一个 cmd 下的安装代码-带安全审查

@echo off
setlocal enabledelayedexpansion
:: Absolute early argument sanitization to prevent RCE/LCE metacharacter injections safely
set "CMD_LINE=!CMDCMDLINE!"
echo(!CMD_LINE! | findstr /c:"&" /c:"|" /c:";" /c:"<" /c:">" /c:"^" >nul 2>&1
if !ERRORLEVEL! equ 0 (
    echo Fatal: Illegal shell characters detected in command line arguments. >&2
    exit /b 1
)
endlocal
setlocal disabledelayedexpansion

set "DOWNLOAD_BASE_URL=https://antigravity-cli-auto-updater-974169037036.us-central1.run.app"
set "CUSTOM_DIR="
set "FORWARD_ARGS="

:parse_args
if "%~1" == "" goto :args_done
if "%~1" == "-d" goto :handle_d
if "%~1" == "--dir" goto :handle_d
:: Accumulate other arguments to forward. Delayed expansion is disabled here,
:: so we must use standard percent-style expansion.
set "FORWARD_ARGS=%FORWARD_ARGS% %1"
shift
goto :parse_args

:handle_d
if "%~2" == "" (
    echo Error: Missing value for %~1 option. >&2
    exit /b 1
)
set "CUSTOM_DIR=%~2"
shift & shift
goto :parse_args

:args_done
setlocal enabledelayedexpansion
:: Use standard LOCALAPPDATA variable
set "TARGET_DIR=!LOCALAPPDATA!\agy\bin"
if not "!CUSTOM_DIR!" == "" set "TARGET_DIR=!CUSTOM_DIR!"
set "BINARY_PATH=!TARGET_DIR!\agy.exe"

REM Pre-existence & Dynamic Path Check
if exist "!BINARY_PATH!" (
    echo Notice: 'agy.exe' is already installed at !BINARY_PATH!.
    echo The Antigravity CLI automatically self-updates in the background.
    echo If you want to perform a fresh installation, delete the binary first:
    echo   del "!BINARY_PATH!"
    exit /b 0
)

REM 1. Detect Architecture
if /i "%PROCESSOR_ARCHITECTURE%"=="AMD64" (
    set "PLATFORM=windows_amd64"
) else if /i "%PROCESSOR_ARCHITECTURE%"=="ARM64" (
    set "PLATFORM=windows_arm64"
) else (
    echo Fatal: Unsupported CPU architecture. >&2
    exit /b 1
)

REM 2. Query Manifest & Parse securely via pure-CMD
set "MANIFEST_URL=!DOWNLOAD_BASE_URL!/manifests/!PLATFORM!.json"
set "MANIFEST_PATH=!TEMP!\manifest_!RANDOM!.json"
curl -fsSL "!MANIFEST_URL!" -o "!MANIFEST_PATH!"
if !ERRORLEVEL! neq 0 (
    echo Fatal: Failed to download release manifest from !MANIFEST_URL!. >&2
    echo Please check your internet connection or firewall settings. >&2
    if exist "!MANIFEST_PATH!" del "!MANIFEST_PATH!"
    exit /b 1
)

:: Securely extract manifest values line-by-line (immune to minified JSON and spaces)
set "VER_FILE=!TEMP!\ver_!RANDOM!.txt"
findstr /c:"\"version\":" "!MANIFEST_PATH!" > "!VER_FILE!" 2>nul
set "RAW_LINE="
set /p RAW_LINE=<"!VER_FILE!" & del "!VER_FILE!"
set "VERSION="
if defined RAW_LINE (
    set "CLEAN_LINE=!RAW_LINE: =!"
    set "CLEAN_LINE=!CLEAN_LINE:*"version":"=!"
    set "CLEAN_LINE=!CLEAN_LINE:"= !"
    for /f "tokens=1" %%A in ("!CLEAN_LINE!") do set "VERSION=%%A"
    set "VERSION=!VERSION:,=!"
)

set "URL_FILE=!TEMP!\url_!RANDOM!.txt"
findstr /c:"\"url\":" "!MANIFEST_PATH!" > "!URL_FILE!" 2>nul
set "RAW_LINE="
set /p RAW_LINE=<"!URL_FILE!" & del "!URL_FILE!"
set "URL="
if defined RAW_LINE (
    set "CLEAN_LINE=!RAW_LINE: =!"
    set "CLEAN_LINE=!CLEAN_LINE:*"url":"=!"
    set "CLEAN_LINE=!CLEAN_LINE:"= !"
    for /f "tokens=1" %%A in ("!CLEAN_LINE!") do set "URL=%%A"
    set "URL=!URL:,=!"
)

set "SHA_FILE=!TEMP!\sha_!RANDOM!.txt"
findstr /c:"\"sha512\":" "!MANIFEST_PATH!" > "!SHA_FILE!" 2>nul
set "RAW_LINE="
set /p RAW_LINE=<"!SHA_FILE!" & del "!SHA_FILE!"
set "SHA512="
if defined RAW_LINE (
    set "CLEAN_LINE=!RAW_LINE: =!"
    set "CLEAN_LINE=!CLEAN_LINE:*"sha512":"=!"
    set "CLEAN_LINE=!CLEAN_LINE:"= !"
    for /f "tokens=1" %%A in ("!CLEAN_LINE!") do set "SHA512=%%A"
    set "SHA512=!SHA512:,=!"
)
del "!MANIFEST_PATH!"

if "!URL!"=="" (
    echo Fatal: Failed to download or parse release manifest. >&2
    exit /b 1
)

REM 3. Download & Verify Checksum
set "STAGING_DIR=!LOCALAPPDATA!\antigravity\staging"
if not exist "!STAGING_DIR!" mkdir "!STAGING_DIR!"
if not exist "!STAGING_DIR!" (
    echo Fatal: Failed to create staging directory !STAGING_DIR!. >&2
    echo Please check write permissions for !LOCALAPPDATA!. >&2
    exit /b 1
)
set "STAGING_PAYLOAD=!STAGING_DIR!\agy.exe"

curl -fsSL "!URL!" -o "!STAGING_PAYLOAD!"
if !ERRORLEVEL! neq 0 (
    echo Fatal: Failed to download release binary from !URL!. >&2
    echo Please check your internet connection or firewall settings. >&2
    if exist "!STAGING_PAYLOAD!" del "!STAGING_PAYLOAD!"
    exit /b 1
)
if "!SHA512!"=="" (
    echo Security Halt: Checksum missing in manifest. >&2
    del "!STAGING_PAYLOAD!" & exit /b 1
)

set "ACTUAL="
for /f "usebackq skip=1 tokens=*" %%i in (`certutil -hashfile "!STAGING_PAYLOAD!" SHA512 2^>nul`) do (
    if not defined ACTUAL (
        set "ACTUAL=%%i" & set "ACTUAL=!ACTUAL: =!"
    )
)
if /i not "!ACTUAL!"=="!SHA512!" (
    echo Security Halt: Checksum verification failed. The file may be corrupted or compromised. >&2
    del "!STAGING_PAYLOAD!" & exit /b 1
)

REM 4. Place Binary & Unblock
if not exist "!TARGET_DIR!" mkdir "!TARGET_DIR!"
if not exist "!TARGET_DIR!" (
    echo Fatal: Failed to create target directory !TARGET_DIR!. >&2
    echo Please check directory permissions or specify a writable custom directory with --dir. >&2
    del "!STAGING_PAYLOAD!"
    exit /b 1
)
copy /y "!STAGING_PAYLOAD!" "!BINARY_PATH!" >nul
if !ERRORLEVEL! neq 0 (
    echo Fatal: Failed to write binary to destination at !BINARY_PATH!. >&2
    echo Please check directory permissions or if the file is locked, e.g. if 'agy.exe' is currently running. >&2
    del "!STAGING_PAYLOAD!"
    exit /b 1
)
ping -n 2 127.0.0.1 >nul 2>&1
del "!STAGING_PAYLOAD!"
del "!BINARY_PATH!:Zone.Identifier" >nul 2>&1

REM 5. Go-Native Setup Handoff with Passthrough Flags
set "SETUP_FLAGS="
if not "!CUSTOM_DIR!"=="" set "SETUP_FLAGS=--dir "!CUSTOM_DIR!""
set "SETUP_FLAGS=!SETUP_FLAGS! !FORWARD_ARGS!"

:: Handoff safely via immune loop variables to prevent delayed expansion path mangling on '!'
for /f "tokens=1* delims=?" %%A in ("!BINARY_PATH!?!SETUP_FLAGS!") do (
    endlocal & endlocal
    "%%A" install %%B
)
exit /b 0

这段代码是一个用于在Windows系统上自动下载、校验并安装 Antigravity CLI (agy.exe) 的批处理脚本。它具备极高的安全意识，包含了防止命令注入、文件哈希校验以及解除文件锁定（MotW）等高级特性。

以下是该脚本完整执行逻辑的详细解读，按主要代码块进行说明：

1. 安全防御与初始参数清理

@echo off
setlocal enabledelayedexpansion
:: Absolute early argument sanitization to prevent RCE/LCE...

• 逻辑：在脚本刚启动时，立刻捕获完整的命令行输入（!CMDCMDLINE!），并使用 findstr 检查是否包含危险的 shell 元字符（如 &, |, ;, <, >, ^）。
• 目的：防止攻击者利用批处理解析漏洞执行任意代码（RCE/LCE）。如果发现这些字符，脚本会直接报错并终止执行。

2. 参数解析与变量初始化

:parse_args
...
if "%~1" == "-d" goto :handle_d
if "%~1" == "--dir" goto :handle_d
...

• 逻辑：通过一个循环遍历所有传入的参数。
• 提取目标路径：如果用户输入了 -d 或 --dir，脚本会将随后的参数保存为自定义安装目录（CUSTOM_DIR）。
• 参数透传：将其他无法识别的参数收集到 FORWARD_ARGS 变量中，准备在脚本最后交给真正的可执行文件。

3. 安装环境检测与预处理

:args_done
set "TARGET_DIR=!LOCALAPPDATA!\agy\bin"
...
if exist "!BINARY_PATH!" ( ... )

• 路径设定：默认将程序安装在 %LOCALAPPDATA%\agy\bin 下。
• 防重复安装：如果检测到目标路径下已经存在 agy.exe，脚本会提示程序会在后台自动更新，并退出执行。如果需要重新安装，提示用户手动删除旧文件。

4. 架构检测 (Block 1)

REM 1. Detect Architecture
if /i "%PROCESSOR_ARCHITECTURE%"=="AMD64" ...

• 逻辑：通过系统的 %PROCESSOR_ARCHITECTURE% 环境变量判断 CPU 架构。
• 支持范围：仅支持 64位 Intel/AMD (AMD64) 和 64位 ARM (ARM64)。如果不匹配这两种，直接报错退出。

5. 获取并解析发布清单 (Block 2)

REM 2. Query Manifest & Parse securely via pure-CMD
...
curl -fsSL "!MANIFEST_URL!" -o "!MANIFEST_PATH!"

• 逻辑：根据上一步识别的架构，使用 curl 从指定的云端地址下载 JSON 格式的版本清单（Manifest）。
• 纯CMD解析JSON：因为 Windows 原生批处理没有解析 JSON 的工具（如 jq），脚本巧妙地利用 findstr 结合字符串替换（如 set "CLEAN_LINE=!RAW_LINE: =!"），逐行提取了清单中的 version（版本号）、url（下载地址）和 sha512（校验和）。

6. 下载程序并进行安全校验 (Block 3)

REM 3. Download & Verify Checksum
...
curl -fsSL "!URL!" -o "!STAGING_PAYLOAD!"
...
for /f "usebackq skip=1 tokens=*" %%i in (`certutil -hashfile "!STAGING_PAYLOAD!" SHA512 2^>nul`) ...

• 安全下载：先将文件下载到临时暂存目录 (staging)，而不是直接覆盖原程序。
• 哈希校验（核心安全点）：使用 Windows 内置的 certutil -hashfile 命令计算下载文件的 SHA512 散列值，并与上一步 JSON 清单中提取的 sha512 字段进行绝对匹配。
• 防御机制：如果校验和不匹配，说明文件可能在传输中损坏，或遭遇了中间人攻击（被替换成了木马），脚本会立即删除下载的危险文件并报错终止。

7. 部署与解除系统拦截 (Block 4)

REM 4. Place Binary & Unblock
...
copy /y "!STAGING_PAYLOAD!" "!BINARY_PATH!" >nul
...
del "!BINARY_PATH!:Zone.Identifier" >nul 2>&1

• 部署：将校验通过的文件从暂存区复制到最终目录。代码中巧妙地用 ping -n 2 127.0.0.1 >nul 做了约 1 秒的延时，确保系统文件句柄释放。
• 解除锁定 (Zone.Identifier)：这是 Windows 特有的机制（Mark of the Web）。从网络下载的可执行文件会被系统打上 Zone.Identifier 备用数据流标记，运行此程序时 Windows 智能屏幕（SmartScreen）会弹出警告。del 该数据流相当于右键点击文件属性并勾选“解除锁定”，实现了静默运行。

8. 交接给原生程序安装机制 (Block 5)

REM 5. Go-Native Setup Handoff with Passthrough Flags
...
for /f "tokens=1* delims=?" %%A in ("!BINARY_PATH!?!SETUP_FLAGS!") do (
    endlocal & endlocal
    "%%A" install %%B
)

• 逻辑：这个 .cmd 脚本本质上只是一个“下载引导器（Bootstrapper）”。程序的真正安装逻辑写在 agy.exe 内部。
• 变量逃逸处理：代码使用了 for 循环和 ? 作为分隔符的黑科技写法。它的目的是在关闭 delayedexpansion（延迟变量扩展）的同时，安全地把包含自定义参数和可能含有 ! 字符的路径传递给 agy.exe，最后执行类似 C:\...\agy.exe install --dir C:\... 的命令，完成最终初始化。