fix(plan): address review feedback for Phase 1 plan

- Fix mock path in setup.ts to use @ alias
- Add Web Crypto polyfill for Node.js test environment
- Use pnpm exec for vitest version check
- Update Task 4.1 to note existing isLocalhost function
- Add cross-platform notes for Windows users

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/superpowers/plans/2026-03-21-phase1-security-testing.md

@@ -55,7 +55,12 @@ desktop/
 
 - [ ] **Step 1: 安装 Vitest 和测试相关依赖**
 
-Run:
+Run (Windows):
+```bash
+cd g:\ZClaw_openfang\desktop && pnpm add -D vitest@2.1.8 @testing-library/react@16.1.0 @testing-library/jest-dom@6.6.3 jsdom@25.0.1
+```
+
+Run (Unix):
 ```bash
 cd g:/ZClaw_openfang/desktop && pnpm add -D vitest@2.1.8 @testing-library/react@16.1.0 @testing-library/jest-dom@6.6.3 jsdom@25.0.1
 ```
@@ -66,7 +71,7 @@ Expected: 依赖安装成功
 
 Run:
 ```bash
-cd g:/ZClaw_openfang/desktop && pnpm vitest --version
+cd g:\ZClaw_openfang\desktop && pnpm exec vitest --version
 ```
 
 Expected: 输出 `vitest/2.1.8`
@@ -129,14 +134,20 @@ Create `desktop/tests/setup.ts`:
 ```typescript
 import '@testing-library/jest-dom';
 import { vi } from 'vitest';
+import { webcrypto } from 'node:crypto';
+
+// Polyfill Web Crypto API for Node.js test environment
+Object.defineProperty(global, 'crypto', {
+  value: webcrypto,
+});
 
 // Mock Tauri API
 vi.mock('@tauri-apps/api/core', () => ({
   invoke: vi.fn(),
 }));
 
-// Mock Tauri runtime check
-vi.mock('../src/lib/tauri-gateway', () => ({
+// Mock Tauri runtime check - use alias path for consistency
+vi.mock('@/lib/tauri-gateway', () => ({
   isTauriRuntime: () => false,
   getGatewayClient: vi.fn(),
 }));
@@ -718,14 +729,14 @@ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>"
 - Modify: `desktop/src/lib/gateway-client.ts`
 - Create: `desktop/tests/lib/gateway-security.test.ts`
 
+**前置说明:**
+- `isLocalhost` 函数已存在于 `gateway-storage.ts` (第 27-36 行)
+- `gateway-client.ts` 已导入 `isLocalhost` (第 41 行)
+- 现有代码仅输出警告 (第 209 行)，需要改为抛出错误
+
 - [ ] **Step 1: 读取现有 gateway-client.ts WebSocket 连接逻辑**
 
-Read file sections around WebSocket connection (lines 200-250 based on spec):
-
-```bash
-# View the relevant section
-head -n 250 g:/ZClaw_openfang/desktop/src/lib/gateway-client.ts | tail -n 100
-```
+Use Read tool to view `desktop/src/lib/gateway-client.ts` lines 200-220 to see current implementation.
 
 - [ ] **Step 2: 写失败的测试 - WSS 强制**