fix: 修正 ORPC handler 语义、加固 Electron 安全、优化构建与运行时配置

- todo.router: create 错误码 NOT_FOUND → INTERNAL_SERVER_ERROR，remove 增加存在性检查
- __root: devtools 仅在 DEV 环境渲染
- Electron: 添加 will-navigate 导航拦截、显式安全 webPreferences、deny-all 权限请求
- sidecar: 空 catch 块补充意图注释，新增 lastResolvedUrl getter
- todo.contract: 硬编码 omit 改用 generatedFieldKeys
- router: QueryClient 添加 staleTime/retry 默认值
- turbo: build 任务精细化 inputs 提升缓存命中率
- fields: id() 改为模块私有

apps/desktop/src/main/index.ts

@@ -1,5 +1,5 @@
 import { join } from 'node:path'
-import { app, BrowserWindow, dialog, shell } from 'electron'
+import { app, BrowserWindow, dialog, session, shell } from 'electron'
 import { createSidecarRuntime } from './sidecar'
 
 const DEV_SERVER_URL = 'http://localhost:3000'
@@ -61,6 +61,8 @@ const createWindow = async () => {
     webPreferences: {
       preload: join(__dirname, '../preload/index.js'),
       sandbox: true,
+      contextIsolation: true,
+      nodeIntegration: false,
     },
   })
   mainWindow = windowRef
@@ -78,6 +80,21 @@ const createWindow = async () => {
     return { action: 'deny' }
   })
 
+  windowRef.webContents.on('will-navigate', (event, url) => {
+    const allowed = [DEV_SERVER_URL, sidecar.lastResolvedUrl].filter((v): v is string => v != null)
+    const isAllowed = allowed.some((origin) => url.startsWith(origin))
+
+    if (!isAllowed) {
+      event.preventDefault()
+
+      if (canOpenExternally(url)) {
+        void shell.openExternal(url)
+      } else if (!app.isPackaged) {
+        console.warn(`Blocked navigation to: ${url}`)
+      }
+    }
+  })
+
   windowRef.on('closed', () => {
     if (mainWindow === windowRef) {
       mainWindow = null
@@ -151,7 +168,13 @@ const handleWindowCreationError = (error: unknown, context: string) => {
 
 app
   .whenReady()
-  .then(() => ensureWindow())
+  .then(() => {
+    session.defaultSession.setPermissionRequestHandler((_webContents, _permission, callback) => {
+      callback(false)
+    })
+
+    return ensureWindow()
+  })
   .catch((error) => {
     handleWindowCreationError(error, 'Failed to create window')
   })

apps/desktop/src/main/sidecar.ts

@@ -27,6 +27,7 @@ type SidecarRuntimeOptions = {
 type SidecarRuntime = {
   resolveUrl: () => Promise<string>
   stop: () => void
+  lastResolvedUrl: string | null
 }
 
 const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))
@@ -72,7 +73,9 @@ const isServerReady = async (url: string): Promise<boolean> => {
 
         return true
       }
-    } catch {}
+    } catch {
+      // Expected: probe request fails while server is still starting up
+    }
   }
 
   return false
@@ -239,11 +242,15 @@ export const createSidecarRuntime = (options: SidecarRuntimeOptions): SidecarRun
       throw new Error('Dev server not responding. Run `bun dev` in apps/server first.')
     }
 
+    state.url = options.devServerUrl
     return options.devServerUrl
   }
 
   return {
     resolveUrl,
     stop,
+    get lastResolvedUrl() {
+      return state.url
+    },
   }
 }