后台灰度预设补上游戏发布开关

- admin-web：灰度发布配置的固定目标新增「游戏分发 → 游戏发布」（game-distribution:publish），前缀标签与描述说明「未配置或关闭时默认开放，开启后只放行白名单/灰度命中」。
- 默认语义：选中预设后保持 enabled=false，避免误把发布收紧成全关；需要灰度时再显式打开并填白名单/比例。
- 用例：新增「可选择游戏发布开关且默认不收紧」与「保存写入白名单与比例」两条后台用例。
- 文档：开发运维文档说明该键配置前不会出现在已有列表、必须从预设或手填新建一行。

.codex/skills/genarrative-external-editor-api/references/api-operations.md

@@ -102,7 +102,7 @@ Use OpenAPI as the final authority; these common values are a routing aid:
 
 - Image `kind`: `spec`, `character`, `quick-edit`, `ui-design`, `publication-material`; ordinary image generation may omit it.
 - External v1 currently has no structured game-scene generation operation. Do not send `kind: "scene"` or `assetKind: "scene"` through generic image generation; the server rejects both before queueing.
-- Image `model`: `gpt-image-2.5`, `gemini-3.1-flash-image-preview`, `nanobanana2`, `nano-banana`. Persisted `gpt-image-2` is a legacy value resolved only when submitting a new task; the retired `gpt-image-2-c` is no longer accepted and is handled as an unsupported value.
+- Image `model`: `gpt-image-2`, `gemini-3.1-flash-image-preview`, `nanobanana2`, `nano-banana`.
 - Image `aspectRatio`: `1:1`, `2:3`, `3:2`, `9:16`, `16:9`.
 - Image `imageSize`: `0.5K`, `1K`, `2K`.
 - Video `model`: `seedance2.0`, `seedance2.0-fast`, `kling3.0`, `kling3.0-omni`, `veo3.1`, `veo3.1-fast`.

.codex/skills/gpt-image-2-apimart/SKILL.md

@@ -1,17 +1,11 @@
 ---
 name: gpt-image-2-apimart
-description: Generate or inspect project image assets through this repository's Tiantoken GPT Image 2.5 workflow. Use when Codex needs to create puzzle template sample images, reproduce the server-rs image request body, dry-run image prompts, batch-generate local project thumbnails, or debug TIANTOKEN_BASE_URL / TIANTOKEN_API_KEY image-generation configuration without exposing secrets. The directory name is historical.
+description: Generate or inspect project image assets through this repository's VectorEngine gpt-image-2 workflow with gpt-image-2-c fallback. Use when Codex needs to create puzzle template sample images, reproduce the server-rs image request body, dry-run image prompts, batch-generate local project thumbnails, or debug VECTOR_ENGINE_BASE_URL / VECTOR_ENGINE_API_KEY image-generation configuration without exposing secrets. The directory name is historical.
 ---
 
-# GPT Image 2.5 project image workflow
+# gpt-image-2 VectorEngine
 
-Use this skill for project-local image asset generation that must match the repository's image request contract. Provider routing is owned by `server-rs`; when this skill talks to the provider directly it must send the concrete provider model and the matching provider credentials, because the provider side only accepts concrete models:
-
-- generation (no reference images): `gpt-image-2.5-flare-c` through Tiantoken
-- edits (any reference image): `gpt-image-2.5-sunburst-c` through Tiantoken
-- nanobanana (`gemini-3.1-flash-image-preview`) stays on VectorEngine
-
-The business model name `gpt-image-2.5` is resolved to a concrete key by `server-rs` at the task boundary and is never sent to a provider directly. This client must not perform a cross-model fallback; the only retry the bundled scripts do is a same-model retry on transient upstream statuses (`408` / `429` / `5xx`, 1s/2s backoff, at most 3 attempts), which never changes the model. The folder still contains `apimart` in its name for compatibility with existing local plugin references.
+Use this skill for project-local image asset generation that must match the repository's `server-rs` VectorEngine image path. Keep the product/price model identifier and primary provider request as `gpt-image-2`, then fall back once to `gpt-image-2-c` for eligible provider failures. The folder still contains `apimart` in its name for compatibility with existing local plugin references.
 
 ## Workflow
 
@@ -30,15 +24,15 @@ The business model name `gpt-image-2.5` is resolved to a concrete key by `server
    ```
 
 5. Save final project assets under `public/` or another explicitly requested workspace path.
-6. Never print `TIANTOKEN_API_KEY`. Report only whether configuration exists.
+6. Never print `VECTOR_ENGINE_API_KEY`. Report only whether configuration exists.
 
 ## Request Contract
 
 The repository image path uses:
 
 ```text
-POST {TIANTOKEN_BASE_URL}/v1/images/generations
-Authorization: Bearer {TIANTOKEN_API_KEY}
+POST {VECTOR_ENGINE_BASE_URL}/v1/images/generations
+Authorization: Bearer {VECTOR_ENGINE_API_KEY}
 Content-Type: application/json
 ```
 
@@ -46,7 +40,7 @@ Default body:
 
 ```json
 {
-  "model": "gpt-image-2.5-flare-c",
+  "model": "gpt-image-2",
   "prompt": "<prompt>",
   "n": 1,
   "size": "1024x1024"
@@ -56,22 +50,22 @@ Default body:
 For visual references, use the edit endpoint instead of the create endpoint:
 
 ```text
-POST {TIANTOKEN_BASE_URL}/v1/images/edits
-Authorization: Bearer {TIANTOKEN_API_KEY}
+POST {VECTOR_ENGINE_BASE_URL}/v1/images/edits
+Authorization: Bearer {VECTOR_ENGINE_API_KEY}
 Content-Type: multipart/form-data
 ```
 
 Multipart fields:
 
 ```text
-model=gpt-image-2.5-sunburst-c
+model=gpt-image-2
 prompt=<prompt>
 n=1
 size=1024x1024
 image=@reference.png
 ```
 
-In this repository, calls with no reference images use `POST /v1/images/generations` with `gpt-image-2.5-flare-c`; calls with any reference image use `POST /v1/images/edits` with `gpt-image-2.5-sunburst-c` and pass references as one or more `image` form parts. Server-side calls still submit the business model `gpt-image-2.5` and let `server-rs` resolve the concrete key; provider routing and retry policy remain server-owned, and pricing follows the same reference-image rule (generation with a reference image is charged at the edit tier). Match3D container UI generation embeds `public/match3d-background-references/pot-fused-reference.png` into the edit request as an `image` part.
+In this repository, calls with no reference images use `POST /v1/images/generations`; calls with any reference image use `POST /v1/images/edits` and pass references as one or more `image` form parts. Both paths prefer `gpt-image-2`; on an eligible upstream/model failure they retry with `gpt-image-2-c`. Do not fall back for authentication, local validation, request-budget exhaustion, uncertain send/connection failure, content-safety rejection, or a generated image URL download failure. Match3D container UI generation embeds `public/match3d-background-references/pot-fused-reference.png` into the edit request as an `image` part.
 
 Accept image output from `data[].url`, `data[].b64_json`, or direct nested `url` fields. VectorEngine image generation currently returns synchronously; do not poll APIMart task endpoints.
 
@@ -81,14 +75,12 @@ Load environment values from process env first, then `.env.secrets.local`, `.env
 
 Required for live generation:
 
-- `TIANTOKEN_BASE_URL`
-- `TIANTOKEN_API_KEY`
+- `VECTOR_ENGINE_BASE_URL`
+- `VECTOR_ENGINE_API_KEY`
 
 Optional:
 
-- `TIANTOKEN_IMAGE_REQUEST_TIMEOUT_MS`
-
-`VECTOR_ENGINE_*` values no longer serve GPT Image 2.5: those credentials belong to VectorEngine, which only serves nanobanana. Do not fall back from `TIANTOKEN_*` to `VECTOR_ENGINE_*`.
+- `VECTOR_ENGINE_IMAGE_REQUEST_TIMEOUT_MS`
 
 If the key or base URL is missing, stop after dry-run or explain the missing configuration. Do not ask the user to paste the key in chat.
 

.codex/skills/gpt-image-2-apimart/scripts/generate-anthro-cat-illustrations.mjs

@@ -9,9 +9,8 @@ const skillRoot = path.resolve(__dirname, '..');
 const repoRoot = path.resolve(skillRoot, '..', '..', '..');
 const defaultOutDir = path.join(repoRoot, 'public', 'anthro-cat-illustrations');
 const defaultTimeoutMs = 1000000;
-// GPT Image 2.5 生成任务只接受 concrete provider model；业务模型名 `gpt-image-2.5`
-// 由 server-rs 在任务边界解析，脚本直连 provider 时必须自己给出 concrete key。
-const imageModel = 'gpt-image-2.5-flare-c';
+const preferredImageModel = 'gpt-image-2';
+const fallbackImageModel = 'gpt-image-2-c';
 
 const prompts = [
   {
@@ -102,18 +101,18 @@ function resolveEnv() {
     ...process.env,
   };
   return {
-    baseUrl: String(loaded.TIANTOKEN_BASE_URL || '')
+    baseUrl: String(loaded.VECTOR_ENGINE_BASE_URL || '')
       .trim()
       .replace(/\/+$/u, ''),
-    apiKey: String(loaded.TIANTOKEN_API_KEY || '').trim(),
+    apiKey: String(loaded.VECTOR_ENGINE_API_KEY || '').trim(),
     timeoutMs: Number.parseInt(
-      String(loaded.TIANTOKEN_IMAGE_REQUEST_TIMEOUT_MS || defaultTimeoutMs),
+      String(loaded.VECTOR_ENGINE_IMAGE_REQUEST_TIMEOUT_MS || defaultTimeoutMs),
       10,
     ),
   };
 }
 
-function buildTiantokenImagesGenerationUrl(baseUrl) {
+function buildVectorEngineImagesGenerationUrl(baseUrl) {
   return baseUrl.endsWith('/v1')
     ? `${baseUrl}/images/generations`
     : `${baseUrl}/v1/images/generations`;
@@ -223,15 +222,6 @@ function inferExtensionFromBytes(bytes) {
   return null;
 }
 
-// Tiantoken 偶发 408/429/5xx 时重试同一个 concrete model；跨模型回退仍由
-// server-rs 负责，脚本不做任何模型替换。
-const transientRetryMaxAttempts = 3;
-const transientRetryBaseDelayMs = 1000;
-
-function isTransientProviderStatus(status) {
-  return status === 408 || status === 429 || status >= 500;
-}
-
 async function fetchJson(url, options, timeoutMs) {
   const abortController = new AbortController();
   const timer = setTimeout(() => abortController.abort(), timeoutMs);
@@ -243,21 +233,22 @@ async function fetchJson(url, options, timeoutMs) {
     const text = await response.text();
     if (!response.ok) {
       const error = new Error(
-        `Tiantoken ${response.status}: ${text.slice(0, 600)}`,
+        `VectorEngine ${response.status}: ${text.slice(0, 600)}`,
       );
-      error.providerStatus = response.status;
+      error.vectorEngineStatus = response.status;
+      error.vectorEngineBody = text;
       throw error;
     }
     try {
       return JSON.parse(text);
     } catch (error) {
-      throw new Error(
-        `Tiantoken 返回无法解析的响应体：${error.message}；响应片段：${text.slice(0, 600)}`,
-      );
+      error.vectorEngineResponseParse = true;
+      error.vectorEngineBody = text;
+      throw error;
     }
   } catch (error) {
     if (error?.name === 'AbortError') {
-      throw new Error(`Tiantoken request timed out after ${timeoutMs}ms`);
+      throw new Error(`VectorEngine request timed out after ${timeoutMs}ms`);
     }
     throw error;
   } finally {
@@ -265,55 +256,81 @@ async function fetchJson(url, options, timeoutMs) {
   }
 }
 
-async function fetchJsonWithRetry(url, options, timeoutMs, requestId) {
-  for (let attempt = 1; ; attempt += 1) {
-    try {
-      return await fetchJson(url, options, timeoutMs);
-    } catch (error) {
-      if (
-        attempt >= transientRetryMaxAttempts ||
-        !isTransientProviderStatus(error?.providerStatus)
-      ) {
-        throw error;
-      }
-      const delayMs = transientRetryBaseDelayMs * 2 ** (attempt - 1);
-      console.warn(
-        `Tiantoken ${error.providerStatus} on ${requestId}, retrying the same model in ${delayMs}ms (attempt ${attempt + 1}/${transientRetryMaxAttempts})`,
-      );
-      await new Promise((resolve) => setTimeout(resolve, delayMs));
-    }
+function shouldFallbackImageModel(error) {
+  const raw =
+    `${error?.message || ''}\n${error?.vectorEngineBody || ''}`.toLowerCase();
+  if (error?.vectorEngineResponseParse) {
+    return !containsContentRejection(raw);
   }
+  const status = Number(error?.vectorEngineStatus || 0);
+  if (status === 408 || status >= 500) {
+    return true;
+  }
+  if (status === 429) {
+    return !containsContentRejection(raw);
+  }
+  const mentionsImageModel =
+    raw.includes('model') ||
+    raw.includes('模型') ||
+    raw.includes(preferredImageModel) ||
+    raw.includes(fallbackImageModel);
+  return (
+    [400, 404, 422].includes(status) &&
+    mentionsImageModel &&
+    /(not found|not supported|unsupported|unavailable|does not exist|invalid model|unknown model|不存在|不支持|不可用|未开通)/u.test(
+      raw,
+    )
+  );
+}
+
+function containsContentRejection(raw) {
+  return /(invalid_prompt|safety|content[_ ]policy|moderation|prompt rejected|content rejected|prompt refusal|content refusal|rejected by safety|rejected by moderation|敏感|违规|安全策略|内容审核|提示词拒绝|内容拒绝)/u.test(
+    raw,
+  );
 }
 
 async function requestImagePayload(env, entry) {
-  const model = imageModel;
-  const requestBody = {
-    model,
-    prompt: buildPrompt(entry),
-    n: 1,
-    size: '1024x1024',
-  };
-  const payload = await fetchJsonWithRetry(
-    buildTiantokenImagesGenerationUrl(env.baseUrl),
-    {
-      method: 'POST',
-      headers: {
-        Authorization: `Bearer ${env.apiKey}`,
-        Accept: 'application/json',
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(requestBody),
-    },
-    env.timeoutMs,
-    entry.id,
-  );
-  const base64Image = decodeStrictBase64Image(extractBase64Images(payload)[0]);
-  if (extractImageUrls(payload)[0] || base64Image) {
-    return payload;
+  for (const model of [preferredImageModel, fallbackImageModel]) {
+    const requestBody = {
+      model,
+      prompt: buildPrompt(entry),
+      n: 1,
+      size: '1024x1024',
+    };
+    try {
+      const payload = await fetchJson(
+        buildVectorEngineImagesGenerationUrl(env.baseUrl),
+        {
+          method: 'POST',
+          headers: {
+            Authorization: `Bearer ${env.apiKey}`,
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(requestBody),
+        },
+        env.timeoutMs,
+      );
+      const base64Image = decodeStrictBase64Image(
+        extractBase64Images(payload)[0],
+      );
+      if (extractImageUrls(payload)[0] || base64Image) {
+        return payload;
+      }
+      const error = new Error(`VectorEngine returned no image for ${entry.id}`);
+      error.vectorEngineResponseParse = true;
+      error.vectorEngineBody = JSON.stringify(payload).slice(0, 600);
+      throw error;
+    } catch (error) {
+      if (model !== preferredImageModel || !shouldFallbackImageModel(error)) {
+        throw error;
+      }
+      console.warn(
+        `VectorEngine ${preferredImageModel} failed, retrying with ${fallbackImageModel}: ${error.message}`,
+      );
+    }
   }
-  throw new Error(
-    `Tiantoken returned no image for ${entry.id}：${JSON.stringify(payload).slice(0, 600)}`,
-  );
+  throw new Error(`VectorEngine returned no image for ${entry.id}`);
 }
 
 async function downloadUrl(url, timeoutMs) {
@@ -356,7 +373,7 @@ async function generateOne(env, entry, outDir) {
     const bytes = decodeStrictBase64Image(b64Images[0]);
     if (!bytes) {
       throw new Error(
-        `Tiantoken returned invalid base64 image for ${entry.id}`,
+        `VectorEngine returned invalid base64 image for ${entry.id}`,
       );
     }
     image = {
@@ -364,7 +381,7 @@ async function generateOne(env, entry, outDir) {
       extension: inferExtensionFromBytes(bytes),
     };
   } else {
-    throw new Error(`Tiantoken returned no image for ${entry.id}`);
+    throw new Error(`VectorEngine returned no image for ${entry.id}`);
   }
 
   mkdirSync(outDir, { recursive: true });
@@ -391,8 +408,9 @@ if (dryRun) {
         requests: selectedPrompts.map((entry) => ({
           id: entry.id,
           title: entry.title,
+          fallbackModel: fallbackImageModel,
           body: {
-            model: imageModel,
+            model: preferredImageModel,
             prompt: buildPrompt(entry),
             n: 1,
             size: '1024x1024',
@@ -411,7 +429,7 @@ if (!env.baseUrl || !env.apiKey) {
   console.error(
     JSON.stringify({
       ok: false,
-      error: 'Missing TIANTOKEN_BASE_URL or TIANTOKEN_API_KEY',
+      error: 'Missing VECTOR_ENGINE_BASE_URL or VECTOR_ENGINE_API_KEY',
       hasBaseUrl: Boolean(env.baseUrl),
       hasApiKey: Boolean(env.apiKey),
     }),

.codex/skills/gpt-image-2-apimart/scripts/generate-template-samples.mjs

@@ -18,9 +18,8 @@ const defaultOutDir = path.join(
   'puzzle-creation-templates',
 );
 const defaultTimeoutMs = 1000000;
-// GPT Image 2.5 生成任务只接受 concrete provider model；业务模型名 `gpt-image-2.5`
-// 由 server-rs 在任务边界解析，脚本直连 provider 时必须自己给出 concrete key。
-const imageModel = 'gpt-image-2.5-flare-c';
+const preferredImageModel = 'gpt-image-2';
+const fallbackImageModel = 'gpt-image-2-c';
 
 const args = new Map();
 for (let index = 2; index < process.argv.length; index += 1) {
@@ -72,18 +71,18 @@ function resolveEnv() {
     ...process.env,
   };
   return {
-    baseUrl: String(loaded.TIANTOKEN_BASE_URL || '')
+    baseUrl: String(loaded.VECTOR_ENGINE_BASE_URL || '')
       .trim()
       .replace(/\/+$/u, ''),
-    apiKey: String(loaded.TIANTOKEN_API_KEY || '').trim(),
+    apiKey: String(loaded.VECTOR_ENGINE_API_KEY || '').trim(),
     timeoutMs: Number.parseInt(
-      String(loaded.TIANTOKEN_IMAGE_REQUEST_TIMEOUT_MS || defaultTimeoutMs),
+      String(loaded.VECTOR_ENGINE_IMAGE_REQUEST_TIMEOUT_MS || defaultTimeoutMs),
       10,
     ),
   };
 }
 
-function buildTiantokenImagesGenerationUrl(baseUrl) {
+function buildVectorEngineImagesGenerationUrl(baseUrl) {
   return baseUrl.endsWith('/v1')
     ? `${baseUrl}/images/generations`
     : `${baseUrl}/v1/images/generations`;
@@ -193,15 +192,6 @@ function inferExtensionFromBytes(bytes) {
   return null;
 }
 
-// Tiantoken 偶发 408/429/5xx 时重试同一个 concrete model；跨模型回退仍由
-// server-rs 负责，脚本不做任何模型替换。
-const transientRetryMaxAttempts = 3;
-const transientRetryBaseDelayMs = 1000;
-
-function isTransientProviderStatus(status) {
-  return status === 408 || status === 429 || status >= 500;
-}
-
 async function fetchJson(url, options, timeoutMs) {
   const abortController = new AbortController();
   const timer = setTimeout(() => abortController.abort(), timeoutMs);
@@ -213,21 +203,22 @@ async function fetchJson(url, options, timeoutMs) {
     const text = await response.text();
     if (!response.ok) {
       const error = new Error(
-        `Tiantoken ${response.status}: ${text.slice(0, 600)}`,
+        `VectorEngine ${response.status}: ${text.slice(0, 600)}`,
       );
-      error.providerStatus = response.status;
+      error.vectorEngineStatus = response.status;
+      error.vectorEngineBody = text;
       throw error;
     }
     try {
       return JSON.parse(text);
     } catch (error) {
-      throw new Error(
-        `Tiantoken 返回无法解析的响应体：${error.message}；响应片段：${text.slice(0, 600)}`,
-      );
+      error.vectorEngineResponseParse = true;
+      error.vectorEngineBody = text;
+      throw error;
     }
   } catch (error) {
     if (error?.name === 'AbortError') {
-      throw new Error(`Tiantoken request timed out after ${timeoutMs}ms`);
+      throw new Error(`VectorEngine request timed out after ${timeoutMs}ms`);
     }
     throw error;
   } finally {
@@ -235,55 +226,83 @@ async function fetchJson(url, options, timeoutMs) {
   }
 }
 
-async function fetchJsonWithRetry(url, options, timeoutMs, requestId) {
-  for (let attempt = 1; ; attempt += 1) {
-    try {
-      return await fetchJson(url, options, timeoutMs);
-    } catch (error) {
-      if (
-        attempt >= transientRetryMaxAttempts ||
-        !isTransientProviderStatus(error?.providerStatus)
-      ) {
-        throw error;
-      }
-      const delayMs = transientRetryBaseDelayMs * 2 ** (attempt - 1);
-      console.warn(
-        `Tiantoken ${error.providerStatus} on ${requestId}, retrying the same model in ${delayMs}ms (attempt ${attempt + 1}/${transientRetryMaxAttempts})`,
-      );
-      await new Promise((resolve) => setTimeout(resolve, delayMs));
-    }
+function shouldFallbackImageModel(error) {
+  const raw =
+    `${error?.message || ''}\n${error?.vectorEngineBody || ''}`.toLowerCase();
+  if (error?.vectorEngineResponseParse) {
+    return !containsContentRejection(raw);
   }
+  const status = Number(error?.vectorEngineStatus || 0);
+  if (status === 408 || status >= 500) {
+    return true;
+  }
+  if (status === 429) {
+    return !containsContentRejection(raw);
+  }
+  const mentionsImageModel =
+    raw.includes('model') ||
+    raw.includes('模型') ||
+    raw.includes(preferredImageModel) ||
+    raw.includes(fallbackImageModel);
+  return (
+    [400, 404, 422].includes(status) &&
+    mentionsImageModel &&
+    /(not found|not supported|unsupported|unavailable|does not exist|invalid model|unknown model|不存在|不支持|不可用|未开通)/u.test(
+      raw,
+    )
+  );
+}
+
+function containsContentRejection(raw) {
+  return /(invalid_prompt|safety|content[_ ]policy|moderation|prompt rejected|content rejected|prompt refusal|content refusal|rejected by safety|rejected by moderation|敏感|违规|安全策略|内容审核|提示词拒绝|内容拒绝)/u.test(
+    raw,
+  );
 }
 
 async function requestImagePayload(env, template) {
-  const model = imageModel;
-  const requestBody = {
-    model,
-    prompt: buildPrompt(template),
-    n: 1,
-    size: '1024x1024',
-  };
-  const payload = await fetchJsonWithRetry(
-    buildTiantokenImagesGenerationUrl(env.baseUrl),
-    {
-      method: 'POST',
-      headers: {
-        Authorization: `Bearer ${env.apiKey}`,
-        Accept: 'application/json',
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(requestBody),
-    },
-    env.timeoutMs,
-    template.id,
-  );
-  const base64Image = decodeStrictBase64Image(extractBase64Images(payload)[0]);
-  if (extractImageUrls(payload)[0] || base64Image) {
-    return payload;
+  for (const model of [preferredImageModel, fallbackImageModel]) {
+    const requestBody = {
+      model,
+      prompt: buildPrompt(template),
+      n: 1,
+      size: '1024x1024',
+    };
+    try {
+      const payload = await fetchJson(
+        buildVectorEngineImagesGenerationUrl(env.baseUrl),
+        {
+          method: 'POST',
+          headers: {
+            Authorization: `Bearer ${env.apiKey}`,
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(requestBody),
+        },
+        env.timeoutMs,
+      );
+      const base64Image = decodeStrictBase64Image(
+        extractBase64Images(payload)[0],
+      );
+      if (extractImageUrls(payload)[0] || base64Image) {
+        return payload;
+      }
+      const error = new Error(
+        `VectorEngine returned no image for ${template.id}`,
+      );
+      error.vectorEngineResponseParse = true;
+      error.vectorEngineBody = JSON.stringify(payload).slice(0, 600);
+      throw error;
+    } catch (error) {
+      if (model !== preferredImageModel || !shouldFallbackImageModel(error)) {
+        throw error;
+      }
+      console.warn(
+        `VectorEngine ${preferredImageModel} failed, retrying with ${fallbackImageModel}: ${error.message}`,
+      );
+    }
   }
-  throw new Error(
-    `Tiantoken returned no image for ${template.id}：${JSON.stringify(payload).slice(0, 600)}`,
-  );
+  throw new Error(`VectorEngine returned no image for ${template.id}`);
 }
 
 async function downloadUrl(url, timeoutMs) {
@@ -326,7 +345,7 @@ async function generateOne(env, template, outDir) {
     const bytes = decodeStrictBase64Image(b64Images[0]);
     if (!bytes) {
       throw new Error(
-        `Tiantoken returned invalid base64 image for ${template.id}`,
+        `VectorEngine returned invalid base64 image for ${template.id}`,
       );
     }
     image = {
@@ -334,7 +353,7 @@ async function generateOne(env, template, outDir) {
       extension: inferExtensionFromBytes(bytes),
     };
   } else {
-    throw new Error(`Tiantoken returned no image for ${template.id}`);
+    throw new Error(`VectorEngine returned no image for ${template.id}`);
   }
 
   mkdirSync(outDir, { recursive: true });
@@ -365,8 +384,9 @@ if (dryRun) {
         requests: selectedTemplates.map((template) => ({
           id: template.id,
           title: template.title,
+          fallbackModel: fallbackImageModel,
           body: {
-            model: imageModel,
+            model: preferredImageModel,
             prompt: buildPrompt(template),
             n: 1,
             size: '1024x1024',
@@ -385,7 +405,7 @@ if (!env.baseUrl || !env.apiKey) {
   console.error(
     JSON.stringify({
       ok: false,
-      error: 'Missing TIANTOKEN_BASE_URL or TIANTOKEN_API_KEY',
+      error: 'Missing VECTOR_ENGINE_BASE_URL or VECTOR_ENGINE_API_KEY',
       hasBaseUrl: Boolean(env.baseUrl),
       hasApiKey: Boolean(env.apiKey),
     }),

.eslintrc.cjs

@@ -213,6 +213,8 @@ module.exports = {
     '!src/services/clipboard.test.ts',
     '!src/services/frontendRuntimeConfigService.ts',
     '!src/services/frontendRuntimeConfigService.test.ts',
+    '!src/services/gameDistributionClient.ts',
+    '!src/services/gameDistributionClient.test.ts',
     '!src/services/sseStream.ts',
     '!src/services/sseStream.test.ts',
     'src/AdventurePanel.tsx',

.gitea/workflows/project-ci.yml

@@ -98,6 +98,12 @@ jobs:
       - name: Report isolated Rust compilation cache
         if: always()
         run: bash scripts/ci-rust-cache.sh report
+      - name: Publish master Rust cache artifact
+        continue-on-error: true
+        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        env:
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: python3 scripts/export-gitea-rust-cache.py
 
   ai-game-creator-shell-rust-lane-2:
     name: AI game creator shell Rust lane 2/2
@@ -141,6 +147,12 @@ jobs:
       - name: Report isolated Rust compilation cache
         if: always()
         run: bash scripts/ci-rust-cache.sh report
+      - name: Publish master Rust cache artifact
+        continue-on-error: true
+        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        env:
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: python3 scripts/export-gitea-rust-cache.py
 
   # agent-run smoke 会 spawn `cargo run`（走壳自己的 manifest），同样不装 npm 依赖，
   # 单独一个 job，免得把已经压到 4 分钟级的片 job 拖长。
@@ -183,6 +195,12 @@ jobs:
       - name: Report isolated Rust compilation cache
         if: always()
         run: bash scripts/ci-rust-cache.sh report
+      - name: Publish master Rust cache artifact
+        continue-on-error: true
+        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        env:
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: python3 scripts/export-gitea-rust-cache.py
 
   # AGC 壳依赖的共享 / 平台和编辑器插件 crate 各自预热独立 manifest，再运行对应测试。
   ai-game-creator-shell-rust-crates:
@@ -291,6 +309,12 @@ jobs:
       - name: Report isolated Rust compilation cache
         if: always()
         run: bash scripts/ci-rust-cache.sh report
+      - name: Publish master Rust cache artifact
+        continue-on-error: true
+        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        env:
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: python3 scripts/export-gitea-rust-cache.py
 
   backend-tests:
     name: Backend tests
@@ -380,6 +404,12 @@ jobs:
       - name: Report isolated Rust compilation cache
         if: always()
         run: bash scripts/ci-rust-cache.sh report
+      - name: Publish master Rust cache artifact
+        continue-on-error: true
+        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        env:
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: python3 scripts/export-gitea-rust-cache.py
 
   # 客户端的壳级与契约门禁：静态契约断言、H5 / 微信 / 移动 / 桌面壳运行时门禁，
   # 以及依赖发布产物的构建 smoke。
@@ -442,6 +472,12 @@ jobs:
       - name: Report isolated Rust compilation cache
         if: always()
         run: bash scripts/ci-rust-cache.sh report
+      - name: Publish master Rust cache artifact
+        continue-on-error: true
+        if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        env:
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: python3 scripts/export-gitea-rust-cache.py
 
   frontend-tests:
     name: Frontend tests
@@ -524,6 +560,11 @@ jobs:
       - name: Install npm dependencies
         run: bash scripts/ci-npm-ci-with-retry.sh
 
+      - name: Validate CI cache maintenance behavior
+        run: |
+          python3 -m unittest discover -s scripts -p 'test_gitea_cache_*.py'
+          node --test scripts/export-ci-npm-download-cache.test.mjs
+
       - name: Run repository checks
         run: npm run check:repository-ci
 

CONTEXT.md

@@ -44,35 +44,6 @@ _Avoid_: 把同一资源的全局元数据和某一次摆放坐标混在同一
 由图片生成或图片修改流程产生的画布资源，必须记录来源资源、提示词、实际提示词、模型、provider、任务 ID 和生成时间；本期 `/editor` 的生成修改先允许 mock 生成资源，但仍按生成资源元数据形状保存。
 _Avoid_: 无来源的静态素材、只显示在 UI 但不落工程资源记录的生成结果
 
-**图片模型历史值与使用端解析**:
-图片资源中已持久化的 `gpt-image-2` 是历史业务事实，读回时保持原值；新任务使用业务模型值 `gpt-image-2.5`。当用户基于历史资源再次发起生成或编辑任务时，服务端只在新任务的使用端把历史值解析为当前业务模型，不改写历史资源。provider route 属于服务端执行与审计边界，前端不接收、不持久化、不展示，也不据此分支。
-_Avoid_: 读取数据库时改写历史模型值、把 provider route 暴露为前端模型选项或公开 DTO
-
-**图片 provider 显式路由**:
-api-server 在任务入口按业务语义显式选择具体 provider model name（生成或编辑），并把同一具体名传给图片平台适配器和后台定价解析；图片平台适配器不从参考图数量或前端字段猜测任务。具体 provider model name 只存在于服务端调用、定价配置和审计边界。
-后台管理 Web/API 是明确例外，可以查看和编辑两个具体定价 key；主站普通前端与公开定价 API 不接收这些 key。
-_Avoid_: 让图片适配器隐式猜路由、让主站前端携带 provider model name
-
-**业务模型**:
-面向任务与产品契约的稳定模型值；当前 GPT 图片新任务的业务模型是 `gpt-image-2.5`。业务模型不等同于 provider 的具体计费/请求 model，也不暴露 provider 凭证或 endpoint。
-_Avoid_: 把 provider concrete model 当作前端业务选项、用业务模型值直接推断 provider 凭证
-
-**具体模型**:
-服务端发送请求和定价使用的 concrete model name。GPT Image 2.5 生成与编辑分别是 `gpt-image-2.5-flare-c` 和 `gpt-image-2.5-sunburst-c`；nanobanana 仍使用 `gemini-3.1-flash-image-preview`。具体模型只在服务端执行、定价和审计边界出现。
-_Avoid_: 把具体模型写入普通前端 DTO、让未知字符串自动选择 provider
-
-**provider client**:
-按具体模型选出的外部图片 provider 连接配置，包含 provider identity、base URL 和 API key；VectorEngine 与 Tiantoken client 共享图片协议执行器，不复制请求/响应业务逻辑。两套 required client 在 api-server 启动时构造。
-_Avoid_: 在首次请求时才创建 client、在 provider client 中复制尺寸/重试/审计逻辑、跨 provider credential fallback
-
-**历史模型值**:
-已持久化的 `gpt-image-2` 字符串，只作为历史事实原样读取和审计；基于历史资源提交新任务时，在使用端解析为当前 GPT Image 2.5 业务任务，不回写历史记录，也不把旧值作为现役 provider route。已退役的 `gpt-image-2-c` 已从代码整体删除，只有数据库里的历史审计字符串原样保留，任何入口传入该值都按不支持的值处理。
-_Avoid_: 数据库批量改写历史值、把历史值重新路由到 VectorEngine、把兼容解析扩散到普通前端、为已删除的 `gpt-image-2-c` 重新加回常量或解析分支
-
-**GPT Image 2.5 新生成展示名**:
-`GPT Image 2.5` 是新生成任务的产品展示名；历史资源与既有编辑上下文不因新模型上线而改写展示语义。
-_Avoid_: 把新生成展示名扩散到历史记录、历史生成器或旧编辑上下文
-
 **系列素材图集生成**:
 一组同类素材的统一批量生成方式，采用批量规划、sheet 生图、后端切图、透明化、OSS 持久化和局部重生成的通用流水线。
 _Avoid_: 为每个玩法单独发明素材流水线、把系列素材建模成任一玩法专属 DTO
@@ -223,6 +194,34 @@ _Avoid_: 进度通知、快照轮询、第二套历史
 把项目对话历史条目与运行态事件转换成消息气泡和工具卡片的读取期转换；不持久化，也不构成事实源。
 _Avoid_: 投影缓存文件、已脱敏卡片库、第二套 reducer
 
+**引用候选**:
+输入区可以命中的对象集合（`@` 素材、`$` Skill），由宿主按种类注入；输入区不判断候选属于哪一类。
+_Avoid_: 输入区自己读项目清单或应用目录、把候选取值写死在组件里
+
+**引用 provider**:
+一种引用种类向输入区提供的全部能力：触发符、候选、身份解析与正文文本形态；每种引用各一份，宿主按需选择性注入。
+_Avoid_: 一个总装对象决定所有种类、输入区按种类分叉、provider 之间互相知道对方
+
+**静默 provider**:
+不提供候选、只负责已有引用身份与文本形态的 provider；附件与运行画面区域属于这一类，只能由外部插入或草稿回填进入正文。
+_Avoid_: 给附件或运行画面区域造候选、为它们保留输入区内的专门分支
+
+**引用文本语法**:
+引用在正文文本里的形态（`@显示名` / `$名称` / `@附件名`）及其反解析；出站与解析必须同一口径，token 前后各留一个空白。
+_Avoid_: 出站与解析各写一套、在空白边界之外再补兼容别名、让解析依赖具体种类的字段
+
+**引用输入区**:
+只负责编辑与渲染引用的共享输入组件；候选、身份解析与文本语法都来自注入的 provider，它不持有项目清单、不访问后端。
+_Avoid_: 输入区自己拉 Skill 目录、把选择器面板塞在输入区内部
+
+**引用选择器**:
+宿主渲染的独立面板，自己拿数据与筛选状态，确认后把选中的引用交给输入区的插入缝。
+_Avoid_: 输入区自带面板、每个宿主各画一个、绕开插入缝另开第二条通道
+
+**附件芯片**:
+聊天附件在正文里的唯一表示；附件导入成功即以芯片进入正文，正文之外不存在第二份附件状态。
+_Avoid_: 待发送附件列表与正文芯片并存、提交时再拼一遍附件
+
 ## Relationships
 
 - 一个 **汪汪声浪大作战** 单局包含多个 **有效声浪触发**。
@@ -238,6 +237,10 @@ _Avoid_: 投影缓存文件、已脱敏卡片库、第二套 reducer
 - **个人历史成绩** 由最近记录列表和个人最佳摘要组成，只允许本人查看；排行榜只公开入榜胜利成绩。
 - **正式作品入口闭环** 必须覆盖创作入口、作品详情 CTA、广场/作品卡片、我的作品/个人作品架、稳定作品 ID runtime 路由和 `work_play_start` 埋点。
 - **Phase 2 实施顺序** 固定为：契约与领域规则 → SpacetimeDB 表/reducer 与 api-server BFF → 最小前端纵切 → 投影与列表体验 → 收口验证。
+- **引用输入区** 由宿主注入的若干 **引用 provider** 组成；**引用候选** 与 **引用文本语法** 都来自 provider，输入区不判断引用种类。
+- **引用选择器** 不属于 **引用输入区**：它自己拿数据，确认后只通过输入区的插入缝交付引用。
+- 只有带触发符的 **引用 provider** 会产生候选；**静默 provider** 没有触发符，只能由外部插入或草稿回填进入正文。
+- **附件芯片** 是本轮附件的唯一事实源；附件导入失败时不产生芯片。
 
 ## Example dialogue
 

apps/admin-web/src/api/adminApiClient.test.ts

@@ -7,9 +7,12 @@ import {
   getAdminFeatureGateConfig,
   getAdminUserDetail,
   importAdminAgcTemplates,
+  listAdminGameDistributionReviews,
   listAdminRechargeOrders,
   reconcileAdminUserConsumption,
   resolveAdminRechargeRefundManualReview,
+  reviewAdminGameDistributionVersion,
+  suspendAdminGameDistributionGame,
   updateAdminAccount,
   updateAdminAgcTemplate,
   uploadAdminEditorShowcaseCampaignImage,
@@ -454,3 +457,134 @@ test('退款人工复核使用独立 resolve 管理员路由', async () => {
     }),
   );
 });
+
+test('游戏审核列表与审核动作使用约定的 URL、方法和幂等键', async () => {
+  const fetchMock = vi.fn().mockImplementation(() =>
+    Promise.resolve(
+      new Response(JSON.stringify({ entries: [], nextCursor: null }), {
+        status: 200,
+      }),
+    ),
+  );
+  vi.stubGlobal('fetch', fetchMock);
+
+  await listAdminGameDistributionReviews('admin-token');
+  await reviewAdminGameDistributionVersion(
+    'admin-token',
+    'gamever/1',
+    'game-review-key-1',
+    {
+      decision: 'approve',
+      expectedPublicationRevision: 3,
+      entryUrl: 'https://games.example.test/releases/game_1/index.html',
+    },
+  );
+
+  expect(fetchMock.mock.calls[0]?.[0]).toBe(
+    '/admin/api/game-distribution/reviews?limit=48',
+  );
+  expect(fetchMock.mock.calls[1]?.[0]).toBe(
+    '/admin/api/game-distribution/versions/gamever%2F1/review',
+  );
+  expect(fetchMock.mock.calls[1]?.[1]).toEqual(
+    expect.objectContaining({
+      method: 'POST',
+      headers: expect.objectContaining({
+        Authorization: 'Bearer admin-token',
+        'Idempotency-Key': 'game-review-key-1',
+      }),
+      body: JSON.stringify({
+        decision: 'approve',
+        expectedPublicationRevision: 3,
+        entryUrl: 'https://games.example.test/releases/game_1/index.html',
+      }),
+    }),
+  );
+});
+
+test('安全下架请求携带公开修订号、原因与幂等键', async () => {
+  const fetchMock = vi.fn().mockImplementation(() =>
+    Promise.resolve(
+      new Response(JSON.stringify({ game: {}, replayed: false }), {
+        status: 200,
+      }),
+    ),
+  );
+  vi.stubGlobal('fetch', fetchMock);
+
+  await suspendAdminGameDistributionGame(
+    'admin-token',
+    'game/1',
+    'game-suspend-key-1',
+    { expectedPublicationRevision: 7, reason: '版权投诉' },
+  );
+
+  expect(fetchMock.mock.calls[0]?.[0]).toBe(
+    '/admin/api/game-distribution/games/game%2F1/suspend',
+  );
+  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
+    expect.objectContaining({
+      method: 'POST',
+      headers: expect.objectContaining({
+        Authorization: 'Bearer admin-token',
+        'Idempotency-Key': 'game-suspend-key-1',
+      }),
+      body: JSON.stringify({
+        expectedPublicationRevision: 7,
+        reason: '版权投诉',
+      }),
+    }),
+  );
+
+  expect(() =>
+    suspendAdminGameDistributionGame('admin-token', '  ', 'key', {
+      expectedPublicationRevision: 1,
+    }),
+  ).toThrow('缺少游戏 ID');
+  expect(() =>
+    suspendAdminGameDistributionGame('admin-token', 'game-1', '  ', {
+      expectedPublicationRevision: 1,
+    }),
+  ).toThrow('下架幂等键必须是 1 到 128 个字符');
+  expect(fetchMock).toHaveBeenCalledTimes(1);
+});
+
+test('游戏审核拒绝请求携带理由，空幂等键在本地失败关闭', async () => {
+  const fetchMock = vi.fn().mockImplementation(() =>
+    Promise.resolve(
+      new Response(JSON.stringify({ version: {}, replayed: false }), {
+        status: 200,
+      }),
+    ),
+  );
+  vi.stubGlobal('fetch', fetchMock);
+
+  await reviewAdminGameDistributionVersion(
+    'admin-token',
+    'version-1',
+    'game-review-key-2',
+    {
+      decision: 'reject',
+      expectedPublicationRevision: 0,
+      reviewReason: '运行时报错',
+    },
+  );
+  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
+    expect.objectContaining({
+      body: JSON.stringify({
+        decision: 'reject',
+        expectedPublicationRevision: 0,
+        reviewReason: '运行时报错',
+      }),
+    }),
+  );
+
+  expect(() =>
+    reviewAdminGameDistributionVersion('admin-token', 'version-1', '   ', {
+      decision: 'reject',
+      expectedPublicationRevision: 0,
+      reviewReason: 'x',
+    }),
+  ).toThrow('审核幂等键必须是 1 到 128 个字符');
+  expect(fetchMock).toHaveBeenCalledTimes(1);
+});

apps/admin-web/src/api/adminApiClient.ts

@@ -30,6 +30,9 @@ import type {
   AdminExternalApiKeyListQuery,
   AdminExternalApiKeyListResponse,
   AdminFeatureGateConfigResponse,
+  AdminGameDistributionReviewListResponse,
+  AdminGameDistributionReviewRequest,
+  AdminGameDistributionReviewResponse,
   AdminImportAgcTemplatesResponse,
   AdminLoginResponse,
   AdminMeResponse,
@@ -1200,6 +1203,75 @@ export function saveAgcModelCatalog(
   );
 }
 
+export function listAdminGameDistributionReviews(token: string, limit = 48) {
+  const normalizedLimit = Number.isFinite(limit)
+    ? Math.min(Math.max(Math.trunc(limit), 1), 48)
+    : 48;
+  return request<AdminGameDistributionReviewListResponse>(
+    `/admin/api/game-distribution/reviews?limit=${normalizedLimit}`,
+    { token },
+  );
+}
+
+/**
+ * 审核游戏发行版本。幂等键由调用方生成并在同一次提交内复用，避免重复点击产生
+ * 两条审核结论。
+ */
+/**
+ * 安全下架整个游戏。管理员下架同样要求 CAS 修订号与幂等键，避免并发审核互相覆盖。
+ */
+export function suspendAdminGameDistributionGame(
+  token: string,
+  gameId: string,
+  idempotencyKey: string,
+  payload: import('./adminApiTypes').AdminGameDistributionSuspendRequest,
+) {
+  const normalizedGameId = gameId.trim();
+  const normalizedKey = idempotencyKey.trim();
+  if (!normalizedGameId) {
+    throw new Error('缺少游戏 ID');
+  }
+  if (!normalizedKey || normalizedKey.length > 128) {
+    throw new Error('下架幂等键必须是 1 到 128 个字符');
+  }
+  return request<
+    import('./adminApiTypes').AdminGameDistributionSuspendResponse
+  >(
+    `/admin/api/game-distribution/games/${encodeURIComponent(normalizedGameId)}/suspend`,
+    {
+      method: 'POST',
+      token,
+      headers: { 'Idempotency-Key': normalizedKey },
+      body: payload,
+    },
+  );
+}
+
+export function reviewAdminGameDistributionVersion(
+  token: string,
+  versionId: string,
+  idempotencyKey: string,
+  payload: AdminGameDistributionReviewRequest,
+) {
+  const normalizedVersionId = versionId.trim();
+  const normalizedKey = idempotencyKey.trim();
+  if (!normalizedVersionId) {
+    throw new Error('缺少发行版本 ID');
+  }
+  if (!normalizedKey || normalizedKey.length > 128) {
+    throw new Error('审核幂等键必须是 1 到 128 个字符');
+  }
+  return request<AdminGameDistributionReviewResponse>(
+    `/admin/api/game-distribution/versions/${encodeURIComponent(normalizedVersionId)}/review`,
+    {
+      method: 'POST',
+      token,
+      headers: { 'Idempotency-Key': normalizedKey },
+      body: payload,
+    },
+  );
+}
+
 export function getAdminAgcTemplates(token: string, signal?: AbortSignal) {
   return request<AdminAgcTemplateLibraryResponse>('/admin/api/agc-templates', {
     token,

apps/admin-web/src/api/adminApiTypes.ts

@@ -1043,6 +1043,51 @@ export interface AdminAgcModelCatalog {
   models: AdminAgcModel[];
 }
 
+export interface AdminGameDistributionReviewEntry {
+  versionId: string;
+  gameId: string;
+  versionNumber: number;
+  packageSha256: string;
+  packageBytes: number;
+  status: string;
+  publicationRevision: number;
+  reviewReason: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface AdminGameDistributionReviewListResponse {
+  entries: AdminGameDistributionReviewEntry[];
+  nextCursor: string | null;
+}
+
+export interface AdminGameDistributionReviewRequest {
+  decision: 'approve' | 'reject';
+  expectedPublicationRevision: number;
+  reviewReason?: string;
+  entryUrl?: string;
+}
+
+export interface AdminGameDistributionReviewResponse {
+  version: AdminGameDistributionReviewEntry;
+  replayed: boolean;
+}
+
+export interface AdminGameDistributionSuspendRequest {
+  expectedPublicationRevision: number;
+  reason?: string;
+}
+
+export interface AdminGameDistributionSuspendResponse {
+  game: {
+    id: string;
+    title: string;
+    status: string;
+    publicationRevision: number;
+  };
+  replayed: boolean;
+}
+
 export interface AdminAgcTemplatePayload {
   id: string;
   title: string;

apps/admin-web/src/app/AdminApp.tsx

@@ -27,6 +27,7 @@ import { AdminEditorAssetQueryPage } from '../pages/AdminEditorAssetQueryPage';
 import { AdminEditorGenerationPricingPage } from '../pages/AdminEditorGenerationPricingPage';
 import { AdminEditorShowcaseReviewPage } from '../pages/AdminEditorShowcaseReviewPage';
 import { AdminErrorReportsPage } from '../pages/AdminErrorReportsPage';
+import { AdminGameDistributionReviewPage } from '../pages/AdminGameDistributionReviewPage';
 import { AdminGrayReleaseConfigPage } from '../pages/AdminGrayReleaseConfigPage';
 import { AdminInviteCodePage } from '../pages/AdminInviteCodePage';
 import { AdminLoginPage } from '../pages/AdminLoginPage';
@@ -307,6 +308,12 @@ export function AdminApp() {
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
+      {activeRouteId === 'game-distribution' ? (
+        <AdminGameDistributionReviewPage
+          token={token}
+          onUnauthorized={handleUnauthorized}
+        />
+      ) : null}
       {activeRouteId === 'editor-assets' ? (
         <AdminEditorAssetQueryPage
           token={token}

apps/admin-web/src/app/AdminShell.tsx

@@ -5,6 +5,7 @@ import {
   Coins,
   Database,
   FolderArchive,
+  Gamepad2,
   GitBranch,
   Images,
   LayoutDashboard,
@@ -49,6 +50,7 @@ const routeIcons = {
   'recharge-orders': ReceiptText,
   'editor-generation-pricing': Coins,
   'editor-showcase': Star,
+  'game-distribution': Gamepad2,
   'editor-assets': Images,
   'project-snapshots': FolderArchive,
   accounts: Users,

apps/admin-web/src/app/adminRoutes.test.ts

@@ -148,6 +148,27 @@ test('项目工程入口对 owner 与已授权 member 开放且可分配权限',
   ).not.toContainEqual(route);
 });
 
+test('后台游戏审核路由可通过导航和 hash 访问', () => {
+  expect(adminRoutes).toContainEqual({
+    id: 'game-distribution',
+    label: '游戏审核',
+    hash: '#game-distribution',
+  });
+  expect(resolveAdminRoute('#game-distribution')).toBe('game-distribution');
+  expect(routeHash('game-distribution')).toBe('#game-distribution');
+});
+
+test('member 可单独获得游戏审核 Tab 权限', () => {
+  const routes = getAccessibleAdminRoutes({
+    accountRole: 'member',
+    tabPermissions: ['game-distribution'],
+  });
+  expect(routes.map((route) => route.id)).toEqual(['game-distribution']);
+  expect(resolveAccessibleAdminRoute('#game-distribution', routes)).toBe(
+    'game-distribution',
+  );
+});
+
 test('模板管理只对 owner 或具有 agc-templates 权限的 member 可见', () => {
   expect(adminRoutes).toContainEqual({
     id: 'agc-templates',

apps/admin-web/src/app/adminRoutes.ts

@@ -15,6 +15,7 @@ export type AdminRouteId =
   | 'recharge-orders'
   | 'editor-generation-pricing'
   | 'editor-showcase'
+  | 'game-distribution'
   | 'editor-assets'
   | 'project-snapshots'
   | 'agc-models'
@@ -56,6 +57,7 @@ export const adminRoutes: AdminRouteDefinition[] = [
   { id: 'agc-models', label: 'AGC 模型', hash: '#agc-models', ownerOnly: true },
   { id: 'agc-templates', label: '模板管理', hash: '#agc-templates' },
   { id: 'editor-showcase', label: '精选审核', hash: '#editor-showcase' },
+  { id: 'game-distribution', label: '游戏审核', hash: '#game-distribution' },
   { id: 'editor-assets', label: '素材查询', hash: '#editor-assets' },
   { id: 'project-snapshots', label: '项目工程', hash: '#project-snapshots' },
   { id: 'accounts', label: '账号管理', hash: '#accounts', ownerOnly: true },

apps/admin-web/src/pages/AdminGameDistributionReviewPage.test.tsx

@@ -0,0 +1,186 @@
+/* @vitest-environment jsdom */
+
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { beforeEach, expect, test, vi } from 'vitest';
+
+import {
+  listAdminGameDistributionReviews,
+  reviewAdminGameDistributionVersion,
+  suspendAdminGameDistributionGame,
+} from '../api/adminApiClient';
+import type { AdminGameDistributionReviewEntry } from '../api/adminApiTypes';
+import {
+  AdminGameDistributionReviewPage,
+  resolveGameReleaseEntryUrlError,
+} from './AdminGameDistributionReviewPage';
+
+vi.mock('../api/adminApiClient', () => ({
+  isAdminApiError: vi.fn(
+    (error: unknown) =>
+      typeof error === 'object' &&
+      error !== null &&
+      'status' in error &&
+      typeof error.status === 'number',
+  ),
+  formatAdminApiError: vi.fn((error: unknown) =>
+    error instanceof Error ? error.message : '请求失败',
+  ),
+  listAdminGameDistributionReviews: vi.fn(),
+  reviewAdminGameDistributionVersion: vi.fn(),
+  suspendAdminGameDistributionGame: vi.fn(),
+}));
+
+const entry: AdminGameDistributionReviewEntry = {
+  versionId: 'version-1',
+  gameId: 'game_1',
+  versionNumber: 2,
+  packageSha256: 'a'.repeat(64),
+  packageBytes: 2048,
+  status: 'pending_review',
+  publicationRevision: 4,
+  reviewReason: null,
+  createdAt: '2026-09-20T08:00:00Z',
+  updatedAt: '2026-09-20T08:00:00Z',
+};
+
+beforeEach(() => {
+  vi.mocked(listAdminGameDistributionReviews).mockReset();
+  vi.mocked(reviewAdminGameDistributionVersion).mockReset();
+  vi.mocked(suspendAdminGameDistributionGame).mockReset();
+  vi.mocked(listAdminGameDistributionReviews).mockResolvedValue({
+    entries: [entry],
+    nextCursor: null,
+  });
+});
+
+test('发行入口必须是带完整来源的 HTTPS 地址', () => {
+  expect(resolveGameReleaseEntryUrlError('')).toBe('请填写发行入口');
+  expect(
+    resolveGameReleaseEntryUrlError('http://games.test/a/index.html'),
+  ).toBe('发行入口必须以 https:// 开头');
+  expect(
+    resolveGameReleaseEntryUrlError('https://games.test/a/index.html?token=1'),
+  ).toBe('发行入口不能包含 query 或 fragment');
+  expect(
+    resolveGameReleaseEntryUrlError('https://u:p@games.test/a/index.html'),
+  ).toBe('发行入口不能包含凭据');
+  expect(
+    resolveGameReleaseEntryUrlError('https://games.test/a/index.html'),
+  ).toBe('');
+});
+
+test('通过审核时提交当前 publicationRevision 与发行入口并刷新列表', async () => {
+  vi.mocked(reviewAdminGameDistributionVersion).mockResolvedValue({
+    version: { ...entry, status: 'published' },
+    replayed: false,
+  });
+
+  render(
+    <AdminGameDistributionReviewPage
+      token="admin-token"
+      onUnauthorized={vi.fn()}
+    />,
+  );
+  await screen.findByText('game_1');
+
+  fireEvent.change(screen.getByLabelText('发行入口'), {
+    target: { value: 'https://games.test/releases/game_1/index.html' },
+  });
+  fireEvent.click(screen.getByRole('button', { name: '通过' }));
+
+  await waitFor(() =>
+    expect(reviewAdminGameDistributionVersion).toHaveBeenCalledTimes(1),
+  );
+  const [token, versionId, idempotencyKey, payload] =
+    vi.mocked(reviewAdminGameDistributionVersion).mock.calls[0] ?? [];
+  expect(token).toBe('admin-token');
+  expect(versionId).toBe('version-1');
+  expect(String(idempotencyKey)).toContain('version-1');
+  expect(payload).toEqual({
+    decision: 'approve',
+    expectedPublicationRevision: 4,
+    entryUrl: 'https://games.test/releases/game_1/index.html',
+  });
+  await waitFor(() =>
+    expect(vi.mocked(listAdminGameDistributionReviews)).toHaveBeenCalledTimes(
+      2,
+    ),
+  );
+});
+
+test('缺少拒绝理由时不调用审核接口', async () => {
+  render(
+    <AdminGameDistributionReviewPage
+      token="admin-token"
+      onUnauthorized={vi.fn()}
+    />,
+  );
+  await screen.findByText('game_1');
+
+  fireEvent.click(screen.getByRole('button', { name: '拒绝' }));
+
+  expect(await screen.findByText('拒绝审核必须填写理由')).toBeTruthy();
+  expect(reviewAdminGameDistributionVersion).not.toHaveBeenCalled();
+});
+
+test('安全下架需要二次确认，并携带公开修订号与原因', async () => {
+  vi.mocked(suspendAdminGameDistributionGame).mockResolvedValue({
+    game: {
+      id: 'game_1',
+      title: '测试游戏',
+      status: 'suspended',
+      publicationRevision: 5,
+    },
+    replayed: false,
+  });
+
+  render(
+    <AdminGameDistributionReviewPage
+      token="admin-token"
+      onUnauthorized={vi.fn()}
+    />,
+  );
+  await screen.findByText('game_1');
+
+  fireEvent.change(screen.getByLabelText('下架原因'), {
+    target: { value: '盗用素材' },
+  });
+  fireEvent.click(screen.getByRole('button', { name: '安全下架' }));
+
+  // 第一次点击只弹出确认面板，不直接调用后端。
+  expect(suspendAdminGameDistributionGame).not.toHaveBeenCalled();
+  expect(await screen.findByRole('dialog')).toBeTruthy();
+
+  fireEvent.click(screen.getByRole('button', { name: '确认' }));
+
+  await waitFor(() =>
+    expect(suspendAdminGameDistributionGame).toHaveBeenCalledTimes(1),
+  );
+  const [token, gameId, idempotencyKey, payload] =
+    vi.mocked(suspendAdminGameDistributionGame).mock.calls[0] ?? [];
+  expect(token).toBe('admin-token');
+  expect(gameId).toBe('game_1');
+  expect(String(idempotencyKey)).toContain('game_1');
+  expect(payload).toEqual({
+    expectedPublicationRevision: 4,
+    reason: '盗用素材',
+  });
+  expect(await screen.findByText(/已安全下架/u)).toBeTruthy();
+});
+
+test('取消确认时不下架', async () => {
+  render(
+    <AdminGameDistributionReviewPage
+      token="admin-token"
+      onUnauthorized={vi.fn()}
+    />,
+  );
+  await screen.findByText('game_1');
+
+  fireEvent.click(screen.getByRole('button', { name: '安全下架' }));
+  await screen.findByRole('dialog');
+  fireEvent.click(screen.getByRole('button', { name: '取消' }));
+
+  await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull());
+  expect(suspendAdminGameDistributionGame).not.toHaveBeenCalled();
+});

apps/admin-web/src/pages/AdminGameDistributionReviewPage.tsx

@@ -0,0 +1,365 @@
+import { RefreshCcw } from 'lucide-react';
+import { useCallback, useEffect, useState } from 'react';
+
+import {
+  listAdminGameDistributionReviews,
+  reviewAdminGameDistributionVersion,
+  suspendAdminGameDistributionGame,
+} from '../api/adminApiClient';
+import type { AdminGameDistributionReviewEntry } from '../api/adminApiTypes';
+import { useAdminWriteConfirm } from '../components/useAdminWriteConfirm';
+import { handlePageError } from './pageUtils';
+
+interface AdminGameDistributionReviewPageProps {
+  token: string;
+  onUnauthorized: (message?: string) => void;
+}
+
+function formatBytes(value: number) {
+  if (value >= 1024 * 1024) {
+    return `${(value / (1024 * 1024)).toFixed(1)} MiB`;
+  }
+  if (value >= 1024) {
+    return `${(value / 1024).toFixed(1)} KiB`;
+  }
+  return `${value} B`;
+}
+
+function formatTime(value: string) {
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime())) return value;
+  return parsed.toLocaleString('zh-CN', { hour12: false });
+}
+
+function createSuspendIdempotencyKey(gameId: string) {
+  const random =
+    typeof crypto !== 'undefined' && 'randomUUID' in crypto
+      ? crypto.randomUUID()
+      : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  return `game-suspend-${gameId}-${random}`.slice(0, 128);
+}
+
+function createReviewIdempotencyKey(versionId: string) {
+  const random =
+    typeof crypto !== 'undefined' && 'randomUUID' in crypto
+      ? crypto.randomUUID()
+      : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  return `game-review-${versionId}-${random}`.slice(0, 128);
+}
+
+export function resolveGameReleaseEntryUrlError(value: string) {
+  const normalized = value.trim();
+  if (!normalized) return '请填写发行入口';
+  if (!normalized.startsWith('https://')) {
+    return '发行入口必须以 https:// 开头';
+  }
+  if (normalized.includes('?') || normalized.includes('#')) {
+    return '发行入口不能包含 query 或 fragment';
+  }
+  try {
+    const parsed = new URL(normalized);
+    if (parsed.username || parsed.password) {
+      return '发行入口不能包含凭据';
+    }
+  } catch {
+    return '发行入口不是合法 URL';
+  }
+  return '';
+}
+
+export function AdminGameDistributionReviewPage({
+  token,
+  onUnauthorized,
+}: AdminGameDistributionReviewPageProps) {
+  const [entries, setEntries] = useState<AdminGameDistributionReviewEntry[]>(
+    [],
+  );
+  const [isLoading, setIsLoading] = useState(false);
+  const [busyVersionId, setBusyVersionId] = useState('');
+  const [errorMessage, setErrorMessage] = useState('');
+  const [statusMessage, setStatusMessage] = useState('');
+  const [entryUrlByVersion, setEntryUrlByVersion] = useState<
+    Record<string, string>
+  >({});
+  const [reasonByVersion, setReasonByVersion] = useState<
+    Record<string, string>
+  >({});
+  const [suspendReasonByGame, setSuspendReasonByGame] = useState<
+    Record<string, string>
+  >({});
+  const [busyGameId, setBusyGameId] = useState('');
+  const writeConfirm = useAdminWriteConfirm();
+
+  const loadReviews = useCallback(async () => {
+    setIsLoading(true);
+    setErrorMessage('');
+    try {
+      const response = await listAdminGameDistributionReviews(token);
+      setEntries(response.entries);
+    } catch (error) {
+      handlePageError(error, onUnauthorized, setErrorMessage);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [token, onUnauthorized]);
+
+  useEffect(() => {
+    void loadReviews();
+  }, [loadReviews]);
+
+  async function submitReview(
+    entry: AdminGameDistributionReviewEntry,
+    decision: 'approve' | 'reject',
+  ) {
+    const entryUrl = (entryUrlByVersion[entry.versionId] ?? '').trim();
+    const reason = (reasonByVersion[entry.versionId] ?? '').trim();
+    if (decision === 'approve') {
+      const invalid = resolveGameReleaseEntryUrlError(entryUrl);
+      if (invalid) {
+        setErrorMessage(invalid);
+        return;
+      }
+    } else if (!reason) {
+      setErrorMessage('拒绝审核必须填写理由');
+      return;
+    }
+    setBusyVersionId(entry.versionId);
+    setErrorMessage('');
+    setStatusMessage('');
+    try {
+      await reviewAdminGameDistributionVersion(
+        token,
+        entry.versionId,
+        createReviewIdempotencyKey(entry.versionId),
+        decision === 'approve'
+          ? {
+              decision,
+              expectedPublicationRevision: entry.publicationRevision,
+              entryUrl,
+            }
+          : {
+              decision,
+              expectedPublicationRevision: entry.publicationRevision,
+              reviewReason: reason,
+            },
+      );
+      setStatusMessage(
+        decision === 'approve'
+          ? `版本 v${entry.versionNumber} 已通过审核`
+          : `版本 v${entry.versionNumber} 已拒绝`,
+      );
+      await loadReviews();
+    } catch (error) {
+      handlePageError(error, onUnauthorized, setErrorMessage);
+    } finally {
+      setBusyVersionId('');
+    }
+  }
+
+  /**
+   * 管理员安全下架：先二次确认，再带当前公开修订号调用后端；并发审核导致修订号变化时
+   * 由服务端返回冲突，前端只提示刷新，不静默重试。
+   */
+  async function suspendGame(entry: AdminGameDistributionReviewEntry) {
+    const reason = (suspendReasonByGame[entry.gameId] ?? '').trim();
+    const confirmed = await writeConfirm.confirmWrite({
+      action: '安全下架游戏',
+      target: `${entry.gameId}（版本 v${entry.versionNumber}）`,
+    });
+    if (!confirmed) return;
+    setBusyGameId(entry.gameId);
+    setErrorMessage('');
+    setStatusMessage('');
+    try {
+      await suspendAdminGameDistributionGame(
+        token,
+        entry.gameId,
+        createSuspendIdempotencyKey(entry.gameId),
+        {
+          expectedPublicationRevision: entry.publicationRevision,
+          ...(reason ? { reason } : {}),
+        },
+      );
+      setStatusMessage(`游戏 ${entry.gameId} 已安全下架，发行入口已关闭`);
+      setSuspendReasonByGame((current) => ({ ...current, [entry.gameId]: '' }));
+      await loadReviews();
+    } catch (error) {
+      handlePageError(error, onUnauthorized, setErrorMessage);
+    } finally {
+      setBusyGameId('');
+    }
+  }
+
+  return (
+    <section className="admin-page admin-page-wide">
+      <div className="admin-page-heading">
+        <h1>游戏审核</h1>
+        <button
+          type="button"
+          className="admin-secondary-button"
+          onClick={() => void loadReviews()}
+          disabled={isLoading}
+        >
+          <RefreshCcw aria-hidden="true" />
+          刷新
+        </button>
+      </div>
+
+      {errorMessage ? (
+        <div className="admin-alert admin-alert-warning" role="alert">
+          {errorMessage}
+        </div>
+      ) : null}
+      {statusMessage ? (
+        <div className="admin-alert admin-alert-success" role="status">
+          {statusMessage}
+        </div>
+      ) : null}
+
+      <div className="admin-panel">
+        <div className="admin-panel-heading">
+          <h2>待审版本</h2>
+          <span className="admin-muted-text">共 {entries.length} 条</span>
+        </div>
+
+        {isLoading ? (
+          <p className="admin-muted-text">正在加载待审版本…</p>
+        ) : null}
+
+        {!isLoading && entries.length === 0 ? (
+          <p className="admin-muted-text">当前没有待审核的游戏版本。</p>
+        ) : null}
+
+        {!isLoading && entries.length > 0 ? (
+          <div className="admin-table-wrap">
+            <table className="admin-table admin-table-wide">
+              <thead>
+                <tr>
+                  <th>游戏</th>
+                  <th>版本</th>
+                  <th>发行包</th>
+                  <th>提交时间</th>
+                  <th>审核</th>
+                </tr>
+              </thead>
+              <tbody>
+                {entries.map((entry) => {
+                  const busy = busyVersionId === entry.versionId;
+                  return (
+                    <tr key={entry.versionId}>
+                      <td>
+                        <code>{entry.gameId}</code>
+                      </td>
+                      <td>
+                        v{entry.versionNumber}
+                        <div className="admin-muted-text">{entry.status}</div>
+                        {entry.reviewReason ? (
+                          <div className="admin-muted-text">
+                            {entry.reviewReason}
+                          </div>
+                        ) : null}
+                      </td>
+                      <td>
+                        {formatBytes(entry.packageBytes)}
+                        <div className="admin-muted-text">
+                          <code>{entry.packageSha256.slice(0, 12)}</code>
+                        </div>
+                      </td>
+                      <td>{formatTime(entry.createdAt)}</td>
+                      <td>
+                        <div className="admin-action-row">
+                          <div className="admin-field">
+                            <label
+                              htmlFor={`game-release-url-${entry.versionId}`}
+                            >
+                              发行入口
+                            </label>
+                            <input
+                              id={`game-release-url-${entry.versionId}`}
+                              value={entryUrlByVersion[entry.versionId] ?? ''}
+                              placeholder="https://"
+                              onChange={(event) =>
+                                setEntryUrlByVersion((current) => ({
+                                  ...current,
+                                  [entry.versionId]: event.target.value,
+                                }))
+                              }
+                              disabled={busy}
+                            />
+                          </div>
+                          <button
+                            type="button"
+                            className="admin-primary-button"
+                            disabled={busy}
+                            onClick={() => void submitReview(entry, 'approve')}
+                          >
+                            通过
+                          </button>
+                          <div className="admin-field">
+                            <label
+                              htmlFor={`game-reject-reason-${entry.versionId}`}
+                            >
+                              拒绝理由
+                            </label>
+                            <input
+                              id={`game-reject-reason-${entry.versionId}`}
+                              value={reasonByVersion[entry.versionId] ?? ''}
+                              onChange={(event) =>
+                                setReasonByVersion((current) => ({
+                                  ...current,
+                                  [entry.versionId]: event.target.value,
+                                }))
+                              }
+                              disabled={busy}
+                            />
+                          </div>
+                          <button
+                            type="button"
+                            className="admin-ghost-button"
+                            disabled={busy}
+                            onClick={() => void submitReview(entry, 'reject')}
+                          >
+                            拒绝
+                          </button>
+                          <div className="admin-field">
+                            <label
+                              htmlFor={`game-suspend-reason-${entry.versionId}`}
+                            >
+                              下架原因
+                            </label>
+                            <input
+                              id={`game-suspend-reason-${entry.versionId}`}
+                              value={suspendReasonByGame[entry.gameId] ?? ''}
+                              onChange={(event) =>
+                                setSuspendReasonByGame((current) => ({
+                                  ...current,
+                                  [entry.gameId]: event.target.value,
+                                }))
+                              }
+                              disabled={busy}
+                            />
+                          </div>
+                          <button
+                            type="button"
+                            className="admin-danger-button"
+                            disabled={busy || busyGameId === entry.gameId}
+                            onClick={() => void suspendGame(entry)}
+                          >
+                            {busyGameId === entry.gameId
+                              ? '正在下架…'
+                              : '安全下架'}
+                          </button>
+                        </div>
+                      </td>
+                    </tr>
+                  );
+                })}
+              </tbody>
+            </table>
+          </div>
+        ) : null}
+      </div>
+      {writeConfirm.confirmDialog}
+    </section>
+  );
+}

apps/admin-web/src/pages/AdminGrayReleaseConfigPage.test.tsx

@@ -175,6 +175,86 @@ test('灰度发布页可选择模板库并默认启用零比例灰度', async ()
   );
 });
 
+test('灰度发布页可选择游戏发布开关，默认保持「未开启即开放」语义', async () => {
+  const user = userEvent.setup();
+  render(
+    <AdminGrayReleaseConfigPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  await screen.findByRole('button', { name: 'editor.new-toolbar' });
+  await user.selectOptions(screen.getByLabelText('Gate Key 前缀'), [
+    'game-distribution',
+  ]);
+
+  expect((screen.getByLabelText('Gate Key') as HTMLInputElement).value).toBe(
+    'game-distribution:publish',
+  );
+  expect(
+    (screen.getByLabelText('Gate Key 目标') as HTMLSelectElement).value,
+  ).toBe('publish');
+  // 该开关的语义是「未配置/关闭 = 默认开放」，所以选中后不能默认打开收紧。
+  expect((screen.getByLabelText('启用') as HTMLInputElement).checked).toBe(
+    false,
+  );
+  expect((screen.getByLabelText('灰度比例') as HTMLInputElement).value).toBe(
+    '0',
+  );
+  expect(
+    (screen.getByLabelText('描述') as HTMLTextAreaElement).value,
+  ).toContain('游戏发布入口灰度');
+});
+
+test('灰度发布页保存游戏发布开关时写入白名单与比例', async () => {
+  const user = userEvent.setup();
+  vi.mocked(upsertAdminFeatureGateConfig).mockResolvedValueOnce({
+    gates: [
+      ...configResponse.gates,
+      {
+        gateKey: 'game-distribution:publish',
+        enabled: true,
+        rolloutPercent: 20,
+        allowUserIds: ['user-internal'],
+        allowUserTags: [],
+        denyUserIds: [],
+        description: '游戏发布入口灰度',
+        updatedAt: '2026-09-22T10:00:00Z',
+      },
+    ],
+  });
+  render(
+    <AdminGrayReleaseConfigPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  await screen.findByRole('button', { name: 'editor.new-toolbar' });
+  await user.selectOptions(screen.getByLabelText('Gate Key 前缀'), [
+    'game-distribution',
+  ]);
+  fireEvent.click(screen.getByLabelText('启用'));
+  fireEvent.change(screen.getByLabelText('灰度比例'), {
+    target: { value: '20' },
+  });
+  fireEvent.change(screen.getByLabelText('允许用户 ID'), {
+    target: { value: 'user-internal' },
+  });
+  fireEvent.change(screen.getByLabelText('描述'), {
+    target: { value: '游戏发布入口灰度' },
+  });
+  await user.click(screen.getByRole('button', { name: '保存配置' }));
+  await user.click(screen.getByRole('button', { name: '确认' }));
+
+  await waitFor(() =>
+    expect(upsertAdminFeatureGateConfig).toHaveBeenCalledWith('admin-token', {
+      gateKey: 'game-distribution:publish',
+      enabled: true,
+      rolloutPercent: 20,
+      allowUserIds: ['user-internal'],
+      allowUserTags: [],
+      denyUserIds: [],
+      description: '游戏发布入口灰度',
+    }),
+  );
+});
+
 test('灰度发布页保存时转换数组和百分比', async () => {
   const user = userEvent.setup();
   vi.mocked(upsertAdminFeatureGateConfig).mockResolvedValueOnce({

apps/admin-web/src/pages/AdminGrayReleaseConfigPage.tsx

@@ -28,6 +28,7 @@ interface GateTargetOption {
 const GATE_PREFIX_LABELS: Record<string, string> = {
   'image-editor': '画布',
   agc: '客户端',
+  'game-distribution': '游戏分发',
 };
 
 const FIXED_GATE_TARGETS: GateTargetOption[] = [
@@ -45,6 +46,14 @@ const FIXED_GATE_TARGETS: GateTargetOption[] = [
     label: 'Agent 侧边栏',
     description: '画布 Agent 入口灰度',
   },
+  {
+    prefix: 'game-distribution',
+    suffix: 'publish',
+    key: 'game-distribution:publish',
+    label: '游戏发布',
+    description:
+      '游戏发布入口灰度：未配置或关闭时对已登录作者默认开放，开启后只放行白名单 / 灰度命中',
+  },
 ];
 
 export function AdminGrayReleaseConfigPage({

apps/ai-game-creator-shell/scripts/build-release.mjs

@@ -648,6 +648,32 @@ function readHeadCommit() {
   }
 }
 
+/**
+ * Git 的 %s 会把「标题后紧接说明行、没有空行」的整个首段拼成一行；
+ * 更新摘要只允许展示原始提交消息的第一行，避免把说明暴露给用户。
+ */
+function commitMessageTitle(message) {
+  return String(message ?? '')
+    .split(/\r?\n/u, 1)[0]
+    .trim();
+}
+
+/** 解析 `git log -z --format=%h%x09%B`，只保留每个 commit 的消息首行。 */
+function parseReleaseCommitLog(output) {
+  return output
+    .split('\0')
+    .map((record) => record.trimEnd())
+    .filter(Boolean)
+    .map((record) => {
+      const separator = record.indexOf('\t');
+      if (separator < 0) return null;
+      const sha = record.slice(0, separator);
+      const subject = commitMessageTitle(record.slice(separator + 1));
+      return sha && subject ? { sha, subject } : null;
+    })
+    .filter(Boolean);
+}
+
 /**
  * 上一次发布到本次之间的客户端相关提交。
  *
@@ -675,8 +701,9 @@ export function collectReleaseCommits(
       'git',
       [
         'log',
+        '-z',
         '--no-merges',
-        '--format=%h%x09%s',
+        '--format=%h%x09%B',
         `${previousCommit}..${headCommit}`,
         '--',
         ...paths,
@@ -686,28 +713,22 @@ export function collectReleaseCommits(
   } catch {
     return null;
   }
-  return output
-    .split(/\r?\n/u)
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .map((line) => {
-      const [sha = '', ...subject] = line.split('\t');
-      return { sha, subject: subject.join('\t') };
-    });
+  return parseReleaseCommitLog(output);
 }
 
-/** 自动更新摘要：逐条列客户端相关改动，超过上限时折叠并整体截断。 */
+/** 自动更新摘要：逐条列客户端相关改动标题，超过上限时折叠并整体截断。 */
 export function formatReleaseNotes(
   commits,
   { limit = 12, subjectLength = 80, maxLength = 900 } = {},
 ) {
   if (!commits || commits.length === 0) return '';
-  const lines = commits.slice(0, limit).map(({ sha, subject }) => {
+  const lines = commits.slice(0, limit).map(({ subject }) => {
+    const title = commitMessageTitle(subject);
     const trimmed =
-      subject.length > subjectLength
-        ? `${subject.slice(0, subjectLength - 1)}…`
-        : subject;
-    return `- ${trimmed}（${sha}）`;
+      title.length > subjectLength
+        ? `${title.slice(0, subjectLength - 1)}…`
+        : title;
+    return `- ${trimmed}`;
   });
   if (commits.length > limit) {
     lines.push(`- 其余 ${commits.length - limit} 项客户端改动省略`);
@@ -726,20 +747,21 @@ export function collectRecentReleaseCommits({
   try {
     output = execFileSync(
       'git',
-      ['log', '--no-merges', `-n${limit}`, '--format=%h%x09%s', '--', ...paths],
+      [
+        'log',
+        '-z',
+        '--no-merges',
+        `-n${limit}`,
+        '--format=%h%x09%B',
+        '--',
+        ...paths,
+      ],
       { cwd, encoding: 'utf8' },
     );
   } catch {
     return null;
   }
-  const commits = output
-    .split(/\r?\n/u)
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .map((line) => {
-      const [sha = '', ...subject] = line.split('\t');
-      return { sha, subject: subject.join('\t') };
-    });
+  const commits = parseReleaseCommitLog(output);
   return commits.length > 0 ? commits : null;
 }
 

apps/ai-game-creator-shell/scripts/build-release.test.mjs

@@ -645,17 +645,19 @@ test('Windows remains the default and explicit Windows overrides macOS environme
 
 test('no-bundle smoke skips version writes and manifest generation', async () => {
   const steps = [];
-  await buildRelease(['--no-bundle', '--target=aarch64-apple-darwin'], {
-    prepareVersion: () => {
-      steps.push('version');
-    },
-    build: (_args, context) => {
-      steps.push(context.channel);
-    },
-    generateManifest: () => {
-      steps.push('manifest');
-    },
-  });
+  await withEnv({ AGC_UPDATE_CHANNEL: undefined }, () =>
+    buildRelease(['--no-bundle', '--target=aarch64-apple-darwin'], {
+      prepareVersion: () => {
+        steps.push('version');
+      },
+      build: (_args, context) => {
+        steps.push(context.channel);
+      },
+      generateManifest: () => {
+        steps.push('manifest');
+      },
+    }),
+  );
   assert.deepEqual(steps, ['dev']);
 });
 
@@ -1075,20 +1077,17 @@ test('release entry forwards the built artifacts and dry-run mode to the uploade
   assert.ok(source.includes('\n  dryRun,\n'));
 });
 
-test('release notes list client commits with short sha and bound their size', () => {
+test('release notes list client commit subjects only and bound their size', () => {
   const notes = formatReleaseNotes([
     { sha: 'a5fd25f1', subject: '客户端更新切换到官方更新插件' },
     { sha: '55af6014', subject: '修'.repeat(120) },
   ]);
   const lines = notes.split('\n');
   assert.equal(lines.length, 2);
-  assert.match(lines[0], /^- 客户端更新切换到官方更新插件（a5fd25f1）$/u);
-  const truncatedSubject = lines[1]
-    .replace(/^- /u, '')
-    .replace(/（55af6014）$/u, '');
+  assert.equal(lines[0], '- 客户端更新切换到官方更新插件');
+  const truncatedSubject = lines[1].replace(/^- /u, '');
   assert.equal(truncatedSubject.length, 80, `主题应截断到 80 字：${lines[1]}`);
   assert.match(truncatedSubject, /…$/u);
-  assert.match(lines[1], /（55af6014）$/u);
 
   const many = formatReleaseNotes(
     Array.from({ length: 20 }, (_, index) => ({
@@ -1097,6 +1096,15 @@ test('release notes list client commits with short sha and bound their size', ()
     })),
   );
   assert.match(many, /- 其余 8 项客户端改动省略$/u);
+  assert.equal(
+    formatReleaseNotes([
+      {
+        sha: 'ignored',
+        subject: '提交标题\n不应展示的说明一\n不应展示的说明二',
+      },
+    ]),
+    '- 提交标题',
+  );
   assert.equal(formatReleaseNotes([]), '');
   assert.equal(formatReleaseNotes(null), '');
 });
@@ -1120,8 +1128,17 @@ test('release commits cover only client paths and skip merge commits', () => {
       path.join(directory, 'apps/ai-game-creator-shell/main.rs'),
       'fn main() {}\n',
     );
+    const commitMessagePath = path.join(
+      directory,
+      '.git',
+      'commit-message.txt',
+    );
+    writeFileSync(
+      commitMessagePath,
+      '客户端：新增更新插件接入\n补充更新插件接入的详细说明\n',
+    );
     git('add', '.');
-    git('commit', '--quiet', '-m', '客户端：新增更新插件接入');
+    git('commit', '--quiet', '-F', commitMessagePath);
 
     writeFileSync(path.join(directory, 'docs/readme.md'), '# 文档\n');
     git('add', '.');
@@ -1147,6 +1164,7 @@ test('release commits cover only client paths and skip merge commits', () => {
     const commits = collectReleaseCommits(base, 'HEAD', { cwd: directory });
     assert.ok(commits, '应能在临时仓库里收集提交');
     const subjects = commits.map((entry) => entry.subject);
+    // 标题后没有空行时，git %s 会把说明行拼进标题；摘要必须取原始首行。
     // 合并提交本身被 --no-merges 排除，但它带入的客户端改动仍然计入。
     assert.deepEqual(subjects, [
       '客户端：侧分支改动',

apps/ai-game-creator-shell/scripts/check-config.mjs

@@ -200,15 +200,16 @@ const allowedUncalledTauriCommands = [
   'read_agc_plugin_panel',
   'set_agc_plugin_enabled',
   // 下面这些命令的调用方只有随 Project Supervisor 前端链路一起删除的旧命令聊天入口；
-  // 现在 App 前端、工作台与策划聊天都没有接线（检查点 / 恢复 / 索引 / 导出包 /
+  // 现在 App 前端、工作台与策划聊天都没有接线（检查点 / 恢复 / 索引 /
   // 画板同步 / 素材登记 / 权限策略 / 本地草案 / 平台美术），Rust 侧只剩注册与实现，
   // `*_at` helper 仍由 Rust 用例覆盖。接回新入口还是删除属于 native 能力取舍，先按
   // native-only 登记，避免孤儿检查一直报错。
   // 预览不在本清单：`activate_local_game_preview` 已按 ADR 回接到 App 的「运行」入口。
+  // 导出试玩包同样不在本清单：发布链路（`requestGamePublish`）已把它接回
+  // DirectProject 聊天头的「发布」入口。
   'build_local_project_index',
   'control_agent_run',
   'create_local_project_checkpoint',
-  'export_local_project_package',
   'generate_local_game_draft',
   'generate_platform_art_asset',
   'import_canvas_asset',
@@ -1940,6 +1941,7 @@ for (const snippet of [
   '官方账号服务（固定）',
   'runtime_config.save',
   "'/run：运行自检，启动本地 HTTP 预览并载入客户端运行视图'",
+  '已载入客户端运行视图',
   'async function executeRunLocal',
   'function needsInitializedChatProject',
   "'/remember [short|long|blackboard] 内容：追加短期、长期或黑板记忆'",

apps/ai-game-creator-shell/src-tauri/capabilities/main.json

@@ -16,7 +16,8 @@
         { "url": "https://www.genarrative.world/api/*" },
         { "url": "https://*/api/*" },
         { "url": "http://localhost:*/*" },
-        { "url": "http://127.0.0.1:*/*" }
+        { "url": "http://127.0.0.1:*/*" },
+        { "url": "https://*.aliyuncs.com/*" }
       ]
     },
     "opener:default",

apps/ai-game-creator-shell/src-tauri/src/agent/codex_cli.rs

@@ -203,12 +203,51 @@ pub(in crate::agent) fn game_creator_codex_cli_version_at(
     Ok(version.to_string())
 }
 
+/// 开发态允许从宿主 PATH 里找到 Codex，但宿主必须持有可锚定的绝对文件：
+/// 裸命令名按 PATH 解析成真实路径，否则 `bind_codex_executor` 的 canonicalize 会按 CWD 解析并失败。
+/// 发行构建不走这段，候选顺序、校验与返回值都与原先一致（打包环境用内置侧车/npm 绝对路径）。
+#[cfg(debug_assertions)]
+fn anchor_codex_cli_executable_candidate(
+    candidate: &Path,
+    path: Option<&std::ffi::OsStr>,
+) -> Option<PathBuf> {
+    let is_bare_command_name = candidate
+        .parent()
+        .is_some_and(|parent| parent.as_os_str().is_empty());
+    if !is_bare_command_name {
+        return candidate.is_file().then(|| candidate.to_path_buf());
+    }
+    let name = candidate.as_os_str();
+    for directory in path.into_iter().flat_map(std::env::split_paths) {
+        if directory.as_os_str().is_empty() {
+            continue;
+        }
+        let target = directory.join(name);
+        if target.is_file() {
+            // 第一个实际命中的项就是 OS 会执行的项；锚定失败时不再从 PATH 里换另一个。
+            return target.canonicalize().ok();
+        }
+    }
+    None
+}
+
 pub(crate) fn game_creator_codex_cli_executable_path() -> Result<PathBuf, String> {
     let mut last_error = None;
     let mut seen = std::collections::HashSet::new();
     let bundled =
         game_creator_bundled_codex_cli_path(game_creator_bundled_resource_dir().as_deref());
     for candidate in game_creator_codex_cli_executable_candidates() {
+        #[cfg(debug_assertions)]
+        let candidate = match anchor_codex_cli_executable_candidate(
+            &candidate,
+            std::env::var_os("PATH").as_deref(),
+        ) {
+            Some(candidate) => candidate,
+            None => {
+                last_error = Some("候选执行器不是可锚定的文件".to_string());
+                continue;
+            }
+        };
         let identity = candidate.to_string_lossy().to_ascii_lowercase();
         if !seen.insert(identity) {
             continue;

apps/ai-game-creator-shell/src-tauri/src/browser.rs

@@ -6,6 +6,7 @@ mod model;
 mod network_policy;
 mod playtest;
 mod process;
+mod sweep;
 
 pub use discovery::discover_chrome_or_edge;
 #[allow(unused_imports)]
@@ -22,6 +23,7 @@ pub(crate) use process::validate_local_preview_in_browser_with_cancellation;
 pub use process::{
     validate_local_preview_in_browser, validate_local_preview_in_browser_with_interaction,
 };
+pub(crate) use sweep::sweep_stale_browser_processes;
 
 pub(crate) use model::required_viewport_playtests_passed;
 pub(crate) use playtest::browser_playtest_scenario_fingerprint;