From 74941aae5451c03a296413710fe888b1924e8c27 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 4 Sep 2026 15:36:53 +0200 Subject: feat(packaging): offer one elevated firewall step instead of two dialogs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Installing used to mean clicking through two separate Windows "Allow access" prompts later — one for MeshBay.exe, one for meshbay-node.exe — each confusing on its own and worse before the exe carried a version resource. Adding a firewall rule needs admin, and the installer is deliberately per-user with no elevation, so this can only ever be opt-in. packaging/win/firewall.ps1 (new, shipped as an extraResource at resources\firewall.ps1): idempotent add/remove of the two inbound UDP rules ("MeshBay", "MeshBay Node"), grouped, logged to %TEMP%\meshbay-firewall.log. Locates both executables from its own path, no arguments needed beyond the action. build/installer.nsh: customInstall asks "Allow MeshBay through Windows Firewall now?" and runs firewall.ps1 via NSIS ExecShellWait "runas" — one UAC prompt — only when not ${Silent}; declining or dismissing UAC falls back to Windows' own per-process prompts, unchanged. customUnInstall offers the same in reverse, defaulted to No (a stale rule for a deleted exe is inert, so this should not nag on the way out) and skipped for a silent uninstall. Verified: rebuilt MeshBay-Setup-0.1.0.exe (electron-builder compiles the new LogicLib.nsh / ExecShellWait NSIS successfully); firewall.ps1 run unelevated fails cleanly into its log ("Access is denied") rather than silently doing nothing, confirming the fallback path. Node suite 835 pass / 25 skip. Co-Authored-By: Claude Sonnet 5 --- docs/PACKAGING-GUIDE.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'docs') diff --git a/docs/PACKAGING-GUIDE.md b/docs/PACKAGING-GUIDE.md index 56504d4..c4f6b00 100644 --- a/docs/PACKAGING-GUIDE.md +++ b/docs/PACKAGING-GUIDE.md @@ -66,9 +66,16 @@ node (with `meshbay-common` inside it). There is no Windows hub. ### Install -Run the installer. It is **per-user** — no administrator prompt — and lands in -`%LOCALAPPDATA%\Programs\meshbay-client\`. The node daemon ships beside the app -at `resources\node-runtime\meshbay-node.exe`; the client finds it automatically. +Run the installer. It is **per-user** and lands in +`%LOCALAPPDATA%\Programs\meshbay-client\` without needing admin rights. The +node daemon ships beside the app at `resources\node-runtime\meshbay-node.exe`; +the client finds it automatically. + +It does ask one thing: **"Allow MeshBay through Windows Firewall now?"** — +say yes and one administrator confirmation adds both inbound rules the client +and the node need for WebRTC. Say no and the install finishes the same either +way; Windows will show its own "Allow access" dialog instead, once for each, +the first time they actually need to accept a connection. **ffmpeg** is required for video streaming and is *not* in the installer unless it was built with `-FfmpegDir`. Otherwise install it separately -- cgit v1.2.3