From f4844aa8f1d04f0dc74e1a5c10d20e6ca1d65c4f Mon Sep 17 00:00:00 2001
From: Cheng Zhou <zhoucheng857@gmail.com>
Date: Thu, 9 Jul 2026 09:38:55 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E6=A1=8C=E9=9D=A2?=
 =?UTF-8?q?=E6=A3=80=E6=9F=A5=E8=84=9A=E6=9C=AC=E7=9A=84=20Windows=20?=
 =?UTF-8?q?=E8=B7=AF=E5=BE=84=E5=88=A4=E6=96=AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 frontend/scripts/verify-desktop-release.mjs  | 3 ++-
 frontend/scripts/verify-runtime-boundary.mjs | 9 ++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/frontend/scripts/verify-desktop-release.mjs b/frontend/scripts/verify-desktop-release.mjs
index 6e88cc47..6243caf7 100644
--- a/frontend/scripts/verify-desktop-release.mjs
+++ b/frontend/scripts/verify-desktop-release.mjs
@@ -29,6 +29,7 @@ const walk = async (directory) => {
 
 const permissionIdentifier = (permission) =>
   typeof permission === "string" ? permission : typeof permission?.identifier === "string" ? permission.identifier : "";
+const toPosixPath = (path) => path.split("\\").join("/");
 
 const assertPathScope = (permission, expectedPrefix, description) => {
   const allow = Array.isArray(permission.allow) ? permission.allow : [];
@@ -205,7 +206,7 @@ const verifySourceSafety = async () => {
 
   for (const path of files) {
     const source = await readFile(path, "utf8");
-    const file = relative(rootDir, path);
+    const file = toPosixPath(relative(rootDir, path));
     const isRuntimeFile = file.startsWith("frontend/src/runtime/");
     assert(!/[?&](?:token|access_token)=/i.test(source), `${file}: token must not be passed through query parameters.`);
     assert(
diff --git a/frontend/scripts/verify-runtime-boundary.mjs b/frontend/scripts/verify-runtime-boundary.mjs
index 08fbc062..545338a3 100644
--- a/frontend/scripts/verify-runtime-boundary.mjs
+++ b/frontend/scripts/verify-runtime-boundary.mjs
@@ -1,5 +1,5 @@
 import { readdir, readFile } from "node:fs/promises";
-import { extname, relative, resolve } from "node:path";
+import { extname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const frontendDir = fileURLToPath(new URL("../", import.meta.url));
@@ -7,6 +7,7 @@ const sourceDir = resolve(frontendDir, "src");
 const runtimeDir = resolve(sourceDir, "runtime");
 const sourceExtensions = new Set([".ts", ".tsx", ".vue", ".js", ".jsx"]);
 const violations = [];
+const toPosixPath = (path) => path.split("\\").join("/");
 
 const walk = async (directory) => {
   const entries = await readdir(directory, { withFileTypes: true });
@@ -21,10 +22,12 @@ const walk = async (directory) => {
 };
 
 for (const path of await walk(sourceDir)) {
-  if (!sourceExtensions.has(extname(path)) || path.startsWith(`${runtimeDir}/`)) continue;
+  const runtimeRelativePath = relative(runtimeDir, path);
+  const isRuntimeFile = Boolean(runtimeRelativePath) && !runtimeRelativePath.startsWith("..") && !isAbsolute(runtimeRelativePath);
+  if (!sourceExtensions.has(extname(path)) || isRuntimeFile) continue;
 
   const source = await readFile(path, "utf8");
-  const file = relative(frontendDir, path);
+  const file = toPosixPath(relative(frontendDir, path));
   if (source.includes("@tauri-apps/") || source.includes("__TAURI")) {
     violations.push(`${file}: direct Tauri access is only allowed inside src/runtime`);
   }