akm-cli 0.9.0-rc.0 → 0.9.0-rc.13

package/dist/tasks/backends/schtasks.js

@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * schtasks.exe backend for `akm tasks` (Windows default).
+ * schtasks.exe backend for `akm task` (Windows default).
  *
  * Each task is registered under the `\akm\` Task Scheduler folder so the
  * backend never touches user-managed tasks. The full task definition is
@@ -13,9 +13,8 @@
  *   • `LogonType=InteractiveToken` means the task runs in the context of
  *     the registering user only when they are logged in — there is no
  *     stored password and the task will not fire at the lock screen.
- *   • `<Principal>` deliberately omits `<UserId>`; per the Task Scheduler
- *     2.0 schema (`principalType.UserId` minOccurs=0) this is valid and
- *     defaults to the registering user.
+ *   • `<Principal>` records the current user SID so sync can detect identity
+ *     drift instead of silently accepting a task registered to another user.
  *   • `<DisallowStartIfOnBatteries>false</…>` and `<StopIfGoingOnBatteries>
  *     false</…>` allow the task to run on battery — utility tasks would
  *     otherwise be silently skipped on laptops.
@@ -29,6 +28,7 @@
  *
  * Tests inject a fake exec + filesystem.
  */
+import { createHash } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -37,33 +37,90 @@ import { ConfigError } from "../../core/errors.js";
 import { getTaskLogDir } from "../../core/paths.js";
 import { resolveAkmInvocation } from "../resolve-akm-bin.js";
 import { parseSchedule, translateToSchtasks } from "../schedule.js";
-import { escapeXml, nodeExec, nodeFs } from "./exec-utils.js";
+import { buildScheduledTaskInvocation, parseScheduledTaskArgv, resolveScheduledTaskContext, schedulerContextDescriptor, schedulerContextPath, } from "../scheduler-invocation.js";
+import { escapeXml, nodeExec, nodeFs, normalizeXmlForUtf16File, runOrThrow, } from "./exec-utils.js";
 export const DEFAULT_FOLDER_PREFIX = "\\akm\\";
+const SIGNATURE_PREFIX = "akm:v1:";
 export function SCHTASKS_BACKEND(options = {}) {
     const exec = options.exec ?? defaultSchtasksExec();
     const fsLike = options.fs ?? defaultSchtasksFs();
     const akmArgv = options.akmArgv ?? resolveAkmInvocation().argv;
     const logDir = options.logDir ?? getTaskLogDir();
     const folder = options.folderPrefix ?? DEFAULT_FOLDER_PREFIX;
+    const scheduledContext = options.scheduledContext ?? resolveScheduledTaskContext();
+    const defaultContextPath = schedulerContextPath(schedulerContextDescriptor(scheduledContext, process.env.PATH ?? ""));
+    const userSid = options.userSid ?? resolveCurrentUserSid(exec);
     const taskName = (id) => `${folder}${id}`;
     return {
         name: "schtasks",
-        install(task) {
+        install(task, opts) {
+            const xml = normalizeXmlForUtf16File(buildSchtasksXml(task, akmArgv, logDir, {
+                folderPrefix: folder,
+                contextPath: opts?.contextPath ?? defaultContextPath,
+                userSid,
+                binding: [...(opts?.binding ?? akmArgv)],
+                ...(opts?.target !== undefined ? { target: opts.target } : {}),
+            }));
+            const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(task.id), "/XML"], {
+                isOk: (r) => r.status === 0 || isMissingTaskResult(r),
+                message: (r) => `schtasks /Query failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
+            });
+            let previous;
+            if (query.status === 0) {
+                const enabled = taskXmlEnabled(query.stdout);
+                if (enabled === undefined) {
+                    throw new ConfigError(`schtasks /Query returned an unreadable definition for "${taskName(task.id)}"; refusing to replace it.`, "INVALID_CONFIG_FILE");
+                }
+                previous = { xml: normalizeXmlForUtf16File(query.stdout), enabled };
+            }
             fsLike.ensureDir(logDir);
-            const xml = buildSchtasksXml(task, akmArgv, logDir, { folderPrefix: folder });
             const tmpFile = path.join(fsLike.tmpdir(), `akm-task-${task.id}-${Date.now()}.xml`);
             fsLike.writeFile(tmpFile, xml);
             try {
-                // /F forces overwrite if a task with the same name exists.
-                const r = exec.run(["schtasks", "/Create", "/TN", taskName(task.id), "/XML", tmpFile, "/F"]);
-                if (r.status !== 0) {
-                    throw new ConfigError(`schtasks /Create failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
+                try {
+                    // /F forces overwrite if a task with the same name exists.
+                    runOrThrow(exec, ["schtasks", "/Create", "/TN", taskName(task.id), "/XML", tmpFile, "/F"], {
+                        message: (r) => `schtasks /Create failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
+                    });
+                    if (!task.enabled) {
+                        runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(task.id), "/DISABLE"], {
+                            message: (r) => `schtasks /Change /DISABLE failed: ${r.stderr || r.stdout || "no output"}.`,
+                        });
+                    }
                 }
-                if (!task.enabled) {
-                    const dis = exec.run(["schtasks", "/Change", "/TN", taskName(task.id), "/DISABLE"]);
-                    if (dis.status !== 0) {
-                        throw new ConfigError(`schtasks /Change /DISABLE failed: ${dis.stderr || dis.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
+                catch (err) {
+                    const rollbackErrors = [];
+                    if (previous === undefined) {
+                        try {
+                            const remove = exec.run(["schtasks", "/Delete", "/TN", taskName(task.id), "/F"]);
+                            if (remove.status !== 0 && !isMissingTaskResult(remove)) {
+                                rollbackErrors.push(new ConfigError(`schtasks /Delete during rollback failed: ${remove.stderr || remove.stdout || "no output"}.`, "INVALID_CONFIG_FILE"));
+                            }
+                        }
+                        catch (rollbackError) {
+                            rollbackErrors.push(rollbackError);
+                        }
                     }
+                    else {
+                        try {
+                            fsLike.writeFile(tmpFile, previous.xml);
+                            runOrThrow(exec, ["schtasks", "/Create", "/TN", taskName(task.id), "/XML", tmpFile, "/F"], {
+                                message: (r) => `schtasks /Create during rollback failed: ${r.stderr || r.stdout || "no output"}.`,
+                            });
+                            const stateFlag = previous.enabled ? "/ENABLE" : "/DISABLE";
+                            runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(task.id), stateFlag], {
+                                message: (r) => `schtasks /Change ${stateFlag} during rollback failed: ${r.stderr || r.stdout || "no output"}.`,
+                            });
+                        }
+                        catch (rollbackError) {
+                            rollbackErrors.push(rollbackError);
+                        }
+                    }
+                    if (rollbackErrors.length > 0) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        throw new AggregateError([err, ...rollbackErrors], `${message}; rollback for Task Scheduler task "${task.id}" was incomplete.`);
+                    }
+                    throw err;
                 }
             }
             finally {
@@ -71,22 +128,21 @@ export function SCHTASKS_BACKEND(options = {}) {
             }
         },
         uninstall(id) {
-            const r = exec.run(["schtasks", "/Delete", "/TN", taskName(id), "/F"]);
-            if (r.status !== 0 && !/cannot find/i.test(r.stderr ?? "")) {
-                throw new ConfigError(`schtasks /Delete failed: ${r.stderr || r.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
-            }
+            runOrThrow(exec, ["schtasks", "/Delete", "/TN", taskName(id), "/F"], {
+                isOk: (r) => r.status === 0 || /cannot find/i.test(r.stderr ?? ""),
+                message: (r) => `schtasks /Delete failed: ${r.stderr || r.stdout || "no output"}.`,
+            });
         },
         setEnabled(id, enabled) {
             const flag = enabled ? "/ENABLE" : "/DISABLE";
-            const r = exec.run(["schtasks", "/Change", "/TN", taskName(id), flag]);
-            if (r.status !== 0) {
-                throw new ConfigError(`schtasks /Change ${flag} failed: ${r.stderr || r.stdout || "no output"}.`, "INVALID_CONFIG_FILE");
-            }
+            runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(id), flag], {
+                message: (r) => `schtasks /Change ${flag} failed: ${r.stderr || r.stdout || "no output"}.`,
+            });
         },
         list() {
-            const r = exec.run(["schtasks", "/Query", "/FO", "CSV", "/NH"]);
-            if (r.status !== 0)
-                return [];
+            const r = runOrThrow(exec, ["schtasks", "/Query", "/FO", "CSV", "/NH"], {
+                message: (res) => `schtasks /Query failed (exit ${res.status}): ${res.stderr || res.stdout || "no output"}.`,
+            });
             const ids = [];
             for (const line of (r.stdout ?? "").split(/\r?\n/)) {
                 const m = line.match(/^"([^"]+)",/);
@@ -97,58 +153,218 @@ export function SCHTASKS_BACKEND(options = {}) {
                     ids.push(name.slice(folder.length));
                 }
             }
-            return ids.map((id) => ({ id }));
+            const refs = [];
+            for (const id of ids) {
+                const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(id), "/XML"], {
+                    message: (r) => `schtasks /Query /XML for "${taskName(id)}" failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
+                });
+                const signature = installedSignature(query.stdout);
+                const installed = extractSchtasksInvocation(query.stdout);
+                // An invocation that no longer parses (e.g. a pre-0.9 `tasks run`
+                // entry surviving the scheduler-ABI respelling) is an orphan of its
+                // marker id, not a hard failure: omit it so `akmTasksSync` treats the
+                // id as "not present" and reinstalls it from the current task file.
+                if (!installed)
+                    continue;
+                refs.push({
+                    id,
+                    ...(signature !== undefined ? { signature } : {}),
+                    ...(installed.target !== undefined ? { target: installed.target } : {}),
+                    binding: installed.binding,
+                    contextPath: installed.contextPath,
+                });
+            }
+            return refs;
+        },
+        listForRebind() {
+            const r = runOrThrow(exec, ["schtasks", "/Query", "/FO", "CSV", "/NH"], {
+                message: (res) => `schtasks /Query failed (exit ${res.status}): ${res.stderr || res.stdout || "no output"}.`,
+            });
+            const refs = [];
+            for (const line of (r.stdout ?? "").split(/\r?\n/)) {
+                const match = line.match(/^"([^"]+)",/);
+                const name = match?.[1];
+                if (!name?.startsWith(folder))
+                    continue;
+                const id = name.slice(folder.length);
+                const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(id), "/XML"], {
+                    message: (result) => `schtasks /Query /XML for "${taskName(id)}" failed (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
+                });
+                const signature = installedSignature(query.stdout);
+                const installed = extractSchtasksInvocation(query.stdout);
+                refs.push({
+                    id,
+                    ...(signature !== undefined ? { signature } : {}),
+                    ...(installed?.target !== undefined ? { target: installed.target } : {}),
+                });
+            }
+            return refs;
+        },
+        expectedSignature(task, opts) {
+            const signature = taskXmlSignature(buildSchtasksXml(task, akmArgv, logDir, {
+                folderPrefix: folder,
+                contextPath: opts?.contextPath ?? defaultContextPath,
+                userSid,
+                binding: [...(opts?.binding ?? akmArgv)],
+                ...(opts?.target !== undefined ? { target: opts.target } : {}),
+            }));
+            if (signature === undefined)
+                throw new Error("Failed to fingerprint generated Task Scheduler XML.");
+            return signature;
         },
     };
 }
-export function buildSchtasksXml(task, akmArgv, logDir, options = {}) {
+/**
+ * Recover the bundle name embedded as a `--bundle <bundle>` pair in the
+ * PowerShell `<Arguments>` of an installed Task Scheduler definition. Returns
+ * undefined for the primary/default form.
+ */
+export function extractSchtasksTarget(xml) {
+    return extractSchtasksInvocation(xml)?.target;
+}
+export function extractSchtasksInvocation(xml) {
+    const argsElement = xml.match(/<(?:[\w.-]+:)?Arguments>([\s\S]*?)<\/(?:[\w.-]+:)?Arguments>/i);
+    if (!argsElement)
+        return undefined;
+    const commandLine = decodeXml(argsElement[1]);
+    const invocationStart = findPowerShellInvocationOperator(commandLine);
+    if (invocationStart === undefined)
+        return undefined;
+    return parseScheduledTaskArgv(parsePowerShellSingleQuotedArgs(commandLine, invocationStart + 1));
+}
+function findPowerShellInvocationOperator(script) {
+    let inSingleQuote = false;
+    for (let index = 0; index < script.length; index += 1) {
+        const char = script[index];
+        if (char === "'") {
+            if (inSingleQuote && script[index + 1] === "'") {
+                index += 1;
+            }
+            else {
+                inSingleQuote = !inSingleQuote;
+            }
+            continue;
+        }
+        if (!inSingleQuote && char === "&" && /\s/.test(script[index + 1] ?? ""))
+            return index;
+    }
+    return undefined;
+}
+function parsePowerShellSingleQuotedArgs(script, start) {
+    const argv = [];
+    let index = start;
+    while (index < script.length) {
+        while (/\s/.test(script[index] ?? ""))
+            index += 1;
+        if (script[index] === ";" || script[index] === '"' || index >= script.length)
+            break;
+        if (script[index] !== "'")
+            return [];
+        index += 1;
+        let value = "";
+        let closed = false;
+        while (index < script.length) {
+            const char = script[index];
+            if (char !== "'") {
+                value += char;
+                index += 1;
+                continue;
+            }
+            if (script[index + 1] === "'") {
+                value += "'";
+                index += 2;
+                continue;
+            }
+            index += 1;
+            closed = true;
+            break;
+        }
+        if (!closed)
+            return [];
+        argv.push(value);
+    }
+    return argv;
+}
+export function buildSchtasksXml(task, akmArgv, logDir, options) {
     const folder = options.folderPrefix ?? DEFAULT_FOLDER_PREFIX;
     const now = options.now ? options.now() : new Date();
-    const startBoundary = formatStartBoundary(now);
-    const spec = parseSchedule(task.schedule, "schtasks");
-    const trigger = translateToSchtasks(spec);
-    const command = akmArgv[0];
-    const args = [...akmArgv.slice(1), "tasks", "run", task.id].map((a) => quoteArg(a)).join(" ");
-    const triggerXml = renderSchtasksTrigger(trigger, startBoundary);
-    const logPath = path.join(logDir, `${task.id}.log`);
+    const definition = buildSchtasksDefinition(task, options.binding ?? akmArgv, logDir, folder, options.contextPath, options.userSid, options.target);
+    const triggerXml = renderSchtasksTrigger(definition.trigger, now);
     return schtasksTemplate
         .replaceAll("{{TASK_ID}}", escapeXml(task.id))
         .replaceAll("{{FOLDER}}", escapeXml(folder))
+        .replace("{{SIGNATURE}}", definition.signature)
         .replace("{{TRIGGER_XML}}", triggerXml)
+        .replace('<Principal id="Author">', `<Principal id="Author">\n      <UserId>${escapeXml(options.userSid)}</UserId>`)
         .replace("{{ENABLED}}", task.enabled ? "true" : "false")
-        .replace("{{COMMAND}}", escapeXml(command))
-        .replace("{{ARGS}}", escapeXml(args))
-        .replace("{{LOG_PATH}}", escapeXml(logPath));
+        .replace("{{COMMAND}}", escapeXml(definition.command))
+        .replace("{{ARGS}}", escapeXml(definition.args))
+        .replace("{{LOG_PATH}}", escapeXml(definition.logPath));
+}
+function buildSchtasksDefinition(task, akmArgv, logDir, folder, contextPath, userSid, target) {
+    const spec = parseSchedule(task.schedule, "schtasks");
+    const trigger = translateToSchtasks(spec);
+    const invocation = buildScheduledTaskInvocation(akmArgv, task.id, contextPath, target);
+    const invoke = `& ${invocation.argv.map((arg) => quotePowerShell(arg)).join(" ")}`;
+    const script = `${invoke}; exit $LASTEXITCODE`;
+    const command = "powershell.exe";
+    const args = ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script].map(quoteArg).join(" ");
+    const logPath = path.join(logDir, `${task.id}.log`);
+    // The boundary changes on reinstall, and enabled state can change via /Change.
+    // Keep both outside the stored definition fingerprint so no-op sync stays stable.
+    const fingerprint = createHash("sha256")
+        .update(JSON.stringify({ folder, id: task.id, trigger, command, args, logPath, userSid }))
+        .digest("hex");
+    return { trigger, command, args, logPath, signature: `${SIGNATURE_PREFIX}${fingerprint}` };
 }
-function renderSchtasksTrigger(trigger, startBoundary) {
+function renderSchtasksTrigger(trigger, now) {
+    return expandNativeTriggers(trigger)
+        .map((native) => renderNativeTrigger(native, formatStartBoundary(nextStartBoundary(native, now))))
+        .join("\n");
+}
+function expandNativeTriggers(trigger) {
     switch (trigger.kind) {
         case "minute":
-            return `    <TimeTrigger>
-      <Repetition>
-        <Interval>PT${trigger.everyMinutes}M</Interval>
-      </Repetition>
-      <StartBoundary>${startBoundary}</StartBoundary>
-      <Enabled>true</Enabled>
-    </TimeTrigger>`;
+            return [{ kind: "daily", atHour: 0, atMinute: 0, repeatEveryMinutes: trigger.everyMinutes }];
+        case "minuteValues":
+            return trigger.minutes.map((atMinute) => ({ kind: "daily", atHour: 0, atMinute, repeatEveryMinutes: 60 }));
         case "hour":
-            return `    <TimeTrigger>
-      <Repetition>
-        <Interval>PT${trigger.everyHours}H</Interval>
-      </Repetition>
-      <StartBoundary>${startBoundary}</StartBoundary>
-      <Enabled>true</Enabled>
-    </TimeTrigger>`;
+            return [
+                {
+                    kind: "daily",
+                    atHour: 0,
+                    atMinute: trigger.atMinute,
+                    repeatEveryMinutes: trigger.everyHours * 60,
+                },
+            ];
+        case "hourValues":
+            return trigger.hours.map((atHour) => ({ kind: "daily", atHour, atMinute: trigger.atMinute }));
         case "daily":
-            return `    <CalendarTrigger>
-      <StartBoundary>${pad(startBoundary, trigger.atHour, trigger.atMinute)}</StartBoundary>
+            return [{ kind: "daily", atHour: trigger.atHour, atMinute: trigger.atMinute }];
+        case "weekly":
+            return [trigger];
+    }
+}
+function renderNativeTrigger(trigger, startBoundary) {
+    if (trigger.kind === "daily") {
+        const repetition = trigger.repeatEveryMinutes === undefined
+            ? ""
+            : `      <Repetition>
+        <Interval>${formatRepetitionInterval(trigger.repeatEveryMinutes)}</Interval>
+        <Duration>${formatRepetitionDuration(trigger.repeatEveryMinutes)}</Duration>
+        <StopAtDurationEnd>false</StopAtDurationEnd>
+      </Repetition>
+`;
+        return `    <CalendarTrigger>
+${repetition}      <StartBoundary>${startBoundary}</StartBoundary>
       <Enabled>true</Enabled>
       <ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay>
     </CalendarTrigger>`;
-        case "weekly": {
-            const dayMap = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
-            const days = trigger.daysOfWeek.map((d) => `        <${dayMap[d]} />`).join("\n");
-            return `    <CalendarTrigger>
-      <StartBoundary>${pad(startBoundary, trigger.atHour, trigger.atMinute)}</StartBoundary>
+    }
+    const dayMap = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+    const days = trigger.daysOfWeek.map((d) => `        <${dayMap[d]} />`).join("\n");
+    return `    <CalendarTrigger>
+      <StartBoundary>${startBoundary}</StartBoundary>
       <Enabled>true</Enabled>
       <ScheduleByWeek>
         <DaysOfWeek>
@@ -157,16 +373,42 @@ ${days}
         <WeeksInterval>1</WeeksInterval>
       </ScheduleByWeek>
     </CalendarTrigger>`;
-        }
-    }
 }
-function pad(base, hour, minute) {
-    // Rewrite the time component of an ISO-8601 boundary while preserving
-    // the date so daily/weekly triggers fire at the configured wall-clock
-    // time rather than the install instant.
-    const hh = String(hour).padStart(2, "0");
-    const mm = String(minute).padStart(2, "0");
-    return base.replace(/T\d\d:\d\d:\d\d$/, `T${hh}:${mm}:00`);
+function formatRepetitionInterval(minutes) {
+    return formatMinuteDuration(minutes);
+}
+function formatRepetitionDuration(intervalMinutes) {
+    return formatMinuteDuration(24 * 60 - intervalMinutes);
+}
+function formatMinuteDuration(minutes) {
+    const hours = Math.floor(minutes / 60);
+    const remainingMinutes = minutes % 60;
+    const hourPart = hours > 0 ? `${hours}H` : "";
+    const minutePart = remainingMinutes > 0 ? `${remainingMinutes}M` : "";
+    return `PT${hourPart}${minutePart}`;
+}
+function nextStartBoundary(trigger, now) {
+    const boundary = new Date(now.getTime());
+    switch (trigger.kind) {
+        case "daily":
+            boundary.setHours(trigger.atHour, trigger.atMinute, 0, 0);
+            if (trigger.repeatEveryMinutes !== undefined) {
+                while (boundary.getTime() <= now.getTime()) {
+                    boundary.setMinutes(boundary.getMinutes() + trigger.repeatEveryMinutes);
+                }
+            }
+            else if (boundary.getTime() <= now.getTime()) {
+                boundary.setDate(boundary.getDate() + 1);
+            }
+            return boundary;
+        case "weekly":
+            boundary.setHours(trigger.atHour, trigger.atMinute, 0, 0);
+            while (!trigger.daysOfWeek.includes(boundary.getDay()) || boundary.getTime() <= now.getTime()) {
+                boundary.setDate(boundary.getDate() + 1);
+                boundary.setHours(trigger.atHour, trigger.atMinute, 0, 0);
+            }
+            return boundary;
+    }
 }
 function formatStartBoundary(d) {
     // Local-time ISO-8601 (no zone suffix) — Task Scheduler interprets a
@@ -183,7 +425,249 @@ function formatStartBoundary(d) {
 function quoteArg(s) {
     if (/^[A-Za-z0-9_\-./@:%=+,\\]+$/.test(s))
         return s;
-    return `"${s.replace(/"/g, '\\"')}"`;
+    // CommandLineToArgvW requires backslashes before quotes (including the
+    // closing quote) to be doubled so they survive as literal backslashes.
+    return `"${s.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/g, "$1$1")}"`;
+}
+function quotePowerShell(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function installedSignature(xml) {
+    return taskXmlSignature(xml);
+}
+function isMissingTaskResult(result) {
+    return /cannot find|not found/i.test(`${result.stderr ?? ""}\n${result.stdout ?? ""}`);
+}
+function taskXmlSignature(xml) {
+    try {
+        const document = parseXml(xml);
+        const task = findChild(document, "Task");
+        const triggers = findChild(task, "Triggers");
+        const principals = findChild(task, "Principals");
+        const settings = findChild(task, "Settings");
+        const actions = findChild(task, "Actions");
+        if (!triggers || !principals || !settings || !actions)
+            return undefined;
+        normalizeTriggerBoundaries(triggers);
+        normalizeNativeDefaults(triggers, principals, settings);
+        const enabledElement = findChild(settings, "Enabled");
+        const enabledValue = enabledElement ? elementText(enabledElement).toLowerCase() : undefined;
+        const enabled = enabledValue === undefined || enabledValue === "true" || enabledValue === "1";
+        // Enabled is represented explicitly in the signature suffix. Removing it
+        // here also treats an omitted Enabled element as its schema default, true.
+        settings.children = settings.children.filter((child) => typeof child === "string" || child.name.toLowerCase() !== "enabled");
+        const canonical = [triggers, principals, settings, actions].map(canonicalXmlElement).join("\n");
+        const fingerprint = createHash("sha256").update(canonical).digest("hex");
+        return signatureWithEnabled(`${SIGNATURE_PREFIX}${fingerprint}`, enabled);
+    }
+    catch {
+        return undefined;
+    }
+}
+function taskXmlEnabled(xml) {
+    try {
+        const document = parseXml(xml);
+        const settings = findChild(findChild(document, "Task"), "Settings");
+        if (!settings)
+            return undefined;
+        const enabledElement = findChild(settings, "Enabled");
+        if (!enabledElement)
+            return true;
+        const enabled = elementText(enabledElement).toLowerCase();
+        if (enabled === "true" || enabled === "1")
+            return true;
+        if (enabled === "false" || enabled === "0")
+            return false;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseXml(xml) {
+    const document = { name: "#document", attributes: {}, children: [] };
+    const stack = [document];
+    const tokens = xml.match(/<!--[\s\S]*?-->|<\?[\s\S]*?\?>|<[^>]+>|[^<]+/g) ?? [];
+    for (const token of tokens) {
+        if (token.startsWith("<!--") || token.startsWith("<?"))
+            continue;
+        if (token.startsWith("</")) {
+            if (stack.length === 1)
+                throw new Error("Unexpected XML closing tag.");
+            const closingName = localXmlName(token.slice(2, -1).trim());
+            const current = stack.pop();
+            if (current?.name !== closingName)
+                throw new Error("Mismatched XML closing tag.");
+            continue;
+        }
+        if (token.startsWith("<")) {
+            const selfClosing = /\/\s*>$/.test(token);
+            const match = token.match(/^<\s*([^\s/>]+)([\s\S]*?)\/?\s*>$/);
+            if (!match)
+                throw new Error("Invalid XML opening tag.");
+            const element = {
+                name: localXmlName(match[1]),
+                attributes: parseXmlAttributes(match[2]),
+                children: [],
+            };
+            stack[stack.length - 1].children.push(element);
+            if (!selfClosing)
+                stack.push(element);
+            continue;
+        }
+        const text = decodeXml(token.trim());
+        if (text.length > 0)
+            stack[stack.length - 1].children.push(text);
+    }
+    if (stack.length !== 1)
+        throw new Error("Unclosed XML tag.");
+    return document;
+}
+function parseXmlAttributes(raw) {
+    const attributes = {};
+    const pattern = /([^\s=]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+    for (const match of raw.matchAll(pattern)) {
+        const name = localXmlName(match[1]);
+        if (match[1] === "xmlns" || match[1].startsWith("xmlns:"))
+            continue;
+        attributes[name] = decodeXml(match[2] ?? match[3] ?? "");
+    }
+    return attributes;
+}
+function localXmlName(name) {
+    return name.slice(name.lastIndexOf(":") + 1);
+}
+function decodeXml(value) {
+    return value.replace(/&(?:#(\d+)|#x([\da-f]+)|amp|lt|gt|quot|apos);/gi, (entity, decimal, hex) => {
+        if (decimal !== undefined)
+            return String.fromCodePoint(Number(decimal));
+        if (hex !== undefined)
+            return String.fromCodePoint(Number.parseInt(hex, 16));
+        switch (entity.toLowerCase()) {
+            case "&amp;":
+                return "&";
+            case "&lt;":
+                return "<";
+            case "&gt;":
+                return ">";
+            case "&quot;":
+                return '"';
+            case "&apos;":
+                return "'";
+            default:
+                return entity;
+        }
+    });
+}
+function findChild(parent, name) {
+    return parent?.children.find((child) => typeof child !== "string" && child.name.toLowerCase() === name.toLowerCase());
+}
+function elementText(element) {
+    return element.children.filter((child) => typeof child === "string").join("");
+}
+function normalizeTriggerBoundaries(triggers) {
+    for (const trigger of triggers.children) {
+        if (typeof trigger === "string")
+            continue;
+        const boundary = findChild(trigger, "StartBoundary");
+        if (!boundary)
+            continue;
+        const time = elementText(boundary).match(/T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?/);
+        if (!time)
+            continue;
+        const secondsSinceMidnight = Number(time[1]) * 3600 + Number(time[2]) * 60 + Number(time[3]);
+        const interval = findChild(findChild(trigger, "Repetition"), "Interval");
+        const intervalSeconds = interval ? parseIsoDurationSeconds(elementText(interval)) : undefined;
+        boundary.children = [
+            intervalSeconds === undefined
+                ? `dynamic-date;time=${time[1]}:${time[2]}:${time[3]}`
+                : `dynamic-cycle;phase-seconds=${secondsSinceMidnight % intervalSeconds}`,
+        ];
+    }
+}
+const MATERIALIZED_SETTING_DEFAULTS = {
+    allowstartondemand: "true",
+    allowhardterminate: "true",
+    startwhenavailable: "false",
+    runonlyifnetworkavailable: "false",
+    hidden: "false",
+    runonlyifidle: "false",
+    waketorun: "false",
+    executiontimelimit: "PT72H",
+    priority: "7",
+    compatibility: "Vista",
+    useunifiedschedulingengine: "true",
+    disallowstartonremoteappsession: "false",
+    volatile: "false",
+};
+const MATERIALIZED_IDLE_DEFAULTS = {
+    duration: "PT10M",
+    waittimeout: "PT1H",
+    stoponidleend: "true",
+    restartonidle: "false",
+};
+function normalizeNativeDefaults(triggers, principals, settings) {
+    for (const principal of elementChildren(principals)) {
+        principal.children = principal.children.filter((child) => {
+            if (typeof child === "string")
+                return true;
+            return child.name.toLowerCase() !== "runlevel" || elementText(child).toLowerCase() !== "leastprivilege";
+        });
+    }
+    settings.children = settings.children.filter((child) => {
+        if (typeof child === "string")
+            return true;
+        const name = child.name.toLowerCase();
+        if (name === "idlesettings")
+            return !containsOnlyDefaults(child, MATERIALIZED_IDLE_DEFAULTS);
+        const defaultValue = MATERIALIZED_SETTING_DEFAULTS[name];
+        return defaultValue === undefined || elementText(child) !== defaultValue;
+    });
+    for (const trigger of elementChildren(triggers)) {
+        trigger.children = trigger.children.filter((child) => {
+            if (typeof child === "string")
+                return true;
+            const name = child.name.toLowerCase();
+            if (name === "enabled")
+                return elementText(child).toLowerCase() !== "true";
+            return name !== "executiontimelimit" || elementText(child) !== "PT72H";
+        });
+    }
+}
+function resolveCurrentUserSid(exec) {
+    const result = runOrThrow(exec, ["whoami", "/user", "/fo", "csv", "/nh"], {
+        message: (r) => `whoami /user failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
+    });
+    const match = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.match(/\bS-\d+(?:-\d+){2,}\b/i);
+    if (!match) {
+        throw new ConfigError("whoami /user returned no Windows user SID.", "INVALID_CONFIG_FILE");
+    }
+    return `S${match[0].slice(1)}`;
+}
+function elementChildren(element) {
+    return element.children.filter((child) => typeof child !== "string");
+}
+function containsOnlyDefaults(element, defaults) {
+    const children = elementChildren(element);
+    return (children.length > 0 &&
+        children.length === element.children.length &&
+        children.every((child) => defaults[child.name.toLowerCase()] === elementText(child)));
+}
+function parseIsoDurationSeconds(value) {
+    const match = value.match(/^PT(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?$/i);
+    if (!match)
+        return undefined;
+    const seconds = Number(match[1] ?? 0) * 3600 + Number(match[2] ?? 0) * 60 + Number(match[3] ?? 0);
+    return seconds > 0 ? seconds : undefined;
+}
+function canonicalXmlElement(element) {
+    const attributes = Object.entries(element.attributes).sort(([a], [b]) => a.localeCompare(b));
+    const children = element.children.map((child) => typeof child === "string" ? ["text", child] : ["element", canonicalXmlElement(child)]);
+    children.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+    return JSON.stringify([element.name, attributes, children]);
+}
+function signatureWithEnabled(signature, enabled) {
+    return `${signature}|enabled=${enabled ? "true" : "false"}`;
 }
 function defaultSchtasksExec() {
     return nodeExec();
@@ -191,6 +675,9 @@ function defaultSchtasksExec() {
 function defaultSchtasksFs() {
     return {
         ...nodeFs(),
+        writeFile(file, content) {
+            fs.writeFileSync(file, `\uFEFF${content}`, { encoding: "utf16le" });
+        },
         removeFile(file) {
             try {
                 fs.rmSync(file, { force: true });