Windows installer: fix the Windows build and register the browser host

- main.rs: the Windows clipboard branch dropped the copy's Result (only the non-Windows branch was
  checked), which failed to compile for Windows; both now report a failed copy.
- windows/hooks.nsh: the NSIS installer writes the native messaging manifests next to kestrove-nmh.exe
  and registers them under HKCU for Chrome, Chromium, Edge, Brave, Vivaldi and Firefox; uninstall
  removes them. Per-user install.
- scripts/windows.sh: cross-build with cargo-xwin, compile the installer with NSIS 3.11 in a Debian 13
  container (Homebrew's makensis 3.13 crashes on macOS).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src-tauri/src/main.rs

@@ -290,13 +290,14 @@ fn copy_secret(app: State<'_, App>, id: String, field: Option<String>) -> CmdRes
     }
     let cb = guard.as_mut().expect("clipboard initialized above");
     #[cfg(windows)]
-    {
+    let copied = {
         // docs/04: keep secrets out of clipboard history, cloud sync and monitors.
         use arboard::SetExtWindows;
         cb.set().exclude_from_monitoring().exclude_from_cloud().exclude_from_history().text(secret.to_string())
-    }
+    };
     #[cfg(not(windows))]
-    { cb.set_text(secret.to_string()) }.map_err(|e| e.to_string())?;
+    let copied = cb.set_text(secret.to_string());
+    copied.map_err(|e| e.to_string())?;
     drop(guard);
     thread::spawn(move || {
         thread::sleep(CLIPBOARD_CLEAR);

src-tauri/tauri.conf.json

@@ -10,14 +10,42 @@
     "frontendDist": "../dist"
   },
   "app": {
-    "windows": [{ "title": "Kestrove", "width": 1040, "height": 680, "minWidth": 760, "minHeight": 480, "titleBarStyle": "Overlay", "hiddenTitle": true }],
+    "windows": [
+      {
+        "title": "Kestrove",
+        "width": 1040,
+        "height": 680,
+        "minWidth": 760,
+        "minHeight": 480,
+        "titleBarStyle": "Overlay",
+        "hiddenTitle": true
+      }
+    ],
     "security": {
       "csp": "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src ipc: http://ipc.localhost"
     }
   },
   "bundle": {
     "active": true,
-    "targets": ["msi", "nsis", "appimage", "deb"],
-    "icon": ["icons/32x32.png", "icons/128x128.png", "icons/[email protected]", "icons/icon.icns", "icons/icon.ico", "icons/icon.png"]
+    "targets": [
+      "msi",
+      "nsis",
+      "appimage",
+      "deb"
+    ],
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/[email protected]",
+      "icons/icon.icns",
+      "icons/icon.ico",
+      "icons/icon.png"
+    ],
+    "windows": {
+      "nsis": {
+        "installerHooks": "windows/hooks.nsh",
+        "installMode": "currentUser"
+      }
+    }
   }
 }

src-tauri/windows/hooks.nsh

@@ -0,0 +1,35 @@
+; Kestrove NSIS installer hooks (tauri.conf.json → bundle.windows.nsis.installerHooks).
+; Registers the browser extension's native messaging host for the current user (HKCU, no admin), like
+; native-messaging/install.ps1: a manifest next to kestrove-nmh.exe ("path" relative to the manifest, which
+; Chrome and Firefox allow on Windows) and one registry key per browser.
+; Extension ids: keep in sync with kestrove-apple/App/BrowserIntegration.swift (NativeHostRegistration).
+
+!define KV_HOST "app.kestrove.nmh"
+!define KV_CHROME_ORIGINS '"chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"'
+!define KV_FIREFOX_IDS '"[email protected]"'
+
+!macro NSIS_HOOK_POSTINSTALL
+  FileOpen $0 "$INSTDIR\${KV_HOST}.chrome.json" w
+  FileWrite $0 '{"name": "${KV_HOST}", "description": "Kestrove", "path": "kestrove-nmh.exe", "type": "stdio", "allowed_origins": [${KV_CHROME_ORIGINS}]}'
+  FileClose $0
+  FileOpen $0 "$INSTDIR\${KV_HOST}.firefox.json" w
+  FileWrite $0 '{"name": "${KV_HOST}", "description": "Kestrove", "path": "kestrove-nmh.exe", "type": "stdio", "allowed_extensions": [${KV_FIREFOX_IDS}]}'
+  FileClose $0
+  WriteRegStr HKCU "Software\Google\Chrome\NativeMessagingHosts\${KV_HOST}" "" "$INSTDIR\${KV_HOST}.chrome.json"
+  WriteRegStr HKCU "Software\Chromium\NativeMessagingHosts\${KV_HOST}" "" "$INSTDIR\${KV_HOST}.chrome.json"
+  WriteRegStr HKCU "Software\Microsoft\Edge\NativeMessagingHosts\${KV_HOST}" "" "$INSTDIR\${KV_HOST}.chrome.json"
+  WriteRegStr HKCU "Software\BraveSoftware\Brave-Browser\NativeMessagingHosts\${KV_HOST}" "" "$INSTDIR\${KV_HOST}.chrome.json"
+  WriteRegStr HKCU "Software\Vivaldi\NativeMessagingHosts\${KV_HOST}" "" "$INSTDIR\${KV_HOST}.chrome.json"
+  WriteRegStr HKCU "Software\Mozilla\NativeMessagingHosts\${KV_HOST}" "" "$INSTDIR\${KV_HOST}.firefox.json"
+!macroend
+
+!macro NSIS_HOOK_PREUNINSTALL
+  DeleteRegKey HKCU "Software\Google\Chrome\NativeMessagingHosts\${KV_HOST}"
+  DeleteRegKey HKCU "Software\Chromium\NativeMessagingHosts\${KV_HOST}"
+  DeleteRegKey HKCU "Software\Microsoft\Edge\NativeMessagingHosts\${KV_HOST}"
+  DeleteRegKey HKCU "Software\BraveSoftware\Brave-Browser\NativeMessagingHosts\${KV_HOST}"
+  DeleteRegKey HKCU "Software\Vivaldi\NativeMessagingHosts\${KV_HOST}"
+  DeleteRegKey HKCU "Software\Mozilla\NativeMessagingHosts\${KV_HOST}"
+  Delete "$INSTDIR\${KV_HOST}.chrome.json"
+  Delete "$INSTDIR\${KV_HOST}.firefox.json"
+!macroend