import { afterEach, describe, expect, it } from "@effect/vitest"; import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; import { cmdSetValue, generateLaunchdPlist, generateSystemdUnit, generateWindowsDaemonWrapper, generateWindowsHiddenLauncherVbs, generateWindowsTaskXml, getServiceBackend, parseNetstatListenerPids, parseSchtasksRunning, } from "./service"; const tempDirs: Array = []; afterEach(() => { for (const dir of tempDirs.splice(0)) { rmSync(dir, { recursive: true, force: true }); } }); describe("service unit generation", () => { const launchdInput = { label: "sh.executor.daemon", programArguments: [ "/Applications/Executor.app/Contents/Resources/executor/executor", "daemon", "run", "--foreground", "--port", "4789", "--hostname", "127.0.0.1", ], environment: { EXECUTOR_SUPERVISED: "1", EXECUTOR_DATA_DIR: "/Users/x/.executor", EXECUTOR_SERVICE_VERSION: "1.5.10", PATH: "/opt/homebrew/bin:/usr/bin", }, stdoutPath: "/Users/x/.executor/logs/daemon.log", stderrPath: "/Users/x/.executor/logs/daemon.error.log", workingDirectory: "/Users/x/.executor", }; const makeExecutorBundle = (bundleIdentifier: string): string => { const root = mkdtempSync(join(tmpdir(), "executor-launchd-bundle-")); tempDirs.push(root); const contentsDir = join(root, "Executor.app", "Contents"); const executableDir = join(contentsDir, "Resources", "executor"); mkdirSync(executableDir, { recursive: true }); writeFileSync( join(contentsDir, "Info.plist"), ` CFBundleIdentifier ${bundleIdentifier} `, ); return join(executableDir, "executor"); }; const expectLaunchdInvariants = (plist: string, input: typeof launchdInput): void => { const programArguments = input.programArguments .map((arg) => ` ${arg}`) .join("\n"); expect(plist).toContain("Label"); expect(plist).toContain(`${input.label}`); expect(plist).toContain( ` ProgramArguments\n \n${programArguments}\n `, ); expect(plist).toMatch(/RunAtLoad<\/key>\s*/); expect(plist).toMatch( /KeepAlive<\/key>\s*\s*SuccessfulExit<\/key>\s*\s*<\/dict>/, ); }; it("renders a launchd plist that restarts on crash but not clean stop", () => { const plist = generateLaunchdPlist(launchdInput); expectLaunchdInvariants(plist, launchdInput); expect(plist).toContain(''); // KeepAlive => restart only on non-zero/crash exit, not on a clean bootout. expect(plist).toContain("SuccessfulExit"); expect(plist).toContain("ProcessType"); expect(plist).toContain("Background"); expect(plist).toContain("--foreground"); expect(plist).toContain("EXECUTOR_SUPERVISED"); expect(plist).toContain("/Users/x/.executor/logs/daemon.error.log"); }); it("never leaks the auth password into the unit", () => { const plist = generateLaunchdPlist(launchdInput); // No secret in the unit — the daemon reads the bearer from auth.json at boot. expect(plist).not.toContain("EXECUTOR_AUTH_PASSWORD"); }); it("associates an app-bundled launchd plist with the enclosing bundle identifier", () => { const executablePath = makeExecutorBundle("sh.executor.desktop.test"); const input = { ...launchdInput, programArguments: [executablePath, ...launchdInput.programArguments.slice(1)], }; const plist = generateLaunchdPlist(input); expectLaunchdInvariants(plist, input); expect(plist.match(/AssociatedBundleIdentifiers<\/key>/g)).toHaveLength(1); expect(plist).toMatch( /\s*Label<\/key>\s*sh\.executor\.daemon<\/string>\s*AssociatedBundleIdentifiers<\/key>\s*\s*sh\.executor\.desktop\.test<\/string>\s*<\/array>\s*ProgramArguments<\/key>/, ); }); it("omits app association for standalone launchd binaries", () => { const input = { ...launchdInput, programArguments: ["/usr/local/bin/executor", ...launchdInput.programArguments.slice(1)], }; const plist = generateLaunchdPlist(input); expectLaunchdInvariants(plist, input); expect(plist).not.toContain("AssociatedBundleIdentifiers"); }); it("xml-escapes environment values", () => { const plist = generateLaunchdPlist({ ...launchdInput, environment: { PATH: "a&b\"d'" }, }); expect(plist).toContain("a&b<c>"d'"); expect(plist).not.toMatch(/a&b/); }); it("renders a systemd --user unit with crash-only restart", () => { const unit = generateSystemdUnit({ execStart: [ "/usr/local/bin/executor", "daemon", "run", "--foreground", "--port", "4789", "--hostname", "127.0.0.1", ], environment: { EXECUTOR_SUPERVISED: "1", EXECUTOR_DATA_DIR: "/home/x/.executor" }, workingDirectory: "/home/x/.executor", stdoutPath: "/home/x/.executor/logs/daemon.log", stderrPath: "/home/x/.executor/logs/daemon.error.log", }); expect(unit).toContain( "ExecStart=/usr/local/bin/executor daemon run --foreground --port 4789 --hostname 127.0.0.1", ); expect(unit).toContain("Restart=on-failure"); expect(unit).toContain("WantedBy=default.target"); expect(unit).toContain("Environment=EXECUTOR_SUPERVISED=1"); expect(unit).not.toContain("EXECUTOR_AUTH_PASSWORD"); }); it("bakes the supervised env into the Windows wrapper .cmd", () => { const wrapper = generateWindowsDaemonWrapper( { executablePath: "C:\\Program Files\\Executor\\executor.exe", port: 4789, version: "1.5.10", }, "C:\\Users\\x\\.executor", "C:\\Users\\x\\.executor\\logs", ); // Task Scheduler can't set env, so it rides as `set` lines in the wrapper. expect(wrapper).toContain('set "EXECUTOR_SUPERVISED=1"'); expect(wrapper).toContain('set "EXECUTOR_DATA_DIR=C:\\Users\\x\\.executor"'); expect(wrapper).toContain( '"C:\\Program Files\\Executor\\executor.exe" daemon run --foreground --port 4789 --hostname 127.0.0.1', ); expect(wrapper).toContain('1>> "C:\\Users\\x\\.executor\\logs\\daemon.log"'); // No secret in the wrapper — the daemon reads the bearer from auth.json at boot. expect(wrapper).not.toContain("EXECUTOR_AUTH_PASSWORD"); }); it("sanitizes cmd.exe metacharacters in baked env values (cmdSetValue)", () => { // A `"` in PATH would close the `set "PATH=..."` quote early and let a // `& cmd &` fragment run at boot as the user; strip it (illegal in a path // anyway). A `%` would re-expand against the boot environment; double it. expect(cmdSetValue('C:\\a" & evil & "C:\\b')).toBe("C:\\a & evil & C:\\b"); expect(cmdSetValue("C:\\tools\\%LOCALAPPDATA%\\bin")).toBe("C:\\tools\\%%LOCALAPPDATA%%\\bin"); expect(cmdSetValue("C:\\Program Files\\node")).toBe("C:\\Program Files\\node"); // The sanitized value, embedded in a `set` line, can't break out of quotes. expect(`set "PATH=${cmdSetValue('a"&b')}"`).not.toMatch(/"\s*&/); }); it("defaults to a per-user logon task that needs no elevation", () => { const xml = generateWindowsTaskXml({ command: "wscript.exe", arguments: '"C:\\Users\\x\\.executor\\server-control\\run-daemon.vbs"', userId: "HOST\\x", }); // LogonTrigger + InteractiveToken + LeastPrivilege = run as the user at their // own logon, unprivileged. A standard user may register this without admin. expect(xml).toContain("trueHOST\\x"); expect(xml).toContain("InteractiveToken"); expect(xml).toContain("LeastPrivilege"); // The default path must NOT use the admin-only Boot/S4U/Highest knobs. expect(xml).not.toContain("BootTrigger"); expect(xml).not.toContain("S4U"); expect(xml).not.toContain("HighestAvailable"); expect(xml).toContain("PT1M3"); expect(xml).toContain("wscript.exe"); expect(xml).toContain("run-daemon.vbs""); }); it("registers a boot-triggered S4U task under --boot (the reboot-survival contract)", () => { const xml = generateWindowsTaskXml({ command: "wscript.exe", arguments: '"C:\\Users\\x\\.executor\\server-control\\run-daemon.vbs"', userId: "HOST\\x", boot: true, }); // BootTrigger + S4U + HighestAvailable = run as the user, at boot, no stored // password, no logon. Task Scheduler only lets an elevated shell create this. expect(xml).toContain("true"); expect(xml).toContain("S4U"); expect(xml).toContain("HighestAvailable"); expect(xml).not.toContain("LogonTrigger"); expect(xml).not.toContain("InteractiveToken"); }); it("hides the daemon console via a wait-and-propagate wscript shim", () => { const vbs = generateWindowsHiddenLauncherVbs( "C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd", ); // Run(cmd, 0, True): 0 = hidden window, True = wait so the task stays Running // and the wrapper's exit code propagates (preserving RestartOnFailure). expect(vbs).toContain( 'sh.Run("""C:\\Users\\x\\.executor\\server-control\\run-daemon.cmd""", 0, True)', ); expect(vbs).toContain("WScript.Quit rc"); }); it("parses LISTENING pids for the service port from netstat output", () => { const netstat = [ "Active Connections", " Proto Local Address Foreign Address State PID", " TCP 127.0.0.1:4789 0.0.0.0:0 LISTENING 4072", " TCP 127.0.0.1:4789 127.0.0.1:51000 ESTABLISHED 4072", " TCP [::1]:4789 [::]:0 LISTENING 4072", " TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4", " TCP 127.0.0.1:8765 0.0.0.0:0 LISTENING 9999", ].join("\r\n"); expect(parseNetstatListenerPids(netstat, 4789)).toEqual([4072]); // A connection in another state on the port must not be treated as a listener. expect(parseNetstatListenerPids(netstat, 445)).toEqual([4]); expect(parseNetstatListenerPids(netstat, 1234)).toEqual([]); }); it("identifies listeners by wildcard remote, so it survives a localized state column", () => { // German netstat: the state word is "ABHÖREN"/"HERGESTELLT", but addresses and // "TCP" are not localized. Listener detection must not depend on the word. const deNetstat = [ "Aktive Verbindungen", " Proto Lokale Adresse Remoteadresse Status PID", " TCP 127.0.0.1:4789 0.0.0.0:0 ABHÖREN 4072", " TCP 127.0.0.1:4789 127.0.0.1:51000 HERGESTELLT 8000", ].join("\r\n"); expect(parseNetstatListenerPids(deNetstat, 4789)).toEqual([4072]); }); it("detects a running task via the locale-invariant result code, not the Status word", () => { // English verbose LIST output for a running task. const en = [ "TaskName: \\ExecutorDaemon", "Status: Running", "Last Result: 267009", ].join("\r\n"); expect(parseSchtasksRunning(en)).toBe(true); // French Windows: both the label and the status word are translated, but the // SCHED_S_TASK_RUNNING code (267009 / 0x41301) is the same. const fr = [ "Nom de tâche: \\ExecutorDaemon", "État: En cours d'exécution", "Dernier résultat: 267009", ].join("\r\n"); expect(parseSchtasksRunning(fr)).toBe(true); // A ready/terminated task (267014 = SCHED_S_TASK_TERMINATED) is not running. const ready = ["Status: Ready", "Last Result: 267014"].join( "\r\n", ); expect(parseSchtasksRunning(ready)).toBe(false); // Hex form (some builds/locales) is also recognized. expect(parseSchtasksRunning("Last Result: 0x41301")).toBe(true); }); }); describe("service backend dispatch", () => { it("selects launchd on macOS (automated)", () => { const backend = getServiceBackend("darwin"); expect(backend.platform).toBe("darwin"); expect(backend.automated).toBe(true); }); it("selects systemd on linux (automated)", () => { expect(getServiceBackend("linux").platform).toBe("linux"); }); it("selects Task Scheduler on windows (automated)", () => { const backend = getServiceBackend("win32"); expect(backend.platform).toBe("win32"); expect(backend.automated).toBe(true); }); it("falls back to unsupported on other platforms", () => { expect(getServiceBackend("freebsd").platform).toBe("unsupported"); }); });