From ad9179642a4f282427a00e6dac599732e2ef9f50 Mon Sep 17 00:00:00 2001
From: Ethan Lane <1124774683@qq.com>
Date: Fri, 20 Feb 2026 14:57:57 +0800
Subject: [PATCH] fix: harden windows installer and release verification

---
 install.ps1                         | 21 ++++++++++++++++++++-
 packages/codeblog/script/release.ts | 26 +++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/install.ps1 b/install.ps1
index cef0670..545e614 100644
--- a/install.ps1
+++ b/install.ps1
@@ -3,6 +3,9 @@
 
 $ErrorActionPreference = "Stop"
 
+# Force TLS 1.2 — PowerShell 5.1 defaults to TLS 1.0 which modern HTTPS endpoints reject
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
 $InstallDir = if ($env:CODEBLOG_INSTALL_DIR) { $env:CODEBLOG_INSTALL_DIR } else { "$env:USERPROFILE\.local\bin" }
 $BinName = "codeblog"
 $NpmRegistry = "https://registry.npmjs.org"
@@ -72,7 +75,23 @@ function Write-Header {
 
 # ── Platform detection ──────────────────────────────────────────────────────
 function Get-Platform {
-    $arch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLower()
+    # PowerShell 7+ has RuntimeInformation; PowerShell 5.1 (.NET Framework) does not.
+    # Fall back to PROCESSOR_ARCHITECTURE env var which works on all Windows versions.
+    $arch = $null
+    try {
+        $arch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLower()
+    } catch {}
+
+    if (-not $arch) {
+        $envArch = $env:PROCESSOR_ARCHITECTURE
+        switch ($envArch) {
+            "AMD64"  { $arch = "x64" }
+            "x86"    { $arch = "x64" }   # 32-bit PS on 64-bit OS — still download x64 binary
+            "ARM64"  { $arch = "arm64" }
+            default  { Write-Fail "Unsupported architecture: $envArch" }
+        }
+    }
+
     if ($arch -eq "x64") { return "x64" }
     elseif ($arch -eq "arm64") { return "arm64" }
     else { Write-Fail "Unsupported architecture: $arch" }
diff --git a/packages/codeblog/script/release.ts b/packages/codeblog/script/release.ts
index 4147e74..89e5eaa 100644
--- a/packages/codeblog/script/release.ts
+++ b/packages/codeblog/script/release.ts
@@ -177,7 +177,31 @@ try {
   console.log("   ⚠ Could not verify install.sh version")
 }
 
-// 7c. Verify platform packages
+// 7c. Verify codeblog.ai/install.ps1 has Windows compatibility guards
+try {
+  const remote = await fetch("https://codeblog.ai/install.ps1").then((r) => r.text())
+  const local = await Bun.file(path.join(root, "install.ps1")).text()
+  const normRemote = remote.replaceAll("\r\n", "\n")
+  const normLocal = local.replaceAll("\r\n", "\n")
+  if (normRemote === normLocal) {
+    console.log("   ✓ install.ps1 is synced to codeblog.ai")
+  } else {
+    console.log("   ⚠ install.ps1 on codeblog.ai differs from repository install.ps1")
+  }
+  const guard = [
+    "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12",
+    "$env:PROCESSOR_ARCHITECTURE",
+  ].every((s) => normRemote.includes(s))
+  if (guard) {
+    console.log("   ✓ install.ps1 includes TLS 1.2 + architecture fallback guards")
+  } else {
+    console.log("   ⚠ install.ps1 is missing TLS/architecture guards needed for PowerShell 5.1")
+  }
+} catch {
+  console.log("   ⚠ Could not verify codeblog.ai/install.ps1")
+}
+
+// 7d. Verify platform packages
 for (const p of platforms) {
   try {
     const res = await fetch(`https://registry.npmjs.org/codeblog-app-${p}/latest`)