D 工程化：CSP安全策略+启动迁移+UI集成(C1-C7)

apps/desktop/src/main/index.ts

@@ -4,6 +4,7 @@ import nodePath from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { VaultService } from './services/vault-service.js';
 import { registerIpc } from './ipc/handlers.js';
+import { MigrationService } from './services/migration-service.js';
 import { IPC } from '@hunter/shared';
 
 const __dirname = nodePath.dirname(fileURLToPath(import.meta.url));
@@ -32,6 +33,11 @@ function createWindow() {
 app.whenReady().then(async () => {
   const vault = new VaultService();
   await vault.init(); // 确保有当前库
+  // 旧版数据迁移检测（FR-D1/D2/D3）：幂等，无旧数据则跳过
+  const migrator = new MigrationService(app.getPath('userData'));
+  const oldDataDir = nodePath.join(app.getPath('userData'), 'legacy-data');
+  const r = await migrator.migrate(oldDataDir, vault.fileService?.getRoot() ?? '').catch(() => null);
+  if (r?.migrated) console.log('[MIGRATION] migrated', r.count, 'items');
   registerIpc(vault);
   createWindow();
   app.on('activate', () => { if (BrowserWindow.getAllWindows().length === 0) createWindow(); });

apps/desktop/src/renderer/index.html

@@ -3,10 +3,11 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:5173 http://127.0.0.1:5173; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self' http://localhost:5173 ws://localhost:5173;" />
   <title>狩夜人笔记</title>
 </head>
 <body>
   <div id="root"></div>
   <script type="module" src="./main.tsx"></script>
 </body>
-</html>
+</html>