@allbluecn/web-app 0.19.2 → 0.19.4

package/src/components/tiptap/ui/doc-reference-floating/doc-reference-floating.tsx

@@ -19,6 +19,7 @@ import type { Editor } from "@tiptap/react"
 import { ExternalLink, Type, LayoutGrid, Trash2 } from "lucide-react"
 import { useTiptapEditor } from "../../hooks/use-tiptap-editor.ts"
 import { isNodeTypeSelected } from "../../lib/utils.ts"
+import { openDocRefInNewTab } from "../../lib/doc-group.ts"
 import { Button } from "../../ui-primitive/button/index.tsx"
 import { Separator } from "../../ui-primitive/separator/index.tsx"
 import { m } from "@/paraglide/messages.js";
@@ -46,17 +47,9 @@ editor: providedEditor,
 
   const handleOpenNewTab = () => {
     const { id, docGroup } = attrs
-    if (docGroup && docGroup && [m['editor_laws-regulations']() as string, m['editor_industry-compliance']() as string, m['editor_dictionary-entry']() as string, m['editor_website-bookmark']() as string].includes(docGroup)) {
-      const typeMap: Record<string, string> = {
-        [m['editor_laws-regulations']()]: "law",
-        [m['editor_industry-compliance']()]: "compliance",
-        [m['editor_dictionary-entry']()]: "dictionary",
-        [m['editor_website-bookmark']()]: "bookmarks",
-      }
-      window.open(`/knowledge/${typeMap[docGroup]}/${id}`, "_blank")
-    } else {
-      window.open(`/knowledge/doc/${id}`, "_blank")
-    }
+    // 分组 → 路由段映射收敛于 lib/doc-group.ts（此前 law/dictionary 单数拼写
+    // 与实际路由 laws/dictionaries 不一致，法规/词典文档打开必 404）
+    openDocRefInNewTab(id, docGroup ?? "")
   }
 
   const handleSwitchView = (view: "title" | "card") => {

package/src/components/tiptap/ui/drag-context-menu/drag-context-menu.tsx

@@ -103,6 +103,9 @@ import { Repeat2Icon } from "../../icons/repeat-2-icon.tsx"
 import "./drag-context-menu.scss"
 import { m } from "@/paraglide/messages.js";
 
+/** 拖拽把手与浮层的主轴偏移（同时用于定位中间计算，审计 ⚪：魔法数命名化） */
+const DRAG_HANDLE_MAIN_AXIS_OFFSET = 16
+
 const useNodeTransformActions = () => {
   const text = useText()
   const heading1 = useHeading({ level: 1 })
@@ -355,14 +358,12 @@ const AIActionGroup: React.FC = () => {
   return (
     <>
       <MenuGroup>
-        {canAiAsk && (
-          <BaseMenuItem
-            icon={AiAskIcon}
-            label={m['editor_ask-ai']()}
-            onClick={handleAiAsk}
-            shortcutBadge={<AskAiShortcutBadge />}
-          />
-        )}
+        <BaseMenuItem
+          icon={AiAskIcon}
+          label={m['editor_ask-ai']()}
+          onClick={handleAiAsk}
+          shortcutBadge={<AskAiShortcutBadge />}
+        />
       </MenuGroup>
 
       <Separator orientation="horizontal" />
@@ -410,8 +411,6 @@ export const DragContextMenu: React.FC<DragContextMenuProps> = ({
     editor.commands.setMeta("lockDragHandle", open)
   }, [editor, open])
 
-  const mainAxisOffset = 16
-
   const dynamicPositions = useMemo(() => {
     return {
       middleware: [
@@ -423,7 +422,7 @@ export const DragContextMenu: React.FC<DragContextMenuProps> = ({
           const crossAxis = nodeHeight / 2 - dragHandleHeight / 2
 
           return {
-            mainAxis: mainAxisOffset,
+            mainAxis: DRAG_HANDLE_MAIN_AXIS_OFFSET,
             // if height is more than 40px, then it's likely a block node
             crossAxis: nodeHeight > 40 ? 0 : crossAxis,
           }
@@ -461,7 +460,7 @@ export const DragContextMenu: React.FC<DragContextMenuProps> = ({
     <div
       style={
         {
-          "--drag-handle-main-axis-offset": `${mainAxisOffset}px`,
+          "--drag-handle-main-axis-offset": `${DRAG_HANDLE_MAIN_AXIS_OFFSET}px`,
         } as React.CSSProperties
       }
     >

package/src/components/tiptap/ui/image-download-button/use-image-download.ts

@@ -195,7 +195,8 @@ function tryDirectDownload(url: string, filename: string): boolean {
  */
 function openInNewTab(url: string): boolean {
   try {
-    window.open(url, "_blank")
+    // 与 use-link-popover 的 openLink 一致：阻断新页面对 window.opener 的访问
+    window.open(url, "_blank", "noopener,noreferrer")
     return true
   } catch (error) {
     console.error("Failed to open image:", error)

package/src/components/tiptap/ui/improve-dropdown/use-improve-dropdown.ts

@@ -42,6 +42,20 @@ export type AICommand =
   | "complete"
   | "summarize"
 
+/** AICommand → 命令执行器映射（审计 🔵：替代 7 case 逐字 switch，保留全类型） */
+const AI_COMMAND_RUNNERS: Record<
+  AICommand,
+  (editor: Editor, options: TextOptions) => boolean
+> = {
+  fixSpellingAndGrammar: (ed, options) => ed.commands.aiFixSpellingAndGrammar(options),
+  extend: (ed, options) => ed.commands.aiExtend(options),
+  shorten: (ed, options) => ed.commands.aiShorten(options),
+  simplify: (ed, options) => ed.commands.aiSimplify(options),
+  emojify: (ed, options) => ed.commands.aiEmojify(options),
+  complete: (ed, options) => ed.commands.aiComplete(options),
+  summarize: (ed, options) => ed.commands.aiSummarize(options),
+}
+
 /**
  * Configuration for the improve dropdown functionality
  */
@@ -206,29 +220,7 @@ export function useImproveDropdown(config?: UseImproveDropdownConfig) {
       editor.chain().focus().aiGenerationShow().run()
 
       setTimeout(() => {
-        switch (command) {
-          case "fixSpellingAndGrammar":
-            editor.commands.aiFixSpellingAndGrammar(defaultOptions)
-            break
-          case "extend":
-            editor.commands.aiExtend(defaultOptions)
-            break
-          case "shorten":
-            editor.commands.aiShorten(defaultOptions)
-            break
-          case "simplify":
-            editor.commands.aiSimplify(defaultOptions)
-            break
-          case "emojify":
-            editor.commands.aiEmojify(defaultOptions)
-            break
-          case "complete":
-            editor.commands.aiComplete(defaultOptions)
-            break
-          case "summarize":
-            editor.commands.aiSummarize(defaultOptions)
-            break
-        }
+        AI_COMMAND_RUNNERS[command](editor, defaultOptions)
       }, 0)
     },
     [editor, defaultOptions]

package/src/components/tiptap/ui/link-popover/link-popover.tsx

@@ -166,7 +166,7 @@ const LinkMain: React.FC<LinkMainProps> = ({
             <Button
               type="button"
               onClick={setLink}
-              title={m['editor_apply-link']()}
+              tooltip={m['editor_apply-link']()}
               disabled={!url && !isActive}
               variant="ghost"
             >
@@ -177,29 +177,25 @@ const LinkMain: React.FC<LinkMainProps> = ({
           <Separator />
 
           <ButtonGroup>
-            <ButtonGroup>
-              <Button
-                type="button"
-                onClick={openLink}
-                title={m['editor_open-in-new-window']()}
-                disabled={!url && !isActive}
-                variant="ghost"
-              >
-                <ExternalLinkIcon className="tiptap-button-icon" />
-              </Button>
-            </ButtonGroup>
+            <Button
+              type="button"
+              onClick={openLink}
+              tooltip={m['editor_open-in-new-window']()}
+              disabled={!url && !isActive}
+              variant="ghost"
+            >
+              <ExternalLinkIcon className="tiptap-button-icon" />
+            </Button>
 
-            <ButtonGroup>
-              <Button
-                type="button"
-                onClick={removeLink}
-                title={m['editor_remove-link']()}
-                disabled={!url && !isActive}
-                variant="ghost"
-              >
-                <TrashIcon className="tiptap-button-icon" />
-              </Button>
-            </ButtonGroup>
+            <Button
+              type="button"
+              onClick={removeLink}
+              tooltip={m['editor_remove-link']()}
+              disabled={!url && !isActive}
+              variant="ghost"
+            >
+              <TrashIcon className="tiptap-button-icon" />
+            </Button>
           </ButtonGroup>
         </CardItemGroup>
       </CardBody>

package/src/components/tiptap/ui/link-popover/use-link-popover.ts

@@ -30,7 +30,8 @@ import {
   isNodeTypeSelected,
   sanitizeUrl,
 } from "../../lib/utils.ts"
-import { m } from "@/paraglide/messages.js";
+import { toast } from "@/components/ui/toast"
+import { m } from "@/paraglide/messages.js"
 
 /**
  * Configuration for the link popover functionality
@@ -155,12 +156,21 @@ export function useLinkHandler(props: LinkHandlerProps) {
   const setLink = useCallback(() => {
     if (!url || !editor) return
 
+    // 审计 🟡（防御纵深）：写入文档前经 sanitizeUrl 白名单校验，拒绝
+    // javascript:/data: 等 scheme——编辑器内另有 openOnClick:false 兜底，
+    // 但 getHTML 持久化后被导出/只读渲染等消费方渲染时可能成为可点击恶意链接
+    const safeUrl = sanitizeUrl(url, window.location.href)
+    if (safeUrl === "#") {
+      toast.error(m.editor_link_invalid())
+      return
+    }
+
     const { selection } = editor.state
     const isEmpty = selection.empty
 
     let chain = editor.chain().focus()
 
-    chain = chain.extendMarkRange("link").setLink({ href: url })
+    chain = chain.extendMarkRange("link").setLink({ href: safeUrl })
 
     if (isEmpty) {
       chain = chain.insertContent({ type: "text", text: url })

package/src/components/tiptap/ui/slash-dropdown-menu/use-slash-dropdown-menu.ts

@@ -231,6 +231,15 @@ const texts = {
 
 export type SlashMenuItemType = keyof typeof texts
 
+/**
+ * 非 AI 菜单项集合（hideAi 场景的 enabledItems）。
+ * 从 texts 派生而非手抄清单（审计 🔵：notion-like-editor 内联的 15 项字面量
+ * 与此处重复维护，增删项时必漏改）；group === "AI" 的条目自动剔除。
+ */
+export const SLASH_NON_AI_ITEMS: SlashMenuItemType[] = (
+  Object.keys(texts) as SlashMenuItemType[]
+).filter((key) => texts[key].group !== "AI")
+
 const getItemImplementations = () => {
   return {
     // AI

package/src/components/workspace/dialogs/create-workspace-dialog.tsx

@@ -20,6 +20,7 @@ import { useForm } from "@tanstack/react-form";
 import { Link, useRouter } from "@tanstack/react-router";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
+import { Textarea } from "@/components/ui/textarea";
 import {
   Dialog,
   DialogContent,
@@ -27,9 +28,11 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog";
+import { AppFieldError } from "@/components/forms/app-field-error";
 import { LucideIconPicker } from "@/components/shared-kit/icons/lucide-icon-picker";
 import { createWorkspaceFn } from "@/server/serverFns/workspace";
-import { createWorkspaceSchema } from "../schemas/create-workspace";
+import { workspaceFormSchema } from "../schemas/create-workspace";
+import { errorMessage } from "@/lib/toast-error";
 import { m } from "@/paraglide/messages.js";
 import { emitEvent, AppEvents } from "@/lib/events";
 
@@ -55,7 +58,7 @@ export function CreateWorkspaceDialog({
       description: "",
       icon: "",
     },
-    validators: [{ run: createWorkspaceSchema as any, triggers: ['change'] }],
+    validators: [{ run: workspaceFormSchema, triggers: ['change'] }],
   });
 
   const handleSubmit = async () => {
@@ -87,7 +90,7 @@ export function CreateWorkspaceDialog({
         setShowUpgrade(true);
         return;
       }
-      setError(err instanceof Error ? err.message : m.workspace_createWorkspace_createFailed());
+      setError(errorMessage(err, m.workspace_createWorkspace_createFailed()));
     } finally {
       setLoading(false);
     }
@@ -133,27 +136,31 @@ export function CreateWorkspaceDialog({
                   />
                 )} />
                 <form.Field name="name" children={(field) => (
-                  <Input
-                    value={field.value ?? ""}
-                    onChange={(e) => field.handleChange(e.target.value)}
-                    onBlur={field.handleBlur}
-                    placeholder={m.workspace_createWorkspace_namePlaceholder()}
-                    maxLength={100}
-                    className="h-10 flex-1"
-                  />
+                  <div className="min-w-0 flex-1">
+                    <Input
+                      value={field.value ?? ""}
+                      onChange={(e) => field.handleChange(e.target.value)}
+                      onBlur={field.handleBlur}
+                      placeholder={m.workspace_createWorkspace_namePlaceholder()}
+                      maxLength={100}
+                      className="h-10 w-full"
+                    />
+                    <AppFieldError field={field} />
+                  </div>
                 )} />
               </div>
 
               <form.Field name="description" children={(field) => (
                 <div className="notion-full-width min-h-50 max-h-150 flex flex-col overflow-y-auto border rounded-md border-border">
-                  <textarea
+                  <Textarea
                     value={field.value ?? ""}
                     onChange={(e) => field.handleChange(e.target.value)}
                     onBlur={field.handleBlur}
                     placeholder={m.workspace_createWorkspace_descriptionPlaceholder()}
                     maxLength={500}
-                    className="flex-1 min-h-0 resize-none bg-transparent px-3 py-2 text-sm outline-none placeholder:text-muted-foreground"
+                    className="flex-1 min-h-0 resize-none border-0 shadow-none bg-transparent px-3 py-2 text-sm outline-none placeholder:text-muted-foreground focus-visible:ring-0 focus-visible:border-0"
                   />
+                  <AppFieldError field={field} />
                 </div>
               )} />
 

package/src/components/workspace/dialogs/delete-workspace-options.tsx

@@ -30,7 +30,6 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
-import { Separator } from "@/components/ui/separator";
 import { m } from "@/paraglide/messages.js";
 
 interface DeleteWorkspaceOptionsProps {
@@ -145,7 +144,6 @@ export function DeleteWorkspaceOptions({
         </div>
       )}
       <div className="flex flex-col gap-2">
-        {/* <Separator /> */}
         <p className="text-sm text-muted-foreground">{m.workspace_settings_knowledgeBaseHandling()}</p>
         <RadioGroup
           value={knowledgeBaseMode}
@@ -171,7 +169,6 @@ export function DeleteWorkspaceOptions({
           </FieldLabel>
         </RadioGroup>
       </div>
-      <Separator />
     </div>
   );
 }

package/src/components/workspace/dialogs/edit-workspace-dialog.tsx

@@ -20,6 +20,7 @@ import { useForm } from "@tanstack/react-form";
 import { useRouter } from "@tanstack/react-router";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
+import { Textarea } from "@/components/ui/textarea";
 import {
   Dialog,
   DialogContent,
@@ -27,9 +28,11 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog";
+import { AppFieldError } from "@/components/forms/app-field-error";
 import { LucideIconPicker } from "@/components/shared-kit/icons/lucide-icon-picker";
 import { updateWorkspaceFn } from "@/server/serverFns/workspace";
-import { createWorkspaceSchema } from "../schemas/create-workspace";
+import { workspaceFormSchema } from "../schemas/create-workspace";
+import { errorMessage } from "@/lib/toast-error";
 import { m } from "@/paraglide/messages.js";
 import { emitEvent, AppEvents } from "@/lib/events";
 
@@ -56,7 +59,7 @@ export function EditWorkspaceDialog({
       description: workspace.description ?? "",
       icon: workspace.icon,
     },
-    validators: [{ run: createWorkspaceSchema as any, triggers: ['change'] }],
+    validators: [{ run: workspaceFormSchema, triggers: ['change'] }],
   });
 
   const handleSubmit = async () => {
@@ -80,7 +83,7 @@ export function EditWorkspaceDialog({
       emitEvent(AppEvents.workspace.updated);
       await router.invalidate();
     } catch (err) {
-      setError(err instanceof Error ? err.message : m.workspace_createWorkspace_createFailed());
+      setError(errorMessage(err, m.workspace_createWorkspace_createFailed()));
     } finally {
       setLoading(false);
     }
@@ -113,27 +116,31 @@ export function EditWorkspaceDialog({
               />
             )} />
             <form.Field name="name" children={(field) => (
-              <Input
-                value={field.value ?? ""}
-                onChange={(e) => field.handleChange(e.target.value)}
-                onBlur={field.handleBlur}
-                placeholder={m.workspace_createWorkspace_namePlaceholder()}
-                maxLength={100}
-                className="h-10 flex-1"
-              />
+              <div className="min-w-0 flex-1">
+                <Input
+                  value={field.value ?? ""}
+                  onChange={(e) => field.handleChange(e.target.value)}
+                  onBlur={field.handleBlur}
+                  placeholder={m.workspace_createWorkspace_namePlaceholder()}
+                  maxLength={100}
+                  className="h-10 w-full"
+                />
+                <AppFieldError field={field} />
+              </div>
             )} />
           </div>
 
           <form.Field name="description" children={(field) => (
             <div className="notion-full-width min-h-50 max-h-150 flex flex-col overflow-y-auto border rounded-md border-border">
-              <textarea
+              <Textarea
                 value={field.value ?? ""}
                 onChange={(e) => field.handleChange(e.target.value)}
                 onBlur={field.handleBlur}
                 placeholder={m.workspace_createWorkspace_descriptionPlaceholder()}
                 maxLength={500}
-                className="flex-1 min-h-0 resize-none bg-transparent px-3 py-2 text-sm outline-none placeholder:text-muted-foreground"
+                className="flex-1 min-h-0 resize-none border-0 shadow-none bg-transparent px-3 py-2 text-sm outline-none placeholder:text-muted-foreground focus-visible:ring-0 focus-visible:border-0"
               />
+              <AppFieldError field={field} />
             </div>
           )} />
 

package/src/components/workspace/header/workspace-header.tsx

@@ -46,7 +46,7 @@ export function WorkspaceHeader({ workspace, onEdit, onDelete }: WorkspaceHeader
   return (
     <>
       <div className="mb-4 flex items-center justify-between">
-        <Button render={<Link to="/workspaces" params={{ workspaceId: workspace.id }} />} variant="ghost" size="sm" nativeButton={false}>
+        <Button render={<Link to="/workspaces" />} variant="ghost" size="sm" nativeButton={false}>
             <ArrowLeft className="size-4" />
             {m.workspace_detail_back()}
           </Button>

package/src/components/workspace/kb/workspace-kb-card.tsx

@@ -48,6 +48,7 @@ import {
 import { WorkspaceKbManageDialog } from "./workspace-kb-manage-dialog";
 import { WorkspaceQuickDocDialog } from "./workspace-quick-doc-dialog";
 import { LucideIconByName } from "@/components/shared-kit/icons/lucide-icon-picker/lucide-icon-by-name";
+import { toSafeHref } from "@/lib/safe-url";
 import { m } from "@/paraglide/messages.js";
 import { t } from "@/lib/i18n/resolver";
 import { toastError } from "@/lib/toast-error";
@@ -176,6 +177,9 @@ const QuickDocRowItem = React.memo(function QuickDocRowItem({ row, index, onRena
   );
 
   const linkTarget = docLinkTarget(row);
+  // 外部 URL 渲染 sink：scheme 白名单校验（safe-url 全站唯一入口，审计 A7x 🟠）；
+  // javascript:/data: 等非法 scheme 降级为纯文本，不可点击
+  const safeExternalHref = hasExternalUrl(row) ? toSafeHref(row.url) : null;
   // 标签同色系更浅背景（color-mix 透明度混合，深浅色主题自适应）
   const labelColor = row.label ? LABEL_COLORS[row.label] : null;
 
@@ -216,10 +220,10 @@ const QuickDocRowItem = React.memo(function QuickDocRowItem({ row, index, onRena
         // editing=false 时 Link 重新挂载，后续点击正常触发导航
         editing ? (
           <span className="min-w-0 flex-1 truncate text-sm">{titleBlock}</span>
-        ) : hasExternalUrl(row) ? (
-          // 有外部 URL：直接用 <a> 跳转，不走 SPA 路由
+        ) : safeExternalHref ? (
+          // 有安全外部 URL：直接用 <a> 跳转，不走 SPA 路由
           <a
-            href={row.url!}
+            href={safeExternalHref}
             target="_blank"
             rel="noreferrer"
             className="min-w-0 flex-1 truncate text-sm"
@@ -506,7 +510,11 @@ export function WorkspaceKbCard({ workspaceId, data }: WorkspaceKbCardProps) {
 
       {quickDocs.length > 0 && (
         <DragDropProvider onDragStart={handleDragStart} onDragMove={handleDragMove} onDragEnd={handleDragEnd}>
-          <div ref={gridRef} className="grid min-h-30 grid-cols-5 items-stretch gap-1.5">
+          <div
+            ref={gridRef}
+            className="grid min-h-30 items-stretch gap-1.5"
+            style={{ gridTemplateColumns: `repeat(${QUICK_DOC_COLUMNS}, minmax(0, 1fr))` }}
+          >
             {columns.map((col, colIdx) => {
               const flatBefore = columns.slice(0, colIdx).reduce((sum, c) => sum + c.length, 0);
               return (

package/src/components/workspace/kb/workspace-kb-manage-dialog.tsx

@@ -57,20 +57,27 @@ export function WorkspaceKbManageDialog({
 
   React.useEffect(() => {
     if (!open) return;
+    // cancelled 守卫（审计 A7x 🟡）：快速关开/workspaceId 变化时 last-resolved 不得覆盖新请求
+    let cancelled = false;
     setSearch("");
     setLoading(true);
     void (async () => {
       try {
         const list = await listKbs({ data: { workspaceId } });
+        if (cancelled) return;
         setOptions(list);
         setSelected(new Set(list.filter((k) => k.linked).map((k) => k.id)));
       } catch (err) {
+        if (cancelled) return;
         toastError(err, m.workspace_kb_opFailed());
         setOptions([]);
       } finally {
-        setLoading(false);
+        if (!cancelled) setLoading(false);
       }
     })();
+    return () => {
+      cancelled = true;
+    };
   }, [open, workspaceId, listKbs]);
 
   const toggle = (id: string) => {

package/src/components/workspace/kb/workspace-quick-doc-dialog.tsx

@@ -44,6 +44,7 @@ import {
   type QuickDocItem,
   type QuickDocLabel,
 } from "@/server/serverFns/workspace-kb-utils";
+import { GENERAL_GROUPS, type GeneralGroup } from "@/server/serverFns/story/kb-general-consts";
 import type { SearchDocRow } from "@/server/knowledge/kb-doc-search";
 import { m } from "@/paraglide/messages.js";
 import { t } from "@/lib/i18n/resolver";
@@ -51,6 +52,12 @@ import { toastError } from "@/lib/toast-error";
 
 type CandidateRow = SearchDocRow;
 
+/** KbFilter.group（宽 string）→ serverFn z.enum(GENERAL_GROUPS) 入参的运行时收窄
+ *  （审计 A7x 🟡：替代 f.group as never，取值漂移回归编译/运行时双重校验） */
+function isGeneralGroup(group: string): group is GeneralGroup {
+  return (GENERAL_GROUPS as readonly string[]).includes(group);
+}
+
 interface WorkspaceQuickDocDialogProps {
   workspaceId: string;
   open: boolean;
@@ -78,24 +85,30 @@ export function WorkspaceQuickDocDialog({
   const [labels, setLabels] = React.useState<Map<string, QuickDocLabel | "">>(new Map());
   const [icons, setIcons] = React.useState<Map<string, string>>(new Map());
 
+  // 请求时序守卫（审计 A7x 🟡）：仅最新一次请求允许落 items/loading
+  const loadSeqRef = React.useRef(0);
   const loadDocs = React.useCallback(
     async (f: KbFilter, query: string) => {
+      const seq = ++loadSeqRef.current;
       setLoading(true);
       try {
         const res = await searchDocs({
           data: {
             workspaceId,
             kbId: f?.type === "kb" ? f.id : undefined,
-            generalGroup: f?.type === "general" ? (f.group as never) : undefined,
+            generalGroup:
+              f?.type === "general" && isGeneralGroup(f.group) ? f.group : undefined,
             query,
           },
         });
-        setItems(res.items as CandidateRow[]);
+        if (seq !== loadSeqRef.current) return;
+        setItems(res.items);
       } catch (err) {
+        if (seq !== loadSeqRef.current) return;
         toastError(err, m.workspace_kb_opFailed());
         setItems([]);
       } finally {
-        setLoading(false);
+        if (seq === loadSeqRef.current) setLoading(false);
       }
     },
     [searchDocs, workspaceId],
@@ -110,16 +123,19 @@ export function WorkspaceQuickDocDialog({
     setSearch("");
     setFilter(null);
     void (async () => {
-      // 先拉回显数据源（当前卡片已有的快捷文档），再加载候选列表，保证勾选回显生效
+      // 先拉回显数据源（当前卡片已有的快捷文档），再加载候选列表，保证勾选回显生效。
+      // existingRef 每次打开整体重建（审计 A7x 🟠）：弹窗常驻不卸载，若只合并不清空，
+      // 卡片侧删除的快捷文档会被旧记录过滤、永远加不回（与失败分支的整体重置对齐）。
       try {
         const card = await getCard({ data: { workspaceId } });
+        const existing = new Map<string, { displayTitle: string; label: string | null; icon: string | null }>();
         const selected = new Map<string, CandidateRow>();
         const titles = new Map<string, string>();
         const labels = new Map<string, QuickDocLabel | "">();
         const icons = new Map<string, string>();
         for (const q of card.quickDocs) {
           const key = q.docId ?? `ext:${q.group}:${q.externalId}`;
-          existingRef.current.set(key, { displayTitle: q.displayTitle, label: q.label, icon: q.icon });
+          existing.set(key, { displayTitle: q.displayTitle, label: q.label, icon: q.icon });
           // 全量回显：已有文档构造为候选行注入勾选（不受搜索/筛选结果限制）
           selected.set(key, {
             id: key,
@@ -129,11 +145,12 @@ export function WorkspaceQuickDocDialog({
             kbIcon: "",
             docIcon: q.docIcon,
             parentId: null,
-          } as unknown as CandidateRow);
+          });
           titles.set(key, q.displayTitle);
           if (q.label) labels.set(key, q.label as QuickDocLabel);
           if (q.icon) icons.set(key, q.icon);
         }
+        existingRef.current = existing;
         setSelectedRows(selected);
         setTitles(titles);
         setLabels(labels);
@@ -150,7 +167,7 @@ export function WorkspaceQuickDocDialog({
       }
       void loadDocs(null, "");
     })();
-  }, [open]);
+  }, [open, workspaceId, getCard, listKbs, loadDocs]);
 
   const debouncedSearch = useDebouncedCallback(
     (q: string) => void loadDocs(filter, q),