合并 master 并保留游戏分发功能

- 合并 origin/master（含 429f991bd 定向回滚、Godot 原生绑定迁移与策划 Agent 模型控件）。 - 回滚提交删除的游戏分发代码按功能面补回：SpacetimeDB 模块注册与迁移表、api-server 路由与权限映射、后台审核页、AGC 发布命令与 payload 类型、SelectionStage 的 games 阶段、ProjectSupervisorView 的 overlay 挂载点、主站路由与标题、Cargo 依赖与锁、vite/vitest 代理与 tailwind source。 - 保留 master 的 Godot C++ 迁移（移除旧 vendored GDExtension、新的 composer 控件布局）与其它 master 侧改动。 - 修正 master 自带的红灯断言：/api/creation-entry 已被 api-server 列入退役路由，dev 中间件按退役路径 404，测试改为断言不进入代理。 - 验证：cargo check（api-server / spacetime-module / spacetime-client / AGC 壳）、cargo test（api-server 游戏分发 17、module-game-distribution 11、AGC 本地导出 7）、全量 vitest 4557 passed、两端 typecheck、eslint、rustfmt、编码、文档索引与 SpacetimeDB schema guard。
把游戏分发客户端纳入 ESLint 边界
2026-09-21 00:20:45 +08:00 · 2026-09-20 22:56:43 +08:00 · 2026-09-20 22:49:56 +08:00 · 2026-09-20 22:45:50 +08:00 · 2026-09-20 22:34:33 +08:00 · 2026-09-20 22:19:50 +08:00
375 changed files with 24196 additions and 36087 deletions
@@ -4,5 +4,3 @@
 src/components/AdventurePanel.tsx
 src/data/customWorldCharacterLoadout.ts
 dist_check_monster_position/**
 # 固定上游UTF-8测试刻意包含U+FFFD；upstream-integrity.test.mjs逐字节验证来源hash。
 apps/ai-game-creator-shell/src-tauri/vendor/codex-utils-path-uri/src/api_path_string_tests.rs
@@ -213,6 +213,8 @@ module.exports = {
    '!src/services/clipboard.test.ts',
    '!src/services/frontendRuntimeConfigService.ts',
    '!src/services/frontendRuntimeConfigService.test.ts',
    '!src/services/gameDistributionClient.ts',
    '!src/services/gameDistributionClient.test.ts',
    '!src/services/sseStream.ts',
    '!src/services/sseStream.test.ts',
    'src/AdventurePanel.tsx',
@@ -47,16 +47,12 @@ temp*build*/
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/codex-package.json
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/manifest.json
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/NOTICE.md
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/darwin-arm64/
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/darwin-x64/
 /plugins/agc-cocos-editor/native/payload/
 /plugins/agc-unity-editor/dotnet/**/bin/
 /plugins/agc-unity-editor/dotnet/**/obj/
 /plugins/agc-unity-editor/dotnet/publish/
 /plugins/agc-unity-editor/dotnet/native-build/
 /apps/ai-game-creator-shell/logs/
 /apps/ai-game-creator-shell/src-tauri/resources/node-runtime/
 /apps/ai-game-creator-shell/src-tauri/resources/node-runtime-staging-*/
 /apps/ai-game-creator-shell/.llm-drafts/
 /apps/ai-game-creator-shell/game-creator.config.local.json
 /apps/mobile-shell/.expo/
@@ -5,9 +5,12 @@ import {
  executeAdminRechargeRefund,
  getAdminFeatureGateConfig,
  getAdminUserDetail,
  listAdminGameDistributionReviews,
  listAdminRechargeOrders,
  reconcileAdminUserConsumption,
  resolveAdminRechargeRefundManualReview,
  reviewAdminGameDistributionVersion,
  suspendAdminGameDistributionGame,
  updateAdminAccount,
  uploadAdminEditorShowcaseCampaignImage,
  upsertAdminFeatureGateConfig,
@@ -364,3 +367,134 @@ test('退款人工复核使用独立 resolve 管理员路由', async () => {
    }),
  );
 });
 test('游戏审核列表与审核动作使用约定的 URL、方法和幂等键', async () => {
  const fetchMock = vi.fn().mockImplementation(() =>
    Promise.resolve(
      new Response(JSON.stringify({ entries: [], nextCursor: null }), {
        status: 200,
      }),
    ),
  );
  vi.stubGlobal('fetch', fetchMock);
  await listAdminGameDistributionReviews('admin-token');
  await reviewAdminGameDistributionVersion(
    'admin-token',
    'gamever/1',
    'game-review-key-1',
    {
      decision: 'approve',
      expectedPublicationRevision: 3,
      entryUrl: 'https://games.example.test/releases/game_1/index.html',
    },
  );
  expect(fetchMock.mock.calls[0]?.[0]).toBe(
    '/admin/api/game-distribution/reviews?limit=48',
  );
  expect(fetchMock.mock.calls[1]?.[0]).toBe(
    '/admin/api/game-distribution/versions/gamever%2F1/review',
  );
  expect(fetchMock.mock.calls[1]?.[1]).toEqual(
    expect.objectContaining({
      method: 'POST',
      headers: expect.objectContaining({
        Authorization: 'Bearer admin-token',
        'Idempotency-Key': 'game-review-key-1',
      }),
      body: JSON.stringify({
        decision: 'approve',
        expectedPublicationRevision: 3,
        entryUrl: 'https://games.example.test/releases/game_1/index.html',
      }),
    }),
  );
 });
 test('安全下架请求携带公开修订号、原因与幂等键', async () => {
  const fetchMock = vi.fn().mockImplementation(() =>
    Promise.resolve(
      new Response(JSON.stringify({ game: {}, replayed: false }), {
        status: 200,
      }),
    ),
  );
  vi.stubGlobal('fetch', fetchMock);
  await suspendAdminGameDistributionGame(
    'admin-token',
    'game/1',
    'game-suspend-key-1',
    { expectedPublicationRevision: 7, reason: '版权投诉' },
  );
  expect(fetchMock.mock.calls[0]?.[0]).toBe(
    '/admin/api/game-distribution/games/game%2F1/suspend',
  );
  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
    expect.objectContaining({
      method: 'POST',
      headers: expect.objectContaining({
        Authorization: 'Bearer admin-token',
        'Idempotency-Key': 'game-suspend-key-1',
      }),
      body: JSON.stringify({
        expectedPublicationRevision: 7,
        reason: '版权投诉',
      }),
    }),
  );
  expect(() =>
    suspendAdminGameDistributionGame('admin-token', '  ', 'key', {
      expectedPublicationRevision: 1,
    }),
  ).toThrow('缺少游戏 ID');
  expect(() =>
    suspendAdminGameDistributionGame('admin-token', 'game-1', '  ', {
      expectedPublicationRevision: 1,
    }),
  ).toThrow('下架幂等键必须是 1 到 128 个字符');
  expect(fetchMock).toHaveBeenCalledTimes(1);
 });
 test('游戏审核拒绝请求携带理由，空幂等键在本地失败关闭', async () => {
  const fetchMock = vi.fn().mockImplementation(() =>
    Promise.resolve(
      new Response(JSON.stringify({ version: {}, replayed: false }), {
        status: 200,
      }),
    ),
  );
  vi.stubGlobal('fetch', fetchMock);
  await reviewAdminGameDistributionVersion(
    'admin-token',
    'version-1',
    'game-review-key-2',
    {
      decision: 'reject',
      expectedPublicationRevision: 0,
      reviewReason: '运行时报错',
    },
  );
  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
    expect.objectContaining({
      body: JSON.stringify({
        decision: 'reject',
        expectedPublicationRevision: 0,
        reviewReason: '运行时报错',
      }),
    }),
  );
  expect(() =>
    reviewAdminGameDistributionVersion('admin-token', 'version-1', '   ', {
      decision: 'reject',
      expectedPublicationRevision: 0,
      reviewReason: 'x',
    }),
  ).toThrow('审核幂等键必须是 1 到 128 个字符');
  expect(fetchMock).toHaveBeenCalledTimes(1);
 });
@@ -29,6 +29,9 @@ import type {
  AdminExternalApiKeyListQuery,
  AdminExternalApiKeyListResponse,
  AdminFeatureGateConfigResponse,
  AdminGameDistributionReviewListResponse,
  AdminGameDistributionReviewRequest,
  AdminGameDistributionReviewResponse,
  AdminLoginResponse,
  AdminMeResponse,
  AdminOverviewResponse,
@@ -1176,3 +1179,72 @@ export function saveAgcModelCatalog(
    { token, method: 'PUT', body },
  );
 }
 export function listAdminGameDistributionReviews(token: string, limit = 48) {
  const normalizedLimit = Number.isFinite(limit)
    ? Math.min(Math.max(Math.trunc(limit), 1), 48)
    : 48;
  return request<AdminGameDistributionReviewListResponse>(
    `/admin/api/game-distribution/reviews?limit=${normalizedLimit}`,
    { token },
  );
 }
 /**
 * 审核游戏发行版本。幂等键由调用方生成并在同一次提交内复用，避免重复点击产生
 * 两条审核结论。
 */
 /**
 * 安全下架整个游戏。管理员下架同样要求 CAS 修订号与幂等键，避免并发审核互相覆盖。
 */
 export function suspendAdminGameDistributionGame(
  token: string,
  gameId: string,
  idempotencyKey: string,
  payload: import('./adminApiTypes').AdminGameDistributionSuspendRequest,
 ) {
  const normalizedGameId = gameId.trim();
  const normalizedKey = idempotencyKey.trim();
  if (!normalizedGameId) {
    throw new Error('缺少游戏 ID');
  }
  if (!normalizedKey || normalizedKey.length > 128) {
    throw new Error('下架幂等键必须是 1 到 128 个字符');
  }
  return request<
    import('./adminApiTypes').AdminGameDistributionSuspendResponse
  >(
    `/admin/api/game-distribution/games/${encodeURIComponent(normalizedGameId)}/suspend`,
    {
      method: 'POST',
      token,
      headers: { 'Idempotency-Key': normalizedKey },
      body: payload,
    },
  );
 }
 export function reviewAdminGameDistributionVersion(
  token: string,
  versionId: string,
  idempotencyKey: string,
  payload: AdminGameDistributionReviewRequest,
 ) {
  const normalizedVersionId = versionId.trim();
  const normalizedKey = idempotencyKey.trim();
  if (!normalizedVersionId) {
    throw new Error('缺少发行版本 ID');
  }
  if (!normalizedKey || normalizedKey.length > 128) {
    throw new Error('审核幂等键必须是 1 到 128 个字符');
  }
  return request<AdminGameDistributionReviewResponse>(
    `/admin/api/game-distribution/versions/${encodeURIComponent(normalizedVersionId)}/review`,
    {
      method: 'POST',
      token,
      headers: { 'Idempotency-Key': normalizedKey },
      body: payload,
    },
  );
 }
@@ -144,8 +144,6 @@ export interface AdminErrorReportListResponse {
 }
 export interface AdminErrorReportDetail extends AdminErrorReportEntry {
  firstFingerprint?: string;
  firstSource?: string;
  note?: string;
  events: Array<Record<string, unknown>>;
  logNames: string[];
@@ -1033,3 +1031,48 @@ export interface AdminAgcModelCatalog {
  defaultModelId: string;
  models: AdminAgcModel[];
 }
 export interface AdminGameDistributionReviewEntry {
  versionId: string;
  gameId: string;
  versionNumber: number;
  packageSha256: string;
  packageBytes: number;
  status: string;
  publicationRevision: number;
  reviewReason: string | null;
  createdAt: string;
  updatedAt: string;
 }
 export interface AdminGameDistributionReviewListResponse {
  entries: AdminGameDistributionReviewEntry[];
  nextCursor: string | null;
 }
 export interface AdminGameDistributionReviewRequest {
  decision: 'approve' | 'reject';
  expectedPublicationRevision: number;
  reviewReason?: string;
  entryUrl?: string;
 }
 export interface AdminGameDistributionReviewResponse {
  version: AdminGameDistributionReviewEntry;
  replayed: boolean;
 }
 export interface AdminGameDistributionSuspendRequest {
  expectedPublicationRevision: number;
  reason?: string;
 }
 export interface AdminGameDistributionSuspendResponse {
  game: {
    id: string;
    title: string;
    status: string;
    publicationRevision: number;
  };
  replayed: boolean;
 }
@@ -26,6 +26,7 @@ import { AdminEditorAssetQueryPage } from '../pages/AdminEditorAssetQueryPage';
 import { AdminEditorGenerationPricingPage } from '../pages/AdminEditorGenerationPricingPage';
 import { AdminEditorShowcaseReviewPage } from '../pages/AdminEditorShowcaseReviewPage';
 import { AdminErrorReportsPage } from '../pages/AdminErrorReportsPage';
 import { AdminGameDistributionReviewPage } from '../pages/AdminGameDistributionReviewPage';
 import { AdminGrayReleaseConfigPage } from '../pages/AdminGrayReleaseConfigPage';
 import { AdminInviteCodePage } from '../pages/AdminInviteCodePage';
 import { AdminLoginPage } from '../pages/AdminLoginPage';
@@ -300,6 +301,12 @@ export function AdminApp() {
          onUnauthorized={handleUnauthorized}
        />
      ) : null}
      {activeRouteId === 'game-distribution' ? (
        <AdminGameDistributionReviewPage
          token={token}
          onUnauthorized={handleUnauthorized}
        />
      ) : null}
      {activeRouteId === 'editor-assets' ? (
        <AdminEditorAssetQueryPage
          token={token}
@@ -5,6 +5,7 @@ import {
  Coins,
  Database,
  FolderArchive,
  Gamepad2,
  GitBranch,
  Images,
  LayoutDashboard,
@@ -49,6 +50,7 @@ const routeIcons = {
  'recharge-orders': ReceiptText,
  'editor-generation-pricing': Coins,
  'editor-showcase': Star,
  'game-distribution': Gamepad2,
  'editor-assets': Images,
  'project-snapshots': FolderArchive,
  accounts: Users,
@@ -147,3 +147,24 @@ test('项目工程入口对 owner 与已授权 member 开放且可分配权限',
    }),
  ).not.toContainEqual(route);
 });
 test('后台游戏审核路由可通过导航和 hash 访问', () => {
  expect(adminRoutes).toContainEqual({
    id: 'game-distribution',
    label: '游戏审核',
    hash: '#game-distribution',
  });
  expect(resolveAdminRoute('#game-distribution')).toBe('game-distribution');
  expect(routeHash('game-distribution')).toBe('#game-distribution');
 });
 test('member 可单独获得游戏审核 Tab 权限', () => {
  const routes = getAccessibleAdminRoutes({
    accountRole: 'member',
    tabPermissions: ['game-distribution'],
  });
  expect(routes.map((route) => route.id)).toEqual(['game-distribution']);
  expect(resolveAccessibleAdminRoute('#game-distribution', routes)).toBe(
    'game-distribution',
  );
 });
@@ -15,6 +15,7 @@ export type AdminRouteId =
  | 'recharge-orders'
  | 'editor-generation-pricing'
  | 'editor-showcase'
  | 'game-distribution'
  | 'editor-assets'
  | 'project-snapshots'
  | 'agc-models'
@@ -54,6 +55,7 @@ export const adminRoutes: AdminRouteDefinition[] = [
  },
  { id: 'agc-models', label: 'AGC 模型', hash: '#agc-models', ownerOnly: true },
  { id: 'editor-showcase', label: '精选审核', hash: '#editor-showcase' },
  { id: 'game-distribution', label: '游戏审核', hash: '#game-distribution' },
  { id: 'editor-assets', label: '素材查询', hash: '#editor-assets' },
  { id: 'project-snapshots', label: '项目工程', hash: '#project-snapshots' },
  { id: 'accounts', label: '账号管理', hash: '#accounts', ownerOnly: true },
@@ -1,18 +0,0 @@
 import { describe, expect, it } from 'vitest';
 import {
  formatAdminTimestamp,
  parseAdminTimestamp,
 } from './AdminErrorReportsPage';
 describe('错误报告时间格式化', () => {
  it('解析 SpacetimeDB seconds.microsZ 时间', () => {
    expect(parseAdminTimestamp('1778207451.731746Z')).toBe(1778207451731);
  });
  it('解析微秒字符串并拒绝无效时间', () => {
    expect(parseAdminTimestamp('1778207451731746')).toBe(1778207451731);
    expect(formatAdminTimestamp('not-a-date')).toBe('-');
    expect(formatAdminTimestamp('999999999999999999999999')).toBe('-');
  });
 });
@@ -17,57 +17,6 @@ type Props = { token: string; onUnauthorized: (message?: string) => void };
 const ADMIN_ERROR_REPORT_STATUSES = ['new', 'in-progress', 'resolved'] as const;
 const ERROR_REPORT_PAGE_SIZE = 50;
 const ERROR_REPORT_STATUS_LABELS: Record<string, string> = {
  new: '待处理',
  'in-progress': '处理中',
  resolved: '已解决',
 };
 export function parseAdminTimestamp(value: string | null | undefined) {
  const normalized = value?.trim() ?? '';
  if (/^-?\d+\.\d{6}Z$/u.test(normalized)) {
    const [secondsText, microsText] = normalized.slice(0, -1).split('.');
    const seconds = Number(secondsText);
    const micros = Number(microsText);
    return Number.isFinite(seconds) && Number.isFinite(micros)
      ? seconds * 1000 + Math.floor(micros / 1000)
      : Number.NaN;
  }
  if (/^-?\d+$/u.test(normalized)) {
    const numeric = Number(normalized);
    if (!Number.isFinite(numeric)) return Number.NaN;
    if (Math.abs(numeric) >= 1e14) return Math.floor(numeric / 1000);
    if (Math.abs(numeric) >= 1e11) return numeric;
    return numeric * 1000;
  }
  return Date.parse(normalized);
 }
 export function formatAdminTimestamp(value: string | null | undefined) {
  const timestamp = parseAdminTimestamp(value);
  if (!Number.isFinite(timestamp)) return '-';
  const date = new Date(timestamp);
  if (!Number.isFinite(date.getTime())) return '-';
  try {
    return new Intl.DateTimeFormat('zh-CN', {
      year: 'numeric',
      month: '2-digit',
      day: '2-digit',
      hour: '2-digit',
      minute: '2-digit',
      second: '2-digit',
    }).format(date);
  } catch {
    return '-';
  }
 }
 function eventText(event: Record<string, unknown>, key: string) {
  const value = event[key];
  return typeof value === 'string' || typeof value === 'number'
    ? String(value)
    : '';
 }
 export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
  const [reports, setReports] = useState<AdminErrorReportEntry[]>([]);
@@ -80,24 +29,6 @@ export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
  const [pageInfo, setPageInfo] = useState({ total: 0, hasMore: false });
  const openReportRequestId = useRef(0);
  const loadRequestId = useRef(0);
  const detailCloseButtonRef = useRef<HTMLButtonElement | null>(null);
  useEffect(() => {
    if (!selected) return;
    const previousFocus = document.activeElement as HTMLElement | null;
    const focusFrame = window.requestAnimationFrame(() => {
      detailCloseButtonRef.current?.focus();
    });
    const handleEscape = (event: KeyboardEvent) => {
      if (event.key === 'Escape') setSelected(null);
    };
    window.addEventListener('keydown', handleEscape);
    return () => {
      window.cancelAnimationFrame(focusFrame);
      window.removeEventListener('keydown', handleEscape);
      previousFocus?.focus?.();
    };
  }, [selected]);
  const load = useCallback(async () => {
    const requestId = ++loadRequestId.current;
@@ -253,15 +184,9 @@ export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
                <td>{report.batchId}</td>
                <td>{report.eventCount}</td>
                <td>{report.source ?? '-'}</td>
-                <td>
+                <td>{report.status}</td>
                  <span
                    className={`admin-error-report-status is-${report.status}`}
                  >
                    {ERROR_REPORT_STATUS_LABELS[report.status] ?? report.status}
                  </span>
                </td>
                <td>{report.userId}</td>
-                <td>{formatAdminTimestamp(report.createdAt)}</td>
+                <td>{new Date(report.createdAt).toLocaleString()}</td>
              </tr>
            ))}
          </tbody>
@@ -299,173 +224,66 @@ export function AdminErrorReportsPage({ token, onUnauthorized }: Props) {
          className="admin-detail-modal"
          role="dialog"
          aria-label="错误报告详情"
          aria-modal="true"
          onMouseDown={(event) => {
            if (event.target === event.currentTarget) setSelected(null);
          }}
        >
-          <div className="admin-detail-modal__panel admin-error-report-detail">
+          <div className="admin-detail-modal__panel">
-            <header className="admin-error-report-detail__header">
+            <header>
-              <div className="admin-error-report-detail__heading">
+              <h2>{selected.batchId}</h2>
-                <span className="admin-error-report-detail__eyebrow">
+              <button type="button" onClick={() => setSelected(null)}>
-                  错误报告详情
+                关闭
                </span>
                <h2>{selected.batchId}</h2>
                <div className="admin-error-report-detail__badges">
                  <span
                    className={`admin-error-report-status is-${selected.status}`}
                  >
                    {ERROR_REPORT_STATUS_LABELS[selected.status] ??
                      selected.status}
                  </span>
                  <span className="admin-error-report-detail__badge">
                    {selected.firstSource ?? selected.source ?? '未知来源'}
                  </span>
                </div>
              </div>
              <button
                type="button"
                className="admin-error-report-detail__close"
                ref={detailCloseButtonRef}
                onClick={() => setSelected(null)}
                aria-label="关闭错误报告详情"
              >
                ×
              </button>
            </header>
-            <div className="admin-error-report-detail__summary">
+            <p>
-              <div>
+              用户：{selected.userId} · 事件：{selected.eventCount} · 日志：
-                <span>用户</span>
+              {selected.logCount}
-                <strong>{selected.userId}</strong>
+            </p>
-              </div>
+            <pre>{JSON.stringify(selected.events.slice(0, 20), null, 2)}</pre>
-              <div>
+            {selected.userDescription ? (
-                <span>发生时间</span>
+              <p>用户描述：{selected.userDescription}</p>
-                <strong>{formatAdminTimestamp(selected.createdAt)}</strong>
+            ) : null}
-              </div>
+            <label className="admin-detail-modal__note">
-              <div>
+              处理备注
-                <span>错误事件</span>
+              <textarea
-                <strong>{selected.eventCount}</strong>
+                value={selected.note ?? ''}
-              </div>
+                onChange={(event) =>
-              <div>
+                  setSelected((current) =>
-                <span>应用日志</span>
+                    current
-                <strong>{selected.logCount}</strong>
+                      ? { ...current, note: event.target.value }
-              </div>
+                      : current,
                  )
                }
                maxLength={2000}
                rows={4}
                placeholder="记录处理结论或后续跟进事项"
                disabled={busy}
              />
            </label>
            <div className="admin-detail-modal__actions">
              <select
                value={selected.status}
                onChange={(event) => void saveStatus(event.target.value)}
                disabled={busy}
              >
                {ADMIN_ERROR_REPORT_STATUSES.map((value) => (
                  <option key={value} value={value}>
                    {value}
                  </option>
                ))}
              </select>
              <button
                type="button"
                onClick={() => void saveStatus(selected.status)}
                disabled={busy}
              >
                保存备注
              </button>
              <button
                type="button"
                onClick={() => void download(selected.batchId)}
                disabled={downloading}
              >
                {downloading ? '下载中…' : '下载诊断包'}
              </button>
            </div>
            <div className="admin-error-report-detail__body">
              <section className="admin-error-report-detail__section">
                <div className="admin-error-report-detail__section-heading">
                  <div>
                    <h3>错误事件</h3>
                    <span>展示最近 20 条，完整内容请下载诊断包。</span>
                  </div>
                  <span className="admin-error-report-detail__count">
                    {selected.events.length} 条
                  </span>
                </div>
                <div className="admin-error-report-event-list">
                  {selected.events.length === 0 ? (
                    <p className="admin-error-report-detail__empty">
                      归档中没有可展示的错误事件。
                    </p>
                  ) : null}
                  {selected.events.slice(0, 20).map((event, index) => {
                    const message = eventText(event, 'message') || '未知错误';
                    const stack = eventText(event, 'stack');
                    const occurredAt = eventText(event, 'occurredAt');
                    return (
                      <article
                        className="admin-error-report-event"
                        key={`${index}-${message}`}
                      >
                        <div className="admin-error-report-event__topline">
                          <span className="admin-error-report-event__index">
                            #{index + 1}
                          </span>
                          <span>{eventText(event, 'source') || 'client'}</span>
                          <span>{eventText(event, 'count') || '1'} 次</span>
                          <time>{formatAdminTimestamp(occurredAt)}</time>
                        </div>
                        <p className="admin-error-report-event__message">
                          {message}
                        </p>
                        {eventText(event, 'fingerprint') ? (
                          <code>{eventText(event, 'fingerprint')}</code>
                        ) : null}
                        {stack ? (
                          <details>
                            <summary>查看调用栈</summary>
                            <pre>{stack}</pre>
                          </details>
                        ) : null}
                      </article>
                    );
                  })}
                </div>
              </section>
              {selected.userDescription ? (
                <section className="admin-error-report-detail__section">
                  <div className="admin-error-report-detail__section-heading">
                    <div>
                      <h3>用户描述</h3>
                    </div>
                  </div>
                  <p className="admin-error-report-detail__description">
                    {selected.userDescription}
                  </p>
                </section>
              ) : null}
              <section className="admin-error-report-detail__section admin-error-report-detail__section--note">
                <label className="admin-detail-modal__note">
                  <span>处理备注</span>
                  <textarea
                    value={selected.note ?? ''}
                    onChange={(event) =>
                      setSelected((current) =>
                        current
                          ? { ...current, note: event.target.value }
                          : current,
                      )
                    }
                    maxLength={2000}
                    rows={4}
                    placeholder="记录处理结论或后续跟进事项"
                    disabled={busy}
                  />
                </label>
              </section>
            </div>
            <footer className="admin-error-report-detail__footer">
              <label className="admin-error-report-detail__status-field">
                状态
                <select
                  value={selected.status}
                  onChange={(event) => void saveStatus(event.target.value)}
                  disabled={busy}
                >
                  {ADMIN_ERROR_REPORT_STATUSES.map((value) => (
                    <option key={value} value={value}>
                      {ERROR_REPORT_STATUS_LABELS[value]}
                    </option>
                  ))}
                </select>
              </label>
              <div className="admin-error-report-detail__footer-actions">
                <button
                  type="button"
                  onClick={() => void saveStatus(selected.status)}
                  disabled={busy}
                >
                  {busy ? '保存中…' : '保存备注'}
                </button>
                <button
                  type="button"
                  onClick={() => void download(selected.batchId)}
                  disabled={downloading}
                >
                  {downloading ? '下载中…' : '下载诊断包'}
                </button>
              </div>
            </footer>
          </div>
        </div>
      ) : null}
@@ -0,0 +1,186 @@
 /* @vitest-environment jsdom */
 import { fireEvent, render, screen, waitFor } from '@testing-library/react';
 import { beforeEach, expect, test, vi } from 'vitest';
 import {
  listAdminGameDistributionReviews,
  reviewAdminGameDistributionVersion,
  suspendAdminGameDistributionGame,
 } from '../api/adminApiClient';
 import type { AdminGameDistributionReviewEntry } from '../api/adminApiTypes';
 import {
  AdminGameDistributionReviewPage,
  resolveGameReleaseEntryUrlError,
 } from './AdminGameDistributionReviewPage';
 vi.mock('../api/adminApiClient', () => ({
  isAdminApiError: vi.fn(
    (error: unknown) =>
      typeof error === 'object' &&
      error !== null &&
      'status' in error &&
      typeof error.status === 'number',
  ),
  formatAdminApiError: vi.fn((error: unknown) =>
    error instanceof Error ? error.message : '请求失败',
  ),
  listAdminGameDistributionReviews: vi.fn(),
  reviewAdminGameDistributionVersion: vi.fn(),
  suspendAdminGameDistributionGame: vi.fn(),
 }));
 const entry: AdminGameDistributionReviewEntry = {
  versionId: 'version-1',
  gameId: 'game_1',
  versionNumber: 2,
  packageSha256: 'a'.repeat(64),
  packageBytes: 2048,
  status: 'pending_review',
  publicationRevision: 4,
  reviewReason: null,
  createdAt: '2026-09-20T08:00:00Z',
  updatedAt: '2026-09-20T08:00:00Z',
 };
 beforeEach(() => {
  vi.mocked(listAdminGameDistributionReviews).mockReset();
  vi.mocked(reviewAdminGameDistributionVersion).mockReset();
  vi.mocked(suspendAdminGameDistributionGame).mockReset();
  vi.mocked(listAdminGameDistributionReviews).mockResolvedValue({
    entries: [entry],
    nextCursor: null,
  });
 });
 test('发行入口必须是带完整来源的 HTTPS 地址', () => {
  expect(resolveGameReleaseEntryUrlError('')).toBe('请填写发行入口');
  expect(
    resolveGameReleaseEntryUrlError('http://games.test/a/index.html'),
  ).toBe('发行入口必须以 https:// 开头');
  expect(
    resolveGameReleaseEntryUrlError('https://games.test/a/index.html?token=1'),
  ).toBe('发行入口不能包含 query 或 fragment');
  expect(
    resolveGameReleaseEntryUrlError('https://u:p@games.test/a/index.html'),
  ).toBe('发行入口不能包含凭据');
  expect(
    resolveGameReleaseEntryUrlError('https://games.test/a/index.html'),
  ).toBe('');
 });
 test('通过审核时提交当前 publicationRevision 与发行入口并刷新列表', async () => {
  vi.mocked(reviewAdminGameDistributionVersion).mockResolvedValue({
    version: { ...entry, status: 'published' },
    replayed: false,
  });
  render(
    <AdminGameDistributionReviewPage
      token="admin-token"
      onUnauthorized={vi.fn()}
    />,
  );
  await screen.findByText('game_1');
  fireEvent.change(screen.getByLabelText('发行入口'), {
    target: { value: 'https://games.test/releases/game_1/index.html' },
  });
  fireEvent.click(screen.getByRole('button', { name: '通过' }));
  await waitFor(() =>
    expect(reviewAdminGameDistributionVersion).toHaveBeenCalledTimes(1),
  );
  const [token, versionId, idempotencyKey, payload] =
    vi.mocked(reviewAdminGameDistributionVersion).mock.calls[0] ?? [];
  expect(token).toBe('admin-token');
  expect(versionId).toBe('version-1');
  expect(String(idempotencyKey)).toContain('version-1');
  expect(payload).toEqual({
    decision: 'approve',
    expectedPublicationRevision: 4,
    entryUrl: 'https://games.test/releases/game_1/index.html',
  });
  await waitFor(() =>
    expect(vi.mocked(listAdminGameDistributionReviews)).toHaveBeenCalledTimes(
      2,
    ),
  );
 });
 test('缺少拒绝理由时不调用审核接口', async () => {
  render(
    <AdminGameDistributionReviewPage
      token="admin-token"
      onUnauthorized={vi.fn()}
    />,
  );
  await screen.findByText('game_1');
  fireEvent.click(screen.getByRole('button', { name: '拒绝' }));
  expect(await screen.findByText('拒绝审核必须填写理由')).toBeTruthy();
  expect(reviewAdminGameDistributionVersion).not.toHaveBeenCalled();
 });
 test('安全下架需要二次确认，并携带公开修订号与原因', async () => {
  vi.mocked(suspendAdminGameDistributionGame).mockResolvedValue({
    game: {
      id: 'game_1',
      title: '测试游戏',
      status: 'suspended',
      publicationRevision: 5,
    },
    replayed: false,
  });
  render(
    <AdminGameDistributionReviewPage
      token="admin-token"
      onUnauthorized={vi.fn()}
    />,
  );
  await screen.findByText('game_1');
  fireEvent.change(screen.getByLabelText('下架原因'), {
    target: { value: '盗用素材' },
  });
  fireEvent.click(screen.getByRole('button', { name: '安全下架' }));
  // 第一次点击只弹出确认面板，不直接调用后端。
  expect(suspendAdminGameDistributionGame).not.toHaveBeenCalled();
  expect(await screen.findByRole('dialog')).toBeTruthy();
  fireEvent.click(screen.getByRole('button', { name: '确认' }));
  await waitFor(() =>
    expect(suspendAdminGameDistributionGame).toHaveBeenCalledTimes(1),
  );
  const [token, gameId, idempotencyKey, payload] =
    vi.mocked(suspendAdminGameDistributionGame).mock.calls[0] ?? [];
  expect(token).toBe('admin-token');
  expect(gameId).toBe('game_1');
  expect(String(idempotencyKey)).toContain('game_1');
  expect(payload).toEqual({
    expectedPublicationRevision: 4,
    reason: '盗用素材',
  });
  expect(await screen.findByText(/已安全下架/u)).toBeTruthy();
 });
 test('取消确认时不下架', async () => {
  render(
    <AdminGameDistributionReviewPage
      token="admin-token"
      onUnauthorized={vi.fn()}
    />,
  );
  await screen.findByText('game_1');
  fireEvent.click(screen.getByRole('button', { name: '安全下架' }));
  await screen.findByRole('dialog');
  fireEvent.click(screen.getByRole('button', { name: '取消' }));
  await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull());
  expect(suspendAdminGameDistributionGame).not.toHaveBeenCalled();
 });
@@ -0,0 +1,365 @@
 import { RefreshCcw } from 'lucide-react';
 import { useCallback, useEffect, useState } from 'react';
 import {
  listAdminGameDistributionReviews,
  reviewAdminGameDistributionVersion,
  suspendAdminGameDistributionGame,
 } from '../api/adminApiClient';
 import type { AdminGameDistributionReviewEntry } from '../api/adminApiTypes';
 import { useAdminWriteConfirm } from '../components/useAdminWriteConfirm';
 import { handlePageError } from './pageUtils';
 interface AdminGameDistributionReviewPageProps {
  token: string;
  onUnauthorized: (message?: string) => void;
 }
 function formatBytes(value: number) {
  if (value >= 1024 * 1024) {
    return `${(value / (1024 * 1024)).toFixed(1)} MiB`;
  }
  if (value >= 1024) {
    return `${(value / 1024).toFixed(1)} KiB`;
  }
  return `${value} B`;
 }
 function formatTime(value: string) {
  const parsed = new Date(value);
  if (Number.isNaN(parsed.getTime())) return value;
  return parsed.toLocaleString('zh-CN', { hour12: false });
 }
 function createSuspendIdempotencyKey(gameId: string) {
  const random =
    typeof crypto !== 'undefined' && 'randomUUID' in crypto
      ? crypto.randomUUID()
      : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
  return `game-suspend-${gameId}-${random}`.slice(0, 128);
 }
 function createReviewIdempotencyKey(versionId: string) {
  const random =
    typeof crypto !== 'undefined' && 'randomUUID' in crypto
      ? crypto.randomUUID()
      : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
  return `game-review-${versionId}-${random}`.slice(0, 128);
 }
 export function resolveGameReleaseEntryUrlError(value: string) {
  const normalized = value.trim();
  if (!normalized) return '请填写发行入口';
  if (!normalized.startsWith('https://')) {
    return '发行入口必须以 https:// 开头';
  }
  if (normalized.includes('?') || normalized.includes('#')) {
    return '发行入口不能包含 query 或 fragment';
  }
  try {
    const parsed = new URL(normalized);
    if (parsed.username || parsed.password) {
      return '发行入口不能包含凭据';
    }
  } catch {
    return '发行入口不是合法 URL';
  }
  return '';
 }
 export function AdminGameDistributionReviewPage({
  token,
  onUnauthorized,
 }: AdminGameDistributionReviewPageProps) {
  const [entries, setEntries] = useState<AdminGameDistributionReviewEntry[]>(
    [],
  );
  const [isLoading, setIsLoading] = useState(false);
  const [busyVersionId, setBusyVersionId] = useState('');
  const [errorMessage, setErrorMessage] = useState('');
  const [statusMessage, setStatusMessage] = useState('');
  const [entryUrlByVersion, setEntryUrlByVersion] = useState<
    Record<string, string>
  >({});
  const [reasonByVersion, setReasonByVersion] = useState<
    Record<string, string>
  >({});
  const [suspendReasonByGame, setSuspendReasonByGame] = useState<
    Record<string, string>
  >({});
  const [busyGameId, setBusyGameId] = useState('');
  const writeConfirm = useAdminWriteConfirm();
  const loadReviews = useCallback(async () => {
    setIsLoading(true);
    setErrorMessage('');
    try {
      const response = await listAdminGameDistributionReviews(token);
      setEntries(response.entries);
    } catch (error) {
      handlePageError(error, onUnauthorized, setErrorMessage);
    } finally {
      setIsLoading(false);
    }
  }, [token, onUnauthorized]);
  useEffect(() => {
    void loadReviews();
  }, [loadReviews]);
  async function submitReview(
    entry: AdminGameDistributionReviewEntry,
    decision: 'approve' | 'reject',
  ) {
    const entryUrl = (entryUrlByVersion[entry.versionId] ?? '').trim();
    const reason = (reasonByVersion[entry.versionId] ?? '').trim();
    if (decision === 'approve') {
      const invalid = resolveGameReleaseEntryUrlError(entryUrl);
      if (invalid) {
        setErrorMessage(invalid);
        return;
      }
    } else if (!reason) {
      setErrorMessage('拒绝审核必须填写理由');
      return;
    }
    setBusyVersionId(entry.versionId);
    setErrorMessage('');
    setStatusMessage('');
    try {
      await reviewAdminGameDistributionVersion(
        token,
        entry.versionId,
        createReviewIdempotencyKey(entry.versionId),
        decision === 'approve'
          ? {
              decision,
              expectedPublicationRevision: entry.publicationRevision,
              entryUrl,
            }
          : {
              decision,
              expectedPublicationRevision: entry.publicationRevision,
              reviewReason: reason,
            },
      );
      setStatusMessage(
        decision === 'approve'
          ? `版本 v${entry.versionNumber} 已通过审核`
          : `版本 v${entry.versionNumber} 已拒绝`,
      );
      await loadReviews();
    } catch (error) {
      handlePageError(error, onUnauthorized, setErrorMessage);
    } finally {
      setBusyVersionId('');
    }
  }
  /**
   * 管理员安全下架：先二次确认，再带当前公开修订号调用后端；并发审核导致修订号变化时
   * 由服务端返回冲突，前端只提示刷新，不静默重试。
   */
  async function suspendGame(entry: AdminGameDistributionReviewEntry) {
    const reason = (suspendReasonByGame[entry.gameId] ?? '').trim();
    const confirmed = await writeConfirm.confirmWrite({
      action: '安全下架游戏',
      target: `${entry.gameId}（版本 v${entry.versionNumber}）`,
    });
    if (!confirmed) return;
    setBusyGameId(entry.gameId);
    setErrorMessage('');
    setStatusMessage('');
    try {
      await suspendAdminGameDistributionGame(
        token,
        entry.gameId,
        createSuspendIdempotencyKey(entry.gameId),
        {
          expectedPublicationRevision: entry.publicationRevision,
          ...(reason ? { reason } : {}),
        },
      );
      setStatusMessage(`游戏 ${entry.gameId} 已安全下架，发行入口已关闭`);
      setSuspendReasonByGame((current) => ({ ...current, [entry.gameId]: '' }));
      await loadReviews();
    } catch (error) {
      handlePageError(error, onUnauthorized, setErrorMessage);
    } finally {
      setBusyGameId('');
    }
  }
  return (
    <section className="admin-page admin-page-wide">
      <div className="admin-page-heading">
        <h1>游戏审核</h1>
        <button
          type="button"
          className="admin-secondary-button"
          onClick={() => void loadReviews()}
          disabled={isLoading}
        >
          <RefreshCcw aria-hidden="true" />
          刷新
        </button>
      </div>
      {errorMessage ? (
        <div className="admin-alert admin-alert-warning" role="alert">
          {errorMessage}
        </div>
      ) : null}
      {statusMessage ? (
        <div className="admin-alert admin-alert-success" role="status">
          {statusMessage}
        </div>
      ) : null}
      <div className="admin-panel">
        <div className="admin-panel-heading">
          <h2>待审版本</h2>
          <span className="admin-muted-text">共 {entries.length} 条</span>
        </div>
        {isLoading ? (
          <p className="admin-muted-text">正在加载待审版本…</p>
        ) : null}
        {!isLoading && entries.length === 0 ? (
          <p className="admin-muted-text">当前没有待审核的游戏版本。</p>
        ) : null}
        {!isLoading && entries.length > 0 ? (
          <div className="admin-table-wrap">
            <table className="admin-table admin-table-wide">
              <thead>
                <tr>
                  <th>游戏</th>
                  <th>版本</th>
                  <th>发行包</th>
                  <th>提交时间</th>
                  <th>审核</th>
                </tr>
              </thead>
              <tbody>
                {entries.map((entry) => {
                  const busy = busyVersionId === entry.versionId;
                  return (
                    <tr key={entry.versionId}>
                      <td>
                        <code>{entry.gameId}</code>
                      </td>
                      <td>
                        v{entry.versionNumber}
                        <div className="admin-muted-text">{entry.status}</div>
                        {entry.reviewReason ? (
                          <div className="admin-muted-text">
                            {entry.reviewReason}
                          </div>
                        ) : null}
                      </td>
                      <td>
                        {formatBytes(entry.packageBytes)}
                        <div className="admin-muted-text">
                          <code>{entry.packageSha256.slice(0, 12)}</code>
                        </div>
                      </td>
                      <td>{formatTime(entry.createdAt)}</td>
                      <td>
                        <div className="admin-action-row">
                          <div className="admin-field">
                            <label
                              htmlFor={`game-release-url-${entry.versionId}`}
                            >
                              发行入口
                            </label>
                            <input
                              id={`game-release-url-${entry.versionId}`}
                              value={entryUrlByVersion[entry.versionId] ?? ''}
                              placeholder="https://"
                              onChange={(event) =>
                                setEntryUrlByVersion((current) => ({
                                  ...current,
                                  [entry.versionId]: event.target.value,
                                }))
                              }
                              disabled={busy}
                            />
                          </div>
                          <button
                            type="button"
                            className="admin-primary-button"
                            disabled={busy}
                            onClick={() => void submitReview(entry, 'approve')}
                          >
                            通过
                          </button>
                          <div className="admin-field">
                            <label
                              htmlFor={`game-reject-reason-${entry.versionId}`}
                            >
                              拒绝理由
                            </label>
                            <input
                              id={`game-reject-reason-${entry.versionId}`}
                              value={reasonByVersion[entry.versionId] ?? ''}
                              onChange={(event) =>
                                setReasonByVersion((current) => ({
                                  ...current,
                                  [entry.versionId]: event.target.value,
                                }))
                              }
                              disabled={busy}
                            />
                          </div>
                          <button
                            type="button"
                            className="admin-ghost-button"
                            disabled={busy}
                            onClick={() => void submitReview(entry, 'reject')}
                          >
                            拒绝
                          </button>
                          <div className="admin-field">
                            <label
                              htmlFor={`game-suspend-reason-${entry.versionId}`}
                            >
                              下架原因
                            </label>
                            <input
                              id={`game-suspend-reason-${entry.versionId}`}
                              value={suspendReasonByGame[entry.gameId] ?? ''}
                              onChange={(event) =>
                                setSuspendReasonByGame((current) => ({
                                  ...current,
                                  [entry.gameId]: event.target.value,
                                }))
                              }
                              disabled={busy}
                            />
                          </div>
                          <button
                            type="button"
                            className="admin-danger-button"
                            disabled={busy || busyGameId === entry.gameId}
                            onClick={() => void suspendGame(entry)}
                          >
                            {busyGameId === entry.gameId
                              ? '正在下架…'
                              : '安全下架'}
                          </button>
                        </div>
                      </td>
                    </tr>
                  );
                })}
              </tbody>
            </table>
          </div>
        ) : null}
      </div>
      {writeConfirm.confirmDialog}
    </section>
  );
 }
@@ -3213,377 +3213,6 @@ button:disabled {
  padding: 12px;
  border-radius: 8px;
 }
 .admin-error-report-detail {
  width: min(980px, 100%);
  padding: 0;
  overflow: hidden;
  border: 1px solid #eadfd6;
  background: #fffdfb;
  box-shadow: 0 24px 80px rgb(57 31 18 / 22%);
 }
 .admin-error-report-detail__header {
  align-items: flex-start;
  padding: 24px 28px 20px;
  border-bottom: 1px solid #eee2d8;
  background: linear-gradient(135deg, #fffaf5, #fffdfb 65%);
 }
 .admin-error-report-detail__heading {
  min-width: 0;
 }
 .admin-error-report-detail__eyebrow {
  display: block;
  margin-bottom: 7px;
  color: #a4775d;
  font-size: 12px;
  font-weight: 750;
  letter-spacing: 0.08em;
 }
 .admin-error-report-detail__heading h2 {
  margin: 0;
  overflow-wrap: anywhere;
  color: #3d2a20;
  font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
  font-size: 19px;
  line-height: 1.35;
 }
 .admin-error-report-detail__badges,
 .admin-error-report-detail__footer-actions {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 8px;
 }
 .admin-error-report-detail__badges {
  margin-top: 12px;
 }
 .admin-error-report-detail__badge,
 .admin-error-report-detail__count {
  display: inline-flex;
  align-items: center;
  min-height: 26px;
  padding: 0 9px;
  border: 1px solid #eadfd6;
  border-radius: 999px;
  color: #785b49;
  background: #fff;
  font-size: 12px;
  font-weight: 700;
 }
 .admin-error-report-detail__close {
  display: inline-flex;
  width: 34px;
  height: 34px;
  align-items: center;
  justify-content: center;
  flex: 0 0 auto;
  border: 1px solid #e5d5c8;
  border-radius: 9px;
  color: #765848;
  background: #fff;
  font-size: 24px;
  line-height: 1;
  cursor: pointer;
 }
 .admin-error-report-detail__close:hover,
 .admin-error-report-detail__close:focus-visible {
  border-color: #b6623f;
  color: #9b4f31;
  outline: none;
 }
 .admin-error-report-status {
  display: inline-flex;
  align-items: center;
  min-height: 26px;
  padding: 0 9px;
  border-radius: 999px;
  font-size: 12px;
  font-weight: 750;
 }
 .admin-error-report-status.is-new {
  color: #a14e20;
  background: #fff0e5;
 }
 .admin-error-report-status.is-in-progress {
  color: #72551b;
  background: #fff7d9;
 }
 .admin-error-report-status.is-resolved {
  color: #28704d;
  background: #e9f7ee;
 }
 .admin-error-report-detail__summary {
  display: grid;
  grid-template-columns: minmax(0, 1.7fr) repeat(3, minmax(100px, 1fr));
  gap: 1px;
  border-bottom: 1px solid #eee2d8;
  background: #eee2d8;
 }
 .admin-error-report-detail__summary > div {
  display: grid;
  min-width: 0;
  gap: 5px;
  padding: 14px 18px;
  background: #fffdfb;
 }
 .admin-error-report-detail__summary span,
 .admin-error-report-detail__section-heading span,
 .admin-error-report-detail__status-field {
  color: #997d6a;
  font-size: 12px;
  font-weight: 650;
 }
 .admin-error-report-detail__summary strong {
  overflow-wrap: anywhere;
  color: #4d3326;
  font-size: 13px;
 }
 .admin-error-report-detail__body {
  display: grid;
  gap: 16px;
  max-height: min(62vh, 640px);
  overflow: auto;
  padding: 20px 28px;
 }
 .admin-error-report-detail__section {
  display: grid;
  gap: 12px;
 }
 .admin-error-report-detail__section-heading {
  display: flex;
  align-items: flex-start;
  justify-content: space-between;
  gap: 16px;
 }
 .admin-error-report-detail__section-heading h3 {
  margin: 0 0 4px;
  color: #4d3326;
  font-size: 15px;
 }
 .admin-error-report-detail__section-heading span {
  line-height: 1.5;
 }
 .admin-error-report-detail__count {
  flex: 0 0 auto;
 }
 .admin-error-report-event-list {
  display: grid;
  gap: 10px;
 }
 .admin-error-report-detail__empty {
  margin: 0;
  padding: 16px;
  border: 1px dashed #e4d2c5;
  border-radius: 10px;
  color: #997d6a;
  background: #fffaf6;
  text-align: center;
 }
 .admin-error-report-event {
  display: grid;
  gap: 9px;
  padding: 14px 16px;
  border: 1px solid #eee2d8;
  border-radius: 12px;
  background: #fff;
 }
 .admin-error-report-event__topline {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 8px;
  color: #927663;
  font-size: 12px;
 }
 .admin-error-report-event__topline time {
  margin-left: auto;
  color: #aa9282;
 }
 .admin-error-report-event__index {
  color: #b6623f;
  font-weight: 750;
 }
 .admin-error-report-event__message {
  margin: 0;
  color: #4a3024;
  font-size: 14px;
  line-height: 1.55;
  overflow-wrap: anywhere;
 }
 .admin-error-report-event code {
  overflow-wrap: anywhere;
  color: #957a69;
  font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
  font-size: 11px;
 }
 .admin-error-report-event details {
  border-top: 1px solid #f0e7df;
  padding-top: 9px;
 }
 .admin-error-report-event summary {
  color: #a15d3e;
  font-size: 12px;
  font-weight: 700;
  cursor: pointer;
 }
 .admin-error-report-event pre {
  max-height: 180px;
  margin: 9px 0 0;
  padding: 10px;
  border: 1px solid #f0e7df;
  background: #fffaf6;
  color: #72594a;
  font-size: 11px;
  line-height: 1.5;
 }
 .admin-error-report-detail__description {
  margin: 0;
  padding: 13px 15px;
  border-radius: 10px;
  color: #634b3c;
  background: #fff8f2;
  line-height: 1.6;
  white-space: pre-wrap;
  overflow-wrap: anywhere;
 }
 .admin-error-report-detail__section--note {
  padding-top: 4px;
 }
 .admin-error-report-detail__section--note .admin-detail-modal__note {
  display: grid;
  gap: 8px;
  color: #624938;
  font-size: 13px;
  font-weight: 700;
 }
 .admin-error-report-detail__section--note textarea {
  width: 100%;
  min-height: 100px;
  box-sizing: border-box;
  resize: vertical;
  border: 1px solid #e4d2c5;
  border-radius: 10px;
  padding: 11px 12px;
  color: #4d3326;
  background: #fff;
  font: inherit;
  line-height: 1.5;
 }
 .admin-error-report-detail__section--note textarea:focus {
  border-color: #b6623f;
  box-shadow: 0 0 0 3px rgb(182 98 63 / 14%);
  outline: none;
 }
 .admin-error-report-detail__footer {
  display: flex;
  align-items: flex-end;
  justify-content: space-between;
  gap: 16px;
  padding: 16px 28px 20px;
  border-top: 1px solid #eee2d8;
  background: #fffaf6;
 }
 .admin-error-report-detail__status-field {
  display: grid;
  gap: 6px;
 }
 .admin-error-report-detail__status-field select {
  min-width: 132px;
  min-height: 38px;
  border: 1px solid #e4d2c5;
  border-radius: 8px;
  padding: 0 10px;
  color: #4d3326;
  background: #fff;
  font: inherit;
 }
 .admin-error-report-detail__footer-actions button {
  min-height: 38px;
  border: 1px solid #d9c3b4;
  border-radius: 8px;
  padding: 0 13px;
  color: #6d4b3a;
  background: #fff;
  font-weight: 700;
  cursor: pointer;
 }
 .admin-error-report-detail__footer-actions button:last-child {
  border-color: #a96442;
  color: #fff;
  background: #a96442;
 }
 .admin-error-report-detail__footer-actions button:hover,
 .admin-error-report-detail__footer-actions button:focus-visible {
  border-color: #a96442;
  outline: none;
 }
@media (max-width: 720px) {
  .admin-error-report-detail__header,
  .admin-error-report-detail__body,
  .admin-error-report-detail__footer {
    padding-right: 18px;
    padding-left: 18px;
  }
  .admin-error-report-detail__summary {
    grid-template-columns: repeat(2, minmax(0, 1fr));
  }
  .admin-error-report-detail__footer {
    align-items: stretch;
    flex-direction: column;
  }
  .admin-error-report-detail__footer-actions button {
    flex: 1;
  }
 }
 .admin-agc-models {
  min-width: 0;
 }
@@ -66,15 +66,15 @@
    "zustand": "^5.0.14"
  },
  "devDependencies": {
-    "@openai/codex": "0.155.1",
+    "@openai/codex": "0.147.0",
    "@tailwindcss/vite": "^4.1.14",
    "@tauri-apps/cli": "^2.11.2",
    "@testing-library/react": "^16.3.2",
    "@testing-library/user-event": "^14.6.1",
    "@types/react": "^19.2.14",
    "@types/react-dom": "^19.2.3",
    "@types/react-window": "^1.8.8",
    "@types/three": "^0.184.1",
    "@types/react-window": "^1.8.8",
    "tailwindcss": "^4.1.14",
    "typescript": "~5.8.2",
    "vitest": "^0.34.6"
@@ -1,280 +0,0 @@
 import assert from 'node:assert/strict';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
  generateUpdateManifest,
  prepareReleaseVersion,
  resolveReleaseContext,
  resolveReleasePartition,
  runTauriBuild,
 } from './build-release.mjs';
 import { readReleaseDryRun, uploadReleaseArtifacts } from './release-oss.mjs';
 import {
  readUpdaterPubkey,
  verifyUpdaterSignature,
 } from './verify-updater-signature.mjs';
 /**
 * AGC macOS 分区（`<channel>-mac`）发布入口：构建 universal 包 → 双架构 smoke → 生成 universal DMG
 * → 生成分区清单 latest.json → 用产物内烘焙的公钥验签 → 按 dry-run 决定是否上传 OSS。
 *
 * 边界：
 * - Apple 签名与公证暂缺：本入口剥离 `APPLE_*` 凭据让 Tauri 跳过 Apple 签名，但**不能传
 *   `--no-sign`** —— 该标志同时会跳过 updater 的 minisign 签名，产物就没有 `.sig`；
 *   未签名 + 未公证必须显式记录而非静默通过；
 * - 更新包签名（TAURI_SIGNING_PRIVATE_KEY，minisign）是硬需求：缺了客户端一律拒绝安装，
 *   因此构建前要求凭据存在，构建后用内置公钥复核 `.sig` 才允许继续上传；
 * - 未通过验签绝不写 OSS：上传顺序为更新包、签名、首装包，全部成功后才覆盖渠道清单指针。
 */
 const appRoot = fileURLToPath(new URL('..', import.meta.url));
 const repoRoot = path.resolve(appRoot, '../..');
 /**
 * 产品名只从 Tauri 配置读取：它同时决定 `*.app` 目录名、updater 归档名与 DMG 卷名。
 * 写死会在改名后让入口静默找错对象（清理、打包、归档三处一起失效）。
 */
 function readProductName() {
  const read = (file) =>
    JSON.parse(fs.readFileSync(path.join(appRoot, 'src-tauri', file), 'utf8'));
  const base = read('tauri.conf.json');
  const macosPath = path.join(appRoot, 'src-tauri', 'tauri.macos.conf.json');
  const productName = fs.existsSync(macosPath)
    ? (read('tauri.macos.conf.json').productName ?? base.productName)
    : base.productName;
  assert.ok(
    typeof productName === 'string' && productName.trim().length > 0,
    'Tauri 配置缺少 productName',
  );
  return productName;
 }
 const productName = readProductName();
 const appBundleName = `${productName}.app`;
 const updaterArtifactName = `${productName}.app.tar.gz`;
 assert.equal(process.platform, 'darwin', '只能在 macOS Agent 执行');
 assert.equal(
  process.env.JENKINS_URL?.length > 0,
  true,
  '此入口仅用于 Jenkins 独立工作区',
 );
 assert.equal(
  fs.realpathSync(process.env.WORKSPACE || '.'),
  fs.realpathSync(repoRoot),
  '必须在 Jenkins workspace 根目录执行',
 );
 const space = fs.statfsSync(repoRoot);
 assert.ok(
  space.bavail * space.bsize >= 8 * 1024 ** 3,
  '构建前至少需要 8 GiB 可用空间；禁止自动清理开发缓存',
 );
 // 仅剥离 Apple 签名/公证变量：本节点没有证书，误用只会让构建失败；
 // 更新包签名与 OSS 凭据必须保留，它们是本入口发布能力的组成部分。
 for (const key of Object.keys(process.env)) {
  if (/^APPLE_/u.test(key)) delete process.env[key];
 }
 assert.ok(
  process.env.TAURI_SIGNING_PRIVATE_KEY?.length > 0 ||
    process.env.TAURI_SIGNING_PRIVATE_KEY_PATH?.length > 0,
  '缺少更新包签名私钥（TAURI_SIGNING_PRIVATE_KEY / _PATH）：无签名的更新包会被客户端拒绝，禁止继续',
 );
 const bucket = process.env.AGC_OSS_BUCKET?.trim() || 'agc-dev';
 const endpoint =
  process.env.AGC_OSS_ENDPOINT?.trim() || 'oss-rg-china-mainland.aliyuncs.com';
 if (!/^[a-z0-9][a-z0-9.-]{1,62}$/u.test(bucket) || /[\r\n\0]/u.test(endpoint)) {
  throw new Error('OSS bucket 或 endpoint 配置无效');
 }
 process.env.AGC_UPDATE_OSS_BASE_URL ||= `https://${bucket}.${endpoint}/agc`;
 const dryRun = readReleaseDryRun();
 process.env.CARGO_TARGET_DIR = path.join(appRoot, 'src-tauri/target');
 const context = resolveReleaseContext(['--target=universal-apple-darwin']);
 const partition = resolveReleasePartition(context.channel, context.target);
 const version = await prepareReleaseVersion(context);
 // 首装包名必须保持 `<产品名>_<版本>_universal.dmg`：清单侧按该后缀唯一匹配本次产物。
 const firstInstallName = `${productName}_${version}_universal.dmg`;
 // 幂等边界：workspace 会保留上一轮产物。先删掉本次将要写出的对象，否则
 //  1) hdiutil 会因同名 DMG 已存在直接失败（首次实跑即命中）；
 //  2) 上一轮遗留的 `.sig` 会让验签门禁把「本轮其实没签」判成通过。
 // 只删本次要写出的确切路径，不动其它版本产物与编译缓存。
 const macosBundle = path.join(context.bundleRoot, 'macos');
 for (const stale of [
  path.join(macosBundle, updaterArtifactName),
  path.join(macosBundle, `${updaterArtifactName}.sig`),
  path.join(macosBundle, `${firstInstallName}`),
  path.join(macosBundle, `${firstInstallName}.sha256`),
  path.join(context.bundleRoot, 'latest.json'),
  path.join(context.bundleRoot, 'release-notes.txt'),
 ]) {
  fs.rmSync(stale, { force: true });
 }
 const args = [
  '--target=universal-apple-darwin',
  '--bundles',
  'app',
  '--ci',
  // 刻意不传 `--no-sign`：它会连带跳过 updater 签名，而客户端强制校验更新包签名。
  // Apple 侧改为剥离 APPLE_* 凭据，未配置身份时 Tauri 不签名也不失败。
  // 基础配置已开启；这里显式声明，避免被其它配置来源关掉后静默失去更新能力。
  '--config',
  '{"bundle":{"createUpdaterArtifacts":true}}',
 ];
 const command = (binary, argv, options = {}) =>
  execFileSync(binary, argv, { cwd: repoRoot, stdio: 'inherit', ...options });
 runTauriBuild(args, context);
 const app = path.join(context.bundleRoot, 'macos', appBundleName);
 for (const architecture of ['arm64', 'x86_64']) {
  command(process.execPath, [
    path.join(appRoot, 'scripts/check-macos-bundle.mjs'),
    app,
    architecture,
    '--universal',
  ]);
 }
 // DMG 放在 bundle 根目录下：渠道清单的首装包选择会扫描该目录，命名必须匹配 `_<version>_universal.dmg`。
 const dmgDirectory = path.join(context.bundleRoot, 'macos');
 fs.mkdirSync(dmgDirectory, { recursive: true });
 const dmg = path.join(dmgDirectory, firstInstallName);
 const stage = fs.mkdtempSync(path.join(os.tmpdir(), 'agc-ci-dmg-'));
 try {
  command('ditto', [app, path.join(stage, appBundleName)]);
  fs.symlinkSync('/Applications', path.join(stage, 'Applications'));
  command('hdiutil', [
    'create',
    // 前面已删除同名对象；这里再要求显式覆盖，避免残留文件让构建以「文件已存在」失败。
    '-ov',
    '-volname',
    productName,
    '-srcfolder',
    stage,
    '-format',
    'UDZO',
    dmg,
  ]);
  command('hdiutil', ['verify', dmg]);
 } finally {
  fs.rmSync(stage, { recursive: true, force: true });
 }
 const release = await generateUpdateManifest(context);
 assert.equal(
  path.resolve(release.downloadArtifact),
  path.resolve(dmg),
  '首装包必须锁定本次生成的 universal DMG',
 );
 // 上传前门禁：用产物里烘焙的公钥复核更新包签名。验不过就停在这里，绝不写 OSS。
 const signature = verifyUpdaterSignature({
  artifactPath: release.artifact,
  signaturePath: `${release.artifact}.sig`,
  pubkey: readUpdaterPubkey(),
 });
 console.log(
  `[agc-macos] 更新包签名校验通过：alg=${signature.algorithm}，keyId=${signature.keyId}`,
 );
 const artifacts = path.join(repoRoot, 'artifacts');
 // 只清理本 Job 的归档输出，不能把上次 DMG 当成本次成功产物。
 fs.rmSync(artifacts, { recursive: true, force: true });
 fs.mkdirSync(artifacts, { recursive: true });
 const sha256 = (file) => {
  const hash = createHash('sha256');
  hash.update(fs.readFileSync(file));
  return hash.digest('hex');
 };
 const dmgHash = sha256(dmg);
 fs.writeFileSync(`${dmg}.sha256`, `${dmgHash}  ${path.basename(dmg)}\n`);
 const uploadPlan = uploadReleaseArtifacts(release, {
  bucket,
  endpoint,
  binary: process.env.OSSUTIL_BIN?.trim() || 'ossutil',
  accessKeyId: process.env.AGC_OSS_ACCESS_KEY_ID?.trim(),
  accessKeySecret: process.env.AGC_OSS_ACCESS_KEY_SECRET,
  dryRun,
 });
 const archived = [
  dmg,
  `${dmg}.sha256`,
  release.manifestPath,
  release.notesPath,
  `${release.artifact}.sig`,
 ];
 for (const file of archived) {
  fs.copyFileSync(file, path.join(artifacts, path.basename(file)));
 }
 const commit = execFileSync('git', ['rev-parse', 'HEAD'], {
  cwd: repoRoot,
  encoding: 'utf8',
 }).trim();
 // Apple 签名状态必须实测：剥离 APPLE_* 后 Tauri 通常跳过签名，但节点若装了 Developer ID
 // 证书仍可能签上，硬编码 appleSigned=false 会把「其实签了」写成假事实。
 const signatureProbe = spawnSync('codesign', ['-dv', '--verbose=2', app], {
  encoding: 'utf8',
 });
 const signatureText = `${signatureProbe.stdout ?? ''}${signatureProbe.stderr ?? ''}`;
 const appleSigned = /Authority=Developer ID Application/u.test(signatureText);
 const appleSignatureKind = appleSigned
  ? 'developer-id'
  : /Signature=adhoc/u.test(signatureText)
    ? 'adhoc'
    : 'unsigned';
 fs.writeFileSync(
  path.join(artifacts, 'build-manifest.json'),
  `${JSON.stringify(
    {
      version,
      commit,
      target: context.target,
      channel: context.channel,
      // Apple 签名与公证暂缺：显式记录为未验证项，不静默通过。
      appleSigned,
      appleSignatureKind,
      notarized: false,
      dryRun,
      uploaded: !dryRun,
      updaterSignature: {
        algorithm: signature.algorithm,
        keyId: signature.keyId,
        verified: true,
      },
      oss: {
        bucket,
        endpoint,
        partition,
        latest: `oss://${bucket}/agc/${partition}/latest.json`,
        objects: uploadPlan.map(({ destination }) => destination),
      },
      artifacts: {
        updater: path.basename(release.artifact),
        updaterSha256: sha256(release.artifact),
        updaterBytes: fs.statSync(release.artifact).size,
        updaterSignature: path.basename(`${release.artifact}.sig`),
        firstInstall: path.basename(dmg),
        firstInstallSha256: dmgHash,
        manifest: 'latest.json',
      },
      smokes: ['arm64', 'x86_64'],
      intelSmoke: process.arch === 'arm64' ? 'Rosetta' : 'native',
    },
    null,
    2,
  )}\n`,
 );
 console.log(
  dryRun
    ? `[agc-macos] dry-run 完成：${partition} 分区产物与清单已生成，未写入 OSS`
    : `[agc-macos] ${partition} 分区更新包、签名、首装包与清单已上传 OSS`,
 );
@@ -13,7 +13,6 @@ import {
  defaultEditorFeatures,
  withDefaultCargoFeatures,
 } from './cargo-features.mjs';
 import { stageNodeRuntime } from './stage-node-runtime.mjs';
 const appRoot = fileURLToPath(new URL('..', import.meta.url));
 // 提交摘要里的 pathspec 与 `git log` 都以仓库根为基准，不能在应用目录里执行。
@@ -47,12 +46,16 @@ function explicitBuildTarget(args) {
 }
 function validateReleaseTarget(target) {
  if (target === 'universal-apple-darwin') {
    throw new Error(
      '内置 Codex 资源仅支持 macOS 单架构构建，请使用 aarch64-apple-darwin 或 x86_64-apple-darwin',
    );
  }
  if (
    ![
      'x86_64-pc-windows-msvc',
      'aarch64-apple-darwin',
      'x86_64-apple-darwin',
      'universal-apple-darwin',
    ].includes(target)
  ) {
    throw new Error(`不支持的发布目标：${target}`);
@@ -197,12 +200,10 @@ export function updateManifestUrl(
 }
 /**
- * universal 主程序与双目录原生资源共用一个更新包；单架构只登记实际目标。
+ * 单架构产物只登记实际目标，不能把同一原生资源映射为另一架构。
 */
 export function resolveManifestPlatformKeys(target = defaultTarget()) {
  validateReleaseTarget(target);
  if (target === 'universal-apple-darwin')
    return ['darwin-aarch64', 'darwin-x86_64'];
  if (target === 'aarch64-apple-darwin') return ['darwin-aarch64'];
  if (target === 'x86_64-apple-darwin') return ['darwin-x86_64'];
  if (target.includes('windows')) {
@@ -441,25 +442,22 @@ export function createChannelConfig(
  };
 }
-function writeChannelConfigFile(channel, target, includeNodeRuntime = false) {
+function writeChannelConfigFile(channel, target) {
  const configPath = path.join(
    os.tmpdir(),
    `agc-tauri-channel-${channel}-${target}.json`,
  );
-  const config = createChannelConfig(channel, target);
+  fs.writeFileSync(
-  // 普通 cargo test/dev 不要求发行资源；只有完成 staging 的发行构建加入映射。
+    configPath,
-  if (includeNodeRuntime)
+    `${JSON.stringify(createChannelConfig(channel, target), null, 2)}\n`,
-    config.bundle = {
+  );
      resources: { 'resources/node-runtime': 'game-runtime/node' },
    };
  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
  return configPath;
 }
 export function runTauriBuild(
  args = [],
  context = resolveReleaseContext(args),
-  { spawn = spawnSync, stageRuntime = stageNodeRuntime } = {},
+  { spawn = spawnSync } = {},
 ) {
  if (
    explicitBuildTarget(args) &&
@@ -469,12 +467,7 @@ export function runTauriBuild(
  }
  const tauriArguments = buildTauriBuildArguments(args, context.target);
  const { channel, target } = context;
-  if (!args.includes('--no-bundle')) stageRuntime(target);
+  const configPath = writeChannelConfigFile(channel, target);
  const configPath = writeChannelConfigFile(
    channel,
    target,
    !args.includes('--no-bundle'),
  );
  console.log(
    `[ai-game-creator-shell] 渠道 ${channel} 端点配置：${configPath}`,
  );
@@ -490,17 +483,7 @@ export function runTauriBuild(
  const result = spawn(
    npmCommand,
    ['--prefix', '../..', 'exec', 'tauri', '--', ...tauriArguments],
-    {
+    { cwd: appRoot, stdio: 'inherit', shell: process.platform === 'win32' },
      cwd: appRoot,
      stdio: 'inherit',
      shell: process.platform === 'win32',
      env: {
        ...process.env,
        // Vite embeds the platform API origin in the packaged renderer. The
        // release channel and updater channel therefore cannot drift apart.
        VITE_AGC_PLATFORM_CHANNEL: channel,
      },
    },
  );
  if (result.error) throw result.error;
  if (result.status !== 0) process.exit(result.status ?? 1);
@@ -560,18 +543,6 @@ export function selectFirstInstallArtifact(
    if (!selected?.endsWith('.exe')) {
      throw new Error('Windows 首装包必须复用本次 NSIS .exe 更新包');
    }
  } else if (target === 'universal-apple-darwin') {
    // universal 主程序只产出一个 DMG，aarch64 与 x86_64 首装共用它（命名见 build-macos-ci.mjs）。
    const suffix = `_${version}_universal.dmg`;
    const candidates = files.filter((file) =>
      path.basename(file).endsWith(suffix),
    );
    if (candidates.length !== 1) {
      throw new Error(
        `首装 DMG 必须唯一匹配本次版本 ${version} 的 universal 产物，找到 ${candidates.length} 个`,
      );
    }
    selected = candidates[0];
  } else {
    // Tauri DMG 文件名使用 aarch64 / x64，而 updater 的 Intel 平台键是 x86_64。
    const architecture = target.startsWith('aarch64') ? 'aarch64' : 'x64';
@@ -45,22 +45,19 @@ const packageVersion = JSON.parse(
 ).version;
 function createDmgFixture(root, target, version = packageVersion) {
-  const architecture = target.startsWith('aarch64')
+  const architecture = target.startsWith('aarch64') ? 'aarch64' : 'x64';
    ? 'aarch64'
    : target === universalTarget
      ? 'universal'
      : 'x64';
  const dmg = path.join(root, `陶泥儿_${version}_${architecture}.dmg`);
  writeFileSync(dmg, 'first installation disk image');
  return dmg;
 }
-test('native sidecar builds accept universal and each macOS architecture', () => {
+test('native sidecar builds reject universal targets and accept each macOS architecture', () => {
-  for (const target of [
+  assert.throws(() => buildTauriBuildArguments([], universalTarget), /单架构/);
-    universalTarget,
+  assert.throws(
-    'aarch64-apple-darwin',
+    () => buildTauriBuildArguments(['--target=universal-apple-darwin']),
-    'x86_64-apple-darwin',
+    /单架构/,
-  ]) {
+  );
  for (const target of ['aarch64-apple-darwin', 'x86_64-apple-darwin']) {
    assert.deepEqual(buildTauriBuildArguments([], target), [
      'build',
      '--target',
@@ -204,26 +201,8 @@ test('channel manifest URL and build-time endpoint follow the channel', () => {
  });
 });
-test('packaged renderer receives the same channel as the updater manifest', () => {
+test('macOS manifests only advertise the architecture actually built', () => {
-  const context = resolveReleaseContext([], {
+  assert.throws(() => resolveManifestPlatformKeys(universalTarget), /单架构/);
    AGC_BUILD_TARGET: windowsTarget,
    AGC_UPDATE_CHANNEL: 'release',
  });
  let spawnOptions;
  runTauriBuild([], context, {
    spawn: (_binary, _args, options) => {
      spawnOptions = options;
      return { status: 0 };
    },
  });
  assert.equal(spawnOptions?.env?.VITE_AGC_PLATFORM_CHANNEL, 'release');
 });
 test('macOS manifests advertise exactly the architectures actually built', () => {
  assert.deepEqual(resolveManifestPlatformKeys(universalTarget), [
    'darwin-aarch64',
    'darwin-x86_64',
  ]);
  assert.deepEqual(resolveManifestPlatformKeys('aarch64-apple-darwin'), [
    'darwin-aarch64',
  ]);
@@ -267,6 +246,7 @@ test('release context resolves explicit targets before environment/default and f
    ['--target='],
    ['--target', '--no-bundle'],
    ['--target', windowsTarget, '--target=aarch64-apple-darwin'],
    ['--target', universalTarget],
    ['--target', 'unknown'],
  ])
    assert.throws(() => resolveReleaseContext(args, {}));
@@ -299,7 +279,6 @@ test('explicit macOS target drives version lookup, Tauri endpoint, artifact and
            build: (args, context) => {
              seenContexts.push(context);
              runTauriBuild(args, context, {
                stageRuntime: () => {},
                spawn: (_binary, command) => {
                  const configIndex = command.lastIndexOf('--config');
                  const config = JSON.parse(
@@ -482,8 +461,8 @@ test('invalid target or platform used as channel fails before any release side e
    },
  };
  await assert.rejects(
-    () => buildRelease(['--target', 'unknown'], sideEffects),
+    () => buildRelease(['--target', universalTarget], sideEffects),
-    /不支持的发布目标/,
+    /单架构/,
  );
  await withEnv({ AGC_UPDATE_CHANNEL: 'dev-win' }, () =>
    assert.rejects(
@@ -494,43 +473,6 @@ test('invalid target or platform used as channel fails before any release side e
  assert.equal(touched, false);
 });
 test('universal uses the Mac channel and the same signed artifact for both architectures', () => {
  const context = resolveReleaseContext(['--target', universalTarget], {
    AGC_BUILD_TARGET: windowsTarget,
  });
  // 渠道本身不含系统：分区由渠道 + 目标推导，二者不能混为一谈。
  assert.equal(context.channel, 'dev');
  assert.equal(
    resolveReleasePartition(context.channel, context.target),
    'dev-mac',
  );
  assert.ok(context.bundleRoot.includes(universalTarget));
  withSignedArtifact('陶泥儿.app.tar.gz', (artifact) => {
    const manifest = createUpdateManifest(artifact, {
      ...context,
      downloadArtifact: createDmgFixture(
        path.dirname(artifact),
        universalTarget,
      ),
    });
    assert.deepEqual(Object.keys(manifest.platforms), [
      'darwin-aarch64',
      'darwin-x86_64',
    ]);
    assert.deepEqual(
      manifest.platforms['darwin-aarch64'],
      manifest.platforms['darwin-x86_64'],
    );
    assert.match(manifest.platforms['darwin-aarch64'].url, /\/dev-mac\//);
    // 两个平台键共用同一个 universal 首装包，不能要求出两份架构 DMG。
    assert.deepEqual(
      manifest.downloads['darwin-aarch64'].url,
      manifest.downloads['darwin-x86_64'].url,
    );
    assert.match(manifest.downloads['darwin-aarch64'].url, /_universal\.dmg$/u);
  });
 });
 test('Windows remains the default and explicit Windows overrides macOS environment', () => {
  const files = ['/tmp/mac.app.tar.gz', '/tmp/windows.exe', '/tmp/mac.dmg'];
  for (const context of [
@@ -548,7 +490,6 @@ test('Windows remains the default and explicit Windows overrides macOS environme
      ['--target', windowsTarget, '--config', 'user-config.json'],
      context,
      {
        stageRuntime: () => {},
        spawn: (_binary, command) => {
          assert.ok(
            command.includes(
@@ -587,52 +528,6 @@ test('no-bundle smoke skips version writes and manifest generation', async () =>
  assert.deepEqual(steps, ['dev']);
 });
 test('release stages Node before Tauri and injects its resource mapping only for bundles', () => {
  const context = resolveReleaseContext(['--target', windowsTarget]);
  const events = [];
  runTauriBuild(['--target', windowsTarget], context, {
    stageRuntime(target) {
      assert.equal(target, windowsTarget);
      events.push('stage');
    },
    spawn(_binary, args) {
      events.push('build');
      const config = JSON.parse(
        readFileSync(args[args.lastIndexOf('--config') + 1], 'utf8'),
      );
      assert.deepEqual(config.bundle.resources, {
        'resources/node-runtime': 'game-runtime/node',
      });
      return { status: 0 };
    },
  });
  assert.deepEqual(events, ['stage', 'build']);
  runTauriBuild(['--no-bundle', '--target', windowsTarget], context, {
    stageRuntime() {
      assert.fail('no-bundle must not stage resources');
    },
    spawn(_binary, args) {
      const config = JSON.parse(
        readFileSync(args[args.lastIndexOf('--config') + 1], 'utf8'),
      );
      assert.equal(config.bundle, undefined);
      return { status: 0 };
    },
  });
  assert.throws(
    () =>
      runTauriBuild(['--target', windowsTarget], context, {
        stageRuntime() {
          throw new Error('missing runtime');
        },
        spawn() {
          assert.fail('invalid runtime must prevent build');
        },
      }),
    /missing runtime/,
  );
 });
 test('channel manifest carries version, platform keys and signature', () => {
  withSignedArtifact('陶泥儿_0.1.48_x64-setup.exe', (artifact) => {
    withEnv({ AGC_UPDATE_RELEASE_NOTES: '修复与改进' }, () => {
@@ -736,7 +631,6 @@ for (const channel of ['release', 'beta-2']) {
              '2.3.4',
            );
            runTauriBuild([`--target=${target}`], context, {
              stageRuntime: () => {},
              spawn: (_binary, command) => {
                const config = JSON.parse(
                  readFileSync(
@@ -4,25 +4,9 @@ import { EventEmitter } from 'node:events';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 // 固定解析源码保留上游测试中的替换字符；必须同时核对原始字节与许可。
 execFileSync(
  process.execPath,
  [
    '--test',
    fileURLToPath(
      new URL(
        '../src-tauri/vendor/codex-patch-parser/upstream-integrity.test.mjs',
        import.meta.url,
      ),
    ),
  ],
  { stdio: 'inherit' },
 );
 import {
  appIdentifier,
  defaultRealSwarmTestTask,
@@ -1329,18 +1313,6 @@ if (tauriConfig.identifier !== 'world.genarrative.ai-game-creator') {
 const expectedBundledDesignAgentResources = {
  'design-agent': 'design-agent',
  ...Object.fromEntries(
    [
      'codex-patch-parser',
      'codex-utils-path-uri',
      'codex-utils-absolute-path',
    ].flatMap((name) =>
      ['LICENSE', 'NOTICE'].map((file) => [
        `vendor/${name}/${file}`,
        `licenses/${name}/${file}`,
      ]),
    ),
  ),
 };
 const expectedBundledWindowsResources = {
  'resources/codex/win-x64/bin/codex.exe': 'coding-agent/win-x64/bin/codex.exe',
@@ -1364,7 +1336,7 @@ assert.deepEqual(
  'AI game creator shell base Tauri config must bundle the design-agent resource pack',
 );
 for (const key of Object.keys(tauriConfig.bundle?.resources ?? {})) {
-  if (String(key).startsWith('resources/codex/')) {
+  if (String(key).includes('codex')) {
    throw new Error(
      'AI game creator shell base Tauri config must not require Windows-only Codex resources',
    );
@@ -1393,20 +1365,18 @@ if (windowsTauriConfig.bundle?.useLocalToolsDir !== true) {
 assert.deepEqual(
  macosTauriConfig.bundle?.resources,
  Object.fromEntries([
-    ...['darwin-arm64', 'darwin-x64'].flatMap((arch) =>
+    ...[
-      [
+      'bin/codex',
-        'bin/codex',
+      'bin/codex-code-mode-host',
-        'bin/codex-code-mode-host',
+      'codex-path/rg',
-        'codex-path/rg',
+      'codex-resources/zsh/bin/zsh',
-        'codex-resources/zsh/bin/zsh',
+      'codex-package.json',
-        'codex-package.json',
+      'NOTICE.md',
-        'NOTICE.md',
+      'manifest.json',
-        'manifest.json',
+    ].map((file) => [
-      ].map((file) => [
+      `resources/codex/mac-native/${file}`,
-        `resources/codex/mac-native/${arch}/${file}`,
+      `coding-agent/mac-native/${file}`,
-        `coding-agent/mac-native/${arch}/${file}`,
+    ]),
      ]),
    ),
    ['resources/plugins', 'plugins'],
  ]),
  'macOS must bundle the complete native Codex layout and plugin workspace',
@@ -8,13 +8,6 @@ import path from 'node:path';
 // 只操作临时复制品；不启动 GUI、不读取开发机凭据、不访问 Provider。
 assert.equal(process.platform, 'darwin', '此验证必须在 macOS 执行');
 const source = path.resolve(process.argv[2] || '');
 const architecture =
  process.argv[3] || (process.arch === 'arm64' ? 'arm64' : 'x86_64');
 assert.ok(
  ['arm64', 'x86_64'].includes(architecture),
  '架构只接受 arm64 / x86_64',
 );
 const requireUniversal = process.argv.includes('--universal');
 assert.ok(
  source.endsWith('.app') && fs.statSync(source).isDirectory(),
  '请传入 .app 绝对路径',
@@ -22,28 +15,7 @@ assert.ok(
 const root = fs.realpathSync(
  fs.mkdtempSync(path.join(os.tmpdir(), 'agc-macos-bundle-')),
 );
-// 产品名从传入的 .app 推导，不在校验脚本里写死；改名后校验对象仍指向同一个包。
+const app = path.join(root, '陶泥儿 隔离测试.app');
 const appBundleName = path.basename(source);
 const app = path.join(root, `隔离-${appBundleName}`);
 // 侧车清单版本必须等于锁定的 @openai/codex 版本，避免两处固定版本漂移。
 const appPackage = JSON.parse(
  fs.readFileSync(
    path.join(
      path.dirname(new URL(import.meta.url).pathname),
      '../package.json',
    ),
    'utf8',
  ),
 );
 const pinnedCodexVersion =
  appPackage.dependencies?.['@openai/codex'] ??
  appPackage.devDependencies?.['@openai/codex'] ??
  appPackage.optionalDependencies?.['@openai/codex'];
 assert.match(
  pinnedCodexVersion,
  /^\d+\.\d+\.\d+$/u,
  'package.json 必须锁定精确的 @openai/codex 版本',
 );
 const home = path.join(root, 'home');
 const config = path.join(root, 'config');
 const tmp = path.join(root, 'tmp');
@@ -59,58 +31,17 @@ const env = {
 };
 function run(command, args) {
-  // 只强制被测应用切片；本机 Xcode 检查工具可能仅提供宿主架构。
+  const result = spawnSync(command, args, {
-  const useSlice = command.startsWith(`${app}${path.sep}`);
+    cwd: root,
-  const result = spawnSync(
+    env,
-    useSlice ? '/usr/bin/arch' : command,
+    encoding: 'utf8',
-    useSlice ? [`-${architecture}`, command, ...args] : args,
+    timeout: 30_000,
-    {
+    maxBuffer: 1024 * 1024,
-      cwd: root,
+  });
      env,
      encoding: 'utf8',
      timeout: 120_000,
      maxBuffer: 1024 * 1024,
    },
  );
  assert.ifError(result.error);
  return result;
 }
 /**
 * APFS 上优先用 `ditto --clone`：整包按区块克隆，秒级完成且几乎不占额外空间。
 * 跨卷或非 APFS 时回退到真实复制；两种路径都必须产出可独立改动的副本，
 * 因为「缺组件拒绝」用例会在副本里改名文件。
 */
 function copyBundle(from, to) {
  const cloned = spawnSync('/usr/bin/ditto', ['--clone', from, to], {
    encoding: 'utf8',
  });
  if (
    cloned.status === 0 &&
    fs.existsSync(path.join(to, 'Contents/Info.plist'))
  ) {
    return 'clone';
  }
  fs.cpSync(from, to, { recursive: true });
  return 'copy';
 }
 /** 可执行名以包内 Info.plist 为准：它是稳定契约，但没必要在校验脚本里重复硬编码。 */
 function readBundleExecutable(appPath) {
  const plist = path.join(appPath, 'Contents/Info.plist');
  const result = spawnSync(
    '/usr/libexec/PlistBuddy',
    ['-c', 'Print :CFBundleExecutable', plist],
    { encoding: 'utf8' },
  );
  const name = (result.stdout ?? '').trim();
  assert.ok(
    name.length > 0,
    `无法从 Info.plist 读取 CFBundleExecutable：${plist}`,
  );
  return name;
 }
 async function hashFile(file) {
  const hash = createHash('sha256');
  for await (const chunk of fs.createReadStream(file)) hash.update(chunk);
@@ -129,7 +60,7 @@ async function handshake(executable) {
    await new Promise((resolve, reject) => {
      const timer = setTimeout(
        () => reject(new Error('app-server 初始化超时')),
-        120_000,
+        15_000,
      );
      const finish = (error) => {
        clearTimeout(timer);
@@ -196,39 +127,23 @@ async function handshake(executable) {
 }
 try {
-  const copiedWith = copyBundle(source, app);
+  fs.cpSync(source, app, { recursive: true });
  const resources = path.join(app, 'Contents/Resources');
-  const platform = architecture === 'arm64' ? 'darwin-arm64' : 'darwin-x64';
+  const bundle = path.join(resources, 'coding-agent/mac-native');
  const bundle = path.join(resources, 'coding-agent/mac-native', platform);
  const executable = path.join(bundle, 'bin/codex');
-  const main = path.join(app, 'Contents/MacOS', readBundleExecutable(app));
+  const main = path.join(
-  const mainArchitectures = run('/usr/bin/lipo', ['-archs', main]);
+    app,
-  assert.equal(mainArchitectures.status, 0);
+    'Contents/MacOS/genarrative-ai-game-creator-shell',
-  assert.ok(mainArchitectures.stdout.split(/\s+/).includes(architecture));
+  );
  if (requireUniversal) {
    assert.deepEqual(mainArchitectures.stdout.trim().split(/\s+/).sort(), [
      'arm64',
      'x86_64',
    ]);
    for (const platform of ['darwin-arm64', 'darwin-x64']) {
      assert.ok(
        fs.existsSync(
          path.join(
            resources,
            'coding-agent/mac-native',
            platform,
            'manifest.json',
          ),
        ),
      );
    }
  }
  const manifest = JSON.parse(
    fs.readFileSync(path.join(bundle, 'manifest.json'), 'utf8'),
  );
  assert.equal(manifest.schemaVersion, 'genarrative-codex-sidecar.v2');
-  assert.equal(manifest.platform, platform);
+  assert.equal(
-  assert.equal(manifest.version, `codex-cli ${pinnedCodexVersion}`);
+    manifest.platform,
    process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64',
  );
  assert.equal(manifest.version, 'codex-cli 0.147.0');
  const components = [
    'bin/codex',
    'bin/codex-code-mode-host',
@@ -244,41 +159,14 @@ try {
      fs.accessSync(file, fs.constants.X_OK);
      const arch = run('/usr/bin/lipo', ['-archs', file]);
      assert.equal(arch.status, 0, component);
-      assert.equal(arch.stdout.trim(), architecture, component);
+      assert.equal(
        arch.stdout.trim(),
        process.arch === 'arm64' ? 'arm64' : 'x86_64',
        component,
      );
    }
  }
  assert.ok(fs.existsSync(path.join(bundle, 'NOTICE.md')));
  const nodeRoot = path.join(resources, 'game-runtime/node');
  const nodeManifest = JSON.parse(
    fs.readFileSync(path.join(nodeRoot, 'manifest.json'), 'utf8'),
  );
  assert.equal(nodeManifest.schemaVersion, 'agc-node-runtime.v1');
  assert.equal(nodeManifest.platform, 'darwin');
  assert.equal(nodeManifest.arch, process.arch);
  const runtimeFiles = fs
    .readdirSync(nodeRoot, { recursive: true })
    .filter(
      (file) =>
        fs.statSync(path.join(nodeRoot, file)).isFile() &&
        file !== 'manifest.json',
    );
  assert.deepEqual(runtimeFiles.sort(), Object.keys(nodeManifest.files).sort());
  for (const [file, digest] of Object.entries(nodeManifest.files)) {
    assert.equal(await hashFile(path.join(nodeRoot, file)), digest, file);
  }
  assert.ok(nodeManifest.files['NODE-LICENSE']);
  assert.ok(nodeManifest.files['node_modules/npm/LICENSE']);
  assert.equal(
    run(path.join(nodeRoot, 'node'), ['--version']).stdout.trim(),
    nodeManifest.nodeVersion,
  );
  assert.equal(
    run(path.join(nodeRoot, 'node'), [
      path.join(nodeRoot, 'node_modules/npm/bin/npm-cli.js'),
      '--version',
    ]).stdout.trim(),
    nodeManifest.npmVersion,
  );
  const plugin = path.join(resources, 'plugins/agc-cocos-editor');
  for (const file of [
    'plugin.json',
@@ -289,13 +177,10 @@ try {
  }
  const packageFiles = fs.readdirSync(resources, { recursive: true });
  assert.ok(
-    !packageFiles.some(
+    !packageFiles.some((file) =>
-      (file) =>
+      /(^|\/)(\.env[^/]*|auth\.json|node_modules|target|\.git)(\/|$)|\.(exe|dll)$/.test(
-        /(^|\/)(\.env[^/]*|auth\.json|target|\.git)(\/|$)|\.(exe|dll)$/.test(
+        file,
-          file,
+      ),
        ) ||
        (/(^|\/)node_modules(\/|$)/.test(file) &&
          !file.startsWith('game-runtime/node/node_modules/npm')),
    ),
  );
  assert.equal(run(executable, ['--version']).stdout.trim(), manifest.version);
@@ -327,7 +212,7 @@ try {
  assert.notEqual(broken.status, 0);
  assert.match(`${broken.stdout}\n${broken.stderr}`, /Codex CLI 未安装/);
  console.log(
-    `PASS (${architecture}, 副本=${copiedWith}): 隔离安装包资源、架构、摘要、权限、正式 Codex 查找、app-server 握手及缺组件拒绝`,
+    'PASS: 隔离安装包资源、架构、摘要、权限、正式 Codex 查找、app-server 握手及缺组件拒绝',
  );
  console.log(
    '未验证：GUI、真实登录/Provider 对话、Cocos macOS 原生桥接；插件 Node 仍为外部前提',
@@ -1,134 +0,0 @@
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const appRoot = fileURLToPath(new URL('..', import.meta.url));
 const repoRoot = path.resolve(appRoot, '../..');
 const platforms = {
  arm64: 'aarch64-apple-darwin',
  x64: 'x86_64-apple-darwin',
 };
 export function lockedMacPackage(lock, arch, version) {
  assert.ok(Object.hasOwn(platforms, arch), '未知 macOS 架构');
  const alias = `@openai/codex-darwin-${arch}`;
  const entry = lock.packages?.[`node_modules/${alias}`];
  assert.equal(
    entry?.version,
    `${version}-darwin-${arch}`,
    '原生依赖必须与应用锁定版本一致',
  );
  assert.deepEqual(entry.os, ['darwin']);
  assert.deepEqual(entry.cpu, [arch]);
  const url = new URL(entry.resolved);
  assert.equal(url.protocol, 'https:');
  assert.equal(
    url.hostname,
    'registry.npmjs.org',
    '只下载锁定的官方 npm 原生包',
  );
  assert.equal(url.username + url.password + url.search + url.hash, '');
  assert.match(entry.integrity, /^sha512-[A-Za-z0-9+/]+={0,2}$/);
  return { alias, target: platforms[arch], ...entry };
 }
 export function verifyPackageIntegrity(bytes, expected) {
  const actual = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
  assert.equal(actual, expected, 'Codex 下载包 lockfile integrity 不匹配');
 }
 export function validateArchiveListing(listing) {
  const files = listing.trim().split(/\r?\n/u);
  assert.ok(files.length > 0);
  for (const file of files) {
    assert.ok(file.startsWith('package/'), '原生包必须只有 package 根目录');
    assert.ok(
      !file.split('/').includes('..') && !file.includes('\\'),
      '压缩包路径不安全',
    );
  }
 }
 export async function prepareMacosCodex() {
  assert.equal(process.platform, 'darwin', '该入口仅用于 macOS 构建机');
  const lock = JSON.parse(
    fs.readFileSync(path.join(repoRoot, 'package-lock.json'), 'utf8'),
  );
  const app = JSON.parse(
    fs.readFileSync(path.join(appRoot, 'package.json'), 'utf8'),
  );
  const version = app.devDependencies['@openai/codex'];
  assert.match(version, /^\d+\.\d+\.\d+$/u, 'Codex 必须锁定精确版本');
  const cache = path.join(appRoot, 'src-tauri/target/.macos-native-cache');
  fs.mkdirSync(cache, { recursive: true });
  for (const arch of Object.keys(platforms)) {
    const entry = lockedMacPackage(lock, arch, version);
    const archive = path.join(cache, `codex-${entry.version}.tgz`);
    if (!fs.existsSync(archive)) {
      const response = await fetch(entry.resolved, {
        signal: AbortSignal.timeout(300_000),
      });
      assert.ok(response.ok, `原生包下载失败 HTTP ${response.status}`);
      const bytes = Buffer.from(await response.arrayBuffer());
      verifyPackageIntegrity(bytes, entry.integrity);
      const partial = `${archive}.${process.pid}.tmp`;
      fs.writeFileSync(partial, bytes);
      fs.renameSync(partial, archive);
    }
    verifyPackageIntegrity(fs.readFileSync(archive), entry.integrity);
    validateArchiveListing(
      execFileSync('tar', ['-tzf', archive], { encoding: 'utf8' }),
    );
    // 拒绝链接、设备及其它特殊条目，不能让 tar 在包目录之外写入。
    const entries = execFileSync('tar', ['-tvzf', archive], {
      encoding: 'utf8',
    });
    assert.ok(
      entries
        .trim()
        .split(/\r?\n/u)
        .every((line) => /^[-d]/u.test(line)),
      '原生包禁止链接或特殊文件',
    );
    const parent = path.join(repoRoot, 'node_modules/@openai');
    fs.mkdirSync(parent, { recursive: true });
    const stage = fs.mkdtempSync(path.join(parent, '.mac-native-'));
    try {
      execFileSync(
        'tar',
        ['-xzf', archive, '-C', stage, '--strip-components=1'],
        { stdio: 'pipe' },
      );
      const metadata = JSON.parse(
        fs.readFileSync(
          path.join(stage, 'vendor', entry.target, 'codex-package.json'),
          'utf8',
        ),
      );
      assert.equal(metadata.version, version);
      assert.equal(metadata.target, entry.target);
      assert.equal(metadata.entrypoint, 'bin/codex');
      const destination = path.join(repoRoot, 'node_modules', entry.alias);
      assert.ok(
        !fs.existsSync(destination) ||
          !fs.lstatSync(destination).isSymbolicLink(),
        '拒绝覆盖链接依赖',
      );
      fs.rmSync(destination, { recursive: true, force: true });
      fs.renameSync(stage, destination);
    } finally {
      fs.rmSync(stage, { recursive: true, force: true });
    }
    console.log(`[macOS Codex] ${entry.version}: lockfile integrity 已验证`);
  }
 }
 if (
  process.argv[1] &&
  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
 ) {
  await prepareMacosCodex();
 }
@@ -1,197 +0,0 @@
 import assert from 'node:assert/strict';
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import { test } from 'node:test';
 import {
  lockedMacPackage,
  validateArchiveListing,
  verifyPackageIntegrity,
 } from './prepare-macos-codex.mjs';
 const lock = JSON.parse(
  fs.readFileSync(new URL('../../../package-lock.json', import.meta.url)),
 );
 const version = JSON.parse(
  fs.readFileSync(new URL('../package.json', import.meta.url)),
 ).devDependencies['@openai/codex'];
 test('both macOS dependencies resolve from the lockfile without floating versions', () => {
  assert.equal(
    lockedMacPackage(lock, 'arm64', version).target,
    'aarch64-apple-darwin',
  );
  assert.equal(
    lockedMacPackage(lock, 'x64', version).target,
    'x86_64-apple-darwin',
  );
  assert.throws(() => lockedMacPackage(lock, 'other', version));
  assert.throws(() => lockedMacPackage(lock, 'x64', '0.0.0'));
 });
 test('native package integrity rejects tampering', () => {
  const bytes = Buffer.from('pinned package');
  const integrity = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
  verifyPackageIntegrity(bytes, integrity);
  assert.throws(() =>
    verifyPackageIntegrity(Buffer.from('modified'), integrity),
  );
 });
 test('archive traversal and non-package entries fail closed', () => {
  validateArchiveListing(
    'package/package.json\npackage/vendor/target/bin/codex\n',
  );
  for (const listing of [
    '',
    '/tmp/payload',
    'package/../private',
    'other/file',
    'package/..\\file',
  ]) {
    assert.throws(() => validateArchiveListing(listing));
  }
 });
 test('CI pipeline is manual, publishes the macOS partition and never reuses a developer workspace', () => {
  const pipeline = fs.readFileSync(
    new URL(
      '../../../jenkins/Jenkinsfile.ai-game-creator-shell-macos-build',
      import.meta.url,
    ),
    'utf8',
  );
  for (const required of [
    'genarrative-agc-macos',
    'disableConcurrentBuilds()',
    '$AGC_AGENT_ROOT',
    'StrictHostKeyChecking=yes',
    'git merge-base --is-ancestor',
    'allowEmptyArchive: false',
    "string(name: 'AGC_UPDATE_CHANNEL', defaultValue: 'dev'",
    'AGC_UPDATE_CHANNEL=${params.AGC_UPDATE_CHANNEL}',
    "string(credentialsId: 'AgcUpdaterSigningKey'",
    "string(credentialsId: 'AgcUpdaterSigningKeyPassword'",
    "string(credentialsId: 'AliyunAccessKeyId'",
    "string(credentialsId: 'AliyunaccessKeySecret'",
    'AGC_RELEASE_VERSION',
    'OSSUTIL_BIN',
    // 并行度必须可调：节点是共用机器，写死容易把整机压满或反过来浪费一半核心。
    "string(name: 'CARGO_BUILD_JOBS', defaultValue: '8'",
    'CARGO_BUILD_JOBS=${params.CARGO_BUILD_JOBS}',
    // Agent 工作区按约定匹配，不写死节点名：节点改名（-local → -01）后守卫仍成立。
    '"$HOME"/Library/Jenkins/agents/*/workspace/*',
    // 上一次发布的 commit 落在 master 上，取到它更新摘要才不会退化成「最近提交」。
    'refs/heads/master:refs/remotes/origin/master',
  ]) {
    assert.ok(pipeline.includes(required), required);
  }
  assert.ok(
    !pipeline.includes('genarrative-agc-macos-local'),
    'Jenkinsfile 不得写死具体节点名',
  );
  // 这条管线是正式发布入口（与 Windows 对称）：默认真发布，演练需显式勾选。
  assert.match(
    pipeline,
    /booleanParam\(name: 'AGC_RELEASE_DRY_RUN', defaultValue: false/u,
    'Channel 发布默认必须是真发布，演练只能显式勾选',
  );
  // 节点是办公机：离线期间排队的旧构建必须自行让位，且跳过要覆盖后续全部阶段。
  assert.match(
    pipeline,
    /booleanParam\(name: 'SKIP_IF_SUPERSEDED', defaultValue: false/u,
  );
  // 仓库文件不得出现节点用户名/个人 Home 路径：换机或改名后必须仍然可用。
  assert.ok(
    !pipeline.includes('/Users/'),
    'Jenkinsfile 不得写死个人 Home 路径，工具链位置应按 $HOME 展开',
  );
  assert.ok(
    pipeline.includes('export PATH="$HOME/'),
    'PATH 必须在 shell 步骤里按 $HOME 展开',
  );
  // 超时必须高于实测最慢（78 分钟冷构建 + 共用机器），否则会被中断在链接阶段。
  assert.ok(
    pipeline.includes('timeout(time: 150'),
    '构建超时上限必须留出冷构建余量',
  );
  for (const diagnostic of ['macOS 发布失败', '被中断']) {
    assert.ok(pipeline.includes(diagnostic), diagnostic);
  }
  assert.ok(
    pipeline.includes('.jenkins-superseded-by'),
    '必须记录被推进的标记供后续阶段判定',
  );
  assert.equal(
    (pipeline.match(/env\.AGC_BUILD_SUPERSEDED != 'true'/gu) ?? []).length,
    3,
    'Toolchain / Package / Archive 三个阶段都必须按跳过标记收口',
  );
  for (const forbidden of [
    'triggers {',
    'cron(',
    'pollSCM(',
    'git clean -fdx',
    // release:upload 会重新触发一次完整构建，既翻倍耗时也绕过本 Job 的验签门禁。
    'release:upload',
  ]) {
    assert.ok(!pipeline.includes(forbidden), forbidden);
  }
 });
 test('macOS release entry verifies the updater signature before uploading', () => {
  const entry = fs.readFileSync(
    new URL('./build-macos-ci.mjs', import.meta.url),
    'utf8',
  );
  const verifyIndex = entry.indexOf('verifyUpdaterSignature({');
  const uploadIndex = entry.indexOf('uploadReleaseArtifacts(release');
  assert.ok(verifyIndex > 0, '必须调用更新包验签');
  assert.ok(uploadIndex > 0, '必须调用 OSS 上传');
  assert.ok(verifyIndex < uploadIndex, '必须先验签再上传，验不过不得写 OSS');
  // 无签名私钥时禁止构建：未签名的更新包会被客户端一律拒绝。
  assert.ok(entry.includes('TAURI_SIGNING_PRIVATE_KEY'));
  // `--no-sign` 会连带跳过 updater 的 minisign 签名，产物将没有 .sig，入口不得传它。
  assert.ok(
    !entry.includes("'--no-sign'"),
    '--no-sign 会同时跳过 updater 签名，产物缺少 .sig',
  );
  // workspace 会跨构建保留产物：必须先删本次要写的对象，否则会因同名 DMG 失败，
  // 或让上一轮遗留的 .sig 让验签门禁误通过。
  for (const required of [
    // 清理对象用派生的产品名算出来，而不是写死某个名字。
    '${updaterArtifactName}.sig',
    '${firstInstallName}.sha256',
    'fs.rmSync(stale, { force: true })',
    "'-ov'",
  ]) {
    assert.ok(entry.includes(required), required);
  }
 });
 test('macOS release entry and smoke script derive product names from config and the bundle', () => {
  const entry = fs.readFileSync(
    new URL('./build-macos-ci.mjs', import.meta.url),
    'utf8',
  );
  // 产品名决定 *.app、updater 归档与 DMG 卷名：写死会在改名后静默找错对象。
  assert.ok(entry.includes('readProductName'), '入口必须从 Tauri 配置读产品名');
  assert.ok(!entry.includes('陶泥儿'), 'macOS 发布入口不得写死产品名');
  assert.ok(
    entry.includes('_${version}_universal.dmg'),
    '首装包名必须保留清单侧唯一匹配所需的后缀',
  );
  const smoke = fs.readFileSync(
    new URL('./check-macos-bundle.mjs', import.meta.url),
    'utf8',
  );
  assert.ok(!smoke.includes('陶泥儿'), '校验脚本不得写死产品名');
  for (const required of [
    'path.basename(source)',
    'Print :CFBundleExecutable',
    "'--clone'",
  ]) {
    assert.ok(smoke.includes(required), required);
  }
 });
@@ -1,95 +0,0 @@
 # 只读取 Windows Installer 已登记的同版本 Node.js 缓存；不执行安装、不访问网络。
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 $expectedVersion = $env:AGC_STAGING_NODE_VERSION
 if ($expectedVersion -notmatch '^\d+\.\d+\.\d+$') { throw 'Invalid Node version' }
 # WinVerifyTrust 强制仅使用本地证书缓存，禁止吊销/证书 URL 网络检索。
 Add-Type -TypeDefinition @'
 using System;
 using System.Runtime.InteropServices;
 public static class AgcOfflineSignature {
    [StructLayout(LayoutKind.Sequential)]
    struct FileInfo { public uint Size; public IntPtr Path; public IntPtr File; public IntPtr Subject; }
    [StructLayout(LayoutKind.Sequential)]
    struct TrustData {
        public uint Size; public IntPtr Policy; public IntPtr Sip; public uint Ui;
        public uint Revocation; public uint Choice; public IntPtr File;
        public uint StateAction; public IntPtr State; public IntPtr Url;
        public uint Flags; public uint Context;
    }
    [DllImport("wintrust.dll", ExactSpelling=true, PreserveSig=true)]
    static extern int WinVerifyTrust(IntPtr window, ref Guid action, ref TrustData data);
    public static bool Verify(string path) {
        IntPtr name = Marshal.StringToCoTaskMemUni(path);
        IntPtr file = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(FileInfo)));
        try {
            var info = new FileInfo { Size=(uint)Marshal.SizeOf(typeof(FileInfo)), Path=name };
            Marshal.StructureToPtr(info, file, false);
            var data = new TrustData { Size=(uint)Marshal.SizeOf(typeof(TrustData)), Ui=2, Choice=1, File=file, Flags=0x1000|0x10 };
            var action = new Guid("00AAC56B-CD44-11d0-8CC2-00C04FC295EE");
            return WinVerifyTrust(new IntPtr(-1), ref action, ref data) == 0;
        } finally { Marshal.FreeHGlobal(file); Marshal.FreeCoTaskMem(name); }
    }
 }
 '@
 function Read-Property($database, [string]$name) {
    $view = $database.OpenView("SELECT ``Value`` FROM ``Property`` WHERE ``Property`` = '$name'")
    try {
        [void]$view.Execute()
        $record = $view.Fetch()
        if ($null -ne $record) { return $record.StringData(1) }
        return ''
    } finally { [void]$view.Close() }
 }
 $installer = New-Object -ComObject WindowsInstaller.Installer
 $cacheRoot = [System.IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath('Windows')) 'Installer'))
 $registrations = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
 )
 $products = Get-ItemProperty $registrations -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -eq 'Node.js' -and $_.DisplayVersion -eq $expectedVersion -and $_.PSChildName -match '^\{[0-9A-Fa-f-]{36}\}$' } |
    Select-Object -ExpandProperty PSChildName -Unique
 foreach ($product in $products) {
    try {
        if ($installer.ProductInfo($product, 'ProductName') -ne 'Node.js') { continue }
        if ($installer.ProductInfo($product, 'VersionString') -ne $expectedVersion) { continue }
        $package = [System.IO.Path]::GetFullPath($installer.ProductInfo($product, 'LocalPackage'))
        if (-not [string]::Equals([System.IO.Path]::GetDirectoryName($package), $cacheRoot, [StringComparison]::OrdinalIgnoreCase)) { continue }
        if ([System.IO.Path]::GetExtension($package) -ne '.msi') { continue }
        $entry = Get-Item -LiteralPath $package -Force
        $cache = Get-Item -LiteralPath $cacheRoot -Force
        if (($entry.Attributes -band [IO.FileAttributes]::ReparsePoint) -or ($cache.Attributes -band [IO.FileAttributes]::ReparsePoint)) { continue }
        if (-not [AgcOfflineSignature]::Verify($package)) { continue }
        $certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new([System.Security.Cryptography.X509Certificates.X509Certificate]::CreateFromSignedFile($package))
        if ($certificate.Subject -notmatch '(^|,\s*)O=OpenJS Foundation(,|$)') { continue }
        $database = $installer.OpenDatabase($package, 0)
        if ((Read-Property $database 'ProductName') -ne 'Node.js') { continue }
        if ((Read-Property $database 'ProductVersion') -ne $expectedVersion) { continue }
        if ((Read-Property $database 'ProductCode') -ne $product) { continue }
        $manufacturer = Read-Property $database 'Manufacturer'
        if ($manufacturer -notin @('Node.js Foundation', 'OpenJS Foundation')) { continue }
        $view = $database.OpenView('SELECT `Text` FROM `Control` WHERE `Dialog_` = ''LicenseAgreementDlg'' AND `Control` = ''LicenseText''')
        try {
            [void]$view.Execute()
            $record = $view.Fetch()
            if ($null -eq $record) { continue }
            $content = $record.StringData(1)
        } finally { [void]$view.Close() }
        if (-not $content.StartsWith('{\rtf') -or $content.Length -gt 1048576) { continue }
        if (-not $content.Contains('Node.js') -or -not $content.Contains('Permission is hereby granted')) { continue }
        [pscustomobject]@{
            productName = 'Node.js'; version = $expectedVersion; manufacturer = $manufacturer
            signatureVerified = $true; signer = 'OpenJS Foundation'; format = 'rtf'; content = $content
        } | ConvertTo-Json -Compress
        exit 0
    } catch {
        # 单个损坏/无权限缓存不能绕过验证；继续查找其它已登记候选。
        continue
    }
 }
 throw 'No matching trusted installed Node.js license'
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kdletters	5ac7f65c92	合并 master 并保留游戏分发功能 - 合并 origin/master（含 `429f991bd` 定向回滚、Godot 原生绑定迁移与策划 Agent 模型控件）。 - 回滚提交删除的游戏分发代码按功能面补回：SpacetimeDB 模块注册与迁移表、api-server 路由与权限映射、后台审核页、AGC 发布命令与 payload 类型、SelectionStage 的 games 阶段、ProjectSupervisorView 的 overlay 挂载点、主站路由与标题、Cargo 依赖与锁、vite/vitest 代理与 tailwind source。 - 保留 master 的 Godot C++ 迁移（移除旧 vendored GDExtension、新的 composer 控件布局）与其它 master 侧改动。 - 修正 master 自带的红灯断言：/api/creation-entry 已被 api-server 列入退役路由，dev 中间件按退役路径 404，测试改为断言不进入代理。 - 验证：cargo check（api-server / spacetime-module / spacetime-client / AGC 壳）、cargo test（api-server 游戏分发 17、module-game-distribution 11、AGC 本地导出 7）、全量 vitest 4557 passed、两端 typecheck、eslint、rustfmt、编码、文档索引与 SpacetimeDB schema guard。	2026-09-21 00:20:45 +08:00
kdletters	2f0e2a48a3	把游戏分发客户端纳入 ESLint 边界 - `.eslintrc.cjs`：`src/services/gameDistributionClient.ts` 及其测试加入活跃服务白名单，不再被遗留忽略列表吞掉。 - 客户端：按仓库规则修掉排序与未使用类型导入（顺带移除两个只在 re-export 中出现的多余导入）。 - 修复 `scripts/vite-retired-css-plugin.test.ts` 的边界门禁：活跃模块不得停留在 ESLint 忽略名单里。	2026-09-20 22:56:43 +08:00
kdletters	00b96f244d	补齐 AGC 素材直传的错误文案与能力作用域验证 - AGC：直传对象存储抛错（能力作用域拒绝、网络不可达、请求被取消）时统一转成中文可操作文案，不再把英文插件错误原样暴露给作者。 - 测试：新增直传抛错的单测，确认失败时不再登记素材。 - 文档：记录用 tauri-plugin-http 同一套 urlpattern 逻辑验证 `https://.aliyuncs.com/` 命中 dev/生产 OSS 桶且拒绝无关主机，并说明桌面端真实执行仍需在装有 AGC 的机器上补跑。	2026-09-20 22:49:56 +08:00
kdletters	0dde6ee501	打磨封面与截图的文件选择交互 - 网页发布页：封面与截图改用透明 input 覆盖自定义胶囊按钮，点击命中原生控件；上传后不再出现「未选择任何文件」与「已选择」互相矛盾的状态。 - AGC 发布面板：同一处理，按钮文案随状态在「选择封面图片 / 更换封面图片」「添加截图 / 截图已满 6 张」之间切换。 - 文档：实施计划补充真实浏览器发布链路证据（网页上传封面 → my-games 待审 → 版本 frozenMetadata 指向本次上传素材）与交互打磨记录。	2026-09-20 22:45:50 +08:00
kdletters	4a91e5865a	创建游戏同步校验封面与截图素材归属 - 服务端：抽出 `resolve_owned_game_media`，创建游戏与创建版本复用同一素材校验；不存在的素材返回 400，借用他人素材返回 403，避免游戏行先落一个无效素材 ID。 - 脚本：新增 `npm run check:game-distribution-media-e2e`（`scripts/check-game-distribution-media-e2e.mjs`），在本地 dev 栈上跑真实素材直传、冻结、审核生效、匿名换签读与发行网关的可重复检查。 - 文档：后端数据契约补充创建游戏的素材复核口径，实施计划记录真实本地栈 27 项媒体验证与真实浏览器封面/截图展示证据。	2026-09-20 22:34:33 +08:00
kdletters	4a2b270714	补齐游戏分发封面与截图的冻结、上传与展示 - 服务端：游戏表追加可空 cover_object_key / screenshots_json，版本表追加可空 metadata_json，创建版本时校验必需封面、最多 6 张截图与图片素材归属，并从素材记录派生对象键生成冻结资料。 - 服务端：审核通过时把冻结资料整体生效到游戏行；只有已公开且存在有效活动版本的游戏，其封面/截图素材才在 /api/assets/read-url 获得匿名读授权。 - 服务端：作者与管理员回读版本时追加 frozenMetadata，带回封面与截图素材 ID 供续发复用，公开投影仍只暴露对象键。 - 网页：/games/publish 新增「封面与截图」区，复用平台图片直传与 confirm 通道，缺封面或截图超量在发请求前拦截，更新版本时按冻结资料回填且不要求重新上传。 - 网页：游戏广场卡片与详情页 hero 换签展示真实封面，详情页新增可点击的截图缩略图条，无素材或换签失败时静默回退原有渐变占位。 - AGC：发布面板支持封面必选与截图最多 6 张，新增素材直传服务并在创建游戏前拦截缺封面，同一文件重复提交复用素材 ID。 - AGC：http 能力作用域新增阿里云 OSS 直传地址，客户端同时校验直传目标必须是平台素材存储。 - 契约与文档：同步 shared-contracts、packages/shared 契约，更新 SpacetimeDB 迁移注释、后端架构、玩法链路与实施计划文档，并补齐网页端与 AGC 定向测试。	2026-09-20 22:19:50 +08:00
kdletters	789aef4ce5	补齐游戏分发结构化可观测事件 - api-server 游戏分发模块新增 package_confirmed/package_rejected/version_submitted/version_cancelled 事件，带 request_id、game_id、version_id、耗时与体积/文件数（不记录凭据、URL 与文件内容） - 新增 review_backlog_listed（审核积压）、review_decided（审核结论与公开修订号）、game_unpublished/game_suspended（撤销传播）与 publish_switch_blocked/unavailable（开关拦截）事件 - 发行网关拒绝路径补 debug 级 release_rejected（cookie、扩展名、未公开、非公开版本）便于排查发行 4xx - 运维文档给出可直接 grep 的事件名与关键字段，实施计划记录真实栈复跑证据	2026-09-20 21:30:32 +08:00
kdletters	7ff6e46774	修复分支上的格式与导入排序门禁问题 - 用 rustfmt 修正 AGC Tauri 导出包测试的断言排版 - 按 simple-import-sort 修正 AGC App.tsx 导入顺序与 packages/shared 导出顺序	2026-09-20 21:17:27 +08:00
kdletters	2254831db5	补充游戏内真实触屏输入的运行时证据 - 用 CDP Input.dispatchTouchEvent 向游玩页 iframe 派发真实 touchStart/touchEnd，沙箱内探测包收到 touchstart/touchend/pointerdown(pointerType=touch)/click 并命中目标元素 - 记录触摸模拟必须在 iframe 文档创建前启用的踩坑口径	2026-09-20 21:11:37 +08:00
kdletters	64425e8d1a	Merge commit 'a2acfa9a6' into codex/game-distribution	2026-09-20 20:59:58 +08:00
kdletters	328ac31844	恢复游戏分发完整实现（特性分支） - 主站：游戏广场、详情、在线游玩、网页发布与作者中心，以及共享契约与客户端服务 - 后端：module-game-distribution 领域层、SpacetimeDB 表/迁移/绑定、spacetime-client facade、api-server 路由与发行网关 - 后台：游戏审核页（待审列表、通过/拒绝、安全下架） - AGC：发布面板、本地导出包读取命令与发布服务，含默认跳过的真实链路测试 - 运维：发行来源 nginx 模板与门禁、game-distribution:publish 灰度发布开关、OSS PutObject 受控重试 - 文档：主规范、里程碑与实施计划、决策日志与踩坑记录	2026-09-20 20:49:42 +08:00