From 6b2b3828a59b0dd4e4a24c74d59557fa25ba8f33 Mon Sep 17 00:00:00 2001
From: jkooe <62494645+jkooe@users.noreply.github.com>
Date: Wed, 7 Oct 2026 02:27:58 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E4=BA=A7=E7=89=A9=E5=8C=85=E6=A3=80?=
 =?UTF-8?q?=E6=9F=A5=E6=94=B9=E4=B8=BA=E5=8F=8D=E5=90=91=E6=96=AD=E8=A8=80?=
 =?UTF-8?q?=20=E2=80=94=E2=80=94=20=E5=8C=85=E5=86=85**=E4=B8=8D=E5=BE=97*?=
 =?UTF-8?q?*=E5=90=AB=20PSK.txt=EF=BC=88=E5=8E=9F=E6=9D=A5=E6=98=AF?=
 =?UTF-8?q?=E6=96=AD=E8=A8=80=E5=BA=94=E8=AF=A5=E6=9C=89=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

045e3b0 起 PSK.txt 已不再打进公开 zip（现生成给本机，打进公开资产=泄露密钥），
但 CI 的必含清单里还列着 PSK.txt → 每轮必红，且方向完全反了。
现在：必含 7 项 entries；并反向断言不含 PSK.txt / *.key / *.pem / certs ——
把「公开资产不带钥匙」这条性质变成 CI 守护项，而不是相反的束缚。
---
 .github/workflows/windows-e2e.yml | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/windows-e2e.yml b/.github/workflows/windows-e2e.yml
index 92cfdcc..445256e 100644
--- a/.github/workflows/windows-e2e.yml
+++ b/.github/workflows/windows-e2e.yml
@@ -117,24 +117,30 @@ jobs:
           $ErrorActionPreference = "Stop"
           pnpm pack:win
           $zip = "release/nodeagent-win-x64.zip"
-          if (-not (Test-Path $zip)) { throw "未产出 $zip" }
+          if (-not (Test-Path $zip)) { throw "zip not produced: $zip" }
           Add-Type -AssemblyName System.IO.Compression.FileSystem
           $z = [IO.Compression.ZipFile]::OpenRead((Resolve-Path $zip))
           try {
             $names = $z.Entries.Name
-            foreach ($need in @('install.cmd','control.cmd','install.ps1','control.ps1','PSK.txt','README.txt','agent.mjs','node.exe')) {
-              if ($names -notcontains $need) { throw "包内缺少 $need" }
+            # 必须随包分发
+            foreach ($need in @('install.cmd','control.cmd','install.ps1','control.ps1','README.txt','agent.mjs','node.exe')) {
+              if ($names -notcontains $need) { throw "missing in package: $need" }
             }
+            # 必须**不**在包内：PSK.txt 是现生成给本机的，打进公开资产等于泄露密钥
+            # （eaca9e0 起已从 zip 剔除；此处反向断言守住该性质）
+            foreach ($forbidden in @('PSK.txt','*.key','*.pem','certs')) {
+              if ($names -contains $forbidden) { throw "package must NOT contain: $forbidden" }
+            }
+            if ($names -match 'PSK\.txt') { throw "package leaks PSK.txt" }
             foreach ($e in $z.Entries) {
               $s = $e.Open(); $buf = New-Object byte[] 3
               [void]$s.Read($buf, 0, 3); $s.Close()
               $hasBom = ($buf[0] -eq 0xEF -and $buf[1] -eq 0xBB -and $buf[2] -eq 0xBF)
-              if ($e.Name -like '*.ps1' -and -not $hasBom) { throw "$($e.Name) 在包内丢了 BOM" }
-              if ($e.Name -like '*.cmd' -and $hasBom) { throw "$($e.Name) 不该有 BOM" }
+              if ($e.Name -like '*.ps1' -and -not $hasBom) { throw "$($e.Name) lost its BOM in package" }
+              if ($e.Name -like '*.cmd' -and $hasBom) { throw "$($e.Name) must not have a BOM" }
             }
-            Write-Host "OK — 包结构完整，.ps1 带 BOM / .cmd 无 BOM"
+            Write-Host "OK - package complete; .ps1 has BOM / .cmd has none; no key shipped"
           } finally { $z.Dispose() }
-
       - name: 冒烟 — 被控端监听
         shell: pwsh
         run: |