@nowcrew/daemon 0.6.97-beta.14 → 0.6.97-beta.16

package/dist/automatic-service-migration.js

@@ -4,6 +4,7 @@ import { buildServiceSpec, serviceStatus, windowsCommandArg, } from "./computer-
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { inspectLegacyServiceInstallationDetails } from "./legacy-service-installation.js";
 import { powershellCommandArgs } from "./powershell-command.js";
+import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -143,8 +144,9 @@ async function discoverWindows(input, identity) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
-        "[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+        "$task=$tasks[0];$actions=@($task.Actions);",
+        windowsTaskPrincipalScript,
+        `[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
     ].join("");
     const result = await input.runner("powershell.exe", powershellCommandArgs(script, [encoded(identity.id)]));
     if (result.exitCode !== 0) {
@@ -164,7 +166,7 @@ async function discoverWindows(input, identity) {
         : null;
     if (definition.count !== 1
         || definition.actionCount !== 1
-        || definition.principalMatches !== true
+        || !windowsTaskPrincipalMatches(definition)
         || !win32.isAbsolute(definition.execute ?? "")
         || match === null
         || match[2] !== input.desired.profile

package/dist/computer-service.js

@@ -6,6 +6,7 @@ import { promisify } from "node:util";
 import { dirname, resolve } from "node:path";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
 import { daemonRegistryCandidates } from "./daemon-registry.js";
+import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 import { npmInvocation } from "./npm-command.js";
 import { powershellCommandArgs } from "./powershell-command.js";
 const execFileAsync = promisify(execFile);
@@ -196,8 +197,9 @@ async function windowsTaskDefinitionMatches(spec, runner) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
-        "[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+        "$task=$tasks[0];$actions=@($task.Actions);",
+        windowsTaskPrincipalScript,
+        `[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
     ].join("");
     const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
     if (result.exitCode !== 0) {
@@ -213,7 +215,7 @@ async function windowsTaskDefinitionMatches(spec, runner) {
     const expectedArguments = spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ");
     return definition.count === 1
         && definition.actionCount === 1
-        && definition.principalMatches === true
+        && windowsTaskPrincipalMatches(definition)
         && sameWindowsPath(definition.execute, spec.daemonCommand[0])
         && definition.arguments === expectedArguments;
 }

package/dist/windows-task-principal.js

@@ -0,0 +1,26 @@
+/** Read only: resolve the task's account with Windows, without guessing or stripping its domain. */
+export const windowsTaskPrincipalScript = [
+    "$currentUserSid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value;",
+    "$principalSid=$null;",
+    "try{",
+    "$account=[string]$task.Principal.UserId;",
+    "if($account -match '^S-\\d-'){",
+    "$principalSid=([Security.Principal.SecurityIdentifier]::new($account)).Value;",
+    "}else{",
+    "$principalSid=([Security.Principal.NTAccount]::new($account)).Translate([Security.Principal.SecurityIdentifier]).Value;",
+    "}",
+    "}catch{$principalSid=$null};",
+].join("");
+export const windowsTaskPrincipalFields = [
+    "currentUserSid=$currentUserSid;",
+    "principalSid=$principalSid;",
+    "logonType=[int]$task.Principal.LogonType;",
+    "runLevel=[int]$task.Principal.RunLevel;",
+].join("");
+export function windowsTaskPrincipalMatches(principal) {
+    return typeof principal.currentUserSid === "string"
+        && /^S-1-(?:\d+-)*\d+$/.test(principal.currentUserSid)
+        && principal.principalSid === principal.currentUserSid
+        && principal.logonType === 3 // Interactive
+        && principal.runLevel === 0; // Limited
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.97-beta.14",
+  "version": "0.6.97-beta.16",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -18,6 +18,13 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@nowcrew/cli": "0.4.17",
@@ -39,11 +46,5 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
-  },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
   }
-}
+}