@indigoai-us/hq-cli 5.345.177 → 5.345.179

package/dist/lib/bot/run.d.ts

@@ -134,6 +134,21 @@ export interface BotRunDeps {
     inboxPollBackoffEnabled?: () => Promise<boolean>;
     /** Default-off gate for the per-job quiet-success option. */
     jobQuietOptionEnabled?: () => boolean | Promise<boolean>;
+    /**
+     * The built-in hot-signal-sync job (jobs/hot-signal-sync.ts), run in-process
+     * with no model turn. Unset = a fired run of that job fails with a plain
+     * report instead of handing the instruction to the model.
+     */
+    hotSignalSync?: (input: {
+        company: string;
+        catchUp: boolean;
+        now: () => Date;
+        /** The signals-failure alert to the owner, sent even when the job is quiet (US-012). */
+        sendAlert: (text: string) => Promise<void>;
+    }) => Promise<{
+        ok: boolean;
+        text: string;
+    }>;
     heartbeatIntervalMs?: number;
     /** Override the rendered system prompt (tests). */
     systemPromptOverride?: string;

package/dist/lib/bot/run.js

@@ -82,6 +82,7 @@ import { isAgentSender, isDmItem, isMetaNonReply, resolveReplyTarget } from "./r
 import { resolveRoomMentionsForBot, roomPostHasMentionTokens, } from "./room-mentions.js";
 import { buildJobTurnPrompt, isCatchUpRun, isJobItem, jobReportHeader, jobRunOutput, machineTimeZone, planJobRuns, stripJobHeader, SUPERSEDED_DISPOSITION } from "./job-run.js";
 import { botJobQuietOptionEnabled } from "./job-quiet-flag.js";
+import { currentHotSignalSyncCompany, hotSignalSyncJobCompany, removeStaleHotSignalSyncJobs } from "./jobs/hot-signal-sync.js";
 import { clearPendingJobCompletion, isCompletionDue, isCompletionExpired, isCompletionForOtherAgent, readPendingJobCompletions, recordPendingJobCompletion } from "./job-completions.js";
 import { SIGN_IN_CHECK_FRESH_MS, SIGN_IN_CHECK_MS, SIGN_IN_RETRY_MS, signInNeededText, signedOutExcerpt, } from "./runtime-sign-in.js";
 import { checkRuntimeSignIn } from "./runtime-sign-in-check.js";
@@ -1932,6 +1933,66 @@ export async function runBot(deps) {
         const markReported = (status) => {
             patchInflight(dir, id, { jobCompleted: status });
         };
+        // The built-in hot-signal-sync job runs here, in the bot, with no model
+        // turn. It is marked processed as soon as the sync finishes, so a report
+        // that fails to post (or a redelivered item) never syncs a second time.
+        const syncCompany = hotSignalSyncJobCompany(job.context);
+        if (syncCompany) {
+            // The job's stored company is checked against the bot's current config
+            // (read fresh from disk) every time it fires. A company the bot no longer
+            // serves is never synced: the run is skipped and the job removed.
+            const currentCompany = currentHotSignalSyncCompany(readBotConfig(dir) ?? config);
+            if (currentCompany !== syncCompany) {
+                let removedNote = "";
+                try {
+                    removeStaleHotSignalSyncJobs(dir, currentCompany);
+                    removedNote = ` Removed job ${jobId}.`;
+                }
+                catch (err) {
+                    removedNote = ` Could not remove job ${jobId}: ${err instanceof Error ? err.message : String(err)}`;
+                }
+                const text = `Skipped the hot-channel sync for ${syncCompany}: this bot no longer syncs that company (current: ${currentCompany ?? "none"}). Nothing was written.${removedNote}`;
+                markProcessed(dir, id, now().toISOString());
+                try {
+                    await sendToPerson(text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                await completeJobRun(jobId, id, { status: "skipped-precondition", output: jobRunOutput(text) });
+                markReported("skipped-precondition");
+                await api.ackInbox(config.agentUid, id);
+                clearInflight(dir, id);
+                attempts.delete(id);
+                setStatus({ lastActivityAt: now().toISOString() });
+                log("info", `hot-signal-sync job ${jobId} run ${id} skipped: company ${syncCompany} no longer served (current: ${currentCompany ?? "none"})`);
+                return;
+            }
+            const result = deps.hotSignalSync
+                ? await deps.hotSignalSync({ company: syncCompany, catchUp, now, sendAlert: (text) => sendToPerson(text) })
+                : { ok: false, text: `This bot cannot run the hot-channel sync for ${syncCompany}.` };
+            markProcessed(dir, id, now().toISOString());
+            const status = result.ok ? "succeeded" : "failed";
+            if (!(quietJob && result.ok)) {
+                try {
+                    await sendToPerson(result.text);
+                }
+                catch (err) {
+                    log("warn", `report for run ${id} of job ${jobId} was not delivered: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            await completeJobRun(jobId, id, { status, output: jobRunOutput(result.text) });
+            markReported(status);
+            await api.ackInbox(config.agentUid, id);
+            clearInflight(dir, id);
+            attempts.delete(id);
+            setStatus({
+                ...(!(quietJob && result.ok) ? { repliesSent: (readStatus()?.repliesSent ?? 0) + 1 } : {}),
+                lastActivityAt: now().toISOString(),
+            });
+            log("info", `hot-signal-sync job ${jobId} run ${id} ${status} for ${syncCompany}${catchUp ? " (catch-up)" : ""}`);
+            return;
+        }
         const { outcome, poster } = await runTurnWithProgress({
             marker: { messageId: id, target: markerTarget, jobId, jobHeader: header, agentUid: config.agentUid },
             prompt: buildJobTurnPrompt(job, { now: now(), timeZone }),

package/dist/lib/daemon/catalog.d.ts

@@ -21,6 +21,8 @@ export declare function isServiceName(value: unknown): value is ServiceName;
 export declare const SERVICE_DESCRIPTIONS: Record<ServiceName, string>;
 /** The services each machine type runs without being asked. */
 export declare const DEFAULT_SERVICES: Record<MachineType, readonly ServiceName[]>;
+/** Services another enabled service turns on; only an explicit disable keeps them off. */
+export declare const IMPLIED_SERVICES: Partial<Record<ServiceName, ServiceName>>;
 /** Defaults plus this host's overrides, in catalog order. Unknown names are ignored. */
 export declare function enabledServices(machineType: MachineType, overrides: {
     enable: readonly string[];

package/dist/lib/daemon/catalog.js

@@ -80,12 +80,17 @@ export const DEFAULT_SERVICES = {
     "agent-box": ["mesh", "heartbeat", "inbox", "search-index", "updater", "housekeeping"],
     "agent-kit": ["heartbeat", "inbox", "updater", "housekeeping"],
 };
+/** Services another enabled service turns on; only an explicit disable keeps them off. */
+export const IMPLIED_SERVICES = { mesh: "sync-core" };
 /** Defaults plus this host's overrides, in catalog order. Unknown names are ignored. */
 export function enabledServices(machineType, overrides) {
     const defaults = DEFAULT_SERVICES[machineType];
     const wanted = (s) => (defaults.includes(s) || overrides.enable.includes(s)) && !overrides.disable.includes(s);
-    const wakeSubscriber = wanted("sync-core") && !overrides.disable.includes("mesh");
-    return SERVICE_NAMES.filter((s) => wanted(s) || (s === "mesh" && wakeSubscriber));
+    const implied = (s) => {
+        const by = IMPLIED_SERVICES[s];
+        return by !== undefined && wanted(by) && !overrides.disable.includes(s);
+    };
+    return SERVICE_NAMES.filter((s) => wanted(s) || implied(s));
 }
 export const SYNC_CORE_RECONCILE_UNIT = "sync-core";
 export const SYNC_CORE_RECONCILE_INTERVAL_SEC = 600;

package/dist/lib/daemon/config.d.ts

@@ -29,7 +29,8 @@ export declare function readDaemonConfig(file: string): DaemonConfig;
 export declare function writeDaemonConfig(file: string, config: DaemonConfig): void;
 /**
  * Turn services on or off for this host, relative to the machine type's
- * defaults: only differences from the defaults are stored.
+ * defaults: only differences from the defaults are stored. A disable is also
+ * stored for a service another service can turn on, so it stays off.
  */
 export declare function applyServiceToggle(config: DaemonConfig, action: "enable" | "disable", services: readonly string[], defaults: readonly ServiceName[]): DaemonConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/lib/daemon/config.js

@@ -7,7 +7,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { valid as validSemver } from "semver";
-import { isServiceName } from "./catalog.js";
+import { IMPLIED_SERVICES, isServiceName } from "./catalog.js";
 import { isMachineType } from "./machine-type.js";
 import { ensurePrivateDir } from "./paths.js";
 export function effectiveSyncOwner(config, machineType) {
@@ -81,7 +81,8 @@ export function writeDaemonConfig(file, config) {
 }
 /**
  * Turn services on or off for this host, relative to the machine type's
- * defaults: only differences from the defaults are stored.
+ * defaults: only differences from the defaults are stored. A disable is also
+ * stored for a service another service can turn on, so it stays off.
  */
 export function applyServiceToggle(config, action, services, defaults) {
     for (const s of services) {
@@ -99,7 +100,7 @@ export function applyServiceToggle(config, action, services, defaults) {
         }
         else {
             enable.delete(s);
-            if (isDefault)
+            if (isDefault || (isServiceName(s) && IMPLIED_SERVICES[s] !== undefined))
                 disable.add(s);
         }
     }

package/dist/lib/daemon/handoff.d.ts

@@ -32,7 +32,11 @@ export interface DaemonUnitHost {
     platform: NodeJS.Platform;
     home: string;
     systemUnitDir?: string;
+    /** This user's own Scheduled Task name (daemonWindowsTaskName); another user's task on the PC does not count. */
+    windowsTaskName: string;
     windowsTaskExists: (task: string) => boolean;
+    /** The shared task an older install registered runs as this user (it still counts until install moves it). */
+    windowsLegacyTaskIsMine?: () => boolean;
 }
 /** The `hq daemon` OS unit is installed on this machine (for this user, or as the box's system unit). */
 export declare function daemonUnitInstalled(host: DaemonUnitHost): boolean;

package/dist/lib/daemon/handoff.js

@@ -10,7 +10,8 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SERVICES, enabledServices, isServiceName } from "./catalog.js";
 import { readDaemonConfig, writeDaemonConfig } from "./config.js";
-import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from "./install.js";
+import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, SYSTEM_UNIT_DIR, currentWindowsIdentity, legacyWindowsTask, windowsTaskName } from "./install.js";
+import { defaultRunCommand } from "../service-manager/launchd.js";
 import { isDaemonProcess, runningDaemonPid } from "./lock.js";
 import { detectMachineType } from "./machine-type.js";
 import { daemonPaths } from "./paths.js";
@@ -96,7 +97,7 @@ export function daemonUnitInstalled(host) {
         case "darwin":
             return fs.existsSync(path.join(host.home, "Library", "LaunchAgents", `${DAEMON_LAUNCHD_LABEL}.plist`));
         case "win32":
-            return host.windowsTaskExists(DAEMON_WINDOWS_TASK);
+            return host.windowsTaskExists(host.windowsTaskName) || (host.windowsLegacyTaskIsMine?.() ?? false);
         default:
             return (fs.existsSync(path.join(host.home, ".config", "systemd", "user", DAEMON_SYSTEMD_UNIT)) ||
                 fs.existsSync(path.join(host.systemUnitDir ?? SYSTEM_UNIT_DIR, DAEMON_SYSTEMD_UNIT)));
@@ -142,9 +143,12 @@ export function handOffInstallHere(services, env = process.env, opts = {}) {
     if (opts.ifStale && services.every((service) => config.disable.includes(service))) {
         return `hq daemon has ${services.join(", ")} disabled, so the older service will not be installed.`;
     }
+    const identity = process.platform === "win32" ? currentWindowsIdentity() : undefined;
     const installed = daemonUnitInstalled({
         platform: process.platform,
         home,
+        windowsTaskName: identity ? windowsTaskName(identity) : "",
+        windowsLegacyTaskIsMine: () => identity !== undefined && legacyWindowsTask(defaultRunCommand, identity).state === "mine",
         windowsTaskExists: (task) => spawnSync("schtasks.exe", ["/Query", "/TN", task], { encoding: "utf8", windowsHide: true }).status === 0,
     }) || hostedDaemonRunning(paths);
     if (!installed) {

package/dist/lib/daemon/install.d.ts

@@ -7,7 +7,7 @@
  * - Linux, per-user: systemd user unit hq-daemon.service
  * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
  *   running as the box's login user; needs root
- * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
+ * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon-<user SID>
  * - anything else: no unit; the caller prints the command to run
  *
  * The unit never names services. `hq daemon run` reads the machine type and
@@ -20,8 +20,34 @@ import { type PidLockRecord } from "../mesh/live/daemon/pid-lock.js";
 import type { MachineType } from "./machine-type.js";
 export declare const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
 export declare const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
-export declare const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
+/**
+ * The one machine-wide task name older installs registered on Windows. Two
+ * users on one PC overwrote each other's daemon under it, so each user now
+ * gets their own name (daemonWindowsTaskName). Install moves the current
+ * user's task off this name; another user's task under it is left alone.
+ */
+export declare const LEGACY_DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
 export declare const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+/**
+ * The Windows task name for one user: the shared prefix plus the user's SID,
+ * or the `DOMAIN\user` name with characters a task name cannot hold replaced
+ * when the SID could not be read. Never the bare legacy name.
+ */
+export declare function daemonWindowsTaskName(who: {
+    sid?: string;
+    user: string;
+}): string;
+/** The current Windows user's SID from `whoami /user`, or undefined when it cannot be read. */
+export declare function readWindowsSid(run: RunCommand): string | undefined;
+/** The per-user task name for the user running this process. */
+export declare function currentDaemonWindowsTaskName(run: RunCommand, user: string): string;
+/**
+ * `DOMAIN\user` for the current account. Same answer as the mesh installer's
+ * resolveWindowsUser, kept here so lookups do not load the mesh installer.
+ */
+export declare function currentWindowsUser(env?: NodeJS.ProcessEnv): string;
+/** The current user as a DaemonHost names them on Windows. */
+export declare function currentWindowsIdentity(run?: RunCommand, env?: NodeJS.ProcessEnv): Pick<DaemonHost, "windowsSid" | "windowsUser">;
 export type InstallScope = "user" | "system";
 export interface DaemonHost {
     platform: NodeJS.Platform;
@@ -34,6 +60,8 @@ export interface DaemonHost {
     isRoot: boolean;
     /** `DOMAIN\user` the Windows task runs as. */
     windowsUser: string;
+    /** That user's SID, when `whoami /user` could read it. Names the per-user task. */
+    windowsSid?: string;
     /** conhost.exe path when `--headless` is supported, else undefined. */
     windowsHeadlessLauncher: string | undefined;
     /** Where system units are written (tests point this at a temp dir). */
@@ -70,6 +98,8 @@ export interface DaemonUnitResult {
     startPending?: true;
     /** Windows: an older daemon may still be running; HQ could not verify it, so did not stop it. */
     warning?: string;
+    /** Windows: what happened to the shared task from an older install, when there is one. */
+    notice?: string;
 }
 export interface InstallDeps {
     run: RunCommand;
@@ -93,6 +123,43 @@ export declare function daemonRootRefusal(isRoot: boolean, machineType: MachineT
 /** Boxes run the daemon as a system unit; everything else per user. */
 export declare function installScopeFor(machineType: MachineType): InstallScope;
 export declare function planDaemonUnit(host: DaemonHost, options: InstallOptions): DaemonUnitPlan;
+/**
+ * The registered per-user task names for `host`: the current name, and the
+ * user-name form an install used when it could not read the SID. The fallback
+ * name is only returned when its principal is this user.
+ */
+export declare function windowsUserTaskNames(run: RunCommand, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): string[];
+/** The per-user task name for `host`. */
+export declare function windowsTaskName(host: Pick<DaemonHost, "windowsSid" | "windowsUser">): string;
+/**
+ * Whether two Windows account names are the same user, ignoring case. Both
+ * names must have the same form: `DOMAIN\user` matches only the same
+ * `DOMAIN\user`, and a bare `user` only the same bare `user`. A bare name is
+ * never matched against a domain name, because `bob` could be `PC\bob` or
+ * `CORP\bob`, and a wrong match would end and delete another user's task.
+ */
+export declare function sameWindowsUser(a: string, b: string): boolean;
+/**
+ * The shared task an older install registered, and whose it is. "mine" means
+ * its principal is the current user, so HQ may move it. "other" means another
+ * user's, or a principal HQ cannot match to the current user; "unreadable"
+ * means schtasks refused to show it. Both are left alone.
+ */
+export type LegacyWindowsTask = {
+    state: "none";
+} | {
+    state: "mine";
+    owner: string;
+} | {
+    state: "other";
+    owner: string;
+} | {
+    state: "unreadable";
+    reason: string;
+};
+export declare function legacyWindowsTask(run: RunCommand, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): LegacyWindowsTask;
+/** Whose task `task` is, read from `schtasks /Query /XML`. */
+export declare function classifyWindowsTask(run: RunCommand, task: string, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): LegacyWindowsTask;
 /** What to tell the user when HQ did not stop pid `pid` because it could not verify it. */
 export declare function oldDaemonWarning(pid: number, reason: string): string;
 export declare function installDaemonUnit(host: DaemonHost, options: InstallOptions, deps: InstallDeps): DaemonUnitResult;
@@ -127,5 +194,6 @@ export declare function uninstallDaemonUnit(host: DaemonHost, options: InstallOp
     unitPath: string;
     removed: boolean;
     warning?: string;
+    notice?: string;
 };
 //# sourceMappingURL=install.d.ts.map

package/dist/lib/daemon/install.js

@@ -7,7 +7,7 @@
  * - Linux, per-user: systemd user unit hq-daemon.service
  * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
  *   running as the box's login user; needs root
- * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
+ * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon-<user SID>
  * - anything else: no unit; the caller prints the command to run
  *
  * The unit never names services. `hq daemon run` reads the machine type and
@@ -16,6 +16,7 @@
  * never touch launchctl, systemctl or schtasks.
  */
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { activateLaunchd, blockingSleep, deactivateLaunchd, defaultRunCommand, installLaunchdPlist, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
 import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdUnitPath, } from "../service-manager/systemd.js";
@@ -26,8 +27,58 @@ import { liveDaemonLock, verifyDaemonForKill } from "./lock.js";
 import { daemonPaths } from "./paths.js";
 export const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
 export const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
-export const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
+/**
+ * The one machine-wide task name older installs registered on Windows. Two
+ * users on one PC overwrote each other's daemon under it, so each user now
+ * gets their own name (daemonWindowsTaskName). Install moves the current
+ * user's task off this name; another user's task under it is left alone.
+ */
+export const LEGACY_DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
 export const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+/**
+ * The Windows task name for one user: the shared prefix plus the user's SID,
+ * or the `DOMAIN\user` name with characters a task name cannot hold replaced
+ * when the SID could not be read. Never the bare legacy name.
+ */
+export function daemonWindowsTaskName(who) {
+    const sid = who.sid?.trim();
+    if (sid)
+        return `${LEGACY_DAEMON_WINDOWS_TASK}-${sid}`;
+    const user = who.user.trim().replace(/[^A-Za-z0-9_.-]/g, "_");
+    return `${LEGACY_DAEMON_WINDOWS_TASK}-${user || "user"}`;
+}
+/** The current Windows user's SID from `whoami /user`, or undefined when it cannot be read. */
+export function readWindowsSid(run) {
+    const r = run("whoami.exe", ["/user", "/FO", "CSV", "/NH"]);
+    if (r.status !== 0)
+        return undefined;
+    return /S-1-\d+(?:-\d+)+/.exec(r.stdout)?.[0];
+}
+/** The per-user task name for the user running this process. */
+export function currentDaemonWindowsTaskName(run, user) {
+    return daemonWindowsTaskName({ sid: readWindowsSid(run), user });
+}
+/**
+ * `DOMAIN\user` for the current account. Same answer as the mesh installer's
+ * resolveWindowsUser, kept here so lookups do not load the mesh installer.
+ */
+export function currentWindowsUser(env = process.env) {
+    let user = env.USERNAME?.trim() ?? "";
+    if (!user) {
+        try {
+            user = os.userInfo().username;
+        }
+        catch {
+            user = "";
+        }
+    }
+    const domain = env.USERDOMAIN?.trim();
+    return domain ? `${domain}\\${user}` : user;
+}
+/** The current user as a DaemonHost names them on Windows. */
+export function currentWindowsIdentity(run = defaultRunCommand, env = process.env) {
+    return { windowsUser: currentWindowsUser(env), windowsSid: readWindowsSid(run) };
+}
 /** How long install waits for the Windows task to start a daemon process. */
 export const WINDOWS_START_WAIT_MS = 10_000;
 const WINDOWS_START_POLL_MS = 500;
@@ -128,7 +179,7 @@ function renderWindowsTaskXml(host) {
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
-    <URI>\\${DAEMON_WINDOWS_TASK}</URI>
+    <URI>\\${windowsTaskName(host)}</URI>
     <Description>HQ daemon: runs this machine's HQ background services</Description>
   </RegistrationInfo>
   <Triggers>
@@ -204,7 +255,7 @@ export function planDaemonUnit(host, options) {
     if (host.platform === "win32") {
         return {
             kind: "schtasks",
-            unitPath: path.join(host.daemonDir, `${DAEMON_WINDOWS_TASK}.xml`),
+            unitPath: path.join(host.daemonDir, `${LEGACY_DAEMON_WINDOWS_TASK}.xml`),
             rendered: renderWindowsTaskXml(host),
         };
     }
@@ -224,8 +275,9 @@ function commandError(what, r) {
  * immediately before the kill and killed only when it is verifiably the
  * daemon. Returns a warning when a process was left running unverified.
  */
-function endWindowsDaemon(run, owner) {
-    run("schtasks.exe", ["/End", "/TN", DAEMON_WINDOWS_TASK]);
+function endWindowsDaemon(run, owner, tasks) {
+    for (const task of tasks)
+        run("schtasks.exe", ["/End", "/TN", task]);
     if (!owner || owner.pid === process.pid)
         return undefined;
     const check = verifyDaemonForKill(owner, run);
@@ -237,6 +289,79 @@ function endWindowsDaemon(run, owner) {
         return undefined;
     return oldDaemonWarning(owner.pid, check.reason);
 }
+/**
+ * The registered per-user task names for `host`: the current name, and the
+ * user-name form an install used when it could not read the SID. The fallback
+ * name is only returned when its principal is this user.
+ */
+export function windowsUserTaskNames(run, host) {
+    const names = [];
+    const current = windowsTaskName(host);
+    if (run("schtasks.exe", ["/Query", "/TN", current]).status === 0)
+        names.push(current);
+    const byUser = daemonWindowsTaskName({ user: host.windowsUser });
+    if (byUser !== current && classifyWindowsTask(run, byUser, host).state === "mine")
+        names.push(byUser);
+    return names;
+}
+/** The per-user task name for `host`. */
+export function windowsTaskName(host) {
+    return daemonWindowsTaskName({ sid: host.windowsSid, user: host.windowsUser });
+}
+/**
+ * Whether two Windows account names are the same user, ignoring case. Both
+ * names must have the same form: `DOMAIN\user` matches only the same
+ * `DOMAIN\user`, and a bare `user` only the same bare `user`. A bare name is
+ * never matched against a domain name, because `bob` could be `PC\bob` or
+ * `CORP\bob`, and a wrong match would end and delete another user's task.
+ */
+export function sameWindowsUser(a, b) {
+    const left = a.trim().toLowerCase();
+    const right = b.trim().toLowerCase();
+    const leftBare = (left.split("\\").pop() ?? "").trim();
+    const rightBare = (right.split("\\").pop() ?? "").trim();
+    if (!leftBare || !rightBare)
+        return false;
+    if (left.includes("\\") !== right.includes("\\"))
+        return false;
+    return left === right;
+}
+/** The principal a task XML runs as. */
+function windowsTaskPrincipal(xml) {
+    return /<Principal\b[^>]*>[\s\S]*?<UserId>([^<]*)<\/UserId>/.exec(xml)?.[1]?.trim() || undefined;
+}
+export function legacyWindowsTask(run, host) {
+    return classifyWindowsTask(run, LEGACY_DAEMON_WINDOWS_TASK, host);
+}
+/** Whose task `task` is, read from `schtasks /Query /XML`. */
+export function classifyWindowsTask(run, task, host) {
+    const r = run("schtasks.exe", ["/Query", "/TN", task, "/XML"]);
+    if (r.status !== 0) {
+        const reason = (r.stderr.trim() || r.stdout.trim()).replace(/\0/g, "");
+        return /access is denied/i.test(reason) ? { state: "unreadable", reason } : { state: "none" };
+    }
+    const owner = windowsTaskPrincipal(r.stdout.replace(/\0/g, ""));
+    if (!owner)
+        return { state: "unreadable", reason: "the task does not name the user it runs as" };
+    if (/^S-1-/i.test(owner)) {
+        const sid = host.windowsSid?.trim();
+        return sid && sid.toLowerCase() === owner.toLowerCase() ? { state: "mine", owner } : { state: "other", owner };
+    }
+    return sameWindowsUser(owner, host.windowsUser) ? { state: "mine", owner } : { state: "other", owner };
+}
+const REMOVE_LEGACY_TASK = `schtasks /Delete /TN ${LEGACY_DAEMON_WINDOWS_TASK} /F`;
+/** What to tell the user about a shared task HQ left alone, or undefined when there is none. */
+function legacyLeftNotice(legacy) {
+    if (legacy.state === "other") {
+        return (`Another Windows user's HQ daemon task (\\${LEGACY_DAEMON_WINDOWS_TASK}, run as ${legacy.owner}) was left untouched. ` +
+            `If it is in fact yours, remove it with: ${REMOVE_LEGACY_TASK}`);
+    }
+    if (legacy.state === "unreadable") {
+        return (`The shared HQ daemon task \\${LEGACY_DAEMON_WINDOWS_TASK} from an older install was left untouched because HQ could not read it (${legacy.reason}). ` +
+            `It may belong to another Windows user. If it is yours, remove it with: ${REMOVE_LEGACY_TASK}`);
+    }
+    return undefined;
+}
 /** What to tell the user when HQ did not stop pid `pid` because it could not verify it. */
 export function oldDaemonWarning(pid, reason) {
     return [
@@ -250,10 +375,10 @@ function activate(plan, host, run, sleep, previous = null) {
     switch (plan.kind) {
         case "launchd":
             activateLaunchd(plan.unitPath, run, host.uid, { sleep });
-            return;
+            return {};
         case "systemd-user":
             activateSystemd(DAEMON_SYSTEMD_UNIT, run);
-            return;
+            return {};
         case "systemd-system": {
             const reload = run("systemctl", ["daemon-reload"]);
             if (reload.status !== 0)
@@ -262,23 +387,41 @@ function activate(plan, host, run, sleep, previous = null) {
             if (enable.status !== 0)
                 throw commandError(`systemctl enable --now ${DAEMON_SYSTEMD_UNIT}`, enable);
             run("systemctl", ["restart", DAEMON_SYSTEMD_UNIT]);
-            return;
+            return {};
         }
         case "schtasks": {
-            const create = run("schtasks.exe", ["/Create", "/TN", DAEMON_WINDOWS_TASK, "/XML", plan.unitPath, "/F"]);
+            const task = windowsTaskName(host);
+            // Older installs registered one task name for the whole machine. Read
+            // whose it is before registering this user's own task.
+            const legacy = legacyWindowsTask(run, host);
+            const create = run("schtasks.exe", ["/Create", "/TN", task, "/XML", plan.unitPath, "/F"]);
             if (create.status !== 0)
                 throw commandError("schtasks /Create", create);
+            const warnings = [];
+            let notice = legacyLeftNotice(legacy);
+            if (legacy.state === "mine") {
+                // Only the current user's shared task is moved; another user's is never ended or deleted.
+                run("schtasks.exe", ["/End", "/TN", LEGACY_DAEMON_WINDOWS_TASK]);
+                const del = run("schtasks.exe", ["/Delete", "/TN", LEGACY_DAEMON_WINDOWS_TASK, "/F"]);
+                if (del.status !== 0) {
+                    warnings.push(`Could not remove the shared task \\${LEGACY_DAEMON_WINDOWS_TASK}: ${(del.stderr.trim() || del.stdout.trim() || `exit ${del.status}`).replace(/\0/g, "")}. ` +
+                        `Remove it with: ${REMOVE_LEGACY_TASK}`);
+                }
+                notice = `Moved your HQ daemon from the shared task \\${LEGACY_DAEMON_WINDOWS_TASK} to \\${task}.`;
+            }
             // `/Create /F` leaves a running instance alone and `/Run` is ignored
             // while one runs, so a daemon from an earlier install would keep the old
             // settings. Stop it first so `/Run` starts a new one.
-            const warning = previous ? endWindowsDaemon(run, previous) : undefined;
-            const start = run("schtasks.exe", ["/Run", "/TN", DAEMON_WINDOWS_TASK]);
+            const old = previous ? endWindowsDaemon(run, previous, [task]) : undefined;
+            if (old)
+                warnings.push(old);
+            const start = run("schtasks.exe", ["/Run", "/TN", task]);
             if (start.status !== 0)
                 throw commandError("schtasks /Run", start);
-            return warning;
+            return { ...(warnings.length ? { warning: warnings.join("\n") } : {}), ...(notice ? { notice } : {}) };
         }
         case "manual":
-            return undefined;
+            return {};
     }
 }
 export function installDaemonUnit(host, options, deps) {
@@ -330,8 +473,7 @@ export function installDaemonUnit(host, options, deps) {
         const lockPath = daemonPaths(host.home, { HQ_DAEMON_DIR: host.daemonDir }).lockPath;
         const runningDaemon = deps.runningDaemon ?? (() => liveDaemonLock(lockPath));
         const previous = plan.kind === "schtasks" ? runningDaemon() : null;
-        const warning = plan.kind !== "launchd" ? activate(plan, host, deps.run, deps.sleep, previous) : undefined;
-        const warn = warning ? { warning } : {};
+        const warn = plan.kind !== "launchd" ? activate(plan, host, deps.run, deps.sleep, previous) : {};
         if (plan.kind === "schtasks") {
             // schtasks /Run exits 0 even when the task cannot run: an
             // InteractiveToken task with no signed-in session stays at "has not yet
@@ -478,11 +620,22 @@ export function uninstallDaemonUnit(host, options, deps) {
         : planDaemonUnit(host, options);
     if (plan.kind === "manual")
         return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
-    // A registered task is removed even when its XML file has gone missing.
-    const present = fs.existsSync(plan.unitPath) ||
-        (plan.kind === "schtasks" && deps.run("schtasks.exe", ["/Query", "/TN", DAEMON_WINDOWS_TASK]).status === 0);
-    if (!present)
-        return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
+    // On Windows the XML file is shared with older installs, so it does not show
+    // that this user's per-user task exists. Ask schtasks for each name this
+    // user's task may have: the SID name, and the user-name form used when the
+    // SID could not be read at install time.
+    const userTasks = plan.kind === "schtasks" ? windowsUserTaskNames(deps.run, host) : [];
+    const present = plan.kind === "schtasks" ? userTasks.length > 0 : fs.existsSync(plan.unitPath);
+    // The current user's shared task from an older install goes too; another user's stays.
+    const legacy = plan.kind === "schtasks" ? legacyWindowsTask(deps.run, host) : { state: "none" };
+    const notice = legacyLeftNotice(legacy);
+    const noted = notice ? { notice } : {};
+    if (!present && legacy.state !== "mine") {
+        // A task XML left by an older install with no task behind it is stale.
+        if (plan.kind === "schtasks")
+            fs.rmSync(plan.unitPath, { force: true });
+        return { kind: plan.kind, unitPath: plan.unitPath, removed: false, ...noted };
+    }
     let warning;
     switch (plan.kind) {
         case "launchd":
@@ -503,15 +656,20 @@ export function uninstallDaemonUnit(host, options, deps) {
         }
         case "schtasks": {
             // The lock may be stale; endWindowsDaemon kills only a verified daemon.
-            warning = endWindowsDaemon(deps.run, readPidLock(path.join(host.daemonDir, "daemon.pid")));
-            const del = deps.run("schtasks.exe", ["/Delete", "/TN", DAEMON_WINDOWS_TASK, "/F"]);
-            // Keep the XML so a later uninstall still finds the task.
-            if (del.status !== 0)
-                throw commandError(`schtasks /Delete /TN ${DAEMON_WINDOWS_TASK}`, del);
+            const tasks = [...(legacy.state === "mine" ? [LEGACY_DAEMON_WINDOWS_TASK] : []), ...userTasks];
+            warning = endWindowsDaemon(deps.run, readPidLock(path.join(host.daemonDir, "daemon.pid")), tasks);
+            for (const name of tasks) {
+                const del = deps.run("schtasks.exe", ["/Delete", "/TN", name, "/F"]);
+                // A task that is already gone counts as removed. Otherwise keep the
+                // XML so a later uninstall still finds the task.
+                if (del.status !== 0 && deps.run("schtasks.exe", ["/Query", "/TN", name]).status === 0) {
+                    throw commandError(`schtasks /Delete /TN ${name}`, del);
+                }
+            }
             break;
         }
     }
     fs.rmSync(plan.unitPath, { force: true });
-    return { kind: plan.kind, unitPath: plan.unitPath, removed: true, ...(warning ? { warning } : {}) };
+    return { kind: plan.kind, unitPath: plan.unitPath, removed: true, ...(warning ? { warning } : {}), ...noted };
 }
 //# sourceMappingURL=install.js.map