1 files changed, 27 insertions, 10 deletions
diff --git a/packaging/win/service-mode.ps1 b/packaging/win/service-mode.ps1
index 2cb61b4..21794da 100644
--- a/packaging/win/service-mode.ps1
+++ b/packaging/win/service-mode.ps1
@@ -24,31 +24,48 @@
 #>
 [CmdletBinding()]
 param(
-    [ValidateSet("install", "remove")]
+    # install:   the boot task + the firewall rules, then start the node.
+    # remove:    the boot task only -- switching to "at sign-in" or "only while
+    #            MeshBay is open" from the Node page. The firewall rules serve
+    #            every mode; removing them here left a node that silently
+    #            accepted no connections (found by switching modes on a real
+    #            install).
+    # uninstall: the boot task and the firewall rules -- the uninstaller.
+    [ValidateSet("install", "remove", "uninstall")]
     [string]$Action = "install"
 )
 
 $here = $PSScriptRoot
 $log = Join-Path $env:TEMP "meshbay-firewall.log"
-$firewallAction = if ($Action -eq "install") { "add" } else { "remove" }
 $failed = $false
 
 "[{0}] service-mode {1}" -f (Get-Date -Format s), $Action | Add-Content $log
 
+# Elevated, so this reaches a node in any session. The desktop app has already
+# asked it to stop properly; this only catches one that did not. Before
+# install, a node still running would hold the control API's port and the
+# service's own node would quit at once; before remove, deleting the task does
+# not end its running instance, which would run on with nothing to stop it.
+Get-Process -Name meshbay-node -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
+
+$serviceAction = if ($Action -eq "install") { "install" } else { "remove" }
 try {
-    & (Join-Path $here "service.ps1") $Action
+    & (Join-Path $here "service.ps1") $serviceAction
 }
 catch {
-    "  service $Action failed: $_" | Add-Content $log
+    "  service $serviceAction failed: $_" | Add-Content $log
     $failed = $true
 }
 
-try {
-    & (Join-Path $here "firewall.ps1") $firewallAction
-}
-catch {
-    "  firewall $firewallAction failed: $_" | Add-Content $log
-    $failed = $true
+if ($Action -ne "remove") {
+    $firewallAction = if ($Action -eq "install") { "add" } else { "remove" }
+    try {
+        & (Join-Path $here "firewall.ps1") $firewallAction
+    }
+    catch {
+        "  firewall $firewallAction failed: $_" | Add-Content $log
+        $failed = $true
+    }
 }
 
 # Register-ScheduledTask with -Trigger AtStartup does exactly that -- it does