FOLDER DASHBOARD - DEPLOYMENT KIT (administrator notes)
=======================================================

What this adds
  "Open in Explorer" buttons in the dashboard, plus a one-click, per-user installer that staff
  run from a shared folder. No administrator rights are needed on staff PCs.

Files in this folder
  Install-FolderDashboard.bat   staff double-click this
  Install-FolderDashboard.ps1   the installer (also used by the Start menu "Update" shortcut)
  Uninstall-FolderDashboard.ps1 copied to each PC; used by Apps & features
  FolderDashLauncher.ps1        handles folderdash:// links; opens one existing folder, nothing else
  config.json                   YOU EDIT THIS (see below)
  folder-dashboard.html         v1.4.6
  folder-dashboard-guide.html
  version.json                  for your update host (not used by the installer)

Set up (about 5 minutes)
  1. Create a folder on the network for the kit, for example  \\fileserver\tools\FolderDashboard
     - It must be OUTSIDE the shared folder the dashboard monitors, or the dashboard will list
       its own installer files and report them as changes.
     - Staff get READ-ONLY access. Only you can write to it. Whoever can change these files can
       run code on every PC that installs from here.
  2. Copy every file from this kit into it.
  3. Edit config.json:
       "basePath"     the folder staff select in the dashboard, exactly as File Explorer shows it
       "allowedRoots" the ONLY folders Open in Explorer may open. List every route staff use
                      (e.g. "S:\\Shared" and "\\\\fileserver\\Shared"). Double backslashes.
     A crafted link could otherwise point Explorer at \\attacker\share and leak the user's Windows
     credentials. allowedRoots is what prevents that. If it is empty or wrong, nothing opens.
  4. Tell staff: open that folder, double-click Install-FolderDashboard.bat.

Pilot first (do not skip)
  I could not run Windows, PowerShell or a browser against a real share while building this. Test
  on ONE PC with a normal (non-admin) account before rolling out:
   [ ] Installer finishes; desktop shortcut and Start menu entries appear
   [ ] Dashboard opens from the shortcut; "Select folder" works from a file:// page in Edge/Chrome
       (if the picker does nothing, serve the dashboard from an internal https address instead)
   [ ] Open in Explorer appears; first click shows the browser's "Open Folder Dashboard?" prompt
   [ ] It opens the right folder for: the top button, a file row, a Needs attention row
   [ ] A folder with spaces, an apostrophe or a bracket in its name still opens
   [ ] The drive root (basePath S:\ ) opens correctly
   [ ] Changing "Set path" to a folder outside allowedRoots shows the "outside the shared folder"
       message and opens nothing
   [ ] Apps & features > Folder Dashboard > Uninstall removes it; the link then stops working
   [ ] Re-running the installer after editing config.json updates the PC
   [ ] PCs with AppLocker / Constrained Language Mode / Defender ASR rules: confirm the launcher runs

Silent install for everyone (logon script or GPO)
  powershell -NoProfile -ExecutionPolicy Bypass -File "\\fileserver\tools\FolderDashboard\Install-FolderDashboard.ps1" -Quiet
  With -Quiet it does nothing when the PC already has identical files.

Releasing an update
  Replace the files in the kit folder (bump VERSION in folder-dashboard.html and version.json).
  Staff use Start menu > Folder Dashboard > "Update Folder Dashboard", or get it at next logon if
  you use the silent install.

What gets installed on each PC (current user only)
  %LOCALAPPDATA%\FolderDashboard\   dashboard, guide, launcher, config.json, folder-dashboard-config.js
  HKCU\Software\Classes\folderdash  the link handler
  HKCU\...\Uninstall\FolderDashboard  Apps & features entry
  Desktop + Start menu shortcuts

Privacy
  The launcher log (%LOCALAPPDATA%\FolderDashboard\launcher.log) records refusals and errors, and
  for refusals the path that was refused. Successful opens are logged without the path, so the log
  is not a record of which client folders someone opened. It is local and capped at ~200 KB.

Known limits
  - Windows only. Mac staff keep using Copy path.
  - The launcher briefly flashes a console window when it starts.
  - Chrome/Edge must be allowed to open the folderdash:// link; managed browsers can pre-approve it
    with the AutoLaunchProtocolsFromOrigins policy, which needs a web origin (not file://).
  - Windows may show "Windows protected your PC" the first time the .bat is run from a download or
    share. Unblock the files once on the share (right-click > Properties > Unblock, or
    Get-ChildItem <kit folder> | Unblock-File) to avoid that for staff.