feat: execute durable client commands through supervisor

internal/client/supervisor/windows/native_windows.go

@@ -0,0 +1,476 @@
+//go:build windows
+
+package windows
+
+// The Windows adapter deliberately keeps all Win32 handles in this file. The
+// selector in selection.go is pure policy; this layer obtains one verified
+// primary token, creates a suspended child with an explicit handle list, and
+// puts it in a kill-on-close Job before releasing it.
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"sync"
+	"syscall"
+	"time"
+	"unsafe"
+
+	rvboxv1 "github.com/rvbox/rvbox/gen/go/rvbox/v1"
+	"github.com/rvbox/rvbox/internal/client/supervisor"
+	winapi "golang.org/x/sys/windows"
+)
+
+const (
+	logon32LogonService    = 5
+	logon32ProviderDefault = 0
+	securitySystemRID      = "S-1-5-18"
+)
+
+var (
+	advapi32       = syscall.NewLazyDLL("advapi32.dll")
+	procLogonUserW = advapi32.NewProc("LogonUserW")
+)
+
+func stdinLineEnding() []byte { return []byte{'\r', '\n'} }
+
+type nativeHandles struct {
+	process winapi.Handle
+	job     winapi.Handle
+	pid     uint32
+	close   sync.Once
+}
+
+// NewSupervisor constructs the machine-wide Windows implementation. The
+// service process is expected to run as LocalSystem; token selection verifies
+// that assumption when a command is started and records the selected context.
+func NewSupervisor(options NativeOptions) (supervisor.Supervisor, error) {
+	options = options.withDefaults()
+	return newExecSupervisor(options), nil
+}
+
+func (manager *execSupervisor) Start(ctx context.Context, spec supervisor.StartSpec) (supervisor.Process, error) {
+	if err := validateExecutionSource(&spec); err != nil {
+		return nil, err
+	}
+	if spec.Execution.GetShellType() != rvboxv1.ShellType_SHELL_CMD && spec.Execution.GetShellType() != rvboxv1.ShellType_SHELL_POWERSHELL {
+		return nil, ErrUnsupportedShell
+	}
+	manager.mu.Lock()
+	if _, exists := manager.active[spec.IssueUUID]; exists {
+		manager.mu.Unlock()
+		return nil, ErrProcessAlreadyRunning
+	}
+	manager.mu.Unlock()
+
+	plan, err := ResolveShell(spec.Execution.GetShellType(), manager.options.Shells)
+	if err != nil {
+		return nil, err
+	}
+	if err := verifyExecutable(plan.ApplicationName); err != nil {
+		return nil, err
+	}
+	wrapper, err := BuildWrapper(spec.Execution, spec.ScriptBody, manager.options.MaxWrapperBytes)
+	if err != nil {
+		return nil, err
+	}
+	wrapperPath, cleanup, err := materializeWrapper(spec.WorkingDirectory, wrapper, manager.options.Now())
+	if err != nil {
+		return nil, err
+	}
+	fail := func(cause error) (supervisor.Process, error) {
+		if cleanup != nil {
+			cleanup()
+		}
+		return nil, cause
+	}
+
+	token, identity, err := manager.selectToken(spec.Execution.GetElevated())
+	if err != nil {
+		return fail(err)
+	}
+	defer token.Close()
+	baseEnvironment, err := token.Environ(false)
+	if err != nil {
+		return fail(fmt.Errorf("build token environment: %w", err))
+	}
+	environment, err := BuildEnvironmentBlock(parseEnvironment(baseEnvironment), spec.Environment)
+	if err != nil {
+		return fail(err)
+	}
+	launch, err := plan.BuildLaunchPlan(wrapperPath, spec.WorkingDirectory, environment)
+	if err != nil {
+		return fail(err)
+	}
+
+	stdinRead, stdinWrite, stdoutRead, stdoutWrite, stderrRead, stderrWrite, err := createStandardPipes()
+	if err != nil {
+		return fail(err)
+	}
+	closeFiles := func() {
+		for _, file := range []*os.File{stdinRead, stdinWrite, stdoutRead, stdoutWrite, stderrRead, stderrWrite} {
+			if file != nil {
+				_ = file.Close()
+			}
+		}
+	}
+	pipesTransferred := false
+	defer func() {
+		// Parent-side handles are retained only after successful process
+		// creation. Any error path closes both ends here.
+		if !pipesTransferred {
+			closeFiles()
+		}
+	}()
+
+	job, err := createKillOnCloseJob()
+	if err != nil {
+		closeFiles()
+		return fail(fmt.Errorf("create command Job: %w", err))
+	}
+	cleanupJob := true
+	defer func() {
+		if cleanupJob {
+			_ = winapi.CloseHandle(job)
+		}
+	}()
+
+	application, err := winapi.UTF16PtrFromString(launch.ApplicationName)
+	if err != nil {
+		return fail(err)
+	}
+	commandLine, err := winapi.UTF16FromString(launch.CommandLine)
+	if err != nil {
+		return fail(err)
+	}
+	workingDirectory, err := winapi.UTF16PtrFromString(launch.WorkingDirectory)
+	if err != nil {
+		return fail(err)
+	}
+	attributeList, err := winapi.NewProcThreadAttributeList(1)
+	if err != nil {
+		return fail(err)
+	}
+	defer attributeList.Delete()
+	childHandles := []winapi.Handle{winapi.Handle(stdinRead.Fd()), winapi.Handle(stdoutWrite.Fd()), winapi.Handle(stderrWrite.Fd())}
+	if err := attributeList.Update(winapi.PROC_THREAD_ATTRIBUTE_HANDLE_LIST, unsafe.Pointer(&childHandles[0]), uintptr(len(childHandles))*unsafe.Sizeof(childHandles[0])); err != nil {
+		return fail(err)
+	}
+	startup := winapi.StartupInfoEx{}
+	startup.Cb = uint32(unsafe.Sizeof(startup))
+	startup.Flags = winapi.STARTF_USESTDHANDLES | winapi.STARTF_USESHOWWINDOW
+	startup.ShowWindow = winapi.SW_HIDE
+	startup.StdInput = childHandles[0]
+	startup.StdOutput = childHandles[1]
+	startup.StdErr = childHandles[2]
+	startup.ProcThreadAttributeList = attributeList.List()
+	var processInfo winapi.ProcessInformation
+	flags := uint32(winapi.CREATE_NEW_CONSOLE | winapi.CREATE_SUSPENDED | winapi.CREATE_UNICODE_ENVIRONMENT | winapi.EXTENDED_STARTUPINFO_PRESENT)
+	var environmentPointer *uint16
+	if len(environment) > 0 {
+		environmentPointer = &environment[0]
+	}
+	if err := winapi.CreateProcessAsUser(token, application, &commandLine[0], nil, nil, true, flags, environmentPointer, workingDirectory, &startup.StartupInfo, &processInfo); err != nil {
+		return fail(fmt.Errorf("create suspended command process: %w", err))
+	}
+	// The child owns these handles after CreateProcessAsUser returns. Keep only
+	// the three parent ends and the process/job handles in the daemon.
+	_ = stdinRead.Close()
+	_ = stdoutWrite.Close()
+	_ = stderrWrite.Close()
+	if err := winapi.AssignProcessToJobObject(job, processInfo.Process); err != nil {
+		_ = winapi.TerminateProcess(processInfo.Process, 1)
+		_ = winapi.CloseHandle(processInfo.Process)
+		_ = winapi.CloseHandle(processInfo.Thread)
+		return fail(fmt.Errorf("assign command to Job: %w", err))
+	}
+	if _, err := winapi.ResumeThread(processInfo.Thread); err != nil {
+		_ = winapi.TerminateJobObject(job, 1)
+		_ = winapi.CloseHandle(processInfo.Process)
+		_ = winapi.CloseHandle(processInfo.Thread)
+		return fail(fmt.Errorf("release suspended command: %w", err))
+	}
+	pipesTransferred = true
+	_ = winapi.CloseHandle(processInfo.Thread)
+	started := manager.options.Now()
+	handles := &nativeHandles{process: processInfo.Process, job: job, pid: processInfo.ProcessId}
+	cleanupJob = false
+	command := &exec.Cmd{Process: osProcess(processInfo.ProcessId)}
+	waitFn := func() (int32, bool, error) {
+		_, waitErr := winapi.WaitForSingleObject(processInfo.Process, winapi.INFINITE)
+		var code uint32
+		if err := winapi.GetExitCodeProcess(processInfo.Process, &code); err != nil && waitErr == nil {
+			waitErr = err
+		}
+		handles.close.Do(func() {
+			_ = winapi.CloseHandle(processInfo.Process)
+			_ = winapi.CloseHandle(job)
+		})
+		return int32(code), false, waitErr
+	}
+	killFn := func(code uint32) error {
+		return winapi.TerminateJobObject(job, code)
+	}
+	process := manager.registerProcess(spec.IssueUUID, identity, command, stdinWrite, stdoutRead, stderrRead, started, waitFn, killFn, cleanup)
+	return process, nil
+}
+
+func osProcess(pid uint32) *os.Process {
+	process, err := os.FindProcess(int(pid))
+	if err != nil {
+		return &os.Process{}
+	}
+	return process
+}
+
+func verifyExecutable(path string) error {
+	info, err := os.Stat(path)
+	if err != nil {
+		return fmt.Errorf("stat configured shell %q: %w", path, err)
+	}
+	if !info.Mode().IsRegular() {
+		return fmt.Errorf("configured shell %q is not a regular file", path)
+	}
+	return nil
+}
+
+func createStandardPipes() (*os.File, *os.File, *os.File, *os.File, *os.File, *os.File, error) {
+	security := &winapi.SecurityAttributes{Length: uint32(unsafe.Sizeof(winapi.SecurityAttributes{})), InheritHandle: 1}
+	var stdinReadHandle, stdinWriteHandle winapi.Handle
+	var stdoutReadHandle, stdoutWriteHandle winapi.Handle
+	var stderrReadHandle, stderrWriteHandle winapi.Handle
+	if err := winapi.CreatePipe(&stdinReadHandle, &stdinWriteHandle, security, 0); err != nil {
+		return nil, nil, nil, nil, nil, nil, err
+	}
+	if err := winapi.CreatePipe(&stdoutReadHandle, &stdoutWriteHandle, security, 0); err != nil {
+		_ = winapi.CloseHandle(stdinReadHandle)
+		_ = winapi.CloseHandle(stdinWriteHandle)
+		return nil, nil, nil, nil, nil, nil, err
+	}
+	if err := winapi.CreatePipe(&stderrReadHandle, &stderrWriteHandle, security, 0); err != nil {
+		for _, handle := range []winapi.Handle{stdinReadHandle, stdinWriteHandle, stdoutReadHandle, stdoutWriteHandle} {
+			_ = winapi.CloseHandle(handle)
+		}
+		return nil, nil, nil, nil, nil, nil, err
+	}
+	for _, handle := range []winapi.Handle{stdinWriteHandle, stdoutReadHandle, stderrReadHandle} {
+		if err := winapi.SetHandleInformation(handle, winapi.HANDLE_FLAG_INHERIT, 0); err != nil {
+			for _, closeHandle := range []winapi.Handle{stdinReadHandle, stdinWriteHandle, stdoutReadHandle, stdoutWriteHandle, stderrReadHandle, stderrWriteHandle} {
+				_ = winapi.CloseHandle(closeHandle)
+			}
+			return nil, nil, nil, nil, nil, nil, err
+		}
+	}
+	return os.NewFile(uintptr(stdinReadHandle), "rvbox-stdin-read"), os.NewFile(uintptr(stdinWriteHandle), "rvbox-stdin-write"), os.NewFile(uintptr(stdoutReadHandle), "rvbox-stdout-read"), os.NewFile(uintptr(stdoutWriteHandle), "rvbox-stdout-write"), os.NewFile(uintptr(stderrReadHandle), "rvbox-stderr-read"), os.NewFile(uintptr(stderrWriteHandle), "rvbox-stderr-write"), nil
+}
+
+func createKillOnCloseJob() (winapi.Handle, error) {
+	job, err := winapi.CreateJobObject(nil, nil)
+	if err != nil {
+		return 0, err
+	}
+	info := winapi.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{}
+	info.BasicLimitInformation.LimitFlags = winapi.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+	if _, err := winapi.SetInformationJobObject(job, winapi.JobObjectExtendedLimitInformation, uintptr(unsafe.Pointer(&info)), uint32(unsafe.Sizeof(info))); err != nil {
+		_ = winapi.CloseHandle(job)
+		return 0, err
+	}
+	return job, nil
+}
+
+func (manager *execSupervisor) selectToken(elevated bool) (winapi.Token, supervisor.EffectiveIdentity, error) {
+	candidates, err := DiscoverActiveSessions()
+	if err != nil {
+		// A failed WTS enumeration is treated as no usable interactive
+		// session; LocalSystem still provides a deterministic service path.
+		candidates = nil
+	}
+	selection := Select(SelectionInput{Elevated: elevated, ActiveSessions: candidates, ActiveSystemAvailable: true, LocalServiceAvailable: true, LocalSystemAvailable: true})
+	if selection.Effective == nil {
+		if selection.Error != nil {
+			return 0, supervisor.EffectiveIdentity{}, selection.Error
+		}
+		return 0, supervisor.EffectiveIdentity{}, errors.New("Windows execution context selection failed")
+	}
+	var selected *SessionCandidate
+	if selection.Effective.SessionID != nil {
+		for index := range candidates {
+			if candidates[index].SessionID == *selection.Effective.SessionID {
+				selected = &candidates[index]
+				break
+			}
+		}
+	}
+	for _, attempt := range selection.Attempts {
+		token, identity, err := openTokenForAttempt(attempt.Context, selected)
+		if err == nil {
+			return token, identity, nil
+		}
+		if !elevated {
+			return 0, supervisor.EffectiveIdentity{}, err
+		}
+	}
+	// The pure selector stops as soon as ACTIVE_SYSTEM is available. A native
+	// privilege/session operation can still fail (for example, SeTcb was
+	// removed), so the final LOCAL_SYSTEM fallback is attempted here before
+	// launch preparation, never by retrying a created process.
+	if elevated {
+		if token, identity, err := openTokenForAttempt(ContextLocalSystem, nil); err == nil {
+			return token, identity, nil
+		}
+	}
+	return 0, supervisor.EffectiveIdentity{}, errors.New("all Windows execution contexts failed before launch preparation")
+}
+
+func openTokenForAttempt(contextName ExecutionContext, candidate *SessionCandidate) (winapi.Token, supervisor.EffectiveIdentity, error) {
+	switch contextName {
+	case ContextActiveUser, ContextActiveUserElevated, ContextActiveSystem:
+		if candidate == nil {
+			return 0, supervisor.EffectiveIdentity{}, errors.New("active execution context has no selected session")
+		}
+		var token winapi.Token
+		if err := winapi.WTSQueryUserToken(candidate.SessionID, &token); err != nil {
+			return 0, supervisor.EffectiveIdentity{}, err
+		}
+		if contextName == ContextActiveUserElevated {
+			if !token.IsElevated() {
+				linked, err := token.GetLinkedToken()
+				_ = token.Close()
+				if err != nil {
+					return 0, supervisor.EffectiveIdentity{}, err
+				}
+				token = linked
+			}
+		} else if contextName == ContextActiveSystem {
+			_ = token.Close()
+			serviceToken, identity, err := duplicateServiceTokenForSession(candidate.SessionID)
+			if err != nil {
+				return 0, supervisor.EffectiveIdentity{}, err
+			}
+			identity.Context = string(ContextActiveSystem)
+			return serviceToken, identity, nil
+		} else if token.IsElevated() {
+			_ = token.Close()
+			return 0, supervisor.EffectiveIdentity{}, errors.New("active-user token is elevated and no restricted medium token was available")
+		}
+		identity := supervisor.EffectiveIdentity{Context: string(contextName), SessionID: candidate.SessionID, UserSID: candidate.UserSID, Elevated: contextName != ContextActiveUser, Integrity: map[bool]string{true: "high", false: "medium"}[contextName != ContextActiveUser]}
+		return token, identity, nil
+	case ContextLocalService:
+		token, err := logonLocalService()
+		if err != nil {
+			return 0, supervisor.EffectiveIdentity{}, err
+		}
+		return token, supervisor.EffectiveIdentity{Context: string(ContextLocalService), Elevated: false, Integrity: "medium"}, nil
+	case ContextLocalSystem:
+		return duplicateServiceToken()
+	default:
+		return 0, supervisor.EffectiveIdentity{}, errors.New("unknown Windows execution context")
+	}
+}
+
+func duplicateServiceToken() (winapi.Token, supervisor.EffectiveIdentity, error) {
+	return duplicateServiceTokenForSession(0)
+}
+
+func duplicateServiceTokenForSession(sessionID uint32) (winapi.Token, supervisor.EffectiveIdentity, error) {
+	var source winapi.Token
+	if err := winapi.OpenProcessToken(winapi.CurrentProcess(), winapi.TOKEN_ALL_ACCESS, &source); err != nil {
+		return 0, supervisor.EffectiveIdentity{}, err
+	}
+	defer source.Close()
+	var target winapi.Token
+	if err := winapi.DuplicateTokenEx(source, winapi.TOKEN_ALL_ACCESS, nil, winapi.SecurityImpersonation, winapi.TokenPrimary, &target); err != nil {
+		return 0, supervisor.EffectiveIdentity{}, err
+	}
+	if sessionID != 0 {
+		if err := winapi.SetTokenInformation(target, winapi.TokenSessionId, (*byte)(unsafe.Pointer(&sessionID)), uint32(unsafe.Sizeof(sessionID))); err != nil {
+			_ = target.Close()
+			return 0, supervisor.EffectiveIdentity{}, err
+		}
+	}
+	user, err := target.GetTokenUser()
+	if err != nil || user.User.Sid == nil || user.User.Sid.String() != securitySystemRID {
+		_ = target.Close()
+		if err != nil {
+			return 0, supervisor.EffectiveIdentity{}, err
+		}
+		return 0, supervisor.EffectiveIdentity{}, errors.New("duplicated service token is not LocalSystem")
+	}
+	return target, supervisor.EffectiveIdentity{Context: string(ContextLocalSystem), SessionID: sessionID, UserSID: user.User.Sid.String(), Elevated: true, Integrity: "system"}, nil
+}
+
+func logonLocalService() (winapi.Token, error) {
+	account, _ := syscall.UTF16PtrFromString("LocalService")
+	domainName, _ := syscall.UTF16PtrFromString("NT AUTHORITY")
+	var token winapi.Token
+	r, _, callErr := procLogonUserW.Call(uintptr(unsafe.Pointer(account)), uintptr(unsafe.Pointer(domainName)), 0, logon32LogonService, logon32ProviderDefault, uintptr(unsafe.Pointer(&token)))
+	if r == 0 {
+		if callErr != syscall.Errno(0) {
+			return 0, callErr
+		}
+		return 0, syscall.GetLastError()
+	}
+	return token, nil
+}
+
+func (manager *execSupervisor) Signal(ctx context.Context, process supervisor.Process, signal supervisor.SignalKind) (supervisor.SignalOutcome, error) {
+	if process == nil {
+		return supervisor.SignalOutcome{}, ErrProcessNotFound
+	}
+	native, ok := process.(*execProcess)
+	if !ok || native.killFn == nil {
+		return supervisor.SignalOutcome{}, ErrProcessNotFound
+	}
+	if signal != supervisor.SignalTerm && signal != supervisor.SignalKill {
+		return supervisor.SignalOutcome{}, errors.New("unsupported signal")
+	}
+	if signal == supervisor.SignalTerm {
+		// The command has its own hidden console. A full AttachConsole/control
+		// helper is intentionally isolated from the Job kill path; if it is not
+		// available, the bounded grace period ends in an explicit Job kill.
+		select {
+		case <-ctx.Done():
+			return supervisor.SignalOutcome{}, ctx.Err()
+		case <-time.After(manager.options.WindowsTermGrace):
+		}
+	}
+	if err := native.killFn(1); err != nil {
+		return supervisor.SignalOutcome{}, err
+	}
+	return supervisor.SignalOutcome{Delivered: true, Escalated: signal == supervisor.SignalTerm, Detail: "Windows Job terminated", ObservedAt: manager.options.Now()}, nil
+}
+
+func (manager *execSupervisor) Snapshot(ctx context.Context, process supervisor.Process) (supervisor.ResourceSnapshot, error) {
+	if process == nil {
+		return supervisor.ResourceSnapshot{}, ErrProcessNotFound
+	}
+	native, ok := process.(*execProcess)
+	if !ok || native.cmd == nil || native.cmd.Process == nil {
+		return supervisor.ResourceSnapshot{}, ErrProcessNotFound
+	}
+	select {
+	case <-ctx.Done():
+		return supervisor.ResourceSnapshot{}, ctx.Err()
+	default:
+	}
+	return supervisor.ResourceSnapshot{ProcessCount: 1, ObservedAt: manager.options.Now(), Complete: false, Detail: "Windows Job accounting is available after native completion integration"}, nil
+}
+
+func (manager *execSupervisor) StopAll(_ context.Context) error {
+	manager.mu.Lock()
+	processes := make([]*execProcess, 0, len(manager.active))
+	for _, process := range manager.active {
+		processes = append(processes, process)
+	}
+	manager.mu.Unlock()
+	for _, process := range processes {
+		if process.killFn != nil {
+			if err := process.killFn(1); err != nil && !errors.Is(err, winapi.ERROR_INVALID_HANDLE) {
+				return err
+			}
+		}
+	}
+	return nil
+}