feat: declare and execute SCUM guided installs

2026-07-27 20:09:14 +08:00
parent 08fa5488f2
commit 2ae27bb746
21 changed files with 185 additions and 9 deletions
@@ -31,12 +31,17 @@ Raw host directories and command text are normally protected. The operator has e

 5. **Auto-reveal only within the authorized editor route.** The editor calls the existing owner-scoped reveal endpoint when opened, stores values only in component state, signals that protected values are visible, and clears state on close. Ordinary deployment reads remain redacted.

+6. **SCUM guided installation is a typed template, not a custom command.** The first-party SCUM template is the authority for SteamCMD App `3792580`, SCUM file/config markers, Microsoft Visual C++ prerequisites, DirectX runtime, and verification. Run receives the frozen template plus the protected root and game fields, creates a controlled SteamCMD argument vector including `+force_install_dir`, and never interprets an operator or plugin supplied shell snippet for the guided path. Microsoft prerequisite artifacts use official Microsoft endpoints and silent switches under a fixed Run catalog; an internal mirror is not selected unless it is explicitly checksum-equivalent to that catalog. Run checks runtime markers before each install and verifies the marker again afterward.
+
+7. **Keep transport identifiers internal and present safe operation text.** `process.install` remains the Run capability because it is part of the leased job protocol. The Platform Web task card derives its title from the frozen plugin/action and deployment phase (for example, `安装 SCUM 服务端`), rather than rendering the protocol capability as user-facing copy.
+
 ## Risks / Trade-offs

 - [Raw local diagnostics can be copied from the host console] → Diagnostics are opt-in, local-only, action-scoped, and clearly warn operators; no credentials or environment are included.
 - [Mixed Platform/Run releases can lose execution confirmation] → Version/capability negotiation rejects deployment-aware jobs until the Run supports the protocol, rather than silently ignoring input.
 - [An editor request can reveal operational values to an authorized browser] → It remains owner-authorized, uses no shared cache, and clears on dialog close.
 - [Existing clients cannot express clearing] → The additive `clearFields` field preserves existing requests while enabling explicit removal.
+- [A download mirror may be stale or tampered with] → Prefer the official Microsoft catalog and a fixed checksum/signature policy. Mirrors are acceleration only after equivalence verification; they are never the trust root.

 ## Migration Plan

@@ -12,6 +12,8 @@ This change makes the editor load the authorized saved definition directly and m
 - Return a non-sensitive receipt containing the deployment revision and execution mode so Platform can distinguish dispatch evidence from Run execution confirmation.
 - Automatically fetch and prefill the authorized saved deployment inputs when opening the edit workflow, then clear them when the dialog closes.
 - Replace ambiguous empty-string update handling with explicit preserve/set/clear semantics and prevent an omitted shell from resetting the saved shell.
+- Make first-party SCUM guided installation fully plugin-owned: Run must consume the frozen SCUM template, ensure SteamCMD plus declared Microsoft prerequisites, install App `3792580` into the selected root, materialize configuration, and verify the resulting server. Operators supply the target directory and game settings, never lifecycle commands or prerequisite installers.
+- Replace raw lifecycle capability text such as `process.install` in operator task surfaces with the plugin-aware operation name and phase, while retaining the capability as the internal routing identifier.

 ## Capabilities

@@ -29,3 +31,4 @@ This change makes the editor load the authorized saved definition directly and m
 - Platform job-channel DTOs, domain contracts, validation, lifecycle dispatch/result projection, and deployment editor API/client/view code.
 - Independent `run.git` protocol, lifecycle executor, worker diagnostics, tests, and release compatibility metadata. No Run source is added to this repository.
 - Operator workflow: opening an authorized stopped-server editor reads protected deployment values; normal list/detail/job/log/audit responses remain redacted.
+- SCUM guided deployment: first-party manifest declaration, Platform's frozen assignment, and the independent Run executor.
@@ -32,3 +32,18 @@ Platform SHALL preserve a deployment value when an update omits it and SHALL cle
 #### Scenario: Optional command is cleared
 - **WHEN** an editor submits `stopCommand` in its explicit clear list
 - **THEN** Platform SHALL store no stop command for the next deployment revision
+
+### Requirement: SCUM guided deployment is template-owned
+For a frozen SCUM guided-install assignment, Run SHALL execute the declared SCUM installation template rather than requiring an operator-provided install or start command. The operator supplies only the protected target root and plugin create inputs.
+
+#### Scenario: Missing runtime prerequisites are installed silently
+- **WHEN** a Windows SCUM guided-install detects a required declared Microsoft runtime is absent
+- **THEN** Run SHALL obtain the approved Microsoft artifact, invoke only its fixed silent installer arguments, verify the runtime marker, and continue only when verification passes
+
+#### Scenario: SteamCMD installs into the selected root
+- **WHEN** a valid SCUM guided-install is executed for root `C:\\scumserver`
+- **THEN** Run SHALL invoke SteamCMD with `+force_install_dir C:\\scumserver`, anonymous login, App `3792580`, validation, and quit as separate argument values
+
+#### Scenario: Guided execution does not disclose raw values remotely
+- **WHEN** Run completes or fails a SCUM guided-install
+- **THEN** its progress, result, evidence, artifact names, and uploaded logs SHALL contain no raw root, command line, credential, or installer URL
@@ -8,7 +8,8 @@

 - [x] 2.1 Add typed deployment execution version/receipt contracts and validation for frozen lifecycle jobs.
 - [x] 2.2 Require compatible Run capability before lifecycle dispatch and project validated Run confirmation in deployment views.
- [ ] 2.3 Add explicit deployment-field clearing and preserve omitted shell values; cover service/API behavior with tests.
+- [x] 2.3 Add explicit deployment-field clearing and preserve omitted shell values; cover service/API behavior with tests.
+- [x] 2.4 Freeze SCUM prerequisite/template execution data into the leased deployment plan and validate it as a first-party Windows-only guided installation contract.

 ## 3. Platform editor workflow

@@ -20,10 +21,12 @@
 - [x] 4.1 Extend independent `run.git` protocol and validation with the typed deployment envelope and safe execution receipt.
 - [x] 4.2 Execute deployment-aware lifecycle actions using the frozen root, working directory, shell, and commands.
 - [x] 4.3 Add opt-in local-only raw startup diagnostics that bypass the upload log sink and exclude credentials/environment values.
- [ ] 4.4 Add Run protocol/runtime tests covering execution, receipt fences, enabled diagnostics, and remote-channel redaction.
+- [x] 4.4 Add Run protocol/runtime tests covering execution, receipt fences, enabled diagnostics, and remote-channel redaction.
+- [x] 4.5 Implement the SCUM guided executor: dependency probes and silent Microsoft prerequisite installation, SteamCMD bootstrap, `+force_install_dir` installation, configuration materialization, verification evidence, and local-only diagnostic output.

 ## 5. Verification and delivery

 - [x] 5.1 Run browser Platform/backend/frontend validation and strict OpenSpec validation.
 - [x] 5.2 Run independent Run test suite and inspect both worktrees for scoped changes only.
 - [x] 5.3 Stage, commit, and push scoped changes on `main` in both repositories.
+- [x] 5.4 Replace raw lifecycle capability labels in the server-management task views and run focused UI tests.