@letitbexai_root/lexxit-automation-framework 1.0.2 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letitbexai_root/lexxit-automation-framework",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Playwright test execution framework with Express API for test execution and reporting.",
   "publishConfig": {
     "access": "public"

package/scripts/deploy/windows/install-lexxit-agent.ps1

@@ -57,7 +57,7 @@ param(
     [string] $RunnerUsername = "lexxit-runner",
     [string] $RunnerPassword = "",                       # generated below if blank
     [string] $Resolution = "1920x1080",
-    [string] $AgentPackage = "lexxit-automation-framework",
+    [string] $AgentPackage = "@letitbexai_root/lexxit-automation-framework",
     # "latest" is a placeholder, not a recommendation - pin a real version
     # once one has been published including healthProbes.ts's
     # os/browsers/vnc_ready/session_state fields (the plan's section 1.6
@@ -243,8 +243,36 @@ $msiArgs = @(
     "SERVER_REGISTER_AS_SERVICE=1",
     "SERVER_ADD_FIREWALL_EXCEPTION=1",
     "SET_USEVNCAUTHENTICATION=1", "VALUE_OF_USEVNCAUTHENTICATION=1",
+    # VALUE_OF_PASSWORD on an msiexec command line is readable in plaintext
+    # by any other local user/process on this VM for the few seconds this
+    # install runs (Task Manager's "Command line" column, Get-CimInstance
+    # Win32_Process, etc.) - TightVNC's MSI has no encrypted/file-based way
+    # to set this property, only this one. Accepted deliberately: the
+    # password is random and single-use per VM (generated fresh per install
+    # token, encrypted at rest in Mongo), the exposure window is brief, and
+    # exploiting it needs local access to this exact VM during that window -
+    # not a remote or persistent risk. A real fix exists (write TightVNC's
+    # registry password directly using its fixed-key DES obfuscation,
+    # bypassing this property entirely) but was deliberately not done here:
+    # hand-rolling that obfuscation wrong fails silently into the exact same
+    # "VNC authentication failed" this script already had to debug once.
     "SET_PASSWORD=1", "VALUE_OF_PASSWORD=$VncPassword",
-    "SET_ALLOWLOOPBACK=1", "VALUE_OF_ALLOWLOOPBACK=1"
+    "SET_ALLOWLOOPBACK=1", "VALUE_OF_ALLOWLOOPBACK=1",
+    # Without these, `msiexec /i` on a TightVNC that is ALREADY installed at
+    # the same product version silently no-ops instead of reapplying
+    # properties - VALUE_OF_PASSWORD included. That left a real VM with
+    # TightVNC still on an old password after this script re-ran (e.g. after
+    # someone changed it by hand via TightVNC's own config UI in between),
+    # while the backend had already stored the new one from this run's
+    # install token, causing the live-view proxy's VNC auth to fail with no
+    # indication why. REINSTALL=ALL + REINSTALLMODE=vomus forces msiexec to
+    # treat this as a genuine reinstall - v: run from source, o: reinstall
+    # if older/missing, m/u: rewrite machine+user registry (where TightVNC's
+    # password actually lives), s: rewrite shortcuts - so the password (and
+    # every other property above) is guaranteed to re-apply every single
+    # time this script runs, install or reinstall alike. Confirmed the hard
+    # way: a real VM's live view broke from exactly this gap.
+    "REINSTALL=ALL", "REINSTALLMODE=vomus"
 )
 Start-Process msiexec.exe -ArgumentList $msiArgs -Wait -NoNewWindow
 # TightVNC's "service mode" specifically captures the active CONSOLE
@@ -272,6 +300,19 @@ if (-not $node) {
                 [System.Environment]::GetEnvironmentVariable("Path", "User")
 }
 
+# Playwright's default browser cache is per-Windows-user (%LOCALAPPDATA%\
+# ms-playwright), but whoever runs THIS install (an Administrator, or SYSTEM
+# over SSM) is never the same Windows account that later runs the agent
+# (lexxit-runner, via the Scheduled Task below) - so a browser downloaded
+# under the installer's own profile is invisible to the running agent,
+# which reports it as missing (/api/health's browsers.chromium: false) even
+# though it is genuinely installed, just under the wrong profile. Pointing
+# both the install-time download and the launcher's runtime env (below) at
+# the same fixed, non-per-user path makes this independent of who installs.
+# Confirmed the hard way on a real Windows EC2 AMI.
+$browsersPath = Join-Path $AgentInstallDir ".playwright-browsers"
+$env:PLAYWRIGHT_BROWSERS_PATH = $browsersPath
+
 Write-Host "[lexxit] Installing $AgentPackage@$AgentVersion into $AgentInstallDir..."
 if (-not (Test-Path $AgentInstallDir)) { New-Item -ItemType Directory -Path $AgentInstallDir -Force | Out-Null }
 Push-Location $AgentInstallDir
@@ -299,6 +340,7 @@ $launcherContent = @"
 `$env:PORT = '$AgentPort'
 `$env:VNC_READY_MARKER = '$vncReadyMarker'
 `$env:SESSION_PROBE_SCRIPT = '$probeScript'
+`$env:PLAYWRIGHT_BROWSERS_PATH = '$browsersPath'
 New-Item -ItemType File -Path `$env:VNC_READY_MARKER -Force | Out-Null
 node "$agentEntry"
 "@