Release 1.7.0: reduce AV false positives (no bat updater, no silent core download, app manifest).

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/vpnapp/main_windows.go

@@ -8,11 +8,9 @@ import (
 	"fmt"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 	"unsafe"
 
@@ -59,6 +57,10 @@ type uiState struct {
 }
 
 func main() {
+	if update.MaybeFinishUpdate(os.Args[1:]) {
+		return
+	}
+
 	log.SetFlags(log.LstdFlags | log.Lshortfile)
 
 	cfgPath, err := config.LocateConfig()
@@ -95,9 +97,7 @@ func main() {
 	dataPath := filepath.Join(filepath.Dir(cfgPath), ".navis-webview")
 	_ = os.MkdirAll(dataPath, 0o755)
 
-	go func() {
-		_, _ = mgr.EnsureAllCores()
-	}()
+	// Do NOT auto-download cores on startup — silent network+write looks like malware to AV.
 
 	w := webview2.NewWithOptions(webview2.WebViewOptions{
 		Debug:     false,
@@ -373,18 +373,7 @@ func openURL(raw string) error {
 	default:
 		return fmt.Errorf("разрешена только ссылка evilfox.win")
 	}
-	if err := shellOpen(raw); err == nil {
-		return nil
-	}
-	// Fallbacks when ShellExecute is blocked by policy.
-	cmd := exec.Command("cmd", "/c", "start", "", raw)
-	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
-	if err := cmd.Start(); err == nil {
-		return nil
-	}
-	cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", raw)
-	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
-	return cmd.Start()
+	return shellOpen(raw)
 }
 
 func shellOpen(raw string) error {