Windows: install the background service without Administrator (#1211)

* Windows: install the background service without Administrator

The Windows `executor install` / `executor service install` always required
an elevated PowerShell. It registered the daemon as a boot-triggered Scheduled
Task (AtStartup + S4U + RunLevel Highest), and Task Scheduler only lets an
Administrator create that shape. macOS (launchd RunAtLoad) and Linux
(systemd --user) both install per-user with no elevation, so Windows was the
odd one out.

Default to a per-user logon task instead: a LogonTrigger + InteractiveToken
principal at LeastPrivilege, which a standard user may register for themselves.
This matches the launchd/systemd behavior (start at login, unprivileged). The
old boot-before-login behavior is preserved behind an explicit `--boot` flag,
which still needs an Administrator shell and says so.

Register via schtasks.exe rather than the PowerShell *-ScheduledTask cmdlets.
Those cmdlets reach Task Scheduler over CIM/DCOM, whose local-activation check
fails with Access denied (0x80070005) when the compiled binary spawns the
helper on a non-interactive window station; schtasks uses Task Scheduler RPC and
has no such dependency. status/uninstall/restart and the orphaned-listener
cleanup move off CIM too (schtasks query + netstat/taskkill).

A logon task runs in the user's interactive session, so launch the daemon
through a hidden wscript shim to avoid flashing a console window on the desktop
at every login; the shim waits on the wrapper so the task stays Running and
RestartOnFailure is preserved.

Verified on Windows Server 2022 as a standard, non-admin user: `--boot` is
correctly refused, the default install registers a logon task, the daemon comes
up, and /api/health returns 200.

* Windows service: locale-invariant status + guard --boot off-Windows

Address review on non-English Windows:

- status() derived "running" from the schtasks `Status: Running` line, but
  both the label and the word are localized (fr: `État : En cours d'exécution`),
  so it always read as not-running on a non-English install. Detect via the
  locale-invariant SCHED_S_TASK_RUNNING result code (267009 / 0x41301) instead,
  extracted into the pure, tested parseSchtasksRunning().

- parseNetstatListenerPids matched the localized `LISTENING` state word. Identify
  a listener by its wildcard/zero remote endpoint (0.0.0.0:0 / [::]:0) instead;
  TCP and addresses are not localized.

- `--boot` is documented Windows-only but was silently ignored on macOS/Linux.
  Warn when it is passed on a non-Windows platform.

Tests add fr-FR / de-DE fixtures for both parsers. Verified on the Windows guest
against a real running task's schtasks output: the old Status/Running regex
regresses to false under fr-FR rendering while the 267009-based check stays
correct.

---------

Co-authored-by: Rhys Sullivan <rhys@executor.sh>

Author: RhysSullivan

apps/cli/src/main.ts

@@ -2794,6 +2794,16 @@ const servicePortOption = () =>
     .pipe(Options.withDefault(DEFAULT_SERVICE_PORT))
     .pipe(Options.withDescription("Port the supervised daemon binds (loopback only)."));
 
+const serviceBootOption = () =>
+  Options.boolean("boot")
+    .pipe(Options.withDefault(false))
+    .pipe(
+      Options.withDescription(
+        "Windows only: start the daemon at boot before any login (needs an Administrator shell). " +
+          "Default installs a per-user login task that needs no elevation.",
+      ),
+    );
+
 const serviceManagerName = (platform: ReturnType<typeof getServiceBackend>["platform"]): string => {
   switch (platform) {
     case "darwin":
@@ -2807,7 +2817,7 @@ const serviceManagerName = (platform: ReturnType<typeof getServiceBackend>["plat
   }
 };
 
-const installService = (port: number, commandName: string) =>
+const installService = (port: number, commandName: string, boot = false) =>
   Effect.gen(function* () {
     const command = `${cliPrefix} ${commandName}`;
     if (isDevMode) {
@@ -2822,9 +2832,24 @@ const installService = (port: number, commandName: string) =>
     }
 
     const backend = getServiceBackend();
+
+    // `--boot` only means something on Windows (a boot/S4U Scheduled Task). The
+    // launchd/systemd backends silently ignore the descriptor field, so warn
+    // rather than let a macOS/Linux caller believe it took effect.
+    if (boot && backend.platform !== "win32") {
+      console.warn(
+        `Note: --boot is a Windows-only option and has no effect on ${process.platform}; installing the standard login-based service.`,
+      );
+    }
+
     if (!backend.automated) {
       // Unsupported platforms surface their manual steps via the install error.
-      yield* backend.install({ executablePath: process.execPath, port, version: CLI_VERSION });
+      yield* backend.install({
+        executablePath: process.execPath,
+        port,
+        version: CLI_VERSION,
+        boot,
+      });
       return;
     }
 
@@ -2881,7 +2906,7 @@ const installService = (port: number, commandName: string) =>
     // The unit carries no secret: the supervised daemon mints/loads its bearer
     // from auth.json (under EXECUTOR_DATA_DIR) on first boot, and clients read
     // the same file — so reachability is the credential-free /api/health probe.
-    yield* backend.install({ executablePath: process.execPath, port, version: CLI_VERSION });
+    yield* backend.install({ executablePath: process.execPath, port, version: CLI_VERSION, boot });
 
     console.log(`Waiting for Executor to publish its service manifest at ${origin}...`);
     const reachable = yield* waitForReachable({
@@ -2904,16 +2929,21 @@ const installService = (port: number, commandName: string) =>
     }
 
     console.log(`Executor is now running as a background service at ${origin}.`);
-    console.log("It keeps serving after you quit the app and restarts on login.");
+    console.log(
+      boot && backend.platform === "win32"
+        ? "It keeps serving after you quit the app and starts at boot, before login."
+        : "It keeps serving after you quit the app and restarts on login.",
+    );
     console.log(`Open it in your browser, already signed in, with:  ${cliPrefix} web`);
   });
 
 const serviceInstallCommand = Command.make(
   "install",
   {
     port: servicePortOption(),
+    boot: serviceBootOption(),
   },
-  ({ port }) => installService(port, "service install"),
+  ({ port, boot }) => installService(port, "service install", boot),
 ).pipe(
   Command.withDescription("Install and start Executor as an OS-supervised background service"),
 );
@@ -2996,8 +3026,9 @@ const installCommand = Command.make(
   "install",
   {
     port: servicePortOption(),
+    boot: serviceBootOption(),
   },
-  ({ port }) => installService(port, "install"),
+  ({ port, boot }) => installService(port, "install", boot),
 ).pipe(
   Command.withDescription("Install and start Executor as an OS-supervised background service"),
 );

apps/cli/src/service.test.ts

@@ -5,9 +5,11 @@ import {
   generateLaunchdPlist,
   generateSystemdUnit,
   generateWindowsDaemonWrapper,
-  generateWindowsRegisterScript,
-  generateWindowsStopExecutorListenersScript,
+  generateWindowsHiddenLauncherVbs,
+  generateWindowsTaskXml,
   getServiceBackend,
+  parseNetstatListenerPids,
+  parseSchtasksRunning,
 } from "./service";
 
 describe("service unit generation", () => {
@@ -124,28 +126,107 @@ describe("service unit generation", () => {
     expect(`set "PATH=${cmdSetValue('a"&b')}"`).not.toMatch(/"\s*&/);
   });
 
-  it("registers a boot-triggered S4U task (the reboot-survival contract)", () => {
-    const script = generateWindowsRegisterScript({
-      taskName: "ExecutorDaemon",
-      wrapperPath: "C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd",
-      userId: "x",
+  it("defaults to a per-user logon task that needs no elevation", () => {
+    const xml = generateWindowsTaskXml({
+      command: "wscript.exe",
+      arguments: '"C:\\Users\\x\\.executor\\server-control\\run-daemon.vbs"',
+      userId: "HOST\\x",
     });
-    // S4U + AtStartup = run as the user, at boot, no stored password, no logon.
-    expect(script).toContain("-LogonType S4U");
-    expect(script).toContain("New-ScheduledTaskTrigger -AtStartup");
-    expect(script).toContain("-RestartCount 3");
-    expect(script).toContain("Register-ScheduledTask -TaskName 'ExecutorDaemon'");
-    expect(script).toContain("Start-ScheduledTask -TaskName 'ExecutorDaemon'");
-  });
-
-  it("stops orphaned executor.exe listeners without shadowing PowerShell's $PID", () => {
-    const script = generateWindowsStopExecutorListenersScript(4789);
-
-    expect(script).toContain("Get-NetTCPConnection -LocalPort 4789 -State Listen");
-    expect(script).toContain("$listenerPid");
-    expect(script).not.toContain("foreach ($pid");
-    expect(script).toContain("[string]$process.Name -ieq 'executor.exe'");
-    expect(script).toContain('Write-Output ("STOPPED=" + $listenerPid)');
+    // LogonTrigger + InteractiveToken + LeastPrivilege = run as the user at their
+    // own logon, unprivileged. A standard user may register this without admin.
+    expect(xml).toContain("<LogonTrigger><Enabled>true</Enabled><UserId>HOST\\x</UserId>");
+    expect(xml).toContain("<LogonType>InteractiveToken</LogonType>");
+    expect(xml).toContain("<RunLevel>LeastPrivilege</RunLevel>");
+    // The default path must NOT use the admin-only Boot/S4U/Highest knobs.
+    expect(xml).not.toContain("BootTrigger");
+    expect(xml).not.toContain("S4U");
+    expect(xml).not.toContain("HighestAvailable");
+    expect(xml).toContain("<RestartOnFailure><Interval>PT1M</Interval><Count>3</Count>");
+    expect(xml).toContain("<Command>wscript.exe</Command>");
+    expect(xml).toContain("run-daemon.vbs&quot;</Arguments>");
+  });
+
+  it("registers a boot-triggered S4U task under --boot (the reboot-survival contract)", () => {
+    const xml = generateWindowsTaskXml({
+      command: "wscript.exe",
+      arguments: '"C:\\Users\\x\\.executor\\server-control\\run-daemon.vbs"',
+      userId: "HOST\\x",
+      boot: true,
+    });
+    // BootTrigger + S4U + HighestAvailable = run as the user, at boot, no stored
+    // password, no logon. Task Scheduler only lets an elevated shell create this.
+    expect(xml).toContain("<BootTrigger><Enabled>true</Enabled></BootTrigger>");
+    expect(xml).toContain("<LogonType>S4U</LogonType>");
+    expect(xml).toContain("<RunLevel>HighestAvailable</RunLevel>");
+    expect(xml).not.toContain("LogonTrigger");
+    expect(xml).not.toContain("InteractiveToken");
+  });
+
+  it("hides the daemon console via a wait-and-propagate wscript shim", () => {
+    const vbs = generateWindowsHiddenLauncherVbs(
+      "C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd",
+    );
+    // Run(cmd, 0, True): 0 = hidden window, True = wait so the task stays Running
+    // and the wrapper's exit code propagates (preserving RestartOnFailure).
+    expect(vbs).toContain(
+      'sh.Run("""C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd""", 0, True)',
+    );
+    expect(vbs).toContain("WScript.Quit rc");
+  });
+
+  it("parses LISTENING pids for the service port from netstat output", () => {
+    const netstat = [
+      "Active Connections",
+      "  Proto  Local Address          Foreign Address        State           PID",
+      "  TCP    127.0.0.1:4789         0.0.0.0:0              LISTENING       4072",
+      "  TCP    127.0.0.1:4789         127.0.0.1:51000       ESTABLISHED     4072",
+      "  TCP    [::1]:4789             [::]:0                LISTENING       4072",
+      "  TCP    0.0.0.0:445            0.0.0.0:0             LISTENING       4",
+      "  TCP    127.0.0.1:8765         0.0.0.0:0             LISTENING       9999",
+    ].join("\r\n");
+    expect(parseNetstatListenerPids(netstat, 4789)).toEqual([4072]);
+    // A connection in another state on the port must not be treated as a listener.
+    expect(parseNetstatListenerPids(netstat, 445)).toEqual([4]);
+    expect(parseNetstatListenerPids(netstat, 1234)).toEqual([]);
+  });
+
+  it("identifies listeners by wildcard remote, so it survives a localized state column", () => {
+    // German netstat: the state word is "ABHÖREN"/"HERGESTELLT", but addresses and
+    // "TCP" are not localized. Listener detection must not depend on the word.
+    const deNetstat = [
+      "Aktive Verbindungen",
+      "  Proto  Lokale Adresse         Remoteadresse          Status          PID",
+      "  TCP    127.0.0.1:4789         0.0.0.0:0              ABHÖREN         4072",
+      "  TCP    127.0.0.1:4789         127.0.0.1:51000       HERGESTELLT     8000",
+    ].join("\r\n");
+    expect(parseNetstatListenerPids(deNetstat, 4789)).toEqual([4072]);
+  });
+
+  it("detects a running task via the locale-invariant result code, not the Status word", () => {
+    // English verbose LIST output for a running task.
+    const en = [
+      "TaskName:                             \\ExecutorDaemon",
+      "Status:                               Running",
+      "Last Result:                          267009",
+    ].join("\r\n");
+    expect(parseSchtasksRunning(en)).toBe(true);
+
+    // French Windows: both the label and the status word are translated, but the
+    // SCHED_S_TASK_RUNNING code (267009 / 0x41301) is the same.
+    const fr = [
+      "Nom de tâche:                         \\ExecutorDaemon",
+      "État:                                 En cours d'exécution",
+      "Dernier résultat:                     267009",
+    ].join("\r\n");
+    expect(parseSchtasksRunning(fr)).toBe(true);
+
+    // A ready/terminated task (267014 = SCHED_S_TASK_TERMINATED) is not running.
+    const ready = ["Status:                               Ready", "Last Result:    267014"].join(
+      "\r\n",
+    );
+    expect(parseSchtasksRunning(ready)).toBe(false);
+    // Hex form (some builds/locales) is also recognized.
+    expect(parseSchtasksRunning("Last Result: 0x41301")).toBe(true);
   });
 });