fix: harden proxied client installation

test/distribution.test.ts

@@ -25,6 +25,8 @@ test("customer distribution is a generic single-login gateway bridge", () => {
   assert.match(installer, /安装长时间无最终 JSON[\s\S]*残留 staging/s);
   assert.match(installer, /系统无需预装 Node\.js/);
   assert.match(installer, /阿里云精确版本.*npmmirror 精确版本.*Node 官方精确版本/s);
+  assert.match(installer, /国内备用发布源[\s\S]*主发布源.*国内 Gitea 备用源/s);
+  assert.match(installer, /不要设置全局 `NODE_OPTIONS=--use-env-proxy`[\s\S]*不要手工预装 `node_modules`/s);
   assert.match(installer, /BOOTSTRAP_WINDOWS_URL|Windows 安装引导/);
   assert.match(installer, /Linux\/macOS 安装引导/);
   assert.match(installer, /dingtalk-approval-bridge\.cmd/);
@@ -50,10 +52,12 @@ test("customer distribution is a generic single-login gateway bridge", () => {
   assert.match(windowsBootstrap, /OSArchitecture[\s\S]*Save-DingDownload[\s\S]*Expand-Archive/);
   assert.match(windowsBootstrap, /SHA-256 不匹配，停止安装/);
   assert.match(windowsBootstrap, /Write-DingProgress[\s\S]*\[dingtalk-approval\]/);
+  assert.match(windowsBootstrap, /dingInstallerUrls[\s\S]*dingManifestMirrorUrls[\s\S]*use-env-proxy/s);
   assert.match(posixBootstrap, /^#!\/bin\/sh\nset -eu/);
   assert.match(posixBootstrap, /uname -s[\s\S]*uname -m[\s\S]*tar -xzf/);
   assert.match(posixBootstrap, /SHA-256 不匹配，停止安装/);
   assert.match(posixBootstrap, /ding_progress[\s\S]*\[dingtalk-approval\]/);
+  assert.match(posixBootstrap, /ding_installer_urls[\s\S]*ding_manifest_mirror_urls[\s\S]*use-env-proxy/s);
   assert.equal(spawnSync("sh", ["-n", "distribution/bootstrap-posix.template.sh"]).status, 0);
   assert.doesNotMatch(`${windowsBootstrap}\n${posixBootstrap}`, /latest-v|npm install -g/);
 
@@ -69,6 +73,7 @@ test("customer distribution is a generic single-login gateway bridge", () => {
 
   const builder = readFileSync("scripts/build-release.mjs", "utf8");
   assert.match(builder, /schemaVersion: 3,\s+version,/s);
+  assert.match(builder, /download-mirror-base-url[\s\S]*manifestMirrors[\s\S]*mirrors:/s);
   assert.match(builder, /signData\(null, manifestBytes/);
   assert.match(builder, /dingtalk-approval-client/);
   assert.match(builder, /bootstrap-windows\.template\.ps1/);