sync: taiji 定制版同步最新基线 8d810b99e（LegionCard 样式统一 + 群聊 P0 修复）

.github/workflows/ci.yml

@@ -83,6 +83,9 @@ jobs:
     name: CLI Tests (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
+    env:
+      # Same warning gate as rust-build-check.
+      RUSTFLAGS: "-D warnings"
     strategy:
       fail-fast: false
       matrix:
@@ -138,14 +141,55 @@ jobs:
           cargo test --locked -p terminal-core background_only_binding_is_owned_by_the_session -- --test-threads=1
 
   # ── Rust: build check ─────────────────────────────────────────────
+  # Cargo-deny gate: advisories + licenses + sources (+ bans at warn level).
+  # Kept on Linux only - the license/source graph is OS-independent, so a
+  # single check covers the whole workspace without triplicating the run.
+  cargo-deny:
+    name: Cargo Deny (advisories + licenses)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: "cargo-deny-v1"
+          cache-bin: false
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --locked --version 0.20.2
+
+      - name: Deny advisories
+        run: cargo deny check advisories
+
+      - name: Deny licenses
+        # -A no-license-field silences the diagnostic for crates that declare
+        # `license-file` instead of the SPDX `license` expression field
+        # (display-info 0.4.8 via screenshots); the actual LICENSE text is
+        # still parsed and gated by the allow list below.
+        run: cargo deny check licenses -A no-license-field
+
+      - name: Deny sources
+        run: cargo deny check sources
+
   rust-build-check:
     name: Rust Build Check (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    # Rust workspace check + 6 test groups across 3 OS; generous but bounded
+    # so a wedged dependency/network cannot burn the full 6h default.
+    timeout-minutes: 60
     env:
       # Keep the workspace check plus desktop test profiles within hosted-runner disk limits.
       CARGO_INCREMENTAL: "0"
       CARGO_PROFILE_DEV_DEBUG: "0"
       CARGO_PROFILE_TEST_DEBUG: "0"
+      # Warning gate: any rustc warning (dead code, unused imports, ...) fails
+      # the build, so a warning regression cannot re-enter silently. The
+      # linker_messages lint intentionally ignores -D warnings (see workspace
+      # lints), so MSVC link noise stays non-fatal.
+      RUSTFLAGS: "-D warnings"
     strategy:
       fail-fast: false
       matrix:
@@ -204,6 +248,50 @@ jobs:
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
           cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
+      # sherpa-onnx-sys downloads its native static libraries from GitHub
+      # Releases at build time. Hosted runners intermittently fail that
+      # download (network/rate limits), so pre-fetch and extract the archive
+      # here, then point SHERPA_ONNX_LIB_DIR at the extracted lib directory.
+      # The build script uses that variable directly without any cache/rerun
+      # logic, so both `cargo check` and `cargo test` link against the same
+      # pre-fetched libraries. Windows is skipped: its archive is already
+      # cached in the rust-cache path and the previous failures were Linux and
+      # macOS only.
+      - name: Pre-download sherpa-onnx native libraries
+        if: runner.os != 'Windows'
+        shell: bash
+        env:
+          SHERPA_VERSION: "1.13.4"
+        run: |
+          set -euo pipefail
+          case "${{ runner.os }}" in
+            Linux)
+              archive="sherpa-onnx-v${SHERPA_VERSION}-linux-x64-static-lib.tar.bz2"
+              ;;
+            macOS)
+              archive="sherpa-onnx-v${SHERPA_VERSION}-osx-arm64-static-lib.tar.bz2"
+              ;;
+            *)
+              exit 0
+              ;;
+          esac
+          mkdir -p "$RUNNER_TEMP/sherpa-onnx-libs"
+          archive_path="$RUNNER_TEMP/sherpa-onnx-libs/$archive"
+          if [ ! -f "$archive_path" ]; then
+            curl -fL --retry 5 --retry-all-errors \
+              "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${SHERPA_VERSION}/${archive}" \
+              -o "$archive_path"
+          fi
+          lib_dir="$RUNNER_TEMP/sherpa-onnx-libs/lib"
+          if [ ! -d "$lib_dir" ]; then
+            tar -xjf "$archive_path" -C "$RUNNER_TEMP/sherpa-onnx-libs"
+            # The archive extracts to a versioned directory; its lib/ is the
+            # native library directory the build script expects.
+            lib_dir="$(find "$RUNNER_TEMP/sherpa-onnx-libs" -maxdepth 2 -type d -name lib | head -n 1)"
+          fi
+          test -n "$lib_dir" && test -f "$lib_dir/libsherpa-onnx-c-api.a"
+          echo "SHERPA_ONNX_LIB_DIR=$lib_dir" >> "$GITHUB_ENV"
+
       # rust-cache prunes the workspace target directory before saving it, so
       # native libraries stored under target need an independent cache lifecycle.
       - name: Restore Sherpa native libraries
@@ -282,6 +370,9 @@ jobs:
   frontend-build:
     name: Frontend Build
     runs-on: ubuntu-latest
+    # Full web-ui test + build + i18n audits; bounded so a stuck install or
+    # test cannot burn the full 6h default.
+    timeout-minutes: 40
     env:
       NODE_OPTIONS: --max-old-space-size=6144
     steps:
@@ -339,7 +430,9 @@ jobs:
         run: pnpm run verify:webkit-compatibility:test
 
       - name: Lint web UI
-        run: pnpm run lint:web
+        # Warning gate: any eslint warning (not just errors) fails the job so
+        # lint regressions cannot re-enter silently.
+        run: pnpm --dir src/web-ui exec eslint . --max-warnings=0
 
       - name: Run web UI tests
         run: pnpm --dir src/web-ui run test:run

.github/workflows/desktop-package.yml

@@ -46,6 +46,7 @@ jobs:
   prepare:
     name: Prepare
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       version: ${{ steps.meta.outputs.version }}
       release_tag: ${{ steps.meta.outputs.release_tag }}
@@ -140,11 +141,15 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     needs: prepare
     if: needs.prepare.outputs.relay_image_only != 'true'
+    # Release packaging: full release-profile build + bundles per platform.
+    # 6h default is far too long for a wedged job; cap it at 120m.
+    timeout-minutes: 120
     env:
       NODE_OPTIONS: --max-old-space-size=6144
       BITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }}
       BITFUN_RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }}
-      TAURI_UPDATER_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || '' }}
+      # 本侧定制：stable 直链 latest.json（updater 常规路径）
+      TAURI_UPDATER_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || format('https://github.com/{0}/releases/latest/download/latest.json', github.repository) }}
       TAURI_UPDATER_FALLBACK_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || '' }}
       TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
       # Same trust root, compiled into the Desktop binary so one-click relay
@@ -346,6 +351,7 @@ jobs:
   publish-relay-image:
     name: Publish Relay Server Image
     needs: [prepare, linux-binaries]
+    timeout-minutes: 60
     if: >-
       always() &&
       ((needs.prepare.outputs.upload_to_release == 'true' &&
@@ -358,7 +364,7 @@ jobs:
       contents: write
       packages: write
     env:
-      IMAGE: ghcr.io/gcwing/bitfun-relay-server
+      IMAGE: ghcr.io/${{ github.repository_owner }}/bitfun-relay-server
 
     steps:
       - name: Checkout
@@ -384,7 +390,7 @@ jobs:
           set -euo pipefail
           mkdir -p linux-release-assets
           gh release download "${RELEASE_TAG}" \
-            --repo GCWing/BitFun \
+            --repo "${{ github.repository }}" \
             --dir linux-release-assets \
             --pattern 'bitfun-relay-server-*.tar.gz' \
             --pattern 'bitfun-relay-server-*.tar.gz.sha256'
@@ -432,7 +438,7 @@ jobs:
             if [[ "${IMAGE_ONLY}" == "true" ]]; then
               # Backfilling an older release must not roll the floating tag
               # backwards. GitHub's latest endpoint excludes prereleases.
-              latest_release="$(gh api repos/GCWing/BitFun/releases/latest --jq .tag_name)"
+              latest_release="$(gh api repos/${{ github.repository }}/releases/latest --jq .tag_name)"
               if [[ "${RELEASE_TAG}" == "${latest_release}" ]]; then
                 echo "${IMAGE}:latest"
               fi
@@ -538,6 +544,7 @@ jobs:
   upload-release-assets:
     name: Upload Release Assets
     needs: [prepare, package, linux-binaries, publish-relay-image]
+    timeout-minutes: 30
     if: >-
       always() &&
       needs.prepare.outputs.upload_to_release == 'true' &&
@@ -637,7 +644,7 @@ jobs:
             --assets-dir linux-release-assets \
             --version "${{ needs.prepare.outputs.version }}" \
             --tag "${{ needs.prepare.outputs.release_tag }}" \
-            --repo "GCWing/BitFun" \
+            --repo "${{ github.repository }}" \
             --out linux-release-assets/linux-binaries.json
 
       # The Tauri bundler signs the five updater artifacts during `tauri build`,
@@ -748,7 +755,7 @@ jobs:
         if: needs.prepare.outputs.release_channel == 'stable'
         run: |
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
             -o linux-binaries.published.json
           test "$(jq -r '.version' linux-binaries.published.json)" = "${{ needs.prepare.outputs.version }}"
           while IFS= read -r cli_url; do
@@ -760,13 +767,13 @@ jobs:
         if: needs.prepare.outputs.release_channel == 'stable'
         run: |
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \
             -o relay-image.published.json
           test "$(jq -r '.tag' relay-image.published.json)" = "${{ needs.prepare.outputs.release_tag }}"
-          test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/gcwing/bitfun-relay-server"
+          test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/${{ github.repository_owner }}/bitfun-relay-server"
           jq -e '.digest | test("^sha256:[0-9a-f]{64}$")' relay-image.published.json >/dev/null
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \
             -o /dev/null
 
       - name: Resolve beta channel promotion

.gitignore

@@ -23,11 +23,44 @@ dist-ssr
 # Build outputs - Rust/Tauri
 target/
 **/target/
+.target/
 /.targets/
+# Local evidence working dir (fully ignored; intermediate artifacts go to
+# outside the repo)
+target2/
 # The deployable Rust services use the workspace lockfile for reproducible
 # container builds.
 !Cargo.lock
 
+# Work artifacts that must never enter the repo (S-37/S-56 hygiene):
+# recon/fix/verify/report/sediment intermediates, sync records, ws-check data.
+/docs/plans/RECON-*
+/docs/plans/FIX-*
+/docs/plans/VERIFY-*
+/docs/plans/REPORT-*
+/docs/plans/SEDIMENT-*
+/docs/plans/sync-record-*
+/docs/plans/recon-*
+/docs/plans/fix-*
+/docs/plans/doc-governance-report-*
+/docs/plans/pr-final-*
+/docs/plans/ws-check-*
+/docs/plans/del-*.json
+/docs/plans/侦查-*
+/docs/plans/核对-*
+/docs/plans/核查-*
+/docs/plans/*.log
+/docs/plans/*.json
+/docs/plans/*.cjs
+
+# Local customization docs stay out of the repo (S-56 sanitize)
+
+/docs/功能文档/
+/交接文档-现状与决议.md
+/fix-dualfeed-停止回报.md
+/docs/plans/review-upstream-sync-*
+/docs/features/agent-hot-reload.md
+
 # Monaco Editor - copied from node_modules
 public/monaco-editor/
 src/web-ui/public/monaco-editor/
@@ -91,5 +124,9 @@ external/
 /.bitfun/search/flashgrep-index/
 .agents/
 /.flashgrep-index-engine/
+/src/apps/desktop/.bitfun/search/flashgrep-index/
+/target/debug/.bitfun/search/flashgrep-index/
 
 .design/
+__pycache__/
+*.pyc

BitFun-Installer/src-tauri/src/installer/commands.rs

@@ -402,7 +402,9 @@ unsafe fn windows_sys_get_disk_free_space(
             lpTotalNumberOfFreeBytes: *mut u64,
         ) -> i32;
     }
-    GetDiskFreeSpaceExW(path, free_bytes_available, total_bytes, total_free_bytes)
+    // SAFETY: callers guarantee the pointers reference valid kernel32
+    // arguments; the foreign function only writes through the out-pointers.
+    unsafe { GetDiskFreeSpaceExW(path, free_bytes_available, total_bytes, total_free_bytes) }
 }
 
 #[tauri::command]