@allbluecn/web-app 0.10.2 → 0.11.0

package/src/routes/_nav/knowledge/compliance/index.lazy.tsx

@@ -18,7 +18,7 @@
 import { cn } from "@/lib/utils"
 import { createLazyFileRoute, useNavigate } from '@tanstack/react-router'
 import { useState } from 'react'
-import { useQuery, keepPreviousData } from '@tanstack/react-query'
+import { useQuery, keepPreviousData, useQueryClient } from '@tanstack/react-query'
 import { listComplianceFn } from '@/server/serverFns/knowledge-public/compliance/list'
 import { createComplianceFn } from '@/server/serverFns/knowledge-public/compliance/create'
 import { getEntityTagsFn } from '@/server/serverFns/knowledge-public/entity-tags'
@@ -50,6 +50,7 @@ export const Route = createLazyFileRoute('/_nav/knowledge/compliance/')({ compon
 
 function CompliancePage() {
   const navigate = useNavigate()
+  const qc = useQueryClient()
   const industryOptions = buildIndustryOptions()
   const industryGroups = [
     { key: 'industry', label: m.knowledge_compliance_index_industry(), options: industryOptions },
@@ -94,7 +95,9 @@ function CompliancePage() {
           search={search}
           onSearchChange={setSearch}
           onCreate={async () => {
-            const r = await createComplianceFn({ data: { title: m.knowledge_compliance_index_untitled(), industry: '', tags: [] } })
+            const r = await createComplianceFn({ data: { title: '新合规', industry: '', tags: [] } })
+            qc.invalidateQueries({ queryKey: ['compliance'] })
+            await qc.refetchQueries({ queryKey: ['compliance'], type: 'all' })
             navigate({ to: '/knowledge/compliance/edit/$id', params: { id: r.id } })
           }}
           createLabel={m.knowledge_compliance_index_add()}

package/src/routes/_nav/knowledge/index.lazy.tsx

@@ -146,7 +146,7 @@ function KnowledgeListPage() {
                 <Card key={kb.id} className={`group relative p-5 transition-colors hover:bg-accent/40 border rounded-lg ${isLaw ? 'overflow-hidden' : ''}`}>
                   <Link
                     to={kb.link}
-                    className="absolute inset-0"
+                    className="absolute inset-0 z-10"
                     aria-label={name}
                   />
                   {isLaw ? (

package/src/routes/_nav/knowledge/laws/index.lazy.tsx

@@ -18,7 +18,7 @@
 import { cn } from "@/lib/utils"
 import { createLazyFileRoute, useNavigate } from '@tanstack/react-router'
 import { useState } from 'react'
-import { useQuery, keepPreviousData } from '@tanstack/react-query'
+import { useQuery, keepPreviousData, useQueryClient } from '@tanstack/react-query'
 import { listLegalFn } from '@/server/serverFns/knowledge-public/legal/list'
 import { createLegalFn } from '@/server/serverFns/knowledge-public/legal/create'
 import { getEntityTagsFn } from '@/server/serverFns/knowledge-public/entity-tags'
@@ -44,6 +44,7 @@ export const Route = createLazyFileRoute('/_nav/knowledge/laws/')({ component: L
 
 function LawPage() {
   const navigate = useNavigate()
+  const qc = useQueryClient()
   const jurisdictionOptions = buildJurisdictionOptions()
   const jurisdictionGroups = [
     { key: 'jurisdiction', label: m.knowledge_laws_index_jurisdiction(), options: jurisdictionOptions },
@@ -79,7 +80,9 @@ function LawPage() {
           search={search}
           onSearchChange={setSearch}
           onCreate={async () => {
-            const r = await createLegalFn({ data: { title: m.knowledge_laws_index_untitled(), jurisdiction: '', category: '', tags: [] } })
+            const r = await createLegalFn({ data: { title: '新法规', jurisdiction: '', category: '', tags: [] } })
+            qc.invalidateQueries({ queryKey: ['legal'] })
+            await qc.refetchQueries({ queryKey: ['legal'], type: 'all' })
             navigate({ to: '/knowledge/laws/edit/$id', params: { id: r.id } })
           }}
           createLabel={m.knowledge_laws_index_add()}

package/src/routes/_nav/route.tsx

@@ -21,6 +21,10 @@ import { useMemo } from 'react'
 
 import { m } from '@/paraglide/messages.js'
 import { isDesktopServer } from '@/server/desktop-guest'
+import { listPinnedWorkspacesBriefFn } from '@/server/serverFns/workspace'
+import { listKnowledgeFn } from '@/server/serverFns/knowledge'
+import { WORKSPACES_QUERY_KEY } from '@/lib/collections/reference/workspaces-collection'
+import { KNOWLEDGE_BASES_QUERY_KEY } from '@/lib/collections/knowledge/knowledge-bases-collection'
 import { Empty, EmptyContent, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from '@/components/ui/empty'
 import { Button } from '@/components/ui/button'
 import { GlobalErrorBoundary } from '@/components/error/global-error-boundary'
@@ -157,6 +161,23 @@ export const Route = createFileRoute('/_nav')({
       })
     }
   },
+  loader: async ({ context }) => {
+    const { queryClient } = context
+    // SSR 预取侧边栏常驻菜单（工作空间/知识库）数据，刷新后 hydrate 首帧即有数据，
+    // 避免侧边栏菜单每次刷新重新加载
+    await Promise.all([
+      queryClient.ensureQueryData({
+        queryKey: WORKSPACES_QUERY_KEY,
+        queryFn: () => listPinnedWorkspacesBriefFn(),
+      }),
+      queryClient.ensureQueryData({
+        queryKey: KNOWLEDGE_BASES_QUERY_KEY,
+        queryFn: () => listKnowledgeFn(),
+      }),
+    ]).catch(() => {
+      // 预取失败降级为客户端 fetch（与旧行为一致），不阻塞页面
+    })
+  },
   notFoundComponent: NavNotFound,
   errorComponent: GlobalErrorBoundary,
 })

package/src/routes/_nav/workspaces/$workspaceId/route.lazy.tsx

@@ -20,21 +20,22 @@ import { useEffect, useState } from "react";
 import { useTheme } from "next-themes";
 import { GlyphMatrix } from "@/components/magicui/glyph-matrix";
 import { CreateProjectDialog } from "@/components/project/create-project-dialog";
-import { EditWorkspaceDialog } from "@/components/workspace/edit-workspace-dialog";
+import { EditWorkspaceDialog } from "@/components/workspace/dialogs/edit-workspace-dialog";
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
-import { DeleteWorkspaceOptions } from "@/components/workspace/delete-workspace-options";
+import { DeleteWorkspaceOptions } from "@/components/workspace/dialogs/delete-workspace-options";
 import {
   deleteWorkspaceFn,
   listWorkspaceMembersFn,
   listWorkspacesFn,
 } from "@/server/serverFns/workspace";
 import { deleteProjectFn } from "@/server/serverFns/project";
-import { WorkspaceHeader } from "@/components/workspace/workspace-header";
-import { WorkspaceKbCard } from "@/components/workspace/workspace-kb-card";
-import { WorkspaceContributionCard } from "@/components/workspace/workspace-contribution-card";
-import { WorkspaceProjectList } from "@/components/workspace/workspace-project-list";
-import { WorkspaceActivityCard } from "@/components/workspace/workspace-activity-card";
-import { WorkspaceMembersManager } from "@/components/workspace/workspace-members-manager";
+import { WorkspaceHeader } from "@/components/workspace/header/workspace-header";
+import { WorkspaceKbCard } from "@/components/workspace/kb/workspace-kb-card";
+import { WorkspaceContributionCard } from "@/components/workspace/contribution/workspace-contribution-card";
+import { WorkspaceProjectList } from "@/components/workspace/projects/workspace-project-list";
+import { WorkspaceActivityCard } from "@/components/workspace/activity/workspace-activity-card";
+import { WorkspaceMembersManager } from "@/components/workspace/members/workspace-members-manager";
+import type { WorkspaceKbCardData } from "@/server/serverFns/workspace-kb-utils";
 import { m } from "@/paraglide/messages.js";
 
 type DetailData = {
@@ -75,10 +76,11 @@ type DetailData = {
     joinedAt: Date;
     user?: { id: string; username: string; email: string; avatarConfig?: unknown; bgShape?: string | null; bgColor?: string | null };
   }[];
+  kbCard: WorkspaceKbCardData;
 };
 
 function WorkspaceDetailPage() {
-  const { workspace, projects, activities, contributionData, members } = Route.useLoaderData() as DetailData;
+  const { workspace, projects, activities, contributionData, members, kbCard } = Route.useLoaderData() as DetailData;
   const [editOpen, setEditOpen] = useState(false);
   const [deleteOpen, setDeleteOpen] = useState(false);
   const [projectEditOpen, setProjectEditOpen] = useState(false);
@@ -150,7 +152,7 @@ function WorkspaceDetailPage() {
           onEdit={() => setEditOpen(true)}
           onDelete={() => setDeleteOpen(true)}
         />
-        <WorkspaceKbCard />
+        <WorkspaceKbCard workspaceId={workspace.id} data={kbCard} />
         <div className="grid gap-6 lg:grid-cols-3">
           <div className="lg:col-span-2 space-y-6">
             <WorkspaceContributionCard data={contributionData} />
@@ -166,7 +168,7 @@ function WorkspaceDetailPage() {
               workspaceId={workspace.id}
               workspaceOwnerId={workspace.ownerId}
               members={members}
-              onMembersUpdated={() => window.dispatchEvent(new CustomEvent("workspace-members-updated"))}
+              onMembersUpdated={() => { void router.invalidate(); }}
             />
           </div>
         </div>

package/src/routes/_nav/workspaces/$workspaceId/route.tsx

@@ -23,17 +23,19 @@ import {
   getWorkspaceActivityDataFn,
   listWorkspaceMembersFn,
 } from "@/server/serverFns/workspace";
+import { getWorkspaceKbCardFn } from "@/server/serverFns/workspace-kb";
 
 export const Route = createFileRoute("/_nav/workspaces/$workspaceId")({
   loader: async ({ params }) => {
-    const [workspace, projects, activities, contributionData, members] = await Promise.all([
+    const [workspace, projects, activities, contributionData, members, kbCard] = await Promise.all([
       getWorkspaceDetailFn({ data: { workspaceId: params.workspaceId } }),
       listWorkspaceProjectsFn({ data: { workspaceId: params.workspaceId } }),
       listWorkspaceActivitiesFn({ data: { workspaceId: params.workspaceId, take: 5 } }),
       getWorkspaceActivityDataFn({ data: { workspaceId: params.workspaceId } }),
       listWorkspaceMembersFn({ data: { workspaceId: params.workspaceId } }),
+      getWorkspaceKbCardFn({ data: { workspaceId: params.workspaceId } }),
     ]);
-    return { workspace, projects, activities, contributionData, members };
+    return { workspace, projects, activities, contributionData, members, kbCard };
   },
   pendingComponent: () => null,
 });

package/src/routes/_nav/workspaces/$workspaceId/settings/route.lazy.tsx

@@ -28,7 +28,7 @@ import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { LucideIconPicker } from "@/components/shared-kit/icons/lucide-icon-picker";
 
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
-import { DeleteWorkspaceOptions } from "@/components/workspace/delete-workspace-options";
+import { DeleteWorkspaceOptions } from "@/components/workspace/dialogs/delete-workspace-options";
 import {
   updateWorkspaceFn,
   deleteWorkspaceFn,

package/src/routes/_nav/workspaces/index.lazy.tsx

@@ -30,9 +30,9 @@ import {
 import { Separator } from "@/components/ui/separator";
 import { GlyphMatrix } from "@/components/magicui/glyph-matrix";
 import { LucideIconByName } from "@/components/shared-kit/icons/lucide-icon-picker/lucide-icon-by-name";
-import { CreateWorkspaceDialog } from "@/components/workspace/create-workspace-dialog";
-import { DeleteWorkspaceOptions } from "@/components/workspace/delete-workspace-options";
-import { EditWorkspaceDialog } from "@/components/workspace/edit-workspace-dialog";
+import { CreateWorkspaceDialog } from "@/components/workspace/dialogs/create-workspace-dialog";
+import { DeleteWorkspaceOptions } from "@/components/workspace/dialogs/delete-workspace-options";
+import { EditWorkspaceDialog } from "@/components/workspace/dialogs/edit-workspace-dialog";
 import { NameConfirmDialog } from "@/components/shared-kit/dialogs/name-confirm-dialog";
 import { toggleWorkspacePinFn, deleteWorkspaceFn } from "@/server/serverFns/workspace";
 import { toast } from "@/components/ui/sonner";

package/src/routes/api/search.ts

@@ -0,0 +1,13 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { createFromSource } from 'fumadocs-core/search/server'
+import { source } from '@/lib/source'
+
+const server = createFromSource(source)
+
+export const Route = createFileRoute('/api/search')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => server.GET(request),
+    },
+  },
+})

package/src/routes/docs.tsx

@@ -0,0 +1,9 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+import { getLocale } from '@/paraglide/runtime.js'
+
+export const Route = createFileRoute('/docs')({
+  beforeLoad: () => {
+    const lang = getLocale()
+    throw redirect({ to: '/$lang/docs/$', params: { lang, _splat: '' } })
+  },
+})

package/src/server/__tests__/agent-crud.test.ts

@@ -178,14 +178,14 @@ describe('agent-crud serverFn', () => {
 
     it('FeatureUnavailableError / FeatureForbiddenError → 抛错不建', async () => {
       mocks.requireFeature.mockRejectedValue(new Error('FeatureUnavailableError: xxx'))
-      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toMatchObject({ message: expect.stringMatching(/FeatureUnavailable|FeatureForbidden/) })
+      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toThrow(/FeatureUnavailable|FeatureForbidden/)
       expect(mocks.create).not.toHaveBeenCalled()
     })
 
     it('ResourceLimitError → 抛错不建', async () => {
       mocks.requireFeature.mockResolvedValue(undefined as any)
       mocks.requireResource.mockRejectedValue(new Error('ResourceLimitError: agentQuota 已达上限'))
-      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toMatchObject({ message: expect.stringMatching(/ResourceLimit|已达上限/) })
+      await expect(createAgentFn({ data: { name: 'X', systemPrompt: 'Y' } })).rejects.toThrow(/ResourceLimit|已达上限/)
       expect(mocks.create).not.toHaveBeenCalled()
     })
 
@@ -236,7 +236,7 @@ describe('agent-crud serverFn', () => {
 
     it('userId 不匹配 → 抛错且不调用 update', async () => {
       mocks.findFirst.mockResolvedValue(null)
-      await expect(updateAgentFn({ data: { id: 'ag-other', name: 'X' } })).rejects.toMatchObject({ message: expect.stringMatching(/无权限|FORBIDDEN|not found/) })
+      await expect(updateAgentFn({ data: { id: 'ag-other', name: 'X' } })).rejects.toThrow(/无权限|FORBIDDEN|not found/)
       expect(mocks.update).not.toHaveBeenCalled()
     })
 
@@ -272,7 +272,7 @@ describe('agent-crud serverFn', () => {
 
     it('userId 不匹配 → 抛错且不调用 update', async () => {
       mocks.findFirst.mockResolvedValue(null)
-      await expect(deleteAgentFn({ data: { id: 'ag-other' } })).rejects.toMatchObject({ message: expect.stringMatching(/无权限|FORBIDDEN|not found/) })
+      await expect(deleteAgentFn({ data: { id: 'ag-other' } })).rejects.toThrow(/无权限|FORBIDDEN|not found/)
       expect(mocks.update).not.toHaveBeenCalled()
     })
   })

package/src/server/__tests__/chat-conversations.test.ts

@@ -145,9 +145,7 @@ describe("createConversationFn", () => {
 
     await expect(
       createConversationFn({ data: { agentId: "agent-xxx" } }),
-    ).rejects.toMatchObject({
-      message: expect.stringContaining("not found"),
-    })
+    ).rejects.toThrow("not found")
     expect(mocks.create).not.toHaveBeenCalled()
   })
 

package/src/server/__tests__/fetch-guard.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from "vitest";
+import { assertFetchableUrl, FetchGuardError } from "../fetch-guard";
+
+describe("assertFetchableUrl SSRF 主机防护", () => {
+  it.each([
+    "http://127.0.0.1:8080/api",
+    "http://localhost:3000/x",
+    "http://10.0.0.5/internal",
+    "http://172.16.1.1/admin",
+    "http://192.168.1.1/router",
+    "http://169.254.169.254/latest/meta-data", // 云元数据
+    "http://0.0.0.0/",
+    "http://[::1]:8080/",
+    "http://[fe80::1]/", // 链路本地
+    "http://[::ffff:127.0.0.1]/", // IPv4-mapped IPv6 回环（SSRF 经典绕过）
+    "http://[::ffff:a9fe:a9fe]/", // IPv4-mapped 云元数据
+    "http://[::ffff:10.0.0.5]/", // mapped 归一形态 ::ffff:a00:5（URL 压缩组前导零）
+    "http://[::ffff:0:0:127.0.0.1]/", // IPv4-translated 变体（::ffff:0:0/96 前缀）
+    "http://[::127.0.0.1]/", // IPv4-compatible ::/96 回环
+    "http://[::a9fe:a9fe]/", // IPv4-compatible 云元数据
+    "http://[::10.0.0.5]/", // IPv4-compatible A 类私网
+    "http://[fc00::1]/", // IPv6 ULA 私网段
+    "http://[fd12:3456::1]/",
+  ])("拒绝私网/回环/元数据地址：%s", (url) => {
+    expect(() => assertFetchableUrl(url)).toThrow(FetchGuardError);
+  });
+
+  it.each([
+    "https://api.openai.com/v1/models",
+    "http://example.com/page",
+  ])("放行公网地址：%s", (url) => {
+    expect(() => assertFetchableUrl(url)).not.toThrow();
+  });
+
+  it.each([
+    ["http://[2001:4860:4860::8888]/", "普通公网 IPv6"],
+    ["http://[::ffff:8.8.8.8]/", "IPv4-mapped 公网（防映射还原分支误伤）"],
+    ["http://[::ffff:0:0:8.8.8.8]/", "IPv4-mapped 翻译形态公网（防误伤对称覆盖）"],
+    ["http://[::8.8.8.8]/", "IPv4-compatible 公网（防内嵌分支误伤）"],
+    ["http://[2606:4700:4700::1111]/", "Cloudflare 公网 IPv6"],
+  ])("公网 IPv6 地址放行：%s（%s）", (url) => {
+    expect(() => assertFetchableUrl(url)).not.toThrow();
+  });
+
+  it.each([
+    "file:///etc/passwd",
+    "ftp://example.com/f",
+    "gopher://example.com/",
+  ])("仅允许 http/https 协议：%s", (url) => {
+    expect(() => assertFetchableUrl(url)).toThrow(FetchGuardError);
+  });
+
+  it("allowPrivate 显式放行内网（SearXNG 自托管场景）", () => {
+    expect(() =>
+      assertFetchableUrl("http://127.0.0.1:8888/search", { allowPrivate: true }),
+    ).not.toThrow();
+  });
+
+  it("allowHosts 白名单精确匹配放行", () => {
+    expect(() =>
+      assertFetchableUrl("https://searx.internal.corp/search", {
+        allowedHosts: ["searx.internal.corp"],
+      }),
+    ).not.toThrow();
+    expect(() =>
+      assertFetchableUrl("https://evil.corp/search", {
+        allowedHosts: ["searx.internal.corp"],
+      }),
+    ).toThrow(FetchGuardError);
+  });
+
+  it.each([
+    ["http://2130706433/", "十进制整数 127.0.0.1"],
+    ["http://0x7f000001/", "十六进制 127.0.0.1"],
+    ["http://017700000001/", "八进制整数 127.0.0.1"],
+    ["http://0177.0.0.1/", "点分八进制 127.0.0.1"],
+    ["http://99999999999999/", "超出 IPv4 范围（URL 构造期抛 Invalid URL）"],
+  ])("拒绝整数形式 IP 混淆：%s（%s）", (url) => {
+    expect(() => assertFetchableUrl(url)).toThrow(FetchGuardError);
+  });
+
+  it("返回规范化 URL 供 fetch 使用", () => {
+    expect(assertFetchableUrl("https://example.com/a?q=1").href).toBe(
+      "https://example.com/a?q=1",
+    );
+  });
+
+  it("大写协议与省略段 IPv4 规范化后仍被拒绝", () => {
+    expect(() => assertFetchableUrl("HTTP://127.0.0.1/x")).toThrow(FetchGuardError);
+    expect(() => assertFetchableUrl("http://127.1/")).toThrow(FetchGuardError);
+  });
+
+  it("协议被拒绝时错误类型仍是 FetchGuardError", () => {
+    expect(() => assertFetchableUrl("file:///etc/passwd")).toThrow(FetchGuardError);
+    expect(() => assertFetchableUrl("file:///etc/passwd")).toThrow(
+      /不在允许范围/,
+    );
+  });
+});

package/src/server/__tests__/permissions.test.ts

@@ -62,8 +62,6 @@ describe('requirePermission', () => {
   it('有角色但 checkPermission 返回 none → 拒绝', async () => {
     vi.mocked(prisma.roleAssignment.count).mockResolvedValue(1)
     vi.mocked(getProService('permissions')!.checkPermission).mockResolvedValue('none')
-    await expect(requirePermission('u1', 'knowledge', 'write')).rejects.toMatchObject({
-      name: 'PermissionForbiddenError',
-    })
+    await expect(requirePermission('u1', 'knowledge', 'write')).rejects.toBeInstanceOf(PermissionForbiddenError)
   })
 })

package/src/server/__tests__/resources.team-seats.test.ts

@@ -40,6 +40,7 @@ describe('requireTeamSeats', () => {
     vi.mocked(prisma.plan.findFirst).mockResolvedValue(freePlan as never)
     vi.mocked(prisma.teamMembership.count).mockResolvedValue(5)
     vi.mocked(prisma.teamInvitation.count).mockResolvedValue(0)
+    await expect(requireTeamSeats('owner1', 'member', 1)).rejects.toBeInstanceOf(ResourceLimitError)
     await expect(requireTeamSeats('owner1', 'member', 1)).rejects.toMatchObject({
       resource: 'seats',
     })
@@ -53,6 +54,7 @@ describe('requireTeamSeats', () => {
     } as never)
     vi.mocked(prisma.teamMembership.count).mockResolvedValue(16)
     vi.mocked(prisma.teamInvitation.count).mockResolvedValue(0)
+    await expect(requireTeamSeats('owner1', 'guest', 1)).rejects.toBeInstanceOf(ResourceLimitError)
     await expect(requireTeamSeats('owner1', 'guest', 1)).rejects.toMatchObject({
       resource: 'guestSeats',
     })

package/src/server/__tests__/skill-crud.test.ts

@@ -181,7 +181,7 @@ describe('skill-crud serverFn', () => {
       })
       await expect(
         createSkillFn({ data: { name: 'daily-sum', title: 'X', template: 'Y' } }),
-      ).rejects.toMatchObject({ message: expect.stringContaining('已存在') })
+      ).rejects.toThrow('已存在')
     })
 
     it('FeatureForbiddenError → 抛错不建', async () => {
@@ -232,7 +232,7 @@ describe('skill-crud serverFn', () => {
 
     it('userId 不匹配 → 抛错且不调用 update', async () => {
       mocks.findFirst.mockResolvedValue(null)
-      await expect(updateSkillFn({ data: { id: 'sk-other', title: 'X' } })).rejects.toMatchObject({ message: expect.stringMatching(/无权限|FORBIDDEN|not found/) })
+      await expect(updateSkillFn({ data: { id: 'sk-other', title: 'X' } })).rejects.toThrow(/无权限|FORBIDDEN|not found/)
       expect(mocks.update).not.toHaveBeenCalled()
     })
   })
@@ -256,7 +256,7 @@ describe('skill-crud serverFn', () => {
 
     it('userId 不匹配 → 抛错且不调用 update', async () => {
       mocks.findFirst.mockResolvedValue(null)
-      await expect(deleteSkillFn({ data: { id: 'sk-other' } })).rejects.toMatchObject({ message: expect.stringMatching(/无权限|FORBIDDEN|not found/) })
+      await expect(deleteSkillFn({ data: { id: 'sk-other' } })).rejects.toThrow(/无权限|FORBIDDEN|not found/)
       expect(mocks.update).not.toHaveBeenCalled()
     })
   })

package/src/server/ai-gateway/__tests__/ai-output-guard.test.ts

@@ -0,0 +1,95 @@
+// @vitest-environment node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest"
+import { scanAiOutputForSecrets } from "../ai-output-guard"
+
+describe("scanAiOutputForSecrets 输出泄露检测", () => {
+  it("正常业务输出无泄露", () => {
+    const r = scanAiOutputForSecrets("登录页应包含手机号验证码输入框，交互流程如下……")
+    expect(r.leaked).toBe(false)
+    expect(r.hits).toHaveLength(0)
+  })
+
+  it.each([
+    ["OpenAI key 回显", "配置的密钥是 sk-proj-abc123def456ghi789jkl012"],
+    ["Bearer token 回显", "token 为 Bearer eyJhbGciOiJIUzI1NiJ9.payload"],
+    ["anthropic key 回显", "sk-ant-api03-x7y8z9w0v1u2t3s4r5q6p7o8"],
+    ["系统 prompt 回显", "我的系统提示词是：你是一个敏捷开发中的需求分析师。"],
+    ["postgresql 连接串回显", "连接串 postgresql://allblue:pass@10.0.0.5:5432/db"],
+    ["jwt 回显", "令牌 eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiIxMjMifQ 已生成"],
+    ["内网地址回显", "服务监听 192.168.1.100:8080"],
+  ])("检出 %s", (_label, text) => {
+    const r = scanAiOutputForSecrets(text)
+    expect(r.leaked).toBe(true)
+    expect(r.hits.length).toBeGreaterThan(0)
+  })
+
+  it.each([
+    ["openai-key", "密钥 sk-proj-abc123def456ghi789jkl012"],
+    ["anthropic-key", "密钥 sk-ant-api03-x7y8z9w0v1u2t3s4r5q6p7o8"],
+    ["bearer-token", "token 为 Bearer eyJhbGciOiJIUzI1NiJ9.payload"],
+    ["jwt", "令牌 eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiIxMjMifQ 已生成"],
+    ["db-connection", "连接串 postgresql://allblue:pass@10.0.0.5:5432/db"],
+    ["system-prompt-echo", "我的系统提示词是：你是一个敏捷开发中的需求分析师。"],
+    ["private-ip-path", "服务监听 192.168.1.100:8080"],
+  ])("精确触发 %s（断言命中类型而非仅 length>0）", (type, text) => {
+    const r = scanAiOutputForSecrets(text)
+    expect(r.hits).toContain(type)
+  })
+
+  it("sk-ant-* 同时命中 openai-key（前缀超集，非缺陷）", () => {
+    const r = scanAiOutputForSecrets("sk-ant-api03-x7y8z9w0v1u2t3s4r5q6p7o8")
+    expect(r.hits).toContain("openai-key")
+    expect(r.hits).toContain("anthropic-key")
+  })
+
+  it("命中清单不含原文泄露（防扫描器自身成为泄露面）", () => {
+    const secret = "sk-proj-abc123def456ghi789jkl012"
+    const r = scanAiOutputForSecrets(`密钥 ${secret} 已泄露`)
+    expect(JSON.stringify(r)).not.toContain(secret)
+  })
+
+  it("同一文本重复调用两次结果一致（/g 正则 lastIndex 复位）", () => {
+    const text = "配置 sk-proj-abc123def456ghi789jkl012 并部署到 192.168.1.100"
+    const a = scanAiOutputForSecrets(text)
+    const b = scanAiOutputForSecrets(text)
+    expect(b).toEqual(a)
+    expect(b.leaked).toBe(true)
+  })
+
+  it("短文本阈值：空串与 7 字符均短路为安全", () => {
+    expect(scanAiOutputForSecrets("").leaked).toBe(false)
+    expect(scanAiOutputForSecrets("ok").leaked).toBe(false)
+    expect(scanAiOutputForSecrets("1234567").leaked).toBe(false)
+  })
+
+  it("阈值边界：8 字符正常文本仍安全", () => {
+    expect(scanAiOutputForSecrets("一二三四五六七八").leaked).toBe(false)
+  })
+
+  it("8 字符真实 secret 恰好不被短文本短路漏检", () => {
+    // private-ip-path 的最短可命中形态，与短文本阈值 8 的边界重合——阈值上调即漏检
+    expect(scanAiOutputForSecrets("10.0.0.1").leaked).toBe(true)
+  })
+
+  it("正常业务文本（含内网地址的部署说明）命中 private-ip-path（设计权衡：宁误报）", () => {
+    const r = scanAiOutputForSecrets("部署在 192.168.1.100 的内网服务说明")
+    expect(r.hits).toContain("private-ip-path")
+  })
+})