1  REM Copyright 2026 Alibaba Group Holding Ltd.
 2  REM
 3  REM Licensed under the Apache License, Version 2.0 (the "License");
 4  REM you may not use this file except in compliance with the License.
 5  REM You may obtain a copy of the License at
 6  REM
 7  REM     http://www.apache.org/licenses/LICENSE-2.0
 8  REM
 9  REM Unless required by applicable law or agreed to in writing, software
10  REM distributed under the License is distributed on an "AS IS" BASIS,
11  REM WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  REM See the License for the specific language governing permissions and
13  REM limitations under the License.
14  
15  @echo off
16  setlocal enableextensions
17  
18  set "EXECD_LOG_FILE=%EXECD_LOG_FILE%"
19  if "%EXECD_LOG_FILE%"=="" set "EXECD_LOG_FILE=C:\OpenSandbox\install.log"
20  
21  set "EXECD_STDOUT_LOG=%EXECD_STDOUT_LOG%"
22  if "%EXECD_STDOUT_LOG%"=="" set "EXECD_STDOUT_LOG=C:\OpenSandbox\execd.stdout.log"
23  
24  set "EXECD_STDERR_LOG=%EXECD_STDERR_LOG%"
25  if "%EXECD_STDERR_LOG%"=="" set "EXECD_STDERR_LOG=C:\OpenSandbox\execd.stderr.log"
26  
27  set "EXECD_OEM_BIN=C:\OEM\execd.exe"
28  
29  if not exist "C:\OpenSandbox" mkdir "C:\OpenSandbox"
30  if errorlevel 1 (
31      echo [install.bat] WARN: failed to create log dir: C:\OpenSandbox
32      exit /b 0
33  )
34  
35  call :log "startup begin"
36  call :log "oem bin: %EXECD_OEM_BIN%"
37  call :log "execd stdout log: %EXECD_STDOUT_LOG%"
38  call :log "execd stderr log: %EXECD_STDERR_LOG%"
39  
40  if not exist "%EXECD_OEM_BIN%" (
41      call :log "WARN: execd binary not found at %EXECD_OEM_BIN%"
42      exit /b 0
43  )
44  
45  call :prepare_executable "%EXECD_OEM_BIN%"
46  call :ensure_firewall_rule
47  
48  call :log "starting %EXECD_OEM_BIN%"
49  set "EXECD_BIN_PS=%EXECD_OEM_BIN%"
50  set "EXECD_STDOUT_LOG_PS=%EXECD_STDOUT_LOG%"
51  set "EXECD_STDERR_LOG_PS=%EXECD_STDERR_LOG%"
52  powershell -NoProfile -ExecutionPolicy Bypass -Command "$p=$env:EXECD_BIN_PS; $out=$env:EXECD_STDOUT_LOG_PS; $err=$env:EXECD_STDERR_LOG_PS; try { Start-Process -FilePath $p -WindowStyle Hidden -RedirectStandardOutput $out -RedirectStandardError $err; exit 0 } catch { exit 1 }" >nul 2>&1
53  if errorlevel 1 (
54      call :log "WARN: PowerShell Start-Process failed, fallback to cmd start"
55      start "opensandbox-execd" /B cmd /c ""%EXECD_OEM_BIN%" 1>>"%EXECD_STDOUT_LOG%" 2>>"%EXECD_STDERR_LOG%""
56  )
57  if errorlevel 1 (
58      call :log "WARN: failed to start execd.exe via both powershell and cmd"
59      exit /b 0
60  )
61  
62  call :log "execd started in background"
63  exit /b 0
64  
65  :log
66  echo [install.bat] %~1
67  >>"%EXECD_LOG_FILE%" echo [%date% %time%] [install.bat] %~1
68  exit /b 0
69  
70  :prepare_executable
71  set "TARGET_BIN=%~1"
72  if "%TARGET_BIN%"=="" exit /b 0
73  set "TARGET_BIN_PS=%TARGET_BIN%"
74  call :log "preparing executable security metadata for %TARGET_BIN%"
75  powershell -NoProfile -ExecutionPolicy Bypass -Command "$p=$env:TARGET_BIN_PS; try { if (Test-Path -LiteralPath $p) { Remove-Item -LiteralPath ($p + ':Zone.Identifier') -ErrorAction SilentlyContinue; Unblock-File -LiteralPath $p -ErrorAction SilentlyContinue }; exit 0 } catch { exit 0 }" >nul 2>&1
76  if errorlevel 1 (
77      call :log "WARN: executable prepare returned non-zero"
78  )
79  exit /b 0
80  
81  :ensure_firewall_rule
82  set "EXECD_FW_RULE=OpenSandbox execd 44772"
83  call :log "ensuring firewall rule for TCP 44772"
84  netsh advfirewall firewall delete rule name="%EXECD_FW_RULE%" >nul 2>&1
85  netsh advfirewall firewall add rule name="%EXECD_FW_RULE%" dir=in action=allow protocol=TCP localport=44772 >nul 2>&1
86  if errorlevel 1 (
87      call :log "WARN: failed to add firewall allow rule for TCP 44772"
88      exit /b 0
89  )
90  call :log "firewall rule ready for TCP 44772"
91  exit /b 0