@zswarm/core 0.2.6 → 0.2.7

package/dist/ops/serve-install.js

@@ -7,7 +7,7 @@ import { pathToFileURL } from "node:url";
 import { ZellijError } from "../errors.js";
 import { encodePowerShellCommand } from "../zellij/ipc.js";
 import { coverHostReport, hostDoctorRequest, isRequiredFailure, mergeHostReply, } from "./doctor.js";
-import { callServe, isLoopbackHost, parseListenAddress, probeServe, redactServeSecret, SERVE_CORE_VERSION, SERVE_HELLO_TIMEOUT_MS, SERVE_LAUNCH_ID_ENV, SERVE_PROTOCOL, SERVE_TASK_NAME, serveLogonCommand, } from "./serve.js";
+import { callServe, isLoopbackHost, parseListenAddress, probeServe, redactServeSecret, SERVE_CORE_VERSION, SERVE_HELLO_TIMEOUT_MS, SERVE_LAUNCH_ID_ENV, SERVE_PROTOCOL, SERVE_TASK_NAME, serveLogonCommand, serveTaskTarget, } from "./serve.js";
 import { authorizeServeListen, SERVE_BIND_REMEDY, SERVE_TAILSCALE_BIN_ENV, } from "./serve-bind.js";
 import { throwIfAborted } from "./util.js";
 /** Overall install/readiness deadline when `timeoutMs` is omitted. */
@@ -90,11 +90,45 @@ const PS_PREAMBLE = [
     "  $json = $obj | ConvertTo-Json -Compress -Depth 6",
     "  [Console]::Out.Write($json)",
     "}",
-    `function Get-ZswarmTask { Get-ScheduledTask -TaskName '${SERVE_TASK_NAME}' -ErrorAction Stop }`,
     "function Test-ZswarmMissing($err) {",
     "  return $err.CategoryInfo.Category -eq 'ObjectNotFound' -or ([string]$err.FullyQualifiedErrorId -match 'ObjectNotFound')",
     "}",
 ].join("\n");
+/** A literal `Get-ScheduledTask` lookup; a missing task or folder is `$null`. */
+function scheduledTaskLookup(name, folder) {
+    const path = folder && folder !== "\\" ? ` -TaskPath '${folder}'` : "";
+    return `Get-ScheduledTask -TaskName '${name}'${path} -ErrorAction SilentlyContinue`;
+}
+/**
+ * WHY: a legacy install lives at the Task Scheduler root as `zswarm-serve` and
+ * records the session it serves as `set "ZSWARM_SESSION=<session>"` in its action.
+ * A named session may adopt that task, but only for the session it records:
+ * without the marker, `--clear --session other` would stop an unrelated serve.
+ * The per-session name is always looked up first so a real per-session task wins.
+ */
+function serveTargetResolver(target) {
+    const folder = target.folder ?? "";
+    const session = target.session ?? "";
+    const lines = [
+        "function Get-ZswarmTarget {",
+        `  $found = ${scheduledTaskLookup(target.name, folder)}`,
+        "  if ($found) { return @{ task = $found; name = [string]$found.TaskName; path = [string]$found.TaskPath; legacy = $false } }",
+    ];
+    if (session) {
+        lines.push(`  $legacyTask = ${scheduledTaskLookup(SERVE_TASK_NAME, "")}`, `  if ($legacyTask -and ([string]$legacyTask.Actions[0].Arguments).Contains('set "ZSWARM_SESSION=${session}"')) {`, "    return @{ task = $legacyTask; name = [string]$legacyTask.TaskName; path = [string]$legacyTask.TaskPath; legacy = $true }", "  }");
+    }
+    lines.push(`  return @{ task = $null; name = '${target.name}'; path = '${folder}'; legacy = $false }`, "}");
+    return lines;
+}
+/** Preamble + the target-aware resolver; every action resolves before it mutates. */
+function buildPreamble(target) {
+    return [PS_PREAMBLE, ...serveTargetResolver(target)].join("\n");
+}
+/** Splat only when the resolved task really sits in a folder. */
+const TASK_PATH_SPLAT = [
+    "$taskPath = @{}",
+    "if (-not [string]::IsNullOrEmpty($target.path) -and $target.path -ne '\\') { $taskPath = @{ TaskPath = $target.path } }",
+];
 const REMEDY = {
     notReady: "Registration/start was accepted, but authenticated hello and host inspection did not prove this installation is ready. Retry serve --install or inspect with zswarm doctor; serve --clear removes the owned task. Install does not kill unrelated processes.",
     stale: "A listener answered on this port but did not present this installation's launch identity. Install does not kill arbitrary node processes or port owners. Stop the owned zswarm-serve task (serve --clear) or free the port, then retry.",
@@ -249,19 +283,17 @@ function privilegedSid(sid) {
     return WELL_KNOWN_SIDS.has(sid.trim().toUpperCase());
 }
 export function buildServeTaskScript(action, params = {}) {
+    const target = params.target ?? serveTaskTarget();
     if (action === "inspect") {
         return [
-            PS_PREAMBLE,
-            "try {",
-            "  $task = Get-ZswarmTask",
-            "} catch {",
-            "  if (Test-ZswarmMissing $_) {",
-            "    $identity = Get-ZswarmIdentity",
-            "    Write-ZswarmJson @{ exists = $false; currentUser = $identity.name; currentSid = $identity.sid }",
-            "    exit 0",
-            "  }",
-            "  throw",
+            buildPreamble(target),
+            "$target = Get-ZswarmTarget",
+            "if (-not $target.task) {",
+            "  $identity = Get-ZswarmIdentity",
+            "  Write-ZswarmJson @{ exists = $false; currentUser = $identity.name; currentSid = $identity.sid; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
+            "  exit 0",
             "}",
+            "$task = $target.task",
             "$identity = Get-ZswarmIdentity",
             "$action = @($task.Actions)[0]",
             "$principal = $task.Principal",
@@ -270,6 +302,8 @@ export function buildServeTaskScript(action, params = {}) {
             "  currentUser = $identity.name",
             "  currentSid = $identity.sid",
             "  taskName = [string]$task.TaskName",
+            "  taskPath = [string]$task.TaskPath",
+            "  legacy = $target.legacy",
             "  state = [string]$task.State",
             "  userId = [string]$principal.UserId",
             "  userSid = (Resolve-ZswarmSid ([string]$principal.UserId))",
@@ -284,96 +318,92 @@ export function buildServeTaskScript(action, params = {}) {
         const command = params.command ?? "";
         const commandB64 = Buffer.from(command, "utf8").toString("base64");
         return [
-            PS_PREAMBLE,
+            buildPreamble(target),
             `$cmd = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${commandB64}'))`,
-            "try {",
-            "  $existing = Get-ZswarmTask",
+            "$target = Get-ZswarmTarget",
+            "$existing = $target.task",
+            "if ($existing) {",
             "  $identity = Assert-ZswarmCurrentOwner $existing",
-            "} catch {",
-            "  if (-not (Test-ZswarmMissing $_)) { throw }",
+            "} else {",
             "  $identity = Get-ZswarmIdentity",
             "}",
             "$userId = $identity.name",
             "$action = New-ScheduledTaskAction -Execute 'cmd.exe' -Argument ('/c ' + $cmd)",
             "$principal = New-ScheduledTaskPrincipal -UserId $userId -LogonType Interactive -RunLevel Limited",
             "$trigger = New-ScheduledTaskTrigger -AtLogOn -User $userId",
-            `Register-ScheduledTask -TaskName '${SERVE_TASK_NAME}' -Action $action -Principal $principal -Trigger $trigger -Force | Out-Null`,
-            "Write-ZswarmJson @{ registered = $true; userId = $userId; userSid = $identity.sid; logonType = 'Interactive'; runLevel = 'Limited'; taskName = '" +
-                SERVE_TASK_NAME +
-                "' }",
+            ...TASK_PATH_SPLAT,
+            "Register-ScheduledTask -TaskName $target.name @taskPath -Action $action -Principal $principal -Trigger $trigger -Force | Out-Null",
+            "Write-ZswarmJson @{ registered = $true; userId = $userId; userSid = $identity.sid; logonType = 'Interactive'; runLevel = 'Limited'; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
         ].join("\n");
     }
     if (action === "start") {
+        // Start is only ever asked for a task that was just registered or just
+        // found, so a missing one is a real failure and keeps the old contract:
+        // the strict lookup below throws the cmdlet's own ObjectNotFound.
         return [
-            PS_PREAMBLE,
-            "try {",
-            "  $task = Get-ZswarmTask",
-            "  [void](Assert-ZswarmCurrentOwner $task)",
-            "} catch {",
-            "  throw",
+            buildPreamble(target),
+            "$target = Get-ZswarmTarget",
+            "if (-not $target.task) {",
+            "  if ([string]::IsNullOrEmpty($target.path) -or $target.path -eq '\\') { Get-ScheduledTask -TaskName $target.name -ErrorAction Stop | Out-Null }",
+            "  else { Get-ScheduledTask -TaskName $target.name -TaskPath $target.path -ErrorAction Stop | Out-Null }",
             "}",
-            `Start-ScheduledTask -TaskName '${SERVE_TASK_NAME}'`,
-            "Write-ZswarmJson @{ started = $true; taskName = '" + SERVE_TASK_NAME + "' }",
+            "$task = $target.task",
+            ...TASK_PATH_SPLAT,
+            "[void](Assert-ZswarmCurrentOwner $task)",
+            "Start-ScheduledTask -TaskName $target.name @taskPath",
+            "Write-ZswarmJson @{ started = $true; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
         ].join("\n");
     }
     if (action === "stop") {
         return [
-            PS_PREAMBLE,
+            buildPreamble(target),
+            "$target = Get-ZswarmTarget",
+            "$task = $target.task",
+            ...TASK_PATH_SPLAT,
+            "if ($task) { [void](Assert-ZswarmCurrentOwner $task) }",
             "try {",
-            "  $task = Get-ZswarmTask",
-            "  [void](Assert-ZswarmCurrentOwner $task)",
-            `  Stop-ScheduledTask -TaskName '${SERVE_TASK_NAME}'`,
+            "  Stop-ScheduledTask -TaskName $target.name @taskPath",
             "} catch {",
             "  if (-not (Test-ZswarmMissing $_)) { throw }",
             "}",
-            "Write-ZswarmJson @{ stopped = $true; taskName = '" + SERVE_TASK_NAME + "' }",
+            "Write-ZswarmJson @{ stopped = $true; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
         ].join("\n");
     }
     return [
-        PS_PREAMBLE,
+        buildPreamble(target),
         "$identity = Get-ZswarmIdentity",
         "$stopped = $false",
         "$stopFailed = $false",
         "$stopError = $null",
-        "try {",
-        "  $task = Get-ZswarmTask",
-        "} catch {",
-        "  if (Test-ZswarmMissing $_) {",
-        "    Write-ZswarmJson @{ cleared = $true; missing = $true; stopped = $false; taskName = '" +
-            SERVE_TASK_NAME +
-            "' }",
-        "    exit 0",
-        "  }",
-        "  throw",
+        "$target = Get-ZswarmTarget",
+        "$task = $target.task",
+        ...TASK_PATH_SPLAT,
+        "if (-not $task) {",
+        "  Write-ZswarmJson @{ cleared = $true; missing = $true; stopped = $false; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
+        "  exit 0",
         "}",
         "[void](Assert-ZswarmCurrentOwner $task)",
         "try {",
-        `  Stop-ScheduledTask -TaskName '${SERVE_TASK_NAME}'`,
+        "  Stop-ScheduledTask -TaskName $target.name @taskPath",
         "  $stopped = $true",
         "} catch {",
         "  if (Test-ZswarmMissing $_) {",
-        "    Write-ZswarmJson @{ cleared = $true; missing = $true; stopped = $false; taskName = '" +
-            SERVE_TASK_NAME +
-            "' }",
+        "    Write-ZswarmJson @{ cleared = $true; missing = $true; stopped = $false; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
         "    exit 0",
         "  }",
         "  $stopFailed = $true",
         "  $stopError = [string]$_.Exception.Message",
         "}",
         "try {",
-        `  Unregister-ScheduledTask -TaskName '${SERVE_TASK_NAME}' -Confirm:$false`,
+        "  Unregister-ScheduledTask -TaskName $target.name @taskPath -Confirm:$false",
         "} catch {",
         "  if (Test-ZswarmMissing $_) {",
-        "    Write-ZswarmJson @{ cleared = $true; missing = $true; stopped = $stopped; stopFailed = $stopFailed; stopError = $stopError; taskName = '" +
-            SERVE_TASK_NAME +
-            "' }",
+        "    Write-ZswarmJson @{ cleared = $true; missing = $true; stopped = $stopped; stopFailed = $stopFailed; stopError = $stopError; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
         "    exit 0",
         "  }",
         "  throw",
         "}",
-        "Write-ZswarmJson @{ cleared = $true; stopped = $stopped; stopFailed = $stopFailed; stopError = $stopError; taskName = '" +
-            SERVE_TASK_NAME +
-            "' }",
+        "Write-ZswarmJson @{ cleared = $true; stopped = $stopped; stopFailed = $stopFailed; stopError = $stopError; taskName = $target.name; taskPath = $target.path; legacy = $target.legacy }",
     ].join("\n");
 }
 function runPowerShellDefault(script, options) {
@@ -513,6 +543,11 @@ function launchIdFromCommand(command) {
 function asString(value) {
     return typeof value === "string" ? value : "";
 }
+/** Task Scheduler reports the root folder as `\`; our target path is `''` there. */
+function serveTaskFolder(value) {
+    const text = asString(value).trim();
+    return text === "\\" ? "" : text;
+}
 function liveSessionsFrom(checks) {
     const row = checks.find((item) => item.id === "zellij_sessions");
     const live = row?.detail?.live;
@@ -570,7 +605,10 @@ function notReadyError(message, details, secrets, code = SERVE_NOT_READY_CODE) {
     return new ZellijError(code, scrubDiagnosticText(message, secrets), scrubSecrets(details, secrets));
 }
 async function runTask(action, input) {
-    const script = buildServeTaskScript(action, { command: input.command });
+    const script = buildServeTaskScript(action, {
+        command: input.command,
+        target: input.target,
+    });
     const result = await input.run(script, {
         timeoutMs: input.timeoutMs,
         signal: input.signal,
@@ -642,6 +680,10 @@ export async function installServeLogon(input = {}) {
     const { host, label } = parseListenAddress(input.listen);
     const token = serveInstallToken(input);
     const secrets = [token];
+    // One resolved task identity for the whole install: inspect, register, start and
+    // stop must all address the same task, including an adopted legacy one.
+    const explicitSession = input.session?.trim() || null;
+    const target = serveTaskTarget(explicitSession);
     throwIfAborted(input.signal);
     if (remaining() <= 0) {
         throw notReadyError("serve --install timed out before task mutation", {
@@ -651,7 +693,9 @@ export async function installServeLogon(input = {}) {
             phase: "inspect",
             cause: "timeout",
             listen: label,
-            task: SERVE_TASK_NAME,
+            task: target.name,
+            taskPath: target.folder ?? "",
+            legacy: false,
         }, secrets, "timeout");
     }
     // Non-loopback: verify Tailscale + OS ownership before any task mutation.
@@ -675,7 +719,9 @@ export async function installServeLogon(input = {}) {
             phase: "verify",
             cause: "timeout",
             listen: label,
-            task: SERVE_TASK_NAME,
+            task: target.name,
+            taskPath: target.folder ?? "",
+            legacy: false,
         }, secrets, "timeout");
     }
     const launch = resolveServeCliLaunch({
@@ -688,14 +734,19 @@ export async function installServeLogon(input = {}) {
     const probe = input.probeServe ?? probeServe;
     const call = input.callServe ??
         ((target, args, options) => callServe(target, args, options));
-    const explicitSession = input.session?.trim() || null;
     const requestedLaunchId = input.launchId?.trim() || "";
+    // Refined after inspect when a real (possibly adopted legacy) task is found.
+    let taskName = target.name;
+    let taskPath = target.folder ?? "";
+    let legacyAdopted = false;
     const partial = (extra) => {
         const details = scrubSecrets({
             installed: false,
             ready: false,
             running: false,
-            task: SERVE_TASK_NAME,
+            task: taskName,
+            taskPath,
+            legacy: legacyAdopted,
             listen: label,
             ...extra,
         }, secrets);
@@ -734,8 +785,13 @@ export async function installServeLogon(input = {}) {
         timeoutMs: inspectBudget,
         signal: input.signal,
         secrets,
+        target,
     });
     const exists = inspected.exists === true;
+    // The inspected identity wins: it is the real task (or the adopted legacy one).
+    taskName = asString(inspected.taskName) || target.name;
+    legacyAdopted = inspected.legacy === true;
+    taskPath = legacyAdopted ? "" : serveTaskFolder(inspected.taskPath) || (target.folder ?? "");
     const existingCommand = commandFromArguments(asString(inspected.arguments));
     secrets.push(...tokenFromCommand(existingCommand));
     const ownership = (() => {
@@ -758,7 +814,7 @@ export async function installServeLogon(input = {}) {
         }
         const verified = isWindowsSid(userSid) && sameWindowsSid(currentSid, userSid);
         if (!verified || privilegedSid(userSid) || privilegedAccount(userId)) {
-            throw notReadyError(`serve --install will not overwrite ${SERVE_TASK_NAME} owned by ${userId || "an unverified account"}`, {
+            throw notReadyError(`serve --install will not overwrite ${taskName} owned by ${userId || "an unverified account"}`, {
                 ...partial({
                     phase: "inspect",
                     cause: SERVE_TASK_OWNED_CODE,
@@ -774,7 +830,13 @@ export async function installServeLogon(input = {}) {
     const execute = asString(inspected.execute);
     const alreadyRunning = exists && taskRunning(asString(inspected.state));
     const existingLaunchId = launchIdFromCommand(existingCommand);
-    const desiredBase = serveLogonCommand(launch.execPath, launch.scriptPath, label, token, serveTaskLaunchEnv(env));
+    // WHY: a legacy task is recognised only by the session its command records. If
+    // we re-register it under its own root-folder name, keep the marker, or the
+    // next `--clear --session` can no longer recognise (and remove) it.
+    const taskEnv = legacyAdopted && explicitSession
+        ? { ...env, ZSWARM_SESSION: explicitSession }
+        : env;
+    const desiredBase = serveLogonCommand(launch.execPath, launch.scriptPath, label, token, serveTaskLaunchEnv(taskEnv));
     const configMatches = exists &&
         execute.toLowerCase() === "cmd.exe" &&
         serveCommandFingerprint(existingCommand) === desiredBase &&
@@ -786,7 +848,7 @@ export async function installServeLogon(input = {}) {
     const launchId = reuseExistingLaunch
         ? existingLaunchId
         : (requestedLaunchId || randomUUID());
-    const childEnv = serveTaskLaunchEnv(env, launchId);
+    const childEnv = serveTaskLaunchEnv(taskEnv, launchId);
     const command = serveLogonCommand(launch.execPath, launch.scriptPath, label, token, childEnv);
     const redactedCommand = redactServeSecret(command, token);
     const needsUpdate = !reuseExistingLaunch;
@@ -806,6 +868,7 @@ export async function installServeLogon(input = {}) {
                 signal: input.signal,
                 secrets,
                 command: commandArg,
+                target,
             });
         }
         catch (err) {
@@ -1033,7 +1096,9 @@ export async function installServeLogon(input = {}) {
                 installed: true,
                 ready: true,
                 running: true,
-                task: SERVE_TASK_NAME,
+                task: taskName,
+                taskPath,
+                legacy: legacyAdopted,
                 listen: label,
                 command: redactedCommand,
                 principal,
@@ -1055,7 +1120,7 @@ export async function installServeLogon(input = {}) {
             lastCause === "zellij_wrong_bin" ||
             lastCause === "zellij_incompatible";
         if (conclusive) {
-            throw notReadyError(`serve --install registered ${SERVE_TASK_NAME} but it is not ready (${lastCause})`, known(), secrets);
+            throw notReadyError(`serve --install registered ${taskName} but it is not ready (${lastCause})`, known(), secrets);
         }
         if (remaining() <= 0)
             break;
@@ -1067,7 +1132,7 @@ export async function installServeLogon(input = {}) {
     const code = lastCause === "cancelled" ? "cancelled" : remaining() <= 0 || lastCause === "timeout" ? "timeout" : SERVE_NOT_READY_CODE;
     throw notReadyError(code === "timeout"
         ? "serve --install timed out waiting for authenticated readiness"
-        : `serve --install registered ${SERVE_TASK_NAME} but it is not ready (${lastCause})`, known(), secrets, code === SERVE_NOT_READY_CODE ? SERVE_NOT_READY_CODE : code);
+        : `serve --install registered ${taskName} but it is not ready (${lastCause})`, known(), secrets, code === SERVE_NOT_READY_CODE ? SERVE_NOT_READY_CODE : code);
 }
 export async function uninstallServeLogon(input = {}) {
     if ((input.platform ?? process.platform) !== "win32") {
@@ -1080,12 +1145,21 @@ export async function uninstallServeLogon(input = {}) {
     const token = input.token?.trim() || input.env?.ZSWARM_SERVE_TOKEN?.trim() || "none";
     const secrets = token === "none" ? [] : [token];
     const run = input.runPowerShell ?? runPowerShellDefault;
+    // `--clear` honours `--session`: a named session removes its per-session task,
+    // or the legacy root task only when that task records the same session.
+    const explicitSession = input.session?.trim() || null;
+    const target = serveTaskTarget(explicitSession);
+    let taskName = target.name;
+    let taskPath = target.folder ?? "";
+    let legacyAdopted = false;
     const assertClear = (phase, extra = {}) => {
         if (input.signal?.aborted) {
             throw notReadyError("serve --clear cancelled", {
                 installed: extra.installed ?? false,
                 ready: false,
-                task: SERVE_TASK_NAME,
+                task: taskName,
+                taskPath,
+                legacy: legacyAdopted,
                 phase,
                 cause: "cancelled",
                 ...extra,
@@ -1096,7 +1170,9 @@ export async function uninstallServeLogon(input = {}) {
             throw notReadyError("serve --clear timed out", {
                 installed: extra.installed ?? false,
                 ready: false,
-                task: SERVE_TASK_NAME,
+                task: taskName,
+                taskPath,
+                legacy: legacyAdopted,
                 phase,
                 cause: "timeout",
                 ...extra,
@@ -1110,7 +1186,11 @@ export async function uninstallServeLogon(input = {}) {
         timeoutMs: inspectBudget,
         signal: input.signal,
         secrets,
+        target,
     });
+    taskName = asString(inspected.taskName) || target.name;
+    legacyAdopted = inspected.legacy === true;
+    taskPath = legacyAdopted ? "" : serveTaskFolder(inspected.taskPath) || (target.folder ?? "");
     secrets.push(...tokenFromCommand(commandFromArguments(asString(inspected.arguments))));
     assertClear("unregister", { installed: inspected.exists === true });
     if (inspected.exists === true) {
@@ -1120,10 +1200,12 @@ export async function uninstallServeLogon(input = {}) {
         const existingUser = asString(inspected.userId);
         const verified = isWindowsSid(currentSid) && isWindowsSid(userSid) && sameWindowsSid(currentSid, userSid);
         if (!verified || privilegedSid(userSid) || privilegedAccount(existingUser)) {
-            throw notReadyError(`serve --clear will not remove ${SERVE_TASK_NAME} owned by ${existingUser || "an unverified account"}`, {
+            throw notReadyError(`serve --clear will not remove ${taskName} owned by ${existingUser || "an unverified account"}`, {
                 installed: true,
                 ready: false,
-                task: SERVE_TASK_NAME,
+                task: taskName,
+                taskPath,
+                legacy: legacyAdopted,
                 phase: "inspect",
                 cause: SERVE_TASK_OWNED_CODE,
                 remedy: REMEDY.owner,
@@ -1141,13 +1223,16 @@ export async function uninstallServeLogon(input = {}) {
             timeoutMs: unregisterBudget,
             signal: input.signal,
             secrets,
+            target,
         });
     }
     catch (err) {
         if (err instanceof ZellijError && (err.code === "cancelled" || err.code === "timeout")) {
             throw notReadyError(err.message, {
                 ready: false,
-                task: SERVE_TASK_NAME,
+                task: taskName,
+                taskPath,
+                legacy: legacyAdopted,
                 phase: "unregister",
                 cause: err.code,
                 mutation: "uncertain",
@@ -1165,7 +1250,9 @@ export async function uninstallServeLogon(input = {}) {
     };
     assertClear("unregister", confirmed);
     return {
-        task: SERVE_TASK_NAME,
+        task: taskName,
+        taskPath,
+        legacy: legacyAdopted,
         ...confirmed,
     };
 }

package/dist/ops/serve.d.ts

@@ -2,7 +2,35 @@ import { type Server, type Socket } from "node:net";
 import { type NetworkInterfacesFn, type ServeBindDeps, type TailscaleStatusRunner } from "./serve-bind.js";
 import type { OpsResult } from "./types.js";
 export declare const DEFAULT_SERVE_LISTEN = "127.0.0.1:9419";
+/**
+ * The Windows logon task name used before serve was per session. Installs
+ * without a session still use it, at the Task Scheduler root, exactly as they
+ * always have; an install with `--session` gets its own task under the folder
+ * below, so a second serve cannot overwrite the first.
+ */
 export declare const SERVE_TASK_NAME = "zswarm-serve";
+/** Folder for per-session serve tasks, next to the crew tasks. */
+export declare const SERVE_TASK_FOLDER = "\\zswarm\\";
+export type ServeTaskTarget = {
+    /** `null` is the Task Scheduler root, where a sessionless install lives. */
+    folder: string | null;
+    name: string;
+    /** The session this task stands for, or null for the legacy singleton. */
+    session: string | null;
+};
+/**
+ * The task one serve install/clear owns: `\zswarm\zswarm-serve-<session>` when a
+ * session is named, otherwise the legacy root-folder `zswarm-serve` (so an
+ * install that never names a session behaves exactly as it did before).
+ */
+export declare function serveTaskTarget(session?: string | null): ServeTaskTarget;
+/**
+ * The session a stored task command says it serves, from the
+ * `set "ZSWARM_SESSION=<session>"` an install bakes into the task environment.
+ * This is how a legacy root-folder install is recognised as belonging to one
+ * session: without it, a `--session` install/clear leaves that task alone.
+ */
+export declare function sessionFromCommand(command: string): string | null;
 /** One JSONL request; a client that never sends newline cannot grow forever. */
 export declare const SERVE_MAX_REQUEST_BYTES: number;
 /**

package/dist/ops/serve.js

@@ -5,7 +5,42 @@ import { hostname } from "node:os";
 import { ZellijError } from "../errors.js";
 import { authorizeServeListen, SERVE_BIND_REMEDY, SERVE_BIND_VERIFY_TIMEOUT_MS, } from "./serve-bind.js";
 export const DEFAULT_SERVE_LISTEN = "127.0.0.1:9419";
+/**
+ * The Windows logon task name used before serve was per session. Installs
+ * without a session still use it, at the Task Scheduler root, exactly as they
+ * always have; an install with `--session` gets its own task under the folder
+ * below, so a second serve cannot overwrite the first.
+ */
 export const SERVE_TASK_NAME = "zswarm-serve";
+/** Folder for per-session serve tasks, next to the crew tasks. */
+export const SERVE_TASK_FOLDER = "\\zswarm\\";
+/** Task Scheduler rejects these in a name; sessions get no further validation. */
+const SERVE_TASK_SESSION = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/**
+ * The task one serve install/clear owns: `\zswarm\zswarm-serve-<session>` when a
+ * session is named, otherwise the legacy root-folder `zswarm-serve` (so an
+ * install that never names a session behaves exactly as it did before).
+ */
+export function serveTaskTarget(session) {
+    const wanted = session?.trim();
+    if (!wanted)
+        return { folder: null, name: SERVE_TASK_NAME, session: null };
+    if (!SERVE_TASK_SESSION.test(wanted)) {
+        throw new ZellijError("bad_arg", `invalid session name ${JSON.stringify(session)}`);
+    }
+    return { folder: SERVE_TASK_FOLDER, name: `${SERVE_TASK_NAME}-${wanted}`, session: wanted };
+}
+/**
+ * The session a stored task command says it serves, from the
+ * `set "ZSWARM_SESSION=<session>"` an install bakes into the task environment.
+ * This is how a legacy root-folder install is recognised as belonging to one
+ * session: without it, a `--session` install/clear leaves that task alone.
+ */
+export function sessionFromCommand(command) {
+    const match = /set "ZSWARM_SESSION=([^"]*)"/.exec(command);
+    const session = match?.[1]?.trim();
+    return session && SERVE_TASK_SESSION.test(session) ? session : null;
+}
 /** One JSONL request; a client that never sends newline cannot grow forever. */
 export const SERVE_MAX_REQUEST_BYTES = 1024 * 1024;
 /**

package/dist/policy.js

@@ -5,6 +5,7 @@ const WRITE_OPS = new Set([
     "keys",
     "interrupt",
     "spawn",
+    "restart",
     "close",
     "unworktree",
     "checkpoint",

package/dist/schema.d.ts

@@ -2,7 +2,7 @@
  * One description of the zswarm surface. The MCP tool schema, the CLI flags,
  * and the CLI help text are all generated from it, so they cannot drift apart.
  */
-export declare const OP_NAMES: readonly ["list", "sessions", "send", "broadcast", "dump", "tail", "wait", "status", "keys", "interrupt", "spawn", "close", "worktrees", "unworktree", "signal", "signals", "await", "log", "rename", "focus", "tabs", "layout", "stack", "diff", "checkpoint", "bus", "serve", "doctor"];
+export declare const OP_NAMES: readonly ["list", "sessions", "send", "broadcast", "dump", "tail", "wait", "status", "keys", "interrupt", "spawn", "restart", "close", "worktrees", "unworktree", "signal", "signals", "await", "log", "rename", "focus", "tabs", "layout", "stack", "diff", "checkpoint", "bus", "serve", "doctor"];
 export type OpName = (typeof OP_NAMES)[number];
 /** Ops that address an existing pane through `to`. */
 export declare const TARGET_OPS: readonly OpName[];