@legioncodeinc/hive 0.6.0 → 0.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -0
- package/dist/service/index.d.ts +7 -0
- package/dist/service/index.js +4 -1
- package/dist/service/index.js.map +1 -1
- package/dist/service/templates.d.ts +16 -2
- package/dist/service/templates.js +22 -7
- package/dist/service/templates.js.map +1 -1
- package/dist/service/windows-identity.d.ts +46 -0
- package/dist/service/windows-identity.js +76 -0
- package/dist/service/windows-identity.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -166,6 +166,11 @@ hive register # append Hive to Doctor's daemon registry
|
|
|
166
166
|
|
|
167
167
|
That's the whole list, on purpose. Day to day you never touch it; the installer wires the service unit and registration, Doctor keeps the process alive, and you live in the browser.
|
|
168
168
|
|
|
169
|
+
Two behaviors worth knowing:
|
|
170
|
+
|
|
171
|
+
- **Hive owns sign-in for the fleet.** When Honeycomb or Nectar detect Hive on the machine, they never open a sign-in of their own; this dashboard's onboarding is the one login surface, and the workload daemons sit degraded until it writes the shared credentials, then recover on their own.
|
|
172
|
+
- **`uninstall` is surgical and honest.** It stops the daemon, removes the service unit (current `com.legioncode.hive` and legacy `thehive` labels), deletes Hive's entry from Doctor's registry without touching anyone else's, and removes `~/.apiary/hive`, nothing more. Already gone? It exits 0 and says so. For a full-machine wipe, see `doctor purge` or the one-command uninstall at [get.theapiary.sh](https://get.theapiary.sh).
|
|
173
|
+
|
|
169
174
|
<img src="assets/brand/divider-minor.svg" width="100%" height="3">
|
|
170
175
|
|
|
171
176
|
## ✨ Open one URL, see the whole hive
|
package/dist/service/index.d.ts
CHANGED
|
@@ -59,6 +59,13 @@ export interface ServiceModuleDeps {
|
|
|
59
59
|
* against the plan's home; tests MUST inject a no-op so a fake `home` never touches real disk.
|
|
60
60
|
*/
|
|
61
61
|
readonly migrateState?: (environment: ServiceEnvironment) => void;
|
|
62
|
+
/**
|
|
63
|
+
* Windows-only seam resolving the SID (or `domain\user` fallback) embedded as the schtasks
|
|
64
|
+
* `LogonTrigger`/`Principal` `UserId` (see `templates.ts` `renderScheduledTaskXml`). Defaults to
|
|
65
|
+
* the real {@link resolveWindowsUserId} (execFile of `whoami.exe`, never a shell); tests MUST
|
|
66
|
+
* inject a fixed value so a run never shells out. Never invoked for launchd/systemd plans.
|
|
67
|
+
*/
|
|
68
|
+
readonly resolveWindowsUserId?: () => Promise<string | null>;
|
|
62
69
|
}
|
|
63
70
|
export declare function createExecFileRunner(): CommandRunner;
|
|
64
71
|
export declare function createNodeServiceFs(): ServiceFs;
|
package/dist/service/index.js
CHANGED
|
@@ -6,6 +6,7 @@ import { migrateHiveState } from "../shared/state-migration.js";
|
|
|
6
6
|
import { installCommands, legacyUninstallCommands, stopCommands, uninstallCommands } from "./commands.js";
|
|
7
7
|
import { legacyUnitPath, LEGACY_WINDOWS_TASK_NAME, resolveServiceContext, resolveServicePlan, WINDOWS_TASK_NAME } from "./platform.js";
|
|
8
8
|
import { renderUnit } from "./templates.js";
|
|
9
|
+
import { resolveWindowsUserId as resolveWindowsUserIdDefault } from "./windows-identity.js";
|
|
9
10
|
const SERVICE_COMMAND_TIMEOUT_MS = 15_000;
|
|
10
11
|
export function createExecFileRunner() {
|
|
11
12
|
return {
|
|
@@ -151,6 +152,7 @@ export function createServiceModule(deps) {
|
|
|
151
152
|
((env) => {
|
|
152
153
|
migrateHiveState({ home: env.home, env: process.env });
|
|
153
154
|
});
|
|
155
|
+
const resolveWindowsUserId = deps.resolveWindowsUserId ?? (() => resolveWindowsUserIdDefault());
|
|
154
156
|
function plan() {
|
|
155
157
|
return resolveServicePlan(environment);
|
|
156
158
|
}
|
|
@@ -209,7 +211,8 @@ export function createServiceModule(deps) {
|
|
|
209
211
|
if (needsUnitFile) {
|
|
210
212
|
try {
|
|
211
213
|
fs.mkdirp(dirname(resolvedPlan.unitPath));
|
|
212
|
-
|
|
214
|
+
const windowsUserId = resolvedPlan.manager === "schtasks" ? await resolveWindowsUserId() : null;
|
|
215
|
+
fs.writeFile(resolvedPlan.unitPath, renderUnit(resolvedPlan, process.env, windowsUserId));
|
|
213
216
|
}
|
|
214
217
|
catch (error) {
|
|
215
218
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EAElB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAGlB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EAElB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAGlB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,IAAI,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAE5F,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA2E1C,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,0BAA0B,CAAC;YAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;wBAC/C,OAAO;oBACT,CAAC;oBAED,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBACrE,OAAO,CAAC;wBACN,EAAE,EAAE,KAAK;wBACT,IAAI,EAAE,SAAS;wBACf,MAAM;wBACN,MAAM;wBACN,MAAM,EAAE,KAAK,CAAC,OAAO;qBACtB,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,MAAM,CAAC,IAAY;YACjB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,SAAS,CAAC,IAAY,EAAE,OAAe;YACrC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,UAAU,CAAC,IAAY;YACrB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,UAAU,CAAC,IAAY;YACrB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAI,OAAsD,CAAC,MAAM,CAAC;QAC9E,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,4BAA4B,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,IAAiB;IACpC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,MAAqB,EACrB,QAAmC;IAMnC,IAAI,YAAY,GAA0B,IAAI,CAAC;IAC/C,IAAI,kBAAkB,GAAyB,IAAI,CAAC;IACpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACxC,YAAY,GAAG,OAAO,CAAC;YACvB,kBAAkB,GAAG,MAAM,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAC5E,CAAC;AAED,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,MAA4B;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,SAAS,GACb,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC;IACzG,OAAO,SAAS,CAAC,MAAM,GAAG,wBAAwB;QAChD,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,KAAK;QACtD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,OAA+B,EAAE,MAA4B;IAC3F,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACtF,MAAM,aAAa,GAAG,mFAAmF,CAAC;IAC1G,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,OAAO,CAAC;YACnC,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAiB;IAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,mBAAmB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,CAAC,GAAuB,EAAQ,EAAE;YACjC,gBAAgB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAEhG,SAAS,IAAI;QACX,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,YAAyB;QAC1D,IAAI,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE;gBACjF,SAAS,EAAE,0BAA0B;aACtC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,wBAAwB,CAAC,EAAE;gBACvF,SAAS,EAAE,0BAA0B;aACtC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,UAAU,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,IAAI,CAAC;gBACH,OAAO,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,IAAI,YAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG;iBACzG,CAAC;YACJ,CAAC;YAED,6EAA6E;YAC7E,YAAY,CAAC,WAAW,CAAC,CAAC;YAE1B,4EAA4E;YAC5E,mFAAmF;YACnF,oFAAoF;YACpF,MAAM,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;gBAChD,IAAI,UAAU,KAAK,EAAE;oBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,iFAAiF;YACnF,CAAC;YAED,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,KAAK,EAAE,IAAI,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC;YAC1F,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBAChG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5F,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,qCAAqC,YAAY,CAAC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG;qBACpI,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,8DAA8D,YAAY,EAAE,OAAO,IAAI,SAAS,IAAI;iBAC9G,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,wBAAwB,WAAW,CAAC,YAAY,CAAC,yEAAyE;aACpI,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,YAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG;iBACrG,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1G,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,6EAA6E;gBAC7E,6EAA6E;gBAC7E,0EAA0E;gBAC1E,2EAA2E;gBAC3E,IAAI,sBAAsB,CAAC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBACrE,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,OAAO,EAAE,qCAAqC,WAAW,CAAC,YAAY,CAAC,IAAI;qBAC5E,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,mCAAmC,YAAY,EAAE,OAAO,IAAI,SAAS,wBAAwB,eAAe,CAAC,kBAAkB,CAAC,GAAG;iBAC7I,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,yBAAyB,WAAW,CAAC,YAAY,CAAC,IAAI;aAChE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS;YACb,IAAI,YAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,aAAa,EAAE,KAAK;oBACpB,OAAO,EAAE,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG;iBAC3G,CAAC;YACJ,CAAC;YAED,uFAAuF;YACvF,qFAAqF;YACrF,iEAAiE;YACjE,MAAM,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/G,IAAI,CAAC;gBACH,IAAI,YAAY,CAAC,QAAQ,KAAK,EAAE;oBAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvE,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;gBAChD,IAAI,UAAU,KAAK,EAAE;oBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,oFAAoF;gBACpF,qFAAqF;gBACrF,qFAAqF;gBACrF,oFAAoF;gBACpF,mFAAmF;gBACnF,iCAAiC;gBACjC,IAAI,sBAAsB,CAAC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBACrE,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,aAAa,EAAE,IAAI;wBACnB,OAAO,EAAE,QAAQ,YAAY,CAAC,OAAO,+CAA+C;qBACrF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,aAAa,EAAE,KAAK;oBACpB,OAAO,EAAE,iDAAiD,YAAY,EAAE,OAAO,IAAI,SAAS,wBAAwB,eAAe,CAAC,kBAAkB,CAAC,GAAG;iBAC3J,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,8BAA8B,WAAW,CAAC,YAAY,CAAC,0CAA0C;aAC3G,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
|
|
@@ -2,6 +2,12 @@ import { type ServicePlan } from "./platform.js";
|
|
|
2
2
|
export declare const HIVE_START_COMMAND: "start";
|
|
3
3
|
export declare const RESTART_SEC: 5;
|
|
4
4
|
export declare const WINDOWS_RESTART_INTERVAL: "PT1M";
|
|
5
|
+
/**
|
|
6
|
+
* The task action runs under `conhost.exe --headless` instead of `node.exe` directly, so the
|
|
7
|
+
* scheduled task never pops a visible console window at logon/run (proven empirically: the
|
|
8
|
+
* identical task ran with Last Result 0 and no window under this wrapper).
|
|
9
|
+
*/
|
|
10
|
+
export declare const WINDOWS_CONHOST_COMMAND: "C:\\Windows\\System32\\conhost.exe";
|
|
5
11
|
/**
|
|
6
12
|
* rr-AC-10 / 010a implementation note: when the root resolved at render time differs from the
|
|
7
13
|
* default `<home>/.apiary` (an `APIARY_HOME` or Linux XDG override is active), the installer must
|
|
@@ -24,6 +30,14 @@ export declare function renderSystemdUnit(plan: ServicePlan, env?: NodeJS.Proces
|
|
|
24
30
|
* root at render time, but the task-started daemon resolves the default root unless the operator
|
|
25
31
|
* sets APIARY_HOME machine-wide (setx / system properties). Recorded in PRD-010a implementation
|
|
26
32
|
* notes; hive's Windows service is per-user InteractiveToken only, so no LocalSystem edge exists.
|
|
33
|
+
*
|
|
34
|
+
* `userId` (a SID or a `domain\user` fallback, resolved by the caller and passed in already
|
|
35
|
+
* escaped-ready) scopes the `LogonTrigger` and `Principal` to a concrete identity. An unscoped
|
|
36
|
+
* logon trigger/principal means "any user's logon", which a hardened Windows 11 25H2 machine
|
|
37
|
+
* (Administrator Protection enabled) refuses to register from a non-elevated shell. `null` renders
|
|
38
|
+
* with no `UserId`, matching prior behavior for machines where no identity could be resolved.
|
|
39
|
+
* `UserId` is placed first inside `<Principal>` and after `<Enabled>` inside `<LogonTrigger>` per
|
|
40
|
+
* the Task Scheduler schema's element ordering.
|
|
27
41
|
*/
|
|
28
|
-
export declare function renderScheduledTaskXml(plan: ServicePlan): string;
|
|
29
|
-
export declare function renderUnit(plan: ServicePlan, env?: NodeJS.ProcessEnv): string;
|
|
42
|
+
export declare function renderScheduledTaskXml(plan: ServicePlan, userId?: string | null): string;
|
|
43
|
+
export declare function renderUnit(plan: ServicePlan, env?: NodeJS.ProcessEnv, windowsUserId?: string | null): string;
|
|
@@ -4,6 +4,12 @@ import { resolveFleetRoot, resolveLaunchdLogPaths } from "../shared/apiary-root.
|
|
|
4
4
|
export const HIVE_START_COMMAND = "start";
|
|
5
5
|
export const RESTART_SEC = 5;
|
|
6
6
|
export const WINDOWS_RESTART_INTERVAL = "PT1M";
|
|
7
|
+
/**
|
|
8
|
+
* The task action runs under `conhost.exe --headless` instead of `node.exe` directly, so the
|
|
9
|
+
* scheduled task never pops a visible console window at logon/run (proven empirically: the
|
|
10
|
+
* identical task ran with Last Result 0 and no window under this wrapper).
|
|
11
|
+
*/
|
|
12
|
+
export const WINDOWS_CONHOST_COMMAND = "C:\\Windows\\System32\\conhost.exe";
|
|
7
13
|
/**
|
|
8
14
|
* rr-AC-10 / 010a implementation note: when the root resolved at render time differs from the
|
|
9
15
|
* default `<home>/.apiary` (an `APIARY_HOME` or Linux XDG override is active), the installer must
|
|
@@ -99,10 +105,19 @@ WantedBy=default.target
|
|
|
99
105
|
* root at render time, but the task-started daemon resolves the default root unless the operator
|
|
100
106
|
* sets APIARY_HOME machine-wide (setx / system properties). Recorded in PRD-010a implementation
|
|
101
107
|
* notes; hive's Windows service is per-user InteractiveToken only, so no LocalSystem edge exists.
|
|
108
|
+
*
|
|
109
|
+
* `userId` (a SID or a `domain\user` fallback, resolved by the caller and passed in already
|
|
110
|
+
* escaped-ready) scopes the `LogonTrigger` and `Principal` to a concrete identity. An unscoped
|
|
111
|
+
* logon trigger/principal means "any user's logon", which a hardened Windows 11 25H2 machine
|
|
112
|
+
* (Administrator Protection enabled) refuses to register from a non-elevated shell. `null` renders
|
|
113
|
+
* with no `UserId`, matching prior behavior for machines where no identity could be resolved.
|
|
114
|
+
* `UserId` is placed first inside `<Principal>` and after `<Enabled>` inside `<LogonTrigger>` per
|
|
115
|
+
* the Task Scheduler schema's element ordering.
|
|
102
116
|
*/
|
|
103
|
-
export function renderScheduledTaskXml(plan) {
|
|
117
|
+
export function renderScheduledTaskXml(plan, userId = null) {
|
|
104
118
|
const node = escapeXml(process.execPath);
|
|
105
119
|
const exec = escapeXml(plan.execPath);
|
|
120
|
+
const userIdBlock = userId === null ? "" : `\n <UserId>${escapeXml(userId)}</UserId>`;
|
|
106
121
|
return `<?xml version="1.0" encoding="UTF-16"?>
|
|
107
122
|
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
|
|
108
123
|
<RegistrationInfo>
|
|
@@ -111,11 +126,11 @@ export function renderScheduledTaskXml(plan) {
|
|
|
111
126
|
</RegistrationInfo>
|
|
112
127
|
<Triggers>
|
|
113
128
|
<LogonTrigger>
|
|
114
|
-
<Enabled>true</Enabled
|
|
129
|
+
<Enabled>true</Enabled>${userIdBlock}
|
|
115
130
|
</LogonTrigger>
|
|
116
131
|
</Triggers>
|
|
117
132
|
<Principals>
|
|
118
|
-
<Principal id="Author"
|
|
133
|
+
<Principal id="Author">${userIdBlock}
|
|
119
134
|
<LogonType>InteractiveToken</LogonType>
|
|
120
135
|
<RunLevel>LeastPrivilege</RunLevel>
|
|
121
136
|
</Principal>
|
|
@@ -137,21 +152,21 @@ export function renderScheduledTaskXml(plan) {
|
|
|
137
152
|
</Settings>
|
|
138
153
|
<Actions Context="Author">
|
|
139
154
|
<Exec>
|
|
140
|
-
<Command>${
|
|
141
|
-
<Arguments
|
|
155
|
+
<Command>${WINDOWS_CONHOST_COMMAND}</Command>
|
|
156
|
+
<Arguments>--headless "${node}" "${exec}" ${HIVE_START_COMMAND}</Arguments>
|
|
142
157
|
</Exec>
|
|
143
158
|
</Actions>
|
|
144
159
|
</Task>
|
|
145
160
|
`;
|
|
146
161
|
}
|
|
147
|
-
export function renderUnit(plan, env = process.env) {
|
|
162
|
+
export function renderUnit(plan, env = process.env, windowsUserId = null) {
|
|
148
163
|
switch (plan.manager) {
|
|
149
164
|
case "launchd":
|
|
150
165
|
return renderLaunchdPlist(plan, env);
|
|
151
166
|
case "systemd":
|
|
152
167
|
return renderSystemdUnit(plan, env);
|
|
153
168
|
case "schtasks":
|
|
154
|
-
return renderScheduledTaskXml(plan);
|
|
169
|
+
return renderScheduledTaskXml(plan, windowsUserId);
|
|
155
170
|
}
|
|
156
171
|
}
|
|
157
172
|
//# sourceMappingURL=templates.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/service/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAU,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/service/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAU,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAe,CAAC;AACxD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oCAA6C,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,GAAsB;IACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,gBAAgB,GACpB,GAAG,KAAK,IAAI;QACV,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;YAGI,SAAS,CAAC,GAAG,CAAC;;CAEzB,CAAC;IACA,OAAO;;;;EAIP,gBAAgB;WACP,KAAK;;;YAGJ,IAAI;YACJ,IAAI;YACJ,kBAAkB;;;;;;;YAOlB,WAAW;;;;WAIZ,UAAU;;WAEV,UAAU;;;CAGpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvF,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACrH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,iBAAiB,CAAC,eAAe,GAAG,EAAE,CAAC,IAAI,CAAC;IACvG,OAAO;;;;;;EAMP,eAAe,aAAa,SAAS;;aAE1B,WAAW;;;;;CAKvB,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB,EAAE,SAAwB,IAAI;IACpF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;IAC3F,OAAO;;;;aAII,SAAS,CAAC,iBAAiB,CAAC;;;;+BAIV,WAAW;;;;6BAIb,WAAW;;;;;;;;;;;;;;;;kBAgBtB,wBAAwB;;;;;;iBAMzB,uBAAuB;+BACT,IAAI,MAAM,IAAI,KAAK,kBAAkB;;;;CAInE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,gBAA+B,IAAI;IAEnC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
/** Matches a Windows SID string such as `S-1-5-21-...-1001`. */
|
|
2
|
+
export declare const WINDOWS_SID_PATTERN: RegExp;
|
|
3
|
+
export interface WhoamiResult {
|
|
4
|
+
readonly ok: boolean;
|
|
5
|
+
readonly stdout: string;
|
|
6
|
+
}
|
|
7
|
+
/** Injectable seam over the `whoami.exe` invocation (hermetic tests mirror production env). */
|
|
8
|
+
export type WhoamiRunner = (executable: string, args: readonly string[]) => Promise<WhoamiResult>;
|
|
9
|
+
/** Injectable seams for Windows identity resolution (hermetic tests mirror production env). */
|
|
10
|
+
export interface WindowsUserIdResolverDeps {
|
|
11
|
+
readonly env?: NodeJS.ProcessEnv;
|
|
12
|
+
readonly runWhoami?: WhoamiRunner;
|
|
13
|
+
}
|
|
14
|
+
/**
|
|
15
|
+
* Resolves `whoami.exe` under `%SystemRoot%\System32` explicitly (never bare `whoami`
|
|
16
|
+
* on PATH), so a git-bash `whoami` shadowing the real binary on some machines can never
|
|
17
|
+
* be picked up instead.
|
|
18
|
+
*/
|
|
19
|
+
export declare function whoamiExecutablePath(env: NodeJS.ProcessEnv): string;
|
|
20
|
+
/** Real `whoami.exe` runner: execFile, never a shell. */
|
|
21
|
+
export declare function createExecFileWhoamiRunner(): WhoamiRunner;
|
|
22
|
+
/**
|
|
23
|
+
* Parses the SID out of `whoami /user /fo csv /nh` output, e.g.
|
|
24
|
+
* `"domain\user","S-1-5-21-...-1001"`. Takes the last non-empty line (defensive
|
|
25
|
+
* against a stray header row) and the last CSV field, strips surrounding quotes,
|
|
26
|
+
* and validates the shape. Returns `null` on anything that does not look like a SID.
|
|
27
|
+
*/
|
|
28
|
+
export declare function parseWhoamiSid(stdout: string): string | null;
|
|
29
|
+
/** `${USERDOMAIN}\${USERNAME}`, or `null` when either is unset/empty. */
|
|
30
|
+
export declare function fallbackWindowsAccount(env: NodeJS.ProcessEnv): string | null;
|
|
31
|
+
/**
|
|
32
|
+
* Resolves the value to embed as the schtasks `LogonTrigger`/`Principal` `UserId`.
|
|
33
|
+
*
|
|
34
|
+
* On a hardened Windows 11 25H2 machine (Administrator Protection enabled), an
|
|
35
|
+
* unscoped `LogonTrigger`/`Principal` (no `UserId`, meaning "any user's logon") is
|
|
36
|
+
* exactly what makes `schtasks /Create` refuse registration from a non-elevated
|
|
37
|
+
* shell with "ERROR: Access is denied." Scoping both elements to a concrete
|
|
38
|
+
* identity is the fix.
|
|
39
|
+
*
|
|
40
|
+
* Resolution order: the current user's SID via `whoami.exe /user /fo csv /nh`
|
|
41
|
+
* (execFile, never a shell); falling back to `${USERDOMAIN}\${USERNAME}` when the
|
|
42
|
+
* SID cannot be determined; falling back to `null` (render with no `UserId`,
|
|
43
|
+
* today's unscoped behavior) when neither is available, so non-hardened machines
|
|
44
|
+
* keep working unchanged.
|
|
45
|
+
*/
|
|
46
|
+
export declare function resolveWindowsUserId(deps?: WindowsUserIdResolverDeps): Promise<string | null>;
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
import { execFile } from "node:child_process";
|
|
2
|
+
import { win32 } from "node:path";
|
|
3
|
+
/** Matches a Windows SID string such as `S-1-5-21-...-1001`. */
|
|
4
|
+
export const WINDOWS_SID_PATTERN = /^S-1-\d+(-\d+)+$/;
|
|
5
|
+
/**
|
|
6
|
+
* Resolves `whoami.exe` under `%SystemRoot%\System32` explicitly (never bare `whoami`
|
|
7
|
+
* on PATH), so a git-bash `whoami` shadowing the real binary on some machines can never
|
|
8
|
+
* be picked up instead.
|
|
9
|
+
*/
|
|
10
|
+
export function whoamiExecutablePath(env) {
|
|
11
|
+
return win32.join(env.SystemRoot ?? "C:\\Windows", "System32", "whoami.exe");
|
|
12
|
+
}
|
|
13
|
+
/** Real `whoami.exe` runner: execFile, never a shell. */
|
|
14
|
+
export function createExecFileWhoamiRunner() {
|
|
15
|
+
return (executable, args) => new Promise((resolve) => {
|
|
16
|
+
execFile(executable, [...args], (error, stdout) => {
|
|
17
|
+
resolve({ ok: error === null, stdout });
|
|
18
|
+
});
|
|
19
|
+
});
|
|
20
|
+
}
|
|
21
|
+
/**
|
|
22
|
+
* Parses the SID out of `whoami /user /fo csv /nh` output, e.g.
|
|
23
|
+
* `"domain\user","S-1-5-21-...-1001"`. Takes the last non-empty line (defensive
|
|
24
|
+
* against a stray header row) and the last CSV field, strips surrounding quotes,
|
|
25
|
+
* and validates the shape. Returns `null` on anything that does not look like a SID.
|
|
26
|
+
*/
|
|
27
|
+
export function parseWhoamiSid(stdout) {
|
|
28
|
+
const line = stdout
|
|
29
|
+
.split(/\r?\n/)
|
|
30
|
+
.map((entry) => entry.trim())
|
|
31
|
+
.filter((entry) => entry !== "")
|
|
32
|
+
.pop();
|
|
33
|
+
if (line === undefined)
|
|
34
|
+
return null;
|
|
35
|
+
const fields = line.split(",");
|
|
36
|
+
const rawLast = fields[fields.length - 1];
|
|
37
|
+
if (rawLast === undefined)
|
|
38
|
+
return null;
|
|
39
|
+
const sid = rawLast.trim().replace(/^"/, "").replace(/"$/, "");
|
|
40
|
+
return WINDOWS_SID_PATTERN.test(sid) ? sid : null;
|
|
41
|
+
}
|
|
42
|
+
/** `${USERDOMAIN}\${USERNAME}`, or `null` when either is unset/empty. */
|
|
43
|
+
export function fallbackWindowsAccount(env) {
|
|
44
|
+
const domain = env.USERDOMAIN;
|
|
45
|
+
const user = env.USERNAME;
|
|
46
|
+
if (domain === undefined || domain === "" || user === undefined || user === "")
|
|
47
|
+
return null;
|
|
48
|
+
return `${domain}\\${user}`;
|
|
49
|
+
}
|
|
50
|
+
/**
|
|
51
|
+
* Resolves the value to embed as the schtasks `LogonTrigger`/`Principal` `UserId`.
|
|
52
|
+
*
|
|
53
|
+
* On a hardened Windows 11 25H2 machine (Administrator Protection enabled), an
|
|
54
|
+
* unscoped `LogonTrigger`/`Principal` (no `UserId`, meaning "any user's logon") is
|
|
55
|
+
* exactly what makes `schtasks /Create` refuse registration from a non-elevated
|
|
56
|
+
* shell with "ERROR: Access is denied." Scoping both elements to a concrete
|
|
57
|
+
* identity is the fix.
|
|
58
|
+
*
|
|
59
|
+
* Resolution order: the current user's SID via `whoami.exe /user /fo csv /nh`
|
|
60
|
+
* (execFile, never a shell); falling back to `${USERDOMAIN}\${USERNAME}` when the
|
|
61
|
+
* SID cannot be determined; falling back to `null` (render with no `UserId`,
|
|
62
|
+
* today's unscoped behavior) when neither is available, so non-hardened machines
|
|
63
|
+
* keep working unchanged.
|
|
64
|
+
*/
|
|
65
|
+
export async function resolveWindowsUserId(deps = {}) {
|
|
66
|
+
const env = deps.env ?? process.env;
|
|
67
|
+
const runWhoami = deps.runWhoami ?? createExecFileWhoamiRunner();
|
|
68
|
+
const result = await runWhoami(whoamiExecutablePath(env), ["/user", "/fo", "csv", "/nh"]);
|
|
69
|
+
if (result.ok) {
|
|
70
|
+
const sid = parseWhoamiSid(result.stdout);
|
|
71
|
+
if (sid !== null)
|
|
72
|
+
return sid;
|
|
73
|
+
}
|
|
74
|
+
return fallbackWindowsAccount(env);
|
|
75
|
+
}
|
|
76
|
+
//# sourceMappingURL=windows-identity.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"windows-identity.js","sourceRoot":"","sources":["../../src/service/windows-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAgBtD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAC1B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChD,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,IAAI,GAAG,MAAM;SAChB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;SAC/B,GAAG,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAkC,EAAE;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;IAC/B,CAAC;IAED,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC"}
|