@allbluecn/web-app 0.19.2 → 0.19.4

package/src/lib/auth/auth.config.ts

@@ -15,6 +15,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { DEFAULT_AI_MODEL, DEFAULT_AI_PROVIDER } from '@/lib/ai/default-model'
 import type { StartAuthJSConfig } from 'start-authjs'
 import type { SessionUser } from '@/lib/session'
 import CredentialsProvider from '@auth/core/providers/credentials'
@@ -22,7 +23,7 @@ import GoogleProvider from '@auth/core/providers/google'
 import GitHubProvider from '@auth/core/providers/github'
 import { prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
-import { getRandomConfig, presetBgColors, defaultAvatarConfig } from '@/components/settings/personal-team/account/avatar/avatar-config'
+import { getRandomConfig, presetBgColors, defaultAvatarConfig } from '@/lib/avatar/avatar-config'
 import { resolveIpLocation, getClientIp } from '@allbluecn/kernel'
 import { getResolvedOAuthProviders } from '@/server/oauth-config'
 import { isLoginBlocked, recordLoginFailure, clearLoginFailures } from '@/server/middlewares/auth-rate-limit'
@@ -39,6 +40,8 @@ type CachedProfile = {
   locale: string | null
   aiSourceMode: string | null
   planLabel: 'pro' | 'free'
+  /** null = 降级 profile（DB 异常），版本比对跳过防误杀 */
+  tokenVersion: number | null
 }
 
 // in-flight 去重：value 存 promise 而非结果，TTL 检查基于条目创建时间，
@@ -50,6 +53,21 @@ type CachedProfile = {
 const profileCache = new Map<string, { promise: Promise<CachedProfile | null>; at: number }>()
 const PROFILE_CACHE_TTL = 30_000
 
+// 周期清扫过期条目：仅靠「同 userId 再读时检查 TTL」会让不再发起 session 的
+// 用户条目永久驻留（长运行进程内存缓慢无界增长）
+let cacheSweeper: ReturnType<typeof setInterval> | null = null
+function ensureCacheSweeper(): void {
+  if (cacheSweeper) return
+  cacheSweeper = setInterval(() => {
+    const now = Date.now()
+    for (const [key, entry] of profileCache) {
+      if (now - entry.at > PROFILE_CACHE_TTL) profileCache.delete(key)
+    }
+  }, 5 * 60_000)
+  // 不阻止进程自然退出（测试/工具进程 import 本模块时）
+  cacheSweeper.unref?.()
+}
+
 /** 外部调用者在写入 aiSourceMode 后清空缓存，避免后续 30s 内 JWT session 读到旧值 */
 export function invalidateProfileCache(userId: string): void {
   profileCache.delete(userId)
@@ -70,6 +88,7 @@ async function queryProfile(userId: string): Promise<CachedProfile | null> {
         aiApiKey: true,
         locale: true,
         aiSourceMode: true,
+        tokenVersion: true,
       },
     }),
     prisma.aiProviderConfig.findMany({
@@ -97,17 +116,19 @@ function degradedProfile(): CachedProfile {
     avatarConfig: defaultAvatarConfig,
     bgShape: 'square',
     bgColor: '#fff',
-    aiProvider: 'openrouter',
-    aiModel: 'openai/gpt-4o-mini',
+    aiProvider: DEFAULT_AI_PROVIDER,
+    aiModel: DEFAULT_AI_MODEL,
     timezone: null,
     hasAiKey: false,
     locale: null,
     aiSourceMode: null,
     planLabel: 'free',
+    tokenVersion: null,
   }
 }
 
 async function getCachedProfile(userId: string): Promise<CachedProfile | null> {
+  ensureCacheSweeper()
   const cached = profileCache.get(userId)
   if (cached && Date.now() - cached.at < PROFILE_CACHE_TTL) return cached.promise
   // 先占位 in-flight promise 再发起查询：并发 cache miss 复用同一查询（防缓存击穿）
@@ -134,6 +155,152 @@ function pickBgColor(seed: string) {
   return presetBgColors[Math.abs(hash) % presetBgColors.length]
 }
 
+// Session 有效期常量（remember 勾选 = 30 天，未勾选 = 3 天），多处引用单一来源
+const SESSION_MAX_AGE_REMEMBER = 30 * 24 * 60 * 60
+const SESSION_MAX_AGE_SHORT = 3 * 24 * 60 * 60
+
+// 用户不存在分支的恒 false bcrypt 比较：抹平与「存在用户走 bcrypt.compare」的
+// 响应时间差，防注册邮箱枚举 oracle（值仅作耗时基准，永不匹配）
+let dummyBcryptHash: string | null = null
+function timingEqualizePasswordCompare(): void {
+  try {
+    dummyBcryptHash ??= bcrypt.hashSync('allblue-timing-equalizer', 10)
+    void bcrypt.compare('allblue-timing-equalizer!', dummyBcryptHash)
+  } catch {
+    // 降级：生成失败时跳过（时间差防护尽力而为）
+  }
+}
+
+interface OAuthAccountShape {
+  provider: string
+  providerAccountId: string
+  type: string
+  access_token?: string | null
+  refresh_token?: string | null
+  expires_at?: number | null
+  token_type?: string | null
+  scope?: string | null
+  id_token?: string | null
+  session_state?: string | null
+}
+
+interface OAuthUpsertResult {
+  id: string
+  role: string
+  tokenVersion: number
+}
+
+/**
+ * OAuth 登录的用户落库/绑定（google / github 共用）：按 email 关联已有用户或
+ * 创建新用户 + account upsert。返回真实 users.id 供 jwt callback 写入 token
+ * （provider profiles 映射的 user.id 是外部数字 id，不查库 session 必然 miss）。
+ * username 撞 unique（P2002）时重试并追加随机后缀，消除 check-then-act 竞态。
+ */
+async function ensureOAuthUser(
+  account: OAuthAccountShape,
+  email: string,
+  displayName: string | undefined,
+  picture: string | undefined | null,
+): Promise<OAuthUpsertResult> {
+  const dbUser = await prisma.user.findUnique({ where: { email } })
+
+  if (dbUser) {
+    if (dbUser.status !== 'ACTIVE') throw new Error('OAUTH_USER_INACTIVE')
+    await prisma.$transaction(async (tx) => {
+      if (picture && picture !== dbUser.image) {
+        await tx.user.update({ where: { id: dbUser.id }, data: { image: picture } })
+      }
+      await tx.user.update({ where: { id: dbUser.id }, data: { lastLoginAt: new Date() } })
+      await tx.account.upsert({
+        where: { provider_providerAccountId: { provider: account.provider, providerAccountId: account.providerAccountId } },
+        update: {
+          access_token: account.access_token ?? null,
+          refresh_token: account.refresh_token ?? null,
+          expires_at: account.expires_at ?? null,
+          token_type: account.token_type ?? null,
+          scope: account.scope ?? null,
+          id_token: account.id_token ?? null,
+          session_state: account.session_state ?? null,
+        },
+        create: {
+          userId: dbUser.id,
+          type: account.type,
+          provider: account.provider,
+          providerAccountId: account.providerAccountId,
+          access_token: account.access_token ?? null,
+          refresh_token: account.refresh_token ?? null,
+          expires_at: account.expires_at ?? null,
+          token_type: account.token_type ?? null,
+          scope: account.scope ?? null,
+          id_token: account.id_token ?? null,
+          session_state: account.session_state ?? null,
+        },
+      })
+    })
+    return { id: dbUser.id, role: dbUser.role, tokenVersion: dbUser.tokenVersion }
+  }
+
+  // 新用户：username 由显示名/邮箱前缀派生；并发首登撞唯一约束时重试
+  const baseName = displayName || email.split('@')[0]
+  const baseUsername = baseName.replace(/[^a-zA-Z0-9_]/g, '_').toLowerCase() || 'user'
+  let username = baseUsername
+
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const result = await prisma.$transaction(async (tx) => {
+        const u = await tx.user.create({
+          data: {
+            email,
+            username,
+            password: '',
+            role: 'USER',
+            status: 'ACTIVE',
+            image: picture ?? null,
+            emailVerified: new Date(),
+            lastLoginAt: new Date(),
+            avatarConfig: getRandomConfig(),
+            bgShape: 'square',
+            bgColor: pickBgColor(username),
+          },
+        })
+        await tx.account.upsert({
+          where: { provider_providerAccountId: { provider: account.provider, providerAccountId: account.providerAccountId } },
+          update: {
+            access_token: account.access_token ?? null,
+            refresh_token: account.refresh_token ?? null,
+            expires_at: account.expires_at ?? null,
+            token_type: account.token_type ?? null,
+            scope: account.scope ?? null,
+            id_token: account.id_token ?? null,
+            session_state: account.session_state ?? null,
+          },
+          create: {
+            userId: u.id,
+            type: account.type,
+            provider: account.provider,
+            providerAccountId: account.providerAccountId,
+            access_token: account.access_token ?? null,
+            refresh_token: account.refresh_token ?? null,
+            expires_at: account.expires_at ?? null,
+            token_type: account.token_type ?? null,
+            scope: account.scope ?? null,
+            id_token: account.id_token ?? null,
+            session_state: account.session_state ?? null,
+          },
+        })
+        return u
+      })
+      return { id: result.id, role: result.role, tokenVersion: result.tokenVersion ?? 0 }
+    } catch (err) {
+      const isUsernameConflict =
+        (err as { code?: string })?.code === 'P2002' && attempt < 5
+      if (!isUsernameConflict) throw err
+      // 随机后缀（uuid 片段，空间远大于原 4 字符 base36），重试整个创建事务
+      username = `${baseUsername}_${crypto.randomUUID().replace(/-/g, '').slice(0, 8)}`
+    }
+  }
+}
+
 const credentialsProvider = CredentialsProvider({
   name: 'credentials',
   credentials: {
@@ -143,17 +310,8 @@ const credentialsProvider = CredentialsProvider({
   },
   async authorize(credentials, request) {
     const creds = credentials as { email: string; password: string; remember?: string; stayLoggedIn?: string; ssoToken?: string }
-    if (creds.ssoToken) {
-      const { resolveSsoTokenUser } = await import('./sso-authorize')
-      const user = await resolveSsoTokenUser(creds.ssoToken)
-      if (!user) return null
-      return { id: user.id, email: user.email, name: user.name, role: user.role }
-    }
-    if (!creds.email || !creds.password) return null
-
-    const loginEmail = creds.email.toLowerCase().trim()
-
-    // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）
+    // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）。
+    // credentials 与 ssoToken 两条分支都要用（SSO 登录日志与密码登录审计口径一致）
     let ip: string | null = null
     let userAgent: string | null = null
     try {
@@ -166,6 +324,17 @@ const credentialsProvider = CredentialsProvider({
       // 忽略：IP/UA 仅用于限流与日志，获取失败不影响登录
     }
 
+    if (creds.ssoToken) {
+      const { resolveSsoTokenUser } = await import('./sso-authorize')
+      // 透传 ip/UA：SSO 登录日志与密码登录审计口径一致（可追溯异常登录）
+      const user = await resolveSsoTokenUser(creds.ssoToken, { ip, userAgent })
+      if (!user) return null
+      return { id: user.id, email: user.email, name: user.name, role: user.role }
+    }
+    if (!creds.email || !creds.password) return null
+
+    const loginEmail = creds.email.toLowerCase().trim()
+
     // SEC-09：登录失败限流（email+IP 维度，仅失败计数，成功清零）。
     // 被限流返回 null——与密码错误不可区分，不暴露「被限流」细节（防枚举）。
     // 测试环境豁免（NODE_ENV=test）在限流器内部处理，e2e 成功登录不受影响。
@@ -173,12 +342,14 @@ const credentialsProvider = CredentialsProvider({
 
     const user = await prisma.user.findUnique({
       where: { email: loginEmail },
-      select: { id: true, email: true, username: true, password: true, role: true, status: true },
+      select: { id: true, email: true, username: true, password: true, role: true, status: true, tokenVersion: true },
     })
 
-    // 用户不存在：userId 为外键，无法记录日志（保持现状）
+    // 用户不存在：userId 为外键，无法记录日志（保持现状）。
+    // 补一次恒 false 的 bcrypt 比较，抹平与存在用户的响应时间差（防邮箱枚举）
     if (!user) {
       recordLoginFailure(loginEmail, ip)
+      timingEqualizePasswordCompare()
       return null
     }
 
@@ -262,7 +433,7 @@ const GITHUB_PROVIDER_BASE = {
 
 export const authConfig: StartAuthJSConfig = {
   basePath: '/api/auth',
-  session: { strategy: 'jwt', maxAge: 30 * 24 * 60 * 60 },
+  session: { strategy: 'jwt', maxAge: SESSION_MAX_AGE_REMEMBER },
   pages: { signIn: '/login', error: '/login' },
   secret: process.env.AUTH_SECRET,
   trustHost: true,
@@ -297,82 +468,27 @@ export const authConfig: StartAuthJSConfig = {
   ],
   callbacks: {
     async signIn({ user, account, profile }) {
-      if (account?.provider === 'google') {
+      if (account?.provider === 'google' || account?.provider === 'github') {
+        // google / github 共用落库逻辑：profile.email 缺失（github 私密邮箱等）
+        // 时拒绝登录（email 是唯一关联键，无邮箱无法绑定/建号）
         const email = profile?.email as string | undefined
         if (!email) return false
 
-        const dbUser = await prisma.user.findUnique({ where: { email } })
-
-        if (dbUser) {
-          if (dbUser.status !== 'ACTIVE') return false
-          await prisma.$transaction(async (tx) => {
-            if (profile?.picture && profile.picture !== dbUser.image) {
-              await tx.user.update({ where: { id: dbUser.id }, data: { image: profile.picture as string } })
-            }
-            await tx.user.update({ where: { id: dbUser.id }, data: { lastLoginAt: new Date() } })
-            await tx.account.upsert({
-              where: { provider_providerAccountId: { provider: account.provider, providerAccountId: account.providerAccountId as string } },
-              update: { access_token: account.access_token as string, refresh_token: account.refresh_token as string | null },
-              create: {
-                userId: dbUser.id,
-                type: account.type,
-                provider: account.provider,
-                providerAccountId: account.providerAccountId as string,
-                access_token: account.access_token as string,
-                refresh_token: account.refresh_token as string | null,
-                expires_at: account.expires_at as number | null,
-                token_type: account.token_type as string | null,
-                scope: account.scope as string | null,
-                id_token: account.id_token as string | null,
-                session_state: account.session_state as string | null,
-              },
-            })
-          })
-          user.id = dbUser.id
-          ;(user as { role: string }).role = dbUser.role
-        } else {
-          const name = (profile?.name as string | undefined) || email.split('@')[0]
-          let username = name.replace(/[^a-zA-Z0-9_]/g, '_').toLowerCase()
-          const existing = await prisma.user.findUnique({ where: { username } })
-          if (existing) username = `${username}_${Math.random().toString(36).slice(2, 6)}`
-
-          const newUser = await prisma.$transaction(async (tx) => {
-            const u = await tx.user.create({
-              data: {
-                email,
-                username,
-                password: '',
-                role: 'USER',
-                status: 'ACTIVE',
-                image: (profile?.picture as string | undefined) ?? null,
-                emailVerified: new Date(),
-                lastLoginAt: new Date(),
-                avatarConfig: getRandomConfig(),
-                bgShape: 'square',
-                bgColor: pickBgColor(username),
-              },
-            })
-            await tx.account.upsert({
-              where: { provider_providerAccountId: { provider: account.provider, providerAccountId: account.providerAccountId as string } },
-              update: { access_token: account.access_token as string, refresh_token: account.refresh_token as string | null },
-              create: {
-                userId: u.id,
-                type: account.type,
-                provider: account.provider,
-                providerAccountId: account.providerAccountId as string,
-                access_token: account.access_token as string,
-                refresh_token: account.refresh_token as string | null,
-                expires_at: account.expires_at as number | null,
-                token_type: account.token_type as string | null,
-                scope: account.scope as string | null,
-                id_token: account.id_token as string | null,
-                session_state: account.session_state as string | null,
-              },
-            })
-            return u
-          })
-          user.id = newUser.id
-          ;(user as { role: string }).role = 'USER'
+        const displayName = (profile?.name as string | undefined) || undefined
+        const picture = (profile?.picture as string | undefined) ?? null
+        try {
+          const resolved = await ensureOAuthUser(
+            account as unknown as OAuthAccountShape,
+            email,
+            displayName,
+            picture,
+          )
+          user.id = resolved.id
+          ;(user as { role: string }).role = resolved.role
+          ;(user as { tokenVersion?: number }).tokenVersion = resolved.tokenVersion
+        } catch (e) {
+          if (e instanceof Error && e.message === 'OAUTH_USER_INACTIVE') return false
+          throw e
         }
 
         return true
@@ -386,14 +502,17 @@ export const authConfig: StartAuthJSConfig = {
         token.id = user.id
         token.role = (user as { role: string }).role
         token.picture = (user as { image?: string }).image
-        token.maxAge = 30 * 24 * 60 * 60
+        token.maxAge = SESSION_MAX_AGE_REMEMBER
+        // 凭据版本号只在登录时盖章（后续请求不得回读刷新，否则旧 token 会被「续命」使吊销失效）
+        token.tokenVersion = (user as { tokenVersion?: number }).tokenVersion ?? 0
       }
       // credentials sign-in
       if (user && !account) {
         token.role = (user as { role: string }).role
         token.id = user.id
+        token.tokenVersion = (user as { tokenVersion?: number }).tokenVersion ?? 0
         const remember = (user as { remember?: boolean }).remember
-        token.maxAge = remember ? 30 * 24 * 60 * 60 : 3 * 24 * 60 * 60
+        token.maxAge = remember ? SESSION_MAX_AGE_REMEMBER : SESSION_MAX_AGE_SHORT
       }
       if (token.id && trigger === 'update') {
         // DB 查询失败降级保留原 token（@auth/core 会把 callback 异常误判为
@@ -429,6 +548,12 @@ export const authConfig: StartAuthJSConfig = {
         if (!dbUser) {
           return { ...session, user: null } as unknown as typeof session
         }
+        // 凭据版本比对：重置密码后 bump tokenVersion，持旧 JWT 的会话在此被拒（user:null → 登录页）。
+        // 部署灰度兼容：升级前签发的旧 JWT 无该字段，按 0 处理——用户未重置过密码（版本恒 0）则不受影响。
+        // DB 值缺失/降级（null/undefined）时跳过比对：基础设施异常不误杀会话（schema NOT NULL，缺值仅见于降级路径）。
+        if (dbUser.tokenVersion != null && (token.tokenVersion ?? 0) !== dbUser.tokenVersion) {
+          return { ...session, user: null } as unknown as typeof session
+        }
         if (dbUser.avatarConfig) {
           user.avatarConfig = dbUser.avatarConfig as Record<string, number>
           user.bgShape = dbUser.bgShape ?? 'square'
@@ -451,8 +576,8 @@ export const authConfig: StartAuthJSConfig = {
           user.bgShape = 'square'
           user.bgColor = bgColor
         }
-        user.aiProvider = (dbUser.aiProvider as string) ?? 'openrouter'
-        user.aiModel = (dbUser.aiModel as string) ?? 'openai/gpt-4o-mini'
+        user.aiProvider = (dbUser.aiProvider as string) ?? DEFAULT_AI_PROVIDER
+        user.aiModel = (dbUser.aiModel as string) ?? DEFAULT_AI_MODEL
         user.hasAiKey = dbUser.hasAiKey
         user.timezone = (dbUser.timezone as string | null) ?? null
         user.locale = (dbUser.locale as string | null) ?? null

package/src/lib/auth/sso-authorize.ts

@@ -8,7 +8,15 @@ export interface SsoAuthUser {
   role: string
 }
 
-export async function resolveSsoTokenUser(ssoToken: string): Promise<SsoAuthUser | null> {
+export interface SsoLoginMeta {
+  ip: string | null
+  userAgent: string | null
+}
+
+export async function resolveSsoTokenUser(
+  ssoToken: string,
+  meta?: SsoLoginMeta,
+): Promise<SsoAuthUser | null> {
   const payload = verifySsoToken(ssoToken)
   if (!payload) {
     console.error('[sso] 桥接 token 无效或已过期')
@@ -26,8 +34,9 @@ export async function resolveSsoTokenUser(ssoToken: string): Promise<SsoAuthUser
       await prisma.loginLog.create({
         data: {
           userId: user.id,
-          ip: null,
-          userAgent: null,
+          // 与密码登录审计口径对齐：从请求透传 ip/UA（原恒 null，SSO 异常登录不可追溯）
+          ip: meta?.ip ?? null,
+          userAgent: meta?.userAgent ?? null,
           success,
           ...(message ? { message } : {}),
         },

package/src/lib/auth/submit-credentials.ts

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { resolveLoginCallbackUrl } from '@/lib/login-redirect'
+
+/** 登录/注册/找回/重置四个 auth 页自身的路径（回跳到这些路径时回落默认页） */
+export const AUTH_PATHS = ['/login', '/register', '/forgot-password', '/reset-password'] as const
+
+/**
+ * Credentials 登录公共提交（SSO token / 邮箱密码两分支共用）：
+ * 先取 CSRF token，再以隐藏 form POST 到 Auth.js credentials 回调——
+ * 必须用原生 form 提交让浏览器跟随 302 并落 session cookie
+ * （fetch 无法可靠处理 Set-Cookie，见 AGENTS.md start-authjs 约定）。
+ * 回跳 URL 计算内聚在 resolveLoginCallbackUrl（协议相对/非法 URL 安全回落）。
+ */
+export async function submitCredentialsLogin(
+  fields: ReadonlyArray<{ name: string; value: string }>,
+  redirectTo?: string | null,
+): Promise<void> {
+  const csrfRes = await fetch('/api/auth/csrf')
+  const { csrfToken } = await csrfRes.json()
+  const targetUrl = resolveLoginCallbackUrl({
+    redirectTo,
+    authPaths: AUTH_PATHS,
+    desktopCallbackPath: '/api/auth/desktop-callback',
+    fallbackPath: '/dashboard',
+  })
+  const loginForm = document.createElement('form')
+  loginForm.method = 'POST'
+  loginForm.action = '/api/auth/callback/credentials'
+  loginForm.style.display = 'none'
+  const allFields = [
+    ...fields,
+    { name: 'callbackUrl', value: targetUrl },
+    { name: 'csrfToken', value: csrfToken },
+  ]
+  for (const field of allFields) {
+    const input = document.createElement('input')
+    input.type = 'hidden'
+    input.name = field.name
+    input.value = field.value
+    loginForm.appendChild(input)
+  }
+  document.body.appendChild(loginForm)
+  loginForm.submit()
+}

package/src/lib/changelog/sdk-versions.ts

@@ -1,5 +1,6 @@
 import type { SdkGroup } from './sdk-versions-types'
 
+// GENERATED-BEGIN（由 apps/web/scripts/check-sdk-versions.mjs 生成，勿手改）
 export const SDK_GROUPS: SdkGroup[] = [
   {
     "id": "tanstack",
@@ -95,15 +96,15 @@ export const SDK_GROUPS: SdkGroup[] = [
     "items": [
       {
         "name": "@allbluecn/web-app",
-        "version": "v0.19.2",
-        "lastUpdate": "Oct 26, 2026",
+        "version": "v0.19.4",
+        "lastUpdate": "Oct 28, 2026",
         "source": "apps/web/package.json",
         "docsUrl": "https://github.com/allbluecn/allblue"
       },
       {
         "name": "@allbluecn/kernel",
-        "version": "v0.10.0",
-        "lastUpdate": "Oct 25, 2026",
+        "version": "v0.10.1",
+        "lastUpdate": "Oct 28, 2026",
         "source": "packages/kernel/package.json",
         "docsUrl": "https://github.com/allbluecn/allblue"
       }
@@ -137,8 +138,8 @@ export const SDK_GROUPS: SdkGroup[] = [
       },
       {
         "name": "shadcn UI",
-        "version": "v1.2.4",
-        "lastUpdate": "Sep 11, 2026",
+        "version": "v1.5.0",
+        "lastUpdate": "Oct 26, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://ui.shadcn.com/"
       },
@@ -159,3 +160,4 @@ export const SDK_GROUPS: SdkGroup[] = [
     ]
   }
 ]
+// GENERATED-END

package/src/lib/collab/__tests__/presence-store.test.ts

@@ -387,6 +387,15 @@ describe('resolveModuleLocation', () => {
       expect(mapped?.link).toBe(route.link)
     }
   })
+
+  it('MODULE_ROUTES 按 link 长度降序排列（resolveModuleLocation 最长前缀匹配的前提）', () => {
+    for (let i = 1; i < MODULE_ROUTES.length; i++) {
+      expect(
+        MODULE_ROUTES[i - 1].link.length,
+        `MODULE_ROUTES[${i - 1}].link=${MODULE_ROUTES[i - 1].link} 应不短于后项`,
+      ).toBeGreaterThanOrEqual(MODULE_ROUTES[i].link.length)
+    }
+  })
 })
 
 // ---------------------------------------------------------------------------

package/src/lib/collab/bindings/__tests__/canvas-tree-perf.test.ts

@@ -126,8 +126,12 @@ describe('canvas 数据面性能逻辑基准（防 O(n²) 回归，非帧率）'
         yTreeToScene(doc)
       })
     }
-    const writeRatio = writeAt(1000) / Math.max(writeAt(250), 0.001)
-    const readRatio = readAt(1000) / Math.max(readAt(250), 0.001)
+    // 计时比在 CI 满载下抖动（实测出现过 13.1），取 3 轮最小值消除调度噪声；
+    // O(n²) 的 16x 起红线不受影响（最小值仍必红）
+    const best = (measure: () => number): number =>
+      Math.min(...Array.from({ length: 3 }, measure))
+    const writeRatio = best(() => writeAt(1000)) / Math.max(best(() => writeAt(250)), 0.001)
+    const readRatio = best(() => readAt(1000)) / Math.max(best(() => readAt(250)), 0.001)
     expect(writeRatio).toBeLessThan(12)
     expect(readRatio).toBeLessThan(12)
   })