build: preserve reusable internal packaging skill

.gitea/workflows/build-windows-jd.yml

@@ -7,7 +7,6 @@ jobs:
   build-windows:
     runs-on: [self-hosted, linux, x64, jd-fd-primary]
     env:
-      HOLOLAKE_VERSION: 0.1.5
       VITE_SENTRY_DSN: ""
       SENTRY_DSN: ""
       VITE_POSTHOG_KEY: ""
@@ -19,7 +18,7 @@ jobs:
       - name: Upload internal installer
         uses: actions/upload-artifact@v4
         with:
-          name: HoloLake-Era-0.1.5-Windows-x64-internal
+          name: HoloLake-Era-Windows-x64-internal
           path: |
             src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
             src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe.sha256

README.md

@@ -19,6 +19,7 @@ Tolaria 人类界面 → 工单 → AI 受控处理 → 回执写入仓库 → T
 - `src/`：React 人类界面与编辑器。
 - `src-tauri/`：Mac、Windows 与 Linux 原生应用层。
 - `.gitea/workflows/`：国内第五域主节点的自动构建。
+- `docs/skills/internal-release-packaging/SKILL.md`：Mac、Windows 内测安装包的可复用构建技能（`HLP-SKILL-RELEASE-001`）。
 - `apps/tolaria/patches/`：迁移阶段的只读历史补丁，保留用于追溯。
 
 ## 研发语言路径

docs/ARCHITECTURE.md

@@ -264,6 +264,10 @@ Desktop startup registers `tauri-plugin-deep-link` and `tauri-plugin-single-inst
 Linux and Windows use custom React-rendered window chrome instead of the native Tauri menu bar. `setup_custom_window_chrome()` drops server-side decorations on the main window, `openNoteInNewWindow()` does the same for detached note windows, and `LinuxTitlebar`/`LinuxMenuButton` route both window controls and menu actions back through the same shared command pipeline that the desktop native menus use. The native app menu is macOS-only so Services/Hide/Quit and the reserved `WINDOW_SUBMENU_ID` keep behaving like normal NSApp menu items, while cross-platform custom items such as Check for Updates emit Tolaria command IDs with visible updater feedback from the renderer menu.
 On Linux, `run()` applies WebKitGTK startup safeguards before Tauri creates the webview. Native Wayland launches and AppImage launches inject `WEBKIT_DISABLE_DMABUF_RENDERER=1` and `WEBKIT_DISABLE_COMPOSITING_MODE=1` independently unless the user already set either variable, covering compositor-specific WebKit crashes without changing native X11 launches. AppImage launches keep the additional AppImage-only safeguards: on Wayland sessions Tolaria re-execs once with the first architecture-matching system `libwayland-client.so` in `LD_PRELOAD` when the user has not provided their own preload. The candidate order prefers Fedora-style `lib64` and Debian-style `x86_64-linux-gnu` paths before generic `/usr/lib`, and the ELF header is checked so a 64-bit Tolaria process does not retry with a 32-bit Wayland client library. Runtime startup writes a mount-path-specific `GTK_IM_MODULE_FILE` cache when fcitx is configured via `GTK_IM_MODULE=fcitx` or common fcitx environment hints; release packaging currently uses Tauri's stock linuxdeploy AppImage output plugin instead of Tolaria's experimental output-plugin shim. If the user has not already chosen `GTK_IM_MODULE`, Tolaria sets `GTK_IM_MODULE=fcitx` before WebKit starts. The same AppImage path checks whether `fc-match` resolves the default emoji font to `Noto-COLRv1.ttf`; when the user has not provided `FONTCONFIG_FILE` or `FONTCONFIG_PATH`, Tolaria writes a cache-local fontconfig file that rejects only that matched font file and exports it before WebKit starts. The rendering overrides keep WebViews from blanking or crashing after accelerated compositing/DMA-BUF failures, the re-exec addresses AppImage library-order failures that can surface as `Could not create default EGL display: EGL_BAD_PARAMETER`, and the fontconfig guard avoids known WebKit crashes in COLRv1 emoji font rendering while leaving other emoji fonts available.
 
+## Domestic internal installer pipeline
+
+Internal HoloLake review artifacts use the repository-owned `scripts/build-internal-release.sh` dispatcher and take their version from `src-tauri/tauri.conf.json`. The macOS lane builds a Tauri app bundle, runs the public-architecture/private-route content gate, applies an ad-hoc deep signature, verifies the bundle, and creates a verified DMG plus SHA-256 file. The JD Linux lane cannot ask Tauri's Linux CLI for an NSIS target, so it uses cargo-xwin to build the PE32+ Windows x64 application, stages the executable with MCP, Agent, and public GLS resources, then invokes `scripts/windows-installer.nsi` directly. The same content gate runs against both the frontend output and Windows stage before the installer is accepted. `docs/skills/internal-release-packaging/SKILL.md` is the recovery and handoff contract for this pipeline; production notarization and publisher signing remain owned by the formal release workflows described by ADR-0131.
+
 ## Multi-Window (Note Windows)
 
 Notes can be opened in separate Tauri windows for focused editing. Secondary windows boot the same `App` shell and load the same active workspace graph as the main window, but they start in the editor-only view mode with side panels collapsed.

docs/adr/0152-domestic-internal-installer-skill.md

@@ -0,0 +1,21 @@
+---
+type: ADR
+id: "0152"
+title: "Domestic internal installer skill and single-version build entrypoint"
+status: active
+date: 2026-07-17
+---
+
+## Context
+
+The general release workflow in ADR-0131 covers signed GitHub alpha and stable artifacts. Domestic HoloLake internal reviews also need repeatable Mac handoffs and Windows x64 installers built on the JD Linux node, where Tauri's Linux CLI does not expose the NSIS bundle target.
+
+## Decision
+
+Internal installers use `src-tauri/tauri.conf.json` as their version source and enter through `scripts/build-internal-release.sh`. macOS uses Tauri's app bundle plus ad-hoc signing and a verified DMG. JD Windows builds use cargo-xwin for the PE32+ x64 application and a repository-owned NSIS definition for the installer. Both paths run the public-marker/private-route content gate and produce SHA-256 files.
+
+The operational recovery contract is stored at `docs/skills/internal-release-packaging/SKILL.md` under route `HLP-SKILL-RELEASE-001`.
+
+## Consequences
+
+Version upgrades no longer require editing the JD workflow artifact name or copying commands from a prior conversation. Internal artifacts remain explicitly distinct from notarized macOS and Authenticode-signed Windows production releases.

docs/skills/internal-release-packaging/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: hololake-internal-release-packaging
+description: Build, validate, archive, and hand off repeatable HoloLake Era internal installers for macOS and Windows.
+route_id: HLP-SKILL-RELEASE-001
+---
+
+# HoloLake Era 内测安装包技能
+
+当任务包含“打包新版”“生成 Mac/Windows 安装包”“把安装包放到桌面”或“恢复上次打包方法”时使用本技能。
+
+## 唯一版本源
+
+`src-tauri/tauri.conf.json` 的 `version` 是内测构建唯一版本源。`package.json` 与 `src-tauri/Cargo.toml` 应在版本提交中同步更新。构建脚本会拒绝 `HOLOLAKE_VERSION` 与配置版本不一致的请求，避免文件名、应用版本与仓库状态分叉。
+
+## 固定入口
+
+```bash
+pnpm test:internal-release
+pnpm package:internal:macos
+pnpm package:internal:windows
+```
+
+- macOS 必须在 Apple Silicon Mac 上执行，产物默认进入 `artifacts/internal/<version>/`。
+- Windows 必须在 `JD-FD-PRIMARY` Linux 构建节点执行。脚本使用 `cargo-xwin` 生成 x86-64 Windows 本体，再使用 NSIS 生成安装程序。
+- 京东节点使用 `scripts/cargo-config-jd.toml` 的国内稀疏索引；不要临时改回境外 crates.io 下载路径。
+
+## 构建前检查
+
+1. 工作树干净，当前分支包含目标 UI 和资源。
+2. `tauri.conf.json`、`Cargo.toml`、`package.json` 版本一致。
+3. 运行相关测试、lint、TypeScript/Vite 构建。
+4. 确认公共研发入口和 GLS 文件已经进入源码：
+   - `https://guanghulab.com/fifth-domain/bingshuo/hololake-platform`
+   - `src-tauri/resources/public-architecture/gls-system-architecture.json`
+5. 不把服务器密钥、邮箱授权码、令牌或私人域内容写入仓库和安装包。
+
+## 强制验收
+
+`scripts/verify-internal-package-content.mjs` 是发布硬门：
+
+- 必须找到公共研发仓库标记；
+- 必须找到 `GLS-SYS-ARCH-001`；
+- 发现私人域标记立即失败；
+- Mac 必须通过 `codesign --verify --deep --strict` 与 `hdiutil verify`；
+- Windows 载荷必须为 `PE32+ x86-64`，NSIS 安装包必须存在；
+- 每个安装包必须生成同名 `.sha256`，回传后再次校验。
+
+内测 Mac 包是 ad-hoc 签名、未公证；Windows 包在没有商业证书时未做 Authenticode 签名。交付时必须明确说明，不能描述成正式签名发行版。
+
+## Windows 构建恢复顺序
+
+1. `pnpm install --frozen-lockfile`
+2. Tauri `--no-bundle` + `cargo-xwin` 交叉编译 Windows x64 本体
+3. 将应用、本地图标、MCP、Agent 文档和公共 GLS 资源组成 stage
+4. `scripts/windows-installer.nsi` 生成单用户 NSIS 安装包
+5. 对 `dist` 与 stage 运行内容校验
+6. 生成 SHA-256，并归档到服务器的版本目录
+
+Linux 上的 Tauri CLI 不提供 `nsis` bundle target。不要再次尝试 `tauri build --bundles nsis`；这正是本仓库将“交叉编译”和“NSIS 封装”拆开的原因。
+
+## 故障护栏
+
+- `No matching runner`：是 runner/标签状态，不是应用源码错误；可直接登录已授权的 JD 节点运行同一脚本。
+- crates.io 或 Rust 下载过慢：保留 rsproxy 配置和独立 `CARGO_HOME`。
+- NSIS 找不到图标或 stage：所有传给 NSIS 的路径必须是绝对路径。
+- Windows 链接器报告缺少外部 PDB 的 `LNK4099`：交叉编译的调试信息警告；只有最终链接失败或没有生成 PE32+ x64 本体才算失败。
+- 产物已生成但未回传：不算完成；服务器归档、桌面回传、二次校验是同一个闭环。
+
+## 仓库回写
+
+每次修正构建方法后，将脚本、技能文档和验证结果提交到国内主仓库。发布技能属于 `bingshuo/hololake-platform`，不要写入 REPO-004 零件库。线上主分支能够读到本技能后，才算方法完成沉淀。

package.json

@@ -28,6 +28,9 @@
     "playwright:integration": "playwright test --config playwright.integration.config.ts",
     "test:coverage": "node scripts/run-vitest-coverage.mjs",
     "verify:internal-package": "node scripts/verify-internal-package-content.mjs",
+    "test:internal-release": "node --test scripts/internal-release-version.test.mjs",
+    "package:internal:macos": "./scripts/build-internal-release.sh macos",
+    "package:internal:windows": "./scripts/build-internal-release.sh windows",
     "prepare": "husky"
   },
   "dependencies": {

scripts/build-internal-release.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+platform="${1:-}"
+
+case "$platform" in
+  macos)
+    exec "$repo_root/scripts/build-macos-internal.sh"
+    ;;
+  windows)
+    exec "$repo_root/scripts/build-windows-jd-cross.sh"
+    ;;
+  *)
+    echo "Usage: ./scripts/build-internal-release.sh <macos|windows>" >&2
+    exit 2
+    ;;
+esac

scripts/build-macos-internal.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+[[ "$(uname -s)" == "Darwin" ]] || { echo "macOS internal packages must be built on macOS." >&2; exit 2; }
+
+target="${HOLOLAKE_MAC_TARGET:-aarch64-apple-darwin}"
+version="$(node scripts/internal-release-version.mjs src-tauri/tauri.conf.json "${HOLOLAKE_VERSION:-}")"
+output_dir="${HOLOLAKE_OUTPUT_DIR:-$repo_root/artifacts/internal/$version}"
+bundle_dir="$repo_root/src-tauri/target/$target/release/bundle/macos"
+app="$bundle_dir/HoloLake Era.app"
+installer="$output_dir/HoloLake-Era-$version-Mac-internal-aarch64.dmg"
+
+command -v pnpm >/dev/null || { echo "pnpm is required." >&2; exit 2; }
+command -v hdiutil >/dev/null || { echo "hdiutil is required." >&2; exit 2; }
+mkdir -p "$output_dir"
+
+pnpm install --frozen-lockfile
+pnpm tauri build --target "$target" --bundles app
+[[ -d "$app" ]] || { echo "No macOS application bundle was produced: $app" >&2; exit 1; }
+
+pnpm verify:internal-package "$app"
+codesign --force --deep --sign - "$app"
+codesign --verify --deep --strict "$app"
+hdiutil create -volname "HoloLake Era $version Internal" -srcfolder "$app" -ov -format UDZO "$installer"
+hdiutil verify "$installer"
+shasum -a 256 "$installer" | sed "s#  .*#  $(basename "$installer")#" > "$installer.sha256"
+echo "$installer"

scripts/build-windows-jd-cross.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-version="${HOLOLAKE_VERSION:-0.1.5}"
 target="x86_64-pc-windows-msvc"
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
@@ -19,6 +18,7 @@ if command -v apt-get >/dev/null 2>&1; then
 fi
 
 command -v node >/dev/null || { echo "Node.js is required." >&2; exit 2; }
+version="$(node scripts/internal-release-version.mjs src-tauri/tauri.conf.json "${HOLOLAKE_VERSION:-}")"
 export PATH="$HOME/.cargo/bin:$PATH"
 
 if ! command -v cargo >/dev/null 2>&1; then

scripts/internal-release-version.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+import { readFile } from 'node:fs/promises'
+import { pathToFileURL } from 'node:url'
+
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
+
+export async function resolveInternalReleaseVersion(configPath, explicitVersion = '') {
+  const config = JSON.parse(await readFile(configPath, 'utf8'))
+  const configuredVersion = String(config.version ?? '').trim()
+
+  if (!SEMVER.test(configuredVersion)) {
+    throw new Error(`tauri.conf.json must contain a valid semantic version; received: ${configuredVersion || '<empty>'}`)
+  }
+
+  const requestedVersion = explicitVersion.trim()
+  if (requestedVersion && requestedVersion !== configuredVersion) {
+    throw new Error(`Requested version ${requestedVersion} does not match configured version ${configuredVersion}`)
+  }
+
+  return configuredVersion
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const configPath = process.argv[2]
+  if (!configPath) {
+    console.error('Usage: node scripts/internal-release-version.mjs <tauri.conf.json> [expected-version]')
+    process.exit(2)
+  }
+
+  try {
+    console.log(await resolveInternalReleaseVersion(configPath, process.argv[3] ?? ''))
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error))
+    process.exit(1)
+  }
+}

scripts/internal-release-version.test.mjs

@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict'
+import { mkdtemp, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+
+import { resolveInternalReleaseVersion } from './internal-release-version.mjs'
+
+test('reads the version from tauri.conf.json', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'hololake-release-version-'))
+  await writeFile(join(root, 'tauri.conf.json'), JSON.stringify({ version: '1.2.3' }))
+
+  assert.equal(await resolveInternalReleaseVersion(join(root, 'tauri.conf.json')), '1.2.3')
+})
+
+test('accepts an explicit matching version', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'hololake-release-version-'))
+  await writeFile(join(root, 'tauri.conf.json'), JSON.stringify({ version: '1.2.3' }))
+
+  assert.equal(await resolveInternalReleaseVersion(join(root, 'tauri.conf.json'), '1.2.3'), '1.2.3')
+})
+
+test('rejects a version that differs from the application configuration', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'hololake-release-version-'))
+  await writeFile(join(root, 'tauri.conf.json'), JSON.stringify({ version: '1.2.3' }))
+
+  await assert.rejects(
+    resolveInternalReleaseVersion(join(root, 'tauri.conf.json'), '1.2.4'),
+    /does not match configured version 1\.2\.3/,
+  )
+})
+
+test('rejects malformed configured versions', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'hololake-release-version-'))
+  await writeFile(join(root, 'tauri.conf.json'), JSON.stringify({ version: 'tomorrow' }))
+
+  await assert.rejects(
+    resolveInternalReleaseVersion(join(root, 'tauri.conf.json')),
+    /valid semantic version/,
+  )
+})

scripts/windows-installer.nsi

@@ -19,11 +19,13 @@ InstallDirRegKey HKCU "Software\Guanghu\HoloLake Era" "InstallDir"
 Icon "${STAGE_DIR}/icon.ico"
 UninstallIcon "${STAGE_DIR}/icon.ico"
 
-VIProductVersion "0.1.5.0"
+VIProductVersion "${APP_VERSION}.0"
 VIAddVersionKey "ProductName" "HoloLake Era"
 VIAddVersionKey "ProductVersion" "${APP_VERSION}"
+VIAddVersionKey "FileVersion" "${APP_VERSION}"
 VIAddVersionKey "CompanyName" "Guanghu Language World"
 VIAddVersionKey "FileDescription" "HoloLake Era internal installer"
+VIAddVersionKey "LegalCopyright" "Guanghu Language World"
 
 Page directory
 Page instfiles