@bli-cockpit/cli 0.2.13 → 0.2.14

package/dist/autostart.js

@@ -270,6 +270,13 @@ async function windowsTaskStatus(options) {
         const queryMessage = `${query.stderr}\n${query.stdout}`;
         const taskIsKnownAbsent = query.code === 1 &&
             /cannot find|not found|does not exist/iu.test(queryMessage);
+        // Metadata only: schtasks stderr can carry the state directory, so the exit
+        // code and the classification travel, never the text.
+        console.error("[autostart] windows task query failed", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            exit_code: query.code,
+            status: taskIsKnownAbsent ? "absent" : "not_loaded",
+        }));
         return {
             status: taskIsKnownAbsent ? "absent" : "not_loaded",
             label: AUTOSTART_LABEL,
@@ -305,6 +312,23 @@ async function windowsTaskStatus(options) {
             registrationProblems.push("sync script does not match the current roots or Cockpit runtime");
         }
     }
+    // Both branches log. A line that only fires on failure cannot answer "did
+    // background collection validate at all today?", which is the question that
+    // would have caught a validator rejecting every healthy Windows task.
+    // Problem labels carry no paths, so they are safe to emit verbatim.
+    if (registrationProblems.length > 0) {
+        console.error("[autostart] windows task needs repair", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            problem_count: registrationProblems.length,
+            problems: registrationProblems,
+        }));
+    }
+    else {
+        console.error("[autostart] windows task validated", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            interval_minutes: intervalMinutes,
+        }));
+    }
     return {
         status: registrationProblems.length > 0 ? "not_loaded" : "loaded",
         label: AUTOSTART_LABEL,
@@ -415,7 +439,7 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
     const actionArguments = exactExecBlock
         .match(/<Arguments>\s*([^<]*?)\s*<\/Arguments>/iu)?.[1]
         ?.trim() ?? "";
-    const expectedActionArguments = `-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${expected.scriptPath}"`;
+    const expectedArgumentFlags = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File";
     const requirements = [
         [
             /<DisallowStartIfOnBatteries>\s*false\s*<\/DisallowStartIfOnBatteries>/iu,
@@ -444,8 +468,18 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
         if (!/<LogonType>\s*InteractiveToken\s*<\/LogonType>/iu.test(exactPrincipalBlock)) {
             problems.push("logon type is not InteractiveToken");
         }
-        if (!/<RunLevel>\s*LeastPrivilege\s*<\/RunLevel>/iu.test(exactPrincipalBlock)) {
-            problems.push("task does not run with limited privileges");
+        // Windows omits <RunLevel> entirely when a task runs at the default
+        // LeastPrivilege, so `schtasks /Create ... /RL LIMITED` stores a principal
+        // block with no RunLevel element at all. Demanding the element asks Windows
+        // to state a default it never states, which is why this check failed on
+        // every Windows machine in the fleet and passed on none (0 of 4
+        // autostart-alive events ok, 2026-08-12). Absent means LeastPrivilege; only
+        // an explicit elevated value is a real problem.
+        const runLevel = exactPrincipalBlock
+            .match(/<RunLevel>\s*([^<]*?)\s*<\/RunLevel>/iu)?.[1]
+            ?.trim() || "LeastPrivilege";
+        if (!/^LeastPrivilege$/iu.test(runLevel)) {
+            problems.push(`task does not run with limited privileges (RunLevel=${runLevel})`);
         }
     }
     if (actionContext && actionContext !== principalId) {
@@ -477,8 +511,9 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
     if (!sameWindowsPath(command, expected.powershellPath)) {
         problems.push("task action does not run the expected Windows PowerShell");
     }
-    if (actionArguments !== expectedActionArguments) {
-        problems.push("task action arguments do not exactly run the Cockpit sync script");
+    const actionArgumentProblem = windowsActionArgumentProblem(actionArguments, expectedArgumentFlags, expected.scriptPath);
+    if (actionArgumentProblem) {
+        problems.push(actionArgumentProblem);
     }
     if (/<Duration>/iu.test(repetition)) {
         problems.push("repetition has a finite duration");
@@ -489,6 +524,38 @@ function windowsPowerShellPath(env = process.env) {
     const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
     return path.win32.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
 }
+/**
+ * Task Scheduler stores a normalized form of the action it was given, not the
+ * string we passed: `schtasks /Create /TR "<powershell> <args>"` is split into
+ * <Command> plus <Arguments>, and the quotes around a space-free script path
+ * are dropped. Comparing <Arguments> against the exact string we built
+ * therefore fails on a task that is registered perfectly — observed on
+ * DESKTOP-G2UO1GK (CLI 0.2.13, 2026-08-12), where the stored value differed
+ * from the expected one only by those quotes.
+ *
+ * Compare the flags exactly, because those are ours, and compare the script as
+ * a path, because that is what Windows normalizes. Each failure returns its own
+ * reason so a repair message says which half is wrong rather than "arguments
+ * differ".
+ */
+function windowsActionArgumentProblem(actionArguments, expectedFlags, expectedScriptPath) {
+    if (!actionArguments.startsWith(expectedFlags)) {
+        return "task action does not run PowerShell with the expected Cockpit sync flags";
+    }
+    const scriptArgument = unquoteWindowsArgument(actionArguments.slice(expectedFlags.length));
+    if (!scriptArgument) {
+        return "task action names no sync script to run";
+    }
+    if (!sameWindowsPath(scriptArgument, expectedScriptPath)) {
+        return "task action runs a script other than the Cockpit sync script";
+    }
+    return null;
+}
+function unquoteWindowsArgument(value) {
+    const trimmed = value.trim();
+    const quoted = trimmed.match(/^"([\s\S]*)"$/u) ?? trimmed.match(/^'([\s\S]*)'$/u);
+    return (quoted?.[1] ?? trimmed).trim();
+}
 function sameWindowsPath(left, right) {
     if (!left || !right)
         return false;

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.13");
+    writeLine(io?.stdout ?? process.stdout, "0.2.14");
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "private": false,
   "type": "module",
   "bin": {