diff --git a/docs/agent/ime-log-tracker-matching-budget.md b/docs/agent/ime-log-tracker-matching-budget.md index 1c15296b..7e41aff7 100644 --- a/docs/agent/ime-log-tracker-matching-budget.md +++ b/docs/agent/ime-log-tracker-matching-budget.md @@ -92,6 +92,16 @@ completion) queue behind that work — a monitoring blackout during the enrollme above the work per byte is linear and small, so a writer can only delay processing in proportion to the bytes it writes. +## Pack hygiene against the decompiles (2026-08-30) + +Every shipped pattern's distinctive phrase was checked in the IME decompiles 1.97.107.0, +1.104.102.0 and 1.105.103.0 (`ime-decompiles` repo): no wording changed in any of them. The 11 +disabled legacy patterns whose literals last existed in IME 1.50 (fleet minimum 1.97) were +deleted rather than left as re-enable traps; `IME-DO-TIMEOUT-1/2` now match the exact source +literal (`[Win32App DO] DO downloading is not finished within timeout, jobId = …, fileId = …`) +instead of two lookaheads; `IME-DO-TEL` has no emitter from 1.104 on and stays only while +1.101/1.103 devices are in the fleet (`get_ime_version_history`). + # Verification * `ImeLogPatternPackLinearityTests` loads the shipped pack, asserts the `^` invariant, runs four diff --git a/docs/log.md b/docs/log.md index f5d84f8b..3102ba70 100644 --- a/docs/log.md +++ b/docs/log.md @@ -1,5 +1,9 @@ # Log +## 2026-08-30 (8) + +* **Update**: `agent/ime-log-tracker-matching-budget.md` — pattern-pack hygiene against the IME decompiles (1.97.107.0 / 1.104.102.0 / 1.105.103.0, spot checks 1.50 / 1.83): no wording drift in any shipped pattern; the 11 disabled legacy patterns (IME-DETECTED-OLD, IME-SET-CURRENT-1/2/3, IME-SKIP-APPLICABILITY-NOTMET, IME-SKIP-DEPENDENCY-DETECT, IME-SKIP-DETECTED, IME-SKIP-UNINSTALL-NOTDETECTED-2, IME-UPDATE-NAME-1/2/3) are deleted — their literals last existed in IME 1.50, the fleet starts at 1.97; IME-DO-TIMEOUT-1/2 match the exact source literal (`DO downloading is not finished within timeout, jobId = …, fileId = …`) instead of two lookaheads; IME-DO-TEL is documented as dead from 1.104 on and kept only for the 1.101/1.103 fleet share. + ## 2026-08-30 (7) * **New**: `agent/ime-log-tracker-matching-budget.md` — the shipped IME pattern pack is anchored (`^` on all 90 patterns, `IME-APP-VERSION` without the chained `[^}]*?` scan) and the tracker's read loop is bounded: `BoundedLineReader` (32 MB per line, exact byte bookmarks), 2 s per-line matching budget, held-back unterminated EOF tails with a 1 s settle, one Warning per pass (`oversizedLines` / `regexTimeouts` / `lineBudgetBreaks`); the unanchored `PS-SCRIPT-CONTEXT` false positives on `[Win32App] SideCarScript…` lines are gone. `--run-ime-matching` assembles multiline entries like the tracker. Registered in `index.md`. diff --git a/rules/dist/ime-log-patterns.json b/rules/dist/ime-log-patterns.json index 1d5e7564..e7578a93 100644 --- a/rules/dist/ime-log-patterns.json +++ b/rules/dist/ime-log-patterns.json @@ -182,14 +182,6 @@ "description": "Detects when an app's detection action handler reports successful detection (app is installed).", "enabled": true }, - { - "patternId": "IME-DETECTED-OLD", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] Detected app {GUID} ", - "action": "updateStateInstalled", - "description": "Detects when an app is detected as installed (old log format). DISABLED 2026-08-17: the standalone 'Detected app ' line no longer exists in IME 1.97.107; this regex instead matched the 'Detected app ... and intent is to install, skip applicability check' line, colliding with IME-SKIP-INSTALL-DETECTED and firing updateStateInstalled and updateStateSkipped on the same physical line (see tasks/ime-v1-code-audit-2026-08-17.md).", - "enabled": false - }, { "patternId": "IME-DETECTION-RESULT", "category": "always", @@ -203,21 +195,21 @@ "category": "currentPhase", "pattern": "^\\[DO TEL\\] = (?\\{.*\\})", "action": "updateDoTelemetry", - "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.", + "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent in 1.104.102.0 and 1.105.103.0 decompiles, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.", "enabled": true }, { "patternId": "IME-DO-TIMEOUT-1", "category": "currentPhase", - "pattern": "^\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}", + "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout, jobId = [^,]{0,64}, fileId =.*?intunewin-bin_{GUID}", "action": "updateStatePostponed", - "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).", + "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in the DO fileId). Source literal (ContentDownloaderDeliveryOptimization, identical IME 1.97-1.105): \"[Win32App DO] DO downloading is not finished within timeout, jobId = {0}, fileId = {1}\".", "enabled": true }, { "patternId": "IME-DO-TIMEOUT-2", "category": "currentPhase", - "pattern": "^\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)", + "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout", "action": "updateStatePostponed", "parameters": { "useCurrentApp": "true" @@ -495,30 +487,6 @@ "description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.", "enabled": true }, - { - "patternId": "IME-SET-CURRENT-1", - "category": "always", - "pattern": "^\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name", - "action": "setCurrentApp", - "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, - { - "patternId": "IME-SET-CURRENT-2", - "category": "always", - "pattern": "^\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}", - "action": "setCurrentApp", - "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, - { - "patternId": "IME-SET-CURRENT-3", - "category": "always", - "pattern": "^\\[Win32App\\] ===Step=== Start to Present app {GUID}", - "action": "setCurrentApp", - "description": "Detects the start of app presentation step in IME, setting the app as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, { "patternId": "IME-SET-CURRENT-4", "category": "always", @@ -538,30 +506,6 @@ "description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.", "enabled": true }, - { - "patternId": "IME-SKIP-APPLICABILITY-NOTMET", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b", - "action": "updateStateSkipped", - "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, - { - "patternId": "IME-SKIP-DEPENDENCY-DETECT", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing", - "action": "updateStateSkipped", - "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, - { - "patternId": "IME-SKIP-DETECTED", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] Detected app {GUID}.*?skip next step", - "action": "updateStateSkipped", - "description": "Detects when an already-detected app is skipped for further processing steps (old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, { "patternId": "IME-SKIP-FILTERS", "category": "currentPhase", @@ -589,14 +533,6 @@ "description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).", "enabled": true }, - { - "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation", - "action": "updateStateSkipped", - "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, { "patternId": "IME-STARTED", "category": "always", @@ -643,30 +579,6 @@ "description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.", "enabled": true }, - { - "patternId": "IME-UPDATE-NAME-1", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?.*?)\\W+id\\W+{GUID}", - "action": "updateName", - "description": "Captures the app name from ExecManager processing log (old format: name before id). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, - { - "patternId": "IME-UPDATE-NAME-2", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?.*?)$", - "action": "updateName", - "description": "Captures the app name from ProcessAppWithDependencies log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, - { - "patternId": "IME-UPDATE-NAME-3", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] Processing app \\(id={GUID}, name = (?.*?)\\)", - "action": "updateName", - "description": "Captures the app name from the Processing app log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false - }, { "patternId": "IME-USER-SESSION-COMPLETED", "category": "always", diff --git a/rules/ime-log-patterns/IME-DETECTED-OLD.json b/rules/ime-log-patterns/IME-DETECTED-OLD.json deleted file mode 100644 index 306d56d4..00000000 --- a/rules/ime-log-patterns/IME-DETECTED-OLD.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-DETECTED-OLD", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] Detected app {GUID} ", - "action": "updateStateInstalled", - "description": "Detects when an app is detected as installed (old log format). DISABLED 2026-08-17: the standalone 'Detected app ' line no longer exists in IME 1.97.107; this regex instead matched the 'Detected app ... and intent is to install, skip applicability check' line, colliding with IME-SKIP-INSTALL-DETECTED and firing updateStateInstalled and updateStateSkipped on the same physical line (see tasks/ime-v1-code-audit-2026-08-17.md).", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-DO-TEL.json b/rules/ime-log-patterns/IME-DO-TEL.json index 0f8d70c7..172b880f 100644 --- a/rules/ime-log-patterns/IME-DO-TEL.json +++ b/rules/ime-log-patterns/IME-DO-TEL.json @@ -4,6 +4,6 @@ "category": "currentPhase", "pattern": "^\\[DO TEL\\] = (?\\{.*\\})", "action": "updateDoTelemetry", - "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.", + "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent in 1.104.102.0 and 1.105.103.0 decompiles, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.", "enabled": true } diff --git a/rules/ime-log-patterns/IME-DO-TIMEOUT-1.json b/rules/ime-log-patterns/IME-DO-TIMEOUT-1.json index 83dd916b..13ecdb68 100644 --- a/rules/ime-log-patterns/IME-DO-TIMEOUT-1.json +++ b/rules/ime-log-patterns/IME-DO-TIMEOUT-1.json @@ -2,8 +2,8 @@ "$schema": "../schema/ime-log-pattern.schema.json", "patternId": "IME-DO-TIMEOUT-1", "category": "currentPhase", - "pattern": "^\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}", + "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout, jobId = [^,]{0,64}, fileId =.*?intunewin-bin_{GUID}", "action": "updateStatePostponed", - "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).", + "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in the DO fileId). Source literal (ContentDownloaderDeliveryOptimization, identical IME 1.97-1.105): \"[Win32App DO] DO downloading is not finished within timeout, jobId = {0}, fileId = {1}\".", "enabled": true } diff --git a/rules/ime-log-patterns/IME-DO-TIMEOUT-2.json b/rules/ime-log-patterns/IME-DO-TIMEOUT-2.json index 81a90728..e812ea75 100644 --- a/rules/ime-log-patterns/IME-DO-TIMEOUT-2.json +++ b/rules/ime-log-patterns/IME-DO-TIMEOUT-2.json @@ -2,7 +2,7 @@ "$schema": "../schema/ime-log-pattern.schema.json", "patternId": "IME-DO-TIMEOUT-2", "category": "currentPhase", - "pattern": "^\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)", + "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout", "action": "updateStatePostponed", "parameters": { "useCurrentApp": "true" }, "description": "Detects when a Delivery Optimization download times out (generic, uses current app context).", diff --git a/rules/ime-log-patterns/IME-SET-CURRENT-1.json b/rules/ime-log-patterns/IME-SET-CURRENT-1.json deleted file mode 100644 index a4c848c0..00000000 --- a/rules/ime-log-patterns/IME-SET-CURRENT-1.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-SET-CURRENT-1", - "category": "always", - "pattern": "^\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name", - "action": "setCurrentApp", - "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-SET-CURRENT-2.json b/rules/ime-log-patterns/IME-SET-CURRENT-2.json deleted file mode 100644 index 783ce21d..00000000 --- a/rules/ime-log-patterns/IME-SET-CURRENT-2.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-SET-CURRENT-2", - "category": "always", - "pattern": "^\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}", - "action": "setCurrentApp", - "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-SET-CURRENT-3.json b/rules/ime-log-patterns/IME-SET-CURRENT-3.json deleted file mode 100644 index 631629f5..00000000 --- a/rules/ime-log-patterns/IME-SET-CURRENT-3.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-SET-CURRENT-3", - "category": "always", - "pattern": "^\\[Win32App\\] ===Step=== Start to Present app {GUID}", - "action": "setCurrentApp", - "description": "Detects the start of app presentation step in IME, setting the app as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-SKIP-APPLICABILITY-NOTMET.json b/rules/ime-log-patterns/IME-SKIP-APPLICABILITY-NOTMET.json deleted file mode 100644 index 79436233..00000000 --- a/rules/ime-log-patterns/IME-SKIP-APPLICABILITY-NOTMET.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-SKIP-APPLICABILITY-NOTMET", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b", - "action": "updateStateSkipped", - "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-SKIP-DEPENDENCY-DETECT.json b/rules/ime-log-patterns/IME-SKIP-DEPENDENCY-DETECT.json deleted file mode 100644 index 4ab4cc9c..00000000 --- a/rules/ime-log-patterns/IME-SKIP-DEPENDENCY-DETECT.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-SKIP-DEPENDENCY-DETECT", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing", - "action": "updateStateSkipped", - "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-SKIP-DETECTED.json b/rules/ime-log-patterns/IME-SKIP-DETECTED.json deleted file mode 100644 index fd603fb3..00000000 --- a/rules/ime-log-patterns/IME-SKIP-DETECTED.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-SKIP-DETECTED", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] Detected app {GUID}.*?skip next step", - "action": "updateStateSkipped", - "description": "Detects when an already-detected app is skipped for further processing steps (old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-SKIP-UNINSTALL-NOTDETECTED-2.json b/rules/ime-log-patterns/IME-SKIP-UNINSTALL-NOTDETECTED-2.json deleted file mode 100644 index bc572871..00000000 --- a/rules/ime-log-patterns/IME-SKIP-UNINSTALL-NOTDETECTED-2.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation", - "action": "updateStateSkipped", - "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-UPDATE-NAME-1.json b/rules/ime-log-patterns/IME-UPDATE-NAME-1.json deleted file mode 100644 index 284c8c3b..00000000 --- a/rules/ime-log-patterns/IME-UPDATE-NAME-1.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-UPDATE-NAME-1", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?.*?)\\W+id\\W+{GUID}", - "action": "updateName", - "description": "Captures the app name from ExecManager processing log (old format: name before id). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-UPDATE-NAME-2.json b/rules/ime-log-patterns/IME-UPDATE-NAME-2.json deleted file mode 100644 index 7294ed4d..00000000 --- a/rules/ime-log-patterns/IME-UPDATE-NAME-2.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-UPDATE-NAME-2", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?.*?)$", - "action": "updateName", - "description": "Captures the app name from ProcessAppWithDependencies log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/rules/ime-log-patterns/IME-UPDATE-NAME-3.json b/rules/ime-log-patterns/IME-UPDATE-NAME-3.json deleted file mode 100644 index c8beebdc..00000000 --- a/rules/ime-log-patterns/IME-UPDATE-NAME-3.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "../schema/ime-log-pattern.schema.json", - "patternId": "IME-UPDATE-NAME-3", - "category": "currentPhase", - "pattern": "^\\[Win32App\\] Processing app \\(id={GUID}, name = (?.*?)\\)", - "action": "updateName", - "description": "Captures the app name from the Processing app log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.", - "enabled": false -} diff --git a/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs b/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs index 784f9053..3755a5c6 100644 --- a/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs +++ b/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs @@ -58,7 +58,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime Assert.False(string.IsNullOrEmpty(p.Pattern), $"{file}: pattern missing"); list.Add(p); } - Assert.True(list.Count >= 80, $"expected the full pack, found {list.Count}"); + Assert.True(list.Count >= 75, $"expected the full pack, found {list.Count}"); return list; } @@ -329,12 +329,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime "Launch powershell executor in machine session", new[] { "context=machine" } }; + // Wording from the IME decompile (ContentDownloaderDeliveryOptimization, identical 1.97–1.105). yield return new object[] { "IME-DO-TIMEOUT-2", - "[Win32App DO] DO download is not finished after 600 seconds, timeout", + "[Win32App DO] DO downloading is not finished within timeout, jobId = 1b2c3d4e-0000-0000-0000-000000000000, fileId = intunewin-bin_" + Guid1, new string[0] }; + yield return new object[] + { + "IME-DO-TIMEOUT-1", + "[Win32App DO] DO downloading is not finished within timeout, jobId = 1b2c3d4e-0000-0000-0000-000000000000, fileId = intunewin-bin_" + Guid1, + new[] { "id=" + Guid1 } + }; } [Theory]