herdr-remote 0.2.23 → 0.2.25

package/README.md

@@ -57,8 +57,9 @@ herdr-remote plugin link
 The `herdr` binary is looked up in `HERDR_BIN_PATH`, then `PATH`, then the usual
 install directories (`~/.local/bin`, `~/.cargo/bin`, `~/bin`, `/opt/homebrew/bin`,
 `/usr/local/bin`, …). `herdr-remote keepalive install` writes the binary it found
-and the current `PATH` into the systemd unit, launchd agent, or Windows service
-(`windows-service`), because a service manager does not inherit your shell's environment.
+and the current `PATH` into the systemd unit, launchd agent, Windows logon task
+(`windows-task`), or Windows service (`windows-service`), because managed processes
+do not inherit your shell's environment.
 
 On Windows, only `herdr.exe` is searched for, including `%LOCALAPPDATA%\Programs\Herdr\bin`,
 `~\.cargo\bin`, and `~\scoop\shims`.

package/README.zh-CN.md

@@ -55,9 +55,9 @@ herdr-remote plugin link
 ## herdr 命令的查找方式
 
 依次查找 `HERDR_BIN_PATH`、`PATH`，以及常见安装目录（`~/.local/bin`、`~/.cargo/bin`、
-`~/bin`、`/opt/homebrew/bin`、`/usr/local/bin` 等）。服务管理器不会继承 shell 环境，
+`~/bin`、`/opt/homebrew/bin`、`/usr/local/bin` 等）。后台管理器不会继承 shell 环境，
 因此 `herdr-remote keepalive install` 会把找到的可执行文件路径和当前 `PATH` 写入
-systemd unit、launchd plist 或 Windows 服务（`windows-service`）。
+systemd unit、launchd plist、Windows 登录任务（`windows-task`）或 Windows 服务（`windows-service`）。
 
 Windows 上只查找 `herdr.exe`，还会搜索 `%LOCALAPPDATA%\Programs\Herdr\bin`、
 `~\.cargo\bin` 和 `~\scoop\shims`。

package/dist/config.js

@@ -25,6 +25,7 @@ const KEEPALIVE_MANAGERS = [
     'systemd',
     'launchd',
     'supervisor',
+    'windows-task',
     'windows-service',
     'none',
 ];

package/dist/i18n/en.js

@@ -131,11 +131,12 @@ const en = {
     'keepalive.enableLinger': 'Enable start at boot',
     'keepalive.lingerDone': 'Start at boot enabled for {username}.',
     'keepalive.fallbackNote': 'No system service manager found; background process will not survive reboot.',
-    'keepalive.serviceNote': 'Runs as a Windows service under your account and starts at boot, before anyone signs in. Installing or removing it asks for administrator rights.',
+    'keepalive.windowsTaskNote': 'Starts after you sign in as your account. It needs no password or administrator rights and does not run before sign-in.',
+    'keepalive.serviceNote': 'Runs as a Windows service under your account and starts before sign-in. Installing or removing it asks for administrator rights, and Windows may require your account password.',
     'keepalive.serviceWindowHint': 'Finish the installation in the administrator window that opens.',
     'keepalive.elevationCancelled': 'Administrator rights were not granted; nothing was installed.',
-    'keepalive.passwordPrompt': 'Windows password for {account} (the service signs in as you):',
-    'keepalive.passwordRejected': 'Windows did not accept that password. Try again.',
+    'keepalive.passwordPrompt': 'Windows account password for {account} (not a PIN; press Enter if there is no password):',
+    'keepalive.passwordRejected': 'Windows could not start the service with those credentials. Check the account password and service logon policy.',
     'keepalive.serviceInstalled': 'Service {id} is installed and running.',
     'keepalive.wrongAccount': 'Run this as the account that will use herdr-remote, not another administrator account.',
     'keepalive.pressEnter': 'Press Enter to close this window.',

package/dist/i18n/zh.js

@@ -130,11 +130,12 @@ const zh = {
     'keepalive.enableLinger': '开启开机自启',
     'keepalive.lingerDone': '已为 {username} 开启开机自启。',
     'keepalive.fallbackNote': '无系统服务管理器，使用后台守护进程，重启后不自动恢复。',
-    'keepalive.serviceNote': '以你的账户作为 Windows 服务运行，开机后、登录前自动启动。安装或移除需要管理员权限。',
+    'keepalive.windowsTaskNote': '在你的账户登录后启动，无需密码或管理员权限；登录前不会运行。',
+    'keepalive.serviceNote': '以你的账户作为 Windows 服务运行，在登录前启动。安装或移除需要管理员权限，Windows 也可能要求账户密码。',
     'keepalive.serviceWindowHint': '请在随后打开的管理员窗口中完成安装。',
     'keepalive.elevationCancelled': '未授予管理员权限，未安装服务。',
-    'keepalive.passwordPrompt': '请输入 {account} 的 Windows 密码（服务将以你的账户登录）：',
-    'keepalive.passwordRejected': 'Windows 不接受这个密码，请重试。',
+    'keepalive.passwordPrompt': '请输入 {account} 的 Windows 账户密码（不是 PIN；账户无密码时直接按 Enter）：',
+    'keepalive.passwordRejected': 'Windows 未能使用这些凭据启动服务。请检查账户密码和“作为服务登录”策略。',
     'keepalive.serviceInstalled': '服务 {id} 已安装并正在运行。',
     'keepalive.wrongAccount': '请使用将运行 herdr-remote 的账户执行此操作，不要换用其他管理员账户。',
     'keepalive.pressEnter': '按 Enter 关闭此窗口。',

package/dist/keepalive/index.js

@@ -2,9 +2,8 @@
 //
 // "Start the services" and "keep the services running" are different problems:
 // a detached spawn dies with the first crash and never comes back. This module
-// hands supervision to the platform's service manager where one exists
-// (systemd --user on Linux, launchd on macOS) and falls back to a detached copy
-// of our own supervisor where neither does.
+// hands supervision to the platform's manager where one exists (systemd --user,
+// launchd, or Task Scheduler) and falls back to a detached supervisor elsewhere.
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -14,6 +13,7 @@ import { detached } from './detached.js';
 import { launchd } from './launchd.js';
 import { systemd } from './systemd.js';
 import { windowsService } from './windows-service.js';
+import { windowsTask } from './windows-task.js';
 export { serviceEnvironment, servicePath } from './environment.js';
 export { escapeXml, renderLaunchdPlist } from './launchd.js';
 export { renderSystemdUnit, systemdEnvironmentLine } from './systemd.js';
@@ -41,7 +41,7 @@ export function detectManager(preference = 'auto', platform = process.platform)
     if (preference && preference !== 'auto')
         return preference;
     if (platform === 'win32')
-        return 'windows-service';
+        return 'windows-task';
     if (platform === 'linux') {
         // `systemctl --user` needs a user bus; containers and bare TTY logins often
         // have systemd installed but no session bus, where it would fail at runtime.
@@ -60,16 +60,27 @@ function managerOf(config) {
     return detectManager(config.keepalive?.manager || 'auto');
 }
 /** The backend for `config`. With keep-alive off, uninstalling still cleans up the fallback. */
-function backendOf(config) {
-    const manager = managerOf(config);
+function configuredBackend(manager) {
     if (manager === 'systemd')
         return systemd;
     if (manager === 'launchd')
         return launchd;
+    if (manager === 'windows-task')
+        return windowsTask;
     if (manager === 'windows-service')
         return windowsService;
     return detached;
 }
+function backendOf(config) {
+    const manager = managerOf(config);
+    if (manager === 'windows-task') {
+        if (windowsTask.status().installed)
+            return windowsTask;
+        if (windowsService.status().installed)
+            return windowsService;
+    }
+    return configuredBackend(manager);
+}
 export function status(config = loadConfig()) {
     if (managerOf(config) === 'none')
         return { manager: 'none', installed: false, active: false, enabled: false };
@@ -78,7 +89,7 @@ export function status(config = loadConfig()) {
 export async function install(config = loadConfig()) {
     if (managerOf(config) === 'none')
         throw new Error('keep-alive is disabled in the configuration');
-    const backend = backendOf(config);
+    const backend = configuredBackend(managerOf(config));
     return { manager: backend.name, ...(await backend.install()) };
 }
 export async function uninstall(config = loadConfig()) {

package/dist/keepalive/windows-service-setup.js

@@ -59,6 +59,30 @@ function failure(label, result) {
     const output = String(result.stdout || result.stderr || '').trim();
     return new Error(`${label} failed (${String(result.status)}): ${output}`);
 }
+export async function configureAndStartServiceAccount(id, account, t, dependencies = {}) {
+    const setAccount = dependencies.setAccount || setServiceAccount;
+    const start = dependencies.start || startService;
+    const prompt = dependencies.prompt ||
+        ((name) => promptSecret(t('keepalive.passwordPrompt', { account: name })));
+    const write = dependencies.write || ((message) => process.stdout.write(message));
+    for (let attempt = 0; attempt <= MAX_PASSWORD_ATTEMPTS; attempt += 1) {
+        const password = attempt === 0 ? '' : await prompt(account);
+        if (password === null)
+            return false;
+        const changed = setAccount(id, account, password);
+        if (changed.error || changed.status !== 0)
+            throw failure('Setting the Windows service account', changed);
+        const started = classifyStartResult(start());
+        if (started === 'ok')
+            return true;
+        if (started !== 'logon-failed') {
+            write(`${started.message}\n`);
+            return false;
+        }
+        write(`${t('keepalive.passwordRejected')}\n`);
+    }
+    return false;
+}
 /** Complete service installation inside the elevated console. */
 export async function completeServiceInstall(t) {
     try {
@@ -87,24 +111,9 @@ export async function completeServiceInstall(t) {
             throw failure('WinSW install', installed);
         const { domain, user } = currentServiceAccount();
         const account = `${domain}\\${user}`;
-        for (let attempt = 0; attempt < MAX_PASSWORD_ATTEMPTS; attempt += 1) {
-            const password = await promptSecret(t('keepalive.passwordPrompt', { account }));
-            if (password === null)
-                return 1;
-            const changed = setServiceAccount(paths.id, account, password);
-            if (changed.error || changed.status !== 0)
-                throw failure('Setting the Windows service account', changed);
-            const started = classifyStartResult(startService());
-            if (started === 'ok') {
-                process.stdout.write(`${t('keepalive.serviceInstalled', { id: paths.id })}\n`);
-                return 0;
-            }
-            if (started === 'logon-failed') {
-                process.stdout.write(`${t('keepalive.passwordRejected')}\n`);
-                continue;
-            }
-            process.stdout.write(`${started.message}\n`);
-            return 1;
+        if (await configureAndStartServiceAccount(paths.id, account, t)) {
+            process.stdout.write(`${t('keepalive.serviceInstalled', { id: paths.id })}\n`);
+            return 0;
         }
         return 1;
     }

package/dist/keepalive/windows-task.js

@@ -0,0 +1,191 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { configDir, stateDir } from '../paths.js';
+import { detachedLogsHint } from './detached.js';
+import { cliEntryPoint, serviceEnvironment } from './environment.js';
+import { currentServiceAccount, encodePowerShellCommand, escapePowerShellSingleQuoted, serviceId, windowsService, } from './windows-service.js';
+const TASK_START_TIMEOUT_MS = 15_000;
+const TASK_STOP_TIMEOUT_MS = 15_000;
+const TASK_POLL_INTERVAL_MS = 250;
+export function windowsTaskName(username = currentServiceAccount().user) {
+    return serviceId(username);
+}
+export function renderWindowsTaskLaunchScript(options) {
+    const environment = {
+        ...options.environment,
+        HERDR_REMOTE_CONFIG_DIR: options.configDirectory,
+        HERDR_REMOTE_STATE_DIR: options.stateDirectory,
+        HERDR_REMOTE_SERVICE: '1',
+    };
+    const environmentLines = Object.entries(environment).map(([key, value]) => `$env:${key} = '${escapePowerShellSingleQuoted(value)}'`);
+    return `$ErrorActionPreference = 'Stop'
+${environmentLines.join('\n')}
+Set-Location -LiteralPath '${escapePowerShellSingleQuoted(options.workingDirectory)}'
+& '${escapePowerShellSingleQuoted(options.nodePath)}' '${escapePowerShellSingleQuoted(options.entryPoint)}' run --daemon
+exit $LASTEXITCODE`;
+}
+export function renderWindowsTaskRegistrationScript(options) {
+    const taskName = escapePowerShellSingleQuoted(options.taskName);
+    const account = escapePowerShellSingleQuoted(options.account);
+    const powershellPath = escapePowerShellSingleQuoted(options.powershellPath);
+    const workingDirectory = escapePowerShellSingleQuoted(options.workingDirectory);
+    const launchArguments = `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encodePowerShellCommand(options.launchScript)}`;
+    return `$ErrorActionPreference = 'Stop'
+$action = New-ScheduledTaskAction -Execute '${powershellPath}' -Argument '${launchArguments}' -WorkingDirectory '${workingDirectory}'
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User '${account}'
+# Interactive logon uses the signed-in token and avoids storing account credentials.
+$principal = New-ScheduledTaskPrincipal -UserId '${account}' -LogonType Interactive -RunLevel Limited
+$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew
+Register-ScheduledTask -TaskName '${taskName}' -Description 'Herdr Remote keep-alive' -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null
+Enable-ScheduledTask -TaskName '${taskName}' | Out-Null
+Start-ScheduledTask -TaskName '${taskName}'`;
+}
+export function parseWindowsTaskState(output) {
+    try {
+        const state = JSON.parse(output.replace(/^\uFEFF/, '').trim()).State;
+        return state === 'Ready' || state === 'Queued' || state === 'Running' || state === 'Disabled'
+            ? state
+            : 'Absent';
+    }
+    catch {
+        // Task status is best-effort; malformed scheduler output means no known task.
+        return 'Absent';
+    }
+}
+function windowsPowerShellPath() {
+    const root = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+    return path.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+function taskStateScript(taskName) {
+    const safeName = escapePowerShellSingleQuoted(taskName);
+    return `$ErrorActionPreference = 'Stop'
+$task = Get-ScheduledTask -TaskName '${safeName}' -ErrorAction SilentlyContinue
+if ($null -eq $task) { '{"State":"Absent"}'; exit 0 }
+[pscustomobject]@{ State = [string]$task.State } | ConvertTo-Json -Compress`;
+}
+function invokePowerShell(script, label) {
+    const result = spawnSync(windowsPowerShellPath(), [
+        '-NoLogo',
+        '-NoProfile',
+        '-NonInteractive',
+        '-EncodedCommand',
+        encodePowerShellCommand(script),
+    ], { encoding: 'utf8', windowsHide: true });
+    if (result.error || result.status !== 0) {
+        const output = String(result.stderr || result.stdout || '').trim();
+        throw new Error(`${label} failed (${String(result.status)}): ${output}`);
+    }
+    return String(result.stdout || '').trim();
+}
+function taskState() {
+    const result = spawnSync(windowsPowerShellPath(), [
+        '-NoProfile',
+        '-NoLogo',
+        '-NonInteractive',
+        '-EncodedCommand',
+        encodePowerShellCommand(taskStateScript(windowsTaskName())),
+    ], { encoding: 'utf8', windowsHide: true });
+    if (result.error || result.status !== 0) {
+        // A status query must not make unrelated CLI commands fail on an unavailable scheduler.
+        return 'Absent';
+    }
+    return parseWindowsTaskState(String(result.stdout || ''));
+}
+function accountName() {
+    const { domain, user } = currentServiceAccount();
+    return domain ? `${domain}\\${user}` : user;
+}
+function stopTaskScript(taskName) {
+    const safeName = escapePowerShellSingleQuoted(taskName);
+    return `$ErrorActionPreference = 'Stop'
+$task = Get-ScheduledTask -TaskName '${safeName}' -ErrorAction SilentlyContinue
+if ($null -eq $task -or ($task.State -ne 'Running' -and $task.State -ne 'Queued')) { exit 0 }
+Stop-ScheduledTask -TaskName '${safeName}'
+$deadline = [DateTime]::UtcNow.AddMilliseconds(${TASK_STOP_TIMEOUT_MS})
+do {
+  Start-Sleep -Milliseconds ${TASK_POLL_INTERVAL_MS}
+  $task = Get-ScheduledTask -TaskName '${safeName}' -ErrorAction SilentlyContinue
+} while ($task -and ($task.State -eq 'Running' -or $task.State -eq 'Queued') -and [DateTime]::UtcNow -lt $deadline)
+if ($task -and ($task.State -eq 'Running' -or $task.State -eq 'Queued')) { throw 'Scheduled task did not stop in time.' }`;
+}
+function stopTask() {
+    const state = taskState();
+    if (state === 'Running' || state === 'Queued')
+        invokePowerShell(stopTaskScript(windowsTaskName()), 'Stopping the Windows scheduled task');
+}
+function launchOptions() {
+    const workingDirectory = stateDir();
+    return {
+        nodePath: process.execPath,
+        entryPoint: cliEntryPoint(),
+        workingDirectory,
+        configDirectory: configDir(),
+        stateDirectory: workingDirectory,
+        environment: serviceEnvironment(),
+    };
+}
+function status() {
+    const state = taskState();
+    const installed = state !== 'Absent';
+    return {
+        manager: 'windows-task',
+        installed,
+        active: state === 'Running',
+        enabled: installed && state !== 'Disabled',
+        state: state.toLowerCase(),
+    };
+}
+async function install() {
+    if (taskState() !== 'Absent')
+        stopTask();
+    // Remove the earlier service before starting a second supervisor for this user.
+    if (windowsService.status().installed)
+        await windowsService.uninstall();
+    const options = launchOptions();
+    await fs.promises.mkdir(options.workingDirectory, { recursive: true });
+    const launchScript = renderWindowsTaskLaunchScript(options);
+    const script = renderWindowsTaskRegistrationScript({
+        taskName: windowsTaskName(),
+        account: accountName(),
+        powershellPath: windowsPowerShellPath(),
+        workingDirectory: options.workingDirectory,
+        launchScript,
+    });
+    invokePowerShell(script, 'Installing the Windows scheduled task');
+    const deadline = Date.now() + TASK_START_TIMEOUT_MS;
+    let state = taskState();
+    while (state !== 'Running' && state !== 'Absent' && Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, TASK_POLL_INTERVAL_MS));
+        state = taskState();
+    }
+    if (state !== 'Running')
+        throw new Error(`Windows scheduled task did not start (state: ${state.toLowerCase()}).`);
+    return { ok: true, taskName: windowsTaskName(), state };
+}
+async function uninstall() {
+    const name = windowsTaskName();
+    if (taskState() !== 'Absent') {
+        stopTask();
+        const safeName = escapePowerShellSingleQuoted(name);
+        invokePowerShell(`Unregister-ScheduledTask -TaskName '${safeName}' -Confirm:$false -ErrorAction Stop`, 'Removing the Windows scheduled task');
+    }
+    if (windowsService.status().installed)
+        await windowsService.uninstall();
+    return { ok: true, taskName: name };
+}
+function restart() {
+    stopTask();
+    const safeName = escapePowerShellSingleQuoted(windowsTaskName());
+    invokePowerShell(`Start-ScheduledTask -TaskName '${safeName}'`, 'Starting the Windows scheduled task');
+    return { ok: true };
+}
+export const windowsTask = {
+    name: 'windows-task',
+    status,
+    install,
+    uninstall,
+    restart,
+    stop: stopTask,
+    logsHint: () => detachedLogsHint('win32'),
+};

package/dist/lifecycle.js

@@ -49,7 +49,7 @@ function restartAll(config = loadConfig()) {
     }
     return { ...restartServices(), managed: false };
 }
-/** Release Windows service binaries while npm replaces their package files. */
+/** Stop Windows keep-alive processes while npm replaces their package files. */
 async function whileServicesStopped(config, task, { platform = process.platform, isRunning = () => Boolean(managerInUse(config)?.active || pidAlive(readRuntime().hostPid)), stop = stopAll, start = startAll, } = {}) {
     if (platform !== 'win32' || !isRunning())
         return task();

package/dist/tui/screens/Keepalive.js

@@ -91,5 +91,5 @@ export function Keepalive({ ctx }) {
                                         : t('common.notInstalled')] })] }) }), current?.unitPath ? (_jsx(Row, { label: t('keepalive.unitPath'), children: _jsx(Text, { color: theme.muted, children: current.unitPath }) })) : null, _jsx(Box, { marginTop: 1, flexDirection: "column", children: entries.map((entry) => (_jsx(Selectable, { selected: selected === entry.id, onSelect: () => {
                         setSelected(entry.id);
                         activate(entry.id);
-                    }, onHover: () => setSelected(entry.id), children: entry.label }, entry.id))) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [current?.manager === 'systemd' ? (_jsx(Text, { color: current.linger ? theme.muted : theme.warn, children: current.linger ? t('keepalive.lingerEnabled') : t('keepalive.lingerDisabled') })) : null, current?.manager === 'supervisor' ? (_jsx(Text, { color: theme.warn, children: t('keepalive.fallbackNote') })) : null, current?.manager === 'windows-service' ? (_jsx(Text, { color: theme.warn, children: t('keepalive.serviceNote') })) : null, _jsx(Text, { color: theme.muted, children: t('keepalive.logsHint', { command: status?.logsHint ?? '' }) })] }), _jsx(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? 'info' })] }));
+                    }, onHover: () => setSelected(entry.id), children: entry.label }, entry.id))) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [current?.manager === 'systemd' ? (_jsx(Text, { color: current.linger ? theme.muted : theme.warn, children: current.linger ? t('keepalive.lingerEnabled') : t('keepalive.lingerDisabled') })) : null, current?.manager === 'supervisor' ? (_jsx(Text, { color: theme.warn, children: t('keepalive.fallbackNote') })) : null, current?.manager === 'windows-task' ? (_jsx(Text, { color: theme.muted, children: t('keepalive.windowsTaskNote') })) : null, current?.manager === 'windows-service' ? (_jsx(Text, { color: theme.warn, children: t('keepalive.serviceNote') })) : null, _jsx(Text, { color: theme.muted, children: t('keepalive.logsHint', { command: status?.logsHint ?? '' }) })] }), _jsx(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? 'info' })] }));
 }

package/herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "herdr.remote.web"
 name = "Herdr Remote Web"
-version = "0.2.23"
+version = "0.2.25"
 min_herdr_version = "0.9.1"
 description = "Browser access to Herdr workspaces via local or self-hosted relay"
 platforms = ["linux", "macos", "windows"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herdr-remote",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "Browser access to Herdr workspaces: plugin, host connector, and configuration TUI",
   "license": "MIT",
   "type": "module",