agentroam 0.2.0-preview.24 → 0.2.0-preview.26

package/bin/node-preflight.mjs

@@ -7,7 +7,7 @@ import { promisify } from "node:util";
 import { MINIMUM_NODE_VERSION, compareNodeVersions, isSupportedNodeVersion, parseNodeVersion } from "./runtime-policy.mjs";
 
 const execFileAsync = promisify(execFile);
-const RELEASE_VERSION = "0.2.0-preview.24";
+const RELEASE_VERSION = "0.2.0-preview.26";
 const RELEASE_BASE_URL = `https://gitee.com/caoqu/team-agent/releases/download/v${RELEASE_VERSION}`;
 const FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 

package/dist/args.js

@@ -3,10 +3,11 @@ import { resolve } from "node:path";
 export function parseArgs(argv) {
     const values = [...argv];
     let command = "start";
-    if (values[0] && ["start", "doctor", "version", "service", "update", "update-worker", "pair", "devices", "revoke", "approvals", "approve", "deny", "lock", "unlock", "audit"].includes(values[0])) {
+    if (values[0] && ["start", "doctor", "version", "service", "unlock-service", "update", "update-worker", "pair", "devices", "revoke", "approvals", "approve", "deny", "lock", "unlock", "audit"].includes(values[0])) {
         command = values.shift();
     }
     let serviceAction = null;
+    let unlockServiceAction = null;
     if (command === "service") {
         const action = values.shift();
         if (!action || !["install", "start", "stop", "status", "url", "logs", "restart", "uninstall"].includes(action)) {
@@ -17,6 +18,13 @@ export function parseArgs(argv) {
             throw cliError(`service ${serviceAction} does not accept options`);
         }
     }
+    if (command === "unlock-service") {
+        const action = values.shift();
+        if (!action || !["install", "uninstall", "status"].includes(action) || values.length > 0) {
+            throw cliError("unlock-service requires install, uninstall, or status and accepts no options");
+        }
+        unlockServiceAction = action;
+    }
     let revokeDeviceId = null;
     let revokeAll = false;
     if (command === "revoke") {
@@ -47,6 +55,7 @@ export function parseArgs(argv) {
     const options = {
         command,
         serviceAction,
+        unlockServiceAction,
         roots: [],
         port: null,
         relay: "auto",

package/dist/args.test.js

@@ -6,9 +6,18 @@ describe("parseArgs", () => {
         const value = parseArgs([]);
         expect(value.command).toBe("start");
         expect(value.serviceAction).toBeNull();
+        expect(value.unlockServiceAction).toBeNull();
         expect(value.roots).toEqual([process.cwd()]);
         expect(value.relay).toBe("auto");
     });
+    it("parses Windows unlock service actions", () => {
+        for (const action of ["install", "uninstall", "status"]) {
+            expect(parseArgs(["unlock-service", action])).toMatchObject({ command: "unlock-service", unlockServiceAction: action });
+        }
+        expect(() => parseArgs(["unlock-service"])).toThrow("requires install");
+        expect(() => parseArgs(["unlock-service", "restart"])).toThrow("requires install");
+        expect(() => parseArgs(["unlock-service", "status", "--data-dir", "/tmp/x"])).toThrow("accepts no options");
+    });
     it("parses every supported relay", () => {
         expect(parseArgs(["--relay", "cloudflare"]).relay).toBe("cloudflare");
         expect(parseArgs(["--relay", "pinggy"]).relay).toBe("pinggy");

package/dist/cli.js

@@ -1,6 +1,7 @@
 import { printLocalDesktopUrl } from './local-desktop-url.js';
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
+import { join } from "node:path";
 import { parseArgs } from "./args.js";
 import { ensureCloudflared } from "./cloudflared/installer.js";
 import { resolveCodexRuntime } from "./codex-runtime-manager.js";
@@ -18,6 +19,8 @@ import { selectRelay } from "./tunnel/relay-orchestrator.js";
 import { currentCliPath, startUpdate } from "./update/update-command.js";
 import { runUpdateWorker } from "./update/update-worker.js";
 import { lockInstanceStartup, stopPreviousInstances } from "./instance-takeover.js";
+import { runUnlockServiceCommand } from "./unlock-service.js";
+import { createCliErrorLog } from "./error-log.js";
 const VERSION = AGENTROAM_VERSION;
 export async function main(argv) {
     if (argv.includes("--help") || argv.includes("-h")) {
@@ -35,10 +38,16 @@ export async function main(argv) {
   agentroam revoke <设备ID>          移除一台设备
   agentroam revoke --all            全部退出并取消待用配对码
   agentroam service install|start|stop|restart|status|url|logs|uninstall
+  agentroam unlock-service install|uninstall|status  管理 Windows 远程解锁服务（安装时弹出 UAC）
 设备命令支持 --data-dir PATH；配对码有效期 5 分钟，设备授权有效期 30 天。`);
         return;
     }
     const options = parseArgs(argv);
+    // CLI 进程自身的按天错误日志:<dataDir>/logs/YYYY-MM-DD.log(NDJSON,与
+    // server/desktop 的 core logger 同格式)。uncaughtException 记录后按默认
+    // 语义退出(1),unhandledRejection 只记录。
+    const cliErrorLog = createCliErrorLog(join(options.dataDir, "logs"));
+    cliErrorLog.installGlobalErrorHandlers();
     if (["pair", "devices", "revoke", "approvals", "approve", "deny", "lock", "unlock", "audit"].includes(options.command)) {
         const dataDir = argv.includes("--data-dir") ? options.dataDir : await installedDataDir(options.dataDir);
         if (options.command === "pair")
@@ -83,6 +92,12 @@ export async function main(argv) {
         return;
     }
     const target = detectPlatform();
+    if (options.command === "unlock-service") {
+        if (target !== "windows-amd64")
+            throw new Error("远程解锁服务仅支持 Windows 10/11 x64");
+        runUnlockServiceCommand(options.unlockServiceAction, resolvePlatformRuntime(target).runtimeRoot);
+        return;
+    }
     if (options.command === "update") {
         if (target !== "darwin-arm64" && target !== "windows-amd64")
             throw new Error(`updates are unavailable for ${target}`);

package/dist/error-log.js

@@ -0,0 +1,113 @@
+import { appendFileSync, existsSync, mkdirSync, readdirSync, statSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+// Self-contained daily error log for the CLI process. The CLI cannot depend
+// on @agent/core (it ships as a thin launcher), so this mirrors the exact
+// NDJSON entry format of core's DailyFileLogger
+// (`{ts, level, source, message, error?, data?}`) into `<dataDir>/logs/`.
+// It records uncaughtException / unhandledRejection so launcher failures are
+// strictly persisted, matching the server/desktop log series.
+const LEVELS = new Set(["debug", "info", "warn", "error", "fatal"]);
+function localDateString(date) {
+    const y = date.getFullYear();
+    const m = String(date.getMonth() + 1).padStart(2, "0");
+    const d = String(date.getDate()).padStart(2, "0");
+    return `${y}-${m}-${d}`;
+}
+function serializeError(err) {
+    if (err === undefined || err === null)
+        return undefined;
+    if (err instanceof Error) {
+        const out = { name: err.name, message: err.message };
+        if (err.stack)
+            out.stack = err.stack;
+        return out;
+    }
+    if (typeof err === "object") {
+        const anyErr = err;
+        const out = {
+            name: typeof anyErr.name === "string" ? anyErr.name : "NonError",
+            message: typeof anyErr.message === "string" ? anyErr.message : String(err),
+        };
+        if (typeof anyErr.stack === "string")
+            out.stack = anyErr.stack;
+        return out;
+    }
+    return { name: "NonError", message: String(err) };
+}
+function safeStringify(value) {
+    try {
+        return JSON.stringify(value) ?? "null";
+    }
+    catch {
+        return '"[unserializable]"';
+    }
+}
+export function createCliErrorLog(logsDir) {
+    let reportedWriteFailure = false;
+    const write = (line) => {
+        try {
+            if (!existsSync(logsDir))
+                mkdirSync(logsDir, { recursive: true });
+            appendFileSync(join(logsDir, `${localDateString(new Date())}.log`), line, "utf8");
+        }
+        catch {
+            if (!reportedWriteFailure) {
+                reportedWriteFailure = true;
+                try {
+                    process.stderr.write(`[agentroam] failed to write error log to ${logsDir}; further failures are silent\n`);
+                }
+                catch { /* stderr gone */ }
+            }
+        }
+    };
+    const cleanupOldFiles = () => {
+        // 30-day retention, aligned with the core logger default. Best effort.
+        try {
+            if (!existsSync(logsDir))
+                return;
+            const cutoff = Date.now() - 30 * 24 * 60 * 60 * 1000;
+            for (const name of readdirSync(logsDir)) {
+                if (!/^\d{4}-\d{2}-\d{2}\.log$/.test(name))
+                    continue;
+                const full = join(logsDir, name);
+                try {
+                    if (statSync(full).mtimeMs < cutoff)
+                        unlinkSync(full);
+                }
+                catch { /* concurrent removal */ }
+            }
+        }
+        catch { /* best effort */ }
+    };
+    const log = (level, message, error, data) => {
+        if (!LEVELS.has(level))
+            level = "error";
+        const entry = {
+            ts: new Date().toISOString(),
+            level,
+            source: "cli",
+            message: typeof message === "string" ? message.slice(0, 4000) : String(message),
+        };
+        const serialized = serializeError(error);
+        if (serialized)
+            entry.error = serialized;
+        if (data !== undefined)
+            entry.data = data;
+        write(`${safeStringify(entry)}\n`);
+    };
+    return {
+        log,
+        installGlobalErrorHandlers: (options = {}) => {
+            const exitOnUncaughtException = options.exitOnUncaughtException ?? true;
+            process.on("uncaughtException", (err) => {
+                log("fatal", "uncaughtException", err);
+                if (exitOnUncaughtException)
+                    process.exit(1);
+            });
+            process.on("unhandledRejection", (reason) => {
+                log("error", "unhandledRejection", reason);
+            });
+            cleanupOldFiles();
+        },
+    };
+}

package/dist/platform-packages.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname } from "node:path";
 import { MINIMUM_NODE_VERSION, assertSupportedNodeVersion } from "../bin/runtime-policy.mjs";
-export const AGENTROAM_VERSION = "0.2.0-preview.24";
+export const AGENTROAM_VERSION = "0.2.0-preview.26";
 export const PLATFORM_DEPENDENCY_VERSIONS = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).optionalDependencies;
 export const PLATFORM_PACKAGES = {
     "darwin-arm64": {

package/dist/runtime-manager.js

@@ -36,6 +36,9 @@ export class RuntimeManager {
                 PORT: String(port),
                 HOST: options.localOnly ? "0.0.0.0" : "127.0.0.1",
                 AGENT_DATA_DIR: resolve(dataDir, "data"),
+                // 应用日志收口到 <dataDir>/logs,与 launchd 的 service.stdout/stderr.log
+                // 及 CLI 自身的错误日志同一个目录,用户排障时只需打包这一处。
+                AGENT_LOG_DIR: resolve(dataDir, "logs"),
                 AGENT_WEB_ROOTS: options.roots.join(delimiter),
                 AGENT_TRUST_TUNNEL_PROXY: "1",
                 AGENTROAM_VERSION: resolvePlatformRuntime(target).manifest.packageVersion,

package/dist/service/service-command.test.js

@@ -164,6 +164,7 @@ function options(serviceAction) {
     return {
         command: "service",
         serviceAction,
+        unlockServiceAction: null,
         roots: [resolve("workspace")],
         port: null,
         relay: "auto",

package/dist/tunnel/public-readiness.js

@@ -22,7 +22,7 @@ export async function waitForPublicReadiness(publicUrl, options = {}) {
             try {
                 const response = await fetchImpl(endpoint, {
                     cache: "no-store",
-                    headers: { "user-agent": "agentroam-readiness/0.2.0-preview.24" },
+                    headers: { "user-agent": "agentroam-readiness/0.2.0-preview.26" },
                     signal: options.signal,
                 });
                 if (response.ok) {

package/dist/tunnel/relay-orchestrator.test.js

@@ -61,6 +61,7 @@ function cli(relay, localOnly = false) {
     return {
         command: "start",
         serviceAction: null,
+        unlockServiceAction: null,
         roots: [process.cwd()],
         port: null,
         relay,

package/dist/unlock-service.js

@@ -0,0 +1,97 @@
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+const SERVICE_NAME = "AgentRoamUnlock";
+const DISPLAY_NAME = "AgentRoam Remote Unlock";
+function psQuote(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+export function encodePowerShell(script) {
+    return Buffer.from(script, "utf16le").toString("base64");
+}
+export function unlockServiceExecutable(runtimeRoot) {
+    return resolve(runtimeRoot, "native", "agentroam-remote-unlock.exe");
+}
+export function buildUnlockServiceAdminScript(action, executable) {
+    const common = `$ErrorActionPreference = 'Stop'\n$serviceName = '${SERVICE_NAME}'`;
+    if (action === "uninstall") {
+        return `${common}
+$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
+if ($service) {
+  if ($service.Status -ne 'Stopped') { Stop-Service -Name $serviceName -Force -ErrorAction Stop }
+  & "$env:SystemRoot\\System32\\sc.exe" delete $serviceName | Out-Null
+  if ($LASTEXITCODE -ne 0) { throw "sc.exe delete failed: $LASTEXITCODE" }
+}
+`;
+    }
+    const binaryPath = `\"${executable}\" --service`;
+    return `${common}
+$binary = ${psQuote(executable)}
+if (-not (Test-Path -LiteralPath $binary -PathType Leaf)) { throw "Remote unlock helper is missing: $binary" }
+$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
+if ($service) {
+  if ($service.Status -ne 'Stopped') { Stop-Service -Name $serviceName -Force -ErrorAction Stop }
+  & "$env:SystemRoot\\System32\\sc.exe" delete $serviceName | Out-Null
+  if ($LASTEXITCODE -ne 0) { throw "sc.exe delete failed: $LASTEXITCODE" }
+  for ($attempt = 0; $attempt -lt 50 -and (Get-Service -Name $serviceName -ErrorAction SilentlyContinue); $attempt++) { Start-Sleep -Milliseconds 100 }
+}
+New-Service -Name $serviceName -BinaryPathName ${psQuote(binaryPath)} -DisplayName '${DISPLAY_NAME}' -StartupType Automatic | Out-Null
+& "$env:SystemRoot\\System32\\sc.exe" description $serviceName "Allows an authorized AgentRoam session to wake and unlock the Windows secure desktop." | Out-Null
+Start-Service -Name $serviceName -ErrorAction Stop
+`;
+}
+export function buildElevatedPowerShell(adminScript) {
+    const payload = encodePowerShell(adminScript);
+    return `$ErrorActionPreference = 'Stop'
+$powershell = Join-Path $PSHOME 'powershell.exe'
+$process = Start-Process -FilePath $powershell -Verb RunAs -Wait -PassThru -ArgumentList @('-NoLogo','-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-EncodedCommand','${payload}')
+exit $process.ExitCode
+`;
+}
+export function parseUnlockServiceStatus(output) {
+    const value = output.trim().split(/\r?\n/).at(-1)?.trim().toLowerCase();
+    if (value === "running" || value === "stopped" || value === "missing")
+        return value;
+    throw new Error("无法读取远程解锁服务状态");
+}
+function runPowerShell(script, runner) {
+    return runner("powershell.exe", [
+        "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
+        "-EncodedCommand", encodePowerShell(script),
+    ], { encoding: "utf8", windowsHide: true });
+}
+export function queryUnlockServiceStatus(runner = spawnSync) {
+    const script = `$service = Get-Service -Name '${SERVICE_NAME}' -ErrorAction SilentlyContinue
+if (-not $service) { Write-Output 'missing' } elseif ($service.Status -eq 'Running') { Write-Output 'running' } else { Write-Output 'stopped' }
+`;
+    const result = runPowerShell(script, runner);
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error((result.stderr || "远程解锁服务状态查询失败").trim());
+    return parseUnlockServiceStatus(result.stdout || "");
+}
+export function runUnlockServiceCommand(action, runtimeRoot, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const runner = options.runner ?? spawnSync;
+    const log = options.log ?? console.log;
+    if (platform !== "win32")
+        throw new Error("远程解锁服务仅支持 Windows 10/11 x64");
+    if (action === "status") {
+        const status = queryUnlockServiceStatus(runner);
+        log(status === "running" ? "远程解锁服务正在运行" : status === "stopped" ? "远程解锁服务已安装但未运行" : "远程解锁服务未安装");
+        return;
+    }
+    const executable = unlockServiceExecutable(runtimeRoot);
+    const result = runPowerShell(buildElevatedPowerShell(buildUnlockServiceAdminScript(action, executable)), runner);
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw new Error((result.stderr || (action === "install" ? "远程解锁服务安装失败或已取消管理员授权" : "远程解锁服务卸载失败或已取消管理员授权")).trim());
+    }
+    const status = queryUnlockServiceStatus(runner);
+    if (action === "install" && status !== "running")
+        throw new Error("远程解锁服务安装后未能启动");
+    if (action === "uninstall" && status !== "missing")
+        throw new Error("远程解锁服务卸载后仍然存在");
+    log(action === "install" ? "远程解锁服务已安装并启动" : "远程解锁服务已卸载");
+}

package/dist/unlock-service.test.js

@@ -0,0 +1,37 @@
+import { describe, expect, it, vi } from "vitest";
+import { buildElevatedPowerShell, buildUnlockServiceAdminScript, encodePowerShell, parseUnlockServiceStatus, runUnlockServiceCommand, unlockServiceExecutable, } from "./unlock-service.js";
+function result(stdout = "", status = 0, stderr = "") {
+    return { pid: 1, output: [null, stdout, stderr], stdout, stderr, status, signal: null, error: undefined };
+}
+describe("Windows unlock service command", () => {
+    it("builds an elevated install script without putting credentials on disk or the command line", () => {
+        const executable = "C:\\Program Files\\AgentRoam\\agentroam-remote-unlock.exe";
+        const admin = buildUnlockServiceAdminScript("install", executable);
+        expect(admin).toContain("New-Service");
+        expect(admin).toContain("AgentRoamUnlock");
+        expect(admin).toContain(`'${executable}'`);
+        expect(admin).toContain('"C:\\Program Files\\AgentRoam\\agentroam-remote-unlock.exe" --service');
+        const elevated = buildElevatedPowerShell(admin);
+        expect(elevated).toContain("-Verb RunAs");
+        expect(elevated).toContain("-EncodedCommand");
+        expect(Buffer.from(encodePowerShell(admin), "base64").toString("utf16le")).toBe(admin);
+    });
+    it("reports localized status messages and validates post-install state", () => {
+        const runner = vi.fn()
+            .mockReturnValueOnce(result())
+            .mockReturnValueOnce(result("running\r\n"));
+        const log = vi.fn();
+        runUnlockServiceCommand("install", "C:\\runtime", { platform: "win32", runner, log });
+        expect(unlockServiceExecutable("C:\\runtime")).toMatch(/agentroam-remote-unlock\.exe$/);
+        expect(runner).toHaveBeenCalledTimes(2);
+        expect(log).toHaveBeenCalledWith("远程解锁服务已安装并启动");
+    });
+    it("fails closed on unsupported platforms, canceled elevation, and unknown status output", () => {
+        expect(() => runUnlockServiceCommand("status", "/runtime", { platform: "darwin" })).toThrow("仅支持 Windows");
+        expect(() => runUnlockServiceCommand("install", "C:\\runtime", {
+            platform: "win32",
+            runner: () => result("", 1, "canceled"),
+        })).toThrow("canceled");
+        expect(() => parseUnlockServiceStatus("paused")).toThrow("无法读取");
+    });
+});

package/install/install-agentroam.ps1

@@ -4,7 +4,7 @@ $ProgressPreference = "SilentlyContinue"
 $NodeVersion = "22.22.0"
 $MinimumNodeVersion = "22.22.0"
 # 默认跟随 npm preview 最新标签；可用 $env:AGENTROAM_VERSION 钉精确版本
-# 例如：$env:AGENTROAM_VERSION = "0.2.0-preview.24"; ./install-agentroam.ps1
+# 例如：$env:AGENTROAM_VERSION = "0.2.0-preview.26"; ./install-agentroam.ps1
 $AgentRoamVersionRequest = if ($env:AGENTROAM_VERSION) { $env:AGENTROAM_VERSION } else { "preview" }
 $AgentRoamVersion = "pending-version"
 $NodeArchive = "node-v22.22.0-win-x64.zip"

package/install/install-agentroam.sh

@@ -4,7 +4,7 @@ set -eu
 NODE_VERSION="22.22.0"
 MINIMUM_NODE_VERSION="22.22.0"
 # Default to the newest published preview; pin an exact version via
-# AGENTROAM_VERSION=0.2.0-preview.24 sh install-agentroam.sh
+# AGENTROAM_VERSION=0.2.0-preview.26 sh install-agentroam.sh
 AGENTROAM_VERSION_REQUEST="${AGENTROAM_VERSION:-preview}"
 AGENTROAM_VERSION=""
 NODE_ARCHIVE="node-v22.22.0-darwin-arm64.tar.xz"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentroam",
-  "version": "0.2.0-preview.24",
+  "version": "0.2.0-preview.26",
   "description": "Zero-install mobile remote terminal and file console",
   "type": "module",
   "bin": {
@@ -26,12 +26,12 @@
     "undici": "^6.25.0"
   },
   "optionalDependencies": {
-    "agentroam-runtime-darwin-arm64": "0.2.0-preview.24",
-    "agentroam-runtime-win32-x64": "0.2.0-preview.24",
-    "agentroam-cloudflared-darwin-arm64": "0.2.0-preview.24",
-    "agentroam-cloudflared-win32-x64": "0.2.0-preview.24",
-    "agentroam-tui-darwin-arm64": "0.2.0-preview.24",
-    "@caoqu/agentroam-tui-win32-x64": "0.2.0-preview.24"
+    "agentroam-runtime-darwin-arm64": "0.2.0-preview.26",
+    "agentroam-runtime-win32-x64": "0.2.0-preview.26",
+    "agentroam-cloudflared-darwin-arm64": "0.2.0-preview.26",
+    "agentroam-cloudflared-win32-x64": "0.2.0-preview.26",
+    "agentroam-tui-darwin-arm64": "0.2.0-preview.26",
+    "@caoqu/agentroam-tui-win32-x64": "0.2.0-preview.26"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",