@indigoai-us/hq-cli 5.345.178 → 5.345.179

package/dist/lib/daemon/install.js

@@ -7,7 +7,7 @@
  * - Linux, per-user: systemd user unit hq-daemon.service
  * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
  *   running as the box's login user; needs root
- * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
+ * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon-<user SID>
  * - anything else: no unit; the caller prints the command to run
  *
  * The unit never names services. `hq daemon run` reads the machine type and
@@ -16,6 +16,7 @@
  * never touch launchctl, systemctl or schtasks.
  */
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { activateLaunchd, blockingSleep, deactivateLaunchd, defaultRunCommand, installLaunchdPlist, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
 import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdUnitPath, } from "../service-manager/systemd.js";
@@ -26,8 +27,58 @@ import { liveDaemonLock, verifyDaemonForKill } from "./lock.js";
 import { daemonPaths } from "./paths.js";
 export const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
 export const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
-export const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
+/**
+ * The one machine-wide task name older installs registered on Windows. Two
+ * users on one PC overwrote each other's daemon under it, so each user now
+ * gets their own name (daemonWindowsTaskName). Install moves the current
+ * user's task off this name; another user's task under it is left alone.
+ */
+export const LEGACY_DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
 export const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+/**
+ * The Windows task name for one user: the shared prefix plus the user's SID,
+ * or the `DOMAIN\user` name with characters a task name cannot hold replaced
+ * when the SID could not be read. Never the bare legacy name.
+ */
+export function daemonWindowsTaskName(who) {
+    const sid = who.sid?.trim();
+    if (sid)
+        return `${LEGACY_DAEMON_WINDOWS_TASK}-${sid}`;
+    const user = who.user.trim().replace(/[^A-Za-z0-9_.-]/g, "_");
+    return `${LEGACY_DAEMON_WINDOWS_TASK}-${user || "user"}`;
+}
+/** The current Windows user's SID from `whoami /user`, or undefined when it cannot be read. */
+export function readWindowsSid(run) {
+    const r = run("whoami.exe", ["/user", "/FO", "CSV", "/NH"]);
+    if (r.status !== 0)
+        return undefined;
+    return /S-1-\d+(?:-\d+)+/.exec(r.stdout)?.[0];
+}
+/** The per-user task name for the user running this process. */
+export function currentDaemonWindowsTaskName(run, user) {
+    return daemonWindowsTaskName({ sid: readWindowsSid(run), user });
+}
+/**
+ * `DOMAIN\user` for the current account. Same answer as the mesh installer's
+ * resolveWindowsUser, kept here so lookups do not load the mesh installer.
+ */
+export function currentWindowsUser(env = process.env) {
+    let user = env.USERNAME?.trim() ?? "";
+    if (!user) {
+        try {
+            user = os.userInfo().username;
+        }
+        catch {
+            user = "";
+        }
+    }
+    const domain = env.USERDOMAIN?.trim();
+    return domain ? `${domain}\\${user}` : user;
+}
+/** The current user as a DaemonHost names them on Windows. */
+export function currentWindowsIdentity(run = defaultRunCommand, env = process.env) {
+    return { windowsUser: currentWindowsUser(env), windowsSid: readWindowsSid(run) };
+}
 /** How long install waits for the Windows task to start a daemon process. */
 export const WINDOWS_START_WAIT_MS = 10_000;
 const WINDOWS_START_POLL_MS = 500;
@@ -128,7 +179,7 @@ function renderWindowsTaskXml(host) {
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
-    <URI>\\${DAEMON_WINDOWS_TASK}</URI>
+    <URI>\\${windowsTaskName(host)}</URI>
     <Description>HQ daemon: runs this machine's HQ background services</Description>
   </RegistrationInfo>
   <Triggers>
@@ -204,7 +255,7 @@ export function planDaemonUnit(host, options) {
     if (host.platform === "win32") {
         return {
             kind: "schtasks",
-            unitPath: path.join(host.daemonDir, `${DAEMON_WINDOWS_TASK}.xml`),
+            unitPath: path.join(host.daemonDir, `${LEGACY_DAEMON_WINDOWS_TASK}.xml`),
             rendered: renderWindowsTaskXml(host),
         };
     }
@@ -224,8 +275,9 @@ function commandError(what, r) {
  * immediately before the kill and killed only when it is verifiably the
  * daemon. Returns a warning when a process was left running unverified.
  */
-function endWindowsDaemon(run, owner) {
-    run("schtasks.exe", ["/End", "/TN", DAEMON_WINDOWS_TASK]);
+function endWindowsDaemon(run, owner, tasks) {
+    for (const task of tasks)
+        run("schtasks.exe", ["/End", "/TN", task]);
     if (!owner || owner.pid === process.pid)
         return undefined;
     const check = verifyDaemonForKill(owner, run);
@@ -237,6 +289,79 @@ function endWindowsDaemon(run, owner) {
         return undefined;
     return oldDaemonWarning(owner.pid, check.reason);
 }
+/**
+ * The registered per-user task names for `host`: the current name, and the
+ * user-name form an install used when it could not read the SID. The fallback
+ * name is only returned when its principal is this user.
+ */
+export function windowsUserTaskNames(run, host) {
+    const names = [];
+    const current = windowsTaskName(host);
+    if (run("schtasks.exe", ["/Query", "/TN", current]).status === 0)
+        names.push(current);
+    const byUser = daemonWindowsTaskName({ user: host.windowsUser });
+    if (byUser !== current && classifyWindowsTask(run, byUser, host).state === "mine")
+        names.push(byUser);
+    return names;
+}
+/** The per-user task name for `host`. */
+export function windowsTaskName(host) {
+    return daemonWindowsTaskName({ sid: host.windowsSid, user: host.windowsUser });
+}
+/**
+ * Whether two Windows account names are the same user, ignoring case. Both
+ * names must have the same form: `DOMAIN\user` matches only the same
+ * `DOMAIN\user`, and a bare `user` only the same bare `user`. A bare name is
+ * never matched against a domain name, because `bob` could be `PC\bob` or
+ * `CORP\bob`, and a wrong match would end and delete another user's task.
+ */
+export function sameWindowsUser(a, b) {
+    const left = a.trim().toLowerCase();
+    const right = b.trim().toLowerCase();
+    const leftBare = (left.split("\\").pop() ?? "").trim();
+    const rightBare = (right.split("\\").pop() ?? "").trim();
+    if (!leftBare || !rightBare)
+        return false;
+    if (left.includes("\\") !== right.includes("\\"))
+        return false;
+    return left === right;
+}
+/** The principal a task XML runs as. */
+function windowsTaskPrincipal(xml) {
+    return /<Principal\b[^>]*>[\s\S]*?<UserId>([^<]*)<\/UserId>/.exec(xml)?.[1]?.trim() || undefined;
+}
+export function legacyWindowsTask(run, host) {
+    return classifyWindowsTask(run, LEGACY_DAEMON_WINDOWS_TASK, host);
+}
+/** Whose task `task` is, read from `schtasks /Query /XML`. */
+export function classifyWindowsTask(run, task, host) {
+    const r = run("schtasks.exe", ["/Query", "/TN", task, "/XML"]);
+    if (r.status !== 0) {
+        const reason = (r.stderr.trim() || r.stdout.trim()).replace(/\0/g, "");
+        return /access is denied/i.test(reason) ? { state: "unreadable", reason } : { state: "none" };
+    }
+    const owner = windowsTaskPrincipal(r.stdout.replace(/\0/g, ""));
+    if (!owner)
+        return { state: "unreadable", reason: "the task does not name the user it runs as" };
+    if (/^S-1-/i.test(owner)) {
+        const sid = host.windowsSid?.trim();
+        return sid && sid.toLowerCase() === owner.toLowerCase() ? { state: "mine", owner } : { state: "other", owner };
+    }
+    return sameWindowsUser(owner, host.windowsUser) ? { state: "mine", owner } : { state: "other", owner };
+}
+const REMOVE_LEGACY_TASK = `schtasks /Delete /TN ${LEGACY_DAEMON_WINDOWS_TASK} /F`;
+/** What to tell the user about a shared task HQ left alone, or undefined when there is none. */
+function legacyLeftNotice(legacy) {
+    if (legacy.state === "other") {
+        return (`Another Windows user's HQ daemon task (\\${LEGACY_DAEMON_WINDOWS_TASK}, run as ${legacy.owner}) was left untouched. ` +
+            `If it is in fact yours, remove it with: ${REMOVE_LEGACY_TASK}`);
+    }
+    if (legacy.state === "unreadable") {
+        return (`The shared HQ daemon task \\${LEGACY_DAEMON_WINDOWS_TASK} from an older install was left untouched because HQ could not read it (${legacy.reason}). ` +
+            `It may belong to another Windows user. If it is yours, remove it with: ${REMOVE_LEGACY_TASK}`);
+    }
+    return undefined;
+}
 /** What to tell the user when HQ did not stop pid `pid` because it could not verify it. */
 export function oldDaemonWarning(pid, reason) {
     return [
@@ -250,10 +375,10 @@ function activate(plan, host, run, sleep, previous = null) {
     switch (plan.kind) {
         case "launchd":
             activateLaunchd(plan.unitPath, run, host.uid, { sleep });
-            return;
+            return {};
         case "systemd-user":
             activateSystemd(DAEMON_SYSTEMD_UNIT, run);
-            return;
+            return {};
         case "systemd-system": {
             const reload = run("systemctl", ["daemon-reload"]);
             if (reload.status !== 0)
@@ -262,23 +387,41 @@ function activate(plan, host, run, sleep, previous = null) {
             if (enable.status !== 0)
                 throw commandError(`systemctl enable --now ${DAEMON_SYSTEMD_UNIT}`, enable);
             run("systemctl", ["restart", DAEMON_SYSTEMD_UNIT]);
-            return;
+            return {};
         }
         case "schtasks": {
-            const create = run("schtasks.exe", ["/Create", "/TN", DAEMON_WINDOWS_TASK, "/XML", plan.unitPath, "/F"]);
+            const task = windowsTaskName(host);
+            // Older installs registered one task name for the whole machine. Read
+            // whose it is before registering this user's own task.
+            const legacy = legacyWindowsTask(run, host);
+            const create = run("schtasks.exe", ["/Create", "/TN", task, "/XML", plan.unitPath, "/F"]);
             if (create.status !== 0)
                 throw commandError("schtasks /Create", create);
+            const warnings = [];
+            let notice = legacyLeftNotice(legacy);
+            if (legacy.state === "mine") {
+                // Only the current user's shared task is moved; another user's is never ended or deleted.
+                run("schtasks.exe", ["/End", "/TN", LEGACY_DAEMON_WINDOWS_TASK]);
+                const del = run("schtasks.exe", ["/Delete", "/TN", LEGACY_DAEMON_WINDOWS_TASK, "/F"]);
+                if (del.status !== 0) {
+                    warnings.push(`Could not remove the shared task \\${LEGACY_DAEMON_WINDOWS_TASK}: ${(del.stderr.trim() || del.stdout.trim() || `exit ${del.status}`).replace(/\0/g, "")}. ` +
+                        `Remove it with: ${REMOVE_LEGACY_TASK}`);
+                }
+                notice = `Moved your HQ daemon from the shared task \\${LEGACY_DAEMON_WINDOWS_TASK} to \\${task}.`;
+            }
             // `/Create /F` leaves a running instance alone and `/Run` is ignored
             // while one runs, so a daemon from an earlier install would keep the old
             // settings. Stop it first so `/Run` starts a new one.
-            const warning = previous ? endWindowsDaemon(run, previous) : undefined;
-            const start = run("schtasks.exe", ["/Run", "/TN", DAEMON_WINDOWS_TASK]);
+            const old = previous ? endWindowsDaemon(run, previous, [task]) : undefined;
+            if (old)
+                warnings.push(old);
+            const start = run("schtasks.exe", ["/Run", "/TN", task]);
             if (start.status !== 0)
                 throw commandError("schtasks /Run", start);
-            return warning;
+            return { ...(warnings.length ? { warning: warnings.join("\n") } : {}), ...(notice ? { notice } : {}) };
         }
         case "manual":
-            return undefined;
+            return {};
     }
 }
 export function installDaemonUnit(host, options, deps) {
@@ -330,8 +473,7 @@ export function installDaemonUnit(host, options, deps) {
         const lockPath = daemonPaths(host.home, { HQ_DAEMON_DIR: host.daemonDir }).lockPath;
         const runningDaemon = deps.runningDaemon ?? (() => liveDaemonLock(lockPath));
         const previous = plan.kind === "schtasks" ? runningDaemon() : null;
-        const warning = plan.kind !== "launchd" ? activate(plan, host, deps.run, deps.sleep, previous) : undefined;
-        const warn = warning ? { warning } : {};
+        const warn = plan.kind !== "launchd" ? activate(plan, host, deps.run, deps.sleep, previous) : {};
         if (plan.kind === "schtasks") {
             // schtasks /Run exits 0 even when the task cannot run: an
             // InteractiveToken task with no signed-in session stays at "has not yet
@@ -478,11 +620,22 @@ export function uninstallDaemonUnit(host, options, deps) {
         : planDaemonUnit(host, options);
     if (plan.kind === "manual")
         return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
-    // A registered task is removed even when its XML file has gone missing.
-    const present = fs.existsSync(plan.unitPath) ||
-        (plan.kind === "schtasks" && deps.run("schtasks.exe", ["/Query", "/TN", DAEMON_WINDOWS_TASK]).status === 0);
-    if (!present)
-        return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
+    // On Windows the XML file is shared with older installs, so it does not show
+    // that this user's per-user task exists. Ask schtasks for each name this
+    // user's task may have: the SID name, and the user-name form used when the
+    // SID could not be read at install time.
+    const userTasks = plan.kind === "schtasks" ? windowsUserTaskNames(deps.run, host) : [];
+    const present = plan.kind === "schtasks" ? userTasks.length > 0 : fs.existsSync(plan.unitPath);
+    // The current user's shared task from an older install goes too; another user's stays.
+    const legacy = plan.kind === "schtasks" ? legacyWindowsTask(deps.run, host) : { state: "none" };
+    const notice = legacyLeftNotice(legacy);
+    const noted = notice ? { notice } : {};
+    if (!present && legacy.state !== "mine") {
+        // A task XML left by an older install with no task behind it is stale.
+        if (plan.kind === "schtasks")
+            fs.rmSync(plan.unitPath, { force: true });
+        return { kind: plan.kind, unitPath: plan.unitPath, removed: false, ...noted };
+    }
     let warning;
     switch (plan.kind) {
         case "launchd":
@@ -503,15 +656,20 @@ export function uninstallDaemonUnit(host, options, deps) {
         }
         case "schtasks": {
             // The lock may be stale; endWindowsDaemon kills only a verified daemon.
-            warning = endWindowsDaemon(deps.run, readPidLock(path.join(host.daemonDir, "daemon.pid")));
-            const del = deps.run("schtasks.exe", ["/Delete", "/TN", DAEMON_WINDOWS_TASK, "/F"]);
-            // Keep the XML so a later uninstall still finds the task.
-            if (del.status !== 0)
-                throw commandError(`schtasks /Delete /TN ${DAEMON_WINDOWS_TASK}`, del);
+            const tasks = [...(legacy.state === "mine" ? [LEGACY_DAEMON_WINDOWS_TASK] : []), ...userTasks];
+            warning = endWindowsDaemon(deps.run, readPidLock(path.join(host.daemonDir, "daemon.pid")), tasks);
+            for (const name of tasks) {
+                const del = deps.run("schtasks.exe", ["/Delete", "/TN", name, "/F"]);
+                // A task that is already gone counts as removed. Otherwise keep the
+                // XML so a later uninstall still finds the task.
+                if (del.status !== 0 && deps.run("schtasks.exe", ["/Query", "/TN", name]).status === 0) {
+                    throw commandError(`schtasks /Delete /TN ${name}`, del);
+                }
+            }
             break;
         }
     }
     fs.rmSync(plan.unitPath, { force: true });
-    return { kind: plan.kind, unitPath: plan.unitPath, removed: true, ...(warning ? { warning } : {}) };
+    return { kind: plan.kind, unitPath: plan.unitPath, removed: true, ...(warning ? { warning } : {}), ...noted };
 }
 //# sourceMappingURL=install.js.map

package/dist/lib/daemon/legacy.d.ts

@@ -5,7 +5,8 @@
  *
  * Detection reads unit files and checks for an orphaned loaded macOS mesh job
  * whose plist was removed. Windows scheduled tasks are probed through
- * schtasks. Nothing here stops or removes a unit.
+ * schtasks, and only a task that runs as the current user can be taken over.
+ * Nothing here stops or removes a unit.
  */
 import type { ServiceName } from "./catalog.js";
 export interface LegacyUnit {
@@ -15,9 +16,13 @@ export interface LegacyUnit {
     kind: "launchd" | "systemd-user" | "systemd-system" | "schtasks";
     name: string;
     path?: string;
-    /** False for units owned by another product (the desktop app's own agent). */
+    /** False for units owned by another product (the desktop app's own agent) or another Windows user. */
     migratable: boolean;
+    /** Why a unit that is not the desktop app's is still left alone (another Windows user's task). */
+    notMineReason?: string;
 }
+/** Whose Windows Scheduled Task a name refers to, as classifyWindowsTask reads it. */
+export type WindowsTaskOwner = "none" | "mine" | "other" | "unreadable";
 export interface LegacyProbeDeps {
     platform: NodeJS.Platform;
     home: string;
@@ -25,7 +30,8 @@ export interface LegacyProbeDeps {
     listDir: (dir: string) => string[];
     /** True when launchctl can print the GUI-domain job despite a missing plist. */
     launchdJobLoaded: (label: string) => boolean;
-    windowsTaskExists: (taskName: string) => boolean;
+    /** Whether the task exists and runs as the current user. Another user's task is never taken over. */
+    windowsTaskOwner: (taskName: string) => WindowsTaskOwner;
 }
 export declare function describeLegacyUnit(unit: LegacyUnit): string;
 export declare function findLegacyUnits(deps: LegacyProbeDeps): LegacyUnit[];

package/dist/lib/daemon/legacy.js

@@ -5,7 +5,8 @@
  *
  * Detection reads unit files and checks for an orphaned loaded macOS mesh job
  * whose plist was removed. Windows scheduled tasks are probed through
- * schtasks. Nothing here stops or removes a unit.
+ * schtasks, and only a task that runs as the current user can be taken over.
+ * Nothing here stops or removes a unit.
  */
 import * as path from "node:path";
 const KIT_SERVICES = ["sync", "inbox", "heartbeat"];
@@ -100,9 +101,15 @@ function linuxUnits(deps) {
 }
 function windowsUnits(deps) {
     const task = "ai.getindigo.hq-mesh-daemon";
-    return deps.windowsTaskExists(task)
-        ? [{ unitId: "mesh", service: "mesh", kind: "schtasks", name: task, migratable: true }]
-        : [];
+    const owner = deps.windowsTaskOwner(task);
+    if (owner === "none")
+        return [];
+    const unit = { unitId: "mesh", service: "mesh", kind: "schtasks", name: task, migratable: owner === "mine" };
+    if (owner === "other")
+        unit.notMineReason = "it belongs to another Windows user";
+    if (owner === "unreadable")
+        unit.notMineReason = "HQ could not read which Windows user it belongs to";
+    return [unit];
 }
 export function findLegacyUnits(deps) {
     if (deps.platform === "darwin")

package/dist/lib/daemon/migrate.js

@@ -136,7 +136,7 @@ export function adoptLegacyUnits(units, deps) {
     };
     for (const unit of units) {
         if (!unit.migratable) {
-            result.skipped.push({ unit, reason: "owned by the HQ desktop app" });
+            result.skipped.push({ unit, reason: unit.notMineReason ?? "owned by the HQ desktop app" });
             continue;
         }
         if (unit.kind === "systemd-system" && !deps.isRoot) {

package/dist/lib/daemon/run.d.ts

@@ -6,7 +6,7 @@
  * signing in takes effect without restarting the daemon.
  */
 import { type PlanContext, type ServiceName, type UnitPlan } from "./catalog.js";
-import { type LegacyUnit } from "./legacy.js";
+import { type LegacyUnit, type WindowsTaskOwner } from "./legacy.js";
 import { type DaemonLockResult } from "./lock.js";
 import { type MachineType } from "./machine-type.js";
 import { type PickedHqCloud } from "./hq-cloud.js";
@@ -99,7 +99,8 @@ export declare function daemonInstantSyncEnabled(env: NodeJS.ProcessEnv, configu
  * background service, so it is not one of them.
  */
 export declare function listLocalBots(root?: string): string[];
-export declare function windowsTaskExists(taskName: string): boolean;
+/** Whose task `taskName` is: only the current user's own task may be taken over. */
+export declare function windowsTaskOwner(taskName: string): WindowsTaskOwner;
 export declare function probeLegacyUnits(platform: NodeJS.Platform, home: string): LegacyUnit[];
 /** Absolute path of `name` on PATH, or null. */
 export declare function findOnPath(name: string, env?: NodeJS.ProcessEnv): string | null;

package/dist/lib/daemon/run.js

@@ -32,7 +32,7 @@ import { SUPERVISOR_HANDOFF_FLAG, readDaemonFlag } from "./flag.js";
 import { createBoundedDaemonFlagMonitor } from "./flag-monitor.js";
 import { DAEMON_CHILD_BOOTSTRAP_HANDOFF_WATCH_FLAG, DAEMON_LANES_RECONCILE_FILE_WATCH_FLAG, DAEMON_SEARCH_INDEX_RUNNER_OWNS_INDEX_FLAG, DAEMON_SYNC_PROCESS_SCAN_ON_MISSING_FLAG, } from "./kill-switch-flags.js";
 import { createLanesReconcileWatcher } from "./lanes-reconcile-watcher.js";
-import { findLegacyUnits, legacyMeshUnitsToRetire, legacyOwnerLookup } from "./legacy.js";
+import { findLegacyUnits, legacyMeshUnitsToRetire, legacyOwnerLookup, } from "./legacy.js";
 import { readLegacySyncEnv } from "./legacy-sync-env.js";
 import { readVaultSyncSwitches, unreadableSwitchesWarning } from "../vault-sync-switches.js";
 import { acquireDaemonLock, isProcessAlive, processCommandLine, releaseDaemonLock } from "./lock.js";
@@ -41,7 +41,7 @@ import { daemonDir as meshDaemonDir, daemonPidPath as meshDaemonPidPath } from "
 import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
 import { registryDir, registryFile } from "../registry/registry.js";
 import { updateAnywhereRuntimeRevocationMarker } from "../anywhere-runtime-revocation-marker.js";
-import { daemonRootRefusal } from "./install.js";
+import { classifyWindowsTask, currentWindowsIdentity, daemonRootRefusal } from "./install.js";
 import { detectMachineType } from "./machine-type.js";
 import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
 import { hqdSocketPath } from "./protocol.js";
@@ -310,9 +310,13 @@ export function listLocalBots(root = botsRoot()) {
         .map((d) => d.name)
         .sort();
 }
-export function windowsTaskExists(taskName) {
-    const r = spawnSync("schtasks.exe", ["/Query", "/TN", taskName], { encoding: "utf8", windowsHide: true });
-    return r.status === 0;
+/** Whose task `taskName` is: only the current user's own task may be taken over. */
+export function windowsTaskOwner(taskName) {
+    const run = (cmd, args) => {
+        const r = spawnSync(cmd, args, { encoding: "utf8", windowsHide: true });
+        return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    };
+    return classifyWindowsTask(run, taskName, currentWindowsIdentity(run)).state;
 }
 export function probeLegacyUnits(platform, home) {
     return findLegacyUnits({
@@ -331,7 +335,7 @@ export function probeLegacyUnits(platform, home) {
             });
             return result.status === 0;
         },
-        windowsTaskExists,
+        windowsTaskOwner,
     });
 }
 /** Absolute path of `name` on PATH, or null. */

package/dist/lib/doctor/checks/anywhere.d.ts

@@ -9,6 +9,8 @@
  * on this machine the family reports a single NA line.
  */
 import { type HqdHealthResult } from "../../daemon/protocol.js";
+import { type DaemonHost } from "../../daemon/install.js";
+import type { RunCommand } from "../../service-manager/launchd.js";
 import type { CheckFamily } from "../types.js";
 export declare const REMEDIATION: {
     readonly installClaude: "hq install --global --runtime claude";
@@ -31,6 +33,10 @@ export interface DaemonServiceProbeOptions {
     launchdProbe?: (target: string) => boolean;
     /** Test seam for the desktop app's live managed daemon state. */
     hostedDaemonProbe?: () => boolean;
+    /** Test seam for the schtasks calls the Windows probe makes. */
+    run?: RunCommand;
+    /** Test seam for the Windows account the task name is built from. */
+    windowsIdentity?: Pick<DaemonHost, "windowsSid" | "windowsUser">;
 }
 export interface AnywhereDeps {
     home?: string;

package/dist/lib/doctor/checks/anywhere.js

@@ -20,7 +20,7 @@ import { CHATGPT_MODE } from "../../install/chatgpt-targets.js";
 import { GROK_MODE } from "../../install/grok-targets.js";
 import { HqdClientError, hqdRequest } from "../../daemon/protocol.js";
 import { daemonPresenceLabel, heartbeatFile, readHeartbeat } from "../../daemon/heartbeat.js";
-import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK } from "../../daemon/install.js";
+import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, LEGACY_DAEMON_WINDOWS_TASK, currentWindowsIdentity, legacyWindowsTask, windowsTaskName, } from "../../daemon/install.js";
 import { hostedDaemonRunning } from "../../daemon/handoff.js";
 import { daemonPaths } from "../../daemon/paths.js";
 import { runningDaemonPid } from "../../daemon/lock.js";
@@ -40,6 +40,15 @@ export const REMEDIATION = {
     daemonStatus: "hq daemon status",
     link: "hq link <repo-dir> <company>",
 };
+/** schtasks with the same 5s cap the probe always had, so a hung query cannot stall the doctor. */
+const runSchtasksWithTimeout = (cmd, args) => {
+    const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 5_000, windowsHide: true });
+    return {
+        status: r.status,
+        stdout: typeof r.stdout === "string" ? r.stdout : "",
+        stderr: r.error ? r.error.message : (typeof r.stderr === "string" ? r.stderr : ""),
+    };
+};
 export function createAnywhereFamily(deps = {}) {
     return { id: ANYWHERE_FAMILY_ID, title: "HQ anywhere runtime", run: (context) => runAnywhereChecks(context, deps) };
 }
@@ -451,11 +460,31 @@ export function defaultServiceState(home, options = {}) {
         return { installed: true, loaded: probe.status === 0, detail: `systemd ${systemScope ? "system" : "user"} ${DAEMON_SYSTEMD_UNIT}` };
     }
     if (platform === "win32") {
-        const probe = spawnSync("schtasks.exe", ["/Query", "/TN", DAEMON_WINDOWS_TASK, "/FO", "CSV", "/NH"], { encoding: "utf8", timeout: 5_000 });
-        if (probe.status !== 0)
-            return { installed: false, loaded: false, detail: `no Scheduled Task ${DAEMON_WINDOWS_TASK}` };
-        const loaded = /,\s*"?Running"?\s*$/i.test(probe.stdout.trim());
-        return { installed: true, loaded, detail: `Scheduled Task ${DAEMON_WINDOWS_TASK}${loaded ? " is running" : " is not running"}` };
+        // Each Windows user has their own task. The shared task an older install
+        // registered counts only when it runs as this user.
+        const run = options.run ?? runSchtasksWithTimeout;
+        const identity = options.windowsIdentity ?? currentWindowsIdentity(run);
+        const task = windowsTaskName(identity);
+        const probe = run("schtasks.exe", ["/Query", "/TN", task, "/FO", "CSV", "/NH"]);
+        if (probe.status !== 0) {
+            const legacy = legacyWindowsTask(run, identity);
+            if (legacy.state === "mine") {
+                // Still this user's daemon until install moves it to the per-user name.
+                const legacyProbe = run("schtasks.exe", ["/Query", "/TN", LEGACY_DAEMON_WINDOWS_TASK, "/FO", "CSV", "/NH"]);
+                const legacyLoaded = legacyProbe.status === 0 && /,\s*"?Running"?\s*$/i.test(legacyProbe.stdout.replace(/\0/g, "").trim());
+                return {
+                    installed: true,
+                    loaded: legacyLoaded,
+                    detail: `your daemon runs from the shared task ${LEGACY_DAEMON_WINDOWS_TASK} from an older install${legacyLoaded ? " (running)" : " (not running)"}. Run hq daemon install to move it to your own task ${task}`,
+                };
+            }
+            const someoneElse = legacy.state === "other" || legacy.state === "unreadable"
+                ? ` (${LEGACY_DAEMON_WINDOWS_TASK} belongs to another Windows user and is not yours)`
+                : "";
+            return { installed: false, loaded: false, detail: `no Scheduled Task ${task}${someoneElse}` };
+        }
+        const loaded = /,\s*"?Running"?\s*$/i.test(probe.stdout.replace(/\0/g, "").trim());
+        return { installed: true, loaded, detail: `Scheduled Task ${task}${loaded ? " is running" : " is not running"}` };
     }
     return { installed: false, loaded: false, detail: `${platform}: service probe not available` };
 }

package/dist/lib/hot-channels/adapters/__fixtures__/dummy.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Test-only fifth hot channel (hot-signal-sync US-016).
+ *
+ * This file and `dummy.catalog.json` beside it are everything a new poll
+ * channel needs: the adapter is typed only against `../../contract.js`, and
+ * `contract.e2e.test.ts` runs it through the shared loop, landing, signals
+ * pass and run ledger without any change to those modules.
+ *
+ * It is never registered in the production registry. Only the e2e test
+ * imports it, and it registers it in a registry of its own.
+ */
+import type { PollHotChannelAdapter } from "../../contract.js";
+/** The one provider tool the dummy channel calls through the gateway. */
+export declare const DUMMY_LIST_TOOL = "dummy_list_events";
+/** One recorded item as the dummy provider's list tool returns it. */
+export interface DummyItem {
+    id: string;
+    rev: string;
+    author: string;
+    kind: string;
+    space: string;
+    at: string;
+    title: string;
+    body: string;
+    audience: string[];
+}
+/** The dummy list tool's page shape. */
+export interface DummyListResult {
+    items: DummyItem[];
+    next: string | null;
+}
+export declare function createDummyAdapter(): PollHotChannelAdapter;
+//# sourceMappingURL=dummy.d.ts.map

package/dist/lib/hot-channels/adapters/__fixtures__/dummy.js

@@ -0,0 +1,53 @@
+/**
+ * Test-only fifth hot channel (hot-signal-sync US-016).
+ *
+ * This file and `dummy.catalog.json` beside it are everything a new poll
+ * channel needs: the adapter is typed only against `../../contract.js`, and
+ * `contract.e2e.test.ts` runs it through the shared loop, landing, signals
+ * pass and run ledger without any change to those modules.
+ *
+ * It is never registered in the production registry. Only the e2e test
+ * imports it, and it registers it in a registry of its own.
+ */
+/** The one provider tool the dummy channel calls through the gateway. */
+export const DUMMY_LIST_TOOL = "dummy_list_events";
+const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+function toEvent(item) {
+    return {
+        providerId: item.id,
+        version: item.rev,
+        who: item.author,
+        what: item.kind,
+        where: item.space,
+        when: item.at,
+        audience: [...item.audience],
+        title: item.title,
+        body: item.body,
+        raw: item,
+    };
+}
+export function createDummyAdapter() {
+    return {
+        id: "dummy",
+        channel: "dummy",
+        transport: "poll",
+        hotEventTypes: ["item.created", "item.updated"],
+        catchUpWindow: { maxLookbackMs: WEEK_MS },
+        tokenScope: { provider: "dummy", scopes: ["items:read"] },
+        suggestionRule: { kind: "recent-activity", withinMs: WEEK_MS, minEvents: 1 },
+        async fetch(cursor, ctx) {
+            if (!ctx.gateway)
+                throw new Error("the dummy channel needs a gateway connection");
+            const page = (await ctx.gateway.call(DUMMY_LIST_TOOL, {
+                since: ctx.since,
+                cursor,
+            }));
+            return {
+                events: page.items.map(toEvent),
+                cursor: page.next ?? cursor,
+                hasMore: page.next !== null,
+            };
+        },
+    };
+}
+//# sourceMappingURL=dummy.js.map