sync: taiji 定制版同步最新基线 8d810b99e（LegionCard 样式统一 + 群聊 P0 修复）

.github/workflows/ci-custom.yml

@@ -0,0 +1,154 @@
+# 玫瑰军团 · 本地定制门禁（fork 独立 workflow，白嫖远程 CI）
+#
+# 定位：上游 ci.yml（GCWing/BitFun）只覆盖官方 8 job（rust 3OS / cli-test / deny /
+#       frontend 三连审计 / vitest / web build）。本文件补上游盲区 =
+#       clippy 0 warning + cargo fmt --check + 定制 crate 全量测试。
+# 原则：custom-* job 命名前缀，与上游 job 错开；独立文件 = 上游同步零冲突（U-3 经验）；
+#       公开仓 = GitHub Actions 免费额度，白嫖远程算力。
+# 触发：仅 push main（不跑 PR——PR 面有上游 ci.yml 把关，本文件专盯 main 定制成果）。
+name: CI Custom (Rose Legion)
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'png/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-custom-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ── 定制 Rust crate 全量测试（上游只测 subscription-auth / search:: 子集）──
+  custom-rust-tests:
+    name: Custom Rust Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      RUSTFLAGS: "-D warnings"
+      CARGO_TERM_COLOR: never
+    steps:
+      - uses: actions/checkout@v5
+
+      # Tauri code generation only requires its configured resource roots to
+      # exist during check/test (mirrors upstream ci.yml step).
+      - name: Create Tauri resource directories
+        shell: bash
+        run: mkdir -p dist src/mobile-web/dist
+
+      - name: Install Linux system dependencies (Tauri)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf \
+            libxdo-dev libssl-dev pkg-config build-essential \
+            libleptonica-dev libtesseract-dev tesseract-ocr tesseract-ocr-eng
+
+      - uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: custom-rust-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            custom-rust-${{ runner.os }}-
+
+      - name: Install Rust toolchain (stable)
+        run: rustup toolchain install stable --profile minimal
+
+      - name: Cargo fmt check (0 容忍)
+        run: cargo fmt --all -- --check
+
+      - name: Clippy all targets (0 warning)
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Test ai-adapters full suite
+        # 上游只跑 subscription-auth 子集；本地门禁 = 全量（R-CB 指纹头等定制在此）
+        run: cargo test --locked -p bitfun-ai-adapters
+
+      - name: Test tool-runtime full suite
+        # 上游只跑 search:: 子集；全量覆盖本地群聊/legion/幽灵删除等定制工具
+        run: cargo test --locked -p tool-runtime
+
+      - name: Test assembly core library
+        # 上游只跑 bitfun-core --lib（单测）；本 job 跑全量（含集成测试）
+        # = 定制核心（群聊/steering/warden）测试盲区补全
+        # 不用 --lib：全量 target 编译才覆盖 configured_* 等 pub(crate) 辅助
+        # 函数的所有调用点（--lib + RUSTFLAGS=-D warnings 会把 unused 误报为 error）
+        run: cargo test --locked -p bitfun-core
+
+  # ── 仓库卫生 + 定制符号留存检查 ──
+  custom-hygiene:
+    name: Custom Hygiene
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Verify local CI replica stays in sync with remote ci.yml
+        # 上游 ci.yml 新增/变更检查项 → local-replica.ps1 必须同步覆盖（总纲 §四 第9项）
+        # 探测 local-replica.ps1 实际步骤名（中文别名），对应上游 ci.yml 英文步骤：
+        #   Check compilation → workspace 编译检查
+        #   Run core and desktop library tests → core + desktop 库测试
+        #   Validate i18n contract → i18n 契约（CI profile）
+        #   Lint web UI → web-ui lint（--max-warnings=0）
+        run: |
+          set -euo pipefail
+          for step in "workspace 编译检查" "core + desktop 库测试" "i18n 契约（CI profile）" "web-ui lint（--max-warnings=0）"; do
+            grep -qF "$step" scripts/ci/local-replica.ps1 || {
+              echo "::error::local-replica.ps1 缺少上游 ci.yml 步骤对应项: $step（CI 标准同步核对，总纲 §四 第9项）"
+              exit 1
+            }
+          done
+          echo "local-replica.ps1 覆盖核对通过"
+
+      - name: Reject conflict markers
+        run: |
+          set -euo pipefail
+          if git grep -nE '^(<<<<<<<|=======|>>>>>>>)' -- ':!*.lock' | grep -q .; then
+            echo "::error::冲突标记残留（M-2）"
+            exit 1
+          fi
+          echo "无冲突标记"
+
+      - name: Reject CRLF in shell and deploy assets
+        run: |
+          set -euo pipefail
+          bad=$(git ls-files -z '*.sh' '*.bash' 'Dockerfile' 'Dockerfile.*' '*.Dockerfile' 'Caddyfile' 'docker-compose.yml' 'docker-compose.*.yml' | xargs -0 -r grep -lU $'\r' || true)
+          if [ -n "$bad" ]; then
+            echo "::error::CRLF line endings found:"
+            echo "$bad"
+            exit 1
+          fi
+          echo "All shell and deploy assets are LF-only."
+
+  # ── gitleaks 门禁化（S-9 敏感/安全：全仓敏感扫描，发现真实凭据即 exit 非 0 失败）──
+  # 去伪凭据 = .gitleaks.toml（经人工核实 2026-08-23 的伪阳性：代码字段名/哈希/公钥/测试占位）
+  # 不用 gitleaks-action（org 账户需 GITLEAKS_LICENSE + GITHUB_TOKEN 评论依赖）；
+  # 直接下载 pin v8.30.1 二进制跑 detect，门禁化 = 发现凭据 exit 非 0 失败。
+  gitleaks-secret-scan:
+    name: Gitleaks Secret Scan (门禁化)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Download gitleaks (pinned v8.30.1)
+        run: |
+          set -euo pipefail
+          GL_VERSION="8.30.1"
+          curl -sfL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VERSION}/gitleaks_${GL_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tar.gz
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp
+
+      - name: Gitleaks detect (发现真实凭据即失败)
+        run: |
+          set -euo pipefail
+          /tmp/gitleaks detect --source . --config .gitleaks.toml --redact --no-banner

.github/workflows/ci.yml

@@ -113,6 +113,9 @@ jobs:
     if: ${{ !cancelled() && needs.rust-impact.outputs.rust_required != 'false' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
+    env:
+      # Same warning gate as rust-build-check.
+      RUSTFLAGS: "-D warnings"
     strategy:
       fail-fast: false
       matrix:
@@ -167,16 +170,57 @@ jobs:
           cargo test --locked -p terminal-core background_only_binding_is_owned_by_the_session -- --test-threads=1
 
   # ── Rust: build check ─────────────────────────────────────────────
+  # Cargo-deny gate: advisories + licenses + sources (+ bans at warn level).
+  # Kept on Linux only - the license/source graph is OS-independent, so a
+  # single check covers the whole workspace without triplicating the run.
+  cargo-deny:
+    name: Cargo Deny (advisories + licenses)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: "cargo-deny-v1"
+          cache-bin: false
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --locked --version 0.20.2
+
+      - name: Deny advisories
+        run: cargo deny check advisories
+
+      - name: Deny licenses
+        # -A no-license-field silences the diagnostic for crates that declare
+        # `license-file` instead of the SPDX `license` expression field
+        # (display-info 0.4.8 via screenshots); the actual LICENSE text is
+        # still parsed and gated by the allow list below.
+        run: cargo deny check licenses -A no-license-field
+
+      - name: Deny sources
+        run: cargo deny check sources
+
   rust-build-check:
     name: Rust Build Check (${{ matrix.os }})
     needs: rust-impact
     if: ${{ !cancelled() && needs.rust-impact.outputs.rust_required != 'false' }}
     runs-on: ${{ matrix.os }}
+    # Rust workspace check + 6 test groups across 3 OS; generous but bounded
+    # so a wedged dependency/network cannot burn the full 6h default.
+    timeout-minutes: 60
     env:
       # Keep the workspace check plus desktop test profiles within hosted-runner disk limits.
       CARGO_INCREMENTAL: "0"
       CARGO_PROFILE_DEV_DEBUG: "0"
       CARGO_PROFILE_TEST_DEBUG: "0"
+      # Warning gate: any rustc warning (dead code, unused imports, ...) fails
+      # the build, so a warning regression cannot re-enter silently. The
+      # linker_messages lint intentionally ignores -D warnings (see workspace
+      # lints), so MSVC link noise stays non-fatal.
+      RUSTFLAGS: "-D warnings"
     strategy:
       fail-fast: false
       matrix:
@@ -235,6 +279,50 @@ jobs:
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
           cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
+      # sherpa-onnx-sys downloads its native static libraries from GitHub
+      # Releases at build time. Hosted runners intermittently fail that
+      # download (network/rate limits), so pre-fetch and extract the archive
+      # here, then point SHERPA_ONNX_LIB_DIR at the extracted lib directory.
+      # The build script uses that variable directly without any cache/rerun
+      # logic, so both `cargo check` and `cargo test` link against the same
+      # pre-fetched libraries. Windows is skipped: its archive is already
+      # cached in the rust-cache path and the previous failures were Linux and
+      # macOS only.
+      - name: Pre-download sherpa-onnx native libraries
+        if: runner.os != 'Windows'
+        shell: bash
+        env:
+          SHERPA_VERSION: "1.13.4"
+        run: |
+          set -euo pipefail
+          case "${{ runner.os }}" in
+            Linux)
+              archive="sherpa-onnx-v${SHERPA_VERSION}-linux-x64-static-lib.tar.bz2"
+              ;;
+            macOS)
+              archive="sherpa-onnx-v${SHERPA_VERSION}-osx-arm64-static-lib.tar.bz2"
+              ;;
+            *)
+              exit 0
+              ;;
+          esac
+          mkdir -p "$RUNNER_TEMP/sherpa-onnx-libs"
+          archive_path="$RUNNER_TEMP/sherpa-onnx-libs/$archive"
+          if [ ! -f "$archive_path" ]; then
+            curl -fL --retry 5 --retry-all-errors \
+              "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${SHERPA_VERSION}/${archive}" \
+              -o "$archive_path"
+          fi
+          lib_dir="$RUNNER_TEMP/sherpa-onnx-libs/lib"
+          if [ ! -d "$lib_dir" ]; then
+            tar -xjf "$archive_path" -C "$RUNNER_TEMP/sherpa-onnx-libs"
+            # The archive extracts to a versioned directory; its lib/ is the
+            # native library directory the build script expects.
+            lib_dir="$(find "$RUNNER_TEMP/sherpa-onnx-libs" -maxdepth 2 -type d -name lib | head -n 1)"
+          fi
+          test -n "$lib_dir" && test -f "$lib_dir/libsherpa-onnx-c-api.a"
+          echo "SHERPA_ONNX_LIB_DIR=$lib_dir" >> "$GITHUB_ENV"
+
       # rust-cache prunes the workspace target directory before saving it, so
       # native libraries stored under target need an independent cache lifecycle.
       - name: Restore Sherpa native libraries
@@ -406,6 +494,9 @@ jobs:
   frontend-build:
     name: Frontend Build
     runs-on: ubuntu-latest
+    # Full web-ui test + build + i18n audits; bounded so a stuck install or
+    # test cannot burn the full 6h default.
+    timeout-minutes: 40
     env:
       NODE_OPTIONS: --max-old-space-size=6144
     steps:
@@ -466,7 +557,9 @@ jobs:
         run: pnpm run verify:webkit-compatibility:test
 
       - name: Lint web UI
-        run: pnpm run lint:web
+        # Warning gate: any eslint warning (not just errors) fails the job so
+        # lint regressions cannot re-enter silently.
+        run: pnpm --dir src/web-ui exec eslint . --max-warnings=0
 
       - name: Run web UI tests
         run: pnpm --dir src/web-ui run test:run

.github/workflows/desktop-package.yml

@@ -46,6 +46,7 @@ jobs:
   prepare:
     name: Prepare
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       version: ${{ steps.meta.outputs.version }}
       release_tag: ${{ steps.meta.outputs.release_tag }}
@@ -140,11 +141,15 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     needs: prepare
     if: needs.prepare.outputs.relay_image_only != 'true'
+    # Release packaging: full release-profile build + bundles per platform.
+    # 6h default is far too long for a wedged job; cap it at 120m.
+    timeout-minutes: 120
     env:
       NODE_OPTIONS: --max-old-space-size=6144
       BITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }}
       BITFUN_RELEASE_CHANNEL: ${{ needs.prepare.outputs.release_channel }}
-      TAURI_UPDATER_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || '' }}
+      # 本侧定制：stable 直链 latest.json（updater 常规路径）
+      TAURI_UPDATER_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || format('https://github.com/{0}/releases/latest/download/latest.json', github.repository) }}
       TAURI_UPDATER_FALLBACK_ENDPOINT: ${{ github.repository != 'GCWing/BitFun' && needs.prepare.outputs.release_channel == 'beta' && format('https://github.com/{0}/releases/download/channel-beta/latest.json', github.repository) || '' }}
       TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
       # Same trust root, compiled into the Desktop binary so one-click relay
@@ -346,6 +351,7 @@ jobs:
   publish-relay-image:
     name: Publish Relay Server Image
     needs: [prepare, linux-binaries]
+    timeout-minutes: 60
     if: >-
       always() &&
       ((needs.prepare.outputs.upload_to_release == 'true' &&
@@ -358,7 +364,7 @@ jobs:
       contents: write
       packages: write
     env:
-      IMAGE: ghcr.io/gcwing/bitfun-relay-server
+      IMAGE: ghcr.io/${{ github.repository_owner }}/bitfun-relay-server
 
     steps:
       - name: Checkout
@@ -384,7 +390,7 @@ jobs:
           set -euo pipefail
           mkdir -p linux-release-assets
           gh release download "${RELEASE_TAG}" \
-            --repo GCWing/BitFun \
+            --repo "${{ github.repository }}" \
             --dir linux-release-assets \
             --pattern 'bitfun-relay-server-*.tar.gz' \
             --pattern 'bitfun-relay-server-*.tar.gz.sha256'
@@ -432,7 +438,7 @@ jobs:
             if [[ "${IMAGE_ONLY}" == "true" ]]; then
               # Backfilling an older release must not roll the floating tag
               # backwards. GitHub's latest endpoint excludes prereleases.
-              latest_release="$(gh api repos/GCWing/BitFun/releases/latest --jq .tag_name)"
+              latest_release="$(gh api repos/${{ github.repository }}/releases/latest --jq .tag_name)"
               if [[ "${RELEASE_TAG}" == "${latest_release}" ]]; then
                 echo "${IMAGE}:latest"
               fi
@@ -538,6 +544,7 @@ jobs:
   upload-release-assets:
     name: Upload Release Assets
     needs: [prepare, package, linux-binaries, publish-relay-image]
+    timeout-minutes: 30
     if: >-
       always() &&
       needs.prepare.outputs.upload_to_release == 'true' &&
@@ -637,7 +644,7 @@ jobs:
             --assets-dir linux-release-assets \
             --version "${{ needs.prepare.outputs.version }}" \
             --tag "${{ needs.prepare.outputs.release_tag }}" \
-            --repo "GCWing/BitFun" \
+            --repo "${{ github.repository }}" \
             --out linux-release-assets/linux-binaries.json
 
       # The Tauri bundler signs the five updater artifacts during `tauri build`,
@@ -748,7 +755,7 @@ jobs:
         if: needs.prepare.outputs.release_channel == 'stable'
         run: |
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
             -o linux-binaries.published.json
           test "$(jq -r '.version' linux-binaries.published.json)" = "${{ needs.prepare.outputs.version }}"
           while IFS= read -r cli_url; do
@@ -760,13 +767,13 @@ jobs:
         if: needs.prepare.outputs.release_channel == 'stable'
         run: |
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \
             -o relay-image.published.json
           test "$(jq -r '.tag' relay-image.published.json)" = "${{ needs.prepare.outputs.release_tag }}"
-          test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/gcwing/bitfun-relay-server"
+          test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/${{ github.repository_owner }}/bitfun-relay-server"
           jq -e '.digest | test("^sha256:[0-9a-f]{64}$")' relay-image.published.json >/dev/null
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \
             -o /dev/null
 
       - name: Resolve beta channel promotion