feat(windows): platform ops, service wrapper, helper, and air-gap paths

First Windows parity milestone (DESIGN-WINDOWS.md §13 build order item 1). - Add a PlatformOps abstraction so command dispatch is OS-neutral: - linuxPlatformOps keeps today's systemctl/journalctl/bash behavior (deliberately untagged so shared dispatch tests run on Windows CI) - windowsPlatformOps maps reboot/shutdown to shutdown.exe, service control to sc.exe (stop+start for restart), fetch_logs to Get-WinEvent, arbitrary_bash to powershell -EncodedCommand (byte-exact under arbitrary quoting), and declines configure_ldap (Windows logon goes through OpenCredential) - Run theta-agent as a Windows service (x/sys/windows/svc): SYSTEM auto-start, SCM stop/shutdown handling; CLI install-service/remove-service via svc/mgr - Add theta-agent-helper (session-0 companion): lock/display_off/logout via user32/wtsapi32, and staged self-update (wait for service stop, swap the locked exe, sc start) - Self-update becomes platform-aware: Linux renames over the running binary; Windows stages .new and hands the swap to the helper (running exe is locked) - Platform paths: agent.yml and tray.sock under %ProgramData%\Theta42 (the service runs as SYSTEM while the tray runs as the user, so the per-user temp dir no longer works for tray IPC); LDAP byte-pump falls back to TCP loopback - config: service_name, desktop_helper, public_ip_detect (air-gap: skips external public-IP lookups in telemetry + home monitor), wireguard block - cli: platform-aware config path + self-update artifact name + service restart - tests: dispatch tests pin linuxPlatformOps; 0600 mode assertions gated to POSIX so the suite is green on Windows Rebuilds all tracked dist binaries (v2.1.0).
2026-08-09 17:10:07 -07:00
parent 7a6eb84d36
commit 4a619f7adc
38 changed files with 1115 additions and 171 deletions
@@ -0,0 +1,220 @@
+//go:build windows
+
+package main
+
+// windowsPlatformOps implements PlatformOps for Windows. Remote ops map to
+// Windows equivalents:
+//
+//   - reboot/shutdown  → shutdown.exe
+//   - service control  → sc.exe
+//   - fetch logs       → Get-WinEvent (PowerShell)
+//   - arbitrary_bash   → powershell -EncodedCommand (survives arbitrary quoting)
+//   - desktop control  → theta-agent-helper (session-0 workaround, see
+//     DESIGN-WINDOWS.md §4)
+//   - self-update      → staged `.new` + helper swap (the running exe is locked)
+//
+// configure_ldap is declined: Windows logon goes through the OpenCredential
+// credential provider, which the installer configures directly.
+
+import (
+	"encoding/base64"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"unicode/utf16"
+
+	"golang.org/x/sys/windows"
+)
+
+type windowsPlatformOps struct {
+	exec        Executor
+	helperPath  string // theta-agent-helper.exe (DESIGN-WINDOWS.md §8)
+	serviceName string // Windows service name (defaults to theta-agent)
+}
+
+func (p *windowsPlatformOps) Reboot() ([]byte, error) {
+	return p.exec.Execute("shutdown", "/r", "/t", "0")
+}
+
+func (p *windowsPlatformOps) Shutdown() ([]byte, error) {
+	return p.exec.Execute("shutdown", "/s", "/t", "0")
+}
+
+func (p *windowsPlatformOps) FetchLogs(service string, lines int) ([]byte, error) {
+	script := fmt.Sprintf("Get-WinEvent -LogName Application -MaxEvents %d -ErrorAction SilentlyContinue | Format-List TimeCreated, ProviderName, Id, LevelDisplayName, Message", lines)
+	return p.runPowerShell(script)
+}
+
+// ServiceControl maps systemd-style actions onto sc.exe. `restart` has no
+// one-shot sc command, so it stops then starts; `status` is `sc query`.
+func (p *windowsPlatformOps) ServiceControl(service, action string) ([]byte, error) {
+	switch action {
+	case "status":
+		return p.exec.Execute("sc.exe", "query", service)
+	case "restart":
+		// A service that is already stopped is not an error worth failing on.
+		if _, err := p.exec.Execute("sc.exe", "stop", service); err != nil {
+			log.Printf("[windows] sc stop %s: %v (continuing to start)", service, err)
+		}
+		out, err := p.exec.Execute("sc.exe", "start", service)
+		if err != nil && strings.Contains(string(out), "1056") {
+			// ERROR_SERVICE_ALREADY_RUNNING — the stop never landed; treat as up.
+			return out, nil
+		}
+		return out, err
+	default:
+		return p.exec.Execute("sc.exe", action, service)
+	}
+}
+
+func (p *windowsPlatformOps) RunScript(script string) ([]byte, error) {
+	return p.runPowerShell(script)
+}
+
+// runPowerShell invokes powershell with a UTF-16LE base64 -EncodedCommand. An
+// operator script can contain arbitrary quotes, `&`, `%`, etc.; passing it as a
+// plain argument would be mangled by cmd.exe/arg quoting rules, while the
+// encoded form is byte-exact on both sides.
+func (p *windowsPlatformOps) runPowerShell(script string) ([]byte, error) {
+	units := utf16.Encode([]rune(script))
+	b := make([]byte, len(units)*2)
+	for i, r := range units {
+		b[i*2] = byte(r)
+		b[i*2+1] = byte(r >> 8)
+	}
+	enc := base64.StdEncoding.EncodeToString(b)
+	return p.exec.Execute("powershell", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", enc)
+}
+
+// DesktopControl routes ops that need an interactive desktop to the helper,
+// which the service launches in the target session (DESIGN-WINDOWS.md §4).
+// Sleep can run from session 0 and is handled in-process.
+func (p *windowsPlatformOps) DesktopControl(subAction, targetUser string) ([]byte, error) {
+	var action string
+	switch subAction {
+	case "sleep_host", "sleep":
+		return nil, setSuspendState()
+	case "lock_session", "lock":
+		action = "lock"
+	case "display_off":
+		action = "display_off"
+	case "logout_user", "logout":
+		action = "logout"
+	default:
+		return nil, fmt.Errorf("unknown desktop action '%s'", subAction)
+	}
+
+	if p.helperPath == "" {
+		return nil, fmt.Errorf("desktop control requires theta-agent-helper (desktop_helper not configured)")
+	}
+	args := []string{action}
+	if targetUser != "" {
+		args = append(args, targetUser)
+	}
+	return p.exec.Execute(p.helperPath, args...)
+}
+
+// setSuspendState puts the machine to sleep. Requires SeShutdownPrivilege,
+// which the SYSTEM service holds.
+func setSuspendState() error {
+	powrprof := syscall.NewLazyDLL("powrprof.dll")
+	proc := powrprof.NewProc("SetSuspendState")
+	r, _, err := proc.Call(0, 0, 0) // Hibernate=false, ForceCritical=false, WakeIfDisarmed=false
+	if r == 0 {
+		return err
+	}
+	return nil
+}
+
+// ConfigureLDAP is not applicable on Windows: directory logon uses the
+// OpenCredential credential provider configured by the installer.
+func (p *windowsPlatformOps) ConfigureLDAP(configData string) error {
+	return fmt.Errorf("configure_ldap is not applicable on Windows; logon is managed by the OpenCredential credential provider")
+}
+
+// ApplyUpdate downloads and verifies the new binary to `<self>.new`, then hands
+// the swap to the helper: the running service holds the exe open, so the agent
+// must stop before the file can be replaced. The helper outlives the service
+// (detached process), swaps the files, and restarts the service.
+func (p *windowsPlatformOps) ApplyUpdate(downloadURL, checksum string) error {
+	selfPath, err := os.Executable()
+	if err != nil {
+		return fmt.Errorf("failed to resolve current binary path: %w", err)
+	}
+
+	tmpPath, err := downloadBinary(downloadURL, checksum)
+	if err != nil {
+		return err
+	}
+
+	newPath := selfPath + ".new"
+	if err := moveFile(tmpPath, newPath); err != nil {
+		return fmt.Errorf("failed to stage new binary: %w", err)
+	}
+
+	helper := p.helperPath
+	if helper == "" {
+		return fmt.Errorf("desktop_helper not configured; cannot complete self-update")
+	}
+	service := p.serviceName
+	if service == "" {
+		service = "theta-agent"
+	}
+
+	log.Printf("[windows] staging self-update via helper (%s -> %s)", newPath, selfPath)
+	if err := spawnDetached(helper, "update", newPath, selfPath, service); err != nil {
+		return fmt.Errorf("failed to launch updater helper: %w", err)
+	}
+	return nil
+}
+
+func (p *windowsPlatformOps) SelfRestart() {
+	stopAgent()
+}
+
+// spawnDetached launches exe as a background process that survives this one.
+func spawnDetached(exe string, args ...string) error {
+	cmd := execCommand(exe, args...)
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		CreationFlags: windows.DETACHED_PROCESS | windows.CREATE_NEW_PROCESS_GROUP,
+	}
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Start()
+}
+
+// execCommand is a thin wrapper so tests that build the windows ops can stub it.
+func execCommand(name string, args ...string) *exec.Cmd {
+	return exec.Command(name, args...)
+}
+
+// moveFile renames src onto dst, falling back to a copy when the source is on a
+// different volume than the destination (os.Rename fails across volumes).
+func moveFile(src, dst string) error {
+	if err := os.Rename(src, dst); err == nil {
+		return nil
+	}
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+	out, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
+	if err != nil {
+		return err
+	}
+	if _, err := io.Copy(out, in); err != nil {
+		out.Close()
+		os.Remove(dst)
+		return err
+	}
+	if err := out.Close(); err != nil {
+		os.Remove(dst)
+		return err
+	}
+	return os.Remove(src)
+}