update.bat

@echo off
setlocal EnableExtensions EnableDelayedExpansion

:: ============================================================
::  HumWatch — Secure Update
::  Downloads one named, digest verified release and replaces
::  immutable application content through a guarded transaction.
:: ============================================================

title HumWatch Update
color 0E
echo.
echo   =============================================
echo    HumWatch Update
echo   =============================================
echo.

set "HUMWATCH_UPDATE_ROOT=%~dp0"
set "HUMWATCH_UPDATE_SCRIPT=%~f0"

:: config.json remains operator owned and is never copied from a release.
:: ProgramData contains the preserved token, certificates, private keys, humwatch.db database, and logs.

:: Replacing C:\HumWatch requires the protected installer elevation token.
fltmc >nul 2>&1
if errorlevel 1 (
    echo   Requesting administrator privileges...
    powershell.exe -NoProfile -Command "$child = Start-Process -FilePath $env:ComSpec -Verb RunAs -Wait -PassThru -ArgumentList @('/d','/c', ('call ' + [char]34 + $env:HUMWATCH_UPDATE_SCRIPT + [char]34 + ' --elevated')); exit $child.ExitCode"
    rem Delayed expansion is on, so %errorlevel% inside this parenthesised block
    rem would expand when the block was parsed, before powershell.exe ran.
    set "UPDATE_EXIT=!errorlevel!"
    set "HUMWATCH_UPDATE_ROOT="
    set "HUMWATCH_UPDATE_SCRIPT="
    exit /b !UPDATE_EXIT!
)

echo   Running with administrator privileges.
echo.

:: The updater body lives in a real PowerShell script. It used to be a cmd
:: caret continued -Command string, which cmd joins into one logical line and
:: truncates at 8,191 characters. That block had grown to 17,182, so it was cut
:: mid token and failed at parse time on every install. Nothing may move back.
::
:: This invocation is also the last thing cmd reads from this file. The updater
:: replaces update.bat as part of the release swap, and cmd resumes a batch file
:: by byte offset, so any line after this one would be read out of the new file
:: at the old offset. exit /b is on this line, already buffered, so cmd leaves
:: before that can happen. The result banner belongs to update-core.ps1.
set "HUMWATCH_UPDATE_CORE=%~dp0scripts\update-core.ps1"
if not exist "%HUMWATCH_UPDATE_CORE%" (
    echo   [ERROR] scripts\update-core.ps1 is missing. Reinstall HumWatch from a release archive.
    exit /b 1
)

:: The trailing dot keeps a quoted path ending in a backslash from escaping the
:: closing quote. GetFullPath normalizes it away.
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%HUMWATCH_UPDATE_CORE%" -AppRoot "%HUMWATCH_UPDATE_ROOT%." & exit /b !errorlevel!