Function makeWindowsBackend

apps/cli/src/service.ts:810–950

()

  });

const makeWindowsBackend = (): ServiceBackend => {
  const controlDir = (path: Path.Path): string =>
    path.join(resolveExecutorDataDir(path), "server-control");
  const taskXmlPath = (path: Path.Path): string => path.join(controlDir(path), "run-daemon.xml");
  const wrapperCmdPath = (path: Path.Path): string => path.join(controlDir(path), "run-daemon.cmd");
  const launcherVbsPath = (path: Path.Path): string =>
    path.join(controlDir(path), "run-daemon.vbs");

  return {
    platform: "win32",
    automated: true,
    install: (descriptor) =>
      Effect.gen(function* () {
        const fs = yield* FileSystem.FileSystem;
        const path = yield* Path.Path;
        const dataDir = resolveExecutorDataDir(path);
        const logs = serviceLogDir(path);
        const control = path.join(dataDir, "server-control");
        yield* fs.makeDirectory(logs, { recursive: true });
        yield* fs.makeDirectory(control, { recursive: true });

        const wrapperPath = wrapperCmdPath(path);
        yield* fs.writeFileString(
          wrapperPath,
          generateWindowsDaemonWrapper(descriptor, dataDir, logs),
        );

        // Launch the wrapper through a hidden wscript shim so the logon task
        // doesn't flash a console window on the interactive desktop each login.
        const vbsPath = launcherVbsPath(path);
        yield* fs.writeFileString(vbsPath, generateWindowsHiddenLauncherVbs(wrapperPath));

        const xmlPath = taskXmlPath(path);
        yield* writeUtf16File(
          xmlPath,
          generateWindowsTaskXml({
            command: "wscript.exe",
            arguments: `"${vbsPath}"`,
            userId: windowsTaskUserId(),
            boot: descriptor.boot ?? false,
          }),
        );

        const create = yield* runSchtasks([
          "/create",
          "/tn",
          WINDOWS_TASK_NAME,
          "/xml",
          xmlPath,
          "/f",
        ]);
        if (create.code !== 0) {
          // schtasks ends its messages with a period; drop it so the assembled
          // sentence doesn't read "denied.. <hint>".
          const detail = (create.stderr.trim() || create.stdout.trim()).replace(/\.\s*$/, "");
          // The default (logon) task needs no elevation. Only the --boot path
          // registers a boot/S4U task, which Task Scheduler refuses without
          // Administrator — so point access-denial at the relevant fix.