@allbluecn/web-app 0.19.2 → 0.19.4

package/src/shared/ai-cli/__tests__/cli-detector.test.ts

@@ -1,13 +1,16 @@
 import { describe, expect, it, vi, beforeEach } from 'vitest'
 
-const execFileSyncMock = vi.hoisted(() => vi.fn())
+// cli-detector 已改异步 execFile 并发探测（原 execFileSync 串行同步阻塞，
+// 审计 🟡）+ 同 binary 去重（claude-code/claude-cli 共用 "claude"，审计 🟢）
+const execFileMock = vi.hoisted(() => vi.fn())
 const execSyncMock = vi.hoisted(() => vi.fn())
 
 vi.mock('child_process', async (importOriginal) => {
   const actual = await importOriginal<typeof import('child_process')>()
   return {
     ...actual,
-    execFileSync: execFileSyncMock,
+    execFile: execFileMock,
+    execFileSync: vi.fn(),
     execSync: execSyncMock,
   }
 })
@@ -51,40 +54,50 @@ describe('getApiAgent', () => {
 
 describe('detectAgents 安全探测', () => {
   beforeEach(() => {
-    execFileSyncMock.mockReset()
+    execFileMock.mockReset()
     execSyncMock.mockReset()
   })
 
-  it('用 execFileSync 数组参数探测版本（无 shell 拼接）', async () => {
-    execFileSyncMock.mockReturnValueOnce('v1.2.3')
+  it('用 execFile 数组参数探测版本（无 shell 拼接）', async () => {
+    execFileMock.mockImplementation(
+      (_file: string, _args: string[], _opts: unknown, cb: (err: unknown, stdout: string) => void) =>
+        cb(null, 'v1.2.3'),
+    )
     const agents = await detectAgents()
     const claude = agents.find((a) => a.id === 'claude-code')!
     expect(claude.available).toBe(true)
     expect(claude.version).toBe('v1.2.3')
-    expect(execFileSyncMock).toHaveBeenCalledWith(
+    expect(execFileMock).toHaveBeenCalledWith(
       expect.any(String),
       expect.arrayContaining(['--version']),
-      expect.objectContaining({ timeout: expect.any(Number), encoding: 'utf-8' })
+      expect.objectContaining({ timeout: expect.any(Number), encoding: 'utf-8' }),
+      expect.any(Function),
     )
     expect(execSyncMock).not.toHaveBeenCalled()
   })
 
   it('--version 失败时回退 version 子命令（两步探测，无 shell ||）', async () => {
-    execFileSyncMock
-      .mockImplementationOnce(() => { throw new Error('not found') })
-      .mockReturnValueOnce('2.0.0')
+    execFileMock.mockImplementation(
+      (_file: string, args: string[], _opts: unknown, cb: (err: unknown, stdout: string) => void) => {
+        if (args[0] === '--version') cb(new Error('not found'), '')
+        else cb(null, '2.0.0')
+      },
+    )
     const agents = await detectAgents()
     const first = agents[0]!
     expect(first.available).toBe(true)
     expect(first.version).toBe('2.0.0')
-    const calls = execFileSyncMock.mock.calls
+    const calls = execFileMock.mock.calls
     expect(calls[0]?.[1]).toEqual(['--version'])
     expect(calls[1]?.[1]).toEqual(['version'])
     expect(calls[0]![0]).toBe(calls[1]![0])
   })
 
   it('两步都失败标记不可用且不抛错', async () => {
-    execFileSyncMock.mockImplementation(() => { throw new Error('not found') })
+    execFileMock.mockImplementation(
+      (_file: string, _args: string[], _opts: unknown, cb: (err: unknown, stdout: string) => void) =>
+        cb(new Error('not found'), ''),
+    )
     const agents = await detectAgents()
     expect(agents).toHaveLength(16)
     expect(agents.every((a) => a.available === false)).toBe(true)
@@ -92,8 +105,26 @@ describe('detectAgents 安全探测', () => {
   })
 
   it('版本串截断到 50 字符且去除首尾空白', async () => {
-    execFileSyncMock.mockReturnValue(`  ${'x'.repeat(80)}  \n`)
+    execFileMock.mockImplementation(
+      (_file: string, _args: string[], _opts: unknown, cb: (err: unknown, stdout: string) => void) =>
+        cb(null, `  ${'x'.repeat(80)}  \n`),
+    )
     const agents = await detectAgents()
     expect(agents[0]!.version).toBe('x'.repeat(50))
   })
+
+  it('同 binary 只探测一次（claude-code/claude-cli 共用 "claude"，结果复用）', async () => {
+    execFileMock.mockImplementation(
+      (_file: string, _args: string[], _opts: unknown, cb: (err: unknown, stdout: string) => void) =>
+        cb(null, 'v9'),
+    )
+    const agents = await detectAgents()
+    const claudeCode = agents.find((a) => a.id === 'claude-code')!
+    const claudeCli = agents.find((a) => a.id === 'claude-cli')!
+    expect(claudeCode.version).toBe('v9')
+    expect(claudeCli.version).toBe('v9')
+    // 16 个 agent、15 个唯一 binary → 每个只探一次 --version
+    const versionCalls = execFileMock.mock.calls.filter((c) => (c[1] as string[])[0] === '--version')
+    expect(versionCalls).toHaveLength(15)
+  })
 })

package/src/shared/ai-cli/adapter.ts

@@ -15,17 +15,25 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+// CLI agent 派发执行器（预留接口，当前无运行时消费方——仅测试覆盖）。
+//
+// ⚠ 豁免说明（审计 🟠 记录）：openai-api 分支直连 OpenAI 兼容端点而非
+// ai-gateway 统一入口。豁免依据：本模块定位是「本地 CLI 二进制派发」的对称
+// 兜底（execFile 子进程派发同类 prompt），调用方以「选定某个具体 agent 执行」
+// 语义传参，不经网关的 per-user Key/限流/观测链。若该接口转正接入请求链路，
+// 必须改走 `@/server/ai-gateway` 的 createAdapter + chat()（届时一并去掉
+// env key 直读）。此前遗留的模块级 activeAgentId 单例（跨请求/跨用户共享、
+// check-then-act 串扰）已删除——agent 一律经参数显式传递。
+
 import type { AICommandContext } from '@allbluecn/kernel'
 import type { CLIAgentInfo } from '@allbluecn/kernel'
 
-let activeAgentId: string | null = null
+const CHAT_TIMEOUT_MS = 60_000
+const CLI_TIMEOUT_MS = 60_000
 
-export function getActiveAgent(): string | null {
-  return activeAgentId
-}
-
-export function switchAgent(agentId: string): void {
-  activeAgentId = agentId
+interface OpenAIChatResponse {
+  choices?: { message?: { content?: string } }[]
+  error?: { message?: string }
 }
 
 export async function executeViaAgent(
@@ -34,26 +42,41 @@ export async function executeViaAgent(
   _ctx: AICommandContext
 ): Promise<string> {
   if (agent.id === "openai-api") {
+    const apiKey = process.env.OPENAI_API_KEY
+    // Key 缺失快速失败（cli-detector.getApiAgent 有同款守卫，二者口径对齐），
+    // 不再发出 `Bearer undefined`
+    if (!apiKey) throw new Error("OPENAI_API_KEY 未配置，无法执行 openai-api agent")
     const response = await fetch(`${process.env.AI_BASE_URL || "https://api.openai.com/v1"}/chat/completions`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${process.env.OPENAI_API_KEY}`,
+        Authorization: `Bearer ${apiKey}`,
       },
       body: JSON.stringify({
         model: process.env.AI_MODEL || "gpt-4o-mini",
         messages: [{ role: "user", content: prompt }],
         temperature: 0.7,
       }),
+      // 上游挂起不长期占用；非 2xx 读取 error 体抛出（保留 quota/invalid key 等真实信息）
+      signal: AbortSignal.timeout(CHAT_TIMEOUT_MS),
     })
-    const data = await response.json() as { choices: { message: { content: string } }[] }
-    return data.choices[0]?.message?.content || ""
+    if (!response.ok) {
+      const text = await response.text().catch(() => "")
+      throw new Error(`openai-api 请求失败（${response.status}）: ${text.slice(0, 500)}`)
+    }
+    const data = await response.json() as OpenAIChatResponse
+    return data.choices?.[0]?.message?.content ?? ""
   }
 
-  const { execFileSync } = await import("child_process")
-  const result = execFileSync(agent.binary, ["-p", prompt], {
-    timeout: 60000,
-    encoding: "utf-8",
+  // 异步 execFile：execFileSync 同步子进程最长阻塞事件循环 60s，serverFn/SSR
+  // 上下文调用期间会卡住全站请求。显式 Promise 包装（不用 promisify：
+  // execFile 的 promisify.custom 依赖真实实现，包装层语义需在 mock/真实下一致）
+  const { execFile } = await import("child_process")
+  const stdout = await new Promise<string>((resolve, reject) => {
+    execFile(agent.binary, ["-p", prompt], { timeout: CLI_TIMEOUT_MS, encoding: "utf-8" }, (err, out) => {
+      if (err) reject(err)
+      else resolve(String(out ?? ""))
+    })
   })
-  return result.trim()
+  return stdout.trim()
 }

package/src/shared/ai-cli/cli-detector.ts

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+// 本地 CLI agent 探测（预留接口，当前无运行时消费方——仅测试覆盖）。
+// 异步 execFile 并发探测：原 execFileSync 串行 16 个二进制、任一挂起即同步
+// 阻塞事件循环（3s×2/个，最坏 ~96s）。
+
 import type { CLIAgentInfo } from '@allbluecn/kernel'
 
 const KNOWN_AGENTS: { id: string; name: string; binary: string }[] = [
@@ -36,26 +40,47 @@ const KNOWN_AGENTS: { id: string; name: string; binary: string }[] = [
   { id: "mcp-cli",        name: "MCP CLI",            binary: "mcp" },
 ]
 
-function probeVersion(
-  execFileSync: (file: string, args: string[], options: { timeout: number; encoding: "utf-8" }) => string,
-  binary: string,
-): string {
-  const opts = { timeout: 3000, encoding: "utf-8" } as const
-  try {
-    return execFileSync(binary, ["--version"], opts).trim().slice(0, 50)
-  } catch {
-    try {
-      return execFileSync(binary, ["version"], opts).trim().slice(0, 50)
-    } catch {
-      return ""
-    }
-  }
+const PROBE_TIMEOUT_MS = 3000
+
+// 动态 import 只做一次、execFile 经参数下传（原 execFileSync 同款形态）：
+// 并发 15 路 `await import("child_process")` 在 vitest 下会对同一 mock 模块
+// 产生竞态（部分调用拿到真实实现，ENOENT 被吞成不可用），收敛为单次导入
+type ExecFileFn = (
+  file: string,
+  args: string[],
+  options: { timeout: number; encoding: "utf-8" },
+  callback: (err: unknown, stdout: string) => void,
+) => unknown
+
+function probeVersion(execFile: ExecFileFn, binary: string): Promise<string> {
+  return new Promise<string>((resolve) => {
+    execFile(binary, ["--version"], { timeout: PROBE_TIMEOUT_MS, encoding: "utf-8" }, (err, stdout) => {
+      if (!err) {
+        resolve(String(stdout ?? "").trim().slice(0, 50))
+        return
+      }
+      // 回退 version 子命令（两步探测，无 shell ||）
+      execFile(binary, ["version"], { timeout: PROBE_TIMEOUT_MS, encoding: "utf-8" }, (err2, stdout2) => {
+        resolve(err2 ? "" : String(stdout2 ?? "").trim().slice(0, 50))
+      })
+    })
+  })
 }
 
 export async function detectAgents(): Promise<CLIAgentInfo[]> {
-  const { execFileSync } = await import("child_process")
+  const { execFile } = await import("child_process")
+  const execFileFn = execFile as unknown as ExecFileFn
+  // 同一 binary 只探测一次（claude-code / claude-cli 共用 "claude"），
+  // 结果复用；全部并发探测（单个失败不拖累其余）
+  const binaries = [...new Set(KNOWN_AGENTS.map((a) => a.binary))]
+  const versions = new Map<string, string>()
+  await Promise.all(
+    binaries.map(async (binary) => {
+      versions.set(binary, await probeVersion(execFileFn, binary))
+    }),
+  )
   return KNOWN_AGENTS.map(({ id, name, binary }) => {
-    const version = probeVersion(execFileSync, binary)
+    const version = versions.get(binary) ?? ""
     return { id, name, binary, version, available: version !== "" }
   })
 }

package/src/{components/bug/display/types.ts → shared/bug/display-types.ts}

@@ -19,7 +19,7 @@
 // serverFn 与 UI 共用。枚举取值以规格 §7 list 视图为准：分组 state/severity/assignee/
 // createdBy，排序 manual/created/updated/severity。任务 40：受共享 DisplayOptionsCore
 // 基型约束并补 subGroupBy/showEmptyGroups/showSubItems，与 story DisplayOptions 同构）。
-import type { DisplayOptionsCore } from "@/components/shared-kit/list-kit/display/types";
+import type { DisplayOptionsCore } from "@/shared/list-kit/display-types";
 import { BUG_STATES, BUG_SEVERITIES } from "@/shared/bug/constants";
 
 export const BUG_GROUP_KEYS = ["state", "severity", "assignee", "createdBy", "none"] as const;

package/src/shared/design-ai/ndjson.ts

@@ -63,6 +63,10 @@ export type NdjsonParser = {
 /** 行缓冲 NDJSON 解析器（纯内存、有状态）：逐 delta 拼缓冲、遇 \n 吐完整行，
  *  截断行不吐；CRLF 兼容（行尾 \r 剥离，可跨 delta 拆分）；空行跳过；
  *  非法行（JSON 或 op schema）经 onInvalid 上报后丢弃，不中断流。 */
+// 行缓冲上限（审计 🟡）：上游异常持续输出无 \n 内容时缓冲无限增长。
+// 超限视为协议违规，丢弃缓冲并经 onInvalid 上报（与非法行同通道）
+const MAX_BUFFER_CHARS = 1_000_000
+
 export function createNdjsonParser(options: NdjsonParserOptions = {}): NdjsonParser {
   let buffer = ""
   const { onInvalid } = options
@@ -108,6 +112,15 @@ export function createNdjsonParser(options: NdjsonParserOptions = {}): NdjsonPar
   return {
     push(delta: string): DesignOp[] {
       buffer += delta
+      if (buffer.length > MAX_BUFFER_CHARS) {
+        onInvalid?.({
+          line: buffer.slice(0, 200),
+          reason: "json",
+          error: `行缓冲超过 ${MAX_BUFFER_CHARS} 字符仍无换行（疑似异常流），已丢弃`,
+        })
+        buffer = ""
+        return []
+      }
       return drainBuffer()
     },
     flush(): DesignOp[] {

package/src/{components/shared-kit/list-kit/display/types.ts → shared/list-kit/display-types.ts}

@@ -23,7 +23,7 @@
 // bug 等其余模块不消费本文件的窄化别名，只消费 DisplayOptionsCore
 // 泛型基型实例化自己的 options 类型（模式同 filters 的 K 泛型先例）。
 
-import type { ORDER_DIRECTIONS, ORDER_KEYS, GROUP_KEYS, ALL_DISPLAY_PROPERTIES, PAGE_SIZE_OPTIONS } from "./values";
+import type { ORDER_DIRECTIONS, ORDER_KEYS, GROUP_KEYS, ALL_DISPLAY_PROPERTIES, PAGE_SIZE_OPTIONS } from "@/shared/list-kit/display-values";
 
 export type OrderDirection = (typeof ORDER_DIRECTIONS)[number];
 export type OrderKey = (typeof ORDER_KEYS)[number];

package/src/{components/shared-kit/list-kit/display/values.ts → shared/list-kit/display-values.ts}

@@ -23,7 +23,7 @@
 // 不变——User.storyDisplayOptions Json 的键集/取值必须保持）。bug 的
 // BUG_* 常量仍在 bug/display/types（其 serverFn 消费面不在本期收拢范围）。
 
-import type { DisplayOptions, OrderDirection, OrderKey } from "./types";
+import type { DisplayOptions, OrderDirection, OrderKey } from "@/shared/list-kit/display-types";
 
 export const GROUP_KEYS = [
   "state", "priority", "assignee", "labels", "createdBy", "project", "none",

package/src/start.ts

@@ -36,6 +36,8 @@ function ensureGithubSyncTimer() {
       console.warn('[github-sync] error', e instanceof Error ? e.message : String(e))
     }
   }, 6 * 60 * 60 * 1000)
+  // 不阻止进程自然退出（测试/工具进程 import 本模块时挂住）
+  globalAny.__githubSyncTimer.unref?.()
 }
 
 const isDesktop = process.env.DEPLOY_TARGET === 'desktop'
@@ -51,10 +53,13 @@ const CSRF_EXEMPT_PATHS = [
 ]
 
 const csrfMiddleware = createCsrfMiddleware({
-  filter: (ctx) =>
-    ctx.handlerType === 'serverFn' &&
-    !isDesktop &&
-    !CSRF_EXEMPT_PATHS.some((path) => ctx.request.url.includes(path)),
+  filter: (ctx) => {
+    if (ctx.handlerType !== 'serverFn' || isDesktop) return false
+    // 必须 match pathname 全等：用 url.includes 会让 `?x=/api/bugs/report` 这类查询串
+    // 把任意非豁免 serverFn 变成免 CSRF（审计 2026-10-25）
+    const pathname = new URL(ctx.request.url).pathname
+    return !CSRF_EXEMPT_PATHS.some((path) => pathname === path)
+  },
 })
 
 const aiPortsMiddleware = createMiddleware().server(async ({ next }) => {
@@ -68,7 +73,9 @@ const BUG_CORS_PREFIX = '/api/bugs/'
 const BUG_CORS_HEADERS = 'Content-Type, X-Bug-Key'
 
 const apiCorsMiddleware = createMiddleware().server(async ({ request, next }: any) => {
-  const needsCors = request.url.includes('/api/') || request.url.includes('/_serverFn/')
+  // 同上按 pathname 判定，不用全 URL includes（查询串可伪造前缀命中）
+  const { pathname } = new URL(request.url)
+  const needsCors = pathname.startsWith('/api/') || pathname.startsWith('/_serverFn/')
   if (!needsCors) {
     return next()
   }
@@ -77,21 +84,30 @@ const apiCorsMiddleware = createMiddleware().server(async ({ request, next }: an
   const origin = request.headers.get('origin')
 
   const headers = new Headers(result?.headers || result?.response?.headers || {})
-  if (request.url.includes(BUG_CORS_PREFIX)) {
+  if (pathname.startsWith(BUG_CORS_PREFIX)) {
     headers.set('Access-Control-Allow-Origin', '*')
     headers.set('Access-Control-Allow-Methods', 'POST, OPTIONS')
     headers.set('Access-Control-Allow-Headers', BUG_CORS_HEADERS)
   } else if (origin) {
-    const allowedOrigins = [
-      new URL(process.env.AUTH_URL || 'http://localhost:3000').origin,
-      new URL(process.env.APP_URL || 'http://localhost:3000').origin,
-    ]
+    const safeOrigin = (value: string | undefined): string | null => {
+      try {
+        return new URL(value || 'http://localhost:3000').origin
+      } catch {
+        // env 配置为非法 URL：回落默认而非让所有 /api/ 请求 500
+        return null
+      }
+    }
+    const allowedOrigins = [safeOrigin(process.env.AUTH_URL), safeOrigin(process.env.APP_URL)]
+      .filter((v): v is string => v !== null)
     if (allowedOrigins.includes(origin)) {
       headers.set('Access-Control-Allow-Origin', origin)
       headers.set('Access-Control-Allow-Credentials', 'true')
       headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
       headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization')
     }
+    // ACAO 随 Origin 变化：补 Vary 防中间层把 A origin 的响应缓存给 B origin
+    const vary = headers.get('Vary')
+    headers.set('Vary', vary ? `${vary}, Origin` : 'Origin')
   }
 
   if (request.method === 'OPTIONS') {

package/src/styles/globals.css

@@ -67,6 +67,9 @@
 }
 
 @source "../";
+/* @allbluecn/kernel dist 内的类名字符串（如 PROVIDER_BADGE_STYLES 角标预设），
+   Tailwind v4 不会自动扫描 node_modules，须显式声明否则生产构建样式静默丢失 */
+@source "../../../../packages/kernel/dist";
 
 @custom-variant dark (&:is(.dark *));
 
@@ -440,6 +443,14 @@ html.theme-transitioning *::after {
   .font-trap-black { font-family: 'Trap', 'Inter Variable', sans-serif; font-weight: 900; letter-spacing: -0.01em; }
   /* 中文品牌快捷类（未来引入中文字体后取消注释） */
   /* .font-brand-zh { font-family: var(--brand-font-zh-family); font-weight: var(--brand-font-zh-weight, 500); letter-spacing: normal; } */
+  /* 隐藏滚动条（Firefox 走 scrollbar-width:none 内联样式，这里补 WebKit）——
+     横向 chip 溢出滚动条（AI 上下文选择器等）共用，替代组件内多处 <style> 注入 */
+  .scroll-hide::-webkit-scrollbar {
+    display: none !important;
+    height: 0 !important;
+    width: 0 !important;
+    background: transparent !important;
+  }
 }
 
 .bg-dot-grid {

package/vite.shared.ts

@@ -116,7 +116,10 @@ function prismaDirnamePolyfill(rootDir: string): PluginOption {
             await writeFile(fp, polyfill + code)
           }
         }
-      } catch {}
+      } catch (e) {
+        // 与同文件其他插件风格一致：补齐日志（非必然故障，不终止构建）
+        console.error('[prisma-dirname-polyfill] 产物修补失败:', e instanceof Error ? e.message : e)
+      }
     },
   }
 }
@@ -160,30 +163,36 @@ function cssTreeRuntimeAssetsPlugin(rootDir: string): PluginOption {
             await writeFile(isoLib, code)
           }
         }
-        // b) css-tree data/patch.json（dom-selector 内 createRequire('../data/patch.json')）
-        //    css-tree 是 transitive 包，从 .pnpm 虚拟目录扫描定位
-        const ctVdirs = (await readdir(pnpmDir)).filter((d) => d.startsWith('css-tree@'))
-        let cssTreePkg: string | null = null
-        for (const v of ctVdirs) {
-          const cand = path.join(pnpmDir, v, 'node_modules/css-tree')
-          if (existsSync(path.join(cand, 'data/patch.json'))) {
-            cssTreePkg = cand
-            break
-          }
-        }
-        if (!cssTreePkg) throw new Error('css-tree data/patch.json 未找到')
-        const patchDestDir = path.join(funcDir, '_libs/data')
-        await mkdir(patchDestDir, { recursive: true })
-        await copyFile(path.join(cssTreePkg, 'data/patch.json'), path.join(patchDestDir, 'patch.json'))
-        // c) mdn-data css json（require('mdn-data/css/*.json') 向上解析 node_modules）
-        const mdnCssDir = path.join(path.dirname(cssTreePkg), 'mdn-data/css')
-        const dest = path.join(funcDir, 'node_modules/mdn-data/css')
-        await mkdir(dest, { recursive: true })
-        for (const f of await readdir(mdnCssDir)) {
-          if (f.endsWith('.json')) await copyFile(path.join(mdnCssDir, f), path.join(dest, f))
-        }
       } catch (e) {
-        console.error('[css-tree-runtime-assets] 资源补齐失败:', e instanceof Error ? e.message : e)
+        // jsdom 分支可降级（依赖已移除时整体缺失属正常）：仅日志
+        console.error('[css-tree-runtime-assets] jsdom 资源补齐失败（可降级）:', e instanceof Error ? e.message : e)
+      }
+      // b) css-tree data/patch.json（dom-selector 内 createRequire('../data/patch.json')）
+      //    css-tree 是 transitive 包，从 .pnpm 虚拟目录扫描定位。
+      //    ⚠ css-tree 缺失是必然运行时故障（冷启动 ENOENT 全站 500）：直接抛出
+      //    终止构建，不让 CI 绿灯放行错位部署（审计 🟡；与 CF 分支 prisma 补丁
+      //    校验直接 throw 的策略对齐）
+      const ctVdirs = (await readdir(pnpmDir)).filter((d) => d.startsWith('css-tree@'))
+      let cssTreePkg: string | null = null
+      for (const v of ctVdirs) {
+        const cand = path.join(pnpmDir, v, 'node_modules/css-tree')
+        if (existsSync(path.join(cand, 'data/patch.json'))) {
+          cssTreePkg = cand
+          break
+        }
+      }
+      if (!cssTreePkg) {
+        throw new Error('[css-tree-runtime-assets] css-tree data/patch.json 未找到：产物冷启动必 ENOENT 全站 500，构建终止（检查 pnpm 虚拟 store）')
+      }
+      const patchDestDir = path.join(funcDir, '_libs/data')
+      await mkdir(patchDestDir, { recursive: true })
+      await copyFile(path.join(cssTreePkg, 'data/patch.json'), path.join(patchDestDir, 'patch.json'))
+      // c) mdn-data css json（require('mdn-data/css/*.json') 向上解析 node_modules）
+      const mdnCssDir = path.join(path.dirname(cssTreePkg), 'mdn-data/css')
+      const dest = path.join(funcDir, 'node_modules/mdn-data/css')
+      await mkdir(dest, { recursive: true })
+      for (const f of await readdir(mdnCssDir)) {
+        if (f.endsWith('.json')) await copyFile(path.join(mdnCssDir, f), path.join(dest, f))
       }
     },
   }
@@ -319,6 +328,11 @@ export function createWebViteConfig(opts: WebViteConfigOptions) {
         'import.meta.env.VITE_DEPLOY_TARGET': JSON.stringify(
           process.env.DEPLOY_TARGET ?? 'web',
         ),
+        // deploy-region.ts 客户端安全读取通道（原 process.env.DEPLOY_REGION
+        // 在浏览器渲染路径抛 ReferenceError）
+        'import.meta.env.VITE_DEPLOY_REGION': JSON.stringify(
+          process.env.DEPLOY_REGION ?? 'overseas',
+        ),
         '__APP_VERSION__': JSON.stringify(webVersion),
         '__APP_UPDATE_DATE__': JSON.stringify(appUpdateDate),
       },
@@ -358,7 +372,7 @@ export function createWebViteConfig(opts: WebViteConfigOptions) {
         },
       },
       optimizeDeps: {
-        exclude: ['@allbluecn/database', '@allbluecn/kernel', ],
+        exclude: ['@allbluecn/database', '@allbluecn/kernel'],
         // leafer-editor 在 engine.ts 中动态 import，不预构建时 dev 冷启动会触发
         // Vite「new dependencies optimized → page reload」，表现为首次画图页面自动刷新
         include: ['@tanstack/react-router', 'leafer-editor'],