fix: QMT 填密码走 helper 子进程，gateway 主进程不再 import pywinauto

#120：uiautomationcore.dll 残留 COM 回调在 QMT 客户端退出后变成野指针，gateway 进程会被段错误（0xc0000005）干掉。\n\n修复：把 _fill_qmt_login_password 推到 qmt_restart_helper 子进程。\n- Session 0 路径：原本就走 helper（via task scheduler），不动。\n- Session 2 路径：原本直接调 _fill_qmt_login_password 现在改走 _launch_qmt_process_via_helper，跟 Session 0 行为一致。\n- 旧 _fill_qmt_login_password / _wait_for_login_window_to_close 保留但不再被 gateway 主进程调用。

Author: quantclaws

qmt_gateway/services/trade_service.py

@@ -101,17 +101,15 @@ def _task() -> dict:
                 else:
                     logger.info("未发现正在运行的 QMT 进程: image={}", executable.name)
 
-            if service._get_current_session_id() == 0:
-                password_token = service.issue_restart_password_token(qmt_password)
+            # 总是为 helper 生成 token，让 pywinauto 走子进程而不是在
+            # gateway 主进程内直接调用——避免 uiautomationcore.dll 残留
+            # COM 回调在 QMT 客户端退出后引发 0xc0000005 access violation
+            # （gateway 进程被直接干掉）。
+            password_token = service.issue_restart_password_token(qmt_password)
 
             process = service._launch_qmt_process(executable, password_token=password_token)
-            if password_token is None:
-                service._fill_qmt_login_password(process.pid, qmt_password)
-                # 等待登录窗口消失，确保 QMT 已处理完密码提交
-                service._wait_for_login_window_to_close(
-                    process.pid,
-                    timeout_sec=float(service._qmt_login_timeout_sec),
-                )
+            # 旧路径：Session 2 直接调 _fill_qmt_login_password，pywinauto 在主
+            # 进程内工作；该路径已经走 helper 子进程代替，这里不再执行。
 
             if not verify_connection:
                 logger.info("启动+填密码完成，跳过连接验证（verify_connection=False）")
@@ -775,7 +773,78 @@ def _launch_qmt_process(self, executable: Path, password_token: str | None = Non
             if not password_token:
                 raise RuntimeError("缺少 QMT 重启密码令牌，无法在交互会话中自动填入密码")
             return self._launch_qmt_process_in_interactive_session(executable, before_pids, password_token)
-        return self._launch_qmt_process_locally(executable, before_pids)
+        # Session 2（gateway 与用户在同一个交互会话）：也走 helper 子进程。
+        # 原本这里直接 _launch_qmt_process_locally + _fill_qmt_login_password，
+        # 但 pywinauto 的 Desktop 持有的 uiautomationcore.dll COM 回调会在
+        # QMT 客户端被关闭、uiautomationcore.dll 被卸载后变成野指针，下次
+        # 访问就 0xc0000005 access violation 把整个 gateway 进程干掉。
+        # 把填密码这件事放到独立子进程（helper）里，进程退出时所有
+        # COM 引用随之释放，gateway 主进程完全不用 import pywinauto。
+        return self._launch_qmt_process_via_helper(executable, before_pids, password_token)
+
+    def _launch_qmt_process_via_helper(
+        self,
+        executable: Path,
+        before_pids: set[int],
+        password_token: str | None,
+    ):
+        """在当前会话（Session 2）里拉起一个 helper 子进程来启动 QMT 并填密码。
+
+        helper 启动后通过 HTTP ``/api/trade/restart-qmt/password?token=...`` 拉
+        真实密码（token 由调用方在 ``issue_restart_password_token`` 时存入），
+        不在命令行里出现明文。helper 进程退出后所有 pywinauto / comtypes /
+        uiautomationcore.dll 引用随之释放，gateway 主进程完全不接触。
+        """
+        # 优先用调用方传来的 token（通常是 wizard 路径上预生成的）；如果没有
+        # 重新生成一个——但 helper 需要 gateway 在线才能拉密码，这种情况下
+        # caller 必须确保在 _fill_qmt_login_password 之前 issue token。
+        if not password_token:
+            raise RuntimeError("缺少 QMT 重启密码令牌，无法在交互会话中自动填入密码")
+        helper_python = self._get_helper_python_executable()
+        argument_list = [
+            "-m",
+            "qmt_gateway.qmt_restart_helper",
+            "--base-url",
+            self._build_restart_helper_base_url(),
+            "--token",
+            password_token,
+            "--exe",
+            str(executable),
+            "--launch-timeout",
+            str(self._qmt_launch_probe_timeout_sec),
+            "--login-timeout",
+            str(self._qmt_login_timeout_sec),
+            "--retry-delay",
+            str(self._qmt_login_retry_delay_sec),
+        ]
+        logger.info(
+            "在交互会话中通过 helper 子进程启动 QMT: helper={}, exe={}",
+            helper_python,
+            executable,
+        )
+        result = subprocess.run(  # noqa: S603
+            [str(helper_python), *argument_list],
+            cwd=str(executable.parent),
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=False,
+            timeout=max(
+                float(self._qmt_launch_probe_timeout_sec)
+                + float(self._qmt_login_timeout_sec)
+                + 30.0,
+                60.0,
+            ),
+            check=False,
+        )
+        stdout = self._decode_subprocess_output(result.stdout)
+        stderr = self._decode_subprocess_output(result.stderr)
+        helper_message = (stdout + "\n" + stderr).strip()
+        if result.returncode != 0:
+            raise RuntimeError(
+                helper_message or f"helper 启动 QMT 失败，退出码: {result.returncode}"
+            )
+        return self._wait_for_new_process(executable.name, before_pids)
 
     def _load_pywinauto(self):
         try:
@@ -874,7 +943,7 @@ def _fill_qmt_login_password(self, process_id: int, password: str) -> None:
 
         active_process_ids = self._collect_qmt_process_ids(process_id, QMT_CLIENT_EXECUTABLE)
         logger.warning(
-            "自动填入 QMT 密码失败，未找到登录窗口: launcher_pid={}, active_pids={}",
+            "自动填入 QMT 密码失败，未找到登录窗口: launcher_pid={}, active_process_ids={}",
             process_id,
             active_process_ids,
         )

tests/test_trade_service.py

@@ -211,14 +211,25 @@ def test_restart_and_login_relaunches_client_and_reconnects(monkeypatch):
     executable = Path(r"C:\apps\qmt\bin.x64\XtMiniQmt.exe")
     calls = []
 
+    issued_tokens = []
+    monkeypatch.setattr(service, "issue_restart_password_token", lambda password: issued_tokens.append(password) or "test-token")
     monkeypatch.setattr(service, "_get_current_session_id", lambda: 1)
     monkeypatch.setattr(service, "_resolve_qmt_client_path", lambda qmt_path: executable)
     monkeypatch.setattr(service, "disconnect", lambda: calls.append("disconnect"))
     monkeypatch.setattr(service, "discard_restart_password_token", lambda token: calls.append(("discard", token)))
     monkeypatch.setattr(service, "_set_connection_state", lambda connected, message: calls.append(("state", connected, message)) or message)
     monkeypatch.setattr(service, "_kill_qmt_process", lambda name: calls.append(("kill", name)) or "terminated")
     monkeypatch.setattr(service, "_launch_qmt_process", lambda path, password_token=None: calls.append(("launch", path, password_token)) or SimpleNamespace(pid=4321))
-    monkeypatch.setattr(service, "_fill_qmt_login_password", lambda pid, password: calls.append(("fill", pid, password)))
+    # 关键：填密码被推到 helper 子进程后，gateway 主进程不应该再调
+    # _fill_qmt_login_password。把它 monkeypatch 成抛 AssertionError 来
+    # 防止回归到旧路径。
+    monkeypatch.setattr(
+        service,
+        "_fill_qmt_login_password",
+        lambda *a, **k: (_ for _ in ()).throw(
+            AssertionError("_fill_qmt_login_password 必须在 helper 子进程中执行")
+        ),
+    )
     monkeypatch.setattr(
         service,
         "connect",
@@ -233,15 +244,17 @@ def test_restart_and_login_relaunches_client_and_reconnects(monkeypatch):
     )
 
     assert result == {"success": True, "message": "QMT 已重启并重新连接交易接口"}
+    # 关键：launch 阶段必须传 token（让 helper 走子进程），不再有
+    # _fill_qmt_login_password 调用。
     assert calls == [
         "disconnect",
         ("state", False, "交易接口连接断开，正在重启 QMT"),
         ("kill", "XtMiniQmt.exe"),
-        ("launch", executable, None),
-        ("fill", 4321, "trade-secret"),
+        ("launch", executable, "test-token"),
         ("connect", "8881457417", r"C:\apps\qmt\userdata_mini"),
-        ("discard", None),
+        ("discard", "test-token"),
     ]
+    assert issued_tokens == ["trade-secret"]
 
 
 def test_restart_and_login_requires_password():
@@ -256,26 +269,39 @@ def test_restart_and_login_requires_password():
     assert result == {"success": False, "error": "请输入交易密码"}
 
 
-def test_restart_and_login_waits_for_login_window_before_connecting(monkeypatch):
-    """填入密码后应等待登录窗口消失，再尝试 connect()。"""
+def test_restart_and_login_passes_token_to_launch_in_interactive_session(monkeypatch):
+    """#120 回归：填密码必须经 helper 子进程，gateway 主进程不应直接调
+    ``_fill_qmt_login_password``（uiautomationcore.dll 残留 COM 回调会
+    在 QMT 退出后引发 access violation）。
+    """
     service = TradeService()
     service._account_id = "8881457417"
     service._qmt_path = r"C:\apps\qmt\userdata_mini"
     executable = Path(r"C:\apps\qmt\bin.x64\XtMiniQmt.exe")
     calls = []
 
+    monkeypatch.setattr(service, "issue_restart_password_token", lambda password: "tok-XYZ")
     monkeypatch.setattr(service, "_get_current_session_id", lambda: 1)
     monkeypatch.setattr(service, "_resolve_qmt_client_path", lambda qmt_path: executable)
     monkeypatch.setattr(service, "disconnect", lambda: calls.append("disconnect"))
     monkeypatch.setattr(service, "discard_restart_password_token", lambda token: calls.append(("discard", token)))
     monkeypatch.setattr(service, "_set_connection_state", lambda connected, message: calls.append(("state", connected, message)) or message)
     monkeypatch.setattr(service, "_kill_qmt_process", lambda name: "terminated")
-    monkeypatch.setattr(service, "_launch_qmt_process", lambda path, password_token=None: SimpleNamespace(pid=4321))
-    monkeypatch.setattr(service, "_fill_qmt_login_password", lambda pid, password: calls.append(("fill", pid, password)))
+    monkeypatch.setattr(service, "_launch_qmt_process", lambda path, password_token=None: calls.append(("launch", path, password_token)) or SimpleNamespace(pid=4321))
+    # gateway 主进程不应再调 _fill_qmt_login_password / _wait_for_login_window
+    monkeypatch.setattr(
+        service,
+        "_fill_qmt_login_password",
+        lambda *a, **k: (_ for _ in ()).throw(
+            AssertionError("不应在主进程中调 _fill_qmt_login_password")
+        ),
+    )
     monkeypatch.setattr(
         service,
         "_wait_for_login_window_to_close",
-        lambda pid, timeout_sec: calls.append(("wait", pid, timeout_sec)) or True,
+        lambda *a, **k: (_ for _ in ()).throw(
+            AssertionError("不应在主进程中调 _wait_for_login_window_to_close")
+        ),
     )
     monkeypatch.setattr(
         service,
@@ -291,12 +317,15 @@ def test_restart_and_login_waits_for_login_window_before_connecting(monkeypatch)
     )
 
     assert result["success"] is True
-    # 关键：fill 之后必须 wait，然后才 connect
-    assert ("fill", 4321, "trade-secret") in calls
-    fill_index = calls.index(("fill", 4321, "trade-secret"))
-    wait_index = calls.index(("wait", 4321, 20.0))
-    connect_index = calls.index(("connect", "8881457417", r"C:\apps\qmt\userdata_mini"))
-    assert fill_index < wait_index < connect_index
+    # 关键：launch 阶段带 token（让 helper 子进程填密码），connect 紧随其后，
+    # 中间不再有 _fill_qmt_login_password / _wait_for_login_window_to_close。
+    assert calls == [
+        "disconnect",
+        ("state", False, "交易接口连接断开，正在重启 QMT"),
+        ("launch", executable, "tok-XYZ"),
+        ("connect", "8881457417", r"C:\apps\qmt\userdata_mini"),
+        ("discard", "tok-XYZ"),
+    ]
 
 
 def test_kill_qmt_process_ignores_missing_process_message(monkeypatch):
@@ -364,6 +393,10 @@ def set_edit_text(self, password):
 
 
 def test_launch_qmt_process_uses_shell_open_and_detects_new_pid(monkeypatch):
+    """#120 回归：Session 2 路径现在也走 helper 子进程，pywinauto 不在主进程内
+    调用。本测试只验证 _launch_qmt_process_locally 的旧行为（在没有 token
+    时仍可独立调用），由 _launch_qmt_process 路由。
+    """
     service = TradeService()
     executable = Path(r"C:\apps\qmt\bin.x64\XtMiniQmt.exe")
     launch_calls = []
@@ -374,7 +407,7 @@ def test_launch_qmt_process_uses_shell_open_and_detects_new_pid(monkeypatch):
     monkeypatch.setattr(trade_service_module.os, "startfile", lambda path, cwd=None: launch_calls.append((path, cwd)))
     monkeypatch.setattr(trade_service_module.time, "sleep", lambda seconds: None)
 
-    process = service._launch_qmt_process(executable)
+    process = service._launch_qmt_process_locally(executable, set())
 
     assert process.pid == 8765
     assert launch_calls == [(str(executable), str(executable.parent))]