fix(onboarding/dispatch): 空路径登记防护——拒绝分发而非写进进程 cwd

批量实调实锤：两条空路径登记（银龙集团应用/agent编排界面）使
Path::new("") 变相对路径，接入包整套写进了 dev 进程的 src-tauri/。
apply_onboarding_pack 入口拦截空/不存在路径（单点防护），批量 SQL
同步过滤空串，回归测试驻军。

Rules-Applied: R06,R07

src-tauri/src/commands/onboarding.rs

@@ -264,6 +264,12 @@ pub fn apply_onboarding_pack(
     project_path: String,
     project_id: String,
 ) -> Result<OnboardingReport, String> {
+    // 空/无效路径必须在此拦截：Path::new("") 是相对路径，模板会写进炼境进程的
+    // cwd（2026-07-15 批量实调实锤：空路径登记把接入包写进了 src-tauri/）
+    let root = Path::new(project_path.trim_end_matches(['/', '\\']));
+    if project_path.trim().is_empty() || !root.is_dir() {
+        return Err(format!("项目路径为空或不存在，拒绝分发: {project_path:?}"));
+    }
     let templates = dispatch_templates(&project_path);
     let hook = run_lefthook_install(Path::new(project_path.trim_end_matches(['/', '\\'])));
     let buff = crate::commands::buff::apply_blueprint_buff(project_path, project_id)?;
@@ -728,6 +734,18 @@ mod tests {
         assert!(!check_managed_version(Some("手写内容，无标记"), expected).0, "无标记应 fail");
     }
 
+    /// 回归：空路径登记曾把接入包写进炼境进程 cwd（src-tauri/，2026-07-15 批量实调实锤）。
+    #[test]
+    fn apply_rejects_empty_or_missing_path() {
+        let err = apply_onboarding_pack(String::new(), "p".into()).unwrap_err();
+        assert!(err.contains("拒绝分发"), "空路径应拒绝: {err}");
+        let err = apply_onboarding_pack("  ".into(), "p".into()).unwrap_err();
+        assert!(err.contains("拒绝分发"), "空白路径应拒绝: {err}");
+        let err =
+            apply_onboarding_pack("E:/不存在的目录/xyz-404".into(), "p".into()).unwrap_err();
+        assert!(err.contains("拒绝分发"), "不存在路径应拒绝: {err}");
+    }
+
     // ── U1：全托管文件三态 + lefthook 检查段自省 ─────────────────────────────
 
     #[test]

src-tauri/src/mcp_tools.rs

@@ -613,7 +613,7 @@ pub async fn tools_call(params: Option<&Value>) -> Value {
             let conn = db::pool().get().map_err(|e| e.to_string())?;
             let targets: Vec<(String, String)> = {
                 let mut stmt = conn
-                    .prepare("SELECT id, win_path FROM project_workspaces WHERE win_path IS NOT NULL")
+                    .prepare("SELECT id, win_path FROM project_workspaces WHERE win_path IS NOT NULL AND TRIM(win_path) != ''")
                     .map_err(|e| e.to_string())?;
                 let rows = stmt
                     .query_map([], |r| Ok((r.get(0)?, r.get(1)?)))