@echo off
REM ============================================================
REM  DFCode - fix "running scripts is disabled on this system"
REM  Double-click me. Nothing is downloaded. No admin needed.
REM
REM  Fixes this symptom:
REM    dfcode : File C:\Users\<you>\AppData\Roaming\npm\dfcode.ps1
REM    cannot be loaded because running scripts is disabled on this system.
REM    zh-CN: dfcode : Wu Fa Jia Zai Wen Jian ... Jin Zhi Yun Xing Jiao Ben
REM
REM  Why: npm creates dfcode.ps1 next to dfcode.cmd, PowerShell prefers the
REM  .ps1, and Windows ships with ExecutionPolicy=Restricted, which forbids
REM  every script file. This sets the CURRENT USER policy to RemoteSigned.
REM
REM  MAINTAINERS - TWO RULES, DO NOT BREAK THEM:
REM   1) Never use -File and never call a .ps1 from here. A machine that
REM      "cannot run scripts" cannot run our fix script either. -Command is
REM      not a script file, so it is immune to the execution policy.
REM   2) Never pass -ExecutionPolicy. That flag sets Process scope, which
REM      outranks CurrentUser and is inherited by children - it would poison
REM      every measurement below and make this tool always report success.
REM
REM  ASCII-only on purpose (cmd.exe codepage safety).
REM  Chinese explanation: see Q13 of the "Deng Lu Bu Shu" doc on the site.
REM ============================================================
setlocal
set "FIXVER=2026.09.07"

REM Drop any inherited Process-scope policy so every probe below measures the
REM REAL policy that a normal user window would get.
set "PSExecutionPolicyPreference="

REM Shared program, run once per host (Windows PowerShell 5.1 and pwsh 7).
REM Computes the effective policy the way the engine does, but with the
REM Process row excluded; refuses to write when Group Policy locks it.
set "FIXPS=$r=Get-ExecutionPolicy -List; $e=''; foreach($s in 'MachinePolicy','UserPolicy','CurrentUser','LocalMachine'){ if($e -eq ''){ foreach($x in $r){ if((([string]$x.Scope) -eq $s) -and (([string]$x.ExecutionPolicy) -ne 'Undefined')){ $e=[string]$x.ExecutionPolicy } } } }; if($e -eq ''){ $e='Restricted' }; $g=''; foreach($x in $r){ if(((([string]$x.Scope) -eq 'MachinePolicy') -or (([string]$x.Scope) -eq 'UserPolicy')) -and (((([string]$x.ExecutionPolicy) -eq 'Restricted')) -or ((([string]$x.ExecutionPolicy) -eq 'AllSigned')))){ $g=([string]$x.Scope)+'='+([string]$x.ExecutionPolicy) } }; if(('RemoteSigned','Unrestricted','Bypass') -contains $e){ Write-Host ('    [OK] policy is already '+$e+' - nothing to change'); exit 0 }; if($g -ne ''){ Write-Host ('    [X] locked by Group Policy ('+$g+') - this machine cannot be fixed locally'); exit 3 }; try{ Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -Force -ErrorAction Stop }catch{ Write-Host ('    [X] could not set policy: '+$_.FullyQualifiedErrorId); exit 2 }; Write-Host '    [OK] CurrentUser policy set to RemoteSigned (your account only, no admin)'; exit 0"

echo ============================================================
echo   DFCode - PowerShell execution policy fix   v%FIXVER%
echo ============================================================
echo.
echo [*] Step 1/4: policy before the fix
powershell -NoProfile -NonInteractive -Command "Get-ExecutionPolicy -List | Format-Table -AutoSize | Out-String -Width 78"

echo [*] Step 2/4: fixing Windows PowerShell (5.1)
powershell -NoProfile -NonInteractive -Command "%FIXPS%"
set "RC51=%errorlevel%"

echo [*] Step 3/4: fixing PowerShell 7 (pwsh), if installed
where pwsh >nul 2>nul
if errorlevel 1 (
  echo     [-] pwsh not installed - skipped
) else (
  pwsh -NoProfile -NonInteractive -Command "%FIXPS%"
)

echo [*] Step 4/4: verifying that dfcode actually starts
powershell -NoProfile -NonInteractive -Command "dfcode --version"
set "RCRUN=%errorlevel%"

echo.
echo ------------------------------------------------------------
if "%RCRUN%"=="0" (
  echo  [OK] Done. dfcode works in PowerShell now.
  echo       The policy change takes effect immediately -
  echo       you do NOT need to reopen this window.
) else (
  if "%RC51%"=="3" (
    echo  [X] Your IT locked script execution via Group Policy.
    echo      This cannot be fixed on your side. Two options:
    echo        1. Run dfcode from cmd.exe or Git Bash instead.
    echo        2. Ask IT to allow RemoteSigned for developer accounts.
  ) else (
    echo  [X] dfcode still does not start. Please screenshot this WHOLE
    echo      window and send it to support. Useful extra check:
    echo        Get-ExecutionPolicy -List
    echo      If dfcode is "not recognized", it is a PATH problem, not a
    echo      policy problem - reinstall with install_win.bat.
  )
)
echo ------------------------------------------------------------
echo.
if "%DFCODE_NO_PAUSE%"=="1" exit /b %RCRUN%
echo Press any key to close this window . . .
pause >nul
exit /b %RCRUN%