fix: verify configured Goose targets during Portal release

scripts/release-portal-runtime-prod.sh

@@ -497,6 +497,31 @@ remount_goosed_after_live_swap() {
   local marker_host="${APP_DIR}/${marker_rel}"
   local marker_value="${RELEASE_ID}-$(date +%s)"
   local ready=0
+  local targets_line target port
+  local target_urls=() native_ports=()
+  targets_line="$(sed -n 's/^TKMIND_API_TARGETS=//p' "${APP_DIR}/.env" | tail -1 | tr -d "\"'\r")"
+  if [[ -z "${targets_line}" ]]; then
+    echo "goosed remount failed: TKMIND_API_TARGETS is empty" >&2
+    return 1
+  fi
+  IFS=',' read -r -a target_urls <<< "${targets_line}"
+  for target in "${target_urls[@]}"; do
+    target="$(printf '%s' "${target}" | tr -d '[:space:]')"
+    if [[ ! "${target}" =~ ^https://(127\.0\.0\.1|localhost):([0-9]+)/*$ ]]; then
+      echo "goosed remount failed: invalid or unsupported configured target: ${target}" >&2
+      return 1
+    fi
+    port="${BASH_REMATCH[2]}"
+    if (( 10#${port} < 1 || 10#${port} > 65535 )); then
+      echo "goosed remount failed: configured target port out of range" >&2
+      return 1
+    fi
+    native_ports+=("${port}")
+  done
+  if [[ "${#native_ports[@]}" -eq 0 ]]; then
+    echo "goosed remount failed: TKMIND_API_TARGETS is empty" >&2
+    return 1
+  fi
 
   if [[ ! -x "${docker_bin}" || ! -f "${compose_file}" ]]; then
     say "重启 native goosed 以刷新 Portal/MindSpace bind mount"
@@ -505,7 +530,7 @@ remount_goosed_after_live_swap() {
 
     local gui="gui/$(id -u)"
     local port
-    for port in $(seq 18006 18014); do
+    for port in "${native_ports[@]}"; do
       launchctl kickstart -k "${gui}/cn.tkmind.goosed-native-${port}" >/dev/null 2>&1 || true
     done
 
@@ -517,7 +542,7 @@ remount_goosed_after_live_swap() {
       if [[ ! -f "${APP_DIR}/mindspace-sandbox-mcp.mjs" ]]; then
         healthy=0
       fi
-      for port in $(seq 18006 18014); do
+      for port in "${native_ports[@]}"; do
         if [[ "$(curl -skS -m 5 "https://127.0.0.1:${port}/status" 2>/dev/null || true)" != "ok" ]]; then
           healthy=0
         fi
@@ -590,7 +615,7 @@ remount_goosed_after_live_swap() {
     done
 
     local port
-    for port in $(seq 18006 18014); do
+    for port in "${native_ports[@]}"; do
       if [[ "$(curl -skS -m 5 "https://127.0.0.1:${port}/status" 2>/dev/null || true)" != "ok" ]]; then
         healthy=0
       fi