agentroam 0.2.0-preview.23 → 0.2.0-preview.25

package/bin/node-preflight.mjs

@@ -7,7 +7,7 @@ import { promisify } from "node:util";
 import { MINIMUM_NODE_VERSION, compareNodeVersions, isSupportedNodeVersion, parseNodeVersion } from "./runtime-policy.mjs";
 
 const execFileAsync = promisify(execFile);
-const RELEASE_VERSION = "0.2.0-preview.23";
+const RELEASE_VERSION = "0.2.0-preview.25";
 const RELEASE_BASE_URL = `https://gitee.com/caoqu/team-agent/releases/download/v${RELEASE_VERSION}`;
 const FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 

package/dist/args.js

@@ -3,10 +3,11 @@ import { resolve } from "node:path";
 export function parseArgs(argv) {
     const values = [...argv];
     let command = "start";
-    if (values[0] && ["start", "doctor", "version", "service", "update", "update-worker", "pair", "devices", "revoke", "approvals", "approve", "deny", "lock", "unlock", "audit"].includes(values[0])) {
+    if (values[0] && ["start", "doctor", "version", "service", "unlock-service", "update", "update-worker", "pair", "devices", "revoke", "approvals", "approve", "deny", "lock", "unlock", "audit"].includes(values[0])) {
         command = values.shift();
     }
     let serviceAction = null;
+    let unlockServiceAction = null;
     if (command === "service") {
         const action = values.shift();
         if (!action || !["install", "start", "stop", "status", "url", "logs", "restart", "uninstall"].includes(action)) {
@@ -17,6 +18,13 @@ export function parseArgs(argv) {
             throw cliError(`service ${serviceAction} does not accept options`);
         }
     }
+    if (command === "unlock-service") {
+        const action = values.shift();
+        if (!action || !["install", "uninstall", "status"].includes(action) || values.length > 0) {
+            throw cliError("unlock-service requires install, uninstall, or status and accepts no options");
+        }
+        unlockServiceAction = action;
+    }
     let revokeDeviceId = null;
     let revokeAll = false;
     if (command === "revoke") {
@@ -47,6 +55,7 @@ export function parseArgs(argv) {
     const options = {
         command,
         serviceAction,
+        unlockServiceAction,
         roots: [],
         port: null,
         relay: "auto",

package/dist/args.test.js

@@ -6,9 +6,18 @@ describe("parseArgs", () => {
         const value = parseArgs([]);
         expect(value.command).toBe("start");
         expect(value.serviceAction).toBeNull();
+        expect(value.unlockServiceAction).toBeNull();
         expect(value.roots).toEqual([process.cwd()]);
         expect(value.relay).toBe("auto");
     });
+    it("parses Windows unlock service actions", () => {
+        for (const action of ["install", "uninstall", "status"]) {
+            expect(parseArgs(["unlock-service", action])).toMatchObject({ command: "unlock-service", unlockServiceAction: action });
+        }
+        expect(() => parseArgs(["unlock-service"])).toThrow("requires install");
+        expect(() => parseArgs(["unlock-service", "restart"])).toThrow("requires install");
+        expect(() => parseArgs(["unlock-service", "status", "--data-dir", "/tmp/x"])).toThrow("accepts no options");
+    });
     it("parses every supported relay", () => {
         expect(parseArgs(["--relay", "cloudflare"]).relay).toBe("cloudflare");
         expect(parseArgs(["--relay", "pinggy"]).relay).toBe("pinggy");

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { printLocalDesktopUrl } from './local-desktop-url.js';
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "./args.js";
@@ -17,6 +18,7 @@ import { selectRelay } from "./tunnel/relay-orchestrator.js";
 import { currentCliPath, startUpdate } from "./update/update-command.js";
 import { runUpdateWorker } from "./update/update-worker.js";
 import { lockInstanceStartup, stopPreviousInstances } from "./instance-takeover.js";
+import { runUnlockServiceCommand } from "./unlock-service.js";
 const VERSION = AGENTROAM_VERSION;
 export async function main(argv) {
     if (argv.includes("--help") || argv.includes("-h")) {
@@ -34,6 +36,7 @@ export async function main(argv) {
   agentroam revoke <设备ID>          移除一台设备
   agentroam revoke --all            全部退出并取消待用配对码
   agentroam service install|start|stop|restart|status|url|logs|uninstall
+  agentroam unlock-service install|uninstall|status  管理 Windows 远程解锁服务（安装时弹出 UAC）
 设备命令支持 --data-dir PATH；配对码有效期 5 分钟，设备授权有效期 30 天。`);
         return;
     }
@@ -82,6 +85,12 @@ export async function main(argv) {
         return;
     }
     const target = detectPlatform();
+    if (options.command === "unlock-service") {
+        if (target !== "windows-amd64")
+            throw new Error("远程解锁服务仅支持 Windows 10/11 x64");
+        runUnlockServiceCommand(options.unlockServiceAction, resolvePlatformRuntime(target).runtimeRoot);
+        return;
+    }
     if (options.command === "update") {
         if (target !== "darwin-arm64" && target !== "windows-amd64")
             throw new Error(`updates are unavailable for ${target}`);
@@ -137,6 +146,9 @@ export async function main(argv) {
         }
         void runtime.exited.then(() => controller.abort());
         console.log(`✓ Local server: ${runtime.localUrl}/web`);
+        await serviceReporter?.localReady(runtime.localUrl);
+        if (!serviceReporter)
+            printLocalDesktopUrl(runtime.localUrl);
         const lanUrl = options.localOnly ? findLanUrl(runtime.port) ?? runtime.localUrl : runtime.localUrl;
         relay = await selectRelay({
             cli: options,

package/dist/local-desktop-url.js

@@ -0,0 +1,8 @@
+export function printLocalDesktopUrl(localUrl, log = console.log, platform = process.platform) {
+    log(`远程桌面授权地址：${localUrl.replace(/\/$/, '')}/web`);
+    log('请在运行 CLI 的这台电脑上用浏览器打开此地址，配对后点击“远程授权”（盾牌图标）。');
+    if (platform === 'win32')
+        log('点击“开启共享”。请保持 Windows 已登录且未锁屏；暂不支持 UAC 安全桌面和管理员窗口控制。');
+    else
+        log('按提示授予“屏幕录制”和“辅助功能”权限，然后点击“开启共享”。');
+}

package/dist/platform-packages.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname } from "node:path";
 import { MINIMUM_NODE_VERSION, assertSupportedNodeVersion } from "../bin/runtime-policy.mjs";
-export const AGENTROAM_VERSION = "0.2.0-preview.23";
+export const AGENTROAM_VERSION = "0.2.0-preview.25";
 export const PLATFORM_DEPENDENCY_VERSIONS = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).optionalDependencies;
 export const PLATFORM_PACKAGES = {
     "darwin-arm64": {

package/dist/service/runtime-state.js

@@ -16,6 +16,9 @@ export class ServiceRuntimeReporter {
         await removeIfExists(this.paths.urlPath);
         await this.write({ status: "starting" });
     }
+    async localReady(localUrl) {
+        await this.write({ status: "starting", localUrl });
+    }
     async ready(ready) {
         await this.write({ status: "ready", ...ready });
         await writePrivateText(this.paths.urlPath, `${ready.accessUrl}\n`);

package/dist/service/runtime-state.test.js

@@ -13,6 +13,9 @@ describe("ServiceRuntimeReporter", () => {
         await reporter.starting();
         expect(await readServiceState(paths)).toMatchObject({ status: "starting", pid: 123, version: "0.2.0-preview.9" });
         await expect(access(paths.urlPath)).rejects.toMatchObject({ code: "ENOENT" });
+        await reporter.localReady("http://127.0.0.1:49157");
+        expect(await readServiceState(paths)).toMatchObject({ status: "starting", localUrl: "http://127.0.0.1:49157", pid: 123 });
+        await expect(access(paths.urlPath)).rejects.toMatchObject({ code: "ENOENT" });
         await reporter.ready({
             localUrl: "http://127.0.0.1:3000",
             publicUrl: "https://example.trycloudflare.com",

package/dist/service/service-command.js

@@ -1,3 +1,4 @@
+import { printLocalDesktopUrl } from '../local-desktop-url.js';
 import { delimiter, dirname, isAbsolute, resolve, win32 } from "node:path";
 import { resolveCodexRuntime } from "../codex-runtime-manager.js";
 import { detectPlatform } from "../platform.js";
@@ -60,13 +61,10 @@ export async function runServiceCommand(options, context) {
             log(`✓ AgentRoam service installed: ${definition}`);
             if (state?.status === "ready" && state.version === config.version)
                 await cleanupOldLaunchers(config, log);
+            if (state?.localUrl && state.status !== "stopped")
+                printLocalDesktopUrl(state.localUrl, log, platform);
             if (state?.status === "ready" && state.accessUrl) {
                 log(`Open: ${state.accessUrl}`);
-                if (state.localUrl) {
-                    log(`远程桌面授权地址：${state.localUrl.replace(/\/$/, "")}/web`);
-                    log('请在运行 CLI 的这台电脑上用浏览器打开此地址，配对后点击“远程授权”（盾牌图标）。');
-                    log('按提示授予“屏幕录制”和“辅助功能”权限，然后点击“开启共享”。');
-                }
                 await (context.pairingPrinter ?? printPairingCode)(options.dataDir, log, { accessUrl: state.accessUrl, qr: options.qr, interactive: stdoutIsTTY });
             }
             else
@@ -78,6 +76,8 @@ export async function runServiceCommand(options, context) {
             log("✓ AgentRoam service started");
             if (state?.status === "ready" && state.accessUrl)
                 await logAccessUrl(state.accessUrl);
+            if (state?.localUrl && state.status !== "stopped")
+                printLocalDesktopUrl(state.localUrl, log, platform);
             return;
         }
         case "stop":
@@ -95,6 +95,8 @@ export async function runServiceCommand(options, context) {
                 log(`Version: ${status.config.version}`);
                 log(`Root: ${status.config.roots.join(", ")}`);
             }
+            if (status.running && status.state?.localUrl)
+                printLocalDesktopUrl(status.state.localUrl, log, platform);
             if (status.running && status.state?.status === "ready" && status.state.accessUrl) {
                 await logAccessUrl(status.state.accessUrl);
             }
@@ -118,6 +120,8 @@ export async function runServiceCommand(options, context) {
             log("✓ AgentRoam service restarted");
             if (state?.status === "ready" && state.accessUrl)
                 await logAccessUrl(state.accessUrl);
+            if (state?.localUrl && state.status !== "stopped")
+                printLocalDesktopUrl(state.localUrl, log, platform);
             return;
         }
         case "uninstall": {

package/dist/service/service-command.test.js

@@ -164,6 +164,7 @@ function options(serviceAction) {
     return {
         command: "service",
         serviceAction,
+        unlockServiceAction: null,
         roots: [resolve("workspace")],
         port: null,
         relay: "auto",
@@ -173,3 +174,16 @@ function options(serviceAction) {
         dataDir: resolve("data"),
     };
 }
+it.each(['install', 'start', 'restart', 'status'])('prints the actual Windows local address for %s before tunnel readiness', async (action) => {
+    const state = { status: 'starting', localUrl: 'http://127.0.0.1:49157', pid: 123 };
+    const log = vi.fn();
+    const control = controller({
+        install: vi.fn(async () => ({ state, definition: 'task' })), start: vi.fn(async () => state), restart: vi.fn(async () => state),
+        status: vi.fn(async () => ({ installed: true, running: true, state, config: null })),
+    });
+    await runServiceCommand(options(action), { platform: 'win32', arch: 'x64', nodePath: 'C:\\node.exe', cliPath: 'C:\\agentroam.mjs', version: 'test', nodeVersion: '22.22.0', controller: control, log,
+        codexResolver: vi.fn(async () => ({ executable: 'C:\\codex.exe', version: 'test', source: 'global' })) });
+    expect(log).toHaveBeenCalledWith('远程桌面授权地址：http://127.0.0.1:49157/web');
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('保持 Windows 已登录'));
+    expect(log.mock.calls.some(([line]) => line.includes('屏幕录制') || line.includes('辅助功能'))).toBe(false);
+});

package/dist/tunnel/public-readiness.js

@@ -22,7 +22,7 @@ export async function waitForPublicReadiness(publicUrl, options = {}) {
             try {
                 const response = await fetchImpl(endpoint, {
                     cache: "no-store",
-                    headers: { "user-agent": "agentroam-readiness/0.2.0-preview.23" },
+                    headers: { "user-agent": "agentroam-readiness/0.2.0-preview.25" },
                     signal: options.signal,
                 });
                 if (response.ok) {

package/dist/tunnel/relay-orchestrator.test.js

@@ -61,6 +61,7 @@ function cli(relay, localOnly = false) {
     return {
         command: "start",
         serviceAction: null,
+        unlockServiceAction: null,
         roots: [process.cwd()],
         port: null,
         relay,

package/dist/unlock-service.js

@@ -0,0 +1,97 @@
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+const SERVICE_NAME = "AgentRoamUnlock";
+const DISPLAY_NAME = "AgentRoam Remote Unlock";
+function psQuote(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+export function encodePowerShell(script) {
+    return Buffer.from(script, "utf16le").toString("base64");
+}
+export function unlockServiceExecutable(runtimeRoot) {
+    return resolve(runtimeRoot, "native", "agentroam-remote-unlock.exe");
+}
+export function buildUnlockServiceAdminScript(action, executable) {
+    const common = `$ErrorActionPreference = 'Stop'\n$serviceName = '${SERVICE_NAME}'`;
+    if (action === "uninstall") {
+        return `${common}
+$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
+if ($service) {
+  if ($service.Status -ne 'Stopped') { Stop-Service -Name $serviceName -Force -ErrorAction Stop }
+  & "$env:SystemRoot\\System32\\sc.exe" delete $serviceName | Out-Null
+  if ($LASTEXITCODE -ne 0) { throw "sc.exe delete failed: $LASTEXITCODE" }
+}
+`;
+    }
+    const binaryPath = `\"${executable}\" --service`;
+    return `${common}
+$binary = ${psQuote(executable)}
+if (-not (Test-Path -LiteralPath $binary -PathType Leaf)) { throw "Remote unlock helper is missing: $binary" }
+$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
+if ($service) {
+  if ($service.Status -ne 'Stopped') { Stop-Service -Name $serviceName -Force -ErrorAction Stop }
+  & "$env:SystemRoot\\System32\\sc.exe" delete $serviceName | Out-Null
+  if ($LASTEXITCODE -ne 0) { throw "sc.exe delete failed: $LASTEXITCODE" }
+  for ($attempt = 0; $attempt -lt 50 -and (Get-Service -Name $serviceName -ErrorAction SilentlyContinue); $attempt++) { Start-Sleep -Milliseconds 100 }
+}
+New-Service -Name $serviceName -BinaryPathName ${psQuote(binaryPath)} -DisplayName '${DISPLAY_NAME}' -StartupType Automatic | Out-Null
+& "$env:SystemRoot\\System32\\sc.exe" description $serviceName "Allows an authorized AgentRoam session to wake and unlock the Windows secure desktop." | Out-Null
+Start-Service -Name $serviceName -ErrorAction Stop
+`;
+}
+export function buildElevatedPowerShell(adminScript) {
+    const payload = encodePowerShell(adminScript);
+    return `$ErrorActionPreference = 'Stop'
+$powershell = Join-Path $PSHOME 'powershell.exe'
+$process = Start-Process -FilePath $powershell -Verb RunAs -Wait -PassThru -ArgumentList @('-NoLogo','-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-EncodedCommand','${payload}')
+exit $process.ExitCode
+`;
+}
+export function parseUnlockServiceStatus(output) {
+    const value = output.trim().split(/\r?\n/).at(-1)?.trim().toLowerCase();
+    if (value === "running" || value === "stopped" || value === "missing")
+        return value;
+    throw new Error("无法读取远程解锁服务状态");
+}
+function runPowerShell(script, runner) {
+    return runner("powershell.exe", [
+        "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
+        "-EncodedCommand", encodePowerShell(script),
+    ], { encoding: "utf8", windowsHide: true });
+}
+export function queryUnlockServiceStatus(runner = spawnSync) {
+    const script = `$service = Get-Service -Name '${SERVICE_NAME}' -ErrorAction SilentlyContinue
+if (-not $service) { Write-Output 'missing' } elseif ($service.Status -eq 'Running') { Write-Output 'running' } else { Write-Output 'stopped' }
+`;
+    const result = runPowerShell(script, runner);
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error((result.stderr || "远程解锁服务状态查询失败").trim());
+    return parseUnlockServiceStatus(result.stdout || "");
+}
+export function runUnlockServiceCommand(action, runtimeRoot, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const runner = options.runner ?? spawnSync;
+    const log = options.log ?? console.log;
+    if (platform !== "win32")
+        throw new Error("远程解锁服务仅支持 Windows 10/11 x64");
+    if (action === "status") {
+        const status = queryUnlockServiceStatus(runner);
+        log(status === "running" ? "远程解锁服务正在运行" : status === "stopped" ? "远程解锁服务已安装但未运行" : "远程解锁服务未安装");
+        return;
+    }
+    const executable = unlockServiceExecutable(runtimeRoot);
+    const result = runPowerShell(buildElevatedPowerShell(buildUnlockServiceAdminScript(action, executable)), runner);
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw new Error((result.stderr || (action === "install" ? "远程解锁服务安装失败或已取消管理员授权" : "远程解锁服务卸载失败或已取消管理员授权")).trim());
+    }
+    const status = queryUnlockServiceStatus(runner);
+    if (action === "install" && status !== "running")
+        throw new Error("远程解锁服务安装后未能启动");
+    if (action === "uninstall" && status !== "missing")
+        throw new Error("远程解锁服务卸载后仍然存在");
+    log(action === "install" ? "远程解锁服务已安装并启动" : "远程解锁服务已卸载");
+}

package/dist/unlock-service.test.js

@@ -0,0 +1,37 @@
+import { describe, expect, it, vi } from "vitest";
+import { buildElevatedPowerShell, buildUnlockServiceAdminScript, encodePowerShell, parseUnlockServiceStatus, runUnlockServiceCommand, unlockServiceExecutable, } from "./unlock-service.js";
+function result(stdout = "", status = 0, stderr = "") {
+    return { pid: 1, output: [null, stdout, stderr], stdout, stderr, status, signal: null, error: undefined };
+}
+describe("Windows unlock service command", () => {
+    it("builds an elevated install script without putting credentials on disk or the command line", () => {
+        const executable = "C:\\Program Files\\AgentRoam\\agentroam-remote-unlock.exe";
+        const admin = buildUnlockServiceAdminScript("install", executable);
+        expect(admin).toContain("New-Service");
+        expect(admin).toContain("AgentRoamUnlock");
+        expect(admin).toContain(`'${executable}'`);
+        expect(admin).toContain('"C:\\Program Files\\AgentRoam\\agentroam-remote-unlock.exe" --service');
+        const elevated = buildElevatedPowerShell(admin);
+        expect(elevated).toContain("-Verb RunAs");
+        expect(elevated).toContain("-EncodedCommand");
+        expect(Buffer.from(encodePowerShell(admin), "base64").toString("utf16le")).toBe(admin);
+    });
+    it("reports localized status messages and validates post-install state", () => {
+        const runner = vi.fn()
+            .mockReturnValueOnce(result())
+            .mockReturnValueOnce(result("running\r\n"));
+        const log = vi.fn();
+        runUnlockServiceCommand("install", "C:\\runtime", { platform: "win32", runner, log });
+        expect(unlockServiceExecutable("C:\\runtime")).toMatch(/agentroam-remote-unlock\.exe$/);
+        expect(runner).toHaveBeenCalledTimes(2);
+        expect(log).toHaveBeenCalledWith("远程解锁服务已安装并启动");
+    });
+    it("fails closed on unsupported platforms, canceled elevation, and unknown status output", () => {
+        expect(() => runUnlockServiceCommand("status", "/runtime", { platform: "darwin" })).toThrow("仅支持 Windows");
+        expect(() => runUnlockServiceCommand("install", "C:\\runtime", {
+            platform: "win32",
+            runner: () => result("", 1, "canceled"),
+        })).toThrow("canceled");
+        expect(() => parseUnlockServiceStatus("paused")).toThrow("无法读取");
+    });
+});

package/install/install-agentroam.ps1

@@ -4,7 +4,7 @@ $ProgressPreference = "SilentlyContinue"
 $NodeVersion = "22.22.0"
 $MinimumNodeVersion = "22.22.0"
 # 默认跟随 npm preview 最新标签；可用 $env:AGENTROAM_VERSION 钉精确版本
-# 例如：$env:AGENTROAM_VERSION = "0.2.0-preview.23"; ./install-agentroam.ps1
+# 例如：$env:AGENTROAM_VERSION = "0.2.0-preview.25"; ./install-agentroam.ps1
 $AgentRoamVersionRequest = if ($env:AGENTROAM_VERSION) { $env:AGENTROAM_VERSION } else { "preview" }
 $AgentRoamVersion = "pending-version"
 $NodeArchive = "node-v22.22.0-win-x64.zip"

package/install/install-agentroam.sh

@@ -4,7 +4,7 @@ set -eu
 NODE_VERSION="22.22.0"
 MINIMUM_NODE_VERSION="22.22.0"
 # Default to the newest published preview; pin an exact version via
-# AGENTROAM_VERSION=0.2.0-preview.23 sh install-agentroam.sh
+# AGENTROAM_VERSION=0.2.0-preview.25 sh install-agentroam.sh
 AGENTROAM_VERSION_REQUEST="${AGENTROAM_VERSION:-preview}"
 AGENTROAM_VERSION=""
 NODE_ARCHIVE="node-v22.22.0-darwin-arm64.tar.xz"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentroam",
-  "version": "0.2.0-preview.23",
+  "version": "0.2.0-preview.25",
   "description": "Zero-install mobile remote terminal and file console",
   "type": "module",
   "bin": {
@@ -26,12 +26,12 @@
     "undici": "^6.25.0"
   },
   "optionalDependencies": {
-    "agentroam-runtime-darwin-arm64": "0.2.0-preview.23",
-    "agentroam-runtime-win32-x64": "0.2.0-preview.23",
-    "agentroam-cloudflared-darwin-arm64": "0.2.0-preview.20",
-    "agentroam-cloudflared-win32-x64": "0.2.0-preview.20",
-    "agentroam-tui-darwin-arm64": "0.2.0-preview.20",
-    "@caoqu/agentroam-tui-win32-x64": "0.2.0-preview.20"
+    "agentroam-runtime-darwin-arm64": "0.2.0-preview.25",
+    "agentroam-runtime-win32-x64": "0.2.0-preview.25",
+    "agentroam-cloudflared-darwin-arm64": "0.2.0-preview.25",
+    "agentroam-cloudflared-win32-x64": "0.2.0-preview.25",
+    "agentroam-tui-darwin-arm64": "0.2.0-preview.25",
+    "@caoqu/agentroam-tui-win32-x64": "0.2.0-preview.25"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",