fix(wish-tree): 修复切换树后导航消失和树类型错误

- loadWishes使用safeInitRibbons/safeInitDanmaku，防止初始化出错导致页面崩溃
- getCurrentTree确保返回带type字段的有效树对象
- 添加错误处理，避免未定义错误

.gitea/scripts/notify.sh

@@ -30,6 +30,12 @@ fi
 
 COLOR="${COLOR:-$DEFAULT_COLOR}"
 
+# 校验 COLOR 必须是数字
+if ! [[ "$COLOR" =~ ^[0-9]+$ ]]; then
+  echo "⚠️  非法 COLOR 值: $COLOR，使用默认颜色 $DEFAULT_COLOR"
+  COLOR="$DEFAULT_COLOR"
+fi
+
 # 获取 Git 信息
 REPO="${GITEA_REPO:-unknown}"
 BRANCH="${GITEA_REF_NAME:-unknown}"
@@ -40,6 +46,16 @@ WORKFLOW="${GITEA_WORKFLOW:-unknown}"
 RUN_NUMBER="${GITEA_RUN_NUMBER:-unknown}"
 RUN_URL="${GITEA_SERVER_URL:-}/${GITEA_REPO}/actions/runs/${GITEA_RUN_ID:-}"
 
+# HTML 转义函数（用于 Telegram）
+html_escape() {
+  local s="$1"
+  s="${s//&/&}"
+  s="${s//</&lt;}"
+  s="${s//>/&gt;}"
+  s="${s//\"/&quot;}"
+  printf '%s' "$s"
+}
+
 # ==================== Telegram 通知 ====================
 send_telegram() {
   if [ -z "$TELEGRAM_BOT_TOKEN" ] || [ -z "$TELEGRAM_CHAT_ID" ]; then
@@ -47,28 +63,41 @@ send_telegram() {
     return 0
   fi
 
-  local tg_message="${EMOJI} <b>${TITLE}</b>
+  # 转义所有用户可控的变量
+  local escaped_title escaped_message escaped_repo escaped_branch escaped_author escaped_workflow escaped_run_url
+  escaped_title=$(html_escape "$TITLE")
+  escaped_message=$(html_escape "$MESSAGE")
+  escaped_repo=$(html_escape "$REPO")
+  escaped_branch=$(html_escape "$BRANCH")
+  escaped_author=$(html_escape "$AUTHOR")
+  escaped_workflow=$(html_escape "$WORKFLOW")
+  escaped_run_url=$(html_escape "$RUN_URL")
+
+  local tg_message="${EMOJI} <b>${escaped_title}</b>
 
 <b>状态:</b> ${STATUS_TEXT}
-<b>仓库:</b> ${REPO}
-<b>分支:</b> ${BRANCH}
+<b>仓库:</b> ${escaped_repo}
+<b>分支:</b> ${escaped_branch}
 <b>提交:</b> <code>${COMMIT_SHORT}</code>
-<b>作者:</b> ${AUTHOR}
-<b>工作流:</b> ${WORKFLOW} #${RUN_NUMBER}
+<b>作者:</b> ${escaped_author}
+<b>工作流:</b> ${escaped_workflow} #${RUN_NUMBER}
 
-${MESSAGE}
+${escaped_message}
 
-<a href=\"${RUN_URL}\">查看详情</a>"
+<a href=\"${escaped_run_url}\">查看详情</a>"
 
   echo "📤 发送 Telegram 通知..."
   
   local response
-  response=$(curl -s -X POST \
+  response=$(curl -sS --connect-timeout 5 --max-time 15 -X POST \
     "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
     -d "chat_id=${TELEGRAM_CHAT_ID}" \
-    -d "text=${tg_message}" \
+    --data-urlencode "text=${tg_message}" \
     -d "parse_mode=HTML" \
-    -d "disable_web_page_preview=true")
+    -d "disable_web_page_preview=true" 2>&1) || {
+    echo "❌ Telegram 请求失败: $response"
+    return 1
+  }
 
   if echo "$response" | grep -q '"ok":true'; then
     echo "✅ Telegram 通知发送成功"
@@ -87,66 +116,63 @@ send_discord() {
 
   echo "📤 发送 Discord 通知..."
 
-  # 构建 Discord Embed JSON
+  # 使用 python3 构建 JSON，防止注入
   local discord_payload
-  discord_payload=$(cat <<EOF
-{
-  "embeds": [{
-    "title": "${EMOJI} ${TITLE}",
-    "description": "${MESSAGE}",
-    "color": ${COLOR},
-    "fields": [
-      {
-        "name": "状态",
-        "value": "${STATUS_TEXT}",
-        "inline": true
-      },
-      {
-        "name": "仓库",
-        "value": "${REPO}",
-        "inline": true
-      },
-      {
-        "name": "分支",
-        "value": "${BRANCH}",
-        "inline": true
-      },
-      {
-        "name": "提交",
-        "value": "\`${COMMIT_SHORT}\`",
-        "inline": true
-      },
-      {
-        "name": "作者",
-        "value": "${AUTHOR}",
-        "inline": true
-      },
-      {
-        "name": "工作流",
-        "value": "${WORKFLOW} #${RUN_NUMBER}",
-        "inline": true
-      }
-    ],
-    "footer": {
-      "text": "Gitea Actions"
-    },
-    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-    "url": "${RUN_URL}"
-  }]
-}
-EOF
-)
+  discord_payload=$(python3 -c "
+import json
+import sys
 
-  local response
-  response=$(curl -s -X POST \
+payload = {
+    'embeds': [{
+        'title': sys.argv[1],
+        'description': sys.argv[2],
+        'color': int(sys.argv[3]),
+        'fields': [
+            {'name': '状态', 'value': sys.argv[4], 'inline': True},
+            {'name': '仓库', 'value': sys.argv[5], 'inline': True},
+            {'name': '分支', 'value': sys.argv[6], 'inline': True},
+            {'name': '提交', 'value': sys.argv[7], 'inline': True},
+            {'name': '作者', 'value': sys.argv[8], 'inline': True},
+            {'name': '工作流', 'value': sys.argv[9], 'inline': True}
+        ],
+        'footer': {'text': 'Gitea Actions'},
+        'timestamp': sys.argv[10],
+        'url': sys.argv[11]
+    }]
+}
+print(json.dumps(payload, ensure_ascii=False))
+" \
+    "${EMOJI} ${TITLE}" \
+    "${MESSAGE}" \
+    "${COLOR}" \
+    "${STATUS_TEXT}" \
+    "${REPO}" \
+    "${BRANCH}" \
+    "\`${COMMIT_SHORT}\`" \
+    "${AUTHOR}" \
+    "${WORKFLOW} #${RUN_NUMBER}" \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    "${RUN_URL}"
+  )
+
+  local http_code response_body
+  response_body=$(mktemp)
+  http_code=$(curl -sS -o "$response_body" -w "%{http_code}" \
+    --connect-timeout 5 --max-time 15 -X POST \
     "$DISCORD_WEBHOOK_URL" \
     -H "Content-Type: application/json" \
-    -d "$discord_payload")
+    -d "$discord_payload" 2>&1) || {
+    echo "❌ Discord 请求失败: $http_code"
+    rm -f "$response_body"
+    return 1
+  }
 
-  if [ -z "$response" ] || echo "$response" | grep -q '"id"'; then
-    echo "✅ Discord 通知发送成功"
+  if [ "$http_code" = "204" ] || [ "$http_code" = "200" ]; then
+    echo "✅ Discord 通知发送成功 (HTTP $http_code)"
+    rm -f "$response_body"
   else
-    echo "❌ Discord 通知发送失败: $response"
+    echo "❌ Discord 通知发送失败 (HTTP $http_code): $(cat "$response_body")"
+    rm -f "$response_body"
     return 1
   fi
 }
@@ -176,9 +202,12 @@ main() {
   echo ""
   if [ $failed -eq 0 ]; then
     echo "✅ 所有通知发送完成"
+  elif [ $failed -ge 2 ]; then
+    echo "❌ 所有通知渠道均发送失败"
+    exit 1  # 全部失败时退出非 0，让 CI 可见
   else
     echo "⚠️  部分通知发送失败 ($failed 个)"
-    # 不退出脚本，避免影响主流程
+    # 部分失败不退出，避免影响主流程
   fi
 }
 

.gitea/workflows/miniapp-preview.yml

@@ -102,10 +102,10 @@ jobs:
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
           VERSION="$(tr -d '\n' < mini/ci-artifacts/resolved-version.txt)"
-          chmod +x .gitea/scripts/notify.sh
-          .gitea/scripts/notify.sh success \
+          bash .gitea/scripts/notify.sh success \
             "小程序开发版上传成功" \
-            "版本: ${VERSION}\n上传结果已保存到: /opt/lunar/ci-artifacts/miniapp-upload-latest.json"
+            "版本: ${VERSION}
+上传结果已保存到: /opt/lunar/ci-artifacts/miniapp-upload-latest.json"
       
       - name: Send failure notification
         if: failure()
@@ -114,8 +114,7 @@ jobs:
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
-          chmod +x .gitea/scripts/notify.sh
-          .gitea/scripts/notify.sh failure \
+          bash .gitea/scripts/notify.sh failure \
             "小程序开发版上传失败" \
             "请检查 Actions 日志了解失败原因"
       

.gitea/workflows/server-deploy.yml

@@ -76,8 +76,7 @@ jobs:
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
-          chmod +x .gitea/scripts/notify.sh
-          .gitea/scripts/notify.sh success \
+          bash .gitea/scripts/notify.sh success \
             "后端服务部署成功" \
             "部署包已保存到: /opt/lunar/ci-artifacts/server-deploy-latest.tar.gz"
       
@@ -88,8 +87,7 @@ jobs:
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
-          chmod +x .gitea/scripts/notify.sh
-          .gitea/scripts/notify.sh failure \
+          bash .gitea/scripts/notify.sh failure \
             "后端服务部署失败" \
             "请检查 Actions 日志了解失败原因"