Add ProxiFyre firewall rule management and bump version to 1.1.0

src-tauri/tests/command_tests.rs

@@ -287,6 +287,11 @@ fn proxifyre_install_script_uses_resilient_download_helpers() {
     ));
     assert!(script.contains("github.com/wiresock/ndisapi/releases/download"));
     assert!(script.contains("github.com/wiresock/proxifyre/releases/download"));
+    assert!(script.contains(
+        "[IO.File]::WriteAllText($markerPath, $markerJson, [Text.UTF8Encoding]::new($false))"
+    ));
+    assert!(!script
+        .contains("ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $markerPath -Encoding UTF8"));
     let packet_filter_step = script
         .find("Write-ProxyWardenProgress 'install' 'packet-filter'")
         .expect("packet filter install step should be present");
@@ -342,6 +347,52 @@ fn proxifyre_install_script_prefers_bundled_assets_before_downloads() {
     cleanup(&root);
 }
 
+#[test]
+fn proxifyre_firewall_script_scopes_rules_to_managed_executable() {
+    let executable =
+        PathBuf::from(r"C:\Program Files\Proxy'Warden\components\ProxiFyre\ProxiFyre.exe");
+    let script = commands::configure_proxifyre_firewall_script(&executable);
+
+    assert!(script.contains(
+        "$exePath = 'C:\\Program Files\\Proxy''Warden\\components\\ProxiFyre\\ProxiFyre.exe'"
+    ));
+    assert!(script.contains("ProxyWarden.ProxiFyre.Inbound"));
+    assert!(script.contains("ProxyWarden.ProxiFyre.Outbound"));
+    assert!(script.contains("-Program $exePath"));
+    assert!(script.contains("Get-NetFirewallRule -Name $rule.Name"));
+    assert!(!script.contains("Get-NetFirewallRule -DisplayName"));
+}
+
+#[test]
+#[cfg(windows)]
+fn proxifyre_firewall_script_parses_as_powershell() {
+    let root = test_root("proxifyre-firewall-script");
+    fs::create_dir_all(&root).expect("test root should be created");
+    let script = commands::configure_proxifyre_firewall_script(
+        &root.join("ProxiFyre").join("ProxiFyre.exe"),
+    );
+    let script_path = root.join("firewall.ps1");
+    fs::write(&script_path, script).expect("script should be written");
+
+    let escaped_path = script_path.display().to_string().replace('\'', "''");
+    let parser = format!(
+        "$tokens = $null; $errors = $null; [System.Management.Automation.Language.Parser]::ParseFile('{escaped_path}', [ref]$tokens, [ref]$errors) | Out-Null; if ($errors.Count -gt 0) {{ $errors | ForEach-Object {{ $_.Message }}; exit 1 }}"
+    );
+    let output = ProcessCommand::new("powershell")
+        .args(["-NoProfile", "-NonInteractive", "-Command", &parser])
+        .output()
+        .expect("powershell parser should run");
+
+    assert!(
+        output.status.success(),
+        "firewall script should parse\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr),
+    );
+
+    cleanup(&root);
+}
+
 #[test]
 #[cfg(windows)]
 fn proxifyre_uninstall_script_parses_as_powershell() {
@@ -410,6 +461,8 @@ fn proxifyre_uninstall_script_removes_packet_filter_after_proxifyre() {
     assert!(script.contains("Start-Process -FilePath 'msiexec.exe'"));
     assert!(script.contains("ArgumentList @('/x', $productCode, '/qn', '/norestart'"));
     assert!(script.contains("Uninstall-MsiProgram $packetFilter 'Windows Packet Filter'"));
+    assert!(script.contains("ProxyWarden.ProxiFyre.Inbound"));
+    assert!(script.contains("ProxyWarden.ProxiFyre.Outbound"));
     let proxifyre_step = script
         .find("Write-ProxyWardenProgress 'uninstall' 'proxifyre'")
         .expect("proxifyre uninstall step should be present");
@@ -419,6 +472,16 @@ fn proxifyre_uninstall_script_removes_packet_filter_after_proxifyre() {
     assert!(proxifyre_step < packet_filter_step);
 }
 
+#[test]
+fn proxywarden_uninstall_hook_removes_only_managed_firewall_rules() {
+    let script = include_str!("../bundled/cleanup/uninstall-managed-components.ps1");
+
+    assert!(script.contains("ProxyWarden.ProxiFyre.Inbound"));
+    assert!(script.contains("ProxyWarden.ProxiFyre.Outbound"));
+    assert!(script.contains("Get-NetFirewallRule -Name $name"));
+    assert!(!script.contains("Get-NetFirewallRule -DisplayName"));
+}
+
 #[test]
 fn proxifyre_uninstall_script_leaves_shared_packet_filter_installed() {
     let detected = DetectedProxyfier {

src-tauri/tests/proxifyre_ownership_tests.rs

@@ -18,6 +18,35 @@ fn accepts_matching_managed_install_and_returns_packet_filter_ownership() {
     assert!(ownership.remove_packet_filter);
 }
 
+#[test]
+fn accepts_windows_powershell_utf8_bom_marker() {
+    let fixture = ManagedInstallFixture::new("utf8-bom");
+    let marker = json!({
+        "manager": "ProxyWarden",
+        "component": "proxifyre",
+        "serviceName": "ProxiFyreService",
+        "installRoot": fixture.install_dir,
+        "packetFilterInstalledByProxyWarden": false
+    });
+    let mut marker_bytes = vec![0xEF, 0xBB, 0xBF];
+    marker_bytes.extend(serde_json::to_vec_pretty(&marker).expect("marker should serialize"));
+    fs::write(
+        fixture.install_dir.join("proxywarden-component.json"),
+        marker_bytes,
+    )
+    .expect("BOM marker should be written");
+
+    let ownership = verify_managed_proxifyre_install(
+        &fixture.install_dir,
+        &fixture.executable_path,
+        &fixture.install_dir,
+    )
+    .expect("Windows PowerShell BOM marker should prove ownership");
+
+    assert_eq!(ownership.service_name, "ProxiFyreService");
+    assert!(!ownership.remove_packet_filter);
+}
+
 #[test]
 fn rejects_install_outside_expected_managed_directory() {
     let fixture = ManagedInstallFixture::new("unexpected-root");