feat(winpe): add boot image customization suite with windowless psbootstrapper boot

[freedbygrace]

Summary

Adds a WinPE/WinRE boot image customization suite to Foundry OSD: a new Expert Boot Image page (Settings, Drivers, Optional Components, PowerShell, Modules, Additional Folders), a windowless boot path via psbootstrapper + winpeshl.ini, and ${VARIABLE} expansion for deployed computer names.

Why

Boot image content (optional components, drivers, PowerShell, modules, extra files) previously had to be hand-tuned or wasn't configurable at all, drivers lived in a confusing place on the General page, and booting through cmd /k startnet.cmd flashed a console window before the Foundry UI appeared.

Changes

Boot process

• Bundle psbootstrapper.exe (x64/arm64) and copy it into the image's System32.
• Launch the Foundry bootstrap from the auto-discovered X:\Unattend.xml (hidden), instead of a PowerShell line in startnet.cmd.
• Boot via winpeshl.ini (launching only wpeinit) so WinPE no longer runs cmd /k startnet.cmd — removes the console window that flashed at boot. wpeinit still processes the unattend (Display / EnableNetwork / EnableFirewall + the bootstrap launch). startnet.cmd is kept as a wpeinit-only fallback.
• Unattend commands are emitted as CDATA so quotes and %WINDIR% aren't XML-escaped.
• Optional, debug-gated minimized troubleshooting console (off by default).

Boot Image page (new, Expert)

• In-page section rail so the page doesn't grow vertically.
• Settings — firewall (on by default), keep a copy of boot.wim next to the ISO, troubleshooting console.
• Drivers — moved off the General page. Vendor packs (Dell/HP) as a checkbox grid with description tooltips, plus multiple driver folders that can each be enabled/disabled via checkbox or removed. Folder paths are clickable (open in Explorer).
• Optional Components — scanned live from the installed ADK, wrapping checkbox grid with description tooltips, recommended defaults pre-checked.
• PowerShell — optional PowerShell 7 integration; latest 10 stable releases, full archive download link + copy-to-clipboard.
• Modules — PowerShell Gallery search (wildcard-tolerant) with a per-result version selector (latest by default), plus local Save-Module folders. Selected Gallery/local modules are shown separately; Gallery modules link to their version page.
• Additional Folders — each folder has a boot-image-relative destination (\ = image root, \Windows, …), copied recursively.

Driver injection resilience

• DISM /Add-Driver exit codes 50 and 3010 are treated as success (50 is returned when a recursive folder contains drivers that don't apply to WinPE while the applicable ones still inject).
• New "continue on driver error" option (on by default) skips a failing package with a warning instead of failing media creation.
• Progress reports which folder each package is injected from.

Optional component integration

• WinPE-SecureBootCmdlets and WinPE-SecureStartup are always integrated last, in that order.
• Per-component "Optional component X of N" progress.
• Existing idempotency preserved (already-installed components are skipped).
• Correct language cabs are still applied automatically for the selected WinPE language.

Computer name variables

• Machine-name prefixes support ${SERIALNUMBER} (plus ${MODEL}, ${MANUFACTURER}, ${PRODUCT}).
• Expanded at deployment time from the destination machine's hardware, then normalized/truncated to the 15-character NetBIOS limit.
• A name may be a variable on its own (no literal prefix or suffix required).

Also

• Two-level build progress ("Task X of N" + "Driver package / Optional component X of N").
• PowerShell modules install to %WINDIR%\System32\WindowsPowerShell\v1.0\Modules\<Name>\<Version>.
• All settings persist in the Foundry configuration document; low-cardinality telemetry added (no paths or names).
• Localized across all 38 cultures (English source text pending translation).

Testing

• dotnet build .\src\Foundry.slnx — 0 errors
• Unit tests: Core 343, Deploy 313, Connect 88, Localization 54, Telemetry 31 — all pass
• Manual testing completed (ISO build + Boot Image page exercised in the desktop app)

Notes

• Breaking changes: none for consumers. The config document schema is bumped (10 → 11); older documents load with defaults. A legacy single custom-driver directory is migrated into the new driver folder list on first use.
• Related issues: n/a
• Screenshots: see below.

Screenshots

1. New Boot Image section — Settings (firewall, keep boot.wim, troubleshooting console)

2. Optional Components — dynamic ADK detection with sane defaults and safe ordering

3. PowerShell 7 — optional inclusion with version selection and download link

4. Modules — PowerShell Gallery search and local Save-Module folders

5. Customization — computer-name variables (${SERIALNUMBER})

[freedbygrace]

I know that it is a huge PR, sorry for that, I tried to keep the commits focused because I was working on two projects in tandem, but I have tested the entire process and it works a treat, even the inclusion of Powershell 7. I have been doing endpoint management for over 13 years, so all these enhancements came from real world experience. I am glad to connect and discuss my thinking on this. I did use the assistance of Claude Code to help build the code out as I am not a software engineer by training, but I understand at a developer level data structures, code flow, etc etc. I have several examples of Powershell solutions I have done to show my writing of Powershell mnaually at this level. Anyways, I just thought this tool was sooooo cool that with these things, it would be even better! I truly applaud your approach on this so far and how polished it is.

[mchave3]

Hi @freedbygrace , Thank you for the PR and for the time you spent developing this improvement. I’ll review the changes on my side and see which parts would be relevant to keep. I don’t have much time this week, but I’ll try to take a look at it as soon as possible.

[freedbygrace]

Some more changes incoming because I noticed that the Foundry bootstrap.ps1 script doesn't wait on the Foundry.Deploy execution and since the change over to winpeshl.ini to avoid the cmd window, launching the foundry deploy async makes the process break down so in this flow, the bootstrap ps1 controls and drives the entire execution process, so when it exits, WindowsPE will exit unless an error occurs in the script and then a powershell window will spawn for troubleshooting but is optional.

[freedbygrace]

The flow is all working a treat now...Modules are there, files are copied, I added an optional troubleshooting key combo so that you can press ctrl + f8 to launch a powershell Window for example. I connected, launched into deploy, it formatted the specified disk (I think custom partition plans here would be helpful), although a VBScript style confirmation appears, downloaded the cloud image, then failed to do the BCDBoot operations...

I am glad to do additional testing here.

[mchave3]

Sounds good. Thank you for taking the time to work on this and for your detailed implementation. I really appreciate it.

I have a lot of work this week, so I don't think I'll have time to look into it until next week. I'll take the time to review your implementation carefully and decide which parts I want to keep or adapt.