From efdaffa73fc85b7f1b8301efaad300a823725ed7 Mon Sep 17 00:00:00 2001
From: sysadmin <sysadmin@silverlined.dev>
Date: Tue, 9 Jun 2026 03:36:46 +0100
Subject: [PATCH] feat(welcome): bootstrap auto-login launches the Welcome app
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename the unattend LocalAccount from silvermetal → sm-bootstrap
(Administrators), add a one-time AutoLogon and a FirstLogonCommands
entry that launches SilverOS.Welcome.App.exe on first boot. The
Welcome app's ApplyService tears down AutoAdminLogon + removes
sm-bootstrap on successful onboarding.
---
 .../installer/autounattend/autounattend.xml   | 33 +++++++++++++++++--
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/windows/installer/autounattend/autounattend.xml b/windows/installer/autounattend/autounattend.xml
index 33cd51b..38bf9f9 100644
--- a/windows/installer/autounattend/autounattend.xml
+++ b/windows/installer/autounattend/autounattend.xml
@@ -84,14 +84,41 @@
       </OOBE>
       <UserAccounts>
         <LocalAccounts>
+          <!--
+            sm-bootstrap: ephemeral one-time admin account used ONLY for the
+            SilverOS Welcome onboarding wizard.  The Welcome app's ApplyService
+            tears this account down on success (removes AutoAdminLogon registry
+            keys, deletes the account, and creates the real end-user account
+            instead).  Never ship this password as-is for end-users; the
+            production pipeline MUST inject a per-device credential.
+          -->
           <LocalAccount wcm:action="add" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
-            <Name>silvermetal</Name>
+            <Name>sm-bootstrap</Name>
             <Group>Administrators</Group>
-            <DisplayName>SilverMetal</DisplayName>
-            <Password><Value>open sesame</Value><PlainText>true</PlainText></Password>
+            <DisplayName>SilverOS Bootstrap</DisplayName>
+            <Password><Value>bootstrap-OneTime!</Value><PlainText>true</PlainText></Password>
           </LocalAccount>
         </LocalAccounts>
       </UserAccounts>
+      <!--
+        AutoLogon: logs in as sm-bootstrap exactly once so that FirstLogonCommands
+        can launch the Welcome wizard.  After the wizard completes successfully,
+        ApplyService removes the AutoAdminLogon registry values and deletes
+        sm-bootstrap, so the one-time session cannot be re-entered.
+      -->
+      <AutoLogon>
+        <Enabled>true</Enabled>
+        <LogonCount>1</LogonCount>
+        <Username>sm-bootstrap</Username>
+        <Password><Value>bootstrap-OneTime!</Value><PlainText>true</PlainText></Password>
+      </AutoLogon>
+      <FirstLogonCommands>
+        <SynchronousCommand wcm:action="add" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+          <Order>1</Order>
+          <CommandLine>cmd /c "C:\Program Files\SilverOS\Welcome\SilverOS.Welcome.App.exe"</CommandLine>
+          <Description>SilverOS Welcome</Description>
+        </SynchronousCommand>
+      </FirstLogonCommands>
       <RegisteredOwner>SilverMetal</RegisteredOwner>
       <RegisteredOrganization>SilverLABS</RegisteredOrganization>
       <!--