# ShellOrchestra Windows app install and upgrade

ShellOrchestra Server for Windows is the Docker-free local deployment mode. Docker remains the recommended production deployment for stronger isolation, but the Windows app is supported for operators who want a local Windows-hosted controller.

## Fresh install

1. Download the latest `ShellOrchestraSetup-<version>.exe` from the ShellOrchestra downloads page.
2. Verify that the publisher is `Develastic` and that the version matches the release page.
3. Run the installer as Administrator.
4. The installer creates two Windows services:
   - `ShellOrchestra Supervisor` for the local runtime;
   - `ShellOrchestra Updater` for signed one-click upgrades.
5. The tray/WebView app opens `http://127.0.0.1:7171` by default.

ShellOrchestra does not open LAN or public firewall access during the default Windows install. Enable remote access later from the application after reading the security warning.

## One-click upgrade

When a signed update is available, ShellOrchestra shows an update banner after sign-in. Press **Upgrade now** to start the local updater. The updater downloads the signed Windows update bundle, verifies the manifest, artifact signature, SHA-256, and internal checksums, then updates both the local runtime and the tray/WebView desktop client.

Active SSH sessions and virtual desktops are interrupted during the service restart. If the upgrade is started from the Windows tray/WebView client, that desktop window can close while its executable is replaced; reopen ShellOrchestra from the Start menu or desktop shortcut after the update completes. If health validation fails, the updater rolls back to the previous runtime and desktop-client payload.

## Manual upgrade

If one-click upgrade is unavailable or the updater service is unhealthy:

1. Download the latest `ShellOrchestraSetup-<version>.exe`.
2. Run it as Administrator on the Windows host, or from PowerShell in the
   download directory:

   ```powershell
   Start-Process .\ShellOrchestraSetup.exe -Verb RunAs
   ```

3. Keep the existing `%ProgramData%\ShellOrchestra` data when prompted.
4. Confirm that both Windows services are running after install.

Do not copy random files over an existing installation. Use the signed installer or the in-product updater only.