锁定桌面壳生成权限不入库

新增桌面壳配置检查拒绝跟踪 Tauri 生成文件

防止自动生成权限扩大桌面 HostBridge 暴露面

apps/desktop-shell/scripts/check-config.mjs

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
 
 const configPath = new URL('../src-tauri/tauri.conf.json', import.meta.url);
 const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
@@ -1414,6 +1415,38 @@ function assertGeneratedPermissions(commandNames) {
   }
 }
 
+function assertNoTrackedDesktopGeneratedTauriFiles() {
+  const generatedPaths = [
+    'apps/desktop-shell/src-tauri/gen',
+    'apps/desktop-shell/src-tauri/permissions/autogenerated',
+  ];
+  const result = spawnSync('git', ['ls-files', ...generatedPaths], {
+    cwd: new URL('../../..', import.meta.url),
+    encoding: 'utf8',
+  });
+
+  if (result.error) {
+    throw new Error(
+      `unable to check desktop generated Tauri files: ${result.error.message}`,
+    );
+  }
+  if ((result.status ?? 0) !== 0) {
+    throw new Error(
+      `unable to check desktop generated Tauri files: ${result.stderr.trim()}`,
+    );
+  }
+
+  const trackedGeneratedFiles = result.stdout
+    .split('\n')
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  if (trackedGeneratedFiles.length > 0) {
+    throw new Error(
+      `desktop generated Tauri files must stay untracked: ${trackedGeneratedFiles.join(', ')}`,
+    );
+  }
+}
+
 function assertOnlyMainCapabilityFile() {
   const capabilityDir = new URL('../src-tauri/capabilities/', import.meta.url);
   const files = fs
@@ -3085,6 +3118,7 @@ assertSameList(
   'desktop shell invoke handler commands',
 );
 assertGeneratedPermissions(allowedTauriCommands);
+assertNoTrackedDesktopGeneratedTauriFiles();
 
 if (buildScript.includes('resolve_desktop_shell_runtime')) {
   throw new Error('desktop shell build manifest exposes an unused runtime command');