@letitbexai_root/lexxit-automation-framework 1.0.3 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letitbexai_root/lexxit-automation-framework",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Playwright test execution framework with Express API for test execution and reporting.",
   "publishConfig": {
     "access": "public"

package/scripts/deploy/windows/install-lexxit-agent.ps1

@@ -237,14 +237,57 @@ New-NetFirewallRule -DisplayName "Lexxit Agent" -Direction Inbound -Protocol TCP
 Write-Host "[lexxit] Installing TightVNC..."
 $tvncMsi = Join-Path $env:TEMP "tightvnc.msi"
 Invoke-WebRequest -Uri $TightVncMsiUrl -OutFile $tvncMsi -UseBasicParsing
+
+# Confirmed on a real Windows EC2 AMI: REINSTALL=ALL + REINSTALLMODE=vomus
+# (tried first, see git history) does NOT reliably make TightVNC's MSI
+# reapply VALUE_OF_PASSWORD on top of an already-installed copy - verified
+# by decrypting the backend's actual stored password for a freshly
+# re-registered agent and running it through the real VNC auth handshake
+# directly: still rejected, even with REINSTALLMODE=vomus on the reinstall
+# that supposedly set it. TightVNC's password-setting custom action
+# evidently gates on something REINSTALLMODE doesn't override. An explicit
+# uninstall first removes that "already installed" state entirely, so the
+# following /i is always a genuine fresh install, which does apply every
+# property correctly. /x against the same MSI package is a no-op (not an
+# error) when TightVNC isn't installed yet, so this is safe on every run.
+Start-Process msiexec.exe -ArgumentList @("/x", "`"$tvncMsi`"", "/quiet", "/norestart") -Wait -NoNewWindow
+
 $msiArgs = @(
     "/i", "`"$tvncMsi`"", "/quiet", "/norestart",
     "ADDLOCAL=Server",
     "SERVER_REGISTER_AS_SERVICE=1",
     "SERVER_ADD_FIREWALL_EXCEPTION=1",
     "SET_USEVNCAUTHENTICATION=1", "VALUE_OF_USEVNCAUTHENTICATION=1",
+    # VALUE_OF_PASSWORD on an msiexec command line is readable in plaintext
+    # by any other local user/process on this VM for the few seconds this
+    # install runs (Task Manager's "Command line" column, Get-CimInstance
+    # Win32_Process, etc.) - TightVNC's MSI has no encrypted/file-based way
+    # to set this property, only this one. Accepted deliberately: the
+    # password is random and single-use per VM (generated fresh per install
+    # token, encrypted at rest in Mongo), the exposure window is brief, and
+    # exploiting it needs local access to this exact VM during that window -
+    # not a remote or persistent risk. A real fix exists (write TightVNC's
+    # registry password directly using its fixed-key DES obfuscation,
+    # bypassing this property entirely) but was deliberately not done here:
+    # hand-rolling that obfuscation wrong fails silently into the exact same
+    # "VNC authentication failed" this script already had to debug once.
     "SET_PASSWORD=1", "VALUE_OF_PASSWORD=$VncPassword",
-    "SET_ALLOWLOOPBACK=1", "VALUE_OF_ALLOWLOOPBACK=1"
+    "SET_ALLOWLOOPBACK=1", "VALUE_OF_ALLOWLOOPBACK=1",
+    # Without these, `msiexec /i` on a TightVNC that is ALREADY installed at
+    # the same product version silently no-ops instead of reapplying
+    # properties - VALUE_OF_PASSWORD included. That left a real VM with
+    # TightVNC still on an old password after this script re-ran (e.g. after
+    # someone changed it by hand via TightVNC's own config UI in between),
+    # while the backend had already stored the new one from this run's
+    # install token, causing the live-view proxy's VNC auth to fail with no
+    # indication why. REINSTALL=ALL + REINSTALLMODE=vomus forces msiexec to
+    # treat this as a genuine reinstall - v: run from source, o: reinstall
+    # if older/missing, m/u: rewrite machine+user registry (where TightVNC's
+    # password actually lives), s: rewrite shortcuts - so the password (and
+    # every other property above) is guaranteed to re-apply every single
+    # time this script runs, install or reinstall alike. Confirmed the hard
+    # way: a real VM's live view broke from exactly this gap.
+    "REINSTALL=ALL", "REINSTALLMODE=vomus"
 )
 Start-Process msiexec.exe -ArgumentList $msiArgs -Wait -NoNewWindow
 # TightVNC's "service mode" specifically captures the active CONSOLE