郎速科技
2331 lines
110 KiB
PowerShell
2331 lines
110 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[string]$PackageRoot = $PSScriptRoot,
|
|
[string]$PackageArchivePath = '',
|
|
[AllowEmptyString()]
|
|
[ValidatePattern('^[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}$')]
|
|
[string]$ExpectedPackageVersion = '',
|
|
[Parameter(Mandatory = $true)][string]$SpritePath,
|
|
[Parameter(Mandatory = $true)][string]$SpriteLicenseEvidence,
|
|
[Parameter(Mandatory = $true)][string]$AstrBotComplianceEvidence,
|
|
[Parameter(Mandatory = $true)][string]$MiniMaxServiceComplianceEvidence,
|
|
[Parameter(Mandatory = $true)][string]$MiniMaxVisionProbeEvidence,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Fa-f0-9]{40}$')]
|
|
[string]$HostCertificateThumbprint,
|
|
[string]$AstrBotBaseUrl = 'http://127.0.0.1:6185',
|
|
[ValidatePattern('^[A-Za-z0-9_.-]{1,128}$')]
|
|
[string]$CredentialTarget = 'Langsu.Lserp.AstrBot.ApiKey',
|
|
[string]$BridgeDiscoveryDirectory = "$env:LOCALAPPDATA\Langsu\Lserp\AgentBridge",
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateRange(1, 2147483647)]
|
|
[int]$ErpProcessId,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Fa-f0-9]{64}$')]
|
|
[string]$ExpectedDatabaseScopeFingerprint,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateLength(1, 256)]
|
|
[string]$ExpectedUserId,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateLength(1, 256)]
|
|
[string]$ExpectedUserName,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateLength(1, 256)]
|
|
[string]$ExpectedAccountBook,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateLength(1, 256)]
|
|
[string]$ExpectedSubSystemId,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateSet('true', 'false')]
|
|
[string]$ExpectedIsAdministrator,
|
|
[string]$LegacyArtifactRoot = '',
|
|
[Parameter(Mandatory = $true)][string]$RolloutPolicyPath,
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[A-Za-z0-9][A-Za-z0-9_.:-]{0,63}$')]
|
|
[string]$RolloutCustomerId,
|
|
[string]$ReportDirectory = "$env:LOCALAPPDATA\Langsu\Lserp\AcceptanceReports"
|
|
)
|
|
|
|
Set-StrictMode -Version 2.0
|
|
$ErrorActionPreference = 'Stop'
|
|
$expectedAdministrator = $ExpectedIsAdministrator -ieq 'true'
|
|
$checks = New-Object System.Collections.Generic.List[object]
|
|
|
|
function Add-Check([string]$Name, [bool]$Passed, [string]$Code, [string]$Detail) {
|
|
$resultCode = if ($Passed) { 'ok' } else { $Code }
|
|
$checks.Add([ordered]@{
|
|
name = $Name
|
|
passed = $Passed
|
|
code = $resultCode
|
|
detail = $Detail
|
|
})
|
|
}
|
|
|
|
function Test-RegularFile([string]$Path, [long]$MaximumBytes) {
|
|
if (-not [IO.File]::Exists($Path)) { return $false }
|
|
$item = Get-Item -LiteralPath $Path -Force
|
|
return $item.Length -gt 0 -and $item.Length -le $MaximumBytes -and
|
|
(($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -eq 0)
|
|
}
|
|
|
|
function Get-RegularFileSha256([string]$Path, [long]$MaximumBytes) {
|
|
$stream = $null
|
|
$sha256 = $null
|
|
try {
|
|
if (-not (Test-RegularFile $Path $MaximumBytes)) { return $null }
|
|
$stream = [IO.File]::Open(
|
|
$Path,
|
|
[IO.FileMode]::Open,
|
|
[IO.FileAccess]::Read,
|
|
[IO.FileShare]::Read)
|
|
if ($stream.Length -le 0 -or $stream.Length -gt $MaximumBytes) {
|
|
return $null
|
|
}
|
|
$sha256 = [Security.Cryptography.SHA256]::Create()
|
|
[byte[]]$digest = $sha256.ComputeHash($stream)
|
|
return -join @($digest | ForEach-Object { $_.ToString('x2') })
|
|
}
|
|
catch { return $null }
|
|
finally {
|
|
if ($null -ne $sha256) { $sha256.Dispose() }
|
|
if ($null -ne $stream) { $stream.Dispose() }
|
|
}
|
|
}
|
|
|
|
function Get-BytesSha256([byte[]]$Bytes) {
|
|
$sha256 = [Security.Cryptography.SHA256]::Create()
|
|
try {
|
|
[byte[]]$digest = $sha256.ComputeHash($Bytes)
|
|
return -join @($digest | ForEach-Object { $_.ToString('x2') })
|
|
}
|
|
finally { $sha256.Dispose() }
|
|
}
|
|
|
|
function Get-StreamSha256([IO.Stream]$Stream) {
|
|
$sha256 = [Security.Cryptography.SHA256]::Create()
|
|
try {
|
|
[byte[]]$digest = $sha256.ComputeHash($Stream)
|
|
return -join @($digest | ForEach-Object { $_.ToString('x2') })
|
|
}
|
|
finally { $sha256.Dispose() }
|
|
}
|
|
|
|
function Test-PackageArchiveBinding(
|
|
[string]$ArchivePath,
|
|
[object]$Manifest,
|
|
[string]$ManifestSha256) {
|
|
$result = [ordered]@{
|
|
passed = $false
|
|
code = 'package_archive_binding_failed'
|
|
detail = '最终 ZIP 必须与当前解包目录的清单、逐文件大小和 SHA-256 完全一致。'
|
|
sha256 = $null
|
|
}
|
|
$stream = $null
|
|
$archive = $null
|
|
try {
|
|
if ([string]::IsNullOrWhiteSpace($ArchivePath)) {
|
|
$result.code = 'package_archive_required'
|
|
$result.detail = '必须提供最终未修改的商用 ZIP，不能只预检解包目录。'
|
|
return $result
|
|
}
|
|
$fullPath = [IO.Path]::GetFullPath($ArchivePath)
|
|
if ([IO.Path]::GetExtension($fullPath) -cne '.zip' -or
|
|
-not (Test-RegularFile $fullPath 4GB) -or
|
|
$ManifestSha256 -cnotmatch '^[a-f0-9]{64}$') {
|
|
throw 'package_archive_input_invalid'
|
|
}
|
|
|
|
Add-Type -AssemblyName System.IO.Compression -ErrorAction Stop
|
|
try {
|
|
Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop
|
|
}
|
|
catch {
|
|
if ($null -eq ('System.IO.Compression.ZipArchive' -as [type])) { throw }
|
|
}
|
|
$stream = [IO.File]::Open(
|
|
$fullPath,
|
|
[IO.FileMode]::Open,
|
|
[IO.FileAccess]::Read,
|
|
[IO.FileShare]::Read)
|
|
if ($stream.Length -le 0 -or $stream.Length -gt 4GB) {
|
|
throw 'package_archive_size_invalid'
|
|
}
|
|
$archiveSha256 = Get-StreamSha256 $stream
|
|
$stream.Position = 0
|
|
$archive = [IO.Compression.ZipArchive]::new(
|
|
$stream, [IO.Compression.ZipArchiveMode]::Read, $true)
|
|
|
|
$expected = New-Object 'System.Collections.Generic.Dictionary[string,object]' `
|
|
([StringComparer]::OrdinalIgnoreCase)
|
|
foreach ($manifestEntry in @($Manifest.files)) {
|
|
$relative = [string]$manifestEntry.path
|
|
if ($expected.ContainsKey($relative)) {
|
|
throw 'package_archive_manifest_duplicate'
|
|
}
|
|
$expected.Add($relative, $manifestEntry)
|
|
}
|
|
|
|
$seen = New-Object 'System.Collections.Generic.HashSet[string]' `
|
|
([StringComparer]::OrdinalIgnoreCase)
|
|
$files = New-Object System.Collections.Generic.List[object]
|
|
$rootName = $null
|
|
[long]$totalLength = 0
|
|
foreach ($entry in $archive.Entries) {
|
|
$name = [string]$entry.FullName
|
|
if ([string]::IsNullOrWhiteSpace($name) -or
|
|
$name.Contains('\') -or $name.StartsWith('/') -or
|
|
$name.Contains(':') -or $name.Contains('//')) {
|
|
throw 'package_archive_path_invalid'
|
|
}
|
|
$isDirectory = $name.EndsWith('/')
|
|
$trimmed = if ($isDirectory) { $name.TrimEnd('/') } else { $name }
|
|
$segments = @($trimmed.Split('/'))
|
|
if ($segments.Count -lt 1 -or
|
|
@($segments | Where-Object {
|
|
[string]::IsNullOrWhiteSpace($_) -or $_ -in @('.', '..')
|
|
}).Count -ne 0 -or
|
|
$segments[0] -cnotmatch '^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$') {
|
|
throw 'package_archive_path_invalid'
|
|
}
|
|
if ($null -eq $rootName) { $rootName = $segments[0] }
|
|
if ($segments[0] -cne $rootName -or -not $seen.Add($trimmed)) {
|
|
throw 'package_archive_root_or_duplicate_invalid'
|
|
}
|
|
|
|
[int]$externalAttributes = $entry.ExternalAttributes
|
|
[int]$unixType = (($externalAttributes -shr 16) -band 0xF000)
|
|
if ($unixType -eq 0xA000 -or
|
|
($externalAttributes -band [int][IO.FileAttributes]::ReparsePoint) -ne 0) {
|
|
throw 'package_archive_link_forbidden'
|
|
}
|
|
$attributeDirectory =
|
|
($externalAttributes -band [int][IO.FileAttributes]::Directory) -ne 0
|
|
if ($isDirectory) {
|
|
if ($entry.Length -ne 0) { throw 'package_archive_directory_invalid' }
|
|
continue
|
|
}
|
|
if ($attributeDirectory -or $segments.Count -lt 2 -or
|
|
$entry.Length -le 0 -or $entry.Length -gt 512MB -or
|
|
$totalLength -gt 4GB - $entry.Length) {
|
|
throw 'package_archive_entry_invalid'
|
|
}
|
|
$totalLength += $entry.Length
|
|
$relative = [string]::Join('/', $segments[1..($segments.Count - 1)])
|
|
$files.Add([ordered]@{ relative = $relative; entry = $entry })
|
|
}
|
|
if ([string]::IsNullOrWhiteSpace($rootName) -or
|
|
$files.Count -ne $expected.Count + 1) {
|
|
throw 'package_archive_file_count_invalid'
|
|
}
|
|
|
|
$manifestFound = $false
|
|
foreach ($archiveFile in $files) {
|
|
$relative = [string]$archiveFile.relative
|
|
$entry = $archiveFile.entry
|
|
$entryStream = $null
|
|
try {
|
|
$entryStream = $entry.Open()
|
|
$actualHash = Get-StreamSha256 $entryStream
|
|
}
|
|
finally {
|
|
if ($null -ne $entryStream) { $entryStream.Dispose() }
|
|
}
|
|
if ($relative -ceq 'SHA256SUMS.json') {
|
|
if ($manifestFound -or $actualHash -cne $ManifestSha256) {
|
|
throw 'package_archive_manifest_mismatch'
|
|
}
|
|
$manifestFound = $true
|
|
continue
|
|
}
|
|
$manifestEntry = $null
|
|
if (-not $expected.TryGetValue($relative, [ref]$manifestEntry) -or
|
|
[long]$manifestEntry.sizeBytes -ne [long]$entry.Length -or
|
|
([string]$manifestEntry.sha256).ToLowerInvariant() -cne $actualHash) {
|
|
throw 'package_archive_entry_mismatch'
|
|
}
|
|
}
|
|
if (-not $manifestFound) { throw 'package_archive_manifest_missing' }
|
|
|
|
$result.passed = $true
|
|
$result.code = 'ok'
|
|
$result.detail = ("最终 ZIP 已绑定同一清单并逐项验证 {0} 个包内文件。" -f `
|
|
$expected.Count)
|
|
$result.sha256 = $archiveSha256
|
|
return $result
|
|
}
|
|
catch { return $result }
|
|
finally {
|
|
if ($null -ne $archive) { $archive.Dispose() }
|
|
if ($null -ne $stream) { $stream.Dispose() }
|
|
}
|
|
}
|
|
|
|
function Read-UInt24LittleEndian([byte[]]$Bytes, [int]$Offset) {
|
|
if ($null -eq $Bytes -or $Offset -lt 0 -or $Offset + 3 -gt $Bytes.Length) {
|
|
throw 'webp_uint24_out_of_range'
|
|
}
|
|
return ([uint32]$Bytes[$Offset] -bor `
|
|
([uint32]$Bytes[$Offset + 1] -shl 8) -bor `
|
|
([uint32]$Bytes[$Offset + 2] -shl 16))
|
|
}
|
|
|
|
function Get-WebPDimensions([string]$Path, [long]$MaximumBytes) {
|
|
$stream = $null
|
|
$reader = $null
|
|
try {
|
|
if (-not (Test-RegularFile $Path $MaximumBytes)) { return $null }
|
|
$stream = [IO.File]::Open(
|
|
$Path,
|
|
[IO.FileMode]::Open,
|
|
[IO.FileAccess]::Read,
|
|
[IO.FileShare]::Read)
|
|
if ($stream.Length -lt 26 -or $stream.Length -gt $MaximumBytes) {
|
|
throw 'webp_length_invalid'
|
|
}
|
|
$reader = [IO.BinaryReader]::new($stream, [Text.Encoding]::ASCII, $true)
|
|
$sha256 = [Security.Cryptography.SHA256]::Create()
|
|
try {
|
|
[byte[]]$digest = $sha256.ComputeHash($stream)
|
|
}
|
|
finally {
|
|
$sha256.Dispose()
|
|
}
|
|
$digestHex = -join @($digest | ForEach-Object { $_.ToString('x2') })
|
|
$stream.Position = 0
|
|
if ($reader.ReadUInt32() -ne [uint32]0x46464952) { # RIFF
|
|
throw 'webp_riff_missing'
|
|
}
|
|
[uint32]$riffSize = $reader.ReadUInt32()
|
|
if ([uint64]$riffSize + 8 -ne [uint64]$stream.Length -or
|
|
$reader.ReadUInt32() -ne [uint32]0x50424557) { # WEBP
|
|
throw 'webp_container_invalid'
|
|
}
|
|
|
|
$width = $null
|
|
$height = $null
|
|
$seenVp8X = $false
|
|
$seenBitstream = $false
|
|
$chunkCount = 0
|
|
while ($stream.Position -lt $stream.Length) {
|
|
$chunkCount++
|
|
if ($chunkCount -gt 1024 -or $stream.Length - $stream.Position -lt 8) {
|
|
throw 'webp_chunk_header_invalid'
|
|
}
|
|
|
|
[uint32]$chunkType = $reader.ReadUInt32()
|
|
[uint32]$chunkSize = $reader.ReadUInt32()
|
|
[long]$payloadStart = $stream.Position
|
|
[long]$paddedSize = [long]$chunkSize + ([long]$chunkSize -band 1)
|
|
if ($paddedSize -gt $stream.Length - $payloadStart) {
|
|
throw 'webp_chunk_size_invalid'
|
|
}
|
|
|
|
$candidateWidth = $null
|
|
$candidateHeight = $null
|
|
if ($chunkType -eq [uint32]0x58385056) { # VP8X
|
|
if ($seenVp8X -or $chunkCount -ne 1 -or $chunkSize -ne 10) {
|
|
throw 'webp_vp8x_invalid'
|
|
}
|
|
$seenVp8X = $true
|
|
[byte[]]$header = $reader.ReadBytes(10)
|
|
if ($header.Length -ne 10 -or
|
|
($header[0] -band 0xc3) -ne 0 -or
|
|
$header[1] -ne 0 -or $header[2] -ne 0 -or $header[3] -ne 0) {
|
|
throw 'webp_vp8x_header_invalid'
|
|
}
|
|
$candidateWidth = 1 + (Read-UInt24LittleEndian $header 4)
|
|
$candidateHeight = 1 + (Read-UInt24LittleEndian $header 7)
|
|
}
|
|
elseif ($chunkType -eq [uint32]0x20385056) { # VP8 + trailing space
|
|
if ($seenBitstream -or $chunkSize -lt 10) {
|
|
throw 'webp_vp8_invalid'
|
|
}
|
|
$seenBitstream = $true
|
|
[byte[]]$header = $reader.ReadBytes(10)
|
|
[uint32]$frameTag = Read-UInt24LittleEndian $header 0
|
|
if ($header.Length -ne 10 -or ($frameTag -band 1) -ne 0 -or
|
|
$header[3] -ne 0x9d -or $header[4] -ne 0x01 -or
|
|
$header[5] -ne 0x2a) {
|
|
throw 'webp_vp8_header_invalid'
|
|
}
|
|
$candidateWidth = 1 * (([int]$header[6] -bor `
|
|
([int]$header[7] -shl 8)) -band 0x3fff)
|
|
$candidateHeight = 1 * (([int]$header[8] -bor `
|
|
([int]$header[9] -shl 8)) -band 0x3fff)
|
|
}
|
|
elseif ($chunkType -eq [uint32]0x4c385056) { # VP8L
|
|
if ($seenBitstream -or $chunkSize -lt 5) {
|
|
throw 'webp_vp8l_invalid'
|
|
}
|
|
$seenBitstream = $true
|
|
[byte[]]$header = $reader.ReadBytes(5)
|
|
if ($header.Length -ne 5 -or $header[0] -ne 0x2f) {
|
|
throw 'webp_vp8l_header_invalid'
|
|
}
|
|
[uint64]$bits = [uint64]$header[1] -bor `
|
|
([uint64]$header[2] -shl 8) -bor `
|
|
([uint64]$header[3] -shl 16) -bor `
|
|
([uint64]$header[4] -shl 24)
|
|
if (($bits -shr 29) -ne 0) { throw 'webp_vp8l_version_invalid' }
|
|
$candidateWidth = 1 + ($bits -band 0x3fff)
|
|
$candidateHeight = 1 + (($bits -shr 14) -band 0x3fff)
|
|
}
|
|
|
|
if ($null -ne $candidateWidth) {
|
|
if ($candidateWidth -le 0 -or $candidateHeight -le 0 -or
|
|
($null -ne $width -and
|
|
($width -ne $candidateWidth -or $height -ne $candidateHeight))) {
|
|
throw 'webp_dimensions_inconsistent'
|
|
}
|
|
$width = [int]$candidateWidth
|
|
$height = [int]$candidateHeight
|
|
}
|
|
|
|
if (($chunkSize -band 1) -ne 0) {
|
|
$stream.Position = $payloadStart + [long]$chunkSize
|
|
if ($reader.ReadByte() -ne 0) { throw 'webp_padding_invalid' }
|
|
}
|
|
$stream.Position = $payloadStart + $paddedSize
|
|
}
|
|
|
|
if ($null -eq $width -or $null -eq $height -or -not $seenBitstream) {
|
|
throw 'webp_dimensions_missing'
|
|
}
|
|
return [pscustomobject]@{
|
|
width = [int]$width
|
|
height = [int]$height
|
|
sha256 = $digestHex
|
|
}
|
|
}
|
|
catch {
|
|
return $null
|
|
}
|
|
finally {
|
|
if ($null -ne $reader) { $reader.Dispose() }
|
|
if ($null -ne $stream) { $stream.Dispose() }
|
|
}
|
|
}
|
|
|
|
function Test-ExactProperties([object]$Value, [string[]]$Expected) {
|
|
if ($null -eq $Value) { return $false }
|
|
$names = @($Value.PSObject.Properties | ForEach-Object { $_.Name })
|
|
if ($names.Count -ne $Expected.Count) { return $false }
|
|
foreach ($name in $Expected) {
|
|
if ($names -cnotcontains $name) { return $false }
|
|
}
|
|
return $true
|
|
}
|
|
|
|
function Test-SafeSessionScopeValue([object]$Value) {
|
|
if ($null -eq $Value) { return $false }
|
|
$text = [string]$Value
|
|
if ([string]::IsNullOrWhiteSpace($text) -or
|
|
$text.Length -gt 256 -or
|
|
$text -cne $text.Trim()) {
|
|
return $false
|
|
}
|
|
foreach ($character in $text.ToCharArray()) {
|
|
if ([char]::IsControl($character)) { return $false }
|
|
}
|
|
return $true
|
|
}
|
|
|
|
function Test-ExpectedSessionContext([object]$Data) {
|
|
if (-not (Test-ExactProperties $Data @(
|
|
'userId', 'userName', 'accountBook', 'subSystemId',
|
|
'databaseScopeFingerprint', 'subSystemName',
|
|
'isAdministrator', 'activeModule', 'openModuleCount',
|
|
'openModulesTruncated', 'openModules'))) {
|
|
return $false
|
|
}
|
|
foreach ($name in @(
|
|
'userId', 'userName', 'accountBook', 'subSystemId',
|
|
'subSystemName')) {
|
|
if (-not (Test-SafeSessionScopeValue $Data.$name)) { return $false }
|
|
}
|
|
$openModuleCount = -1
|
|
return ([string]$Data.userId -ceq $ExpectedUserId) -and
|
|
([string]$Data.userName -ceq $ExpectedUserName) -and
|
|
([string]$Data.accountBook -ceq $ExpectedAccountBook) -and
|
|
([string]$Data.subSystemId -ceq $ExpectedSubSystemId) -and
|
|
([string]$Data.databaseScopeFingerprint).ToLowerInvariant() -ceq
|
|
$ExpectedDatabaseScopeFingerprint.ToLowerInvariant() -and
|
|
([string]$Data.databaseScopeFingerprint).ToLowerInvariant() -cmatch
|
|
'^[a-f0-9]{64}$' -and
|
|
$Data.isAdministrator -is [bool] -and
|
|
[bool]$Data.isAdministrator -eq $expectedAdministrator -and
|
|
$Data.openModulesTruncated -is [bool] -and
|
|
[int]::TryParse(
|
|
[string]$Data.openModuleCount,
|
|
[ref]$openModuleCount) -and
|
|
$openModuleCount -ge 0 -and $openModuleCount -le 10000 -and
|
|
@($Data.openModules).Count -le 50
|
|
}
|
|
|
|
function Invoke-VerifiedBridgeRead([string]$Action) {
|
|
if ($Action -cnotin @('health', 'context')) { return $null }
|
|
$correlationId = 'preflight-' + $Action + '-' +
|
|
[Guid]::NewGuid().ToString('N')
|
|
$arguments = @(
|
|
'bridge', $Action,
|
|
'--erp-process-id', [string]$ErpProcessId,
|
|
'--expected-database-scope-fingerprint',
|
|
$ExpectedDatabaseScopeFingerprint.ToLowerInvariant(),
|
|
'--expected-user-id', $ExpectedUserId,
|
|
'--expected-user-name', $ExpectedUserName,
|
|
'--expected-account-book', $ExpectedAccountBook,
|
|
'--expected-subsystem-id', $ExpectedSubSystemId,
|
|
'--expected-is-administrator', $(if ($expectedAdministrator) {
|
|
'true'
|
|
} else { 'false' }),
|
|
'--correlation-id', $correlationId
|
|
)
|
|
try {
|
|
$raw = (& $bridgeCliPath @arguments 2>$null | Out-String)
|
|
if ($LASTEXITCODE -ne 0 -or
|
|
[string]::IsNullOrWhiteSpace($raw) -or
|
|
$raw.Length -gt 4MB) {
|
|
return $null
|
|
}
|
|
$result = $raw | ConvertFrom-Json
|
|
if (-not (Test-ExactProperties $result @(
|
|
'ok', 'correlationId', 'data')) -or
|
|
$result.ok -ne $true -or
|
|
[string]$result.correlationId -cne $correlationId -or
|
|
$null -eq $result.data) {
|
|
return $null
|
|
}
|
|
return $result.data
|
|
}
|
|
catch { return $null }
|
|
}
|
|
|
|
foreach ($expectedScopeValue in @(
|
|
$ExpectedUserId,
|
|
$ExpectedUserName,
|
|
$ExpectedAccountBook,
|
|
$ExpectedSubSystemId)) {
|
|
if (-not (Test-SafeSessionScopeValue $expectedScopeValue)) {
|
|
throw 'expected_erp_session_scope_invalid'
|
|
}
|
|
}
|
|
$ExpectedDatabaseScopeFingerprint =
|
|
$ExpectedDatabaseScopeFingerprint.ToLowerInvariant()
|
|
|
|
function Remove-JsonWhitespaceOutsideStrings([string]$Json) {
|
|
if ($null -eq $Json) { return $null }
|
|
$builder = New-Object Text.StringBuilder
|
|
$inString = $false
|
|
$escaped = $false
|
|
foreach ($character in $Json.ToCharArray()) {
|
|
if ($inString) {
|
|
$builder.Append($character) | Out-Null
|
|
if ($escaped) {
|
|
$escaped = $false
|
|
} elseif ($character -eq '\') {
|
|
$escaped = $true
|
|
} elseif ($character -eq '"') {
|
|
$inString = $false
|
|
}
|
|
} elseif ($character -eq '"') {
|
|
$inString = $true
|
|
$builder.Append($character) | Out-Null
|
|
} elseif (-not [char]::IsWhiteSpace($character)) {
|
|
$builder.Append($character) | Out-Null
|
|
}
|
|
}
|
|
if ($inString -or $escaped) { return $null }
|
|
return $builder.ToString()
|
|
}
|
|
|
|
function Test-NonNegativeInteger([object]$Value, [long]$Maximum) {
|
|
if ($null -eq $Value) { return $false }
|
|
$integerTypes = @(
|
|
[byte], [sbyte], [int16], [uint16], [int32], [uint32], [int64], [uint64]
|
|
)
|
|
if ($integerTypes -notcontains $Value.GetType()) { return $false }
|
|
try {
|
|
[long]$number = $Value
|
|
return $number -ge 0 -and $number -le $Maximum
|
|
}
|
|
catch { return $false }
|
|
}
|
|
|
|
function Test-MiniMaxVisionProbeEvidence(
|
|
[string]$EvidencePath,
|
|
[DateTimeOffset]$NowUtc) {
|
|
$result = [ordered]@{
|
|
passed = $false
|
|
code = 'minimax_vision_probe_evidence_missing'
|
|
detail = '必须提供由随包在线探针生成的、24 小时内且不含客户数据的 MiniMax VLM JSON 报告。'
|
|
sha256 = $null
|
|
observedAtUtc = $null
|
|
region = $null
|
|
contractVersion = $null
|
|
}
|
|
try {
|
|
if ([string]::IsNullOrWhiteSpace($EvidencePath)) { return $result }
|
|
$fullPath = [IO.Path]::GetFullPath($EvidencePath)
|
|
if ([IO.Path]::GetExtension($fullPath) -cne '.json' -or
|
|
-not (Test-RegularFile $fullPath 64KB)) {
|
|
return $result
|
|
}
|
|
$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$raw = [IO.File]::ReadAllText($fullPath, $strictUtf8)
|
|
$evidence = $raw | ConvertFrom-Json
|
|
$contract = $evidence.contract
|
|
$probeResult = $evidence.result
|
|
$shapeValid =
|
|
(Test-ExactProperties $evidence @(
|
|
'schemaVersion', 'observedAtUtc', 'passed', 'region',
|
|
'endpoint', 'contract', 'syntheticSourceSha256', 'result')) -and
|
|
(Test-ExactProperties $contract @(
|
|
'component', 'version', 'sourceCommit', 'clientSourceSha256',
|
|
'serverSourceSha256', 'apiSourceHeader')) -and
|
|
(Test-ExactProperties $probeResult @(
|
|
'schemaVersion', 'documentType', 'lineCount',
|
|
'uncertainFieldCount', 'contentSha256')) -and
|
|
($evidence.passed -is [bool]) -and $evidence.passed -eq $true -and
|
|
([string]$evidence.schemaVersion -ceq '1.0') -and
|
|
([string]$contract.component -ceq 'minimax-coding-plan-mcp') -and
|
|
([string]$contract.version -ceq '0.0.4') -and
|
|
([string]$contract.sourceCommit -ceq
|
|
'fbac3b3e56922a1249e00eebe07d9ee68f4768dc') -and
|
|
([string]$contract.clientSourceSha256 -ceq
|
|
'08d4116a20e8a652ceb9e2b6f58b1e7cdfe464b14baff05977e08b4b05b66be3') -and
|
|
([string]$contract.serverSourceSha256 -ceq
|
|
'1dea28d6ba4ee46ba516d7eeedd325a5a102410bb7abb074fc4b0a8a66571864') -and
|
|
([string]$contract.apiSourceHeader -ceq 'Minimax-MCP') -and
|
|
([string]$evidence.syntheticSourceSha256 -ceq
|
|
'd37476a5273821c12ee4a72b512dc152db5729055b6febb8603985f86243abda') -and
|
|
([string]$probeResult.schemaVersion -ceq '1.0') -and
|
|
@('purchase_invoice', 'purchase_detail', 'unknown') -ccontains
|
|
([string]$probeResult.documentType) -and
|
|
(Test-NonNegativeInteger $probeResult.lineCount 10000) -and
|
|
(Test-NonNegativeInteger $probeResult.uncertainFieldCount 10000) -and
|
|
([string]$probeResult.contentSha256 -cmatch '^[a-f0-9]{64}$')
|
|
$region = [string]$evidence.region
|
|
$expectedEndpoint = if ($region -ceq 'cn') {
|
|
'https://api.minimaxi.com/v1/coding_plan/vlm'
|
|
} elseif ($region -ceq 'global') {
|
|
'https://api.minimax.io/v1/coding_plan/vlm'
|
|
} else { '' }
|
|
$shapeValid = $shapeValid -and -not [string]::IsNullOrWhiteSpace(
|
|
$expectedEndpoint) -and ([string]$evidence.endpoint -ceq $expectedEndpoint)
|
|
|
|
$timestampMatch = [Text.RegularExpressions.Regex]::Match(
|
|
$raw,
|
|
'"observedAtUtc"\s*:\s*"(?<value>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,6})?\+00:00)"',
|
|
[Text.RegularExpressions.RegexOptions]::CultureInvariant)
|
|
$timestamp = if ($timestampMatch.Success) {
|
|
$timestampMatch.Groups['value'].Value
|
|
} else { '' }
|
|
$observed = [DateTimeOffset]::MinValue
|
|
$timestampValid = $timestamp -cmatch `
|
|
'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,6})?\+00:00$' -and
|
|
[DateTimeOffset]::TryParse(
|
|
$timestamp,
|
|
[Globalization.CultureInfo]::InvariantCulture,
|
|
[Globalization.DateTimeStyles]::None,
|
|
[ref]$observed) -and
|
|
$observed.Offset -eq [TimeSpan]::Zero
|
|
$shapeValid = $shapeValid -and $timestampValid
|
|
|
|
$canonicalObject = [ordered]@{
|
|
contract = [ordered]@{
|
|
apiSourceHeader = [string]$contract.apiSourceHeader
|
|
clientSourceSha256 = [string]$contract.clientSourceSha256
|
|
component = [string]$contract.component
|
|
serverSourceSha256 = [string]$contract.serverSourceSha256
|
|
sourceCommit = [string]$contract.sourceCommit
|
|
version = [string]$contract.version
|
|
}
|
|
endpoint = [string]$evidence.endpoint
|
|
observedAtUtc = $timestamp
|
|
passed = $true
|
|
region = $region
|
|
result = [ordered]@{
|
|
contentSha256 = [string]$probeResult.contentSha256
|
|
documentType = [string]$probeResult.documentType
|
|
lineCount = [long]$probeResult.lineCount
|
|
schemaVersion = [string]$probeResult.schemaVersion
|
|
uncertainFieldCount = [long]$probeResult.uncertainFieldCount
|
|
}
|
|
schemaVersion = [string]$evidence.schemaVersion
|
|
syntheticSourceSha256 = [string]$evidence.syntheticSourceSha256
|
|
}
|
|
$actualCanonical = Remove-JsonWhitespaceOutsideStrings $raw
|
|
$expectedCanonical = Remove-JsonWhitespaceOutsideStrings `
|
|
($canonicalObject | ConvertTo-Json -Compress -Depth 8)
|
|
$shapeValid = $shapeValid -and
|
|
-not [string]::IsNullOrWhiteSpace($actualCanonical) -and
|
|
$actualCanonical -ceq $expectedCanonical
|
|
if (-not $shapeValid) {
|
|
$result.code = 'minimax_vision_probe_contract_invalid'
|
|
$result.detail = 'MiniMax 在线探针报告不是当前受审来源、固定合成图片和精确 JSON 合同。'
|
|
return $result
|
|
}
|
|
if ($observed -gt $NowUtc.AddMinutes(5) -or
|
|
$observed -lt $NowUtc.AddHours(-24)) {
|
|
$result.code = 'minimax_vision_probe_stale'
|
|
$result.detail = 'MiniMax 在线探针必须在预检前 24 小时内完成，未来时间最多容忍 5 分钟。'
|
|
return $result
|
|
}
|
|
$sha256 = Get-RegularFileSha256 $fullPath 64KB
|
|
if ([string]::IsNullOrWhiteSpace($sha256)) { return $result }
|
|
$result.passed = $true
|
|
$result.code = 'ok'
|
|
$result.detail = '合成图片在线探针合同、区域、时效和报告 SHA-256 已验证。'
|
|
$result.sha256 = $sha256
|
|
$result.observedAtUtc = $timestamp
|
|
$result.region = $region
|
|
$result.contractVersion = '0.0.4'
|
|
return $result
|
|
}
|
|
catch {
|
|
$result.code = 'minimax_vision_probe_contract_invalid'
|
|
$result.detail = 'MiniMax 在线探针报告不是严格 UTF-8 JSON 或合同字段无效。'
|
|
return $result
|
|
}
|
|
}
|
|
|
|
function Test-LegacyBuildEvidence([string]$ArtifactRoot, [string]$ExpectedCommit) {
|
|
$result = [ordered]@{
|
|
passed = $false
|
|
code = 'legacy_build_evidence_missing'
|
|
detail = '必须提供 Windows 旧 ERP/CLI 验收构建目录。'
|
|
evidenceSha256 = $null
|
|
erpPath = $null
|
|
cliPath = $null
|
|
signedPaths = @()
|
|
certificateThumbprint = $null
|
|
}
|
|
try {
|
|
if ([string]::IsNullOrWhiteSpace($ArtifactRoot) -or
|
|
$ExpectedCommit -notmatch '^[A-Fa-f0-9]{40}$') {
|
|
return $result
|
|
}
|
|
$legacyRoot = [IO.Path]::GetFullPath($ArtifactRoot).TrimEnd([char[]]@('\', '/'))
|
|
if (-not [IO.Directory]::Exists($legacyRoot)) { return $result }
|
|
$rootItem = Get-Item -LiteralPath $legacyRoot -Force
|
|
if (($rootItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
|
|
throw 'legacy_root_reparse_forbidden'
|
|
}
|
|
$rootPrefix = $legacyRoot + [IO.Path]::DirectorySeparatorChar
|
|
$evidencePath = Join-Path $legacyRoot 'LEGACY-BUILD-EVIDENCE.json'
|
|
if (-not (Test-RegularFile $evidencePath 8MB)) { return $result }
|
|
$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$evidence = [IO.File]::ReadAllText($evidencePath, $strictUtf8) | ConvertFrom-Json
|
|
$expectedProperties = @(
|
|
'schemaVersion', 'generatedAtUtc', 'buildVerified', 'releaseReadiness',
|
|
'sourceCommit', 'sourceWorktreeDirty', 'configuration', 'platform',
|
|
'targetFramework', 'devExpressContract', 'dependencies', 'msbuildVersion',
|
|
'editbinVersion', 'authenticode', 'erpBinary', 'cliBinary', 'sourceFiles',
|
|
'files', 'remainingHardGates'
|
|
)
|
|
$requiredSignedFiles = @(
|
|
'Ls_ERP.exe', 'lserp-cli.exe', 'Lskj.AgentBridge.dll',
|
|
'Lskj.CommandKernel.dll', 'Lskj.Core.dll'
|
|
)
|
|
$authenticodeFiles = @($evidence.authenticode.files | ForEach-Object { [string]$_ })
|
|
$authenticodeShapeValid = (Test-ExactProperties $evidence.authenticode @(
|
|
'signed', 'certificateThumbprint', 'certificateStoreLocation',
|
|
'timestampUrl', 'files')) -and
|
|
$evidence.authenticode.signed -eq $true -and
|
|
([string]$evidence.authenticode.certificateThumbprint) -match '^[A-Fa-f0-9]{40}$' -and
|
|
@('CurrentUser', 'LocalMachine') -contains `
|
|
([string]$evidence.authenticode.certificateStoreLocation) -and
|
|
([string]$evidence.authenticode.timestampUrl).StartsWith('https://') -and
|
|
$authenticodeFiles.Count -eq $requiredSignedFiles.Count
|
|
foreach ($signedFile in $requiredSignedFiles) {
|
|
if ($authenticodeFiles -notcontains $signedFile) { $authenticodeShapeValid = $false }
|
|
}
|
|
$dependencyShapeValid = (Test-ExactProperties $evidence.dependencies @('cefRedistX86')) -and
|
|
(Test-ExactProperties $evidence.dependencies.cefRedistX86 @(
|
|
'packageId', 'version', 'sha256')) -and
|
|
$evidence.dependencies.cefRedistX86.packageId -eq 'cef.redist.x86' -and
|
|
$evidence.dependencies.cefRedistX86.version -eq '87.1.13' -and
|
|
$evidence.dependencies.cefRedistX86.sha256 -eq `
|
|
'34dfe2504c1ffaef02eab1f38578701b045439349997b6465fd5dd6659fab021'
|
|
$binaryShape = @(
|
|
'assemblyName', 'machine', 'pe32', 'ilOnly', 'bit32Required',
|
|
'largeAddressAware', 'corFlags', 'runtimeVersion'
|
|
)
|
|
if (-not (Test-ExactProperties $evidence $expectedProperties) -or
|
|
$evidence.schemaVersion -ne '1.0' -or $evidence.buildVerified -ne $true -or
|
|
$evidence.releaseReadiness -ne $false -or
|
|
$evidence.sourceWorktreeDirty -ne $false -or
|
|
([string]$evidence.sourceCommit).ToLowerInvariant() -ne $ExpectedCommit.ToLowerInvariant() -or
|
|
$evidence.configuration -ne 'Release' -or $evidence.platform -ne 'x86' -or
|
|
$evidence.targetFramework -ne 'v4.0' -or $evidence.devExpressContract -ne '15.2' -or
|
|
$evidence.erpBinary.assemblyName -ne 'Ls_ERP' -or
|
|
$evidence.cliBinary.assemblyName -ne 'lserp-cli' -or
|
|
$evidence.erpBinary.machine -ne '0x014c' -or
|
|
$evidence.cliBinary.machine -ne '0x014c' -or
|
|
$evidence.erpBinary.pe32 -ne $true -or $evidence.cliBinary.pe32 -ne $true -or
|
|
$evidence.erpBinary.ilOnly -ne $true -or $evidence.cliBinary.ilOnly -ne $true -or
|
|
$evidence.erpBinary.bit32Required -ne $true -or
|
|
$evidence.cliBinary.bit32Required -ne $true -or
|
|
$evidence.erpBinary.largeAddressAware -ne $true -or
|
|
-not (Test-ExactProperties $evidence.erpBinary $binaryShape) -or
|
|
-not (Test-ExactProperties $evidence.cliBinary $binaryShape) -or
|
|
-not $dependencyShapeValid -or
|
|
-not $authenticodeShapeValid -or
|
|
-not ([string]$evidence.erpBinary.runtimeVersion).StartsWith('v4.0') -or
|
|
-not ([string]$evidence.cliBinary.runtimeVersion).StartsWith('v4.0') -or
|
|
$null -eq $evidence.sourceFiles -or $evidence.sourceFiles.Count -le 0 -or
|
|
$evidence.sourceFiles.Count -gt 100 -or
|
|
$null -eq $evidence.files -or $evidence.files.Count -le 0 -or
|
|
$evidence.files.Count -gt 2000 -or
|
|
$null -eq $evidence.remainingHardGates -or
|
|
$evidence.remainingHardGates.Count -ne 3) {
|
|
throw 'legacy_evidence_shape_invalid'
|
|
}
|
|
$expectedFiles = New-Object `
|
|
'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|
|
foreach ($entry in $evidence.files) {
|
|
if (-not (Test-ExactProperties $entry @('path', 'sizeBytes', 'sha256'))) {
|
|
throw 'legacy_evidence_file_shape_invalid'
|
|
}
|
|
$relative = [string]$entry.path
|
|
if ([string]::IsNullOrWhiteSpace($relative) -or
|
|
$relative.Contains('\') -or $relative.StartsWith('/') -or
|
|
$relative.Split('/') -contains '..' -or
|
|
-not $expectedFiles.Add($relative) -or
|
|
([string]$entry.sha256) -notmatch '^[A-Fa-f0-9]{64}$') {
|
|
throw 'legacy_evidence_path_invalid'
|
|
}
|
|
$full = [IO.Path]::GetFullPath((Join-Path $legacyRoot `
|
|
($relative.Replace('/', [string][IO.Path]::DirectorySeparatorChar))))
|
|
if (-not $full.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase) -or
|
|
-not (Test-RegularFile $full 512MB)) {
|
|
throw 'legacy_evidence_file_invalid'
|
|
}
|
|
$item = Get-Item -LiteralPath $full -Force
|
|
if ([long]$entry.sizeBytes -ne $item.Length -or
|
|
(Get-FileHash -LiteralPath $full -Algorithm SHA256).Hash.ToLowerInvariant() -ne
|
|
([string]$entry.sha256).ToLowerInvariant()) {
|
|
throw 'legacy_evidence_hash_mismatch'
|
|
}
|
|
}
|
|
foreach ($sourceEntry in $evidence.sourceFiles) {
|
|
if (-not (Test-ExactProperties $sourceEntry @('path', 'sha256')) -or
|
|
([string]$sourceEntry.path).Contains('\') -or
|
|
([string]$sourceEntry.path).Split('/') -contains '..' -or
|
|
([string]$sourceEntry.sha256) -notmatch '^[A-Fa-f0-9]{64}$') {
|
|
throw 'legacy_source_evidence_shape_invalid'
|
|
}
|
|
}
|
|
$reparseDirectories = @(Get-ChildItem -LiteralPath $legacyRoot -Recurse -Directory -Force |
|
|
Where-Object {
|
|
($_.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0
|
|
})
|
|
if ($reparseDirectories.Count -ne 0) { throw 'legacy_reparse_directory_forbidden' }
|
|
$actualFiles = @(Get-ChildItem -LiteralPath $legacyRoot -Recurse -File -Force |
|
|
ForEach-Object {
|
|
$_.FullName.Substring($rootPrefix.Length).Replace('\', '/')
|
|
} | Where-Object { $_ -ne 'LEGACY-BUILD-EVIDENCE.json' })
|
|
foreach ($relative in $actualFiles) {
|
|
if (-not $expectedFiles.Contains($relative)) {
|
|
throw 'legacy_unexpected_artifact_file'
|
|
}
|
|
}
|
|
$requiredCefFiles = [ordered]@{
|
|
'Runtime/Xilium.CefGlue.dll' = `
|
|
'5057f66d83727e73ce926f918c459fa4a29c9e0a78a2654c09e58210f4355cd7'
|
|
'Runtime/libcef.dll' = `
|
|
'a8d4c9974cbdfc989f9c993cba0a388d69e2c5c009661b2c064baaf016e84cfd'
|
|
'Runtime/chrome_elf.dll' = `
|
|
'b6194e1b093a000a7b9a883edfd4114a9e79332775970a20a36da1dd1837e8f3'
|
|
'Runtime/icudtl.dat' = `
|
|
'8364e6c6bf5744357199de0de3f6ba30846ccda70288675b75059e6fd52241f3'
|
|
'Runtime/locales/zh-CN.pak' = `
|
|
'6be9ef1c87b3162253090c00487238bbf4e5466d235cb49fdb69915a03c480cf'
|
|
'Runtime/locales/en-US.pak' = `
|
|
'f9e993df87cad724a36be1efb4f5a71322c9de4d0885419e5f13ca564115dce7'
|
|
}
|
|
foreach ($relative in $requiredCefFiles.Keys) {
|
|
if (-not $expectedFiles.Contains($relative)) {
|
|
throw 'legacy_cef_runtime_missing'
|
|
}
|
|
$full = Join-Path $legacyRoot `
|
|
($relative.Replace('/', [string][IO.Path]::DirectorySeparatorChar))
|
|
if ((Get-FileHash -LiteralPath $full -Algorithm SHA256).Hash.ToLowerInvariant() -ne
|
|
$requiredCefFiles[$relative]) {
|
|
throw 'legacy_cef_runtime_hash_mismatch'
|
|
}
|
|
}
|
|
if ($actualFiles.Count -ne $expectedFiles.Count -or
|
|
-not $expectedFiles.Contains('Runtime/Ls_ERP.exe') -or
|
|
-not $expectedFiles.Contains('Runtime/lserp-cli.exe') -or
|
|
-not $expectedFiles.Contains('Runtime/Lskj.AgentBridge.dll') -or
|
|
-not $expectedFiles.Contains('Runtime/Lskj.CommandKernel.dll') -or
|
|
-not $expectedFiles.Contains('Runtime/Lskj.Core.dll') -or
|
|
-not $expectedFiles.Contains('MSBUILD.log')) {
|
|
throw 'legacy_required_artifact_missing'
|
|
}
|
|
$result.passed = $true
|
|
$result.code = 'ok'
|
|
$result.detail = ("已验证 {0} 个旧 ERP/CLI 构建文件。" -f $expectedFiles.Count)
|
|
$result.evidenceSha256 = (Get-FileHash -LiteralPath $evidencePath -Algorithm SHA256).Hash.ToLowerInvariant()
|
|
$result.erpPath = Join-Path $legacyRoot 'Runtime\Ls_ERP.exe'
|
|
$result.cliPath = Join-Path $legacyRoot 'Runtime\lserp-cli.exe'
|
|
$result.signedPaths = @($requiredSignedFiles | ForEach-Object {
|
|
Join-Path $legacyRoot ('Runtime\' + $_)
|
|
})
|
|
$result.certificateThumbprint = `
|
|
([string]$evidence.authenticode.certificateThumbprint).ToUpperInvariant()
|
|
return $result
|
|
}
|
|
catch {
|
|
$result.code = 'legacy_build_evidence_invalid'
|
|
$result.detail = '旧 ERP/CLI 构建证据结构、来源绑定或文件哈希无效。'
|
|
return $result
|
|
}
|
|
}
|
|
|
|
function Get-WebView2Version {
|
|
foreach ($path in @(
|
|
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}',
|
|
'HKLM:\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}',
|
|
'HKCU:\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}'
|
|
)) {
|
|
if (Test-Path -LiteralPath $path) {
|
|
$value = (Get-ItemProperty -LiteralPath $path -Name pv -ErrorAction SilentlyContinue).pv
|
|
if ($value) { return [string]$value }
|
|
}
|
|
}
|
|
return $null
|
|
}
|
|
|
|
function Test-TcpEndpoint([Uri]$Uri) {
|
|
$port = if ($Uri.IsDefaultPort) {
|
|
if ($Uri.Scheme -eq 'https') { 443 } else { 80 }
|
|
} else { $Uri.Port }
|
|
$client = New-Object System.Net.Sockets.TcpClient
|
|
try {
|
|
$pending = $client.BeginConnect($Uri.DnsSafeHost, $port, $null, $null)
|
|
if (-not $pending.AsyncWaitHandle.WaitOne(3000, $false)) { return $false }
|
|
$client.EndConnect($pending)
|
|
return $client.Connected
|
|
}
|
|
catch { return $false }
|
|
finally { $client.Dispose() }
|
|
}
|
|
|
|
function Get-AstrBotRuntimeContract([Uri]$BaseUri) {
|
|
$result = [ordered]@{
|
|
passed = $false
|
|
runtimeVersion = $null
|
|
codeVersion = $null
|
|
detail = '无法验证 AstrBot 运行时与磁盘代码版本。'
|
|
}
|
|
$response = $null
|
|
$stream = $null
|
|
$memory = $null
|
|
try {
|
|
$endpoint = [Uri]::new($BaseUri, '/api/v1/stats/versions')
|
|
$request = [Net.HttpWebRequest]::CreateHttp($endpoint)
|
|
$request.Method = 'GET'
|
|
$request.Accept = 'application/json'
|
|
$request.AllowAutoRedirect = $false
|
|
$request.Timeout = 3000
|
|
$request.ReadWriteTimeout = 3000
|
|
$request.Proxy = $null
|
|
$response = [Net.HttpWebResponse]$request.GetResponse()
|
|
if ([int]$response.StatusCode -ne 200 -or
|
|
[string]::IsNullOrWhiteSpace($response.ContentType) -or
|
|
-not $response.ContentType.StartsWith(
|
|
'application/json', [StringComparison]::OrdinalIgnoreCase)) {
|
|
throw 'astrbot_version_response_invalid'
|
|
}
|
|
$maximumBytes = 32KB
|
|
if ($response.ContentLength -gt $maximumBytes) {
|
|
throw 'astrbot_version_response_too_large'
|
|
}
|
|
$stream = $response.GetResponseStream()
|
|
$memory = [IO.MemoryStream]::new()
|
|
[byte[]]$buffer = New-Object byte[] 4096
|
|
[long]$total = 0
|
|
while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) {
|
|
$total += $read
|
|
if ($total -gt $maximumBytes) {
|
|
throw 'astrbot_version_response_too_large'
|
|
}
|
|
$memory.Write($buffer, 0, $read)
|
|
}
|
|
if ($total -le 0) { throw 'astrbot_version_response_empty' }
|
|
$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$payload = $strictUtf8.GetString($memory.ToArray()) | ConvertFrom-Json
|
|
if (-not (Test-ExactProperties $payload @('status', 'message', 'data')) -or
|
|
-not (Test-ExactProperties $payload.data @(
|
|
'webui_version', 'astrbot_version', 'astrbot_code_version')) -or
|
|
[string]$payload.status -cne 'ok' -or
|
|
$payload.data.astrbot_version -isnot [string] -or
|
|
$payload.data.astrbot_code_version -isnot [string]) {
|
|
throw 'astrbot_version_response_shape_invalid'
|
|
}
|
|
$result.runtimeVersion = [string]$payload.data.astrbot_version
|
|
$result.codeVersion = [string]$payload.data.astrbot_code_version
|
|
$result.passed = $result.runtimeVersion -ceq '4.27.2' -and
|
|
$result.codeVersion -ceq '4.27.2'
|
|
$result.detail = if ($result.passed) {
|
|
'运行时与磁盘代码版本均为已复核的 AstrBot 4.27.2。'
|
|
} else {
|
|
'AstrBot 运行时或磁盘代码版本不是已复核的 4.27.2。'
|
|
}
|
|
return $result
|
|
}
|
|
catch {
|
|
return $result
|
|
}
|
|
finally {
|
|
if ($null -ne $memory) { $memory.Dispose() }
|
|
if ($null -ne $stream) { $stream.Dispose() }
|
|
if ($null -ne $response) { $response.Dispose() }
|
|
}
|
|
}
|
|
|
|
$runningOnWindows = $env:OS -eq 'Windows_NT'
|
|
Add-Check 'windows_os' $runningOnWindows 'windows_required' '必须在客户 Windows 10/11 环境运行。'
|
|
|
|
$root = [IO.Path]::GetFullPath($PackageRoot).TrimEnd([char[]]@('\', '/')) + [IO.Path]::DirectorySeparatorChar
|
|
$bridgeCliPath = Join-Path $root 'Host\lserp-agent-cli.exe'
|
|
$manifestPath = Join-Path $root 'SHA256SUMS.json'
|
|
$manifestPassed = $false
|
|
$manifest = $null
|
|
$manifestSha256 = $null
|
|
try {
|
|
if (-not (Test-RegularFile $manifestPath 4MB)) { throw 'manifest_missing' }
|
|
$manifestStream = $null
|
|
$manifestReader = $null
|
|
try {
|
|
$manifestStream = [IO.File]::Open(
|
|
$manifestPath,
|
|
[IO.FileMode]::Open,
|
|
[IO.FileAccess]::Read,
|
|
[IO.FileShare]::Read)
|
|
if ($manifestStream.Length -le 0 -or $manifestStream.Length -gt 4MB) {
|
|
throw 'manifest_size_invalid'
|
|
}
|
|
$manifestReader = [IO.BinaryReader]::new($manifestStream)
|
|
[byte[]]$manifestBytes = $manifestReader.ReadBytes([int]$manifestStream.Length)
|
|
if ($manifestBytes.Length -ne $manifestStream.Length) {
|
|
throw 'manifest_read_incomplete'
|
|
}
|
|
$manifestSha256 = Get-BytesSha256 $manifestBytes
|
|
$strictManifestUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$manifest = $strictManifestUtf8.GetString($manifestBytes) | ConvertFrom-Json
|
|
}
|
|
finally {
|
|
if ($null -ne $manifestReader) { $manifestReader.Dispose() }
|
|
elseif ($null -ne $manifestStream) { $manifestStream.Dispose() }
|
|
}
|
|
if ($manifest.schemaVersion -ne '1.0' -or
|
|
$null -eq $manifest.files -or
|
|
$manifest.files.Count -le 0 -or
|
|
$manifest.files.Count -gt 2000) {
|
|
throw 'manifest_shape_invalid'
|
|
}
|
|
$packageReparseDirectories = @(Get-ChildItem -LiteralPath $root -Recurse -Directory -Force |
|
|
Where-Object {
|
|
($_.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0
|
|
})
|
|
if ($packageReparseDirectories.Count -ne 0) { throw 'manifest_reparse_directory' }
|
|
$expected = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|
|
foreach ($entry in $manifest.files) {
|
|
$relative = [string]$entry.path
|
|
if ([string]::IsNullOrWhiteSpace($relative) -or
|
|
$relative.Contains('\') -or
|
|
$relative.StartsWith('/') -or
|
|
$relative.Split('/') -contains '..' -or
|
|
-not $expected.Add($relative)) {
|
|
throw 'manifest_path_invalid'
|
|
}
|
|
$full = [IO.Path]::GetFullPath((Join-Path $root ($relative.Replace('/', [string][IO.Path]::DirectorySeparatorChar))))
|
|
if (-not $full.StartsWith($root, [StringComparison]::OrdinalIgnoreCase) -or
|
|
-not (Test-RegularFile $full 512MB)) {
|
|
throw 'manifest_file_invalid'
|
|
}
|
|
$item = Get-Item -LiteralPath $full -Force
|
|
if ([long]$entry.sizeBytes -ne $item.Length) { throw 'manifest_size_mismatch' }
|
|
$actual = (Get-FileHash -LiteralPath $full -Algorithm SHA256).Hash.ToLowerInvariant()
|
|
if ($actual -ne ([string]$entry.sha256).ToLowerInvariant()) {
|
|
throw 'manifest_hash_mismatch'
|
|
}
|
|
}
|
|
$actualFiles = @(Get-ChildItem -LiteralPath $root -Recurse -File -Force | ForEach-Object {
|
|
$_.FullName.Substring($root.Length).Replace('\', '/')
|
|
} | Where-Object { $_ -ne 'SHA256SUMS.json' })
|
|
foreach ($relative in $actualFiles) {
|
|
if (-not $expected.Contains($relative)) { throw 'unexpected_package_file' }
|
|
}
|
|
if ($actualFiles.Count -ne $expected.Count) { throw 'manifest_file_count_mismatch' }
|
|
$manifestPassed = $true
|
|
Add-Check 'package_hashes' $true 'ok' ("已验证 {0} 个包内文件。" -f $expected.Count)
|
|
}
|
|
catch {
|
|
$manifestFailure = [string]$_.Exception.Message
|
|
$knownManifestFailures = @(
|
|
'manifest_missing',
|
|
'manifest_size_invalid',
|
|
'manifest_read_incomplete',
|
|
'manifest_shape_invalid',
|
|
'manifest_path_invalid',
|
|
'manifest_file_invalid',
|
|
'manifest_size_mismatch',
|
|
'manifest_hash_mismatch',
|
|
'unexpected_package_file',
|
|
'manifest_file_count_mismatch'
|
|
'manifest_reparse_directory'
|
|
)
|
|
if ($knownManifestFailures -notcontains $manifestFailure) {
|
|
$manifestFailure = 'manifest_verification_error'
|
|
}
|
|
Add-Check 'package_hashes' $false 'package_integrity_failed' `
|
|
("逐文件大小或 SHA-256 校验失败；分类：{0}。" -f $manifestFailure)
|
|
}
|
|
|
|
$packageArchiveBinding = if ($manifestPassed) {
|
|
Test-PackageArchiveBinding $PackageArchivePath $manifest $manifestSha256
|
|
} else {
|
|
[ordered]@{
|
|
passed = $false
|
|
code = 'package_archive_manifest_invalid'
|
|
detail = '解包目录清单未通过，无法把最终 ZIP 绑定到本次预检。'
|
|
sha256 = $null
|
|
}
|
|
}
|
|
Add-Check 'package_archive_binding' $packageArchiveBinding.passed `
|
|
$packageArchiveBinding.code $packageArchiveBinding.detail
|
|
|
|
$packageCommit = ''
|
|
$packageVersion = ''
|
|
$expectedPackageVersionForBinding = [string]$ExpectedPackageVersion
|
|
$packageVersionBindingPassed = $false
|
|
$packageProvenancePassed = $false
|
|
$sqlCompatibilityPassed = $false
|
|
$gugaSupplyChainAuditPassed = $false
|
|
try {
|
|
$buildReportPath = Join-Path $root 'BUILD-VERIFICATION.json'
|
|
if (-not (Test-RegularFile $buildReportPath 1MB)) { throw 'build_report_missing' }
|
|
$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$buildReport = [IO.File]::ReadAllText($buildReportPath, $strictUtf8) | ConvertFrom-Json
|
|
$packageCommit = ([string]$buildReport.sourceCommit).ToLowerInvariant()
|
|
$packageVersion = [string]$buildReport.packageVersion
|
|
if ([string]::IsNullOrWhiteSpace($expectedPackageVersionForBinding)) {
|
|
$archiveName = [IO.Path]::GetFileName($PackageArchivePath)
|
|
$archiveMatch = [Text.RegularExpressions.Regex]::Match(
|
|
$archiveName,
|
|
'^Lserp-AgentPet-(?<version>[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4})-win-x64\.zip$')
|
|
if ($archiveMatch.Success) {
|
|
$expectedPackageVersionForBinding =
|
|
$archiveMatch.Groups['version'].Value
|
|
}
|
|
}
|
|
$packageVersionBindingPassed =
|
|
-not [string]::IsNullOrWhiteSpace($expectedPackageVersionForBinding) -and
|
|
$packageVersion -ceq $expectedPackageVersionForBinding
|
|
$verification = $buildReport.automatedVerification
|
|
$deliveryTopology = $buildReport.deliveryTopology
|
|
$deliveryTopologyValid =
|
|
$null -ne $deliveryTopology -and
|
|
(Test-ExactProperties $deliveryTopology @(
|
|
'desktopBundleContainsLserpCli',
|
|
'desktopBundleContainsBridgeCli',
|
|
'bridgeCliPath',
|
|
'bridgeCliDatabaseDirectAccess',
|
|
'bridgeCliPublishMode',
|
|
'desktopBundleContainsLegacyErp',
|
|
'legacyArtifactMode',
|
|
'legacyBuildTool',
|
|
'runtimeRequiresLegacyArtifact')) -and
|
|
$deliveryTopology.desktopBundleContainsLserpCli -eq $false -and
|
|
$deliveryTopology.desktopBundleContainsBridgeCli -eq $true -and
|
|
[string]$deliveryTopology.bridgeCliPath -ceq `
|
|
'Host/lserp-agent-cli.exe' -and
|
|
$deliveryTopology.bridgeCliDatabaseDirectAccess -eq $false -and
|
|
[string]$deliveryTopology.bridgeCliPublishMode -ceq `
|
|
'win_x64_single_file_self_contained' -and
|
|
$deliveryTopology.desktopBundleContainsLegacyErp -eq $false -and
|
|
[string]$deliveryTopology.legacyArtifactMode -ceq `
|
|
'separate_signed_windows_build' -and
|
|
[string]$deliveryTopology.legacyBuildTool -ceq `
|
|
'Deployment/Build-LegacyErpAcceptance.ps1' -and
|
|
$deliveryTopology.runtimeRequiresLegacyArtifact -eq $true
|
|
$astrbotRuntimeEvidence = $verification.astrbotRuntimeContract
|
|
$sqlCompatibility = $verification.sqlServerCompatibility100
|
|
$sqlCompatibilityPassed =
|
|
(Test-ExactProperties $sqlCompatibility @(
|
|
'passed', 'failed', 'parserPackage', 'parserVersion', 'dialect')) -and
|
|
[int]$sqlCompatibility.passed -ge 10 -and
|
|
[int]$sqlCompatibility.failed -eq 0 -and
|
|
[string]$sqlCompatibility.parserPackage -ceq `
|
|
'Microsoft.SqlServer.TransactSql.ScriptDom' -and
|
|
[string]$sqlCompatibility.parserVersion -ceq '180.59.2' -and
|
|
[string]$sqlCompatibility.dialect -ceq 'TSql100'
|
|
$gugaBuildAudit = $verification.gugaSupplyChainAudit
|
|
$gugaAuditRelative = 'Deployment/guga-upstream-audit.v1.json'
|
|
$gugaAuditPath = Join-Path $root `
|
|
($gugaAuditRelative.Replace('/', [IO.Path]::DirectorySeparatorChar))
|
|
$gugaAuditSha256 = Get-RegularFileSha256 $gugaAuditPath 64KB
|
|
$gugaAudit = [IO.File]::ReadAllText(
|
|
$gugaAuditPath, $strictUtf8) | ConvertFrom-Json
|
|
$gugaAsset = $gugaAudit.asset
|
|
$gugaInstaller = $gugaAudit.installer
|
|
$gugaServiceSource = $gugaAudit.serviceSource
|
|
$gugaDecision = $gugaAudit.commercialDecision
|
|
$bannedGugaHashes = @(
|
|
'3ebd971ba59a0c988a6be0924669b4c5db9234bcc5d17d506e34eba332e6021f',
|
|
'f9f715811c26ca610764a7698e28f2e182882f097f4c60a3f00a79dd7530bd20',
|
|
'1b61ea2af98717b9ebe55beb4c6b820b89e9c42d4fdfeca21cf63ed3ad4e38da'
|
|
)
|
|
$bundledGugaAssets = @($manifest.files | Where-Object {
|
|
$relativePath = ([string]$_.path).Replace('\', '/')
|
|
$fileName = [IO.Path]::GetFileName($relativePath).ToLowerInvariant()
|
|
$fileName -ceq 'spritesheet.webp' -or
|
|
$fileName.EndsWith('.codex-pet.zip') -or
|
|
$bannedGugaHashes -ccontains ([string]$_.sha256).ToLowerInvariant()
|
|
})
|
|
$gugaSupplyChainAuditPassed =
|
|
(Test-ExactProperties $gugaBuildAudit @(
|
|
'passed', 'auditFile', 'auditSha256', 'assetId',
|
|
'installerPackage', 'installerVersion',
|
|
'installerTarballSha256', 'observedSpriteSha256',
|
|
'upstreamCommercialLicensePresent', 'assetBundled')) -and
|
|
$gugaBuildAudit.passed -is [bool] -and
|
|
$gugaBuildAudit.passed -eq $true -and
|
|
[string]$gugaBuildAudit.auditFile -ceq $gugaAuditRelative -and
|
|
[string]$gugaBuildAudit.auditSha256 -ceq $gugaAuditSha256 -and
|
|
[string]$gugaBuildAudit.assetId -ceq 'guga' -and
|
|
[string]$gugaBuildAudit.installerPackage -ceq 'codex-pets' -and
|
|
[string]$gugaBuildAudit.installerVersion -ceq '0.3.0' -and
|
|
[string]$gugaBuildAudit.installerTarballSha256 -ceq
|
|
'9ec8bf1ea09e6d8fdc17b33a594a178a9b20bd3dc6decbb22973758394c9c1c7' -and
|
|
[string]$gugaBuildAudit.observedSpriteSha256 -ceq
|
|
'1b61ea2af98717b9ebe55beb4c6b820b89e9c42d4fdfeca21cf63ed3ad4e38da' -and
|
|
$gugaBuildAudit.upstreamCommercialLicensePresent -is [bool] -and
|
|
$gugaBuildAudit.upstreamCommercialLicensePresent -eq $false -and
|
|
$gugaBuildAudit.assetBundled -is [bool] -and
|
|
$gugaBuildAudit.assetBundled -eq $false -and
|
|
(Test-ExactProperties $gugaAudit @(
|
|
'schemaVersion', 'auditedAtUtc', 'asset', 'installer',
|
|
'serviceSource', 'commercialDecision')) -and
|
|
[string]$gugaAudit.schemaVersion -ceq '1.0' -and
|
|
[string]$gugaAudit.auditedAtUtc -ceq
|
|
'2026-08-13T19:31:24+00:00' -and
|
|
(Test-ExactProperties $gugaAsset @(
|
|
'id', 'displayName', 'ownerHandle', 'ownerName',
|
|
'uploadedAtUtc', 'shareUrl', 'shareDataUrl', 'downloadUrl',
|
|
'packageSha256', 'packageSizeBytes', 'manifestSha256',
|
|
'spriteSha256', 'spriteSizeBytes', 'atlasSize',
|
|
'licenseMetadataPresent', 'licenseFilePresent')) -and
|
|
[string]$gugaAsset.id -ceq 'guga' -and
|
|
[string]$gugaAsset.ownerHandle -ceq 'circus' -and
|
|
[string]$gugaAsset.shareUrl -ceq
|
|
'https://codex-pets.net/share/guga' -and
|
|
[string]$gugaAsset.packageSha256 -ceq $bannedGugaHashes[0] -and
|
|
[long]$gugaAsset.packageSizeBytes -eq 1946012 -and
|
|
[string]$gugaAsset.manifestSha256 -ceq $bannedGugaHashes[1] -and
|
|
[string]$gugaAsset.spriteSha256 -ceq $bannedGugaHashes[2] -and
|
|
[long]$gugaAsset.spriteSizeBytes -eq 1945586 -and
|
|
[string]$gugaAsset.atlasSize -ceq '1536x1872' -and
|
|
$gugaAsset.licenseMetadataPresent -is [bool] -and
|
|
$gugaAsset.licenseMetadataPresent -eq $false -and
|
|
$gugaAsset.licenseFilePresent -is [bool] -and
|
|
$gugaAsset.licenseFilePresent -eq $false -and
|
|
(Test-ExactProperties $gugaInstaller @(
|
|
'packageName', 'version', 'registryUrl', 'tarballUrl',
|
|
'tarballSha1', 'tarballSha256', 'npmIntegrity',
|
|
'declaredLicense', 'repositoryDeclared', 'defaultApiBase',
|
|
'installRoot', 'writtenFiles', 'assetDigestVerification',
|
|
'assetSignatureVerification', 'assetLicenseVerification')) -and
|
|
[string]$gugaInstaller.packageName -ceq 'codex-pets' -and
|
|
[string]$gugaInstaller.version -ceq '0.3.0' -and
|
|
[string]$gugaInstaller.tarballSha1 -ceq
|
|
'82e41349ae63eb9e63099f2e06a56468182e2c90' -and
|
|
[string]$gugaInstaller.tarballSha256 -ceq
|
|
'9ec8bf1ea09e6d8fdc17b33a594a178a9b20bd3dc6decbb22973758394c9c1c7' -and
|
|
[string]$gugaInstaller.declaredLicense -ceq 'MIT' -and
|
|
$gugaInstaller.repositoryDeclared -is [bool] -and
|
|
$gugaInstaller.repositoryDeclared -eq $false -and
|
|
@($gugaInstaller.writtenFiles).Count -eq 2 -and
|
|
[string]$gugaInstaller.writtenFiles[0] -ceq 'pet.json' -and
|
|
[string]$gugaInstaller.writtenFiles[1] -ceq 'spritesheet.webp' -and
|
|
$gugaInstaller.assetDigestVerification -eq $false -and
|
|
$gugaInstaller.assetSignatureVerification -eq $false -and
|
|
$gugaInstaller.assetLicenseVerification -eq $false -and
|
|
(Test-ExactProperties $gugaServiceSource @(
|
|
'repository', 'commit', 'softwareLicense', 'licenseSha256',
|
|
'termsSourceSha256', 'termsEffectiveDate',
|
|
'uploadTermsScope')) -and
|
|
[string]$gugaServiceSource.repository -ceq
|
|
'https://github.com/portons/codex-pet-share' -and
|
|
[string]$gugaServiceSource.commit -ceq
|
|
'22725091da2787e8e525c9289cb7826a34be4950' -and
|
|
[string]$gugaServiceSource.softwareLicense -ceq 'MIT' -and
|
|
[string]$gugaServiceSource.licenseSha256 -ceq
|
|
'13e779572adacb503b7e7a0c676571fcd86114a73f6aa000412c24a9a06a97d3' -and
|
|
[string]$gugaServiceSource.termsSourceSha256 -ceq
|
|
'70ad12414864566b8cd469a7d2ca39fe60050686cecacc126ff1aca587f790bb' -and
|
|
[string]$gugaServiceSource.uploadTermsScope -ceq
|
|
'public-sharing-through-service' -and
|
|
(Test-ExactProperties $gugaDecision @(
|
|
'status', 'code', 'reason', 'requiredEvidence')) -and
|
|
[string]$gugaDecision.status -ceq 'external-license-required' -and
|
|
[string]$gugaDecision.code -ceq 'guga_commercial_license_missing' -and
|
|
@($gugaDecision.requiredEvidence).Count -eq 7 -and
|
|
$bundledGugaAssets.Count -eq 0
|
|
$astrbotRuntimeEvidenceValid =
|
|
(Test-ExactProperties $astrbotRuntimeEvidence @(
|
|
'schemaVersion', 'passed', 'repository', 'sourceTag',
|
|
'sourceCommit', 'runtimeVersion', 'versionSpecifier',
|
|
'pluginVersion', 'licenseExpression', 'licenseSha256',
|
|
'eulaSha256', 'criticalSourceFilesVerified',
|
|
'registeredTools')) -and
|
|
$astrbotRuntimeEvidence.schemaVersion -ceq '1.1' -and
|
|
$astrbotRuntimeEvidence.passed -eq $true -and
|
|
$astrbotRuntimeEvidence.repository -ceq `
|
|
'https://github.com/AstrBotDevs/AstrBot.git' -and
|
|
$astrbotRuntimeEvidence.sourceTag -ceq 'v4.27.2' -and
|
|
$astrbotRuntimeEvidence.sourceCommit -ceq `
|
|
'ad4fbfa90ca0c4ac2b30b3250e34dbf8fe7babbf' -and
|
|
$astrbotRuntimeEvidence.runtimeVersion -ceq '4.27.2' -and
|
|
$astrbotRuntimeEvidence.versionSpecifier -ceq '==4.27.2' -and
|
|
$astrbotRuntimeEvidence.pluginVersion -ceq '0.4.0' -and
|
|
$astrbotRuntimeEvidence.licenseExpression -ceq `
|
|
'AGPL-3.0-or-later' -and
|
|
$astrbotRuntimeEvidence.licenseSha256 -ceq `
|
|
'ccf7d08f932af3e813848881731113afbb7c80d0fd6d958e8d319002bf344d02' -and
|
|
$astrbotRuntimeEvidence.eulaSha256 -ceq `
|
|
'c332de7781e87c67d6d3beda463fa04705075a6bae9e52a252f7c639f6defd80' -and
|
|
[int]$astrbotRuntimeEvidence.criticalSourceFilesVerified -eq 20 -and
|
|
@($astrbotRuntimeEvidence.registeredTools).Count -eq 3 -and
|
|
[string]$astrbotRuntimeEvidence.registeredTools[0] -ceq 'erp_get_context' -and
|
|
[string]$astrbotRuntimeEvidence.registeredTools[1] -ceq `
|
|
'erp_get_capabilities' -and
|
|
[string]$astrbotRuntimeEvidence.registeredTools[2] -ceq 'erp_plan_command'
|
|
if ($buildReport.schemaVersion -ne '1.1' -or
|
|
-not $packageVersionBindingPassed -or
|
|
$packageCommit -notmatch '^[a-f0-9]{40}$' -or
|
|
$buildReport.sourceWorktreeDirty -ne $false -or
|
|
-not $deliveryTopologyValid -or
|
|
$verification.commandKernel.failed -ne 0 -or
|
|
$verification.desktopHost.failed -ne 0 -or
|
|
$verification.petWebUi.failed -ne 0 -or
|
|
$verification.astrbotPlugin.failed -ne 0 -or
|
|
$verification.astrbotPlugin.skipped -ne 0 -or
|
|
-not $astrbotRuntimeEvidenceValid -or
|
|
-not $gugaSupplyChainAuditPassed -or
|
|
$verification.deploymentContracts.failed -ne 0 -or
|
|
-not $sqlCompatibilityPassed -or
|
|
$verification.commandKernel.passed -le 0 -or
|
|
$verification.desktopHost.passed -le 0 -or
|
|
$verification.petWebUi.passed -le 0 -or
|
|
$verification.astrbotPlugin.passed -le 0 -or
|
|
$verification.deploymentContracts.passed -le 0 -or
|
|
$verification.legacyNet40ApiCompile -ne $true -or
|
|
$verification.winX64SelfContainedPublish -ne $true -or
|
|
$verification.bridgeCliWinX64SelfContainedPublish -ne $true -or
|
|
$verification.hostAuthenticode.signed -ne $true -or
|
|
([string]$verification.hostAuthenticode.certificateThumbprint).ToUpperInvariant() -ne
|
|
$HostCertificateThumbprint.ToUpperInvariant()) {
|
|
throw 'build_report_invalid'
|
|
}
|
|
$packageProvenancePassed = $true
|
|
}
|
|
catch {
|
|
$packageProvenancePassed = $false
|
|
}
|
|
Add-Check 'package_source_provenance' $packageProvenancePassed `
|
|
'package_source_provenance_invalid' '包必须来自相同干净提交、版本必须与 ExpectedPackageVersion 或标准 ZIP 文件名一致，且所有自动化契约测试为零失败、零跳过。'
|
|
Add-Check 'guga_supply_chain_audit' $gugaSupplyChainAuditPassed `
|
|
'guga_supply_chain_audit_invalid' `
|
|
'包必须携带锁定 npm/服务/素材哈希的 guga 上游审计，且不得夹带在线下载的素材；该审计不代替书面商用授权。'
|
|
Add-Check 'sqlserver_compatibility100_syntax' $sqlCompatibilityPassed `
|
|
'sqlserver_compatibility100_syntax_invalid' `
|
|
'所有随包 SQL 必须通过锁定版本 Microsoft ScriptDom TSql100 解析，并证明不会误接受高版本语法。'
|
|
|
|
$legacyBuildTool = Join-Path $root 'Deployment\Build-LegacyErpAcceptance.ps1'
|
|
Add-Check 'legacy_build_tool' (Test-RegularFile $legacyBuildTool 2MB) `
|
|
'legacy_build_tool_missing' '商用包必须携带旧 ERP/CLI 的可重复 Windows 构建与取证脚本。'
|
|
$legacyBuildContractTests = Join-Path $root 'Deployment\Test-DeploymentContracts.ps1'
|
|
Add-Check 'legacy_build_contract_tests' (Test-RegularFile $legacyBuildContractTests 2MB) `
|
|
'legacy_build_contract_tests_missing' '商用包必须携带旧 ERP/CLI 构建脚本的离线正负契约测试。'
|
|
$writeEvidenceTools = @(
|
|
(Join-Path $root 'Deployment\New-WorkflowWriteCasesTemplate.ps1'),
|
|
(Join-Path $root 'Deployment\New-WorkflowWriteIntegrationEvidence.ps1'),
|
|
(Join-Path $root 'Deployment\Invoke-WorkflowWriteCaseCapture.ps1'),
|
|
(Join-Path $root 'Deployment\Invoke-LserpFieldReadOnlyValidation.ps1'),
|
|
(Join-Path $root 'Deployment\field-readonly-validation.example.json'),
|
|
(Join-Path $root 'Deployment\Invoke-LserpReadOnlySessionPreflight.ps1'),
|
|
(Join-Path $root 'Deployment\Invoke-LserpSelectOnlyCatalogSnapshot.ps1'),
|
|
(Join-Path $root 'Deployment\Invoke-LserpSelectOnlyProfilePreflight.ps1'),
|
|
(Join-Path $root 'Deployment\New-WorkflowUatAuthorization.ps1'),
|
|
(Join-Path $root 'Deployment\New-WorkflowWriteUatCampaign.ps1'),
|
|
(Join-Path $root 'Deployment\Test-WorkflowWriteUatCampaign.ps1'),
|
|
(Join-Path $root 'Deployment\workflow-write-uat-case-catalog.v1.json'),
|
|
(Join-Path $root 'Deployment\New-WorkflowAcceptanceEvidence.ps1'),
|
|
(Join-Path $root 'Deployment\New-CustomerAcceptanceBundle.ps1')
|
|
)
|
|
$writeEvidenceToolsPresent = @($writeEvidenceTools | Where-Object {
|
|
Test-RegularFile $_ 2MB
|
|
}).Count -eq $writeEvidenceTools.Count
|
|
Add-Check 'workflow_write_evidence_tools' $writeEvidenceToolsPresent `
|
|
'workflow_write_evidence_tools_missing' '商用包必须携带经独立审批并锁定哈希的现场输入交接、绑定精确 ERP 会话的只读动态合同预检、UAT 授权、哈希绑定的 32 用例现场目录、活动编排/断点预检、受控采集、写用例模板、严格证据生成器、工作流签名和客户总验收工具。'
|
|
|
|
$workflowUatCaseCatalogPath = Join-Path $root `
|
|
'Deployment\workflow-write-uat-case-catalog.v1.json'
|
|
$expectedWorkflowUatCaseCatalogSha256 = `
|
|
'23eb6c4f308d4904bf3920ed37499f05521beebde9422026f9732983c16002d5'
|
|
$workflowUatCaseCatalogValid = $false
|
|
$workflowUatCaseCatalogStream = $null
|
|
try {
|
|
if (-not (Test-RegularFile $workflowUatCaseCatalogPath 256KB)) {
|
|
throw 'catalog_file_invalid'
|
|
}
|
|
$workflowUatCaseCatalogStream = [IO.File]::Open(
|
|
$workflowUatCaseCatalogPath, [IO.FileMode]::Open,
|
|
[IO.FileAccess]::Read, [IO.FileShare]::Read)
|
|
$catalogHash = Get-StreamSha256 $workflowUatCaseCatalogStream
|
|
if ($catalogHash -cne $expectedWorkflowUatCaseCatalogSha256) {
|
|
throw 'catalog_hash_mismatch'
|
|
}
|
|
$workflowUatCaseCatalogStream.Position = 0
|
|
$catalogReader = New-Object IO.StreamReader(
|
|
$workflowUatCaseCatalogStream, $strictUtf8, $true, 4096, $true)
|
|
try { $catalogText = $catalogReader.ReadToEnd() }
|
|
finally { $catalogReader.Dispose() }
|
|
$catalog = $catalogText | ConvertFrom-Json
|
|
if (-not (Test-ExactProperties $catalog @(
|
|
'schemaVersion', 'packageType', 'safety', 'workflows')) -or
|
|
[string]$catalog.schemaVersion -cne '1.0' -or
|
|
[string]$catalog.packageType -cne 'workflow_write_uat_case_catalog' -or
|
|
-not (Test-ExactProperties $catalog.safety @(
|
|
'productionUseProhibited',
|
|
'automaticDatabaseOrConfigurationChanges',
|
|
'approvedRestorePointRequired', 'containsCredentials',
|
|
'containsBusinessIdentifiers', 'executableInstructionsIncluded')) -or
|
|
$catalog.safety.productionUseProhibited -ne $true -or
|
|
$catalog.safety.automaticDatabaseOrConfigurationChanges -ne $false -or
|
|
$catalog.safety.approvedRestorePointRequired -ne $true -or
|
|
$catalog.safety.containsCredentials -ne $false -or
|
|
$catalog.safety.containsBusinessIdentifiers -ne $false -or
|
|
$catalog.safety.executableInstructionsIncluded -ne $false) {
|
|
throw 'catalog_contract_invalid'
|
|
}
|
|
$catalogWorkflows = @($catalog.workflows)
|
|
if ($catalogWorkflows.Count -ne 2 -or
|
|
[string]$catalogWorkflows[0].workflow -cne 'purchase' -or
|
|
[int]$catalogWorkflows[0].caseCount -ne 13 -or
|
|
@($catalogWorkflows[0].cases).Count -ne 13 -or
|
|
[string]$catalogWorkflows[1].workflow -cne 'leave' -or
|
|
[int]$catalogWorkflows[1].caseCount -ne 19 -or
|
|
@($catalogWorkflows[1].cases).Count -ne 19) {
|
|
throw 'catalog_coverage_invalid'
|
|
}
|
|
$purchaseCommitCatalogCase = @($catalogWorkflows[0].cases)[0]
|
|
$purchaseCommitPreconditions = [string]::Join(
|
|
"`n",
|
|
@($purchaseCommitCatalogCase.preconditions | ForEach-Object {
|
|
[string]$_
|
|
}))
|
|
$purchaseCommitDbaChecks = [string]::Join(
|
|
"`n",
|
|
@($purchaseCommitCatalogCase.dbaReadOnlyChecks | ForEach-Object {
|
|
[string]$_
|
|
}))
|
|
if ([string]$purchaseCommitCatalogCase.caseCode -cne
|
|
'purchase_unique_match_commit' -or
|
|
$purchaseCommitCatalogCase.sourceDocumentProofRequired -ne $true -or
|
|
-not $purchaseCommitPreconditions.Contains('脱敏电子 PDF') -or
|
|
-not $purchaseCommitPreconditions.Contains(
|
|
'pdfium_minimax_pages_v1') -or
|
|
-not $purchaseCommitDbaChecks.Contains('XML v3') -or
|
|
-not $purchaseCommitDbaChecks.Contains(
|
|
'pdfium_minimax_pages_v1')) {
|
|
throw 'catalog_pdf_evidence_contract_invalid'
|
|
}
|
|
$campaignGeneratorSource = [IO.File]::ReadAllText(
|
|
(Join-Path $root 'Deployment\New-WorkflowWriteUatCampaign.ps1'),
|
|
$strictUtf8)
|
|
$campaignCheckerSource = [IO.File]::ReadAllText(
|
|
(Join-Path $root 'Deployment\Test-WorkflowWriteUatCampaign.ps1'),
|
|
$strictUtf8)
|
|
if (-not $campaignGeneratorSource.Contains($expectedWorkflowUatCaseCatalogSha256) -or
|
|
-not $campaignCheckerSource.Contains($expectedWorkflowUatCaseCatalogSha256)) {
|
|
throw 'catalog_tool_binding_invalid'
|
|
}
|
|
$workflowUatCaseCatalogValid = $true
|
|
}
|
|
catch {
|
|
$workflowUatCaseCatalogValid = $false
|
|
}
|
|
finally {
|
|
if ($null -ne $workflowUatCaseCatalogStream) {
|
|
$workflowUatCaseCatalogStream.Dispose()
|
|
}
|
|
}
|
|
Add-Check 'workflow_uat_case_catalog' $workflowUatCaseCatalogValid `
|
|
'workflow_uat_case_catalog_invalid' '32 项现场目录必须保持受审原始字节、安全声明和采购 13/请假 19 覆盖，并由活动生成器及恢复检查器共同绑定其 SHA-256。'
|
|
|
|
$legacyEvidence = Test-LegacyBuildEvidence $LegacyArtifactRoot $packageCommit
|
|
Add-Check 'legacy_build_evidence' $legacyEvidence.passed $legacyEvidence.code $legacyEvidence.detail
|
|
$legacyErpSignature = $false
|
|
$legacyCliSignature = $false
|
|
$legacyCriticalSignatures = $false
|
|
if ($legacyEvidence.passed -and $runningOnWindows) {
|
|
try {
|
|
$criticalValid = $true
|
|
foreach ($signedPath in $legacyEvidence.signedPaths) {
|
|
$signature = Get-AuthenticodeSignature -LiteralPath $signedPath
|
|
if ($signature.Status -ne [System.Management.Automation.SignatureStatus]::Valid -or
|
|
$null -eq $signature.SignerCertificate -or
|
|
$signature.SignerCertificate.Thumbprint -ne $legacyEvidence.certificateThumbprint) {
|
|
$criticalValid = $false
|
|
}
|
|
}
|
|
$erpSignature = Get-AuthenticodeSignature -LiteralPath $legacyEvidence.erpPath
|
|
$cliSignature = Get-AuthenticodeSignature -LiteralPath $legacyEvidence.cliPath
|
|
$legacyErpSignature = $erpSignature.Status -eq `
|
|
[System.Management.Automation.SignatureStatus]::Valid
|
|
$legacyCliSignature = $cliSignature.Status -eq `
|
|
[System.Management.Automation.SignatureStatus]::Valid
|
|
$legacyCriticalSignatures = $criticalValid
|
|
}
|
|
catch {
|
|
$legacyErpSignature = $false
|
|
$legacyCliSignature = $false
|
|
$legacyCriticalSignatures = $false
|
|
}
|
|
}
|
|
Add-Check 'legacy_erp_authenticode' $legacyErpSignature `
|
|
'legacy_erp_signature_invalid' '最终 Ls_ERP.exe 必须具有有效 Authenticode 签名。'
|
|
Add-Check 'legacy_cli_authenticode' $legacyCliSignature `
|
|
'legacy_cli_signature_invalid' '最终 lserp-cli.exe 必须具有有效 Authenticode 签名。'
|
|
Add-Check 'legacy_bridge_authenticode' $legacyCriticalSignatures `
|
|
'legacy_bridge_signature_invalid' 'AgentBridge、CommandKernel 和 Core 关键程序集必须与 EXE 使用同一有效签名证书。'
|
|
|
|
$hostPath = Join-Path $root 'Host\Lskj.AgentPet.Host.exe'
|
|
$hostCriticalPaths = @(
|
|
$hostPath,
|
|
(Join-Path $root 'Host\Lskj.AgentPet.Host.dll'),
|
|
(Join-Path $root 'Host\Lskj.AgentPet.Host.Core.dll'),
|
|
$bridgeCliPath
|
|
)
|
|
$bundledFullCliCount = if ($manifestPassed) {
|
|
@($manifest.files | Where-Object {
|
|
[string]$_.path -match '(^|/)lserp-cli[.]exe$'
|
|
}).Count
|
|
} else { 1 }
|
|
$hostPresent = @($hostCriticalPaths | Where-Object {
|
|
-not (Test-RegularFile $_ 512MB)
|
|
}).Count -eq 0 -and
|
|
$bundledFullCliCount -eq 0 -and
|
|
-not [IO.File]::Exists((Join-Path $root 'Host\lserp-agent-cli.dll')) -and
|
|
-not [IO.File]::Exists((Join-Path $root 'Host\lserp-agent-cli.deps.json')) -and
|
|
-not [IO.File]::Exists((Join-Path $root 'Host\lserp-agent-cli.runtimeconfig.json'))
|
|
Add-Check 'desktop_host' $hostPresent 'host_missing' '自包含桌宠宿主必须存在。'
|
|
$hostSignaturesValid = $false
|
|
if ($hostPresent -and $runningOnWindows) {
|
|
$hostSignaturesValid = $true
|
|
$expectedHostThumbprint = $HostCertificateThumbprint.ToUpperInvariant()
|
|
foreach ($criticalPath in $hostCriticalPaths) {
|
|
$signature = Get-AuthenticodeSignature -LiteralPath $criticalPath
|
|
if ($signature.Status -ne [System.Management.Automation.SignatureStatus]::Valid -or
|
|
$null -eq $signature.SignerCertificate -or
|
|
$signature.SignerCertificate.Thumbprint.ToUpperInvariant() -ne
|
|
$expectedHostThumbprint) {
|
|
$hostSignaturesValid = $false
|
|
}
|
|
}
|
|
}
|
|
Add-Check 'host_authenticode' $hostSignaturesValid `
|
|
'host_signature_invalid' '桌宠与桥接 CLI 的一方 EXE/DLL 必须使用指定客户发布证书且签名有效。'
|
|
|
|
$bridgeCliIdentityValid = $false
|
|
if ($hostSignaturesValid -and $runningOnWindows) {
|
|
try {
|
|
$identityCorrelation = 'preflight-version-' + `
|
|
[Guid]::NewGuid().ToString('N')
|
|
$identityRaw = (& $bridgeCliPath version `
|
|
--correlation-id $identityCorrelation 2>$null | Out-String)
|
|
if ($LASTEXITCODE -ne 0 -or
|
|
[string]::IsNullOrWhiteSpace($identityRaw) -or
|
|
$identityRaw.Length -gt 64KB) {
|
|
throw 'bridge_cli_identity_execution_failed'
|
|
}
|
|
$identity = $identityRaw | ConvertFrom-Json
|
|
$identityData = $identity.data
|
|
$bridgeCliIdentityValid =
|
|
(Test-ExactProperties $identity @(
|
|
'ok', 'correlationId', 'data')) -and
|
|
$identity.ok -eq $true -and
|
|
[string]$identity.correlationId -ceq $identityCorrelation -and
|
|
(Test-ExactProperties $identityData @(
|
|
'component', 'version', 'protocolVersion', 'bridgeOnly',
|
|
'databaseDirectAccess', 'sessionSource')) -and
|
|
[string]$identityData.component -ceq 'lserp-agent-cli' -and
|
|
[string]$identityData.version -ceq $packageVersion -and
|
|
[string]$identityData.protocolVersion -ceq '1.0' -and
|
|
$identityData.bridgeOnly -eq $true -and
|
|
$identityData.databaseDirectAccess -eq $false -and
|
|
[string]$identityData.sessionSource -ceq `
|
|
'current_logged_in_erp_process'
|
|
}
|
|
catch { $bridgeCliIdentityValid = $false }
|
|
}
|
|
Add-Check 'bridge_cli_runtime_identity' $bridgeCliIdentityValid `
|
|
'bridge_cli_runtime_identity_invalid' `
|
|
'最终签名桥接 CLI 必须实际运行并逐字段证明包版本、协议、本地 ERP 会话来源和禁止数据库直连。'
|
|
|
|
$webViewVersion = if ($runningOnWindows) { Get-WebView2Version } else { $null }
|
|
$minimumWebViewVersion = [Version]'151.0.4129.50'
|
|
$parsedWebViewVersion = $null
|
|
$webViewVersionValid = -not [string]::IsNullOrWhiteSpace($webViewVersion) -and
|
|
[Version]::TryParse($webViewVersion, [ref]$parsedWebViewVersion)
|
|
$webViewCompatible = $webViewVersionValid -and
|
|
$parsedWebViewVersion -ge $minimumWebViewVersion
|
|
$webViewCode = if ([string]::IsNullOrWhiteSpace($webViewVersion)) {
|
|
'webview2_missing'
|
|
} else {
|
|
'webview2_version_unsupported'
|
|
}
|
|
$webViewDetail = if (-not $webViewVersionValid) {
|
|
'未检测到可解析的 Evergreen Runtime 版本。最低要求：151.0.4129.50。'
|
|
} elseif (-not $webViewCompatible) {
|
|
"版本：$webViewVersion；最低要求：151.0.4129.50。"
|
|
} else {
|
|
"版本：$webViewVersion"
|
|
}
|
|
Add-Check 'webview2_runtime' $webViewCompatible $webViewCode $webViewDetail
|
|
|
|
$expectedSpriteWidth = 1536
|
|
$expectedSpriteHeight = 1872
|
|
$maximumSpriteBytes = 20MB
|
|
$spriteFull = [IO.Path]::GetFullPath($SpritePath)
|
|
$licenseFull = [IO.Path]::GetFullPath($SpriteLicenseEvidence)
|
|
$astrBotComplianceFull = [IO.Path]::GetFullPath($AstrBotComplianceEvidence)
|
|
$miniMaxComplianceFull = [IO.Path]::GetFullPath($MiniMaxServiceComplianceEvidence)
|
|
$miniMaxProbeFull = [IO.Path]::GetFullPath($MiniMaxVisionProbeEvidence)
|
|
$rolloutFull = [IO.Path]::GetFullPath($RolloutPolicyPath)
|
|
$rolloutSha256 = Get-RegularFileSha256 $rolloutFull 256KB
|
|
$rolloutFileOk = -not [string]::IsNullOrWhiteSpace($rolloutSha256)
|
|
Add-Check 'rollout_policy_file' $rolloutFileOk 'rollout_policy_file_invalid' `
|
|
'命令发布策略必须是包外、非链接、不超过 256 KB 且可完整哈希的普通文件。'
|
|
$spriteDimensions = if ((Test-RegularFile $spriteFull $maximumSpriteBytes) -and
|
|
([IO.Path]::GetExtension($spriteFull) -eq '.webp')) {
|
|
Get-WebPDimensions $spriteFull $maximumSpriteBytes
|
|
} else {
|
|
$null
|
|
}
|
|
$spriteOk = $null -ne $spriteDimensions -and
|
|
$spriteDimensions.width -eq $expectedSpriteWidth -and
|
|
$spriteDimensions.height -eq $expectedSpriteHeight
|
|
$licenseExtension = [IO.Path]::GetExtension($licenseFull).ToLowerInvariant()
|
|
$licenseOk = (Test-RegularFile $licenseFull 16MB) -and
|
|
@('.pdf', '.p7s') -contains $licenseExtension
|
|
$astrBotComplianceExtension = [IO.Path]::GetExtension(
|
|
$astrBotComplianceFull).ToLowerInvariant()
|
|
$astrBotComplianceSha256 = if (
|
|
@('.pdf', '.p7s') -contains $astrBotComplianceExtension) {
|
|
Get-RegularFileSha256 $astrBotComplianceFull 16MB
|
|
} else { $null }
|
|
$astrBotComplianceOk = -not [string]::IsNullOrWhiteSpace(
|
|
$astrBotComplianceSha256)
|
|
$miniMaxComplianceExtension = [IO.Path]::GetExtension(
|
|
$miniMaxComplianceFull).ToLowerInvariant()
|
|
$miniMaxComplianceSha256 = if (
|
|
@('.pdf', '.p7s') -contains $miniMaxComplianceExtension) {
|
|
Get-RegularFileSha256 $miniMaxComplianceFull 16MB
|
|
} else { $null }
|
|
$miniMaxComplianceOk = -not [string]::IsNullOrWhiteSpace(
|
|
$miniMaxComplianceSha256)
|
|
Add-Check 'guga_sprite' $spriteOk 'sprite_invalid' `
|
|
'素材必须是包外、结构完整且尺寸为 1536×1872 的普通 WebP 文件。'
|
|
Add-Check 'guga_commercial_license_evidence' $licenseOk 'sprite_license_missing' '必须提供经人工复核的书面商用授权 PDF 或 P7S 证据。'
|
|
Add-Check 'astrbot_agpl_eula_compliance_evidence' $astrBotComplianceOk `
|
|
'astrbot_compliance_evidence_missing' `
|
|
'必须提供法务复核的 AstrBot AGPL-3.0-or-later、EULA、交付和网络源码方案 PDF 或 P7S。'
|
|
Add-Check 'minimax_api_service_compliance_evidence' $miniMaxComplianceOk `
|
|
'minimax_service_compliance_evidence_missing' `
|
|
'必须提供法务复核的 MiniMax API 服务条款、数据处理、区域、套餐与密钥管理方案 PDF 或 P7S。'
|
|
$miniMaxProbe = Test-MiniMaxVisionProbeEvidence `
|
|
$miniMaxProbeFull ([DateTimeOffset]::UtcNow)
|
|
Add-Check 'minimax_online_vision_probe_evidence' $miniMaxProbe.passed `
|
|
$miniMaxProbe.code $miniMaxProbe.detail
|
|
|
|
$credentialListing = ''
|
|
if ($runningOnWindows) {
|
|
$credentialListing = (& "$env:SystemRoot\System32\cmdkey.exe" "/list:$CredentialTarget" 2>$null | Out-String)
|
|
}
|
|
$credentialOk = $credentialListing.IndexOf($CredentialTarget, [StringComparison]::OrdinalIgnoreCase) -ge 0
|
|
Add-Check 'astrbot_credential' $credentialOk 'astrbot_credential_missing' 'AstrBot Key 必须位于 Windows 通用凭据中。'
|
|
Add-Check 'desktop_secret_environment' `
|
|
(-not $env:LSERP_ASTRBOT_API_KEY -and -not $env:MINIMAX_API_KEY) `
|
|
'desktop_secret_environment_forbidden' '桌宠进程环境不得包含 AstrBot 或 MiniMax Key。'
|
|
|
|
$uri = $null
|
|
$uriOk = [Uri]::TryCreate($AstrBotBaseUrl, [UriKind]::Absolute, [ref]$uri)
|
|
if ($uriOk) {
|
|
$uriOk = $uri.Scheme -in @('http', 'https') -and
|
|
$uri.IsLoopback -and
|
|
-not $uri.UserInfo -and -not $uri.Query -and -not $uri.Fragment
|
|
}
|
|
Add-Check 'astrbot_transport' $uriOk 'astrbot_loopback_required' `
|
|
'当前商用传输只支持同机 loopback AstrBot；远程模式必须先部署双向设备身份 Agent Gateway。'
|
|
$astrBotReachable = $uriOk -and (Test-TcpEndpoint $uri)
|
|
Add-Check 'astrbot_reachable' $astrBotReachable 'astrbot_unreachable' '只检查 TCP 连通性，不发送 Key。'
|
|
$astrbotRuntime = if ($astrBotReachable) {
|
|
Get-AstrBotRuntimeContract $uri
|
|
} else {
|
|
[ordered]@{
|
|
passed = $false
|
|
runtimeVersion = $null
|
|
codeVersion = $null
|
|
detail = 'AstrBot 不可达，无法验证运行时与磁盘代码版本。'
|
|
}
|
|
}
|
|
Add-Check 'astrbot_runtime_contract' $astrbotRuntime.passed `
|
|
'astrbot_runtime_contract_mismatch' $astrbotRuntime.detail
|
|
|
|
$bridgeFiles = @()
|
|
if ([IO.Directory]::Exists($BridgeDiscoveryDirectory)) {
|
|
$bridgeFiles = @(Get-ChildItem -LiteralPath $BridgeDiscoveryDirectory -Filter 'agentbridge-*.json' -File -ErrorAction SilentlyContinue)
|
|
}
|
|
$bridgeHealthy = $false
|
|
$rolloutAttested = $false
|
|
$sessionScopeAttested = $false
|
|
if ($runningOnWindows -and $legacyCliSignature -and $bridgeFiles.Count -gt 0) {
|
|
try {
|
|
$firstSession = Invoke-VerifiedBridgeRead 'context'
|
|
$health = Invoke-VerifiedBridgeRead 'health'
|
|
$lastSession = Invoke-VerifiedBridgeRead 'context'
|
|
$bridgeHealthy = $null -ne $health -and
|
|
(Test-ExactProperties $health @(
|
|
'status', 'protocolVersion', 'serverTimeUtc',
|
|
'commandCount', 'enabledCommandCount',
|
|
'operationalPolicy', 'rolloutPolicy', 'workflowUat')) -and
|
|
[string]$health.status -ceq 'ready' -and
|
|
[string]$health.protocolVersion -ceq '1.0'
|
|
$sessionScopeAttested =
|
|
(Test-ExpectedSessionContext $firstSession) -and
|
|
(Test-ExpectedSessionContext $lastSession) -and
|
|
[string]$firstSession.userId -ceq [string]$lastSession.userId -and
|
|
[string]$firstSession.userName -ceq [string]$lastSession.userName -and
|
|
[string]$firstSession.accountBook -ceq
|
|
[string]$lastSession.accountBook -and
|
|
[string]$firstSession.subSystemId -ceq
|
|
[string]$lastSession.subSystemId -and
|
|
[string]$firstSession.databaseScopeFingerprint -ceq
|
|
[string]$lastSession.databaseScopeFingerprint -and
|
|
[bool]$firstSession.isAdministrator -eq
|
|
[bool]$lastSession.isAdministrator
|
|
if ($bridgeHealthy) {
|
|
try {
|
|
$runtimeRollout = $health.rolloutPolicy
|
|
$expectedRolloutProperties = @(
|
|
'configured',
|
|
'failClosed',
|
|
'customerId',
|
|
'databaseScopeFingerprint',
|
|
'sourceSha256',
|
|
'defaultAction',
|
|
'ruleCount'
|
|
)
|
|
$actualRolloutProperties = @(
|
|
$runtimeRollout.PSObject.Properties |
|
|
ForEach-Object { $_.Name }
|
|
)
|
|
$rolloutShapeValid =
|
|
$actualRolloutProperties.Count -eq
|
|
$expectedRolloutProperties.Count
|
|
foreach ($name in $expectedRolloutProperties) {
|
|
$rolloutShapeValid = $rolloutShapeValid -and
|
|
($actualRolloutProperties -ccontains $name)
|
|
}
|
|
$runtimeRuleCount = -1
|
|
$ruleCountValid = [int]::TryParse(
|
|
[string]$runtimeRollout.ruleCount,
|
|
[ref]$runtimeRuleCount) -and
|
|
$runtimeRuleCount -ge 0 -and $runtimeRuleCount -le 128
|
|
$rolloutAttested = $rolloutShapeValid -and
|
|
$rolloutFileOk -and
|
|
$runtimeRollout.configured -eq $true -and
|
|
$runtimeRollout.failClosed -eq $true -and
|
|
[string]$runtimeRollout.customerId -ceq
|
|
$RolloutCustomerId -and
|
|
[string]$runtimeRollout.databaseScopeFingerprint -ceq
|
|
$ExpectedDatabaseScopeFingerprint -and
|
|
[string]$runtimeRollout.sourceSha256 -ceq
|
|
$rolloutSha256 -and
|
|
[string]$runtimeRollout.defaultAction -ceq 'deny' -and
|
|
$ruleCountValid
|
|
}
|
|
catch { $rolloutAttested = $false }
|
|
}
|
|
}
|
|
catch { $bridgeHealthy = $false }
|
|
}
|
|
Add-Check 'erp_agent_bridge' $bridgeHealthy 'erp_bridge_unhealthy' `
|
|
'必须由最终签名 CLI 实际连接 -ErpProcessId 指定的当前 ERP 命令桥。'
|
|
Add-Check 'erp_rollout_policy' $rolloutAttested 'erp_rollout_policy_mismatch' `
|
|
'目标 ERP 必须证明已加载与现场文件 SHA-256、客户部署标识和数据库作用域一致的默认拒绝发布策略。'
|
|
Add-Check 'erp_session_scope' $sessionScopeAttested `
|
|
'erp_session_scope_mismatch' `
|
|
'目标 ERP 在健康检查前后都必须逐字匹配预期用户、账套、子系统和数据库作用域；报告不保存这些原始标识。'
|
|
|
|
$astrbotPluginRoot = Join-Path $root 'AstrBotPlugin'
|
|
$expectedAstrBotPluginFiles = @(
|
|
'README.md',
|
|
'__init__.py',
|
|
'_conf_schema.json',
|
|
'astrbot-contract.json',
|
|
'astrbot_contract.py',
|
|
'attachment_extract.py',
|
|
'attachment_provenance.py',
|
|
'attachment_sandbox.py',
|
|
'attachment_worker.py',
|
|
'bridge_protocol.py',
|
|
'main.py',
|
|
'metadata.yaml',
|
|
'pdf_render_sandbox.py',
|
|
'pdf_render_worker.py',
|
|
'pdf_vision.py',
|
|
'plan_chain.py',
|
|
'prompt.py',
|
|
'purchase_tabular_binding.py',
|
|
'purchase_vision_binding.py',
|
|
'requirements.txt',
|
|
'session_auth.py',
|
|
'tools.py',
|
|
'verify_astrbot_contract.py',
|
|
'verify_minimax_vlm_contract.py',
|
|
'vision.py'
|
|
)
|
|
$astrbotPluginLayoutOk = $false
|
|
try {
|
|
$actualAstrBotPluginPaths = @(
|
|
[IO.Directory]::GetFiles(
|
|
$astrbotPluginRoot,
|
|
'*',
|
|
[IO.SearchOption]::TopDirectoryOnly)
|
|
)
|
|
$actualAstrBotPluginFiles = @(
|
|
$actualAstrBotPluginPaths |
|
|
ForEach-Object { [IO.Path]::GetFileName($_) }
|
|
)
|
|
$astrbotPluginLayoutOk =
|
|
@([IO.Directory]::GetDirectories(
|
|
$astrbotPluginRoot,
|
|
'*',
|
|
[IO.SearchOption]::TopDirectoryOnly)).Count -eq 0 -and
|
|
$actualAstrBotPluginFiles.Count -eq $expectedAstrBotPluginFiles.Count
|
|
foreach ($name in $expectedAstrBotPluginFiles) {
|
|
$astrbotPluginLayoutOk = $astrbotPluginLayoutOk -and
|
|
($actualAstrBotPluginFiles -ccontains $name)
|
|
}
|
|
foreach ($path in $actualAstrBotPluginPaths) {
|
|
$astrbotPluginLayoutOk = $astrbotPluginLayoutOk -and
|
|
(Test-RegularFile $path 2MB)
|
|
}
|
|
}
|
|
catch { $astrbotPluginLayoutOk = $false }
|
|
Add-Check 'astrbot_plugin_layout' $astrbotPluginLayoutOk `
|
|
'astrbot_plugin_layout_invalid' `
|
|
'AstrBot 插件目录只能包含受审的顶层白名单源码，禁止夹带 data、缓存、凭据或链接。'
|
|
|
|
$metadataPath = Join-Path $astrbotPluginRoot 'metadata.yaml'
|
|
$astrbotContractPath = Join-Path $root 'AstrBotPlugin\astrbot-contract.json'
|
|
$astrbotGuardPath = Join-Path $root 'AstrBotPlugin\astrbot_contract.py'
|
|
$astrbotMainPath = Join-Path $root 'AstrBotPlugin\main.py'
|
|
$metadataOk = $false
|
|
if ((Test-RegularFile $metadataPath 64KB) -and
|
|
(Test-RegularFile $astrbotContractPath 64KB) -and
|
|
(Test-RegularFile $astrbotGuardPath 64KB) -and
|
|
(Test-RegularFile $astrbotMainPath 512KB)) {
|
|
try {
|
|
$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$metadata = [IO.File]::ReadAllText($metadataPath, $strictUtf8)
|
|
$contract = [IO.File]::ReadAllText(
|
|
$astrbotContractPath, $strictUtf8) | ConvertFrom-Json
|
|
$guard = [IO.File]::ReadAllText($astrbotGuardPath, $strictUtf8)
|
|
$main = [IO.File]::ReadAllText($astrbotMainPath, $strictUtf8)
|
|
$criticalHashProperties = @(
|
|
$contract.criticalSourceSha256.PSObject.Properties)
|
|
$criticalHashNames = @(
|
|
'astrbot/__init__.py',
|
|
'astrbot/api/__init__.py',
|
|
'astrbot/api/event/__init__.py',
|
|
'astrbot/api/message_components.py',
|
|
'astrbot/api/provider/__init__.py',
|
|
'astrbot/api/star/__init__.py',
|
|
'astrbot/core/agent/run_context.py',
|
|
'astrbot/core/agent/tool.py',
|
|
'astrbot/core/astr_agent_context.py',
|
|
'astrbot/core/message/components.py',
|
|
'astrbot/core/provider/entities.py',
|
|
'astrbot/core/star/base.py',
|
|
'astrbot/core/star/context.py',
|
|
'astrbot/core/star/star_manager.py',
|
|
'astrbot/dashboard/api/stats.py',
|
|
'astrbot/dashboard/responses.py',
|
|
'astrbot/dashboard/services/stat_service.py'
|
|
)
|
|
$criticalHashesValid = $criticalHashProperties.Count -eq `
|
|
$criticalHashNames.Count
|
|
foreach ($name in $criticalHashNames) {
|
|
$property = $contract.criticalSourceSha256.PSObject.Properties[$name]
|
|
$criticalHashesValid = $criticalHashesValid -and
|
|
$null -ne $property -and
|
|
([string]$property.Value) -cmatch '^[a-f0-9]{64}$'
|
|
}
|
|
$metadataOk = $metadata.Contains('version: 0.4.0') -and
|
|
$metadata.Contains('astrbot_version: "==4.27.2"') -and
|
|
(Test-ExactProperties $contract @(
|
|
'schemaVersion', 'repository', 'tag', 'commit',
|
|
'runtimeVersion', 'versionSpecifier', 'pluginVersion',
|
|
'license', 'licenseSha256', 'eulaSha256',
|
|
'projectMetadataSha256', 'criticalSourceSha256')) -and
|
|
$contract.schemaVersion -ceq '1.1' -and
|
|
$contract.repository -ceq `
|
|
'https://github.com/AstrBotDevs/AstrBot.git' -and
|
|
$contract.tag -ceq 'v4.27.2' -and
|
|
$contract.commit -ceq `
|
|
'ad4fbfa90ca0c4ac2b30b3250e34dbf8fe7babbf' -and
|
|
$contract.runtimeVersion -ceq '4.27.2' -and
|
|
$contract.versionSpecifier -ceq '==4.27.2' -and
|
|
$contract.pluginVersion -ceq '0.4.0' -and
|
|
$contract.license -ceq 'AGPL-3.0-or-later' -and
|
|
$contract.licenseSha256 -ceq `
|
|
'ccf7d08f932af3e813848881731113afbb7c80d0fd6d958e8d319002bf344d02' -and
|
|
$contract.eulaSha256 -ceq `
|
|
'c332de7781e87c67d6d3beda463fa04705075a6bae9e52a252f7c639f6defd80' -and
|
|
$contract.projectMetadataSha256 -ceq `
|
|
'd61527cc6ccb6163930f2b32f8518e8ca56a4247cd67e883adfc68a19dd233aa' -and
|
|
$criticalHashesValid -and
|
|
$guard.Contains('SUPPORTED_ASTRBOT_VERSION: Final = "4.27.2"') -and
|
|
$guard.Contains('SUPPORTED_ASTRBOT_SOURCE_SHA256: Final') -and
|
|
$guard.Contains('critical_source_hash_mismatch') -and
|
|
$guard.Contains('astrbot_runtime_contract_mismatch') -and
|
|
$main.Contains('assert_supported_astrbot_runtime()')
|
|
}
|
|
catch { $metadataOk = $false }
|
|
}
|
|
Add-Check 'astrbot_plugin_contract' $metadataOk 'astrbot_plugin_contract_invalid' `
|
|
'插件、运行时守卫和来源证据必须精确锁定 AstrBot 4.27.2。'
|
|
|
|
$visionPath = Join-Path $root 'AstrBotPlugin\vision.py'
|
|
$visionConfigPath = Join-Path $root 'AstrBotPlugin\_conf_schema.json'
|
|
$visionProbePath = Join-Path $root 'AstrBotPlugin\verify_minimax_vlm_contract.py'
|
|
$miniMaxDirectOk = $false
|
|
if ((Test-RegularFile $visionPath 64KB) -and
|
|
(Test-RegularFile $visionConfigPath 32KB) -and
|
|
(Test-RegularFile $visionProbePath 32KB) -and
|
|
-not (Test-Path -LiteralPath (Join-Path $root 'MmxRuntime'))) {
|
|
try {
|
|
$visionText = Get-Content -LiteralPath $visionPath -Raw -Encoding UTF8
|
|
$visionConfigText = Get-Content -LiteralPath $visionConfigPath -Raw -Encoding UTF8
|
|
$visionProbeText = Get-Content -LiteralPath $visionProbePath -Raw -Encoding UTF8
|
|
$miniMaxDirectOk =
|
|
$visionText.Contains('https://api.minimax.io/v1/coding_plan/vlm') -and
|
|
$visionText.Contains('https://api.minimaxi.com/v1/coding_plan/vlm') -and
|
|
$visionText.Contains('MINIMAX_VLM_CONTRACT_VERSION = "0.0.4"') -and
|
|
$visionText.Contains('MINIMAX_VLM_CONTRACT_COMMIT = "fbac3b3e56922a1249e00eebe07d9ee68f4768dc"') -and
|
|
$visionText.Contains('fbac3b3e56922a1249e00eebe07d9ee68f4768dc') -and
|
|
$visionText.Contains('08d4116a20e8a652ceb9e2b6f58b1e7cdfe464b14baff05977e08b4b05b66be3') -and
|
|
$visionText.Contains('1dea28d6ba4ee46ba516d7eeedd325a5a102410bb7abb074fc4b0a8a66571864') -and
|
|
$visionText.Contains('MM-API-Source') -and
|
|
$visionText.Contains('"MM-API-Source": MINIMAX_API_SOURCE') -and
|
|
$visionText.Contains('MINIMAX_API_SOURCE = "Minimax-MCP"') -and
|
|
$visionText.Contains('urllib.request.ProxyHandler({})') -and
|
|
$visionText.Contains('_NoRedirectHandler()') -and
|
|
$visionText.Contains('MINIMAX_API_KEY') -and
|
|
$visionText.Contains('assert_minimax_vision_runtime') -and
|
|
-not $visionText.Contains('create_subprocess_exec') -and
|
|
-not $visionText.Contains('mmx-cli') -and
|
|
$visionConfigText.Contains('"minimax_vision_enabled"') -and
|
|
$visionConfigText.Contains('"minimax_api_region"') -and
|
|
-not $visionConfigText.Contains('"mmx_executable"') -and
|
|
$visionProbeText.Contains('def synthetic_probe_png()') -and
|
|
$visionProbeText.Contains('SYNTHETIC_PROBE_SHA256 = (') -and
|
|
$visionProbeText.Contains(
|
|
'd37476a5273821c12ee4a72b512dc152db5729055b6febb8603985f86243abda') -and
|
|
$visionProbeText.Contains('if digest != SYNTHETIC_PROBE_SHA256:') -and
|
|
$visionProbeText.Contains('vision_probe_source_contract_invalid') -and
|
|
$visionProbeText.Contains('describe_business_image(') -and
|
|
$visionProbeText.Contains('os.O_EXCL') -and
|
|
$visionProbeText.Contains('"syntheticSourceSha256"') -and
|
|
-not $visionProbeText.Contains('image_source')
|
|
}
|
|
catch { $miniMaxDirectOk = $false }
|
|
}
|
|
Add-Check 'minimax_direct_https_vlm' $miniMaxDirectOk `
|
|
'minimax_direct_https_contract_invalid' `
|
|
'必须由 AstrBot 服务端使用固定区域、禁代理、禁重定向的 HTTPS VLM，并提供不含客户数据的合成图片在线探针；交付包不得包含 mmx-cli 或 Node 运行时。'
|
|
|
|
$pdfRenderSandboxPath = Join-Path $root 'AstrBotPlugin\pdf_render_sandbox.py'
|
|
$pdfRenderWorkerPath = Join-Path $root 'AstrBotPlugin\pdf_render_worker.py'
|
|
$pdfVisionPath = Join-Path $root 'AstrBotPlugin\pdf_vision.py'
|
|
$purchaseTabularPath = Join-Path $root `
|
|
'AstrBotPlugin\purchase_tabular_binding.py'
|
|
$attachmentExtractContractPath = Join-Path $root `
|
|
'AstrBotPlugin\attachment_extract.py'
|
|
$attachmentProvenanceContractPath = Join-Path $root `
|
|
'AstrBotPlugin\attachment_provenance.py'
|
|
$sourceDocumentSchemaPath = Join-Path $root `
|
|
'Deployment\SqlServer\001_agent_business_idempotency.sql'
|
|
$purchaseWriteContractPath = Join-Path $root `
|
|
'Deployment\customer-profiles\lserp-ai.workflow-write.purchase.compat100.draft.sql'
|
|
$purchaseWireContractPath = Join-Path $root `
|
|
'Contracts\erp-agent-wire-contract-v1.json'
|
|
$requirementsPath = Join-Path $root 'AstrBotPlugin\requirements.txt'
|
|
$pdfiumWheelName = 'pypdfium2-5.12.1-py3-none-win_amd64.whl'
|
|
$pdfiumWheelPath = Join-Path $root ('PythonWheels\' + $pdfiumWheelName)
|
|
$pdfiumWheelSha256 = `
|
|
'9609be73a6701a68f29dffe0335f7a2e4b3ba581542ed65d35d49f761a4600ca'
|
|
$pdfInvoicePipelineOk = $false
|
|
$pdfiumWheelStream = $null
|
|
$pdfiumWheelArchive = $null
|
|
try {
|
|
$pythonWheelsPath = Join-Path $root 'PythonWheels'
|
|
if (-not [IO.Directory]::Exists($pythonWheelsPath)) {
|
|
throw 'pdfium_wheel_directory_missing'
|
|
}
|
|
$pdfiumWheels = @([IO.Directory]::GetFiles(
|
|
$pythonWheelsPath,
|
|
'pypdfium2-*.whl',
|
|
[IO.SearchOption]::TopDirectoryOnly))
|
|
if ($pdfiumWheels.Count -ne 1 -or
|
|
[IO.Path]::GetFileName($pdfiumWheels[0]) -cne $pdfiumWheelName -or
|
|
(Get-RegularFileSha256 $pdfiumWheelPath 32MB) -cne
|
|
$pdfiumWheelSha256) {
|
|
throw 'pdfium_wheel_identity_invalid'
|
|
}
|
|
foreach ($sourcePath in @(
|
|
$pdfRenderSandboxPath,
|
|
$pdfRenderWorkerPath,
|
|
$pdfVisionPath,
|
|
$purchaseTabularPath,
|
|
$attachmentExtractContractPath,
|
|
$attachmentProvenanceContractPath,
|
|
$sourceDocumentSchemaPath,
|
|
$purchaseWriteContractPath,
|
|
$purchaseWireContractPath,
|
|
$requirementsPath)) {
|
|
if (-not (Test-RegularFile $sourcePath 512KB)) {
|
|
throw 'pdf_pipeline_source_missing'
|
|
}
|
|
}
|
|
|
|
$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$requirementsText = [IO.File]::ReadAllText(
|
|
$requirementsPath, $strictUtf8)
|
|
$pdfRenderSandboxText = [IO.File]::ReadAllText(
|
|
$pdfRenderSandboxPath, $strictUtf8)
|
|
$pdfRenderWorkerText = [IO.File]::ReadAllText(
|
|
$pdfRenderWorkerPath, $strictUtf8)
|
|
$pdfVisionText = [IO.File]::ReadAllText($pdfVisionPath, $strictUtf8)
|
|
$purchaseTabularText = [IO.File]::ReadAllText(
|
|
$purchaseTabularPath, $strictUtf8)
|
|
$attachmentMainText = [IO.File]::ReadAllText(
|
|
$astrbotMainPath, $strictUtf8)
|
|
$attachmentExtractContractText = [IO.File]::ReadAllText(
|
|
$attachmentExtractContractPath, $strictUtf8)
|
|
$attachmentProvenanceContractText = [IO.File]::ReadAllText(
|
|
$attachmentProvenanceContractPath, $strictUtf8)
|
|
$sourceDocumentSchemaText = [IO.File]::ReadAllText(
|
|
$sourceDocumentSchemaPath, $strictUtf8)
|
|
$purchaseWriteContractText = [IO.File]::ReadAllText(
|
|
$purchaseWriteContractPath, $strictUtf8)
|
|
$purchaseWireContractText = [IO.File]::ReadAllText(
|
|
$purchaseWireContractPath, $strictUtf8)
|
|
|
|
if (-not $requirementsText.Contains('pypdfium2==5.12.1 \') -or
|
|
-not $requirementsText.Contains(
|
|
'--hash=sha256:9609be73a6701a68f29dffe0335f7a2e4b3ba581542ed65d35d49f761a4600ca') -or
|
|
-not $pdfRenderSandboxText.Contains('MAX_PDF_VISION_PAGES = 3') -or
|
|
-not $pdfRenderSandboxText.Contains('asyncio.create_subprocess_exec(') -or
|
|
-not $pdfRenderSandboxText.Contains('"-I",') -or
|
|
-not $pdfRenderSandboxText.Contains('"-B",') -or
|
|
-not $pdfRenderSandboxText.Contains('_validate_rgb_png(') -or
|
|
-not $pdfRenderWorkerText.Contains('import pypdfium2 as pdfium') -or
|
|
-not $pdfRenderWorkerText.Contains(
|
|
'sys.addaudithook(_deny_unsafe_runtime_operations)') -or
|
|
-not $pdfRenderWorkerText.Contains('may_draw_forms=False') -or
|
|
-not $pdfRenderWorkerText.Contains(
|
|
'if page_count > limits["maximumPages"]:') -or
|
|
-not $pdfRenderWorkerText.Contains(
|
|
'source_bytes = _read_source_snapshot(') -or
|
|
-not $pdfVisionText.Contains(
|
|
'PDF_VISION_PIPELINE = "pdfium_minimax_pages_v1"') -or
|
|
-not $pdfVisionText.Contains('describe_business_image_bytes(') -or
|
|
-not $pdfVisionText.Contains('merge_purchase_vision_documents(') -or
|
|
-not $pdfVisionText.Contains('project_pdf_vision_content(content)') -or
|
|
-not $purchaseTabularText.Contains(
|
|
'return project_pdf_vision_content(envelope["content"])') -or
|
|
-not $attachmentMainText.Contains('describe_business_pdf(') -or
|
|
-not $attachmentMainText.Contains(
|
|
'maximum_pages=remaining_pages') -or
|
|
-not $attachmentExtractContractText.Contains(
|
|
'PREPROCESS_CONTRACT_PDF = "pdfium_minimax_pages_v1"') -or
|
|
-not $attachmentExtractContractText.Contains(
|
|
'result["preprocessContract"] = _preprocess_contract(') -or
|
|
-not $attachmentExtractContractText.Contains(
|
|
'content.get("pipeline") != PREPROCESS_CONTRACT_PDF') -or
|
|
-not $attachmentProvenanceContractText.Contains(
|
|
'"preprocessContract": preprocess_contract') -or
|
|
-not $attachmentProvenanceContractText.Contains(
|
|
'expected["preprocessContract"] != preprocess_contract') -or
|
|
-not $sourceDocumentSchemaText.Contains(
|
|
'preprocess_contract VARCHAR(64) NOT NULL') -or
|
|
-not $sourceDocumentSchemaText.Contains(
|
|
"'pdfium_minimax_pages_v1'") -or
|
|
-not $purchaseWriteContractText.Contains(
|
|
'/source_documents[@version="3"]') -or
|
|
-not $purchaseWriteContractText.Contains(
|
|
"'(@preprocess_contract)[1]'") -or
|
|
-not $purchaseWriteContractText.Contains(
|
|
'source_sha256, extraction_sha256, preprocess_contract, size_bytes') -or
|
|
-not $purchaseWireContractText.Contains(
|
|
'"commandVersion": "1.4"')) {
|
|
throw 'pdf_pipeline_contract_invalid'
|
|
}
|
|
|
|
Add-Type -AssemblyName System.IO.Compression -ErrorAction Stop
|
|
try {
|
|
Add-Type -AssemblyName System.IO.Compression.FileSystem `
|
|
-ErrorAction Stop
|
|
}
|
|
catch {
|
|
if ($null -eq ('System.IO.Compression.ZipArchive' -as [type])) {
|
|
throw
|
|
}
|
|
}
|
|
$pdfiumWheelStream = [IO.File]::Open(
|
|
$pdfiumWheelPath,
|
|
[IO.FileMode]::Open,
|
|
[IO.FileAccess]::Read,
|
|
[IO.FileShare]::Read)
|
|
$pdfiumWheelArchive = [IO.Compression.ZipArchive]::new(
|
|
$pdfiumWheelStream,
|
|
[IO.Compression.ZipArchiveMode]::Read,
|
|
$true)
|
|
if ($pdfiumWheelArchive.Entries.Count -lt 1 -or
|
|
$pdfiumWheelArchive.Entries.Count -gt 256) {
|
|
throw 'pdfium_wheel_layout_invalid'
|
|
}
|
|
$wheelEntries = New-Object `
|
|
'System.Collections.Generic.HashSet[string]' `
|
|
([StringComparer]::Ordinal)
|
|
[long]$wheelUncompressedBytes = 0
|
|
foreach ($entry in $pdfiumWheelArchive.Entries) {
|
|
if (-not $wheelEntries.Add([string]$entry.FullName) -or
|
|
$entry.Length -lt 0 -or $entry.Length -gt 64MB -or
|
|
$wheelUncompressedBytes -gt 128MB - $entry.Length) {
|
|
throw 'pdfium_wheel_layout_invalid'
|
|
}
|
|
$wheelUncompressedBytes += $entry.Length
|
|
}
|
|
foreach ($requiredWheelEntry in @(
|
|
'pypdfium2_raw/pdfium.dll',
|
|
'pypdfium2-5.12.1.dist-info/licenses/LICENSES/Apache-2.0.txt',
|
|
'pypdfium2-5.12.1.dist-info/licenses/LICENSES/BSD-3-Clause.txt',
|
|
'pypdfium2-5.12.1.dist-info/licenses/LICENSES/CC-BY-4.0.txt',
|
|
'pypdfium2-5.12.1.dist-info/licenses/data/windows_x64/BUILD_LICENSES/pdfium.txt',
|
|
'pypdfium2-5.12.1.dist-info/licenses/data/windows_x64/BUILD_LICENSES/pdfium-binaries.txt')) {
|
|
if (-not $wheelEntries.Contains($requiredWheelEntry)) {
|
|
throw 'pdfium_wheel_license_or_runtime_missing'
|
|
}
|
|
}
|
|
$pdfInvoicePipelineOk = $true
|
|
}
|
|
catch {
|
|
$pdfInvoicePipelineOk = $false
|
|
}
|
|
finally {
|
|
if ($null -ne $pdfiumWheelArchive) { $pdfiumWheelArchive.Dispose() }
|
|
if ($null -ne $pdfiumWheelStream) { $pdfiumWheelStream.Dispose() }
|
|
}
|
|
Add-Check 'pdf_invoice_pipeline' $pdfInvoicePipelineOk `
|
|
'pdf_invoice_pipeline_invalid' `
|
|
'电子 PDF 发票必须使用最多三页的隔离 PDFium 渲染、逐页 MiniMax 严格识别和原文件摘要绑定，并只携带精确哈希且内含许可证的 Windows x64 wheel。'
|
|
|
|
$attachmentSnapshotOk = $false
|
|
$attachmentMainPath = Join-Path $root 'AstrBotPlugin\main.py'
|
|
$attachmentExtractPath = Join-Path $root 'AstrBotPlugin\attachment_extract.py'
|
|
$attachmentSandboxPath = Join-Path $root 'AstrBotPlugin\attachment_sandbox.py'
|
|
$attachmentWorkerPath = Join-Path $root 'AstrBotPlugin\attachment_worker.py'
|
|
if ((Test-RegularFile $attachmentMainPath 128KB) -and
|
|
(Test-RegularFile $attachmentExtractPath 128KB) -and
|
|
(Test-RegularFile $attachmentSandboxPath 128KB) -and
|
|
(Test-RegularFile $attachmentWorkerPath 64KB) -and
|
|
(Test-RegularFile $visionPath 64KB)) {
|
|
try {
|
|
$attachmentMainText = Get-Content -LiteralPath $attachmentMainPath `
|
|
-Raw -Encoding UTF8
|
|
$attachmentExtractText = Get-Content -LiteralPath $attachmentExtractPath `
|
|
-Raw -Encoding UTF8
|
|
$attachmentSandboxText = Get-Content -LiteralPath $attachmentSandboxPath `
|
|
-Raw -Encoding UTF8
|
|
$attachmentWorkerText = Get-Content -LiteralPath $attachmentWorkerPath `
|
|
-Raw -Encoding UTF8
|
|
$attachmentSnapshotOk =
|
|
([Text.RegularExpressions.Regex]::Matches(
|
|
$attachmentMainText,
|
|
'expected_sha256\s*=\s*str\(\s*receipt_before\["sha256"\]\s*\)').Count -eq 3) -and
|
|
([Text.RegularExpressions.Regex]::Matches(
|
|
$attachmentMainText,
|
|
'expected_size_bytes\s*=\s*int\(\s*receipt_before\["sizeBytes"\]\s*\)').Count -eq 3) -and
|
|
$attachmentExtractText.Contains('_read_stable_source(') -and
|
|
$attachmentExtractText.Contains('_verify_expected_source(') -and
|
|
$attachmentExtractText.Contains('io.BytesIO(source_bytes)') -and
|
|
$attachmentSandboxText.Contains('"expectedSource"') -and
|
|
$attachmentWorkerText.Contains('"expectedSource"') -and
|
|
$visionText.Contains('_read_validated_image(') -and
|
|
$visionText.Contains(
|
|
'hashlib.sha256(image_bytes).hexdigest() != expected_sha256') -and
|
|
$visionText.Contains('attachment_changed_during_preprocess')
|
|
}
|
|
catch { $attachmentSnapshotOk = $false }
|
|
}
|
|
Add-Check 'attachment_snapshot_binding' $attachmentSnapshotOk `
|
|
'attachment_snapshot_binding_invalid' `
|
|
'视觉与文档预处理必须把实际读取的单一字节快照绑定到识别前来源 SHA-256 和大小。'
|
|
|
|
$wireContractPath = Join-Path $root 'Contracts\erp-agent-wire-contract-v1.json'
|
|
$wireContractOk = $false
|
|
if (Test-RegularFile $wireContractPath 256KB) {
|
|
try {
|
|
$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$wireContract = [IO.File]::ReadAllText(
|
|
$wireContractPath, $strictUtf8) | ConvertFrom-Json
|
|
$expectedPlanFields = @(
|
|
'planId', 'commandName', 'commandVersion', 'moduleCode', 'risk',
|
|
'createdAtUtc', 'expiresAtUtc', 'valid', 'executionAllowed',
|
|
'inputFingerprint', 'outcomeCode', 'title', 'preview', 'data',
|
|
'warnings'
|
|
)
|
|
$actualPlanFields = @($wireContract.planProjectionFields)
|
|
$fieldsValid = $actualPlanFields.Count -eq $expectedPlanFields.Count
|
|
for ($index = 0; $index -lt $expectedPlanFields.Count; $index++) {
|
|
$fieldsValid = $fieldsValid -and
|
|
[string]$actualPlanFields[$index] -ceq $expectedPlanFields[$index]
|
|
}
|
|
$expectedScenarios = @(
|
|
'purchase_resolve_to_create',
|
|
'leave_resolve_to_create',
|
|
'leave_submit_followup',
|
|
'module_diagnose_read_only',
|
|
'module_trace_initialization',
|
|
'dynamic_module_resolve_to_create',
|
|
'dynamic_module_resolve_to_update',
|
|
'module_navigate'
|
|
)
|
|
$scenarios = @($wireContract.scenarios)
|
|
$scenarioNames = @($scenarios | ForEach-Object { [string]$_.name })
|
|
$scenariosValid = $scenarios.Count -eq $expectedScenarios.Count
|
|
foreach ($name in $expectedScenarios) {
|
|
$scenariosValid = $scenariosValid -and ($scenarioNames -ccontains $name)
|
|
}
|
|
foreach ($scenario in $scenarios) {
|
|
$plan = $scenario.plan
|
|
$createdAt = [DateTimeOffset]::MinValue
|
|
$expiresAt = [DateTimeOffset]::MinValue
|
|
$createdValid = [DateTimeOffset]::TryParse(
|
|
[string]$plan.createdAtUtc, [ref]$createdAt)
|
|
$expiresValid = [DateTimeOffset]::TryParse(
|
|
[string]$plan.expiresAtUtc, [ref]$expiresAt)
|
|
$risk = [string]$plan.risk
|
|
$executionExpected = $plan.valid -eq $true -and
|
|
@('navigate', 'write', 'critical') -ccontains $risk
|
|
$scenariosValid = $scenariosValid -and
|
|
(Test-ExactProperties $scenario @(
|
|
'name', 'requestedCommand', 'autoFollowedFrom', 'plan')) -and
|
|
(Test-ExactProperties $plan $expectedPlanFields) -and
|
|
([string]$plan.planId -cmatch '^[A-Fa-f0-9]{32}$') -and
|
|
([string]$plan.commandName -cmatch '^[A-Za-z0-9_.:-]{1,128}$') -and
|
|
([string]$plan.commandVersion -cmatch '^[0-9]+(?:\.[0-9]+){1,3}$') -and
|
|
([string]$plan.moduleCode -cmatch '^[A-Za-z0-9_.:-]{1,128}$') -and
|
|
(@('read', 'navigate', 'draft', 'write', 'critical') -ccontains $risk) -and
|
|
([string]$plan.inputFingerprint -cmatch '^[a-f0-9]{64}$') -and
|
|
([string]$plan.outcomeCode -cmatch '^[A-Za-z0-9_.:-]{1,128}$') -and
|
|
($plan.valid -is [bool]) -and
|
|
($plan.executionAllowed -is [bool]) -and
|
|
($plan.executionAllowed -eq $executionExpected) -and
|
|
$createdValid -and $expiresValid -and
|
|
$expiresAt -gt $createdAt -and
|
|
($expiresAt - $createdAt) -le [TimeSpan]::FromMinutes(15) -and
|
|
$null -ne $plan.data -and
|
|
@($plan.warnings).Count -le 64
|
|
}
|
|
$wireContractOk =
|
|
(Test-ExactProperties $wireContract @(
|
|
'schemaVersion', 'protocolVersion', 'requestSessionScope',
|
|
'planProjectionFields', 'trustedBridgeCorrelationId',
|
|
'scenarios')) -and
|
|
$wireContract.schemaVersion -ceq '1.1' -and
|
|
$wireContract.protocolVersion -ceq '1.0' -and
|
|
$wireContract.requestSessionScope.field -ceq 'sessionScopeToken' -and
|
|
$wireContract.requestSessionScope.tokenVersion -ceq 'v3' -and
|
|
$wireContract.requestSessionScope.format -ceq '32-lowercase-hex' -and
|
|
@($wireContract.requestSessionScope.requiredMethods).Count -eq 3 -and
|
|
@($wireContract.requestSessionScope.bootstrapOptionalMethods).Count -eq 2 -and
|
|
@($wireContract.requestSessionScope.boundFields).Count -eq 6 -and
|
|
$wireContract.requestSessionScope.serverAuthoritativeRecheck -eq $true -and
|
|
([string]$wireContract.trustedBridgeCorrelationId -cmatch
|
|
'^[A-Za-z0-9_.:-]{8,128}$') -and
|
|
$fieldsValid -and $scenariosValid
|
|
}
|
|
catch { $wireContractOk = $false }
|
|
}
|
|
Add-Check 'erp_wire_contract' $wireContractOk `
|
|
'erp_wire_contract_invalid' `
|
|
'交付包必须携带版本化、精确字段且覆盖采购、请假和模块诊断的 ERP Agent 线协议。'
|
|
|
|
$passed = ($checks | Where-Object { -not $_.passed }).Count -eq 0
|
|
$spriteHash = if ($spriteOk) { $spriteDimensions.sha256 } else { $null }
|
|
$licenseHash = if ($licenseOk) { (Get-FileHash -LiteralPath $licenseFull -Algorithm SHA256).Hash.ToLowerInvariant() } else { $null }
|
|
$nextStep = if ($passed) {
|
|
'继续执行 CUSTOMER_ACCEPTANCE.md 的客户 ERP/SQL Server 三条真实闭环；本报告本身不启用写命令。'
|
|
} else {
|
|
'修复失败门禁后生成新报告；不得启用客户写命令。'
|
|
}
|
|
$report = [ordered]@{
|
|
schemaVersion = '1.7'
|
|
generatedAtUtc = [DateTime]::UtcNow.ToString('o')
|
|
passed = $passed
|
|
packageManifestVerified = $manifestPassed
|
|
packageSha256 = $packageArchiveBinding.sha256
|
|
packageSourceCommit = $packageCommit
|
|
legacyBuildEvidenceSha256 = $legacyEvidence.evidenceSha256
|
|
rolloutPolicySha256 = $rolloutSha256
|
|
rolloutCustomerId = $RolloutCustomerId
|
|
spriteSha256 = $spriteHash
|
|
spriteLicenseEvidenceSha256 = $licenseHash
|
|
astrBotComplianceEvidenceSha256 = $astrBotComplianceSha256
|
|
miniMaxServiceComplianceEvidenceSha256 = $miniMaxComplianceSha256
|
|
miniMaxIntegrationMode = 'direct_https_vlm'
|
|
miniMaxVisionProbeEvidenceSha256 = $miniMaxProbe.sha256
|
|
miniMaxVisionProbeObservedAtUtc = $miniMaxProbe.observedAtUtc
|
|
miniMaxVisionProbeRegion = $miniMaxProbe.region
|
|
miniMaxVisionProbeContractVersion = $miniMaxProbe.contractVersion
|
|
checks = $checks
|
|
nextStep = $nextStep
|
|
}
|
|
[IO.Directory]::CreateDirectory([IO.Path]::GetFullPath($ReportDirectory)) | Out-Null
|
|
$reportPath = Join-Path ([IO.Path]::GetFullPath($ReportDirectory)) `
|
|
("commercial-preflight-{0}.json" -f ([DateTime]::UtcNow.ToString('yyyyMMddTHHmmssfffZ')))
|
|
$utf8 = New-Object Text.UTF8Encoding($false, $true)
|
|
$bytes = $utf8.GetBytes(($report | ConvertTo-Json -Depth 10))
|
|
$stream = [IO.File]::Open($reportPath, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
|
|
try { $stream.Write($bytes, 0, $bytes.Length); $stream.Flush() }
|
|
finally { $stream.Dispose() }
|
|
|
|
[ordered]@{
|
|
passed = $passed
|
|
reportPath = $reportPath
|
|
failedChecks = @($checks | Where-Object { -not $_.passed } | ForEach-Object { $_.name })
|
|
} | ConvertTo-Json -Depth 4
|
|
if (-not $passed) { exit 6 }
|