@withbuddi/buddi 0.1.0-pre.52 → 0.1.0-pre.54

package/packages/install/dist/launcher.js

@@ -9,19 +9,23 @@
  */
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawn, execFile } from 'node:child_process';
+import { spawn, execFile, execFileSync } from 'node:child_process';
 import { request } from 'node:http';
 import { open, mkdir, writeFile, rm, rename, copyFile, chmod } from 'node:fs/promises';
 import os from 'node:os';
 import { promisify } from 'node:util';
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
-import { environment, identityMismatch, portMovedLines, dashboardReady, launchAgentLabel, launchAgentPlist, reloadLaunchAgent, nativeEnvironment, reloadSystemdUnit, systemdUnitPath, atomicJson, browsersDir, SERVICE_UNIT_VAR } from './environment.js';
-import { briefSupervisorEnv, supervise, supervisorSocket } from './supervisor.js';
+import { existsSync, openSync, readFileSync, realpathSync, writeFileSync, writeSync } from 'node:fs';
+import { environment, lockHolder, identityMismatch, portMovedLines, dashboardReady, launchAgentLabel, launchAgentPlist, reloadLaunchAgent, nativeEnvironment, reloadSystemdUnit, systemdUnitPath, atomicJson, browsersDir, SERVICE_UNIT_VAR } from './environment.js';
+import { NotOurSupervisor, answeredBySupervisor, briefSupervisorEnv, runningOrStarting, supervise, supervisorSocket } from './supervisor.js';
 import { keptPluginDataLine, readKeptPluginData } from './kept-data.js';
 import { readProfileZone, timezoneLine } from './doctor-timezone.js';
 import { installedVersion, readUpgradeState, upgradeDoctorLines, versionView } from './upgrade.js';
-import { APP_RUNNING_LINE, appLayout, insideAppBundle, runsAppCopy } from './app-layout.js';
+import { APP_RUNNING_LINE, appLayout, insideAppBundle, linuxInstall, runsAppCopy, windowsInstall } from './app-layout.js';
+import { runtimeFacts, runtimeLines } from './runtime-info.js';
+import { commandOwnedBy, desktopEntryPaths, linuxUnitSpec, ownDesktopEntries } from './linux-install.js';
 import { APP_BUNDLE_ID, SHIM_REFUSAL, SHIM_VAR, shimAction, shimDoctorLines, shimRefusesSupervise, shimsFor } from './cli-shim.js';
+import { buildSuperviseScript, buildTaskXml, followLogsCommand, registerWindowsTask, taskXmlBytes, windowsTaskName, windowsTaskScript, windowsTaskXmlFile } from './windows-task.js';
+import { SETUP_DATA_KEY, SETUP_UNINSTALL_VAR, cleanupNodeCopyCommand, regQueryValue, uninstallerIsOurs, insideFolder, readWindowsInstallerRecord, windowsCommandOwnedBy, windowsTaskSpec } from './windows-install.js';
 const entry = fileURLToPath(import.meta.url);
 // <root>/packages/install/dist/launcher.js — the installation root is three up.
 const root = path.resolve(path.dirname(entry), '../../..');
@@ -57,6 +61,11 @@ async function ask(ctx, method, route, body) {
             headers: { host: 'localhost', ...(payload === undefined ? {} : { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) }) },
             timeout: 25_000,
         }, res => {
+            // Windows: a pipe's name can be listed by anyone; the secret beside it in the data directory cannot.
+            if (!answeredBySupervisor(ctx.data, res.headers)) {
+                res.resume();
+                return reject(new NotOurSupervisor());
+            }
             let text = '';
             res.setEncoding('utf8');
             res.on('data', chunk => { text += chunk; });
@@ -99,12 +108,75 @@ function isAppInstall(ctx) {
 function runsFromApp(status, ctx) {
     return runsAppCopy(status.installRoot, ctx.data);
 }
+/**
+ * Is this the Linux install (scripts/install.sh)? Its `buddi` and its unit say
+ * so; a process they started with a trimmed environment (the uninstall the
+ * dashboard spawns) is told by the layout: on Linux there is no buddi.app, so
+ * a release under `<data>/releases` is the installer's.
+ */
+function isLinuxInstall(ctx) {
+    return linuxInstall(process.env) || (process.platform === 'linux' && isAppInstall(ctx));
+}
+/**
+ * Is this the Windows install (the setup, apps/windows)? Its `buddi.cmd` and
+ * its task say so; as on Linux, there is no buddi.app on Windows, so a
+ * release under `<data>\releases` is the setup's.
+ */
+function isWindowsInstall(ctx) {
+    return windowsInstall(process.env) || (process.platform === 'win32' && isAppInstall(ctx));
+}
 function withApp(view, ctx) {
-    return isAppInstall(ctx) ? { ...view, app: true } : view;
+    return isAppInstall(ctx) && !isLinuxInstall(ctx) && !isWindowsInstall(ctx) ? { ...view, app: true } : view;
 }
 async function control(ctx, action = 'status') {
     return await ask(ctx, action === 'status' ? 'GET' : 'POST', `/${action}`);
 }
+/** The pid `supervisor.lock` names, while that process lives and the lock is of this boot (environment.ts `lockHolder`). */
+function supervisorLockPid(data) {
+    return lockHolder(data);
+}
+/**
+ * Windows: a postmaster still running on this installation's cluster, its
+ * `postmaster.pid` naming a live process. There it can outlive its
+ * supervisor for a moment (it is stopped with pg_ctl), and a folder it holds cannot be removed.
+ * Elsewhere the supervisor's own exit is the answer, as before.
+ */
+function postmasterLeft(data) {
+    if (process.platform !== 'win32')
+        return false;
+    let pid;
+    try {
+        pid = Number(readFileSync(path.join(data, 'postgres', 'postmaster.pid'), 'utf8').split('\n')[0].trim());
+    }
+    catch {
+        return false;
+    }
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Windows: stop the supervisor the way a signal does elsewhere. A kill there
+ * is TerminateProcess, which skips the database's shutdown, so it is asked on
+ * its socket and followed until its lock is gone. A refusal (a restore or an
+ * upgrade under way) is thrown, never overridden with a kill.
+ */
+async function exitSupervisor(ctx, timeoutMs = 90_000) {
+    if (supervisorLockPid(ctx.data) === undefined)
+        return;
+    await ask(ctx, 'POST', '/exit');
+    for (let waited = 0; supervisorLockPid(ctx.data) !== undefined; waited += 250) {
+        if (waited >= timeoutMs)
+            throw new Error(`the supervisor (pid ${supervisorLockPid(ctx.data)}) did not stop within ${Math.round(timeoutMs / 1000)} seconds`);
+        await new Promise(resolve => setTimeout(resolve, 250));
+    }
+}
 /** The supervisor's status as the sentence `buddi service status` prints. */
 export function serviceLine(status) {
     const gateway = status.gateway === 'running'
@@ -172,7 +244,7 @@ async function startSupervisorBriefly(ctx, lockPid) {
     const log = await open(path.join(ctx.data, 'logs/supervisor.log'), 'a', 0o600);
     let child;
     try {
-        child = spawn(process.execPath, [entry, 'supervise'], { detached: true, stdio: ['ignore', log.fd, log.fd], env: briefSupervisorEnv(ctx.env, process.pid, SHIM_VAR) });
+        child = spawn(process.execPath, [entry, 'supervise'], { detached: true, stdio: ['ignore', log.fd, log.fd], env: briefSupervisorEnv(ctx.env, process.pid, SHIM_VAR), windowsHide: true });
         await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
     }
     finally {
@@ -199,10 +271,15 @@ async function startSupervisorBriefly(ctx, lockPid) {
         process.removeListener('SIGINT', onInterrupt);
         process.removeListener('SIGTERM', onInterrupt);
         if (!exited && child.pid !== undefined) {
-            try {
-                process.kill(child.pid, 'SIGTERM');
+            // Windows: SIGTERM is TerminateProcess, which would skip the database's shutdown.
+            if (process.platform === 'win32')
+                await ask(ctx, 'POST', '/exit').catch(() => { });
+            else {
+                try {
+                    process.kill(child.pid, 'SIGTERM');
+                }
+                catch { /* gone */ }
             }
-            catch { /* gone */ }
         }
         const alive = () => { if (exited || child.pid === undefined)
             return false; try {
@@ -212,7 +289,7 @@ async function startSupervisorBriefly(ctx, lockPid) {
         catch {
             return false;
         } };
-        for (let waited = 0; lockPid() !== undefined || alive(); waited += 250) {
+        for (let waited = 0; lockPid() !== undefined || alive() || postmasterLeft(ctx.data); waited += 250) {
             if (waited >= 60_000)
                 throw new Error(`the database started for the last backup did not stop within a minute (supervisor pid ${child.pid})`);
             await new Promise(resolve => setTimeout(resolve, 250));
@@ -233,6 +310,73 @@ async function startSupervisorBriefly(ctx, lockPid) {
         await new Promise(resolve => setTimeout(resolve, 500));
     }
 }
+/**
+ * What the Linux install put where: `installer.json` (written by
+ * scripts/install.sh) names the command and whether it turned on lingering;
+ * the command is removed only while it still carries the installer's marker.
+ */
+function linuxInstallParts(ctx, home) {
+    let recorded = {};
+    try {
+        recorded = JSON.parse(readFileSync(path.join(ctx.data, 'installer.json'), 'utf8'));
+    }
+    catch { /* an older install: the defaults */ }
+    const command = typeof recorded.command === 'string' && path.isAbsolute(recorded.command) ? recorded.command : path.join(home, '.local', 'bin', 'buddi');
+    // Ours only while it runs this data folder: another installation may have written the same bin folder since.
+    const owned = () => commandOwnedBy((() => { try {
+        return readFileSync(command, 'utf8');
+    }
+    catch {
+        return undefined;
+    } })(), ctx.data, realpathSync);
+    return {
+        runtime: path.join(ctx.data, 'node'),
+        releases: appLayout(process.env) ?? path.join(ctx.data, 'releases'),
+        ...(owned() ? { command, commandOwned: owned } : {}),
+        ...(recorded.linger === true ? { linger: true } : {}),
+        desktopEntries: ownDesktopEntries(desktopEntryPaths(process.env, home), ctx.data, file => { try {
+            return readFileSync(file, 'utf8');
+        }
+        catch {
+            return undefined;
+        } }),
+    };
+}
+/**
+ * What the Windows setup put where: `installer.json` (written by its
+ * windows-setup.ts) names `buddi.cmd` and the setup's uninstaller; the command
+ * is removed only while it still runs this data folder.
+ */
+function windowsInstallParts(ctx) {
+    const recorded = readWindowsInstallerRecord((() => { try {
+        return readFileSync(path.join(ctx.data, 'installer.json'), 'utf8');
+    }
+    catch {
+        return undefined;
+    } })());
+    const command = recorded.command;
+    const owned = () => command !== undefined && windowsCommandOwnedBy((() => { try {
+        return readFileSync(command, 'utf8');
+    }
+    catch {
+        return undefined;
+    } })(), ctx.data, realpathSync);
+    // The setup's one registration serves one data folder: started for another, it would remove that one.
+    const registered = (() => { try {
+        return regQueryValue(execFileSync('reg.exe', ['query', SETUP_DATA_KEY, '/v', 'DataDir'], { encoding: 'utf8', windowsHide: true }), 'DataDir');
+    }
+    catch {
+        return undefined;
+    } })();
+    const uninstaller = recorded.uninstaller !== undefined && existsSync(recorded.uninstaller) && uninstallerIsOurs(registered, ctx.data) ? recorded.uninstaller : undefined;
+    return {
+        runtime: path.join(ctx.data, 'node'),
+        releases: appLayout(process.env) ?? path.join(ctx.data, 'releases'),
+        ...(command !== undefined && owned() ? { command, commandOwned: owned } : {}),
+        // Run from the setup's own uninstaller, which removes its entry itself afterwards.
+        ...(uninstaller !== undefined && (process.env[SETUP_UNINSTALL_VAR] ?? '').trim() !== '1' ? { uninstaller } : {}),
+    };
+}
 /**
  * `buddi uninstall`, in a packaged installation. The order and the refusals
  * are in `uninstall.ts`; this wires them to the real machine: the supervisor's
@@ -252,24 +396,7 @@ async function uninstall(ctx, rest) {
     const { purgeKeychain, clearTelegramMenu } = await import('@buddi/core/uninstall');
     const { dashboardAppOwnedBy } = await import('@buddi/cli');
     const home = os.homedir();
-    const lockPid = () => {
-        let pid;
-        try {
-            pid = Number(readFileSync(path.join(ctx.data, 'supervisor.lock'), 'utf8').trim());
-        }
-        catch {
-            return undefined;
-        }
-        if (!Number.isInteger(pid) || pid <= 0)
-            return undefined;
-        try {
-            process.kill(pid, 0);
-            return pid;
-        }
-        catch {
-            return undefined;
-        }
-    };
+    const lockPid = () => supervisorLockPid(ctx.data);
     const service = ctx.env.BUDDI_VAULT_SERVICE ?? 'buddi';
     const vault = (() => { try {
         return core.createVault({ env: ctx.env });
@@ -280,10 +407,37 @@ async function uninstall(ctx, rest) {
     const stored = await vault?.get('TELEGRAM_BOT_TOKEN').catch(() => null) ?? null;
     const token = stored ?? (ctx.env.TELEGRAM_BOT_TOKEN?.startsWith('<') ? undefined : ctx.env.TELEGRAM_BOT_TOKEN?.trim() || undefined);
     const app = dashboardAppOwnedBy(path.join(root, 'packages/cli/dist/main.js'), home);
+    const linuxParts = isLinuxInstall(ctx) ? linuxInstallParts(ctx, home) : undefined;
+    const windowsParts = isWindowsInstall(ctx) ? windowsInstallParts(ctx) : undefined;
+    if (windowsParts !== undefined && insideFolder(process.execPath, ctx.data)) {
+        // buddi.cmd, the dashboard and the setup's uninstaller run a copy of node from TEMP for this.
+        console.error(`buddi: this node runs from inside ${ctx.data}, which Windows will not remove while it runs. Run buddi uninstall from a new Command Prompt (buddi.cmd runs it from a copy), or remove buddi in Settings → Apps. Nothing was removed.`);
+        return 1;
+    }
+    // The copy of node this runs from (see above) goes once it has exited.
+    if (process.platform === 'win32') {
+        const cleanup = cleanupNodeCopyCommand(process.execPath, ctx.env.SystemRoot ?? ctx.env.SYSTEMROOT ?? 'C:\\Windows');
+        if (cleanup !== undefined)
+            process.once('exit', () => { try {
+                writeFileSync(cleanup.script.file, cleanup.script.text);
+                spawn(cleanup.command, cleanup.args, { detached: true, stdio: 'ignore', windowsHide: true, env: { ...process.env, ...cleanup.env }, cwd: os.homedir() }).unref();
+            }
+            catch { /* TEMP is cleaned by Windows too */ } });
+    }
     return await uninstallPackaged(options, {
+        ...(linuxParts === undefined ? {} : { linuxInstall: linuxParts }),
+        ...(windowsParts === undefined ? {} : { windowsInstall: windowsParts }),
         data: ctx.data, home, platform: process.platform, env: ctx.env, uid: process.getuid?.() ?? 501,
         exists: existsSync,
-        remove: file => rm(file, { recursive: true, force: true }),
+        launch: async (command, argv) => {
+            await new Promise((resolve, reject) => {
+                const child = spawn(command, argv, { detached: true, stdio: 'ignore', windowsHide: true, cwd: home });
+                child.once('error', reject);
+                child.once('spawn', () => { child.unref(); resolve(); });
+            });
+        },
+        // Retried: on Windows a process that just exited can hold a folder for a moment (EBUSY).
+        remove: file => rm(file, { recursive: true, force: true, maxRetries: 10, retryDelay: 250 }),
         move: async (from, to) => {
             await mkdir(path.dirname(to), { recursive: true, mode: 0o700 });
             try {
@@ -295,7 +449,7 @@ async function uninstall(ctx, rest) {
             }
         },
         exec: (command, argv) => new Promise(resolve => {
-            execFile(command, argv, { env: { ...nativeEnvironment(ctx.env), ...systemdSession(ctx.env) } }, (error, stdout, stderr) => {
+            execFile(command, argv, { env: { ...nativeEnvironment(ctx.env), ...systemdSession(ctx.env) }, windowsHide: true }, (error, stdout, stderr) => {
                 const code = error?.code;
                 resolve({ code: error ? (typeof code === 'number' ? code : 1) : 0, stdout: String(stdout), stderr: error && typeof code !== 'number' ? error.message : String(stderr) });
             });
@@ -308,7 +462,7 @@ async function uninstall(ctx, rest) {
         },
         // Run by buddi.app itself (its uninstall route), the app is already on its way out: nothing to say about it.
         buddiApp: async () => {
-            if (appLayout(process.env) !== undefined)
+            if (appLayout(process.env) !== undefined || isLinuxInstall(ctx) || isWindowsInstall(ctx))
                 return undefined;
             const status = await control(ctx).catch(() => undefined);
             if (status !== undefined && runsFromApp(status, ctx))
@@ -331,10 +485,20 @@ async function uninstall(ctx, rest) {
             return existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : undefined;
         },
         supervisorPid: lockPid,
-        signal: (pid, signal) => { try {
-            process.kill(pid, signal);
-        }
-        catch { /* gone already */ } },
+        // Windows: a kill is TerminateProcess, which would skip the database's
+        // shutdown; the supervisor is asked on its socket instead, and a refusal
+        // (a restore or an upgrade under way) stops the uninstall, not the supervisor.
+        signal: async (pid, signal) => {
+            if (process.platform === 'win32' && pid === lockPid()) {
+                await exitSupervisor(ctx);
+                return;
+            }
+            try {
+                process.kill(pid, signal);
+            }
+            catch { /* gone already */ }
+        },
+        postmasterLeft: () => postmasterLeft(ctx.data),
         ...(core.vaultSelection({ env: ctx.env }) === 'keychain' ? {
             keychain: {
                 service,
@@ -624,11 +788,20 @@ async function launchService(ctx, temporary) {
         const unit = systemdUnitPath(ctx.data, ctx.env);
         const { buildSystemdUnit } = await import('@buddi/cli');
         await mkdir(path.dirname(unit), { recursive: true });
+        /*
+         * The Linux install runs `<data>/releases/current` with its bundled node,
+         * named through the link rather than resolved: an upgrade switches the
+         * link and systemd's restart runs the new release from the same unit.
+         */
+        const releases = isLinuxInstall(ctx) ? appLayout(process.env) ?? path.join(ctx.data, 'releases') : undefined;
+        const spec = releases === undefined
+            ? { nodePath: process.execPath, serveEntry: entry, environment: { BUDDI_DATA_DIR: ctx.data, [SERVICE_UNIT_VAR]: label, ...serviceEnvironment() }, path: [path.dirname(process.execPath), '/usr/local/bin', '/usr/bin', '/bin'].join(':') }
+            : linuxUnitSpec({ data: ctx.data, releases, label, exists: existsSync, extra: serviceEnvironment() });
         await writeFile(unit, buildSystemdUnit({
-            label, nodePath: process.execPath, serveEntry: entry, args: ['supervise'],
-            environment: { BUDDI_DATA_DIR: ctx.data, [SERVICE_UNIT_VAR]: label, ...serviceEnvironment() },
+            label, nodePath: spec.nodePath, serveEntry: spec.serveEntry, args: ['supervise'],
+            environment: spec.environment,
             workingDirectory: ctx.data,
-            path: [path.dirname(process.execPath), '/usr/local/bin', '/usr/bin', '/bin'].join(':'),
+            path: spec.path,
             logFile: path.join(ctx.data, 'logs/supervisor.log'), errorFile: path.join(ctx.data, 'logs/supervisor.log'),
         }), { mode: 0o600 });
         try {
@@ -638,14 +811,58 @@ async function launchService(ctx, temporary) {
             const detail = error instanceof Error ? error.message : String(error);
             throw new Error(`systemd could not start the service (${detail.trim()}). The unit is at ${unit}. Run buddi --no-service to start it in the foreground instead.`);
         }
-        console.log(`Background service: systemd user unit ${label} (survives logout only after: loginctl enable-linger ${ctx.env.USER ?? '$USER'})`);
+        // Lingering already on (the Linux installer turns it on when it may): nothing to add.
+        const lingering = await exec('loginctl', ['show-user', ctx.env.USER ?? os.userInfo().username, '-p', 'Linger', '--value'], { env: nativeEnvironment(ctx.env) })
+            .then(out => out.stdout.trim() === 'yes', () => false);
+        console.log(`Background service: systemd user unit ${label}${lingering ? '' : ` (survives logout only after: loginctl enable-linger ${ctx.env.USER ?? '$USER'})`}`);
+        return;
+    }
+    if (!temporary && process.platform === 'win32') {
+        /*
+         * A Task Scheduler task of the owner's (windows-task.ts): started now, and
+         * at every logon from then on. Its script carries what the plist's
+         * environment carries on a Mac.
+         */
+        const label = launchAgentLabel(ctx.data);
+        const script = windowsTaskScript(ctx.data);
+        await mkdir(path.dirname(script), { recursive: true, mode: 0o700 });
+        /*
+         * The Windows install runs `<data>\releases\current` with its bundled
+         * node, named through the junction: an upgrade switches it, and the task
+         * runs the new release at the next sign-in without being written again.
+         */
+        const logs = { [SUPERVISOR_LOG_VAR]: path.join(ctx.data, 'logs', 'supervisor.log') };
+        const spec = isWindowsInstall(ctx)
+            ? windowsTaskSpec({ data: ctx.data, label, exists: existsSync, extra: { ...logs, ...serviceEnvironment() } })
+            : { nodePath: process.execPath, entry, environment: { BUDDI_DATA_DIR: ctx.data, ...logs, ...serviceEnvironment() } };
+        await writeFile(script, buildSuperviseScript({
+            ...spec,
+            // What the supervisor says before it opens its log (a node that will not start).
+            logFile: path.join(ctx.data, 'logs', 'service.log'),
+        }), { mode: 0o600 });
+        const user = [ctx.env.USERDOMAIN, ctx.env.USERNAME ?? os.userInfo().username].filter(Boolean).join('\\');
+        await writeFile(windowsTaskXmlFile(ctx.data), taskXmlBytes(buildTaskXml({
+            // Not the data directory: Windows will not remove a folder a process runs in, and uninstall removes it.
+            user, script, workingDirectory: os.homedir(), systemRoot: ctx.env.SystemRoot ?? ctx.env.SYSTEMROOT ?? 'C:\\Windows',
+        })), { mode: 0o600 });
+        // A running supervisor stops on its socket first (its database cleanly);
+        // the task's /End below would be TerminateProcess.
+        await exitSupervisor(ctx).catch((error) => { throw new Error(`The running service could not be stopped to restart it: ${error.message}.`); });
+        try {
+            await registerWindowsTask((cmd, argv) => exec(cmd, argv, { env: nativeEnvironment(ctx.env), windowsHide: true }), windowsTaskName(label), windowsTaskXmlFile(ctx.data));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new Error(`Task Scheduler could not start the service (${detail.trim()}). Run buddi --no-service to start it in this window instead.`);
+        }
+        console.log(`Background service: Task Scheduler task ${windowsTaskName(label)} (starts at sign-in)`);
         return;
     }
     if (!temporary && process.platform !== 'darwin')
-        throw new Error('Background installation runs under launchd (macOS) or systemd (Linux). Use buddi --no-service or buddi supervise on this platform.');
+        throw new Error('Background installation runs under launchd (macOS), systemd (Linux) or Task Scheduler (Windows). Use buddi --no-service or buddi supervise on this platform.');
     const log = await open(path.join(ctx.data, 'logs/supervisor.log'), 'a', 0o600);
     try {
-        const child = spawn(process.execPath, [entry, 'supervise'], { detached: true, stdio: ['ignore', log.fd, log.fd], env: ctx.env });
+        const child = spawn(process.execPath, [entry, 'supervise'], { detached: true, stdio: ['ignore', log.fd, log.fd], env: ctx.env, windowsHide: true });
         await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
         child.unref();
     }
@@ -653,6 +870,27 @@ async function launchService(ctx, temporary) {
         await log.close();
     }
 }
+/**
+ * Where a supervisor started by the Windows task writes its output
+ * (windows-task.ts). The task's own redirection would hold the log open
+ * without letting another process append, and an upgrade's successor appends
+ * to the same file; so the supervisor opens it itself, as node opens files,
+ * shared.
+ */
+const SUPERVISOR_LOG_VAR = 'BUDDI_SUPERVISOR_LOG';
+function appendOutputTo(file) {
+    const fd = openSync(file, 'a', 0o600);
+    for (const stream of [process.stdout, process.stderr]) {
+        stream.write = ((chunk, encoding, done) => {
+            try {
+                writeSync(fd, typeof chunk === 'string' ? Buffer.from(chunk, typeof encoding === 'string' ? encoding : 'utf8') : chunk);
+            }
+            catch { /* a log that cannot be written is not a reason to stop */ }
+            (typeof encoding === 'function' ? encoding : done)?.();
+            return true;
+        });
+    }
+}
 async function run() {
     let ctx = await environment(root);
     // A supervisor started through buddi.app's command line tool would compete with the app's own (cli-shim.ts).
@@ -661,13 +899,22 @@ async function run() {
         process.exitCode = 2;
         return;
     }
-    if (args[0] === 'supervise')
+    if (args[0] === 'supervise') {
+        const logFile = (process.env[SUPERVISOR_LOG_VAR] ?? '').trim();
+        if (logFile !== '')
+            appendOutputTo(logFile);
         return supervise(ctx);
+    }
     if (args[0] === '__gateway') {
         // Parent death must not leave two gateways claiming jobs on the next boot.
         if (!process.send)
             throw new Error('The gateway child must be started by buddi supervise.');
-        const parentGone = () => process.kill(process.pid, 'SIGTERM');
+        // On Windows a kill is TerminateProcess, so the gateway's SIGTERM handler
+        // is run directly: it is also how the supervisor stops it there (stopChild).
+        const parentGone = () => { if (process.platform === 'win32')
+            process.emit('SIGTERM', 'SIGTERM');
+        else
+            process.kill(process.pid, 'SIGTERM'); };
         process.once('disconnect', parentGone);
         const gateway = await import('@buddi/gateway');
         try {
@@ -754,9 +1001,14 @@ async function run() {
             process.exitCode = 1;
             return;
         }
-        console.log(`tail -F ${logs.join(' ')}  (Ctrl-C to stop)`);
+        const windows = process.platform === 'win32';
+        console.log(`${windows ? 'Following' : 'tail -F'} ${logs.join(' ')}  (Ctrl-C to stop)`);
         await new Promise(resolve => {
-            const child = spawn('tail', ['-n', '80', '-F', ...logs], { stdio: 'inherit' });
+            // Windows has no tail: a PowerShell loop follows the same files (windows-task.ts).
+            const follow = windows ? followLogsCommand(logs) : undefined;
+            const child = follow !== undefined
+                ? spawn('powershell.exe', follow.args, { stdio: 'inherit', env: { ...process.env, ...follow.env } })
+                : spawn('tail', ['-n', '80', '-F', ...logs], { stdio: 'inherit' });
             child.once('exit', () => resolve());
             child.once('error', err => { console.error(`buddi: could not follow the log: ${err.message}`); resolve(); });
         });
@@ -771,7 +1023,12 @@ async function run() {
             return entry;
         } })();
         console.log(`This buddi: ${invoked} (Node ${process.execPath})`);
-        console.log(`From: ${insideAppBundle(root) ? `buddi.app (${root.slice(0, root.indexOf('.app/') + 4)})` : root.startsWith(path.join(ctx.data, 'releases') + path.sep) ? `an update buddi.app installed (${root})` : `npm (${root})`}`);
+        const linux = isLinuxInstall(ctx);
+        const windows = isWindowsInstall(ctx);
+        console.log(`From: ${insideAppBundle(root) ? `buddi.app (${root.slice(0, root.indexOf('.app/') + 4)})` : linux ? `the Linux install (${root})` : windows ? `the Windows install (${root})` : root.startsWith(path.join(ctx.data, 'releases') + path.sep) ? `an update buddi.app installed (${root})` : `npm (${root})`}`);
+        // Which Node and which npm: the bundled runtime, or the machine's (roadmap: no dependence on a host Node).
+        for (const line of runtimeLines(await runtimeFacts(), insideAppBundle(process.execPath) ? 'buddi.app' : linux ? 'the Linux install' : windows ? 'the Windows install' : 'this installation'))
+            console.log(line);
         for (const line of shimDoctorLines({ home: os.homedir(), exists: existsSync, read: file => { try {
                 return readFileSync(file, 'utf8');
             }
@@ -801,7 +1058,7 @@ async function run() {
          * looking at a supervisor that is barely up. The file is the record.
          */
         const state = await readUpgradeState(ctx.data, await installedVersion(root));
-        for (const line of upgradeDoctorLines(withApp(versionView(state), ctx), ctx.state?.phase))
+        for (const line of upgradeDoctorLines(withApp(versionView(state), ctx), ctx.state?.phase, { linux, windows }))
             console.log(line);
         console.log(`Logs: ${path.join(ctx.data, 'logs')}`);
         return;
@@ -873,7 +1130,7 @@ async function run() {
          * (a foreground `buddi supervise`) the owner is told to restart it.
          */
         if (ctx.state !== undefined && askedWebPort !== undefined && askedWebPort !== ctx.state.webPort) {
-            const serviced = process.platform === 'darwin' ? existsSync(launchAgentPlist(ctx.data)) : process.platform === 'linux' ? existsSync(systemdUnitPath(ctx.data, ctx.env)) : false;
+            const serviced = process.platform === 'darwin' ? existsSync(launchAgentPlist(ctx.data)) : process.platform === 'linux' ? existsSync(systemdUnitPath(ctx.data, ctx.env)) : process.platform === 'win32' ? existsSync(windowsTaskScript(ctx.data)) : false;
             if (!serviced)
                 throw new Error(`The dashboard port is ${ctx.state.webPort}. To move it to ${askedWebPort}, stop the running supervisor, change "webPort" in ${path.join(ctx.data, 'installation.json')}, and start it again.`);
             const from = ctx.state.webPort;
@@ -884,11 +1141,13 @@ async function run() {
             relaunched = true;
         }
         else {
-            try {
-                const status = await control(ctx);
+            // A missing supervisor is normal on first run; one that holds the lock is
+            // waited for, and if it never answers that is said, not restarted over.
+            const status = await runningOrStarting(() => control(ctx), () => supervisorLockPid(ctx.data));
+            if (status !== undefined) {
                 if (status.installRoot === root && status.nodePath === process.execPath) {
                     if (status.gateway === 'stopped')
-                        await control(ctx, 'start');
+                        await control(ctx, 'start').catch(() => undefined);
                     running = true;
                 }
                 else if (runsFromApp(status, ctx) && (!isAppInstall(ctx) || viaShim)) {
@@ -897,14 +1156,13 @@ async function run() {
                     running = true;
                 }
             }
-            catch { /* A missing supervisor is normal on first run. */ }
         }
         // The shim never installs a service beside buddi.app (it opened the app above).
         if (!running && viaShim)
             throw new Error('buddi.app is not running buddi. Open buddi.app, then run buddi again.');
         if (!running) {
             if (!relaunched) {
-                console.log('Starting Buddi. First run provisions a private Postgres cluster.');
+                console.log(firstRun ? 'Starting Buddi. First run provisions a private Postgres cluster.' : 'Starting buddi.');
                 await launchService(ctx, args.includes('--no-service'));
             }
             const deadline = Date.now() + 120_000;
@@ -959,6 +1217,34 @@ async function run() {
             console.log(gateway.browserLine(found));
         if (!args.includes('--no-open') && process.platform === 'darwin')
             await exec('open', [url], { env: nativeEnvironment(ctx.env) });
+        // Windows: the default browser, through the URL handler (no shell, so the link's `&` stays the link's).
+        if (!args.includes('--no-open') && process.platform === 'win32') {
+            const opened = await new Promise(resolve => {
+                const child = spawn('rundll32.exe', ['url.dll,FileProtocolHandler', url], { detached: true, stdio: 'ignore', env: nativeEnvironment(process.env), windowsHide: true });
+                child.once('error', () => resolve(false));
+                child.once('spawn', () => { child.unref(); resolve(true); });
+            });
+            if (opened)
+                console.log('Opened it in your browser.');
+        }
+        /*
+         * On a Linux desktop the link opens in the owner's browser, as `open` does
+         * on a Mac: only from a graphical session (a terminal on the desktop has
+         * DISPLAY or WAYLAND_DISPLAY; an SSH shell has neither, and a browser
+         * popping up on a screen nobody is looking at helps no one).
+         */
+        if (!args.includes('--no-open') && process.platform === 'linux' && (process.env.DISPLAY || process.env.WAYLAND_DISPLAY)) {
+            const opened = await new Promise(resolve => {
+                // The OS context and the desktop session's own variables only: never the .env secrets or the vault key.
+                const desktop = ['DISPLAY', 'WAYLAND_DISPLAY', 'XAUTHORITY', 'XDG_RUNTIME_DIR', 'DBUS_SESSION_BUS_ADDRESS', 'XDG_CURRENT_DESKTOP', 'XDG_SESSION_TYPE', 'XDG_SESSION_DESKTOP', 'DESKTOP_SESSION', 'XDG_DATA_DIRS', 'XDG_CONFIG_DIRS', 'XDG_DATA_HOME', 'XDG_CONFIG_HOME', 'BROWSER'];
+                const env = { ...nativeEnvironment(process.env), ...Object.fromEntries(desktop.filter(key => typeof process.env[key] === 'string').map(key => [key, process.env[key]])) };
+                const child = spawn('xdg-open', [url], { detached: true, stdio: 'ignore', env });
+                child.once('error', () => resolve(false));
+                child.once('spawn', () => { child.unref(); resolve(true); });
+            });
+            if (opened)
+                console.log('Opened it in your browser.');
+        }
         return;
     }
     if (!wantsHelp && args[0] === 'backup' && (args[1] === 'restore' || args[1] === 'create')) {