feat: add desktop app hot update channel

electron/lib/secrets.js

@@ -0,0 +1,66 @@
+// 密钥安全存储：用 Electron safeStorage 加密后写入 userData/secrets.json
+// name 取 "github" / "registry"。读时解密；无则返回空串。
+const fs = require("fs");
+const path = require("path");
+const { app, safeStorage } = require("electron");
+
+function secretsPath() {
+  return path.join(app.getPath("userData"), "secrets.json");
+}
+
+function readStore() {
+  try {
+    const txt = fs.readFileSync(secretsPath(), "utf-8");
+    return JSON.parse(txt || "{}");
+  } catch (e) {
+    return {};
+  }
+}
+
+function writeStore(store) {
+  const p = secretsPath();
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, JSON.stringify(store, null, 2), { encoding: "utf-8" });
+  try {
+    fs.chmodSync(p, 0o600);
+  } catch (e) {
+    /* 忽略权限设置失败（非 POSIX 平台） */
+  }
+}
+
+// 取密钥；无则空串
+function getSecret(name) {
+  const store = readStore();
+  const enc = store[name];
+  if (!enc) return "";
+  try {
+    if (safeStorage.isEncryptionAvailable()) {
+      return safeStorage.decryptString(Buffer.from(enc, "base64"));
+    }
+    // 加密不可用时的降级：明文（base64）存储
+    return Buffer.from(enc, "base64").toString("utf-8");
+  } catch (e) {
+    return "";
+  }
+}
+
+// 存密钥；空值视为删除
+function setSecret(name, value) {
+  const store = readStore();
+  if (!value) {
+    delete store[name];
+    writeStore(store);
+    return { ok: true };
+  }
+  let encB64;
+  if (safeStorage.isEncryptionAvailable()) {
+    encB64 = safeStorage.encryptString(value).toString("base64");
+  } else {
+    encB64 = Buffer.from(value, "utf-8").toString("base64");
+  }
+  store[name] = encB64;
+  writeStore(store);
+  return { ok: true };
+}
+
+module.exports = { getSecret, setSecret };