1 files changed, 55 insertions, 0 deletions
diff --git a/packaging/win/service-mode.ps1 b/packaging/win/service-mode.ps1
new file mode 100644
index 0000000..e522f04
--- /dev/null
+++ b/packaging/win/service-mode.ps1
@@ -0,0 +1,55 @@
+<#
+.SYNOPSIS
+    Elevated helper: set up (or tear down) service mode in ONE UAC prompt,
+    not two.
+
+.DESCRIPTION
+    "Run as a background service" is two things -- the boot-time Scheduled
+    Task and the firewall rules -- and needs one elevation, not one each.
+    build/installer.nsh runs this single script via ExecShellWait "runas"
+    for both the install-time choice and the uninstaller's cleanup, instead
+    of elevating service.ps1 and firewall.ps1 separately.
+
+    Each stays a script of its own rather than being folded together, so both
+    remain independently callable and testable -- the CLI does, through
+    meshbay-node service, and so does a later "just fix the firewall rules"
+    retry that has nothing to do with the service task.
+
+    Logs to the same file firewall.ps1 already uses, so both are visible in
+    one place: %TEMP%\meshbay-firewall.log.
+
+.PARAMETER Action
+    install  service.ps1 install, then firewall.ps1 add
+    remove   service.ps1 remove,  then firewall.ps1 remove
+#>
+[CmdletBinding()]
+param(
+    [ValidateSet("install", "remove")]
+    [string]$Action = "install"
+)
+
+$here = $PSScriptRoot
+$log = Join-Path $env:TEMP "meshbay-firewall.log"
+$firewallAction = if ($Action -eq "install") { "add" } else { "remove" }
+$failed = $false
+
+"[{0}] service-mode {1}" -f (Get-Date -Format s), $Action | Add-Content $log
+
+try {
+    & (Join-Path $here "service.ps1") $Action
+}
+catch {
+    "  service $Action failed: $_" | Add-Content $log
+    $failed = $true
+}
+
+try {
+    & (Join-Path $here "firewall.ps1") $firewallAction
+}
+catch {
+    "  firewall $firewallAction failed: $_" | Add-Content $log
+    $failed = $true
+}
+
+if ($failed) { exit 1 }
+exit 0