fix(desktop): 重构菜单并恢复 Shiki 高亮

frontend/src-tauri/src/main.rs

@@ -70,6 +70,15 @@ mod core_proxy_tests {
         assert!(core_url("https://example.com/api/status").is_err());
         assert!(core_url("/api/../secret").is_err());
     }
+
+    #[test]
+    fn desktop_csp_allows_shiki_wasm_without_general_eval() {
+        let config: serde_json::Value =
+            serde_json::from_str(include_str!("../tauri.conf.json")).unwrap();
+        let csp = config["app"]["security"]["csp"].as_str().unwrap();
+        assert!(csp.contains("'wasm-unsafe-eval'"));
+        assert!(!csp.split_whitespace().any(|token| token == "'unsafe-eval'"));
+    }
 }
 
 /// 预览版只代理固定回环地址，避免 WebView CORS 与任意地址转发。

frontend/src-tauri/tauri.conf.json

@@ -12,7 +12,7 @@
   "app": {
     "windows": [{"label": "main", "title": "NotesAgent Preview", "width": 1280, "height": 960, "minWidth": 720, "minHeight": 700, "center": true, "decorations": false}],
     "security": {
-      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http://127.0.0.1:8000; font-src 'self' data:; connect-src ipc: http://ipc.localhost http://127.0.0.1:8000; frame-src 'self' blob:; object-src 'none'; base-uri 'self'",
+      "csp": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http://127.0.0.1:8000; font-src 'self' data:; connect-src ipc: http://ipc.localhost http://127.0.0.1:8000; frame-src 'self' blob:; object-src 'none'; base-uri 'self'",
       "capabilities": ["main"]
     }
   },