fix(cli): copy wintun.dll beside an auto-downloaded version on Windows

WinTUN loads wintun.dll from the executable's own directory (not PATH), so a version fetched into ~/.plug/versions/<v>/ failed with "Error loading wintun.dll: module could not be found" — the DLL was only beside the launcher in Programs/plug. The launcher now copies it next to each downloaded version. Also refreshes a stale route_windows.go comment (the NRPT rule is the .plug suffix now, not a catch-all).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hhfrancois

cli/internal/tun/route_windows.go

@@ -69,12 +69,14 @@ func configure(dev any, _, cidr, dnsIP string, log logfn) ([]string, string, fun
 	return nil, "", cleanup, nil
 }
 
-// setSystemNRPT installs a catch-all Name Resolution Policy Table rule (namespace
-// ".") sending every DNS query to dnsIP. This is what makes single-label cluster
-// names resolve on Windows — the equivalent of scutil on macOS / resolv.conf on
-// Linux. Driven through the DnsClient cmdlets, which encode the DnsPolicyConfig
-// registry correctly (the same table WireGuard-Windows writes by hand), and flush
-// the resolver cache so a prior negative answer ("Could not resolve") doesn't stick.
+// setSystemNRPT installs a Name Resolution Policy Table rule routing the ".plug"
+// search suffix to dnsIP. Paired with that suffix on plug0 (SetDNS above), it makes
+// single-label cluster names resolve on Windows: getaddrinfo appends the suffix (a
+// real DNS query at last), NRPT sends ".plug" here, answerDNS strips it back. It is
+// the Windows equivalent of scutil on macOS / resolv.conf on Linux, and the same
+// suffix+NRPT mechanism Tailscale/WireGuard use. Driven through the DnsClient cmdlets
+// (they encode the DnsPolicyConfig registry correctly), flushing the resolver cache
+// so a prior "Could not resolve" negative doesn't stick.
 func setSystemNRPT(dnsIP string) error {
 	clearSystemNRPT(dnsIP) // drop a stale rule a crashed run may have left
 	return psRun("Add-DnsClientNrptRule -Namespace '." + searchSuffix + "' -NameServers '" + dnsIP + "'; Clear-DnsClientCache")

cli/main.go

@@ -302,6 +302,7 @@ func ensureVersion(v string, cfg config) (string, error) {
 	own := func() { chownToUser(versionsDir()); chownToUser(dir); chownToUser(bin) }
 	if fi, err := os.Stat(bin); err == nil && fi.Size() > 1<<20 {
 		own()
+		ensureWintunBeside(bin)
 		return bin, nil
 	}
 	data, err := getDownload(cfg, fmt.Sprintf("%s-%s", runtime.GOOS, runtime.GOARCH), "v"+v)
@@ -331,9 +332,34 @@ func ensureVersion(v string, cfg config) (string, error) {
 		return "", err
 	}
 	own()
+	ensureWintunBeside(bin)
 	return bin, nil
 }
 
+// ensureWintunBeside copies wintun.dll next to a versioned binary on Windows.
+// WinTUN's loader looks only in the executable's OWN directory (a hardening choice,
+// not the PATH), so a binary run from ~/.plug/versions/<v>/ can't find the wintun.dll
+// the installer dropped in the launcher dir — "Error loading wintun.dll ... module
+// could not be found". Best-effort: copy it from beside the launcher; no-op elsewhere.
+func ensureWintunBeside(bin string) {
+	if runtime.GOOS != "windows" {
+		return
+	}
+	dst := filepath.Join(filepath.Dir(bin), "wintun.dll")
+	if _, err := os.Stat(dst); err == nil {
+		return // already there
+	}
+	self, err := os.Executable()
+	if err != nil {
+		return
+	}
+	data, err := os.ReadFile(filepath.Join(filepath.Dir(self), "wintun.dll"))
+	if err != nil {
+		return // launcher has none beside it — nothing to copy
+	}
+	_ = os.WriteFile(dst, data, 0o644)
+}
+
 func listVersions() {
 	fmt.Printf("launcher: v%s\n", version)
 	entries, err := os.ReadDir(versionsDir())