feat: add iSphere live probe recorder

This commit is contained in:
zhaoyilun
2026-07-10 10:59:48 +08:00
parent 349fbe4a44
commit f7914a63dc
13 changed files with 2209 additions and 16 deletions

View File

@@ -0,0 +1,146 @@
# C30 Send Sidecar Runtime Probe Plan
Date: 2026-07-10
Route decision: B primary, A fallback
Parent: `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`
## Objective
Prove whether the running logged-in iSphere / `IMPlatformClient.exe` client on this machine can support the B-route sidecar connector.
This node is read-only. It does not send messages, upload files, click UI, type text, inject hooks, or attach runtime instrumentation.
## Scope
Use `ISphereWinHelper` op:
```text
probe_client_runtime
```
For a machine where iSphere can actually log in, prefer the portable package:
```text
runs/live-probe-recorder-package.zip
```
It collects the runtime probe plus process details, network metadata, filesystem candidates, registry/service/shortcut inventory, and UIA target-window dumps in one run.
Collect:
- target process PID;
- process name;
- main window title/handle;
- executable path;
- process bitness;
- helper host bitness;
- target-process command-line metadata with redaction;
- key module presence:
- `IMPlatformClient.exe`
- `smack.dll`
- `IMPP.Interface.dll`
- `IMPP.ServiceBase.dll`
- `IMPP.Service.dll`
- `TcpFileTransfer.dll`
- `HYHC.IMPP.DAL.dll`
- install/cache/config/log/database candidate metadata;
- key file versions and hashes;
- target-process TCP connections and related named pipes;
- registry uninstall entries, services, shortcuts;
- UIA target-window dumps for A-route fallback.
## Acceptance gates
### B1 runtime discovery
Pass when:
- at least one target process is returned;
- target score favors `IMPlatformClient` / iSphere;
- executable path is present;
- bitness is known or module probing still succeeds.
Fail when:
- no target process is running;
- process cannot be inspected enough to determine path/bitness;
- discovered process does not match iSphere/IMPlatformClient.
### B2 module availability
Pass when:
- `IMPlatformClient.exe` is confirmed;
- `smack.dll` is present in loaded modules or install path evidence;
- `IMPP.Interface.dll`, `IMPP.ServiceBase.dll`, and `IMPP.Service.dll` are present or explainably loadable.
Fail when:
- `smack.dll` is absent and no install-path fallback is available;
- service/interface DLLs are absent;
- helper bitness prevents module inspection and no x86/x64 helper variant is available.
## Commands
Build and verify helper:
```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-win-helper.ps1
```
Run live runtime probe after the user has logged in to iSphere:
```powershell
$request = @{
protocol = 'isphere.helper.v1'
request_id = 'c30-live-runtime-probe'
op = 'probe_client_runtime'
timeout_ms = 5000
args = @{
process_names = @('IMPlatformClient', 'IMPP.ISphere', 'iSphere', 'importal')
include_modules = $true
max_modules = 160
}
} | ConvertTo-Json -Depth 8 -Compress
$request | .\runs\win-helper\ISphereWinHelper.exe | Tee-Object -FilePath .\runs\real-loggedin-lab\sidecar-probe\c30-runtime-probe.json
```
If the target is 32-bit and module probing fails from the default helper, rebuild x86 helper:
```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\build-win-helper.ps1 -Platform x86 -OutputDir runs\win-helper-x86
```
Then rerun the same request against:
```powershell
.\runs\win-helper-x86\ISphereWinHelper.exe
```
## Output artifacts
If a logged-in client is available, write:
```text
runs/real-loggedin-lab/sidecar-probe/c30-runtime-probe.json
```
Then update:
```text
docs/source-discovery/capability-source-matrix.md
```
## Next node decision
If B1/B2 pass:
- move to C31 non-mutating manual-send observation plan;
- observe whether manual send hits `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and `XMPPConnection.send`.
If B1/B2 fail:
- document exact failure;
- decide whether to try x86/x64 helper variant;
- if still blocked, activate A-route constrained UI/RPA fallback.