fix: Fixed scale and mouse handler

.gitea/workflows/agent-release.yml

@@ -68,28 +68,23 @@ jobs:
                   cache: true
                   cache-dependency-path: agent/go.sum
 
+            - name: Extract version
+              id: version
+              shell: pwsh
+              run: |
+                  $v = "${{ github.ref_name }}" -replace '^agent/v', ''
+                  "VERSION=$v" | Out-File -Append $env:GITHUB_OUTPUT
+                  # MSI ProductVersion must be numeric x.x.x.x
+                  "MSIVERSION=$v.0" | Out-File -Append $env:GITHUB_OUTPUT
+
             - name: Build agent exe
               working-directory: agent
               shell: pwsh
+              env:
+                  VERSION: ${{ steps.version.outputs.VERSION }}
               run: |
                   $env:GOOS = "windows"; $env:GOARCH = "amd64"
-                  go build -o ../installer/vantage-agent-windows-amd64.exe ./cmd
-
-            - name: Cache nssm
-              id: cache-nssm
-              uses: actions/cache@v4
-              with:
-                  path: installer/nssm.exe
-                  key: nssm-2.24-win64
-
-            - name: Fetch nssm
-              if: steps.cache-nssm.outputs.cache-hit != 'true'
-              working-directory: installer
-              shell: pwsh
-              run: |
-                  Invoke-WebRequest -Uri https://nssm.cc/release/nssm-2.24.zip -OutFile nssm.zip
-                  Expand-Archive -Path nssm.zip -DestinationPath nssm-extract -Force
-                  Copy-Item nssm-extract/nssm-2.24/win64/nssm.exe -Destination nssm.exe
+                  go build -ldflags="-s -w -X main.Version=$env:VERSION" -o ../installer/vantage-agent-windows-amd64.exe ./cmd
 
             - name: Install WiX
               shell: pwsh
@@ -100,7 +95,7 @@ jobs:
               shell: pwsh
               run: |
                   $env:PATH = "$env:PATH;$env:USERPROFILE\.dotnet\tools"
-                  wix build vantage-agent.wxs -o vantage-agent.msi
+                  wix build vantage-agent.wxs -d Version=${{ steps.version.outputs.MSIVERSION }} -o vantage-agent.msi
                   (Get-FileHash vantage-agent.msi -Algorithm SHA256).Hash.ToLower() + "  vantage-agent.msi" | Out-File -Encoding ascii checksums-msi.txt
 
             - name: Attach MSI to release

.gitignore

@@ -4,7 +4,7 @@ build
 .env
 docs
 .superpowers
-installer/*.exe
+installer/vantage-agent-windows-amd64.exe
 installer/*.msi
 installer/nssm.zip
 installer/checksums-msi.txt

agent/internal/sync/sync.go

@@ -11,6 +11,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"runtime"
 	"strings"
 	"time"
@@ -265,6 +266,11 @@ func handleDeleteKey(cmd *pb.ServerCommand) {
 }
 
 func handleUpdateAgent(cmd *pb.ServerCommand) {
+	if runtime.GOOS == "windows" {
+		handleUpdateAgentWindows(cmd)
+		return
+	}
+
 	u := cmd.UpdateAgent
 	arch := runtime.GOARCH // "amd64" or "arm64"
 	tag := "agent%2Fv" + u.Version
@@ -305,6 +311,47 @@ func handleUpdateAgent(cmd *pb.ServerCommand) {
 	exec.Command("systemctl", "restart", "vantage-agent").Run()
 }
 
+// handleUpdateAgentWindows downloads the latest MSI and launches msiexec to
+// perform a MajorUpgrade. msiexec is started DETACHED (via "cmd /c start") so
+// that when the upgrade stops the VantageAgent service, nssm's process-tree
+// kill of this agent does not also kill the installer mid-flight. Config
+// (server_id, agent_token) is preserved by setup.ps1 on upgrade.
+func handleUpdateAgentWindows(cmd *pb.ServerCommand) {
+	u := cmd.UpdateAgent
+	tag := "agent%2Fv" + u.Version
+	msiURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/vantage-agent.msi", u.GiteaBaseURL, tag)
+	checksumURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/checksums-msi.txt", u.GiteaBaseURL, tag)
+
+	log.Printf("updating agent to v%s from %s (cmd=%s)", u.Version, u.GiteaBaseURL, cmd.CommandId)
+
+	msiPath := filepath.Join(os.TempDir(), "vantage-agent-update.msi")
+	if err := downloadFile(msiURL, msiPath); err != nil {
+		log.Printf("update download failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+
+	checksumData, err := httpGetBytes(checksumURL)
+	if err != nil {
+		log.Printf("update checksum fetch failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+	if err := verifyChecksum(msiPath, "vantage-agent.msi", checksumData); err != nil {
+		log.Printf("update checksum mismatch (cmd=%s): %v", cmd.CommandId, err)
+		os.Remove(msiPath)
+		return
+	}
+
+	logPath := filepath.Join(os.TempDir(), "vantage-agent-msi.log")
+	log.Printf("launching msiexec for upgrade to v%s (cmd=%s)", u.Version, cmd.CommandId)
+	// "start" detaches msiexec from this process tree so the service stop
+	// during the upgrade does not terminate the installer.
+	up := exec.Command("cmd", "/c", "start", "", "/wait", "msiexec", "/i", msiPath, "/qn", "/norestart", "/l*v", logPath)
+	if err := up.Start(); err != nil {
+		log.Printf("failed to launch msiexec (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+}
+
 func downloadFile(url, dest string) error {
 	resp, err := http.Get(url) //nolint:gosec
 	if err != nil {

installer/setup.ps1

@@ -32,6 +32,10 @@ function Invoke-Native {
 function Invoke-NativeSoft {
   param([string]$File, [string[]]$Arguments)
   Write-Log ("RUN(soft): {0} {1}" -f $File, ($Arguments -join " "))
+  # Native stderr merged via 2>&1 becomes terminating errors under
+  # ErrorActionPreference=Stop; force Continue in this scope so a benign nssm
+  # message (e.g. "service has not been started") never aborts setup.
+  $ErrorActionPreference = "Continue"
   $out = & $File @Arguments 2>&1
   if ($out) { Write-Log ("OUT: {0}" -f ($out -join "`n")) }
   Write-Log ("EXIT: {0}" -f $LASTEXITCODE)
@@ -66,8 +70,17 @@ try {
 
   $cfgDir = Join-Path $env:ProgramData "vantage"
   New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
+  $cfgPath = Join-Path $cfgDir "config.yaml"
 
-  $cfg = @"
+  # Preserve existing config on upgrade. A MajorUpgrade re-runs this script with
+  # no SERVERID/TOKEN, so blindly rewriting would wipe the agent_token the agent
+  # persisted after Register(). Only (re)write when a ServerId is supplied
+  # (fresh install / explicit re-register).
+  if ((Test-Path $cfgPath) -and (-not $ServerId)) {
+    Write-Log "config.yaml exists and no ServerId supplied - preserving existing config (upgrade)"
+  }
+  else {
+    $cfg = @"
 server_url: "$ServerUrl"
 server_id: "$ServerId"
 pre_reg_token: "$Token"
@@ -75,12 +88,12 @@ agent_token: ""
 poll_interval: 30s
 tls: true
 "@
-  $cfgPath = Join-Path $cfgDir "config.yaml"
-  Set-Content -Path $cfgPath -Value $cfg -Encoding utf8
-  Write-Log "wrote $cfgPath"
+    Set-Content -Path $cfgPath -Value $cfg -Encoding utf8
+    Write-Log "wrote $cfgPath"
 
-  # Lock down ACL: SYSTEM + Administrators only
-  Invoke-Native -File "icacls" -Arguments @($cfgPath, "/inheritance:r", "/grant:r", "SYSTEM:F", "Administrators:F")
+    # Lock down ACL: SYSTEM + Administrators only
+    Invoke-Native -File "icacls" -Arguments @($cfgPath, "/inheritance:r", "/grant:r", "SYSTEM:F", "Administrators:F")
+  }
 
   if (-not $InstallDir) { $InstallDir = $PSScriptRoot }
   $nssm = Join-Path $InstallDir "nssm.exe"
@@ -89,9 +102,33 @@ tls: true
   if (-not (Test-Path $nssm)) { throw "nssm.exe not found at $nssm" }
   if (-not (Test-Path $exe))  { throw "vantage-agent.exe not found at $exe" }
 
-  Invoke-Native -File $nssm -Arguments @("install", "VantageAgent", $exe)
+  # Install only if the service isn't already registered (an upgrade may leave
+  # it in place). "nssm install" on an existing service errors otherwise.
+  $exists = Get-Service -Name "VantageAgent" -ErrorAction SilentlyContinue
+  if (-not $exists) {
+    Invoke-Native -File $nssm -Arguments @("install", "VantageAgent", $exe)
+  } else {
+    Write-Log "VantageAgent service already exists - updating binary path"
+    Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "Application", $exe)
+  }
   Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "Start", "SERVICE_AUTO_START")
-  Invoke-Native -File $nssm -Arguments @("start", "VantageAgent")
+
+  # Redirect service stdout/stderr to log files (nssm discards them otherwise)
+  # with online rotation at ~1MB.
+  $outLog = Join-Path $logDir "agent-stdout.log"
+  $errLog = Join-Path $logDir "agent-stderr.log"
+  Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppStdout", $outLog)
+  Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppStderr", $errLog)
+  Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppStdoutCreationDisposition", "4")
+  Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppStderrCreationDisposition", "4")
+  Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateFiles", "1")
+  Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateOnline", "1")
+  Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateBytes", "1048576")
+
+  # Service is freshly (re)installed and stopped here (teardown removed the old
+  # one on upgrade), so start it. "restart" would try to stop a not-running
+  # service and emit a stderr error.
+  Invoke-NativeSoft -File $nssm -Arguments @("start", "VantageAgent")
 
   Write-Log "=== setup ok ==="
   exit 0

installer/vantage-agent.wxs

@@ -1,9 +1,13 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<?ifndef Version ?>
+<?define Version = "0.0.0.0" ?>
+<?endif?>
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
   <Package Name="Vantage Agent" Manufacturer="Vantage"
-           Version="1.0.0.0" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
+           Version="$(var.Version)" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
            Scope="perMachine">
-    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed." />
+    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed."
+                  Schedule="afterInstallInitialize" />
     <MediaTemplate EmbedCab="yes" />
 
     <!-- Public properties settable via msiexec: SERVERID, TOKEN, SERVERURL -->

server/internal/api/handlers.go

@@ -23,6 +23,7 @@ func RegisterRoutes(r *gin.Engine) {
 	r.GET("/install", handleInstallScript)
 	r.GET("/install.ps1", handleInstallScriptWindows)
 	r.GET("/update", handleUpdateScript)
+	r.GET("/update.ps1", handleUpdateScriptWindows)
 
 	// ESO read endpoint — bearer-token auth, not session auth, so Kubernetes
 	// External Secrets Operator can call it. Lives under /api (so the reverse

server/internal/api/install_ps1.go

@@ -54,3 +54,40 @@ func handleInstallScriptWindows(c *gin.Context) {
 	c.Header("Content-Type", "text/plain; charset=utf-8")
 	c.String(http.StatusOK, script)
 }
+
+// handleUpdateScriptWindows serves a PowerShell one-liner that upgrades an
+// already-installed Windows agent. No server_id/token needed: the MSI is a
+// MajorUpgrade and setup.ps1 preserves the existing config on upgrade.
+func handleUpdateScriptWindows(c *gin.Context) {
+	giteaHost := os.Getenv("GITEA_HOST")
+	if giteaHost == "" {
+		giteaHost = "gitea.example.com"
+	}
+
+	script := fmt.Sprintf(
+		"#Requires -RunAsAdministrator\n"+
+			"$ErrorActionPreference = \"Stop\"\n"+
+			"\n"+
+			"$GiteaHost = \"%s\"\n"+
+			"\n"+
+			"$rel = Invoke-RestMethod -Uri \"https://$GiteaHost/api/v1/repos/mrhid6/vantage/releases?limit=10\"\n"+
+			"$tag = ($rel | Where-Object { $_.tag_name -like 'agent/v*' } | Select-Object -First 1).tag_name\n"+
+			"if (-not $tag) { throw \"Could not determine latest agent version\" }\n"+
+			"$enc = $tag -replace '/','%%2F'\n"+
+			"$base = \"https://$GiteaHost/mrhid6/vantage/releases/download/$enc\"\n"+
+			"\n"+
+			"$tmp = Join-Path $env:TEMP \"vantage-agent.msi\"\n"+
+			"Invoke-WebRequest -Uri \"$base/vantage-agent.msi\" -OutFile $tmp\n"+
+			"Invoke-WebRequest -Uri \"$base/checksums-msi.txt\" -OutFile \"$env:TEMP\\checksums-msi.txt\"\n"+
+			"\n"+
+			"$expected = (Get-Content \"$env:TEMP\\checksums-msi.txt\" | Select-String 'vantage-agent.msi').ToString().Split()[0]\n"+
+			"$actual = (Get-FileHash $tmp -Algorithm SHA256).Hash.ToLower()\n"+
+			"if ($expected -ne $actual) { throw \"Checksum mismatch\" }\n"+
+			"\n"+
+			"Start-Process msiexec.exe -Wait -ArgumentList \"/i `\"$tmp`\" /qn /norestart\"\n"+
+			"Write-Host \"Vantage agent updated to $tag.\"\n",
+		giteaHost)
+
+	c.Header("Content-Type", "text/plain; charset=utf-8")
+	c.String(http.StatusOK, script)
+}

web/app/servers/[id]/console/page.tsx

@@ -15,7 +15,11 @@ export default function ServerConsolePage() {
     const serverId = params.id as string;
 
     const containerRef = useRef<HTMLDivElement>(null);
-    const connectionRef = useRef<{ disconnect: () => void } | null>(null);
+    const connectionRef = useRef<{
+        disconnect: () => void;
+        setScale: (scale: number) => void;
+        resize: (width: number, height: number) => void;
+    } | null>(null);
 
     const [protocol, setProtocol] = useState<string>(searchParams.get("protocol") || "");
     const [keyId, setKeyId] = useState<string>("");
@@ -27,6 +31,8 @@ export default function ServerConsolePage() {
     const [connected, setConnected] = useState(false);
     const [error, setError] = useState<string | null>(null);
     const [pending, setPending] = useState<{ token: string; wsPath: string } | null>(null);
+    const [zoom, setZoom] = useState(1);
+    const dprRef = useRef(1);
 
     // Inject the vendored Guacamole client script once.
     useEffect(() => {
@@ -103,17 +109,36 @@ export default function ServerConsolePage() {
         const wsProto = location.protocol === "https:" ? "wss" : "ws";
         const wsUrl = `${wsProto}://${location.host}${pending.wsPath}`;
         const rect = containerRef.current.getBoundingClientRect();
-        const dpi = Math.round(96 * (window.devicePixelRatio || 1));
+        const dpr = window.devicePixelRatio || 1;
+        dprRef.current = dpr;
+        // Request the remote at device-pixel resolution with a fixed 96 dpi, then
+        // scale the display back down by dpr. Folding dpr into `dpi` instead makes
+        // the remote enlarge everything, which reads as a zoomed-in view.
         const connectData =
             `token=${encodeURIComponent(pending.token)}` +
-            `&width=${Math.floor(rect.width)}` +
-            `&height=${Math.floor(rect.height)}` +
-            `&dpi=${dpi}`;
+            `&width=${Math.floor(rect.width * dpr)}` +
+            `&height=${Math.floor(rect.height * dpr)}` +
+            `&dpi=96`;
 
         connectionRef.current = openConsole(containerRef.current, wsUrl, connectData);
+        connectionRef.current.setScale(zoom / dpr);
         setPending(null);
     }, [connected, pending]);
 
+    // Apply zoom live without reconnecting: resize the remote to a resolution
+    // that, once scaled to fit the container, yields the requested zoom. Higher
+    // zoom = fewer remote pixels rendered larger. Display always fits the
+    // container exactly, so no scrollbars appear.
+    useEffect(() => {
+        if (!connectionRef.current || !containerRef.current) return;
+        const rect = containerRef.current.getBoundingClientRect();
+        const dpr = dprRef.current;
+        const remoteW = Math.floor((rect.width * dpr) / zoom);
+        const remoteH = Math.floor((rect.height * dpr) / zoom);
+        connectionRef.current.resize(remoteW, remoteH);
+        connectionRef.current.setScale(zoom / dpr);
+    }, [zoom]);
+
     function handleDisconnect() {
         connectionRef.current?.disconnect();
         connectionRef.current = null;
@@ -246,12 +271,25 @@ export default function ServerConsolePage() {
                     <Button variant="danger" onClick={handleDisconnect}>
                         Disconnect
                     </Button>
+                    <label className="text-sm text-text-secondary">Scale</label>
+                    <select
+                        value={zoom}
+                        onChange={(e) => setZoom(Number(e.target.value))}
+                        className="rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                    >
+                        <option value={0.5}>50%</option>
+                        <option value={0.75}>75%</option>
+                        <option value={1}>100%</option>
+                        <option value={1.25}>125%</option>
+                        <option value={1.5}>150%</option>
+                        <option value={2}>200%</option>
+                    </select>
                 </div>
             )}
 
             <div
                 ref={containerRef}
-                className="min-h-[500px] flex-1 rounded-lg border border-border bg-black"
+                className="min-h-[500px] flex-1 overflow-hidden rounded-lg border border-border bg-black"
             />
         </div>
     );

web/app/servers/[id]/page.tsx

@@ -416,10 +416,10 @@ export default function ServerDetailPage() {
                             {updateSuccess ? "Update Sent!" : "Update Agent"}
                         </Button>
                         <div className="relative flex-1 min-w-64 rounded-lg border border-border bg-[#0a0c14] px-4 py-2.5 font-mono text-sm">
-                            <span className="text-accent">$</span> <span className="text-text-primary">{api.getUpdateCommand()}</span>
+                            <span className="text-accent">{server.os_info?.toLowerCase().includes("windows") ? "PS>" : "$"}</span> <span className="text-text-primary">{api.getUpdateCommand(server.os_info)}</span>
                             <button
                                 onClick={async () => {
-                                    await navigator.clipboard.writeText(api.getUpdateCommand());
+                                    await navigator.clipboard.writeText(api.getUpdateCommand(server.os_info));
                                     setCopiedUpdate(true);
                                     setTimeout(() => setCopiedUpdate(false), 2000);
                                 }}

web/lib/api.ts

@@ -189,7 +189,10 @@ export const api = {
     });
   },
 
-  getUpdateCommand(): string {
+  getUpdateCommand(osInfo?: string): string {
+    if (osInfo && osInfo.toLowerCase().includes("windows")) {
+      return `irm "${window.location.origin}/update.ps1" | iex`;
+    }
     return `curl -fsSL "${window.location.origin}/update" | bash`;
   },
 

web/lib/guacConsole.ts

@@ -2,7 +2,11 @@
 // The library attaches a global `Guacamole` object when loaded.
 declare const Guacamole: any;
 
-export function openConsole(container: HTMLElement, wsUrl: string, connectData = ""): { disconnect: () => void } {
+export function openConsole(
+  container: HTMLElement,
+  wsUrl: string,
+  connectData = ""
+): { disconnect: () => void; setScale: (scale: number) => void; resize: (width: number, height: number) => void } {
   // Guacamole's WebSocketTunnel builds the socket URL as `wsUrl + "?" + data`,
   // so wsUrl must NOT already contain a query string — pass params via connectData.
   const tunnel = new Guacamole.WebSocketTunnel(wsUrl);
@@ -10,20 +14,58 @@ export function openConsole(container: HTMLElement, wsUrl: string, connectData =
 
   container.innerHTML = "";
   container.appendChild(client.getDisplay().getElement());
+  // Make the console focusable so keyboard capture is scoped to it (see below).
+  container.tabIndex = 0;
 
   client.connect(connectData);
 
-  // Wire keyboard + mouse.
-  const mouse = new Guacamole.Mouse(client.getDisplay().getElement());
-  mouse.onmousedown = mouse.onmouseup = mouse.onmousemove = (state: any) =>
-    client.sendMouseState(state);
-  const keyboard = new Guacamole.Keyboard(document);
+  const display = client.getDisplay();
+  let scale = 1;
+
+  // Wire keyboard + mouse. The display element is rendered at `scale` of the
+  // remote's native resolution, but Guacamole.Mouse reports coordinates in
+  // element (on-screen) pixels. Divide by scale to map back to remote
+  // coordinates, otherwise the cursor is offset.
+  const mouse = new Guacamole.Mouse(display.getElement());
+  mouse.onmousedown = mouse.onmouseup = mouse.onmousemove = (state: any) => {
+    const s = new Guacamole.Mouse.State(
+      state.x / scale,
+      state.y / scale,
+      state.left,
+      state.middle,
+      state.right,
+      state.up,
+      state.down
+    );
+    client.sendMouseState(s);
+  };
+  // Scope keyboard capture to the container rather than `document`, so it only
+  // grabs keys while the console is focused and stops entirely once the element
+  // is removed (navigating away / disconnect). Attaching to `document` leaks the
+  // capture and swallows keystrokes in unrelated inputs.
+  const keyboard = new Guacamole.Keyboard(container);
   keyboard.onkeydown = (k: number) => client.sendKeyEvent(1, k);
   keyboard.onkeyup = (k: number) => client.sendKeyEvent(0, k);
+  // Guacamole.Mouse consumes the native mousedown, so clicking the console never
+  // moves DOM focus back to it. Refocus explicitly so keyboard capture resumes.
+  const refocus = () => container.focus();
+  container.addEventListener("mousedown", refocus);
+  container.focus();
 
   return {
     disconnect() {
+      container.removeEventListener("mousedown", refocus);
+      keyboard.onkeydown = null;
+      keyboard.onkeyup = null;
+      if (typeof keyboard.reset === "function") keyboard.reset();
       client.disconnect();
     },
+    setScale(s: number) {
+      scale = s;
+      display.scale(s);
+    },
+    resize(width: number, height: number) {
+      client.sendSize(width, height);
+    },
   };
 }

web/next.config.ts

@@ -26,6 +26,10 @@ const nextConfig: NextConfig = {
                 source: "/update",
                 destination: `${apiUrl}/update`,
             },
+            {
+                source: "/update.ps1",
+                destination: `${apiUrl}/update.ps1`,
+            },
         ];
     },
 };