feat: opt-in Windows service mode (boot-time, one elevation) + v1.0.0

The per-user Startup-folder launcher (W3) only ever runs after this user
signs in. A real Windows Service would start earlier, but under
LocalSystem/NetworkService -- accounts with no normal profile, so
%LOCALAPPDATA%\meshbay\ (config, keystore, data) would not exist for it.
Relocating storage to make that work is real surgery, deliberately not
done here.

Instead: a Scheduled Task, created once with admin rights, that runs AS
THIS USER at boot without needing them to sign in first.
`schtasks /create ... /ru <user> /rp ""` with no `/it` registers an S4U
(Service For User) logon -- no password stored anywhere, and unlike
LocalSystem it loads this account's own profile, so config_dir()/
data_dir() need zero changes. The cost: S4U carries no network credential,
which the node never needed -- everything it touches is local disk plus
outbound internet. Creating the task needs admin (a boot trigger touches
system-wide scheduler state, the same reason /sc onlogon needed it);
querying/starting/stopping an existing one does not -- Task Scheduler
grants the owning user that much itself, which is what lets the Node
page's Start/Stop/Restart drive it with no further UAC prompts.

meshbay_node/platform.py
  service_install/_remove/_status/_run/_end -- mirrors autostart_* but
  for the Scheduled Task; TASK_NAME moved here (was decorative before)

meshbay_node/daemon.py
  new `service install|remove|start|stop|status` verb; restart-daemon and
  reset now check for the service task too

packaging/win/service.ps1
  the installer-side equivalent (extraResource); status/run/end never
  self-elevate -- only install/remove do, exactly matching what
  Task Scheduler itself requires

packaging/win/service-mode.ps1
  ONE elevated helper running service.ps1 + firewall.ps1 together, so
  choosing service mode costs exactly one UAC prompt, not two

build/installer.nsh
  the install-time choice: "run as a background service?" (one
  elevation, both jobs) vs the existing per-user + separate firewall
  question. Checked first, unelevated, so re-running setup with
  everything already configured asks nothing. Uninstall offers the
  matching one-elevation cleanup, default No.

src/main.js
  winServiceTaskStatus/Run/End, wired into node:installed,
  node:service-status/-stop/-restart and node:start: when the Scheduled
  Task exists, drive it; otherwise fall back to the existing per-user
  spawn/kill path. This is the hard requirement -- Start/Stop/Restart
  from the Node page must work in either mode.

node-page.js / locales
  a hint explaining why the per-user autostart toggle is absent when
  service mode is active (info.mode from the backend, no new field to
  gate on -- it just isn't sent in that case)

package.json: 0.1.0 -> 1.0.0.

Verified: electron-builder compiles the new NSIS choice logic and ships
all three scripts; service.ps1's S4U install fails cleanly (Access
denied) when run unelevated, and its status/run/end never touch "runas".
Cannot verify the elevated success path myself (no admin in this
session) -- that needs a real UAC click. Node suite 843 pass / 25 skip;
test_packaging_win.py pins the one-elevation property, the S4U flags,
and that main.js actually checks the service task in all three handlers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 100 insertions, 3 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py
index 3c160a1..9b18618 100644
--- a/packages/meshbay-node/src/meshbay_node/platform.py
+++ b/packages/meshbay-node/src/meshbay_node/platform.py
@@ -199,9 +199,8 @@ def ffprobe_cmd() -> str:
 # to create — and this must work for an ordinary user with no admin rights.
 # So: a `.vbs` launcher in the per-user Startup folder. wscript runs it hidden
 # (Run(..., 0, ...)) at every sign-in; no console window, no admin, no
-# third-party dependency.
-
-TASK_NAME = "MeshBay Node"   # the name the Electron client shows
+# third-party dependency. See the Service mode section below for the
+# boot-capable, admin-once alternative built on top of Task Scheduler instead.
 
 
 def autostart_supported() -> bool:
@@ -277,3 +276,101 @@ def autostart_end() -> None:
     if autostart_supported():
         subprocess.run(["taskkill", "/IM", "meshbay-node.exe", "/F"],
                        capture_output=True)
+
+
+# ── Service mode (Windows, opt-in at install time) ───────────────────────────
+#
+# The Startup-folder .vbs above only ever runs after *this* user signs in. A
+# real Windows Service would run before anyone signs in, but under
+# LocalSystem/NetworkService — accounts with no normal user profile, so
+# %LOCALAPPDATA%\meshbay\ (config, keystore, data) would not exist for it.
+# Relocating storage to make that work is real surgery (Phase 2, deliberately
+# not this).
+#
+# The middle ground: a Scheduled Task, created once with admin rights, that
+# runs *as this user* at system boot without needing them to sign in first.
+# `schtasks /create ... /ru <user> /rp ""` with no `/it` registers an S4U
+# (Service For User) logon — no password stored anywhere, and unlike
+# LocalSystem it loads this account's own profile, so config_dir()/data_dir()
+# need no special-casing at all. The cost: S4U carries no *network* credential
+# (no reaching a domain share as this user), which the node never needed
+# anyway — everything it touches is local disk plus outbound internet.
+#
+# Creating the task needs admin (a boot-trigger touches system-wide scheduler
+# state, the same reason /sc onlogon did — see the autostart section above).
+# Querying, running and ending an *already-created* task, as the same user it
+# was registered for, does not — Task Scheduler grants the owner that much by
+# default, which is what lets the Node page drive it with no further prompts.
+
+TASK_NAME = "MeshBay Node"   # the Scheduled Task's own name
+
+
+def service_supported() -> bool:
+    return sys.platform == "win32"
+
+
+def _current_user() -> str:
+    domain = os.environ.get("USERDOMAIN") or os.environ.get("COMPUTERNAME") or "."
+    user = os.environ.get("USERNAME") or ""
+    return f"{domain}\\{user}" if user else ""
+
+
+def _schtasks(*args: str) -> subprocess.CompletedProcess:
+    return subprocess.run(["schtasks", *args], capture_output=True, text=True)
+
+
+def service_status() -> dict:
+    """{'installed': bool, 'state': str}. 'state' is Task Scheduler's own word
+    ('Ready', 'Running', 'Disabled', ...), '' when not installed."""
+    if not service_supported():
+        return {"installed": False, "state": ""}
+    r = _schtasks("/query", "/tn", TASK_NAME, "/fo", "list")
+    if r.returncode != 0:
+        return {"installed": False, "state": ""}
+    state = ""
+    for line in r.stdout.splitlines():
+        if line.lower().startswith("status:"):
+            state = line.split(":", 1)[1].strip()
+            break
+    return {"installed": True, "state": state}
+
+
+def service_install(exe: str | None = None) -> None:
+    """
+    Register the boot-time Scheduled Task. Needs admin — raises RuntimeError
+    with schtasks' own message on failure, which is "Access is denied." when
+    not elevated.
+    """
+    if not service_supported():
+        raise RuntimeError("service mode is Windows-only")
+    exe = exe or _node_exe()
+    if not exe:
+        raise RuntimeError(
+            "cannot locate the meshbay-node launcher — pass its path, or run "
+            "this from where meshbay-node is on PATH")
+    user = _current_user()
+    if not user:
+        raise RuntimeError("could not determine the current user (USERNAME unset)")
+    r = _schtasks("/create", "/tn", TASK_NAME, "/tr", f'"{exe}"',
+                  "/sc", "onstart", "/ru", user, "/rp", "", "/rl", "limited", "/f")
+    if r.returncode != 0:
+        raise RuntimeError(f"schtasks /create failed: {r.stderr.strip() or r.stdout.strip()}")
+
+
+def service_remove() -> None:
+    """Delete the Scheduled Task if present. Needs admin; silent otherwise
+    (mirrors autostart_remove — nothing to report if it was never installed)."""
+    if service_supported():
+        _schtasks("/delete", "/tn", TASK_NAME, "/f")
+
+
+def service_run() -> None:
+    """Start the task now. No admin needed for an already-registered task."""
+    if service_supported():
+        _schtasks("/run", "/tn", TASK_NAME)
+
+
+def service_end() -> None:
+    """Stop the running instance, if any. No admin needed."""
+    if service_supported():
+        _schtasks("/end", "/tn", TASK_NAME)