@allbluecn/web-app 0.18.2 → 0.19.0

package/src/server/__tests__/testcase-bulk.test.ts

@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// bulkUpdateTestCasesFn folderId 归属校验测试（PR-8 审查 A）。组合死角：scope=all
+// 聚合圈选（任务 16）+ 批量条 FolderEditor（任务 28）+ 批量路径无归属校验 → 跨
+// 项目 folderId 静默错挂。修复后三层断言：模块不存在拒绝 / 模块不可见拒绝 /
+// 跨项目用例混入拒绝（均零写），合法归属与 folderId=null 放行。
+// mock 边界照 testcase-list-scope.test.ts：tanstack/react-start createServerFn
+// 桩 + prisma 层 mock，handler 端到端（断言 prisma 实收 where/data）。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const H = vi.hoisted(() => {
+  const fns = {
+    requireAuth: vi.fn(),
+  };
+  const db = {
+    memberFindMany: vi.fn(),
+    folderFindUnique: vi.fn(),
+    caseCount: vi.fn(),
+    caseUpdateMany: vi.fn(),
+    caseFindMany: vi.fn(),
+    storyFindUnique: vi.fn(),
+    transaction: vi.fn(),
+  };
+  return { fns, db };
+});
+const M = H.fns;
+const DB = H.db;
+
+vi.mock("@tanstack/react-start", () => {
+  // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
+  const createServerFn = () => {
+    const capture: { validator?: unknown; handler?: unknown } = {};
+    const api = {
+      validator: (v: unknown) => {
+        capture.validator = v;
+        return api;
+      },
+      handler: (h: unknown) => {
+        capture.handler = h;
+        return async (args?: { data?: unknown }) => {
+          const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
+          const data = v && v.parse ? v.parse(args?.data) : args?.data;
+          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+        };
+      },
+    };
+    return api;
+  };
+  return { createServerFn };
+});
+
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: H.fns.requireAuth }));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => ({
+    projectMember: { findMany: DB.memberFindMany },
+    testCaseFolder: { findUnique: DB.folderFindUnique },
+    testCase: {
+      count: DB.caseCount,
+      updateMany: DB.caseUpdateMany,
+      findMany: DB.caseFindMany,
+    },
+    story: { findUnique: DB.storyFindUnique },
+    $transaction: DB.transaction,
+  }),
+}));
+
+import { bulkUpdateTestCasesFn } from "@/server/serverFns/testcase/bulk";
+
+const U = "u-1";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: U } });
+  DB.memberFindMany.mockResolvedValue([{ projectId: "p1" }]);
+  DB.caseUpdateMany.mockResolvedValue({ count: 2 });
+  DB.caseCount.mockResolvedValue(0);
+});
+
+describe("bulkUpdateTestCasesFn folderId 归属校验（PR-8 审查 A）", () => {
+  it("模块不存在 → 拒绝且零写", async () => {
+    DB.folderFindUnique.mockResolvedValue(null);
+
+    await expect(
+      bulkUpdateTestCasesFn({ data: { caseIds: ["c1", "c2"], patch: { folderId: "f-x" } } }),
+    ).rejects.toThrow("模块不存在或无权访问");
+    expect(DB.caseUpdateMany).not.toHaveBeenCalled();
+  });
+
+  it("模块属其他项目（用户不可见）→ 拒绝且零写", async () => {
+    DB.folderFindUnique.mockResolvedValue({ id: "f-other", projectId: "pr-other" });
+
+    await expect(
+      bulkUpdateTestCasesFn({ data: { caseIds: ["c1"], patch: { folderId: "f-other" } } }),
+    ).rejects.toThrow("模块不存在或无权访问");
+    expect(DB.caseUpdateMany).not.toHaveBeenCalled();
+  });
+
+  it("scope=all 跨项目用例混入圈选 → 拒绝且零写（count 查询按 not 模块项目圈定）", async () => {
+    // 用户可见 p1+p2（聚合 scope），模块属 p1，但圈选含 p2 用例
+    DB.memberFindMany.mockResolvedValue([{ projectId: "p1" }, { projectId: "p2" }]);
+    DB.folderFindUnique.mockResolvedValue({ id: "f1", projectId: "p1" });
+    DB.caseCount.mockResolvedValue(1);
+
+    await expect(
+      bulkUpdateTestCasesFn({ data: { caseIds: ["c1", "c2"], patch: { folderId: "f1" } } }),
+    ).rejects.toThrow("存在不属于该模块所在项目的用例，已拒绝本次批量移动");
+    expect(DB.caseCount).toHaveBeenCalledWith({
+      where: { id: { in: ["c1", "c2"] }, projectId: { not: "p1" } },
+    });
+    expect(DB.caseUpdateMany).not.toHaveBeenCalled();
+  });
+
+  it("合法归属（模块与用例同项目）→ 放行落库 folderId", async () => {
+    DB.folderFindUnique.mockResolvedValue({ id: "f1", projectId: "p1" });
+    DB.caseCount.mockResolvedValue(0);
+
+    await expect(
+      bulkUpdateTestCasesFn({ data: { caseIds: ["c1", "c2"], patch: { folderId: "f1" } } }),
+    ).resolves.toEqual({ updated: 2 });
+    expect(DB.caseUpdateMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({ id: { in: ["c1", "c2"] } }),
+        data: { folderId: "f1" },
+      }),
+    );
+  });
+
+  it("folderId=null（移出分组）→ 不触发归属校验直接落库", async () => {
+    await expect(
+      bulkUpdateTestCasesFn({ data: { caseIds: ["c1"], patch: { folderId: null } } }),
+    ).resolves.toEqual({ updated: 2 });
+    expect(DB.folderFindUnique).not.toHaveBeenCalled();
+    expect(DB.caseUpdateMany).toHaveBeenCalledWith(
+      expect.objectContaining({ data: { folderId: null } }),
+    );
+  });
+});

package/src/server/__tests__/testcase-list-scope.test.ts

@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 用例列表/分组「全部项目」聚合 scope 测试（二期 TC-A，对齐 story/bug 域
+// resolveStoryScopeProjectIds 语义）。三场景钉死（复审 P0-1 修正语义）：
+// ① projectId 缺省 → where.projectId = { in: 成员关系全部项目 id }（聚合，
+//   禁止静默回退单项目；聚合查询须排除 suspended）；
+// ② 非成员/不存在 projectId → 与 story 现网同构：静默回退内置独立项目，
+//   where 不含目标项目 id（不抛错、不泄漏存在性）；
+// ③ 单项目（有效成员）→ 仅该项目（{ in: [projectId] }），且不触发成员关系聚合查询。
+// mock 边界：只 mock prisma 层（@allbluecn/database + get-prisma），
+// resolveStoryScopeProjectIds 走真实现——其聚合/回退语义已由
+// server/__tests__/builtin-project.test.ts 锁定，此处验证 handler 接线端到端
+// （断言 prisma testCase.findMany / groupBy 实际收到的 where）。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const H = vi.hoisted(() => {
+  const fns = {
+    requireAuth: vi.fn(),
+    isUserInTeam: vi.fn(),
+  };
+  const db = {
+    memberFindUnique: vi.fn(),
+    memberFindMany: vi.fn(),
+    projectFindFirst: vi.fn(),
+    caseFindMany: vi.fn(),
+    caseGroupBy: vi.fn(),
+  };
+  return { fns, db };
+});
+const M = H.fns;
+const DB = H.db;
+
+vi.mock("@tanstack/react-start", () => {
+  // 每个 serverFn 实例独立持有自己的 capture，避免同模块多实例共用导致 validator 串号
+  const createServerFn = () => {
+    const capture: { validator?: unknown; handler?: unknown } = {};
+    const api = {
+      validator: (v: unknown) => {
+        capture.validator = v;
+        return api;
+      },
+      handler: (h: unknown) => {
+        capture.handler = h;
+        return async (args?: { data?: unknown }) => {
+          const v = capture.validator as { parse?: (d: unknown) => unknown } | undefined;
+          const data = v && v.parse ? v.parse(args?.data) : args?.data;
+          return (h as (p: { data: unknown }) => Promise<unknown>)({ data });
+        };
+      },
+    };
+    return api;
+  };
+  return { createServerFn };
+});
+
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: H.fns.requireAuth }));
+vi.mock("@/server/team-access", () => ({ isUserInTeam: H.fns.isUserInTeam }));
+
+// 成员关系查询层：resolveStoryScopeProjectIds（真实现）依赖此 mock
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    project: { findFirst: H.db.projectFindFirst },
+    projectMember: {
+      findUnique: H.db.memberFindUnique,
+      findMany: H.db.memberFindMany,
+    },
+  },
+}));
+
+vi.mock("@allbluecn/database/get-prisma", () => ({
+  getPrisma: async () => ({
+    testCase: { findMany: H.db.caseFindMany, groupBy: H.db.caseGroupBy },
+  }),
+}));
+
+import { listTestCasesFn } from "@/server/serverFns/testcase/testcase-crud";
+import { listGroupsFn } from "@/server/serverFns/testcase/testcase-groups";
+
+const U = "u-1";
+const INDEPENDENT = "pr-independent";
+
+interface Scenario {
+  name: string;
+  arg: Record<string, unknown>;
+  /** DB mock 预置（成员关系/项目查询层） */
+  setup: () => void;
+  /** 期望 where.projectId */
+  expected: unknown;
+  /** 断言 where 序列化后不含该项目 id（防越权泄漏） */
+  forbiddenId?: string;
+  /** 断言未触发成员关系聚合查询（单项目路径） */
+  noAggregate?: boolean;
+}
+
+const SCENARIOS: Scenario[] = [
+  {
+    name: "① projectId 缺省 → where 含成员关系全部项目 id（聚合，排除 suspended）",
+    arg: {},
+    setup: () => {
+      DB.memberFindMany.mockResolvedValue([{ projectId: "p1" }, { projectId: "p2" }]);
+    },
+    expected: { in: ["p1", "p2"] },
+  },
+  {
+    name: "② 非成员/不存在 projectId → 回退内置独立项目，where 不含目标项目 id（不抛错不泄漏）",
+    arg: { projectId: "pr-other" },
+    setup: () => {
+      DB.memberFindUnique.mockResolvedValue(null);
+      DB.projectFindFirst.mockResolvedValue({ id: INDEPENDENT });
+    },
+    expected: { in: [INDEPENDENT] },
+    forbiddenId: "pr-other",
+  },
+  {
+    name: "③ 单项目（有效成员）→ where 仅含该项目，且不触发成员关系聚合查询",
+    arg: { projectId: "p1" },
+    setup: () => {
+      DB.memberFindUnique.mockResolvedValue({ status: "active" });
+    },
+    expected: { in: ["p1"] },
+    noAggregate: true,
+  },
+];
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: U } });
+  DB.caseFindMany.mockResolvedValue([]);
+  DB.caseGroupBy.mockResolvedValue([]);
+});
+
+describe("listTestCasesFn scope（全部项目聚合）", () => {
+  for (const s of SCENARIOS) {
+    it(s.name, async () => {
+      s.setup();
+
+      await listTestCasesFn({ data: s.arg });
+
+      expect(DB.caseFindMany).toHaveBeenCalledTimes(1);
+      const where = (DB.caseFindMany.mock.calls[0][0] as { where: Record<string, unknown> })
+        .where;
+      expect(where.projectId).toEqual(s.expected);
+      if (s.forbiddenId) {
+        expect(JSON.stringify(where)).not.toContain(s.forbiddenId);
+      }
+      if (s.noAggregate) {
+        expect(DB.memberFindMany).not.toHaveBeenCalled();
+      }
+    });
+  }
+
+  it("缺省聚合查询口径：projectMember.findMany 按成员关系圈定且排除 suspended", async () => {
+    DB.memberFindMany.mockResolvedValue([{ projectId: "p1" }]);
+
+    await listTestCasesFn({ data: {} });
+
+    expect(DB.memberFindMany).toHaveBeenCalledWith({
+      where: { userId: U, status: { not: "suspended" } },
+      select: { projectId: true },
+    });
+  });
+
+  it("缺省时其余筛选/归档闸门不受聚合影响（archived 缺省 → false）", async () => {
+    DB.memberFindMany.mockResolvedValue([{ projectId: "p1" }, { projectId: "p2" }]);
+
+    await listTestCasesFn({ data: { state: "draft" } });
+
+    expect(DB.caseFindMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { projectId: { in: ["p1", "p2"] }, archived: false, state: "draft" },
+        // 任务 25 起 id tiebreaker 补全序（boardOrder/sequenceId 同值行 cursor 翻页不抖动）
+        orderBy: [{ sequenceId: "asc" }, { id: "asc" }],
+        take: 50,
+      }),
+    );
+  });
+});
+
+describe("listGroupsFn scope（与列表同口径）", () => {
+  for (const s of SCENARIOS) {
+    it(s.name, async () => {
+      s.setup();
+
+      await listGroupsFn({ data: { ...s.arg, groupBy: "state" } });
+
+      expect(DB.caseGroupBy).toHaveBeenCalledTimes(1);
+      const where = (DB.caseGroupBy.mock.calls[0][0] as { where: Record<string, unknown> })
+        .where;
+      expect(where.projectId).toEqual(s.expected);
+      if (s.forbiddenId) {
+        expect(JSON.stringify(where)).not.toContain(s.forbiddenId);
+      }
+      if (s.noAggregate) {
+        expect(DB.memberFindMany).not.toHaveBeenCalled();
+      }
+    });
+  }
+});

package/src/server/ai-gateway/__tests__/chat-handler-prompt-key.test.ts

@@ -25,6 +25,25 @@ vi.mock("../provider-tools", () => ({ hasNativeWebSearch: vi.fn(() => false) }))
 vi.mock("@/server/serverFns/web-search", () => ({
   isSearxngEnabled: vi.fn(() => false),
 }))
+// story-handler / handleChatRequest 链路所需（threadId 贯通用例）：
+// chat 改为 mock 断言捕获，其余导出（defineChatMiddleware/defineInterrupt 等
+// middlewares/*.ts 顶层调用）保留 actual，避免逐个枚举补齐。
+vi.mock("@tanstack/ai", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@tanstack/ai")>()
+  return {
+    ...actual,
+    chat: vi.fn(),
+  }
+})
+vi.mock("../durability/reaper-lazy", () => ({ scheduleLazyReap: vi.fn() }))
+vi.mock("../adapter", () => ({
+  createAdapter: vi.fn(() => "adapter"),
+  createProviderAdapter: vi.fn(async () => "adapter"),
+  resolveAiConfig: vi.fn(async () => null),
+}))
+vi.mock("../runs/agent-runtime", () => ({
+  resolveAgentFor: vi.fn(async () => null),
+}))
 
 import {
   type PromptDefinition,
@@ -35,8 +54,14 @@ import {
 } from "../prompts/registry"
 import {
   assembleSystemPrompts,
+  handleChatRequest,
   type AssembleSystemPromptsInput,
 } from "../chat-handler"
+import { handleStoryAiRequest } from "../story-handler"
+import { chat } from "@tanstack/ai"
+import { getPorts } from "../runtime"
+import { resolveDefaultProviderConfig } from "../provider-router"
+import { resolveUnifiedAiRoute, type UnifiedAiStream } from "../unified-router"
 
 describe("assembleSystemPrompts", () => {
   beforeEach(() => {
@@ -242,3 +267,84 @@ describe("assembleSystemPrompts", () => {
   })
 
 })
+
+// threadId 服务端贯通（TanStack AI 1.0 必填要求的前置兜底）：
+// ① chat-handler 对非 1.0 客户端缺省 threadId 兜底 uuid；
+// ② story-handler 裸 chat() 幂等派生 story-<storyId>。
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+function mockAuthedSession() {
+  vi.mocked(getPorts).mockReturnValue({
+    auth: { getSession: async () => ({ user: { id: "u1" } }) },
+  } as unknown as ReturnType<typeof getPorts>)
+}
+
+async function collect(it: AsyncIterable<unknown>): Promise<unknown[]> {
+  const out: unknown[] = []
+  for await (const chunk of it) out.push(chunk)
+  return out
+}
+
+describe("handleChatRequest threadId 服务端兜底", () => {
+  beforeEach(() => {
+    mockAuthedSession()
+    vi.mocked(resolveUnifiedAiRoute).mockResolvedValue({
+      kind: "local",
+      stream: (async function* () {
+        yield { type: "TEXT", delta: "ok" }
+      })() as unknown as UnifiedAiStream,
+    })
+  })
+
+  it("请求体无 threadId → 兜底生成 uuid 形态值传给 resolveUnifiedAiRoute，不因缺省报错", async () => {
+    const request = new Request("http://localhost/api/chat", {
+      method: "POST",
+      body: JSON.stringify({ messages: [{ role: "user", content: "hi" }] }),
+    })
+    const chunks = await collect(handleChatRequest(request))
+    expect(chunks).toHaveLength(1)
+    const routeReq = vi.mocked(resolveUnifiedAiRoute).mock.calls[0][0]
+    expect(routeReq.threadId).toMatch(UUID_RE)
+  })
+})
+
+describe("story-handler threadId 幂等派生", () => {
+  function makeStoryRequest(): Request {
+    return new Request("http://localhost/api/story-ai", {
+      method: "POST",
+      body: JSON.stringify({
+        mode: "create",
+        prompt: "生成登录需求",
+        context: { story: { id: "abc123", name: "登录" } },
+      }),
+    })
+  }
+
+  beforeEach(() => {
+    mockAuthedSession()
+    vi.mocked(resolveDefaultProviderConfig).mockResolvedValue({
+      providerId: "prov-1",
+      model: "gpt-test",
+      apiKey: "key",
+      baseUrl: "https://example.test",
+      adapterKind: "openrouter",
+    } as unknown as Awaited<ReturnType<typeof resolveDefaultProviderConfig>>)
+    vi.mocked(chat).mockReturnValue(
+      (async function* () {
+        yield { type: "TEXT", delta: "ok" }
+      })() as unknown as ReturnType<typeof chat>,
+    )
+  })
+
+  it("chat() 携带 threadId=story-<storyId>，同 story 重复请求值幂等", async () => {
+    vi.mocked(resolveSystemPrompt).mockResolvedValueOnce(["story prompt"])
+    await collect(handleStoryAiRequest(makeStoryRequest()))
+    const first = vi.mocked(chat).mock.calls[0][0] as { threadId?: string }
+    expect(first.threadId).toBe("story-abc123")
+
+    vi.mocked(resolveSystemPrompt).mockResolvedValueOnce(["story prompt"])
+    await collect(handleStoryAiRequest(makeStoryRequest()))
+    const second = vi.mocked(chat).mock.calls[1][0] as { threadId?: string }
+    expect(second.threadId).toBe("story-abc123")
+  })
+})

package/src/server/ai-gateway/__tests__/chat-stream-builder-sandbox.test.ts

@@ -183,10 +183,16 @@ describe("buildChatStreamWithTools 沙箱装配", () => {
     expect(mocks.buildSandboxMiddleware.mock.calls[0][0].policyLevel).toBe("readonly")
   })
 
-  it("sandbox=true 但无 threadId 时不装配（无法派生实例 key，静默跳过）", async () => {
+  it("sandbox=true 但无 threadId 时服务端兜底生成后照常装配（1.0 threadId 必填）", async () => {
     await buildChatStreamWithTools({ ...BASE_PARAMS, sandbox: true, threadId: undefined })
-    expect(mocks.buildSandboxMiddleware).not.toHaveBeenCalled()
-    expect(middlewareNames().map((mw) => mw.name)).not.toContain("sandbox")
+    const uuid =
+      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+    const sandboxThreadId = mocks.buildSandboxMiddleware.mock.calls[0][0]
+      .threadId as string
+    expect(sandboxThreadId).toMatch(uuid)
+    // 同一次请求内 chat() 与沙箱中间件必须同源同 threadId
+    expect(callOptions()?.threadId).toBe(sandboxThreadId)
+    expect(middlewareNames().map((mw) => mw.name)).toContain("sandbox")
   })
 
   it("沙箱 durable run 铸造 runId 并同源传给 chat()（journal 与 run 记录对齐）", async () => {

package/src/server/ai-gateway/__tests__/conformance.test.ts

@@ -36,8 +36,9 @@ const CONFORMANCE_USER_ID = "conformance-test-user"
  *   npx vitest run src/server/ai-gateway/__tests__/conformance.test.ts
  *
  * 本轮只提供 chat 四状态 store（messages / runs / interrupts / metadata），
- * 故意不提供 generation 三件（generationRuns / artifacts / blobs）——conformance
- * 契约要求「故意省略的 store 必须显式声明」，否则静默缺口会直接失败。
+ * 故意不提供 generation 三件（generationRuns / artifacts / blobs）与 1.0 新增的
+ * activities store——conformance 契约要求「故意省略的 store 必须显式声明」，
+ * 否则静默缺口会直接失败。
  *
  * ⚠ testkit 用固定 userId（CONFORMANCE_USER_ID）驱动所有 store，而 AllBlue
  * schema 有完整 FK 链（User → ChatThread → ChatRun → ChatInterrupt），testkit
@@ -68,7 +69,7 @@ describe.skipIf(!process.env.DATABASE_URL)("Prisma persistence conformance", ()
     "AllBlue Prisma adapter",
     () => createPrismaPersistence(CONFORMANCE_USER_ID),
     {
-      skip: ["generationRuns", "artifacts", "blobs"],
+      skip: ["generationRuns", "artifacts", "blobs", "activities"],
       skipMethods: [],
     },
   )

package/src/server/ai-gateway/adapter.ts

@@ -283,7 +283,8 @@ export async function runChat(
   if (options?.outputSchema) {
     return await streamToStructuredText(stream)
   }
-  return streamToText(stream)
+  // 1.0 起 streamToText 返回 ChatResult { text, chunks }，取拼接文本。
+  return (await streamToText(stream)).text
 }
 
 /** R17 修复（2026-10-03 实测截断缺陷）：provider 不发 structured-output.complete
@@ -329,5 +330,6 @@ export async function runChatWithModel(
   if (options.outputSchema) {
     return await streamToStructuredText(stream)
   }
-  return streamToText(stream)
+  // 1.0 起 streamToText 返回 ChatResult { text, chunks }，取拼接文本。
+  return (await streamToText(stream)).text
 }

package/src/server/ai-gateway/chat-handler.ts

@@ -279,7 +279,7 @@ export const chatBodySchema = z.object({
       z.object({ type: z.literal("local"), path: z.string() }),
       z.object({ type: z.literal("cloud"), workspaceId: z.string() }),
     ]).optional(),
-   threadId: z.string().optional(),
+   threadId: z.string().min(1).optional(),
   runId: z.string().optional(),
   parentRunId: z.string().optional(),
   resume: z.array(z.any()).optional(),
@@ -388,7 +388,7 @@ export async function* handleChatRequest(
   scheduleLazyReap()
 
   const raw = await (options?.body ?? request.json())
-  const body = { ...raw, ...(raw.forwardedProps ?? raw.data ?? {}) }
+  const body = { ...raw, ...(raw.forwardedProps ?? {}) }
   const parsed = chatBodySchema.safeParse({
     ...mergeChatOverrides(options?.overrides),
     ...body,
@@ -401,6 +401,10 @@ export async function* handleChatRequest(
     )
   }
   const { messages, allowedTools, knowledgeBaseIds, temperature, webSearchEnabled, codeModeEnabled, sandbox, model, provider, workspaceId, workspaceContext, threadId, runId, parentRunId, resume, attachments } = parsed.data
+  // 1.0 起 threadId 为必填：非 1.0 客户端缺省时由服务端兜底生成（每次请求即新会话），
+  // 防 resolveUnifiedAiRoute 的 durability/memory 装配与 SaaS 转发在缺参时静默降级。
+  // 空字符串已在 schema 被 min(1) 拒绝，这里只需处理 undefined。
+  const effectiveThreadId = threadId ?? crypto.randomUUID()
   // 计费闸只在请求真的启用沙箱时才走：feature 未开通或分钟配额耗尽都在这一步
   // fail-closed，不会白付一次 provider 装配与沙箱创建的成本。
   // 知识库所有权校验：过滤客户端传入的非法 KB ID（非自有/非所属工作空间共享）
@@ -507,7 +511,7 @@ export async function* handleChatRequest(
     codeModeEnabled,
     sandbox,
     durabilityFactory: options?.durabilityFactory,
-    threadId,
+    threadId: effectiveThreadId,
     runId,
     parentRunId,
     resume,
@@ -518,7 +522,11 @@ export async function* handleChatRequest(
   }, request)
 
   if (route.kind === 'remote') {
-    yield* forwardToSaas(route, request, parsed.data as Record<string, unknown>)
+    // 透传体同步改用兜底后的 threadId：SaaS 侧与本地链路看到同一会话标识。
+    yield* forwardToSaas(route, request, {
+      ...parsed.data,
+      threadId: effectiveThreadId,
+    } as Record<string, unknown>)
     return
   }
 
@@ -533,7 +541,7 @@ async function* forwardToSaas(
   const body = rawBody ?? {}
   const fwdBody = {
     ...body,
-    ...(body.forwardedProps ?? body.data ?? {}),
+    ...(body.forwardedProps ?? {}),
     model: route.model ?? (body.model as string | undefined),
   }
 

package/src/server/ai-gateway/chat-stream-builder.ts

@@ -66,8 +66,8 @@ interface BuildChatStreamParams {
   knowledgeBaseIds?: string[]
   /** 请求级编排模式开关（UI 开关传入）。与服务端 env 门控为「与」关系，任一为 false 即不启用。 */
   codeModeEnabled?: boolean
-  /** 请求级沙箱执行开关（UI 开关传入）。需 threadId 在场才装配——无线程无法
-   * 派生沙箱实例 key，静默跳过而非退回全局共享沙箱。 */
+  /** 请求级沙箱执行开关（UI 开关传入）。1.0 起 threadId 服务端兜底恒有值，
+   * 装配实质仅由本开关决定。 */
   sandbox?: boolean
   /** 多实例 durable runs 装配链（chat.ts 创建，与 SSE transport 共用同一 producer key）。 */
   durabilityFactory?: PgStreamDurabilityFactory
@@ -132,11 +132,15 @@ export async function buildChatStreamWithTools(
   // run 记录会对不上。非沙箱请求保持原样（undefined 时由 chat 内部生成）。
   const effectiveRunId = params.runId ?? (params.sandbox ? randomUUID() : undefined)
 
+  // 1.0 起 chat() 的 threadId 为必填：调用方缺省时由服务端兜底生成
+  // （内部一次性生成链路如 runChatStream，每次请求即独立线程）。
+  const effectiveThreadId = params.threadId ?? randomUUID()
+
   const context: AppContext = {
     userId: params.userId,
     db: prisma,
     knowledgeBaseIds: params.knowledgeBaseIds,
-    threadId: params.threadId,
+    threadId: effectiveThreadId,
     workspaceId: usageWorkspaceId ?? undefined,
     provider: params.usageProvider,
     model: params.usageModel,
@@ -184,10 +188,11 @@ export async function buildChatStreamWithTools(
     ReturnType<typeof buildSandboxMiddleware>
   >["middleware"] | null = null
   let sandboxAdapter: any = null
-  if (params.sandbox && params.threadId) {
+  // effectiveThreadId 已兜底恒有值，沙箱装配实质收敛为 sandbox 开关（1.0 threadId 必填）。
+  if (params.sandbox) {
     let policyLevel = SANDBOX_DEFAULT_POLICY_LEVEL
     const thread = await prisma.chatThread.findUnique({
-      where: { id: params.threadId },
+      where: { id: effectiveThreadId },
       select: { sandboxPolicy: true },
     })
     if (isSandboxPolicyLevel(thread?.sandboxPolicy)) {
@@ -195,7 +200,7 @@ export async function buildChatStreamWithTools(
     }
 
     const result = await buildSandboxMiddleware({
-      threadId: params.threadId,
+      threadId: effectiveThreadId,
       policyLevel,
       // 与 withPersistence 共用同一 RunStore 实例：一份记录描述一次 run，
       // 避免两份 store 各自记录后互相矛盾。
@@ -223,7 +228,7 @@ export async function buildChatStreamWithTools(
     tools,
     interrupts: [planApprovalInterrupt],
     ...(Object.keys(modelOptions).length > 0 ? { modelOptions } : {}),
-    threadId: params.threadId,
+    threadId: effectiveThreadId,
     runId: effectiveRunId,
     parentRunId: params.parentRunId,
     resume: params.resume,