ci: WoA NSIS install smoke tests and remove resedit afterPack hook (#557)

* chore: remove resedit longPathAware Windows afterPack hook

- Drop electron-builder afterPack, mesh-client-long-path.manifest.xml,
  and the resedit devDependency; packaged apps use stock Electron PEs.
- Simplify verify-win-packaging to existence/size checks only (no PE parse).
- Rename packaging contract test to windows-packaging.contract.test.ts and
  assert afterPack/resedit are absent; remove troubleshooting longPathAware bullet.

longPathAware did not help pnpm build paths and PE rewrites did not fix WoA
NSIS installs; removing the hook reduces packaging risk with no loss to split
x64/arm64 NSIS artifacts.

* chore: bump deps

* ci: add WoA NSIS install smoke tests and diagnostics

- Add test-win-nsis-install.mjs for silent x64/arm64 install checks with
  NSIS /LOG= output and optional 7z probe to isolate extract vs copy.
- Run x64 install on windows-latest after dist:win; arm64 repro on
  windows-11-arm from build artifacts in build and release workflows.
- Add NSIS customFinish guard (resources/installer.nsh) when Mesh-client.exe
  is missing after install.
- Expand WoA troubleshooting with install log, Event Viewer, and policy steps.
- Bump electron-builder to ^26.15.4 and extend packaging contract tests.

WoA users report partial NSIS installs; CI now reproduces install on native
ARM and captures logs before we apply a targeted NSIS fix.

Author: rinchen

.github/workflows/build.yaml

@@ -68,6 +68,20 @@ jobs:
       - name: Build
         run: ${{ matrix.build_script }}
 
+      - name: Smoke test x64 NSIS install
+        if: matrix.os == 'windows-latest'
+        run: node scripts/test-win-nsis-install.mjs --arch x64
+
+      - name: Upload Windows install failure logs
+        if: failure() && matrix.os == 'windows-latest'
+        uses: actions/upload-artifact@v7
+        with:
+          name: mesh-client-win-x64-install-logs-${{ github.sha }}
+          path: |
+            ${{ runner.temp }}/mesh-client-install-x64.log
+          if-no-files-found: ignore
+          retention-days: 7
+
       - name: Upload macOS Artifact
         if: matrix.os == 'macos-latest'
         uses: actions/upload-artifact@v7
@@ -104,3 +118,33 @@ jobs:
             # Per-arch NSIS installers: Mesh-client Setup {version}.exe + {version}-arm64.exe
             release/*.exe
           retention-days: 30
+
+  win-arm64-install:
+    name: Smoke test arm64 NSIS install (WoA)
+    needs: build
+    runs-on: windows-11-arm
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Download Windows build artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: mesh-client-windows-${{ github.sha }}
+          path: release
+
+      - name: Smoke test arm64 NSIS install (7z probe + install)
+        run: node scripts/test-win-nsis-install.mjs --arch arm64 --probe-7z
+
+      - name: Upload arm64 install failure logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: mesh-client-win-arm64-install-logs-${{ github.sha }}
+          path: |
+            ${{ runner.temp }}/mesh-client-install-arm64.log
+            ${{ runner.temp }}/mesh-client-7z-probe/**
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/release.yaml

@@ -63,6 +63,20 @@ jobs:
         # dist:*:publish scripts run electron-builder with --publish always
         run: ${{ matrix.build_script }}
 
+      - name: Smoke test x64 NSIS install
+        if: matrix.os == 'windows-latest'
+        run: node scripts/test-win-nsis-install.mjs --arch x64
+
+      - name: Upload Windows install failure logs
+        if: failure() && matrix.os == 'windows-latest'
+        uses: actions/upload-artifact@v7
+        with:
+          name: mesh-client-win-x64-install-logs-${{ github.sha }}
+          path: |
+            ${{ runner.temp }}/mesh-client-install-x64.log
+          if-no-files-found: ignore
+          retention-days: 7
+
       # Keep artificates for 30 days when we manually build
       - name: Upload macOS Artifact
         if: matrix.os == 'macos-latest'
@@ -107,3 +121,33 @@ jobs:
             release/win-arm64-unpacked/**/*
             release/win-x64-unpacked/**/*
           retention-days: 30
+
+  win-arm64-install:
+    name: Smoke test arm64 NSIS install (WoA)
+    needs: release
+    runs-on: windows-11-arm
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Download Windows build artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: mesh-client-windows-${{ github.sha }}
+          path: release
+
+      - name: Smoke test arm64 NSIS install (7z probe + install)
+        run: node scripts/test-win-nsis-install.mjs --arch arm64 --probe-7z
+
+      - name: Upload arm64 install failure logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: mesh-client-win-arm64-install-logs-${{ github.sha }}
+          path: |
+            ${{ runner.temp }}/mesh-client-install-arm64.log
+            ${{ runner.temp }}/mesh-client-7z-probe/**
+          if-no-files-found: ignore
+          retention-days: 7

.prettierignore

@@ -19,6 +19,7 @@ patches/
 *.desktop
 *.metainfo.xml
 resources/win/*.xml
+*.nsh
 
 # CodeQL MaD — Prettier line-wrap breaks yamllint indentation for barrier tuples
 .github/codeql/extensions/**/*.yml

docs/troubleshooting.md

@@ -16,14 +16,34 @@ See [development-environment.md](development-environment.md) for OS-specific pre
 
 **Cause**
 
-Older releases shipped a **universal** NSIS installer (x64 + arm64 in one `.exe`). On **native Windows 11 ARM**, that installer can partially extract support files while failing to copy the main executable.
+On **native Windows 11 ARM**, the arm64 NSIS installer can partially extract support files while failing to copy the main executable. CI builds the exe correctly (it is inside the installer's `app-arm64.7z`); the failure happens at **install time**, not during packaging.
+
+Older releases also shipped a **universal** NSIS installer (x64 + arm64 in one `.exe`), which made arch selection worse — use the split **`-arm64.exe`** installer on WoA hardware.
 
 **Fix**
 
 1. Delete the broken install folder: `%LOCALAPPDATA%\Programs\Mesh-client\`
 2. Download the **arm64** installer from [GitHub Releases](https://github.com/Colorado-Mesh/mesh-client/releases): `Mesh-client Setup {version}-arm64.exe` (not the x64-only `Mesh-client Setup {version}.exe`).
 3. Re-run the installer. Confirm `Mesh-client.exe` exists in the install folder and the app appears in **Installed apps**.
 
+**Diagnostic checklist (if the exe is still missing)**
+
+Capture this before opening a GitHub issue — it helps isolate NSIS extract vs copy vs policy blocks:
+
+1. **NSIS install log** — run the installer from Command Prompt or PowerShell with logging:
+   ```bat
+   "Mesh-client Setup {version}-arm64.exe" /LOG=%USERPROFILE%\Desktop\mesh-install.log
+   ```
+   After failure, open `mesh-install.log` and search for `Mesh-client.exe`, `CopyFiles`, or `error`.
+2. **Event Viewer** — **Windows Logs → Application** during the install window; note any errors from `MsiInstaller`, `Application Error`, or antivirus agents.
+3. **Controlled folder access** — **Windows Security → Virus & threat protection → Ransomware protection**; if enabled, try temporarily allowing the installer or install to a short path such as `C:\mc-test` (see step 5).
+4. **Install path** — confirm `%LOCALAPPDATA%` is on a local NTFS volume, not OneDrive-redirected or sync-rooted.
+5. **Custom install directory** — test a short path:
+   ```bat
+   "Mesh-client Setup {version}-arm64.exe" /D=C:\mc-test /LOG=%USERPROFILE%\Desktop\mesh-install.log
+   ```
+6. **Clean tree** — ensure no leftover `Mesh-client` folder or running `Mesh-client.exe` from a prior partial install before re-running the installer.
+
 **Workaround before a fixed release**
 
 Download a CI or release artifact's `win-arm64-unpacked` folder and run `Mesh-client.exe` directly (portable, no installer).
@@ -319,7 +339,6 @@ CI builds avoid both issues by using short paths and clean agents; local Windows
 2. **Enable long paths in Git** (helps clones/checkouts): `git config --global core.longpaths true`, then re-clone or ensure no stuck long paths in the worktree.
 3. **Enable Win32 long paths in Windows** (Windows 10 1607+): this option is **not** available as a normal toggle in **Settings**; enable it via **Local Group Policy** → _Computer Configuration → Administrative Templates → System → Filesystem → Enable Win32 long paths_, or set the registry DWORD **`LongPathsEnabled = 1`** under `HKLM\SYSTEM\CurrentControlSet\Control\FileSystem` (admin rights; reboot may be required). See [Microsoft: Maximum Path Length Limitation](https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation).
 4. **`pnpm run dist:win`** already runs a **hoisted** `pnpm install` to shorten `node_modules` depth before packaging; if **`pnpm install`** / **`pnpm run rebuild`** fails earlier with this error, try the short path and long-path OS settings first, or temporarily: `pnpm install --config.node-linker=hoisted` from a short root path.
-5. **Packaged app (`dist:win`)**: the build embeds a Windows application manifest with **`longPathAware`** so the installed **Mesh-client.exe** can use long paths when the machine has long paths enabled (registry / policy). That helps **runtime** paths inside the app; it does **not** shorten **`node_modules`** during **`pnpm install`** on the build machine—CI and developers still benefit from short clone paths for native rebuilds.
 
 ### Database schema newer than this app (downgrade blocked)
 

electron-builder.yml

@@ -1,6 +1,5 @@
 appId: com.mesh-client.app
 productName: Mesh-client
-afterPack: scripts/electron-builder-after-pack.cjs
 directories:
   buildResources: resources
   output: release
@@ -77,3 +76,4 @@ win:
   icon: resources/icons/win/colorado-mesh.ico
 nsis:
   buildUniversalInstaller: false
+  include: resources/installer.nsh

package.json

@@ -131,9 +131,9 @@
     "@typescript-eslint/parser": "^8.61.1",
     "@vitejs/plugin-react": "^6.0.2",
     "@vitest/coverage-v8": "^4.1.9",
-    "concurrently": "^9.2.1",
+    "concurrently": "^9.2.3",
     "electron": "^41.8.0",
-    "electron-builder": "^26.15.3",
+    "electron-builder": "^26.15.4",
     "esbuild": "^0.28.1",
     "eslint": "^10.5.0",
     "eslint-config-prettier": "^10.1.8",
@@ -158,7 +158,6 @@
     "react-dom": "^19.2.7",
     "react-leaflet": "^5.0.0",
     "recharts": "^3.8.1",
-    "resedit": "^1.7.2",
     "sort-package-json": "^3.7.1",
     "tailwindcss": "^4.3.1",
     "typescript": "^6.0.3",