chore: 保存工作副本——客户端授权新契约(双端点/验签/令牌/周检)与桌面会话可靠性改进

scripts/build.sh

@@ -176,10 +176,23 @@ esac
 node scripts/release-preflight.mjs "$RELEASE_PLATFORM"
 
 log "构建原生安装包"
+TAURI_ARGS=(--ci --target "$RUST_TARGET")
+CODESIGN_WRAP_DIR=""
 if [ "$RELEASE_PLATFORM" = "macos" ]; then
-  npx tauri build --ci --target "$RUST_TARGET" --bundles app,dmg
-else
-  npx tauri build --ci --target "$RUST_TARGET"
+  TAURI_ARGS+=(--bundles app,dmg)
+  CODESIGN_WRAP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/opsx-codesign.XXXXXX")"
+  cp "$ROOT_DIR/scripts/macos-codesign-wrapper.sh" "$CODESIGN_WRAP_DIR/codesign"
+  chmod +x "$CODESIGN_WRAP_DIR/codesign"
+  export PATH="$CODESIGN_WRAP_DIR:$PATH"
+  log "macOS 签名使用 HTTP 时间戳（可用 CODESIGN_USE_SYSTEM_TIMESTAMP=1 关闭）"
+fi
+if [ -f "$ROOT_DIR/src-tauri/tauri.signing.conf.json" ]; then
+  TAURI_ARGS+=(--config src-tauri/tauri.signing.conf.json)
+  log "使用 src-tauri/tauri.signing.conf.json 签名"
+fi
+npx tauri build "${TAURI_ARGS[@]}"
+if [ -n "$CODESIGN_WRAP_DIR" ]; then
+  rm -rf "$CODESIGN_WRAP_DIR"
 fi
 
 BUNDLE_ROOT="${CARGO_TARGET_DIR:-$ROOT_DIR/src-tauri/target}/$RUST_TARGET/release/bundle"