完善桌面端界面、发布检查与邮箱域名同步

frontend/scripts/verify-desktop-release.mjs

@@ -48,6 +48,7 @@ const verifyTauriConfig = async () => {
   const targetList = Array.isArray(targets) ? targets : [targets].filter(Boolean);
   const csp = tauriConfig.app?.security?.csp || "";
   const cspTokens = csp.split(/[;\s]+/).filter(Boolean);
+  const mainWindow = tauriConfig.app?.windows?.find((window) => window.label === "main") || tauriConfig.app?.windows?.[0];
 
   assert(tauriConfig.bundle?.active === true, "Tauri bundle must be active for desktop release builds.");
   assert(targetList.includes("app"), "Tauri bundle targets must include app.");
@@ -68,6 +69,8 @@ const verifyTauriConfig = async () => {
     "Tauri CSP must not use wildcard sources.",
   );
   assert(!/\bconnect-src\b[^;]*\bhttp:\b/.test(csp), "Tauri CSP must not allow broad http: API access.");
+  assert(mainWindow?.minWidth === 1180, "Main desktop window must keep the minimum width at 1180.");
+  assert(mainWindow?.minHeight === 760, "Main desktop window must keep the minimum height at 760.");
 };
 
 const verifyCapabilities = async () => {
@@ -151,16 +154,61 @@ const verifySourceSafety = async () => {
     const source = await readFile(path, "utf8");
     const file = relative(rootDir, path);
     assert(!/[?&]token=/.test(source), `${file}: token must not be passed through query parameters.`);
+    assert(
+      !/console\.(log|debug|info|warn|error)\s*\([^)]*token/i.test(source),
+      `${file}: token-related values must not be written to console logs.`,
+    );
     if (source.includes("ctms_token") && file !== "frontend/src/runtime/secureSessionStorage.ts") {
       fail(`${file}: ctms_token may only be handled by secureSessionStorage.`);
     }
+    if (source.includes("sendNotification") && file !== "frontend/src/runtime/notifications.ts") {
+      fail(`${file}: system notifications must be routed through frontend/src/runtime/notifications.ts.`);
+    }
   }
 };
 
+const verifyNotificationBoundary = async () => {
+  const source = await readFile(resolve(sourceDir, "runtime/notifications.ts"), "utf8");
+  assert(source.includes('title: "CTMS 文件更新"'), "Desktop notification title must stay generic.");
+  assert(source.includes('body: "有新的文件版本待查看"'), "Desktop notification body must stay generic.");
+  assert(!/showSystemNotification\s*=\s*async\s*\([^)]*[a-zA-Z]/.test(source), "Desktop notification body must not accept dynamic business content.");
+};
+
+const verifyUpdaterBoundary = async () => {
+  const source = await readFile(resolve(tauriDir, "src/updates.rs"), "utf8");
+  assert(source.includes('join("desktop-updates/stable/latest.json")'), "Desktop updater must derive the fixed stable latest.json path.");
+  assert(source.includes("desktop updates require HTTPS outside localhost"), "Desktop updater must reject non-local HTTP update feeds.");
+  assert(source.includes("server origin must not include credentials"), "Desktop updater must reject server origins that include credentials.");
+};
+
+const verifyWorkflowGates = async () => {
+  const workflow = await readFile(resolve(rootDir, ".github/workflows/client-quality-gates.yml"), "utf8");
+  const requiredCommands = [
+    "npm run version:check",
+    "npm run runtime:check",
+    "npm run desktop:release:check",
+    "npm run ui:contract",
+    "npm run type-check",
+    "npm run test:unit",
+    "npm run build",
+    "npm run desktop:build:app",
+    "npm run release:env:check",
+  ];
+
+  for (const command of requiredCommands) {
+    assert(workflow.includes(command), `Client quality gates workflow must run ${command}.`);
+  }
+  assert(workflow.includes("VITE_BUILD_CHANNEL"), "Client quality gates workflow must inject VITE_BUILD_CHANNEL.");
+  assert(workflow.includes("VITE_BUILD_COMMIT"), "Client quality gates workflow must inject VITE_BUILD_COMMIT.");
+};
+
 await verifyTauriConfig();
 await verifyCapabilities();
 await verifyRustBoundary();
 await verifySourceSafety();
+await verifyNotificationBoundary();
+await verifyUpdaterBoundary();
+await verifyWorkflowGates();
 
 if (failures.length > 0) {
   console.error(`Desktop release gate failed:\n${failures.map((item) => `  - ${item}`).join("\n")}`);