@allbluecn/web-app 0.19.2 → 0.19.4

package/src/lib/__tests__/sse-transport.test.ts

@@ -40,15 +40,33 @@ afterEach(() => {
 })
 
 describe('createSSETransport', () => {
-  it('creates EventSource with correct URL', async () => {
+  it('subscribe 入参 ids 优先于构造参数（原实现忽略入参，审计 🟡 修复）', async () => {
     const { createSSETransport } = await import('@/lib/sse-transport')
     const transport = createSSETransport(['entity-1', 'entity-2'])
-    const unsubscribe = transport.subscribe(['entity-1'], vi.fn())
+    const unsubscribe = transport.subscribe(['entity-9'], vi.fn())
+
+    expect(instances[0]?.url).toBe('/api/ws?ids=entity-9')
+    unsubscribe()
+  })
+
+  it('subscribe 空数组回落构造参数 entityIds', async () => {
+    const { createSSETransport } = await import('@/lib/sse-transport')
+    const transport = createSSETransport(['entity-1', 'entity-2'])
+    const unsubscribe = transport.subscribe([], vi.fn())
 
     expect(instances[0]?.url).toBe('/api/ws?ids=entity-1,entity-2')
     unsubscribe()
   })
 
+  it('ids 逐个编码（特殊字符不破坏 query 语义）', async () => {
+    const { createSSETransport } = await import('@/lib/sse-transport')
+    const transport = createSSETransport([])
+    const unsubscribe = transport.subscribe(['a&b', 'c,d'], vi.fn())
+
+    expect(instances[0]?.url).toBe('/api/ws?ids=a%26b,c%2Cd')
+    unsubscribe()
+  })
+
   it('calls onUpdate when message received', async () => {
     const { createSSETransport } = await import('@/lib/sse-transport')
     const transport = createSSETransport(['e1'])

package/src/lib/agents/skill-errors.ts

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// Skill serverFn 错误码（客户端安全纯模块，server 与组件双端消费）。
+// serverFn RPC 错误序列化仅保留 message（机器可读 code 通道为跨层基建，见
+// DECISIONS-2026-10-28 S3），过渡口径 = 稳定 code 前缀 + message 携带人类可读文案。
+export const SKILL_NAME_CONFLICT_CODE = "SKILL_NAME_CONFLICT";
+
+export function isSkillNameConflict(err: unknown): boolean {
+  return err instanceof Error && err.message.startsWith(SKILL_NAME_CONFLICT_CODE);
+}

package/src/lib/ai/__tests__/story-jsonl.test.ts

@@ -148,12 +148,24 @@ describe("parseJsonlBuffer 增量解析", () => {
     expect(skippedCount).toBe(0)
   })
 
-  it("嵌套对象整条剔除并计数", () => {
+  it("嵌套对象按花括号深度整体提取（单遍扫描替代歧义正则后的新行为）", () => {
+    // 旧歧义正则对嵌套对象只能匹配到内层片段（剔除计数）；单遍 inString+深度
+    // 扫描可正确提取整个对象，extra 字段经 storySchema.passthrough 保留
     const { items, skippedCount } = parseJsonlBuffer(
       '{"name":"外层","meta":{"k":"v"}}\n{"name":"正常条"}\n',
     )
-    expect(items).toHaveLength(1)
-    expect(items[0].name).toBe("正常条")
+    expect(items).toHaveLength(2)
+    expect(items[0].name).toBe("外层")
+    expect(items[1].name).toBe("正常条")
+    expect(skippedCount).toBe(0)
+  })
+
+  it("未闭合花括号（截断行）不产生片段误匹配", () => {
+    const { items, skippedCount } = parseJsonlBuffer(
+      '{"name":"a","description":"未闭合\n',
+    )
+    expect(items).toHaveLength(0)
+    // 无完整对象：按「剔除计数」口径记 1（与旧行为一致，只是不会匹配出错误片段）
     expect(skippedCount).toBe(1)
   })
 

package/src/lib/ai/chat-handoff.ts

@@ -15,50 +15,65 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { z } from "zod"
+
 export const PENDING_WORKSPACE_MESSAGE_KEY = "pendingWorkspaceMessage";
+export const PENDING_SIDEBAR_DRAFT_KEY = "pendingSidebarDraft";
+
+/**
+ * sessionStorage 槽位工厂：stash/consume（一次性消费）成对出现的统一实现。
+ * 字符串槽位不传 transform；结构化槽位传 { serialize, deserialize }，
+ * deserialize 抛错（含校验失败）时 consume 返回 null，不让畸形数据外泄。
+ */
+function createSessionSlot<T>(
+  key: string,
+  transform?: {
+    serialize: (value: T) => string
+    deserialize: (raw: string) => T
+  },
+): { stash: (value: T) => boolean; consume: () => T | null } {
+  const stash = (value: T): boolean => {
+    try {
+      sessionStorage.setItem(
+        key,
+        transform ? transform.serialize(value) : (value as unknown as string),
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const consume = (): T | null => {
+    try {
+      const raw = sessionStorage.getItem(key);
+      if (raw === null) return null;
+      sessionStorage.removeItem(key);
+      return transform ? transform.deserialize(raw) : (raw as unknown as T);
+    } catch {
+      return null;
+    }
+  };
+  return { stash, consume };
+}
+
+const pendingWorkspaceMessageSlot = createSessionSlot<string>(PENDING_WORKSPACE_MESSAGE_KEY);
 
 export function stashPendingWorkspaceMessage(message: string): boolean {
-  try {
-    sessionStorage.setItem(PENDING_WORKSPACE_MESSAGE_KEY, message);
-    return true;
-  } catch {
-    return false;
-  }
+  return pendingWorkspaceMessageSlot.stash(message);
 }
 
 export function consumePendingWorkspaceMessage(): string | null {
-  try {
-    const msg = sessionStorage.getItem(PENDING_WORKSPACE_MESSAGE_KEY);
-    if (msg !== null) {
-      sessionStorage.removeItem(PENDING_WORKSPACE_MESSAGE_KEY);
-    }
-    return msg;
-  } catch {
-    return null;
-  }
+  return pendingWorkspaceMessageSlot.consume();
 }
 
-export const PENDING_SIDEBAR_DRAFT_KEY = "pendingSidebarDraft";
+const sidebarDraftSlot = createSessionSlot<string>(PENDING_SIDEBAR_DRAFT_KEY);
 
 export function stashSidebarDraft(draft: string): boolean {
-  try {
-    sessionStorage.setItem(PENDING_SIDEBAR_DRAFT_KEY, draft);
-    return true;
-  } catch {
-    return false;
-  }
+  return sidebarDraftSlot.stash(draft);
 }
 
 export function consumeSidebarDraft(): string | null {
-  try {
-    const draft = sessionStorage.getItem(PENDING_SIDEBAR_DRAFT_KEY);
-    if (draft !== null) {
-      sessionStorage.removeItem(PENDING_SIDEBAR_DRAFT_KEY);
-    }
-    return draft;
-  } catch {
-    return null;
-  }
+  return sidebarDraftSlot.consume();
 }
 
 export interface HandoffConversation {
@@ -76,26 +91,29 @@ export interface HandoffContext {
 
 const HANDOFF_CONTEXT_KEY = "handoffContext";
 
+// storage 被污染时经 zod 校验拒绝（consume 返回 null），畸形对象不再静默扩散
+const handoffContextSchema = z.object({
+  board: z.string(),
+  entityId: z.string(),
+});
+
+const handoffContextSlot = createSessionSlot<HandoffContext>(HANDOFF_CONTEXT_KEY, {
+  serialize: (context) => JSON.stringify(context),
+  deserialize: (raw) => {
+    const parsed = handoffContextSchema.safeParse(JSON.parse(raw));
+    if (!parsed.success) throw new Error("invalid handoff context payload");
+    return parsed.data;
+  },
+});
+
 export function startHandoffWithContext(
   text: string,
   context: HandoffContext,
 ): { pending: string } {
-  try {
-    sessionStorage.setItem(HANDOFF_CONTEXT_KEY, JSON.stringify(context));
-  } catch {
-    // ignore
-  }
+  handoffContextSlot.stash(context);
   return { pending: text };
 }
 
 export function consumeHandoffContext(): HandoffContext | null {
-  try {
-    const raw = sessionStorage.getItem(HANDOFF_CONTEXT_KEY);
-    if (raw === null) return null;
-    sessionStorage.removeItem(HANDOFF_CONTEXT_KEY);
-    return JSON.parse(raw) as HandoffContext;
-  } catch {
-    return null;
-  }
+  return handoffContextSlot.consume();
 }
-

package/src/lib/ai/default-model.ts

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+
+// AI provider/model 缺省值的单一来源（客户端安全纯常量）：
+// auth.config 降级 profile / jwt 回填、desktop guest session、buildRemoteSession
+// 四处此前各持字面量（审计 A2x-1 auth/session#5 魔法串），改值只改这里。
+export const DEFAULT_AI_PROVIDER = "openrouter";
+export const DEFAULT_AI_MODEL = "openai/gpt-4o-mini";

package/src/lib/ai/story-jsonl.ts

@@ -56,15 +56,48 @@ export function stripCodeFence(raw: string): string {
 }
 
 /**
- * 匹配行内所有 {…} 顶层对象片段。字符串分支前置，使字符串字面量整体消费
- * （含内部的 `{`/`}` 都不会截断对象边界）。需求 JSON 无嵌套对象：
- * 嵌套对象会被提取为缺尾 `}` 的片段，JSON.parse 失败后整条剔除计数。
+ * 匹配行内所有 {…} 顶层对象片段。单遍手写扫描（inString + 花括号深度），
+ * 替代原 `/\{("[^"]*"|[^{}])*\}/g` 歧义正则——原正则的 `"[^"]*"` 与 `[^{}]`
+ * 对引号字符存在两种消费方式，未闭合 `{` + 大量引号时失败匹配回溯路径按
+ * 引号数指数放大（ReDoS），且该函数在流式增量解析中被反复调用。
+ * 嵌套对象按深度整体提取（原正则只能匹配到内层片段后剔除）；字符串内的
+ * `{`/`}`/转义引号不破坏边界；未闭合输入不产生片段误匹配。
  */
 function extractObjects(text: string): string[] {
   const objects: string[] = []
-  const regex = /\{("[^"]*"|[^{}])*\}/g
-  let match: RegExpExecArray | null
-  while ((match = regex.exec(text)) !== null) objects.push(match[0])
+  let depth = 0
+  let start = -1
+  let inString = false
+  let escaped = false
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i]
+    if (inString) {
+      if (escaped) {
+        escaped = false
+      } else if (ch === "\\") {
+        escaped = true
+      } else if (ch === '"') {
+        inString = false
+      }
+      continue
+    }
+    if (ch === '"') {
+      if (depth > 0) inString = true
+      continue
+    }
+    if (ch === "{") {
+      if (depth === 0) start = i
+      depth++
+      continue
+    }
+    if (ch === "}" && depth > 0) {
+      depth--
+      if (depth === 0 && start >= 0) {
+        objects.push(text.slice(start, i + 1))
+        start = -1
+      }
+    }
+  }
   return objects
 }
 

package/src/lib/ai/use-knowledge-bases.ts

@@ -16,26 +16,33 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // apps/web/src/lib/ai/use-knowledge-bases.ts
-import { useEffect, useState } from "react"
+import { useQuery } from "@tanstack/react-query"
 import { listKnowledgeFn } from "@/server/serverFns/knowledge"
 import type { KnowledgeBaseItem } from "@/components/ai/ai-prompt-input"
 
+export const KNOWLEDGE_BASES_QUERY_KEY = ["knowledge-bases"] as const
+
 /**
  * 加载当前用户的知识库列表，供 AIPromptInput 的「添加上下文」选择器使用。
  * 传 knowledgeBases 时 AIPromptInput 显示知识库版本（非 mock 页面/用户选择器）。
+ *
+ * react-query 消费（与 use-code-mode-readiness / use-search-capability 一致）：
+ * 缓存/重试/去重免费，失败经 query error 状态可见而非空数组静默。
  */
 export function useKnowledgeBases(): KnowledgeBaseItem[] {
-  const [knowledgeBases, setKnowledgeBases] = useState<KnowledgeBaseItem[]>([])
-
-  useEffect(() => {
-    listKnowledgeFn()
-      .then((list: { id: string; name: string; icon: string }[]) =>
-        setKnowledgeBases(
-          list.map((kb: { id: string; name: string; icon: string }) => ({ id: kb.id, name: kb.name, icon: kb.icon })),
-        ),
+  const { data } = useQuery({
+    queryKey: KNOWLEDGE_BASES_QUERY_KEY,
+    queryFn: async () => {
+      const list = await listKnowledgeFn()
+      return list.map(
+        (kb: { id: string; name: string; icon: string }) => ({
+          id: kb.id,
+          name: kb.name,
+          icon: kb.icon,
+        }),
       )
-      .catch(() => {})
-  }, [])
-
-  return knowledgeBases
+    },
+    staleTime: 60_000,
+  })
+  return data ?? []
 }

package/src/lib/ai/use-selected-model.ts

@@ -16,36 +16,86 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // apps/web/src/lib/ai/use-selected-model.ts
-import { useEffect, useState } from "react"
+import { useCallback, useSyncExternalStore } from "react"
 
 const STORAGE_KEY = "chat:selectedModel"
 
+/**
+ * 模块级单例 store：同页多个 hook 实例（对话页/工作台/全局浮窗）共享同一份
+ * 模型选择，任一处切换经 listeners 通知全部实例；localStorage 仅作持久化
+ * （storage 事件只跨标签页，同页同步必须靠模块级订阅）。
+ */
+let currentValue: string = ""
+let initialized = false
+const listeners = new Set<() => void>()
+
+function readStorage(): string {
+  // 本项目 SSR 的 Node 环境存在注入的 window（opaque origin，localStorage
+  // 访问抛 SecurityError），typeof 守卫会穿透——浏览器存储访问必须 try/catch
+  try {
+    return window.localStorage.getItem(STORAGE_KEY) ?? ""
+  } catch {
+    return ""
+  }
+}
+
+function ensureInitialized() {
+  if (!initialized) {
+    initialized = true
+    currentValue = readStorage()
+  }
+}
+
+function emitChange() {
+  for (const listener of listeners) listener()
+}
+
+function setSelectedModelGlobal(
+  value: string | ((prev: string) => string),
+) {
+  ensureInitialized()
+  const next = typeof value === "function" ? value(currentValue) : value
+  if (next === currentValue) return
+  currentValue = next
+  try {
+    // 空值时移除持久化条目，避免刷新后 stale 模型复活
+    if (next) {
+      window.localStorage.setItem(STORAGE_KEY, next)
+    } else {
+      window.localStorage.removeItem(STORAGE_KEY)
+    }
+  } catch {
+    // SSR/无存储环境降级：不持久化
+  }
+  emitChange()
+}
+
+function subscribe(listener: () => void) {
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+  }
+}
+
+function getSnapshot() {
+  ensureInitialized()
+  return currentValue
+}
+
+function getServerSnapshot() {
+  return ""
+}
+
 /**
  * 共享模型选择 state，跨入口（对话页/工作台/全局浮窗）同步。
  * 持久化到 localStorage，任一处切换模型全局生效。
  */
 export function useSelectedModel() {
-  const [selectedModel, setSelectedModel] = useState<string>(
-    () => {
-      // 本项目 SSR 的 Node 环境存在注入的 window（opaque origin，localStorage
-      // 访问抛 SecurityError），typeof 守卫会穿透——浏览器存储访问必须 try/catch
-      try {
-        return window.localStorage.getItem(STORAGE_KEY) ?? "";
-      } catch {
-        return "";
-      }
-    },
+  const selectedModel = useSyncExternalStore(
+    subscribe,
+    getSnapshot,
+    getServerSnapshot,
   )
-
-  useEffect(() => {
-    try {
-      if (selectedModel) {
-        localStorage.setItem(STORAGE_KEY, selectedModel)
-      }
-    } catch {
-      // SSR/无存储环境降级：不持久化
-    }
-  }, [selectedModel])
-
+  const setSelectedModel = useCallback(setSelectedModelGlobal, [])
   return [selectedModel, setSelectedModel] as const
 }

package/src/lib/anyhub/anyhub-message-bridge.ts

@@ -15,20 +15,27 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { checkPermission } from "./permissions"
-
-type PendingRequest = {
-  resolve: (data: unknown) => void
-  reject: (error: Error) => void
-}
-
-const pendingRequests = new Map<string, PendingRequest>()
+import { checkAnyHubPermissionFn } from "@/server/serverFns/anyhub/permissions"
 
 export function initializeMessageBridge(
   iframeRef: React.RefObject<HTMLIFrameElement | null>,
   appId: string,
-  userId: string,
 ) {
+  // 记录 iframe 初始 origin 作为 postMessage targetOrigin，避免 iframe 被导航到
+  // 其他 origin 时用户数据泄露给新 origin；无法解析时退回 "*"（保持旧行为）
+  const resolveTargetOrigin = (): string => {
+    try {
+      const src = iframeRef.current?.src
+      if (src) {
+        const origin = new URL(src, window.location.origin).origin
+        if (origin && origin !== "null") return origin
+      }
+    } catch {
+      // ignore: 解析失败退回通配
+    }
+    return "*"
+  }
+
   const handler = async (event: MessageEvent) => {
     const iframe = iframeRef.current
     if (!iframe) return
@@ -39,31 +46,51 @@ export function initializeMessageBridge(
     if (data.type !== "anyhub:request") return
 
     const { id, method, params } = data
-    if (!id || !method) return
+    if (!id || !method || typeof method !== "string") return
+
+    const normalized = normalizeMethod(method)
+    if (!normalized) {
+      sendMessageToIframe(iframe, {
+        type: "anyhub:response",
+        id,
+        error: { code: "BAD_METHOD", message: `未知的 API 方法: ${method}` },
+      }, resolveTargetOrigin())
+      return
+    }
 
-    const hasPermission = await checkPermission(appId, method, userId)
+    // 权限表在 DB，经 serverFn RPC 判定（userId 以 session 为准，不信任客户端传值）；
+    // 原「直连 lib/anyhub/permissions」会把 prisma 拉进客户端 bundle，且浏览器根本不可查
+    let hasPermission = false
+    try {
+      hasPermission = await checkAnyHubPermissionFn({ data: { appId, method: normalized } })
+    } catch {
+      hasPermission = false
+    }
     if (!hasPermission) {
       sendMessageToIframe(iframe, {
         type: "anyhub:response",
         id,
-        error: { code: "PERMISSION_DENIED", message: `无权限: ${method}` },
-      })
+        error: { code: "PERMISSION_DENIED", message: `无权限: ${normalized}` },
+      }, resolveTargetOrigin())
       return
     }
 
     try {
-      const result = await proxyToInternalAPI(method, params)
+      const result = await proxyToInternalAPI(normalized, params)
       sendMessageToIframe(iframe, {
         type: "anyhub:response",
         id,
         data: result,
-      })
-    } catch (e: any) {
+      }, resolveTargetOrigin())
+    } catch (e: unknown) {
       sendMessageToIframe(iframe, {
         type: "anyhub:response",
         id,
-        error: { code: "API_ERROR", message: e.message },
-      })
+        error: {
+          code: "API_ERROR",
+          message: e instanceof Error ? e.message : String(e),
+        },
+      }, resolveTargetOrigin())
     }
   }
 
@@ -71,29 +98,45 @@ export function initializeMessageBridge(
   return () => window.removeEventListener("message", handler)
 }
 
+/**
+ * 方法名统一为冒号格式（`prd:list`）。iframe 侧历史上的下划线格式
+ * （`prd_list`）归一化后兼容——两套格式曾互斥，导致权限校验恒拒或路由不存在。
+ */
+function normalizeMethod(method: string): string | null {
+  if (!/^[a-z]+[_:][a-z]+$/i.test(method)) return null
+  return method.replace(/_/g, ":").toLowerCase()
+}
+
+function encodedParam(value: unknown): string {
+  if (value === undefined || value === null || value === "") return ""
+  // encodeURIComponent 阻断 `../` 路径穿越与 `?`/`#` 对 query 的破坏
+  return encodeURIComponent(String(value))
+}
+
 function sendMessageToIframe(
   iframe: HTMLIFrameElement,
   message: Record<string, unknown>,
+  targetOrigin: string,
 ) {
-  iframe.contentWindow?.postMessage(message, "*")
+  iframe.contentWindow?.postMessage(message, targetOrigin)
 }
 
 async function proxyToInternalAPI(
   method: string,
   params: Record<string, unknown> | undefined,
 ): Promise<unknown> {
-  const [group, action] = method.split('_')
+  const [group, action] = method.split(":")
   const apiMap: Record<string, Record<string, string>> = {
     prd: {
       list: "/api/prd",
-      get: `/api/prd/${params?.id || ""}`,
+      get: `/api/prd/${encodedParam(params?.id)}`,
       create: "/api/prd",
-      update: `/api/prd/${params?.id || ""}`,
-      delete: `/api/prd/${params?.id || ""}`,
+      update: `/api/prd/${encodedParam(params?.id)}`,
+      delete: `/api/prd/${encodedParam(params?.id)}`,
     },
     doc: {
-      list: `/api/prd/${params?.designId || ""}/pages`,
-      get: `/api/prd/${params?.designId || ""}/pages/${params?.pageId || ""}`,
+      list: `/api/prd/${encodedParam(params?.designId)}/pages`,
+      get: `/api/prd/${encodedParam(params?.designId)}/pages/${encodedParam(params?.pageId)}`,
     },
     user: {
       get: "/api/user/profile",
@@ -133,9 +176,19 @@ export function sendEventToIframe(
   event: string,
   data: unknown,
 ) {
-  sendMessageToIframe(iframe, {
-    type: "anyhub:event",
-    event,
-    data,
-  })
+  try {
+    const origin = iframe.src
+      ? new URL(iframe.src, window.location.origin).origin
+      : "*"
+    sendMessageToIframe(
+      iframe,
+      { type: "anyhub:event", event, data },
+      origin && origin !== "null" ? origin : "*",
+    )
+  } catch {
+    iframe.contentWindow?.postMessage(
+      { type: "anyhub:event", event, data },
+      "*",
+    )
+  }
 }

package/src/lib/anyhub/anyhub-store.ts

@@ -74,24 +74,29 @@ export const anyHubActions = {
         installedApps: typed,
         pinnedApps: typed.filter((a) => a.pinned),
       }))
+    } catch {
+      // 与 installApp/uninstallApp 一致：失败不向 fire-and-forget 调用方抛
+      // unhandled rejection（调用方多为 useEffect 直接调）
     } finally {
       anyHubActions.setLoading(false)
     }
   },
 
-  fetchMarketplace: async (_category?: string, _search?: string) => {
+  fetchMarketplace: async (category?: string, search?: string) => {
     anyHubActions.setLoading(true)
     try {
-      const apps = await listMarketplaceAppsFn({ data: { category: _category, search: _search } })
+      const apps = await listMarketplaceAppsFn({ data: { category, search } })
       anyHubStore.setState((s) => ({ ...s, marketApps: apps }))
+    } catch {
+      // 同 fetchInstalled：吞掉拒绝，调用方经空列表感知
     } finally {
       anyHubActions.setLoading(false)
     }
   },
 
-  installApp: async (source: string, params: Record<string, string>) => {
+  installApp: async (source: 'marketplace' | 'github' | 'local', params: Record<string, string>) => {
     try {
-      const app = await installAnyHubAppFn({ data: { source: source as any, ...params } })
+      const app = await installAnyHubAppFn({ data: { source, ...params } })
       await anyHubActions.fetchInstalled()
       return app
     } catch {
@@ -109,9 +114,9 @@ export const anyHubActions = {
     }
   },
 
-  togglePin: async (_appId: string) => {
+  togglePin: async (appId: string) => {
     try {
-      await togglePinFn({ data: { appId: _appId } })
+      await togglePinFn({ data: { appId } })
       await anyHubActions.fetchInstalled()
       return true
     } catch {