From 037ee24042ae05be7a59d6176aedeaa6d3d3f0af Mon Sep 17 00:00:00 2001
From: kdletters <kdletters@qq.com>
Date: Sat, 20 Jun 2026 22:16:31 +0800
Subject: [PATCH] =?UTF-8?q?=E9=94=81=E5=AE=9A=E6=A1=8C=E9=9D=A2=E5=A3=B3?=
 =?UTF-8?q?=E7=94=9F=E6=88=90=E6=9D=83=E9=99=90=E4=B8=8D=E5=85=A5=E5=BA=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

新增桌面壳配置检查拒绝跟踪 Tauri 生成文件

防止自动生成权限扩大桌面 HostBridge 暴露面
---
 apps/desktop-shell/scripts/check-config.mjs | 34 +++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/apps/desktop-shell/scripts/check-config.mjs b/apps/desktop-shell/scripts/check-config.mjs
index 265965a33..b1368e294 100644
--- a/apps/desktop-shell/scripts/check-config.mjs
+++ b/apps/desktop-shell/scripts/check-config.mjs
@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
 
 const configPath = new URL('../src-tauri/tauri.conf.json', import.meta.url);
 const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
@@ -1414,6 +1415,38 @@ function assertGeneratedPermissions(commandNames) {
   }
 }
 
+function assertNoTrackedDesktopGeneratedTauriFiles() {
+  const generatedPaths = [
+    'apps/desktop-shell/src-tauri/gen',
+    'apps/desktop-shell/src-tauri/permissions/autogenerated',
+  ];
+  const result = spawnSync('git', ['ls-files', ...generatedPaths], {
+    cwd: new URL('../../..', import.meta.url),
+    encoding: 'utf8',
+  });
+
+  if (result.error) {
+    throw new Error(
+      `unable to check desktop generated Tauri files: ${result.error.message}`,
+    );
+  }
+  if ((result.status ?? 0) !== 0) {
+    throw new Error(
+      `unable to check desktop generated Tauri files: ${result.stderr.trim()}`,
+    );
+  }
+
+  const trackedGeneratedFiles = result.stdout
+    .split('\n')
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  if (trackedGeneratedFiles.length > 0) {
+    throw new Error(
+      `desktop generated Tauri files must stay untracked: ${trackedGeneratedFiles.join(', ')}`,
+    );
+  }
+}
+
 function assertOnlyMainCapabilityFile() {
   const capabilityDir = new URL('../src-tauri/capabilities/', import.meta.url);
   const files = fs
@@ -3085,6 +3118,7 @@ assertSameList(
   'desktop shell invoke handler commands',
 );
 assertGeneratedPermissions(allowedTauriCommands);
+assertNoTrackedDesktopGeneratedTauriFiles();
 
 if (buildScript.includes('resolve_desktop_shell_runtime')) {
   throw new Error('desktop shell build manifest exposes an unused runtime command');