Merge branch 'master' into fix/typecheck-test

2026-10-03 18:41:28 +08:00
parent 2922b94594 8aee5db84e
commit 88abe52c3d
186 changed files with 10116 additions and 610 deletions
@@ -49,6 +49,7 @@ import type {
  AdminLoginResponse,
  AdminMeResponse,
  AdminOverviewResponse,
+  AdminPaymentOrderListResponse,
  AdminProjectSnapshotChannelsResponse,
  AdminProjectSnapshotListQuery,
  AdminProjectSnapshotListResponse,
@@ -801,6 +802,12 @@ export function listAdminRechargeOrders(
  );
 }

+export function listAdminPaymentOrders(token: string) {
+  return request<AdminPaymentOrderListResponse>('/admin/api/payment/orders', {
+    token,
+  });
+}
+
 export function getAdminUserDetail(token: string, query: AdminUserDetailQuery) {
  return request<AdminUserDetailResponse>(
    `/admin/api/profile/users/detail${buildAdminUserDetailQuery(query)}`,
@@ -1054,6 +1054,39 @@ export interface AdminWechatPaymentCheckPayload {
  knownRefundsRefreshed: number;
 }

+export interface AdminPaymentOrderEntry {
+  orderId: string;
+  appId: string;
+  ownerUserId: string;
+  merchantOrderId: string;
+  title: string;
+  amountCents: number;
+  currency: string;
+  provider: string;
+  providerTradeNo: string | null;
+  status: string;
+  createdAt: string;
+  expiresAt: string;
+  paidAt: string | null;
+}
+
+export interface AdminPaymentOrderListResponse {
+  entries: AdminPaymentOrderEntry[];
+  webhooks: AdminPaymentWebhookEntry[];
+}
+
+export interface AdminPaymentWebhookEntry {
+  deliveryId: string;
+  orderId: string;
+  appId: string;
+  callbackUrl: string;
+  status: string;
+  attemptCount: number;
+  availableAt: string;
+  lastErrorMessage: string | null;
+  updatedAt: string;
+}
+
 export interface AdminRechargeRefundPreviewResponse {
  order: AdminRechargeOrderEntryPayload;
  paymentCheck: AdminWechatPaymentCheckPayload;
@@ -36,6 +36,7 @@ import { AdminGrayReleaseConfigPage } from '../pages/AdminGrayReleaseConfigPage'
 import { AdminInviteCodePage } from '../pages/AdminInviteCodePage';
 import { AdminLoginPage } from '../pages/AdminLoginPage';
 import { AdminOverviewPage } from '../pages/AdminOverviewPage';
+import { AdminPaymentOrderPage } from '../pages/AdminPaymentOrderPage';
 import { AdminProfileWalletConfigPage } from '../pages/AdminProfileWalletConfigPage';
 import { AdminProjectSnapshotsPage } from '../pages/AdminProjectSnapshotsPage';
 import { AdminRechargeOrderPage } from '../pages/AdminRechargeOrderPage';
@@ -297,6 +298,12 @@ export function AdminApp() {
          onUnauthorized={handleUnauthorized}
        />
      ) : null}
+      {activeRouteId === 'payment-orders' ? (
+        <AdminPaymentOrderPage
+          token={token}
+          onUnauthorized={handleUnauthorized}
+        />
+      ) : null}
      {activeRouteId === 'editor-generation-pricing' ? (
        <AdminEditorGenerationPricingPage
          token={token}
@@ -51,6 +51,7 @@ const routeIcons = {
  tasks: ListChecks,
  'recharge-products': BadgeDollarSign,
  'recharge-orders': ReceiptText,
+  'payment-orders': ReceiptText,
  'editor-generation-pricing': Coins,
  'editor-showcase': Star,
  'game-distribution': Gamepad2,
@@ -14,6 +14,7 @@ export type AdminRouteId =
  | 'tasks'
  | 'recharge-products'
  | 'recharge-orders'
+  | 'payment-orders'
  | 'editor-generation-pricing'
  | 'editor-showcase'
  | 'game-distribution'
@@ -53,6 +54,7 @@ export const adminRoutes: AdminRouteDefinition[] = [
  { id: 'tasks', label: '任务配置', hash: '#tasks' },
  { id: 'recharge-products', label: '充值商品', hash: '#recharge-products' },
  { id: 'recharge-orders', label: '充值管理', hash: '#recharge-orders' },
+  { id: 'payment-orders', label: '支付订单', hash: '#payment-orders' },
  {
    id: 'editor-generation-pricing',
    label: '模型定价',
@@ -0,0 +1,198 @@
+import {
+  AdminEmptyState,
+  AdminListPanel,
+  AdminPage,
+  AdminPageHeading,
+  AdminStatusPill,
+} from '@genarrative/shared/components';
+import { useCallback, useEffect, useState } from 'react';
+
+import {
+  formatAdminApiError,
+  listAdminPaymentOrders,
+} from '../api/adminApiClient';
+import type {
+  AdminPaymentOrderEntry,
+  AdminPaymentWebhookEntry,
+} from '../api/adminApiTypes';
+import { handlePageError } from './pageUtils';
+
+type AdminPaymentOrderPageProps = {
+  token: string;
+  onUnauthorized: (message?: string) => void;
+};
+
+function statusTone(status: string): 'ok' | 'pending' | 'error' {
+  if (status === 'paid') return 'ok';
+  if (status === 'closed' || status === 'expired') return 'error';
+  return 'pending';
+}
+
+export function AdminPaymentOrderPage({
+  token,
+  onUnauthorized,
+}: AdminPaymentOrderPageProps) {
+  const [entries, setEntries] = useState<AdminPaymentOrderEntry[]>([]);
+  const [webhooks, setWebhooks] = useState<AdminPaymentWebhookEntry[]>([]);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState('');
+
+  const load = useCallback(() => {
+    setIsLoading(true);
+    setError('');
+    void listAdminPaymentOrders(token)
+      .then((response) => {
+        setEntries(response.entries ?? []);
+        setWebhooks(response.webhooks ?? []);
+      })
+      .catch((nextError: unknown) => {
+        handlePageError(nextError, onUnauthorized, (message) =>
+          setError(message || formatAdminApiError(nextError)),
+        );
+      })
+      .finally(() => setIsLoading(false));
+  }, [onUnauthorized, token]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  return (
+    <AdminPage wide>
+      <AdminPageHeading
+        title="支付订单"
+        description="平台统一收款的外部产品订单与到账状态。"
+        actions={
+          <button
+            className="admin-button admin-button--secondary"
+            type="button"
+            onClick={load}
+          >
+            刷新
+          </button>
+        }
+      />
+      <AdminListPanel
+        title="外部回调投递"
+        count={`${webhooks.length} 条`}
+        busy={isLoading}
+        emptyText={<AdminEmptyState>暂无外部回调记录。</AdminEmptyState>}
+        columns={[
+          {
+            key: 'delivery',
+            label: '投递',
+            render: (entry) => (
+              <>
+                <strong>{entry.deliveryId}</strong>
+                <small className="admin-muted-block">{entry.orderId}</small>
+              </>
+            ),
+          },
+          { key: 'app', label: '应用', render: (entry) => entry.appId },
+          {
+            key: 'callback',
+            label: '回调地址',
+            render: (entry) => entry.callbackUrl,
+          },
+          {
+            key: 'status',
+            label: '状态',
+            render: (entry) => (
+              <AdminStatusPill
+                tone={
+                  entry.status === 'delivered'
+                    ? 'ok'
+                    : entry.status === 'failed'
+                      ? 'error'
+                      : 'pending'
+                }
+              >
+                {entry.status}
+              </AdminStatusPill>
+            ),
+          },
+          {
+            key: 'attempts',
+            label: '尝试次数',
+            render: (entry) => entry.attemptCount,
+          },
+          {
+            key: 'error',
+            label: '最近错误',
+            render: (entry) => entry.lastErrorMessage ?? '-',
+          },
+          {
+            key: 'updated',
+            label: '更新时间',
+            render: (entry) => entry.updatedAt,
+          },
+        ]}
+        rows={webhooks}
+        rowKey={(entry) => entry.deliveryId}
+      />
+      {error ? (
+        <div className="admin-alert admin-alert--error">{error}</div>
+      ) : null}
+      <AdminListPanel
+        title="订单记录"
+        count={`${entries.length} 条`}
+        busy={isLoading}
+        emptyText={
+          <AdminEmptyState>
+            暂无支付订单，外部产品创建订单后会显示在这里。
+          </AdminEmptyState>
+        }
+        columns={[
+          {
+            key: 'order',
+            label: '订单',
+            render: (entry) => (
+              <>
+                <strong>{entry.merchantOrderId}</strong>
+                <small className="admin-muted-block">{entry.orderId}</small>
+              </>
+            ),
+          },
+          {
+            key: 'app',
+            label: '应用',
+            render: (entry) => (
+              <>
+                <strong>{entry.title}</strong>
+                <small className="admin-muted-block">{entry.appId}</small>
+              </>
+            ),
+          },
+          {
+            key: 'amount',
+            label: '金额',
+            render: (entry) =>
+              `${entry.currency} ${(entry.amountCents / 100).toFixed(2)}`,
+          },
+          { key: 'provider', label: '渠道', render: (entry) => entry.provider },
+          {
+            key: 'status',
+            label: '状态',
+            render: (entry) => (
+              <AdminStatusPill tone={statusTone(entry.status)}>
+                {entry.status}
+              </AdminStatusPill>
+            ),
+          },
+          {
+            key: 'created',
+            label: '创建时间',
+            render: (entry) => entry.createdAt,
+          },
+          {
+            key: 'paid',
+            label: '支付时间',
+            render: (entry) => entry.paidAt ?? '-',
+          },
+        ]}
+        rows={entries}
+        rowKey={(entry) => entry.orderId}
+      />
+    </AdminPage>
+  );
+}
@@ -86,7 +86,7 @@ maud = "0.27.0"
 libc = "0.2"

 [target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.61", features = ["Wdk_Storage_FileSystem", "Win32_Foundation", "Win32_Storage_FileSystem", "Win32_System_Diagnostics_ToolHelp", "Win32_System_IO", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_WindowsAndMessaging"] }
+windows-sys = { version = "0.61", features = ["Wdk_Storage_FileSystem", "Win32_Foundation", "Win32_Storage_FileSystem", "Win32_System_Diagnostics_ToolHelp", "Win32_System_IO", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }

 [profile.dev]
 opt-level = 0
@@ -43,9 +43,9 @@ pub mod tool;
 pub(crate) use art_manifest::*;
 use claude_code_cli::*;
 pub(crate) use claude_code_cli::{
-    cancel_direct_claude_code_turn_at, direct_game_creator_claude_code_chat_at,
-    direct_game_creator_claude_code_home_chat, game_creator_claude_code_cli_route_error,
-    game_creator_claude_code_cli_version_identity,
+    cancel_direct_claude_code_turn_at, claude_code_failure_to_llm_error,
+    direct_game_creator_claude_code_chat_at, direct_game_creator_claude_code_home_chat,
+    game_creator_claude_code_cli_route_error, game_creator_claude_code_cli_version_identity,
 };
 pub(crate) use codex_app_server::direct_game_creator_codex_chat_at;
 pub(crate) use codex_app_server::turn_error::*;
@@ -747,6 +747,46 @@ fn parse_usage(value: &serde_json::Value) -> Option<platform_llm::LlmTokenUsage>
    })
 }

+/// 把 Claude Code/sidecar 的字符串失败投影到与 Codex app-server 相同的 LlmError 分类。
+///
+/// DirectProject 不能把上游 HTTP 错误统统包装成 Transport：那会把 429、401、5xx 等可识别
+/// 的上游事实显示成“执行通道已断开”。这里只认结构化的状态位置（`Request rejected (N)` /
+/// `HTTP N`），其它文本继续保留为 Transport，避免凭关键词猜测。
+pub(crate) fn claude_code_failure_to_llm_error(detail: String) -> platform_llm::LlmError {
+    if let Some(status_code) = claude_code_failure_status_code(&detail) {
+        return platform_llm::LlmError::Upstream {
+            status_code,
+            message: detail,
+        };
+    }
+    if detail.contains("Claude Agent SDK sidecar 回合超时") {
+        return platform_llm::LlmError::Timeout { attempts: 1 };
+    }
+    if detail.contains("Claude Code 缺少最终回复") {
+        return platform_llm::LlmError::EmptyResponse;
+    }
+    if detail.contains("sidecar 输出不是有效 JSON") || detail.contains("stream-json 包含无效 JSON")
+    {
+        return platform_llm::LlmError::Deserialize(detail);
+    }
+    platform_llm::LlmError::Transport(detail)
+}
+
+fn claude_code_failure_status_code(detail: &str) -> Option<u16> {
+    ["Request rejected (", "HTTP "].iter().find_map(|marker| {
+        let tail = detail.split_once(marker)?.1;
+        let digits = tail
+            .chars()
+            .take_while(|character| character.is_ascii_digit())
+            .collect::<String>();
+        if digits.len() != 3 {
+            return None;
+        }
+        let status_code = digits.parse::<u16>().ok()?;
+        (100..=599).contains(&status_code).then_some(status_code)
+    })
+}
+
 fn parse_claude_code_result(
    stdout: &[u8],
    request: &LlmRunRequest,
@@ -758,7 +798,7 @@ fn parse_claude_code_result(
        let detail = claude_result_error_detail(&value)
            .map(|detail| format!("：{detail}"))
            .unwrap_or_default();
-        return Err(platform_llm::LlmError::Transport(format!(
+        return Err(claude_code_failure_to_llm_error(format!(
            "Claude Code 返回失败终态{detail}"
        )));
    }
@@ -1156,6 +1196,29 @@ mod tests {
        assert!(error.to_string().contains("Authentication failed"));
    }

+    #[test]
+    fn claude_failure_reuses_codex_error_categories() {
+        assert!(matches!(
+            claude_code_failure_to_llm_error(
+                "Claude Code 返回失败终态：API Error: Request rejected (429)".into()
+            ),
+            platform_llm::LlmError::Upstream {
+                status_code: 429,
+                ..
+            }
+        ));
+        assert!(matches!(
+            claude_code_failure_to_llm_error(
+                "Claude Agent SDK sidecar 回合超时：连续 180000 ms 没有任何事件".into()
+            ),
+            platform_llm::LlmError::Timeout { attempts: 1 }
+        ));
+        assert!(matches!(
+            claude_code_failure_to_llm_error("Claude Code 缺少最终回复".into()),
+            platform_llm::LlmError::EmptyResponse
+        ));
+    }
+
    #[test]
    fn parses_direct_stream_result_and_final_text() {
        let mut observed = Vec::new();
@@ -5300,7 +5300,9 @@ pub(crate) async fn direct_game_creator_codex_chat_at_with_optional_observer(
            observer,
        )
        .await
-        .map_err(|detail| TurnError::from_model_call(&platform_llm::LlmError::Transport(detail)));
+        .map_err(|detail| {
+            TurnError::from_model_call(&crate::agent::claude_code_failure_to_llm_error(detail))
+        });
    }
    game_creator_codex_app_server_validate_llm_config(&config.llm).map_err(|error| {
        TurnError::EnvironmentNotReady(EnvironmentNotReady {
@@ -304,7 +304,7 @@ impl ModelCallKind {
                native,
            } => match native {
                Some(native) => native.is_retryable(),
-                None => *status_code >= 500,
+                None => matches!(*status_code, 401 | 408 | 429 | 500..=599),
            },
            Self::PaidCreditsInsufficient => false,
            Self::EmptyResponse => false,
@@ -322,9 +322,16 @@ impl ModelCallKind {
            }
            Self::EmptyResponse => Some("模型未返回内容"),
            Self::PayloadInvalid { .. } => Some("模型回执无法解析"),
-            Self::RequestRejected { native } | Self::UpstreamFailed { native, .. } => {
+            Self::RequestRejected { native } => {
                native.as_ref().and_then(NativeKind::public_summary)
            }
+            Self::UpstreamFailed {
+                status_code,
+                native,
+            } => native
+                .as_ref()
+                .and_then(NativeKind::public_summary)
+                .or_else(|| upstream_status_summary(*status_code)),
        }
    }

@@ -341,13 +348,40 @@ impl ModelCallKind {
            Self::EmptyResponse | Self::PayloadInvalid { .. } => {
                Some("模型未给出可用的回执，请重试；如持续失败请检查项目诊断")
            }
-            Self::RequestRejected { native } | Self::UpstreamFailed { native, .. } => {
-                native.as_ref().and_then(NativeKind::recovery_hint)
-            }
+            Self::RequestRejected { native } => native.as_ref().and_then(NativeKind::recovery_hint),
+            Self::UpstreamFailed {
+                status_code,
+                native,
+            } => native
+                .as_ref()
+                .and_then(NativeKind::recovery_hint)
+                .or_else(|| upstream_status_recovery_hint(*status_code)),
        }
    }
 }

+fn upstream_status_summary(status_code: u16) -> Option<&'static str> {
+    Some(match status_code {
+        401 => "上游服务拒绝认证（HTTP 401）",
+        403 => "上游服务拒绝访问（HTTP 403）",
+        408 => "上游请求超时（HTTP 408）",
+        429 => "上游服务返回 HTTP 429",
+        500..=599 => "上游服务暂时不可用",
+        _ => return None,
+    })
+}
+
+fn upstream_status_recovery_hint(status_code: u16) -> Option<&'static str> {
+    Some(match status_code {
+        401 => "请重新登录陶泥儿后重试；如持续失败请检查项目诊断",
+        403 => "请检查当前账号的上游访问权限后重试；如持续失败请检查项目诊断",
+        408 => "上游请求超时，请稍后重试；如持续失败请检查项目诊断",
+        429 => "上游服务暂时繁忙（HTTP 429），请稍后重试；如持续失败请检查项目诊断",
+        500..=599 => "上游服务暂时不可用，请稍后重试；如持续失败请检查项目诊断",
+        _ => return None,
+    })
+}
+
 // ══════════════════════════════════════════════════════════════════════════════════════════
 // 入队失败：`#[tauri::command]` 的 `Err`，这一轮没有开始也没有进队列
 // ══════════════════════════════════════════════════════════════════════════════════════════
@@ -1327,6 +1361,31 @@ mod tests {
        assert!(!projected.is_model_repairable());
    }

+    #[test]
+    fn upstream_http_status_keeps_codex_style_summary_and_retry_guidance() {
+        let rate_limited = TurnError::from_model_call(&LlmError::Upstream {
+            status_code: 429,
+            message: "Claude Code 返回失败终态：API Error: Request rejected (429)".into(),
+        });
+        assert_eq!(rate_limited.public_summary(), Some("上游服务返回 HTTP 429"));
+        assert_eq!(
+            rate_limited.recovery_hint(),
+            Some("上游服务暂时繁忙（HTTP 429），请稍后重试；如持续失败请检查项目诊断")
+        );
+        assert!(rate_limited.is_retryable());
+        assert!(!rate_limited.is_model_repairable());
+
+        let unauthorized = TurnError::from_model_call(&LlmError::Upstream {
+            status_code: 401,
+            message: "Claude Code 返回失败终态：HTTP 401".into(),
+        });
+        assert_eq!(
+            unauthorized.public_summary(),
+            Some("上游服务拒绝认证（HTTP 401）")
+        );
+        assert!(unauthorized.is_retryable());
+    }
+
    /// 反馈判据：原生分类里"再跑一次也不会变"的那些不再反馈给模型。
    #[test]
    fn terminal_native_kinds_are_not_fed_back_to_the_model() {
@@ -567,6 +567,23 @@ pub(crate) fn upload_local_asset_at(
    file_name: &str,
    media_type: &str,
    bytes: &[u8],
+) -> Result<UploadLocalAssetResult, String> {
+    upload_local_asset_at_with_category(root, file_name, media_type, bytes, None)
+}
+
+/// 带**显式入口栏目**的上传：只给 GUI 工具栏上传用（前端 `targetCategory`）。
+///
+/// 上传的 manifest `kind` 只由内容证据推导（图片 / 视频 / 代码 → `unclassified`），
+/// 与栏目不是同一套词汇：在栏目画布里上传素材时，用户选定的栏目才是归属真相，
+/// 否则素材会落进「待归类」、在上传它的那一栏里看不见。
+/// 取值校验与失败关闭沿用 [`register_local_asset_entry_with_category`]：
+/// 非法值报错、绝不回退到 kind 派生；其它调用方继续走 [`upload_local_asset_at`]。
+pub(crate) fn upload_local_asset_at_with_category(
+    root: &Path,
+    file_name: &str,
+    media_type: &str,
+    bytes: &[u8],
+    target_category: Option<&str>,
 ) -> Result<UploadLocalAssetResult, String> {
    if bytes.is_empty() {
        return Err("上传文件不能为空".to_string());
@@ -584,7 +601,7 @@ pub(crate) fn upload_local_asset_at(
    }
    crate::write_game_creator_private_file(&absolute_path, bytes, "上传文件")?;

-    register_local_asset_entry(
+    register_local_asset_entry_with_category(
        root,
        &relative_path,
        uploaded_asset_kind(file_name, media_type),
@@ -602,6 +619,7 @@ pub(crate) fn upload_local_asset_at(
            generation_kind: None,
            reference_resource_ids: Vec::new(),
        },
+        target_category,
    )
 }

@@ -2375,6 +2393,70 @@ mod tests {
        );
    }

+    /// Issue 359：工具栏上传带上入口栏目，素材才不会落进「待归类」。
+    ///
+    /// 上传的 manifest `kind` 只由内容证据推导，图片 / 视频 / 代码都派生成 `unclassified`；
+    /// 在栏目画布（如「角色与对象」）里上传时栏目才是归属真相。不传时保持既有行为，
+    /// 非法值失败关闭且不留下半成品登记。
+    #[test]
+    fn upload_registers_into_the_explicit_entry_category() {
+        fn upload_category(root: &Path, asset_id: &str) -> GameCreationAppAssetCategory {
+            read_existing_manifest_for_project(root)
+                .expect("read manifest")
+                .assets
+                .into_iter()
+                .find(|asset| asset.id == asset_id)
+                .expect("uploaded asset is registered")
+                .category
+        }
+
+        let temporary = tempfile::tempdir().expect("tempdir");
+        let root = temporary.path();
+        crate::project::init_local_game_project_at(root, "upload-category-test", "上传入口栏目")
+            .expect("init project");
+
+        let uploaded = upload_local_asset_at_with_category(
+            root,
+            "hero.png",
+            "image/png",
+            b"png-bytes",
+            Some("character"),
+        )
+        .expect("upload with an entry category");
+        assert_eq!(
+            upload_category(root, &uploaded.id),
+            GameCreationAppAssetCategory::Character
+        );
+
+        let plain = upload_local_asset_at(root, "plain.png", "image/png", b"png-bytes")
+            .expect("upload without an entry category");
+        assert_eq!(
+            upload_category(root, &plain.id),
+            GameCreationAppAssetCategory::Unclassified
+        );
+
+        // 非法入口栏目（栏目侧伪值 `version` 不在枚举里）失败关闭：不新增登记。
+        let assets_before = read_existing_manifest_for_project(root)
+            .expect("read manifest")
+            .assets
+            .len();
+        assert!(upload_local_asset_at_with_category(
+            root,
+            "bad.png",
+            "image/png",
+            b"png-bytes",
+            Some("version"),
+        )
+        .is_err());
+        assert_eq!(
+            read_existing_manifest_for_project(root)
+                .expect("read manifest")
+                .assets
+                .len(),
+            assets_before
+        );
+    }
+
    /// 画板导出推断出的 kind 必须已经是 canonical 值。
    #[test]
    fn canvas_export_asset_kind_is_always_canonical() {
@@ -12,6 +12,8 @@ use serde::{Deserialize, Serialize};

 use super::discovery::system_browser_candidates;
 use super::process::{browser_process_temp_root, BROWSER_TEMP_PREFIX};
+#[cfg(windows)]
+use crate::process_session::WindowsProcessJob;

 const OWNER_FILE: &str = "owner.json";
 const OWNER_SCHEMA: &str = "agc-browser-process.v1";
@@ -34,13 +36,17 @@ pub(super) struct BrowserProcessOwner {

 /// 运行期 launch 的身份锚点；任何一步拿不到身份证明都不写，
 /// 该目录之后按旧残留只删不杀。
-pub(super) fn write_browser_process_owner(temp_root: &Path, browser_pid: u32, executable: &Path) {
+pub(super) fn write_browser_process_owner(
+    temp_root: &Path,
+    browser_pid: u32,
+    executable: &Path,
+) -> bool {
    let identity =
        crate::process_identity::external_agent_runner_process_start_identity(browser_pid);
    let owner_identity =
        crate::process_identity::external_agent_runner_process_start_identity(std::process::id());
    let (Ok(Some(identity)), Ok(Some(owner_identity))) = (identity, owner_identity) else {
-        return;
+        return false;
    };
    let owner = BrowserProcessOwner {
        schema_version: OWNER_SCHEMA.into(),
@@ -52,9 +58,9 @@ pub(super) fn write_browser_process_owner(temp_root: &Path, browser_pid: u32, ex
        created_unix_ms: super::evidence::unix_time_ms(),
    };
    let Ok(bytes) = serde_json::to_vec_pretty(&owner) else {
-        return;
+        return false;
    };
-    let _ = fs::write(temp_root.join(OWNER_FILE), bytes);
+    fs::write(temp_root.join(OWNER_FILE), bytes).is_ok()
 }

 fn read_browser_process_owner(dir: &Path) -> Option<BrowserProcessOwner> {
@@ -115,34 +121,142 @@ fn trusted_browser_executable(path: &Path) -> bool {
 }

 /// 杀前复核：PID 对应的活进程镜像必须就是 owner.json 声明的那个可执行
-/// 文件。仅核对字符串不够——/tmp 全局可写时，同机其他用户可以伪造
-/// owner.json 把 browser_pid 指到本用户的任意进程借清扫杀之。
-/// Linux 进一步要求命令行声明本目录的 profile，把 PID 绑到这份配置
-/// 目录，挡住同用户伪造 owner.json 指向正在使用的浏览器。
+/// 文件，命令行还必须绑定同一份临时 Profile；只核对镜像会把其它 AGC
+/// 实例或用户 Edge 误认成本轮浏览器。
 #[cfg(windows)]
-fn live_process_executable_matches(pid: u32, expected: &Path, _profile_dir: &Path) -> bool {
-    // 已知残余风险：Windows 读他进程命令行成本高（PEB/WMI），此处只核对
-    // 镜像；同用户伪造 owner.json 指向正在使用的浏览器时可误杀它。
+fn windows_process_command_line(pid: u32) -> Option<String> {
+    use std::ffi::c_void;
+    use windows_sys::Win32::Foundation::CloseHandle;
+    use windows_sys::Win32::System::Threading::{
+        OpenProcess, PROCESS_QUERY_INFORMATION, PROCESS_VM_READ,
+    };
+
+    #[repr(C)]
+    struct UnicodeString {
+        length: u16,
+        maximum_length: u16,
+        buffer: *const u16,
+    }
+
+    #[link(name = "ntdll")]
+    unsafe extern "system" {
+        fn NtQueryInformationProcess(
+            process: *mut c_void,
+            information_class: u32,
+            information: *mut c_void,
+            information_length: u32,
+            return_length: *mut u32,
+        ) -> i32;
+    }
+
+    let process = unsafe { OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0, pid) };
+    if process.is_null() {
+        return None;
+    }
+    let mut required = 0;
+    let _ =
+        unsafe { NtQueryInformationProcess(process, 60, std::ptr::null_mut(), 0, &mut required) };
+    if required == 0 || required > 64 * 1024 {
+        unsafe { CloseHandle(process) };
+        return None;
+    }
+    let mut buffer = vec![0u8; required as usize];
+    let status = unsafe {
+        NtQueryInformationProcess(
+            process,
+            60,
+            buffer.as_mut_ptr().cast(),
+            required,
+            &mut required,
+        )
+    };
+    unsafe { CloseHandle(process) };
+    if status != 0 {
+        return None;
+    }
+    let command_line = unsafe { &*(buffer.as_ptr().cast::<UnicodeString>()) };
+    if command_line.buffer.is_null() || command_line.length == 0 || command_line.length % 2 != 0 {
+        return None;
+    }
+    let text = unsafe {
+        std::slice::from_raw_parts(command_line.buffer, command_line.length as usize / 2)
+    };
+    String::from_utf16(text).ok()
+}
+
+#[cfg(windows)]
+fn windows_command_line_arguments(command_line: &str) -> Option<Vec<String>> {
+    use windows_sys::Win32::Foundation::LocalFree;
+    use windows_sys::Win32::UI::Shell::CommandLineToArgvW;
+
+    let wide = command_line
+        .encode_utf16()
+        .chain(std::iter::once(0))
+        .collect::<Vec<_>>();
+    let mut count = 0;
+    let argv = unsafe { CommandLineToArgvW(wide.as_ptr(), &mut count) };
+    if argv.is_null() || count < 0 {
+        if !argv.is_null() {
+            unsafe { LocalFree(argv.cast()) };
+        }
+        return None;
+    }
+    let result = unsafe { std::slice::from_raw_parts(argv, count as usize) }
+        .iter()
+        .map(|argument| {
+            if argument.is_null() {
+                return None;
+            }
+            let mut length = 0;
+            unsafe {
+                while *argument.add(length) != 0 {
+                    length += 1;
+                }
+                String::from_utf16(std::slice::from_raw_parts(*argument, length)).ok()
+            }
+        })
+        .collect::<Option<Vec<_>>>();
+    unsafe { LocalFree(argv.cast()) };
+    result
+}
+
+#[cfg(windows)]
+fn command_line_contains_profile(command_line: &str, profile_dir: &Path) -> bool {
+    const MARKER: &str = "--user-data-dir=";
+    let Some(arguments) = windows_command_line_arguments(command_line) else {
+        return false;
+    };
+    arguments.iter().enumerate().any(|(index, argument)| {
+        let value = argument.strip_prefix(MARKER).or_else(|| {
+            (argument == "--user-data-dir")
+                .then(|| arguments.get(index + 1).map(String::as_str))
+                .flatten()
+        });
+        value.is_some_and(|value| same_executable_path(Path::new(value), profile_dir))
+    })
+}
+
+#[cfg(windows)]
+fn live_process_executable_matches(pid: u32, expected: &Path, profile_dir: &Path) -> bool {
    use windows_sys::Win32::Foundation::CloseHandle;
    use windows_sys::Win32::System::Threading::{
        OpenProcess, QueryFullProcessImageNameW, PROCESS_QUERY_LIMITED_INFORMATION,
    };
-    // SAFETY: 句柄非空时由 CloseHandle 释放；打开失败按不匹配处理（fail-closed）。
    let handle = unsafe { OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid) };
    if handle.is_null() {
        return false;
    }
    let mut buffer = [0u16; 1024];
    let mut length = buffer.len() as u32;
-    // SAFETY: buffer 可写，length 先传入容量、返回实际长度。
    let okay = unsafe { QueryFullProcessImageNameW(handle, 0, buffer.as_mut_ptr(), &mut length) };
-    // SAFETY: handle 是本函数持有的合法句柄。
    unsafe { CloseHandle(handle) };
    if okay == 0 || length == 0 {
        return false;
    }
    let actual = std::path::PathBuf::from(String::from_utf16_lossy(&buffer[..length as usize]));
    same_executable_path(&actual, expected)
+        && windows_process_command_line(pid)
+            .is_some_and(|command_line| command_line_contains_profile(&command_line, profile_dir))
 }

 #[cfg(target_os = "linux")]
@@ -181,7 +295,10 @@ fn directory_owned_by_current_user(dir: &Path) -> bool {
        .unwrap_or(false)
 }

-fn kill_browser_process_tree(root_pid: u32, expected_identity: &str) -> Result<(), String> {
+pub(super) fn kill_browser_process_tree(
+    root_pid: u32,
+    expected_identity: &str,
+) -> Result<(), String> {
    #[cfg(windows)]
    {
        // 追踪所有经确认属于这棵树的 PID；只有它们全部从快照中消失才判
@@ -190,15 +307,17 @@ fn kill_browser_process_tree(root_pid: u32, expected_identity: &str) -> Result<(
        for _ in 0..TREE_KILL_MAX_PASSES {
            let snapshot = windows_process_snapshot()?;
            let root_present = snapshot.iter().any(|(pid, _)| *pid == root_pid);
-            if root_present && process_identity_matches(root_pid, expected_identity) {
+            if root_present {
+                if !process_identity_matches(root_pid, expected_identity) {
+                    return Err("browser-sweep-root-identity-mismatch".into());
+                }
                // root 仍是目标浏览器：发现并追踪当前整棵子树。
                for pid in windows_process_tree_pids_from(&snapshot, root_pid)? {
                    track_process(&mut tracked, pid);
                }
-            } else if !root_present {
+            } else {
                // root 已退出且 PID 未被复用：发现临终前才拉起、仍挂在旧父
-                // PID 上的孤儿子进程。PID 已被复用时不做发现，避免误认
-                // 复用者的子进程。
+                // PID 上的孤儿子进程。PID 已被复用时不会进入此分支。
                for (pid, ppid) in &snapshot {
                    if *ppid == root_pid {
                        track_process(&mut tracked, *pid);
@@ -323,6 +442,62 @@ fn windows_process_tree_pids_from(
    Ok(tree)
 }

+#[cfg(windows)]
+pub(super) fn ensure_browser_tree_in_job(
+    root_pid: u32,
+    root_identity: &str,
+    job: &WindowsProcessJob,
+) -> Result<(), String> {
+    for _ in 0..TREE_KILL_MAX_PASSES {
+        let snapshot = windows_process_snapshot()?;
+        if !snapshot.iter().any(|(pid, _)| *pid == root_pid)
+            || !process_identity_matches(root_pid, root_identity)
+        {
+            return Err("browser-job-root-identity-unconfirmed".into());
+        }
+        let tree = windows_process_tree_pids_from(&snapshot, root_pid)?;
+        if tree.is_empty() {
+            return Err("browser-job-root-exited-before-coverage".into());
+        }
+        let mut members = Vec::with_capacity(tree.len());
+        for pid in tree {
+            let identity = if pid == root_pid {
+                root_identity.to_string()
+            } else {
+                crate::process_identity::external_agent_runner_process_start_identity(pid)
+                    .ok()
+                    .flatten()
+                    .ok_or_else(|| "browser-job-process-identity-unconfirmed".to_string())?
+            };
+            members.push((pid, identity));
+        }
+        for (pid, identity) in members {
+            if !process_identity_matches(pid, &identity) {
+                return Err("browser-job-process-identity-changed".into());
+            }
+            if !job.contains_pid(pid)? {
+                job.assign_pid(pid)?;
+            }
+            if !process_identity_matches(pid, &identity) {
+                return Err("browser-job-process-identity-changed".into());
+            }
+        }
+
+        let verified = windows_process_snapshot()?;
+        let verified_tree = windows_process_tree_pids_from(&verified, root_pid)?;
+        if process_identity_matches(root_pid, root_identity)
+            && !verified_tree.is_empty()
+            && verified_tree
+                .iter()
+                .all(|pid| job.contains_pid(*pid).unwrap_or(false))
+        {
+            return Ok(());
+        }
+        std::thread::sleep(TREE_KILL_PASS_INTERVAL);
+    }
+    Err("browser-job-tree-coverage-unconfirmed".into())
+}
+
 #[cfg(windows)]
 fn windows_terminate_process(pid: u32) {
    use windows_sys::Win32::Foundation::CloseHandle;
@@ -468,6 +643,18 @@ mod tests {
        }
    }

+    #[test]
+    fn owner_write_failure_leaves_no_partial_ownership_record() {
+        let root = tempfile::tempdir().unwrap();
+        let missing_root = root.path().join("missing");
+        assert!(!write_browser_process_owner(
+            &missing_root,
+            std::process::id(),
+            &std::env::current_exe().unwrap(),
+        ));
+        assert!(!missing_root.join(OWNER_FILE).exists());
+    }
+
    #[test]
    fn legacy_directory_without_owner_file_is_removed_only_when_old_enough() {
        let root = tempfile::tempdir().unwrap();
@@ -548,6 +735,90 @@ mod tests {
        assert!(trusted_browser_executable(&installed));
    }

+    #[cfg(windows)]
+    #[test]
+    fn windows_browser_cleanup_requires_the_exact_profile_argument() {
+        let profile = Path::new(r#"C:\Users\tester\App Data\ga-browser-1\profile"#);
+        assert!(command_line_contains_profile(
+            r#"msedge.exe --headless --user-data-dir="C:\Users\tester\App Data\ga-browser-1\profile""#,
+            profile
+        ));
+        assert!(command_line_contains_profile(
+            r#""msedge.exe" "--user-data-dir=C:\Users\tester\App Data\ga-browser-1\profile""#,
+            profile
+        ));
+        assert!(!command_line_contains_profile(
+            r#"msedge.exe --headless --user-data-dir="C:\Users\tester\App Data\ga-browser-2\profile""#,
+            profile
+        ));
+        assert!(!command_line_contains_profile(
+            r#"msedge.exe --headless --user-data-dir="C:\Users\tester\App Data\ga-browser-1\profile-copy""#,
+            profile
+        ));
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn browser_job_adopts_children_created_before_assignment() {
+        use std::process::{Command, Stdio};
+
+        let mut child = Command::new("cmd.exe")
+            .args([
+                "/c",
+                "ping",
+                "127.0.0.1",
+                "-n",
+                "60",
+                "&",
+                "ping",
+                "127.0.0.1",
+                "-n",
+                "60",
+            ])
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("spawn fixture");
+        let pid = child.id();
+        let identity = crate::process_identity::external_agent_runner_process_start_identity(pid)
+            .expect("fixture identity")
+            .expect("fixture identity present");
+        std::thread::sleep(Duration::from_millis(500));
+        let job = WindowsProcessJob::assign_std(&child).expect("assign fixture job");
+        ensure_browser_tree_in_job(pid, &identity, &job).expect("adopt fixture tree");
+        let snapshot = windows_process_snapshot().expect("snapshot after adoption");
+        let tree = windows_process_tree_pids_from(&snapshot, pid).expect("tree after adoption");
+        assert!(tree
+            .iter()
+            .all(|member| job.contains_pid(*member).expect("job membership")));
+        job.terminate().expect("terminate fixture job");
+        let _ = child.wait();
+        assert!(job.is_empty().expect("fixture job empty"));
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn kill_browser_process_tree_rejects_root_identity_mismatch() {
+        use std::process::{Command, Stdio};
+
+        let mut child = Command::new("cmd.exe")
+            .args(["/c", "ping", "127.0.0.1", "-n", "60"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("spawn fixture");
+        let pid = child.id();
+        let result = kill_browser_process_tree(pid, "not-the-fixture-identity");
+        let _ = child.kill();
+        let _ = child.wait();
+        assert_eq!(
+            result.expect_err("identity mismatch must fail closed"),
+            "browser-sweep-root-identity-mismatch"
+        );
+    }
+
    #[cfg(windows)]
    #[test]
    fn kill_browser_process_tree_reaps_fixture_tree() {
@@ -600,10 +871,8 @@ mod tests {
    fn live_process_executable_matches_current_process_image() {
        let exe = std::env::current_exe().unwrap();
        let profile = Path::new("C:\\fixture\\ga-browser-x\\profile");
-        // Windows 只核对镜像；Linux 还要求命令行绑定 profile，本测试进程
-        // 不具备该标记，正例只在 Windows 断言。
-        #[cfg(windows)]
-        assert!(live_process_executable_matches(
+        // 当前测试进程不携带目标 Profile 标识，即使镜像一致也不能清理。
+        assert!(!live_process_executable_matches(
            std::process::id(),
            &exe,
            profile
@@ -493,12 +493,19 @@ pub(crate) fn upload_local_asset(
    file_name: String,
    media_type: String,
    bytes: Vec<u8>,
+    target_category: Option<String>,
 ) -> Result<UploadLocalAssetResult, String> {
    let root = Path::new(project_path.trim());
    enforce_project_permission_policy(root, "asset.upload")?;
    let _lock = acquire_project_write_lock(root, "asset.upload")?;
    advance_agent_runtime_project_revision_locked(root)?;
-    upload_local_asset_at(root, file_name.trim(), media_type.trim(), &bytes)
+    upload_local_asset_at_with_category(
+        root,
+        file_name.trim(),
+        media_type.trim(),
+        &bytes,
+        target_category.as_deref(),
+    )
 }

 #[tauri::command]
@@ -311,6 +311,13 @@ async fn host_npm(
 fn browser_validation_failure_code(error: &str) -> &'static str {
    if error.contains("未发现可用的") {
        "web-preflight-browser-missing"
+    } else if error.starts_with("browser-recovery-") {
+        "web-preflight-browser-recovery-failed"
+    } else if error.contains("browser-temp-unavailable") || error.contains("browser-config-invalid")
+    {
+        "web-preflight-browser-environment-failed"
+    } else if error.starts_with("browser-launch-failed:") {
+        "web-preflight-browser-launch-failed"
    } else if error.contains("启动浏览器超时") {
        "web-preflight-browser-launch-timeout"
    } else if error.contains("启动浏览器失败") {
@@ -342,6 +349,13 @@ fn browser_validation_failure_code(error: &str) -> &'static str {
    }
 }

+fn browser_validation_diagnostic(error: &str) -> Option<&str> {
+    (error.starts_with("browser-recovery-")
+        || error.starts_with("browser-launch-failed:")
+        || error.starts_with("browser-cleanup-unconfirmed:"))
+    .then_some(error)
+}
+
 pub(crate) async fn host_web_creation_preflight() -> Value {
    let started = Instant::now();
    // 预检前顺手清扫陈旧的无头浏览器，避免残留进程放大本轮超时。
@@ -362,18 +376,60 @@ pub(crate) async fn host_web_creation_preflight() -> Value {
        let validation = crate::browser::validate_local_preview_in_browser(BrowserValidationInput {
            url: preview.url, viewports: vec![BrowserValidationViewport::Desktop, BrowserValidationViewport::Mobile], expected_text: vec![], settle_ms: 100, fail_on_console_error: true, playtest_scenario: None, evidence_root: root.join("evidence"),
        }).await;
-        let result = validation.map_err(|error| browser_validation_failure_code(&error).to_string())?;
-        if !result.passed || result.viewport_results.len() != 2 { return Err("web-preflight-page-check-failed".into()); }
+        let result = validation
+            .map_err(|error| {
+                let code = browser_validation_failure_code(&error);
+                browser_validation_diagnostic(&error)
+                    .map(|diagnostic| format!("{code};diagnostic={diagnostic}"))
+                    .unwrap_or_else(|| code.to_string())
+            })?;
+        if !result.passed || result.viewport_results.len() != 2 {
+            return Err("web-preflight-page-check-failed".into());
+        }
        let mut pngs = Vec::new();
        for viewport in result.viewport_results {
-            let bytes = fs::read(&viewport.screenshot_path).map_err(|_| "web-preflight-screenshot-missing")?;
-            if !bytes.starts_with(b"\x89PNG\r\n\x1a\n") || bytes.len() < 128 { return Err("web-preflight-screenshot-invalid".into()); }
-            image::load_from_memory(&bytes).map_err(|_| "web-preflight-screenshot-invalid")?;
-            pngs.push(json!({"viewport":viewport.viewport,"passed":viewport.passed,"pngBytes":bytes.len()}));
+            let bytes = fs::read(&viewport.screenshot_path)
+                .map_err(|_| "web-preflight-screenshot-missing")?;
+            if !bytes.starts_with(b"\x89PNG\r\n\x1a\n") || bytes.len() < 128 {
+                return Err("web-preflight-screenshot-invalid".into());
+            }
+            image::load_from_memory(&bytes)
+                .map_err(|_| "web-preflight-screenshot-invalid")?;
+            pngs.push(json!({
+                "viewport": viewport.viewport,
+                "passed": viewport.passed,
+                "pngBytes": bytes.len(),
+            }));
        }
-        Ok::<_, String>(json!({"schemaVersion":"agc-web-creation-preflight.v1","status":"ready","runtime":{"source":runtime.source,"nodeVersion":node,"npmVersion":npm},"build":{"status":"ready","kind":"npm-node-fixture"},"browser":{"status":"ready","viewports":pngs}}))
-    }.await;
-    let mut result = run.unwrap_or_else(|code| json!({"schemaVersion":"agc-web-creation-preflight.v1","status":"blocked","code":code}));
+        Ok::<_, String>(json!({
+            "schemaVersion": "agc-web-creation-preflight.v1",
+            "status": "ready",
+            "runtime": {
+                "source": runtime.source,
+                "nodeVersion": node,
+                "npmVersion": npm,
+            },
+            "build": {"status": "ready", "kind": "npm-node-fixture"},
+            "browser": {"status": "ready", "viewports": pngs},
+        }))
+    }
+    .await;
+    let mut result = run.unwrap_or_else(|error| {
+        let (code, diagnostic) = error
+            .split_once(";diagnostic=")
+            .map_or((error.as_str(), None), |(code, diagnostic)| {
+                (code, Some(diagnostic))
+            });
+        let mut blocked = json!({
+            "schemaVersion": "agc-web-creation-preflight.v1",
+            "status": "blocked",
+            "code": code,
+        });
+        if let Some(diagnostic) = diagnostic {
+            blocked["diagnostic"] = json!(diagnostic);
+        }
+        blocked
+    });
    result["elapsedMs"] = json!(started.elapsed().as_millis());
    result
 }
@@ -382,9 +438,14 @@ pub(crate) async fn host_web_creation_preflight() -> Value {
 pub(crate) async fn preflight_web_game_creation() -> Result<Value, String> {
    let result = host_web_creation_preflight().await;
    if result["status"] != "ready" {
+        let diagnostic = result["diagnostic"]
+            .as_str()
+            .map(|value| format!("；诊断：{value}"))
+            .unwrap_or_default();
        return Err(format!(
-            "Web 游戏环境预检未通过：{}；尚未启动生成",
-            result["code"].as_str().unwrap_or("web-preflight-failed")
+            "Web 游戏环境预检未通过：{}{}；尚未启动生成",
+            result["code"].as_str().unwrap_or("web-preflight-failed"),
+            diagnostic,
        ));
    }
    Ok(result)
@@ -548,16 +609,40 @@ mod tests {
            browser_validation_failure_code("启动浏览器失败：2"),
            "web-preflight-browser-launch-failed"
        );
+
+        assert_eq!(
+            browser_validation_failure_code(
+                "browser-launch-failed: stage=setup cause=browser-temp-unavailable"
+            ),
+            "web-preflight-browser-environment-failed"
+        );
+
+        let recovery_diagnostic = "browser-recovery-failed: initial-stage=ws-handshake final-stage=cdp-connect subprocess-exited=true cleanup-confirmed=true recovery-retried=true";
+        assert_eq!(
+            browser_validation_failure_code(recovery_diagnostic),
+            "web-preflight-browser-recovery-failed"
+        );
+        assert_eq!(
+            browser_validation_diagnostic(recovery_diagnostic),
+            Some(recovery_diagnostic)
+        );
+        assert_eq!(
+            browser_validation_diagnostic("启动浏览器失败：原始错误"),
+            None
+        );
        assert_eq!(
            browser_validation_failure_code("宿主已停止本轮浏览器验证"),
            "web-preflight-cancelled"
        );
+        let cleanup_diagnostic = "browser-cleanup-unconfirmed: stage=shutdown subprocess-exited=true cleanup-confirmed=false recovery-retried=false";
        assert_eq!(
-            browser_validation_failure_code(
-                "browser-cleanup-unconfirmed: 浏览器收束后无法证明退出，请核对本轮验证进程"
-            ),
+            browser_validation_failure_code(cleanup_diagnostic),
            "web-preflight-browser-cleanup-failed"
        );
+        assert_eq!(
+            browser_validation_diagnostic(cleanup_diagnostic),
+            Some(cleanup_diagnostic)
+        );
        assert_eq!(
            browser_validation_failure_code("创建浏览器临时目录失败：拒绝访问"),
            "web-preflight-browser-environment-failed"
@@ -236,7 +236,42 @@ impl WindowsProcessJob {
            .ok_or_else(|| "子进程缺少 Windows process handle".to_string())?;
        Self::assign_handle(handle as windows_sys::Win32::Foundation::HANDLE)
    }
+    pub(crate) fn contains_pid(&self, pid: u32) -> Result<bool, String> {
+        use windows_sys::Win32::Foundation::CloseHandle;
+        use windows_sys::Win32::System::JobObjects::IsProcessInJob;
+        use windows_sys::Win32::System::Threading::{
+            OpenProcess, PROCESS_QUERY_LIMITED_INFORMATION,
+        };
+        let process = unsafe { OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid) };
+        if process.is_null() {
+            return Err("无法打开进程核对 Windows Job 归属".into());
+        }
+        let mut in_job = 0;
+        let okay = unsafe { IsProcessInJob(process, self.0, &mut in_job) };
+        unsafe { CloseHandle(process) };
+        if okay == 0 {
+            return Err("无法核对进程 Windows Job 归属".into());
+        }
+        Ok(in_job != 0)
+    }

+    pub(crate) fn assign_pid(&self, pid: u32) -> Result<(), String> {
+        use windows_sys::Win32::Foundation::CloseHandle;
+        use windows_sys::Win32::System::JobObjects::AssignProcessToJobObject;
+        use windows_sys::Win32::System::Threading::{
+            OpenProcess, PROCESS_SET_QUOTA, PROCESS_TERMINATE,
+        };
+        let process = unsafe { OpenProcess(PROCESS_SET_QUOTA | PROCESS_TERMINATE, 0, pid) };
+        if process.is_null() {
+            return Err("无法打开进程加入 Windows Job".into());
+        }
+        let okay = unsafe { AssignProcessToJobObject(self.0, process) };
+        unsafe { CloseHandle(process) };
+        if okay == 0 {
+            return Err("无法将进程加入 Windows Job".into());
+        }
+        Ok(())
+    }
    pub(crate) fn assign_tokio_named(
        child: &tokio::process::Child,
        name: &str,
@@ -99,7 +99,13 @@ export type ResourceCanvasAudioToolAction =
    audioKind: ResourceCanvasGenerationKind;
  };

-/** 上传入口：复用既有 `upload_local_asset`。 */
+/**
+ * 上传入口：复用既有 `upload_local_asset`。
+ *
+ * 调用方按当前栏目带 `targetCategory`（见 `uploadResourceCanvasToolbarFiles`）——上传的
+ * manifest `kind` 只由内容证据推导，图片 / 视频 / 代码都会派生成 `unclassified`，
+ * 不带入口栏目素材就落「待归类」、在上传它的那一栏里看不见。
+ */
 export type ResourceCanvasUploadToolAction =
  ResourceCanvasBottomToolActionBase & {
    route: 'upload';
@@ -3,4 +3,4 @@
 /**
 * 认证网络客户端构建失败的原始错误明细。
 */
-export type AuthClientInitFailed = { detail: string };
+export type AuthClientInitFailed = { detail: string, };
@@ -1,7 +1,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AuthNetworkReason } from './AuthNetworkReason';
+import type { AuthNetworkReason } from "./AuthNetworkReason";

 /**
 * 连接登录服务的传输层失败原因。
 */
-export type AuthNetworkFailure = { reason: AuthNetworkReason };
+export type AuthNetworkFailure = { reason: AuthNetworkReason, };
@@ -3,4 +3,4 @@
 /**
 * 连接登录服务失败的具体原因。
 */
-export type AuthNetworkReason = 'timeout' | 'unreachable';
+export type AuthNetworkReason = "timeout" | "unreachable";
@@ -1,13 +1,11 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AuthResponseInvalidReason } from './AuthResponseInvalidReason';
+import type { AuthResponseInvalidReason } from "./AuthResponseInvalidReason";

 /**
 * 登录响应契约破损的原因与服务端原文。
 */
-export type AuthResponseInvalid = {
-  reason: AuthResponseInvalidReason;
-  /**
-   * 只有 `serverRejected` 可能带服务端原文；其余是 `null`。
-   */
-  serverMessage: string | null;
-};
+export type AuthResponseInvalid = { reason: AuthResponseInvalidReason, 
+/**
+ * 只有 `serverRejected` 可能带服务端原文；其余是 `null`。
+ */
+serverMessage: string | null, };
@@ -3,9 +3,4 @@
 /**
 * 登录响应契约破损的具体原因。
 */
-export type AuthResponseInvalidReason =
-  | 'notJson'
-  | 'invalidBody'
-  | 'missingRefreshCookie'
-  | 'missingUserIdentity'
-  | 'serverRejected';
+export type AuthResponseInvalidReason = "notJson" | "invalidBody" | "missingRefreshCookie" | "missingUserIdentity" | "serverRejected";
@@ -3,4 +3,4 @@
 /**
 * 登录服务 5xx 的状态码。
 */
-export type AuthServiceUnavailable = { status: number };
+export type AuthServiceUnavailable = { status: number, };
@@ -1,35 +1,17 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AuthClientInitFailed } from './AuthClientInitFailed';
-import type { AuthNetworkFailure } from './AuthNetworkFailure';
-import type { AuthResponseInvalid } from './AuthResponseInvalid';
-import type { AuthServiceUnavailable } from './AuthServiceUnavailable';
-import type { ClientSessionPersistFailed } from './ClientSessionPersistFailed';
-import type { PasswordLoginRejected } from './PasswordLoginRejected';
-import type { PhoneCodeLoginRejected } from './PhoneCodeLoginRejected';
-import type { RuntimeSessionInstallFailed } from './RuntimeSessionInstallFailed';
-import type { SendCodeRejected } from './SendCodeRejected';
-import type { ServerAddressRejected } from './ServerAddressRejected';
-import type { UnexpectedRejection } from './UnexpectedRejection';
+import type { AuthClientInitFailed } from "./AuthClientInitFailed";
+import type { AuthNetworkFailure } from "./AuthNetworkFailure";
+import type { AuthResponseInvalid } from "./AuthResponseInvalid";
+import type { AuthServiceUnavailable } from "./AuthServiceUnavailable";
+import type { ClientSessionPersistFailed } from "./ClientSessionPersistFailed";
+import type { PasswordLoginRejected } from "./PasswordLoginRejected";
+import type { PhoneCodeLoginRejected } from "./PhoneCodeLoginRejected";
+import type { RuntimeSessionInstallFailed } from "./RuntimeSessionInstallFailed";
+import type { SendCodeRejected } from "./SendCodeRejected";
+import type { ServerAddressRejected } from "./ServerAddressRejected";
+import type { UnexpectedRejection } from "./UnexpectedRejection";

 /**
 * 变体名就是线上的分流键（`type`），带载荷的变体持有同名载荷类型。
 */
-export type ClientAuthError =
-  | ({ type: 'serverAddressRejected' } & ServerAddressRejected)
-  | { type: 'phoneNumberInvalid' }
-  | { type: 'passwordMissing' }
-  | { type: 'loginCodeMissing' }
-  | ({ type: 'passwordLoginRejected' } & PasswordLoginRejected)
-  | { type: 'phoneOrPasswordMismatch' }
-  | ({ type: 'sendCodeRejected' } & SendCodeRejected)
-  | { type: 'smsCodeThrottled' }
-  | ({ type: 'phoneCodeLoginRejected' } & PhoneCodeLoginRejected)
-  | { type: 'sessionInvalidated' }
-  | { type: 'permissionDenied' }
-  | ({ type: 'authNetworkFailure' } & AuthNetworkFailure)
-  | ({ type: 'authServiceUnavailable' } & AuthServiceUnavailable)
-  | ({ type: 'unexpectedRejection' } & UnexpectedRejection)
-  | ({ type: 'authResponseInvalid' } & AuthResponseInvalid)
-  | ({ type: 'clientSessionPersistFailed' } & ClientSessionPersistFailed)
-  | ({ type: 'runtimeSessionInstallFailed' } & RuntimeSessionInstallFailed)
-  | ({ type: 'authClientInitFailed' } & AuthClientInitFailed);
+export type ClientAuthError = { "type": "serverAddressRejected" } & ServerAddressRejected | { "type": "phoneNumberInvalid" } | { "type": "passwordMissing" } | { "type": "loginCodeMissing" } | { "type": "passwordLoginRejected" } & PasswordLoginRejected | { "type": "phoneOrPasswordMismatch" } | { "type": "sendCodeRejected" } & SendCodeRejected | { "type": "smsCodeThrottled" } | { "type": "phoneCodeLoginRejected" } & PhoneCodeLoginRejected | { "type": "sessionInvalidated" } | { "type": "permissionDenied" } | { "type": "authNetworkFailure" } & AuthNetworkFailure | { "type": "authServiceUnavailable" } & AuthServiceUnavailable | { "type": "unexpectedRejection" } & UnexpectedRejection | { "type": "authResponseInvalid" } & AuthResponseInvalid | { "type": "clientSessionPersistFailed" } & ClientSessionPersistFailed | { "type": "runtimeSessionInstallFailed" } & RuntimeSessionInstallFailed | { "type": "authClientInitFailed" } & AuthClientInitFailed;
--- a/Show More
+++ b/Show More