Test-PublicRelease.ps1

param(
    [Parameter(Mandatory = $true)]
    [string]$ReleaseDirectory,

    [string]$ArchivePath = '',

    [string]$SourceDirectory = '',

    [string[]]$ForbiddenMarker = @()
)

$ErrorActionPreference = 'Stop'
$releaseRoot = [IO.Path]::GetFullPath($ReleaseDirectory).TrimEnd('\')
$violations = [Collections.Generic.List[string]]::new()
$textExtensions = [Collections.Generic.HashSet[string]]::new(
    [StringComparer]::OrdinalIgnoreCase)
foreach ($extension in @('.ps1', '.json', '.txt', '.md', '.xml', '.config')) {
    [void]$textExtensions.Add($extension)
}
$privateMarkers = @(
    ('Deep' + 'Seek'),
    ('Koikatu' + 'Profiles'),
    ('Codex.Koikatu.' + 'OneStopManager'),
    ('Codex\KoikatuManager' + '\Data'),
    ('3.1-' + ('deep' + 'seek'))
)
$allForbiddenMarkers = @($privateMarkers) + @(
    $ForbiddenMarker |
        Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
        Select-Object -Unique)

function Add-Violation([string]$Message) {
    $script:violations.Add($Message)
}

function Get-RelativePath([string]$Root, [string]$Path) {
    return $Path.Substring($Root.Length).TrimStart('\').Replace('\', '/')
}

function Get-Sha256([string]$Path) {
    $stream = [IO.File]::OpenRead($Path)
    $sha256 = [Security.Cryptography.SHA256]::Create()
    try {
        return [BitConverter]::ToString(
            $sha256.ComputeHash($stream)).Replace('-', '')
    }
    finally {
        $sha256.Dispose()
        $stream.Dispose()
    }
}

function Test-TextContent([string]$Path, [string]$DisplayPath) {
    $content = [IO.File]::ReadAllText($Path, [Text.Encoding]::UTF8)
    if ($content -match '(?<![A-Za-z0-9_])[A-Za-z]:\\') {
        Add-Violation "Absolute drive path in text file: $DisplayPath"
    }
    if ($content -match '(?i)C:/Users/|/home/[^/\s]+/') {
        Add-Violation "User-home path in text file: $DisplayPath"
    }
    foreach ($marker in $allForbiddenMarkers) {
        if ($content.IndexOf($marker, [StringComparison]::OrdinalIgnoreCase) -ge 0) {
            Add-Violation "Private/development marker '$marker' in: $DisplayPath"
        }
    }
}

function Test-BinaryMarkers([string]$Path, [string]$DisplayPath) {
    $bytes = [IO.File]::ReadAllBytes($Path)
    $ascii = [Text.Encoding]::ASCII.GetString($bytes)
    $unicode = [Text.Encoding]::Unicode.GetString($bytes)
    foreach ($marker in $allForbiddenMarkers) {
        if ($ascii.IndexOf($marker, [StringComparison]::OrdinalIgnoreCase) -ge 0 -or
            $unicode.IndexOf($marker, [StringComparison]::OrdinalIgnoreCase) -ge 0) {
            Add-Violation "Private/development marker '$marker' embedded in: $DisplayPath"
        }
    }
}

if (-not (Test-Path -LiteralPath $releaseRoot -PathType Container)) {
    throw "Release directory does not exist: $releaseRoot"
}

$releaseFiles = @(Get-ChildItem -LiteralPath $releaseRoot -Recurse -File -Force)
$relativeFiles = @($releaseFiles | ForEach-Object {
    Get-RelativePath $releaseRoot $_.FullName
})

if ($releaseFiles.Count -eq 0) {
    Add-Violation 'Release directory is empty.'
}
foreach ($relativePath in $relativeFiles) {
    $segments = @($relativePath -split '/')
    if ($segments -contains 'Data') {
        Add-Violation "User-data directory is present: $relativePath"
    }
    $leaf = $segments[-1]
    if ($leaf -match '(?i)^(settings|instances-v\d+|run-record|operation-manifest|plugin-baseline-v\d+)\.json$' -or
        $leaf -match '(?i)\.(pdb|log|bak|tmp|user|suo|dmp)$') {
        Add-Violation "Runtime, debug or backup file is present: $relativePath"
    }
    if ($leaf.Equals('portable.flag', [StringComparison]::OrdinalIgnoreCase)) {
        Add-Violation 'portable.flag must not be shipped in the public distribution.'
    }
}

$allowedTopLevel = @(
    'KoikatuManager.exe',
    'README.zh-CN.txt',
    'CHANGELOG.zh-CN.md',
    'release-manifest.json',
    'Tools'
)
foreach ($item in Get-ChildItem -LiteralPath $releaseRoot -Force) {
    if ($allowedTopLevel -notcontains $item.Name) {
        Add-Violation "Unexpected top-level release item: $($item.Name)"
    }
}

foreach ($file in $releaseFiles) {
    $relative = Get-RelativePath $releaseRoot $file.FullName
    if ($textExtensions.Contains($file.Extension)) {
        Test-TextContent $file.FullName $relative
    }
    else {
        Test-BinaryMarkers $file.FullName $relative
    }
}

$manifestPath = Join-Path $releaseRoot 'release-manifest.json'
if (-not (Test-Path -LiteralPath $manifestPath -PathType Leaf)) {
    Add-Violation 'release-manifest.json is missing.'
}
else {
    try {
        $manifest = Get-Content -LiteralPath $manifestPath -Raw -Encoding UTF8 |
            ConvertFrom-Json
        if ($manifest.product -ne 'KoikatuManager' -or $manifest.version -ne '3.8.1') {
            Add-Violation 'Release manifest product/version is not the public 3.8.1 identity.'
        }
        if ($manifest.includesUserData -ne $false) {
            Add-Violation 'Release manifest does not explicitly reject bundled user data.'
        }
        if ($manifest.distributionMode -ne 'installed' -or
            $manifest.dataStorage -ne '%LOCALAPPDATA%\KoikatuManager\Data') {
            Add-Violation 'Release manifest data-storage policy is invalid.'
        }
        $manifestFiles = @($manifest.files | ForEach-Object {
            ([string]$_.path).Replace('\', '/')
        })
        $expectedManifestFiles = @($relativeFiles |
            Where-Object { $_ -ne 'release-manifest.json' } |
            Sort-Object)
        $actualManifestFiles = @($manifestFiles | Sort-Object)
        $manifestDifference = @(Compare-Object $expectedManifestFiles $actualManifestFiles)
        if ($manifestDifference.Count -gt 0) {
            Add-Violation 'Release manifest file list does not match the release directory.'
        }
    }
    catch {
        Add-Violation "Release manifest is invalid JSON: $($_.Exception.Message)"
    }
}

if (-not [string]::IsNullOrWhiteSpace($ArchivePath)) {
    $resolvedArchive = [IO.Path]::GetFullPath($ArchivePath)
    if (-not (Test-Path -LiteralPath $resolvedArchive -PathType Leaf)) {
        Add-Violation "Archive does not exist: $resolvedArchive"
    }
    else {
        Add-Type -AssemblyName System.IO.Compression.FileSystem
        $archive = [IO.Compression.ZipFile]::OpenRead($resolvedArchive)
        try {
            $entries = @($archive.Entries | Where-Object {
                -not [string]::IsNullOrEmpty($_.Name)
            })
            $entryNames = @($entries | ForEach-Object {
                $_.FullName.Replace('\', '/')
            } | Sort-Object)
            $directoryNames = @($relativeFiles | Sort-Object)
            if (@(Compare-Object $directoryNames $entryNames).Count -gt 0) {
                Add-Violation 'ZIP entries do not exactly match the audited release directory.'
            }
            foreach ($entry in $entries) {
                $relative = $entry.FullName.Replace('\', '/')
                $diskPath = Join-Path $releaseRoot $relative.Replace('/', '\')
                if (-not (Test-Path -LiteralPath $diskPath -PathType Leaf)) {
                    continue
                }
                $sha = [Security.Cryptography.SHA256]::Create()
                try {
                    $stream = $entry.Open()
                    try {
                        $entryHash = [BitConverter]::ToString(
                            $sha.ComputeHash($stream)).Replace('-', '')
                    }
                    finally {
                        $stream.Dispose()
                    }
                }
                finally {
                    $sha.Dispose()
                }
                $diskHash = Get-Sha256 $diskPath
                if ($entryHash -ne $diskHash) {
                    Add-Violation "ZIP content differs from audited file: $relative"
                }
            }
        }
        finally {
            $archive.Dispose()
        }
    }
}

if (-not [string]::IsNullOrWhiteSpace($SourceDirectory)) {
    $sourceRoot = [IO.Path]::GetFullPath($SourceDirectory).TrimEnd('\')
    if (-not (Test-Path -LiteralPath $sourceRoot -PathType Container)) {
        Add-Violation "Public source directory does not exist: $sourceRoot"
    }
    else {
        foreach ($file in Get-ChildItem -LiteralPath $sourceRoot -Recurse -File -Force) {
            $relative = Get-RelativePath $sourceRoot $file.FullName
            if ($relative -match '(^|/)(Data|bin|obj|\.git)(/|$)') {
                Add-Violation "Generated/private directory is present in source package: $relative"
                continue
            }
            if ($file.Name -in @(
                    'IMPLEMENTATION-LOG.zh-CN.md',
                    'UI-SELF-AUDIT-1.0.zh-CN.md')) {
                Add-Violation "Private development history is present in source package: $relative"
            }
            if ($file.Name -ne 'Test-PublicRelease.ps1' -and
                $textExtensions.Contains($file.Extension)) {
                $content = [IO.File]::ReadAllText($file.FullName, [Text.Encoding]::UTF8)
                $containsPrivateMarker = $false
                foreach ($marker in $privateMarkers) {
                    if ($content.IndexOf(
                            $marker,
                            [StringComparison]::OrdinalIgnoreCase) -ge 0) {
                        $containsPrivateMarker = $true
                        break
                    }
                }
                if ($content -match '(?i)(?<![A-Za-z0-9_])[PZF]:\\' -or
                    $content -match '(?i)C:\\Users\\[^\\\s]+\\' -or
                    $containsPrivateMarker) {
                    Add-Violation "Private machine path or development marker in source: $relative"
                }
            }
        }
    }
}

if ($violations.Count -gt 0) {
    $details = ($violations | Sort-Object -Unique | ForEach-Object { " - $_" }) -join [Environment]::NewLine
    throw "Public release audit failed:$([Environment]::NewLine)$details"
}

Write-Output (
    "PUBLIC-RELEASE-AUDIT PASS files={0} bytes={1} archive={2} source={3}" -f
        $releaseFiles.Count,
        (($releaseFiles | Measure-Object Length -Sum).Sum),
        (-not [string]::IsNullOrWhiteSpace($ArchivePath)),
        (-not [string]::IsNullOrWhiteSpace($SourceDirectory)))