@getfootgun/keys 0.2.0-rc.1 → 0.2.0-rc.2

package/lib/schedule.d.mts

@@ -8,4 +8,5 @@ export function registerNativeHost(opts: {
   manifest: { name: string; [key: string]: unknown };
 }): Promise<void>;
 export function healthTaskXml(launcher: string, now?: Date): string;
-export function scheduleDaily(opts: { platform: string; exec: Exec; home: string; launcher: string; uid?: number; support?: string; now?: () => Date }): Promise<void>;
+export function scheduleDaily(opts: { platform: string; exec: Exec; home: string; launcher: string; uid?: number; support?: string; now?: () => Date }): Promise<{ when: "daily" } | { when: "signin"; reason: string }>;
+export function firstLine(e: unknown): string;

package/lib/schedule.mjs

@@ -6,6 +6,8 @@ import { launchdPlist } from "./launchd.mjs";
 const LABEL = "com.getfootgun.keys.health";
 const WIN_HOST_KEY = "HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts\\com.getfootgun.keys";
 const TASK = "Footgun Keys health";
+const WIN_RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+const WIN_RUN_VALUE = "FootgunKeysHealth";
 
 async function loadAgent(exec, uid, plist) {
   try {
@@ -79,19 +81,35 @@ export function healthTaskXml(launcher, now = new Date()) {
   ].join("\r\n");
 }
 
-// Daily 9:30 run of "<launcher> health". Throws if the OS scheduler refuses.
+// Daily 9:30 run of "<launcher> health". Resolves { when: "daily" }, or on a Windows PC that blocks
+// Task Scheduler { when: "signin", reason } after falling back to a per-user Run entry that checks
+// at each sign-in. Throws if neither works.
 export async function scheduleDaily({ platform, exec, home, launcher, uid, support, now = () => new Date() }) {
   if (platform === "win32") {
     // schtasks reads /XML files as UTF-16LE with a byte order mark.
     const xmlPath = win32.join(support, "health-task.xml");
     const body = Buffer.from(healthTaskXml(launcher, now()), "utf16le");
     await writePrivate(xmlPath, Buffer.concat([Buffer.from([0xff, 0xfe]), body]));
-    await exec("schtasks", ["/Create", "/F", "/TN", TASK, "/XML", xmlPath]);
-    return;
+    try {
+      await exec("schtasks", ["/Create", "/F", "/TN", TASK, "/XML", xmlPath]);
+    } catch (e) {
+      // Some PCs (security software, policy) refuse every new task, even for an administrator.
+      await exec("reg", ["add", WIN_RUN_KEY, "/v", WIN_RUN_VALUE, "/t", "REG_SZ", "/d", `conhost.exe --headless "${launcher}" health`, "/f"]).catch(() => { throw e; });
+      return { when: "signin", reason: firstLine(e) };
+    }
+    // A sign-in entry from an earlier blocked run would now double the checks.
+    await exec("reg", ["delete", WIN_RUN_KEY, "/v", WIN_RUN_VALUE, "/f"]).catch(() => {});
+    return { when: "daily" };
   }
   const agents = join(home, "Library", "LaunchAgents");
   await mkdir(agents, { recursive: true });
   const plist = join(agents, `${LABEL}.plist`);
   await writePrivate(plist, launchdPlist(launcher));
   await loadAgent(exec, uid, plist);
+  return { when: "daily" };
+}
+
+// The OS tool's own message (schtasks/launchctl stderr), which names no key.
+export function firstLine(e) {
+  return String(e?.stderr || (e instanceof Error ? e.message : "") || "").trim().split(/\r?\n/)[0];
 }

package/lib/setup.mjs

@@ -8,7 +8,7 @@ import { Writable } from "node:stream";
 import { promisify } from "node:util";
 import { EXTENSION_IDS } from "../shared/extension-ids.mjs";
 import { SITE, ensureSupportDir, writePrivate } from "./paths.mjs";
-import { registerNativeHost, scheduleDaily } from "./schedule.mjs";
+import { firstLine, registerNativeHost, scheduleDaily } from "./schedule.mjs";
 import { keychainStore } from "./vault.mjs";
 import { WIN_NOTIFY_SCRIPT } from "./platform.mjs";
 import { makeServer } from "./server.mjs";
@@ -134,11 +134,18 @@ export async function setup({ home, platform, prompt, exec, installApp, server,
 
   let scheduled = true;
   try {
-    await scheduleDaily({ platform, exec, home, launcher, uid, support, now });
-    print("Scheduled the daily key check.");
-  } catch {
+    const result = await scheduleDaily({ platform, exec, home, launcher, uid, support, now });
+    if (result?.when === "signin") {
+      print(`Windows would not create a scheduled task on this PC${result.reason ? ` (${result.reason})` : ""}.`);
+      print("Footgun will check your keys each time you sign in to Windows instead.");
+    } else {
+      print("Scheduled the daily key check.");
+    }
+  } catch (e) {
     scheduled = false;
     print("Could not schedule the daily key check. Run setup again to retry.");
+    const reason = firstLine(e);
+    if (reason) print(`The scheduler said: ${reason}`);
   }
   // A failed schedule must not end in apparent success, so it is repeated last and fails the run.
   const finish = (code) => {

package/package.json

@@ -1 +1 @@
-{ "name": "@getfootgun/keys", "version": "0.2.0-rc.1", "description": "Footgun Keys: guided API key setup that saves keys to the Mac Keychain or Windows Credential Manager.", "bin": { "footgun-keys": "bin/footgun-keys.mjs" }, "type": "module", "license": "MIT", "files": ["bin", "lib", "shared", "README.md"], "dependencies": { "@modelcontextprotocol/server": "2.3.1", "@napi-rs/keyring": "2.1.2", "zod": "4.6.7" }, "engines": { "node": ">=20" } }
+{ "name": "@getfootgun/keys", "version": "0.2.0-rc.2", "description": "Footgun Keys: guided API key setup that saves keys to the Mac Keychain or Windows Credential Manager.", "bin": { "footgun-keys": "bin/footgun-keys.mjs" }, "type": "module", "license": "MIT", "files": ["bin", "lib", "shared", "README.md"], "dependencies": { "@modelcontextprotocol/server": "2.3.1", "@napi-rs/keyring": "2.1.2", "zod": "4.6.7" }, "engines": { "node": ">=20" } }