@nowcrew/daemon 0.6.98 → 0.6.99-beta.2

package/README.md

@@ -40,7 +40,40 @@ This compatibility form stays resident in the current terminal and reconnects wi
 `pnpm --filter @nowcrew/daemon daemon`. `crew-daemon run --agent <handle> --channel <id>` is the legacy
 manual one-shot entry.
 
-## Browser-Approved Computer Setup
+## Single-Command Computer Setup
+
+After the deployment enables Token setup, an owner/admin opens **Add Computer**, copies the complete
+command, and pastes it into the target computer's terminal. The same steps apply on macOS, Linux/SSH,
+and Windows. Node.js 22+ and npm must already be installed. The command launches the installer with npx;
+no separate global installation, browser confirmation, or verification code is needed during execution.
+
+The generated command pins an exact published installer version and includes a `--setup-token`.
+This is an already-approved one-time connection request, valid for ten minutes. The program exchanges
+it for the machine credential only when executed, then reuses native service installation, new-hello
+verification, credential finalization and rollback. Merely generating or copying a command does not
+rotate the existing credential. An expired or consumed command must be regenerated in the Web UI.
+
+For a machine credential you already hold, the same setup entry accepts `--api-key` or
+`CREW_MACHINE_TOKEN` without browser pairing:
+
+```bash
+nowwork-computer setup --server-url https://nowwork.nowcoder.com /nowcoder-app \
+  --machine <machine-uuid> --api-key <existing-machine-token>
+```
+
+The machine Token must match the specified Workspace and Computer. This path never rotates the
+credential or creates an approval request; it confirms a new control-plane connection with the expected
+profile and paths before reporting success. Token sources cannot be combined. JSON output puts progress
+on stderr and the final result on stdout. On Windows shells that block npm.ps1/npx.ps1, use npx.cmd as
+the package entry; the setup arguments and workflow are unchanged.
+
+Deployment requires `CREW_PUBLIC_URL` (or `CREW_SERVER_URL`) and
+`CREW_COMPUTER_TOKEN_SETUP_VERSION` set to an exact, published version known to support the Token flags.
+The server checks its published release catalog and channel before issuing a Token command. Leave the
+version unset until that installer has been released; it returns `computer_token_setup_unavailable`
+instead of generating a command for an unsupported package. Existing clients retain browser setup.
+
+## Browser-Approved Computer Setup (Compatibility)
 
 The Web UI generates a token-free command for a specific Workspace and Machine:
 
@@ -77,6 +110,15 @@ to confirm Workspace, Machine, environment, profile, and storage identity. It do
 existing `.crew` data. Existing `crew-daemon install --server-url ... --api-key ...` and profile lifecycle
 commands remain available as compatibility and recovery entry points.
 
+Profiles created by older installers may omit `workspaceId` and `machineId`. During setup, the installer
+uses the newly authorized machine credential to call `POST /daemon/computer-setup/legacy-profile` with
+the SHA-256 of the previous profile token. The server checks historical ownership within that exact
+Workspace and Machine, including revoked credentials, without reactivating them. After the server,
+profile name, Agent root and any existing identity fields match, normal installation persists both UUIDs.
+A mismatch or failed verification stops before changing the local profile or service; do not delete a
+profile or fill in UUIDs by guessing. Deploy the server endpoint before publishing the compatible daemon;
+an older server cannot verify legacy profiles, and already published daemon packages remain unchanged.
+
 ## Machine Environment
 
 The daemon loads exported variables from its OS account’s bash/zsh configuration on macOS/Linux,

package/dist/automatic-daemon-installer.js

@@ -1,7 +1,8 @@
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import { posix, win32 } from "node:path";
 import { z } from "zod";
-import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
+import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, resolveAgentsRoot, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
 import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { buildManagedServiceRecord, installManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
@@ -15,8 +16,14 @@ import { daemonRegistryCandidates } from "./daemon-registry.js";
 import { npmInvocation } from "./npm-command.js";
 import { discoverExactLegacyService, } from "./automatic-service-migration.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
-import { serverHostIdentity } from "./server-url.js";
-import { computerSetupRecoveryGuidance } from "./computer-setup-client.js";
+import { serverHostIdentity, serverUrlsMatch } from "./server-url.js";
+import { computerSetupRecoveryGuidance, createComputerSetupClient, } from "./computer-setup-client.js";
+export const automaticDaemonInstallStageMessage = {
+    downloading: "Downloading the Daemon package...",
+    configuring: "Configuring the Daemon service...",
+    starting: "Starting the Daemon service...",
+    confirming: "Confirming the computer connection...",
+};
 function profileStorage(platform, userHome, runner) {
     return {
         platform,
@@ -57,6 +64,7 @@ function defaultDependencies() {
         version: daemonVersion(),
         ...(process.env.PATH ? { runtimePath: process.env.PATH } : {}),
         runner,
+        verifyLegacyProfileIdentity: (serverUrl, input) => createComputerSetupClient({ serverUrl }).verifyLegacyProfileIdentity(input),
         captureProfile: async (target) => (await listProfiles(target.daemonHome)).includes(target.profile)
             ? loadProfile(target.profile, target.daemonHome, storage)
             : null,
@@ -260,18 +268,37 @@ function setupIdentity(input) {
         machineId: z.string().uuid().parse(input.machineId),
     };
 }
-function assertExistingProfileIdentity(previous, identity) {
+async function assertExistingProfileIdentity(previous, identity, target, machineToken, dependencies) {
     if (previous === null || identity === null)
         return;
-    if (previous.workspaceId === undefined || previous.machineId === undefined) {
-        throw new Error(`Profile '${previous.name}' does not record its Workspace and Machine identity`);
-    }
-    if (previous.workspaceId !== identity.workspaceId) {
+    if (previous.workspaceId !== undefined && previous.workspaceId !== identity.workspaceId) {
         throw new Error(`Profile '${previous.name}' belongs to a different Workspace identity`);
     }
-    if (previous.machineId !== identity.machineId) {
+    if (previous.machineId !== undefined && previous.machineId !== identity.machineId) {
         throw new Error(`Profile '${previous.name}' belongs to a different Machine identity`);
     }
+    if (previous.workspaceId !== undefined && previous.machineId !== undefined)
+        return;
+    const rootIdentity = (root) => {
+        const resolved = resolveAgentsRoot(root, dependencies.userHome, dependencies.platform);
+        return dependencies.platform === "win32" ? resolved.toLowerCase() : resolved;
+    };
+    if (previous.name !== target.profile || !serverUrlsMatch(previous.serverUrl, target.serverUrl)
+        || rootIdentity(previous.agentsRoot) !== rootIdentity(target.agentsRoot)) {
+        throw new Error(`Legacy profile '${previous.name}' does not match the requested server, profile, or Agent root`);
+    }
+    if (dependencies.verifyLegacyProfileIdentity === undefined) {
+        throw new Error(`Cannot verify legacy profile '${previous.name}' Workspace and Machine identity`);
+    }
+    // The old credential may already have been revoked by setup. Only the current credential
+    // authenticates this read-only request; the old hash proves historical ownership.
+    const verified = await dependencies.verifyLegacyProfileIdentity(target.serverUrl, {
+        machineToken,
+        previousTokenHash: createHash("sha256").update(previous.machineToken).digest("hex"),
+    });
+    if (verified.workspaceId !== identity.workspaceId || verified.machineId !== identity.machineId) {
+        throw new Error(`Legacy profile '${previous.name}' belongs to a different Workspace or Machine identity`);
+    }
 }
 export async function installDaemonAutomatically(input, dependencies = defaultDependencies()) {
     const machineToken = MachineTokenSchema.parse(input.machineToken);
@@ -308,7 +335,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
     });
     const previousProfile = await dependencies.captureProfile(target);
     await dependencies.assertProfileTarget(target, previousProfile);
-    assertExistingProfileIdentity(previousProfile, identity);
+    await assertExistingProfileIdentity(previousProfile, identity, target, machineToken, dependencies);
     const previousService = await dependencies.captureService(spec, target);
     if (previousService.installed && !previousService.exact) {
         throw new Error(`Installed service '${spec.id}' does not match the requested identity`);
@@ -331,6 +358,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
         });
         let installFailure;
         try {
+            input.onProgress?.("downloading");
             await dependencies.installPackage(target.npmPrefix, dependencies.version, dependencies.platform, dependencies.runner, target.registryUrl);
         }
         catch (error) {
@@ -353,6 +381,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
             legacyRemovalStarted = true;
             await dependencies.removeLegacyService(legacyService);
         }
+        input.onProgress?.("configuring");
         profileSaved = true;
         await dependencies.saveTargetProfile({
             version: 1,
@@ -367,6 +396,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
         }, target.daemonHome);
         serviceReplacementStarted = true;
         await dependencies.replaceService(spec, target);
+        input.onProgress?.("starting");
         await dependencies.startService(spec);
         const status = await dependencies.verifyService(spec);
         if (!status.running)
@@ -380,6 +410,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
             daemonHome: target.daemonHome,
             agentsRoot: target.agentsRoot,
         };
+        input.onProgress?.("confirming");
         await input.verifyAfterStart?.(result);
         return result;
     }

package/dist/automatic-service-migration.js

@@ -3,6 +3,8 @@ import { posix, win32 } from "node:path";
 import { buildServiceSpec, serviceStatus, windowsCommandArg, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { inspectLegacyServiceInstallationDetails } from "./legacy-service-installation.js";
+import { powershellCommandArgs } from "./powershell-command.js";
+import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -142,12 +144,11 @@ async function discoverWindows(input, identity) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
-        "[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+        "$task=$tasks[0];$actions=@($task.Actions);",
+        windowsTaskPrincipalScript,
+        `[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
     ].join("");
-    const result = await input.runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encoded(identity.id),
-    ]);
+    const result = await input.runner("powershell.exe", powershellCommandArgs(script, [encoded(identity.id)]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect legacy scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -165,7 +166,7 @@ async function discoverWindows(input, identity) {
         : null;
     if (definition.count !== 1
         || definition.actionCount !== 1
-        || definition.principalMatches !== true
+        || !windowsTaskPrincipalMatches(definition)
         || !win32.isAbsolute(definition.execute ?? "")
         || match === null
         || match[2] !== input.desired.profile

package/dist/computer-service.js

@@ -6,10 +6,14 @@ import { promisify } from "node:util";
 import { dirname, resolve } from "node:path";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
 import { daemonRegistryCandidates } from "./daemon-registry.js";
+import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 import { npmInvocation } from "./npm-command.js";
+import { powershellCommandArgs } from "./powershell-command.js";
 const execFileAsync = promisify(execFile);
 const WINDOWS_STOP_TIMEOUT_MS = 5_000;
 const WINDOWS_STOP_POLL_MS = 100;
+const DARWIN_STOP_TIMEOUT_MS = 30_000;
+const DARWIN_STOP_POLL_MS = 100;
 /** Windows cannot spawn .cmd/.bat shims directly with shell:false; route them through cmd.exe explicitly. */
 export function systemCommandInvocation(command, args, platform = process.platform, comSpec = process.env.ComSpec ?? process.env.COMSPEC ?? "cmd.exe") {
     if (platform === "win32" && /\.(?:cmd|bat)$/iu.test(command)) {
@@ -184,6 +188,32 @@ async function checked(runner, command, args, action) {
     }
     return result;
 }
+async function stopLaunchdService(spec, initial, runner) {
+    const assertQueryable = (result) => {
+        // launchctl uses 113 for an absent service. Other failures cannot prove it stopped.
+        if (result.exitCode !== 0 && result.exitCode !== 113) {
+            throw new Error(`launchd status failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`}`);
+        }
+    };
+    assertQueryable(initial);
+    if (initial.exitCode === 113)
+        return;
+    const target = `${spec.managerDomain}/${spec.id}`;
+    await checked(runner, "launchctl", ["bootout", target], "launchd stop");
+    const deadline = Date.now() + DARWIN_STOP_TIMEOUT_MS;
+    while (true) {
+        const current = await runner("launchctl", ["print", target]);
+        assertQueryable(current);
+        if (current.exitCode === 113)
+            return;
+        // bootout returns while the job is SIGTERMed and still owns its installation lease.
+        // Wait for removal, not merely a non-running state, before installing or bootstrapping.
+        if (Date.now() >= deadline) {
+            throw new Error(`launchd service '${spec.id}' did not unload within ${DARWIN_STOP_TIMEOUT_MS}ms`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, DARWIN_STOP_POLL_MS));
+    }
+}
 function sameWindowsPath(left, right) {
     return left !== undefined
         && left.replaceAll("/", "\\").toLowerCase() === right.replaceAll("/", "\\").toLowerCase();
@@ -195,12 +225,11 @@ async function windowsTaskDefinitionMatches(spec, runner) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
-        "[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+        "$task=$tasks[0];$actions=@($task.Actions);",
+        windowsTaskPrincipalScript,
+        `[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
-    ]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect scheduled task definition: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -214,7 +243,7 @@ async function windowsTaskDefinitionMatches(spec, runner) {
     const expectedArguments = spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ");
     return definition.count === 1
         && definition.actionCount === 1
-        && definition.principalMatches === true
+        && windowsTaskPrincipalMatches(definition)
         && sameWindowsPath(definition.execute, spec.daemonCommand[0])
         && definition.arguments === expectedArguments;
 }
@@ -226,9 +255,7 @@ async function windowsTaskState(spec, runner) {
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -eq 0){'missing'}elseif($tasks.Count -eq 1){'state:'+([int]$tasks[0].State)}else{throw 'duplicate scheduled tasks'}",
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
-    ]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to query scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -279,10 +306,9 @@ export async function installService(spec, runner = systemCommandRunner) {
             "$principal=New-ScheduledTaskPrincipal -UserId $identity -LogonType Interactive -RunLevel Limited;",
             "Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -ErrorAction Stop|Out-Null;",
         ].join("");
-        await checked(runner, "powershell.exe", [
-            "-NoProfile", "-NonInteractive", "-Command", script,
+        await checked(runner, "powershell.exe", powershellCommandArgs(script, [
             encodedName, encodedExecutable, encodedArguments,
-        ], "Scheduled task installation");
+        ]), "Scheduled task installation");
         return;
     }
     if (spec.descriptorPath === null || spec.descriptor === null)
@@ -358,9 +384,7 @@ export async function uninstallService(spec, runner = systemCommandRunner) {
     }
     if (spec.platform === "darwin") {
         const status = await serviceStatus(spec, runner);
-        if (status.loaded) {
-            await checked(runner, "launchctl", ["bootout", `${spec.managerDomain}/${spec.id}`], "launchd bootout");
-        }
+        await stopLaunchdService(spec, status, runner);
     }
     else {
         const disable = await runner("systemctl", ["--user", "disable", "--now", spec.id]);
@@ -387,8 +411,7 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
                 await checked(runner, "launchctl", ["bootstrap", spec.managerDomain, spec.descriptorPath], "launchd start");
         }
         else if (action === "stop") {
-            if (status.loaded)
-                await checked(runner, "launchctl", ["bootout", target], "launchd stop");
+            await stopLaunchdService(spec, status, runner);
         }
         else {
             if (status.loaded)
@@ -418,6 +441,33 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
     }
 }
 const systemDetachedSpawn = (command, args, options) => spawn(command, [...args], options);
+function windowsRestartCommandArgs(spec) {
+    if (!spec.runtimeProcessIdentity)
+        throw new Error("Windows daemon process identity is required for restart");
+    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
+    const encodedExecutable = Buffer.from(spec.daemonCommand[0], "utf16le").toString("base64");
+    const encodedArguments = Buffer.from(spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "), "utf16le").toString("base64");
+    const script = [
+        "$ErrorActionPreference='Stop';",
+        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
+        "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
+        "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
+        "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
+        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+        "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
+        "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
+        "$p.Kill();",
+        "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
+        "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
+        "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
+        "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
+        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+        "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
+    ].join("");
+    return powershellCommandArgs(script, [
+        String(process.pid), encodedName, encodedExecutable, encodedArguments, spec.runtimeProcessIdentity,
+    ]);
+}
 const RESTART_HELPER_SOURCE = String.raw `
 const { spawnSync } = require("node:child_process");
 const spec = JSON.parse(process.argv[1]);
@@ -428,27 +478,7 @@ setTimeout(() => {
   } else if (spec.platform === "linux") {
     restarted = spawnSync("systemctl", ["--user", "--no-block", "restart", spec.id], { stdio: "ignore", shell: false });
   } else {
-    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
-    const encodedExecutable = Buffer.from(spec.executable, "utf16le").toString("base64");
-    const encodedArguments = Buffer.from(spec.arguments, "utf16le").toString("base64");
-    const script = [
-      "$ErrorActionPreference='Stop';",
-      "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
-      "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
-      "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
-      "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
-      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-      "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
-      "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
-      "$p.Kill();",
-      "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
-      "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
-      "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
-      "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
-      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-      "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
-    ].join("");
-    restarted = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, String(spec.daemonPid), encodedName, encodedExecutable, encodedArguments, spec.processIdentity], { stdio: "ignore", shell: false });
+    restarted = spawnSync("powershell.exe", spec.powershellArgs, { stdio: "ignore", shell: false });
   }
   if (restarted.status !== 0) process.send?.({ type: "restart-failed", status: restarted.status });
   setTimeout(() => {
@@ -470,15 +500,8 @@ export function scheduleServiceRestart(spec, spawnDetached = systemDetachedSpawn
             ? { platform: spec.platform, id: spec.id }
             : {
                 platform: spec.platform,
-                id: spec.id,
-                daemonPid: process.pid,
-                executable: spec.daemonCommand[0],
-                arguments: spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "),
-                processIdentity: spec.runtimeProcessIdentity,
+                powershellArgs: windowsRestartCommandArgs(spec),
             };
-    if (spec.platform === "win32" && !payload.processIdentity) {
-        throw new Error("Windows daemon process identity is required for restart");
-    }
     const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"], shell: false });
     child.unref();
     let settleFailure;
@@ -627,7 +650,7 @@ export async function windowsProfileIsPrivate(path, runner = systemCommandRunner
         "$unsafe=$rules|Where-Object { $_.AccessControlType -eq 'Allow' -and $safe -notcontains $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value };",
         "if($unsafe){'false'}else{'true'}",
     ].join("");
-    const result = await runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, encodedPath]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedPath]));
     if (result.exitCode !== 0)
         throw new Error(`Profile ACL inspection failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     if (result.stdout.trim() === "true")

package/dist/computer-setup-client.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { hostname } from "node:os";
 import { MachineTokenSchema } from "./computer-profile.js";
+import { powershellCommandArgs } from "./powershell-command.js";
 import { systemCommandRunner, } from "./computer-service.js";
 const HttpUrlSchema = z.string().url().refine((value) => {
     const url = new URL(value);
@@ -38,6 +39,26 @@ const SetupBootstrapSchema = z.object({
     expiresAt: z.string().datetime({ offset: true }).optional(),
     machineToken: MachineTokenSchema,
 }).strict();
+const SetupTokenTargetSchema = SetupBootstrapSchema.omit({ setupId: true, machineToken: true }).extend({
+    workspaceSlug: z.string().min(1).max(80),
+    releaseTag: z.enum(["latest", "beta"]),
+    connection: z.object({
+        status: z.enum(["online", "offline"]),
+        epoch: z.number().int().nonnegative(),
+        profile: z.string().nullable(),
+        daemonHome: z.string().nullable(),
+        agentsRoot: z.string().nullable(),
+        storageId: z.string().optional(),
+        credentialMatchesConnection: z.boolean(),
+    }).strict(),
+}).strict();
+const SetupReceiptSchema = z.object({
+    setupId: z.string().uuid(),
+    credentialState: z.enum(["pending", "finalized"]),
+    target: SetupTokenTargetSchema.omit({ connection: true }),
+    connection: SetupTokenTargetSchema.shape.connection,
+    connectionConfirmed: z.boolean(),
+}).strict();
 const SetupPendingSchema = z.object({
     status: z.enum(["authorization_pending", "pending"]),
     intervalSeconds: z.number().int().positive().max(300).optional(),
@@ -75,7 +96,8 @@ export class ComputerSetupHttpError extends Error {
     }
 }
 export function redactSetupSecrets(value, secrets = []) {
-    let redacted = value.replace(/\bsk_machine_[A-Za-z0-9_-]+\b/gu, "<redacted>");
+    let redacted = value.replace(/\bsk_machine_[A-Za-z0-9_-]+\b/gu, "<redacted>")
+        .replace(/(--setup-token(?:=|\s+))[A-Za-z0-9_-]+/gu, "$1<redacted>");
     for (const secret of secrets) {
         if (secret.length > 0)
             redacted = redacted.replaceAll(secret, "<redacted>");
@@ -236,8 +258,9 @@ export function createComputerSetupClient(options) {
         setTimeout(resolve, milliseconds);
     }));
     const now = options.now ?? Date.now;
-    let activeMachineId;
     const request = async (method, path, body, bearer) => {
+        const secretInputs = [bearer ?? "", body?.deviceCode ?? "",
+            body?.setupToken ?? ""];
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
         try {
@@ -252,7 +275,7 @@ export function createComputerSetupClient(options) {
             });
             const payload = await response.json();
             if (!response.ok || payload?.success === false) {
-                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`);
+                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`, secretInputs);
                 throw new ComputerSetupHttpError(message, response.status, payload?.error?.code ?? `HTTP_${response.status}`);
             }
             return (payload?.success === true ? payload.data : payload);
@@ -262,15 +285,26 @@ export function createComputerSetupClient(options) {
                 throw new Error("computer setup request timed out");
             if (error instanceof ComputerSetupHttpError)
                 throw error;
-            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error)));
+            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error), secretInputs));
         }
         finally {
             clearTimeout(timeoutId);
         }
     };
     return {
+        receipt: async ({ setupToken, machineToken }) => {
+            const receipt = SetupReceiptSchema.safeParse(await request("POST", "/daemon/computer-setup/receipt", { setupToken }, machineToken));
+            if (!receipt.success)
+                throw new Error("Invalid computer setup receipt response");
+            return receipt.data;
+        },
+        tokenTarget: async (machineToken) => SetupTokenTargetSchema.parse(await request("GET", "/daemon/computer-setup/target", undefined, machineToken)),
+        verifyLegacyProfileIdentity: async (input) => z.object({
+            workspaceId: z.string().uuid(), machineId: z.string().uuid(),
+        }).strict().parse(await request("POST", "/daemon/computer-setup/legacy-profile", {
+            previousTokenHash: input.previousTokenHash,
+        }, input.machineToken)),
         start: async (input) => {
-            activeMachineId = input.machineId;
             return parseStart(await request("POST", "/api/auth/computer-setup/start", {
                 ...(input.workspace.kind === "id"
                     ? { workspaceId: input.workspace.value }
@@ -281,8 +315,6 @@ export function createComputerSetupClient(options) {
             }));
         },
         poll: async (deviceCode) => {
-            if (activeMachineId === undefined)
-                throw new Error("computer setup polling has no active machine");
             return parsePoll(await request("POST", "/api/auth/computer-setup/poll", { deviceCode }));
         },
         waitForHello: async (input) => {
@@ -309,8 +341,10 @@ export function createComputerSetupClient(options) {
     };
 }
 export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
-    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
-    const args = [url];
+    const command = platform === "win32" ? "powershell.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = platform === "win32"
+        ? powershellCommandArgs("Start-Process -FilePath $args[0] -ErrorAction Stop | Out-Null", [url])
+        : [url];
     const result = await runner(command, args);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);