admin/isphere-ai-bridge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: analyze returned live probe evidence

Browse Source
This commit is contained in:
zhaoyilun
2026-07-10 13:11:42 +08:00
parent 81f23a6a54
commit b2ce7b0e36
6 changed files with 279 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

173
docs/source-discovery/2026-07-10-returned-live-probe-analysis.md Normal file
View File

@@ -0,0 +1,173 @@
# Returned Live Probe Analysis
Date: 2026-07-10
Node: R5b / C30 runtime evidence intake
Evidence package: `runs/returned-live-probe/isphere-live-probe-20260710-121958/`
Zip SHA256: `73815D5D5370D646410C95A008EB1EAAC0C189DADEF1A9ECF69C3D628A156FEE`
Recorder: `ISphereLiveProbeRecorder` `0.2.0`, `isphere.helper.v1`, x86 process on x64 Windows
## Goal
Decide whether the returned logged-in-client probe unblocks the send-message/send-file connector path.
The probe is read-only evidence. It does not send, click, type, upload, download, dump memory, or hook the client.
## Runtime evidence
| Field | Observed value |
| --- | --- |
| Target process | `IMPlatformClient.exe` |
| PID count | `1` |
| Main executable | `C:\Program Files (x86)\Impp\IMPlatformClient.exe` |
| Client version | `4.1.2.6842` |
| Process bitness | x86 |
| UI framework evidence | WinForms/WPF/.NET Framework 4 plus CEF modules |
| Loaded install modules | `IMPlatformClient.exe`, `libcef.dll`, `chrome_elf.dll`, `System.Data.SQLite.dll` |
| Live TCP connection | `10.212.229.210:<ephemeral>` -> `25.215.214.81:10088`, `ESTABLISHED` |
| Config endpoint evidence | `ConnSel.xml` contains `25.215.214.81:10083` |
| Registry uninstall entry | `即时通讯 4.1.2.6839`, uninstall path under install directory |
Interpretation:
- B-route sidecar work must be 32-bit / x86-compatible.
- The live client is a .NET Framework desktop process with CEF and SQLite loaded.
- The observed version matches the previously extracted send-candidate binary family: `IMPlatformClient.exe` length `8366592`, version `4.1.2.6842`.
- The live process did not currently load `IMPP.*`, `smack.dll`, `TcpFileTransfer.dll`, `INetwork.dll`, or `IOClientNetwork.dll` as enumerated process modules. This does not reject B route, because those assemblies are present on disk and may be loaded lazily or as managed assemblies not visible through this module view.
## Installed assembly evidence
The live install directory contains the B-route candidate files:
| Candidate | Present in live install | Version/size evidence |
| --- | --- | --- |
| `IMPlatformClient.exe` | yes | version `4.1.2.6842`, length `8366592` |
| `smack.dll` | yes | version `1.0.0.0`, length `370688` |
| `IMPP.Interface.dll` | yes | version `1.0.0.0`, length `33792` |
| `IMPP.ServiceBase.dll` | yes | version `1.0.0.0`, length `12800` |
| `IMPP.Service.dll` | yes | version `1.0.0.0`, length `21504` |
| `IMPP.Common.dll` | yes | version `1.0.0.0`, length `479744` |
| `IMPP.Model.dll` | yes | version `1.0.0.0`, length `35328` |
| `IMPP.UI.dll` | yes | version `14.4.13.0`, length `2401792` |
| `IMPP.Util.dll` | yes | version `1.0.0.0`, length `10240` |
| `TcpFileTransfer.dll` | yes | length `45056` |
| `HYHC.IMPP.DAL.dll` | yes | version `1.0.0.0`, length `148992` |
| `INetwork.dll` | yes | length `87552` |
| `IOClientNetwork.dll` | yes | length `145920` |
Interpretation:
- Gate B2 "files present / loadable from same install family" is partially satisfied.
- Gate B2 "runtime entrypoints reachable from logged-in client context" is not yet satisfied.
- Next B-route probe should be `probe_send_entrypoints`: read-only reflection/metadata confirmation for `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message methods.
## Local data evidence
The inventory found active local state under the iSphere document profile path shape:
```text
%USERPROFILE%\Documents\iSphere\<profile>\27000000\Account\<account>\MsgLib.db
```
The latest active `MsgLib.db` candidate was updated on 2026-07-10 UTC and belongs to the same account family previously used for copied-DB sidecar verification.
Interpretation:
- The receive/search side remains well-supported by the existing `MsgLibReadSidecar` path.
- This package does not include DB contents or table output, so it is not a new receive-message schema proof by itself.
## UIA evidence
The probe captured three `IMPlatformClient.exe` windows successfully:
| Window type | Root automation id | Evidence |
| --- | --- | --- |
| Main window | `frmMain` | WinForms tree captured; left search edit is addressable |
| Group chat | `frmReserveChatRoom` | receive document, send document, send button, file menu captured |
| Direct/P2P chat | `frmP2PChat` | receive document, send document, send button, file menu captured |
Important controls:
| Capability | UIA evidence |
| --- | --- |
| Search contacts/groups | main window edit `skinAlphaTxt`, prompt `按帐号、姓名、拼音、标签查询联系人`; toolbar button `查找联系人、工作组` |
| Read chat panel | chat document `rtbRecvMessage` |
| Draft text | chat document `rtbSendMessage` under `ucChatSendMessageBox1` |
| Send text | button `btnSend`, name `发送(S)` |
| Send file | toolbar/menu item `发送文件`; child items include `发送文件`, `最近使用文件`, `最近使用文件夹`, and group-window `查看文件列表` |
| Conversation member info | group pane shows member-count control shape |
Critical blocker observed in both chat windows:
```text
您已处于离线状态，无法发送消息，请上线后再次尝试！
```
Interpretation:
- A-route fallback is now much stronger than before: it can locate search, draft, send button, and file-send menu controls.
- A-route is not yet production-safe because the captured state explicitly reports an offline send blocker.
- The first A-route implementation slice should be non-mutating only: locate controls, report offline/disabled send state, and optionally support draft preview in a controlled sandbox later. It should not click `btnSend` yet.
## Network/protocol evidence
The runtime had one established TCP connection:
```text
remote=25.215.214.81:10088
```
The install config also points at:
```text
25.215.214.81:10083
```
Interpretation:
- Network/protocol route has endpoint evidence, but still lacks a sent-message request/ack contract.
- Network replay/reimplementation remains deferred behind B route and A fallback.
## Connector decision
This returned package changes the write-side status from "no live connector evidence" to "B/A connector evidence found, but production send remains blocked".
### B route status
- B1 runtime discovery: pass.
- B2 file presence/load-family check: partial pass.
- B2 runtime entrypoint availability: not yet proven.
- B3 non-mutating dynamic observation: not yet done.
- B4 dry run: not yet implemented.
- B5 one sandbox send: not yet allowed by evidence.
### A route status
- Main search selector: found.
- Chat editor selector: found.
- Send button selector: found.
- File-send menu selector: found.
- Failure/offline state: found.
- Production send: blocked until online/test-target evidence and a dry-run/idempotency/audit path exist.
## Business-goal impact
| Business goal | Impact from this package |
| --- | --- |
| Search contacts | Live UIA search box exists; existing MCP search remains DB/log-backed and already usable. |
| Search groups | Live UIA search/group toolbar exists; existing MCP search remains DB/log-backed and already usable. |
| Receive messages | Active `MsgLib.db` path shape confirmed; existing explicit `msglib_readonly` receive path remains the implementation route. |
| Send messages | Connector evidence improved, but actual sending is still not complete. Next work is non-mutating B entrypoint probe and/or A offline-state preflight. |
| Receive files | File-list metadata remains supported; download mapping is still blocked. |
| Send files | File menu and DLLs exist, but send-file remains behind message-send connector plus upload/file-transfer dry-run evidence. |
## Next node
Recommended next node: **R6a / C31 non-mutating send connector preflight**.
Scope:
1. Add/read-only `probe_send_entrypoints` evidence using installed/extracted binaries.
2. Confirm `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message entrypoints by metadata, not by invoking them.
3. Add UIA preflight classification for search/edit/send/file controls plus offline-send message detection.
4. Keep `isphere_send_message` production blocked.
5. Update the plan only after the preflight says whether B can continue or A fallback should take over.

14
docs/source-discovery/2026-07-10-send-message-connector-selection.md
View File

@@ -124,3 +124,17 @@ Because R5 did not select a connector:
- R6 production send implementation is blocked.
- R7/R8 send-file work is also blocked behind the send-message connector and upload/file-transfer evidence.
- The project should pause write-side implementation and request one of the evidence packages above.
## R5b update from returned live probe
The later returned live-probe package is documented in `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`.
It changes this R5 conclusion from “waiting for any connector evidence” to “connector evidence exists, but production send remains blocked”:
- B-route runtime discovery now passes for a real x86 `IMPlatformClient.exe` `4.1.2.6842` process.
- The live install contains the expected B-route DLL candidates.
- A-route UIA selectors for search, draft editor, send button, and file-send menu are visible.
- Runtime send entrypoint reachability and success/ack mapping are still unproven.
- The captured chat windows show an offline-send blocker.
The next node is therefore R6a/C31 non-mutating send connector preflight, not R6 production send.

14
docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md
View File

@@ -344,14 +344,16 @@ connector_stage = "preview" | "sandbox_send" | "production"
## Next implementation loop
Next node should be **C30 B-route runtime probe**:
R5b/C30-live returned-probe intake is now complete. The live probe confirmed a running x86 `IMPlatformClient.exe` `4.1.2.6842`, installed B-route candidate DLLs, and A-route UIA controls, but it did not prove runtime send entrypoint reachability. It also observed an offline-send blocker in the captured chat windows.
Next node should be **R6a/C31 non-mutating send connector preflight**:
1. Use the C# WinHelper read-only op `probe_client_runtime`.
2. Probe running `IMPlatformClient.exe` process, bitness, path, loaded modules, and installed assembly presence.
3. Do not send, click, type, upload, or attach hooks in this node.
4. Write probe output to `runs/real-loggedin-lab/sidecar-probe/` if a live client is available.
5. Update `capability-source-matrix.md` after B1/B2 pass or fail.
2. Add or run `probe_send_entrypoints` against copied/installed binaries to confirm `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message candidates by metadata only.
3. Add or run a UIA preflight classifier for `skinAlphaTxt`, `rtbSendMessage`, `btnSend`, `发送文件`, and offline-send message state.
4. Do not send, click, type, upload, attach hooks, or capture network traffic in this node.
5. Update `capability-source-matrix.md` after B2/A-route preflight passes or fails.
## Current status
B is selected as the primary send/file-send route. The first non-mutating runtime probe op has been added to `ISphereWinHelper` as `probe_client_runtime`; local verification passed with no target client running. The next executable work is to run that probe while the real iSphere/`IMPlatformClient.exe` client is logged in, then perform non-mutating entrypoint confirmation.
B is selected as the primary send/file-send route. The first non-mutating runtime probe has now been run against a real logged-in environment through the returned live-probe package. B can continue only through non-mutating entrypoint confirmation; A remains the fallback and now has concrete UIA selector evidence, but production send remains blocked until dry-run/idempotency/audit and sandbox-send evidence exist.

7
docs/source-discovery/capability-source-matrix.md
View File

@@ -4,6 +4,7 @@ Date: 2026-07-10
Stage: Core business capability roadmap
Evidence index: `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md`
Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
Returned live probe: `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`
## Source priority
@@ -22,8 +23,8 @@ Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
| `isphere_search_contacts` | bare sender/receiver JIDs extracted from normalized log-backed messages loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `TD_Roster`, `TD_CustomEffigy`, `tblRecent`, `tblChatLevel`, `tblPersonMsg`; decrypted roster/contact stanzas from `Smark.SendReceive`; UIA helper source if display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/contacts_test.go`; `internal/tools/isphere_contacts_test.go` | C34 documents optional MsgLib contact display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core contact search complete; optional richer fields later |
| `isphere_search_groups` | decrypted `PacketReader.ProcessPacket` `type="groupchat"` stanzas and conference/MUC JIDs loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `tblMsgGroupPersonMsg`, `TD_WorkGroupAuth`, `tblRecent`; UIA helper source if group display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/groups_test.go`; `internal/tools/isphere_groups_test.go`; C9 ignored-log scan: PacketReader 86 groupchat/86 conference hits; Smark 24 groupchat/658 conference/631 muc hits | C34 documents optional MsgLib group display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core group search complete; optional member/owner hierarchy later |
| `isphere_receive_files` | decrypted `PacketReader.ProcessPacket` file-transfer message stanzas via `internal/isphere.ListFilesFromMessages` and `isphere_receive_files` list mode; configured PacketReader file or directory source; `zyl\importal\<hash>` cache entries remain unlinked | MsgLib `TD_ReceiveFileRecord` safe metadata through explicit copied-DB path; decrypted `Smark.SendReceive` and `SaveToDB` traces for file-reference reconciliation; future UIA/client connector for download | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#c12-file-transfer-evidence-precheck`; `docs/source-discovery/2026-07-10-file-download-mapping-precheck.md`; `docs/source-discovery/2026-07-10-file-cache-mapping-diagnostic.md` | C22 verifies safe file-list contract args; R3 confirms list metadata is available; R3b diagnostic finds 0 current cache/archive matches, so R4 remains blocked | blocked pending better cache evidence or UI/client download connector |
| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path | A-route fallback: constrained UI/RPA wrapper only if B cannot pass runtime probe, entrypoint availability, dynamic observation, and idempotent dry-run gates; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md` | C29 route correction: previous C15/R5 block remains historical evidence; user approved B primary and A backup. Static IL evidence identifies the client-side send chain `IMPlatformClient.exe -> smack.dll`, but no runtime sidecar send is implemented yet | next: C30 B-route runtime probe, then non-mutating manual-send observation before enabling sandbox send |
| `isphere_send_file` | B-route selected after send-message probe: managed offline-file path through `OffLineFileSend.sendFile()`, `IMPP.Service*.dll` `IFileTransfer.FileUpload(...)`, and `Chat.sendFileMessage(...)` | A-route fallback: constrained UI/RPA upload/send-file flow; native `TcpFileTransfer.dll` is a later candidate only after managed path is rejected | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md` | C29 route correction: static IL evidence identifies upload-plus-file-message chain, but runtime probe and one approved sandbox file-send observation are still required | next: wait for C30/C31 message-send probe; then C32 file-send runtime/upload probe |
| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path | A-route fallback: constrained UI/RPA wrapper only if B cannot pass runtime probe, entrypoint availability, dynamic observation, and idempotent dry-run gates; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md` | R5b returned live probe confirms an x86 running `IMPlatformClient.exe` `4.1.2.6842`, live TCP endpoint, installed B-route DLL presence, and A-route UIA controls (`skinAlphaTxt`, `rtbSendMessage`, `btnSend`, file menu). It also shows the chat window reporting an offline-send blocker, and it does not prove runtime send entrypoint reachability or success/ack mapping. | next: R6a/C31 non-mutating send connector preflight: `probe_send_entrypoints` plus UIA offline-state/control classifier; keep production send blocked |
| `isphere_send_file` | B-route selected after send-message probe: managed offline-file path through `OffLineFileSend.sendFile()`, `IMPP.Service*.dll` `IFileTransfer.FileUpload(...)`, and `Chat.sendFileMessage(...)` | A-route fallback: constrained UI/RPA upload/send-file flow; native `TcpFileTransfer.dll` is a later candidate only after managed path is rejected | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md` | R5b confirms `IMPP.Service*.dll`, `TcpFileTransfer.dll`, and UIA `发送文件` menu evidence in the live install/window tree, but file-send remains blocked behind message-send connector preflight plus upload/file-message dry-run evidence. | next: wait for R6a/C31 message-send preflight; then file-send runtime/upload preflight |
## Stage C entry rule
@@ -40,4 +41,4 @@ Start Stage C with a narrow log-backed `isphere_receive_messages` source abstrac
## Deferred source work
`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. The active roadmap is `docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md`; next step is R3 receive-file download mapping precheck.
`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. The active roadmap is `docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md`; next step is R6a/C31 non-mutating send connector preflight.