From 473cf7e92bb911950545bb0ab1b324a8455c7045 Mon Sep 17 00:00:00 2001
From: lanrtop <lanrtop@gmail.com>
Date: Wed, 15 Jul 2026 19:53:47 +0900
Subject: [PATCH] =?UTF-8?q?fix(onboarding/dispatch):=20=E7=A9=BA=E8=B7=AF?=
 =?UTF-8?q?=E5=BE=84=E7=99=BB=E8=AE=B0=E9=98=B2=E6=8A=A4=E2=80=94=E2=80=94?=
 =?UTF-8?q?=E6=8B=92=E7=BB=9D=E5=88=86=E5=8F=91=E8=80=8C=E9=9D=9E=E5=86=99?=
 =?UTF-8?q?=E8=BF=9B=E8=BF=9B=E7=A8=8B=20cwd?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

批量实调实锤：两条空路径登记（银龙集团应用/agent编排界面）使
Path::new("") 变相对路径，接入包整套写进了 dev 进程的 src-tauri/。
apply_onboarding_pack 入口拦截空/不存在路径（单点防护），批量 SQL
同步过滤空串，回归测试驻军。

Rules-Applied: R06,R07
---
 src-tauri/src/commands/onboarding.rs | 18 ++++++++++++++++++
 src-tauri/src/mcp_tools.rs           |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src-tauri/src/commands/onboarding.rs b/src-tauri/src/commands/onboarding.rs
index db92a32..828cd27 100644
--- a/src-tauri/src/commands/onboarding.rs
+++ b/src-tauri/src/commands/onboarding.rs
@@ -264,6 +264,12 @@ pub fn apply_onboarding_pack(
     project_path: String,
     project_id: String,
 ) -> Result<OnboardingReport, String> {
+    // 空/无效路径必须在此拦截：Path::new("") 是相对路径，模板会写进炼境进程的
+    // cwd（2026-07-15 批量实调实锤：空路径登记把接入包写进了 src-tauri/）
+    let root = Path::new(project_path.trim_end_matches(['/', '\\']));
+    if project_path.trim().is_empty() || !root.is_dir() {
+        return Err(format!("项目路径为空或不存在，拒绝分发: {project_path:?}"));
+    }
     let templates = dispatch_templates(&project_path);
     let hook = run_lefthook_install(Path::new(project_path.trim_end_matches(['/', '\\'])));
     let buff = crate::commands::buff::apply_blueprint_buff(project_path, project_id)?;
@@ -728,6 +734,18 @@ mod tests {
         assert!(!check_managed_version(Some("手写内容，无标记"), expected).0, "无标记应 fail");
     }
 
+    /// 回归：空路径登记曾把接入包写进炼境进程 cwd（src-tauri/，2026-07-15 批量实调实锤）。
+    #[test]
+    fn apply_rejects_empty_or_missing_path() {
+        let err = apply_onboarding_pack(String::new(), "p".into()).unwrap_err();
+        assert!(err.contains("拒绝分发"), "空路径应拒绝: {err}");
+        let err = apply_onboarding_pack("  ".into(), "p".into()).unwrap_err();
+        assert!(err.contains("拒绝分发"), "空白路径应拒绝: {err}");
+        let err =
+            apply_onboarding_pack("E:/不存在的目录/xyz-404".into(), "p".into()).unwrap_err();
+        assert!(err.contains("拒绝分发"), "不存在路径应拒绝: {err}");
+    }
+
     // ── U1：全托管文件三态 + lefthook 检查段自省 ─────────────────────────────
 
     #[test]
diff --git a/src-tauri/src/mcp_tools.rs b/src-tauri/src/mcp_tools.rs
index a02ea9c..3ea0e9c 100644
--- a/src-tauri/src/mcp_tools.rs
+++ b/src-tauri/src/mcp_tools.rs
@@ -613,7 +613,7 @@ pub async fn tools_call(params: Option<&Value>) -> Value {
             let conn = db::pool().get().map_err(|e| e.to_string())?;
             let targets: Vec<(String, String)> = {
                 let mut stmt = conn
-                    .prepare("SELECT id, win_path FROM project_workspaces WHERE win_path IS NOT NULL")
+                    .prepare("SELECT id, win_path FROM project_workspaces WHERE win_path IS NOT NULL AND TRIM(win_path) != ''")
                     .map_err(|e| e.to_string())?;
                 let rows = stmt
                     .query_map([], |r| Ok((r.get(0)?, r.get(1)?)))