@withbuddi/buddi 0.1.0-pre.52 → 0.1.0-pre.54

package/packages/install/dist/supervisor.d.ts

@@ -13,8 +13,59 @@ import type { Connector, ConnectorStatus } from './cloudflared.js';
  * `state.upgrade` says which upgrade was under way and what it backed up.
  */
 export declare function pendingUpgrade(marker: UpgradeInProgress | undefined): UpgradeInProgress | undefined;
-/** The control socket of the installation whose data directory this is. */
-export declare function supervisorSocket(data: string): string;
+/** Where a Windows supervisor records the name of its pipe, inside the private data directory. */
+export declare const PIPE_NAME_FILE = "supervisor.pipe";
+/** The response header a Windows supervisor proves itself with: the secret beside its pipe's name. */
+export declare const SUPERVISOR_SECRET_HEADER = "x-buddi-supervisor";
+/** The live supervisor's pipe name and secret (Windows), or nothing when `supervisor.lock` names no live process. */
+export declare function supervisorPipe(data: string): {
+    name: string;
+    secret: string;
+} | undefined;
+/**
+ * The control socket of the installation whose data directory this is. On
+ * Windows a named pipe instead (Node listens on no other kind of path there).
+ * A pipe's name is in a namespace every account shares and can list, and
+ * one created first by someone else would be answered by them; so the name
+ * is random, made afresh at each supervisor start, kept where only this
+ * account can read it (`supervisor.pipe` in the data directory, see
+ * protectDataDirectory) beside a secret every answer carries, and given out
+ * only while `supervisor.lock` names a live supervisor. Otherwise: a name
+ * nobody can have made, which no one answers.
+ */
+export declare function supervisorSocket(data: string, platform?: NodeJS.Platform | string): string;
+/** Does an answer on this installation's socket come from its supervisor? Always, but on Windows (see supervisorSocket). */
+export declare function answeredBySupervisor(data: string, headers: Record<string, string | string[] | undefined>, platform?: NodeJS.Platform | string): boolean;
+/** What a client says when the pipe answered without this supervisor's secret (Windows). */
+export declare class NotOurSupervisor extends Error {
+    constructor();
+}
+export interface StartingOptions {
+    timeoutMs?: number;
+    intervalMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}
+/**
+ * A supervisor that holds the lock but does not answer yet is starting: its
+ * database, its migrations, then its socket (or pipe). It is waited for, never
+ * started again over it (that is what a sign-in race did: the task's
+ * supervisor starting while the desktop app ran `buddi --no-open`, which then
+ * tried to restart the service and could not reach it). Undefined when no
+ * supervisor holds the lock (any more). Throws when it has not answered in
+ * time, or at once when something else answers in its place: either way the
+ * caller must not start or restart anything over a live holder.
+ */
+export declare function awaitStartingSupervisor<T>(holder: () => number | undefined, ask: () => Promise<T>, options?: StartingOptions): Promise<T | undefined>;
+/**
+ * `buddi` with no command: the running supervisor's status, a starting one's
+ * once it answers, or undefined when none holds the lock (start one). Errors
+ * about a live holder (it never answered, something else answered) are
+ * thrown, never turned into "start another".
+ */
+export declare function runningOrStarting<T>(ask: () => Promise<T>, holder: () => number | undefined, options?: StartingOptions): Promise<T | undefined>;
+/** A new pipe name and secret for this supervisor (Windows; elsewhere the socket's path is fixed). Called with the lock held; returns the secret. */
+export declare function nameSupervisorPipe(data: string, platform?: NodeJS.Platform | string): Promise<string | undefined>;
 export declare function restartDelay(failures: number): number;
 /**
  * How long a handed-over supervisor waits to leave on its own before it is
@@ -104,6 +155,12 @@ export interface ControlSocketOptions {
     } | undefined;
     /** Cloudflare's connector (cloudflared.ts): its status, and the two verbs the gateway asks for. */
     connector?: Pick<Connector, 'status' | 'sync' | 'remove'> | undefined;
+    /**
+     * Shut the supervisor down as SIGTERM would. Windows has no signals (a kill
+     * there is TerminateProcess, which would leave the cluster running), so the
+     * uninstall asks here instead.
+     */
+    exit?: (() => void) | undefined;
 }
 /**
  * The maintenance API, served on a Unix domain socket in the data directory.
@@ -124,7 +181,7 @@ export interface ControlSocketOptions {
  * `<data>/incoming/`, and that is checked to be under that directory, resolved,
  * before it is passed on.
  */
-export declare function controlSocket({ status, action, backup, upgrade, data, uninstall, cli, connector }: ControlSocketOptions): Server;
+export declare function controlSocket({ status, action, backup, upgrade, data, uninstall, cli, connector, exit }: ControlSocketOptions): Server;
 /**
  * Bind the control socket, replacing a stale file a killed supervisor left.
  *

package/packages/install/dist/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAmB,MAAM,EAAkB,MAAM,WAAW,CAAC;AAWzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,kBAAkB,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMnE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAKnG;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AA0BD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAgE;AAEtH;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAC1C,+EAA+E;AAC/E,eAAO,MAAM,YAAY,QAAc,CAAC;AAExC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,GAAE,MAAqB,EAAE,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAkB,GAAG,MAAM,GAAG,SAAS,CAK/I;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG7C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAIhH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACpD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,GAAG,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5G,GAAG,MAAM,IAAI,CAgBb;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,gBAAgB,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACrC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,yDAAyD;IACzD,SAAS,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACzC,2EAA2E;IAC3E,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;IACtI,mGAAmG;IACnG,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,GAAG,SAAS,CAAC;CACvE;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,oBAAoB,GAAG,MAAM,CAuNhI;AAWD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAelF;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmYlE"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAmB,MAAM,EAAkB,MAAM,WAAW,CAAC;AAYzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,kBAAkB,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMnE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAKnG;AAED,kGAAkG;AAClG,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD,sGAAsG;AACtG,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,qHAAqH;AACrH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIzF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAAQ,GAAG,MAAyB,GAAG,MAAM,CAM5G;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,QAAQ,GAAE,MAAM,CAAC,QAAQ,GAAG,MAAyB,GAAG,OAAO,CAIzK;AAED,4FAA4F;AAC5F,qBAAa,gBAAiB,SAAQ,KAAK;;CAE1C;AAED,MAAM,WAAW,eAAe;IAAG,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;AAEvI;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAc/J;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAOzJ;AAED,qJAAqJ;AACrJ,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAAQ,GAAG,MAAyB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAOzI;AA0BD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAgE;AAEtH;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAC1C,+EAA+E;AAC/E,eAAO,MAAM,YAAY,QAAc,CAAC;AAExC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,GAAE,MAAqB,EAAE,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAkB,GAAG,MAAM,GAAG,SAAS,CAK/I;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG7C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAIhH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACpD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,GAAG,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5G,GAAG,MAAM,IAAI,CAgBb;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,gBAAgB,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACrC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,yDAAyD;IACzD,SAAS,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACzC,2EAA2E;IAC3E,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;IACtI,mGAAmG;IACnG,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,GAAG,SAAS,CAAC;IACtE;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CACjC;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,oBAAoB,GAAG,MAAM,CA8NtI;AAWD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BlF;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ZlE"}

package/packages/install/dist/supervisor.js

@@ -11,16 +11,19 @@ import { createServer } from 'node:http';
 import { spawn, execFile } from 'node:child_process';
 import { createWriteStream, existsSync, openSync, closeSync, mkdirSync, readFileSync, realpathSync, rmSync } from 'node:fs';
 import { readFile, chmod, unlink, lstat, mkdir, rename, copyFile, rm, writeFile } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { GATEWAY_PID_FILE, acquireLock, initialize, atomicJson, stopChild, portMovedLines, launchAgentLabel, launchAgentPlist, systemdUnitPath, nativeEnvironment, SERVICE_UNIT_VAR } from './environment.js';
-import { APP_UNINSTALL_EXIT, UNINSTALL_REQUEST, createProductUninstall } from './product-uninstall.js';
+import { GATEWAY_PID_FILE, KEPT_FOR_REINSTALL_FILE, acquireLock, lockHolder, initialize, atomicJson, stopChild, portMovedLines, launchAgentLabel, launchAgentPlist, systemdUnitPath, nativeEnvironment, SERVICE_UNIT_VAR } from './environment.js';
+import { APP_UNINSTALL_EXIT, UNINSTALL_REQUEST, createProductUninstall, desktopAppOnThisComputer } from './product-uninstall.js';
 import { installShim, shimsFor } from './cli-shim.js';
+import { windowsTaskName, windowsTaskScript } from './windows-task.js';
+import { nodeOutsideData, readWindowsInstallerRecord } from './windows-install.js';
 import { createBackupService, isIncomingPath, isSafeArchiveName, parseSchedule, sweepIncoming } from './backup.js';
 import { startDatabase } from './postgres.js';
 import { createUpgradeService, finishUpgrade, handOver, installedVersion, isVersion, recoverySentence, statusOnSocket, TICK_INTERVAL_MS } from './upgrade.js';
-import { APP_RESTART_EXIT, appLayout } from './app-layout.js';
+import { APP_RESTART_EXIT, appLayout, appRuns, currentLauncher, installerLayout, linuxInstall, windowsInstall } from './app-layout.js';
 import { createConnector } from './cloudflared.js';
 /** The launcher, as the supervisor spawns it for the gateway child. */
 const LAUNCHER = path.resolve(path.dirname(fileURLToPath(import.meta.url)), 'launcher.js');
@@ -38,10 +41,111 @@ export function pendingUpgrade(marker) {
     const named = [from, to, startedAt].every(value => typeof value === 'string' && value !== '');
     return named ? marker : undefined;
 }
-/** The control socket of the installation whose data directory this is. */
-export function supervisorSocket(data) {
+/** Where a Windows supervisor records the name of its pipe, inside the private data directory. */
+export const PIPE_NAME_FILE = 'supervisor.pipe';
+/** The response header a Windows supervisor proves itself with: the secret beside its pipe's name. */
+export const SUPERVISOR_SECRET_HEADER = 'x-buddi-supervisor';
+/** The live supervisor's pipe name and secret (Windows), or nothing when `supervisor.lock` names no live process. */
+export function supervisorPipe(data) {
+    if (lockHolder(data) === undefined)
+        return undefined;
+    const [name = '', secret = ''] = (() => { try {
+        return readFileSync(path.join(data, PIPE_NAME_FILE), 'utf8').split(/\r?\n/);
+    }
+    catch {
+        return [];
+    } })();
+    return /^buddi-supervisor-[0-9a-f]{32}$/.test(name) && /^[0-9a-f]{64}$/.test(secret) ? { name, secret } : undefined;
+}
+/**
+ * The control socket of the installation whose data directory this is. On
+ * Windows a named pipe instead (Node listens on no other kind of path there).
+ * A pipe's name is in a namespace every account shares and can list, and
+ * one created first by someone else would be answered by them; so the name
+ * is random, made afresh at each supervisor start, kept where only this
+ * account can read it (`supervisor.pipe` in the data directory, see
+ * protectDataDirectory) beside a secret every answer carries, and given out
+ * only while `supervisor.lock` names a live supervisor. Otherwise: a name
+ * nobody can have made, which no one answers.
+ */
+export function supervisorSocket(data, platform = process.platform) {
+    if (platform === 'win32') {
+        const pipe = supervisorPipe(data);
+        return pipe !== undefined ? `\\\\.\\pipe\\${pipe.name}` : `\\\\.\\pipe\\buddi-supervisor-none-${randomBytes(16).toString('hex')}`;
+    }
     return path.join(data, 'supervisor.sock');
 }
+/** Does an answer on this installation's socket come from its supervisor? Always, but on Windows (see supervisorSocket). */
+export function answeredBySupervisor(data, headers, platform = process.platform) {
+    if (platform !== 'win32')
+        return true;
+    const secret = supervisorPipe(data)?.secret;
+    return secret !== undefined && headers[SUPERVISOR_SECRET_HEADER] === secret;
+}
+/** What a client says when the pipe answered without this supervisor's secret (Windows). */
+export class NotOurSupervisor extends Error {
+    constructor() { super('Something other than this installation\'s supervisor answered on its pipe.'); }
+}
+/**
+ * A supervisor that holds the lock but does not answer yet is starting: its
+ * database, its migrations, then its socket (or pipe). It is waited for, never
+ * started again over it (that is what a sign-in race did: the task's
+ * supervisor starting while the desktop app ran `buddi --no-open`, which then
+ * tried to restart the service and could not reach it). Undefined when no
+ * supervisor holds the lock (any more). Throws when it has not answered in
+ * time, or at once when something else answers in its place: either way the
+ * caller must not start or restart anything over a live holder.
+ */
+export async function awaitStartingSupervisor(holder, ask, options = {}) {
+    const { timeoutMs = 90_000, intervalMs = 500 } = options;
+    const sleep = options.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const now = options.now ?? Date.now;
+    const since = now();
+    for (;;) {
+        const pid = holder();
+        if (pid === undefined)
+            return undefined;
+        try {
+            return await ask();
+        }
+        catch (error) {
+            if (error instanceof NotOurSupervisor)
+                throw error; /* not listening yet */
+        }
+        if (now() - since >= timeoutMs) {
+            throw new Error(`buddi is starting (supervisor pid ${pid}) and has not answered for ${Math.round(timeoutMs / 1000)} seconds. Its log is logs/supervisor.log in the data folder.`);
+        }
+        await sleep(intervalMs);
+    }
+}
+/**
+ * `buddi` with no command: the running supervisor's status, a starting one's
+ * once it answers, or undefined when none holds the lock (start one). Errors
+ * about a live holder (it never answered, something else answered) are
+ * thrown, never turned into "start another".
+ */
+export async function runningOrStarting(ask, holder, options = {}) {
+    try {
+        return await ask();
+    }
+    catch (error) {
+        if (error instanceof NotOurSupervisor)
+            throw error;
+        if (holder() === undefined)
+            return undefined;
+        return await awaitStartingSupervisor(holder, ask, options);
+    }
+}
+/** A new pipe name and secret for this supervisor (Windows; elsewhere the socket's path is fixed). Called with the lock held; returns the secret. */
+export async function nameSupervisorPipe(data, platform = process.platform) {
+    if (platform !== 'win32')
+        return undefined;
+    const file = path.join(data, PIPE_NAME_FILE);
+    const secret = randomBytes(32).toString('hex');
+    await writeFile(`${file}.tmp`, `buddi-supervisor-${randomBytes(16).toString('hex')}\n${secret}\n`, { mode: 0o600 });
+    await rename(`${file}.tmp`, file);
+    return secret;
+}
 /** The moved-port line for `/status`, for a day after the move. */
 function portNotice(moved) {
     if (!moved || Date.now() - Date.parse(moved.at) > 24 * 60 * 60_000)
@@ -190,7 +294,7 @@ function optionalString(value) {
  * `<data>/incoming/`, and that is checked to be under that directory, resolved,
  * before it is passed on.
  */
-export function controlSocket({ status, action, backup, upgrade, data, uninstall, cli, connector }) {
+export function controlSocket({ status, action, backup, upgrade, data, uninstall, cli, connector, exit }) {
     return createServer((req, res) => {
         void handle(req, res).catch(() => send(res, 500, { error: 'The supervisor could not complete that action.' }));
     });
@@ -208,6 +312,15 @@ export function controlSocket({ status, action, backup, upgrade, data, uninstall
                 return send(res, 200, base);
             return send(res, 200, { ...base, recovery: await recovery(), lastBackupAt: await backup.lastBackupAt() });
         }
+        if (method === 'POST' && route === '/exit' && exit) {
+            if (backup?.busy())
+                return send(res, 409, { error: 'A restore is running.' });
+            if (upgrade?.busy())
+                return send(res, 409, { error: 'An upgrade is running.' });
+            send(res, 202, status());
+            exit();
+            return;
+        }
         if (method === 'POST' && ['/start', '/stop', '/restart'].includes(route)) {
             // One hand on the lever at a time: a restore is already stopping and
             // starting the gateway around a database it is replacing.
@@ -473,6 +586,20 @@ function normalizePassphraseText(input) {
  * can reach the path in that window either way.
  */
 export async function listenOnSocket(server, socket) {
+    // A Windows named pipe is no file: nothing to replace, and no mode to set.
+    // Node offers no access list for it, so it has the default one: full
+    // control for this account, administrators and SYSTEM, read-only for
+    // everyone else — not enough to write a request. Its random name, readable
+    // by this account alone, is what keeps others from finding or squatting it
+    // (supervisorSocket), and libuv creates it as the first instance, so a pipe
+    // of that name someone else made first fails the listen instead of sharing it.
+    if (socket.startsWith('\\\\.\\pipe\\')) {
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(socket, () => resolve());
+        });
+        return;
+    }
     // Only a socket is replaced: a killed supervisor leaves exactly that. Any
     // other entry at the path is somebody else's, and refusing beats deleting it.
     try {
@@ -517,6 +644,7 @@ export async function supervise(ctx) {
     /** Has a pending upgrade been written into the history yet? */
     let resolved = false, pending;
     let desired = true, closing = false, chain = Promise.resolve();
+    let pipeSecret;
     let failures = 0;
     const stopGateway = async () => {
         desired = false;
@@ -533,11 +661,17 @@ export async function supervise(ctx) {
     const onSignal = () => { closing = true; desired = false; resolveShutdown(); };
     process.once('SIGINT', onSignal);
     process.once('SIGTERM', onSignal);
+    // Windows: its console closing (sign-out, shutdown) is the one signal node gets there.
+    if (process.platform === 'win32')
+        process.once('SIGHUP', onSignal);
     if (briefPid !== undefined) {
         unwatchBrief = watchBriefParent({ parent: briefPid, leave: why => { console.error(`supervisor: leaving the brief run: ${why}.`); onSignal(); } });
     }
     try {
         await initialize(ctx);
+        // Kept data that a buddi runs on again (buddi.app reinstalled on a Mac, where no setup clears it).
+        await rm(path.join(ctx.data, KEPT_FOR_REINSTALL_FILE), { force: true }).catch(() => { });
+        pipeSecret = await nameSupervisorPipe(ctx.data);
         const ready = ctx;
         /*
          * An upgrade that installed new code and handed over is finished here, by
@@ -602,7 +736,7 @@ export async function supervise(ctx) {
             // back and came up, so the upgrade is over without having arrived.
             console.error(entry.outcome === 'done'
                 ? `upgrade: ${entry.from} to ${entry.to} finished.`
-                : entry.step === 'finishing' ? `upgrade: ${entry.error}.` : recoverySentence(entry, { app: appLayout(process.env) !== undefined }));
+                : entry.step === 'finishing' ? `upgrade: ${entry.error}.` : recoverySentence(entry, { app: appRuns(process.env), linux: linuxInstall(process.env), windows: windowsInstall(process.env) }));
         }
         else {
             ready.state.phase = 'ready';
@@ -618,7 +752,7 @@ export async function supervise(ctx) {
             if (closing || !database.alive || (child && child.exitCode === null && child.signalCode === null))
                 return;
             const started = Date.now();
-            child = spawn(process.execPath, [LAUNCHER, '__gateway'], { env: ready.env, stdio: ['ignore', 'pipe', 'pipe', 'ipc'] });
+            child = spawn(process.execPath, [LAUNCHER, '__gateway'], { env: ready.env, stdio: ['ignore', 'pipe', 'pipe', 'ipc'], windowsHide: true });
             console.error(`supervisor: gateway started (pid ${child.pid}).`);
             // Recorded, so a supervisor that dies and leaves it running is not taken
             // for a stranger holding the web port at the next start (environment.ts).
@@ -678,19 +812,30 @@ export async function supervise(ctx) {
         });
         // Uninstall from the product: the last backup and its words first, then the removal (product-uninstall.ts).
         const home = os.homedir();
-        const appFinishes = appLayout(process.env) !== undefined;
+        // buddi.app finishes its own removal; the Linux install shares its layout but not that.
+        const appFinishes = appRuns(process.env);
         uninstall = createProductUninstall({
             data: ready.data, home, backup, appFinishes,
             plan: () => {
-                const unit = process.platform === 'darwin' ? launchAgentPlist(ready.data, home) : process.platform === 'linux' ? systemdUnitPath(ready.data, ready.env, home) : undefined;
+                const unit = process.platform === 'darwin' ? launchAgentPlist(ready.data, home) : process.platform === 'linux' ? systemdUnitPath(ready.data, ready.env, home) : process.platform === 'win32' ? windowsTaskScript(ready.data) : undefined;
                 const bundle = process.env.BUDDI_APP_BUNDLE?.trim();
+                const setupUninstaller = process.platform === 'win32'
+                    ? readWindowsInstallerRecord((() => { try {
+                        return readFileSync(path.join(ready.data, 'installer.json'), 'utf8');
+                    }
+                    catch {
+                        return undefined;
+                    } })()).uninstaller
+                    : undefined;
+                const desktopApp = desktopAppOnThisComputer(process.platform, { exists: existsSync, ...(setupUninstaller === undefined ? {} : { setupUninstaller }) });
                 return {
                     data: ready.data,
                     ...(core.vaultSelection({ env: ready.env }) === 'keychain' && ready.env.BUDDI_VAULT_SERVICE ? { keychain: ready.env.BUDDI_VAULT_SERVICE } : {}),
-                    ...(unit !== undefined && existsSync(unit) ? { service: process.platform === 'darwin' ? `launchd agent ${launchAgentLabel(ready.data)}` : `systemd user unit ${launchAgentLabel(ready.data)}.service` } : {}),
+                    ...(unit !== undefined && existsSync(unit) ? { service: process.platform === 'darwin' ? `launchd agent ${launchAgentLabel(ready.data)}` : process.platform === 'win32' ? `Task Scheduler task ${windowsTaskName(launchAgentLabel(ready.data))}` : `systemd user unit ${launchAgentLabel(ready.data)}.service` } : {}),
                     ...(appFinishes && bundle ? { app: bundle } : {}),
                     backups: path.join(home, 'buddi-backups'),
                     appFinishes,
+                    ...(desktopApp === undefined ? {} : { desktopApp }),
                 };
             },
             exists: existsSync,
@@ -717,11 +862,13 @@ export async function supervise(ctx) {
                 const env = { ...nativeEnvironment(startEnv), BUDDI_DATA_DIR: ready.data,
                     ...Object.fromEntries(['XDG_RUNTIME_DIR', 'DBUS_SESSION_BUS_ADDRESS'].filter(key => typeof startEnv[key] === 'string').map(key => [key, startEnv[key]])) };
                 // systemd stops every process in the unit's cgroup with it: the uninstall runs in a transient scope of its own.
+                // Windows: a node from inside the data folder (the Windows install's) would keep it from being removed.
+                const node = nodeOutsideData(ready.data);
                 const [command, args] = startEnv[SERVICE_UNIT_VAR]
                     ? ['systemd-run', ['--user', '--collect', '--quiet', '--scope', process.execPath, LAUNCHER, ...argv]]
-                    : [process.execPath, [LAUNCHER, ...argv]];
+                    : [node, [LAUNCHER, ...argv]];
                 console.error(`supervisor: removing buddi; the account is in ${logFile}.`);
-                const child = spawn(command, args, { detached: true, stdio: ['ignore', fd, fd], env, cwd: home });
+                const child = spawn(command, args, { detached: true, stdio: ['ignore', fd, fd], env, cwd: home, windowsHide: true });
                 child.unref();
                 closeSync(fd);
             },
@@ -789,7 +936,13 @@ export async function supervise(ctx) {
                 await stopGateway(); if (name !== 'stop')
                 start(); }); return chain; },
             backup, upgrade, data: ready.data, uninstall, cli, connector,
+            exit: () => { console.error('supervisor: asked to exit on the control socket.'); onSignal(); },
         });
+        if (pipeSecret !== undefined) {
+            const secret = pipeSecret;
+            // Before the routes answer: every reply says it is this supervisor's.
+            server.prependListener('request', (_req, res) => { res.setHeader(SUPERVISOR_SECRET_HEADER, secret); });
+        }
         await listenOnSocket(server, supervisorSocket(ready.data));
         if (briefly)
             console.error('supervisor: started briefly, for an uninstall\'s last backup; the gateway stays stopped.');
@@ -833,7 +986,7 @@ export async function supervise(ctx) {
             const entry = await finishUpgrade(ctx, pending, { ok: false, error: error instanceof Error ? error.message : String(error) }, 'starting')
                 .catch(() => undefined);
             if (entry)
-                console.error(recoverySentence(entry, { app: appLayout(process.env) !== undefined }));
+                console.error(recoverySentence(entry, { app: appRuns(process.env), linux: linuxInstall(process.env), windows: windowsInstall(process.env) }));
         }
         throw error;
     }
@@ -864,9 +1017,13 @@ export async function supervise(ctx) {
         }
         finally {
             log?.end();
+            // Its pipe's name and secret go before the lock does (Windows).
+            if (pipeSecret !== undefined)
+                await rm(path.join(ctx.data, PIPE_NAME_FILE), { force: true });
             await release();
             process.removeListener('SIGINT', onSignal);
             process.removeListener('SIGTERM', onSignal);
+            process.removeListener('SIGHUP', onSignal);
         }
     }
     // buddi.app finishes an uninstall the owner started in Settings → System (product-uninstall.ts).
@@ -885,7 +1042,8 @@ export async function supervise(ctx) {
     if (handingOver) {
         const marker = ctx.state?.upgrade;
         const result = await handOver({
-            ctx, launcher: LAUNCHER, env: startEnv,
+            // An installer's successor (Linux, Windows) is `current`'s launcher, which the upgrade just switched.
+            ctx, launcher: installerLayout(process.env) ? currentLauncher(appLayout(process.env)) : LAUNCHER, env: startEnv,
             /*
              * The successor is ready when it serves, not when it holds the lock: it
              * takes the lock first and then starts a cluster and runs migrations,
@@ -893,7 +1051,7 @@ export async function supervise(ctx) {
              * installed is the whole hand-over, observed rather than assumed.
              */
             ready: async () => {
-                const status = await statusOnSocket(supervisorSocket(ctx.data));
+                const status = await statusOnSocket(supervisorSocket(ctx.data), undefined, headers => answeredBySupervisor(ctx.data, headers));
                 if (status !== undefined && status.current === marker?.to)
                     return true;
                 /*
@@ -924,7 +1082,7 @@ export async function supervise(ctx) {
             const entry = await finishUpgrade(ctx, marker, { ok: false, error: `the upgraded supervisor did not answer on ${supervisorSocket(ctx.data)}` }, 'starting')
                 .catch(() => undefined);
             if (entry)
-                console.error(recoverySentence(entry, { app: appLayout(process.env) !== undefined }));
+                console.error(recoverySentence(entry, { app: appRuns(process.env), linux: linuxInstall(process.env), windows: windowsInstall(process.env) }));
         }
         /*
          * And then go, whatever is still holding the loop.