#Requires -Version 5.1
<#  SilverMetal Enhanced - Windows | Domain G: Physical & lock-screen hygiene
    Theft is threat #1 for a pocket device. Short auto-lock, PIN on wake, block
    DMA while locked, prefer hibernate, no HW kill switch (software cam/mic).
    Spec: ../hardening-spec.md (G)   |   SCAFFOLD (M1).
#>
[CmdletBinding()] param()
Set-StrictMode -Version Latest; $ErrorActionPreference = 'Stop'
Write-Host '[G] Physical & lock-screen hygiene'

# Auto-lock: machine inactivity limit (seconds) + require password on wake.
$sys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
New-Item $sys -Force | Out-Null
Set-ItemProperty $sys -Name InactivityTimeoutSecs -Type DWord -Value 120   # lock after 2 min idle
$pol = 'HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51'
New-Item $pol -Force | Out-Null
Set-ItemProperty $pol -Name ACSettingIndex -Type DWord -Value 1            # require password on wake (AC)
Set-ItemProperty $pol -Name DCSettingIndex -Type DWord -Value 1            # ... and on battery

# Block new DMA-capable devices while the screen is locked (compensates if firmware
# Kernel DMA Protection is absent - see Domain D / open question §8).
$fve = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
New-Item $fve -Force | Out-Null
Set-ItemProperty $fve -Name DisableExternalDMAUnderLock -Type DWord -Value 1

# Prefer hibernate over sleep (keys not left resident in RAM as long).
# Tolerate environments without hibernation support (e.g. VMs) -- native stderr
# under ErrorActionPreference=Stop would otherwise abort the module.
try { & powercfg /hibernate on 2>&1 | Out-Null } catch { Write-Host '   (hibernate unavailable here; skipped)' }
# TODO-M1: set lid-close + idle -> hibernate via powercfg; deny camera/mic per-app
#          (Device Manager disable is the stopgap; the Pocket 4 has NO hardware kill switch).
# NOTE: SilverDuress (Stack, v1.1) provides duress-PIN / panic-wipe - installed by module 08.

Write-Host '   [G] auto-lock=120s, password-on-wake, DMA-blocked-while-locked, hibernate on.'
