From add206457f0d229c120eb3ef17c521e30f7bdda6 Mon Sep 17 00:00:00 2001
From: Tom Butcher <tom@tombutcher.work>
Date: Mon, 3 Aug 2026 00:45:53 +0100
Subject: [PATCH] Add user access permissions for Windows installer</message>

<message>
- Introduced a new macro in `grant-users-access.nsh` to grant standard users read and execute access to the installation directory, addressing permission issues that affect non-admin users.
- Updated `installer.nsh` and `scripts/installer.nsh` to include the new macro during the installation process, ensuring proper access rights are set for the install tree.
---
 packaging/windows/grant-users-access.nsh | 12 ++++++++++++
 packaging/windows/installer.nsh          |  4 ++++
 packaging/windows/msi-wrapped.wxs        |  1 -
 scripts/installer.nsh                    |  4 ++++
 4 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 packaging/windows/grant-users-access.nsh

diff --git a/packaging/windows/grant-users-access.nsh b/packaging/windows/grant-users-access.nsh
new file mode 100644
index 0000000..47f64e5
--- /dev/null
+++ b/packaging/windows/grant-users-access.nsh
@@ -0,0 +1,12 @@
+; Grant standard (non-admin) users read/execute on the install tree.
+; Elevated installs into Program Files often create admin-only ACLs, which
+; breaks launcher.exe and bun reading deeplink.js for normal users.
+!macro grantUsersInstallAccess
+  Push $0
+  DetailPrint "Granting standard users read and execute access to $INSTDIR"
+  ExecWait '"$SYSDIR\icacls.exe" "$INSTDIR" /inheritance:e /T /C' $0
+  DetailPrint "Enabled inherited permissions (exit code: $0)"
+  ExecWait '"$SYSDIR\icacls.exe" "$INSTDIR" /grant *S-1-5-32-545:(OI)(CI)RX /T /C' $0
+  DetailPrint "Granted Users read/execute (exit code: $0)"
+  Pop $0
+!macroend
diff --git a/packaging/windows/installer.nsh b/packaging/windows/installer.nsh
index fd8e767..65ee57c 100644
--- a/packaging/windows/installer.nsh
+++ b/packaging/windows/installer.nsh
@@ -75,7 +75,11 @@
   RMDir "$SMPROGRAMS\Farm Control"
 !macroend
 
+!include "grant-users-access.nsh"
+
 !macro customInstall
+  !insertmacro grantUsersInstallAccess
+
   DetailPrint "Register farmcontrol URI Handler"
   DeleteRegKey HKCR "farmcontrol"
   WriteRegStr HKCR "farmcontrol" "" "URL:farmcontrol"
diff --git a/packaging/windows/msi-wrapped.wxs b/packaging/windows/msi-wrapped.wxs
index 1e5a9d5..ff9298b 100644
--- a/packaging/windows/msi-wrapped.wxs
+++ b/packaging/windows/msi-wrapped.wxs
@@ -24,7 +24,6 @@
     <Property Id="ARPPRODUCTICON" Value="InstallerIcon" />
 
     <Property Id="DISABLEADVTSHORTCUTS" Value="1" />
-    <Property Id="MSIINSTALLPERUSER" Value="1" />
 
   <Property Id="PREVIOUS_UNINSTALL_CMD">
     <RegistrySearch
diff --git a/scripts/installer.nsh b/scripts/installer.nsh
index a3217b2..7d58b96 100644
--- a/scripts/installer.nsh
+++ b/scripts/installer.nsh
@@ -1,4 +1,8 @@
+!include "packaging\windows\grant-users-access.nsh"
+
 !macro customInstall
+  !insertmacro grantUsersInstallAccess
+
   DetailPrint "Register farmcontrol URI Handler"
   DeleteRegKey HKCR "farmcontrol"
   WriteRegStr HKCR "farmcontrol" "" "URL:farmcontrol"