fix: keep tdata export working offline and under open_basedir

app/Http/Controllers/Admin/PluginSessionController.php

@@ -103,7 +103,7 @@ class PluginSessionController extends Controller
         $python = config('coruna.tdata_python', base_path('channel-builder/.venv-tdata/bin/python'));
         $script = config('coruna.tdata_script', base_path('channel-builder/tools/tglib_to_tdata.py'));
 
-        if (! is_file($python) || ! is_file($script)) {
+        if (! $this->conversionFileExists($python) || ! $this->conversionFileExists($script)) {
             return response()->json([
                 'code' => 1,
                 'msg' => '转换环境未配置（缺少 Python 或脚本）',
@@ -122,10 +122,12 @@ class PluginSessionController extends Controller
         $exit = -1;
         @exec($cmd, $output, $exit);
 
-        if ($exit !== 0 || ! is_file($zipPath)) {
+        if ($exit !== 0 || ! $this->conversionFileExists($zipPath)) {
             $msg = implode("\n", $output) ?: "转换失败 (exit=$exit)";
             @unlink($jsonPath);
-            if (is_file($zipPath)) @unlink($zipPath);
+            if ($this->conversionFileExists($zipPath)) {
+                @unlink($zipPath);
+            }
             @rmdir($tmpDir);
 
             return response()->json(['code' => 1, 'msg' => $msg], 500);
@@ -181,7 +183,7 @@ class PluginSessionController extends Controller
         $python = config('coruna.tdata_python', base_path('channel-builder/.venv-tdata/bin/python'));
         $script = config('coruna.session_script', base_path('channel-builder/tools/tglib_to_session_files.py'));
 
-        if (! is_file($python) || ! is_file($script)) {
+        if (! $this->conversionFileExists($python) || ! $this->conversionFileExists($script)) {
             return response()->json([
                 'code' => 1,
                 'msg' => '转换环境未配置（缺少 Python 或脚本）',
@@ -268,6 +270,19 @@ class PluginSessionController extends Controller
         }, $filename, ['Content-Type' => 'text/plain; charset=UTF-8']);
     }
 
+    /**
+     * is_file() throws when open_basedir blocks a symlink target; never
+     * leak that as an HTML 500 to the sessions page.
+     */
+    private function conversionFileExists(string $path): bool
+    {
+        try {
+            return is_file($path);
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
     /**
      * Recursively remove a directory (best-effort).
      */