@echo off
chcp 936 >nul
title 局域网遥控 - 修复防火墙
cd /d "%~dp0"

net session >nul 2>nul
if not errorlevel 1 goto ELEVATED
echo.
echo   需要管理员权限，正在请求提权，请在弹窗里点「是」...
powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
exit /b

:ELEVATED

rem 找到被控端 exe 的实际位置（脚本可能和 exe 同目录，也可能在子目录里）
set "EXE=%~dp0ykxmz.exe"
if not exist "%EXE%" set "EXE=%~dp0..\ykxmz.exe"
if not exist "%EXE%" set "EXE=%~dp0ykxmz\ykxmz.exe"
rem 兼容改名前的老目录：从旧版本升级上来的机器上可能还留着
if not exist "%EXE%" set "EXE=%~dp0LanRemote-Agent\LanRemote-Agent.exe"
if not exist "%EXE%" set "EXE=%~dp0..\LanRemote-Agent\LanRemote-Agent.exe"

echo ============================================================
echo    局域网遥控 - 修复防火墙
echo ============================================================
echo.
echo  为什么要修：
echo    Windows 防火墙的「阻止」规则优先级高于「放行」规则。
echo    程序监听的端口如果没有该程序的放行规则，系统会弹窗询问；
echo    没人点「允许」时，系统就自动生成阻止规则。
echo    于是表现成：手表能搜到电脑，但连不上（连接超时）。
echo.
echo  本脚本做四件事：
echo    1. 删掉已有的阻止规则
echo    2. 删掉旧的端口放行规则
echo    3. 重建端口放行规则
echo    4. 添加【程序级】放行规则 —— 这一步才是治本，
echo       有了它系统以后不会再自动生成阻止规则。
echo.
echo  将放行的程序: %EXE%
echo.
echo ------------------------------------------------------------
echo  [1/4] 删除阻止规则 ...
echo ------------------------------------------------------------
netsh advfirewall firewall delete rule name="lanremote-agent.exe" dir=in
netsh advfirewall firewall delete rule name="python.exe" dir=in
netsh advfirewall firewall delete rule name="pythonw.exe" dir=in
echo.
echo ------------------------------------------------------------
echo  [2/4] 删除旧的放行规则 ...
echo ------------------------------------------------------------
netsh advfirewall firewall delete rule name="LAN Remote TCP"
netsh advfirewall firewall delete rule name="LAN Remote UDP"
netsh advfirewall firewall delete rule name="LAN Remote App TCP"
netsh advfirewall firewall delete rule name="LAN Remote App UDP"
echo.
echo ------------------------------------------------------------
echo  [3/4] 重建端口放行 8765(TCP) / 8766(UDP) ...
echo ------------------------------------------------------------
netsh advfirewall firewall add rule name="LAN Remote TCP" dir=in action=allow protocol=TCP localport=8765 profile=any
netsh advfirewall firewall add rule name="LAN Remote UDP" dir=in action=allow protocol=UDP localport=8766 profile=any
echo.
echo ------------------------------------------------------------
echo  [4/4] 添加程序级放行（治本）...
echo ------------------------------------------------------------
if not exist "%EXE%" goto NOEXE
netsh advfirewall firewall add rule name="LAN Remote App TCP" dir=in action=allow program="%EXE%" enable=yes protocol=TCP profile=any
netsh advfirewall firewall add rule name="LAN Remote App UDP" dir=in action=allow program="%EXE%" enable=yes protocol=UDP profile=any
goto DONE

:NOEXE
echo   [注意] 没找到 ykxmz.exe，跳过程序级放行。
echo          端口放行已经加好，但系统可能仍会生成阻止规则。

:DONE
echo.
echo ============================================================
echo    完成！现在可以用手表连接了。
echo ============================================================
echo.
echo  如果 Ctrl+C 关掉本窗口前想确认结果，可以执行：
echo    netsh advfirewall firewall show rule name="LAN Remote App TCP"
echo.
pause