openmeld 0.3.222 → 0.3.224

package/dist/windows-user-task-Io5QuEVR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-user-task-Io5QuEVR.js","names":[],"sources":["../src/local-service/lifecycle/windows-service-binary.ts","../src/local-service/lifecycle/windows-task-host.ts","../src/local-service/lifecycle/windows-user-task.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport {\n  copyFile,\n  mkdir,\n  mkdtemp,\n  open,\n  rename,\n  rm,\n  stat,\n} from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { pruneWindowsBinaryBundle } from \"@openmeld/adapter-core/windows-system\";\nimport { WINDOWS_PROCESS_HELPER_FILENAME } from \"@openmeld/schemas\";\nimport { daemonRuntimeBundlesPath } from \"../../config/daemon-state\";\nimport type { OpenMeldPathResolutionInput } from \"../../config/paths\";\nimport type { CliBinaryReleaseInfo } from \"../../config/version-state\";\nimport type { DaemonActiveBundleState } from \"./daemon-service-bundle\";\n\nconst FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/u;\n\nexport function windowsMaintenanceBinaryPath(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): string {\n  if (\n    !(\n      bundle.sourceDistFingerprint &&\n      FINGERPRINT_PATTERN.test(bundle.sourceDistFingerprint)\n    )\n  ) {\n    throw new Error(\n      \"OpenMeld maintenance needs a verified Windows Service bundle.\"\n    );\n  }\n  return join(\n    daemonRuntimeBundlesPath(pathInput),\n    `maintenance-${bundle.sourceDistFingerprint}`,\n    \"openmeld.exe\"\n  );\n}\n\nexport async function prepareWindowsMaintenanceBinary(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): Promise<string> {\n  const target = windowsMaintenanceBinaryPath(bundle, pathInput);\n  const expected = bundle.sourceDistFingerprint;\n  if (\n    (await hashBinaryServiceBundle(target, true).catch(() => null)) === expected\n  ) {\n    return target;\n  }\n  if (\n    (await hashBinaryServiceBundle(bundle.sourceEntryScriptPath, true)) !==\n    expected\n  ) {\n    throw new Error(\n      \"The Windows maintenance source no longer matches its verified bundle.\"\n    );\n  }\n  const directory = dirname(target);\n  if (\n    await stat(directory).catch((error: NodeJS.ErrnoException) => {\n      if (error.code === \"ENOENT\") {\n        return null;\n      }\n      throw error;\n    })\n  ) {\n    const result = await pruneWindowsBinaryBundle(directory);\n    if (result !== \"removed\" && result !== \"absent\") {\n      throw new Error(\n        \"The existing Windows maintenance copy is still in use or contains unrecognized files.\"\n      );\n    }\n  }\n  await mkdir(daemonRuntimeBundlesPath(pathInput), { recursive: true });\n  const temporary = await mkdtemp(\n    join(daemonRuntimeBundlesPath(pathInput), \".maintenance-\")\n  );\n  try {\n    for (const name of [\"openmeld.exe\", WINDOWS_PROCESS_HELPER_FILENAME]) {\n      await copyFile(\n        name === \"openmeld.exe\"\n          ? bundle.sourceEntryScriptPath\n          : join(dirname(bundle.sourceEntryScriptPath), name),\n        join(temporary, name)\n      );\n    }\n    if (\n      (await hashBinaryServiceBundle(join(temporary, \"openmeld.exe\"), true)) !==\n      expected\n    ) {\n      throw new Error(\n        \"The prepared Windows maintenance copy failed verification.\"\n      );\n    }\n    await rename(temporary, directory);\n  } finally {\n    await rm(temporary, { recursive: true, force: true });\n  }\n  return target;\n}\n\n// Windows binary_v1 bundles contain two indivisible, independently signed files.\n// Keep one bundle fingerprint for inventory, update jobs, and maintenance copies.\nexport function expectedBinaryServiceFingerprint(\n  release: CliBinaryReleaseInfo\n): string {\n  if (!release.platform.startsWith(\"windows-\")) {\n    return release.sha256.toLowerCase();\n  }\n  if (!release.windows) {\n    throw new Error(\n      \"The selected Windows Service has no native helper metadata.\"\n    );\n  }\n  return fingerprint(release.sha256, release.windows.processHelper.sha256);\n}\n\nexport async function hashBinaryServiceBundle(\n  executablePath: string,\n  windows: boolean = process.platform === \"win32\"\n): Promise<string> {\n  const executableHash = await hashFile(executablePath);\n  return windows\n    ? fingerprint(\n        executableHash,\n        await hashFile(\n          join(dirname(executablePath), WINDOWS_PROCESS_HELPER_FILENAME)\n        )\n      )\n    : executableHash;\n}\n\nfunction fingerprint(executableHash: string, helperHash: string): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify([executableHash.toLowerCase(), helperHash.toLowerCase()])\n    )\n    .digest(\"hex\");\n}\n\nasync function hashFile(file: string): Promise<string> {\n  const hash = createHash(\"sha256\");\n  for await (const chunk of createReadStream(file)) {\n    hash.update(chunk);\n  }\n  return hash.digest(\"hex\");\n}\n\n/** A valid signature does not establish the required console-free PE subsystem. */\nexport async function verifyWindowsServiceSubsystem(\n  file: string\n): Promise<void> {\n  const handle = await open(file, \"r\");\n  try {\n    const dos = Buffer.alloc(64);\n    const first = await handle.read(dos, 0, dos.length, 0);\n    if (\n      first.bytesRead !== dos.length ||\n      dos.toString(\"ascii\", 0, 2) !== \"MZ\"\n    ) {\n      throw new Error(\"The Windows Service artifact is not a PE executable.\");\n    }\n    const header = Buffer.alloc(94);\n    const second = await handle.read(\n      header,\n      0,\n      header.length,\n      dos.readUInt32LE(0x3c)\n    );\n    if (\n      second.bytesRead !== header.length ||\n      header.toString(\"ascii\", 0, 4) !== \"PE\\0\\0\" ||\n      header.readUInt16LE(4) !== 0x86_64 ||\n      header.readUInt16LE(24 + 68) !== 2\n    ) {\n      throw new Error(\n        \"The selected Windows Service must be a console-free x64 executable.\"\n      );\n    }\n  } finally {\n    await handle.close();\n  }\n}\n","// Task Scheduler must start a Windows-subsystem executable, not a console\n// executable that hides its window after startup. Keep the existing encoded\n// PowerShell action as the command/environment/logging owner.\n// Windows PowerShell 5.1 compiles this fixed source during guarded installation;\n// no SDK, downloaded executable, WSH/VBScript, or administrator access is needed.\nexport const WINDOWS_TASK_HOST_SOURCE = String.raw`\nusing System;\nusing System.Diagnostics;\nusing System.IO;\nusing System.Reflection;\nusing System.Text;\nusing System.Text.RegularExpressions;\n\npublic static class OpenMeldTaskHostV1 {\n  public static int Main(string[] args) {\n    string logPath = Assembly.GetExecutingAssembly().Location + \".log\";\n    try {\n      // Accept only the existing OpenMeld action, never an arbitrary executable\n      // or a shell-interpolated command line. Base64 contains no quoting syntax.\n      if (args.Length != 7 || args[0] != \"-NoLogo\" || args[1] != \"-NoProfile\" ||\n          args[2] != \"-NonInteractive\" || args[3] != \"-WindowStyle\" ||\n          args[4] != \"Hidden\" || args[5] != \"-EncodedCommand\" ||\n          !Regex.IsMatch(args[6], @\"\\A[A-Za-z0-9+/]+={0,2}\\z\"))\n        throw new ArgumentException(\"Invalid OpenMeld task arguments.\");\n      Convert.FromBase64String(args[6]);\n      var start = new ProcessStartInfo();\n      start.FileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),\n        @\"WindowsPowerShell\\v1.0\\powershell.exe\");\n      start.Arguments = String.Join(\" \", args);\n      start.UseShellExecute = false;\n      start.CreateNoWindow = true;\n      start.RedirectStandardInput = true;\n      start.RedirectStandardOutput = true;\n      start.RedirectStandardError = true;\n      using (var log = Stream.Synchronized(new FileStream(logPath, FileMode.Append,\n          FileAccess.Write, FileShare.ReadWrite)))\n      using (var child = new Process()) {\n        child.StartInfo = start;\n        child.Start();\n        child.StandardInput.Close();\n        var stdout = child.StandardOutput.BaseStream.CopyToAsync(log);\n        var stderr = child.StandardError.BaseStream.CopyToAsync(log);\n        // Do not detach or break away from Task Scheduler's process ownership.\n        // The task remains running until the action completes, and restart-on-\n        // failure still receives the action's real exit code.\n        child.WaitForExit();\n        stdout.GetAwaiter().GetResult();\n        stderr.GetAwaiter().GetResult();\n        return child.ExitCode;\n      }\n    } catch (Exception error) {\n      try { File.AppendAllText(logPath, DateTime.UtcNow.ToString(\"o\") + \" \" +\n        error.GetType().Name + \": \" + error.Message + Environment.NewLine, Encoding.UTF8); }\n      catch { /* Task Scheduler still receives a nonzero result if logging fails. */ }\n      return 1;\n    }\n  }\n}\n`;\n\n// Per-task, lane-owned path: updating the maintenance host cannot replace the\n// executable of a running main Service, or vice versa. Keep v1 stable; a future\n// host format must explicitly support migration from this path.\nexport const WINDOWS_TASK_HOST_SUFFIX = \".task-host-v1.exe\";\n\n// The caller has already verified identity and acquired the lifecycle grant.\n// Build beside the target and replace atomically, never overwrite a running\n// host or fall back to a flashing console when compilation is unavailable.\nexport const WINDOWS_TASK_HOST_INSTALL_SCRIPT = `\n$hostDirectory = [IO.Path]::GetDirectoryName($hostPath)\n$null = [IO.Directory]::CreateDirectory($hostDirectory)\n$temporaryHost = Join-Path $hostDirectory ([Guid]::NewGuid().ToString('N') + '.exe')\ntry {\n  Add-Type -TypeDefinition @'\n${WINDOWS_TASK_HOST_SOURCE}\n'@ -OutputAssembly $temporaryHost -OutputType WindowsApplication -ErrorAction Stop\n  if ($task -and $task.State -eq 4) { throw 'OpenMeld cannot replace a background task while it is running.' }\n  if ([IO.File]::Exists($hostPath)) {\n    # PowerShell coerces bare $null to an empty string for this .NET parameter.\n    # Pass a real null backup path; an empty path breaks repeat setup/repair.\n    [IO.File]::Replace($temporaryHost, $hostPath, [NullString]::Value)\n  } else {\n    [IO.File]::Move($temporaryHost, $hostPath)\n  }\n} finally {\n  if ([IO.File]::Exists($temporaryHost)) { [IO.File]::Delete($temporaryHost) }\n}\n`;\n","import { type ExecFileException, execFile } from \"node:child_process\";\nimport { normalizeCommandEnvironment } from \"@openmeld/adapter-core/process-environment\";\nimport {\n  powerShellEncodedArguments,\n  resolveWindowsPowerShellPath,\n} from \"@openmeld/adapter-core/windows-system\";\nimport {\n  type WindowsUserTaskAction,\n  type WindowsUserTaskRequest,\n  windowsUserTaskActionSchema,\n  windowsUserTaskRequestSchema,\n  windowsUserTaskStatusSchema,\n  windowsUserTaskStoredActionSchema,\n} from \"@openmeld/schemas\";\nimport { currentDaemonServiceLifecycleLock } from \"../../config/daemon-state\";\nimport {\n  attachLockProcess,\n  type OpenMeldLock,\n  releaseLock,\n} from \"../../config/lock\";\nimport { verifyWindowsServiceSubsystem } from \"./windows-service-binary\";\nimport { readWindowsDirectTaskAction } from \"./windows-task-command\";\nimport {\n  WINDOWS_TASK_HOST_INSTALL_SCRIPT,\n  WINDOWS_TASK_HOST_SUFFIX,\n} from \"./windows-task-host\";\n\n// Task Scheduler runs in the signed-in user's session, with that user's tokens\n// and ordinary permissions. No password, elevation, or third-party service host.\n// Native COM contracts: learn.microsoft.com/windows/win32/taskschd/\nconst TASK_CONTROL = String.raw`\n$ErrorActionPreference = 'Stop'\n$ProgressPreference = 'SilentlyContinue'\n[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)\n$r = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:OPENMELD_TASK_REQUEST)))\nif ($env:OPENMELD_TASK_GRANT_REQUIRED -eq '1' -and [Console]::In.ReadLine() -ne 'execute') { exit 125 }\n$env:OPENMELD_TASK_GRANT_REQUIRED = $null\n$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value\nif ($sid -in @('S-1-5-18','S-1-5-19','S-1-5-20')) { throw 'Run OpenMeld setup from your own Windows account, not a system account.' }\n$scheduler = New-Object -ComObject 'Schedule.Service'\n$scheduler.Connect()\n$folder = $scheduler.GetFolder('\\')\n$name = $r.name + '-' + $sid\n$hostPath = $r.legacyScript + '${WINDOWS_TASK_HOST_SUFFIX}'\n$runtimeRoot = [IO.Path]::GetDirectoryName($r.legacyScript)\nfunction Read-OwnedDirectAction($path, $arguments) {\n  if ($arguments -notmatch '(?:^| )--openmeld-windows-task ([A-Za-z0-9+/=]+)$') { return $null }\n  $c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Matches[1])))\n  $bundles = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'bundles')) + '\\'\n  $fullPath = [IO.Path]::GetFullPath($path)\n  if ($c.executable -ne $path -or !$fullPath.StartsWith($bundles, [StringComparison]::OrdinalIgnoreCase) -or [IO.Path]::GetFileName($path) -ne 'openmeld.exe' -or !$c.env.OPENMELD_HOME -or [IO.Path]::GetFullPath((Join-Path $c.env.OPENMELD_HOME 'runtime\\daemon')) -ne [IO.Path]::GetFullPath($runtimeRoot)) {\n    throw 'The Windows task does not belong to this OpenMeld installation.'\n  }\n  return $c\n}\n$existingDirect = $null\n$task = $null\ntry { $task = $folder.GetTask($name) } catch {\n  if ($_.Exception.GetBaseException().HResult -ne -2147024894) { throw }\n}\nif ($task) {\n  $principal = $task.Definition.Principal\n  $taskSid = $principal.UserId\n  if ($taskSid -notmatch '^S-\\d-') { $taskSid = ([Security.Principal.NTAccount]$taskSid).Translate([Security.Principal.SecurityIdentifier]).Value }\n  $actionPath = $task.Definition.Actions.Item(1).Path\n  $existingDirect = Read-OwnedDirectAction $actionPath $task.Definition.Actions.Item(1).Arguments\n  if ($taskSid -ne $sid -or $principal.LogonType -ne 3 -or $principal.RunLevel -ne 0 -or $task.Definition.Actions.Count -ne 1 -or (!$existingDirect -and $actionPath -ne (Join-Path $PSHOME 'powershell.exe') -and $actionPath -ne $hostPath)) {\n    throw 'An existing OpenMeld task uses a different user or launch configuration. Resolve that installation before continuing.'\n  }\n}\n# Migration only owns the exact legacy script in this lane. Never stop another\n# user's or an administrator-customized service merely because its name matches.\n$legacy = Get-CimInstance Win32_Service -Filter (\"Name='\" + $r.name.Replace(\"'\",\"''\") + \"'\")\nif ($legacy -and $legacy.PathName.Trim('\"') -ne $r.legacyScript) {\n  throw 'An existing Windows service uses a different installation. Resolve that installation before continuing.'\n}\nswitch ($r.operation) {\n  'install' {\n    if ($legacy -and $legacy.State -ne 'Stopped') { throw 'The previous OpenMeld Service must finish stopping before migration.' }\n    $nextDirect = Read-OwnedDirectAction $r.executable $r.arguments\n    # A running maintenance invocation keeps its immutable copy and lease. Only\n    # subsequent invocations select the new copy. Main Service replacement still\n    # requires the existing drain and stopped-state proof.\n    $maintenanceUpdate = $r.periodic -and $existingDirect -and $nextDirect -and $existingDirect.args.Count -eq 2 -and $nextDirect.args.Count -eq 2 -and $existingDirect.args[0] -eq 'service' -and $existingDirect.args[1] -eq 'update-worker' -and $nextDirect.args[0] -eq 'service' -and $nextDirect.args[1] -eq 'update-worker'\n    if ($task -and $task.State -eq 4 -and !$maintenanceUpdate) { throw 'OpenMeld cannot replace a background task while it is running.' }\n    if (!$nextDirect) {\n      if ($r.executable -ne (Join-Path $PSHOME 'powershell.exe')) { throw 'OpenMeld tasks require a verified background executable.' }\n      ${WINDOWS_TASK_HOST_INSTALL_SCRIPT}\n    }\n    $definition = $scheduler.NewTask(0)\n    $definition.RegistrationInfo.Description = 'OpenMeld background process for the signed-in user.'\n    $definition.Principal.UserId = $sid\n    $definition.Principal.LogonType = 3\n    $definition.Principal.RunLevel = 0\n    $definition.Settings.Enabled = ($null -eq $legacy)\n    $definition.Settings.Hidden = $true\n    $definition.Settings.AllowDemandStart = $true\n    $definition.Settings.DisallowStartIfOnBatteries = $false\n    $definition.Settings.StopIfGoingOnBatteries = $false\n    $definition.Settings.RunOnlyIfNetworkAvailable = $false\n    $definition.Settings.StartWhenAvailable = $true\n    $definition.Settings.ExecutionTimeLimit = 'PT0S'\n    $definition.Settings.MultipleInstances = 2\n    $definition.Settings.RestartInterval = 'PT1M'\n    $definition.Settings.RestartCount = 999\n    $trigger = $definition.Triggers.Create(9)\n    $trigger.UserId = $sid\n    if ($r.periodic) {\n      $timer = $definition.Triggers.Create(1)\n      $timer.StartBoundary = (Get-Date).AddMinutes(1).ToString('yyyy-MM-ddTHH:mm:ss')\n      $timer.Repetition.Interval = 'PT1H'\n    }\n    $action = $definition.Actions.Create(0)\n    $action.Path = $(if ($nextDirect) { $r.executable } else { $hostPath })\n    $action.Arguments = $r.arguments\n    $action.WorkingDirectory = $r.workingDirectory\n    $task = $folder.RegisterTaskDefinition($name, $definition, 6, $sid, $null, 3, $null)\n    if ($legacy) {\n      try {\n        $deleted = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n        if ($deleted.ReturnValue -ne 0) { throw ('Cannot remove the old Windows Service (code ' + $deleted.ReturnValue + '). An administrator must remove the old registration before setup can continue.') }\n      } catch {\n        $folder.DeleteTask($name,0)\n        throw\n      }\n      $task.Enabled = $true\n    }\n    $legacy = $null\n  }\n  'start' { if (!$task) { throw 'OpenMeld background task is not installed. Run setup to repair it.' }; $null = $task.Run($null) }\n  'enable' { if ($task) { $task.Enabled = $true } }\n  'disable' { if ($task) { $task.Enabled = $false }; if ($legacy) { $result = Invoke-CimMethod -InputObject $legacy -MethodName ChangeStartMode -Arguments @{StartMode='Manual'}; if ($result.ReturnValue -ne 0) { throw 'Cannot disable the old Windows Service. Administrator assistance is required.' } } }\n  'stop' {\n    if ($task) { $task.Stop(0) }\n    if ($legacy -and $legacy.State -ne 'Stopped') {\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName StopService\n      if ($result.ReturnValue -notin @(0,6)) { throw 'Cannot stop the old Windows Service. Administrator assistance is required.' }\n    }\n  }\n  'uninstall' {\n    if ($task) { $task.Stop(0); $folder.DeleteTask($name,0); $task = $null }\n    if ($legacy) {\n      if ($legacy.State -ne 'Stopped') { throw 'The old OpenMeld Service is still running.' }\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n      if ($result.ReturnValue -ne 0) { throw 'Cannot remove the old Windows Service. Administrator assistance is required.' }\n      $legacy = $null\n    }\n  }\n  'status' { }\n  default { throw 'Unknown OpenMeld task operation.' }\n}\n@{ installed=($null -ne $task -or $null -ne $legacy); running=($(if ($task) { $task.State -eq 4 } else { $legacy -and $legacy.State -ne 'Stopped' })); enabled=($(if ($task) { [bool]$task.Enabled } else { $legacy -and $legacy.StartMode -eq 'Auto' })); legacy=($null -ne $legacy); actionArguments=($(if ($task) { $task.Definition.Actions.Item(1).Arguments } else { $null })) } | ConvertTo-Json -Compress\n`;\n\nexport function windowsPowerShellPath(): string {\n  return resolveWindowsPowerShellPath();\n}\n\nexport function windowsTaskActionArguments(\n  input: WindowsUserTaskAction\n): string {\n  // TypeScript's structural type does not strip fields from a spread spec.\n  // Project and validate the actual wire value before encoding it.\n  const action = windowsUserTaskActionSchema.parse({\n    executable: input.executable,\n    args: input.args,\n    env: input.env,\n    logPath: input.logPath,\n  });\n  const data = Buffer.from(JSON.stringify(action)).toString(\"base64\");\n  const script = String.raw`\n$ErrorActionPreference = 'Stop'\n$c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${data}')))\nfunction Quote-ProcessArgument([string]$value) {\n  '\"' + [regex]::Replace([regex]::Replace($value, '(\\\\*)\"', '$1$1\\\"'), '(\\\\+)$', '$1$1') + '\"'\n}\n$start = New-Object Diagnostics.ProcessStartInfo\n$start.FileName = $c.executable\n$start.Arguments = (@($c.args | ForEach-Object { Quote-ProcessArgument $_ }) -join ' ')\n$start.UseShellExecute = $false\n$start.CreateNoWindow = $true\n$start.RedirectStandardOutput = $true\n$start.RedirectStandardError = $true\nforeach ($property in $c.env.PSObject.Properties) { $start.EnvironmentVariables[$property.Name] = [string]$property.Value }\n$log = [IO.Stream]::Synchronized([IO.File]::Open($c.logPath, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::ReadWrite))\n$process = New-Object Diagnostics.Process\n$process.StartInfo = $start\ntry {\n  $null = $process.Start()\n  $stdout = $process.StandardOutput.BaseStream.CopyToAsync($log)\n  $stderr = $process.StandardError.BaseStream.CopyToAsync($log)\n  $process.WaitForExit()\n  $stdout.GetAwaiter().GetResult()\n  $stderr.GetAwaiter().GetResult()\n  $exitCode = $process.ExitCode\n} finally {\n  $log.Dispose()\n  $process.Dispose()\n}\nexit $exitCode\n`;\n  return `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(script, \"utf16le\").toString(\"base64\")}`;\n}\n\nconst ENCODED_ACTION_PATTERN = /-EncodedCommand ([A-Za-z0-9+/=]+)$/u;\nconst ACTION_DATA_PATTERN = /FromBase64String\\('([A-Za-z0-9+/=]+)'\\)/u;\n\nexport function readWindowsTaskAction(argumentsText: string) {\n  const direct = readWindowsDirectTaskAction(argumentsText);\n  if (direct) {\n    return direct;\n  }\n  const encoded = argumentsText.match(ENCODED_ACTION_PATTERN)?.[1];\n  const data =\n    encoded &&\n    Buffer.from(encoded, \"base64\")\n      .toString(\"utf16le\")\n      .match(ACTION_DATA_PATTERN)?.[1];\n  if (!data) {\n    throw new Error(\n      \"Windows task does not contain an OpenMeld launch command.\"\n    );\n  }\n  const action = windowsUserTaskStoredActionSchema.safeParse(\n    JSON.parse(Buffer.from(data, \"base64\").toString(\"utf8\"))\n  );\n  if (!action.success) {\n    throw new Error(\n      \"Windows task contains an invalid OpenMeld launch command.\"\n    );\n  }\n  return action.data;\n}\n\nexport async function runWindowsUserTask(\n  request: WindowsUserTaskRequest\n): Promise<{\n  installed: boolean;\n  running: boolean;\n  enabled: boolean;\n  legacy: boolean;\n  actionArguments: string | null;\n}> {\n  const lock = currentDaemonServiceLifecycleLock();\n  if (request.operation === \"install\" && request.arguments) {\n    const direct = readWindowsDirectTaskAction(request.arguments);\n    if (direct) {\n      if (request.executable !== direct.executable) {\n        throw new Error(\n          \"The Windows task executable does not match its launch envelope.\"\n        );\n      }\n      await verifyWindowsServiceSubsystem(direct.executable);\n    }\n  }\n  const payload = Buffer.from(\n    JSON.stringify(windowsUserTaskRequestSchema.parse(request))\n  ).toString(\"base64\");\n  let finish!: (value: {\n    error: ExecFileException | null;\n    stdout: string;\n  }) => void;\n  const completed = new Promise<{\n    error: ExecFileException | null;\n    stdout: string;\n  }>((resolve) => {\n    finish = resolve;\n  });\n  const child = execFile(\n    windowsPowerShellPath(),\n    powerShellEncodedArguments(TASK_CONTROL),\n    {\n      encoding: \"utf8\",\n      windowsHide: true,\n      timeout: 30_000,\n      maxBuffer: 1024 * 1024,\n      env: {\n        ...normalizeCommandEnvironment(process.env),\n        OPENMELD_TASK_REQUEST: payload,\n        OPENMELD_TASK_GRANT_REQUIRED: lock ? \"1\" : \"0\",\n      },\n    },\n    (error, stdout) => finish({ error, stdout })\n  );\n  // EOF before the grant prevents the COM operation. Once granted, this exact\n  // PowerShell instance retains the existing lifecycle fence if its CLI dies.\n  // This is not a Wake Job: the independently scheduled Service must survive it.\n  child.stdin?.on(\"error\", () => undefined);\n  let participant: OpenMeldLock | undefined;\n  try {\n    if (lock) {\n      if (!child.pid) {\n        throw new Error(\"Windows task control did not establish a process.\");\n      }\n      participant = await attachLockProcess(lock, child.pid);\n    }\n    child.stdin?.end(lock ? \"execute\\n\" : undefined);\n    const result = await completed;\n    if (result.error) {\n      throw result.error;\n    }\n    const status = windowsUserTaskStatusSchema.safeParse(\n      JSON.parse(result.stdout.trim())\n    );\n    if (!status.success) {\n      throw new Error(\"Windows returned an invalid OpenMeld task status.\");\n    }\n    return status.data;\n  } finally {\n    child.stdin?.destroy();\n    if (child.exitCode === null && child.signalCode === null) {\n      child.kill();\n    }\n    await completed;\n    if (participant) {\n      await releaseLock(participant);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,sBAAsB;AAE5B,SAAgB,6BACd,QACA,YAAyC,CAAC,GAClC;CACR,IACE,EACE,OAAO,yBACP,oBAAoB,KAAK,OAAO,qBAAqB,IAGvD,MAAM,IAAI,MACR,+DACF;CAEF,OAAO,KACL,yBAAyB,SAAS,GAClC,eAAe,OAAO,yBACtB,cACF;AACF;AAEA,eAAsB,gCACpB,QACA,YAAyC,CAAC,GACzB;CACjB,MAAM,SAAS,6BAA6B,QAAQ,SAAS;CAC7D,MAAM,WAAW,OAAO;CACxB,IACG,MAAM,wBAAwB,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,MAAO,UAEpE,OAAO;CAET,IACG,MAAM,wBAAwB,OAAO,uBAAuB,IAAI,MACjE,UAEA,MAAM,IAAI,MACR,uEACF;CAEF,MAAM,YAAY,QAAQ,MAAM;CAChC,IACE,MAAM,KAAK,SAAS,CAAC,CAAC,OAAO,UAAiC;EAC5D,IAAI,MAAM,SAAS,UACjB,OAAO;EAET,MAAM;CACR,CAAC,GACD;EACA,MAAM,SAAS,MAAM,yBAAyB,SAAS;EACvD,IAAI,WAAW,aAAa,WAAW,UACrC,MAAM,IAAI,MACR,uFACF;CAEJ;CACA,MAAM,MAAM,yBAAyB,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;CACpE,MAAM,YAAY,MAAM,QACtB,KAAK,yBAAyB,SAAS,GAAG,eAAe,CAC3D;CACA,IAAI;EACF,KAAK,MAAM,QAAQ,CAAC,gBAAgB,+BAA+B,GACjE,MAAM,SACJ,SAAS,iBACL,OAAO,wBACP,KAAK,QAAQ,OAAO,qBAAqB,GAAG,IAAI,GACpD,KAAK,WAAW,IAAI,CACtB;EAEF,IACG,MAAM,wBAAwB,KAAK,WAAW,cAAc,GAAG,IAAI,MACpE,UAEA,MAAM,IAAI,MACR,4DACF;EAEF,MAAM,OAAO,WAAW,SAAS;CACnC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;CACA,OAAO;AACT;AAIA,SAAgB,iCACd,SACQ;CACR,IAAI,CAAC,QAAQ,SAAS,WAAW,UAAU,GACzC,OAAO,QAAQ,OAAO,YAAY;CAEpC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,cAAc,MAAM;AACzE;AAEA,eAAsB,wBACpB,gBACA,UAAmB,QAAQ,aAAa,SACvB;CACjB,MAAM,iBAAiB,MAAM,SAAS,cAAc;CACpD,OAAO,UACH,YACE,gBACA,MAAM,SACJ,KAAK,QAAQ,cAAc,GAAG,+BAA+B,CAC/D,CACF,IACA;AACN;AAEA,SAAS,YAAY,gBAAwB,YAA4B;CACvE,OAAO,WAAW,QAAQ,CAAC,CACxB,OACC,KAAK,UAAU,CAAC,eAAe,YAAY,GAAG,WAAW,YAAY,CAAC,CAAC,CACzE,CAAC,CACA,OAAO,KAAK;AACjB;AAEA,eAAe,SAAS,MAA+B;CACrD,MAAM,OAAO,WAAW,QAAQ;CAChC,WAAW,MAAM,SAAS,iBAAiB,IAAI,GAC7C,KAAK,OAAO,KAAK;CAEnB,OAAO,KAAK,OAAO,KAAK;AAC1B;;AAGA,eAAsB,8BACpB,MACe;CACf,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG;CACnC,IAAI;EACF,MAAM,MAAM,OAAO,MAAM,EAAE;EAE3B,KACE,MAFkB,OAAO,KAAK,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAA,CAE7C,cAAc,IAAI,UACxB,IAAI,SAAS,SAAS,GAAG,CAAC,MAAM,MAEhC,MAAM,IAAI,MAAM,sDAAsD;EAExE,MAAM,SAAS,OAAO,MAAM,EAAE;EAO9B,KACE,MAPmB,OAAO,KAC1B,QACA,GACA,OAAO,QACP,IAAI,aAAa,EAAI,CACvB,EAAA,CAES,cAAc,OAAO,UAC5B,OAAO,SAAS,SAAS,GAAG,CAAC,MAAM,YACnC,OAAO,aAAa,CAAC,MAAM,SAC3B,OAAO,aAAa,EAAO,MAAM,GAEjC,MAAM,IAAI,MACR,qEACF;CAEJ,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;;;ACrLA,MAAa,2BAA2B,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DlD,MAAa,2BAA2B;AAKxC,MAAa,mCAAmC;;;;;;EAM9C,yBAAyB;;;;;;;;;;;;;;;;AC5C3B,MAAM,eAAe,OAAO,GAAG;;;;;;;;;;;;;iCAaE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4ClD,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEzC,SAAgB,wBAAgC;CAC9C,OAAO,6BAA6B;AACtC;AAEA,SAAgB,2BACd,OACQ;CAGR,MAAM,SAAS,4BAA4B,MAAM;EAC/C,YAAY,MAAM;EAClB,MAAM,MAAM;EACZ,KAAK,MAAM;EACX,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;CAClE,MAAM,SAAS,OAAO,GAAG;;sFAE2D,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BzF,OAAO,0EAA0E,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,SAAS,QAAQ;AACnI;AAEA,MAAM,yBAAyB;AAC/B,MAAM,sBAAsB;AAE5B,SAAgB,sBAAsB,eAAuB;CAC3D,MAAM,SAAS,4BAA4B,aAAa;CACxD,IAAI,QACF,OAAO;CAET,MAAM,UAAU,cAAc,MAAM,sBAAsB,CAAC,GAAG;CAC9D,MAAM,OACJ,WACA,OAAO,KAAK,SAAS,QAAQ,CAAC,CAC3B,SAAS,SAAS,CAAC,CACnB,MAAM,mBAAmB,CAAC,GAAG;CAClC,IAAI,CAAC,MACH,MAAM,IAAI,MACR,2DACF;CAEF,MAAM,SAAS,kCAAkC,UAC/C,KAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CACzD;CACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MACR,2DACF;CAEF,OAAO,OAAO;AAChB;AAEA,eAAsB,mBACpB,SAOC;CACD,MAAM,OAAO,kCAAkC;CAC/C,IAAI,QAAQ,cAAc,aAAa,QAAQ,WAAW;EACxD,MAAM,SAAS,4BAA4B,QAAQ,SAAS;EAC5D,IAAI,QAAQ;GACV,IAAI,QAAQ,eAAe,OAAO,YAChC,MAAM,IAAI,MACR,iEACF;GAEF,MAAM,8BAA8B,OAAO,UAAU;EACvD;CACF;CACA,MAAM,UAAU,OAAO,KACrB,KAAK,UAAU,6BAA6B,MAAM,OAAO,CAAC,CAC5D,CAAC,CAAC,SAAS,QAAQ;CACnB,IAAI;CAIJ,MAAM,YAAY,IAAI,SAGlB,YAAY;EACd,SAAS;CACX,CAAC;CACD,MAAM,QAAQ,SACZ,sBAAsB,GACtB,2BAA2B,YAAY,GACvC;EACE,UAAU;EACV,aAAa;EACb,SAAS;EACT,WAAW,OAAO;EAClB,KAAK;GACH,GAAG,4BAA4B,QAAQ,GAAG;GAC1C,uBAAuB;GACvB,8BAA8B,OAAO,MAAM;EAC7C;CACF,IACC,OAAO,WAAW,OAAO;EAAE;EAAO;CAAO,CAAC,CAC7C;CAIA,MAAM,OAAO,GAAG,eAAe,KAAA,CAAS;CACxC,IAAI;CACJ,IAAI;EACF,IAAI,MAAM;GACR,IAAI,CAAC,MAAM,KACT,MAAM,IAAI,MAAM,mDAAmD;GAErE,cAAc,MAAM,kBAAkB,MAAM,MAAM,GAAG;EACvD;EACA,MAAM,OAAO,IAAI,OAAO,cAAc,KAAA,CAAS;EAC/C,MAAM,SAAS,MAAM;EACrB,IAAI,OAAO,OACT,MAAM,OAAO;EAEf,MAAM,SAAS,4BAA4B,UACzC,KAAK,MAAM,OAAO,OAAO,KAAK,CAAC,CACjC;EACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,mDAAmD;EAErE,OAAO,OAAO;CAChB,UAAU;EACR,MAAM,OAAO,QAAQ;EACrB,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,MAAM,KAAK;EAEb,MAAM;EACN,IAAI,aACF,MAAM,YAAY,WAAW;CAEjC;AACF"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "openmeld",
-  "version": "0.3.222",
-  "openMeldReleaseDate": "2026-09-24",
+  "version": "0.3.224",
+  "openMeldReleaseDate": "2026-09-25",
   "description": "OpenMeld CLI - https://openmeld.ai",
   "license": "MIT",
   "type": "module",
@@ -47,34 +47,34 @@
     "typescript": "^5.9.3",
     "unplugin-lightningcss": "^0.4.0",
     "vitest": "~3.2.0",
-    "@openmeld/adapter-antigravity": "0.0.1",
     "@openmeld/adapter-claude-code": "0.0.1",
     "@openmeld/adapter-codex": "0.0.1",
+    "@openmeld/adapter-antigravity": "0.0.1",
     "@openmeld/adapter-core": "0.0.1",
     "@openmeld/adapter-cursor": "0.0.1",
+    "@openmeld/adapter-grok-build": "0.0.1",
     "@openmeld/adapter-openclaw": "0.0.1",
-    "@openmeld/adapter-opencode": "0.0.1",
     "@openmeld/agent-runtime": "0.0.1",
+    "@openmeld/gateway-contract": "0.0.1",
     "@openmeld/api-client": "0.0.1",
+    "@openmeld/adapter-opencode": "0.0.1",
     "@openmeld/local-execution": "0.0.1",
     "@openmeld/local-service": "0.0.1",
-    "@openmeld/gateway-contract": "0.0.1",
     "@openmeld/projects": "0.0.1",
     "@openmeld/routine-schedule": "0.0.1",
-    "@openmeld/protocol": "0.0.1",
     "@openmeld/schemas": "0.0.1",
+    "@openmeld/protocol": "0.0.1",
     "@openmeld/space": "0.0.1",
-    "@openmeld/start": "0.0.1",
     "@openmeld/utils": "0.0.1",
-    "@openmeld/space-mesh": "0.0.1",
-    "@openmeld/adapter-grok-build": "0.0.1"
+    "@openmeld/start": "0.0.1",
+    "@openmeld/space-mesh": "0.0.1"
   },
   "openmeld": {
     "releaseLine": "openmeld-greenfield-2026-07",
-    "minRequiredCliVersion": "0.3.220"
+    "minRequiredCliVersion": "0.3.224"
   },
   "scripts": {
-    "build": "tsdown && node scripts/build-macos-keychain-addon.mjs --copy-npm",
+    "build": "tsdown && node scripts/build-macos-keychain-addon.mjs --copy-npm && node scripts/copy-windows-process-helper.mjs",
     "deploy": "pnpm -C ../.. run release:deploy:local -- --scope cli",
     "verify:npm-artifact": "node ../../scripts/release/npm-cli-artifact.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
@@ -85,5 +85,5 @@
     "test:local-service": "vitest run --config vitest.integration.config.ts tests/local-service-state.integration.test.ts tests/local-service-command.integration.test.ts tests/local-service-menu.integration.test.ts tests/local-service-run.integration.test.ts tests/local-service-bootstrap-recommendation.test.ts",
     "test:watch": "vitest"
   },
-  "gitHead": "7b8741ea2b096a8c36c5245d5d8810a8c568fc89"
+  "gitHead": "a4eaecf87dc1863d21f0ad320e1b1f3151525388"
 }

package/skills/openmeld-cli/playbooks/space-ops.md

@@ -284,8 +284,15 @@ the dispatch prompt for that Space's Publication Mode.
 
 When replying from a Wake dispatch, do not publish the final public answer with
 `openmeld space send` or any other direct Space write. Prefer OpenMeld Space Action
-commands. In this guide, `<DISPATCH_ACTION_CLI>` is a placeholder for the exact
-Space Action command prefix printed in the current Wake dispatch prompt:
+tools when provided: `reply` for answers, limitations, errors, and requests for
+help; `stay_silent` when no public communication is appropriate. These tools do
+not require a shell, repository, or Skill lookup. A rejected input can be
+corrected; an unknown result must be reconciled before resending. Never switch
+transports to bypass a denial, cancellation, or expired authority.
+
+The commands below document the legacy CLI carrier only. `<DISPATCH_ACTION_CLI>`
+is the exact prefix supplied for a CLI-only dispatch, not an alternative to a
+working native tool or a missing-action correction toolset:
 
 The dispatch prompt names the one final action for the current Wake first. Run
 that action before reading optional forms.
@@ -301,7 +308,6 @@ those sources mapped to the current reply instead of mixing requests.
 <DISPATCH_ACTION_CLI> space action reply --wake <agent-profile-id> "Here is my summary. Please continue the review."
 <DISPATCH_ACTION_CLI> space action reply --reference <agent-profile-id> "I used the plan above and finished the implementation."
 <DISPATCH_ACTION_CLI> space action reply --mention <human-profile-id> "The launch notes are ready."
-<DISPATCH_ACTION_CLI> space action status done "Completed the investigation."
 <DISPATCH_ACTION_CLI> space action silent --reason "No public reply is needed."
 <DISPATCH_ACTION_CLI> space action targets
 <DISPATCH_ACTION_CLI> space action help

package/skills/openmeld-cli/references/commands.md

@@ -487,7 +487,6 @@ openmeld space send <space-id> --profile <profile-id> --wake <agent-profile-id>
 <DISPATCH_ACTION_CLI> space action reply --wake <agent-profile-id> "message"
 <DISPATCH_ACTION_CLI> space action reply --reference <agent-profile-id> "message"
 <DISPATCH_ACTION_CLI> space action reply --mention <human-profile-id> "message"
-<DISPATCH_ACTION_CLI> space action status done "short completion update"
 <DISPATCH_ACTION_CLI> space action silent --reason "No public reply is needed."
 <DISPATCH_ACTION_CLI> space action targets
 <DISPATCH_ACTION_CLI> space action help

package/dist/auth-session-D8dbMpaK.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-
-import { u as getAuthSessionMetadata } from "./auth-session-nhS8jyux.js";
-export { getAuthSessionMetadata };