From 8e0f80e38d095ebb92b4b0432a581801bb9ec3a9 Mon Sep 17 00:00:00 2001
From: ogt <ogt@awoooi.local>
Date: Tue, 14 Jul 2026 22:12:04 +0800
Subject: [PATCH] fix(agent99): preserve contract check invocation

---
 scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh     | 2 +-
 .../test_agent99_remote_atomic_deploy_transport_contract.py     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh b/scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh
index a49139784..76b773ff0 100755
--- a/scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh
+++ b/scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh
@@ -424,7 +424,7 @@ $a='C:\Wooo\Agent99';$b=Join-Path $a 'bin';$p=Join-Path $a 'state\runtime-manife
 $r=[ordered]@{exists=$false;sourceRevision='';runtimeMatched=$false;recordedRuntimeMatched=$false;fileCount=0;mismatchCount=-1;recordedMismatchCount=-1;parseError=''}
 if(Test-Path -LiteralPath $p -PathType Leaf){try{$m=Get-Content -LiteralPath $p -Raw|ConvertFrom-Json;$rows=@($m.files);$seen=@{};$bad=0;foreach($x in $rows){$n=[string]$x.name;if(!$n-or[IO.Path]::GetFileName($n)-ne$n-or$seen.ContainsKey($n)){$bad++;continue};$seen[$n]=1;$q=Join-Path $b $n;$h=if(Test-Path -LiteralPath $q -PathType Leaf){(Get-FileHash -LiteralPath $q -Algorithm SHA256).Hash.ToLowerInvariant()}else{'missing'};if(([string]$x.runtimeSha256).ToLowerInvariant()-ne$h){$bad++}};$r.exists=$true;$r.sourceRevision=[string]$m.sourceRevision;$r.recordedRuntimeMatched=[bool]$m.runtimeMatched;$r.fileCount=[int]$m.fileCount;$r.mismatchCount=$bad;$r.recordedMismatchCount=[int]$m.mismatchCount;$r.runtimeMatched=[bool]($m.runtimeMatched-and$m.fileCount-eq 14-and$m.mismatchCount-eq 0-and$rows.Count-eq 14-and$seen.Count-eq 14-and$bad-eq 0)}catch{$r.exists=$true;$r.parseError=$_.Exception.GetType().Name}}
 $c=[ordered]@{executed=$false;ok=$false;exitCode=-1;errorType=''}
-try{& powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '$ProgressPreference="SilentlyContinue";& C:\Wooo\Agent99\bin\agent99-contract-check.ps1 -SourceRoot C:\Wooo\Agent99\bin' 2>$null|Out-Null;$c.executed=$true;$c.exitCode=$LASTEXITCODE;$c.ok=[bool]($c.exitCode-eq 0)}catch{$c.executed=$true;$c.errorType=$_.Exception.GetType().Name}
+try{& powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File (Join-Path $b 'agent99-contract-check.ps1') -SourceRoot $b 2>$null|Out-Null;$c.executed=$true;$c.exitCode=$LASTEXITCODE;$c.ok=[bool]($c.exitCode-eq 0)}catch{$c.executed=$true;$c.errorType=$_.Exception.GetType().Name}
 $z=[ordered]@{};foreach($n in 'remoteWritePerformed,liveRuntimeWritePerformed,livePromotionAttempted,livePromotionPerformed,secretValueRead,privateKeyValueRead,tokenValueRead,environmentSecretRead,uiInteraction,vmPowerChange,hostReboot,serviceRestart,scheduledTaskRestart,scheduledTaskModification'.Split(',')){$z[$n]=$false}
 [ordered]@{schemaVersion='agent99_remote_atomic_deploy_receipt_v1';status='check_ready';mode='check';sourceRevision='__SOURCE_REVISION__';expectedRuntimeFileCount=14;manifestSha256='__MANIFEST_SHA256__';plannedStagingPath='C:\Wooo\Agent99\deploy\remote-source-__STAGE_TOKEN__';runtimeManifest=[pscustomobject]$r;runtimeContract=[pscustomobject]$c;livePreflight=[ordered]@{executed=$false;reason='apply_only_after_validate_only'};transportPayloadMode='control_command_no_stdin';transientTransportPayloadStored=$false;transientTransportPayloadDeletedBeforeReceiver=$false;transportPayloadContainsSecrets=$false;operationBoundaries=$z;nextSafeAction='rerun_with_apply_and_trace_run_work_item_after_source_commit_and_transport_check'}|ConvertTo-Json -Compress -Depth 8'''
 script = (
diff --git a/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py b/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py
index 9db24500f..522ec2a0b 100644
--- a/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py
+++ b/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py
@@ -671,7 +671,7 @@ def test_check_mode_uses_bounded_control_command_without_ssh_stdin(
     assert "agent99-contract-check.ps1" in check_script
     assert "Get-FileHash" in check_script
     assert "runtimeContract" in check_script
-    assert check_script.count("ProgressPreference") == 2
+    assert check_script.count("ProgressPreference") == 1
     assert "remoteWritePerformed" in check_script
     assert "$z[$n]=$false" in check_script
     for write_command in (