path: root/packages/meshbay-node/tests/test_packaging_win.py

"""
The Windows installer (W4): a single per-user NSIS package carrying the Electron
client and the frozen node daemon.

Like test_packaging_units.py this reads the config rather than building anything
— there is no electron-builder or PyInstaller run here. Weak evidence, and the
right kind for the defects it guards against: a per-machine flag that would make
the installer demand admin, a build step wired to the wrong file, the 150 MB
node-runtime artifact slipping into git, the autostart seam between the NSIS
uninstaller and meshbay_node.platform drifting apart.
"""

import json
import re
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[3]
CLIENT = ROOT / "packages" / "meshbay-client"
PKG_JSON = CLIENT / "package.json"
WIN = ROOT / "packaging" / "win"
NSH = CLIENT / "build" / "installer.nsh"

pytestmark = pytest.mark.skipif(
    not PKG_JSON.exists() or not WIN.exists(),
    reason="Windows packaging not present")


def _pkg() -> dict:
    return json.loads(PKG_JSON.read_text(encoding="utf-8"))


# ── electron-builder: Windows target ────────────────────────────────────────

def test_the_windows_target_is_nsis_with_the_committed_icon():
    win = _pkg()["build"]["win"]
    assert win["target"] == "nsis"
    icon = CLIENT / win["icon"]
    assert icon.suffix == ".ico" and icon.exists(), f"{icon} is missing"


def test_the_installer_is_per_user_and_never_asks_for_admin():
    """
    A logon-triggered scheduled task needs elevation (that is why W3 uses the
    Startup folder), and the whole desktop design is no-admin. perMachine or
    allowElevation here would undo that at install time.
    """
    nsis = _pkg()["build"]["nsis"]
    assert nsis["oneClick"] is False
    assert nsis["perMachine"] is False
    assert nsis["allowElevation"] is False
    assert nsis["allowToChangeInstallationDirectory"] is True


def test_the_node_runtime_is_carried_as_an_extraresource():
    """
    PyInstaller output lands in packages/meshbay-client/node-runtime/ and rides
    into the package under resources/node-runtime/. src/main.js:findNodeBinary
    resolves exactly that path (process.resourcesPath / node-runtime /
    meshbay-node.exe), so the two names must agree.
    """
    extra = _pkg()["build"]["win"]["extraResources"]
    entry = next((e for e in extra if e.get("to") == "node-runtime"), None)
    assert entry, "no extraResources entry mapping to node-runtime"
    assert entry["from"] == "node-runtime"

    main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
    assert "'node-runtime', 'meshbay-node.exe'" in main_js, (
        "findNodeBinary no longer looks for the bundled daemon where "
        "extraResources puts it")


def test_find_node_binary_strips_stray_cr_from_multiline_where_output():
    """
    where.exe/which can list more than one match on PATH, and each line
    keeps its own trailing \\r on Windows. `stdout.trim().split('\\n')[0]`
    only strips the ends of the *whole* string, so with 2+ matches a stray
    \\r stayed glued to the end of the first line -- which then landed
    inside the quoted path written into the Startup .vbs and broke
    VBScript's parser with "Unterminated string constant" the next time
    Windows ran it at sign-in. Reproduced live 2026-09-05 (this user's own
    machine has both a dev venv and an installed build on PATH) and fixed
    by splitting on \\r?\\n and trimming each candidate line individually.
    """
    main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
    assert "stdout.split(/\\r?\\n/)" in main_js, (
        "findNodeBinary must split where.exe/which output on \\r?\\n and "
        "trim each line, not a single stdout.trim() over the whole blob")
    assert "stdout.trim().split('\\n')[0]" not in main_js


def test_firewall_helper_is_carried_as_an_extraresource():
    """packaging/win/firewall.ps1 must ride into resources/, at the fixed
    path installer.nsh invokes it from ($INSTDIR\\resources\\firewall.ps1)."""
    extra = _pkg()["build"]["win"]["extraResources"]
    entry = next((e for e in extra if e.get("to") == "firewall.ps1"), None)
    assert entry, "no extraResources entry mapping to firewall.ps1"
    assert entry["from"].endswith("packaging/win/firewall.ps1")
    assert (ROOT / "packaging" / "win" / "firewall.ps1").exists()


def test_dist_win_delegates_to_the_build_script():
    """`dist` (Linux) delegates to build-client.sh; `dist:win` is its
    counterpart and must not be a second inline electron-builder invocation."""
    scripts = _pkg()["scripts"]
    assert "dist:win" in scripts
    assert "build-win.ps1" in scripts["dist:win"]
    # `dist` stays Linux-only and unchanged (test_desktop_shell.py guards it too).
    assert "win" not in scripts["dist"].lower()


# ── the build scripts exist and point at real files ────────────────────────

@pytest.mark.parametrize("name", [
    "build-win.ps1",
    "build-node-runtime.ps1",
    "meshbay-node.spec",
    "node-entry.py",
    "README.md",
])
def test_packaging_win_ships_its_scripts(name):
    assert (WIN / name).exists(), f"packaging/win/{name} is missing"


def test_the_pyinstaller_entry_point_is_the_daemon_main():
    src = (WIN / "node-entry.py").read_text(encoding="utf-8")
    assert "from meshbay_node.daemon import main" in src
    assert "main()" in src


def test_the_spec_pulls_in_the_awkward_dependencies_whole():
    """
    The C/Rust-extension and dynamic-import packages are the ones PyInstaller's
    static pass drops. If someone trims collect_all to shrink the build, the
    frozen daemon fails at runtime, not at build time.
    """
    spec = (WIN / "meshbay-node.spec").read_text(encoding="utf-8")
    for pkg in ("aiortc", "av", "aioquic", "pydantic_core", "uvicorn",
                "watchdog", "guessit", "blake3", "meshbay_node", "meshbay_common"):
        assert re.search(rf'["\']{re.escape(pkg)}["\']', spec), (
            f"{pkg} dropped from the PyInstaller spec's collect list")


def test_the_frozen_exe_carries_a_version_resource():
    """
    Without it the Windows Firewall prompt, Task Manager and Properties show a
    bare "meshbay-node". The version is read from the installed package so it
    tracks pyproject rather than being a second copy to update.
    """
    spec = (WIN / "meshbay-node.spec").read_text(encoding="utf-8")
    assert "VSVersionInfo" in spec
    assert "version=_version_info" in spec, "EXE() is not given the version resource"
    assert 'StringStruct("ProductName", "MeshBay Node")' in spec
    assert '_pkg_version("meshbay-node")' in spec, "version is hardcoded, not read from the package"


# ── the artifact never gets committed ──────────────────────────────────────

def test_the_node_runtime_output_is_gitignored():
    """It is ~150 MB of frozen Python. The `ui/` fork guard in
    test_desktop_shell.py exists for the same reason."""
    gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8")
    assert "packages/meshbay-client/node-runtime/" in gitignore


# ── the NSIS ↔ platform.py autostart seam ─────────────────────────────────

def test_the_uninstaller_clears_the_autostart_launcher():
    """
    W3's `meshbay-node autostart install` drops a .vbs in the Startup folder
    (meshbay_node.platform._startup_vbs). After an uninstall it would point
    wscript at a deleted binary every sign-in, so customUnInstall must delete
    it — and at the path platform.py actually uses.
    """
    from meshbay_node import platform as plat

    nsh = NSH.read_text(encoding="utf-8")
    assert "!macro customUnInstall" in nsh
    assert "taskkill /IM meshbay-node.exe /F" in nsh

    # The tail platform.py builds, made NSIS-relative ($APPDATA == %APPDATA%).
    tail = plat._startup_vbs()
    parts = tail.parts
    i = parts.index("Microsoft")
    rel = "\\".join(parts[i:])                       # Microsoft\...\Startup\MeshBay Node.vbs
    assert rel in nsh, (
        f"customUnInstall does not delete {rel!r} — the W3 autostart path "
        "changed and installer.nsh was not updated")


def test_customInstall_stops_a_running_daemon_before_overwriting_it():
    nsh = NSH.read_text(encoding="utf-8")
    body = nsh.split("!macro customInstall", 1)[1].split("!macroend", 1)[0]
    assert "taskkill /IM meshbay-node.exe /F" in body


# ── the one-time elevated firewall step ─────────────────────────────────────

def _macro_body(nsh: str, name: str) -> str:
    return nsh.split(f"!macro {name}", 1)[1].split("!macroend", 1)[0]


def test_the_installer_offers_a_service_mode_choice_with_one_elevation():
    """
    Adding a firewall rule or a boot-time Scheduled Task both need admin; the
    install itself never elevates (build.nsis allowElevation:false). So this
    must be opt-in (a Yes/No the user can decline) and skipped entirely in a
    silent install — an unattended `/S` install must never pop a UAC prompt on
    its own. Choosing service mode must fold the Scheduled Task AND the
    firewall rules into ONE elevation (service-mode.ps1), never two.
    """
    nsh = NSH.read_text(encoding="utf-8")
    install = _macro_body(nsh, "customInstall")

    assert "${IfNot} ${Silent}" in install, (
        "the mode choice is not guarded against silent installs")
    assert install.count("MessageBox MB_YESNO") == 2, (
        "expected exactly two questions: service-mode-or-not, then (only in "
        "the per-user branch) the firewall-only question")
    assert 'ExecShellWait "runas"' in install
    # Service mode: one elevated call for both jobs, not one each.
    assert 'service-mode.ps1" -Action install' in install
    assert 'firewall.ps1" add' not in install.split("mb_peruser_mode:", 1)[0], (
        "service mode must not ALSO separately elevate for firewall.ps1 — "
        "service-mode.ps1 already does that in the same elevation")
    # Per-user mode (declined the service question) keeps today's separate,
    # still-opt-in firewall step.
    peruser_branch = install.split("mb_peruser_mode:", 1)[1]
    assert 'firewall.ps1" add' in peruser_branch


def test_reinstalling_with_everything_already_in_place_asks_nothing():
    """
    Get-NetFirewallRule needs no admin, only New/Remove do — so customInstall
    checks the firewall rules first, unelevated, and only reaches the mode
    question (and therefore a possible UAC prompt) when something is actually
    missing. Without this, running setup a second time — an upgrade, a repair
    install — would re-ask the question (and, in service mode, re-trigger UAC)
    even though nothing needs to change. Checking the firewall rules alone is
    enough: service-mode.ps1 always sets up both together, so if the rules
    are there, so is everything else that was chosen last time.
    """
    nsh = NSH.read_text(encoding="utf-8")
    install = _macro_body(nsh, "customInstall")

    check_line = 'firewall.ps1" check'
    assert check_line in install
    mode_question = "Run MeshBay Node as a background service?"
    # The check must run, and be evaluated, before the mode question — not after.
    assert install.index(check_line) < install.index(mode_question)
    assert "Pop $0" in install and "${If} $0 == 0" in install
    assert "Goto mb_mode_done" in install


def test_the_uninstaller_offers_to_remove_everything_privileged_default_no():
    """
    Opt-in on the way out too, and defaulting to No: a stale allow-rule or
    Scheduled Task is inert, so this should not nag. One elevation removes
    both, unconditionally — service-mode.ps1's own remove actions are each
    no-ops when there is nothing to remove, so this is safe to run whether or
    not service mode was ever chosen.
    """
    nsh = NSH.read_text(encoding="utf-8")
    uninstall = _macro_body(nsh, "customUnInstall")

    assert "${IfNot} ${Silent}" in uninstall
    assert "/SD IDNO" in uninstall, "the uninstall prompt should default to No"
    assert 'service-mode.ps1" -Action remove' in uninstall
    assert 'ExecShellWait "runas"' in uninstall


# ── service mode itself (packaging/win/service.ps1, service-mode.ps1) ──────

def test_service_ps1_and_service_mode_ps1_are_extraresources():
    for name in ("service.ps1", "service-mode.ps1"):
        entry = next(
            (e for e in _pkg()["build"]["win"]["extraResources"] if e.get("to") == name),
            None)
        assert entry, f"no extraResources entry mapping to {name}"
        assert entry["from"].endswith(f"packaging/win/{name}")
        assert (WIN / name).exists()


def test_service_install_uses_s4u_not_a_stored_password():
    """
    Register-ScheduledTask -LogonType S4U: no password stored anywhere, and
    — unlike LocalSystem/NetworkService — it loads this account's own
    profile, so %LOCALAPPDATA%\\meshbay\\ needs no relocation.

    Not `schtasks /create`: schtasks only *infers* the logon type from
    whether /rp is present, and both readings broke live on a blank-password
    account (common on a personal PC, 2026-09-05) -- `/rp ""` fails
    credential validation ("the user name or password is incorrect", even
    though nothing is wrong), and omitting /rp registers "Interactive only"
    instead of S4U, which never runs at boot and does not launch anything
    even run on demand while signed in. -LogonType S4U is explicit, so losing
    it (e.g. "simplifying" back to schtasks, or dropping -ErrorAction Stop so
    a permission failure silently falls through to "installed") would
    reintroduce one of those two live-reproduced failures.
    """
    src = (WIN / "service.ps1").read_text(encoding="utf-8")
    # Isolate the actual "install" case from the docstring above it (which
    # names these same cmdlets in prose) -- checks below must see only code.
    lines = src.splitlines()
    install_start = next(i for i, line in enumerate(lines) if '"install" {' in line)
    remove_start = next(i for i, line in enumerate(lines) if '"remove" {' in line)
    install_block = "\n".join(lines[install_start:remove_start])

    assert "New-ScheduledTaskTrigger -AtStartup" in install_block, (
        "must trigger at boot, not at sign-in")
    assert "-LogonType S4U" in install_block, (
        "must request S4U explicitly, not infer it from /rp")
    assert "Register-ScheduledTask" in install_block
    assert "-ErrorAction Stop" in install_block, (
        "a permission failure must throw, not fall through as if it installed")
    assert "Get-Credential" not in src, "no password should ever be prompted for"
    assert "schtasks" not in install_block, (
        "the install branch must not fall back to schtasks /create")

    # The install branch must not assign to `$action` (any case): that name is
    # this script's own [ValidateSet(...)][string]$Action parameter, and
    # `$action = New-ScheduledTaskAction ...` coerces the CimInstance to the
    # string "MSFT_TaskExecAction", which Register-ScheduledTask -Action then
    # refuses -- reproduced live 2026-09-05, the install path never created the
    # task at all until this was renamed.
    assert not re.search(r"(?im)^\s*\$action\s*=", install_block), (
        "do not assign to $action in service.ps1 -- it shadows the [string]"
        "$Action parameter and Register-ScheduledTask -Action then gets a string")


def test_service_task_name_is_the_same_everywhere():
    """One name, three places: meshbay_node.platform.TASK_NAME (the CLI),
    service.ps1 (the installer), and main.js's WIN_SERVICE_TASK (the client
    driving Start/Stop/Restart). A mismatch means the client manages a task
    that does not exist, or vice versa."""
    from meshbay_node import platform as plat

    service_ps1 = (WIN / "service.ps1").read_text(encoding="utf-8")
    main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")

    assert f'$TASK_NAME = "{plat.TASK_NAME}"' in service_ps1
    assert f"WIN_SERVICE_TASK = '{plat.TASK_NAME}'" in main_js


def test_service_status_reports_state_without_admin():
    """status/run/end must not need elevation once the task exists (only
    install/remove do) — that is what lets the Node page drive it with no
    further UAC prompts. Nothing in those branches should invoke as an
    elevated call; only the two macros in installer.nsh use "runas"."""
    src = (WIN / "service.ps1").read_text(encoding="utf-8")
    assert "runas" not in src.lower(), (
        "service.ps1 itself must never self-elevate — installer.nsh already "
        "runs the whole script elevated for install/remove, and the client "
        "calls status/run/end directly, unelevated")


HUB_STATIC = ROOT / "packages" / "meshbay-hub" / "src" / "meshbay_hub" / "static"


def test_service_mode_toggle_elevates_the_same_script_the_installer_runs():
    """
    The installer's own mode question is effectively one-shot (it skips
    itself the moment the firewall rules exist for any reason, and per-user
    mode sets those up on its own with no Scheduled Task involved) -- so
    declining once, or the rules existing for any other reason, is a dead
    end through setup alone. The Node page's toggle is the other door in
    (and out), and it must drive service-mode.ps1 -- the exact script
    installer.nsh runs -- so the two paths can never disagree about what
    "service mode" means. One elevation (-Verb RunAs), no stored password.
    """
    main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
    assert "winElevateServiceMode" in main_js
    fn = main_js.split("function winElevateServiceMode", 1)[1]
    fn = fn[:fn.index("\n  }\n")]
    assert "service-mode.ps1" in fn
    assert "-Verb RunAs" in fn or "'-Verb', 'RunAs'" in fn or "-Verb', 'RunAs'" in fn
    assert "Get-Credential" not in fn

    handler = main_js.split("ipcMain.handle('node:service-mode'", 1)[1]
    handler = handler[:handler.index("ipcMain.handle(")]
    assert "winElevateServiceMode" in handler
    assert "'install'" in handler or '"install"' in handler
    assert "'remove'" in handler or '"remove"' in handler


def test_node_page_service_mode_toggle_is_wired_end_to_end():
    """preload.js -> platform.js -> node-page.js, the same three-layer shape
    the existing autostart toggle uses. A break anywhere in this chain means
    the checkbox renders but does nothing, or never renders at all."""
    preload = (CLIENT / "src" / "preload.js").read_text(encoding="utf-8")
    assert "serviceMode:" in preload
    assert "'node:service-mode'" in preload

    platform_js = (HUB_STATIC / "platform.js").read_text(encoding="utf-8")
    assert "serviceMode:" in platform_js
    assert "bridge.node.serviceMode('install')" in platform_js
    assert "bridge.node.serviceMode('remove')" in platform_js

    node_page = (HUB_STATIC / "node-page.js").read_text(encoding="utf-8")
    assert "platform.node.serviceMode.available" in node_page
    assert "platform.node.serviceMode.install()" in node_page
    assert "platform.node.serviceMode.remove()" in node_page
    # Checked state must reflect the CURRENT mode, not a separate flag --
    # otherwise the toggle and the status panel above it could disagree.
    assert "info.mode === 'service'" in node_page


def test_the_help_smoke_test_joins_multiline_output_before_matching():
    """
    `& exe --help 2>&1` is an ARRAY once the output wraps past one line, which
    it now does with `autostart`/`service` in the verb list. `$array -notmatch
    X` is a FILTER, not a boolean test -- it returns the *non-matching*
    elements, and any non-empty array is truthy in `if()` regardless of what
    is in it. Almost every help line lacks the literal string "meshbay-node",
    so an unjoined check throws unconditionally the moment --help exceeds one
    line: found when this specific verb list finally grew past that point,
    which is exactly the kind of one-off silent breakage a passing build
    yesterday gives no warning of today.
    """
    src = (WIN / "build-node-runtime.ps1").read_text(encoding="utf-8")
    body = src.split("smoke test: meshbay-node --help", 1)[1]
    body = body[:800]
    assert '-join "`n"' in body, (
        "the captured --help output must be joined to a single string before "
        "any -match/-notmatch check, or a multi-line result silently always "
        "fails the smoke test")
    # And the join has to happen at capture time, not on some other variable.
    assert '(& $exe --help 2>&1) -join' in body


def test_main_js_drives_the_service_task_for_all_three_actions():
    """The hard requirement: Start/Stop/Restart from the Node page must
    control the Scheduled Task when service mode is active, not just spawn a
    detached process that has nothing to do with it."""
    main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
    for handler in ("node:service-stop", "node:service-restart", "node:start"):
        body = main_js.split(f"ipcMain.handle('{handler}'", 1)[1]
        body = body[:body.index("ipcMain.handle(")]
        assert "winServiceTaskStatus" in body, f"{handler} never checks for the service task"


def test_node_start_provisions_before_it_ever_touches_the_service_task():
    """
    On a fresh install with service mode chosen, the Scheduled Task exists
    before anything is provisioned (node.toml is written by the wizard, not
    by the installer). node:start must call provisionNode() first and only
    then ask about the service task / spawn -- reversed, the very first
    "start" from the wizard would run (or query) an unconfigured daemon
    instead of the one it just told the caller to expect.

    A bare unprovisioned run is independently proven harmless
    (test_a_bare_invocation_with_no_config_yet_exits_cleanly in
    test_cli_dispatch.py), so this is about correctness of *this* call
    actually starting the daemon the wizard just configured, not about
    safety if the order were reversed.
    """
    main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
    body = main_js.split("ipcMain.handle('node:start'", 1)[1]
    body = body[:body.index("ipcMain.handle(")]

    provision_at = body.index("provisionNode(")
    service_check_at = body.index("winServiceTaskStatus")
    assert provision_at < service_check_at, (
        "node:start checks the service task before provisioning — a fresh "
        "install's first Start would run/query the daemon before node.toml "
        "exists for it to read")


def test_node_start_links_the_node_key_on_windows_not_only_linux():
    """
    The daemon comes up at 'waiting_for_account' until its Ed25519 key is
    linked to the hub account it runs as. The Linux branch of node:start does
    that link inline (`PUT /v1/users/me/node_key`); the win32 branch used to
    just return the first reachable status, so the Create Group wizard span on
    "Detecting local node…" for ever and the only way through was linking the
    key by hand on the Profile page.

    Pin that the win32 branch now performs the same link before it reports the
    node started.
    """
    main_js = (CLIENT / "src" / "main.js").read_text(encoding="utf-8")
    body = main_js.split("ipcMain.handle('node:start'", 1)[1]
    body = body[:body.index("ipcMain.handle(")]
    win_branch = body.split("process.platform === 'win32'", 1)[1]
    win_branch = win_branch[:win_branch.index("process.platform !== 'linux'")]
    assert "linkNodeKeyAndAwaitRunning" in win_branch, (
        "node:start's win32 branch never links the node key — the daemon will "
        "sit at waiting_for_account and the wizard will hang")

    helper = main_js.split("async function linkNodeKeyAndAwaitRunning", 1)[1]
    helper = helper[:2000]
    assert "/v1/users/me/node_key" in helper
    assert "waiting_for_account" in helper and "waiting_for_node_key" in helper


def test_firewall_ps1_targets_both_executables_and_is_idempotent():
    """One script, both rules — so installer.nsh only ever has to name it
    once on the way in and once on the way out."""
    src = (ROOT / "packaging" / "win" / "firewall.ps1").read_text(encoding="utf-8")
    assert "MeshBay.exe" in src
    assert "node-runtime" in src and "meshbay-node.exe" in src
    # Remove-then-add: a re-run (reinstall, or install after a manual add)
    # must not leave duplicate rules.
    assert src.index("Remove-NetFirewallRule") < src.index("New-NetFirewallRule")


def test_firewall_ps1_also_covers_lan_casting():
    """
    The WebRTC rules only reach MeshBay.exe / meshbay-node.exe; the cast HTTP
    relay (src/cast-relay.js, fixed TCP 19550-19553) and mDNS device discovery
    (src/cast-chromecast.js, bonjour-service, UDP 5353) are a separate surface
    on the client alone, and need their own ports and protocols. Ports here
    must agree with cast-relay.js's own constants and with the Linux
    definitions in packaging/firewall/*/meshbay-cast.xml — three descriptions
    of one port range that must not drift apart.
    """
    src = (ROOT / "packaging" / "win" / "firewall.ps1").read_text(encoding="utf-8")
    assert "19550-19553" in src, "cast TCP range missing or does not match cast-relay.js"
    assert '"5353"' in src, "mDNS discovery port (UDP 5353) missing"

    relay = (CLIENT / "src" / "cast-relay.js").read_text(encoding="utf-8")
    assert "PORT_BASE = 19550" in relay and "PORT_COUNT = 4" in relay, (
        "cast-relay.js's port range changed — update firewall.ps1 to match")

    firewalld = (ROOT / "packaging" / "firewall" / "firewalld" / "meshbay-cast.xml").read_text(
        encoding="utf-8")
    assert "19550-19553" in firewalld and "5353" in firewalld, (
        "the Linux and Windows cast firewall definitions have drifted apart")


def test_the_bundled_daemon_goes_on_the_user_path_and_comes_back_off():
    """
    The installer has no console entry point of its own; without this the
    operator has to `cd` into resources\\node-runtime\\ to run `meshbay-node`.
    The add uses stock WordFunc (no EnVar plugin — electron-builder's NSIS does
    not bundle it) and the same $INSTDIR-relative string on the way out.
    """
    nsh = NSH.read_text(encoding="utf-8")
    assert "!insertmacro WordAdd" in nsh and "!insertmacro un.WordAdd" in nsh

    install = nsh.split("!macro customInstall", 1)[1].split("!macroend", 1)[0]
    uninstall = nsh.split("!macro customUnInstall", 1)[1].split("!macroend", 1)[0]
    assert 'HKCU "Environment" "Path"' in install
    assert "${WordAdd}" in install and '"+${MB_NODE_BIN}"' in install
    assert "${un.WordAdd}" in uninstall and '"-${MB_NODE_BIN}"' in uninstall
    # New shells need the broadcast to notice.
    assert "WM_WININICHANGE" in install and "WM_WININICHANGE" in uninstall
    # PATH points at the real .exe dir, so `where meshbay-node` resolves to the
    # binary the client and the W3 launcher use too — not a shim.
    assert 'MB_NODE_BIN "$INSTDIR\\resources\\node-runtime"' in nsh


# ── ffmpeg: bundled by default (fetch-ffmpeg.ps1) ───────────────────────────

def test_fetch_ffmpeg_and_its_license_notice_exist():
    assert (WIN / "fetch-ffmpeg.ps1").exists()
    notice = WIN / "LICENSE-ffmpeg.txt"
    assert notice.exists()
    text = notice.read_text(encoding="utf-8")
    assert "GPL" in text
    assert "ffmpeg.org" in text or "FFmpeg/FFmpeg" in text, (
        "the notice must point at where the corresponding source actually is")


def test_ffmpeg_is_pinned_to_a_dated_release_not_the_moving_latest_alias():
    """
    BtbN repoints the "latest" release on every auto-build (their asset
    filenames even embed a fresh git-describe each time), so a URL built from
    that alias silently changes what a build fetches. The dated tag
    (autobuild-YYYY-MM-DD-HH-MM) is immutable once published -- that is what
    makes the pinned checksum mean anything.
    """
    src = (WIN / "fetch-ffmpeg.ps1").read_text(encoding="utf-8")
    tag_match = re.search(r'\$FFMPEG_TAG\s*=\s*"([^"]+)"', src)
    assert tag_match, "no $FFMPEG_TAG pin found"
    assert re.match(r"autobuild-\d{4}-\d{2}-\d{2}-\d{2}-\d{2}$", tag_match.group(1)), (
        f"{tag_match.group(1)!r} is not a dated release tag")
    assert "/releases/latest/" not in src and "/releases/download/latest/" not in src

    sha_match = re.search(r'\$FFMPEG_SHA256\s*=\s*"([0-9a-f]+)"', src)
    assert sha_match, "no $FFMPEG_SHA256 pin found"
    assert len(sha_match.group(1)) == 64, "not a full sha256 hex digest"

    assert '$FFMPEG_URL' in src and '$FFMPEG_TAG' in src.split("$FFMPEG_URL", 1)[1][:200], (
        "the download URL must be built from the pinned tag")


def test_ffplay_is_excluded_from_the_bundle():
    """The vendor zip carries an SDL2 player MeshBay never invokes (~17 MB);
    bundling it would be the collect_all-everything instinct applied where a
    fixed allowlist is right instead."""
    src = (WIN / "fetch-ffmpeg.ps1").read_text(encoding="utf-8")
    keep_block = src.split("$KEEP_FILES", 1)[1].split(")", 1)[0]
    assert "ffplay" not in keep_block
    assert "ffmpeg.exe" in keep_block and "ffprobe.exe" in keep_block


def test_ffmpeg_bundling_is_the_default_not_opt_in():
    """
    Video streaming needs a real H.264 encoder (libx264, GPL -- no LGPL-only
    ffmpeg build has one), and asking an end user to separately run
    `winget install ffmpeg` is not viable for a non-technical install (needs
    network + winget present at that moment, fails silently). So bundling
    must be the default, with an explicit opt-out for local iteration --
    the reverse of the old -FfmpegDir opt-in this replaced.
    """
    runtime_src = (WIN / "build-node-runtime.ps1").read_text(encoding="utf-8")
    assert "SkipFfmpeg" in runtime_src
    assert "FfmpegDir" not in runtime_src, "the old opt-in mechanism should be gone, not parallel"
    assert "fetch-ffmpeg.ps1" in runtime_src

    win_src = (WIN / "build-win.ps1").read_text(encoding="utf-8")
    assert "SkipFfmpeg" in win_src
    assert "FfmpegDir" not in win_src