更新

app/scripts/check_macos_entrypoints.sh

@@ -5,6 +5,7 @@ script_dir="$(cd "$(dirname "$0")" && pwd -P)"
 project_root="$(cd "$script_dir/.." && pwd -P)"
 
 operational_files=(
+  "$script_dir/check_macos_entrypoints.sh"
   "$script_dir/macos_helpers.sh"
   "$script_dir/run_macos.sh"
   "$script_dir/package_macos.sh"
@@ -18,14 +19,28 @@ operational_files=(
 for file in "${operational_files[@]}"; do
   [[ -f "$file" ]] || { printf 'Missing macOS entry file: %s\n' "$file" >&2; exit 1; }
   /bin/bash -n "$file"
+  [[ -x "$file" ]] || { printf 'macOS entry is not executable: %s\n' "$file" >&2; exit 1; }
 done
-for file in \
-  "$project_root/一键运行.command" \
-  "$project_root/一键打包.command" \
-  "$project_root/run_macos.command" \
-  "$project_root/package_macos.command"; do
-  [[ -x "$file" ]] || { printf 'Finder entry is not executable: %s\n' "$file" >&2; exit 1; }
-done
+
+# A Windows checkout can report every shell file as executable even when Git
+# records mode 100644.  Check the index as well so a fresh macOS clone retains
+# Finder/CLI launchability.  Source archives without .git still use the -x gate
+# above.
+if command -v git >/dev/null 2>&1 && \
+  git -C "$project_root" rev-parse --is-inside-work-tree >/dev/null 2>&1 && \
+  git -C "$project_root" ls-files --error-unmatch -- \
+    packaging/doctor_workstation.spec >/dev/null 2>&1; then
+  for file in "${operational_files[@]}"; do
+    relative_path="${file#"$project_root"/}"
+    index_record="$(git -C "$project_root" ls-files --stage -- "$relative_path")"
+    index_mode="${index_record%% *}"
+    [[ "$index_mode" == "100755" ]] || {
+      printf 'Git index mode must be 100755 for macOS entry: %s (found %s)\n' \
+        "$relative_path" "${index_mode:-untracked}" >&2
+      exit 1
+    }
+  done
+fi
 
 open_line="$(grep -nF '/usr/bin/open "$artifact"' "$script_dir/run_macos.sh" | head -n 1 | cut -d: -f1)"
 source_line="$(grep -nF 'macos_ensure_uv' "$script_dir/run_macos.sh" | head -n 1 | cut -d: -f1)"
@@ -46,11 +61,11 @@ grep -Fq 'scripts/run_macos.sh' "$project_root/run_macos.command"
 grep -Fq 'scripts/package_macos.sh' "$project_root/一键打包.command"
 grep -Fq 'scripts/package_macos.sh' "$project_root/package_macos.command"
 
-if grep -En '(^|[[:space:]])(export[[:space:]]+)?HOME=' "${operational_files[@]}"; then
+if grep -En '(^|[[:space:]])(export[[:space:]]+)?HOME=' "${operational_files[@]:1}"; then
   echo 'macOS entry scripts must not repurpose HOME.' >&2
   exit 1
 fi
-if grep -Ein 'SDKSecret(Key)?|UserSig|userSig' "${operational_files[@]}"; then
+if grep -Ein 'SDKSecret(Key)?|UserSig|userSig' "${operational_files[@]:1}"; then
   echo 'macOS entry scripts must not contain RTC secrets or credentials.' >&2
   exit 1
 fi