@myassis/gateway 1.0.40 → 1.0.42

package/dist/services/ServiceManager.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startService = exports.uninstallService = exports.installService = exports.getServiceInfo = exports.SERVICE_DISPLAY_NAME = exports.SERVICE_NAME = void 0;
+exports.execAsUser = exports.isHelperReady = exports.stopHelper = exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startService = exports.uninstallService = exports.installService = exports.getServiceInfo = exports.SERVICE_DISPLAY_NAME = exports.SERVICE_NAME = void 0;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const path_1 = __importDefault(require("path"));
@@ -11,6 +11,7 @@ const fs_1 = __importDefault(require("fs"));
 const axios_1 = __importDefault(require("axios"));
 const shared_1 = require("@myassis/shared");
 const os_1 = __importDefault(require("os"));
+const net_1 = __importDefault(require("net"));
 const logger = (0, shared_1.getLogger)('ServiceManager');
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 exports.SERVICE_NAME = 'myassis-gateway';
@@ -63,39 +64,148 @@ async function queryServiceWindows() {
         return { installed: false, running: false };
     }
 }
+// ─── 用户级进程管理 ─────────────────────────────────────────
+/**
+ * 获取 Gateway 可执行文件路径
+ */
+function getGatewayExePath() {
+    if (isPackagedExe()) {
+        return process.execPath;
+    }
+    const nodeExec = getNodeExec();
+    return nodeExec;
+}
+/**
+ * 检查 Gateway 进程是否在运行
+ */
+function isGatewayRunning() {
+    const pid = getStoredPid();
+    if (!pid)
+        return false;
+    try {
+        // Windows: kill signal 0 探测进程是否存在
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 从 PID 文件读取存储的 PID
+ */
+function getStoredPid() {
+    try {
+        if (!fs_1.default.existsSync(GATEWAY_PID_FILE))
+            return null;
+        const pid = parseInt(fs_1.default.readFileSync(GATEWAY_PID_FILE, 'utf8').trim(), 10);
+        return isNaN(pid) ? null : pid;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * 停止 Gateway 用户进程（优雅终止）
+ */
+async function stopGatewayProcess() {
+    const pid = getStoredPid();
+    if (!pid)
+        return;
+    try {
+        process.kill(pid, 'SIGTERM');
+        await new Promise(r => setTimeout(r, 2000));
+    }
+    catch { /* ignore */ }
+    // 强制终止（如果还没退出）
+    try {
+        process.kill(pid, 'SIGKILL');
+    }
+    catch { /* ignore */ }
+    try {
+        fs_1.default.unlinkSync(GATEWAY_PID_FILE);
+    }
+    catch { /* ignore */ }
+}
+/**
+ * 写入 Gateway 启动脚本（用户级，不弹出窗口）
+ */
+function writeGatewayLauncherScript(exePath, scriptPath, workDir) {
+    // 写入 BOM + UTF-8 内容
+    const content = [
+        "$ErrorActionPreference = 'Stop'",
+        "$exe = '" + exePath.replace(/\\/g, '\\\\') + "'",
+        "$workDir = '" + workDir.replace(/\\/g, '\\\\') + "'",
+        "$pidFile = '" + GATEWAY_PID_FILE.replace(/\\/g, '\\\\') + "'",
+        "$port = 19090",
+        "$svcPort = 19091",
+        "",
+        "# 防止重复启动（检查端口）",
+        "$listener = [System.Net.Sockets.TcpListener]::Start($port)",
+        "$listener.Stop()",
+        "",
+        "# 启动 Gateway 进程（后台、无窗口）",
+        "$psi = New-Object System.Diagnostics.ProcessStartInfo",
+        "$psi.FileName = $exe",
+        "$psi.WorkingDirectory = $workDir",
+        "$psi.Arguments = '--gateway --port ' + $port + ' --service-port ' + $svcPort",
+        "$psi.UseShellExecute = $false",
+        "$psi.RedirectStandardOutput = $true",
+        "$psi.RedirectStandardError = $true",
+        "$psi.CreateNoWindow = $true",
+        "$psi.Environment['NODE_ENV'] = 'production'",
+        "$proc = [System.Diagnostics.Process]::Start($psi)",
+        "if ($proc) {",
+        "  $proc.Id.ToString() | Out-File -FilePath $pidFile -Encoding UTF8",
+        "  $proc.WaitForExit()",
+        "}",
+    ].join('\r\n');
+    fs_1.default.writeFileSync(scriptPath, '\uFEFF' + content, 'utf8');
+}
+/**
+ * 检查 Run key 是否已注册
+ */
+function isRegisteredInRunKey() {
+    // 通过 PowerShell 读取 HKCU Run key
+    try {
+        const { execSync } = require('child_process');
+        const result = execSync(`powershell -NoProfile -Command "if (Test-Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run') { (Get-ItemProperty 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run').PSObject.Properties.Name -contains '${exports.SERVICE_NAME}' } else { $false }"`, { timeout: 5000, windowsHide: true });
+        return result.toString().trim() === 'True';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 写入注册表 Run key（开机自启）
+ */
+async function registerRunKey(scriptPath) {
+    const regCmd = `powershell -NoProfile -Command "Set-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '${exports.SERVICE_NAME}' -Value '\"${scriptPath}\"' -Type String"`;
+    await execAsync(regCmd, { timeout: 10000, windowsHide: true });
+}
+/**
+ * 删除注册表 Run key
+ */
+async function unregisterRunKey() {
+    try {
+        const regCmd = `powershell -NoProfile -Command "Remove-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '${exports.SERVICE_NAME}' -ErrorAction SilentlyContinue"`;
+        await execAsync(regCmd, { timeout: 10000, windowsHide: true });
+    }
+    catch { /* ignore */ }
+}
+// ─── Windows 用户级实现 ─────────────────────────────────────
 async function installWindows() {
-    const isPkg = isPackagedExe();
-    const script = getServiceScript();
-    const exe = getNodeExec();
-    const workDir = isPkg ? path_1.default.dirname(exe) : path_1.default.dirname(script);
-    logger.info(`isPkg=${isPkg}, exe=${exe}, script=${script}, workDir=${workDir}`);
+    const exe = getGatewayExePath();
+    const workDir = path_1.default.dirname(exe);
+    logger.info(`installWindows: exe=${exe}, workDir=${workDir}`);
     const { installed } = await queryServiceWindows();
     if (installed)
         await uninstallWindows();
-    const nssmPath = getNssmPath();
-    const useNssm = !!nssmPath && fs_1.default.existsSync(nssmPath);
     try {
-        if (useNssm) {
-            if (isPkg) {
-                await execAsync(`"${nssmPath}" install ${exports.SERVICE_NAME} "${exe}"`, { timeout: 15000, cwd: workDir });
-            }
-            else {
-                await execAsync(`"${nssmPath}" install ${exports.SERVICE_NAME} "${exe}" "${script}"`, { timeout: 15000, cwd: workDir });
-            }
-            await execAsync(`"${nssmPath}" set ${exports.SERVICE_NAME} AppDirectory "${workDir}"`, { timeout: 10000 });
-            await execAsync(`"${nssmPath}" set ${exports.SERVICE_NAME} DisplayName "${exports.SERVICE_DISPLAY_NAME}"`, { timeout: 10000 });
-            await execAsync(`"${nssmPath}" set ${exports.SERVICE_NAME} Start SERVICE_AUTO_START`, { timeout: 10000 });
-        }
-        else {
-            if (isPkg) {
-                await execAsync(`sc.exe create ${exports.SERVICE_NAME} binPath= "\\"${exe}\\"" DisplayName= "${exports.SERVICE_DISPLAY_NAME}" start= auto`, { timeout: 15000 });
-            }
-            else {
-                await execAsync(`sc.exe create ${exports.SERVICE_NAME} binPath= "\\"${exe}\\" \\"${script}\\"" DisplayName= "${exports.SERVICE_DISPLAY_NAME}" start= auto`, { timeout: 15000 });
-            }
-        }
+        writeGatewayLauncherScript(exe, GATEWAY_LAUNCHER_FILE, workDir);
+        await registerRunKey(GATEWAY_LAUNCHER_FILE);
         await startService();
-        return { success: true, message: '服务安装并启动成功' };
+        return { success: true, message: 'Gateway 安装并启动成功（用户级进程）' };
     }
     catch (err) {
         return { success: false, message: `安装失败: ${err.message}` };
@@ -104,48 +214,48 @@ async function installWindows() {
 async function uninstallWindows() {
     try {
         await stopService();
-        const nssmPath = getNssmPath();
-        if (nssmPath && fs_1.default.existsSync(nssmPath)) {
-            await execAsync(`"${nssmPath}" remove ${exports.SERVICE_NAME} confirm`, { timeout: 10000 });
+        await unregisterRunKey();
+        try {
+            fs_1.default.unlinkSync(GATEWAY_PID_FILE);
         }
-        else {
-            await execAsync(`sc.exe delete ${exports.SERVICE_NAME}`, { timeout: 10000 });
-        }
-        return { success: true, message: '服务卸载成功' };
+        catch { /* ignore */ }
+        return { success: true, message: 'Gateway 已卸载（用户级进程）' };
     }
     catch (err) {
         return { success: false, message: `卸载失败: ${err.message}` };
     }
 }
 async function startServiceWindows() {
+    if (isGatewayRunning()) {
+        return { success: true, message: 'Gateway 已在运行' };
+    }
     try {
-        await execAsync(`sc.exe start ${exports.SERVICE_NAME}`, { timeout: 10000 });
-        return { success: true, message: '服务启动成功' };
+        const exe = getGatewayExePath();
+        const workDir = path_1.default.dirname(exe);
+        if (!fs_1.default.existsSync(GATEWAY_LAUNCHER_FILE)) {
+            writeGatewayLauncherScript(exe, GATEWAY_LAUNCHER_FILE, workDir);
+        }
+        await execAsync(`powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "${GATEWAY_LAUNCHER_FILE}"`, { timeout: 5000, windowsHide: true });
+        const maxWait = 5000;
+        const start = Date.now();
+        while (!isGatewayRunning() && Date.now() - start < maxWait) {
+            await new Promise(r => setTimeout(r, 500));
+        }
+        if (isGatewayRunning()) {
+            return { success: true, message: 'Gateway 启动成功' };
+        }
+        return { success: false, message: 'Gateway 进程未能启动，请检查日志' };
     }
     catch (err) {
         return { success: false, message: `启动失败: ${err.message}` };
     }
 }
 async function restartServiceWindows() {
-    const nssmPath = getNssmPath();
-    // 无 nssm 时需要用户手动更新
-    if (!fs_1.default.existsSync(nssmPath)) {
-        const info = await getServiceInfo();
-        if (info.installed) {
-            return {
-                success: false,
-                message: '检测到您尚未安装 nssm，无法自动重启服务。请手动执行以下步骤更新 Gateway：\n' +
-                    '1. 在桌面上停止 Gateway 服务（系统托盘 → 右键 → 退出）\n' +
-                    '2. 运行 `npm install -g @myassis/gateway@latest`\n' +
-                    '3. 重新启动 Gateway 服务\n\n' +
-                    '如需自动重启功能，请从 https://nssm.cc/download 下载 nssm 并放置到 Gateway 同目录下',
-            };
-        }
-        // 服务未安装时，可直接更新
-    }
     try {
-        await execAsync(`"${nssmPath}" restart ${exports.SERVICE_NAME}`, { timeout: 15000 });
-        return { success: true, message: '服务重启成功' };
+        await stopService();
+        await new Promise(r => setTimeout(r, 1000));
+        await startService();
+        return { success: true, message: 'Gateway 重启成功' };
     }
     catch (err) {
         return { success: false, message: `重启失败: ${err.message}` };
@@ -153,8 +263,8 @@ async function restartServiceWindows() {
 }
 async function stopServiceWindows() {
     try {
-        await execAsync(`sc.exe stop ${exports.SERVICE_NAME}`, { timeout: 10000 });
-        return { success: true, message: '服务停止成功' };
+        await stopGatewayProcess();
+        return { success: true, message: 'Gateway 已停止' };
     }
     catch (err) {
         return { success: false, message: `停止失败: ${err.message}` };
@@ -189,21 +299,21 @@ async function installLinux() {
         if (installed)
             await stopService();
         const execStart = isPkg ? exe : `${exe} ${script}`;
-        const unitContent = `[Unit]
-Description=${exports.SERVICE_DISPLAY_NAME}
-After=network.target
-
-[Service]
-Type=simple
-User=${process.env.USER || 'root'}
-WorkingDirectory=${workDir}
-ExecStart=${execStart}
-Restart=always
-RestartSec=5
-Environment=NODE_ENV=production
-
-[Install]
-WantedBy=multi-user.target
+        const unitContent = `[Unit]
+Description=${exports.SERVICE_DISPLAY_NAME}
+After=network.target
+
+[Service]
+Type=simple
+User=${process.env.USER || 'root'}
+WorkingDirectory=${workDir}
+ExecStart=${execStart}
+Restart=always
+RestartSec=5
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=multi-user.target
 `;
         await fs_1.default.promises.writeFile('/tmp/myassis-gateway.service', unitContent, 'utf8');
         await execAsync('cp /tmp/myassis-gateway.service /etc/systemd/system/myassis-gateway.service', { timeout: 10000 });
@@ -549,3 +659,315 @@ async function updateService() {
     }
 }
 exports.updateService = updateService;
+// ═══════════════════════════════════════════════════════════
+// 用户态 Helper 进程管理 — Windows 专用
+// 目标：在当前登录用户的桌面会话中以该用户身份执行命令
+// 架构：
+//   Service (SYSTEM)  ──TCP/IPC──>  Helper (当前登录用户)
+// ═══════════════════════════════════════════════════════════
+/** IPC 端口号（Service <-> Helper 通信） */
+const HELPER_PORT = 19630;
+/** Helper 超时时间（毫秒） */
+const HELPER_TIMEOUT_MS = 60000;
+/** Gateway PID 文件路径（用户级进程跟踪） */
+const GATEWAY_PID_FILE = path_1.default.join(os_1.default.tmpdir(), 'myassis-gateway-pid.txt');
+/** Gateway 启动脚本路径 */
+const GATEWAY_LAUNCHER_FILE = path_1.default.join(os_1.default.tmpdir(), 'myassis-gateway-launcher.ps1');
+/** 当前活跃的 Helper 进程 */
+let helperProcess = null;
+/** Helper 连接 socket */
+let helperSocket = null;
+/** Helper 是否就绪 */
+let helperReady = false;
+/** Helper 等待队列 */
+const helperPending = new Map();
+/**
+ * Helper Socket 收到的数据缓冲区（可能跨多条消息）
+ */
+let helperDataBuf = '';
+/**
+ * 处理 Helper 返回的数据（JSON 数组，可能跨多次 TCP 推送）
+ */
+function handleHelperData(chunk) {
+    helperDataBuf += chunk;
+    // Helper 可能一次推送多条 JSON 行（每条以 \n 结尾）
+    const lines = helperDataBuf.split('\n');
+    // 保留最后不完整的行（等待下一块数据）
+    helperDataBuf = lines.pop() || '';
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        try {
+            const resp = JSON.parse(line);
+            const pending = helperPending.get(resp.id);
+            if (!pending)
+                continue;
+            clearTimeout(pending.timer);
+            helperPending.delete(resp.id);
+            if (resp.success) {
+                pending.resolve({ stdout: resp.stdout || '', stderr: resp.stderr || '', exitCode: resp.exitCode ?? 0 });
+            }
+            else {
+                pending.reject(new Error(resp.error || 'Helper command failed'));
+            }
+        }
+        catch { /* ignore parse errors */ }
+    }
+}
+/**
+ * 停止 Helper 进程
+ */
+async function stopHelper() {
+    helperReady = false;
+    if (helperSocket) {
+        try {
+            helperSocket.destroy();
+        }
+        catch { /* ignore */ }
+        helperSocket = null;
+    }
+    if (helperProcess) {
+        try {
+            helperProcess.kill();
+        }
+        catch { /* ignore */ }
+        helperProcess = null;
+    }
+    for (const [id, p] of helperPending) {
+        clearTimeout(p.timer);
+        p.reject(new Error('Helper stopped'));
+    }
+    helperPending.clear();
+}
+exports.stopHelper = stopHelper;
+/**
+ * 查询 Helper 是否就绪
+ */
+function isHelperReady() {
+    return helperReady && helperSocket !== null;
+}
+exports.isHelperReady = isHelperReady;
+/**
+ * 通过 Helper 进程执行命令（以当前登录用户身份）
+ */
+async function execAsUser(command, cwd) {
+    // 确保 Helper 已启动
+    if (!helperReady || !helperSocket) {
+        const started = await spawnHelperAsUser();
+        if (!started) {
+            // Helper 启动失败，降级到直接 exec（exit=-2 表示降级执行）
+            logger.warn('Helper spawn failed, falling back to direct exec (exit=-2 = fallback used)');
+            try {
+                const { stdout, stderr } = await execAsync(command, {
+                    cwd: cwd || os_1.default.homedir(),
+                    timeout: HELPER_TIMEOUT_MS,
+                    windowsHide: true,
+                });
+                return { stdout, stderr, exitCode: 0 };
+            }
+            catch (err) {
+                return { stdout: '', stderr: err?.message || String(err), exitCode: -2 };
+            }
+        }
+    }
+    const id = newCmdId();
+    const timeout = HELPER_TIMEOUT_MS;
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            helperPending.delete(id);
+            reject(new Error('Command timeout'));
+        }, timeout);
+        helperPending.set(id, { resolve, reject, timer });
+        const req = JSON.stringify({ id, command, cwd: cwd || os_1.default.homedir() });
+        const data = Buffer.from(req + '\n', 'utf8');
+        if (!helperSocket) {
+            clearTimeout(timer);
+            helperPending.delete(id);
+            reject(new Error('Helper socket not available'));
+            return;
+        }
+        helperSocket.once('error', (err) => {
+            clearTimeout(timer);
+            helperPending.delete(id);
+            helperReady = false;
+            reject(err);
+        });
+        helperSocket.write(data, () => {
+            // 等待 Helper 响应（由 handleHelperData 处理）
+        });
+    });
+}
+exports.execAsUser = execAsUser;
+/**
+ * 生成随机命令 ID
+ */
+function newCmdId() {
+    return Date.now() + '-' + Math.random().toString(36).slice(2, 9);
+}
+/**
+ * 生成 Helper 的 PowerShell 执行脚本
+ */
+function buildHelperScript() {
+    const l = [];
+    const push = (x) => l.push(x);
+    push('# User Helper Process - Myassis Gateway');
+    push('$port = ' + HELPER_PORT);
+    push("$ErrorActionPreference = 'Stop'");
+    push('function Write-Log { param([string]$m) Write-Host "[$(Get-Date -Format HH:mm:ss)] $m" }');
+    push('Write-Log "helper started (PID=$PID)"');
+    push('$listener = [System.Net.Sockets.TcpListener]::Start($port)');
+    push('$listener.Start()');
+    push('Write-Log "listening on port $port"');
+    push('while ($true) {');
+    push('  $client = $listener.AcceptTcpClient()');
+    push('  $stream = $client.GetStream()');
+    push('  $reader = New-Object System.IO.StreamReader($stream, [System.Text.Encoding]::UTF8)');
+    push('  $line = $reader.ReadLine()');
+    push('  $client.Close()');
+    push('  if (-not $line) { continue }');
+    push('  Write-Log "received: $line"');
+    push('  try {');
+    push('    $cmd = $line | ConvertFrom-Json');
+    push('    $id = $cmd.id');
+    push('    $command = $cmd.command');
+    push('    $cwd = if ($cmd.cwd) { $cmd.cwd } else { $env:USERPROFILE }');
+    push('    Write-Log "executing: $command"');
+    push('    $stdoutFile = "$env:TEMP\\myassis-stdout-$id.txt"');
+    push('    $stderrFile = "$env:TEMP\\myassis-stderr-$id.txt"');
+    push('    $proc = Start-Process -FilePath "cmd.exe" -ArgumentList "/c $command" -WorkingDirectory $cwd -NoNewWindow -Wait -PassThru -RedirectStandardOutput $stdoutFile -RedirectStandardError $stderrFile');
+    push('    $stdout = if (Test-Path $stdoutFile) { Get-Content $stdoutFile -Raw -Encoding UTF8 } else { "" }');
+    push('    $stderr = if (Test-Path $stderrFile) { Get-Content $stderrFile -Raw -Encoding UTF8 } else { "" }');
+    push('    Remove-Item $stderrFile -Force -ErrorAction SilentlyContinue');
+    push('    Remove-Item $stdoutFile -Force -ErrorAction SilentlyContinue');
+    push('    $exitCode = $proc.ExitCode');
+    push('    Write-Log "done (exit=$exitCode)"');
+    push('    $resp = @{ id=$id; success=$true; stdout=$stdout; stderr=$stderr; exitCode=$exitCode } | ConvertTo-Json -Compress');
+    push('    $nl = [Environment]::NewLine');
+    push('    $bytes = [System.Text.Encoding]::UTF8.GetBytes($resp + $nl)');
+    push('    $client.Client.Send($bytes)');
+    push('  } catch {');
+    push('    Write-Log "error: $($_.Exception.Message)"');
+    push('    try {');
+    push('      $resp = @{ id=$id; success=$false; error=$($_.Exception.Message) } | ConvertTo-Json -Compress');
+    push('      $nl = [Environment]::NewLine');
+    push('      $bytes = [System.Text.Encoding]::UTF8.GetBytes($resp + $nl)');
+    push('      $client.Client.Send($bytes)');
+    push('    } catch { }');
+    push('  }');
+    push('}');
+    return l.join('\r\n');
+}
+/**
+ * 查找当前登录用户的会话 ID（Explorer.exe 所在会话）
+ */
+async function getUserSessionId() {
+    try {
+        const { stdout } = await execAsync('powershell -NoProfile -Command "Get-Process Explorer -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty SessionId"', { timeout: 5000 });
+        const n = parseInt(stdout.trim(), 10);
+        if (!isNaN(n) && n > 0)
+            return n;
+    }
+    catch { /* ignore */ }
+    return null;
+}
+async function spawnHelperAsUser() {
+    if (process.platform !== 'win32')
+        return false;
+    if (helperReady && helperSocket)
+        return true;
+    const sessionId = await getUserSessionId();
+    if (!sessionId) {
+        logger.warn('Cannot get user session ID');
+        return false;
+    }
+    logger.info('Trying to spawn helper in session ' + sessionId);
+    const scriptContent = buildHelperScript();
+    let scriptPath = '';
+    let launchPath = '';
+    try {
+        scriptPath = path_1.default.join(os_1.default.tmpdir(), 'myassis-gateway-helper-' + Date.now() + '.ps1');
+        launchPath = path_1.default.join(os_1.default.tmpdir(), 'myassis-gateway-launch-' + Date.now() + '.ps1');
+        // Write with BOM for UTF-8
+        fs_1.default.writeFileSync(scriptPath, '\uFEFF' + scriptContent, 'utf8');
+        const psLaunchScript = [
+            '$ErrorActionPreference = \'Stop\'',
+            'Add-Type -Namespace Win32 -Name NativeMethods -MemberDefinition @\'',
+            '  [DllImport("wtsapi32.dll", SetLastError=true)] public static extern bool WTSQueryUserToken(int sessionId, out IntPtr token);',
+            '  [DllImport("advapi32.dll", SetLastError=true)] public static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);',
+            '  [StructLayout(LayoutKind.Sequential)] public struct STARTUPINFO { public int cb; public string lpReserved; public string lpDesktop; public string lpTitle; public int dwX; public int dwY; public int dwXSize; public int dwYSize; public int dwXCountChars; public int dwYCountChars; public int dwFillAttribute; public int dwFlags; public short wShowWindow; public short cbReserved2; public IntPtr lpReserved2; public IntPtr hStdInput; public IntPtr hStdOutput; public IntPtr hStdError; }',
+            '  [StructLayout(LayoutKind.Sequential)] public struct PROCESS_INFORMATION { public IntPtr hProcess; public IntPtr hThread; public int dwProcessId; public int dwThreadId; }',
+            "'@",
+            '$sessionId = ' + sessionId,
+            '$tokenPtr = [IntPtr]::Zero',
+            '$ok = [Win32.NativeMethods]::WTSQueryUserToken($sessionId, [ref]$tokenPtr)',
+            'if (-not $ok) { Write-Error "WTSQueryUserToken failed"; exit 1 }',
+            '$si = New-Object Win32.NativeMethods+STARTUPINFO',
+            '$si.cb = [Runtime.InteropServices.Marshal]::SizeOf($si)',
+            '$si.lpDesktop = "WinSta0\\Default"',
+            '$pi = [Win32.NativeMethods+PROCESS_INFORMATION]::new()',
+            '$cmdLine = "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\\"" + "' + scriptPath.replace(/\\\\/g, '\\\\\\\\') + '" + "\\\""',
+            '$envBlock = [IntPtr]::Zero',
+            '$bInherit = $true',
+            '$CREATE_NO_WINDOW = 0x08000000',
+            '$CREATE_UNICODE_ENVIRONMENT = 0x00040000',
+            '$flags = $CREATE_NO_WINDOW -bor $CREATE_UNICODE_ENVIRONMENT',
+            '$result = [Win32.NativeMethods]::CreateProcessAsUser($tokenPtr, $null, $cmdLine, [IntPtr]::Zero, [IntPtr]::Zero, $bInherit, $flags, $envBlock, $null, [ref]$si, [ref]$pi)',
+            '[void][Win32.NativeMethods]',
+            'if (-not $result) { Write-Error "CreateProcessAsUser failed (code=$LASTEXITCODE)"; exit 1 }',
+            '[void][Runtime.InteropServices.Marshal]::Release($tokenPtr)',
+            'Write-Output "started pid=$($pi.dwProcessId)"',
+        ].join('\r\n');
+        fs_1.default.writeFileSync(launchPath, '\uFEFF' + psLaunchScript, 'utf8');
+        const { stdout } = await execAsync('powershell -NoProfile -ExecutionPolicy Bypass -File "' + launchPath + '"', { timeout: 15000, windowsHide: true });
+        logger.info('Helper launch output: ' + stdout.trim());
+        // Wait for helper to become ready，连接成功后升级为持久 socket
+        const maxWait = 5000;
+        const start = Date.now();
+        while (Date.now() - start < maxWait) {
+            try {
+                await new Promise((resolve, reject) => {
+                    const s = net_1.default.createConnection(HELPER_PORT, '127.0.0.1');
+                    s.setTimeout(500);
+                    s.on('connect', () => { s.destroy(); resolve(); });
+                    s.on('timeout', () => { s.destroy(); reject(new Error('timeout')); });
+                    s.on('error', () => { s.destroy(); reject(new Error('error')); });
+                });
+                // Helper 已就绪，建立持久 socket
+                helperSocket = net_1.default.createConnection(HELPER_PORT, '127.0.0.1');
+                helperSocket.setTimeout(0);
+                helperSocket.on('data', (chunk) => {
+                    handleHelperData(chunk.toString('utf8'));
+                });
+                helperSocket.on('error', (err) => {
+                    logger.error('Helper socket error: ' + err.message);
+                    helperReady = false;
+                });
+                helperSocket.on('close', () => {
+                    helperReady = false;
+                    logger.info('Helper socket closed');
+                });
+                helperReady = true;
+                logger.info('Helper process ready');
+                break;
+            }
+            catch {
+                await new Promise(r => setTimeout(r, 500));
+            }
+        }
+        return helperReady;
+    }
+    catch (err) {
+        logger.error('Helper launch failed: ' + (err.message || err));
+        return false;
+    }
+    finally {
+        try {
+            fs_1.default.unlinkSync(scriptPath);
+        }
+        catch { /* ignore */ }
+        try {
+            fs_1.default.unlinkSync(launchPath);
+        }
+        catch { /* ignore */ }
+    }
+}

package/dist/services/tools/exec.js

@@ -10,6 +10,7 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const shared_1 = require("@myassis/shared");
 const crypto_1 = __importDefault(require("crypto"));
+const ServiceManager_js_1 = require("../ServiceManager.js");
 const logger = (0, shared_1.getLogger)('exec');
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 // 待批准的命令缓存：token -> { command, cwd, timeout, sessionId, expiresAt }
@@ -71,14 +72,15 @@ function generateApprovalToken() {
 }
 /** 检查命令是否危险 */
 function isDangerousCommand(command) {
+    // 命令分隔符（起始位置、空格、shell 操作符）隔离的危险关键字
     const dangerousPatterns = [
-        /rm\s+-rf\s+\//,
-        /format\s+[a-z]:/i,
-        /del\s+\/[sfq]\s+\*/i,
-        /shutdown/i,
-        /reboot/i,
-        /mkfs/i,
-        /dd\s+if=.*of=\/dev\//i,
+        /(^|[\s;|&])rm\s+-rf\s+\//,
+        /(^|[\s;|&])format\s+[a-z]:/i,
+        /(^|[\s;|&])del\s+\/[sfq]\s+\*/i,
+        /(^|[\s;|&])shutdown\b/i,
+        /(^|[\s;|&])reboot\b/i,
+        /(^|[\s;|&])mkfs\b/i,
+        /(^|[\s;|&])dd\s+if=.*of=\/dev\//i,
     ];
     for (const reg of dangerousPatterns) {
         if (reg.test(command))
@@ -174,6 +176,23 @@ exports.execTool = {
                     return;
                 }
             }
+            // Windows 下通过 Helper 以登录用户身份执行
+            if (process.platform === 'win32') {
+                try {
+                    const result = await (0, ServiceManager_js_1.execAsUser)(command, cwd);
+                    resolve({
+                        success: result.exitCode === 0,
+                        output: result.stdout.substring(0, 100000),
+                        errorMessage: result.stderr.substring(0, 100000),
+                        exitCode: result.exitCode,
+                    });
+                    return;
+                }
+                catch (e) {
+                    resolve({ success: false, errorMessage: e?.message || String(e) });
+                    return;
+                }
+            }
             const options = {
                 cwd,
                 timeout,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myassis/gateway",
-  "version": "1.0.40",
+  "version": "1.0.42",
   "description": "我的助手 Gateway Service - 本地 AI 网关服务，支持认证、WebSocket 实时通信和任务调度",
   "main": "dist/index.js",
   "bin": {