fix(packaging): the command-line client's Store alias on an application of its own

An Application declares one windows.appExecutionAlias extension, and the
app's is meshbay-node.exe; the second one added for meshbay-cli.exe made
makeappx refuse the package ("must only be declared once") at the very end of
the Store build. The client is now an Application of its own, out of the Start
menu, carrying its alias. Built: MeshBay-0.20.0.appx with both aliases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4 files changed, 43 insertions, 8 deletions

diff --git a/packages/meshbay-client/build/appx-extensions.xml b/packages/meshbay-client/build/appx-extensions.xml
index db6e345..3326dd8 100644
--- a/packages/meshbay-client/build/appx-extensions.xml
+++ b/packages/meshbay-client/build/appx-extensions.xml
@@ -13,10 +13,3 @@
       <uap5:ExecutionAlias Alias="meshbay-node.exe" />
     </uap5:AppExecutionAlias>
   </uap5:Extension>
-  <!-- `meshbay-cli` in a terminal, the command-line client: the same alias
-       mechanism, for the same reason. -->
-  <uap5:Extension Category="windows.appExecutionAlias" Executable="app\resources\node-runtime\meshbay-cli.exe" EntryPoint="Windows.FullTrustApplication">
-    <uap5:AppExecutionAlias>
-      <uap5:ExecutionAlias Alias="meshbay-cli.exe" />
-    </uap5:AppExecutionAlias>
-  </uap5:Extension>
diff --git a/packages/meshbay-client/build/appx-manifest.xml b/packages/meshbay-client/build/appx-manifest.xml
index c097fdd..0542bd5 100644
--- a/packages/meshbay-client/build/appx-manifest.xml
+++ b/packages/meshbay-client/build/appx-manifest.xml
@@ -43,6 +43,27 @@
       </uap:VisualElements>
       ${extensions}
     </Application>
+    <!-- `meshbay-cli` in a terminal, by the same alias mechanism as the node.
+         An application declares one execution alias, and meshbay-node.exe has
+         the app's (appx-extensions.xml): a second one there made makeappx
+         refuse the package. So the command-line client is an application of
+         its own, listed nowhere. -->
+    <Application Id="MeshBayCli" Executable="app\resources\node-runtime\meshbay-cli.exe" EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements
+       AppListEntry="none"
+       BackgroundColor="${backgroundColor}"
+       DisplayName="MeshBay command-line client"
+       Square150x150Logo="${square150x150Logo}"
+       Square44x44Logo="${square44x44Logo}"
+       Description="MeshBay command-line client" />
+      <Extensions>
+        <uap5:Extension Category="windows.appExecutionAlias" Executable="app\resources\node-runtime\meshbay-cli.exe" EntryPoint="Windows.FullTrustApplication">
+          <uap5:AppExecutionAlias>
+            <uap5:ExecutionAlias Alias="meshbay-cli.exe" />
+          </uap5:AppExecutionAlias>
+        </uap5:Extension>
+      </Extensions>
+    </Application>
   </Applications>
   <!-- The node accepts connections from peers (WebRTC, QUIC, casting), and
        the command-line client does during a transfer (WebRTC). Rules declared
diff --git a/packages/meshbay-node/tests/test_packaging_win.py b/packages/meshbay-node/tests/test_packaging_win.py
index 6ee4891..0110b6c 100644
--- a/packages/meshbay-node/tests/test_packaging_win.py
+++ b/packages/meshbay-node/tests/test_packaging_win.py
@@ -1497,6 +1497,27 @@ def test_msix_gives_the_cli_an_execution_alias_and_the_windows_it_needs():
     assert 'xmlns:uap5="http://schemas.microsoft.com/appx/manifest/uap/windows10/5"' in xml
 
 
+def test_msix_gives_the_command_line_client_an_alias_of_its_own_application():
+    """An Application may declare one windows.appExecutionAlias extension.
+    meshbay-node.exe has the app's; a second one beside it for meshbay-cli.exe
+    made makeappx refuse the whole package ("must only be declared once"), at
+    the very end of a Store build. The client is an Application of its own,
+    kept out of the Start menu, with its alias and its firewall rule."""
+    xml = MSIX_MANIFEST_XML.read_text(encoding="utf-8")
+    ext = MSIX_EXTENSIONS_XML.read_text(encoding="utf-8")
+    assert ext.count('Category="windows.appExecutionAlias"') == 1
+    apps = re.findall(r"<Application\b.*?</Application>", xml, re.S)
+    for app in apps:
+        assert app.count('Category="windows.appExecutionAlias"') <= 1, app[:80]
+    [cli] = [a for a in apps if 'Executable="app\\resources\\node-runtime\\meshbay-cli.exe"'
+             in a.split(">", 1)[0]]
+    assert 'AppListEntry="none"' in cli
+    assert 'Alias="meshbay-cli.exe"' in cli
+    package_level = xml.split("</Applications>", 1)[1]
+    rule = package_level.split('Executable="app\\resources\\node-runtime\\meshbay-cli.exe"', 1)
+    assert len(rule) == 2 and 'IPProtocol="UDP"' in rule[1].split("</desktop2:", 1)[0]
+
+
 def test_the_node_runtime_has_a_windowless_daemon_beside_the_cli():
     spec = (WIN / "meshbay-node.spec").read_text(encoding="utf-8")
     windowless = spec.split('name="meshbay-nodew"', 1)
diff --git a/packaging/win/README.md b/packaging/win/README.md
index 89185fe..959e651 100644
--- a/packaging/win/README.md
+++ b/packaging/win/README.md
@@ -37,7 +37,7 @@ way — not LocalSystem/NetworkService, which would have none of this.
 `build/installer.nsh` also adds `…\resources\node-runtime` to the **per-user**
 `Path` (`HKCU\Environment`) so `meshbay-node` and `meshbay-cli` work in a
 terminal, and takes it back out on uninstall. The Store package declares an
-execution alias for each instead (`build/appx-extensions.xml`). New shells only — a `WM_SETTINGCHANGE` broadcast nudges
+execution alias for each instead (the node's in `build/appx-extensions.xml`; the client's on an application of its own in `build/appx-manifest.xml`, since an application declares one alias). New shells only — a `WM_SETTINGCHANGE` broadcast nudges
 open ones. It uses stock `WordFunc.nsh` (the `EnVar` plugin is not in
 electron-builder's NSIS bundle).