补充Mac Jenkins节点工具链路径

为LaunchAgent构建环境注入Node、npm、Cargo和Homebrew路径

.gitignore

@@ -47,6 +47,8 @@ temp*build*/
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/codex-package.json
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/manifest.json
 /apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/NOTICE.md
+/apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/darwin-arm64/
+/apps/ai-game-creator-shell/src-tauri/resources/codex/mac-native/darwin-x64/
 /plugins/agc-cocos-editor/native/payload/
 /apps/ai-game-creator-shell/logs/
 /apps/ai-game-creator-shell/.llm-drafts/

apps/ai-game-creator-shell/scripts/agent-swarm-test-chat.mjs

@@ -957,6 +957,9 @@ async function runInteractiveCargo(cliArguments, setActiveChild) {
   return result;
 }
 
+// 立项策划跑 standard 档，`agent.delegate` 这类动作按项目权限策略必须逐个确认，
+// 而确认和问询都只从 CLI 的 stdin 读。自主构建档没有这一步，所以只有 --plan 需要
+// 一个把「人坐在终端前敲 approve」自动化掉的应答器；判据本身仍然走后端确认命令。
 const swarmConfirmationPromptPattern = /输入 approve 或 reject：$/u;
 const swarmUserInputPromptPattern = /请选择 1-\d+，或直接输入其他答案：$/u;
 

apps/ai-game-creator-shell/scripts/build-macos-ci.mjs

@@ -0,0 +1,113 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { resolveReleaseContext, runTauriBuild } from './build-release.mjs';
+
+const appRoot = fileURLToPath(new URL('..', import.meta.url));
+const repoRoot = path.resolve(appRoot, '../..');
+assert.equal(process.platform, 'darwin', '只能在 macOS Agent 执行');
+assert.equal(
+  process.env.JENKINS_URL?.length > 0,
+  true,
+  '此入口仅用于 Jenkins 独立工作区',
+);
+assert.equal(
+  fs.realpathSync(process.env.WORKSPACE || '.'),
+  fs.realpathSync(repoRoot),
+  '必须在 Jenkins workspace 根目录执行',
+);
+const space = fs.statfsSync(repoRoot);
+assert.ok(
+  space.bavail * space.bsize >= 8 * 1024 ** 3,
+  '构建前至少需要 8 GiB 可用空间；禁止自动清理开发缓存',
+);
+
+// 本入口永不发布，不使用 Agent 用户可能持有的发布或 Apple 认证环境。
+for (const key of Object.keys(process.env)) {
+  if (/^(TAURI_SIGNING_|APPLE_|AGC_OSS_)/u.test(key)) delete process.env[key];
+}
+process.env.RUSTC_WRAPPER = '';
+process.env.CARGO_TARGET_DIR = path.join(appRoot, 'src-tauri/target');
+const context = resolveReleaseContext(['--target=universal-apple-darwin']);
+const args = [
+  '--target=universal-apple-darwin',
+  '--bundles',
+  'app',
+  '--ci',
+  '--no-sign',
+  '--config',
+  '{"bundle":{"createUpdaterArtifacts":false}}',
+];
+const command = (binary, argv, options = {}) =>
+  execFileSync(binary, argv, { cwd: repoRoot, stdio: 'inherit', ...options });
+runTauriBuild(args, context);
+const app = path.join(context.bundleRoot, 'macos/陶泥儿.app');
+for (const architecture of ['arm64', 'x86_64']) {
+  command(process.execPath, [
+    path.join(appRoot, 'scripts/check-macos-bundle.mjs'),
+    app,
+    architecture,
+    '--universal',
+  ]);
+}
+const version = JSON.parse(
+  fs.readFileSync(path.join(appRoot, 'package.json'), 'utf8'),
+).version;
+assert.match(version, /^\d+\.\d+\.\d+$/u);
+const artifacts = path.join(repoRoot, 'artifacts');
+// 只清理本 Job 的归档输出，不能把上次 DMG 当成本次成功产物。
+fs.rmSync(artifacts, { recursive: true, force: true });
+fs.mkdirSync(artifacts, { recursive: true });
+const dmg = path.join(artifacts, `陶泥儿_${version}_universal.dmg`);
+const stage = fs.mkdtempSync(path.join(os.tmpdir(), 'agc-ci-dmg-'));
+try {
+  command('ditto', [app, path.join(stage, '陶泥儿.app')]);
+  fs.symlinkSync('/Applications', path.join(stage, 'Applications'));
+  command('hdiutil', [
+    'create',
+    '-volname',
+    '陶泥儿',
+    '-srcfolder',
+    stage,
+    '-format',
+    'UDZO',
+    dmg,
+  ]);
+  command('hdiutil', ['verify', dmg]);
+} finally {
+  fs.rmSync(stage, { recursive: true, force: true });
+}
+const hash = createHash('sha256');
+for await (const chunk of fs.createReadStream(dmg)) hash.update(chunk);
+fs.writeFileSync(
+  `${dmg}.sha256`,
+  `${hash.digest('hex')}  ${path.basename(dmg)}\n`,
+);
+const commit = execFileSync('git', ['rev-parse', 'HEAD'], {
+  cwd: repoRoot,
+  encoding: 'utf8',
+}).trim();
+fs.writeFileSync(
+  path.join(artifacts, 'build-manifest.json'),
+  `${JSON.stringify(
+    {
+      version,
+      commit,
+      target: context.target,
+      channel: context.channel,
+      signed: false,
+      notarized: false,
+      uploaded: false,
+      smoke: ['arm64', 'x86_64'],
+      intelSmoke: process.arch === 'arm64' ? 'Rosetta' : 'native',
+    },
+    null,
+    2,
+  )}\n`,
+);
+console.log('[macOS CI] universal 包与校验文件已生成；未发布、未签名或公证');

apps/ai-game-creator-shell/scripts/build-release.mjs

@@ -42,16 +42,12 @@ function explicitBuildTarget(args) {
 }
 
 function validateReleaseTarget(target) {
-  if (target === 'universal-apple-darwin') {
-    throw new Error(
-      '内置 Codex 资源仅支持 macOS 单架构构建，请使用 aarch64-apple-darwin 或 x86_64-apple-darwin',
-    );
-  }
   if (
     ![
       'x86_64-pc-windows-msvc',
       'aarch64-apple-darwin',
       'x86_64-apple-darwin',
+      'universal-apple-darwin',
     ].includes(target)
   ) {
     throw new Error(`不支持的发布目标：${target}`);
@@ -197,10 +193,12 @@ export function updateManifestUrl(channel = resolveReleaseChannel()) {
 }
 
 /**
- * 单架构产物只登记实际目标，不能把同一原生资源映射为另一架构。
+ * universal 主程序与双目录原生资源共用一个更新包；单架构只登记实际目标。
  */
 export function resolveManifestPlatformKeys(target = defaultTarget()) {
   validateReleaseTarget(target);
+  if (target === 'universal-apple-darwin')
+    return ['darwin-aarch64', 'darwin-x86_64'];
   if (target === 'aarch64-apple-darwin') return ['darwin-aarch64'];
   if (target === 'x86_64-apple-darwin') return ['darwin-x86_64'];
   if (target.includes('windows')) {

apps/ai-game-creator-shell/scripts/build-release.test.mjs

@@ -39,13 +39,12 @@ import {
 const windowsTarget = 'x86_64-pc-windows-msvc';
 const universalTarget = 'universal-apple-darwin';
 
-test('native sidecar builds reject universal targets and accept each macOS architecture', () => {
-  assert.throws(() => buildTauriBuildArguments([], universalTarget), /单架构/);
-  assert.throws(
-    () => buildTauriBuildArguments(['--target=universal-apple-darwin']),
-    /单架构/,
-  );
-  for (const target of ['aarch64-apple-darwin', 'x86_64-apple-darwin']) {
+test('native sidecar builds accept universal and each macOS architecture', () => {
+  for (const target of [
+    universalTarget,
+    'aarch64-apple-darwin',
+    'x86_64-apple-darwin',
+  ]) {
     assert.deepEqual(buildTauriBuildArguments([], target), [
       'build',
       '--target',
@@ -152,8 +151,11 @@ test('channel manifest URL and build-time endpoint follow the channel', () => {
   });
 });
 
-test('macOS manifests only advertise the architecture actually built', () => {
-  assert.throws(() => resolveManifestPlatformKeys(universalTarget), /单架构/);
+test('macOS manifests advertise exactly the architectures actually built', () => {
+  assert.deepEqual(resolveManifestPlatformKeys(universalTarget), [
+    'darwin-aarch64',
+    'darwin-x86_64',
+  ]);
   assert.deepEqual(resolveManifestPlatformKeys('aarch64-apple-darwin'), [
     'darwin-aarch64',
   ]);
@@ -197,7 +199,6 @@ test('release context resolves explicit targets before environment/default and f
     ['--target='],
     ['--target', '--no-bundle'],
     ['--target', windowsTarget, '--target=aarch64-apple-darwin'],
-    ['--target', universalTarget],
     ['--target', 'unknown'],
   ])
     assert.throws(() => resolveReleaseContext(args, {}));
@@ -314,8 +315,8 @@ test('invalid target or mismatched channel fails before any release side effect'
     },
   };
   await assert.rejects(
-    () => buildRelease(['--target', universalTarget], sideEffects),
-    /单架构/,
+    () => buildRelease(['--target', 'unknown'], sideEffects),
+    /不支持的发布目标/,
   );
   await withEnv({ AGC_UPDATE_CHANNEL: 'dev-win' }, () =>
     assert.rejects(
@@ -326,6 +327,26 @@ test('invalid target or mismatched channel fails before any release side effect'
   assert.equal(touched, false);
 });
 
+test('universal uses the Mac channel and the same signed artifact for both architectures', () => {
+  const context = resolveReleaseContext(['--target', universalTarget], {
+    AGC_BUILD_TARGET: windowsTarget,
+  });
+  assert.equal(context.channel, 'dev-mac');
+  assert.ok(context.bundleRoot.includes(universalTarget));
+  withSignedArtifact('陶泥儿.app.tar.gz', (artifact) => {
+    const manifest = createUpdateManifest(artifact, context);
+    assert.deepEqual(Object.keys(manifest.platforms), [
+      'darwin-aarch64',
+      'darwin-x86_64',
+    ]);
+    assert.deepEqual(
+      manifest.platforms['darwin-aarch64'],
+      manifest.platforms['darwin-x86_64'],
+    );
+    assert.match(manifest.platforms['darwin-aarch64'].url, /\/dev-mac\//);
+  });
+});
+
 test('Windows remains the default and explicit Windows overrides macOS environment', () => {
   const files = ['/tmp/mac.app.tar.gz', '/tmp/windows.exe', '/tmp/mac.dmg'];
   for (const context of [

apps/ai-game-creator-shell/scripts/check-config.mjs

@@ -1367,18 +1367,20 @@ if (windowsTauriConfig.bundle?.useLocalToolsDir !== true) {
 assert.deepEqual(
   macosTauriConfig.bundle?.resources,
   Object.fromEntries([
-    ...[
-      'bin/codex',
-      'bin/codex-code-mode-host',
-      'codex-path/rg',
-      'codex-resources/zsh/bin/zsh',
-      'codex-package.json',
-      'NOTICE.md',
-      'manifest.json',
-    ].map((file) => [
-      `resources/codex/mac-native/${file}`,
-      `coding-agent/mac-native/${file}`,
-    ]),
+    ...['darwin-arm64', 'darwin-x64'].flatMap((arch) =>
+      [
+        'bin/codex',
+        'bin/codex-code-mode-host',
+        'codex-path/rg',
+        'codex-resources/zsh/bin/zsh',
+        'codex-package.json',
+        'NOTICE.md',
+        'manifest.json',
+      ].map((file) => [
+        `resources/codex/mac-native/${arch}/${file}`,
+        `coding-agent/mac-native/${arch}/${file}`,
+      ]),
+    ),
     ['resources/plugins', 'plugins'],
   ]),
   'macOS must bundle the complete native Codex layout and plugin workspace',
@@ -1590,11 +1592,13 @@ if (!viteConfigSource.includes('allow: [repoRoot]')) {
   );
 }
 
-if (!(
-  tauriConfig.build?.beforeDevCommand?.includes(
-    'run ai-game-creator-shell:dev-server',
-  ) || tauriConfig.build?.beforeDevCommand?.includes('run agc:serve')
-)) {
+if (
+  !(
+    tauriConfig.build?.beforeDevCommand?.includes(
+      'run ai-game-creator-shell:dev-server',
+    ) || tauriConfig.build?.beforeDevCommand?.includes('run agc:serve')
+  )
+) {
   throw new Error(
     'AI game creator shell beforeDevCommand must start the selected Vite dev server',
   );

apps/ai-game-creator-shell/scripts/check-macos-bundle.mjs

@@ -8,6 +8,13 @@ import path from 'node:path';
 // 只操作临时复制品；不启动 GUI、不读取开发机凭据、不访问 Provider。
 assert.equal(process.platform, 'darwin', '此验证必须在 macOS 执行');
 const source = path.resolve(process.argv[2] || '');
+const architecture =
+  process.argv[3] || (process.arch === 'arm64' ? 'arm64' : 'x86_64');
+assert.ok(
+  ['arm64', 'x86_64'].includes(architecture),
+  '架构只接受 arm64 / x86_64',
+);
+const requireUniversal = process.argv.includes('--universal');
 assert.ok(
   source.endsWith('.app') && fs.statSync(source).isDirectory(),
   '请传入 .app 绝对路径',
@@ -31,13 +38,19 @@ const env = {
 };
 
 function run(command, args) {
-  const result = spawnSync(command, args, {
-    cwd: root,
-    env,
-    encoding: 'utf8',
-    timeout: 30_000,
-    maxBuffer: 1024 * 1024,
-  });
+  // 只强制被测应用切片；本机 Xcode 检查工具可能仅提供宿主架构。
+  const useSlice = command.startsWith(`${app}${path.sep}`);
+  const result = spawnSync(
+    useSlice ? '/usr/bin/arch' : command,
+    useSlice ? [`-${architecture}`, command, ...args] : args,
+    {
+      cwd: root,
+      env,
+      encoding: 'utf8',
+      timeout: 120_000,
+      maxBuffer: 1024 * 1024,
+    },
+  );
   assert.ifError(result.error);
   return result;
 }
@@ -60,7 +73,7 @@ async function handshake(executable) {
     await new Promise((resolve, reject) => {
       const timer = setTimeout(
         () => reject(new Error('app-server 初始化超时')),
-        15_000,
+        120_000,
       );
       const finish = (error) => {
         clearTimeout(timer);
@@ -129,20 +142,39 @@ async function handshake(executable) {
 try {
   fs.cpSync(source, app, { recursive: true });
   const resources = path.join(app, 'Contents/Resources');
-  const bundle = path.join(resources, 'coding-agent/mac-native');
+  const platform = architecture === 'arm64' ? 'darwin-arm64' : 'darwin-x64';
+  const bundle = path.join(resources, 'coding-agent/mac-native', platform);
   const executable = path.join(bundle, 'bin/codex');
   const main = path.join(
     app,
     'Contents/MacOS/genarrative-ai-game-creator-shell',
   );
+  const mainArchitectures = run('/usr/bin/lipo', ['-archs', main]);
+  assert.equal(mainArchitectures.status, 0);
+  assert.ok(mainArchitectures.stdout.split(/\s+/).includes(architecture));
+  if (requireUniversal) {
+    assert.deepEqual(mainArchitectures.stdout.trim().split(/\s+/).sort(), [
+      'arm64',
+      'x86_64',
+    ]);
+    for (const platform of ['darwin-arm64', 'darwin-x64']) {
+      assert.ok(
+        fs.existsSync(
+          path.join(
+            resources,
+            'coding-agent/mac-native',
+            platform,
+            'manifest.json',
+          ),
+        ),
+      );
+    }
+  }
   const manifest = JSON.parse(
     fs.readFileSync(path.join(bundle, 'manifest.json'), 'utf8'),
   );
   assert.equal(manifest.schemaVersion, 'genarrative-codex-sidecar.v2');
-  assert.equal(
-    manifest.platform,
-    process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64',
-  );
+  assert.equal(manifest.platform, platform);
   assert.equal(manifest.version, 'codex-cli 0.147.0');
   const components = [
     'bin/codex',
@@ -159,11 +191,7 @@ try {
       fs.accessSync(file, fs.constants.X_OK);
       const arch = run('/usr/bin/lipo', ['-archs', file]);
       assert.equal(arch.status, 0, component);
-      assert.equal(
-        arch.stdout.trim(),
-        process.arch === 'arm64' ? 'arm64' : 'x86_64',
-        component,
-      );
+      assert.equal(arch.stdout.trim(), architecture, component);
     }
   }
   assert.ok(fs.existsSync(path.join(bundle, 'NOTICE.md')));
@@ -212,7 +240,7 @@ try {
   assert.notEqual(broken.status, 0);
   assert.match(`${broken.stdout}\n${broken.stderr}`, /Codex CLI 未安装/);
   console.log(
-    'PASS: 隔离安装包资源、架构、摘要、权限、正式 Codex 查找、app-server 握手及缺组件拒绝',
+    `PASS (${architecture}): 隔离安装包资源、架构、摘要、权限、正式 Codex 查找、app-server 握手及缺组件拒绝`,
   );
   console.log(
     '未验证：GUI、真实登录/Provider 对话、Cocos macOS 原生桥接；插件 Node 仍为外部前提',

apps/ai-game-creator-shell/scripts/prepare-macos-codex.mjs

@@ -0,0 +1,134 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const appRoot = fileURLToPath(new URL('..', import.meta.url));
+const repoRoot = path.resolve(appRoot, '../..');
+const platforms = {
+  arm64: 'aarch64-apple-darwin',
+  x64: 'x86_64-apple-darwin',
+};
+
+export function lockedMacPackage(lock, arch, version) {
+  assert.ok(Object.hasOwn(platforms, arch), '未知 macOS 架构');
+  const alias = `@openai/codex-darwin-${arch}`;
+  const entry = lock.packages?.[`node_modules/${alias}`];
+  assert.equal(
+    entry?.version,
+    `${version}-darwin-${arch}`,
+    '原生依赖必须与应用锁定版本一致',
+  );
+  assert.deepEqual(entry.os, ['darwin']);
+  assert.deepEqual(entry.cpu, [arch]);
+  const url = new URL(entry.resolved);
+  assert.equal(url.protocol, 'https:');
+  assert.equal(
+    url.hostname,
+    'registry.npmjs.org',
+    '只下载锁定的官方 npm 原生包',
+  );
+  assert.equal(url.username + url.password + url.search + url.hash, '');
+  assert.match(entry.integrity, /^sha512-[A-Za-z0-9+/]+={0,2}$/);
+  return { alias, target: platforms[arch], ...entry };
+}
+
+export function verifyPackageIntegrity(bytes, expected) {
+  const actual = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+  assert.equal(actual, expected, 'Codex 下载包 lockfile integrity 不匹配');
+}
+
+export function validateArchiveListing(listing) {
+  const files = listing.trim().split(/\r?\n/u);
+  assert.ok(files.length > 0);
+  for (const file of files) {
+    assert.ok(file.startsWith('package/'), '原生包必须只有 package 根目录');
+    assert.ok(
+      !file.split('/').includes('..') && !file.includes('\\'),
+      '压缩包路径不安全',
+    );
+  }
+}
+
+export async function prepareMacosCodex() {
+  assert.equal(process.platform, 'darwin', '该入口仅用于 macOS 构建机');
+  const lock = JSON.parse(
+    fs.readFileSync(path.join(repoRoot, 'package-lock.json'), 'utf8'),
+  );
+  const app = JSON.parse(
+    fs.readFileSync(path.join(appRoot, 'package.json'), 'utf8'),
+  );
+  const version = app.devDependencies['@openai/codex'];
+  assert.match(version, /^\d+\.\d+\.\d+$/u, 'Codex 必须锁定精确版本');
+  const cache = path.join(appRoot, 'src-tauri/target/.macos-native-cache');
+  fs.mkdirSync(cache, { recursive: true });
+  for (const arch of Object.keys(platforms)) {
+    const entry = lockedMacPackage(lock, arch, version);
+    const archive = path.join(cache, `codex-${entry.version}.tgz`);
+    if (!fs.existsSync(archive)) {
+      const response = await fetch(entry.resolved, {
+        signal: AbortSignal.timeout(300_000),
+      });
+      assert.ok(response.ok, `原生包下载失败 HTTP ${response.status}`);
+      const bytes = Buffer.from(await response.arrayBuffer());
+      verifyPackageIntegrity(bytes, entry.integrity);
+      const partial = `${archive}.${process.pid}.tmp`;
+      fs.writeFileSync(partial, bytes);
+      fs.renameSync(partial, archive);
+    }
+    verifyPackageIntegrity(fs.readFileSync(archive), entry.integrity);
+    validateArchiveListing(
+      execFileSync('tar', ['-tzf', archive], { encoding: 'utf8' }),
+    );
+    // 拒绝链接、设备及其它特殊条目，不能让 tar 在包目录之外写入。
+    const entries = execFileSync('tar', ['-tvzf', archive], {
+      encoding: 'utf8',
+    });
+    assert.ok(
+      entries
+        .trim()
+        .split(/\r?\n/u)
+        .every((line) => /^[-d]/u.test(line)),
+      '原生包禁止链接或特殊文件',
+    );
+    const parent = path.join(repoRoot, 'node_modules/@openai');
+    fs.mkdirSync(parent, { recursive: true });
+    const stage = fs.mkdtempSync(path.join(parent, '.mac-native-'));
+    try {
+      execFileSync(
+        'tar',
+        ['-xzf', archive, '-C', stage, '--strip-components=1'],
+        { stdio: 'pipe' },
+      );
+      const metadata = JSON.parse(
+        fs.readFileSync(
+          path.join(stage, 'vendor', entry.target, 'codex-package.json'),
+          'utf8',
+        ),
+      );
+      assert.equal(metadata.version, version);
+      assert.equal(metadata.target, entry.target);
+      assert.equal(metadata.entrypoint, 'bin/codex');
+      const destination = path.join(repoRoot, 'node_modules', entry.alias);
+      assert.ok(
+        !fs.existsSync(destination) ||
+          !fs.lstatSync(destination).isSymbolicLink(),
+        '拒绝覆盖链接依赖',
+      );
+      fs.rmSync(destination, { recursive: true, force: true });
+      fs.renameSync(stage, destination);
+    } finally {
+      fs.rmSync(stage, { recursive: true, force: true });
+    }
+    console.log(`[macOS Codex] ${entry.version}: lockfile integrity 已验证`);
+  }
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  await prepareMacosCodex();
+}

apps/ai-game-creator-shell/scripts/prepare-macos-codex.test.mjs

@@ -0,0 +1,85 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import { test } from 'node:test';
+
+import {
+  lockedMacPackage,
+  validateArchiveListing,
+  verifyPackageIntegrity,
+} from './prepare-macos-codex.mjs';
+
+const lock = JSON.parse(
+  fs.readFileSync(new URL('../../../package-lock.json', import.meta.url)),
+);
+const version = JSON.parse(
+  fs.readFileSync(new URL('../package.json', import.meta.url)),
+).devDependencies['@openai/codex'];
+
+test('both macOS dependencies resolve from the lockfile without floating versions', () => {
+  assert.equal(
+    lockedMacPackage(lock, 'arm64', version).target,
+    'aarch64-apple-darwin',
+  );
+  assert.equal(
+    lockedMacPackage(lock, 'x64', version).target,
+    'x86_64-apple-darwin',
+  );
+  assert.throws(() => lockedMacPackage(lock, 'other', version));
+  assert.throws(() => lockedMacPackage(lock, 'x64', '0.0.0'));
+});
+
+test('native package integrity rejects tampering', () => {
+  const bytes = Buffer.from('pinned package');
+  const integrity = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+  verifyPackageIntegrity(bytes, integrity);
+  assert.throws(() =>
+    verifyPackageIntegrity(Buffer.from('modified'), integrity),
+  );
+});
+
+test('archive traversal and non-package entries fail closed', () => {
+  validateArchiveListing(
+    'package/package.json\npackage/vendor/target/bin/codex\n',
+  );
+  for (const listing of [
+    '',
+    '/tmp/payload',
+    'package/../private',
+    'other/file',
+    'package/..\\file',
+  ]) {
+    assert.throws(() => validateArchiveListing(listing));
+  }
+});
+
+test('CI pipeline is manual archive-only and does not reuse a developer workspace', () => {
+  const pipeline = fs.readFileSync(
+    new URL(
+      '../../../jenkins/Jenkinsfile.ai-game-creator-shell-macos-build',
+      import.meta.url,
+    ),
+    'utf8',
+  );
+  for (const required of [
+    'genarrative-agc-macos',
+    'disableConcurrentBuilds()',
+    '$AGC_AGENT_ROOT',
+    'StrictHostKeyChecking=yes',
+    'git merge-base --is-ancestor',
+    'allowEmptyArchive: false',
+  ]) {
+    assert.ok(pipeline.includes(required), required);
+  }
+  for (const forbidden of [
+    'triggers {',
+    'cron(',
+    'pollSCM(',
+    'release:upload',
+    'AgcUpdaterSigningKey',
+    'AliyunAccessKeyId',
+    'git clean -fdx',
+  ]) {
+    assert.ok(!pipeline.includes(forbidden), forbidden);
+  }
+});

apps/ai-game-creator-shell/scripts/start-dev-stack.mjs

@@ -1192,7 +1192,7 @@ async function main() {
 function isDirectModuleExecution() {
   return Boolean(
     process.argv[1] &&
-    resolve(process.argv[1]) === fileURLToPath(import.meta.url),
+      resolve(process.argv[1]) === fileURLToPath(import.meta.url),
   );
 }
 

apps/ai-game-creator-shell/src-tauri/build.rs

@@ -31,7 +31,23 @@ fn sha256_file(path: &std::path::Path) -> Result<String, std::io::Error> {
 fn stage_bundled_codex_cli(manifest_dir: &std::path::Path) {
     let target = env::var("TARGET").expect("Cargo TARGET");
     println!("cargo:rustc-env=AGC_BUILD_TARGET={target}");
-    let Some(layout) = codex_bundle::for_target(&target) else {
+    if target.contains("apple-darwin") {
+        // Tauri 的 universal 两次 Cargo 编译共用 resource staging，
+        // 每次都生成完整双架构目录，最终 bundle 不取决于最后编译的切片。
+        let staging = manifest_dir.join("resources/codex/mac-native");
+        if staging.exists() {
+            fs::remove_dir_all(&staging).expect("清理 macOS Codex staging 失败");
+        }
+        for target in ["aarch64-apple-darwin", "x86_64-apple-darwin"] {
+            stage_codex_target(manifest_dir, target);
+        }
+    } else {
+        stage_codex_target(manifest_dir, &target);
+    }
+}
+
+fn stage_codex_target(manifest_dir: &std::path::Path, target: &str) {
+    let Some(layout) = codex_bundle::for_target(target) else {
         assert!(
             !target.contains("windows") && !target.contains("apple-darwin"),
             "不支持的 Codex 随包目标：{target}"
@@ -81,7 +97,7 @@ fn stage_bundled_codex_cli(manifest_dir: &std::path::Path) {
             &fs::read(source.join("codex-package.json")).expect("读取 Codex 原生包元数据失败"),
         )
         .expect("Codex 原生包元数据无效");
-        codex_bundle::validate_package_metadata(&metadata, &target, layout)
+        codex_bundle::validate_package_metadata(&metadata, target, layout)
             .unwrap_or_else(|error| panic!("{error}"));
         let target_dir = manifest_dir.join("resources/codex").join(layout.directory);
         let notice = target_dir.join("NOTICE.md");

apps/ai-game-creator-shell/src-tauri/build_support/codex_bundle.rs

@@ -49,7 +49,11 @@ pub fn for_target(target: &str) -> Option<Layout> {
             } else {
                 "codex-darwin-x64"
             },
-            directory: "mac-native",
+            directory: if target.starts_with("aarch64") {
+                "mac-native/darwin-arm64"
+            } else {
+                "mac-native/darwin-x64"
+            },
             executable: "bin/codex",
             files: MAC_FILES,
         }),
@@ -90,6 +94,9 @@ mod tests {
         let intel = for_target("x86_64-apple-darwin").unwrap();
         assert_eq!(intel.platform, "darwin-x64");
         assert_eq!(intel.npm_package, "codex-darwin-x64");
+        assert_eq!(mac.directory, "mac-native/darwin-arm64");
+        assert_eq!(intel.directory, "mac-native/darwin-x64");
+        assert_ne!(mac.directory, intel.directory);
         let windows = for_target("x86_64-pc-windows-msvc").unwrap();
         assert_eq!(windows.directory, "win-x64");
         assert_eq!(windows.files.len(), 6);

apps/ai-game-creator-shell/src-tauri/prompts/runtime/supervisor/playbook.md

@@ -2,4 +2,8 @@
 
 需要等待专业 Agent 时不得调用 respond_to_user；Runtime 会通过 delegate/all-join 完成屏障保持同一父 run，取得 readyDelegateReceipts 或 readyIsolatedJoins 后直接整合结果。readyDelegateReceipts 中 contractStatus=evidence-ready 只说明终态、产物和验证等客观证据齐全，你仍须按 acceptanceCriteria 判断语义是否满足；needs-repair 不得当作成功。contractStatus=needs-user-input 时，Runtime 会按原 delivery 逐一发起 user.input_request；每个请求答案收齐后，为对应原 delivery 仅创建一次 continuation 委派，repairOfDelegationId 与 continuationOfDelegationId 都指向该原 delivery，并提交 observation 给出的 questionsSha256、answersSha256；Runtime 自动派生稳定 continuation identity，禁止跨 delivery 混用指纹。客观或语义不满足时可以发起一次新 agent.delegate，并把 repairOfDelegationId 指向已认领原 delivery；不得对返工再返工或为同一原 delivery 创建第二个返工。专业结果冲突且无法依据用户目标裁决时，合并问题后用一次 user.input_request 询问用户。只有实现路径、产品取舍或缺失事实会实质改变结果时才调用 user.input_request；项目内可读取事实、权限确认和工具失败不得伪装成用户问题。
 
+委派 `project-planning` 时，acceptanceCriteria 只写产物形状、覆盖范围与红线（例如必须交付 `game/fast_gdd.md`、必须原创、必须只定义一个 MVP 闭环），**不得替用户预先裁定产品取舍**。用户没有指定的玩法规则、数值、关卡量级、美术方向和目标人群，一律留给策划子 Agent 按其 3 轮问询预算决定是提问还是按默认建议填写；不要写“未指定的标注为立项假设”“自行假设后继续”这类指令，那会把问询预算作废。平台事实（自包含 Web、desktop/mobile 双视口、keyboard/touch 双输入、本地 HTTP 预览）由 Runtime 固定注入，属于已定事实，不得要求标为待定、建议或开放项。
+
+对 `project-planning` 的澄清 continuation，必须按 A/B/“需要原型验证”三项合同原样转述；B 是用户确认的 `confirmed/user_option`，不能转成默认建议。若用户后续自由填写推翻已确认决定，保留用户答案原文逐字不改写、不拆分、不搬轮次，并在被推翻决定后注明“已被第 N 轮回答推翻，以后者为准”，在新决定 topic 中写明推翻关系。
+
 只在所有必要回执已认领、manifest 正式任务图已经完成、所有必要返工也已认领、项目副作用已验证且没有待确认动作或待回答请求时给用户最终回复。不要向用户暴露内部 task/event、工具计划、动态 child ID 或调试状态。

apps/ai-game-creator-shell/src-tauri/src/agent/design_runtime.rs

@@ -1069,10 +1069,15 @@ pub(crate) async fn continue_design_agent_at(
         .ok_or("策划 Agent 当前正在工作")?;
     let mut session = match read_design_session(root)? {
         Some(session) => session,
-        None => new_design_session(
-            &project_id,
-            &load_game_creator_app_config()?.selected_model_id,
-        ),
+        None => {
+            if read_planning_session_v2(root)?.is_some() {
+                return Err("此项目包含旧策划会话，请查看原有记录或在新项目开始五阶段策划".into());
+            }
+            new_design_session(
+                &project_id,
+                &load_game_creator_app_config()?.selected_model_id,
+            )
+        }
     };
     if session.project_id != project_id {
         return Err("策划会话与当前项目不匹配".into());

apps/ai-game-creator-shell/src-tauri/src/agent/runtime_actions/action_execution.rs

@@ -549,7 +549,7 @@ fn append_agent_runtime_file_read_evidence_ref(
     // 给的是**整个三元组**，不是一个碎片。`agent.acceptance_update` 的 evidence 引用
     // 要求 {agentId, runId, actionId} 三个字段，回执查找也按三元组整体做 key。早期
     // 只给 actionId，另外两个靠模型回忆——实测它第一次就把其中一个记错，白吃一次
-    // 拒绝。验收证据只接受当前根 run 的回执，
+    // 拒绝。反正 `validate_fast_gdd_evidence_identity` 只接受当前根 run 的回执，
     // 合法取值唯一，本来就不该让它猜。
     observation.summary = format!(
         "{} · sourceAgentId={agent_id} · sourceRunId={run_id} · sourceActionId={action_id}",
@@ -919,9 +919,9 @@ mod file_read_source_action_id_tests {
         AgentRuntimeToolObservation {
             tool: "file.read".to_string(),
             status: "ok".to_string(),
-            summary: "已读取 design.md 第 1-134 行（共 134 行）".to_string(),
+            summary: "已读取 game/fast_gdd.md 第 1-134 行（共 134 行）".to_string(),
             detail: Some(format!(
-                "design.md · sha256={} · lines 1-134 of 134
+                "game/fast_gdd.md · sha256={} · lines 1-134 of 134
 第一行内容",
                 "a".repeat(64)
             )),
@@ -954,7 +954,7 @@ mod file_read_source_action_id_tests {
             agent_runtime_action_receipt_public_safe_detail_for_test(&root, &observation)
             .expect("safe detail still parses");
         let value = serde_json::from_str::<serde_json::Value>(&safe_detail).expect("json");
-        assert_eq!(value["path"], "design.md");
+        assert_eq!(value["path"], "game/fast_gdd.md");
         assert_eq!(value["lines"], "1-134 of 134");
         assert_eq!(value["contentSha256"], "a".repeat(64));
     }

apps/ai-game-creator-shell/src-tauri/src/agent/runtime_driver/main_loop.rs

@@ -78,6 +78,12 @@ pub(super) fn game_creator_agent_final_reply_error_allows_fallback(error: &str)
     matches!(kind.as_str(), "empty-response" | "deserialize")
 }
 
+/// 这些错误只描述本次 Provider input 或候选 GDD；真正的 session CAS 冲突不在
+/// 此列——那说明 durable session 已被推进或损坏，必须 reconcile。
+fn plan_submit_error_is_business_rejection(error: &PlanningStorageError) -> bool {
+    matches!(error.code(), "PLAN_INVALID_REQUEST" | "PLAN_SIZE_LIMIT")
+}
+
 const AGENT_RUNTIME_PLAN_UPDATE_IDLE_LIMIT: u32 = 4;
 
 /// 最终回复被收束门禁拦下后 run 会原地续跑重试。多数 blocker 是模型自己能解的

apps/ai-game-creator-shell/src-tauri/src/agent/runtime_protocol.rs

@@ -7,6 +7,9 @@ mod design_session;
 mod finalization;
 mod json_sidecar;
 mod models;
+mod planning_gdd_model;
+mod planning_policy_v2;
+mod planning_session_v2;
 mod provider_control;
 mod provider_retry;
 mod real_e2e_checkpoint;
@@ -21,6 +24,9 @@ pub(crate) use design_session::*;
 pub(in crate::agent) use finalization::*;
 pub(in crate::agent) use json_sidecar::*;
 pub(in crate::agent) use models::*;
+pub(crate) use planning_gdd_model::*;
+pub(crate) use planning_policy_v2::*;
+pub(crate) use planning_session_v2::*;
 pub(in crate::agent) use provider_control::*;
 pub(in crate::agent) use provider_retry::*;
 pub(in crate::agent) use real_e2e_checkpoint::*;

apps/ai-game-creator-shell/src-tauri/src/agent/runtime_protocol/provider_control.rs

@@ -781,7 +781,7 @@ mod provider_reconciliation_diagnostic_tests {
         let directory = tempfile::tempdir().expect("diagnostic directory");
         let snapshot = AgentRuntimeProviderRequestSnapshot {
             project_id: "project-1".to_string(),
-            agent_id: "project-supervisor".to_string(),
+            agent_id: "project-planning".to_string(),
             task_id: "task-1".to_string(),
             session_id: "session-1".to_string(),
             run_id: "run-1".to_string(),
@@ -805,7 +805,7 @@ mod provider_reconciliation_diagnostic_tests {
             usage: None,
             tool_calls: vec![platform_llm::LlmToolCall {
                 id: "call-1".to_string(),
-                name: "runtime_tool_agent_message".to_string(),
+                name: "runtime_tool_plan_submit_gdd".to_string(),
                 arguments: "{\"path\":\"C:\\\\private\\\\argument\"}".to_string(),
             }],
             responses_output: Vec::new(),

apps/ai-game-creator-shell/src-tauri/src/agent/runtime_tools/delegation.rs

@@ -201,17 +201,39 @@ pub(crate) fn observe_agent_runtime_agent_message(
     }
 }
 
-/// 委派 task 末尾那句「你在这条链路上的位置」。返工和普通委派的语义不同，单独保留。
+/// 委派 task 末尾那句「你在这条链路上的位置」。三种跳的语义互不相同，共用一句话
+/// 就会说谎，所以这里把它显式化。
 ///
 /// - `Repair`：质量返工，`repair_depth` 上限 1，「唯一返工轮」是真的。而且这句话是
 ///   做游戏链路的**授权信号**——`design-foundation` / `art-director` /
 ///   `art-asset-plan` 的角色提示词都把「任务正文明确标识这是带 repairOfDelegationId
 ///   的唯一返工轮」当作 `replaceExisting=true` 的唯一许可（见 agent/prompt.rs 的三处
 ///   角色 prompt）。这一支逐字不能动。
+/// - `PlanClarification`：澄清续跑不消耗 `repair_depth`，预算是
+///   `static_delegate_clarification_round_limit_at`（plan 链路 3 轮）。master 只有一道
+///   平坦的 depth <= 1 门，那时「唯一返工轮」对澄清跳也成立；本仓库改成按谱系分类后
+///   把预算抬到 3，这句话就变成了假天花板——生产实测 4 次澄清续跑全部命中它，命中后
+///   全部直接出稿，没有任何一个 run 走到第 2 轮。
+/// - `UserRevision`：用户在审批卡上点「修改 / 退回」后的修订轮。它同样带
+///   `repairOfDelegationId`，但 `repair_depth` 防的是 runaway agent，而这一跳每一轮
+///   都由人触发——人本身就是循环边界，所以 `static_delegate_lineage_counters` 早就
+///   把 depth/round 原样继承了。缺的是这句话：走 `Repair` 分支时用户第一次点修改就
+///   会被告知「这是唯一返工轮」，和澄清跳当初那个假天花板是同一个错误。原型对应的是
+///   `USER_REVISION_SOFT_LIMIT = 16`，且超过只提示、不拒绝。
 /// - `None`：普通委派，不加这一段。
 pub(in crate::agent) enum StaticDelegateHopNote<'a> {
     None,
-    Repair { original_delegation_id: &'a str },
+    Repair {
+        original_delegation_id: &'a str,
+    },
+    UserRevision {
+        original_delegation_id: &'a str,
+    },
+    PlanClarification {
+        original_delegation_id: &'a str,
+        rounds_used: u32,
+        rounds_limit: u32,
+    },
 }
 
 impl StaticDelegateHopNote<'_> {
@@ -225,6 +247,32 @@ impl StaticDelegateHopNote<'_> {
             StaticDelegateHopNote::Repair {
                 original_delegation_id,
             } => format!("\n\n这是对已认领委派 {original_delegation_id} 的唯一返工轮。"),
+            StaticDelegateHopNote::UserRevision {
+                original_delegation_id,
+            } => format!(
+                "\n\n这是对已认领委派 {original_delegation_id} 的用户修订轮，由用户在审批卡上提出，不是质量返工，不消耗返工深度，也不重置澄清轮次。按任务正文里的用户意见原文修订同一份 GDD 谱系后重新提交；用户看过新稿还可以再次提出修改，这不是最后一轮，不要因此压缩改动或提前收尾。"
+            ),
+            // 预算用尽：planning_coordinator 出卡时会用
+            // `current_round >= 3` 直接拒掉第四张卡，所以这里不能再邀请提问，
+            // 只能要求收稿——语义上等价于原型的 INJ_MUST_DRAFT_ROUNDS。
+            StaticDelegateHopNote::PlanClarification {
+                original_delegation_id,
+                rounds_used,
+                rounds_limit,
+            } if rounds_used >= rounds_limit => format!(
+                "\n\n这是对已认领委派 {original_delegation_id} 的澄清续跑，不是返工轮。已用澄清轮次 {rounds_used}/{rounds_limit}，澄清预算已用尽：本轮不得再输出 AGC_NEEDS_USER_INPUT_V1 信封，剩余空白按默认建议补齐并标 default_pending，立即提交 GDD。"
+            ),
+            // 轮号必须和 planning_coordinator 出卡时的期望一致：那边用
+            // `validate_exact_plan_clarification_question(.., current_round + 1)`，
+            // current_round 就是本 delivery 的谱系轮次，也就是这里的 rounds_used。
+            StaticDelegateHopNote::PlanClarification {
+                original_delegation_id,
+                rounds_used,
+                rounds_limit,
+            } => format!(
+                "\n\n这是对已认领委派 {original_delegation_id} 的澄清续跑，不是返工轮，不消耗返工深度。已用澄清轮次 {rounds_used}/{rounds_limit}。仍有会实质改变结果的空白且预算未用尽时，可以继续以 AGC_NEEDS_USER_INPUT_V1 信封退出：questions 恰好一题，header 写成「第{next_round}轮·当前要决定：<主题>」，轮号必须是 {next_round}，主题写这一轮真正要定的那件事。预算已用尽，或剩余空白能由默认建议覆盖且不影响首个可玩闭环时，立即提交 GDD。",
+                next_round = rounds_used.saturating_add(1),
+            ),
         }
     }
 }
@@ -1475,3 +1523,122 @@ pub(crate) fn observe_agent_runtime_agent_spawn_isolated(
             .map(|value| redact_agent_runtime_project_paths(root, &value, 3_600)),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// 委派 task 末尾那句话是两条链路的合同，不能共用一份文案。
+    ///
+    /// 上半条钉做游戏链路：`design-foundation` / `art-director` / `art-asset-plan`
+    /// 的角色提示词把「任务正文明确标识这是带 repairOfDelegationId 的唯一返工轮」
+    /// 当作 `replaceExisting=true` 的唯一授权信号，改一个字就会让返工轮拿不到许可。
+    ///
+    /// 下半条钉立项策划链路：澄清续跑不是返工轮，套用返工文案等于告诉策划子 Agent
+    /// 「你只剩这一轮」——这正是生产上 4 次澄清续跑之后无一走到第 2 轮的原因。
+    /// 同时钉住轮号：`planning_coordinator` 出卡时按 `rounds_used + 1` 校验 header，
+    /// 这里写进 task 的必须是同一个数，否则第 2 轮信封会当场被拒。
+    /// 用户修订轮同样不能套返工文案。
+    ///
+    /// 「唯一返工轮」防的是 runaway agent，而这一跳由用户在审批卡上亲手点出来——人本身
+    /// 就是循环边界，`static_delegate_lineage_counters` 早就把 depth/round 原样继承了。
+    /// 套用返工文案就是告诉策划子 Agent「用户只能改这一次」，和澄清跳当初那个假天花板
+    /// 是同一个错误。原型对应的是软阈值 16 次、超过只提示不拒绝。
+    #[test]
+    fn user_revision_hop_note_is_not_the_repair_round_note() {
+        let revision = render_static_delegate_task_contract(
+            "任务",
+            "project-supervisor",
+            "run-1",
+            "delegation-new",
+            &["交付 game/fast_gdd.md".to_string()],
+            &["game/fast_gdd.md".to_string()],
+            StaticDelegateHopNote::UserRevision {
+                original_delegation_id: "delegation-old",
+            },
+        )
+        .expect("render user revision hop note");
+        assert!(
+            !revision.contains("唯一返工轮"),
+            "用户修订轮不得复用返工文案，否则子 Agent 以为用户只能改这一次：{revision}"
+        );
+        assert!(
+            revision.contains("不消耗返工深度"),
+            "必须写明它不吃返工额度：{revision}"
+        );
+        assert!(
+            revision.contains("不是最后一轮"),
+            "必须写明用户还能再改，否则子 Agent 会把多条意见攒到一轮改完：{revision}"
+        );
+    }
+
+    #[test]
+    fn plan_clarification_hop_note_is_not_the_repair_round_note() {
+        let repair = render_static_delegate_task_contract(
+            "任务",
+            "project-supervisor",
+            "run-1",
+            "delegation-new",
+            &["交付产物".to_string()],
+            &["assets/art-spec.png".to_string()],
+            StaticDelegateHopNote::Repair {
+                original_delegation_id: "delegation-old",
+            },
+        )
+        .expect("render repair");
+        assert!(
+            repair.contains("这是对已认领委派 delegation-old 的唯一返工轮。"),
+            "返工轮文案是做游戏链路 replaceExisting 的授权信号，必须逐字保留：{repair}"
+        );
+
+        let clarification = render_static_delegate_task_contract(
+            "任务",
+            "project-supervisor",
+            "run-1",
+            "delegation-new",
+            &["交付 game/fast_gdd.md".to_string()],
+            &["game/fast_gdd.md".to_string()],
+            StaticDelegateHopNote::PlanClarification {
+                original_delegation_id: "delegation-old",
+                rounds_used: 1,
+                rounds_limit: 3,
+            },
+        )
+        .expect("render clarification");
+        assert!(
+            !clarification.contains("唯一返工轮"),
+            "澄清续跑不得复用返工文案，否则策划子 Agent 以为只剩这一轮：{clarification}"
+        );
+        assert!(
+            clarification.contains("已用澄清轮次 1/3"),
+            "澄清续跑必须写明已用轮次与上限：{clarification}"
+        );
+        assert!(
+            clarification.contains("第2轮·当前要决定："),
+            "task 里的轮号必须等于 planning_coordinator 校验 header 时用的 rounds_used + 1：{clarification}"
+        );
+
+        let exhausted = render_static_delegate_task_contract(
+            "任务",
+            "project-supervisor",
+            "run-1",
+            "delegation-new",
+            &["交付 game/fast_gdd.md".to_string()],
+            &["game/fast_gdd.md".to_string()],
+            StaticDelegateHopNote::PlanClarification {
+                original_delegation_id: "delegation-old",
+                rounds_used: 3,
+                rounds_limit: 3,
+            },
+        )
+        .expect("render exhausted clarification");
+        assert!(
+            exhausted.contains("澄清预算已用尽"),
+            "预算用尽时必须要求收稿，出卡侧会直接拒掉第四张卡：{exhausted}"
+        );
+        assert!(
+            !exhausted.contains("第4轮·当前要决定："),
+            "预算用尽时不得再给出下一轮 header，那是一张永远递不上去的卡：{exhausted}"
+        );
+    }
+}

apps/ai-game-creator-shell/src-tauri/src/agent/runtime_tools/file_ops.rs

@@ -10,6 +10,18 @@ pub(in crate::agent) fn agent_role_project_path_mutation_block(
     if autonomous_relaxed_run_at(root, agent_id, run_id).unwrap_or(false) {
         return None;
     }
+    if is_agent_planning_storage_path(path) || is_plan_fast_gdd_projection_path(path) {
+        return Some(AgentRuntimeToolObservation {
+            tool: tool.to_string(),
+            status: "blocked".to_string(),
+            summary: if is_agent_planning_storage_path(path) {
+                "`.agent/planning/**` 只能由立项策划 Runtime 专用存储层写入".to_string()
+            } else {
+                "`game/fast_gdd.md` 只能由立项策划 Runtime renderer 写入".to_string()
+            },
+            detail: Some(format!("agentId={agent_id} · runId={run_id} · path={path}")),
+        });
+    }
     match autonomous_owner_artifact_validation_available_for_run_at(root, agent_id, run_id) {
         Ok(true) => {
             let allowed = autonomous_manifest_owner_artifact_paths(agent_id);

apps/ai-game-creator-shell/src-tauri/src/agent_native_tools.rs

@@ -275,7 +275,8 @@ fn agent_runtime_native_capability_registry() -> Result<&'static CapabilityRegis
 ///
 /// `"__all_agents__"` 是个不对应任何真实 Agent 的哨兵：走这条路径拿到的是
 /// 未按身份收窄的完整函数目录。生产代码必须调用 `_for_agent` 版本并传入真实
-/// `agentId`，否则按身份收窄的工具面会被静默绕开。这里用 `#[cfg(test)]` 把「忘记改用 `_for_agent`」
+/// `agentId`，否则按身份收窄的工具面（如 `project-planning` 的 exact
+/// allowlist）会被静默绕开。这里用 `#[cfg(test)]` 把「忘记改用 `_for_agent`」
 /// 从运行时静默扩权变成编译期错误。
 #[cfg(test)]
 pub(crate) fn build_agent_runtime_native_function_tools() -> Result<Vec<LlmFunctionTool>, String> {