@indigoai-us/hq-cli 5.345.178 → 5.345.180

package/dist/lib/daemon/catalog.js

@@ -148,7 +148,7 @@ function syncOwnerBlock(ctx) {
     }
     return undefined;
 }
-function daemonAloneRunsLegacySync(ctx) {
+export function daemonAloneRunsLegacySync(ctx) {
     return ctx.syncOwner === "daemon" && ctx.legacySyncUnitManagesSync !== true && syncOwnerBlock(ctx) === undefined;
 }
 function planService(service, ctx) {

package/dist/lib/daemon/handoff.d.ts

@@ -32,7 +32,11 @@ export interface DaemonUnitHost {
     platform: NodeJS.Platform;
     home: string;
     systemUnitDir?: string;
+    /** This user's own Scheduled Task name (daemonWindowsTaskName); another user's task on the PC does not count. */
+    windowsTaskName: string;
     windowsTaskExists: (task: string) => boolean;
+    /** The shared task an older install registered runs as this user (it still counts until install moves it). */
+    windowsLegacyTaskIsMine?: () => boolean;
 }
 /** The `hq daemon` OS unit is installed on this machine (for this user, or as the box's system unit). */
 export declare function daemonUnitInstalled(host: DaemonUnitHost): boolean;

package/dist/lib/daemon/handoff.js

@@ -10,7 +10,8 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SERVICES, enabledServices, isServiceName } from "./catalog.js";
 import { readDaemonConfig, writeDaemonConfig } from "./config.js";
-import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from "./install.js";
+import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, SYSTEM_UNIT_DIR, currentWindowsIdentity, legacyWindowsTask, windowsTaskName } from "./install.js";
+import { defaultRunCommand } from "../service-manager/launchd.js";
 import { isDaemonProcess, runningDaemonPid } from "./lock.js";
 import { detectMachineType } from "./machine-type.js";
 import { daemonPaths } from "./paths.js";
@@ -96,7 +97,7 @@ export function daemonUnitInstalled(host) {
         case "darwin":
             return fs.existsSync(path.join(host.home, "Library", "LaunchAgents", `${DAEMON_LAUNCHD_LABEL}.plist`));
         case "win32":
-            return host.windowsTaskExists(DAEMON_WINDOWS_TASK);
+            return host.windowsTaskExists(host.windowsTaskName) || (host.windowsLegacyTaskIsMine?.() ?? false);
         default:
             return (fs.existsSync(path.join(host.home, ".config", "systemd", "user", DAEMON_SYSTEMD_UNIT)) ||
                 fs.existsSync(path.join(host.systemUnitDir ?? SYSTEM_UNIT_DIR, DAEMON_SYSTEMD_UNIT)));
@@ -142,9 +143,12 @@ export function handOffInstallHere(services, env = process.env, opts = {}) {
     if (opts.ifStale && services.every((service) => config.disable.includes(service))) {
         return `hq daemon has ${services.join(", ")} disabled, so the older service will not be installed.`;
     }
+    const identity = process.platform === "win32" ? currentWindowsIdentity() : undefined;
     const installed = daemonUnitInstalled({
         platform: process.platform,
         home,
+        windowsTaskName: identity ? windowsTaskName(identity) : "",
+        windowsLegacyTaskIsMine: () => identity !== undefined && legacyWindowsTask(defaultRunCommand, identity).state === "mine",
         windowsTaskExists: (task) => spawnSync("schtasks.exe", ["/Query", "/TN", task], { encoding: "utf8", windowsHide: true }).status === 0,
     }) || hostedDaemonRunning(paths);
     if (!installed) {

package/dist/lib/daemon/install.d.ts

@@ -7,7 +7,7 @@
  * - Linux, per-user: systemd user unit hq-daemon.service
  * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
  *   running as the box's login user; needs root
- * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
+ * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon-<user SID>
  * - anything else: no unit; the caller prints the command to run
  *
  * The unit never names services. `hq daemon run` reads the machine type and
@@ -20,8 +20,34 @@ import { type PidLockRecord } from "../mesh/live/daemon/pid-lock.js";
 import type { MachineType } from "./machine-type.js";
 export declare const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
 export declare const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
-export declare const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
+/**
+ * The one machine-wide task name older installs registered on Windows. Two
+ * users on one PC overwrote each other's daemon under it, so each user now
+ * gets their own name (daemonWindowsTaskName). Install moves the current
+ * user's task off this name; another user's task under it is left alone.
+ */
+export declare const LEGACY_DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
 export declare const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+/**
+ * The Windows task name for one user: the shared prefix plus the user's SID,
+ * or the `DOMAIN\user` name with characters a task name cannot hold replaced
+ * when the SID could not be read. Never the bare legacy name.
+ */
+export declare function daemonWindowsTaskName(who: {
+    sid?: string;
+    user: string;
+}): string;
+/** The current Windows user's SID from `whoami /user`, or undefined when it cannot be read. */
+export declare function readWindowsSid(run: RunCommand): string | undefined;
+/** The per-user task name for the user running this process. */
+export declare function currentDaemonWindowsTaskName(run: RunCommand, user: string): string;
+/**
+ * `DOMAIN\user` for the current account. Same answer as the mesh installer's
+ * resolveWindowsUser, kept here so lookups do not load the mesh installer.
+ */
+export declare function currentWindowsUser(env?: NodeJS.ProcessEnv): string;
+/** The current user as a DaemonHost names them on Windows. */
+export declare function currentWindowsIdentity(run?: RunCommand, env?: NodeJS.ProcessEnv): Pick<DaemonHost, "windowsSid" | "windowsUser">;
 export type InstallScope = "user" | "system";
 export interface DaemonHost {
     platform: NodeJS.Platform;
@@ -34,6 +60,8 @@ export interface DaemonHost {
     isRoot: boolean;
     /** `DOMAIN\user` the Windows task runs as. */
     windowsUser: string;
+    /** That user's SID, when `whoami /user` could read it. Names the per-user task. */
+    windowsSid?: string;
     /** conhost.exe path when `--headless` is supported, else undefined. */
     windowsHeadlessLauncher: string | undefined;
     /** Where system units are written (tests point this at a temp dir). */
@@ -70,6 +98,8 @@ export interface DaemonUnitResult {
     startPending?: true;
     /** Windows: an older daemon may still be running; HQ could not verify it, so did not stop it. */
     warning?: string;
+    /** Windows: what happened to the shared task from an older install, when there is one. */
+    notice?: string;
 }
 export interface InstallDeps {
     run: RunCommand;
@@ -93,6 +123,43 @@ export declare function daemonRootRefusal(isRoot: boolean, machineType: MachineT
 /** Boxes run the daemon as a system unit; everything else per user. */
 export declare function installScopeFor(machineType: MachineType): InstallScope;
 export declare function planDaemonUnit(host: DaemonHost, options: InstallOptions): DaemonUnitPlan;
+/**
+ * The registered per-user task names for `host`: the current name, and the
+ * user-name form an install used when it could not read the SID. The fallback
+ * name is only returned when its principal is this user.
+ */
+export declare function windowsUserTaskNames(run: RunCommand, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): string[];
+/** The per-user task name for `host`. */
+export declare function windowsTaskName(host: Pick<DaemonHost, "windowsSid" | "windowsUser">): string;
+/**
+ * Whether two Windows account names are the same user, ignoring case. Both
+ * names must have the same form: `DOMAIN\user` matches only the same
+ * `DOMAIN\user`, and a bare `user` only the same bare `user`. A bare name is
+ * never matched against a domain name, because `bob` could be `PC\bob` or
+ * `CORP\bob`, and a wrong match would end and delete another user's task.
+ */
+export declare function sameWindowsUser(a: string, b: string): boolean;
+/**
+ * The shared task an older install registered, and whose it is. "mine" means
+ * its principal is the current user, so HQ may move it. "other" means another
+ * user's, or a principal HQ cannot match to the current user; "unreadable"
+ * means schtasks refused to show it. Both are left alone.
+ */
+export type LegacyWindowsTask = {
+    state: "none";
+} | {
+    state: "mine";
+    owner: string;
+} | {
+    state: "other";
+    owner: string;
+} | {
+    state: "unreadable";
+    reason: string;
+};
+export declare function legacyWindowsTask(run: RunCommand, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): LegacyWindowsTask;
+/** Whose task `task` is, read from `schtasks /Query /XML`. */
+export declare function classifyWindowsTask(run: RunCommand, task: string, host: Pick<DaemonHost, "windowsSid" | "windowsUser">): LegacyWindowsTask;
 /** What to tell the user when HQ did not stop pid `pid` because it could not verify it. */
 export declare function oldDaemonWarning(pid: number, reason: string): string;
 export declare function installDaemonUnit(host: DaemonHost, options: InstallOptions, deps: InstallDeps): DaemonUnitResult;
@@ -127,5 +194,6 @@ export declare function uninstallDaemonUnit(host: DaemonHost, options: InstallOp
     unitPath: string;
     removed: boolean;
     warning?: string;
+    notice?: string;
 };
 //# sourceMappingURL=install.d.ts.map

package/dist/lib/daemon/install.js

@@ -7,7 +7,7 @@
  * - Linux, per-user: systemd user unit hq-daemon.service
  * - Linux, system (outposts and agent boxes): /etc/systemd/system/hq-daemon.service
  *   running as the box's login user; needs root
- * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon
+ * - Windows: per-user logon Scheduled Task ai.getindigo.hq-daemon-<user SID>
  * - anything else: no unit; the caller prints the command to run
  *
  * The unit never names services. `hq daemon run` reads the machine type and
@@ -16,6 +16,7 @@
  * never touch launchctl, systemctl or schtasks.
  */
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { activateLaunchd, blockingSleep, deactivateLaunchd, defaultRunCommand, installLaunchdPlist, launchdIsLoaded, launchdPlistPath, renderLaunchdPlist, } from "../service-manager/launchd.js";
 import { activateSystemd, deactivateSystemd, renderSystemdUserUnit, systemdUnitPath, } from "../service-manager/systemd.js";
@@ -26,8 +27,58 @@ import { liveDaemonLock, verifyDaemonForKill } from "./lock.js";
 import { daemonPaths } from "./paths.js";
 export const DAEMON_LAUNCHD_LABEL = "ai.getindigo.hq-daemon";
 export const DAEMON_SYSTEMD_UNIT = "hq-daemon.service";
-export const DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
+/**
+ * The one machine-wide task name older installs registered on Windows. Two
+ * users on one PC overwrote each other's daemon under it, so each user now
+ * gets their own name (daemonWindowsTaskName). Install moves the current
+ * user's task off this name; another user's task under it is left alone.
+ */
+export const LEGACY_DAEMON_WINDOWS_TASK = "ai.getindigo.hq-daemon";
 export const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+/**
+ * The Windows task name for one user: the shared prefix plus the user's SID,
+ * or the `DOMAIN\user` name with characters a task name cannot hold replaced
+ * when the SID could not be read. Never the bare legacy name.
+ */
+export function daemonWindowsTaskName(who) {
+    const sid = who.sid?.trim();
+    if (sid)
+        return `${LEGACY_DAEMON_WINDOWS_TASK}-${sid}`;
+    const user = who.user.trim().replace(/[^A-Za-z0-9_.-]/g, "_");
+    return `${LEGACY_DAEMON_WINDOWS_TASK}-${user || "user"}`;
+}
+/** The current Windows user's SID from `whoami /user`, or undefined when it cannot be read. */
+export function readWindowsSid(run) {
+    const r = run("whoami.exe", ["/user", "/FO", "CSV", "/NH"]);
+    if (r.status !== 0)
+        return undefined;
+    return /S-1-\d+(?:-\d+)+/.exec(r.stdout)?.[0];
+}
+/** The per-user task name for the user running this process. */
+export function currentDaemonWindowsTaskName(run, user) {
+    return daemonWindowsTaskName({ sid: readWindowsSid(run), user });
+}
+/**
+ * `DOMAIN\user` for the current account. Same answer as the mesh installer's
+ * resolveWindowsUser, kept here so lookups do not load the mesh installer.
+ */
+export function currentWindowsUser(env = process.env) {
+    let user = env.USERNAME?.trim() ?? "";
+    if (!user) {
+        try {
+            user = os.userInfo().username;
+        }
+        catch {
+            user = "";
+        }
+    }
+    const domain = env.USERDOMAIN?.trim();
+    return domain ? `${domain}\\${user}` : user;
+}
+/** The current user as a DaemonHost names them on Windows. */
+export function currentWindowsIdentity(run = defaultRunCommand, env = process.env) {
+    return { windowsUser: currentWindowsUser(env), windowsSid: readWindowsSid(run) };
+}
 /** How long install waits for the Windows task to start a daemon process. */
 export const WINDOWS_START_WAIT_MS = 10_000;
 const WINDOWS_START_POLL_MS = 500;
@@ -128,7 +179,7 @@ function renderWindowsTaskXml(host) {
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
-    <URI>\\${DAEMON_WINDOWS_TASK}</URI>
+    <URI>\\${windowsTaskName(host)}</URI>
     <Description>HQ daemon: runs this machine's HQ background services</Description>
   </RegistrationInfo>
   <Triggers>
@@ -204,7 +255,7 @@ export function planDaemonUnit(host, options) {
     if (host.platform === "win32") {
         return {
             kind: "schtasks",
-            unitPath: path.join(host.daemonDir, `${DAEMON_WINDOWS_TASK}.xml`),
+            unitPath: path.join(host.daemonDir, `${LEGACY_DAEMON_WINDOWS_TASK}.xml`),
             rendered: renderWindowsTaskXml(host),
         };
     }
@@ -224,8 +275,9 @@ function commandError(what, r) {
  * immediately before the kill and killed only when it is verifiably the
  * daemon. Returns a warning when a process was left running unverified.
  */
-function endWindowsDaemon(run, owner) {
-    run("schtasks.exe", ["/End", "/TN", DAEMON_WINDOWS_TASK]);
+function endWindowsDaemon(run, owner, tasks) {
+    for (const task of tasks)
+        run("schtasks.exe", ["/End", "/TN", task]);
     if (!owner || owner.pid === process.pid)
         return undefined;
     const check = verifyDaemonForKill(owner, run);
@@ -237,6 +289,79 @@ function endWindowsDaemon(run, owner) {
         return undefined;
     return oldDaemonWarning(owner.pid, check.reason);
 }
+/**
+ * The registered per-user task names for `host`: the current name, and the
+ * user-name form an install used when it could not read the SID. The fallback
+ * name is only returned when its principal is this user.
+ */
+export function windowsUserTaskNames(run, host) {
+    const names = [];
+    const current = windowsTaskName(host);
+    if (run("schtasks.exe", ["/Query", "/TN", current]).status === 0)
+        names.push(current);
+    const byUser = daemonWindowsTaskName({ user: host.windowsUser });
+    if (byUser !== current && classifyWindowsTask(run, byUser, host).state === "mine")
+        names.push(byUser);
+    return names;
+}
+/** The per-user task name for `host`. */
+export function windowsTaskName(host) {
+    return daemonWindowsTaskName({ sid: host.windowsSid, user: host.windowsUser });
+}
+/**
+ * Whether two Windows account names are the same user, ignoring case. Both
+ * names must have the same form: `DOMAIN\user` matches only the same
+ * `DOMAIN\user`, and a bare `user` only the same bare `user`. A bare name is
+ * never matched against a domain name, because `bob` could be `PC\bob` or
+ * `CORP\bob`, and a wrong match would end and delete another user's task.
+ */
+export function sameWindowsUser(a, b) {
+    const left = a.trim().toLowerCase();
+    const right = b.trim().toLowerCase();
+    const leftBare = (left.split("\\").pop() ?? "").trim();
+    const rightBare = (right.split("\\").pop() ?? "").trim();
+    if (!leftBare || !rightBare)
+        return false;
+    if (left.includes("\\") !== right.includes("\\"))
+        return false;
+    return left === right;
+}
+/** The principal a task XML runs as. */
+function windowsTaskPrincipal(xml) {
+    return /<Principal\b[^>]*>[\s\S]*?<UserId>([^<]*)<\/UserId>/.exec(xml)?.[1]?.trim() || undefined;
+}
+export function legacyWindowsTask(run, host) {
+    return classifyWindowsTask(run, LEGACY_DAEMON_WINDOWS_TASK, host);
+}
+/** Whose task `task` is, read from `schtasks /Query /XML`. */
+export function classifyWindowsTask(run, task, host) {
+    const r = run("schtasks.exe", ["/Query", "/TN", task, "/XML"]);
+    if (r.status !== 0) {
+        const reason = (r.stderr.trim() || r.stdout.trim()).replace(/\0/g, "");
+        return /access is denied/i.test(reason) ? { state: "unreadable", reason } : { state: "none" };
+    }
+    const owner = windowsTaskPrincipal(r.stdout.replace(/\0/g, ""));
+    if (!owner)
+        return { state: "unreadable", reason: "the task does not name the user it runs as" };
+    if (/^S-1-/i.test(owner)) {
+        const sid = host.windowsSid?.trim();
+        return sid && sid.toLowerCase() === owner.toLowerCase() ? { state: "mine", owner } : { state: "other", owner };
+    }
+    return sameWindowsUser(owner, host.windowsUser) ? { state: "mine", owner } : { state: "other", owner };
+}
+const REMOVE_LEGACY_TASK = `schtasks /Delete /TN ${LEGACY_DAEMON_WINDOWS_TASK} /F`;
+/** What to tell the user about a shared task HQ left alone, or undefined when there is none. */
+function legacyLeftNotice(legacy) {
+    if (legacy.state === "other") {
+        return (`Another Windows user's HQ daemon task (\\${LEGACY_DAEMON_WINDOWS_TASK}, run as ${legacy.owner}) was left untouched. ` +
+            `If it is in fact yours, remove it with: ${REMOVE_LEGACY_TASK}`);
+    }
+    if (legacy.state === "unreadable") {
+        return (`The shared HQ daemon task \\${LEGACY_DAEMON_WINDOWS_TASK} from an older install was left untouched because HQ could not read it (${legacy.reason}). ` +
+            `It may belong to another Windows user. If it is yours, remove it with: ${REMOVE_LEGACY_TASK}`);
+    }
+    return undefined;
+}
 /** What to tell the user when HQ did not stop pid `pid` because it could not verify it. */
 export function oldDaemonWarning(pid, reason) {
     return [
@@ -250,10 +375,10 @@ function activate(plan, host, run, sleep, previous = null) {
     switch (plan.kind) {
         case "launchd":
             activateLaunchd(plan.unitPath, run, host.uid, { sleep });
-            return;
+            return {};
         case "systemd-user":
             activateSystemd(DAEMON_SYSTEMD_UNIT, run);
-            return;
+            return {};
         case "systemd-system": {
             const reload = run("systemctl", ["daemon-reload"]);
             if (reload.status !== 0)
@@ -262,23 +387,41 @@ function activate(plan, host, run, sleep, previous = null) {
             if (enable.status !== 0)
                 throw commandError(`systemctl enable --now ${DAEMON_SYSTEMD_UNIT}`, enable);
             run("systemctl", ["restart", DAEMON_SYSTEMD_UNIT]);
-            return;
+            return {};
         }
         case "schtasks": {
-            const create = run("schtasks.exe", ["/Create", "/TN", DAEMON_WINDOWS_TASK, "/XML", plan.unitPath, "/F"]);
+            const task = windowsTaskName(host);
+            // Older installs registered one task name for the whole machine. Read
+            // whose it is before registering this user's own task.
+            const legacy = legacyWindowsTask(run, host);
+            const create = run("schtasks.exe", ["/Create", "/TN", task, "/XML", plan.unitPath, "/F"]);
             if (create.status !== 0)
                 throw commandError("schtasks /Create", create);
+            const warnings = [];
+            let notice = legacyLeftNotice(legacy);
+            if (legacy.state === "mine") {
+                // Only the current user's shared task is moved; another user's is never ended or deleted.
+                run("schtasks.exe", ["/End", "/TN", LEGACY_DAEMON_WINDOWS_TASK]);
+                const del = run("schtasks.exe", ["/Delete", "/TN", LEGACY_DAEMON_WINDOWS_TASK, "/F"]);
+                if (del.status !== 0) {
+                    warnings.push(`Could not remove the shared task \\${LEGACY_DAEMON_WINDOWS_TASK}: ${(del.stderr.trim() || del.stdout.trim() || `exit ${del.status}`).replace(/\0/g, "")}. ` +
+                        `Remove it with: ${REMOVE_LEGACY_TASK}`);
+                }
+                notice = `Moved your HQ daemon from the shared task \\${LEGACY_DAEMON_WINDOWS_TASK} to \\${task}.`;
+            }
             // `/Create /F` leaves a running instance alone and `/Run` is ignored
             // while one runs, so a daemon from an earlier install would keep the old
             // settings. Stop it first so `/Run` starts a new one.
-            const warning = previous ? endWindowsDaemon(run, previous) : undefined;
-            const start = run("schtasks.exe", ["/Run", "/TN", DAEMON_WINDOWS_TASK]);
+            const old = previous ? endWindowsDaemon(run, previous, [task]) : undefined;
+            if (old)
+                warnings.push(old);
+            const start = run("schtasks.exe", ["/Run", "/TN", task]);
             if (start.status !== 0)
                 throw commandError("schtasks /Run", start);
-            return warning;
+            return { ...(warnings.length ? { warning: warnings.join("\n") } : {}), ...(notice ? { notice } : {}) };
         }
         case "manual":
-            return undefined;
+            return {};
     }
 }
 export function installDaemonUnit(host, options, deps) {
@@ -330,8 +473,7 @@ export function installDaemonUnit(host, options, deps) {
         const lockPath = daemonPaths(host.home, { HQ_DAEMON_DIR: host.daemonDir }).lockPath;
         const runningDaemon = deps.runningDaemon ?? (() => liveDaemonLock(lockPath));
         const previous = plan.kind === "schtasks" ? runningDaemon() : null;
-        const warning = plan.kind !== "launchd" ? activate(plan, host, deps.run, deps.sleep, previous) : undefined;
-        const warn = warning ? { warning } : {};
+        const warn = plan.kind !== "launchd" ? activate(plan, host, deps.run, deps.sleep, previous) : {};
         if (plan.kind === "schtasks") {
             // schtasks /Run exits 0 even when the task cannot run: an
             // InteractiveToken task with no signed-in session stays at "has not yet
@@ -478,11 +620,22 @@ export function uninstallDaemonUnit(host, options, deps) {
         : planDaemonUnit(host, options);
     if (plan.kind === "manual")
         return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
-    // A registered task is removed even when its XML file has gone missing.
-    const present = fs.existsSync(plan.unitPath) ||
-        (plan.kind === "schtasks" && deps.run("schtasks.exe", ["/Query", "/TN", DAEMON_WINDOWS_TASK]).status === 0);
-    if (!present)
-        return { kind: plan.kind, unitPath: plan.unitPath, removed: false };
+    // On Windows the XML file is shared with older installs, so it does not show
+    // that this user's per-user task exists. Ask schtasks for each name this
+    // user's task may have: the SID name, and the user-name form used when the
+    // SID could not be read at install time.
+    const userTasks = plan.kind === "schtasks" ? windowsUserTaskNames(deps.run, host) : [];
+    const present = plan.kind === "schtasks" ? userTasks.length > 0 : fs.existsSync(plan.unitPath);
+    // The current user's shared task from an older install goes too; another user's stays.
+    const legacy = plan.kind === "schtasks" ? legacyWindowsTask(deps.run, host) : { state: "none" };
+    const notice = legacyLeftNotice(legacy);
+    const noted = notice ? { notice } : {};
+    if (!present && legacy.state !== "mine") {
+        // A task XML left by an older install with no task behind it is stale.
+        if (plan.kind === "schtasks")
+            fs.rmSync(plan.unitPath, { force: true });
+        return { kind: plan.kind, unitPath: plan.unitPath, removed: false, ...noted };
+    }
     let warning;
     switch (plan.kind) {
         case "launchd":
@@ -503,15 +656,20 @@ export function uninstallDaemonUnit(host, options, deps) {
         }
         case "schtasks": {
             // The lock may be stale; endWindowsDaemon kills only a verified daemon.
-            warning = endWindowsDaemon(deps.run, readPidLock(path.join(host.daemonDir, "daemon.pid")));
-            const del = deps.run("schtasks.exe", ["/Delete", "/TN", DAEMON_WINDOWS_TASK, "/F"]);
-            // Keep the XML so a later uninstall still finds the task.
-            if (del.status !== 0)
-                throw commandError(`schtasks /Delete /TN ${DAEMON_WINDOWS_TASK}`, del);
+            const tasks = [...(legacy.state === "mine" ? [LEGACY_DAEMON_WINDOWS_TASK] : []), ...userTasks];
+            warning = endWindowsDaemon(deps.run, readPidLock(path.join(host.daemonDir, "daemon.pid")), tasks);
+            for (const name of tasks) {
+                const del = deps.run("schtasks.exe", ["/Delete", "/TN", name, "/F"]);
+                // A task that is already gone counts as removed. Otherwise keep the
+                // XML so a later uninstall still finds the task.
+                if (del.status !== 0 && deps.run("schtasks.exe", ["/Query", "/TN", name]).status === 0) {
+                    throw commandError(`schtasks /Delete /TN ${name}`, del);
+                }
+            }
             break;
         }
     }
     fs.rmSync(plan.unitPath, { force: true });
-    return { kind: plan.kind, unitPath: plan.unitPath, removed: true, ...(warning ? { warning } : {}) };
+    return { kind: plan.kind, unitPath: plan.unitPath, removed: true, ...(warning ? { warning } : {}), ...noted };
 }
 //# sourceMappingURL=install.js.map

package/dist/lib/daemon/legacy.d.ts

@@ -5,7 +5,8 @@
  *
  * Detection reads unit files and checks for an orphaned loaded macOS mesh job
  * whose plist was removed. Windows scheduled tasks are probed through
- * schtasks. Nothing here stops or removes a unit.
+ * schtasks, and only a task that runs as the current user can be taken over.
+ * Nothing here stops or removes a unit.
  */
 import type { ServiceName } from "./catalog.js";
 export interface LegacyUnit {
@@ -15,9 +16,13 @@ export interface LegacyUnit {
     kind: "launchd" | "systemd-user" | "systemd-system" | "schtasks";
     name: string;
     path?: string;
-    /** False for units owned by another product (the desktop app's own agent). */
+    /** False for units owned by another product (the desktop app's own agent) or another Windows user. */
     migratable: boolean;
+    /** Why a unit that is not the desktop app's is still left alone (another Windows user's task). */
+    notMineReason?: string;
 }
+/** Whose Windows Scheduled Task a name refers to, as classifyWindowsTask reads it. */
+export type WindowsTaskOwner = "none" | "mine" | "other" | "unreadable";
 export interface LegacyProbeDeps {
     platform: NodeJS.Platform;
     home: string;
@@ -25,7 +30,8 @@ export interface LegacyProbeDeps {
     listDir: (dir: string) => string[];
     /** True when launchctl can print the GUI-domain job despite a missing plist. */
     launchdJobLoaded: (label: string) => boolean;
-    windowsTaskExists: (taskName: string) => boolean;
+    /** Whether the task exists and runs as the current user. Another user's task is never taken over. */
+    windowsTaskOwner: (taskName: string) => WindowsTaskOwner;
 }
 export declare function describeLegacyUnit(unit: LegacyUnit): string;
 export declare function findLegacyUnits(deps: LegacyProbeDeps): LegacyUnit[];

package/dist/lib/daemon/legacy.js

@@ -5,7 +5,8 @@
  *
  * Detection reads unit files and checks for an orphaned loaded macOS mesh job
  * whose plist was removed. Windows scheduled tasks are probed through
- * schtasks. Nothing here stops or removes a unit.
+ * schtasks, and only a task that runs as the current user can be taken over.
+ * Nothing here stops or removes a unit.
  */
 import * as path from "node:path";
 const KIT_SERVICES = ["sync", "inbox", "heartbeat"];
@@ -100,9 +101,15 @@ function linuxUnits(deps) {
 }
 function windowsUnits(deps) {
     const task = "ai.getindigo.hq-mesh-daemon";
-    return deps.windowsTaskExists(task)
-        ? [{ unitId: "mesh", service: "mesh", kind: "schtasks", name: task, migratable: true }]
-        : [];
+    const owner = deps.windowsTaskOwner(task);
+    if (owner === "none")
+        return [];
+    const unit = { unitId: "mesh", service: "mesh", kind: "schtasks", name: task, migratable: owner === "mine" };
+    if (owner === "other")
+        unit.notMineReason = "it belongs to another Windows user";
+    if (owner === "unreadable")
+        unit.notMineReason = "HQ could not read which Windows user it belongs to";
+    return [unit];
 }
 export function findLegacyUnits(deps) {
     if (deps.platform === "darwin")

package/dist/lib/daemon/migrate.js

@@ -136,7 +136,7 @@ export function adoptLegacyUnits(units, deps) {
     };
     for (const unit of units) {
         if (!unit.migratable) {
-            result.skipped.push({ unit, reason: "owned by the HQ desktop app" });
+            result.skipped.push({ unit, reason: unit.notMineReason ?? "owned by the HQ desktop app" });
             continue;
         }
         if (unit.kind === "systemd-system" && !deps.isRoot) {

package/dist/lib/daemon/run.d.ts

@@ -6,7 +6,8 @@
  * signing in takes effect without restarting the daemon.
  */
 import { type PlanContext, type ServiceName, type UnitPlan } from "./catalog.js";
-import { type LegacyUnit } from "./legacy.js";
+import { type SyncCoreVaultPlan } from "../sync-core/engine-home.js";
+import { type LegacyUnit, type WindowsTaskOwner } from "./legacy.js";
 import { type DaemonLockResult } from "./lock.js";
 import { type MachineType } from "./machine-type.js";
 import { type PickedHqCloud } from "./hq-cloud.js";
@@ -14,6 +15,7 @@ import { type HostApp, type Supervisor } from "./supervisor.js";
 export declare const LOG_ROTATE_BYTES: number;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export declare const RESTART_EXIT_CODE = 75;
+export declare function syncCoreVaultPlans(home: string, hqRoot: string | undefined, platform: NodeJS.Platform): SyncCoreVaultPlan[];
 export declare function planUnitsWithSyncCoreInterlock(services: readonly ServiceName[], context: PlanContext, supervisor: Pick<Supervisor, "runningPlanKey" | "state"> | null | undefined): UnitPlan[];
 /** A bounded shutdown deadline that can account for sync push persistence. */
 export declare function createShutdownCap(): {
@@ -99,7 +101,8 @@ export declare function daemonInstantSyncEnabled(env: NodeJS.ProcessEnv, configu
  * background service, so it is not one of them.
  */
 export declare function listLocalBots(root?: string): string[];
-export declare function windowsTaskExists(taskName: string): boolean;
+/** Whose task `taskName` is: only the current user's own task may be taken over. */
+export declare function windowsTaskOwner(taskName: string): WindowsTaskOwner;
 export declare function probeLegacyUnits(platform: NodeJS.Platform, home: string): LegacyUnit[];
 /** Absolute path of `name` on PATH, or null. */
 export declare function findOnPath(name: string, env?: NodeJS.ProcessEnv): string | null;