feat(packaging): offer one elevated firewall step instead of two dialogs

Installing used to mean clicking through two separate Windows "Allow
access" prompts later — one for MeshBay.exe, one for meshbay-node.exe —
each confusing on its own and worse before the exe carried a version
resource. Adding a firewall rule needs admin, and the installer is
deliberately per-user with no elevation, so this can only ever be opt-in.

packaging/win/firewall.ps1 (new, shipped as an extraResource at
resources\firewall.ps1): idempotent add/remove of the two inbound UDP
rules ("MeshBay", "MeshBay Node"), grouped, logged to
%TEMP%\meshbay-firewall.log. Locates both executables from its own path,
no arguments needed beyond the action.

build/installer.nsh: customInstall asks "Allow MeshBay through Windows
Firewall now?" and runs firewall.ps1 via NSIS ExecShellWait "runas" — one
UAC prompt — only when not ${Silent}; declining or dismissing UAC falls
back to Windows' own per-process prompts, unchanged. customUnInstall
offers the same in reverse, defaulted to No (a stale rule for a deleted
exe is inert, so this should not nag on the way out) and skipped for a
silent uninstall.

Verified: rebuilt MeshBay-Setup-0.1.0.exe (electron-builder compiles the
new LogicLib.nsh / ExecShellWait NSIS successfully); firewall.ps1 run
unelevated fails cleanly into its log ("Access is denied") rather than
silently doing nothing, confirming the fallback path. Node suite 835
pass / 25 skip.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 55 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_packaging_win.py b/packages/meshbay-node/tests/test_packaging_win.py
index 77fb1e5..47a2842 100644
--- a/packages/meshbay-node/tests/test_packaging_win.py
+++ b/packages/meshbay-node/tests/test_packaging_win.py
@@ -71,6 +71,16 @@ def test_the_node_runtime_is_carried_as_an_extraresource():
         "extraResources puts it")
 
 
+def test_firewall_helper_is_carried_as_an_extraresource():
+    """packaging/win/firewall.ps1 must ride into resources/, at the fixed
+    path installer.nsh invokes it from ($INSTDIR\\resources\\firewall.ps1)."""
+    extra = _pkg()["build"]["win"]["extraResources"]
+    entry = next((e for e in extra if e.get("to") == "firewall.ps1"), None)
+    assert entry, "no extraResources entry mapping to firewall.ps1"
+    assert entry["from"].endswith("packaging/win/firewall.ps1")
+    assert (ROOT / "packaging" / "win" / "firewall.ps1").exists()
+
+
 def test_dist_win_delegates_to_the_build_script():
     """`dist` (Linux) delegates to build-client.sh; `dist:win` is its
     counterpart and must not be a second inline electron-builder invocation."""
@@ -166,6 +176,51 @@ def test_customInstall_stops_a_running_daemon_before_overwriting_it():
     assert "taskkill /IM meshbay-node.exe /F" in body
 
 
+# ── the one-time elevated firewall step ─────────────────────────────────────
+
+def _macro_body(nsh: str, name: str) -> str:
+    return nsh.split(f"!macro {name}", 1)[1].split("!macroend", 1)[0]
+
+
+def test_the_installer_offers_one_elevated_firewall_step_instead_of_two_dialogs():
+    """
+    Adding a firewall rule needs admin; the install itself never elevates
+    (build.nsis allowElevation:false). So this must be opt-in (a Yes/No the
+    user can decline) and skipped entirely in a silent install — an
+    unattended `/S` install must never pop a UAC prompt on its own.
+    """
+    nsh = NSH.read_text(encoding="utf-8")
+    install = _macro_body(nsh, "customInstall")
+
+    assert "${IfNot} ${Silent}" in install, (
+        "the firewall step is not guarded against silent installs")
+    assert 'MessageBox MB_YESNO' in install
+    assert 'ExecShellWait "runas"' in install
+    assert 'firewall.ps1" add' in install
+
+
+def test_the_uninstaller_offers_to_remove_the_firewall_rules_default_no():
+    """Opt-in on the way out too, and defaulting to No: a stale allow-rule
+    for a deleted exe is inert, so this should not nag."""
+    nsh = NSH.read_text(encoding="utf-8")
+    uninstall = _macro_body(nsh, "customUnInstall")
+
+    assert "${IfNot} ${Silent}" in uninstall
+    assert "/SD IDNO" in uninstall, "the uninstall firewall prompt should default to No"
+    assert 'firewall.ps1" remove' in uninstall
+
+
+def test_firewall_ps1_targets_both_executables_and_is_idempotent():
+    """One script, both rules — so installer.nsh only ever has to name it
+    once on the way in and once on the way out."""
+    src = (ROOT / "packaging" / "win" / "firewall.ps1").read_text(encoding="utf-8")
+    assert "MeshBay.exe" in src
+    assert "node-runtime" in src and "meshbay-node.exe" in src
+    # Remove-then-add: a re-run (reinstall, or install after a manual add)
+    # must not leave duplicate rules.
+    assert src.index("Remove-NetFirewallRule") < src.index("New-NetFirewallRule")
+
+
 def test_the_bundled_daemon_goes_on_the_user_path_and_comes_back_off():
     """
     The installer has no console entry point of its own; without this the