feat: add iSphere live probe recorder

scripts/build-win-helper.ps1

@@ -61,6 +61,7 @@ $windowsBase = Resolve-Reference "WindowsBase.dll"
     /out:$outExe `
     /reference:System.dll `
     /reference:System.Core.dll `
+    /reference:System.Management.dll `
     /reference:System.Web.Extensions.dll `
     /reference:System.Windows.Forms.dll `
     /reference:$uiaClient `

scripts/package-live-probe-recorder.ps1

@@ -0,0 +1,82 @@
+param(
+    [string]$OutputDir = "runs/live-probe-recorder-package",
+    [switch]$NoZip
+)
+
+$ErrorActionPreference = "Stop"
+
+$repo = Resolve-Path -LiteralPath (Join-Path $PSScriptRoot "..")
+$packageDir = Join-Path $repo $OutputDir
+$buildDir = Join-Path $repo "runs/live-probe-recorder-build"
+$helperExe = Join-Path $buildDir "ISphereWinHelper.exe"
+$recorderExe = Join-Path $packageDir "ISphereLiveProbeRecorder.exe"
+
+New-Item -ItemType Directory -Force -Path $packageDir | Out-Null
+
+& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repo "scripts\build-win-helper.ps1") -OutputDir "runs/live-probe-recorder-build"
+if ($LASTEXITCODE -ne 0) {
+    throw "build-win-helper.ps1 failed with exit code $LASTEXITCODE"
+}
+
+if (-not (Test-Path -LiteralPath $helperExe)) {
+    throw "built helper not found: $helperExe"
+}
+
+Copy-Item -LiteralPath $helperExe -Destination $recorderExe -Force
+
+@"
+ISphereLiveProbeRecorder
+
+使用方式：
+1. 把本目录复制到可以正常登录 iSphere/IMPlatformClient 的电脑。
+2. 先手工打开并登录 iSphere/IMPlatformClient。
+3. 尽量手工打开一个联系人聊天窗口、一个群聊窗口，并让输入框/发送按钮/附件按钮所在区域可见；不用发送任何内容。
+4. 保持客户端窗口打开。
+5. 双击 ISphereLiveProbeRecorder.exe。
+6. 程序会在 probe-output 下生成 isphere-live-probe-时间戳 目录。
+7. 把生成的整个目录压缩后发回。
+
+它记录：
+- 目标进程、位数、路径、加载模块；
+- 目标进程命令行摘要；
+- 窗口列表；
+- 目标窗口 UIA 控件树；
+- 安装目录、缓存目录、配置/日志/数据库候选文件元数据；
+- 关键 exe/dll 的版本和 SHA256；
+- 小型配置/日志文件的脱敏文本片段；
+- 注册表卸载项；
+- 相关服务；
+- 相关快捷方式；
+- 目标进程 TCP 连接；
+- 相关命名管道。
+
+它不会：
+- 发送消息；
+- 发送/上传文件；
+- 点击或输入；
+- 注入或 hook；
+- 修改客户端文件或数据。
+"@ | Set-Content -LiteralPath (Join-Path $packageDir "README-使用说明.txt") -Encoding UTF8
+
+@"
+@echo off
+setlocal
+cd /d "%~dp0"
+ISphereLiveProbeRecorder.exe
+pause
+"@ | Set-Content -LiteralPath (Join-Path $packageDir "双击运行-采集.bat") -Encoding ASCII
+
+$zipPath = "$packageDir.zip"
+if (-not $NoZip) {
+    if (Test-Path -LiteralPath $zipPath) {
+        Remove-Item -LiteralPath $zipPath -Force
+    }
+    Compress-Archive -Path (Join-Path $packageDir "*") -DestinationPath $zipPath -Force
+}
+
+[ordered]@{
+    ok = $true
+    package_dir = (Resolve-Path -LiteralPath $packageDir).Path
+    recorder_exe = (Resolve-Path -LiteralPath $recorderExe).Path
+    zip = if (Test-Path -LiteralPath $zipPath) { (Resolve-Path -LiteralPath $zipPath).Path } else { $null }
+} | ConvertTo-Json -Depth 4 -Compress

scripts/verify-win-helper.ps1

@@ -65,6 +65,21 @@ if (-not $scan.ok -or $null -eq $scan.data.windows) {
     throw "scan_windows failed: $($scan | ConvertTo-Json -Depth 8 -Compress)"
 }
 
+$runtimeProbe = Invoke-HelperJson @{
+    protocol = "isphere.helper.v1"
+    request_id = "verify-runtime-probe"
+    op = "probe_client_runtime"
+    timeout_ms = 5000
+    args = @{
+        process_names = @("IMPlatformClient", "IMPP.ISphere", "iSphere", "importal")
+        include_modules = $false
+        max_modules = 0
+    }
+}
+if (-not $runtimeProbe.ok -or $runtimeProbe.data.probe_mode -ne "read_only_process_module_inventory" -or $null -eq $runtimeProbe.data.targets) {
+    throw "probe_client_runtime failed: $($runtimeProbe | ConvertTo-Json -Depth 8 -Compress)"
+}
+
 $dumpMissing = Invoke-HelperJson @{
     protocol = "isphere.helper.v1"
     request_id = "verify-dump-missing"
@@ -118,5 +133,6 @@ finally {
     helper = (Resolve-Path -LiteralPath $helperPath).Path
     version = $version.data.helper_version
     scan_window_count = $scan.data.windows.Count
+    runtime_probe_target_count = $runtimeProbe.data.target_count
     uia_available = $selfCheck.data.uia_available
-} | ConvertTo-Json -Depth 4 -Compress
+} | ConvertTo-Json -Depth 4 -Compress