From c9c5bd37d2b21aec5e5bcde78484816558c1aa97 Mon Sep 17 00:00:00 2001
From: Justin Paul <justin@jpaul.me>
Date: Fri, 8 May 2026 10:15:26 -0400
Subject: [PATCH 1/3] v0.1.1: GUI auto-elevates, installer stops service before
 file copy

Two fixes for the v0.1.0 install experience:

1. Embed app.manifest with requestedExecutionLevel=requireAdministrator
   so the GUI always elevates. The named pipe is ACL'd to SYSTEM and
   the Administrators group, but UAC token splitting puts Admins in
   deny-only on the standard token, so launching the GUI from the
   Start Menu fails to connect with "Access is denied". The manifest
   forces UAC to elevate, surfaces the shield icon on the shortcut,
   and matches the reality that the GUI cannot function without
   admin rights.

2. Add a [Code] PrepareToInstall hook to webhook-server.iss that runs
   `sc stop WebhookServer` before file copy. Upgrade installs were
   failing on locked binaries because the running service held the
   exes open. sc returns non-zero on fresh installs (no service yet)
   which we ignore.

Bumps Version to 0.1.1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Directory.Build.props                         |  2 +-
 installer/webhook-server.iss                  | 15 ++++++++++++
 .../WebhookServer.Gui.csproj                  |  1 +
 src/WebhookServer.Gui/app.manifest            | 24 +++++++++++++++++++
 4 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 src/WebhookServer.Gui/app.manifest

diff --git a/Directory.Build.props b/Directory.Build.props
index 65b6f43..434a152 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -1,7 +1,7 @@
 <Project>
 
   <PropertyGroup>
-    <Version>0.1.0</Version>
+    <Version>0.1.1</Version>
     <Authors>Justin Paul</Authors>
     <Company>Justin Paul</Company>
     <Product>Webhook Server</Product>
diff --git a/installer/webhook-server.iss b/installer/webhook-server.iss
index 36c7314..5e940c8 100644
--- a/installer/webhook-server.iss
+++ b/installer/webhook-server.iss
@@ -77,3 +77,18 @@ Filename: "powershell.exe"; \
     Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\scripts\uninstall-service.ps1"""; \
     Flags: runhidden; \
     RunOnceId: "RemoveWebhookService"
+
+[Code]
+function PrepareToInstall(var NeedsRestart: Boolean): String;
+var
+  ResultCode: Integer;
+begin
+  Result := '';
+  // Stop the running service so its binaries are unlocked before file copy.
+  // Ignore failure - sc returns non-zero if the service doesn't exist (fresh
+  // install) or is already stopped, both of which are fine.
+  Exec(ExpandConstant('{sys}\sc.exe'), 'stop WebhookServer', '', SW_HIDE,
+       ewWaitUntilTerminated, ResultCode);
+  // Give the SCM a moment to actually release the executable.
+  Sleep(2000);
+end;
diff --git a/src/WebhookServer.Gui/WebhookServer.Gui.csproj b/src/WebhookServer.Gui/WebhookServer.Gui.csproj
index 8308673..c0415de 100644
--- a/src/WebhookServer.Gui/WebhookServer.Gui.csproj
+++ b/src/WebhookServer.Gui/WebhookServer.Gui.csproj
@@ -16,6 +16,7 @@
     <UseWPF>true</UseWPF>
     <UseWindowsForms>true</UseWindowsForms>
     <ApplicationIcon>..\..\resources\webhook-server.ico</ApplicationIcon>
+    <ApplicationManifest>app.manifest</ApplicationManifest>
     <AssemblyTitle>Webhook Server</AssemblyTitle>
   </PropertyGroup>
 
diff --git a/src/WebhookServer.Gui/app.manifest b/src/WebhookServer.Gui/app.manifest
new file mode 100644
index 0000000..fe654a1
--- /dev/null
+++ b/src/WebhookServer.Gui/app.manifest
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
+  <assemblyIdentity version="1.0.0.0" name="WebhookServer.Gui"/>
+
+  <!-- The GUI talks to the service via a named pipe ACL'd to SYSTEM and the
+       Administrators group. UAC token splitting denies that group on the
+       standard user token, so without elevation the pipe connect fails with
+       "Access is denied". Always run elevated. Start Menu shortcuts and the
+       installer's post-install launch both honor this. -->
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v2">
+        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <!-- Windows 10 -->
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+    </application>
+  </compatibility>
+</assembly>

From baecc99b23fa123f346626f6147fb70159ad8a07 Mon Sep 17 00:00:00 2001
From: Justin Paul <justin@jpaul.me>
Date: Fri, 8 May 2026 10:16:49 -0400
Subject: [PATCH 2/3] Rename "Backups" menu item to "Config Checkpoints"

User-facing copy only; internal API names (Backups collection,
BackupEntry, list-backups op, etc.) stay the same to avoid churn
through the wire protocol and existing on-disk files. The new
phrasing makes the auto-snapshot-before-save model more discoverable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/WebhookServer.Gui/MainWindow.xaml             | 3 ++-
 src/WebhookServer.Gui/ViewModels/MainViewModel.cs | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/WebhookServer.Gui/MainWindow.xaml b/src/WebhookServer.Gui/MainWindow.xaml
index a2ff565..64f037c 100644
--- a/src/WebhookServer.Gui/MainWindow.xaml
+++ b/src/WebhookServer.Gui/MainWindow.xaml
@@ -29,8 +29,9 @@
                 <Separator/>
                 <MenuItem Header="_Import config…" Command="{Binding ImportConfigCommand}"/>
                 <MenuItem Header="_Export config…" Command="{Binding ExportConfigCommand}"/>
-                <MenuItem Header="_Backups"
+                <MenuItem Header="Config _Checkpoints"
                           ItemsSource="{Binding Backups}"
+                          ToolTip="Snapshots taken automatically before each save. Click one to restore."
                           SubmenuOpened="OnBackupsSubmenuOpened">
                     <MenuItem.ItemContainerStyle>
                         <Style TargetType="MenuItem">
diff --git a/src/WebhookServer.Gui/ViewModels/MainViewModel.cs b/src/WebhookServer.Gui/ViewModels/MainViewModel.cs
index 69b8d11..6387b20 100644
--- a/src/WebhookServer.Gui/ViewModels/MainViewModel.cs
+++ b/src/WebhookServer.Gui/ViewModels/MainViewModel.cs
@@ -189,7 +189,7 @@ private async Task RefreshBackupsAsync()
                 foreach (var b in list) Backups.Add(b);
             });
         }
-        catch { /* ignore - backup listing isn't critical */ }
+        catch { /* ignore - checkpoint listing isn't critical */ }
     }
 
     [RelayCommand]
@@ -197,8 +197,8 @@ private async Task RestoreBackupAsync(BackupEntry? entry)
     {
         if (entry is null) return;
         var ok = MessageBox.Show(
-            $"Restore configuration from {entry.FileName} ({entry.SavedAt:yyyy-MM-dd HH:mm})?\n\nA backup of the current config will be saved first.",
-            "Restore backup",
+            $"Restore the configuration from the checkpoint taken at {entry.SavedAt:yyyy-MM-dd HH:mm}?\n\nThe current configuration is automatically saved as a new checkpoint first, so you can roll forward again.",
+            "Restore checkpoint",
             MessageBoxButton.OKCancel,
             MessageBoxImage.Question);
         if (ok != MessageBoxResult.OK) return;
@@ -249,7 +249,7 @@ private async Task ImportConfigAsync()
             if (cfg is null) throw new InvalidOperationException("File did not contain a valid config.");
 
             var ok = MessageBox.Show(
-                $"Replace the current configuration with {dlg.FileName}?\n\nA backup of the current config will be saved first.",
+                $"Replace the current configuration with {dlg.FileName}?\n\nA checkpoint of the current config is saved first, so you can roll back from File → Config Checkpoints.",
                 "Import config",
                 MessageBoxButton.OKCancel,
                 MessageBoxImage.Warning);

From 0217d9f3073adf05aacecdf754191772befa6b6b Mon Sep 17 00:00:00 2001
From: Justin Paul <justin@jpaul.me>
Date: Fri, 8 May 2026 10:18:01 -0400
Subject: [PATCH 3/3] Installer: synchronous service stop + kill stray
 GUI/Service processes

The previous sc.exe stop is fire-and-forget; on slower machines the
file-copy step started before the service had actually released its
binaries, leaving the upgrade in a broken state. Switch to net.exe
stop which blocks until the service reports STOPPED.

Also taskkill any running WebhookServer.Gui.exe (the user might have
left the tray running) and any orphan WebhookServer.Service.exe (from
deploy.ps1 dev runs) so all copies of the binaries are unlocked
before [Files] runs.

Pre-flight ServiceExists() check via sc query so the installer only
calls "net stop" when there is actually a service to stop, rather
than relying on net's error code.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 installer/webhook-server.iss | 37 +++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/installer/webhook-server.iss b/installer/webhook-server.iss
index 5e940c8..b97f5ef 100644
--- a/installer/webhook-server.iss
+++ b/installer/webhook-server.iss
@@ -79,16 +79,39 @@ Filename: "powershell.exe"; \
     RunOnceId: "RemoveWebhookService"
 
 [Code]
+function ServiceExists(): Boolean;
+var
+  ResultCode: Integer;
+begin
+  // sc.exe query returns 0 when the service exists, 1060 when it does not.
+  Exec(ExpandConstant('{sys}\sc.exe'), 'query WebhookServer', '', SW_HIDE,
+       ewWaitUntilTerminated, ResultCode);
+  Result := (ResultCode = 0);
+end;
+
 function PrepareToInstall(var NeedsRestart: Boolean): String;
 var
   ResultCode: Integer;
 begin
   Result := '';
-  // Stop the running service so its binaries are unlocked before file copy.
-  // Ignore failure - sc returns non-zero if the service doesn't exist (fresh
-  // install) or is already stopped, both of which are fine.
-  Exec(ExpandConstant('{sys}\sc.exe'), 'stop WebhookServer', '', SW_HIDE,
-       ewWaitUntilTerminated, ResultCode);
-  // Give the SCM a moment to actually release the executable.
-  Sleep(2000);
+
+  // 1. If the service exists, stop it so its binaries are unlocked before file
+  //    copy. net stop is synchronous (blocks until the service is actually
+  //    stopped), unlike sc stop which is fire-and-forget. Non-zero exit -
+  //    already stopped, missing, dependency error - we ignore; the file copy
+  //    will fail loudly if the binaries are still locked.
+  if ServiceExists() then
+  begin
+    WizardForm.PreparingLabel.Caption := 'Stopping the WebhookServer service...';
+    Exec(ExpandConstant('{sys}\net.exe'), 'stop WebhookServer', '', SW_HIDE,
+         ewWaitUntilTerminated, ResultCode);
+  end;
+
+  // 2. Kill any running GUI / tray instances so their binaries are unlocked too.
+  //    /f forces termination, /im matches by image name, "*" wildcard would be
+  //    risky so we name them explicitly.
+  Exec(ExpandConstant('{sys}\taskkill.exe'), '/f /im WebhookServer.Gui.exe',
+       '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+  Exec(ExpandConstant('{sys}\taskkill.exe'), '/f /im WebhookServer.Service.exe',
+       '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
 end;