From b1be6947b0bf23d131fa0448c2cd0c4b440885b2 Mon Sep 17 00:00:00 2001 From: Linghong Date: Tue, 22 Sep 2026 10:23:29 +0000 Subject: [PATCH] =?UTF-8?q?=E5=A5=91=E7=BA=A6=E6=A3=80=E6=9F=A5=E8=A1=A5?= =?UTF-8?q?=E9=BD=90=E7=8E=B0=E6=9C=89=20OSS=20=E4=B8=8A=E4=BC=A0=E7=99=BD?= =?UTF-8?q?=E5=90=8D=E5=8D=95=EF=BC=8C=E4=BF=9D=E7=95=99=E7=B2=BE=E7=A1=AE?= =?UTF-8?q?=E6=A0=A1=E9=AA=8C=E3=80=82=20=E4=BF=AE=E6=AD=A3=E8=BF=87?= =?UTF-8?q?=E6=9C=9F=E6=B3=A8=E9=87=8A=E5=B9=B6=E6=9B=B4=E6=96=B0=E6=8E=92?= =?UTF-8?q?=E9=9A=9C=E8=AE=B0=E5=BD=95=E3=80=82=20Native=20shell=20?= =?UTF-8?q?=E5=A5=91=E7=BA=A6=E6=A3=80=E6=9F=A5=E3=80=815=20=E6=9D=A1?= =?UTF-8?q?=E7=B4=A0=E6=9D=90=E4=B8=8A=E4=BC=A0=E6=B5=8B=E8=AF=95=E3=80=81?= =?UTF-8?q?=E7=BC=96=E7=A0=81=E5=8F=8A=E6=A0=BC=E5=BC=8F=E6=A3=80=E6=9F=A5?= =?UTF-8?q?=E5=85=A8=E9=83=A8=E9=80=9A=E8=BF=87=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/project-memory/shared-memory/pitfalls.md | 7 +++++++ scripts/check-native-shells.mjs | 7 ++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/docs/project-memory/shared-memory/pitfalls.md b/docs/project-memory/shared-memory/pitfalls.md index a43bbab5d..7e2d98345 100644 --- a/docs/project-memory/shared-memory/pitfalls.md +++ b/docs/project-memory/shared-memory/pitfalls.md @@ -1,5 +1,12 @@ # 踩坑与排障记录 +## AGC 素材直传的 OSS 权限必须同步到 Native shell 契约检查 + +- **现象**：Native shell CI 在 `check:native-shells:contract` 的 HTTP scope 检查失败，尚未准备 Rust 缓存；后续导出步骤正常退出但实际跳过，导致 master 缓存产物缺组、自动镜像刷新等待。 +- **原因**：`capabilities/main.json` 已为封面与截图直传加入 `https://*.aliyuncs.com/*`，`scripts/check-native-shells.mjs` 的精确白名单仍只有五项，且误以为更新下载迁至原生 updater 后就不再需要 OSS 权限。`assetDirectUpload.ts` 仍通过 Tauri HTTP 插件执行素材直传。 +- **处理**：契约期望同步包含现有 OSS HTTPS 项，保留完整白名单精确比较；不得删除业务所需权限或改成任意 URL 放行。更新下载与素材直传是不同调用链，变更能力配置时同步检查调用方和契约。 +- **验证**：运行 `npm run check:native-shells:contract` 与 `apps/ai-game-creator-shell/tests/assetDirectUpload.test.ts`；缓存完整性以实际 artifact 和导出日志为准，不能仅看上传 step 是否成功。 + ## release 安装包文件名中的编码空格不能按控制字符拒绝 - **现象**：release 环境点击“下载客户端”只显示无法获取最新版本，`GET /api/client-downloads` 返回 `502 UPSTREAM_ERROR`；dev 环境正常。 diff --git a/scripts/check-native-shells.mjs b/scripts/check-native-shells.mjs index 23b20818d..5c0f8af18 100644 --- a/scripts/check-native-shells.mjs +++ b/scripts/check-native-shells.mjs @@ -2602,12 +2602,13 @@ function assertAiGameCreatorShellUserDevBoundary() { { url: 'https://*/api/*' }, { url: 'http://localhost:*/*' }, { url: 'http://127.0.0.1:*/*' }, + { url: 'https://*.aliyuncs.com/*' }, ]) ) { throw new Error( - // 更新清单与安装包下载已改由 tauri-plugin-updater 在原生侧完成， - // 不再需要为 webview 的 http 插件放行 OSS 域名。 - 'AI game creator native HTTP scope must match the release, dev, custom HTTPS, and loopback API boundary', + // 更新清单与安装包下载由 tauri-plugin-updater 在原生侧完成； + // 封面与截图仍通过 webview 的 http 插件向凭证指定的 OSS 地址直传。 + 'AI game creator native HTTP scope must match the release, dev, custom HTTPS, loopback API, and OSS media upload boundary', ); }