vignette/scripts/install-public-runtime-task.ps1

param(
  [Parameter(Mandatory = $true)]
  [string]$StableSourceRoot,
  [string]$TaskName = "VignettePublicRuntimeWatchdog",
  [int]$IntervalMinutes = 5,
  [string[]]$AdditionalPublicHealthUrls = @(),
  [switch]$SkipPublicHealth,
  [switch]$SkipCloudflaredRestart,
  [switch]$RunNow
)

$ErrorActionPreference = "Stop"

if ($IntervalMinutes -lt 1) {
  throw "IntervalMinutes must be 1 or greater"
}

$resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
$installerScript = Join-Path $resolvedSourceRoot "scripts\install-public-runtime-task.ps1"
$watchScript = Join-Path $resolvedSourceRoot "scripts\watch-public-runtime.ps1"
$startScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
$voiceSidecarProbe = Join-Path $resolvedSourceRoot "scripts\probe-public-voice-sidecars.py"

function Invoke-GitText {
  param([string[]]$Arguments)

  $value = & git.exe -C $resolvedSourceRoot @Arguments
  if ($LASTEXITCODE -ne 0) {
    throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
  }
  return (@($value) -join [Environment]::NewLine).Trim()
}

foreach ($requiredScript in @($installerScript, $watchScript, $startScript, $voiceSidecarProbe)) {
  if (!(Test-Path -LiteralPath $requiredScript -PathType Leaf)) {
    throw "Public runtime script not found at $requiredScript"
  }
}

$runningInstaller = (Resolve-Path -LiteralPath $PSCommandPath).Path
if (-not [string]::Equals(
    $runningInstaller,
    (Resolve-Path -LiteralPath $installerScript).Path,
    [System.StringComparison]::OrdinalIgnoreCase
)) {
  throw "Watchdog installer is not executing from the pinned stable source root"
}

$gitRoot = Invoke-GitText -Arguments @("rev-parse", "--show-toplevel")
$resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
if (-not [string]::Equals(
    $resolvedGitRoot,
    $resolvedSourceRoot,
    [System.StringComparison]::OrdinalIgnoreCase
)) {
  throw "Stable source root does not match its Git toplevel"
}

$symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
$symbolicHeadExit = $LASTEXITCODE
if ($symbolicHeadExit -eq 0) {
  throw "Stable source must be a detached HEAD, not branch $symbolicHead"
}
if ($symbolicHeadExit -ne 1) {
  throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
}

$dirty = Invoke-GitText -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
if ($dirty) {
  throw "Stable source is not clean; refusing watchdog installation"
}
foreach ($relativePath in @(
    "scripts/install-public-runtime-task.ps1",
    "scripts/watch-public-runtime.ps1",
    "scripts/start-public-runtime.ps1",
    "scripts/probe-public-voice-sidecars.py"
)) {
  Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
}

$sourceCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
$sourceTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
$watchdogSha256 = (Get-FileHash -LiteralPath $watchScript -Algorithm SHA256).Hash.ToLowerInvariant()
$startScriptSha256 = (Get-FileHash -LiteralPath $startScript -Algorithm SHA256).Hash.ToLowerInvariant()

$powershell = (Get-Command powershell.exe).Source
$userId = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name

$actionArguments = @(
  "-NoProfile",
  "-ExecutionPolicy Bypass",
  "-File `"$watchScript`"",
  "-StableSourceRoot `"$resolvedSourceRoot`"",
  "-ExpectedSourceCommit $sourceCommit",
  "-ExpectedSourceTree $sourceTree",
  "-ExpectedWatchdogSha256 $watchdogSha256",
  "-ExpectedStartScriptSha256 $startScriptSha256"
)
if ($SkipPublicHealth) {
  $actionArguments += "-SkipPublicHealth"
}
if ($SkipCloudflaredRestart) {
  $actionArguments += "-SkipCloudflaredRestart"
}
if ($AdditionalPublicHealthUrls.Count -gt 0) {
  $escapedUrls = $AdditionalPublicHealthUrls | ForEach-Object { "`"$_`"" }
  $actionArguments += "-AdditionalPublicHealthUrls $($escapedUrls -join ',')"
}

$action = New-ScheduledTaskAction `
  -Execute $powershell `
  -Argument ($actionArguments -join " ") `
  -WorkingDirectory $resolvedSourceRoot

$logonTrigger = New-ScheduledTaskTrigger -AtLogOn -User $userId
$repeatTrigger = New-ScheduledTaskTrigger `
  -Once `
  -At (Get-Date).AddMinutes(1) `
  -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes)

$settings = New-ScheduledTaskSettingsSet `
  -AllowStartIfOnBatteries `
  -DontStopIfGoingOnBatteries `
  -ExecutionTimeLimit (New-TimeSpan -Minutes 10) `
  -MultipleInstances IgnoreNew `
  -RestartCount 3 `
  -RestartInterval (New-TimeSpan -Minutes 1) `
  -StartWhenAvailable `
  -WakeToRun

$principal = New-ScheduledTaskPrincipal `
  -UserId $userId `
  -LogonType Interactive `
  -RunLevel Limited

$description = "Runs Vignette public runtime watchdog as $userId from detached clean commit $sourceCommit. Secrets stay in the user profile and apps/api/.env; the task command stores no secrets."
$task = New-ScheduledTask `
  -Action $action `
  -Trigger @($logonTrigger, $repeatTrigger) `
  -Settings $settings `
  -Principal $principal `
  -Description $description

Register-ScheduledTask -TaskName $TaskName -InputObject $task -Force | Out-Null

Write-Output "Installed scheduled task '$TaskName' for $userId"
Write-Output "Action: $powershell $($actionArguments -join ' ')"
Write-Output "Pinned source: root=$resolvedSourceRoot commit=$sourceCommit tree=$sourceTree"
Write-Output "Pinned scripts: watchdog_sha256=$watchdogSha256 start_sha256=$startScriptSha256"
Write-Output "Interval: every $IntervalMinutes minute(s), plus at user logon"
if ($AdditionalPublicHealthUrls.Count -gt 0) {
  Write-Output "Additional public health URLs: $($AdditionalPublicHealthUrls -join ', ')"
}

if ($RunNow) {
  Start-ScheduledTask -TaskName $TaskName
  Write-Output "Started scheduled task '$TaskName'"
}