@remcp/remcp 0.2.205 → 0.2.206

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.205",
+  "version": "0.2.206",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/cli/env.mjs

@@ -17,6 +17,12 @@ export const macServiceFile = path.join(home, 'Library', 'LaunchAgents', `${macS
 export const macLogFile = path.join(home, 'Library', 'Logs', 'remcp-agent.log');
 export const windowsTaskName = 'ReMCP Agent';
 export const windowsServiceLauncherFile = path.join(configDir, 'remcp-agent.cmd');
+// Task Scheduler may refuse to create a task for a standard Windows account.
+// This per-user Startup folder runs without administrator privileges.
+export const windowsStartupScriptFile = path.join(
+  process.env.APPDATA || path.join(home, 'AppData', 'Roaming'),
+  'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'ReMCP Agent.vbs'
+);
 // How npm is invoked is resolved from the running node when possible: a background service has a
 // minimal PATH, which is why auto-update used to find no npm on macOS. See src/npm.mjs.
 export const npm = resolveNpm();

package/src/cli/service-inventory.mjs

@@ -4,8 +4,9 @@ import process from 'node:process';
 import { spawnSync } from 'node:child_process';
 import { PACKAGE_NAME, VERSION } from '../version.mjs';
 import { saveConfig } from './config.mjs';
-import { linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsTaskName } from './env.mjs';
+import { linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsStartupScriptFile, windowsTaskName } from './env.mjs';
 import { servicePlatform, globalCliPath, npmGlobalUpdateForNode } from './npm-global.mjs';
+import { windowsStartupScriptInstalled } from './windows-supervisor.mjs';
 
 export function persistentServiceExpected(config) {
   if (config?.serviceInstalled === false) return false;
@@ -14,7 +15,8 @@ export function persistentServiceExpected(config) {
   if (platform === 'linux') return fs.existsSync(linuxServiceFile);
   if (platform === 'darwin') return fs.existsSync(macServiceFile);
   if (platform === 'win32') {
-    return spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName], { stdio: 'ignore' }).status === 0;
+    return windowsStartupScriptInstalled(windowsStartupScriptFile) ||
+      spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName], { stdio: 'ignore' }).status === 0;
   }
   return false;
 }
@@ -38,6 +40,11 @@ export function persistentServiceState(config) {
     const installed = query.status === 0;
     const outputText = String(query.stdout || '');
     const active = installed && /(?:Status|Состояние):\s*Running/i.test(outputText);
+    if (!installed && windowsStartupScriptInstalled(windowsStartupScriptFile)) {
+      // Startup has no OS status query comparable to Task Scheduler; do not report a
+      // running process without evidence. Device presence is tracked separately.
+      return { expected, installed:true, active:null, manager:'startup-user', name:windowsTaskName };
+    }
     return { expected, installed, active, manager:'schtasks', name:windowsTaskName };
   }
   return { expected:false, installed:false, active:false, manager:null, name:null };

package/src/cli/service.mjs

@@ -15,9 +15,10 @@ export { macLaunchDomain, ensureMacCliCommand, installMacService } from './servi
 import { PACKAGE_NAME, VERSION } from '../version.mjs';
 
 import { saveConfig } from './config.mjs';
-import { configDir, home, linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsServiceLauncherFile, windowsTaskName } from './env.mjs';
+import { configDir, home, linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsServiceLauncherFile, windowsStartupScriptFile, windowsTaskName } from './env.mjs';
 import { run } from './shell.mjs';
-import { windowsServiceLauncherText, windowsTaskReliabilityCommand } from './windows-supervisor.mjs';
+import { windowsServiceLauncherText, windowsTaskReliabilityCommand, windowsTaskAbsenceCommand, windowsBatchUnsafeProfile, windowsStartupScriptText, windowsStartupScriptInstalled } from './windows-supervisor.mjs';
+import { ensureWindowsSupervisorKey, windowsSupervisorCommand } from './windows-user-supervisor.mjs';
 
 export function quoteSystemd(value) {
   return `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
@@ -77,17 +78,106 @@ export function writeWindowsServiceLauncher(cliPath = globalCliPath(), nodePath
   return windowsServiceLauncherFile;
 }
 
+function installWindowsUserStartup(cliPath, nodePath) {
+  const existed = fs.existsSync(windowsStartupScriptFile);
+  if (existed && !windowsStartupScriptInstalled(windowsStartupScriptFile)) {
+    throw new Error('The ReMCP Startup entry is not owned by ReMCP; refusing to overwrite it');
+  }
+  // Windows npm exposes a .cmd shim; the child must execute the actual Node ESM entry.
+  const cliEntry = path.join(path.dirname(cliPath), 'node_modules', '@remcp', 'remcp', 'bin', 'remcp.mjs');
+  const supervisorEntry = path.resolve(path.dirname(cliEntry), '../src/cli/windows-user-supervisor.mjs');
+  if (!fs.existsSync(cliEntry)) throw new Error('Windows ReMCP Node entry is missing');
+  if (!fs.existsSync(supervisorEntry)) throw new Error('Windows supervisor entry is missing from the installed ReMCP package');
+  ensureWindowsSupervisorKey();
+  const script = windowsStartupScriptText(nodePath, supervisorEntry, cliEntry);
+  fs.mkdirSync(path.dirname(windowsStartupScriptFile), { recursive:true });
+  const temporary = `${windowsStartupScriptFile}.${process.pid}.tmp`;
+  try {
+    // WSH requires a Unicode BOM to preserve non-ASCII Windows account names.
+    fs.writeFileSync(temporary, '\uFEFF' + script, { flag:'wx', mode:0o600, encoding:'utf16le' });
+    fs.renameSync(temporary, windowsStartupScriptFile);
+  } finally { try { fs.unlinkSync(temporary); } catch {} }
+  const startAndVerify = () => {
+    run('wscript.exe', ['//B', '//Nologo', windowsStartupScriptFile]);
+    const state = windowsSupervisorCommand('wait');
+    if (!state.running) throw new Error('Windows Startup agent did not launch');
+  };
+  // Reuse a running singleton. A missing OS-held pipe means the old supervisor
+  // exited: relaunch the same verified entry without touching device credentials.
+  if (existed) {
+    try {
+      const state = windowsSupervisorCommand('status');
+      if (!state.running) throw new Error('The existing Windows Startup agent is not running');
+    } catch (error) {
+      const reason = String(error.message || '');
+      if (!reason.includes('ENOENT') && !reason.includes('ECONNREFUSED')) throw error;
+      startAndVerify();
+    }
+  } else {
+    try { startAndVerify(); }
+    catch (error) {
+      // A launched supervisor can be alive when readiness fails. Stop it before cleanup.
+      try { windowsSupervisorCommand('stop'); } catch {}
+      try { fs.unlinkSync(windowsStartupScriptFile); } catch {}
+      throw error;
+    }
+  }
+  console.log('ReMCP uses this Windows account\'s Startup folder (no administrator rights required).');
+}
+
+function requireWindowsScheduledTaskAbsent() {
+  // A failed schtasks /Query is ambiguous across Windows languages and ACLs.
+  // Fail closed if COM cannot prove absence before choosing another startup route.
+  const existing = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive',
+    '-Command', windowsTaskAbsenceCommand(windowsTaskName)],
+    { encoding:'utf8', windowsHide:true, timeout:10000, maxBuffer:4096, input:'' });
+  if (existing.error || existing.status !== 0 || String(existing.stdout || '').trim() !== 'ABSENT') {
+    throw new Error('Could not prove that the ReMCP scheduled task is absent; refusing to start a competing agent');
+  }
+}
+
 export function installWindowsService(cliPath = globalCliPath(), { nodePath = process.execPath } = {}) {
+  if (windowsStartupScriptInstalled(windowsStartupScriptFile)) {
+    installWindowsUserStartup(cliPath, nodePath);
+    return;
+  }
+  if (windowsBatchUnsafeProfile(cliPath, nodePath, windowsServiceLauncherFile)) {
+    requireWindowsScheduledTaskAbsent();
+    console.log('ReMCP: Unicode or shell-sensitive Windows profile; using the per-user Startup supervisor.');
+    installWindowsUserStartup(cliPath, nodePath);
+    return;
+  }
   const launcherFile = writeWindowsServiceLauncher(cliPath, nodePath);
   const command = `"${launcherFile}"`;
-  // Computer-use needs the signed-in interactive desktop. Create the task with /IT from the start
-  // instead of changing it afterwards: schtasks /Change can request the account password even when
-  // the task already belongs to the current user, which turns a one-command install into a prompt.
-  run('schtasks.exe', ['/Create', '/TN', windowsTaskName, '/TR', command, '/SC', 'ONLOGON', '/RL', 'HIGHEST', '/IT', '/F']);
-  // The default Windows task policy expires long-running tasks and stops them on battery.
-  // Apply guarded failure recovery without changing the interactive-user principal/session.
-  run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', windowsTaskReliabilityCommand(windowsTaskName)]);
-  run('schtasks.exe', ['/Run', '/TN', windowsTaskName]);
+  // Current-user interactive tasks need /IT. /RL LIMITED avoids requiring elevation.
+  // An organization may still disable creation of all tasks by standard users.
+  const created = spawnSync('schtasks.exe',
+    ['/Create', '/TN', windowsTaskName, '/TR', command, '/SC', 'ONLOGON', '/RL', 'LIMITED', '/IT', '/F'],
+    { encoding:'utf8', timeout:15000, maxBuffer:64 * 1024, windowsHide:true, input:'' });
+  if (created.error || created.status !== 0) {
+    requireWindowsScheduledTaskAbsent();
+    console.warn('Windows Task Scheduler rejected task creation; switching to per-user Startup.');
+    installWindowsUserStartup(cliPath, nodePath);
+    return;
+  }
+  // Recovery tuning is optional; a policy denying Set-ScheduledTask must not invalidate
+  // a successfully created and runnable interactive task.
+  try {
+    run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', windowsTaskReliabilityCommand(windowsTaskName)]);
+  } catch (error) {
+    console.warn(`ReMCP task recovery settings were not applied: ${error.message}`);
+  }
+  try {
+    run('schtasks.exe', ['/Run', '/TN', windowsTaskName], { timeout:15000 });
+  } catch (error) {
+    // We just created this task. Remove it before registering another launcher, so
+    // a delayed logon cannot start competing agents under two supervisors.
+    const removed = spawnSync('schtasks.exe', ['/Delete', '/TN', windowsTaskName, '/F'],
+      { stdio:'ignore', timeout:10000 });
+    if (removed.status !== 0) throw error;
+    console.warn('Windows Task Scheduler could not start ReMCP; using per-user Startup.');
+    installWindowsUserStartup(cliPath, nodePath);
+  }
 }
 
 // `serviceInstalled` was added after background services already existed in the wild. Treat an
@@ -119,13 +209,13 @@ export function configureMacWriteAccess() {
 }
 
 export function configureWindowsWriteAccess() {
-  // installWindowsService already creates the task as HighestAvailable + InteractiveToken. Keep
-  // post-install access setup non-interactive so a fresh install never asks for the Windows password.
+  // The interactive task runs at LIMITED privilege, or the current-user Startup folder
+  // provides a non-elevated fallback. Neither installation requires a Windows password.
   try {
     const workspaceDir = path.join(process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local'), 'ReMCP');
     fs.mkdirSync(workspaceDir, { recursive: true });
   } catch {}
-  console.log('ReMCP configured with the highest available user privileges for interactive desktop access.');
+  console.log('ReMCP uses this account\'s interactive desktop privileges.');
 }
 
 export function configureLinuxWriteAccess() {
@@ -268,6 +358,11 @@ export function restartPersistentServiceIfInstalled(config, { deferLinux = false
     return macServiceLabel;
   }
   if (platform === 'win32') {
+    if (windowsStartupScriptInstalled(windowsStartupScriptFile)) {
+      const state = windowsSupervisorCommand('restart');
+      if (state.restartScheduled !== true) throw new Error('Windows user supervisor did not schedule a restart');
+      return 'ReMCP user startup supervisor (restart scheduled)';
+    }
     const result = spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName], { stdio: 'ignore' });
     if (result.status === 0) {
       // /Run does not restart a task that is already running; stop the previous
@@ -292,6 +387,20 @@ export function uninstallPersistentService() {
     try { fs.unlinkSync(macServiceFile); } catch {}
     removeMacCliCommand();
   } else if (platform === 'win32') {
+    if (windowsStartupScriptInstalled(windowsStartupScriptFile)) {
+      // Removing Startup alone leaves the already spawned agent alive. Stop the
+      // exact child owned by the authenticated singleton, then remove registration.
+      try {
+        const result = windowsSupervisorCommand('stop');
+        if (!result.stopped) throw new Error('Windows user agent could not be stopped');
+      } catch (error) {
+        // An already-exited supervisor has no listening pipe. That is the one safe
+        // case where removal may proceed without an acknowledged stop. Never ignore
+        // a bad MAC, access denied, timeout, or a failed owned-child termination.
+        if (!/\bconnect (?:ENOENT|ECONNREFUSED)\b/.test(String(error?.message || ''))) throw error;
+      }
+      fs.unlinkSync(windowsStartupScriptFile);
+    }
     spawnSync('schtasks.exe', ['/End', '/TN', windowsTaskName], { stdio: 'ignore' });
     spawnSync('schtasks.exe', ['/Delete', '/TN', windowsTaskName, '/F'], { stdio: 'ignore' });
     try { fs.unlinkSync(windowsServiceLauncherFile); } catch {}

package/src/cli/windows-supervisor.mjs

@@ -1,26 +1,59 @@
 // Recovery for the signed-in user's interactive ReMCP agent on Windows.
 // The desktop UI cannot run in Session 0: this intentionally retains /IT and ONLOGON.
 import path from 'node:path';
+import fs from 'node:fs';
+import process from 'node:process';
 
 function windowsBatchValue(value) {
   // cmd.exe expands % even inside quoted strings. Escape user-controlled prefix paths.
   return String(value).replaceAll('%', '%%');
 }
 
-export function windowsServiceLauncherText(cliPath, nodePath) {
+function windowsBatchLauncherValue(value) {
+  // This trusted variable reference must expand at runtime, not become literal %%.
+  const runtime = '%LOCALAPPDATA%\\ReMCP\\runtime';
+  return value === runtime || value === runtime + '\\remcp.cmd'
+    ? value : windowsBatchValue(value);
+}
+
+// CMD cannot reliably resolve paths containing characters outside the active OEM
+// codepage. Use the Unicode Windows Script Host supervisor instead of batch tasks
+// whenever any launcher path contains non-ASCII or command metacharacters.
+export function windowsBatchUnsafeProfile(...paths) {
+  return paths.some(value => /[^\x20-\x7e]|[&!%^]/.test(String(value || '')));
+}
+
+export function windowsServiceLauncherText(cliPath, nodePath, { localAppData = process.env.LOCALAPPDATA } = {}) {
   // Tests can simulate win32 from a POSIX runner with injected temporary paths.
   // Native Windows paths always use win32 parsing; POSIX-shaped fixtures keep their roots.
   const dirname = file => /^[A-Za-z]:[\\/]/.test(file) || file.includes('\\')
     ? path.win32.dirname(file) : path.dirname(file);
-  const prefix = dirname(cliPath);
-  const nodeDir = dirname(nodePath);
+  let prefix = dirname(cliPath);
+  let nodeDir = dirname(nodePath);
+  // .cmd is decoded using the active Windows codepage, not necessarily UTF-8.
+  // Keep the body ASCII if the CLI/Node live under this user's managed runtime.
+  // This also handles all locale-specific account names and literal %/! in paths.
+  if (typeof localAppData === 'string' && localAppData.trim()) {
+    const canonical = path.win32.resolve(localAppData, 'ReMCP', 'runtime');
+    if (path.win32.normalize(prefix).toLowerCase() === canonical.toLowerCase()) {
+      prefix = '%LOCALAPPDATA%\\ReMCP\\runtime';
+    }
+    if (path.win32.normalize(nodeDir).toLowerCase() === canonical.toLowerCase()) {
+      nodeDir = '%LOCALAPPDATA%\\ReMCP\\runtime';
+    }
+  }
+  const safeCliPath = prefix === '%LOCALAPPDATA%\\ReMCP\\runtime'
+    ? '%LOCALAPPDATA%\\ReMCP\\runtime\\remcp.cmd' : cliPath;
+  if ([prefix, nodeDir, safeCliPath].some(s => /[^\x20-\x7e]/.test(s))) {
+    throw new Error('Windows batch launcher cannot safely encode this Unicode path outside the managed runtime');
+  }
   return [
     '@echo off',
     'setlocal DisableDelayedExpansion',
-    `set "NPM_CONFIG_PREFIX=${windowsBatchValue(prefix)}"`,
-    `set "PATH=${windowsBatchValue(nodeDir)};%PATH%"`,
+    `set "NPM_CONFIG_PREFIX=${windowsBatchLauncherValue(prefix)}"`,
+    `set "PATH=${windowsBatchLauncherValue(nodeDir)};%PATH%"`,
     ':remcp_restart',
-    `call "${windowsBatchValue(cliPath)}" start --service`,
+    `call "${windowsBatchLauncherValue(safeCliPath)}" start --service`,
     // Restart even after a clean unexpected exit. A deliberate stop ends the Scheduled Task
     // process tree, so this supervisor cannot resurrect an intentionally stopped service.
     'rem Reconnect after an interrupted upgrade or a transient crash without logging in again.',
@@ -32,6 +65,71 @@ export function windowsServiceLauncherText(cliPath, nodePath) {
   ].join('\r\n');
 }
 
+export const WINDOWS_STARTUP_MARKER = "' ReMCP managed user startup (do not edit)";
+
+// Start the existing private launcher in the interactive user's session without displaying
+// a permanent console window. Do not interpolate the path into cmd.exe or PowerShell.
+export function windowsStartupScriptText(nodePath, supervisorPath, cliEntry) {
+  for (const value of [nodePath, supervisorPath, cliEntry]) {
+    if (typeof value !== 'string' || !value || /["\0\r\n]/.test(value) ||
+        !(path.isAbsolute(value) || path.win32.isAbsolute(value))) {
+      throw new Error('Invalid ReMCP Windows supervisor path');
+    }
+  }
+  // VBScript quotes each trusted absolute executable/argument path, with no cmd.exe
+  // or PowerShell interpolation. The supervisor owns its agent child and IPC endpoint.
+  return [
+    WINDOWS_STARTUP_MARKER,
+    'Set remcpShell = CreateObject("WScript.Shell")',
+    `remcpShell.Run Chr(34) & "${nodePath}" & Chr(34) & " " & Chr(34) & "${supervisorPath}" & Chr(34) & " serve " & Chr(34) & "${cliEntry}" & Chr(34), 0, False`,
+    '',
+  ].join('\r\n');
+}
+
+export function windowsStartupScriptInstalled(scriptFile) {
+  try {
+    const text = fs.readFileSync(scriptFile, 'utf16le');
+    const lines = text.replace(/^\uFEFF/, '').split('\r\n');
+    if (!text.startsWith('\uFEFF') || lines.length !== 4 ||
+        lines[0] !== WINDOWS_STARTUP_MARKER ||
+        lines[1] !== 'Set remcpShell = CreateObject("WScript.Shell")' ||
+        lines[3] !== '') return false;
+    const match = lines[2].match(/^remcpShell\.Run Chr\(34\) & "([^"]+)" & Chr\(34\) & " " & Chr\(34\) & "([^"]+)" & Chr\(34\) & " serve " & Chr\(34\) & "([^"]+)" & Chr\(34\), 0, False$/);
+    if (!match) return false;
+    const [, node, supervisor, cli] = match;
+    const absolute = value => path.isAbsolute(value) || path.win32.isAbsolute(value);
+    const basename = value => path.posix.basename(value.replaceAll('\\', '/'));
+    return [node, supervisor, cli].every(absolute) &&
+      /^(node|node\.exe)$/i.test(basename(node)) &&
+      basename(supervisor) === 'windows-user-supervisor.mjs' &&
+      basename(cli) === 'remcp.mjs';
+  } catch { return false; }
+}
+
+export function windowsTaskAbsenceCommand(taskName) {
+  if (typeof taskName !== 'string' || !/^[A-Za-z0-9 _-]{1,80}$/.test(taskName)) {
+    throw new Error('Invalid Windows task name');
+  }
+  // Task Scheduler COM gives locale-independent HRESULTs. A failed schtasks /Query
+  // is ambiguous: it may mean "access denied" rather than "does not exist".
+  const name = taskName.replaceAll("'", "''");
+  return [
+    "$ErrorActionPreference = 'Stop'",
+    '$scheduler = New-Object -ComObject Schedule.Service',
+    '$scheduler.Connect()',
+    `try { $null = $scheduler.GetFolder('\\').GetTask('${name}'); Write-Output 'PRESENT' }`,
+    'catch {',
+    '  $e = $_.Exception',
+    '  $missing = $false',
+    '  while ($null -ne $e) {',
+    '    if ($e.HResult -eq -2147024894 -or $e.HResult -eq -2147216625) { $missing = $true; break }',
+    '    $e = $e.InnerException',
+    '  }',
+    "  if ($missing) { Write-Output 'ABSENT' } else { throw }",
+    '}',
+  ].join('\n');
+}
+
 export function windowsTaskReliabilityCommand(taskName) {
   if (typeof taskName !== 'string' || !/^[A-Za-z0-9 _-]{1,80}$/.test(taskName)) {
     throw new Error('Invalid Windows task name');

package/src/cli/windows-user-supervisor.mjs

@@ -0,0 +1,253 @@
+// Single-instance, current-user Windows Startup supervisor with authenticated local control.
+// Owns its child PID; never enumerates or kills unrelated node.exe/cmd.exe processes.
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import crypto from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const currentFile = fileURLToPath(import.meta.url);
+const root = process.env.REMCP_CONFIG_DIR || path.join(os.homedir(), '.config', 'remcp');
+const keyFile = path.join(root, 'windows-startup-control.key');
+const actions = new Set(['status', 'stop', 'restart']);
+
+export function windowsSupervisorPath(configDir = root, platform = process.platform) {
+  const id = crypto.createHash('sha256').update(path.resolve(configDir)).digest('hex').slice(0, 32);
+  return platform === 'win32' ? '\\\\.\\pipe\\remcp-user-' + id
+    : path.join(os.tmpdir(), 'remcp-user-' + id + '.sock');
+}
+
+export function ensureWindowsSupervisorKey() {
+  fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+  try { fs.writeFileSync(keyFile, crypto.randomBytes(32), { flag: 'wx', mode: 0o600 }); }
+  catch (error) { if (error?.code !== 'EEXIST') throw error; }
+  const stat = fs.lstatSync(keyFile);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== 32) {
+    throw new Error('Invalid ReMCP supervisor control key');
+  }
+  return fs.readFileSync(keyFile);
+}
+
+function signature(secret, action, nonce) {
+  return crypto.createHmac('sha256', secret).update(action + ':' + nonce).digest('hex');
+}
+
+export async function windowsSupervisorRequest(action, { timeoutMs = action === 'stop' ? 14500 : 4000 } = {}) {
+  if (!actions.has(action)) throw new Error('Invalid Windows supervisor action');
+  const secret = fs.readFileSync(keyFile);
+  if (secret.length !== 32) throw new Error('Invalid supervisor key');
+  const nonce = crypto.randomBytes(16).toString('hex');
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(windowsSupervisorPath());
+    let output = '';
+    const timer = setTimeout(() => { socket.destroy(); reject(new Error('Supervisor timed out')); }, timeoutMs);
+    socket.on('connect', () => socket.write(JSON.stringify({
+      action, nonce, mac: signature(secret, action, nonce),
+    }) + '\n'));
+    socket.on('data', chunk => {
+      output += chunk.toString('utf8');
+      if (Buffer.byteLength(output) > 2048) socket.destroy(new Error('Supervisor reply too large'));
+    });
+    socket.on('error', error => { clearTimeout(timer); reject(error); });
+    socket.on('end', () => {
+      clearTimeout(timer);
+      try {
+        const result = JSON.parse(output.trim());
+        const { mac, nonce: replyNonce, ...body } = result;
+        if (replyNonce !== nonce || !/^[a-f0-9]{64}$/.test(String(mac))) {
+          throw new Error('Unauthenticated supervisor reply');
+        }
+        const expected = signature(secret, 'reply', nonce + ':' + JSON.stringify(body));
+        if (!crypto.timingSafeEqual(Buffer.from(mac, 'hex'), Buffer.from(expected, 'hex'))) {
+          throw new Error('Untrusted supervisor reply');
+        }
+        if (!body.ok) throw new Error(body.error || 'Supervisor rejected command');
+        resolve(body);
+      } catch (error) { reject(error); }
+    });
+  });
+}
+
+// Synchronous callers in the installed CLI use a separate Node client.
+// Never pass device tokens or control keys in command-line arguments.
+export function windowsSupervisorCommand(action, { timeoutMs = action === 'stop' ? 20000 : 15000 } = {}) {
+  if (!actions.has(action) && action !== 'wait') throw new Error('Invalid supervisor action');
+  const proc = spawnSync(process.execPath, [currentFile, 'control', action], {
+    encoding: 'utf8', windowsHide: true, timeout: timeoutMs, maxBuffer: 8192,
+  });
+  if (proc.error || proc.status !== 0) throw new Error(
+    'ReMCP user supervisor ' + action + ' failed: ' +
+      String(proc.stderr || proc.error?.message || proc.stdout || 'unavailable').trim().slice(0, 300));
+  try { return JSON.parse(proc.stdout.trim()); }
+  catch { throw new Error('Invalid supervisor status'); }
+}
+
+async function serve(cliEntry) {
+  if (!path.isAbsolute(cliEntry) || !fs.existsSync(cliEntry)) throw new Error('Invalid ReMCP CLI entry');
+  const secret = ensureWindowsSupervisorKey();
+  let child = null;
+  let stopped = false;
+  let restartTimer = null;
+  let requestedRestart = null;
+  let startedAt = 0;
+  let lastExit = null;
+  const usedNonces = new Set();
+
+  function start() {
+    if (stopped || child) return;
+    const logFile = path.join(root, 'windows-startup-agent.log');
+    try { if (fs.statSync(logFile).size > 4 * 1024 * 1024) fs.truncateSync(logFile, 0); } catch {}
+    const log = fs.openSync(logFile, 'a', 0o600);
+    const prefix = path.resolve(path.dirname(cliEntry), '../../../../');
+    try {
+      child = spawn(process.execPath, [cliEntry, 'start', '--service'], {
+        cwd: root, windowsHide: true, stdio: ['ignore', log, log, 'ipc'],
+        env: { ...process.env, REMCP_USER_STARTUP_SUPERVISOR:'1', NPM_CONFIG_PREFIX: prefix,
+          PATH: path.dirname(process.execPath) + path.delimiter + (process.env.PATH || '') },
+      });
+    } finally { fs.closeSync(log); }
+    const ownChild = child;
+    startedAt = Date.now();
+    ownChild.on('error', error => {
+      lastExit = error.message;
+      if (child === ownChild) {
+        child = null;
+        if (!stopped) restartTimer = setTimeout(start, 3000);
+      }
+    });
+    ownChild.on('exit', (code, signal) => {
+      if (child !== ownChild) return;
+      child = null;
+      lastExit = code === null ? String(signal || 'unknown') : String(code);
+      if (!stopped) restartTimer = setTimeout(start, 3000);
+    });
+  }
+
+  async function endChild() {
+    clearTimeout(restartTimer);
+    const ownChild = child;
+    if (!ownChild) return;
+    if (ownChild.exitCode === null && !ownChild.killed) {
+      if (process.platform === 'win32') {
+        const result = spawnSync('taskkill.exe', ['/PID', String(ownChild.pid), '/T', '/F'], {
+          windowsHide: true, encoding: 'utf8', timeout: 7000, maxBuffer: 2048,
+        });
+        if (result.status !== 0 && ownChild.exitCode === null) {
+          throw new Error('Could not terminate owned agent process tree');
+        }
+      } else ownChild.kill('SIGTERM');
+    }
+    if (ownChild.exitCode === null) await Promise.race([
+      new Promise(resolve => ownChild.once('exit', resolve)),
+      new Promise((_, reject) => setTimeout(() => reject(new Error('Agent exit timed out')), 4500)),
+    ]);
+  }
+
+  const server = net.createServer(socket => {
+    socket.on('error', () => {}); // A disconnected local client must not crash the agent.
+    socket.setTimeout(15000, () => socket.destroy());
+    let input = '';
+    socket.on('data', chunk => {
+      input += chunk.toString('utf8');
+      if (Buffer.byteLength(input) > 1024) { socket.destroy(); return; }
+      if (!input.includes('\n')) return;
+      const raw = input.slice(0, input.indexOf('\n'));
+      input = '';
+      void (async () => {
+        try {
+          const request = JSON.parse(raw);
+          const reply = body => socket.end(JSON.stringify({ ...body, nonce: request.nonce,
+            mac: signature(secret, 'reply', request.nonce + ':' + JSON.stringify(body)) }) + '\n');
+          if (!actions.has(request.action) ||
+              !/^[a-f0-9]{32}$/.test(String(request.nonce)) ||
+              !/^[a-f0-9]{64}$/.test(String(request.mac)) ||
+              usedNonces.has(request.nonce) ||
+              !crypto.timingSafeEqual(Buffer.from(request.mac, 'hex'),
+                Buffer.from(signature(secret, request.action, request.nonce), 'hex'))) {
+            throw new Error('Unauthorized supervisor request');
+          }
+          usedNonces.add(request.nonce);
+          if (usedNonces.size > 128) usedNonces.clear();
+          if (request.action === 'stop') {
+            clearTimeout(requestedRestart);
+            requestedRestart = null;
+            stopped = true;
+            await endChild();
+            reply({ ok: true, stopped: true });
+            server.close(() => {
+              if (process.platform !== 'win32') {
+                try { fs.unlinkSync(windowsSupervisorPath()); } catch {}
+              }
+              process.exit(0);
+            });
+          } else if (request.action === 'restart') {
+            // Agent-initiated npm updates call this from a child of the current agent.
+            // Killing that tree before the update CLI returns can abort the updater itself.
+            // Coalesce requests and schedule the owned-child handoff after acknowledgement.
+            if (!requestedRestart) {
+              requestedRestart = setTimeout(() => {
+                requestedRestart = null;
+                void (async () => {
+                  stopped = true;
+                  try { await endChild(); }
+                  catch (error) { console.error('ReMCP supervisor restart failed:', error.message); }
+                  finally { stopped = false; if (!child) start(); }
+                })();
+              }, 2500);
+            }
+            reply({ ok: true, restartScheduled: true });
+          } else reply({
+            ok: true, childPid: child?.pid || null,
+            running: Boolean(child?.pid && child.exitCode === null),
+            restartPending: Boolean(requestedRestart),
+            uptimeMs: child ? Date.now() - startedAt : null, lastExit,
+          });
+        } catch (error) { socket.end(JSON.stringify({ ok: false, error: error.message }) + '\n'); }
+      })();
+    });
+  });
+  server.maxConnections = 16;
+  server.on('error', error => {
+    if (error.code === 'EADDRINUSE') {
+      // A second logon or repeated Startup invocation must never create a second agent.
+      process.exitCode = 0;
+    } else { console.error('ReMCP supervisor:', error.message); process.exitCode = 1; }
+  });
+  server.listen(windowsSupervisorPath(), start);
+}
+
+async function control(action) {
+  if (action === 'stop') {
+    const result = await windowsSupervisorRequest('stop');
+    const deadline = Date.now() + 3500;
+    while (Date.now() < deadline) {
+      try { await windowsSupervisorRequest('status', { timeoutMs: 450 }); }
+      catch (error) {
+        if (['ENOENT', 'ECONNREFUSED', 'EPIPE'].includes(error?.code)) return result;
+      }
+      await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    throw new Error('Windows Startup supervisor has not exited after stop');
+  }
+  if (action !== 'wait') return windowsSupervisorRequest(action);
+  const deadline = Date.now() + 11000;
+  while (Date.now() < deadline) {
+    try {
+      const current = await windowsSupervisorRequest('status', { timeoutMs: 1000 });
+      if (current.running && current.uptimeMs >= 700) return current;
+    } catch {}
+    await new Promise(resolve => setTimeout(resolve, 250));
+  }
+  throw new Error('Supervisor did not start');
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === currentFile) {
+  if (process.argv[2] === 'serve') void serve(process.argv[3])
+    .catch(error => { console.error(error.message); process.exitCode = 1; });
+  else if (process.argv[2] === 'control') void control(process.argv[3])
+    .then(result => process.stdout.write(JSON.stringify(result) + '\n'))
+    .catch(error => { console.error(error.message); process.exitCode = 1; });
+}

package/src/cli.mjs

@@ -58,6 +58,14 @@ export async function main(argv = process.argv.slice(2)) {
     // the workspace-generated command and for CI, and `--server` for self-hosted deployments.
     const previous = loadConfig(false);
     const alreadyPaired = Boolean(previous?.deviceId && previous?.deviceToken);
+    // The official Windows bootstrap may be rerun after approval succeeded but OS service
+    // registration failed. Repair the existing credential in place, never initiate another
+    // device-authorization flow or replace an already owned computer.
+    if (alreadyPaired && flags['repair-if-paired'] === true &&
+        flags['re-pair'] !== true && !flags.code && flags.install !== false) {
+      installPersistentAgent(previous);
+      return;
+    }
     if (alreadyPaired && flags['re-pair'] !== true) {
       throw new Error('This computer is already paired. Use `remcp doctor` or `remcp install` to repair it without changing credentials. To intentionally replace the pairing (possibly moving it to another account), add --re-pair.');
     }
@@ -149,7 +157,7 @@ export async function main(argv = process.argv.slice(2)) {
       return;
     }
     const telemetry = telemetryState();
-    await runAgent({
+    const agent = await runAgent({
       ...cfg,
       autoUpdate: autoUpdateEnabled(cfg),
       trustRuntime: cfg.trustRuntime === true
@@ -160,6 +168,14 @@ export async function main(argv = process.argv.slice(2)) {
       installSpec: `${PACKAGE_NAME}@${VERSION}`,
       persistState: patch => saveConfig({ ...cfg, ...patch }),
     });
+    // The per-user Windows supervisor owns this child through a private Node IPC
+    // handle. If the supervisor dies, the agent must close its runtime rather than
+    // remain orphaned and create duplicates at the next interactive logon.
+    if (supervised && process.env.REMCP_USER_STARTUP_SUPERVISOR === '1') {
+      const closeOrphan = () => void agent.stop().finally(() => process.exit(0));
+      process.once('disconnect', closeOrphan);
+      if (!process.connected) closeOrphan();
+    }
     return;
   }