From c11dd22b593358ef7932deec53c8200f5f14ed8b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sat, 5 Sep 2026 14:48:08 +0200 Subject: fix(node): register the service-mode task with Register-ScheduledTask -LogonType S4U schtasks.exe has no flag naming the logon type directly -- it only infers S4U vs Interactive from whether /rp is present, and both readings broke live on a blank-password account: /rp "" fails schtasks' own credential validation, and omitting /rp registers "Interactive only", which never launches the process at boot or on demand despite installing cleanly. Register-ScheduledTask -LogonType S4U names the logon type explicitly, no inference. Confirmed live: install, manual start, and unattended boot-time start all now work. Co-Authored-By: Claude Sonnet 5 --- packaging/win/service.ps1 | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) (limited to 'packaging') diff --git a/packaging/win/service.ps1 b/packaging/win/service.ps1 index 936c060..29a02fe 100644 --- a/packaging/win/service.ps1 +++ b/packaging/win/service.ps1 @@ -10,13 +10,24 @@ any of it. The middle ground, and what this script sets up: a Scheduled Task that runs - AS THIS USER at system boot, without needing them to sign in first. - `schtasks /create ... /ru /rp ""` with no `/it` registers an S4U - (Service For User) logon -- no password stored anywhere, and unlike + AS THIS USER at system boot, without needing them to sign in first -- an + S4U (Service For User) logon: no password stored anywhere, and unlike LocalSystem it loads this account's own profile, so %LOCALAPPDATA%\meshbay\ keeps working with zero changes. The cost: S4U carries no network - credential (no reaching a domain share as this user), which the node never - needed -- everything it touches is local disk plus outbound internet. + credential (no reaching a domain share as this user), which the node + never needed -- everything it touches is local disk plus outbound + internet. + + Install uses Register-ScheduledTask with -LogonType S4U, not + `schtasks /create`: schtasks only infers the logon type from whether /rp + is present, and both readings were tried and broke on this exact machine's + blank-password account (common on a personal PC) -- `/rp ""` fails + credential validation ("the user name or password is incorrect", even + though nothing is wrong), and omitting /rp registers "Interactive only" + instead of S4U, which never runs at boot and doesn't launch anything even + run on demand while signed in (both confirmed live, 2026-09-05). + -LogonType S4U is explicit, no inference. remove/status/run/end have no + such ambiguity and stay on schtasks.exe. Mirrors meshbay_node.platform.service_install/_remove/_status/_run/_end -- same TASK_NAME, same flags -- so the CLI and the installer agree on what @@ -57,8 +68,11 @@ switch ($Action) { "install" { if (-not (Test-Path $node)) { throw "meshbay-node.exe not found at $node" } $user = Get-CurrentUser - & schtasks /create /tn $TASK_NAME /tr "`"$node`"" /sc onstart /ru $user /rp "" /rl limited /f - if ($LASTEXITCODE -ne 0) { throw "schtasks /create failed (exit $LASTEXITCODE)" } + $action = New-ScheduledTaskAction -Execute $node + $trigger = New-ScheduledTaskTrigger -AtStartup + $principal = New-ScheduledTaskPrincipal -UserId $user -LogonType S4U -RunLevel Limited + Register-ScheduledTask -TaskName $TASK_NAME -Action $action -Trigger $trigger ` + -Principal $principal -Force -ErrorAction Stop | Out-Null Write-Host "service: installed ($user, runs at boot)" } "remove" { -- cgit v1.2.3