suzmii
10d1fcbc5f
对抗性复核（`local://verify-m2b.md`）确认三个真实缺口，本次按 P0 → P1-b 补齐；两端规则逐条对齐，parity 门禁仍绿。 - **P0-a 凭据/依赖识别**：任意层级目录新增 `.aws` / `.ssh` / `.kube` / `.docker` / `.gnupg` / `.terraform` / `.secrets`（服务端新增独立变体 `CredentialDirectoryNotAllowed`）；文件名前缀新增 `credentials` / `id_ecdsa` / `id_dsa` / `terraform.tfstate` / `service-account`；后缀新增 `.jks` / `.keystore` / `.ppk` / `.p8` / `.kdbx` / `.der`；全名新增 `.htpasswd` / `.pgpass`。另外对**小体积文本条目**（≤256 KiB、扩展名在白名单或无扩展名）做内容特征扫描：PEM 私钥块、`AKIA`+16 位、`ghp_`/`github_pat_`/`xox*-`（服务端新增 `SecretContentDetected`）；更宽的前缀启发（如 `sk-`）**故意不做**并在注释里写明理由（误报会直接阻断作者发布） - **P0-b 规模检查不再被声明值骗**：两侧校验器改为**读取层封顶**——`by_index(index)?.take(declared_size + 1)` + 预分配收紧到单文件硬上限 + 多读 1 字节即判溢出、短读同样失败；压缩比分母从整包字节改为**该条目自身的压缩字节**；**同一修法同步到发行包校验器**（`package.rs` 原有同款洞），常量注释改成与实现一致（明确它不是整包炸弹防线） - **P0-c 嵌套包识别**：扩展名并集 `.zip/.tar/.gz/.tgz/.7z/.rar/.jar/.whl/.nupkg` + **magic bytes 嗅探**（zip/7z/rar/gzip/tar-ustar），改名成 `.dat` 也拦。**一处有证据的偏离**：`by_index_raw` 拿到的是**压缩流**（zip 2.4.2 文档与实测一致），按它嗅探会漏拦，因此改为对**已按声明大小封顶读出的解压内容**判 magic；客户端命中即报错并点名路径与格式 - **P1-b 执行级交叉证据（走 dev-dependency 路，未退化到 fixture）**：客户端 crate 加 `[dev-dependencies] module-game-distribution`，新测试用真实打包器产出字节喂给服务端 `validate_project_bundle_zip` 断言接受（并逐项比对摘要/字节数/条目顺序），再手造含 `.env` 与 `node_modules` 的包断言服务端独立拒绝 - 客户端同时补上**路径形状检查**（`BUNDLE_FORBIDDEN_PATH_CHARS` / `_SUFFIX_CHARS` / `_SEGMENTS` + `bundle_entry_path_shape_error`），修掉「macOS/Linux 上 `src/a?.ts`、`x.` 客户端能打、服务端必 422」的不一致；客户端压缩比预检也改按条目压缩字节 - 测试：`cargo test -p module-game-distribution` **73 passed**（+4）；AGC `cargo test -- project_bundle` **24 passed**（含交叉证据那条）；**发行包回归**：`cargo test -p api-server game_distribution` **60 passed / 0 failed**（`package.rs` 改动无行为回归，新增「声明说谎 → ReadFailed」用例） - 门禁：`cargo check --all-targets` 0；两端 `cargo fmt --check` 0；policy parity 0（服务端 51 条全被客户端覆盖）；DTO parity 0；schema 0；encoding 0；`git diff --check` 0
117 lines
4.8 KiB
TOML
117 lines
4.8 KiB
TOML
[package]
|
||
name = "genarrative-ai-game-creator-shell"
|
||
version = "0.1.67"
|
||
edition = "2021"
|
||
publish = false
|
||
|
||
[workspace]
|
||
members = [".", "vendor/codex-patch-parser", "vendor/codex-utils-path-uri", "vendor/codex-utils-absolute-path"]
|
||
resolver = "2"
|
||
|
||
[features]
|
||
default = []
|
||
# 模板库假数据注入（仅本地页面压测/演示用）：只有显式开启该 feature 才会编译并在读取清单后
|
||
# 把条目循环补齐成假数据；计数由 AGC_TEMPLATE_LIBRARY_SYNTHETIC_COUNT 控制（默认 1000）。
|
||
template-library-fixtures = []
|
||
cocos-editor = ["cocos-editor-bridge/process-discovery"]
|
||
cocos-editor-execute = ["cocos-editor", "cocos-editor-bridge/windows-bootstrap"]
|
||
cocos-editor-injection = ["cocos-editor-execute", "cocos-editor-bridge/windows-injection"]
|
||
unity-editor-execute = []
|
||
godot-editor-execute = []
|
||
|
||
[build-dependencies]
|
||
serde = { version = "1", features = ["derive"] }
|
||
serde_json = "1"
|
||
sha2 = "0.10"
|
||
shared-contracts = { path = "../../../server-rs/crates/shared-contracts", default-features = false }
|
||
tauri-build = { version = "2.6.2", features = [] }
|
||
|
||
[dependencies]
|
||
codex-patch-parser = { path = "vendor/codex-patch-parser" }
|
||
chrono = { version = "0.4", default-features = false, features = ["std"] }
|
||
ts-rs = "12.0.1"
|
||
typed_floats = { version = "1.0.7", features = ["serde"] }
|
||
nalgebra = { version = "0.35.0", features = ["serde-serialize"] }
|
||
agent-runtime-core = { path = "../../../server-rs/crates/agent-runtime-core" }
|
||
cocos-editor-bridge = { path = "../../../plugins/agc-cocos-editor/native/cocos-editor-bridge", default-features = false }
|
||
editor-adapter-api = { path = "../../../server-rs/crates/editor-adapter-api" }
|
||
unity-editor-bridge = { path = "../../../plugins/agc-unity-editor/native/unity-editor-bridge" }
|
||
godot-editor-bridge = { path = "../../../plugins/agc-godot-editor/native/godot-editor-bridge" }
|
||
base64 = "0.22"
|
||
axum = "0.8"
|
||
chromiumoxide = "0.9.1"
|
||
futures = "0.3"
|
||
getrandom = "0.3"
|
||
http = "1"
|
||
# `tga` / `tiff` / `hdr` 只服务资源画布的只读预览：引擎图像容器（Cocos 的
|
||
# .tga/.tif/.hdr 等）在浏览器里没有解码器，必须先在原生侧转码成 PNG 再送给前端。
|
||
# 刻意不开 `exr`：它要求 `exr ^1.74.0`，当前依赖源只能到 1.73，打不开就先让
|
||
# `.exr` 走「类型卡」而不是留一半解不出来的预览分支。
|
||
image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "tga", "tiff", "hdr"] }
|
||
jsonschema = { version = "0.49.3", default-features = false }
|
||
oxc_allocator = "0.143.0"
|
||
oxc_ast = "0.143.0"
|
||
oxc_ast_visit = "0.143.0"
|
||
oxc_parser = "0.143.0"
|
||
oxc_semantic = "0.143.0"
|
||
oxc_span = "0.143.0"
|
||
serde = { version = "1", features = ["derive"] }
|
||
serde_json = "1"
|
||
serde_yaml = "0.9"
|
||
schemars = "1.2.1"
|
||
sha2 = "0.10"
|
||
similar = "2.7"
|
||
platform-llm = { path = "../../../server-rs/crates/platform-llm" }
|
||
platform-agent = { path = "../../../server-rs/crates/platform-agent" }
|
||
portable-pty = "0.9"
|
||
reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "native-tls", "stream"] }
|
||
regex = "1"
|
||
shared-contracts = { path = "../../../server-rs/crates/shared-contracts", default-features = false, features = ["ts-bindings"] }
|
||
tauri = { version = "2.11.2", features = [] }
|
||
tauri-plugin-dialog = "2.7.1"
|
||
tauri-plugin-opener = "2"
|
||
tauri-plugin-updater = "2.11.0"
|
||
tempfile = "3"
|
||
toml = "0.8"
|
||
ttf-parser = "0.25.1"
|
||
tokio = { version = "1", features = ["io-util", "macros", "process", "rt-multi-thread", "signal", "sync", "time"] }
|
||
url = "2"
|
||
unicode-normalization = "0.1"
|
||
uuid = { version = "1", features = ["v4"] }
|
||
zip = { version = "2", default-features = false, features = ["deflate"] }
|
||
tauri-plugin-clipboard-manager = "2.3.2"
|
||
maud = "0.27.0"
|
||
|
||
# P1-b 执行级交叉证据：客户端打包器产出的字节直接喂给服务端校验器
|
||
# （`module-game-distribution::validate_project_bundle_zip`），替代只有文本级的一致性门禁。
|
||
[dev-dependencies]
|
||
module-game-distribution = { path = "../../../server-rs/crates/module-game-distribution" }
|
||
|
||
[target.'cfg(unix)'.dependencies]
|
||
libc = "0.2"
|
||
|
||
[target.'cfg(windows)'.dependencies]
|
||
windows-sys = { version = "0.61", features = ["Wdk_Storage_FileSystem", "Win32_Foundation", "Win32_Storage_FileSystem", "Win32_System_Diagnostics_ToolHelp", "Win32_System_IO", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
|
||
|
||
[profile.dev]
|
||
opt-level = 0
|
||
debug = 1
|
||
codegen-units = 256
|
||
lto = "off"
|
||
incremental = true
|
||
|
||
# Runner 启动阶段会对当前 Debug 可执行文件计算 SHA-256。仅优化密码学依赖，
|
||
# 保持业务代码的 Debug 编译速度，同时避免整份 Debug 构建因未优化 hash 热点而阻塞启动。
|
||
[profile.dev.package.sha2]
|
||
opt-level = 3
|
||
|
||
[profile.dev.package.digest]
|
||
opt-level = 3
|
||
|
||
[profile.test]
|
||
opt-level = 0
|
||
debug = 1
|
||
codegen-units = 256
|
||
lto = "off"
|
||
incremental = false
|