Fix Windows task and certificate collector reliability

powershell/Inventory.Common.ps1

@@ -13,6 +13,13 @@ function Add-SamsaraError {
         'command_unavailable' { 'Required local inventory command is unavailable.' }
         default { 'Local query could not complete; raw diagnostics are excluded.' }
     }
+    if ($script:SamsaraDiagnostic) {
+        # Fixed stages only; never include messages, identifiers, targets or stacks.
+        $type = $Record.Exception.GetType().Name
+        if ($type -notmatch '^[A-Za-z0-9]+Exception$') { $type = 'Exception' }
+        $category = [string]$Record.CategoryInfo.Category
+        $message += ' Exception type: ' + $type + '; category: ' + $category + '.'
+    }
     $Result.errors += [pscustomobject]@{ code = $code; scope = $Scope; message = $message }
     if ($code -eq 'access_denied') { $Result.permission_limitations += $Scope + ': read access denied.' }
 }
@@ -21,15 +28,28 @@ function Invoke-SamsaraRead {
     param($Result, [string]$Scope, [scriptblock]$Query)
     $Result.attempted_subchecks++
     try {
+        $ErrorActionPreference = 'Stop'
         & $Query
         $Result.successful_subchecks++
     } catch { Add-SamsaraError $Result $_ $Scope }
 }
 
+function ConvertTo-SamsaraJson {
+    param($Value, [int]$Depth = 14)
+    try { ConvertTo-Json -InputObject $Value -Depth $Depth -Compress -ErrorAction Stop }
+    catch {
+        # A serialization failure must not emit a complete empty inventory.
+        [Console]::Error.WriteLine('Inventory JSON serialization failed; raw diagnostics are excluded.')
+        exit 3
+    }
+}
+
 function Get-SamsaraSafeExecutable {
     param([string]$Value)
     # Task action arguments, scripts and environment values are deliberately omitted.
-    $name = [IO.Path]::GetFileName(($Value -replace '\\', '/'))
+    # Scheduler action values need not be valid filesystem paths. Path.GetFileName
+    # throws on malformed/quoted values in .NET Framework (PowerShell 5.1).
+    $name = (($Value -replace '\\', '/') -split '/')[-1]
     if ($name -match '^[A-Za-z0-9_. -]+\.(exe|com|cmd|bat|ps1|vbs|js|wsf|msc)$') { return $name }
     return '[executable name omitted]'
 }