fix(client): remove firewall rules and boot task on uninstall, unasked

The Yes/No before it defaulted to No, so they stayed behind. Read both
unelevated and raise the UAC prompt only when one is left.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 10 insertions, 1 deletions

diff --git a/packaging/win/firewall.ps1 b/packaging/win/firewall.ps1
index 9b3687a..939a58e 100644
--- a/packaging/win/firewall.ps1
+++ b/packaging/win/firewall.ps1
@@ -39,10 +39,13 @@
     add     (default) create/replace the rules
     remove  delete them
     check   exit 0 if all rules already exist, 1 otherwise -- no admin needed
+    any     exit 0 if at least one rule exists, 1 otherwise -- no admin
+            needed; the uninstallers elevate only when this says there is
+            something to remove
 #>
 [CmdletBinding()]
 param(
-    [ValidateSet("add", "remove", "check")]
+    [ValidateSet("add", "remove", "check", "any")]
     [string]$Action = "add"
 )
 
@@ -76,6 +79,12 @@ if ($Action -eq "check") {
     exit 0
 }
 
+if ($Action -eq "any") {
+    $present = $rules | Where-Object { Get-NetFirewallRule -DisplayName $_.Name -ErrorAction SilentlyContinue }
+    if ($present) { exit 0 }
+    exit 1
+}
+
 $ErrorActionPreference = "Stop"
 try {
     foreach ($r in $rules) {