feat: opt-in Windows service mode (boot-time, one elevation) + v1.0.0

The per-user Startup-folder launcher (W3) only ever runs after this user
signs in. A real Windows Service would start earlier, but under
LocalSystem/NetworkService -- accounts with no normal profile, so
%LOCALAPPDATA%\meshbay\ (config, keystore, data) would not exist for it.
Relocating storage to make that work is real surgery, deliberately not
done here.

Instead: a Scheduled Task, created once with admin rights, that runs AS
THIS USER at boot without needing them to sign in first.
`schtasks /create ... /ru <user> /rp ""` with no `/it` registers an S4U
(Service For User) logon -- no password stored anywhere, and unlike
LocalSystem it loads this account's own profile, so config_dir()/
data_dir() need zero changes. The cost: S4U carries no network credential,
which the node never needed -- everything it touches is local disk plus
outbound internet. Creating the task needs admin (a boot trigger touches
system-wide scheduler state, the same reason /sc onlogon needed it);
querying/starting/stopping an existing one does not -- Task Scheduler
grants the owning user that much itself, which is what lets the Node
page's Start/Stop/Restart drive it with no further UAC prompts.

meshbay_node/platform.py
  service_install/_remove/_status/_run/_end -- mirrors autostart_* but
  for the Scheduled Task; TASK_NAME moved here (was decorative before)

meshbay_node/daemon.py
  new `service install|remove|start|stop|status` verb; restart-daemon and
  reset now check for the service task too

packaging/win/service.ps1
  the installer-side equivalent (extraResource); status/run/end never
  self-elevate -- only install/remove do, exactly matching what
  Task Scheduler itself requires

packaging/win/service-mode.ps1
  ONE elevated helper running service.ps1 + firewall.ps1 together, so
  choosing service mode costs exactly one UAC prompt, not two

build/installer.nsh
  the install-time choice: "run as a background service?" (one
  elevation, both jobs) vs the existing per-user + separate firewall
  question. Checked first, unelevated, so re-running setup with
  everything already configured asks nothing. Uninstall offers the
  matching one-elevation cleanup, default No.

src/main.js
  winServiceTaskStatus/Run/End, wired into node:installed,
  node:service-status/-stop/-restart and node:start: when the Scheduled
  Task exists, drive it; otherwise fall back to the existing per-user
  spawn/kill path. This is the hard requirement -- Start/Stop/Restart
  from the Node page must work in either mode.

node-page.js / locales
  a hint explaining why the per-user autostart toggle is absent when
  service mode is active (info.mode from the backend, no new field to
  gate on -- it just isn't sent in that case)

package.json: 0.1.0 -> 1.0.0.

Verified: electron-builder compiles the new NSIS choice logic and ships
all three scripts; service.ps1's S4U install fails cleanly (Access
denied) when run unelevated, and its status/run/end never touch "runas".
Cannot verify the elevated success path myself (no admin in this
session) -- that needs a real UAC click. Node suite 843 pass / 25 skip;
test_packaging_win.py pins the one-elevation property, the S4U flags,
and that main.js actually checks the service task in all three handlers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 75 insertions, 12 deletions

diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js
index b0505a9..15c3cc0 100644
--- a/packages/meshbay-client/src/main.js
+++ b/packages/meshbay-client/src/main.js
@@ -850,6 +850,38 @@ function registerBridge() {
     });
   }
 
+  // ── Windows: the opt-in Scheduled Task "service mode" ──────────────────────
+  // Set up once, elevated, at install time (build/installer.nsh + packaging/win
+  // /service.ps1 + /service-mode.ps1) or via `meshbay-node service install`
+  // from an elevated prompt — this process never creates or deletes it, only
+  // queries and drives an existing one, which needs no elevation (Task
+  // Scheduler grants the owning user that much itself). Kept in step with
+  // meshbay_node.platform.TASK_NAME / service_status().
+  const WIN_SERVICE_TASK = 'MeshBay Node';
+
+  function winServiceTaskStatus() {
+    return new Promise((resolve) => {
+      execFile('schtasks', ['/query', '/tn', WIN_SERVICE_TASK, '/fo', 'list'],
+        (err, stdout) => {
+          if (err) return resolve({ installed: false, state: '' });
+          const m = (stdout || '').split(/\r?\n/).find((l) => /^status:/i.test(l.trim()));
+          resolve({ installed: true, state: m ? m.split(':')[1].trim() : '' });
+        });
+    });
+  }
+
+  function winServiceTaskRun() {
+    return new Promise((resolve) => {
+      execFile('schtasks', ['/run', '/tn', WIN_SERVICE_TASK], () => resolve());
+    });
+  }
+
+  function winServiceTaskEnd() {
+    return new Promise((resolve) => {
+      execFile('schtasks', ['/end', '/tn', WIN_SERVICE_TASK], () => resolve());
+    });
+  }
+
   async function spawnNodeDetached() {
     const bin = await findNodeBinary();
     if (!bin) throw new Error('meshbay-node not found on PATH');
@@ -875,8 +907,12 @@ function registerBridge() {
 
   ipcMain.handle('node:installed', async () => {
     if (process.platform === 'win32') {
-      const bin = await findNodeBinary();
-      return { installed: Boolean(bin), autostart: winAutostartInstalled() };
+      const [bin, svc] = await Promise.all([findNodeBinary(), winServiceTaskStatus()]);
+      return {
+        installed: Boolean(bin),
+        autostart: winAutostartInstalled(),
+        service: svc.installed,
+      };
     }
     if (process.platform !== 'linux') return { installed: false };
     const unit = await new Promise((resolve) => {
@@ -897,16 +933,29 @@ function registerBridge() {
   // looping — exactly the states this panel exists to show and act on.
   ipcMain.handle('node:service-status', async () => {
     if (process.platform === 'win32') {
-      // No Task Scheduler to ask "is it running" — probe the daemon itself.
-      // `installed` used to be winAutostartInstalled(), which is wrong: it
-      // answers "does the Startup launcher exist", not "is there a daemon to
-      // manage". The Node page's Stop/Restart buttons are gated on
-      // `installed`, so with no autostart configured they silently vanished
-      // — the daemon was perfectly manageable, just not launchable at
-      // sign-in. `autostart` carries that state as its own field instead.
+      const svc = await winServiceTaskStatus();
+      if (svc.installed) {
+        // Service mode: Task Scheduler already tracks running/not, directly —
+        // no need to probe the daemon's own API for this panel.
+        const running = /running/i.test(svc.state);
+        return {
+          supported: true,
+          mode: 'service',
+          installed: true,
+          activeState: running ? 'active' : 'inactive',
+          subState: svc.state,
+        };
+      }
+      // Per-user Startup mode. `installed` used to be winAutostartInstalled(),
+      // which is wrong: it answers "does the Startup launcher exist", not "is
+      // there a daemon to manage". The Node page's Stop/Restart buttons are
+      // gated on `installed`, so with no autostart configured they silently
+      // vanished — the daemon was perfectly manageable, just not launchable
+      // at sign-in. `autostart` carries that state as its own field instead.
       const [p, bin] = await Promise.all([probeNode(), findNodeBinary()]);
       return {
         supported: true,
+        mode: 'startup',
         installed: Boolean(bin),
         autostart: winAutostartInstalled(),
         activeState: p ? 'active' : 'inactive',
@@ -939,7 +988,10 @@ function registerBridge() {
 
   ipcMain.handle('node:service-stop', async () => {
     if (process.platform === 'win32') {
-      await killNodeProcesses();   // hard kill — no CTRL_CLOSE handler yet
+      const svc = await winServiceTaskStatus();
+      if (svc.installed) await winServiceTaskEnd();
+      await killNodeProcesses();   // hard kill — no CTRL_CLOSE handler yet;
+      // also the belt-and-suspenders in case /end left the process running
       return { stopped: true };
     }
     if (process.platform !== 'linux') {
@@ -957,8 +1009,14 @@ function registerBridge() {
 
   ipcMain.handle('node:service-restart', async () => {
     if (process.platform === 'win32') {
+      const svc = await winServiceTaskStatus();
+      if (svc.installed) await winServiceTaskEnd();
       await killNodeProcesses();
-      await spawnNodeDetached();
+      if (svc.installed) {
+        await winServiceTaskRun();
+      } else {
+        await spawnNodeDetached();
+      }
       const p = await waitForNode(Date.now() + 30000);
       if (!p) throw new Error('node did not come back up within 30s');
       return { restarted: true, ...p };
@@ -1064,7 +1122,12 @@ function registerBridge() {
     if (process.platform === 'win32') {
       if (opts && opts.hubUrl && opts.username) provisionNode(opts.hubUrl, opts.username);
       await killNodeProcesses();   // clear a crash-looping one
-      await spawnNodeDetached();
+      const svc = await winServiceTaskStatus();
+      if (svc.installed) {
+        await winServiceTaskRun();
+      } else {
+        await spawnNodeDetached();
+      }
       const p = await waitForNode(Date.now() + 60000);
       if (!p) throw new Error('the node did not start within 60s — run it from a '
         + 'terminal (`meshbay-node`) to see why');