From bdd723f62c20762ef704ed9ab25de0b2d8682993 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=BB=9D=E5=B0=98?= <237809796@qq.com>
Date: Sat, 10 Oct 2026 00:40:17 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D:=20swap-install=20=E5=85=BC?=
 =?UTF-8?q?=E5=AE=B9=E6=97=A0=20Get-FileHash=20=E7=9A=84=E7=8E=AF=E5=A2=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 本机 Windows PowerShell 5.1 实测缺 Get-FileHash(v3 脚本 3 处调用直接报错中断,换装不执行)
- 新增 Get-Sha256 辅助:优先 Get-FileHash,异常兜底系统 certutil;两法实测同值
- 收口 3 处调用(baseline/before/after)
---
 scripts/swap-install.ps1 | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/scripts/swap-install.ps1 b/scripts/swap-install.ps1
index e7c7b6b..78e91e1 100644
--- a/scripts/swap-install.ps1
+++ b/scripts/swap-install.ps1
@@ -18,9 +18,19 @@ $builtExe  = 'E:\wk-lab\devflow\target\release\devflow.exe'
 $log       = 'E:\wk-lab\devflow\swap-install.log'
 $lockFile  = 'E:\wk-lab\devflow\swap-install.lock'
 
+# SHA256 取值:Get-FileHash 在部分环境的本机 Windows PowerShell 5.1 上不可用(实测 2026-10-10 缺失),
+# 兜底走系统自带的 certutil。返回大写十六进制串。
+function Get-Sha256($path) {
+    try { return (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction Stop).Hash }
+    catch { return (((certutil -hashfile $path SHA256) | Select-Object -Index 1) -replace '\s', '').ToUpper() }
+}
+
 # 构建产物哈希是唯一强基准; 产物缺失时退化为与安装前快照比对的弱校验
+# 实测(2026-10-10):装机 exe 与本基准哈希不一致(与 target/release/devflow.exe 同尺寸但字节不同,
+# 疑 NSIS 打包前打 bundle-type 补丁所致)→ 强基准恒不命中,实际退化为「两次安装字节一致 + 与
+# 安装前不同」的校验。该退化仍能拦住「installer exit=0 但 exe 未更新」(before==after)。
 $hashWant = $null
-if (Test-Path $builtExe) { $hashWant = (Get-FileHash $builtExe -Algorithm SHA256).Hash }
+if (Test-Path $builtExe) { $hashWant = Get-Sha256 $builtExe }
 
 # 0. SYSTEM 上下文转投用户会话
 $who = whoami
@@ -80,7 +90,7 @@ function Invoke-SwapInstall {
         "[$(Get-Date -Format 'HH:mm:ss')] FAIL: target missing after install" | Add-Content $log
         return $null
     }
-    $afterHash = (Get-FileHash $target -Algorithm SHA256).Hash
+    $afterHash = Get-Sha256 $target
     $afterSize = (Get-Item $target).Length
     "[$(Get-Date -Format 'HH:mm:ss')] installed size=$afterSize hash=$($afterHash.Substring(0, 12))" | Add-Content $log
     return $afterHash
@@ -110,7 +120,7 @@ try {
     # 3. 安装前快照, 供弱校验与前后比对
     $before = @{ hash = 'absent'; size = 0 }
     if (Test-Path $target) {
-        $before.hash = (Get-FileHash $target -Algorithm SHA256).Hash
+        $before.hash = Get-Sha256 $target
         $before.size = (Get-Item $target).Length
     }
     $beforeHashShort = $before.hash