NodePilot 1.2.25

Four defects from running the Engine Switcher against a real System Center Orchestrator installation, and from installing NodePilot with the GUI setup rather than the deployment scripts. Two of them ended a switch that had already started services.

Fixed

A stalled SCOrch reconciliation no longer terminates the Engine Switcher. The switch ran the workload reconciliation under its own deadline. When that deadline expired, the resulting cancellation passed straight through the coordinator — whose error handling excluded every OperationCanceledException — and then out of an async void command handler, which had no handler at all:

Description: The process was terminated due to an unhandled exception.
Exception Info: System.Threading.Tasks.TaskCanceledException: A task was canceled.
   at ScorchRunbookReconciler.ReconcileAsync(...)
   at SwitchCoordinator.SwitchAsync(...)
   at AsyncCommand.Execute(Object parameter)

The window disappeared: no dialog, no fail-closed cleanup, and the target services left running — so the next start reported the other engine as active. The exclusion was guarding against something that could not happen, because the coordinator is invoked with CancellationToken.None and the only cancellation was its own deadline.

A deadline is now reported like any other failure and names the runbooks or jobs that did not settle, the cleanup runs, and nothing escaping a command can take the process down. A caller's own cancellation still propagates.

A listed SCOrch runbook that finishes quickly no longer blocks the switch. Verification required every listed runbook to be running at the same moment. Only a long-lived monitor runbook can satisfy that; an ordinary runbook completed within seconds, left the active job set, and was counted as missing until the deadline expired — which is what reached the crash above.

A runbook now settles once its job is running, or once the job this switch started has finished. Unlisted jobs are rejected exactly as before.

The server installer fills in the Engine Switcher's server URL. Switching to NodePilot failed with No server URL configured. Run 'np config set server <URL>' or pass --server. because serverUrl shipped empty and np fell back to its own configuration — which is per-user and DPAPI-protected, so the account that ran setup is not the account that runs the switcher.

The installer writes the hostname and HTTPS port it just configured into the configuration next to the executable, and the switcher passes --server on every call. A machine-wide configuration under %ProgramData%\NodePilot\EngineSwitcher still wins at load time and is left untouched.

The GUI server setup puts np on the machine PATH again. np.exe sat in <install>\tools\np, np in a console reported "not found", and the installation had reported success.

Setup runs Install-NodePilot.ps1 from its own payload, and that payload was missing MachinePath.ps1 — the helper the PATH block loads. Because the block is wrapped in try/catch, the failure degraded to a warning nobody reads. Installations driven by the deployment-scripts zip carry the helper in their own list and were never affected, which is why only double-clicked setups were.

The payload carries it now. Install and update also read the machine PATH back after writing it, and the installer states the outcome in its closing summary — including that an already-open console keeps the environment it started with, so np needs a new one.

Existing installations do not need a repair beyond installing this version, but an already-open console still will not see the entry.

Verifying this download

Every file below is listed in NodePilot-1.2.25.SHA256SUMS.txt, the publisher certificate included.

Get-FileHash .\NodePilot-1.2.25.zip -Algorithm SHA256

The installers and the standalone switcher are Authenticode-signed with the NodePilot release certificate:

Subject     CN=NodePilot Release Signing
Thumbprint  277EAB317A581C88302CE92BE805938C86B4650D

Compare that thumbprint against nodepilot-release-signing.cer, attached here:

(Get-PfxCertificate .\nodepilot-release-signing.cer).Thumbprint
$sig = Get-AuthenticodeSignature .\NodePilot-Server-Setup-1.2.25.exe
$sig.SignerCertificate.Subject
$sig.SignerCertificate.Thumbprint

Get-AuthenticodeSignature reports Status: UnknownError, and that is the expected result — the certificate is self-signed, so its root is in nobody's trust store and no chain can be built. What carries the meaning is the pair above: the signer's subject, and a thumbprint equal to the certificate shipped alongside. The checksum file proves the download is intact; the thumbprint is what proves who built it.

SmartScreen

Windows SmartScreen warns on first run of a downloaded installer — "Windows protected your PC". That is expected and unrelated to the signature: the release certificate is self-signed and carries no reputation, so signing does not silence it. Choose More info → Run anyway. SmartScreen ignores antivirus exclusion lists entirely; see the deployment guide for the full explanation.