v0.4.1: launcher scripts (run.sh / run.command / run.bat)

First run needs the CLI to install the MITM CA into the system trust
store (sudo/admin prompt), which the UI alone can't do reliably from a
double-click. Add a small launcher for each platform that runs the CLI
with --install-cert once, then starts the UI. Each release archive now
contains a run.* script alongside the binaries.

.github/workflows/release.yml

@@ -99,6 +99,12 @@ jobs:
             cp target/${{ matrix.target }}/release/mhrv-rs-ui dist/mhrv-rs-ui
             chmod +x dist/mhrv-rs-ui
           fi
+          cp assets/launchers/run.sh dist/run.sh
+          chmod +x dist/run.sh
+          if [ "${{ runner.os }}" = "macOS" ]; then
+            cp assets/launchers/run.command dist/run.command
+            chmod +x dist/run.command
+          fi
 
       - name: Build macOS .app bundle
         if: runner.os == 'macOS'
@@ -118,15 +124,18 @@ jobs:
           if (Test-Path target/${{ matrix.target }}/release/mhrv-rs-ui.exe) {
             Copy-Item target/${{ matrix.target }}/release/mhrv-rs-ui.exe dist/mhrv-rs-ui.exe
           }
+          Copy-Item assets/launchers/run.bat dist/run.bat
 
       - name: Make archive
         shell: bash
         run: |
           cd dist
           if [ "${{ runner.os }}" = "Windows" ]; then
-            7z a -tzip "${{ matrix.name }}.zip" mhrv-rs.exe mhrv-rs-ui.exe
+            7z a -tzip "${{ matrix.name }}.zip" mhrv-rs.exe mhrv-rs-ui.exe run.bat
+          elif [ "${{ runner.os }}" = "macOS" ]; then
+            tar czf "${{ matrix.name }}.tar.gz" mhrv-rs mhrv-rs-ui run.sh run.command
           else
-            tar czf "${{ matrix.name }}.tar.gz" mhrv-rs mhrv-rs-ui 2>/dev/null || tar czf "${{ matrix.name }}.tar.gz" mhrv-rs
+            tar czf "${{ matrix.name }}.tar.gz" mhrv-rs mhrv-rs-ui run.sh 2>/dev/null || tar czf "${{ matrix.name }}.tar.gz" mhrv-rs run.sh
           fi
 
       - uses: actions/upload-artifact@v4

Cargo.lock

@@ -1360,7 +1360,7 @@ dependencies = [
 
 [[package]]
 name = "mhrv-rs"
-version = "0.4.0"
+version = "0.4.1"
 dependencies = [
  "base64 0.22.1",
  "bytes",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mhrv-rs"
-version = "0.4.0"
+version = "0.4.1"
 edition = "2021"
 description = "Rust port of MasterHttpRelayVPN -- DPI bypass via Google Apps Script relay with domain fronting"
 license = "MIT"

README.md

@@ -36,6 +36,14 @@ Each release ships two binaries:
 - **`mhrv-rs`** — the CLI. Always works. Headless servers, Docker, automation. No system deps on macOS/Windows; on Linux works even without a display server.
 - **`mhrv-rs-ui`** — the desktop UI (egui). Form for the config, Start/Stop/Test buttons, live stats, recent log. macOS releases also include `mhrv-rs.app` (double-click to launch). Linux UI requires a display server and common desktop libraries (`libxkbcommon`, `libwayland-client`, `libxcb`, `libgl`, `libx11`, `libgtk-3`); install them via your distro's package manager if missing.
 
+On first run the MITM CA must be installed into the system trust store (this typically needs sudo/admin), and this is easiest to do from the CLI. Each archive therefore ships a launcher that does both steps in order:
+
+- Linux: `./run.sh`
+- macOS: `./run.command` (double-click in Finder) or `./run.sh` from a terminal
+- Windows: `run.bat`
+
+The launchers run `mhrv-rs --install-cert` once, then start `mhrv-rs-ui`. Subsequent runs can launch the UI directly.
+
 Config + the MITM CA live in the platform user-data dir:
 
 - macOS: `~/Library/Application Support/mhrv-rs/`

assets/launchers/run.bat

@@ -0,0 +1,30 @@
+@echo off
+REM mhrv-rs launcher for Windows.
+REM Runs the CLI once to initialize the MITM CA (may trigger a UAC prompt when
+REM installing into the Windows trust store), then launches the UI.
+
+setlocal
+cd /d "%~dp0"
+
+if not exist "mhrv-rs.exe" (
+    echo error: mhrv-rs.exe not found next to this script.
+    pause
+    exit /b 1
+)
+
+echo Initializing MITM CA (a UAC prompt may appear)...
+mhrv-rs.exe --install-cert
+if errorlevel 1 (
+    echo warning: CA install returned non-zero. The UI can still run,
+    echo but HTTPS sites may show certificate warnings until the CA is trusted.
+)
+
+if exist "mhrv-rs-ui.exe" (
+    echo Starting mhrv-rs UI...
+    start "" "mhrv-rs-ui.exe"
+) else (
+    echo UI binary not found. Running CLI proxy instead.
+    mhrv-rs.exe
+)
+
+endlocal

assets/launchers/run.command

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Double-clickable launcher for macOS Finder.
+# Same as run.sh but with .command extension so Finder opens it in Terminal.
+set -eu
+
+DIR="$(cd "$(dirname "$0")" && pwd)"
+CLI="$DIR/mhrv-rs"
+UI="$DIR/mhrv-rs-ui"
+
+if [ ! -x "$CLI" ]; then
+    echo "error: $CLI not found or not executable"
+    echo "Press return to close..."
+    read _
+    exit 1
+fi
+
+echo "Initializing MITM CA (you may be asked for your password)..."
+"$CLI" --install-cert || echo "warning: CA install returned non-zero. The UI can still run."
+
+if [ ! -x "$UI" ]; then
+    echo "UI binary not found. Starting CLI proxy instead."
+    exec "$CLI"
+fi
+
+echo "Starting mhrv-rs UI..."
+"$UI"

assets/launchers/run.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# mhrv-rs launcher for Linux / macOS.
+# Runs the CLI once (initializes the MITM CA in the user data dir and installs
+# it into the system trust store; may prompt for sudo), then launches the UI.
+set -eu
+
+DIR="$(cd "$(dirname "$0")" && pwd)"
+CLI="$DIR/mhrv-rs"
+UI="$DIR/mhrv-rs-ui"
+
+if [ ! -x "$CLI" ]; then
+    echo "error: $CLI not found or not executable" >&2
+    exit 1
+fi
+
+echo "Initializing MITM CA (you may be asked for your password)..."
+"$CLI" --install-cert || echo "warning: CA install returned non-zero; the UI can still run, but HTTPS sites may show cert errors until the CA is trusted."
+
+if [ ! -x "$UI" ]; then
+    echo "UI binary not found. Starting CLI proxy instead."
+    exec "$CLI"
+fi
+
+echo "Starting mhrv-rs UI..."
+exec "$UI"