新增: ScriptNode 白名单跨 crate 配置打通(IPC+OnceLock) - 新增 set_script_safety / get_script_safety IPC - ScriptNode.check_command_policy 优先读运行时配置 - 前端设置页保存时同步注入后端运行时 - 核验确认小程序心跳/文件树刷新/项目分页三项已就绪

src-tauri/src/commands/settings.rs

@@ -91,3 +91,37 @@ pub async fn ai_set_approval_timeout(
     tracing::info!("[APPROVAL-TIMEOUT] 已更新: {} 分钟 ({} ms)", minutes, ms);
     Ok(minutes)
 }
+
+/// 设置脚本安全配置(白/黑名单)并注入到 ScriptNode 运行时。
+///
+/// 前端设置页「命令执行安全」保存时调用。
+/// 持久化到 app_settings KV,同时通过 df_nodes::set_script_safety_config 注入内存,
+/// 即时生效(无需重启)。
+#[tauri::command]
+pub async fn set_script_safety(
+    state: State<'_, AppState>,
+    whitelist: String,
+    blacklist: String,
+) -> Result<(), String> {
+    // 持久化到 KV
+    state.settings.set("df-script-whitelist", &whitelist).await.map_err(err_str)?;
+    state.settings.set("df-script-blacklist", &blacklist).await.map_err(err_str)?;
+    // 注入运行时(即时生效,不依赖进程重启)
+    df_nodes::script_node::set_script_safety_config(&whitelist, &blacklist);
+    tracing::info!(
+        whitelist = %whitelist,
+        blacklist = %blacklist,
+        "[SCRIPT-SAFETY] 运行时配置已更新"
+    );
+    Ok(())
+}
+
+/// 读取脚本安全配置。
+#[tauri::command]
+pub async fn get_script_safety(
+    state: State<'_, AppState>,
+) -> Result<(String, String), String> {
+    let wl = state.settings.get("df-script-whitelist").await.map_err(err_str)?.unwrap_or_default();
+    let bl = state.settings.get("df-script-blacklist").await.map_err(err_str)?.unwrap_or_default();
+    Ok((wl, bl))
+}

src-tauri/src/lib.rs

@@ -430,6 +430,9 @@ pub fn run() {
             // 审批超时配置(默认 15 分钟,0=禁用;Settings 页可改)
             commands::settings::ai_get_approval_timeout,
             commands::settings::ai_set_approval_timeout,
+            // ScriptNode 命令安全配置(白/黑名单,前端设置页写入)
+            commands::settings::set_script_safety,
+            commands::settings::get_script_safety,
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");