Installer UI

What works in the first GUI prototype

The BSIS installer runtime now offers a WebView2-based graphical window as an alternative to the existing console prompt. It uses Rust/Tao for the native window and Wry to host the local HTML/CSS UI. No website or external assets are loaded by the wizard.

The experimental GUI shows the real embedded product name, version, publisher and file count, allows the installation destination to be changed, performs installation through the same native Rust engine used by the console installer, and displays completion or a readable failure.

The graphical installer now shows streaming byte-level extraction progress from the Rust core. It emits updates after each additional MiB written within a large file, while the verified-file counter only advances after a file passes SHA-256 verification. A separate finalization stage follows extraction. The progress bar is capped at 99% until the staged directory is committed; only a successful commit emits the completed event and 100%.

This is measured extraction progress, not a download estimate or predicted time remaining. The UI reports both bytes written to private staging and the count of fully verified files. The header and footer stay visible; only the main content scrolls on smaller windows.

Try it on Windows

Build a sample Setup.exe as described in Getting started or use a current Windows CI artifact, and extract the ZIP into a permanent directory first.

.\BSIS-Hello-Setup.exe gui

Choose a new or existing empty directory, then select Install now. A nonempty directory is rejected without overwriting files. After success, the GUI displays the destination and a completion message. The installation folder also contains a native Uninstall.exe, which works without the original Setup.exe. See Uninstaller.

Running Setup.exe without arguments still opens console mode in this prototype. The GUI does not yet open by default.

Graphical removal from Uninstall.exe

An installed Uninstall.exe now has its own opt-in WebView2 window. It does not contain the compressed application payload and therefore cannot launch the installation wizard. It instead opens the receipt-verified removal wizard:

.\Uninstall.exe gui

The removal window lists the installed product and path, warns about observed file-integrity problems, and asks for confirmation. Its Uninstall action always targets the directory containing the running Uninstall.exe; it invokes the existing native receipt-validated uninstall engine, not a JavaScript file-deletion routine. Only tracked files are removed; unrelated user files remain. Windows finishes removal of the running Uninstall.exe after the window exits, if the post-exit cleanup helper can start.

Double-clicking the native Uninstall.exe without arguments continues to show its console confirmation in this prototype. Graphical removal is opt-in and still needs interactive Windows testing. See Uninstaller for the exact removal and failure behavior.

Cancelling an installation safely

Once you select Install now, the Cancel installation button remains available while the Rust installer is working. It sends a limited cancellation message to the native host rather than killing the process.

Cancellation is cooperative: Rust checks for it approximately every 1 MiB of extraction within the current file, at the end of each fully verified file, and immediately before committing the staged directory. If the request is acknowledged before commit, temporary installation files are discarded and no target application is installed. A pre-existing empty destination stays empty.

Even within one large file, BSIS can now stop extraction before that file finishes. A slow or blocked filesystem operation can still delay the response; cancellation does not interrupt an OS write in progress. This is safe pre-commit cancellation, not resumable installation or post-commit rollback.

Important: Once the staged installation has been committed, cancellation cannot undo the completed application installation. Use the native uninstaller for removal after success.

WebView2 developer tools

Normal GUI mode disables right-click context menus, Inspect Element, browser accelerator shortcuts and Print. These are development tools, not options regular installer users need to see.

To enable them explicitly while developing the installer UI:

.\BSIS-Hello-Setup.exe gui --dev

With --dev, right-click and select Inspect Element to open WebView2 Developer Tools. Browser-specific shortcuts are also enabled. Without the flag, those menus and shortcuts stay disabled.

The flag is opt-in for the gui command only. It does not grant the HTML UI additional filesystem privileges or bypass native path validation. Hiding Inspect Element is a UI choice, not a security boundary.

Runtime requirements

• Windows 10 or 11, desktop session.
• Microsoft Edge WebView2 Runtime must already be available.
• The Setup.exe still contains the Rust installation engine, bundled UI assets and Zstandard-compressed application payload.

If WebView2 is missing, the `gui` command reports an error. The console installer remains usable, but we have not yet implemented bundling or an offline fallback for the WebView2 runtime itself.

Rust-to-UI boundary

The installation HTML screen cannot ask the Rust core to execute an arbitrary command. The installer prototype recognizes three narrowly typed IPC actions:

The uninstaller has a separate IPC handler that accepts only uninstall and close, with no path parameters. The core discovers the removal directory from the installed executable’s own location and validates the receipt before deleting files.

Installation runs on a worker thread so the UI remains responsive. Native progress events are sent from the core to the window's event loop for safe rendering as a progress bar and text status. The written_bytes field counts bytes written into the private stage, which are not verified until the current file finishes. completed_bytes and completed_files count only SHA-256-verified content. The UI receives event data but cannot invoke arbitrary Rust commands. Errors or final results are returned to the main UI thread and displayed as text, not injected HTML.

This is an initial boundary, not yet a complete security review. Future custom developer UI requires stricter permissions, navigation policy, event schemas and trust rules.

What remains planned

The following are not yet implemented:

• Svelte/React project-provided installer screens and reusable UI components.
• A shared step engine for welcome, license, components, progress and success.
• Resumable installation, interruption of blocked OS I/O and general-purpose rollback after commit (MiB-granular pre-commit cancellation now exists).
• Native directory picker and richer accessibility testing.
• Automatic GUI-on-double-click and a documented fallback for missing WebView2.
• A Windows-registered uninstaller and Apps & Features entry (an unregistered installed Uninstall.exe now exists).
• Registry integration, shortcuts, services, UAC elevation, updaters and plugins.

The console installer and its proven unattended commands remain part of BSIS as this UI develops. See Roadmap for release-readiness goals.