[cenglin123]

What this changes

Fixes the installer defects that put runtime user data at risk. Stacked on the security baseline (rebuild/security-v1.3.11-20260915), which this PR targets.

1. The installer no longer overwrites runtime user data

[Files] used a single {#SourceDir}\* entry with ignoreversion recursesubdirs. On an upgrade that overwrote modules\PW.txt, config.json and logs\ inside the install directory — and modules\PW.txt there is the user's real password book, not the repository placeholder.

Now:

Source: "{#SourceDir}\*"; DestDir: "{app}"; Excludes: "config.json,logs\*,modules\PW.txt"; Flags: ignoreversion recursesubdirs createallsubdirs
Source: "{#SourceDir}\modules\PW.txt"; DestDir: "{app}\modules"; Flags: onlyifdoesntexist uninsneveruninstall

• the wildcard entry excludes the three runtime user-data paths;
• the placeholder is installed only when the target does not already exist, and is never removed by the uninstaller.

2. Uninstalling now cleans up what was installed

The .iss had no [UninstallRun], so uninstalling left the context-menu registry entries and the machine PATH entry behind. Added:

[UninstallRun]
Filename: "powershell.exe"; Parameters: "-NoProfile -ExecutionPolicy Bypass -File ""{app}\context-menu\Uninstall-ContextMenu.ps1"" -InstallRoot ""{app}"""; Flags: runhidden; RunOnceId: "RemoveContextMenu"

[UninstallRun] runs before files are deleted, so the script is still present. The deletion itself goes through context-menu\RegistryDeleteSafety.ps1, so only allowlisted keys can be removed and critical system roots are refused.

Deliberately not changed

• No [Registry] section and no automatic context-menu registration. Registration is performed by context-menu\01-安装隐写者到右键菜单.cmd today. Making the installer register the menu automatically changes user-visible behaviour, so it is left as an explicit follow-up decision rather than folded into a defect fix.
• The placeholder check is not duplicated in the installer: build-release.ps1 already runs scripts/validate-release.ps1, which now rejects any modules/PW.txt that is not the known placeholder (by exact bytes or SHA-256, never by size). So a real password book cannot be staged in the first place.

Verification and limitations

• Structural self-check of the edited .iss: expected sections present and in valid order ([Setup] [Languages] [Tasks] [Files] [Icons] [Run] [UninstallRun]); Excludes / onlyifdoesntexist / uninsneveruninstall / RunOnceId all present; the original wildcard entry retained.
• Not compile-tested: Inno Setup 6 (ISCC.exe) is not installed on this machine, so the installer could not be built locally. This should be compiled and smoke-tested in an environment that has it before release.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 24aa2fa9de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve context-menu registrations from other installs

Because context-menu registration remains an explicit/manual step, this command executes even when the {app} copy was never registered. If a portable mirror (or another copy at a different path) has registered the shared HKCR...\Steganographier and CommandStore keys, uninstalling this installer runs its generic cleanup script and deletes those keys, leaving the other installation’s right-click integration broken. Gate cleanup on registrations that point to {app} (or record installation ownership) instead of running it unconditionally.

AGENTS.md reference: AGENTS.md:L10-L10

Useful? React with 👍 / 👎.