From b78288640d8c13cc0fb3f4ee7c82f3efac33940f Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 4 Sep 2026 17:29:24 +0200 Subject: feat: opt-in Windows service mode (boot-time, one elevation) + v1.0.0 The per-user Startup-folder launcher (W3) only ever runs after this user signs in. A real Windows Service would start earlier, but under LocalSystem/NetworkService -- accounts with no normal profile, so %LOCALAPPDATA%\meshbay\ (config, keystore, data) would not exist for it. Relocating storage to make that work is real surgery, deliberately not done here. Instead: a Scheduled Task, created once with admin rights, that runs AS THIS USER at boot without needing them to sign in first. `schtasks /create ... /ru /rp ""` with no `/it` registers an S4U (Service For User) logon -- no password stored anywhere, and unlike LocalSystem it loads this account's own profile, so config_dir()/ data_dir() need zero changes. The cost: S4U carries no network credential, which the node never needed -- everything it touches is local disk plus outbound internet. Creating the task needs admin (a boot trigger touches system-wide scheduler state, the same reason /sc onlogon needed it); querying/starting/stopping an existing one does not -- Task Scheduler grants the owning user that much itself, which is what lets the Node page's Start/Stop/Restart drive it with no further UAC prompts. meshbay_node/platform.py service_install/_remove/_status/_run/_end -- mirrors autostart_* but for the Scheduled Task; TASK_NAME moved here (was decorative before) meshbay_node/daemon.py new `service install|remove|start|stop|status` verb; restart-daemon and reset now check for the service task too packaging/win/service.ps1 the installer-side equivalent (extraResource); status/run/end never self-elevate -- only install/remove do, exactly matching what Task Scheduler itself requires packaging/win/service-mode.ps1 ONE elevated helper running service.ps1 + firewall.ps1 together, so choosing service mode costs exactly one UAC prompt, not two build/installer.nsh the install-time choice: "run as a background service?" (one elevation, both jobs) vs the existing per-user + separate firewall question. Checked first, unelevated, so re-running setup with everything already configured asks nothing. Uninstall offers the matching one-elevation cleanup, default No. src/main.js winServiceTaskStatus/Run/End, wired into node:installed, node:service-status/-stop/-restart and node:start: when the Scheduled Task exists, drive it; otherwise fall back to the existing per-user spawn/kill path. This is the hard requirement -- Start/Stop/Restart from the Node page must work in either mode. node-page.js / locales a hint explaining why the per-user autostart toggle is absent when service mode is active (info.mode from the backend, no new field to gate on -- it just isn't sent in that case) package.json: 0.1.0 -> 1.0.0. Verified: electron-builder compiles the new NSIS choice logic and ships all three scripts; service.ps1's S4U install fails cleanly (Access denied) when run unelevated, and its status/run/end never touch "runas". Cannot verify the elevated success path myself (no admin in this session) -- that needs a real UAC click. Node suite 843 pass / 25 skip; test_packaging_win.py pins the one-elevation property, the S4U flags, and that main.js actually checks the service task in all three handlers. Co-Authored-By: Claude Sonnet 5 --- packages/meshbay-node/src/meshbay_node/platform.py | 103 ++++++++++++++++++++- 1 file changed, 100 insertions(+), 3 deletions(-) (limited to 'packages/meshbay-node/src/meshbay_node/platform.py') diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py index 3c160a1..9b18618 100644 --- a/packages/meshbay-node/src/meshbay_node/platform.py +++ b/packages/meshbay-node/src/meshbay_node/platform.py @@ -199,9 +199,8 @@ def ffprobe_cmd() -> str: # to create — and this must work for an ordinary user with no admin rights. # So: a `.vbs` launcher in the per-user Startup folder. wscript runs it hidden # (Run(..., 0, ...)) at every sign-in; no console window, no admin, no -# third-party dependency. - -TASK_NAME = "MeshBay Node" # the name the Electron client shows +# third-party dependency. See the Service mode section below for the +# boot-capable, admin-once alternative built on top of Task Scheduler instead. def autostart_supported() -> bool: @@ -277,3 +276,101 @@ def autostart_end() -> None: if autostart_supported(): subprocess.run(["taskkill", "/IM", "meshbay-node.exe", "/F"], capture_output=True) + + +# ── Service mode (Windows, opt-in at install time) ─────────────────────────── +# +# The Startup-folder .vbs above only ever runs after *this* user signs in. A +# real Windows Service would run before anyone signs in, but under +# LocalSystem/NetworkService — accounts with no normal user profile, so +# %LOCALAPPDATA%\meshbay\ (config, keystore, data) would not exist for it. +# Relocating storage to make that work is real surgery (Phase 2, deliberately +# not this). +# +# The middle ground: a Scheduled Task, created once with admin rights, that +# runs *as this user* at system boot without needing them to sign in first. +# `schtasks /create ... /ru /rp ""` with no `/it` registers an S4U +# (Service For User) logon — no password stored anywhere, and unlike +# LocalSystem it loads this account's own profile, so config_dir()/data_dir() +# need no special-casing at all. The cost: S4U carries no *network* credential +# (no reaching a domain share as this user), which the node never needed +# anyway — everything it touches is local disk plus outbound internet. +# +# Creating the task needs admin (a boot-trigger touches system-wide scheduler +# state, the same reason /sc onlogon did — see the autostart section above). +# Querying, running and ending an *already-created* task, as the same user it +# was registered for, does not — Task Scheduler grants the owner that much by +# default, which is what lets the Node page drive it with no further prompts. + +TASK_NAME = "MeshBay Node" # the Scheduled Task's own name + + +def service_supported() -> bool: + return sys.platform == "win32" + + +def _current_user() -> str: + domain = os.environ.get("USERDOMAIN") or os.environ.get("COMPUTERNAME") or "." + user = os.environ.get("USERNAME") or "" + return f"{domain}\\{user}" if user else "" + + +def _schtasks(*args: str) -> subprocess.CompletedProcess: + return subprocess.run(["schtasks", *args], capture_output=True, text=True) + + +def service_status() -> dict: + """{'installed': bool, 'state': str}. 'state' is Task Scheduler's own word + ('Ready', 'Running', 'Disabled', ...), '' when not installed.""" + if not service_supported(): + return {"installed": False, "state": ""} + r = _schtasks("/query", "/tn", TASK_NAME, "/fo", "list") + if r.returncode != 0: + return {"installed": False, "state": ""} + state = "" + for line in r.stdout.splitlines(): + if line.lower().startswith("status:"): + state = line.split(":", 1)[1].strip() + break + return {"installed": True, "state": state} + + +def service_install(exe: str | None = None) -> None: + """ + Register the boot-time Scheduled Task. Needs admin — raises RuntimeError + with schtasks' own message on failure, which is "Access is denied." when + not elevated. + """ + if not service_supported(): + raise RuntimeError("service mode is Windows-only") + exe = exe or _node_exe() + if not exe: + raise RuntimeError( + "cannot locate the meshbay-node launcher — pass its path, or run " + "this from where meshbay-node is on PATH") + user = _current_user() + if not user: + raise RuntimeError("could not determine the current user (USERNAME unset)") + r = _schtasks("/create", "/tn", TASK_NAME, "/tr", f'"{exe}"', + "/sc", "onstart", "/ru", user, "/rp", "", "/rl", "limited", "/f") + if r.returncode != 0: + raise RuntimeError(f"schtasks /create failed: {r.stderr.strip() or r.stdout.strip()}") + + +def service_remove() -> None: + """Delete the Scheduled Task if present. Needs admin; silent otherwise + (mirrors autostart_remove — nothing to report if it was never installed).""" + if service_supported(): + _schtasks("/delete", "/tn", TASK_NAME, "/f") + + +def service_run() -> None: + """Start the task now. No admin needed for an already-registered task.""" + if service_supported(): + _schtasks("/run", "/tn", TASK_NAME) + + +def service_end() -> None: + """Stop the running instance, if any. No admin needed.""" + if service_supported(): + _schtasks("/end", "/tn", TASK_NAME) -- cgit v1.2.3