恢复固定 Node 在系统 PATH 的可见性

- 上一版把固定 Node 只放在 /usr/local/lib/genarrative-node，未在 /usr/local/bin 建 node 链接 - command.exec 只信任 /usr/local/bin 等系统目录，导致 CI 上所有需要真实 node 的命令用例失败（找不到受信任的 node 可执行文件） - 在 npm 固定版本步骤后恢复 /usr/local/bin/node 符号链接，并同步注释口径
AGC Rust 分片改为失败用例有界复核
2026-09-21 03:23:48 +08:00 · 2026-09-21 03:23:48 +08:00 · 2026-09-21 03:23:48 +08:00 · 2026-09-21 03:23:48 +08:00 · 2026-09-21 03:23:47 +08:00 · 2026-09-21 03:23:47 +08:00
367 changed files with 35975 additions and 24108 deletions
@@ -4,3 +4,5 @@
 src/components/AdventurePanel.tsx
 src/data/customWorldCharacterLoadout.ts
 dist_check_monster_position/**
+# 固定上游UTF-8测试刻意包含U+FFFD；upstream-integrity.test.mjs逐字节验证来源hash。
+apps/ai-game-creator-shell/src-tauri/vendor/codex-utils-path-uri/src/api_path_string_tests.rs
@@ -213,8 +213,6 @@ module.exports = {
    '!src/services/clipboard.test.ts',
    '!src/services/frontendRuntimeConfigService.ts',
    '!src/services/frontendRuntimeConfigService.test.ts',
-    '!src/services/gameDistributionClient.ts',
-    '!src/services/gameDistributionClient.test.ts',
    '!src/services/sseStream.ts',
    '!src/services/sseStream.test.ts',
    'src/AdventurePanel.tsx',
@@ -47,12 +47,16 @@ temp*build*/
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/codex-package.json
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/manifest.json
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/NOTICE.md
+/apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/darwin-arm64/
+/apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/darwin-x64/
 /plugins/agc-cocos-editor/native/payload/
 /plugins/agc-unity-editor/dotnet/**/bin/
 /plugins/agc-unity-editor/dotnet/**/obj/
 /plugins/agc-unity-editor/dotnet/publish/
 /plugins/agc-unity-editor/dotnet/native-build/
 /apps/ai-game-creator-shell/logs/
+/apps/ai-game-creator-shell/src-tauri/resources/node-runtime/
+/apps/ai-game-creator-shell/src-tauri/resources/node-runtime-staging-*/
 /apps/ai-game-creator-shell/.llm-drafts/
 /apps/ai-game-creator-shell/game-creator.config.local.json
 /apps/mobile-shell/.expo/
@@ -5,12 +5,9 @@ import {
  executeAdminRechargeRefund,
  getAdminFeatureGateConfig,
  getAdminUserDetail,
-  listAdminGameDistributionReviews,
  listAdminRechargeOrders,
  reconcileAdminUserConsumption,
  resolveAdminRechargeRefundManualReview,
-  reviewAdminGameDistributionVersion,
-  suspendAdminGameDistributionGame,
  updateAdminAccount,
  uploadAdminEditorShowcaseCampaignImage,
  upsertAdminFeatureGateConfig,
@@ -367,134 +364,3 @@ test('退款人工复核使用独立 resolve 管理员路由', async () => {
    }),
  );
 });
-
-test('游戏审核列表与审核动作使用约定的 URL、方法和幂等键', async () => {
-  const fetchMock = vi.fn().mockImplementation(() =>
-    Promise.resolve(
-      new Response(JSON.stringify({ entries: [], nextCursor: null }), {
-        status: 200,
-      }),
-    ),
-  );
-  vi.stubGlobal('fetch', fetchMock);
-
-  await listAdminGameDistributionReviews('admin-token');
-  await reviewAdminGameDistributionVersion(
-    'admin-token',
-    'gamever/1',
-    'game-review-key-1',
-    {
-      decision: 'approve',
-      expectedPublicationRevision: 3,
-      entryUrl: 'https://games.example.test/releases/game_1/index.html',
-    },
-  );
-
-  expect(fetchMock.mock.calls[0]?.[0]).toBe(
-    '/admin/api/game-distribution/reviews?limit=48',
-  );
-  expect(fetchMock.mock.calls[1]?.[0]).toBe(
-    '/admin/api/game-distribution/versions/gamever%2F1/review',
-  );
-  expect(fetchMock.mock.calls[1]?.[1]).toEqual(
-    expect.objectContaining({
-      method: 'POST',
-      headers: expect.objectContaining({
-        Authorization: 'Bearer admin-token',
-        'Idempotency-Key': 'game-review-key-1',
-      }),
-      body: JSON.stringify({
-        decision: 'approve',
-        expectedPublicationRevision: 3,
-        entryUrl: 'https://games.example.test/releases/game_1/index.html',
-      }),
-    }),
-  );
-});
-
-test('安全下架请求携带公开修订号、原因与幂等键', async () => {
-  const fetchMock = vi.fn().mockImplementation(() =>
-    Promise.resolve(
-      new Response(JSON.stringify({ game: {}, replayed: false }), {
-        status: 200,
-      }),
-    ),
-  );
-  vi.stubGlobal('fetch', fetchMock);
-
-  await suspendAdminGameDistributionGame(
-    'admin-token',
-    'game/1',
-    'game-suspend-key-1',
-    { expectedPublicationRevision: 7, reason: '版权投诉' },
-  );
-
-  expect(fetchMock.mock.calls[0]?.[0]).toBe(
-    '/admin/api/game-distribution/games/game%2F1/suspend',
-  );
-  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
-    expect.objectContaining({
-      method: 'POST',
-      headers: expect.objectContaining({
-        Authorization: 'Bearer admin-token',
-        'Idempotency-Key': 'game-suspend-key-1',
-      }),
-      body: JSON.stringify({
-        expectedPublicationRevision: 7,
-        reason: '版权投诉',
-      }),
-    }),
-  );
-
-  expect(() =>
-    suspendAdminGameDistributionGame('admin-token', '  ', 'key', {
-      expectedPublicationRevision: 1,
-    }),
-  ).toThrow('缺少游戏 ID');
-  expect(() =>
-    suspendAdminGameDistributionGame('admin-token', 'game-1', '  ', {
-      expectedPublicationRevision: 1,
-    }),
-  ).toThrow('下架幂等键必须是 1 到 128 个字符');
-  expect(fetchMock).toHaveBeenCalledTimes(1);
-});
-
-test('游戏审核拒绝请求携带理由，空幂等键在本地失败关闭', async () => {
-  const fetchMock = vi.fn().mockImplementation(() =>
-    Promise.resolve(
-      new Response(JSON.stringify({ version: {}, replayed: false }), {
-        status: 200,
-      }),
-    ),
-  );
-  vi.stubGlobal('fetch', fetchMock);
-
-  await reviewAdminGameDistributionVersion(
-    'admin-token',
-    'version-1',
-    'game-review-key-2',
-    {
-      decision: 'reject',
-      expectedPublicationRevision: 0,
-      reviewReason: '运行时报错',
-    },
-  );
-  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
-    expect.objectContaining({
-      body: JSON.stringify({
-        decision: 'reject',
-        expectedPublicationRevision: 0,
-        reviewReason: '运行时报错',
-      }),
-    }),
-  );
-
-  expect(() =>
-    reviewAdminGameDistributionVersion('admin-token', 'version-1', '   ', {
-      decision: 'reject',
-      expectedPublicationRevision: 0,
-      reviewReason: 'x',
-    }),
-  ).toThrow('审核幂等键必须是 1 到 128 个字符');
-  expect(fetchMock).toHaveBeenCalledTimes(1);
-});
@@ -29,9 +29,6 @@ import type {
  AdminExternalApiKeyListQuery,
  AdminExternalApiKeyListResponse,
  AdminFeatureGateConfigResponse,
-  AdminGameDistributionReviewListResponse,
-  AdminGameDistributionReviewRequest,
-  AdminGameDistributionReviewResponse,
  AdminLoginResponse,
  AdminMeResponse,
  AdminOverviewResponse,
@@ -1179,72 +1176,3 @@ export function saveAgcModelCatalog(
    { token, method: 'PUT', body },
  );
 }
-
-export function listAdminGameDistributionReviews(token: string, limit = 48) {
-  const normalizedLimit = Number.isFinite(limit)
-    ? Math.min(Math.max(Math.trunc(limit), 1), 48)
-    : 48;
-  return request<AdminGameDistributionReviewListResponse>(
-    `/admin/api/game-distribution/reviews?limit=${normalizedLimit}`,
-    { token },
-  );
-}
-
-/**
- * 审核游戏发行版本。幂等键由调用方生成并在同一次提交内复用，避免重复点击产生
- * 两条审核结论。
- */
-/**
- * 安全下架整个游戏。管理员下架同样要求 CAS 修订号与幂等键，避免并发审核互相覆盖。
- */
-export function suspendAdminGameDistributionGame(
-  token: string,
-  gameId: string,
-  idempotencyKey: string,
-  payload: import('./adminApiTypes').AdminGameDistributionSuspendRequest,
-) {
-  const normalizedGameId = gameId.trim();
-  const normalizedKey = idempotencyKey.trim();
-  if (!normalizedGameId) {
-    throw new Error('缺少游戏 ID');
-  }
-  if (!normalizedKey || normalizedKey.length > 128) {
-    throw new Error('下架幂等键必须是 1 到 128 个字符');
-  }
-  return request<
-    import('./adminApiTypes').AdminGameDistributionSuspendResponse
-  >(
-    `/admin/api/game-distribution/games/${encodeURIComponent(normalizedGameId)}/suspend`,
-    {
-      method: 'POST',
-      token,
-      headers: { 'Idempotency-Key': normalizedKey },
-      body: payload,
-    },
-  );
-}
-
-export function reviewAdminGameDistributionVersion(
-  token: string,
-  versionId: string,
-  idempotencyKey: string,
-  payload: AdminGameDistributionReviewRequest,
-) {
-  const normalizedVersionId = versionId.trim();
-  const normalizedKey = idempotencyKey.trim();
-  if (!normalizedVersionId) {
-    throw new Error('缺少发行版本 ID');
-  }
-  if (!normalizedKey || normalizedKey.length > 128) {
-    throw new Error('审核幂等键必须是 1 到 128 个字符');
-  }
-  return request<AdminGameDistributionReviewResponse>(
-    `/admin/api/game-distribution/versions/${encodeURIComponent(normalizedVersionId)}/review`,
-    {
-      method: 'POST',
-      token,
-      headers: { 'Idempotency-Key': normalizedKey },
-      body: payload,
-    },
-  );
-}
@@ -144,6 +144,8 @@ export interface AdminErrorReportListResponse {
 }

 export interface AdminErrorReportDetail extends AdminErrorReportEntry {
+  firstFingerprint?: string;
+  firstSource?: string;
  note?: string;
  events: Array<Record<string, unknown>>;
  logNames: string[];
@@ -1031,48 +1033,3 @@ export interface AdminAgcModelCatalog {
  defaultModelId: string;
  models: AdminAgcModel[];
 }
-
-export interface AdminGameDistributionReviewEntry {
-  versionId: string;
-  gameId: string;
-  versionNumber: number;
-  packageSha256: string;
-  packageBytes: number;
-  status: string;
-  publicationRevision: number;
-  reviewReason: string | null;
-  createdAt: string;
-  updatedAt: string;
-}
-
-export interface AdminGameDistributionReviewListResponse {
-  entries: AdminGameDistributionReviewEntry[];
-  nextCursor: string | null;
-}
-
-export interface AdminGameDistributionReviewRequest {
-  decision: 'approve' | 'reject';
-  expectedPublicationRevision: number;
-  reviewReason?: string;
-  entryUrl?: string;
-}
-
-export interface AdminGameDistributionReviewResponse {
-  version: AdminGameDistributionReviewEntry;
-  replayed: boolean;
-}
-
-export interface AdminGameDistributionSuspendRequest {
-  expectedPublicationRevision: number;
-  reason?: string;
-}
-
-export interface AdminGameDistributionSuspendResponse {
-  game: {
-    id: string;
-    title: string;
-    status: string;
-    publicationRevision: number;
-  };
-  replayed: boolean;
-}
@@ -26,7 +26,6 @@ import { AdminEditorAssetQueryPage } from '../pages/AdminEditorAssetQueryPage';
 import { AdminEditorGenerationPricingPage } from '../pages/AdminEditorGenerationPricingPage';
 import { AdminEditorShowcaseReviewPage } from '../pages/AdminEditorShowcaseReviewPage';
 import { AdminErrorReportsPage } from '../pages/AdminErrorReportsPage';
-import { AdminGameDistributionReviewPage } from '../pages/AdminGameDistributionReviewPage';
 import { AdminGrayReleaseConfigPage } from '../pages/AdminGrayReleaseConfigPage';
 import { AdminInviteCodePage } from '../pages/AdminInviteCodePage';
 import { AdminLoginPage } from '../pages/AdminLoginPage';
@@ -301,12 +300,6 @@ export function AdminApp() {
          onUnauthorized={handleUnauthorized}
        />
      ) : null}
-      {activeRouteId === 'game-distribution' ? (
-        <AdminGameDistributionReviewPage
-          token={token}
-          onUnauthorized={handleUnauthorized}
-        />
-      ) : null}
      {activeRouteId === 'editor-assets' ? (
        <AdminEditorAssetQueryPage
          token={token}
@@ -5,7 +5,6 @@ import {
  Coins,
  Database,
  FolderArchive,
-  Gamepad2,
  GitBranch,
  Images,
  LayoutDashboard,
@@ -50,7 +49,6 @@ const routeIcons = {
  'recharge-orders': ReceiptText,
  'editor-generation-pricing': Coins,
  'editor-showcase': Star,
-  'game-distribution': Gamepad2,
  'editor-assets': Images,
  'project-snapshots': FolderArchive,
  accounts: Users,
@@ -147,24 +147,3 @@ test('项目工程入口对 owner 与已授权 member 开放且可分配权限',
    }),
  ).not.toContainEqual(route);
 });
-
-test('后台游戏审核路由可通过导航和 hash 访问', () => {
-  expect(adminRoutes).toContainEqual({
-    id: 'game-distribution',
-    label: '游戏审核',
-    hash: '#game-distribution',
-  });
-  expect(resolveAdminRoute('#game-distribution')).toBe('game-distribution');
-  expect(routeHash('game-distribution')).toBe('#game-distribution');
-});
-
-test('member 可单独获得游戏审核 Tab 权限', () => {
-  const routes = getAccessibleAdminRoutes({
-    accountRole: 'member',
-    tabPermissions: ['game-distribution'],
-  });
-  expect(routes.map((route) => route.id)).toEqual(['game-distribution']);
-  expect(resolveAccessibleAdminRoute('#game-distribution', routes)).toBe(
-    'game-distribution',
-  );
-});
@@ -15,7 +15,6 @@ export type AdminRouteId =
  | 'recharge-orders'
  | 'editor-generation-pricing'
  | 'editor-showcase'
-  | 'game-distribution'
  | 'editor-assets'
  | 'project-snapshots'
  | 'agc-models'
@@ -55,7 +54,6 @@ export const adminRoutes: AdminRouteDefinition[] = [
  },
  { id: 'agc-models', label: 'AGC 模型', hash: '#agc-models', ownerOnly: true },
  { id: 'editor-showcase', label: '精选审核', hash: '#editor-showcase' },
-  { id: 'game-distribution', label: '游戏审核', hash: '#game-distribution' },
  { id: 'editor-assets', label: '素材查询', hash: '#editor-assets' },
  { id: 'project-snapshots', label: '项目工程', hash: '#project-snapshots' },
  { id: 'accounts', label: '账号管理', hash: '#accounts', ownerOnly: true },
@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  formatAdminTimestamp,
+  parseAdminTimestamp,
+} from './AdminErrorReportsPage';
+
+describe('错误报告时间格式化', () => {
+  it('解析 SpacetimeDB seconds.microsZ 时间', () => {
+    expect(parseAdminTimestamp('1778207451.731746Z')).toBe(1778207451731);
+  });
+
+  it('解析微秒字符串并拒绝无效时间', () => {
+    expect(parseAdminTimestamp('1778207451731746')).toBe(1778207451731);
+    expect(formatAdminTimestamp('not-a-date')).toBe('-');
+    expect(formatAdminTimestamp('999999999999999999999999')).toBe('-');
+  });
+});
@@ -17,6 +17,57 @@ type Props = { token: string; onUnauthorized: (message?: string) => void };

 const ADMIN_ERROR_REPORT_STATUSES = ['new', 'in-progress', 'resolved'] as const;
 const ERROR_REPORT_PAGE_SIZE = 50;
+const ERROR_REPORT_STATUS_LABELS: Record<string, string> = {
+  new: '待处理',
+  'in-progress': '处理中',
+  resolved: '已解决',
+};
+
+export function parseAdminTimestamp(value: string | null | undefined) {
+  const normalized = value?.trim() ?? '';
+  if (/^-?\d+\.\d{6}Z$/u.test(normalized)) {
+    const [secondsText, microsText] = normalized.slice(0, -1).split('.');
+    const seconds = Number(secondsText);
+    const micros = Number(microsText);
+    return Number.isFinite(seconds) && Number.isFinite(micros)
+      ? seconds * 1000 + Math.floor(micros / 1000)
+      : Number.NaN;
+  }
+  if (/^-?\d+$/u.test(normalized)) {
+    const numeric = Number(normalized);
+    if (!Number.isFinite(numeric)) return Number.NaN;
+    if (Math.abs(numeric) >= 1e14) return Math.floor(numeric / 1000);
+    if (Math.abs(numeric) >= 1e11) return numeric;
+    return numeric * 1000;
+  }
+  return Date.parse(normalized);
+}
+
+export function formatAdminTimestamp(value: string | null | undefined) {
+  const timestamp = parseAdminTimestamp(value);
+  if (!Number.isFinite(timestamp)) return '-';
+  const date = new Date(timestamp);
+  if (!Number.isFinite(date.getTime())) return '-';
+  try {
+    return new Intl.DateTimeFormat('zh-CN', {
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit',
+      second: '2-digit',
+    }).format(date);
+  } catch {
+    return '-';
+  }
+}
+
+function eventText(event: Record<string, unknown>, key: string) {
+  const value = event[key];
+  return typeof value === 'string' || typeof value === 'number'
+    ? String(value)
+    : '';
+}

 export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
  const [reports, setReports] = useState<AdminErrorReportEntry[]>([]);
@@ -29,6 +80,24 @@ export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
  const [pageInfo, setPageInfo] = useState({ total: 0, hasMore: false });
  const openReportRequestId = useRef(0);
  const loadRequestId = useRef(0);
+  const detailCloseButtonRef = useRef<HTMLButtonElement | null>(null);
+
+  useEffect(() => {
+    if (!selected) return;
+    const previousFocus = document.activeElement as HTMLElement | null;
+    const focusFrame = window.requestAnimationFrame(() => {
+      detailCloseButtonRef.current?.focus();
+    });
+    const handleEscape = (event: KeyboardEvent) => {
+      if (event.key === 'Escape') setSelected(null);
+    };
+    window.addEventListener('keydown', handleEscape);
+    return () => {
+      window.cancelAnimationFrame(focusFrame);
+      window.removeEventListener('keydown', handleEscape);
+      previousFocus?.focus?.();
+    };
+  }, [selected]);

  const load = useCallback(async () => {
    const requestId = ++loadRequestId.current;
@@ -184,9 +253,15 @@ export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
                <td>{report.batchId}</td>
                <td>{report.eventCount}</td>
                <td>{report.source ?? '-'}</td>
-                <td>{report.status}</td>
+                <td>
+                  <span
+                    className={`admin-error-report-status is-${report.status}`}
+                  >
+                    {ERROR_REPORT_STATUS_LABELS[report.status] ?? report.status}
+                  </span>
+                </td>
                <td>{report.userId}</td>
-                <td>{new Date(report.createdAt).toLocaleString()}</td>
+                <td>{formatAdminTimestamp(report.createdAt)}</td>
              </tr>
            ))}
          </tbody>
@@ -224,66 +299,173 @@ export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
          className="admin-detail-modal"
          role="dialog"
          aria-label="错误报告详情"
+          aria-modal="true"
+          onMouseDown={(event) => {
+            if (event.target === event.currentTarget) setSelected(null);
+          }}
        >
-          <div className="admin-detail-modal__panel">
-            <header>
-              <h2>{selected.batchId}</h2>
-              <button type="button" onClick={() => setSelected(null)}>
-                关闭
+          <div className="admin-detail-modal__panel admin-error-report-detail">
+            <header className="admin-error-report-detail__header">
+              <div className="admin-error-report-detail__heading">
+                <span className="admin-error-report-detail__eyebrow">
+                  错误报告详情
+                </span>
+                <h2>{selected.batchId}</h2>
+                <div className="admin-error-report-detail__badges">
+                  <span
+                    className={`admin-error-report-status is-${selected.status}`}
+                  >
+                    {ERROR_REPORT_STATUS_LABELS[selected.status] ??
+                      selected.status}
+                  </span>
+                  <span className="admin-error-report-detail__badge">
+                    {selected.firstSource ?? selected.source ?? '未知来源'}
+                  </span>
+                </div>
+              </div>
+              <button
+                type="button"
+                className="admin-error-report-detail__close"
+                ref={detailCloseButtonRef}
+                onClick={() => setSelected(null)}
+                aria-label="关闭错误报告详情"
+              >
+                ×
              </button>
            </header>
-            <p>
-              用户：{selected.userId} · 事件：{selected.eventCount} · 日志：
-              {selected.logCount}
-            </p>
-            <pre>{JSON.stringify(selected.events.slice(0, 20), null, 2)}</pre>
-            {selected.userDescription ? (
-              <p>用户描述：{selected.userDescription}</p>
-            ) : null}
-            <label className="admin-detail-modal__note">
-              处理备注
-              <textarea
-                value={selected.note ?? ''}
-                onChange={(event) =>
-                  setSelected((current) =>
-                    current
-                      ? { ...current, note: event.target.value }
-                      : current,
-                  )
-                }
-                maxLength={2000}
-                rows={4}
-                placeholder="记录处理结论或后续跟进事项"
-                disabled={busy}
-              />
-            </label>
-            <div className="admin-detail-modal__actions">
-              <select
-                value={selected.status}
-                onChange={(event) => void saveStatus(event.target.value)}
-                disabled={busy}
-              >
-                {ADMIN_ERROR_REPORT_STATUSES.map((value) => (
-                  <option key={value} value={value}>
-                    {value}
-                  </option>
-                ))}
-              </select>
-              <button
-                type="button"
-                onClick={() => void saveStatus(selected.status)}
-                disabled={busy}
-              >
-                保存备注
-              </button>
-              <button
-                type="button"
-                onClick={() => void download(selected.batchId)}
-                disabled={downloading}
-              >
-                {downloading ? '下载中…' : '下载诊断包'}
-              </button>
+            <div className="admin-error-report-detail__summary">
+              <div>
+                <span>用户</span>
+                <strong>{selected.userId}</strong>
+              </div>
+              <div>
+                <span>发生时间</span>
+                <strong>{formatAdminTimestamp(selected.createdAt)}</strong>
+              </div>
+              <div>
+                <span>错误事件</span>
+                <strong>{selected.eventCount}</strong>
+              </div>
+              <div>
+                <span>应用日志</span>
+                <strong>{selected.logCount}</strong>
+              </div>
            </div>
+            <div className="admin-error-report-detail__body">
+              <section className="admin-error-report-detail__section">
+                <div className="admin-error-report-detail__section-heading">
+                  <div>
+                    <h3>错误事件</h3>
+                    <span>展示最近 20 条，完整内容请下载诊断包。</span>
+                  </div>
+                  <span className="admin-error-report-detail__count">
+                    {selected.events.length} 条
+                  </span>
+                </div>
+                <div className="admin-error-report-event-list">
+                  {selected.events.length === 0 ? (
+                    <p className="admin-error-report-detail__empty">
+                      归档中没有可展示的错误事件。
+                    </p>
+                  ) : null}
+                  {selected.events.slice(0, 20).map((event, index) => {
+                    const message = eventText(event, 'message') || '未知错误';
+                    const stack = eventText(event, 'stack');
+                    const occurredAt = eventText(event, 'occurredAt');
+                    return (
+                      <article
+                        className="admin-error-report-event"
+                        key={`${index}-${message}`}
+                      >
+                        <div className="admin-error-report-event__topline">
+                          <span className="admin-error-report-event__index">
+                            #{index + 1}
+                          </span>
+                          <span>{eventText(event, 'source') || 'client'}</span>
+                          <span>{eventText(event, 'count') || '1'} 次</span>
+                          <time>{formatAdminTimestamp(occurredAt)}</time>
+                        </div>
+                        <p className="admin-error-report-event__message">
+                          {message}
+                        </p>
+                        {eventText(event, 'fingerprint') ? (
+                          <code>{eventText(event, 'fingerprint')}</code>
+                        ) : null}
+                        {stack ? (
+                          <details>
+                            <summary>查看调用栈</summary>
+                            <pre>{stack}</pre>
+                          </details>
+                        ) : null}
+                      </article>
+                    );
+                  })}
+                </div>
+              </section>
+              {selected.userDescription ? (
+                <section className="admin-error-report-detail__section">
+                  <div className="admin-error-report-detail__section-heading">
+                    <div>
+                      <h3>用户描述</h3>
+                    </div>
+                  </div>
+                  <p className="admin-error-report-detail__description">
+                    {selected.userDescription}
+                  </p>
+                </section>
+              ) : null}
+              <section className="admin-error-report-detail__section admin-error-report-detail__section--note">
+                <label className="admin-detail-modal__note">
+                  <span>处理备注</span>
+                  <textarea
+                    value={selected.note ?? ''}
+                    onChange={(event) =>
+                      setSelected((current) =>
+                        current
+                          ? { ...current, note: event.target.value }
+                          : current,
+                      )
+                    }
+                    maxLength={2000}
+                    rows={4}
+                    placeholder="记录处理结论或后续跟进事项"
+                    disabled={busy}
+                  />
+                </label>
+              </section>
+            </div>
+            <footer className="admin-error-report-detail__footer">
+              <label className="admin-error-report-detail__status-field">
+                状态
+                <select
+                  value={selected.status}
+                  onChange={(event) => void saveStatus(event.target.value)}
+                  disabled={busy}
+                >
+                  {ADMIN_ERROR_REPORT_STATUSES.map((value) => (
+                    <option key={value} value={value}>
+                      {ERROR_REPORT_STATUS_LABELS[value]}
+                    </option>
+                  ))}
+                </select>
+              </label>
+              <div className="admin-error-report-detail__footer-actions">
+                <button
+                  type="button"
+                  onClick={() => void saveStatus(selected.status)}
+                  disabled={busy}
+                >
+                  {busy ? '保存中…' : '保存备注'}
+                </button>
+                <button
+                  type="button"
+                  onClick={() => void download(selected.batchId)}
+                  disabled={downloading}
+                >
+                  {downloading ? '下载中…' : '下载诊断包'}
+                </button>
+              </div>
+            </footer>
          </div>
        </div>
      ) : null}
@@ -1,186 +0,0 @@
-/* @vitest-environment jsdom */
-
-import { fireEvent, render, screen, waitFor } from '@testing-library/react';
-import { beforeEach, expect, test, vi } from 'vitest';
-
-import {
-  listAdminGameDistributionReviews,
-  reviewAdminGameDistributionVersion,
-  suspendAdminGameDistributionGame,
-} from '../api/adminApiClient';
-import type { AdminGameDistributionReviewEntry } from '../api/adminApiTypes';
-import {
-  AdminGameDistributionReviewPage,
-  resolveGameReleaseEntryUrlError,
-} from './AdminGameDistributionReviewPage';
-
-vi.mock('../api/adminApiClient', () => ({
-  isAdminApiError: vi.fn(
-    (error: unknown) =>
-      typeof error === 'object' &&
-      error !== null &&
-      'status' in error &&
-      typeof error.status === 'number',
-  ),
-  formatAdminApiError: vi.fn((error: unknown) =>
-    error instanceof Error ? error.message : '请求失败',
-  ),
-  listAdminGameDistributionReviews: vi.fn(),
-  reviewAdminGameDistributionVersion: vi.fn(),
-  suspendAdminGameDistributionGame: vi.fn(),
-}));
-
-const entry: AdminGameDistributionReviewEntry = {
-  versionId: 'version-1',
-  gameId: 'game_1',
-  versionNumber: 2,
-  packageSha256: 'a'.repeat(64),
-  packageBytes: 2048,
-  status: 'pending_review',
-  publicationRevision: 4,
-  reviewReason: null,
-  createdAt: '2026-09-20T08:00:00Z',
-  updatedAt: '2026-09-20T08:00:00Z',
-};
-
-beforeEach(() => {
-  vi.mocked(listAdminGameDistributionReviews).mockReset();
-  vi.mocked(reviewAdminGameDistributionVersion).mockReset();
-  vi.mocked(suspendAdminGameDistributionGame).mockReset();
-  vi.mocked(listAdminGameDistributionReviews).mockResolvedValue({
-    entries: [entry],
-    nextCursor: null,
-  });
-});
-
-test('发行入口必须是带完整来源的 HTTPS 地址', () => {
-  expect(resolveGameReleaseEntryUrlError('')).toBe('请填写发行入口');
-  expect(
-    resolveGameReleaseEntryUrlError('http://games.test/a/index.html'),
-  ).toBe('发行入口必须以 https:// 开头');
-  expect(
-    resolveGameReleaseEntryUrlError('https://games.test/a/index.html?token=1'),
-  ).toBe('发行入口不能包含 query 或 fragment');
-  expect(
-    resolveGameReleaseEntryUrlError('https://u:p@games.test/a/index.html'),
-  ).toBe('发行入口不能包含凭据');
-  expect(
-    resolveGameReleaseEntryUrlError('https://games.test/a/index.html'),
-  ).toBe('');
-});
-
-test('通过审核时提交当前 publicationRevision 与发行入口并刷新列表', async () => {
-  vi.mocked(reviewAdminGameDistributionVersion).mockResolvedValue({
-    version: { ...entry, status: 'published' },
-    replayed: false,
-  });
-
-  render(
-    <AdminGameDistributionReviewPage
-      token="admin-token"
-      onUnauthorized={vi.fn()}
-    />,
-  );
-  await screen.findByText('game_1');
-
-  fireEvent.change(screen.getByLabelText('发行入口'), {
-    target: { value: 'https://games.test/releases/game_1/index.html' },
-  });
-  fireEvent.click(screen.getByRole('button', { name: '通过' }));
-
-  await waitFor(() =>
-    expect(reviewAdminGameDistributionVersion).toHaveBeenCalledTimes(1),
-  );
-  const [token, versionId, idempotencyKey, payload] =
-    vi.mocked(reviewAdminGameDistributionVersion).mock.calls[0] ?? [];
-  expect(token).toBe('admin-token');
-  expect(versionId).toBe('version-1');
-  expect(String(idempotencyKey)).toContain('version-1');
-  expect(payload).toEqual({
-    decision: 'approve',
-    expectedPublicationRevision: 4,
-    entryUrl: 'https://games.test/releases/game_1/index.html',
-  });
-  await waitFor(() =>
-    expect(vi.mocked(listAdminGameDistributionReviews)).toHaveBeenCalledTimes(
-      2,
-    ),
-  );
-});
-
-test('缺少拒绝理由时不调用审核接口', async () => {
-  render(
-    <AdminGameDistributionReviewPage
-      token="admin-token"
-      onUnauthorized={vi.fn()}
-    />,
-  );
-  await screen.findByText('game_1');
-
-  fireEvent.click(screen.getByRole('button', { name: '拒绝' }));
-
-  expect(await screen.findByText('拒绝审核必须填写理由')).toBeTruthy();
-  expect(reviewAdminGameDistributionVersion).not.toHaveBeenCalled();
-});
-
-test('安全下架需要二次确认，并携带公开修订号与原因', async () => {
-  vi.mocked(suspendAdminGameDistributionGame).mockResolvedValue({
-    game: {
-      id: 'game_1',
-      title: '测试游戏',
-      status: 'suspended',
-      publicationRevision: 5,
-    },
-    replayed: false,
-  });
-
-  render(
-    <AdminGameDistributionReviewPage
-      token="admin-token"
-      onUnauthorized={vi.fn()}
-    />,
-  );
-  await screen.findByText('game_1');
-
-  fireEvent.change(screen.getByLabelText('下架原因'), {
-    target: { value: '盗用素材' },
-  });
-  fireEvent.click(screen.getByRole('button', { name: '安全下架' }));
-
-  // 第一次点击只弹出确认面板，不直接调用后端。
-  expect(suspendAdminGameDistributionGame).not.toHaveBeenCalled();
-  expect(await screen.findByRole('dialog')).toBeTruthy();
-
-  fireEvent.click(screen.getByRole('button', { name: '确认' }));
-
-  await waitFor(() =>
-    expect(suspendAdminGameDistributionGame).toHaveBeenCalledTimes(1),
-  );
-  const [token, gameId, idempotencyKey, payload] =
-    vi.mocked(suspendAdminGameDistributionGame).mock.calls[0] ?? [];
-  expect(token).toBe('admin-token');
-  expect(gameId).toBe('game_1');
-  expect(String(idempotencyKey)).toContain('game_1');
-  expect(payload).toEqual({
-    expectedPublicationRevision: 4,
-    reason: '盗用素材',
-  });
-  expect(await screen.findByText(/已安全下架/u)).toBeTruthy();
-});
-
-test('取消确认时不下架', async () => {
-  render(
-    <AdminGameDistributionReviewPage
-      token="admin-token"
-      onUnauthorized={vi.fn()}
-    />,
-  );
-  await screen.findByText('game_1');
-
-  fireEvent.click(screen.getByRole('button', { name: '安全下架' }));
-  await screen.findByRole('dialog');
-  fireEvent.click(screen.getByRole('button', { name: '取消' }));
-
-  await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull());
-  expect(suspendAdminGameDistributionGame).not.toHaveBeenCalled();
-});
@@ -1,365 +0,0 @@
-import { RefreshCcw } from 'lucide-react';
-import { useCallback, useEffect, useState } from 'react';
-
-import {
-  listAdminGameDistributionReviews,
-  reviewAdminGameDistributionVersion,
-  suspendAdminGameDistributionGame,
-} from '../api/adminApiClient';
-import type { AdminGameDistributionReviewEntry } from '../api/adminApiTypes';
-import { useAdminWriteConfirm } from '../components/useAdminWriteConfirm';
-import { handlePageError } from './pageUtils';
-
-interface AdminGameDistributionReviewPageProps {
-  token: string;
-  onUnauthorized: (message?: string) => void;
-}
-
-function formatBytes(value: number) {
-  if (value >= 1024 * 1024) {
-    return `${(value / (1024 * 1024)).toFixed(1)} MiB`;
-  }
-  if (value >= 1024) {
-    return `${(value / 1024).toFixed(1)} KiB`;
-  }
-  return `${value} B`;
-}
-
-function formatTime(value: string) {
-  const parsed = new Date(value);
-  if (Number.isNaN(parsed.getTime())) return value;
-  return parsed.toLocaleString('zh-CN', { hour12: false });
-}
-
-function createSuspendIdempotencyKey(gameId: string) {
-  const random =
-    typeof crypto !== 'undefined' && 'randomUUID' in crypto
-      ? crypto.randomUUID()
-      : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  return `game-suspend-${gameId}-${random}`.slice(0, 128);
-}
-
-function createReviewIdempotencyKey(versionId: string) {
-  const random =
-    typeof crypto !== 'undefined' && 'randomUUID' in crypto
-      ? crypto.randomUUID()
-      : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  return `game-review-${versionId}-${random}`.slice(0, 128);
-}
-
-export function resolveGameReleaseEntryUrlError(value: string) {
-  const normalized = value.trim();
-  if (!normalized) return '请填写发行入口';
-  if (!normalized.startsWith('https://')) {
-    return '发行入口必须以 https:// 开头';
-  }
-  if (normalized.includes('?') || normalized.includes('#')) {
-    return '发行入口不能包含 query 或 fragment';
-  }
-  try {
-    const parsed = new URL(normalized);
-    if (parsed.username || parsed.password) {
-      return '发行入口不能包含凭据';
-    }
-  } catch {
-    return '发行入口不是合法 URL';
-  }
-  return '';
-}
-
-export function AdminGameDistributionReviewPage({
-  token,
-  onUnauthorized,
-}: AdminGameDistributionReviewPageProps) {
-  const [entries, setEntries] = useState<AdminGameDistributionReviewEntry[]>(
-    [],
-  );
-  const [isLoading, setIsLoading] = useState(false);
-  const [busyVersionId, setBusyVersionId] = useState('');
-  const [errorMessage, setErrorMessage] = useState('');
-  const [statusMessage, setStatusMessage] = useState('');
-  const [entryUrlByVersion, setEntryUrlByVersion] = useState<
-    Record<string, string>
-  >({});
-  const [reasonByVersion, setReasonByVersion] = useState<
-    Record<string, string>
-  >({});
-  const [suspendReasonByGame, setSuspendReasonByGame] = useState<
-    Record<string, string>
-  >({});
-  const [busyGameId, setBusyGameId] = useState('');
-  const writeConfirm = useAdminWriteConfirm();
-
-  const loadReviews = useCallback(async () => {
-    setIsLoading(true);
-    setErrorMessage('');
-    try {
-      const response = await listAdminGameDistributionReviews(token);
-      setEntries(response.entries);
-    } catch (error) {
-      handlePageError(error, onUnauthorized, setErrorMessage);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [token, onUnauthorized]);
-
-  useEffect(() => {
-    void loadReviews();
-  }, [loadReviews]);
-
-  async function submitReview(
-    entry: AdminGameDistributionReviewEntry,
-    decision: 'approve' | 'reject',
-  ) {
-    const entryUrl = (entryUrlByVersion[entry.versionId] ?? '').trim();
-    const reason = (reasonByVersion[entry.versionId] ?? '').trim();
-    if (decision === 'approve') {
-      const invalid = resolveGameReleaseEntryUrlError(entryUrl);
-      if (invalid) {
-        setErrorMessage(invalid);
-        return;
-      }
-    } else if (!reason) {
-      setErrorMessage('拒绝审核必须填写理由');
-      return;
-    }
-    setBusyVersionId(entry.versionId);
-    setErrorMessage('');
-    setStatusMessage('');
-    try {
-      await reviewAdminGameDistributionVersion(
-        token,
-        entry.versionId,
-        createReviewIdempotencyKey(entry.versionId),
-        decision === 'approve'
-          ? {
-              decision,
-              expectedPublicationRevision: entry.publicationRevision,
-              entryUrl,
-            }
-          : {
-              decision,
-              expectedPublicationRevision: entry.publicationRevision,
-              reviewReason: reason,
-            },
-      );
-      setStatusMessage(
-        decision === 'approve'
-          ? `版本 v${entry.versionNumber} 已通过审核`
-          : `版本 v${entry.versionNumber} 已拒绝`,
-      );
-      await loadReviews();
-    } catch (error) {
-      handlePageError(error, onUnauthorized, setErrorMessage);
-    } finally {
-      setBusyVersionId('');
-    }
-  }
-
-  /**
-   * 管理员安全下架：先二次确认，再带当前公开修订号调用后端；并发审核导致修订号变化时
-   * 由服务端返回冲突，前端只提示刷新，不静默重试。
-   */
-  async function suspendGame(entry: AdminGameDistributionReviewEntry) {
-    const reason = (suspendReasonByGame[entry.gameId] ?? '').trim();
-    const confirmed = await writeConfirm.confirmWrite({
-      action: '安全下架游戏',
-      target: `${entry.gameId}（版本 v${entry.versionNumber}）`,
-    });
-    if (!confirmed) return;
-    setBusyGameId(entry.gameId);
-    setErrorMessage('');
-    setStatusMessage('');
-    try {
-      await suspendAdminGameDistributionGame(
-        token,
-        entry.gameId,
-        createSuspendIdempotencyKey(entry.gameId),
-        {
-          expectedPublicationRevision: entry.publicationRevision,
-          ...(reason ? { reason } : {}),
-        },
-      );
-      setStatusMessage(`游戏 ${entry.gameId} 已安全下架，发行入口已关闭`);
-      setSuspendReasonByGame((current) => ({ ...current, [entry.gameId]: '' }));
-      await loadReviews();
-    } catch (error) {
-      handlePageError(error, onUnauthorized, setErrorMessage);
-    } finally {
-      setBusyGameId('');
-    }
-  }
-
-  return (
-    <section className="admin-page admin-page-wide">
-      <div className="admin-page-heading">
-        <h1>游戏审核</h1>
-        <button
-          type="button"
-          className="admin-secondary-button"
-          onClick={() => void loadReviews()}
-          disabled={isLoading}
-        >
-          <RefreshCcw aria-hidden="true" />
-          刷新
-        </button>
-      </div>
-
-      {errorMessage ? (
-        <div className="admin-alert admin-alert-warning" role="alert">
-          {errorMessage}
-        </div>
-      ) : null}
-      {statusMessage ? (
-        <div className="admin-alert admin-alert-success" role="status">
-          {statusMessage}
-        </div>
-      ) : null}
-
-      <div className="admin-panel">
-        <div className="admin-panel-heading">
-          <h2>待审版本</h2>
-          <span className="admin-muted-text">共 {entries.length} 条</span>
-        </div>
-
-        {isLoading ? (
-          <p className="admin-muted-text">正在加载待审版本…</p>
-        ) : null}
-
-        {!isLoading && entries.length === 0 ? (
-          <p className="admin-muted-text">当前没有待审核的游戏版本。</p>
-        ) : null}
-
-        {!isLoading && entries.length > 0 ? (
-          <div className="admin-table-wrap">
-            <table className="admin-table admin-table-wide">
-              <thead>
-                <tr>
-                  <th>游戏</th>
-                  <th>版本</th>
-                  <th>发行包</th>
-                  <th>提交时间</th>
-                  <th>审核</th>
-                </tr>
-              </thead>
-              <tbody>
-                {entries.map((entry) => {
-                  const busy = busyVersionId === entry.versionId;
-                  return (
-                    <tr key={entry.versionId}>
-                      <td>
-                        <code>{entry.gameId}</code>
-                      </td>
-                      <td>
-                        v{entry.versionNumber}
-                        <div className="admin-muted-text">{entry.status}</div>
-                        {entry.reviewReason ? (
-                          <div className="admin-muted-text">
-                            {entry.reviewReason}
-                          </div>
-                        ) : null}
-                      </td>
-                      <td>
-                        {formatBytes(entry.packageBytes)}
-                        <div className="admin-muted-text">
-                          <code>{entry.packageSha256.slice(0, 12)}</code>
-                        </div>
-                      </td>
-                      <td>{formatTime(entry.createdAt)}</td>
-                      <td>
-                        <div className="admin-action-row">
-                          <div className="admin-field">
-                            <label
-                              htmlFor={`game-release-url-${entry.versionId}`}
-                            >
-                              发行入口
-                            </label>
-                            <input
-                              id={`game-release-url-${entry.versionId}`}
-                              value={entryUrlByVersion[entry.versionId] ?? ''}
-                              placeholder="https://"
-                              onChange={(event) =>
-                                setEntryUrlByVersion((current) => ({
-                                  ...current,
-                                  [entry.versionId]: event.target.value,
-                                }))
-                              }
-                              disabled={busy}
-                            />
-                          </div>
-                          <button
-                            type="button"
-                            className="admin-primary-button"
-                            disabled={busy}
-                            onClick={() => void submitReview(entry, 'approve')}
-                          >
-                            通过
-                          </button>
-                          <div className="admin-field">
-                            <label
-                              htmlFor={`game-reject-reason-${entry.versionId}`}
-                            >
-                              拒绝理由
-                            </label>
-                            <input
-                              id={`game-reject-reason-${entry.versionId}`}
-                              value={reasonByVersion[entry.versionId] ?? ''}
-                              onChange={(event) =>
-                                setReasonByVersion((current) => ({
-                                  ...current,
-                                  [entry.versionId]: event.target.value,
-                                }))
-                              }
-                              disabled={busy}
-                            />
-                          </div>
-                          <button
-                            type="button"
-                            className="admin-ghost-button"
-                            disabled={busy}
-                            onClick={() => void submitReview(entry, 'reject')}
-                          >
-                            拒绝
-                          </button>
-                          <div className="admin-field">
-                            <label
-                              htmlFor={`game-suspend-reason-${entry.versionId}`}
-                            >
-                              下架原因
-                            </label>
-                            <input
-                              id={`game-suspend-reason-${entry.versionId}`}
-                              value={suspendReasonByGame[entry.gameId] ?? ''}
-                              onChange={(event) =>
-                                setSuspendReasonByGame((current) => ({
-                                  ...current,
-                                  [entry.gameId]: event.target.value,
-                                }))
-                              }
-                              disabled={busy}
-                            />
-                          </div>
-                          <button
-                            type="button"
-                            className="admin-danger-button"
-                            disabled={busy || busyGameId === entry.gameId}
-                            onClick={() => void suspendGame(entry)}
-                          >
-                            {busyGameId === entry.gameId
-                              ? '正在下架…'
-                              : '安全下架'}
-                          </button>
-                        </div>
-                      </td>
-                    </tr>
-                  );
-                })}
-              </tbody>
-            </table>
-          </div>
-        ) : null}
-      </div>
-      {writeConfirm.confirmDialog}
-    </section>
-  );
-}
@@ -3213,6 +3213,377 @@ button:disabled {
  padding: 12px;
  border-radius: 8px;
 }
+
+.admin-error-report-detail {
+  width: min(980px, 100%);
+  padding: 0;
+  overflow: hidden;
+  border: 1px solid #eadfd6;
+  background: #fffdfb;
+  box-shadow: 0 24px 80px rgb(57 31 18 / 22%);
+}
+
+.admin-error-report-detail__header {
+  align-items: flex-start;
+  padding: 24px 28px 20px;
+  border-bottom: 1px solid #eee2d8;
+  background: linear-gradient(135deg, #fffaf5, #fffdfb 65%);
+}
+
+.admin-error-report-detail__heading {
+  min-width: 0;
+}
+
+.admin-error-report-detail__eyebrow {
+  display: block;
+  margin-bottom: 7px;
+  color: #a4775d;
+  font-size: 12px;
+  font-weight: 750;
+  letter-spacing: 0.08em;
+}
+
+.admin-error-report-detail__heading h2 {
+  margin: 0;
+  overflow-wrap: anywhere;
+  color: #3d2a20;
+  font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
+  font-size: 19px;
+  line-height: 1.35;
+}
+
+.admin-error-report-detail__badges,
+.admin-error-report-detail__footer-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+}
+
+.admin-error-report-detail__badges {
+  margin-top: 12px;
+}
+
+.admin-error-report-detail__badge,
+.admin-error-report-detail__count {
+  display: inline-flex;
+  align-items: center;
+  min-height: 26px;
+  padding: 0 9px;
+  border: 1px solid #eadfd6;
+  border-radius: 999px;
+  color: #785b49;
+  background: #fff;
+  font-size: 12px;
+  font-weight: 700;
+}
+
+.admin-error-report-detail__close {
+  display: inline-flex;
+  width: 34px;
+  height: 34px;
+  align-items: center;
+  justify-content: center;
+  flex: 0 0 auto;
+  border: 1px solid #e5d5c8;
+  border-radius: 9px;
+  color: #765848;
+  background: #fff;
+  font-size: 24px;
+  line-height: 1;
+  cursor: pointer;
+}
+
+.admin-error-report-detail__close:hover,
+.admin-error-report-detail__close:focus-visible {
+  border-color: #b6623f;
+  color: #9b4f31;
+  outline: none;
+}
+
+.admin-error-report-status {
+  display: inline-flex;
+  align-items: center;
+  min-height: 26px;
+  padding: 0 9px;
+  border-radius: 999px;
+  font-size: 12px;
+  font-weight: 750;
+}
+
+.admin-error-report-status.is-new {
+  color: #a14e20;
+  background: #fff0e5;
+}
+
+.admin-error-report-status.is-in-progress {
+  color: #72551b;
+  background: #fff7d9;
+}
+
+.admin-error-report-status.is-resolved {
+  color: #28704d;
+  background: #e9f7ee;
+}
+
+.admin-error-report-detail__summary {
+  display: grid;
+  grid-template-columns: minmax(0, 1.7fr) repeat(3, minmax(100px, 1fr));
+  gap: 1px;
+  border-bottom: 1px solid #eee2d8;
+  background: #eee2d8;
+}
+
+.admin-error-report-detail__summary > div {
+  display: grid;
+  min-width: 0;
+  gap: 5px;
+  padding: 14px 18px;
+  background: #fffdfb;
+}
+
+.admin-error-report-detail__summary span,
+.admin-error-report-detail__section-heading span,
+.admin-error-report-detail__status-field {
+  color: #997d6a;
+  font-size: 12px;
+  font-weight: 650;
+}
+
+.admin-error-report-detail__summary strong {
+  overflow-wrap: anywhere;
+  color: #4d3326;
+  font-size: 13px;
+}
+
+.admin-error-report-detail__body {
+  display: grid;
+  gap: 16px;
+  max-height: min(62vh, 640px);
+  overflow: auto;
+  padding: 20px 28px;
+}
+
+.admin-error-report-detail__section {
+  display: grid;
+  gap: 12px;
+}
+
+.admin-error-report-detail__section-heading {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+}
+
+.admin-error-report-detail__section-heading h3 {
+  margin: 0 0 4px;
+  color: #4d3326;
+  font-size: 15px;
+}
+
+.admin-error-report-detail__section-heading span {
+  line-height: 1.5;
+}
+
+.admin-error-report-detail__count {
+  flex: 0 0 auto;
+}
+
+.admin-error-report-event-list {
+  display: grid;
+  gap: 10px;
+}
+
+.admin-error-report-detail__empty {
+  margin: 0;
+  padding: 16px;
+  border: 1px dashed #e4d2c5;
+  border-radius: 10px;
+  color: #997d6a;
+  background: #fffaf6;
+  text-align: center;
+}
+
+.admin-error-report-event {
+  display: grid;
+  gap: 9px;
+  padding: 14px 16px;
+  border: 1px solid #eee2d8;
+  border-radius: 12px;
+  background: #fff;
+}
+
+.admin-error-report-event__topline {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  color: #927663;
+  font-size: 12px;
+}
+
+.admin-error-report-event__topline time {
+  margin-left: auto;
+  color: #aa9282;
+}
+
+.admin-error-report-event__index {
+  color: #b6623f;
+  font-weight: 750;
+}
+
+.admin-error-report-event__message {
+  margin: 0;
+  color: #4a3024;
+  font-size: 14px;
+  line-height: 1.55;
+  overflow-wrap: anywhere;
+}
+
+.admin-error-report-event code {
+  overflow-wrap: anywhere;
+  color: #957a69;
+  font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
+  font-size: 11px;
+}
+
+.admin-error-report-event details {
+  border-top: 1px solid #f0e7df;
+  padding-top: 9px;
+}
+
+.admin-error-report-event summary {
+  color: #a15d3e;
+  font-size: 12px;
+  font-weight: 700;
+  cursor: pointer;
+}
+
+.admin-error-report-event pre {
+  max-height: 180px;
+  margin: 9px 0 0;
+  padding: 10px;
+  border: 1px solid #f0e7df;
+  background: #fffaf6;
+  color: #72594a;
+  font-size: 11px;
+  line-height: 1.5;
+}
+
+.admin-error-report-detail__description {
+  margin: 0;
+  padding: 13px 15px;
+  border-radius: 10px;
+  color: #634b3c;
+  background: #fff8f2;
+  line-height: 1.6;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+
+.admin-error-report-detail__section--note {
+  padding-top: 4px;
+}
+
+.admin-error-report-detail__section--note .admin-detail-modal__note {
+  display: grid;
+  gap: 8px;
+  color: #624938;
+  font-size: 13px;
+  font-weight: 700;
+}
+
+.admin-error-report-detail__section--note textarea {
+  width: 100%;
+  min-height: 100px;
+  box-sizing: border-box;
+  resize: vertical;
+  border: 1px solid #e4d2c5;
+  border-radius: 10px;
+  padding: 11px 12px;
+  color: #4d3326;
+  background: #fff;
+  font: inherit;
+  line-height: 1.5;
+}
+
+.admin-error-report-detail__section--note textarea:focus {
+  border-color: #b6623f;
+  box-shadow: 0 0 0 3px rgb(182 98 63 / 14%);
+  outline: none;
+}
+
+.admin-error-report-detail__footer {
+  display: flex;
+  align-items: flex-end;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 16px 28px 20px;
+  border-top: 1px solid #eee2d8;
+  background: #fffaf6;
+}
+
+.admin-error-report-detail__status-field {
+  display: grid;
+  gap: 6px;
+}
+
+.admin-error-report-detail__status-field select {
+  min-width: 132px;
+  min-height: 38px;
+  border: 1px solid #e4d2c5;
+  border-radius: 8px;
+  padding: 0 10px;
+  color: #4d3326;
+  background: #fff;
+  font: inherit;
+}
+
+.admin-error-report-detail__footer-actions button {
+  min-height: 38px;
+  border: 1px solid #d9c3b4;
+  border-radius: 8px;
+  padding: 0 13px;
+  color: #6d4b3a;
+  background: #fff;
+  font-weight: 700;
+  cursor: pointer;
+}
+
+.admin-error-report-detail__footer-actions button:last-child {
+  border-color: #a96442;
+  color: #fff;
+  background: #a96442;
+}
+
+.admin-error-report-detail__footer-actions button:hover,
+.admin-error-report-detail__footer-actions button:focus-visible {
+  border-color: #a96442;
+  outline: none;
+}
+
+@media (max-width: 720px) {
+  .admin-error-report-detail__header,
+  .admin-error-report-detail__body,
+  .admin-error-report-detail__footer {
+    padding-right: 18px;
+    padding-left: 18px;
+  }
+
+  .admin-error-report-detail__summary {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .admin-error-report-detail__footer {
+    align-items: stretch;
+    flex-direction: column;
+  }
+
+  .admin-error-report-detail__footer-actions button {
+    flex: 1;
+  }
+}
 .admin-agc-models {
  min-width: 0;
 }
@@ -66,15 +66,15 @@
    "zustand": "^5.0.14"
  },
  "devDependencies": {
-    "@openai/codex": "0.147.0",
+    "@openai/codex": "0.155.1",
    "@tailwindcss/vite": "^4.1.14",
    "@tauri-apps/cli": "^2.11.2",
    "@testing-library/react": "^16.3.2",
    "@testing-library/user-event": "^14.6.1",
    "@types/react": "^19.2.14",
    "@types/react-dom": "^19.2.3",
-    "@types/three": "^0.184.1",
    "@types/react-window": "^1.8.8",
+    "@types/three": "^0.184.1",
    "tailwindcss": "^4.1.14",
    "typescript": "~5.8.2",
    "vitest": "^0.34.6"
@@ -0,0 +1,280 @@
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  generateUpdateManifest,
+  prepareReleaseVersion,
+  resolveReleaseContext,
+  resolveReleasePartition,
+  runTauriBuild,
+} from './build-release.mjs';
+import { readReleaseDryRun, uploadReleaseArtifacts } from './release-oss.mjs';
+import {
+  readUpdaterPubkey,
+  verifyUpdaterSignature,
+} from './verify-updater-signature.mjs';
+
+/**
+ * AGC macOS 分区（`<channel>-mac`）发布入口：构建 universal 包 → 双架构 smoke → 生成 universal DMG
+ * → 生成分区清单 latest.json → 用产物内烘焙的公钥验签 → 按 dry-run 决定是否上传 OSS。
+ *
+ * 边界：
+ * - Apple 签名与公证暂缺：本入口剥离 `APPLE_*` 凭据让 Tauri 跳过 Apple 签名，但**不能传
+ *   `--no-sign`** —— 该标志同时会跳过 updater 的 minisign 签名，产物就没有 `.sig`；
+ *   未签名 + 未公证必须显式记录而非静默通过；
+ * - 更新包签名（TAURI_SIGNING_PRIVATE_KEY，minisign）是硬需求：缺了客户端一律拒绝安装，
+ *   因此构建前要求凭据存在，构建后用内置公钥复核 `.sig` 才允许继续上传；
+ * - 未通过验签绝不写 OSS：上传顺序为更新包、签名、首装包，全部成功后才覆盖渠道清单指针。
+ */
+const appRoot = fileURLToPath(new URL('..', import.meta.url));
+const repoRoot = path.resolve(appRoot, '../..');
+
+/**
+ * 产品名只从 Tauri 配置读取：它同时决定 `*.app` 目录名、updater 归档名与 DMG 卷名。
+ * 写死会在改名后让入口静默找错对象（清理、打包、归档三处一起失效）。
+ */
+function readProductName() {
+  const read = (file) =>
+    JSON.parse(fs.readFileSync(path.join(appRoot, 'src-tauri', file), 'utf8'));
+  const base = read('tauri.conf.json');
+  const macosPath = path.join(appRoot, 'src-tauri', 'tauri.macos.conf.json');
+  const productName = fs.existsSync(macosPath)
+    ? (read('tauri.macos.conf.json').productName ?? base.productName)
+    : base.productName;
+  assert.ok(
+    typeof productName === 'string' && productName.trim().length > 0,
+    'Tauri 配置缺少 productName',
+  );
+  return productName;
+}
+
+const productName = readProductName();
+const appBundleName = `${productName}.app`;
+const updaterArtifactName = `${productName}.app.tar.gz`;
+assert.equal(process.platform, 'darwin', '只能在 macOS Agent 执行');
+assert.equal(
+  process.env.JENKINS_URL?.length > 0,
+  true,
+  '此入口仅用于 Jenkins 独立工作区',
+);
+assert.equal(
+  fs.realpathSync(process.env.WORKSPACE || '.'),
+  fs.realpathSync(repoRoot),
+  '必须在 Jenkins workspace 根目录执行',
+);
+const space = fs.statfsSync(repoRoot);
+assert.ok(
+  space.bavail * space.bsize >= 8 * 1024 ** 3,
+  '构建前至少需要 8 GiB 可用空间；禁止自动清理开发缓存',
+);
+
+// 仅剥离 Apple 签名/公证变量：本节点没有证书，误用只会让构建失败；
+// 更新包签名与 OSS 凭据必须保留，它们是本入口发布能力的组成部分。
+for (const key of Object.keys(process.env)) {
+  if (/^APPLE_/u.test(key)) delete process.env[key];
+}
+assert.ok(
+  process.env.TAURI_SIGNING_PRIVATE_KEY?.length > 0 ||
+    process.env.TAURI_SIGNING_PRIVATE_KEY_PATH?.length > 0,
+  '缺少更新包签名私钥（TAURI_SIGNING_PRIVATE_KEY / _PATH）：无签名的更新包会被客户端拒绝，禁止继续',
+);
+
+const bucket = process.env.AGC_OSS_BUCKET?.trim() || 'agc-dev';
+const endpoint =
+  process.env.AGC_OSS_ENDPOINT?.trim() || 'oss-rg-china-mainland.aliyuncs.com';
+if (!/^[a-z0-9][a-z0-9.-]{1,62}$/u.test(bucket) || /[\r\n\0]/u.test(endpoint)) {
+  throw new Error('OSS bucket 或 endpoint 配置无效');
+}
+process.env.AGC_UPDATE_OSS_BASE_URL ||= `https://${bucket}.${endpoint}/agc`;
+const dryRun = readReleaseDryRun();
+
+process.env.CARGO_TARGET_DIR = path.join(appRoot, 'src-tauri/target');
+const context = resolveReleaseContext(['--target=universal-apple-darwin']);
+const partition = resolveReleasePartition(context.channel, context.target);
+const version = await prepareReleaseVersion(context);
+// 首装包名必须保持 `<产品名>_<版本>_universal.dmg`：清单侧按该后缀唯一匹配本次产物。
+const firstInstallName = `${productName}_${version}_universal.dmg`;
+
+// 幂等边界：workspace 会保留上一轮产物。先删掉本次将要写出的对象，否则
+//  1) hdiutil 会因同名 DMG 已存在直接失败（首次实跑即命中）；
+//  2) 上一轮遗留的 `.sig` 会让验签门禁把「本轮其实没签」判成通过。
+// 只删本次要写出的确切路径，不动其它版本产物与编译缓存。
+const macosBundle = path.join(context.bundleRoot, 'macos');
+for (const stale of [
+  path.join(macosBundle, updaterArtifactName),
+  path.join(macosBundle, `${updaterArtifactName}.sig`),
+  path.join(macosBundle, `${firstInstallName}`),
+  path.join(macosBundle, `${firstInstallName}.sha256`),
+  path.join(context.bundleRoot, 'latest.json'),
+  path.join(context.bundleRoot, 'release-notes.txt'),
+]) {
+  fs.rmSync(stale, { force: true });
+}
+
+const args = [
+  '--target=universal-apple-darwin',
+  '--bundles',
+  'app',
+  '--ci',
+  // 刻意不传 `--no-sign`：它会连带跳过 updater 签名，而客户端强制校验更新包签名。
+  // Apple 侧改为剥离 APPLE_* 凭据，未配置身份时 Tauri 不签名也不失败。
+  // 基础配置已开启；这里显式声明，避免被其它配置来源关掉后静默失去更新能力。
+  '--config',
+  '{"bundle":{"createUpdaterArtifacts":true}}',
+];
+const command = (binary, argv, options = {}) =>
+  execFileSync(binary, argv, { cwd: repoRoot, stdio: 'inherit', ...options });
+runTauriBuild(args, context);
+
+const app = path.join(context.bundleRoot, 'macos', appBundleName);
+for (const architecture of ['arm64', 'x86_64']) {
+  command(process.execPath, [
+    path.join(appRoot, 'scripts/check-macos-bundle.mjs'),
+    app,
+    architecture,
+    '--universal',
+  ]);
+}
+
+// DMG 放在 bundle 根目录下：渠道清单的首装包选择会扫描该目录，命名必须匹配 `_<version>_universal.dmg`。
+const dmgDirectory = path.join(context.bundleRoot, 'macos');
+fs.mkdirSync(dmgDirectory, { recursive: true });
+const dmg = path.join(dmgDirectory, firstInstallName);
+const stage = fs.mkdtempSync(path.join(os.tmpdir(), 'agc-ci-dmg-'));
+try {
+  command('ditto', [app, path.join(stage, appBundleName)]);
+  fs.symlinkSync('/Applications', path.join(stage, 'Applications'));
+  command('hdiutil', [
+    'create',
+    // 前面已删除同名对象；这里再要求显式覆盖，避免残留文件让构建以「文件已存在」失败。
+    '-ov',
+    '-volname',
+    productName,
+    '-srcfolder',
+    stage,
+    '-format',
+    'UDZO',
+    dmg,
+  ]);
+  command('hdiutil', ['verify', dmg]);
+} finally {
+  fs.rmSync(stage, { recursive: true, force: true });
+}
+
+const release = await generateUpdateManifest(context);
+assert.equal(
+  path.resolve(release.downloadArtifact),
+  path.resolve(dmg),
+  '首装包必须锁定本次生成的 universal DMG',
+);
+
+// 上传前门禁：用产物里烘焙的公钥复核更新包签名。验不过就停在这里，绝不写 OSS。
+const signature = verifyUpdaterSignature({
+  artifactPath: release.artifact,
+  signaturePath: `${release.artifact}.sig`,
+  pubkey: readUpdaterPubkey(),
+});
+console.log(
+  `[agc-macos] 更新包签名校验通过：alg=${signature.algorithm}，keyId=${signature.keyId}`,
+);
+
+const artifacts = path.join(repoRoot, 'artifacts');
+// 只清理本 Job 的归档输出，不能把上次 DMG 当成本次成功产物。
+fs.rmSync(artifacts, { recursive: true, force: true });
+fs.mkdirSync(artifacts, { recursive: true });
+const sha256 = (file) => {
+  const hash = createHash('sha256');
+  hash.update(fs.readFileSync(file));
+  return hash.digest('hex');
+};
+const dmgHash = sha256(dmg);
+fs.writeFileSync(`${dmg}.sha256`, `${dmgHash}  ${path.basename(dmg)}\n`);
+
+const uploadPlan = uploadReleaseArtifacts(release, {
+  bucket,
+  endpoint,
+  binary: process.env.OSSUTIL_BIN?.trim() || 'ossutil',
+  accessKeyId: process.env.AGC_OSS_ACCESS_KEY_ID?.trim(),
+  accessKeySecret: process.env.AGC_OSS_ACCESS_KEY_SECRET,
+  dryRun,
+});
+
+const archived = [
+  dmg,
+  `${dmg}.sha256`,
+  release.manifestPath,
+  release.notesPath,
+  `${release.artifact}.sig`,
+];
+for (const file of archived) {
+  fs.copyFileSync(file, path.join(artifacts, path.basename(file)));
+}
+
+const commit = execFileSync('git', ['rev-parse', 'HEAD'], {
+  cwd: repoRoot,
+  encoding: 'utf8',
+}).trim();
+// Apple 签名状态必须实测：剥离 APPLE_* 后 Tauri 通常跳过签名，但节点若装了 Developer ID
+// 证书仍可能签上，硬编码 appleSigned=false 会把「其实签了」写成假事实。
+const signatureProbe = spawnSync('codesign', ['-dv', '--verbose=2', app], {
+  encoding: 'utf8',
+});
+const signatureText = `${signatureProbe.stdout ?? ''}${signatureProbe.stderr ?? ''}`;
+const appleSigned = /Authority=Developer ID Application/u.test(signatureText);
+const appleSignatureKind = appleSigned
+  ? 'developer-id'
+  : /Signature=adhoc/u.test(signatureText)
+    ? 'adhoc'
+    : 'unsigned';
+fs.writeFileSync(
+  path.join(artifacts, 'build-manifest.json'),
+  `${JSON.stringify(
+    {
+      version,
+      commit,
+      target: context.target,
+      channel: context.channel,
+      // Apple 签名与公证暂缺：显式记录为未验证项，不静默通过。
+      appleSigned,
+      appleSignatureKind,
+      notarized: false,
+      dryRun,
+      uploaded: !dryRun,
+      updaterSignature: {
+        algorithm: signature.algorithm,
+        keyId: signature.keyId,
+        verified: true,
+      },
+      oss: {
+        bucket,
+        endpoint,
+        partition,
+        latest: `oss://${bucket}/agc/${partition}/latest.json`,
+        objects: uploadPlan.map(({ destination }) => destination),
+      },
+      artifacts: {
+        updater: path.basename(release.artifact),
+        updaterSha256: sha256(release.artifact),
+        updaterBytes: fs.statSync(release.artifact).size,
+        updaterSignature: path.basename(`${release.artifact}.sig`),
+        firstInstall: path.basename(dmg),
+        firstInstallSha256: dmgHash,
+        manifest: 'latest.json',
+      },
+      smokes: ['arm64', 'x86_64'],
+      intelSmoke: process.arch === 'arm64' ? 'Rosetta' : 'native',
+    },
+    null,
+    2,
+  )}\n`,
+);
+console.log(
+  dryRun
+    ? `[agc-macos] dry-run 完成：${partition} 分区产物与清单已生成，未写入 OSS`
+    : `[agc-macos] ${partition} 分区更新包、签名、首装包与清单已上传 OSS`,
+);
@@ -13,6 +13,7 @@ import {
  defaultEditorFeatures,
  withDefaultCargoFeatures,
 } from './cargo-features.mjs';
+import { stageNodeRuntime } from './stage-node-runtime.mjs';

 const appRoot = fileURLToPath(new URL('..', import.meta.url));
 // 提交摘要里的 pathspec 与 `git log` 都以仓库根为基准，不能在应用目录里执行。
@@ -46,16 +47,12 @@ function explicitBuildTarget(args) {
 }

 function validateReleaseTarget(target) {
-  if (target === 'universal-apple-darwin') {
-    throw new Error(
-      '内置 Codex 资源仅支持 macOS 单架构构建，请使用 aarch64-apple-darwin 或 x86_64-apple-darwin',
-    );
-  }
  if (
    ![
      'x86_64-pc-windows-msvc',
      'aarch64-apple-darwin',
      'x86_64-apple-darwin',
+      'universal-apple-darwin',
    ].includes(target)
  ) {
    throw new Error(`不支持的发布目标：${target}`);
@@ -200,10 +197,12 @@ export function updateManifestUrl(
 }

 /**
- * 单架构产物只登记实际目标，不能把同一原生资源映射为另一架构。
+ * universal 主程序与双目录原生资源共用一个更新包；单架构只登记实际目标。
 */
 export function resolveManifestPlatformKeys(target = defaultTarget()) {
  validateReleaseTarget(target);
+  if (target === 'universal-apple-darwin')
+    return ['darwin-aarch64', 'darwin-x86_64'];
  if (target === 'aarch64-apple-darwin') return ['darwin-aarch64'];
  if (target === 'x86_64-apple-darwin') return ['darwin-x86_64'];
  if (target.includes('windows')) {
@@ -442,22 +441,25 @@ export function createChannelConfig(
  };
 }

-function writeChannelConfigFile(channel, target) {
+function writeChannelConfigFile(channel, target, includeNodeRuntime = false) {
  const configPath = path.join(
    os.tmpdir(),
    `agc-tauri-channel-${channel}-${target}.json`,
  );
-  fs.writeFileSync(
-    configPath,
-    `${JSON.stringify(createChannelConfig(channel, target), null, 2)}\n`,
-  );
+  const config = createChannelConfig(channel, target);
+  // 普通 cargo test/dev 不要求发行资源；只有完成 staging 的发行构建加入映射。
+  if (includeNodeRuntime)
+    config.bundle = {
+      resources: { 'resources/node-runtime': 'game-runtime/node' },
+    };
+  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
  return configPath;
 }

 export function runTauriBuild(
  args = [],
  context = resolveReleaseContext(args),
-  { spawn = spawnSync } = {},
+  { spawn = spawnSync, stageRuntime = stageNodeRuntime } = {},
 ) {
  if (
    explicitBuildTarget(args) &&
@@ -467,7 +469,12 @@ export function runTauriBuild(
  }
  const tauriArguments = buildTauriBuildArguments(args, context.target);
  const { channel, target } = context;
-  const configPath = writeChannelConfigFile(channel, target);
+  if (!args.includes('--no-bundle')) stageRuntime(target);
+  const configPath = writeChannelConfigFile(
+    channel,
+    target,
+    !args.includes('--no-bundle'),
+  );
  console.log(
    `[ai-game-creator-shell] 渠道 ${channel} 端点配置：${configPath}`,
  );
@@ -483,7 +490,17 @@ export function runTauriBuild(
  const result = spawn(
    npmCommand,
    ['--prefix', '../..', 'exec', 'tauri', '--', ...tauriArguments],
-    { cwd: appRoot, stdio: 'inherit', shell: process.platform === 'win32' },
+    {
+      cwd: appRoot,
+      stdio: 'inherit',
+      shell: process.platform === 'win32',
+      env: {
+        ...process.env,
+        // Vite embeds the platform API origin in the packaged renderer. The
+        // release channel and updater channel therefore cannot drift apart.
+        VITE_AGC_PLATFORM_CHANNEL: channel,
+      },
+    },
  );
  if (result.error) throw result.error;
  if (result.status !== 0) process.exit(result.status ?? 1);
@@ -543,6 +560,18 @@ export function selectFirstInstallArtifact(
    if (!selected?.endsWith('.exe')) {
      throw new Error('Windows 首装包必须复用本次 NSIS .exe 更新包');
    }
+  } else if (target === 'universal-apple-darwin') {
+    // universal 主程序只产出一个 DMG，aarch64 与 x86_64 首装共用它（命名见 build-macos-ci.mjs）。
+    const suffix = `_${version}_universal.dmg`;
+    const candidates = files.filter((file) =>
+      path.basename(file).endsWith(suffix),
+    );
+    if (candidates.length !== 1) {
+      throw new Error(
+        `首装 DMG 必须唯一匹配本次版本 ${version} 的 universal 产物，找到 ${candidates.length} 个`,
+      );
+    }
+    selected = candidates[0];
  } else {
    // Tauri DMG 文件名使用 aarch64 / x64，而 updater 的 Intel 平台键是 x86_64。
    const architecture = target.startsWith('aarch64') ? 'aarch64' : 'x64';
@@ -45,19 +45,22 @@ const packageVersion = JSON.parse(
 ).version;

 function createDmgFixture(root, target, version = packageVersion) {
-  const architecture = target.startsWith('aarch64') ? 'aarch64' : 'x64';
+  const architecture = target.startsWith('aarch64')
+    ? 'aarch64'
+    : target === universalTarget
+      ? 'universal'
+      : 'x64';
  const dmg = path.join(root, `陶泥儿_${version}_${architecture}.dmg`);
  writeFileSync(dmg, 'first installation disk image');
  return dmg;
 }

-test('native sidecar builds reject universal targets and accept each macOS architecture', () => {
-  assert.throws(() => buildTauriBuildArguments([], universalTarget), /单架构/);
-  assert.throws(
-    () => buildTauriBuildArguments(['--target=universal-apple-darwin']),
-    /单架构/,
-  );
-  for (const target of ['aarch64-apple-darwin', 'x86_64-apple-darwin']) {
+test('native sidecar builds accept universal and each macOS architecture', () => {
+  for (const target of [
+    universalTarget,
+    'aarch64-apple-darwin',
+    'x86_64-apple-darwin',
+  ]) {
    assert.deepEqual(buildTauriBuildArguments([], target), [
      'build',
      '--target',
@@ -201,8 +204,26 @@ test('channel manifest URL and build-time endpoint follow the channel', () => {
  });
 });

-test('macOS manifests only advertise the architecture actually built', () => {
-  assert.throws(() => resolveManifestPlatformKeys(universalTarget), /单架构/);
+test('packaged renderer receives the same channel as the updater manifest', () => {
+  const context = resolveReleaseContext([], {
+    AGC_BUILD_TARGET: windowsTarget,
+    AGC_UPDATE_CHANNEL: 'release',
+  });
+  let spawnOptions;
+  runTauriBuild([], context, {
+    spawn: (_binary, _args, options) => {
+      spawnOptions = options;
+      return { status: 0 };
+    },
+  });
+  assert.equal(spawnOptions?.env?.VITE_AGC_PLATFORM_CHANNEL, 'release');
+});
+
+test('macOS manifests advertise exactly the architectures actually built', () => {
+  assert.deepEqual(resolveManifestPlatformKeys(universalTarget), [
+    'darwin-aarch64',
+    'darwin-x86_64',
+  ]);
  assert.deepEqual(resolveManifestPlatformKeys('aarch64-apple-darwin'), [
    'darwin-aarch64',
  ]);
@@ -246,7 +267,6 @@ test('release context resolves explicit targets before environment/default and f
    ['--target='],
    ['--target', '--no-bundle'],
    ['--target', windowsTarget, '--target=aarch64-apple-darwin'],
-    ['--target', universalTarget],
    ['--target', 'unknown'],
  ])
    assert.throws(() => resolveReleaseContext(args, {}));
@@ -279,6 +299,7 @@ test('explicit macOS target drives version lookup, Tauri endpoint, artifact and
            build: (args, context) => {
              seenContexts.push(context);
              runTauriBuild(args, context, {
+                stageRuntime: () => {},
                spawn: (_binary, command) => {
                  const configIndex = command.lastIndexOf('--config');
                  const config = JSON.parse(
@@ -461,8 +482,8 @@ test('invalid target or platform used as channel fails before any release side e
    },
  };
  await assert.rejects(
-    () => buildRelease(['--target', universalTarget], sideEffects),
-    /单架构/,
+    () => buildRelease(['--target', 'unknown'], sideEffects),
+    /不支持的发布目标/,
  );
  await withEnv({ AGC_UPDATE_CHANNEL: 'dev-win' }, () =>
    assert.rejects(
@@ -473,6 +494,43 @@ test('invalid target or platform used as channel fails before any release side e
  assert.equal(touched, false);
 });

+test('universal uses the Mac channel and the same signed artifact for both architectures', () => {
+  const context = resolveReleaseContext(['--target', universalTarget], {
+    AGC_BUILD_TARGET: windowsTarget,
+  });
+  // 渠道本身不含系统：分区由渠道 + 目标推导，二者不能混为一谈。
+  assert.equal(context.channel, 'dev');
+  assert.equal(
+    resolveReleasePartition(context.channel, context.target),
+    'dev-mac',
+  );
+  assert.ok(context.bundleRoot.includes(universalTarget));
+  withSignedArtifact('陶泥儿.app.tar.gz', (artifact) => {
+    const manifest = createUpdateManifest(artifact, {
+      ...context,
+      downloadArtifact: createDmgFixture(
+        path.dirname(artifact),
+        universalTarget,
+      ),
+    });
+    assert.deepEqual(Object.keys(manifest.platforms), [
+      'darwin-aarch64',
+      'darwin-x86_64',
+    ]);
+    assert.deepEqual(
+      manifest.platforms['darwin-aarch64'],
+      manifest.platforms['darwin-x86_64'],
+    );
+    assert.match(manifest.platforms['darwin-aarch64'].url, /\/dev-mac\//);
+    // 两个平台键共用同一个 universal 首装包，不能要求出两份架构 DMG。
+    assert.deepEqual(
+      manifest.downloads['darwin-aarch64'].url,
+      manifest.downloads['darwin-x86_64'].url,
+    );
+    assert.match(manifest.downloads['darwin-aarch64'].url, /_universal\.dmg$/u);
+  });
+});
+
 test('Windows remains the default and explicit Windows overrides macOS environment', () => {
  const files = ['/tmp/mac.app.tar.gz', '/tmp/windows.exe', '/tmp/mac.dmg'];
  for (const context of [
@@ -490,6 +548,7 @@ test('Windows remains the default and explicit Windows overrides macOS environme
      ['--target', windowsTarget, '--config', 'user-config.json'],
      context,
      {
+        stageRuntime: () => {},
        spawn: (_binary, command) => {
          assert.ok(
            command.includes(
@@ -528,6 +587,52 @@ test('no-bundle smoke skips version writes and manifest generation', async () =>
  assert.deepEqual(steps, ['dev']);
 });

+test('release stages Node before Tauri and injects its resource mapping only for bundles', () => {
+  const context = resolveReleaseContext(['--target', windowsTarget]);
+  const events = [];
+  runTauriBuild(['--target', windowsTarget], context, {
+    stageRuntime(target) {
+      assert.equal(target, windowsTarget);
+      events.push('stage');
+    },
+    spawn(_binary, args) {
+      events.push('build');
+      const config = JSON.parse(
+        readFileSync(args[args.lastIndexOf('--config') + 1], 'utf8'),
+      );
+      assert.deepEqual(config.bundle.resources, {
+        'resources/node-runtime': 'game-runtime/node',
+      });
+      return { status: 0 };
+    },
+  });
+  assert.deepEqual(events, ['stage', 'build']);
+  runTauriBuild(['--no-bundle', '--target', windowsTarget], context, {
+    stageRuntime() {
+      assert.fail('no-bundle must not stage resources');
+    },
+    spawn(_binary, args) {
+      const config = JSON.parse(
+        readFileSync(args[args.lastIndexOf('--config') + 1], 'utf8'),
+      );
+      assert.equal(config.bundle, undefined);
+      return { status: 0 };
+    },
+  });
+  assert.throws(
+    () =>
+      runTauriBuild(['--target', windowsTarget], context, {
+        stageRuntime() {
+          throw new Error('missing runtime');
+        },
+        spawn() {
+          assert.fail('invalid runtime must prevent build');
+        },
+      }),
+    /missing runtime/,
+  );
+});
+
 test('channel manifest carries version, platform keys and signature', () => {
  withSignedArtifact('陶泥儿_0.1.48_x64-setup.exe', (artifact) => {
    withEnv({ AGC_UPDATE_RELEASE_NOTES: '修复与改进' }, () => {
@@ -631,6 +736,7 @@ for (const channel of ['release', 'beta-2']) {
              '2.3.4',
            );
            runTauriBuild([`--target=${target}`], context, {
+              stageRuntime: () => {},
              spawn: (_binary, command) => {
                const config = JSON.parse(
                  readFileSync(
@@ -4,9 +4,25 @@ import { EventEmitter } from 'node:events';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';

 import ts from 'typescript';

+// 固定解析源码保留上游测试中的替换字符；必须同时核对原始字节与许可。
+execFileSync(
+  process.execPath,
+  [
+    '--test',
+    fileURLToPath(
+      new URL(
+        '../src-tauri/vendor/codex-patch-parser/upstream-integrity.test.mjs',
+        import.meta.url,
+      ),
+    ),
+  ],
+  { stdio: 'inherit' },
+);
+
 import {
  appIdentifier,
  defaultRealSwarmTestTask,
@@ -1313,6 +1329,18 @@ if (tauriConfig.identifier !== 'world.genarrative.ai-game-creator') {

 const expectedBundledDesignAgentResources = {
  'design-agent': 'design-agent',
+  ...Object.fromEntries(
+    [
+      'codex-patch-parser',
+      'codex-utils-path-uri',
+      'codex-utils-absolute-path',
+    ].flatMap((name) =>
+      ['LICENSE', 'NOTICE'].map((file) => [
+        `vendor/${name}/${file}`,
+        `licenses/${name}/${file}`,
+      ]),
+    ),
+  ),
 };
 const expectedBundledWindowsResources = {
  'resources/codex/win-x64/bin/codex.exe': 'coding-agent/win-x64/bin/codex.exe',
@@ -1336,7 +1364,7 @@ assert.deepEqual(
  'AI game creator shell base Tauri config must bundle the design-agent resource pack',
 );
 for (const key of Object.keys(tauriConfig.bundle?.resources ?? {})) {
-  if (String(key).includes('codex')) {
+  if (String(key).startsWith('resources/codex/')) {
    throw new Error(
      'AI game creator shell base Tauri config must not require Windows-only Codex resources',
    );
@@ -1365,18 +1393,20 @@ if (windowsTauriConfig.bundle?.useLocalToolsDir !== true) {
 assert.deepEqual(
  macosTauriConfig.bundle?.resources,
  Object.fromEntries([
-    ...[
-      'bin/codex',
-      'bin/codex-code-mode-host',
-      'codex-path/rg',
-      'codex-resources/zsh/bin/zsh',
-      'codex-package.json',
-      'NOTICE.md',
-      'manifest.json',
-    ].map((file) => [
-      `resources/codex/mac-native/${file}`,
-      `coding-agent/mac-native/${file}`,
-    ]),
+    ...['darwin-arm64', 'darwin-x64'].flatMap((arch) =>
+      [
+        'bin/codex',
+        'bin/codex-code-mode-host',
+        'codex-path/rg',
+        'codex-resources/zsh/bin/zsh',
+        'codex-package.json',
+        'NOTICE.md',
+        'manifest.json',
+      ].map((file) => [
+        `resources/codex/mac-native/${arch}/${file}`,
+        `coding-agent/mac-native/${arch}/${file}`,
+      ]),
+    ),
    ['resources/plugins', 'plugins'],
  ]),
  'macOS must bundle the complete native Codex layout and plugin workspace',
@@ -8,6 +8,13 @@ import path from 'node:path';
 // 只操作临时复制品；不启动 GUI、不读取开发机凭据、不访问 Provider。
 assert.equal(process.platform, 'darwin', '此验证必须在 macOS 执行');
 const source = path.resolve(process.argv[2] || '');
+const architecture =
+  process.argv[3] || (process.arch === 'arm64' ? 'arm64' : 'x86_64');
+assert.ok(
+  ['arm64', 'x86_64'].includes(architecture),
+  '架构只接受 arm64 / x86_64',
+);
+const requireUniversal = process.argv.includes('--universal');
 assert.ok(
  source.endsWith('.app') && fs.statSync(source).isDirectory(),
  '请传入 .app 绝对路径',
@@ -15,7 +22,28 @@ assert.ok(
 const root = fs.realpathSync(
  fs.mkdtempSync(path.join(os.tmpdir(), 'agc-macos-bundle-')),
 );
-const app = path.join(root, '陶泥儿 隔离测试.app');
+// 产品名从传入的 .app 推导，不在校验脚本里写死；改名后校验对象仍指向同一个包。
+const appBundleName = path.basename(source);
+const app = path.join(root, `隔离-${appBundleName}`);
+// 侧车清单版本必须等于锁定的 @openai/codex 版本，避免两处固定版本漂移。
+const appPackage = JSON.parse(
+  fs.readFileSync(
+    path.join(
+      path.dirname(new URL(import.meta.url).pathname),
+      '../package.json',
+    ),
+    'utf8',
+  ),
+);
+const pinnedCodexVersion =
+  appPackage.dependencies?.['@openai/codex'] ??
+  appPackage.devDependencies?.['@openai/codex'] ??
+  appPackage.optionalDependencies?.['@openai/codex'];
+assert.match(
+  pinnedCodexVersion,
+  /^\d+\.\d+\.\d+$/u,
+  'package.json 必须锁定精确的 @openai/codex 版本',
+);
 const home = path.join(root, 'home');
 const config = path.join(root, 'config');
 const tmp = path.join(root, 'tmp');
@@ -31,17 +59,58 @@ const env = {
 };

 function run(command, args) {
-  const result = spawnSync(command, args, {
-    cwd: root,
-    env,
-    encoding: 'utf8',
-    timeout: 30_000,
-    maxBuffer: 1024 * 1024,
-  });
+  // 只强制被测应用切片；本机 Xcode 检查工具可能仅提供宿主架构。
+  const useSlice = command.startsWith(`${app}${path.sep}`);
+  const result = spawnSync(
+    useSlice ? '/usr/bin/arch' : command,
+    useSlice ? [`-${architecture}`, command, ...args] : args,
+    {
+      cwd: root,
+      env,
+      encoding: 'utf8',
+      timeout: 120_000,
+      maxBuffer: 1024 * 1024,
+    },
+  );
  assert.ifError(result.error);
  return result;
 }

+/**
+ * APFS 上优先用 `ditto --clone`：整包按区块克隆，秒级完成且几乎不占额外空间。
+ * 跨卷或非 APFS 时回退到真实复制；两种路径都必须产出可独立改动的副本，
+ * 因为「缺组件拒绝」用例会在副本里改名文件。
+ */
+function copyBundle(from, to) {
+  const cloned = spawnSync('/usr/bin/ditto', ['--clone', from, to], {
+    encoding: 'utf8',
+  });
+  if (
+    cloned.status === 0 &&
+    fs.existsSync(path.join(to, 'Contents/Info.plist'))
+  ) {
+    return 'clone';
+  }
+  fs.cpSync(from, to, { recursive: true });
+  return 'copy';
+}
+
+/** 可执行名以包内 Info.plist 为准：它是稳定契约，但没必要在校验脚本里重复硬编码。 */
+function readBundleExecutable(appPath) {
+  const plist = path.join(appPath, 'Contents/Info.plist');
+  const result = spawnSync(
+    '/usr/libexec/PlistBuddy',
+    ['-c', 'Print :CFBundleExecutable', plist],
+    { encoding: 'utf8' },
+  );
+  const name = (result.stdout ?? '').trim();
+  assert.ok(
+    name.length > 0,
+    `无法从 Info.plist 读取 CFBundleExecutable：${plist}`,
+  );
+  return name;
+}
+
 async function hashFile(file) {
  const hash = createHash('sha256');
  for await (const chunk of fs.createReadStream(file)) hash.update(chunk);
@@ -60,7 +129,7 @@ async function handshake(executable) {
    await new Promise((resolve, reject) => {
      const timer = setTimeout(
        () => reject(new Error('app-server 初始化超时')),
-        15_000,
+        120_000,
      );
      const finish = (error) => {
        clearTimeout(timer);
@@ -127,23 +196,39 @@ async function handshake(executable) {
 }

 try {
-  fs.cpSync(source, app, { recursive: true });
+  const copiedWith = copyBundle(source, app);
  const resources = path.join(app, 'Contents/Resources');
-  const bundle = path.join(resources, 'coding-agent/mac-native');
+  const platform = architecture === 'arm64' ? 'darwin-arm64' : 'darwin-x64';
+  const bundle = path.join(resources, 'coding-agent/mac-native', platform);
  const executable = path.join(bundle, 'bin/codex');
-  const main = path.join(
-    app,
-    'Contents/MacOS/genarrative-ai-game-creator-shell',
-  );
+  const main = path.join(app, 'Contents/MacOS', readBundleExecutable(app));
+  const mainArchitectures = run('/usr/bin/lipo', ['-archs', main]);
+  assert.equal(mainArchitectures.status, 0);
+  assert.ok(mainArchitectures.stdout.split(/\s+/).includes(architecture));
+  if (requireUniversal) {
+    assert.deepEqual(mainArchitectures.stdout.trim().split(/\s+/).sort(), [
+      'arm64',
+      'x86_64',
+    ]);
+    for (const platform of ['darwin-arm64', 'darwin-x64']) {
+      assert.ok(
+        fs.existsSync(
+          path.join(
+            resources,
+            'coding-agent/mac-native',
+            platform,
+            'manifest.json',
+          ),
+        ),
+      );
+    }
+  }
  const manifest = JSON.parse(
    fs.readFileSync(path.join(bundle, 'manifest.json'), 'utf8'),
  );
  assert.equal(manifest.schemaVersion, 'genarrative-codex-sidecar.v2');
-  assert.equal(
-    manifest.platform,
-    process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64',
-  );
-  assert.equal(manifest.version, 'codex-cli 0.147.0');
+  assert.equal(manifest.platform, platform);
+  assert.equal(manifest.version, `codex-cli ${pinnedCodexVersion}`);
  const components = [
    'bin/codex',
    'bin/codex-code-mode-host',
@@ -159,14 +244,41 @@ try {
      fs.accessSync(file, fs.constants.X_OK);
      const arch = run('/usr/bin/lipo', ['-archs', file]);
      assert.equal(arch.status, 0, component);
-      assert.equal(
-        arch.stdout.trim(),
-        process.arch === 'arm64' ? 'arm64' : 'x86_64',
-        component,
-      );
+      assert.equal(arch.stdout.trim(), architecture, component);
    }
  }
  assert.ok(fs.existsSync(path.join(bundle, 'NOTICE.md')));
+  const nodeRoot = path.join(resources, 'game-runtime/node');
+  const nodeManifest = JSON.parse(
+    fs.readFileSync(path.join(nodeRoot, 'manifest.json'), 'utf8'),
+  );
+  assert.equal(nodeManifest.schemaVersion, 'agc-node-runtime.v1');
+  assert.equal(nodeManifest.platform, 'darwin');
+  assert.equal(nodeManifest.arch, process.arch);
+  const runtimeFiles = fs
+    .readdirSync(nodeRoot, { recursive: true })
+    .filter(
+      (file) =>
+        fs.statSync(path.join(nodeRoot, file)).isFile() &&
+        file !== 'manifest.json',
+    );
+  assert.deepEqual(runtimeFiles.sort(), Object.keys(nodeManifest.files).sort());
+  for (const [file, digest] of Object.entries(nodeManifest.files)) {
+    assert.equal(await hashFile(path.join(nodeRoot, file)), digest, file);
+  }
+  assert.ok(nodeManifest.files['NODE-LICENSE']);
+  assert.ok(nodeManifest.files['node_modules/npm/LICENSE']);
+  assert.equal(
+    run(path.join(nodeRoot, 'node'), ['--version']).stdout.trim(),
+    nodeManifest.nodeVersion,
+  );
+  assert.equal(
+    run(path.join(nodeRoot, 'node'), [
+      path.join(nodeRoot, 'node_modules/npm/bin/npm-cli.js'),
+      '--version',
+    ]).stdout.trim(),
+    nodeManifest.npmVersion,
+  );
  const plugin = path.join(resources, 'plugins/agc-cocos-editor');
  for (const file of [
    'plugin.json',
@@ -177,10 +289,13 @@ try {
  }
  const packageFiles = fs.readdirSync(resources, { recursive: true });
  assert.ok(
-    !packageFiles.some((file) =>
-      /(^|\/)(\.env[^/]*|auth\.json|node_modules|target|\.git)(\/|$)|\.(exe|dll)$/.test(
-        file,
-      ),
+    !packageFiles.some(
+      (file) =>
+        /(^|\/)(\.env[^/]*|auth\.json|target|\.git)(\/|$)|\.(exe|dll)$/.test(
+          file,
+        ) ||
+        (/(^|\/)node_modules(\/|$)/.test(file) &&
+          !file.startsWith('game-runtime/node/node_modules/npm')),
    ),
  );
  assert.equal(run(executable, ['--version']).stdout.trim(), manifest.version);
@@ -212,7 +327,7 @@ try {
  assert.notEqual(broken.status, 0);
  assert.match(`${broken.stdout}\n${broken.stderr}`, /Codex CLI 未安装/);
  console.log(
-    'PASS: 隔离安装包资源、架构、摘要、权限、正式 Codex 查找、app-server 握手及缺组件拒绝',
+    `PASS (${architecture}, 副本=${copiedWith}): 隔离安装包资源、架构、摘要、权限、正式 Codex 查找、app-server 握手及缺组件拒绝`,
  );
  console.log(
    '未验证：GUI、真实登录/Provider 对话、Cocos macOS 原生桥接；插件 Node 仍为外部前提',
@@ -0,0 +1,134 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const appRoot = fileURLToPath(new URL('..', import.meta.url));
+const repoRoot = path.resolve(appRoot, '../..');
+const platforms = {
+  arm64: 'aarch64-apple-darwin',
+  x64: 'x86_64-apple-darwin',
+};
+
+export function lockedMacPackage(lock, arch, version) {
+  assert.ok(Object.hasOwn(platforms, arch), '未知 macOS 架构');
+  const alias = `@openai/codex-darwin-${arch}`;
+  const entry = lock.packages?.[`node_modules/${alias}`];
+  assert.equal(
+    entry?.version,
+    `${version}-darwin-${arch}`,
+    '原生依赖必须与应用锁定版本一致',
+  );
+  assert.deepEqual(entry.os, ['darwin']);
+  assert.deepEqual(entry.cpu, [arch]);
+  const url = new URL(entry.resolved);
+  assert.equal(url.protocol, 'https:');
+  assert.equal(
+    url.hostname,
+    'registry.npmjs.org',
+    '只下载锁定的官方 npm 原生包',
+  );
+  assert.equal(url.username + url.password + url.search + url.hash, '');
+  assert.match(entry.integrity, /^sha512-[A-Za-z0-9+/]+={0,2}$/);
+  return { alias, target: platforms[arch], ...entry };
+}
+
+export function verifyPackageIntegrity(bytes, expected) {
+  const actual = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+  assert.equal(actual, expected, 'Codex 下载包 lockfile integrity 不匹配');
+}
+
+export function validateArchiveListing(listing) {
+  const files = listing.trim().split(/\r?\n/u);
+  assert.ok(files.length > 0);
+  for (const file of files) {
+    assert.ok(file.startsWith('package/'), '原生包必须只有 package 根目录');
+    assert.ok(
+      !file.split('/').includes('..') && !file.includes('\\'),
+      '压缩包路径不安全',
+    );
+  }
+}
+
+export async function prepareMacosCodex() {
+  assert.equal(process.platform, 'darwin', '该入口仅用于 macOS 构建机');
+  const lock = JSON.parse(
+    fs.readFileSync(path.join(repoRoot, 'package-lock.json'), 'utf8'),
+  );
+  const app = JSON.parse(
+    fs.readFileSync(path.join(appRoot, 'package.json'), 'utf8'),
+  );
+  const version = app.devDependencies['@openai/codex'];
+  assert.match(version, /^\d+\.\d+\.\d+$/u, 'Codex 必须锁定精确版本');
+  const cache = path.join(appRoot, 'src-tauri/target/.macos-native-cache');
+  fs.mkdirSync(cache, { recursive: true });
+  for (const arch of Object.keys(platforms)) {
+    const entry = lockedMacPackage(lock, arch, version);
+    const archive = path.join(cache, `codex-${entry.version}.tgz`);
+    if (!fs.existsSync(archive)) {
+      const response = await fetch(entry.resolved, {
+        signal: AbortSignal.timeout(300_000),
+      });
+      assert.ok(response.ok, `原生包下载失败 HTTP ${response.status}`);
+      const bytes = Buffer.from(await response.arrayBuffer());
+      verifyPackageIntegrity(bytes, entry.integrity);
+      const partial = `${archive}.${process.pid}.tmp`;
+      fs.writeFileSync(partial, bytes);
+      fs.renameSync(partial, archive);
+    }
+    verifyPackageIntegrity(fs.readFileSync(archive), entry.integrity);
+    validateArchiveListing(
+      execFileSync('tar', ['-tzf', archive], { encoding: 'utf8' }),
+    );
+    // 拒绝链接、设备及其它特殊条目，不能让 tar 在包目录之外写入。
+    const entries = execFileSync('tar', ['-tvzf', archive], {
+      encoding: 'utf8',
+    });
+    assert.ok(
+      entries
+        .trim()
+        .split(/\r?\n/u)
+        .every((line) => /^[-d]/u.test(line)),
+      '原生包禁止链接或特殊文件',
+    );
+    const parent = path.join(repoRoot, 'node_modules/@openai');
+    fs.mkdirSync(parent, { recursive: true });
+    const stage = fs.mkdtempSync(path.join(parent, '.mac-native-'));
+    try {
+      execFileSync(
+        'tar',
+        ['-xzf', archive, '-C', stage, '--strip-components=1'],
+        { stdio: 'pipe' },
+      );
+      const metadata = JSON.parse(
+        fs.readFileSync(
+          path.join(stage, 'vendor', entry.target, 'codex-package.json'),
+          'utf8',
+        ),
+      );
+      assert.equal(metadata.version, version);
+      assert.equal(metadata.target, entry.target);
+      assert.equal(metadata.entrypoint, 'bin/codex');
+      const destination = path.join(repoRoot, 'node_modules', entry.alias);
+      assert.ok(
+        !fs.existsSync(destination) ||
+          !fs.lstatSync(destination).isSymbolicLink(),
+        '拒绝覆盖链接依赖',
+      );
+      fs.rmSync(destination, { recursive: true, force: true });
+      fs.renameSync(stage, destination);
+    } finally {
+      fs.rmSync(stage, { recursive: true, force: true });
+    }
+    console.log(`[macOS Codex] ${entry.version}: lockfile integrity 已验证`);
+  }
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  await prepareMacosCodex();
+}
@@ -0,0 +1,197 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import { test } from 'node:test';
+
+import {
+  lockedMacPackage,
+  validateArchiveListing,
+  verifyPackageIntegrity,
+} from './prepare-macos-codex.mjs';
+
+const lock = JSON.parse(
+  fs.readFileSync(new URL('../../../package-lock.json', import.meta.url)),
+);
+const version = JSON.parse(
+  fs.readFileSync(new URL('../package.json', import.meta.url)),
+).devDependencies['@openai/codex'];
+
+test('both macOS dependencies resolve from the lockfile without floating versions', () => {
+  assert.equal(
+    lockedMacPackage(lock, 'arm64', version).target,
+    'aarch64-apple-darwin',
+  );
+  assert.equal(
+    lockedMacPackage(lock, 'x64', version).target,
+    'x86_64-apple-darwin',
+  );
+  assert.throws(() => lockedMacPackage(lock, 'other', version));
+  assert.throws(() => lockedMacPackage(lock, 'x64', '0.0.0'));
+});
+
+test('native package integrity rejects tampering', () => {
+  const bytes = Buffer.from('pinned package');
+  const integrity = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+  verifyPackageIntegrity(bytes, integrity);
+  assert.throws(() =>
+    verifyPackageIntegrity(Buffer.from('modified'), integrity),
+  );
+});
+
+test('archive traversal and non-package entries fail closed', () => {
+  validateArchiveListing(
+    'package/package.json\npackage/vendor/target/bin/codex\n',
+  );
+  for (const listing of [
+    '',
+    '/tmp/payload',
+    'package/../private',
+    'other/file',
+    'package/..\\file',
+  ]) {
+    assert.throws(() => validateArchiveListing(listing));
+  }
+});
+
+test('CI pipeline is manual, publishes the macOS partition and never reuses a developer workspace', () => {
+  const pipeline = fs.readFileSync(
+    new URL(
+      '../../../jenkins/Jenkinsfile.ai-game-creator-shell-macos-build',
+      import.meta.url,
+    ),
+    'utf8',
+  );
+  for (const required of [
+    'genarrative-agc-macos',
+    'disableConcurrentBuilds()',
+    '$AGC_AGENT_ROOT',
+    'StrictHostKeyChecking=yes',
+    'git merge-base --is-ancestor',
+    'allowEmptyArchive: false',
+    "string(name: 'AGC_UPDATE_CHANNEL', defaultValue: 'dev'",
+    'AGC_UPDATE_CHANNEL=${params.AGC_UPDATE_CHANNEL}',
+    "string(credentialsId: 'AgcUpdaterSigningKey'",
+    "string(credentialsId: 'AgcUpdaterSigningKeyPassword'",
+    "string(credentialsId: 'AliyunAccessKeyId'",
+    "string(credentialsId: 'AliyunaccessKeySecret'",
+    'AGC_RELEASE_VERSION',
+    'OSSUTIL_BIN',
+    // 并行度必须可调：节点是共用机器，写死容易把整机压满或反过来浪费一半核心。
+    "string(name: 'CARGO_BUILD_JOBS', defaultValue: '8'",
+    'CARGO_BUILD_JOBS=${params.CARGO_BUILD_JOBS}',
+    // Agent 工作区按约定匹配，不写死节点名：节点改名（-local → -01）后守卫仍成立。
+    '"$HOME"/Library/Jenkins/agents/*/workspace/*',
+    // 上一次发布的 commit 落在 master 上，取到它更新摘要才不会退化成「最近提交」。
+    'refs/heads/master:refs/remotes/origin/master',
+  ]) {
+    assert.ok(pipeline.includes(required), required);
+  }
+  assert.ok(
+    !pipeline.includes('genarrative-agc-macos-local'),
+    'Jenkinsfile 不得写死具体节点名',
+  );
+  // 这条管线是正式发布入口（与 Windows 对称）：默认真发布，演练需显式勾选。
+  assert.match(
+    pipeline,
+    /booleanParam\(name: 'AGC_RELEASE_DRY_RUN', defaultValue: false/u,
+    'Channel 发布默认必须是真发布，演练只能显式勾选',
+  );
+  // 节点是办公机：离线期间排队的旧构建必须自行让位，且跳过要覆盖后续全部阶段。
+  assert.match(
+    pipeline,
+    /booleanParam\(name: 'SKIP_IF_SUPERSEDED', defaultValue: false/u,
+  );
+  // 仓库文件不得出现节点用户名/个人 Home 路径：换机或改名后必须仍然可用。
+  assert.ok(
+    !pipeline.includes('/Users/'),
+    'Jenkinsfile 不得写死个人 Home 路径，工具链位置应按 $HOME 展开',
+  );
+  assert.ok(
+    pipeline.includes('export PATH="$HOME/'),
+    'PATH 必须在 shell 步骤里按 $HOME 展开',
+  );
+  // 超时必须高于实测最慢（78 分钟冷构建 + 共用机器），否则会被中断在链接阶段。
+  assert.ok(
+    pipeline.includes('timeout(time: 150'),
+    '构建超时上限必须留出冷构建余量',
+  );
+  for (const diagnostic of ['macOS 发布失败', '被中断']) {
+    assert.ok(pipeline.includes(diagnostic), diagnostic);
+  }
+  assert.ok(
+    pipeline.includes('.jenkins-superseded-by'),
+    '必须记录被推进的标记供后续阶段判定',
+  );
+  assert.equal(
+    (pipeline.match(/env\.AGC_BUILD_SUPERSEDED != 'true'/gu) ?? []).length,
+    3,
+    'Toolchain / Package / Archive 三个阶段都必须按跳过标记收口',
+  );
+  for (const forbidden of [
+    'triggers {',
+    'cron(',
+    'pollSCM(',
+    'git clean -fdx',
+    // release:upload 会重新触发一次完整构建，既翻倍耗时也绕过本 Job 的验签门禁。
+    'release:upload',
+  ]) {
+    assert.ok(!pipeline.includes(forbidden), forbidden);
+  }
+});
+
+test('macOS release entry verifies the updater signature before uploading', () => {
+  const entry = fs.readFileSync(
+    new URL('./build-macos-ci.mjs', import.meta.url),
+    'utf8',
+  );
+  const verifyIndex = entry.indexOf('verifyUpdaterSignature({');
+  const uploadIndex = entry.indexOf('uploadReleaseArtifacts(release');
+  assert.ok(verifyIndex > 0, '必须调用更新包验签');
+  assert.ok(uploadIndex > 0, '必须调用 OSS 上传');
+  assert.ok(verifyIndex < uploadIndex, '必须先验签再上传，验不过不得写 OSS');
+  // 无签名私钥时禁止构建：未签名的更新包会被客户端一律拒绝。
+  assert.ok(entry.includes('TAURI_SIGNING_PRIVATE_KEY'));
+  // `--no-sign` 会连带跳过 updater 的 minisign 签名，产物将没有 .sig，入口不得传它。
+  assert.ok(
+    !entry.includes("'--no-sign'"),
+    '--no-sign 会同时跳过 updater 签名，产物缺少 .sig',
+  );
+  // workspace 会跨构建保留产物：必须先删本次要写的对象，否则会因同名 DMG 失败，
+  // 或让上一轮遗留的 .sig 让验签门禁误通过。
+  for (const required of [
+    // 清理对象用派生的产品名算出来，而不是写死某个名字。
+    '${updaterArtifactName}.sig',
+    '${firstInstallName}.sha256',
+    'fs.rmSync(stale, { force: true })',
+    "'-ov'",
+  ]) {
+    assert.ok(entry.includes(required), required);
+  }
+});
+
+test('macOS release entry and smoke script derive product names from config and the bundle', () => {
+  const entry = fs.readFileSync(
+    new URL('./build-macos-ci.mjs', import.meta.url),
+    'utf8',
+  );
+  // 产品名决定 *.app、updater 归档与 DMG 卷名：写死会在改名后静默找错对象。
+  assert.ok(entry.includes('readProductName'), '入口必须从 Tauri 配置读产品名');
+  assert.ok(!entry.includes('陶泥儿'), 'macOS 发布入口不得写死产品名');
+  assert.ok(
+    entry.includes('_${version}_universal.dmg'),
+    '首装包名必须保留清单侧唯一匹配所需的后缀',
+  );
+
+  const smoke = fs.readFileSync(
+    new URL('./check-macos-bundle.mjs', import.meta.url),
+    'utf8',
+  );
+  assert.ok(!smoke.includes('陶泥儿'), '校验脚本不得写死产品名');
+  for (const required of [
+    'path.basename(source)',
+    'Print :CFBundleExecutable',
+    "'--clone'",
+  ]) {
+    assert.ok(smoke.includes(required), required);
+  }
+});
@@ -0,0 +1,95 @@
+# 只读取 Windows Installer 已登记的同版本 Node.js 缓存；不执行安装、不访问网络。
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$expectedVersion = $env:AGC_STAGING_NODE_VERSION
+if ($expectedVersion -notmatch '^\d+\.\d+\.\d+$') { throw 'Invalid Node version' }
+
+# WinVerifyTrust 强制仅使用本地证书缓存，禁止吊销/证书 URL 网络检索。
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class AgcOfflineSignature {
+    [StructLayout(LayoutKind.Sequential)]
+    struct FileInfo { public uint Size; public IntPtr Path; public IntPtr File; public IntPtr Subject; }
+    [StructLayout(LayoutKind.Sequential)]
+    struct TrustData {
+        public uint Size; public IntPtr Policy; public IntPtr Sip; public uint Ui;
+        public uint Revocation; public uint Choice; public IntPtr File;
+        public uint StateAction; public IntPtr State; public IntPtr Url;
+        public uint Flags; public uint Context;
+    }
+    [DllImport("wintrust.dll", ExactSpelling=true, PreserveSig=true)]
+    static extern int WinVerifyTrust(IntPtr window, ref Guid action, ref TrustData data);
+    public static bool Verify(string path) {
+        IntPtr name = Marshal.StringToCoTaskMemUni(path);
+        IntPtr file = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(FileInfo)));
+        try {
+            var info = new FileInfo { Size=(uint)Marshal.SizeOf(typeof(FileInfo)), Path=name };
+            Marshal.StructureToPtr(info, file, false);
+            var data = new TrustData { Size=(uint)Marshal.SizeOf(typeof(TrustData)), Ui=2, Choice=1, File=file, Flags=0x1000|0x10 };
+            var action = new Guid("00AAC56B-CD44-11d0-8CC2-00C04FC295EE");
+            return WinVerifyTrust(new IntPtr(-1), ref action, ref data) == 0;
+        } finally { Marshal.FreeHGlobal(file); Marshal.FreeCoTaskMem(name); }
+    }
+}
+'@
+
+function Read-Property($database, [string]$name) {
+    $view = $database.OpenView("SELECT ``Value`` FROM ``Property`` WHERE ``Property`` = '$name'")
+    try {
+        [void]$view.Execute()
+        $record = $view.Fetch()
+        if ($null -ne $record) { return $record.StringData(1) }
+        return ''
+    } finally { [void]$view.Close() }
+}
+
+$installer = New-Object -ComObject WindowsInstaller.Installer
+$cacheRoot = [System.IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath('Windows')) 'Installer'))
+$registrations = @(
+    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
+    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
+    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
+)
+$products = Get-ItemProperty $registrations -ErrorAction SilentlyContinue |
+    Where-Object { $_.DisplayName -eq 'Node.js' -and $_.DisplayVersion -eq $expectedVersion -and $_.PSChildName -match '^\{[0-9A-Fa-f-]{36}\}$' } |
+    Select-Object -ExpandProperty PSChildName -Unique
+foreach ($product in $products) {
+    try {
+        if ($installer.ProductInfo($product, 'ProductName') -ne 'Node.js') { continue }
+        if ($installer.ProductInfo($product, 'VersionString') -ne $expectedVersion) { continue }
+        $package = [System.IO.Path]::GetFullPath($installer.ProductInfo($product, 'LocalPackage'))
+        if (-not [string]::Equals([System.IO.Path]::GetDirectoryName($package), $cacheRoot, [StringComparison]::OrdinalIgnoreCase)) { continue }
+        if ([System.IO.Path]::GetExtension($package) -ne '.msi') { continue }
+        $entry = Get-Item -LiteralPath $package -Force
+        $cache = Get-Item -LiteralPath $cacheRoot -Force
+        if (($entry.Attributes -band [IO.FileAttributes]::ReparsePoint) -or ($cache.Attributes -band [IO.FileAttributes]::ReparsePoint)) { continue }
+        if (-not [AgcOfflineSignature]::Verify($package)) { continue }
+        $certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new([System.Security.Cryptography.X509Certificates.X509Certificate]::CreateFromSignedFile($package))
+        if ($certificate.Subject -notmatch '(^|,\s*)O=OpenJS Foundation(,|$)') { continue }
+        $database = $installer.OpenDatabase($package, 0)
+        if ((Read-Property $database 'ProductName') -ne 'Node.js') { continue }
+        if ((Read-Property $database 'ProductVersion') -ne $expectedVersion) { continue }
+        if ((Read-Property $database 'ProductCode') -ne $product) { continue }
+        $manufacturer = Read-Property $database 'Manufacturer'
+        if ($manufacturer -notin @('Node.js Foundation', 'OpenJS Foundation')) { continue }
+        $view = $database.OpenView('SELECT `Text` FROM `Control` WHERE `Dialog_` = ''LicenseAgreementDlg'' AND `Control` = ''LicenseText''')
+        try {
+            [void]$view.Execute()
+            $record = $view.Fetch()
+            if ($null -eq $record) { continue }
+            $content = $record.StringData(1)
+        } finally { [void]$view.Close() }
+        if (-not $content.StartsWith('{\rtf') -or $content.Length -gt 1048576) { continue }
+        if (-not $content.Contains('Node.js') -or -not $content.Contains('Permission is hereby granted')) { continue }
+        [pscustomobject]@{
+            productName = 'Node.js'; version = $expectedVersion; manufacturer = $manufacturer
+            signatureVerified = $true; signer = 'OpenJS Foundation'; format = 'rtf'; content = $content
+        } | ConvertTo-Json -Compress
+        exit 0
+    } catch {
+        # 单个损坏/无权限缓存不能绕过验证；继续查找其它已登记候选。
+        continue
+    }
+}
+throw 'No matching trusted installed Node.js license'
--- a/Show More
+++ b/Show More