cdx-manager 0.21.4 → 0.21.6

package/src/cli_args.py

@@ -16,6 +16,7 @@ from .config import (
     PROVIDERS,
     REASONING_EFFORT_VALUES,
     normalize_permission,
+    parse_on_off,
 )
 from .errors import CdxArgumentError, CdxError
 from .provider_runtime import _normalize_reasoning_effort
@@ -32,8 +33,8 @@ CONTEXT_USAGE = "Usage: cdx context show|path|init|edit|clear|set|append [text..
 MEMORY_USAGE = "Usage: cdx memory [--global|--project NAME_OR_PATH] [show|view|path|init|edit|clear|set|append|list] [text...] [--json]"
 HANDOFF_USAGE = "Usage: cdx handoff <name> [--json] | cdx handoff <source> <target> [--source-conversation ID | --source-native-transcript PATH | --source-transcript PATH] [--json]"
 LABEL_USAGE = "Usage: cdx label <name> <label> [--json] | cdx label <name> --clear [--json]"
-SET_USAGE = "Usage: cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--logics on|off] [--model MODEL] [--fallback-model MODEL[,MODEL...]] [--budget USD] [--extra-args 'ARGS'] [--priority 0..100] [--json]"
-UNSET_USAGE = "Usage: cdx unset <name>|--sessions all|a,b|--provider PROVIDER (--power|--reasoning-effort|--permission|--fast|--rtk|--logics|--model|--fallback-model|--budget|--extra-args|--priority|--all) [--json]"
+SET_USAGE = "Usage: cdx set <name>|--sessions all|a,b|--provider PROVIDER [--power minimal|low|medium|high|xhigh] [--permission review|default|auto|full] [--fast on|off] [--rtk on|off] [--logics on|off] [--notify on|off] [--notify-preview on|off] [--scrub-env on|off] [--model MODEL] [--fallback-model MODEL[,MODEL...]] [--budget USD] [--extra-args 'ARGS'] [--priority 0..100] [--json]"
+UNSET_USAGE = "Usage: cdx unset <name>|--sessions all|a,b|--provider PROVIDER (--power|--reasoning-effort|--permission|--fast|--rtk|--logics|--notify|--notify-preview|--scrub-env|--model|--fallback-model|--budget|--extra-args|--priority|--all) [--json]"
 SETTING_ALIAS_USAGE = "Usage: cdx power|perm|fast|model <name|all|provider:PROVIDER|a,b> <value|default> [--json]"
 CONFIG_USAGE = "Usage: cdx config <name> [--json]"
 CONFIGS_USAGE = "Usage: cdx configs [--json]"
@@ -213,13 +214,12 @@ def _parse_toggle_args(args, usage):
     return {"name": parsed["names"][0], "json": parsed["json"]}
 
 
-def _parse_fast_value(value):
-    text = str(value).strip().lower()
-    if text in ("on", "true", "1", "yes"):
-        return True
-    if text in ("off", "false", "0", "no"):
-        return False
-    raise CdxError(SET_USAGE)
+def _parse_fast_value(value, label="fast"):
+    return parse_on_off(value, label)
+
+
+def _on_off(label):
+    return lambda value: parse_on_off(value, label)
 
 
 def _parse_priority_value(value):
@@ -248,10 +248,11 @@ def _parse_set_args(args):
         "--power": {"key": "power", "type": "str", "default": None},
         "--permission": {"key": "permission", "type": "str", "default": None},
         "--fast": {"key": "fast", "type": "str", "default": None, "transform": _parse_fast_value},
-        "--rtk": {"key": "rtk", "type": "str", "default": None, "transform": _parse_fast_value},
-        "--logics": {"key": "logics", "type": "str", "default": None, "transform": _parse_fast_value},
-        "--notify": {"key": "notify", "type": "str", "default": None, "transform": _parse_fast_value},
-        "--notify-preview": {"key": "notify_preview", "type": "str", "default": None, "transform": _parse_fast_value},
+        "--rtk": {"key": "rtk", "type": "str", "default": None, "transform": _on_off("rtk")},
+        "--logics": {"key": "logics", "type": "str", "default": None, "transform": _on_off("logics")},
+        "--notify": {"key": "notify", "type": "str", "default": None, "transform": _on_off("notify")},
+        "--notify-preview": {"key": "notify_preview", "type": "str", "default": None, "transform": _on_off("notify preview")},
+        "--scrub-env": {"key": "scrub_env", "type": "str", "default": None, "transform": _on_off("scrub env")},
         "--model": {"key": "model", "type": "str", "default": None},
         "--fallback-model": {"key": "fallback_model", "type": "str", "default": None},
         "--budget": {"key": "budget", "type": "str", "default": None, "transform": _parse_budget_value},
@@ -273,7 +274,7 @@ def _parse_set_args(args):
         raise CdxError(SET_USAGE)
     settings = {
         key: parsed[key]
-        for key in ("power", "permission", "fast", "rtk", "logics", "notify", "notify_preview", "model", "fallback_model", "budget", "extra_args", "priority")
+        for key in ("power", "permission", "fast", "rtk", "logics", "notify", "notify_preview", "scrub_env", "model", "fallback_model", "budget", "extra_args", "priority")
         if parsed[key] is not None
     }
     if not settings:
@@ -297,6 +298,7 @@ def _parse_unset_args(args):
         "--logics": {"key": "logics", "type": "bool", "default": False},
         "--notify": {"key": "notify", "type": "bool", "default": False},
         "--notify-preview": {"key": "notify_preview", "type": "bool", "default": False},
+        "--scrub-env": {"key": "scrub_env", "type": "bool", "default": False},
         "--model": {"key": "model", "type": "bool", "default": False},
         "--fallback-model": {"key": "fallback_model", "type": "bool", "default": False},
         "--budget": {"key": "budget", "type": "bool", "default": False},
@@ -318,7 +320,7 @@ def _parse_unset_args(args):
     if not parsed["names"] and not parsed["sessions"] and not parsed["provider"]:
         raise CdxError(UNSET_USAGE)
     _UNSET_KEYS = (
-        "power", "reasoning_effort", "permission", "fast", "rtk", "logics", "notify", "notify_preview",
+        "power", "reasoning_effort", "permission", "fast", "rtk", "logics", "notify", "notify_preview", "scrub_env",
         "model", "fallback_model", "budget", "extra_args", "priority",
     )
     keys = list(_UNSET_KEYS) if parsed["all"] else [key for key in _UNSET_KEYS if parsed[key]]
@@ -510,8 +512,14 @@ def cdx_schema():
                 "provider_start_failed",
                 "provider_failed",
                 "provider_timeout",
+                "run_cancelled",
+                "invalid_request",
                 "cdx_error",
             ],
+            # The error code on a run record the stale sweep closed.
+            "run_record": [
+                "stale_process",
+            ],
             "run_lookup": [
                 "run_not_found",
                 "run_output_unavailable",
@@ -522,6 +530,26 @@ def cdx_schema():
             "network_disabled_by_permission",
             "session_selected_without_status",
             "limit_ignored_with_since",
+            "claude_auth_probe_failed",
+            "claude_refresh_failed",
+            "disk_cleanup_available",
+            "update_available",
+            "logics_manager_update_available",
+            "update_version_check_failed",
+            "update_version_mismatch",
+            "logics_manager_missing",
+            "logics_viewer_failed",
+            "logics_viewer_root_invalid",
+            "tray_autostart_unsupported",
+            "tray_companion_missing",
+            "tray_companion_not_aligned",
+            "tray_companion_not_available",
+            "tray_companion_not_installed",
+            "tray_companion_restart_pending",
+            "tray_companion_updated",
+            "tray_plugin_action_unknown",
+            "tray_plugin_unknown",
+            "tray_terminal_invalid",
         ],
     }
 

package/src/cli_helpers.py

@@ -9,8 +9,9 @@ import asyncio
 import json
 import os
 import re
-from datetime import datetime
+from datetime import datetime, timezone
 
+from .claude_credentials import delete_keychain_credentials
 from .cli_render import _dim, _info, _pad_table, _style, _warn
 from .errors import CdxError
 from .fs_utils import atomic_write
@@ -237,6 +238,8 @@ def _write_claude_oauth_token(auth_home, token):
         "version": "1.0",
         "type": "oauth_token",
         "access_token": token,
+        # Read by claude_credentials.setup_token_expires_at for the expiry warning.
+        "created_at": datetime.now(timezone.utc).isoformat(),
     }
     # atomic_write keeps the token 0o600 from creation — no umask window.
     atomic_write(cred_path, json.dumps(payload, indent=2) + "\n", mode=0o600)
@@ -244,7 +247,7 @@ def _write_claude_oauth_token(auth_home, token):
 
 def _bootstrap_claude_setup_token(session, ctx):
     ctx["out"](
-        "Claude login did not create isolated credentials; falling back to claude setup-token.\n"
+        "Minting a long-lived Claude setup-token for this session.\n"
     )
     run_info = _run_interactive_provider_command(
         session,
@@ -277,11 +280,14 @@ def _bootstrap_claude_setup_token(session, ctx):
         )
     auth_home = session.get("authHome") or ""
     cred_path = _write_claude_oauth_token(auth_home, token)
-    # ponytail: drop short-lived claude login creds so the ~1yr token wins at launch (provider_runtime _read_claude_launch_oauth_token)
+    # A profile /login wins over the setup-token at launch (see
+    # provider_runtime._read_claude_launch_oauth_token), so drop it on every
+    # platform: the file on Linux/Windows, the profile keychain entry on macOS.
     try:
         os.remove(os.path.join(auth_home, ".claude", ".credentials.json"))
     except OSError:
         pass
+    delete_keychain_credentials(auth_home)
     return cred_path
 
 def _format_launch_config(session, use_color=False):
@@ -297,6 +303,7 @@ def _format_launch_config(session, use_color=False):
         ("logics", "Logics"),
         ("notify", "Agent alerts"),
         ("notify_preview", "Response preview"),
+        ("scrub_env", "Scrub agent env"),
         ("model", "Model"),
         ("fallback_model", "Fallback"),
         ("budget", "Budget"),
@@ -323,14 +330,14 @@ def _format_launch_settings_hint(name="<name>"):
     )
 
 def _format_launch_setting_value(launch, key, use_color=False):
-    if key in ("fast", "rtk", "logics", "notify", "notify_preview"):
+    if key in ("fast", "rtk", "logics", "notify", "notify_preview", "scrub_env"):
         if launch.get(key) is True:
             return _style("on", "32", use_color)
         if launch.get(key) is False:
             return _style("off", "2", use_color)
         if key == "logics":
             return _dim("auto", use_color)
-        if key in ("notify", "notify_preview"):
+        if key in ("notify", "notify_preview", "scrub_env"):
             return _style("off", "2", use_color)
         return _dim("default", use_color)
     value = launch.get(key)

package/src/codex_usage.py

@@ -247,7 +247,7 @@ def _request_codex_app_server(auth_home, method, params, failure_reason, timeout
             stdout=subprocess.PIPE,
             stderr=subprocess.DEVNULL,
             env=env,
-            text=True,
+            text=True, encoding="utf-8", errors="replace",
             bufsize=1,
         )
         thread = threading.Thread(target=_reader_thread, args=(process.stdout, output), daemon=True)

package/src/commands/auth.py

@@ -100,6 +100,12 @@ def handle_ready(rest, ctx):
     unreachable once `cdx ready` became the only entry point.
     """
     parsed = parse_ready_args(rest)
+    if parsed["mode"] == "fire":
+        send_desktop_notification(
+            "cdx", f"{parsed['fire']} reset time reached; it should be usable again",
+            spawn_sync=ctx.get("spawn_sync"), env=ctx.get("env"),
+        )
+        return 0
     event = resolve_notify_event(
         ctx["service"]["get_status_rows"](
             progress_callback=None if parsed["json"] else _make_notify_progress(ctx),

package/src/commands/runs.py

@@ -265,7 +265,7 @@ def _spawn_detached_run(parsed, prompt, artifacts, ctx, session_name, cwd):
         # Surface as a CdxError so handle_run's own handler marks the already
         # registered run failed, instead of letting a raw OSError escape as an
         # unhandled traceback on a --json call.
-        raise CdxError(f"Failed to start detached cdx run: {error}", 126) from error
+        raise CdxError(f"Failed to start detached cdx run: {error}", 126, code="provider_start_failed") from error
     return {
         "pid": getattr(child, "pid", None),
         "launch_log_path": launch_log_path,
@@ -526,7 +526,7 @@ def handle_run(rest, ctx):
             if not session:
                 raise CdxError(f"Unknown session: {parsed['name']}")
             if session.get("enabled", True) is False:
-                raise CdxError(f"Session is disabled: {parsed['name']}")
+                raise CdxError(f"Session is disabled: {parsed['name']}", code="session_disabled")
         else:
             selected = _select_headless_session(
                 ctx,
@@ -552,7 +552,7 @@ def handle_run(rest, ctx):
 
         cwd = os.path.abspath(parsed["cwd"])
         if not os.path.isdir(cwd):
-            raise CdxError(f"Invalid cwd: {parsed['cwd']}")
+            raise CdxError(f"Invalid cwd: {parsed['cwd']}", code="invalid_cwd")
         prompt = read_run_prompt(parsed, stdin=ctx.get("prompt_stdin"))
         _consume_detached_prompt_file(parsed, detached_run_id)
         launch_updates = {}

package/src/commands/tray.py

@@ -685,26 +685,6 @@ def _refuse(ctx, as_json, action, code, message):
     return 0
 
 
-def _companion_action(action, args, ctx):
-    parsed = _parse_flag_args(args, {
-        "--json": {"key": "json", "type": "bool", "default": False},
-    }, TRAY_USAGE, positionals_key="args", max_positionals=0)
-    message = (
-        f"cdx tray {action} is defined but no tray companion ships with CDX {ctx['version']}. "
-        "Nothing was installed, started, or changed."
-    )
-    if parsed["json"]:
-        _write_json(ctx, _json_success(
-            f"tray.{action}",
-            message,
-            warnings=[{"code": COMPANION_UNAVAILABLE, "message": message}],
-            applied=False,
-        ))
-        return 0
-    ctx["out"](f"{_warn(message, ctx['use_color'])}\n")
-    return 0
-
-
 def _pct(value):
     return "?" if value is None else f"{int(value)}%"
 

package/src/config.py

@@ -81,4 +81,20 @@ def normalize_permission(value):
 def get_cdx_home(env=None):
     if env is None:
         env = os.environ
-    return env.get("CDX_HOME", str(Path.home() / ".cdx"))
+    # `or`, not a get() default: the default is evaluated eagerly, and
+    # Path.home() raises on Windows when USERPROFILE is missing.
+    return env.get("CDX_HOME") or str(Path.home() / ".cdx")
+
+
+def parse_on_off(value, label):
+    """Shared by `cdx set` flags and stored launch settings."""
+    from .errors import CdxError
+
+    if isinstance(value, bool):
+        return value
+    text = str(value).strip().lower()
+    if text in ("on", "true", "1", "yes"):
+        return True
+    if text in ("off", "false", "0", "no"):
+        return False
+    raise CdxError(f"Unsupported {label} value: {value} (on|off)")

package/src/context_store.py

@@ -90,7 +90,11 @@ def read_context_path(path):
 
 
 def write_context(base_dir, content, cwd=None):
-    return write_context_path(get_context_path(base_dir, cwd), content)
+    # Same lock as append: otherwise an append that read the old text can land
+    # after this write and resurrect it, or this write can drop the append.
+    path = get_context_path(base_dir, cwd)
+    with _append_lock(path), _registry_lock(path, timeout_seconds=10, label="memory"):
+        return write_context_path(path, content)
 
 
 def write_context_path(path, content):
@@ -155,11 +159,12 @@ def clear_context(base_dir, cwd=None):
 
 
 def clear_context_path(path):
-    try:
-        os.remove(path)
-        removed = True
-    except FileNotFoundError:
-        removed = False
+    with _append_lock(path), _registry_lock(path, timeout_seconds=10, label="memory"):
+        try:
+            os.remove(path)
+            removed = True
+        except FileNotFoundError:
+            removed = False
     return {"path": path, "removed": removed}
 
 

package/src/errors.py

@@ -1,7 +1,11 @@
 class CdxError(Exception):
-    def __init__(self, message, exit_code=1):
+    def __init__(self, message, exit_code=1, *, code=None):
         super().__init__(message)
         self.exit_code = exit_code
+        # Machine-readable code for `cdx run --json`; when absent, callers fall
+        # back to classifying the message (run_command.run_cdx_error_code).
+        if code is not None:
+            self.code = code
 
 
 class CdxArgumentError(CdxError):

package/src/handoff.py

@@ -5,6 +5,7 @@ import hashlib
 import json
 import os
 import re
+import time
 from datetime import datetime, timezone
 from uuid import uuid4
 
@@ -231,9 +232,32 @@ def prepare_entry(base_dir, target, workspace, source=None, transcript=None):
     except OSError:
         os.unlink(path)
         raise
+    _drop_old_entries(os.path.dirname(path), keep=path)
     return path, entry
 
 
+# A launch reads its entry right after preparing it, and concurrent prepares
+# each keep their own, so only entries well past any launch are removed.
+HANDOFF_ENTRY_MAX_AGE_SECONDS = 7 * 24 * 3600
+
+
+def _drop_old_entries(directory, keep, now=None):
+    cutoff = (time.time() if now is None else now) - HANDOFF_ENTRY_MAX_AGE_SECONDS
+    try:
+        names = os.listdir(directory)
+    except OSError:
+        return
+    for name in names:
+        candidate = os.path.join(directory, name)
+        if not name.endswith('.json') or candidate == keep:
+            continue
+        try:
+            if os.path.getmtime(candidate) < cutoff:
+                os.unlink(candidate)
+        except OSError:
+            pass
+
+
 def load_entry(base_dir, target, workspace):
     """Reuse only this target/workspace's prepared entry; never downgrade stale data."""
     pointer = _entry_pointer(base_dir, target, workspace)

package/src/health.py

@@ -110,6 +110,8 @@ def collect_health_report(service, base_dir, env=None, spawn_sync=None, check_pr
         state_path = _state_file_path(base_dir, name)
         if not os.path.isfile(state_path):
             issues.append(_issue("FAIL", "missing_state", f"session {name} state file is missing", state_path, True))
+        if session.get("provider") == PROVIDER_CLAUDE:
+            issues.extend(_claude_setup_token_issues(session))
         if session.get("provider") == PROVIDER_CODEX:
             diag = codex_auth_diagnostic(session, spawn_sync=spawn_sync, env_override=env)
             diag["observed_account"] = _recent_codex_observed_account(diag.get("auth_home"))
@@ -160,7 +162,7 @@ def _run_version_command(command, env, spawn_sync=None):
             [command, "--version"],
             env=env,
             capture_output=True,
-            text=True,
+            text=True, encoding="utf-8", errors="replace",
             timeout=5,
             check=False,
         )
@@ -226,7 +228,7 @@ def _provider_help_text(command, env, spawn_sync=None):
                 text = f"{getattr(result, 'stdout', '') or ''}\n{getattr(result, 'stderr', '') or ''}"
         else:
             completed = subprocess.run(
-                [command, "--help"], env=env, capture_output=True, text=True, timeout=10, check=False,
+                [command, "--help"], env=env, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10, check=False,
             )
             text = f"{completed.stdout or ''}\n{completed.stderr or ''}"
     except (OSError, subprocess.TimeoutExpired):
@@ -374,6 +376,22 @@ def _codex_auth_issues(session, diag):
     return issues
 
 
+def _claude_setup_token_issues(session):
+    from .claude_credentials import SETUP_TOKEN_WARN_DAYS, claude_auth_type, setup_token_days_left
+
+    home = session.get("authHome")
+    if not home or claude_auth_type(home) != "setup-token":
+        return []
+    days = setup_token_days_left(home)
+    if days is None or days > SETUP_TOKEN_WARN_DAYS:
+        return []
+    name = session["name"]
+    when = "has expired" if days < 0 else f"expires in {days} day(s)"
+    return [_issue("WARN", "claude_setup_token_expiry",
+                   f"session {name} Claude setup-token {when}; run cdx login {name}",
+                   {"session": name, "days_left": days})]
+
+
 def _codex_shared_account_id_issues(codex_diagnostics):
     by_account_id = {}
     for session, diag in codex_diagnostics:

package/src/notify.py

@@ -23,6 +23,9 @@ def parse_ready_args(args):
     blocking wait loop — reachable through a `cdx notify` that no longer exists.
     `cdx ready` always schedules the next-ready event, so none of it could run.
     """
+    if len(args) == 2 and args[0] == "--fire":
+        # Internal: what a scheduled job runs when the reset time arrives.
+        return {"name": None, "mode": "fire", "fire": args[1], "json": False, "refresh": False, "schedule": False}
     unknown = [arg for arg in args if arg not in ("--refresh", "--json")]
     if unknown:
         raise CdxError(READY_USAGE)
@@ -212,8 +215,13 @@ def windows_aumid(env=None):
     return _POWERSHELL_AUMID
 
 
+# PowerShell also ends a single-quoted string on the typographic quotes
+# U+2018..U+201B, so each must be doubled like ASCII ' (French "l’agent").
+_POWERSHELL_QUOTES = "'\u2018\u2019\u201a\u201b"
+
+
 def _escape_powershell(value):
-    return str(value).replace("'", "''")
+    return "".join(ch * 2 if ch in _POWERSHELL_QUOTES else ch for ch in str(value))
 
 
 def _escape_applescript(value):
@@ -243,7 +251,7 @@ def schedule_notification_event(base_dir, parsed, event, spawn_sync=None, env=No
             "target_timestamp": target_timestamp,
         }
 
-    argv = _scheduled_notify_argv(parsed, env)
+    argv = _scheduled_notify_argv(event, env)
     if sys.platform == "darwin":
         result = _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env)
     elif sys.platform == "win32":
@@ -255,17 +263,11 @@ def schedule_notification_event(base_dir, parsed, event, spawn_sync=None, env=No
     return result
 
 
-def _scheduled_notify_argv(parsed, env):
+def _scheduled_notify_argv(event, env):
     executable = env.get("CDX_BIN") or shutil.which("cdx", path=env.get("PATH")) or "cdx"
-    argv = [executable, "notify"]
-    if parsed["mode"] == "at-reset":
-        argv.append(parsed["name"])
-        argv.append("--at-reset")
-    else:
-        argv.append("--next-ready")
-    argv.append("--once")
-    argv.append("--refresh")
-    return argv
+    # `cdx notify` is the agent-hook target now and stays silent without a hook
+    # payload, so the job names the notification it has to show.
+    return [executable, "ready", "--fire", event.get("session") or "cdx"]
 
 
 def _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env):
@@ -273,7 +275,7 @@ def _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env):
     schedule_dir = os.path.join(base_dir, "state", "notifications")
     os.makedirs(schedule_dir, mode=0o700, exist_ok=True)
     script_path = os.path.join(schedule_dir, f"{label}.sh")
-    launch_agents = os.path.join(os.path.expanduser("~"), "Library", "LaunchAgents")
+    launch_agents = os.path.join(_operator_home(), "Library", "LaunchAgents")
     os.makedirs(launch_agents, exist_ok=True)
     plist_path = os.path.join(launch_agents, f"{label}.plist")
     target = _round_up_to_next_minute(datetime.fromtimestamp(event["target_timestamp"]).astimezone())
@@ -298,6 +300,14 @@ def _schedule_macos_launchd(base_dir, parsed, event, argv, spawn_sync, env):
     return {"scheduled": True, "existing": False, "backend": "launchd", "id": label, "path": plist_path}
 
 
+def _operator_home():
+    """The operator's real home. Inside a cdx session HOME is the profile home,
+    whose LaunchAgents folder launchd never reads."""
+    import pwd
+
+    return pwd.getpwuid(os.getuid()).pw_dir
+
+
 def _macos_schedule_script(argv, env, label, plist_path, script_path):
     lines = ["#!/bin/sh", f"export PATH={shlex.quote(env.get('PATH', '/usr/local/bin:/usr/bin:/bin'))}"]
     if env.get("CDX_HOME"):
@@ -365,23 +375,23 @@ def _schedule_linux(parsed, event, argv, spawn_sync, env):
 def _schedule_windows_task(parsed, event, argv, spawn_sync, env):
     name = _schedule_id("cdx-manager-notify", parsed, event)
     target = datetime.fromtimestamp(event["target_timestamp"]).astimezone()
-    command = subprocess.list2cmdline([str(part) for part in argv])
-    result = _run_scheduler_command([
-        "schtasks",
-        "/Create",
-        "/SC",
-        "ONCE",
-        "/TN",
-        name,
-        "/TR",
-        command,
-        "/ST",
-        target.strftime("%H:%M"),
-        "/SD",
-        target.strftime("%m/%d/%Y"),
-        "/F",
-        "/Z",
-    ], spawn_sync, env)
+    # Not `schtasks /SD`: it reads the date in the user's locale format, so
+    # mm/dd/yyyy is refused on a dd/MM/yyyy (French) Windows. An invariant
+    # ISO date through Register-ScheduledTask works on every locale.
+    start = target.strftime("%Y-%m-%dT%H:%M")
+    end = (target + timedelta(hours=1)).strftime("%Y-%m-%dT%H:%M")
+    arguments = subprocess.list2cmdline([str(part) for part in argv[1:]])
+    script = (
+        "$c = [Globalization.CultureInfo]::InvariantCulture; "
+        f"$t = New-ScheduledTaskTrigger -Once -At ([datetime]::ParseExact('{start}', 'yyyy-MM-ddTHH:mm', $c)); "
+        f"$t.EndBoundary = ([datetime]::ParseExact('{end}', 'yyyy-MM-ddTHH:mm', $c)).ToString('s'); "
+        f"$a = New-ScheduledTaskAction -Execute '{_escape_powershell(argv[0])}' -Argument '{_escape_powershell(arguments)}'; "
+        "$s = New-ScheduledTaskSettingsSet -DeleteExpiredTaskAfter (New-TimeSpan -Seconds 1); "
+        f"Register-ScheduledTask -TaskName '{_escape_powershell(name)}' -Action $a -Trigger $t -Settings $s -Force | Out-Null"
+    )
+    result = _run_scheduler_command(
+        ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], spawn_sync, env,
+    )
     if not result["ok"]:
         raise CdxError(f"Failed to schedule notification with Task Scheduler: {result['error']}")
     return {"scheduled": True, "existing": False, "backend": "schtasks", "id": name}

package/src/provider_background.py

@@ -107,7 +107,7 @@ def _default_spawn_sync(argv, env=None):
         completed = subprocess.run(
             argv,
             capture_output=True,
-            text=True,
+            text=True, encoding="utf-8", errors="replace",
             timeout=_CAPABILITY_PROBE_TIMEOUT_SECONDS,
             env=env,
             check=False,