@letitbexai_root/lexxit-automation-framework 1.0.3 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letitbexai_root/lexxit-automation-framework",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Playwright test execution framework with Express API for test execution and reporting.",
   "publishConfig": {
     "access": "public"

package/scripts/deploy/windows/install-lexxit-agent.ps1

@@ -243,8 +243,36 @@ $msiArgs = @(
     "SERVER_REGISTER_AS_SERVICE=1",
     "SERVER_ADD_FIREWALL_EXCEPTION=1",
     "SET_USEVNCAUTHENTICATION=1", "VALUE_OF_USEVNCAUTHENTICATION=1",
+    # VALUE_OF_PASSWORD on an msiexec command line is readable in plaintext
+    # by any other local user/process on this VM for the few seconds this
+    # install runs (Task Manager's "Command line" column, Get-CimInstance
+    # Win32_Process, etc.) - TightVNC's MSI has no encrypted/file-based way
+    # to set this property, only this one. Accepted deliberately: the
+    # password is random and single-use per VM (generated fresh per install
+    # token, encrypted at rest in Mongo), the exposure window is brief, and
+    # exploiting it needs local access to this exact VM during that window -
+    # not a remote or persistent risk. A real fix exists (write TightVNC's
+    # registry password directly using its fixed-key DES obfuscation,
+    # bypassing this property entirely) but was deliberately not done here:
+    # hand-rolling that obfuscation wrong fails silently into the exact same
+    # "VNC authentication failed" this script already had to debug once.
     "SET_PASSWORD=1", "VALUE_OF_PASSWORD=$VncPassword",
-    "SET_ALLOWLOOPBACK=1", "VALUE_OF_ALLOWLOOPBACK=1"
+    "SET_ALLOWLOOPBACK=1", "VALUE_OF_ALLOWLOOPBACK=1",
+    # Without these, `msiexec /i` on a TightVNC that is ALREADY installed at
+    # the same product version silently no-ops instead of reapplying
+    # properties - VALUE_OF_PASSWORD included. That left a real VM with
+    # TightVNC still on an old password after this script re-ran (e.g. after
+    # someone changed it by hand via TightVNC's own config UI in between),
+    # while the backend had already stored the new one from this run's
+    # install token, causing the live-view proxy's VNC auth to fail with no
+    # indication why. REINSTALL=ALL + REINSTALLMODE=vomus forces msiexec to
+    # treat this as a genuine reinstall - v: run from source, o: reinstall
+    # if older/missing, m/u: rewrite machine+user registry (where TightVNC's
+    # password actually lives), s: rewrite shortcuts - so the password (and
+    # every other property above) is guaranteed to re-apply every single
+    # time this script runs, install or reinstall alike. Confirmed the hard
+    # way: a real VM's live view broke from exactly this gap.
+    "REINSTALL=ALL", "REINSTALLMODE=vomus"
 )
 Start-Process msiexec.exe -ArgumentList $msiArgs -Wait -NoNewWindow
 # TightVNC's "service mode" specifically captures the active CONSOLE