param([Parameter(Mandatory=$true)][string]$ProjectRoot)
$ErrorActionPreference = 'Stop'
. (Join-Path $ProjectRoot 'scripts/Initialize-SecurityEnv.ps1')
$path = Join-Path $ProjectRoot '.env'
$content = [System.IO.File]::ReadAllText($path)
if ((Get-EnvValue $content 'INFRASTRUCTURE_AUTO_UPDATE_ENABLED') -eq 'false') { return }
$image = Get-EnvValue $content 'WATCHTOWER_IMAGE'
if ([string]::IsNullOrWhiteSpace($image) -or $image -match '^registry\.cn-shanghai\.aliyuncs\.com/comfy-ai/watchtower-aliyun:\d+\.\d+\.\d+$') {
    $content = Set-EnvValue $content 'WATCHTOWER_IMAGE' 'registry.cn-shanghai.aliyuncs.com/comfy-ai/watchtower-aliyun:latest'
    [System.IO.File]::WriteAllText($path, $content, [System.Text.UTF8Encoding]::new($false))
}

# Preserve old scope during a targeted update; unchanged containers keep their labels.
$image = Get-EnvValue $content 'WATCHTOWER_IMAGE'
$target = Get-EnvValue $content 'WATCHTOWER_UPDATE_TARGET'
$scope = Get-EnvValue $content 'WATCHTOWER_SCOPE'
if ([string]::IsNullOrWhiteSpace($env:UPDATE_SERVICES) -and [string]::IsNullOrWhiteSpace($scope) -and $image -eq 'registry.cn-shanghai.aliyuncs.com/comfy-ai/watchtower-aliyun:latest' -and $target -in @('', 'easyai-updater', 'easyai-server easyai-wsgateway easyai-web')) {
    $content = Set-EnvValue $content 'WATCHTOWER_SCOPE' 'easyai'
    [System.IO.File]::WriteAllText($path, $content, [System.Text.UTF8Encoding]::new($false))
}