@myassis/gateway 1.0.39 → 1.0.41

package/dist/services/ServiceManager.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startService = exports.uninstallService = exports.installService = exports.getServiceInfo = exports.SERVICE_DISPLAY_NAME = exports.SERVICE_NAME = void 0;
+exports.execAsUser = exports.isHelperReady = exports.stopHelper = exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startService = exports.uninstallService = exports.installService = exports.getServiceInfo = exports.SERVICE_DISPLAY_NAME = exports.SERVICE_NAME = void 0;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const path_1 = __importDefault(require("path"));
@@ -11,6 +11,7 @@ const fs_1 = __importDefault(require("fs"));
 const axios_1 = __importDefault(require("axios"));
 const shared_1 = require("@myassis/shared");
 const os_1 = __importDefault(require("os"));
+const net_1 = __importDefault(require("net"));
 const logger = (0, shared_1.getLogger)('ServiceManager');
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 exports.SERVICE_NAME = 'myassis-gateway';
@@ -549,3 +550,299 @@ async function updateService() {
     }
 }
 exports.updateService = updateService;
+// ═══════════════════════════════════════════════════════════
+// 用户态 Helper 进程管理 — Windows 专用
+// 目标：在当前登录用户的桌面会话中以该用户身份执行命令
+// 架构：
+//   Service (SYSTEM)  ──TCP/IPC──>  Helper (当前登录用户)
+// ═══════════════════════════════════════════════════════════
+/** IPC 端口号（Service <-> Helper 通信） */
+const HELPER_PORT = 19630;
+/** Helper 超时时间（毫秒） */
+const HELPER_TIMEOUT_MS = 60000;
+/** 当前活跃的 Helper 进程 */
+let helperProcess = null;
+/** Helper 连接 socket */
+let helperSocket = null;
+/** Helper 是否就绪 */
+let helperReady = false;
+/** Helper 等待队列 */
+const helperPending = new Map();
+/**
+ * Helper Socket 收到的数据缓冲区（可能跨多条消息）
+ */
+let helperDataBuf = '';
+/**
+ * 处理 Helper 返回的数据（JSON 数组，可能跨多次 TCP 推送）
+ */
+function handleHelperData(chunk) {
+    helperDataBuf += chunk;
+    // Helper 可能一次推送多条 JSON 行（每条以 \n 结尾）
+    const lines = helperDataBuf.split('\n');
+    // 保留最后不完整的行（等待下一块数据）
+    helperDataBuf = lines.pop() || '';
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        try {
+            const resp = JSON.parse(line);
+            const pending = helperPending.get(resp.id);
+            if (!pending)
+                continue;
+            clearTimeout(pending.timer);
+            helperPending.delete(resp.id);
+            if (resp.success) {
+                pending.resolve({ stdout: resp.stdout || '', stderr: resp.stderr || '', exitCode: resp.exitCode ?? 0 });
+            }
+            else {
+                pending.reject(new Error(resp.error || 'Helper command failed'));
+            }
+        }
+        catch { /* ignore parse errors */ }
+    }
+}
+/**
+ * 停止 Helper 进程
+ */
+async function stopHelper() {
+    helperReady = false;
+    if (helperSocket) {
+        try {
+            helperSocket.destroy();
+        }
+        catch { /* ignore */ }
+        helperSocket = null;
+    }
+    if (helperProcess) {
+        try {
+            helperProcess.kill();
+        }
+        catch { /* ignore */ }
+        helperProcess = null;
+    }
+    for (const [id, p] of helperPending) {
+        clearTimeout(p.timer);
+        p.reject(new Error('Helper stopped'));
+    }
+    helperPending.clear();
+}
+exports.stopHelper = stopHelper;
+/**
+ * 查询 Helper 是否就绪
+ */
+function isHelperReady() {
+    return helperReady && helperSocket !== null;
+}
+exports.isHelperReady = isHelperReady;
+/**
+ * 通过 Helper 进程执行命令（以当前登录用户身份）
+ */
+async function execAsUser(command, cwd) {
+    // 确保 Helper 已启动
+    if (!helperReady || !helperSocket) {
+        const started = await spawnHelperAsUser();
+        if (!started) {
+            return { stdout: '', stderr: 'Failed to start helper process', exitCode: -1 };
+        }
+    }
+    const id = newCmdId();
+    const timeout = HELPER_TIMEOUT_MS;
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            helperPending.delete(id);
+            reject(new Error('Command timeout'));
+        }, timeout);
+        helperPending.set(id, { resolve, reject, timer });
+        const req = JSON.stringify({ id, command, cwd: cwd || os_1.default.homedir() });
+        const data = Buffer.from(req + '\n', 'utf8');
+        if (!helperSocket) {
+            clearTimeout(timer);
+            helperPending.delete(id);
+            reject(new Error('Helper socket not available'));
+            return;
+        }
+        helperSocket.once('error', (err) => {
+            clearTimeout(timer);
+            helperPending.delete(id);
+            helperReady = false;
+            reject(err);
+        });
+        helperSocket.write(data, () => {
+            // 等待 Helper 响应（由 handleHelperData 处理）
+        });
+    });
+}
+exports.execAsUser = execAsUser;
+/**
+ * 生成随机命令 ID
+ */
+function newCmdId() {
+    return Date.now() + '-' + Math.random().toString(36).slice(2, 9);
+}
+/**
+ * 生成 Helper 的 PowerShell 执行脚本
+ */
+function buildHelperScript() {
+    const l = [];
+    const push = (x) => l.push(x);
+    push('# User Helper Process - Myassis Gateway');
+    push('$port = ' + HELPER_PORT);
+    push("$ErrorActionPreference = 'Stop'");
+    push('function Write-Log { param([string]$m) Write-Host "[$(Get-Date -Format HH:mm:ss)] $m" }');
+    push('Write-Log "helper started (PID=$PID)"');
+    push('$listener = [System.Net.Sockets.TcpListener]::Start($port)');
+    push('$listener.Start()');
+    push('Write-Log "listening on port $port"');
+    push('while ($true) {');
+    push('  $client = $listener.AcceptTcpClient()');
+    push('  $stream = $client.GetStream()');
+    push('  $reader = New-Object System.IO.StreamReader($stream, [System.Text.Encoding]::UTF8)');
+    push('  $line = $reader.ReadLine()');
+    push('  $client.Close()');
+    push('  if (-not $line) { continue }');
+    push('  Write-Log "received: $line"');
+    push('  try {');
+    push('    $cmd = $line | ConvertFrom-Json');
+    push('    $id = $cmd.id');
+    push('    $command = $cmd.command');
+    push('    $cwd = if ($cmd.cwd) { $cmd.cwd } else { $env:USERPROFILE }');
+    push('    Write-Log "executing: $command"');
+    push('    $stdoutFile = "$env:TEMP\\myassis-stdout-$id.txt"');
+    push('    $stderrFile = "$env:TEMP\\myassis-stderr-$id.txt"');
+    push('    $proc = Start-Process -FilePath "cmd.exe" -ArgumentList "/c $command" -WorkingDirectory $cwd -NoNewWindow -Wait -PassThru -RedirectStandardOutput $stdoutFile -RedirectStandardError $stderrFile');
+    push('    $stdout = if (Test-Path $stdoutFile) { Get-Content $stdoutFile -Raw -Encoding UTF8 } else { "" }');
+    push('    $stderr = if (Test-Path $stderrFile) { Get-Content $stderrFile -Raw -Encoding UTF8 } else { "" }');
+    push('    Remove-Item $stderrFile -Force -ErrorAction SilentlyContinue');
+    push('    Remove-Item $stdoutFile -Force -ErrorAction SilentlyContinue');
+    push('    $exitCode = $proc.ExitCode');
+    push('    Write-Log "done (exit=$exitCode)"');
+    push('    $resp = @{ id=$id; success=$true; stdout=$stdout; stderr=$stderr; exitCode=$exitCode } | ConvertTo-Json -Compress');
+    push('    $nl = [Environment]::NewLine');
+    push('    $bytes = [System.Text.Encoding]::UTF8.GetBytes($resp + $nl)');
+    push('    $client.Client.Send($bytes)');
+    push('  } catch {');
+    push('    Write-Log "error: $($_.Exception.Message)"');
+    push('    try {');
+    push('      $resp = @{ id=$id; success=$false; error=$($_.Exception.Message) } | ConvertTo-Json -Compress');
+    push('      $nl = [Environment]::NewLine');
+    push('      $bytes = [System.Text.Encoding]::UTF8.GetBytes($resp + $nl)');
+    push('      $client.Client.Send($bytes)');
+    push('    } catch { }');
+    push('  }');
+    push('}');
+    return l.join('\r\n');
+}
+/**
+ * 查找当前登录用户的会话 ID（Explorer.exe 所在会话）
+ */
+async function getUserSessionId() {
+    try {
+        const { stdout } = await execAsync('powershell -NoProfile -Command "Get-Process Explorer -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty SessionId"', { timeout: 5000 });
+        const n = parseInt(stdout.trim(), 10);
+        if (!isNaN(n) && n > 0)
+            return n;
+    }
+    catch { /* ignore */ }
+    return null;
+}
+async function spawnHelperAsUser() {
+    if (process.platform !== 'win32')
+        return false;
+    if (helperReady && helperSocket)
+        return true;
+    const sessionId = await getUserSessionId();
+    if (!sessionId) {
+        logger.warn('Cannot get user session ID');
+        return false;
+    }
+    logger.info('Trying to spawn helper in session ' + sessionId);
+    const scriptContent = buildHelperScript();
+    let scriptPath = '';
+    let launchPath = '';
+    try {
+        scriptPath = path_1.default.join(os_1.default.tmpdir(), 'myassis-gateway-helper-' + Date.now() + '.ps1');
+        launchPath = path_1.default.join(os_1.default.tmpdir(), 'myassis-gateway-launch-' + Date.now() + '.ps1');
+        // Write with BOM for UTF-8
+        fs_1.default.writeFileSync(scriptPath, '\uFEFF' + scriptContent, 'utf8');
+        const psLaunchScript = [
+            '$ErrorActionPreference = \'Stop\'',
+            'Add-Type -Namespace Win32 -Name NativeMethods -MemberDefinition @\'',
+            '  [DllImport("wtsapi32.dll", SetLastError=true)] public static extern bool WTSQueryUserToken(int sessionId, out IntPtr token);',
+            '  [DllImport("advapi32.dll", SetLastError=true)] public static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);',
+            '  [StructLayout(LayoutKind.Sequential)] public struct STARTUPINFO { public int cb; public string lpReserved; public string lpDesktop; public string lpTitle; public int dwX; public int dwY; public int dwXSize; public int dwYSize; public int dwXCountChars; public int dwYCountChars; public int dwFillAttribute; public int dwFlags; public short wShowWindow; public short cbReserved2; public IntPtr lpReserved2; public IntPtr hStdInput; public IntPtr hStdOutput; public IntPtr hStdError; }',
+            '  [StructLayout(LayoutKind.Sequential)] public struct PROCESS_INFORMATION { public IntPtr hProcess; public IntPtr hThread; public int dwProcessId; public int dwThreadId; }',
+            "'@",
+            '$sessionId = ' + sessionId,
+            '$tokenPtr = [IntPtr]::Zero',
+            '$ok = [Win32.NativeMethods]::WTSQueryUserToken($sessionId, [ref]$tokenPtr)',
+            'if (-not $ok) { Write-Error "WTSQueryUserToken failed"; exit 1 }',
+            '$si = New-Object Win32.NativeMethods+STARTUPINFO',
+            '$si.cb = [Runtime.InteropServices.Marshal]::SizeOf($si)',
+            '$si.lpDesktop = "WinSta0\\Default"',
+            '$pi = [Win32.NativeMethods+PROCESS_INFORMATION]::new()',
+            '$cmdLine = "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\\"" + "' + scriptPath.replace(/\\\\/g, '\\\\\\\\') + '" + "\\\""',
+            '$envBlock = [IntPtr]::Zero',
+            '$bInherit = $true',
+            '$CREATE_NO_WINDOW = 0x08000000',
+            '$CREATE_UNICODE_ENVIRONMENT = 0x00040000',
+            '$flags = $CREATE_NO_WINDOW -bor $CREATE_UNICODE_ENVIRONMENT',
+            '$result = [Win32.NativeMethods]::CreateProcessAsUser($tokenPtr, $null, $cmdLine, [IntPtr]::Zero, [IntPtr]::Zero, $bInherit, $flags, $envBlock, $null, [ref]$si, [ref]$pi)',
+            '[void][Win32.NativeMethods]',
+            'if (-not $result) { Write-Error "CreateProcessAsUser failed (code=$LASTEXITCODE)"; exit 1 }',
+            '[void][Runtime.InteropServices.Marshal]::Release($tokenPtr)',
+            'Write-Output "started pid=$($pi.dwProcessId)"',
+        ].join('\r\n');
+        fs_1.default.writeFileSync(launchPath, '\uFEFF' + psLaunchScript, 'utf8');
+        const { stdout } = await execAsync('powershell -NoProfile -ExecutionPolicy Bypass -File "' + launchPath + '"', { timeout: 15000, windowsHide: true });
+        logger.info('Helper launch output: ' + stdout.trim());
+        // Wait for helper to become ready，连接成功后升级为持久 socket
+        const maxWait = 5000;
+        const start = Date.now();
+        while (Date.now() - start < maxWait) {
+            try {
+                await new Promise((resolve, reject) => {
+                    const s = net_1.default.createConnection(HELPER_PORT, '127.0.0.1');
+                    s.setTimeout(500);
+                    s.on('connect', () => { s.destroy(); resolve(); });
+                    s.on('timeout', () => { s.destroy(); reject(new Error('timeout')); });
+                    s.on('error', () => { s.destroy(); reject(new Error('error')); });
+                });
+                // Helper 已就绪，建立持久 socket
+                helperSocket = net_1.default.createConnection(HELPER_PORT, '127.0.0.1');
+                helperSocket.setTimeout(0);
+                helperSocket.on('data', (chunk) => {
+                    handleHelperData(chunk.toString('utf8'));
+                });
+                helperSocket.on('error', (err) => {
+                    logger.error('Helper socket error: ' + err.message);
+                    helperReady = false;
+                });
+                helperSocket.on('close', () => {
+                    helperReady = false;
+                    logger.info('Helper socket closed');
+                });
+                helperReady = true;
+                logger.info('Helper process ready');
+                break;
+            }
+            catch {
+                await new Promise(r => setTimeout(r, 500));
+            }
+        }
+        return helperReady;
+    }
+    catch (err) {
+        logger.error('Helper launch failed: ' + (err.message || err));
+        return false;
+    }
+    finally {
+        try {
+            fs_1.default.unlinkSync(scriptPath);
+        }
+        catch { /* ignore */ }
+        try {
+            fs_1.default.unlinkSync(launchPath);
+        }
+        catch { /* ignore */ }
+    }
+}

package/dist/services/tools/exec.js

@@ -10,6 +10,7 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const shared_1 = require("@myassis/shared");
 const crypto_1 = __importDefault(require("crypto"));
+const ServiceManager_js_1 = require("../ServiceManager.js");
 const logger = (0, shared_1.getLogger)('exec');
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 // 待批准的命令缓存：token -> { command, cwd, timeout, sessionId, expiresAt }
@@ -71,14 +72,15 @@ function generateApprovalToken() {
 }
 /** 检查命令是否危险 */
 function isDangerousCommand(command) {
+    // 命令分隔符（起始位置、空格、shell 操作符）隔离的危险关键字
     const dangerousPatterns = [
-        /rm\s+-rf\s+\//,
-        /format\s+[a-z]:/i,
-        /del\s+\/[sfq]\s+\*/i,
-        /shutdown/i,
-        /reboot/i,
-        /mkfs/i,
-        /dd\s+if=.*of=\/dev\//i,
+        /(^|[\s;|&])rm\s+-rf\s+\//,
+        /(^|[\s;|&])format\s+[a-z]:/i,
+        /(^|[\s;|&])del\s+\/[sfq]\s+\*/i,
+        /(^|[\s;|&])shutdown\b/i,
+        /(^|[\s;|&])reboot\b/i,
+        /(^|[\s;|&])mkfs\b/i,
+        /(^|[\s;|&])dd\s+if=.*of=\/dev\//i,
     ];
     for (const reg of dangerousPatterns) {
         if (reg.test(command))
@@ -169,11 +171,28 @@ exports.execTool = {
                         success: false,
                         needsApproval: true,
                         approvalToken: token,
-                        errorMessage: `危险命令需要用户确认：${command}`,
+                        errorMessage: `${command}`,
                     });
                     return;
                 }
             }
+            // Windows 下通过 Helper 以登录用户身份执行
+            if (process.platform === 'win32') {
+                try {
+                    const result = await (0, ServiceManager_js_1.execAsUser)(command, cwd);
+                    resolve({
+                        success: result.exitCode === 0,
+                        output: result.stdout.substring(0, 100000),
+                        errorMessage: result.stderr.substring(0, 100000),
+                        exitCode: result.exitCode,
+                    });
+                    return;
+                }
+                catch (e) {
+                    resolve({ success: false, errorMessage: e?.message || String(e) });
+                    return;
+                }
+            }
             const options = {
                 cwd,
                 timeout,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myassis/gateway",
-  "version": "1.0.39",
+  "version": "1.0.41",
   "description": "我的助手 Gateway Service - 本地 AI 网关服务，支持认证、WebSocket 实时通信和任务调度",
   "main": "dist/index.js",
   "bin": {