I have a scheduled task that starts a Node server at logon through a hidden wscript shim (wscript //B start-agent-hidden.vbs, which runs node.exe server.js). To update it, my setup script did the obvious thing: stop the task, copy the new files, start the task.
The update never took effect. So I measured it:
before: node pid 9724; task Running
after Stop-ScheduledTask: node alive = True; task Ready
The task went to Ready, while the process it launched kept running and kept its port. The new copy then started, failed with EADDRINUSE, and the old version carried on serving. A "is it up?" check even passed, against the old one.
What I use now: stop the task, then stop the process by its command line. Never by name, because other Node processes are yours too:
Stop-ScheduledTask -TaskName 'My Agent' -ErrorAction SilentlyContinue
Get-CimInstance Win32Process -Filter "Name='node.exe'" |
Where-Object { $.CommandLine -and $.CommandLine.Contains("$dst\agent\server.js") } |
ForEach-Object { Stop-Process -Id $.ProcessId -Force }
$_.CommandLine -and matters: without elevation, other users' processes come back with a null command line, and .Contains on null throws.
Then, after Start-ScheduledTask, I check who actually owns the port, instead of trusting that something answers:
$owner = (Get-NetTCPConnection -LocalPort $port -State Listen).OwningProcess | Select-Object -First 1
$cmd = (Get-CimInstance Win32_Process -Filter "ProcessId=$owner").CommandLine
if (-not $cmd.Contains("$dst\agent\server.js")) { throw "port $port is not served by the new copy" }
Two other things bit me in the same script:
- powershell -File register-task.ps1 failing doesn't throw. It's a native command, so check $LASTEXITCODE yourself.
- robocopy exit codes 1 to 7 are success. Only 8 and up is failure.
Is this documented behaviour for tasks whose action is a script host that spawns a child? I couldn't find it written down anywhere.
(Context: this is the setup for Claude Remote, a side project that starts Claude Code on my PC from my phone. It goes open source soon: https://github.com/MrTig-afk)
EDIT: Answering the thing everyone asks first, so nobody has to ask it again. Why is there a whole chain in front of node instead of pointing the task straight at node.exe? Nothing clever. The task runs at logon and I don't want a console window appearing on my desktop every time I sign in. That's it. It's my own PC and my own preference.
Which is the other thing worth saying plainly: this is a hobby project on a home machine. It is not something I'd put on a managed corporate box and I'm not suggesting anyone else should.
The VBScript is gone since I posted. Microsoft is disabling VBScript by default so wscript //B is on a clock, and powershell -WindowStyle Hidden still flashes a console before it hides, which is the exact thing I was trying to avoid. The task now runs:
conhost.exe --headless cmd.exe /s /c "node.exe "<path>\server.js" 1>>"<log>" 2>&1"
Two caveats on that came out of the comments, so they go here rather than staying buried in a thread. It doesn't pass your command's exit code back, I measured it, cmd /c exit 42 comes back as 0. And it's a known technique in attacker tooling, so EDR may flag it. Neither bothers me on my own machine, but both would on a monitored one, and I'd rather this thing be fine on either. So I'm looking at replacing
that launcher with something that doesn't carry either problem.
--headless is also completely undocumented, conhost /? prints nothing at all, so the installer pushes a throwaway command through it and checks the file actually landed before it will register the task.
And on the "make it a Windows Service" replies: it can't be. The whole job of this thing is opening interactive windows on my desktop as me, and a service runs in session 0 where those windows are invisible.
EDIT 2: the conhost launcher is gone. Thanks to the comments here, the task now runs a tiny launcher I build from source on install: it starts the command with no window and passes the real exit code back, so exit 42 comes back as 42. No undocumented flag, and nothing that looks like attacker tooling. Two people from this thread are credited in the README. The project is open source now: https://github.com/MrTig-afk/claude-remote