@allbluecn/web-app 0.19.2 → 0.19.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@allbluecn/web-app",
-  "version": "0.19.2",
+  "version": "0.19.4",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "files": [
@@ -57,11 +57,42 @@
   "publishConfig": {
     "access": "public"
   },
+  "packageManager": "pnpm@12.4.1",
+  "scripts": {
+    "dev": "vite --port 3000",
+    "build": "vite build",
+    "start": "vite preview",
+    "build:cf": "DEPLOY_TARGET=cloudflare vite build",
+    "deploy:cf": "pnpm build:cf && node ../../scripts/check-cf-worker-size.mjs . dist/server/wrangler.json && wrangler deploy -c dist/server/wrangler.json",
+    "preview:cf": "pnpm build:cf && wrangler dev -c dist/server/wrangler.json --test-scheduled --port 8787",
+    "prelint": "node scripts/check-no-use-client.mjs",
+    "lint": "eslint",
+    "test": "vitest",
+    "test:ui": "vitest --ui",
+    "test:run": "vitest run --project unit --project integration",
+    "pretest:coverage": "pnpm assemble",
+    "test:coverage": "vitest run --project unit --project integration --coverage.enabled",
+    "setup": "pnpm --filter @allbluecn/database generate && pnpm --filter @allbluecn/database migrate:dev",
+    "check:features": "tsx scripts/check-feature-keys.ts",
+    "check:no-use-client": "node scripts/check-no-use-client.mjs",
+    "assemble": "TSX_TSCONFIG_PATH=apps/web/tsconfig.json pnpm -w exec tsx packages/kernel/src/bin.ts --profile oss --assemble --app-dir apps/web",
+    "predev": "pnpm assemble && node scripts/check-sdk-versions.mjs",
+    "prebuild": "pnpm assemble && node scripts/check-sdk-versions.mjs",
+    "pretest": "pnpm assemble",
+    "pretest:run": "pnpm assemble",
+    "prepublishOnly": "node scripts/check-sdk-versions.mjs",
+    "typecheck": "node scripts/i18n/compile.mjs && tsc --noEmit",
+    "test:unit": "vitest run --project unit",
+    "test:visual": "vitest run --project vrt",
+    "test:bench": "vitest bench --project \"integration (bench)\"",
+    "perf:ttft": "node ../../scripts/perf/ttft-probe.mjs",
+    "security:zap": "bash ../../scripts/security/zap-local.sh"
+  },
   "dependencies": {
     "@ag-ui/core": "1.0.0",
-    "@allbluecn/collab-core": "0.2.0",
-    "@allbluecn/database": "0.9.4",
-    "@allbluecn/kernel": "0.10.0",
+    "@allbluecn/collab-core": "workspace:*",
+    "@allbluecn/database": "workspace:*",
+    "@allbluecn/kernel": "workspace:*",
     "@ariakit/react": "^0.4.28",
     "@auth/core": "^0.41.2",
     "@auth/prisma-adapter": "^2.11.2",
@@ -99,7 +130,7 @@
     "@radix-ui/react-dialog": "^1.1.23",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
     "@radix-ui/react-popover": "^1.1.15",
-    "@radix-ui/react-slot": "^1.2.4",
+    "@radix-ui/react-slot": "^1.5.0",
     "@radix-ui/react-visually-hidden": "^1.2.11",
     "@react-email/components": "^1.0.12",
     "@react-email/render": "^2.1.0",
@@ -201,7 +232,7 @@
     "fumadocs-ui": "16.15.8",
     "ioredis": "^5.11.0",
     "is-hotkey": "^0.2.0",
-    "jsdom": "^29.1.1",
+    "jsdom": "^30.1.3",
     "jszip": "^3.10.2",
     "katex": "^0.18.7",
     "leafer-editor": "2.3.0",
@@ -238,10 +269,9 @@
     "sqlite-vec": "^0.1.9",
     "start-authjs": "^1.0.2",
     "tailwind-merge": "^3.5.0",
-    "three": "^0.180.0",
     "tw-animate-css": "^1.4.0",
     "yjs": "^13.6.33",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@babel/parser": "^8.0.4",
@@ -272,10 +302,10 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@types/sanitize-html": "^2.16.2",
-    "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/browser-playwright": "5.0.0",
-    "@vitest/coverage-v8": "5.0.0",
-    "@vitest/ui": "5.0.0",
+    "@vitejs/plugin-react": "^6.1.2",
+    "@vitest/browser-playwright": "^5.0.5",
+    "@vitest/coverage-v8": "^5.0.5",
+    "@vitest/ui": "^5.0.5",
     "eslint": "^9",
     "eslint-plugin-unused-imports": "^4.4.1",
     "msw": "2.15.0",
@@ -285,9 +315,9 @@
     "tailwindcss": "^4.3.3",
     "tsx": "^4.22.0",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.70.1",
+    "typescript-eslint": "^8.72.0",
     "vite": "^8.3.3",
-    "vitest": "5.0.0",
+    "vitest": "catalog:",
     "vitest-browser-react": "2.3.0",
     "wrangler": "^4.99.0",
     "y-protocols": "1.0.7"
@@ -298,34 +328,5 @@
   },
   "optionalDependencies": {
     "@tauri-apps/api": "^2.11.1"
-  },
-  "scripts": {
-    "dev": "vite --port 3000",
-    "build": "vite build",
-    "start": "vite preview",
-    "build:cf": "DEPLOY_TARGET=cloudflare vite build",
-    "deploy:cf": "pnpm build:cf && node ../../scripts/check-cf-worker-size.mjs . dist/server/wrangler.json && wrangler deploy -c dist/server/wrangler.json",
-    "preview:cf": "pnpm build:cf && wrangler dev -c dist/server/wrangler.json --test-scheduled --port 8787",
-    "prelint": "node scripts/check-no-use-client.mjs",
-    "lint": "eslint",
-    "test": "vitest",
-    "test:ui": "vitest --ui",
-    "test:run": "vitest run --project unit --project integration",
-    "pretest:coverage": "pnpm assemble",
-    "test:coverage": "vitest run --project unit --project integration --coverage.enabled",
-    "setup": "pnpm --filter @allbluecn/database generate && pnpm --filter @allbluecn/database migrate:dev",
-    "check:features": "tsx scripts/check-feature-keys.ts",
-    "check:no-use-client": "node scripts/check-no-use-client.mjs",
-    "assemble": "TSX_TSCONFIG_PATH=apps/web/tsconfig.json pnpm -w exec tsx packages/kernel/src/bin.ts --profile oss --assemble --app-dir apps/web",
-    "predev": "pnpm assemble && node scripts/check-sdk-versions.mjs",
-    "prebuild": "pnpm assemble && node scripts/check-sdk-versions.mjs",
-    "pretest": "pnpm assemble",
-    "pretest:run": "pnpm assemble",
-    "typecheck": "node scripts/i18n/compile.mjs && tsc --noEmit",
-    "test:unit": "vitest run --project unit",
-    "test:visual": "vitest run --project vrt",
-    "test:bench": "vitest bench --project \"integration (bench)\"",
-    "perf:ttft": "node ../../scripts/perf/ttft-probe.mjs",
-    "security:zap": "bash ../../scripts/security/zap-local.sh"
   }
-}
+}

package/src/__tests__/desktop-connection-validate.test.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { connectionTest, validateConnectionUrl } from '../../../desktop/src/connection-manager/connection-test'
+import { DEFAULT_SAAS_URL } from '../../../desktop/src/connection-manager/constants'
+
+// 桌面 connection-manager 经 @desktop 别名编入 web 应用；
+// validateConnectionUrl 是 switch_mode 提交前的 scheme 白名单（安全相关），
+// 独立测试防止 file:/// 等任意 scheme 回归进 open_remote_window 链路。
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('validateConnectionUrl（桌面连接 URL 白名单）', () => {
+  it('空 URL 拒绝', () => {
+    expect(validateConnectionUrl('')).not.toBeNull()
+    expect(validateConnectionUrl('   ')).not.toBeNull()
+  })
+
+  it('无法解析的字符串拒绝', () => {
+    expect(validateConnectionUrl('not a url')).not.toBeNull()
+  })
+
+  it('非 http/https scheme 拒绝（file/ftp/javascript）', () => {
+    expect(validateConnectionUrl('file:///etc/passwd')).not.toBeNull()
+    expect(validateConnectionUrl('ftp://example.com')).not.toBeNull()
+    expect(validateConnectionUrl('javascript:alert(1)')).not.toBeNull()
+  })
+
+  it('http/https 合法（含尾斜杠裁剪）', () => {
+    expect(validateConnectionUrl('https://prd.mycompany.com')).toBeNull()
+    expect(validateConnectionUrl('http://10.0.0.8:3000/')).toBeNull()
+  })
+})
+
+describe('connectionTest（/api/health 探测）', () => {
+  it('非法 URL 直接返回错误，不发请求', async () => {
+    const fetchSpy = vi.fn()
+    vi.stubGlobal('fetch', fetchSpy)
+    const result = await connectionTest('file:///etc/passwd')
+    expect(result.ok).toBe(false)
+    expect(result.error).toBeTruthy()
+    expect(fetchSpy).not.toHaveBeenCalled()
+  })
+
+  it('HTTP 200 视为连通并返回延迟', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(null, { status: 200 })))
+    const result = await connectionTest(DEFAULT_SAAS_URL)
+    expect(result.ok).toBe(true)
+    expect(typeof result.latencyMs).toBe('number')
+  })
+
+  it('非 200 返回 HTTP 状态码错误', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(null, { status: 502 })))
+    const result = await connectionTest('https://example.com')
+    expect(result.ok).toBe(false)
+    expect(result.error).toBe('HTTP 502')
+  })
+
+  it('网络异常返回错误信息', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')))
+    const result = await connectionTest('https://example.com')
+    expect(result.ok).toBe(false)
+    expect(result.error).toBe('Failed to fetch')
+  })
+})

package/src/__tests__/knowledge/public/share-merge.test.ts

@@ -34,7 +34,13 @@ vi.mock('@allbluecn/database', () => ({
 
 import { prisma } from '@allbluecn/database'
 
-beforeEach(() => vi.clearAllMocks())
+beforeEach(() => {
+  vi.clearAllMocks()
+  // 实现把双写收进 $transaction（审计 🟡 原子性）；单例 mock 下 tx 与 prisma 同对象
+  ;(prisma as { $transaction?: unknown }).$transaction = vi.fn(
+    async (fn: (tx: unknown) => Promise<unknown>) => fn(prisma),
+  )
+})
 
 describe('shareToPublic', () => {
   it('已存在公共记录时,追加分享人', async () => {

package/src/__tests__/security/xss-sanitize.test.ts

@@ -1,6 +1,27 @@
 import { describe, expect, it } from 'vitest'
 import { sanitize, sanitizeSvg } from '@/lib/sanitize'
 
+describe('XSS 防护：style 属性白名单（allowedStyles 锁定）', () => {
+  it.each([
+    ['url() 外链打点', '<p style="background:url(https://evil.example/pixel)">x</p>', /url\s*\(/i],
+    ['expression 表达式', '<p style="width:expression(alert(1))">x</p>', /expression\s*\(/i],
+    ['javascript: 伪协议', '<p style="background:javascript:alert(1)">x</p>', /javascript:/i],
+    ['position:fixed 全屏覆盖', '<p style="position:fixed;top:0;left:0;width:100%">x</p>', /position\s*:\s*fixed/i],
+    ['未列入白名单的属性', '<p style="z-index:999;clip-path:circle(50%)">x</p>', /z-index|clip-path/i],
+  ])('%s 被清除', (_name, payload, marker) => {
+    expect(sanitize(payload)).not.toMatch(marker)
+  })
+
+  it.each([
+    ['颜色', '<span style="color:#ff0000;background-color:transparent">x</span>', 'color:#ff0000'],
+    ['字号字重', '<span style="font-size:14px;font-weight:bold">x</span>', 'font-size:14px'],
+    ['边距', '<div style="margin:4px;padding:8px">x</div>', 'margin:4px'],
+  ])('%s 等渲染必需声明保留', (_name, payload, keep) => {
+    expect(sanitize(payload)).toContain(keep)
+  })
+})
+
+
 // 安全测试样板：XSS 防护（渲染链路 DOMPurify 清理）。
 // 对应攻击面：用户输入 → 富文本/HTML 渲染 → 存储型/反射型 XSS。
 // 防线：AGENTS.md 约定「所有 HTML 渲染必须经过 sanitize() 清理」。

package/src/__tests__/setup.ts

@@ -18,6 +18,11 @@
 /// <reference types="vitest/globals" />
 import '@testing-library/jest-dom/vitest'
 
+// 单元测试默认环境变量：凭据加密通道（api-key-cipher / webhook-secret）需要一把密钥，
+// 生产由 API_KEY_ENCRYPTION_SECRET（或回退 AUTH_SECRET）提供；测试给固定值，勿用于部署
+process.env.AUTH_SECRET ||= 'unit-test-auth-secret'
+process.env.API_KEY_ENCRYPTION_SECRET ||= 'unit-test-cipher-secret'
+
 import { overwriteGetLocale } from '@/paraglide/runtime.js'
 
 // jsdom 无 ResizeObserver（@dnd-kit/dom 等库模块加载时引用）

package/src/__tests__/story-view.test.ts

@@ -74,9 +74,15 @@ vi.mock("@allbluecn/database", () => ({
 }));
 
 const USER_A = "user-a";
+// 完整 DisplayOptions（审计 🟡 2026-10-25 起写入侧按 displayOptionsSchema 校验，
+// 缺 orderDir/pageSize 等必填键会被拒）
+const baseDisplayOptions = {
+  groupBy: "state", subGroupBy: "none", orderBy: "manual", orderDir: "asc",
+  properties: [], showEmptyGroups: false, showSubItems: false, pageSize: 200,
+};
 const baseRow = {
   id: "v1", userId: USER_A, name: "视图1", description: null, icon: "list",
-  projectId: null, filters: [], displayOptions: { groupBy: "state", subGroupBy: "none", orderBy: "manual", properties: [], showEmptyGroups: false, showSubItems: false }, sortOrder: 0,
+  projectId: null, filters: [], displayOptions: baseDisplayOptions, sortOrder: 0,
   createdAt: new Date(), updatedAt: new Date(),
 };
 
@@ -107,7 +113,7 @@ describe("createStoryViewFn", () => {
       data: {
         name: "新视图", icon: "flag", projectId: undefined,
         filters: [{ id: "f", property: "state", operator: "is", value: "backlog" }],
-        displayOptions: { groupBy: "state", subGroupBy: "none", orderBy: "manual", properties: [], showEmptyGroups: false, showSubItems: false },
+        displayOptions: baseDisplayOptions,
       },
     });
     expect(mocks.create).toHaveBeenCalledWith(
@@ -123,6 +129,22 @@ describe("createStoryViewFn", () => {
       }),
     );
   });
+
+  // 审计 🟡（2026-10-25）：displayOptions 写入侧在 handler 内按
+  // displayOptionsSchema.parse 强校验，缺必填键（orderDir/pageSize）的
+  // 任意 JSON 在落库前被拒，不再直通入库
+  it("displayOptions 缺必填键时拒绝写入", async () => {
+    await expect(
+      createStoryViewFn({
+        data: {
+          name: "坏视图", icon: "flag", projectId: undefined,
+          filters: [],
+          displayOptions: { groupBy: "state", subGroupBy: "none", orderBy: "manual", properties: [], showEmptyGroups: false, showSubItems: false },
+        },
+      }),
+    ).rejects.toThrow();
+    expect(mocks.create).not.toHaveBeenCalled();
+  });
 });
 
 describe("updateStoryViewFn", () => {

package/src/components/agents/agent-bindings-tab.tsx

@@ -13,7 +13,7 @@ import {
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
 import { listAgentsFn } from '@/server/serverFns/agents/agent-crud'
 import { listBindingsFn, upsertBindingFn } from '@/server/serverFns/agents/bindings'
-import { BIZ_AGENT_KEYS, BIZ_KEY_LABELS } from '@/server/ai-gateway/runs/biz-keys'
+import { BIZ_AGENT_KEYS, BIZ_KEY_LABELS, type BizAgentKey } from '@/server/ai-gateway/runs/biz-keys'
 import { m } from '@/paraglide/messages.js'
 
 const FOLLOW_DEFAULT_VALUE = '__follow_default__'
@@ -65,13 +65,15 @@ export function AgentBindingsTab() {
     [agentsQuery.data],
   )
 
-  const handleChange = async (bizKey: string, agentId: string | null) => {
+  const handleChange = async (bizKey: BizAgentKey, agentId: string | null) => {
     const previous = bindingByBizKey.get(bizKey)
     if (previous?.agentId === agentId) return
 
-    const optimistic: BindingRow[] = [
-      ...(bindingsQuery.data as BindingRow[] | undefined) ?? [],
-    ].filter((r) => r.bizKey !== bizKey)
+    const previousRows = ((bindingsQuery.data as BindingRow[] | undefined) ?? []).map((r) => ({
+      ...r,
+    }))
+
+    const optimistic: BindingRow[] = previousRows.filter((r) => r.bizKey !== bizKey)
 
     if (agentId !== null) {
       optimistic.push({
@@ -89,11 +91,15 @@ export function AgentBindingsTab() {
     queryClient.setQueryData<BindingRow[]>(['agent-bindings'], optimistic)
 
     try {
-      await upsertBindingFn({ data: { bizKey: bizKey as (typeof BIZ_AGENT_KEYS)[number], agentId } })
+      await upsertBindingFn({ data: { bizKey, agentId } })
       await queryClient.invalidateQueries({ queryKey: ['agent-bindings'] })
       toast.success(agentId === null ? m.agents_bindings_unbound() : m.agents_bindings_saved())
     } catch (err) {
-      queryClient.setQueryData<BindingRow[]>(['agent-bindings'], previous ? [previous, ...(bindingsQuery.data as BindingRow[] | undefined) ?? []].filter((r) => r.bizKey !== bizKey) : bindingsQuery.data)
+      // 回滚只复原本 bizKey 的行（函数式更新），避免渲染期闭包快照覆盖并发变更
+      queryClient.setQueryData<BindingRow[]>(['agent-bindings'], (old) => {
+        const rest = (old ?? previousRows).filter((r) => r.bizKey !== bizKey)
+        return previous ? [previous, ...rest] : rest
+      })
       const message = err instanceof Error ? err.message : m.agents_bindings_failed()
       toast.error(message)
     }

package/src/components/agents/agent-card.tsx

@@ -17,6 +17,7 @@ import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/com
 import { Button } from '@/components/ui/button'
 import type { AgentData } from './agents-page'
 import { m } from "@/paraglide/messages.js";
+import { t } from '@/lib/i18n/resolver'
 
 interface AgentCardProps {
   agent: AgentData
@@ -32,14 +33,8 @@ function formatRelative(dateStr: Date | string): string {
   }
 }
 
-const TOOLS_DISPLAY: Record<string, string> = {
-  knowledge_search: 'KB',
-  document_action: 'DOC',
-  user_data_query: 'USER',
-  web_search: 'WEB',
-  reindex_knowledge_base: 'REINDEX',
-  delete_project: 'DEL',
-}
+/** 工具徽章文案：与 agent-form-dialog 同源（agents_tools_* 词条），未知 key 回退原文 */
+const toolBadgeLabel = (key: string): string => t(`agents_tools_${key}`)
 
 export function AgentCard({ agent, onEdit, onDelete }: AgentCardProps) {
   
@@ -92,7 +87,7 @@ export function AgentCard({ agent, onEdit, onDelete }: AgentCardProps) {
               </span>
               {agent.temperature != null && (
                 <span className="shrink-0 font-medium text-foreground">
-                  T={agent.temperature.toFixed(1)}
+                  {m.agents_card_temperature({ value: agent.temperature.toFixed(1) })}
                 </span>
               )}
             </div>
@@ -103,7 +98,7 @@ export function AgentCard({ agent, onEdit, onDelete }: AgentCardProps) {
           {agent.allowedTools && agent.allowedTools.length > 0 ? (
             agent.allowedTools.map((key) => (
               <Badge key={key} variant="outline" className="text-xs">
-                {TOOLS_DISPLAY[key] ?? key}
+                {toolBadgeLabel(key)}
               </Badge>
             ))
           ) : (

package/src/components/agents/agent-form-dialog.tsx

@@ -30,6 +30,7 @@ import { agentFormSchema, type AgentFormValues } from './schemas/agent-form'
 import { useAgentHandlers } from './use-agent-handlers'
 import type { AgentData } from './agents-page'
 import { useKnowledgeBases } from '@/lib/ai/use-knowledge-bases'
+import { t } from '@/lib/i18n/resolver'
 import type { KnowledgeBaseItem } from '@/components/ai/ai-prompt-input'
 
 interface AgentFormDialogProps {
@@ -67,11 +68,17 @@ export function AgentFormDialog({ open, onOpenChange, agent, onSuccess }: AgentF
       suggestedPrompts: agent?.suggestedPrompts ?? [],
       knowledgeBaseIds: agent?.knowledgeBaseIds ?? [],
     } as AgentFormValues,
-    validators: [{ run: agentFormSchema as any, triggers: ['change'] }],
+    validators: [{ run: agentFormSchema, triggers: ['change'] }],
   })
 
   const handleSubmit = async () => {
     setServerError('')
+    // 提交前跑一次表单校验：validator 仅配了 change 触发（错误展示），提交路径必须显式阻断
+    const errors = await form.validate('change')
+    if (errors.length > 0) {
+      toast.error(m.agents_agentForm_invalid())
+      return
+    }
     setSaving(true)
 
     try {
@@ -98,7 +105,7 @@ export function AgentFormDialog({ open, onOpenChange, agent, onSuccess }: AgentF
       onOpenChange(false)
       onSuccess?.()
     } catch (err) {
-      handleSaveError(err, 'agent.saveFailed')
+      handleSaveError(err, 'agents_agent_saveFailed')
     } finally {
       setSaving(false)
     }
@@ -357,7 +364,7 @@ export function AgentFormDialog({ open, onOpenChange, agent, onSuccess }: AgentF
                           htmlFor={`tool-${key}`}
                           className="text-sm leading-none cursor-pointer"
                         >
-                          {(m as any)[`tools_${key}`] ?? key}
+                          {t(`agents_tools_${key}`)}
                         </label>
                       </div>
                     ))}

package/src/components/agents/agent-selector.tsx

@@ -18,6 +18,9 @@ export interface AgentSelectorProps {
   className?: string
 }
 
+/** 「跟随默认」哨兵值：value 为 undefined 时 Select 需要一个可渲染的占位 value */
+const DEFAULT_AGENT_VALUE = '__default__'
+
 export function AgentSelector({
   value,
   onValueChange,
@@ -29,19 +32,19 @@ export function AgentSelector({
     staleTime: 30_000,
   })
   const agentList = externalAgents ?? agents ?? []
-  const selectValue = value ?? '__default__'
+  const selectValue = value ?? DEFAULT_AGENT_VALUE
 
   return (
     <Select
       value={selectValue}
-      onValueChange={(v) => onValueChange(v === '__default__' ? undefined : (v ?? ''))}
+      onValueChange={(v) => onValueChange(v === DEFAULT_AGENT_VALUE ? undefined : (v ?? undefined))}
     >
       <SelectTrigger className="h-8 w-[180px] gap-1.5 text-xs">
         <span className="text-base">🤖</span>
         <SelectValue placeholder={m.chat_agentSelector_placeholder()} />
       </SelectTrigger>
       <SelectContent>
-        <SelectItem value="__default__">
+        <SelectItem value={DEFAULT_AGENT_VALUE}>
           <span className="flex items-center gap-1">
             <span>🤖</span>
             {m.chat_agentSelector_default()}

package/src/components/agents/agents-page.tsx

@@ -91,7 +91,7 @@ export function AgentsPage() {const queryClient = useQueryClient()
       )
       refresh()
     } catch (err) {
-      handleSaveError(err, 'agent.deleteFailed')
+      handleSaveError(err, 'agents_agent_deleteFailed')
     }
   }
 
@@ -106,7 +106,7 @@ export function AgentsPage() {const queryClient = useQueryClient()
       )
       refresh()
     } catch (err) {
-      handleSaveError(err, 'skill.deleteFailed')
+      handleSaveError(err, 'agents_skill_deleteFailed')
     }
   }
 
@@ -224,7 +224,10 @@ export function AgentsPage() {const queryClient = useQueryClient()
         </TabsContent>
       </Tabs>
 
+      {/* key 按编辑对象重建实例：TanStack Form defaultValues 与 useState 初始值
+          仅在挂载时求值，常驻挂载下连续编辑不同 agent 会串写上一次的表单值 */}
       <AgentFormDialog
+        key={editingAgent?.id ?? 'create'}
         open={createAgentOpen || !!editingAgent}
         onOpenChange={(open: boolean) => {
           if (!open) {

package/src/components/agents/schemas/agent-form.ts

@@ -11,7 +11,7 @@ export const agentFormSchema = z.object({
   temperature: z.number().min(0).max(2).optional(),
   greeting: z.string().max(1000).optional(),
   suggestedPrompts: z.array(z.string().max(200)).max(4).optional(),
-  knowledgeBaseIds: z.array(z.string()).optional(),
+  knowledgeBaseIds: z.array(z.string()).max(50).optional(),
 })
 
 export const skillFormSchema = z.object({

package/src/components/agents/skill-form-dialog.tsx

@@ -1,3 +1,4 @@
+import { useState } from 'react'
 import { useForm } from '@tanstack/react-form'
 import { toast } from '@/components/ui/toast'
 import {
@@ -16,6 +17,7 @@ import { skillFormSchema, type SkillFormValues } from './schemas/agent-form'
 import { useAgentHandlers } from './use-agent-handlers'
 import type { SkillData } from './agents-page'
 import { m } from "@/paraglide/messages.js";
+import { isSkillNameConflict } from "@/lib/agents/skill-errors";
 
 interface SkillFormDialogProps {
   open: boolean
@@ -26,6 +28,7 @@ interface SkillFormDialogProps {
 
 export function SkillFormDialog({ open, onOpenChange, skill, onSuccess }: SkillFormDialogProps) {const isEdit = !!skill
   const { handleSaveError } = useAgentHandlers()
+  const [saving, setSaving] = useState(false)
 
   const form = useForm({
     defaultValues: {
@@ -33,10 +36,17 @@ export function SkillFormDialog({ open, onOpenChange, skill, onSuccess }: SkillF
       title: skill?.title ?? '',
       template: skill?.template ?? '',
     } as SkillFormValues,
-    validators: [{ run: skillFormSchema as any, triggers: ['change'] }],
+    validators: [{ run: skillFormSchema, triggers: ['change'] }],
   })
 
   const handleSubmit = async () => {
+    // 提交前跑一次表单校验：validator 仅配了 change 触发，提交路径必须显式阻断
+    const errors = await form.validate('change')
+    if (errors.length > 0) {
+      toast.error(m.agents_agentForm_invalid())
+      return
+    }
+    setSaving(true)
     try {
       const values = form.state.values as SkillFormValues
 
@@ -50,11 +60,13 @@ export function SkillFormDialog({ open, onOpenChange, skill, onSuccess }: SkillF
       onOpenChange(false)
       onSuccess?.()
     } catch (err) {
-      if (err instanceof Error && err.message.includes('已存在')) {
+      if (isSkillNameConflict(err)) {
         toast.error(m.agents_skill_nameConflict())
         return
       }
-      handleSaveError(err, 'skill.saveFailed')
+      handleSaveError(err, 'agents_skill_saveFailed')
+    } finally {
+      setSaving(false)
     }
   }
 
@@ -136,8 +148,10 @@ export function SkillFormDialog({ open, onOpenChange, skill, onSuccess }: SkillF
           <Button variant="outline" onClick={() => onOpenChange(false)}>
             {m.agents_skillForm_cancel()}
           </Button>
-          <Button onClick={handleSubmit}>
-            {isEdit ? m.agents_skillForm_save() : m.agents_skillForm_create()}
+          <Button onClick={handleSubmit} disabled={saving}>
+            {saving
+              ? (isEdit ? m.agents_skillForm_saving() : m.agents_skillForm_creating())
+              : (isEdit ? m.agents_skillForm_save() : m.agents_skillForm_create())}
           </Button>
         </DialogFooter>
       </DialogContent>

package/src/components/agents/use-agent-handlers.ts

@@ -1,5 +1,6 @@
 import { toast } from '@/components/ui/toast'
 import { ResourceLimitError } from '@/lib/resource-errors'
+import { t } from '@/lib/i18n/resolver'
 import { m } from "@/paraglide/messages.js";
 
 export function useAgentHandlers() {const handleSaveError = (err: unknown, fallbackKey: string) => {
@@ -13,7 +14,8 @@ export function useAgentHandlers() {const handleSaveError = (err: unknown, fallb
         return
       }
     }
-    const msg = err instanceof Error ? err.message : (m as any)[fallbackKey] ?? fallbackKey
+    // t() 对未知 key 原样返回，缺词条时不再经 as any 静默弹出原始键名以外的错误形态
+    const msg = err instanceof Error ? err.message : t(fallbackKey)
     toast.error(msg)
   }
 

package/src/components/ai/__tests__/ai-prompt-input-attach.test.tsx

@@ -22,9 +22,6 @@ import { AIPromptInput } from "../ai-prompt-input"
 import { filterImageFilesAndToast } from "../ai-prompt-input/image-filter"
 import type { Attachment } from "@/components/harness/composer/attachments/use-attachments"
 
-vi.mock("../ai-prompt-input/components/page-user-context-selector", () => ({
-  PageUserContextSelector: () => null,
-}))
 vi.mock("../ai-prompt-input/components/kb-context-selector", () => ({
   KbContextSelector: () => null,
 }))