From 430d983f65d702c171f454cd6663df7e478f68a6 Mon Sep 17 00:00:00 2001
From: Suzumiya <suzmii@qq.com>
Date: Tue, 6 Oct 2026 00:04:10 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E5=8E=9F=E7=94=9F=E5=A3=B3?=
 =?UTF-8?q?=E9=A2=84=E8=A7=88=E8=BE=B9=E7=95=8C=E5=AE=88=E5=8D=AB=E4=BB=A5?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=97=E5=88=B7=E6=96=B0=E9=87=8D=E8=BD=BD=E5=8F=98?=
 =?UTF-8?q?=E9=87=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 预览框 src 断言改为两种形态都接受：旧的 `src={embeddedUrl}`，或 `src={iframeUrl ?? undefined}`
- 新形态额外要求 `iframeUrl` 由 `useMemo` 定义、且定义体内引用 `embeddedUrl`（只改名不算通过）
- 其余断言（`resolveEmbeddedPreviewUrl(` / loopback 校验 / sandbox / 单 iframe 与单挂载）原样保留
- 背景：14283db94 为「刷新运行画面」引入 iframeUrl，撞红了 Native shell tests 的
  Run native shell contract gates（missing src={embeddedUrl}）；只接受新形态会让 master 反过来红
---
 scripts/check-native-shells.mjs | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/scripts/check-native-shells.mjs b/scripts/check-native-shells.mjs
index 84e7c5125..909290925 100644
--- a/scripts/check-native-shells.mjs
+++ b/scripts/check-native-shells.mjs
@@ -2642,7 +2642,6 @@ function assertAiGameCreatorShellUserDevBoundary() {
     'function resolveEmbeddedPreviewUrl(',
     "url.protocol !== 'http:' || url.hostname !== '127.0.0.1'",
     'sandbox="allow-scripts allow-same-origin allow-forms allow-pointer-lock"',
-    'src={embeddedUrl}',
   ]) {
     if (
       !sourceIncludesSnippet(aiGameCreatorLocalGamePreviewFrameSource, snippet)
@@ -2652,6 +2651,29 @@ function assertAiGameCreatorShellUserDevBoundary() {
       );
     }
   }
+  // 预览框的 `src` 允许经一个短变量中转（刷新时要在地址上叠加 `__agc_reload` 这类非业务参数），
+  // 但这个变量必须由被校验过的 `embeddedUrl` 派生：只换名字、丢掉派生关系仍按漂移处理。
+  const iframeUrlDerivation = aiGameCreatorLocalGamePreviewFrameSource.match(
+    /const\s+iframeUrl\s*=\s*useMemo\(\s*\(\s*\)\s*=>\s*\{[\s\S]*?\}\s*,\s*\[/,
+  );
+  if (
+    !sourceIncludesSnippet(
+      aiGameCreatorLocalGamePreviewFrameSource,
+      'src={embeddedUrl}',
+    ) &&
+    !(
+      sourceIncludesSnippet(
+        aiGameCreatorLocalGamePreviewFrameSource,
+        'src={iframeUrl ?? undefined}',
+      ) &&
+      iframeUrlDerivation !== null &&
+      iframeUrlDerivation[0].includes('embeddedUrl')
+    )
+  ) {
+    throw new Error(
+      'AI game creator embedded preview boundary drifted: iframe src must derive from the validated embeddedUrl',
+    );
+  }
   for (const snippet of [
     "await invoke<LocalPreviewStatus>(\n        'activate_local_game_preview'",
     '已载入客户端运行视图',