stageProf = $null
    try {
        if (Test-HasReparsePointInLineage $p) { continue }
        $profileDir = Split-Path -Path $p -Parent
        if (-not (Test-Path -LiteralPath $profileDir)) { New-Item -ItemType Directory -Path $profileDir -Force -ErrorAction SilentlyContinue | Out-Null }
        if (Test-HasReparsePointInLineage $profileDir) { continue }
        $profContent = ''
        if (Test-Path -LiteralPath $p) {
            if (Test-HasReparsePointInLineage $p) { continue }
            $profContent = [System.IO.File]::ReadAllText($p, [System.Text.Encoding]::UTF8)
        }

        $blockPattern = '(?s)# >>> jvm >>>.*?# <<< jvm <<<'
        $m = [Regex]::Match($profContent, $blockPattern)
        if ($m.Success) {
            $profContent = $profContent.Substring(0, $m.Index) + $profileCode + $profContent.Substring($m.Index + $m.Length)
        } else {
            $profContent = if ([string]::IsNullOrWhiteSpace($profContent)) { $profileCode } else { "$profContent`r`n`r`n$profileCode" }
        }
        $stageProf = "$p.stage.$([Guid]::NewGuid().ToString('N')).tmp"
        [System.IO.File]::WriteAllText($stageProf, $profContent, $utf8NoBom)
        if (-not (Test-HasReparsePointInLineage $p)) {
            Move-Item -LiteralPath $stageProf -Destination $p -Force
        }
    } catch {
        Write-Verbose "Profile hook update skipped for ${p}: $($_.Exception.Message)"
    } finally {
        if ($stageProf -and (Test-Path -LiteralPath $stageProf)) {
            Remove-Item -LiteralPath $stageProf -Force -ErrorAction SilentlyContinue
        }
    }
}

# 4b. Configure CMD AutoRun Hook
try {
    $cmdHookPath = Join-Path $installDir "cmd_hook.cmd"
    Remove-ReparsePointOrFail -FilePath $cmdHookPath
    $cmdHookContent = @'
@echo off
if not defined CMDCMDLINE exit /b 0
set "_JVM_SYS32=%SystemRoot%\System32"
if not exist "%_JVM_SYS32%" set "_JVM_SYS32=%WINDIR%\System32"

if exist "%_JVM_SYS32%\find.exe" (
    echo %CMDCMDLINE% | "%_JVM_SYS32%\find.exe" /i " /c " >nul && exit /b 0
    echo %CMDCMDLINE% | "%_JVM_SYS32%\find.exe" /i " /c\"" >nul && exit /b 0
)

if defined __JVM_CMD_HOOK_ACTIVE exit /b 0
set "__JVM_CMD_HOOK_ACTIVE=1"

if exist "%_JVM_SYS32%\doskey.exe" (
    "%_JVM_SYS32%\doskey.exe" cd=call "%LOCALAPPDATA%\DiamTek\JVM\bin\jvm.bat" --session-cd $* >nul 2>&1
)
set "_JVM_SYS32="
'@
    [System.IO.File]::WriteAllText($cmdHookPath, ($cmdHookContent -replace "`r?`n", "`r`n"), $utf8NoBom)
    if (-not $TargetDir) {
        $cmdRegPath = "HKCU:\Software\Microsoft\Command Processor"
        if (-not (Test-Path -LiteralPath $cmdRegPath)) { New-Item -Path $cmdRegPath -Force | Out-Null }
        $existingAutoRun = (Get-ItemProperty -Path $cmdRegPath -Name "AutoRun" -ErrorAction SilentlyContinue).AutoRun
        $safeHookCmd = "if exist `"$cmdHookPath`" call `"$cmdHookPath`""
        if (-not $existingAutoRun -or $existingAutoRun -notmatch '(?i)cmd_hook\.cmd') {
            $newAutoRun = if ($existingAutoRun) { "$existingAutoRun & $safeHookCmd" } else { $safeHookCmd }
            Set-ItemProperty -Path $cmdRegPath -Name "AutoRun" -Value $newAutoRun -Type String -Force
        }
    }
} catch {
    Write-Verbose "CMD AutoRun hook registration skipped: $($_.Exception.Message)"
}

# 5. Register Windows Uninstaller & Start Menu Shortcuts
Update-Progress -Percent 96 -Activity "Registering Windows uninstaller & shortcuts..."
try {
    # Windows Settings / Control Panel 'Installed Apps' Registration
    $uninstallRegPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\DiamTek.JVM"
    if (-not (Test-Path $uninstallRegPath)) { New-Item -Path $uninstallRegPath -Force | Out-Null }
    
    $sys32Dir = [Environment]::GetFolderPath([Environment+SpecialFolder]::System)
    $systemPowerShell = Join-Path $sys32Dir "WindowsPowerShell\v1.0\powershell.exe"
    if (-not (Test-Path -LiteralPath $systemPowerShell)) {
        throw "Trusted Windows PowerShell binary not found at $systemPowerShell"
    }
    $uninstallScriptPath = Join-Path $repoRoot "uninstall.ps1"
    $uninstallCommand = "`"$systemPowerShell`" -NoProfile -ExecutionPolicy Bypass -File `"$uninstallScriptPath`""
    $quietUninstallCommand = "`"$systemPowerShell`" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$uninstallScriptPath`" -Quiet"
    
    $displayVer = "1.0.1"
    if (Test-Path -LiteralPath $batPath) {
        $batHead = Get-Content -LiteralPath $batPath -Raw -ErrorAction SilentlyContinue
        if ($batHead -match 'set\s+"JVM_VERSION=(.*?)"') {
            $displayVer = $matches[1].Trim()
        }
    }

    Set-ItemProperty -Path $uninstallRegPath -Name "DisplayName" -Value "DiamTek Java Version Manager"
    Set-ItemProperty -Path $uninstallRegPath -Name "DisplayVersion" -Value $displayVer
    Set-ItemProperty -Path $uninstallRegPath -Name "Publisher" -Value "DiamTek / Alexéy Shishkin"
    Set-ItemProperty -Path $uninstallRegPath -Name "InstallLocation" -Value $repoRoot
    Set-ItemProperty -Path $uninstallRegPath -Name "UninstallString" -Value $uninstallCommand
    Set-ItemProperty -Path $uninstallRegPath -Name "QuietUninstallString" -Value $quietUninstallCommand
    $iconPath = Join-Path $repoRoot "assets\icon.ico"
    if (-not (Test-Path -LiteralPath $iconPath)) { $iconPath = Join-Path $repoRoot "icon.ico" }
    if (-not (Test-Path -LiteralPath $iconPath)) { $iconPath = Join-Path $sys32Dir "shell32.dll,27" }

    Set-ItemProperty -Path $uninstallRegPath -Name "DisplayIcon" -Value $iconPath
    Set-ItemProperty -Path $uninstallRegPath -Name "URLInfoAbout" -Value "https://diamtek.github.io/Java-Version-Manager-Windows"
    Set-ItemProperty -Path $uninstallRegPath -Name "HelpLink" -Value "https://github.com/DiamTek/Java-Version-Manager-Windows/issues"
    Set-ItemProperty -Path $uninstallRegPath -Name "NoModify" -Value 1 -Type DWord
    Set-ItemProperty -Path $uninstallRegPath -Name "NoRepair" -Value 1 -Type DWord

    $totalBytes = (Get-ChildItem -LiteralPath $repoRoot -Recurse -File -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum).Sum
    $dotJvm = Join-Path $env:USERPROFILE ".jvm"
    if (Test-Path -LiteralPath $dotJvm) {
        $totalBytes += (Get-ChildItem -LiteralPath $dotJvm -Recurse -File -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum).Sum
    }
    $estimatedSizeKB = [math]::Max(1024, [int][math]::Ceiling($totalBytes / 1KB))
    Set-ItemProperty -Path $uninstallRegPath -Name "EstimatedSize" -Value $estimatedSizeKB -Type DWord

    # Windows Terminal Profile Registration (if Windows Terminal is installed)
    $wtProfileAdded = $false
    $wtSettingsCandidates = @(
        "$env:LOCALAPPDATA\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json",
        "$env:LOCALAPPDATA\Packages\Microsoft.WindowsTerminalPreview_8wekyb3d8bbwe\LocalState\settings.json",
        "$env:LOCALAPPDATA\Microsoft\Windows Terminal\settings.json"
    )
    foreach ($wtSettings in $wtSettingsCandidates) {
        if (Test-Path -LiteralPath $wtSettings) {
            $stageWt = $null
            try {
                if (Test-HasReparsePointInLineage $wtSettings) { continue }
                $maxRetries = 5
                $retryDelayMs = 150
                $wtContent = $null
                for ($attempt = 1; $attempt -le $maxRetries; $attempt++) {
                    try {
                        $fs = [System.IO.File]::Open($wtSettings, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::ReadWrite)
                        try {
                            $sr = New-Object System.IO.StreamReader($fs, [System.Text.Encoding]::UTF8)
                            try { $wtContent = $sr.ReadToEnd() } finally { $sr.Close(); $sr.Dispose() }
                        } finally { $fs.Close(); $fs.Dispose() }
                        break
                    } catch [System.IO.IOException] {
                        if ($attempt -lt $maxRetries) { Start-Sleep -Milliseconds $retryDelayMs } else { throw }
                    }
                }
                if (-not $wtContent) { continue }
                # Strip JSONC comments (block comments /* ... */ and line comments // ...) while preserving strings, and strip trailing commas
                $jsoncPattern = '(?s)("(?:\\.|[^"\\])*")|/\*.*?\*/|(?m)//.*$'
                $cleanJson = [System.Text.RegularExpressions.Regex]::Replace($wtContent, $jsoncPattern, { param($m) if ($m.Groups[1].Success) { $m.Groups[1].Value } else { '' } }) -replace ',\s*([\}\]])', '$1'
                $wtJson = $cleanJson | ConvertFrom-Json
                if ($wtJson.profiles -and $wtJson.profiles.list) {
                    $existing = $wtJson.profiles.list | Where-Object { $_.guid -eq '{b20650a4-4212-4d64-9edf-744e9285e2be}' -or $_.name -eq 'Java Version Manager' }
                    if (-not $existing) {
                        $newProfile = [PSCustomObject]@{
                            commandline       = 'cmd.exe /c "%LOCALAPPDATA%\DiamTek\JVM\bin\jvm.bat"'
                            guid              = '{b20650a4-4212-4d64-9edf-744e9285e2be}'
                            hidden            = $false
                            icon              = '%LOCALAPPDATA%\DiamTek\JVM\assets\icon.png'
                            name              = 'Java Version Manager'
                            startingDirectory = '%USERPROFILE%'
                            closeOnExit       = 'always'
                        }
                        $profileList = [System.Collections.Generic.List[object]]@($wtJson.profiles.list)
                        $profileList.Add($newProfile)
                        $wtJson.profiles.list = $profileList
                        $newWtContent = $wtJson | ConvertTo-Json -Depth 32
                        $stageWt = "$wtSettings.stage.$([Guid]::NewGuid().ToString('N')).tmp"
                        [System.IO.File]::WriteAllText($stageWt, $newWtContent, $utf8NoBom)
                        $wtBak = "$wtSettings.bak"
                        Copy-Item -LiteralPath $wtSettings -Destination $wtBak -Force -ErrorAction SilentlyContinue
                        for ($mAttempt = 1; $mAttempt -le $maxRetries; $mAttempt++) {
                            try {
                                if (-not (Test-HasReparsePointInLineage $wtSettings)) {
                                    Move-Item -LiteralPath $stageWt -Destination $wtSettings -Force
                                    $wtProfileAdded = $true
                                }
                                break
                            } catch [System.IO.IOException] {
                                if ($mAttempt -lt $maxRetries) { Start-Sleep -Milliseconds $retryDelayMs } else { throw }
                            }
                        }
                    } else {
                        $existing.commandline = 'cmd.exe /c "%LOCALAPPDATA%\DiamTek\JVM\bin\jvm.bat"'
                        $existing | Add-Member -NotePropertyName "closeOnExit" -NotePropertyValue "always" -Force
                        $newWtContent = $wtJson | ConvertTo-Json -Depth 32
                        $stageWt = "$wtSettings.stage.$([Guid]::NewGuid().ToString('N')).tmp"
                        [System.IO.File]::WriteAllText($stageWt, $newWtContent, $utf8NoBom)
                        $wtBak = "$wtSettings.bak"
                        Copy-Item -LiteralPath $wtSettings -Destination $wtBak -Force -ErrorAction SilentlyContinue
                        for ($mAttempt = 1; $mAttempt -le $maxRetries; $mAttempt++) {
                            try {
                                if (-not (Test-HasReparsePointInLineage $wtSettings)) {
                                    Move-Item -LiteralPath $stageWt -Destination $wtSettings -Force
                                    $wtProfileAdded = $true
                                }
                                break
                            } catch [System.IO.IOException] {
                                if ($mAttempt -lt $maxRetries) { Start-Sleep -Milliseconds $retryDelayMs } else { throw }
                            }
                        }
                    }
                }
            } catch {
                Write-Verbose "Windows Terminal settings.json update skipped: $($_.Exception.Message)"
            } finally {
                if ($stageWt -and (Test-Path -LiteralPath $stageWt)) {
                    Remove-Item -LiteralPath $stageWt -Force -ErrorAction SilentlyContinue
                }
            }
        }
    }

    $sysCmd = Join-Path $sys32Dir "cmd.exe"
    if (-not (Test-Path -LiteralPath $sysCmd)) {
        throw "Trusted cmd.exe binary not found at $sysCmd"
    }
    $wtCandidate = Join-Path $env:LOCALAPPDATA "Microsoft\WindowsApps\wt.exe"
    $hasWt = $wtProfileAdded -and (Test-Path -LiteralPath $wtCandidate) -and (-not (Test-HasReparsePointInLineage $wtCandidate))
    $targetPath = if ($hasWt) { $wtCandidate } else { $sysCmd }
    $targetArgs = if ($hasWt) { "-p `"Java Version Manager`"" } else { "/c `"$batPath`"" }

    # Start Menu Shortcuts
    $startMenuPrograms = [Environment]::GetFolderPath('Programs')
    if (Test-HasReparsePointInLineage $startMenuPrograms) {
        throw "Refusing to create Start Menu shortcuts because parent directory is a reparse point: $startMenuPrograms"
    }
    $startMenuDir = Join-Path $startMenuPrograms "DiamTek"
    if (-not (Test-Path -LiteralPath $startMenuDir)) { New-Item -ItemType Directory -Path $startMenuDir -Force | Out-Null }
    if (Test-HasReparsePointInLineage $startMenuDir) {
        throw "Refusing to create Start Menu shortcuts in reparse-point directory: $startMenuDir"
    }
    
    $wshell = $null
    $appShortcut = $null
    $tbShortcut = $null
    $shortcut = $null
    try {
        $wshell = New-Object -ComObject WScript.Shell
        $appShortcut = $wshell.CreateShortcut((Join-Path $startMenuDir "Java Version Manager.lnk"))
        $appShortcut.TargetPath = $targetPath
        $appShortcut.Arguments = $targetArgs
        $appShortcut.IconLocation = $iconPath
        $appShortcut.Description = "DiamTek Java Version Manager"
        $appShortcut.WorkingDirectory = $repoRoot
        $appShortcut.Save()

        # Update pinned Taskbar shortcut if it exists
        $taskbarLnk = Join-Path $env:APPDATA "Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Java Version Manager.lnk"
        if ((Test-Path -LiteralPath $taskbarLnk) -and (-not (Test-HasReparsePointInLineage $taskbarLnk))) {
            $tbShortcut = $wshell.CreateShortcut($taskbarLnk)
            $tbShortcut.TargetPath = $targetPath
            $tbShortcut.Arguments = $targetArgs
            $tbShortcut.IconLocation = $iconPath
            $tbShortcut.WorkingDirectory = $repoRoot
            $tbShortcut.Save()
            (Get-Item -LiteralPath $taskbarLnk).LastWriteTime = Get-Date
        }

        $shortcut = $wshell.CreateShortcut((Join-Path $startMenuDir "Uninstall Java Version Manager.lnk"))
        $shortcut.TargetPath = $systemPowerShell
        $shortcut.Arguments = "-NoProfile -ExecutionPolicy Bypass -File `"$uninstallScriptPath`""
        $shortcut.IconLocation = Join-Path ([Environment]::GetFolderPath([Environment+SpecialFolder]::System)) "shell32.dll,31"
        $shortcut.Description = "Uninstall DiamTek Java Version Manager"
        $shortcut.WorkingDirectory = $sys32Dir
        $shortcut.Save()
    } finally {
        if ($null -ne $shortcut) { [System.Runtime.InteropServices.Marshal]::FinalReleaseComObject($shortcut) | Out-Null }
        if ($null -ne $tbShortcut) { [System.Runtime.InteropServices.Marshal]::FinalReleaseComObject($tbShortcut) | Out-Null }
        if ($null -ne $appShortcut) { [System.Runtime.InteropServices.Marshal]::FinalReleaseComObject($appShortcut) | Out-Null }
        if ($null -ne $wshell) {
            [System.Runtime.InteropServices.Marshal]::ReleaseComObject($wshell) | Out-Null
            [System.Runtime.InteropServices.Marshal]::FinalReleaseComObject($wshell) | Out-Null
        }
        [System.GC]::Collect()
    }
} catch {
    $safeErr = ($_.Exception.Message -replace '[\r\n]+', ' ')
    if ($env:LOCALAPPDATA) { $safeErr = $safeErr.Replace($env:LOCALAPPDATA, '%LOCALAPPDATA%') }
    if ($env:USERPROFILE)  { $safeErr = $safeErr.Replace($env:USERPROFILE, '%USERPROFILE%') }
    Write-Host ""
    Write-Host "           [WARN] Could not register uninstaller shortcut: $safeErr" -ForegroundColor Yellow
}

Update-Progress -Percent 100 -Activity "Finalizing setup..."
Write-Host ""

if ($Update) {
    Write-Host "`n[   OK   ] Update Complete!" -ForegroundColor Green
} else {
    Write-Host "`n[   OK   ] Installation Complete!" -ForegroundColor Green
    Write-Host "           Open a new terminal and type 'jvm' to start.`n"
}