fix(tray): Windows tray icon now loads — PNG->ICO with BMP entries

fyne.io/systray requires .ico content on Windows, and LoadImage cannot read PNG-in-ICO. The embedded icons are PNG, so SetIcon always failed and no tray icon ever appeared. pngToIco decodes the PNG and re-encodes classic BMP (XOR + AND mask) entries at 16/32/48px — the format LoadImage has always supported. Verified: the 'unable to set icon' error is gone and the tray process stays up. feat(installer): wizard page, Start Menu icons, silent install params - Wizard page asks for the SSO Manager URL + join key, with an 'Open SSO install-agent page' button (ShellExec); values feed agent.yml - /SERVER_URL /JOIN_KEY /AUTH_TOKEN /PUBLIC_KEY and /B64_CONFIG (base64 of a full agent.yml, decoded by an inline B64Decode) drive the same result in /SILENT mode, so the SSO's Install Agent modal can emit one Windows command - [Icons]: Theta Agent Tray / Open Agent Config / Uninstall in Start Menu - WireGuard client launches its UI at the end of the MSI; taskkill after the msiexec step closes it (the tunnel is agent-managed) - tray starts right after install (not just at next logon) - Inno 7 fixes: controls parent to Page.Surface, SaveStringsToUTF8FileWithoutBOM Adds pngToIco structure tests (valid ICO dir + 32bpp DIBs) and a platform passthrough test for toWindowsIcon. Rebuilds all tracked dist binaries + the setup.exe.
2026-08-09 19:06:00 -07:00
parent ba2a619db5
commit 016a8fc6b6
6 changed files with 267 additions and 17 deletions
@@ -1,4 +1,4 @@
-; Theta Agent — Windows installer (Inno Setup 6.4+)
+; Theta Agent ??? Windows installer (Inno Setup 6.4+)
 ;
 ; Fully offline: bundles the agent, tray, session helper, the official WireGuard
 ; for Windows client, the OpenCredential credential provider, and the VC++ v14
@@ -9,8 +9,11 @@
 ;   theta-agent-2.1.0-windows-amd64-setup.exe /SILENT ^
 ;       /SERVER_URL=https://sso.example.com /JOIN_KEY=tjk_...
 ;
-; /SERVER_URL and /JOIN_KEY are written into agent.yml so the installed service
-; enrolls on first start (no UI, no extra click).
+; Interactively, a wizard page asks for the SSO Manager URL and a join key (with
+; a button that opens the SSO's Directory -> Install Agent page to mint one).
+; In silent mode, /SERVER_URL, /JOIN_KEY, /AUTH_TOKEN, /PUBLIC_KEY and
+; /B64_CONFIG (base64 of a full agent.yml) drive the same result. The values are
+; written into agent.yml so the installed service enrolls on first start.

 #ifndef MyAppVersion
  #define MyAppVersion "2.1.0"
@@ -58,7 +61,7 @@ Source: "{#AgentDir}\theta-agent-windows-amd64.exe"; DestDir: "{app}"; Flags: ig
 Source: "{#AgentDir}\theta-agent-tray-windows-amd64.exe"; DestDir: "{app}\tray"; Flags: ignoreversion
 Source: "{#AgentDir}\theta-agent-helper-windows-amd64.exe"; DestDir: "{app}"; Flags: ignoreversion

-; WireGuard for Windows — official, vendor-signed MSI. Installs offline (the
+; WireGuard for Windows ??? official, vendor-signed MSI. Installs offline (the
 ; driver is signed; no signature phone-home).
 Source: "{#VendorDir}\wireguard-amd64-0.5.3.msi"; DestDir: "{app}\vendor"; Flags: ignoreversion

@@ -67,6 +70,11 @@ Source: "{#VendorDir}\wireguard-amd64-0.5.3.msi"; DestDir: "{app}\vendor"; Flags
 Source: "{#VendorDir}\OpenCredentialInstaller-1.0.0.0.exe"; DestDir: "{app}\vendor"; Flags: ignoreversion
 Source: "{#VendorDir}\vc_redist.x64.exe"; DestDir: "{app}\vendor"; Flags: ignoreversion

+[Icons]
+Name: "{group}\Theta Agent Tray"; Filename: "{app}\tray\theta-agent-tray-windows-amd64.exe"; Comment: "Theta Agent status tray"
+Name: "{group}\Open Agent Config"; Filename: "notepad.exe"; Parameters: "{commonappdata}\Theta42\agent.yml"; Comment: "Open the agent configuration file"
+Name: "{group}\Uninstall Theta Agent"; Filename: "{uninstallexe}"
+
 [Registry]
 ; Start the tray for every interactive logon.
 Root: HKLM; Subkey: "Software\Microsoft\Windows\CurrentVersion\Run"; ValueType: string; ValueName: "ThetaAgentTray"; ValueData: "{app}\tray\theta-agent-tray-windows-amd64.exe"; Flags: uninsdeletevalue
@@ -74,17 +82,30 @@ Root: HKLM; Subkey: "Software\Microsoft\Windows\CurrentVersion\Run"; ValueType:
 [Run]
 ; VC++ v14 runtime (OpenCredential native deps).
 Filename: "{app}\vendor\vc_redist.x64.exe"; Parameters: "/install /quiet /norestart"; StatusMsg: "Installing VC++ runtime..."; Flags: runhidden waituntilterminated
-; OpenCredential credential provider — must be registered before logon.
+; OpenCredential credential provider ??? must be registered before logon.
 Filename: "{app}\vendor\OpenCredentialInstaller-1.0.0.0.exe"; Parameters: "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART"; StatusMsg: "Installing OpenCredential credential provider..."; Flags: runhidden waituntilterminated
 ; WireGuard for Windows client.
 Filename: "msiexec.exe"; Parameters: "/i ""{app}\vendor\wireguard-amd64-0.5.3.msi"" /qn /norestart"; StatusMsg: "Installing WireGuard client..."; Flags: runhidden waituntilterminated
+; The WireGuard client launches its UI at the end of the MSI; close it ??? the
+; tunnel is managed by the agent (wireguard.exe /installtunnelservice).
+Filename: "taskkill.exe"; Parameters: "/f /im wireguard.exe"; Flags: runhidden
 ; Register the agent as a SYSTEM auto-start service.
 Filename: "{app}\{#MyAppExeName}"; Parameters: "install-service"; StatusMsg: "Registering theta-agent service..."; Flags: runhidden waituntilterminated
+; Show the tray right away instead of waiting for the next logon.
+Filename: "{app}\tray\theta-agent-tray-windows-amd64.exe"; Description: "Start Theta Agent tray"; StatusMsg: "Starting Theta Agent tray..."; Flags: nowait postinstall skipifsilent

 [Code]
 var
  ServerURL: String;
  JoinKey: String;
+  AuthToken: String;
+  PublicKey: String;
+  B64Config: String;
+
+  AgentConfigPage: TWizardPage;
+  ServerURLEdit: TNewEdit;
+  JoinKeyEdit: TNewEdit;
+  OpenSSOButton: TNewButton;

 // Reads a custom setup command-line parameter (e.g. /SERVER_URL=https://...).
 // {param:...} raises when the parameter is absent, so the exception becomes "".
@@ -101,21 +122,145 @@ function InitializeSetup(): Boolean;
 begin
  ServerURL := GetCmdParam('SERVER_URL');
  JoinKey := GetCmdParam('JOIN_KEY');
+  AuthToken := GetCmdParam('AUTH_TOKEN');
+  PublicKey := GetCmdParam('PUBLIC_KEY');
+  B64Config := GetCmdParam('B64_CONFIG');
  Result := True;
 end;

+// Opens the SSO's Directory page so the operator can mint a join key right from
+// the wizard. Uses the Server URL they just typed.
+procedure OnOpenSSOClick(Sender: TObject);
+var
+  Url: String;
+  ErrorCode: Integer;
+begin
+  Url := Trim(ServerURLEdit.Text);
+  if Url = '' then begin
+    MsgBox('Enter the SSO Manager URL first (e.g. https://sso.example.com).',
+      mbInformation, MB_OK);
+    Exit;
+  end;
+  if not ShellExec('open', Url, '', '', SW_SHOWNORMAL, ewNoWait, ErrorCode) then
+    MsgBox('Could not open the browser: ' + SysErrorMessage(ErrorCode), mbError, MB_OK);
+end;
+
+procedure CreateAgentConfigPage();
+var
+  InfoLabel: TNewStaticText;
+  UrlLabel: TNewStaticText;
+  KeyLabel: TNewStaticText;
+begin
+  AgentConfigPage := CreateCustomPage(wpWelcome,
+    'SSO Manager connection',
+    'Tell the agent which SSO to enroll with.');
+
+  InfoLabel := TNewStaticText.Create(AgentConfigPage);
+  InfoLabel.Parent := AgentConfigPage.Surface;
+  InfoLabel.WordWrap := True;
+  InfoLabel.Caption := 'Paste the SSO Manager URL for this deployment. Then either paste a join key '
+    + '(mint one with the button below, under Directory -> Install Agent) or leave it blank to '
+    + 'enroll from the tray / CLI later.';
+  InfoLabel.AutoSize := True;
+  InfoLabel.Width := AgentConfigPage.Surface.Width;
+
+  UrlLabel := TNewStaticText.Create(AgentConfigPage);
+  UrlLabel.Parent := AgentConfigPage.Surface;
+  UrlLabel.Caption := 'SSO Manager URL:';
+  UrlLabel.Top := InfoLabel.Top + InfoLabel.Height + 16;
+
+  ServerURLEdit := TNewEdit.Create(AgentConfigPage);
+  ServerURLEdit.Parent := AgentConfigPage.Surface;
+  ServerURLEdit.Top := UrlLabel.Top + UrlLabel.Height + 4;
+  ServerURLEdit.Width := AgentConfigPage.Surface.Width;
+  ServerURLEdit.Text := ServerURL;
+
+  OpenSSOButton := TNewButton.Create(AgentConfigPage);
+  OpenSSOButton.Parent := AgentConfigPage.Surface;
+  OpenSSOButton.Top := ServerURLEdit.Top + ServerURLEdit.Height + 8;
+  OpenSSOButton.Left := ServerURLEdit.Left;
+  OpenSSOButton.Caption := 'Open SSO install-agent page...';
+  OpenSSOButton.Width := 190;
+  OpenSSOButton.OnClick := @OnOpenSSOClick;
+
+  KeyLabel := TNewStaticText.Create(AgentConfigPage);
+  KeyLabel.Parent := AgentConfigPage.Surface;
+  KeyLabel.Caption := 'Join key (optional):';
+  KeyLabel.Top := OpenSSOButton.Top + OpenSSOButton.Height + 12;
+
+  JoinKeyEdit := TNewEdit.Create(AgentConfigPage);
+  JoinKeyEdit.Parent := AgentConfigPage.Surface;
+  JoinKeyEdit.Top := KeyLabel.Top + KeyLabel.Height + 4;
+  JoinKeyEdit.Width := AgentConfigPage.Surface.Width;
+  JoinKeyEdit.Text := JoinKey;
+end;
+
+procedure InitializeWizard();
+begin
+  CreateAgentConfigPage();
+end;
+
+// Pull the values the operator typed into the wizard so WriteAgentConfig can use
+// them; silent installs keep the command-line params.
+procedure CurPageChanged(CurPageID: Integer);
+begin
+  if CurPageID = AgentConfigPage.ID then begin
+    ServerURL := Trim(ServerURLEdit.Text);
+    JoinKey := Trim(JoinKeyEdit.Text);
+  end;
+end;
+
+// Minimal base64 decoder returning a plain String (agent.yml is ASCII).
+function B64Decode(const S: String): String;
+var
+  i, v, p: Integer;
+  buf: array[0..3] of Integer;
+  outStr: String;
+begin
+  outStr := '';
+  v := 0;
+  for i := 1 to Length(S) do begin
+    if S[i] = '=' then begin
+      buf[v] := 0;
+      Inc(v);
+    end else begin
+      p := Pos(S[i], 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/');
+      buf[v] := p - 1;
+      Inc(v);
+    end;
+    if v = 4 then begin
+      outStr := outStr + Chr((buf[0] shl 2) or (buf[1] shr 4));
+      outStr := outStr + Chr(((buf[1] and $F) shl 4) or (buf[2] shr 2));
+      outStr := outStr + Chr(((buf[2] and 3) shl 6) or buf[3]);
+      v := 0;
+    end;
+  end;
+  Result := outStr;
+end;
+
 // Write agent.yml only after all files are in place. The file lives in
 // ProgramData so the SYSTEM service and user processes share it.
 procedure WriteAgentConfig(ConfigPath: String);
 var
  Lines: TArrayOfString;
+  Decoded: String;
 begin
-  SetArrayLength(Lines, 13);
+  // /B64_CONFIG=<base64 agent.yml> overrides everything (the SSO's Custom Config
+  // wizard emits it).
+  if B64Config <> '' then begin
+    Decoded := B64Decode(B64Config);
+    SetArrayLength(Lines, 1);
+    Lines[0] := Decoded;
+    SaveStringsToUTF8FileWithoutBOM(ConfigPath, Lines, False);
+    Exit;
+  end;
+
+  SetArrayLength(Lines, 17);
  Lines[0]  := '# theta-agent configuration (written by installer)';
  Lines[1]  := 'server_url: "' + ServerURL + '"';
-  Lines[2]  := 'auth_token: ""';
+  Lines[2]  := 'auth_token: "' + AuthToken + '"';
  Lines[3]  := 'join_key: "' + JoinKey + '"';
-  Lines[4]  := 'public_key: ""';
+  Lines[4]  := 'public_key: "' + PublicKey + '"';
  Lines[5]  := 'auto_vpn: false';
  Lines[6]  := 'service_name: "theta-agent"';
  Lines[7]  := 'desktop_helper: "' + ExpandConstant('{app}') + '\theta-agent-helper-windows-amd64.exe"';
@@ -124,7 +269,11 @@ begin
  Lines[10] := '  telemetry: true';
  Lines[11] := '  ldap_tunnel: true';
  Lines[12] := '  wireguard: true';
-  SaveStringsToUTF8File(ConfigPath, Lines, False);
+  Lines[13] := '  secrets: false';
+  Lines[14] := '  iam: false';
+  Lines[15] := '  reboot: false';
+  Lines[16] := '  arbitrary_bash: false';
+  SaveStringsToUTF8FileWithoutBOM(ConfigPath, Lines, False);
 end;

 procedure CurStepChanged(CurStep: TSetupStep);