@nowcrew/daemon 0.6.97-beta.10 → 0.6.97-beta.12

package/dist/automatic-service-migration.js

@@ -3,6 +3,7 @@ import { posix, win32 } from "node:path";
 import { buildServiceSpec, serviceStatus, windowsCommandArg, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { inspectLegacyServiceInstallationDetails } from "./legacy-service-installation.js";
+import { powershellCommandArgs } from "./powershell-command.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -145,9 +146,7 @@ async function discoverWindows(input, identity) {
         "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
         "[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await input.runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encoded(identity.id),
-    ]);
+    const result = await input.runner("powershell.exe", powershellCommandArgs(script, [encoded(identity.id)]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect legacy scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }

package/dist/computer-service.js

@@ -7,6 +7,7 @@ import { dirname, resolve } from "node:path";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
 import { daemonRegistryCandidates } from "./daemon-registry.js";
 import { npmInvocation } from "./npm-command.js";
+import { powershellCommandArgs } from "./powershell-command.js";
 const execFileAsync = promisify(execFile);
 const WINDOWS_STOP_TIMEOUT_MS = 5_000;
 const WINDOWS_STOP_POLL_MS = 100;
@@ -198,9 +199,7 @@ async function windowsTaskDefinitionMatches(spec, runner) {
         "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
         "[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
-    ]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect scheduled task definition: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -226,9 +225,7 @@ async function windowsTaskState(spec, runner) {
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -eq 0){'missing'}elseif($tasks.Count -eq 1){'state:'+([int]$tasks[0].State)}else{throw 'duplicate scheduled tasks'}",
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
-    ]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to query scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -279,10 +276,9 @@ export async function installService(spec, runner = systemCommandRunner) {
             "$principal=New-ScheduledTaskPrincipal -UserId $identity -LogonType Interactive -RunLevel Limited;",
             "Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -ErrorAction Stop|Out-Null;",
         ].join("");
-        await checked(runner, "powershell.exe", [
-            "-NoProfile", "-NonInteractive", "-Command", script,
+        await checked(runner, "powershell.exe", powershellCommandArgs(script, [
             encodedName, encodedExecutable, encodedArguments,
-        ], "Scheduled task installation");
+        ]), "Scheduled task installation");
         return;
     }
     if (spec.descriptorPath === null || spec.descriptor === null)
@@ -418,6 +414,33 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
     }
 }
 const systemDetachedSpawn = (command, args, options) => spawn(command, [...args], options);
+function windowsRestartCommandArgs(spec) {
+    if (!spec.runtimeProcessIdentity)
+        throw new Error("Windows daemon process identity is required for restart");
+    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
+    const encodedExecutable = Buffer.from(spec.daemonCommand[0], "utf16le").toString("base64");
+    const encodedArguments = Buffer.from(spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "), "utf16le").toString("base64");
+    const script = [
+        "$ErrorActionPreference='Stop';",
+        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
+        "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
+        "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
+        "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
+        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+        "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
+        "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
+        "$p.Kill();",
+        "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
+        "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
+        "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
+        "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
+        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+        "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
+    ].join("");
+    return powershellCommandArgs(script, [
+        String(process.pid), encodedName, encodedExecutable, encodedArguments, spec.runtimeProcessIdentity,
+    ]);
+}
 const RESTART_HELPER_SOURCE = String.raw `
 const { spawnSync } = require("node:child_process");
 const spec = JSON.parse(process.argv[1]);
@@ -428,27 +451,7 @@ setTimeout(() => {
   } else if (spec.platform === "linux") {
     restarted = spawnSync("systemctl", ["--user", "--no-block", "restart", spec.id], { stdio: "ignore", shell: false });
   } else {
-    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
-    const encodedExecutable = Buffer.from(spec.executable, "utf16le").toString("base64");
-    const encodedArguments = Buffer.from(spec.arguments, "utf16le").toString("base64");
-    const script = [
-      "$ErrorActionPreference='Stop';",
-      "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
-      "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
-      "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
-      "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
-      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-      "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
-      "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
-      "$p.Kill();",
-      "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
-      "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
-      "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
-      "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
-      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-      "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
-    ].join("");
-    restarted = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, String(spec.daemonPid), encodedName, encodedExecutable, encodedArguments, spec.processIdentity], { stdio: "ignore", shell: false });
+    restarted = spawnSync("powershell.exe", spec.powershellArgs, { stdio: "ignore", shell: false });
   }
   if (restarted.status !== 0) process.send?.({ type: "restart-failed", status: restarted.status });
   setTimeout(() => {
@@ -470,15 +473,8 @@ export function scheduleServiceRestart(spec, spawnDetached = systemDetachedSpawn
             ? { platform: spec.platform, id: spec.id }
             : {
                 platform: spec.platform,
-                id: spec.id,
-                daemonPid: process.pid,
-                executable: spec.daemonCommand[0],
-                arguments: spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "),
-                processIdentity: spec.runtimeProcessIdentity,
+                powershellArgs: windowsRestartCommandArgs(spec),
             };
-    if (spec.platform === "win32" && !payload.processIdentity) {
-        throw new Error("Windows daemon process identity is required for restart");
-    }
     const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"], shell: false });
     child.unref();
     let settleFailure;
@@ -627,7 +623,7 @@ export async function windowsProfileIsPrivate(path, runner = systemCommandRunner
         "$unsafe=$rules|Where-Object { $_.AccessControlType -eq 'Allow' -and $safe -notcontains $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value };",
         "if($unsafe){'false'}else{'true'}",
     ].join("");
-    const result = await runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, encodedPath]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedPath]));
     if (result.exitCode !== 0)
         throw new Error(`Profile ACL inspection failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     if (result.stdout.trim() === "true")

package/dist/computer-setup-client.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { hostname } from "node:os";
 import { MachineTokenSchema } from "./computer-profile.js";
+import { powershellCommandArgs } from "./powershell-command.js";
 import { systemCommandRunner, } from "./computer-service.js";
 const HttpUrlSchema = z.string().url().refine((value) => {
     const url = new URL(value);
@@ -309,8 +310,10 @@ export function createComputerSetupClient(options) {
     };
 }
 export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
-    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
-    const args = [url];
+    const command = platform === "win32" ? "powershell.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = platform === "win32"
+        ? powershellCommandArgs("Start-Process -FilePath $args[0] -ErrorAction Stop | Out-Null", [url])
+        : [url];
     const result = await runner(command, args);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);

package/dist/powershell-command.js

@@ -0,0 +1,12 @@
+/**
+ * powershell.exe -Command joins trailing argv into command text, rather than
+ * binding it to $args. Invoke a scriptblock with literal arguments inside one
+ * UTF-16LE encoded command. Encoding is transport, not encryption.
+ */
+export function powershellCommandArgs(script, args = []) {
+    // PowerShell also treats typographic single quotes as string delimiters.
+    const literals = args.map((arg) => `'${arg.replace(/['\u2018-\u201b]/gu, (quote) => quote + quote)}'`).join(" ");
+    const command = "[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false);\n"
+        + `& {\n${script}\n} ${literals}`;
+    return ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(command, "utf16le").toString("base64")];
+}

package/dist/windows-scheduled-task.js

@@ -1,5 +1,6 @@
 import { systemCommandRunner, windowsCommandArg, } from "./computer-service.js";
 import { win32 } from "node:path";
+import { powershellCommandArgs } from "./powershell-command.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -33,10 +34,9 @@ export async function inspectWindowsServiceUpdateScope(spec, npmPrefix, daemonPi
         "$enginePid=if($instances.Count -eq 1){[int64]$instances[0].EnginePID}else{0};",
         "[pscustomobject]@{count=1;state=[int]$task.State;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};instanceCount=$instances.Count;enginePid=$enginePid;engineOwned=($enginePid -eq $pidValue -or $ancestors -contains $enginePid);processIdentity=$processIdentity;conflictingPrefixes=$conflicts.Count}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script,
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [
         encoded(spec.id), encoded(entryMarker), String(daemonPid),
-    ]);
+    ]));
     if (result.exitCode !== 0)
         return { valid: false };
     let inspection;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.97-beta.10",
+  "version": "0.6.97-beta.12",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -18,6 +18,13 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@nowcrew/cli": "0.4.17",
@@ -39,11 +46,5 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
-  },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
   }
-}
+}