User-reported install fixes:
- Branding: every user-facing 'SSO Manager' string now says 'Theta Directory'
(agent logs, CLI usage, agent.yml.example, installer wizard).
- Wizard page: the URL/join-key text boxes were never shown. The layout used
Surface.Width (0 at wizard init) instead of SurfaceWidth and combined
WordWrap with AutoSize (mutually exclusive in VCL). Rewritten with the
canonical Inno pattern (SurfaceWidth + ScaleY + explicit label height).
- No console window after install: the tray and helper now build as
GUI-subsystem binaries (-H=windowsgui) in build_all.sh and
scripts/setup-build-env.ps1. The agent stays a console app for foreground
debugging (as a service it never shows a console).
- The daemon never came up after install: install-service now starts the
service immediately, so the tray IPC socket exists right away and the tray
connects instead of logging 'actively refused' until a reboot.
Verified: go build/vet/test green; tray+helper PE subsystem = GUI (2), agent =
console (3); installer compiles; tray runs silently.
fyne.io/systray requires .ico content on Windows, and LoadImage cannot read
PNG-in-ICO. The embedded icons are PNG, so SetIcon always failed and no tray
icon ever appeared. pngToIco decodes the PNG and re-encodes classic BMP
(XOR + AND mask) entries at 16/32/48px — the format LoadImage has always
supported. Verified: the 'unable to set icon' error is gone and the tray
process stays up.
feat(installer): wizard page, Start Menu icons, silent install params
- Wizard page asks for the SSO Manager URL + join key, with an 'Open SSO
install-agent page' button (ShellExec); values feed agent.yml
- /SERVER_URL /JOIN_KEY /AUTH_TOKEN /PUBLIC_KEY and /B64_CONFIG (base64 of a
full agent.yml, decoded by an inline B64Decode) drive the same result in
/SILENT mode, so the SSO's Install Agent modal can emit one Windows command
- [Icons]: Theta Agent Tray / Open Agent Config / Uninstall in Start Menu
- WireGuard client launches its UI at the end of the MSI; taskkill after the
msiexec step closes it (the tunnel is agent-managed)
- tray starts right after install (not just at next logon)
- Inno 7 fixes: controls parent to Page.Surface, SaveStringsToUTF8FileWithoutBOM
Adds pngToIco structure tests (valid ICO dir + 32bpp DIBs) and a platform
passthrough test for toWindowsIcon.
Rebuilds all tracked dist binaries + the setup.exe.
The Windows CI/CD story is now one idempotent script that both local dev and
GitHub Actions run, so they cannot drift.
scripts/setup-build-env.ps1:
- idempotent: skips anything already present/valid; safe to re-run (verified
no-op on second run)
- Go toolchain: pinned 1.22.2, user-space zip extract, no admin; accepts >= 1.22
- Inno Setup: pinned 7.0.2 from jrsoftware GitHub release, per-user install
(/CURRENTUSER, no admin), sha256-verified installer
- vendor assets: fetches WireGuard MSI, VC++ redist, OpenCredential CP into
installer/windows/vendor/ and verifies each against the pinned manifest;
writes .sha256 sidecars
- -Build: builds agent/tray/helper for windows amd64+arm64, runs go test, and
compiles the installer; -CI: fail loudly for workflows
installer/windows/vendor-manifest.json: pinned urls + sha256 for all three
third-party assets and the toolchain; nothing large is committed to git
(installer/windows/vendor/ is gitignored).
installer/windows/installer.iss: bundle + silently install the real
OpenCredential installer (Inno-built -> /VERYSILENT) and read /SERVER_URL and
/JOIN_KEY via {param:...}; validated by compiling with Inno Setup 7.0.2.
.github/workflows/build-windows.yml now delegates the entire build to the script
(setup-go + setup-build-env.ps1 -SkipGo -Build -CI), then hashes, optionally
signs with Azure Trusted Signing, attaches to the release, and publishes to the
SSO resource tree.
Built locally: dist/theta-agent-2.1.0-windows-amd64-setup.exe (63MB fully
offline bundle) plus windows amd64/arm64 agent, tray, and helper, all verified.
Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13).
WireGuard mesh client (signed, WSS-delivered):
- wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new
wireguard capability. Linux applies via wg-quick up/down; Windows installs the
peer config as a WireGuardTunnel service via wireguard.exe
(/installtunnelservice, /uninstalltunnelservice)
- state polling in the home monitor drives the blue tray icon and auto-VPN:
connect when away from home + auto_vpn, disconnect on return (2m cooldown)
- tray VPN toggle and the auto-VPN checkbox are now live; the preference
persists to agent.yml (PersistAutoVPN)
IAM on Windows (iam_windows.go):
- allowed_login_groups -> net localgroup; ssh_keys -> per-profile
authorized_keys + %ProgramData%\ssh\administrators_authorized_keys;
revoke_users -> helper logs off all of the user's WTS sessions;
sudo_rules logged as no direct equivalent
Tray enrichment:
- Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items
- set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands
handled by the daemon (tray_server.go)
Packaging & release:
- installer/windows/installer.iss: fully-offline Inno Setup bundle (agent,
tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist),
/SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray
autostart, Users-writable %ProgramData%\Theta42 for the IPC socket
- .github/workflows/build-windows.yml: build + test, pinned vendor downloads,
ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach,
optional SSO resource publish
- agent.yml.example documents auto_vpn, wireguard, service_name,
desktop_helper, public_ip_detect
Tests:
- wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN,
ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf
- end-to-end verified against a local mock SSO on Windows: join-key enrollment
(token persisted, join key blanked), discovery/telemetry pushed, signed
arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC
socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389;
helper update swap verified
Rebuilds all tracked dist binaries (v2.1.0).
wmantly