修复纯客户端包的原生助手签名校验与加密报错

- keychain-helper 与 computer-helper 接受同一签名团队下的完整版与 client-only 两个 App 标识，消除远程登录保存时的「无法访问系统加密密钥」
- DesktopCredentials 透出助手真实 stderr，无输出时才回落到通用钥匙串提示

desktop/computer-helper.swift

@@ -34,7 +34,9 @@ func signingInfo(_ code: SecCode) -> [String: Any] {
 let parentInfo = signingInfo(parentCode), ownInfo = signingInfo(ownCode)
 guard let team = ownInfo[kSecCodeInfoTeamIdentifier as String] as? String,
       parentInfo[kSecCodeInfoTeamIdentifier as String] as? String == team,
-      parentInfo[kSecCodeInfoIdentifier as String] as? String == "cn.samien.yaoyao.desktop" else { fail("App 签名身份不匹配") }
+      // The full desktop and the client-only build share one signing team.
+      ["cn.samien.yaoyao.desktop", "cn.samien.yaoyao.desktop.client"]
+        .contains(parentInfo[kSecCodeInfoIdentifier as String] as? String ?? "") else { fail("App 签名身份不匹配") }
 #endif
 let bytes = FileHandle.standardInput.readDataToEndOfFile()
 guard bytes.count <= 131072,

desktop/credentials.mjs

@@ -19,8 +19,11 @@ export class DesktopCredentials {
   async invoke(operation,input){
     if(input.length>1048576)throw new Error('执行节点配置超过加密大小上限')
     return new Promise((resolve,reject)=>{
-      const child=execFile(this.helper,[operation,this.account],{encoding:'buffer',timeout:30000,killSignal:'SIGKILL',maxBuffer:1048576},(error,stdout)=>{
-        if(error)reject(new Error('无法访问当前数据目录的系统加密密钥，请完成钥匙串授权后重试'))
+      const child=execFile(this.helper,[operation,this.account],{encoding:'buffer',timeout:30000,killSignal:'SIGKILL',maxBuffer:1048576},(error,stdout,stderr)=>{
+        if(error){
+          const detail=stderr&&stderr.length?stderr.toString('utf8').trim():''
+          reject(new Error(detail||'无法访问当前数据目录的系统加密密钥，请完成钥匙串授权后重试'))
+        }
         else resolve(stdout)
       })
       child.stdin.on('error',()=>{});child.stdin.end(input)

desktop/keychain-helper.swift

@@ -33,7 +33,9 @@ func signingInfo(_ code: SecCode) -> [String: Any] {
 let parentInfo = signingInfo(parentCode), ownInfo = signingInfo(ownCode)
 guard let team = ownInfo[kSecCodeInfoTeamIdentifier as String] as? String,
       parentInfo[kSecCodeInfoTeamIdentifier as String] as? String == team,
-      parentInfo[kSecCodeInfoIdentifier as String] as? String == "cn.samien.yaoyao.desktop" else { fail("App 签名身份不匹配") }
+      // The full desktop and the client-only build share one signing team.
+      ["cn.samien.yaoyao.desktop", "cn.samien.yaoyao.desktop.client"]
+        .contains(parentInfo[kSecCodeInfoIdentifier as String] as? String ?? "") else { fail("App 签名身份不匹配") }
 #endif
 guard CommandLine.arguments.count == 3 else { fail("钥匙串请求格式无效") }
 let operation = CommandLine.arguments[1], account = CommandLine.arguments[2]