@allbluecn/web-app 0.19.2 → 0.19.4

package/src/lib/login-redirect.ts

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 登录回跳目标白名单（审计 2026-10-25：仅拦 `http` 开头的绝对 URL，`//evil.com`、
+// `/\evil.com` 等协议相对形式原样透传为 callbackUrl——纵深防御缺失）。
+
+/** 登录后的站内回跳：仅接受站内相对路径；协议相对与反斜杠形态一律回落默认页 */
+export function isSafeRelativeRedirect(url: string | null | undefined): boolean {
+  if (!url) return false
+  return url.startsWith('/') && !url.startsWith('//') && !url.startsWith('/\\')
+}
+
+/**
+ * SSO / 密码登录共用的 callbackUrl 解析：
+ * - desktop 回跳标记 → 桌面回调端点（透传 desktop_state，deep link 一次性比对消费）；
+ * - 登录页自身路径 → 默认页（避免登录后回到登录页）；
+ * - 站内相对路径 → 原样；
+ * - 绝对 URL → 取其 pathname+search（同站落地）；
+ * - 其余（协议相对 / 非法）→ 默认页。
+ */
+export function resolveLoginCallbackUrl(options: {
+  redirectTo?: string | null
+  authPaths: readonly string[]
+  desktopCallbackPath: string
+  fallbackPath: string
+}): string {
+  const { redirectTo, authPaths, desktopCallbackPath, fallbackPath } = options
+  if (redirectTo?.includes('desktop_redirect=true')) {
+    // desktop 端 open_login_url 在登录 URL 上拼的一次性 state 须随回跳链透传，
+    // 否则服务端深链无法回传、桌面端只能降级放行（缺失强制校验）
+    let state: string | null = null
+    try {
+      state = new URL(redirectTo, 'https://internal').searchParams.get('desktop_state')
+    } catch {
+      state = null
+    }
+    return state ? `${desktopCallbackPath}?desktop_state=${encodeURIComponent(state)}` : desktopCallbackPath
+  }
+  if (!redirectTo) return fallbackPath
+  if (authPaths.some((p) => redirectTo === p || redirectTo.startsWith(p + '?'))) return fallbackPath
+  if (isSafeRelativeRedirect(redirectTo)) return redirectTo
+  if (/^https?:\/\//i.test(redirectTo)) {
+    try {
+      const u = new URL(redirectTo)
+      return u.pathname + u.search
+    } catch {
+      return fallbackPath
+    }
+  }
+  return fallbackPath
+}

package/src/lib/optimistic/use-optimistic-mutation.ts

@@ -17,6 +17,7 @@
 
 import { useCallback, useRef, useState } from "react";
 import { toastError } from "@/lib/toast-error";
+import { m } from "@/paraglide/messages.js";
 
 export interface OptimisticMutationOptions<TVariables, TData, TSnapshot = void> {
   mutationFn: (variables: TVariables) => Promise<TData>;
@@ -37,6 +38,8 @@ export function useOptimisticMutation<TVariables, TData, TSnapshot = void>({
 }: OptimisticMutationOptions<TVariables, TData, TSnapshot>) {
   const [isLoading, setIsLoading] = useState(false);
   const pendingRef = useRef(0);
+  // 最近一次「成功落定」的 mutate id：stale 失败回滚以它判定快照是否仍有效
+  const lastSettledIdRef = useRef(0);
 
   const mutate = useCallback(
     async (variables: TVariables) => {
@@ -46,14 +49,22 @@ export function useOptimisticMutation<TVariables, TData, TSnapshot = void>({
       try {
         const result = await mutationFn(variables);
         if (pendingRef.current !== id) return;
+        lastSettledIdRef.current = id;
         onSuccess?.(result, variables);
       } catch (err) {
-        if (pendingRef.current !== id) return;
+        if (pendingRef.current !== id) {
+          // stale 失败：仅当之后没有更新的变更成功落定（快照未失效）才回滚，
+          // 防本变更的乐观态永久残留；已有更新结果覆盖时以最新结果为准
+          if (lastSettledIdRef.current < id) rollback(variables, snapshot);
+          return;
+        }
+        lastSettledIdRef.current = id;
         rollback(variables, snapshot);
         onError?.(err as Error, variables);
-        toastError(err, "操作失败");
+        toastError(err, m.common_form_operationFailed());
       } finally {
-        setIsLoading(false);
+        // 无守卫时 stale 请求的 finally 会提前清掉最新请求的 loading
+        if (pendingRef.current === id) setIsLoading(false);
       }
     },
     [mutationFn, optimisticUpdate, rollback, onSuccess, onError],

package/src/lib/outline-utils.ts

@@ -18,6 +18,13 @@
 import { CanvasElement } from "../types/prototype";
 import { OutlineNode } from "../types/outline";
 
+/**
+ * 启发式大纲（审计 ⚪ 记录，刻意为之）：
+ * - 容器判定是尺寸启发式（≥160×100 或显式 isContainer），非语义解析；
+ * - 嵌套容器不递归（内层容器仍平铺在根级）；
+ * - 两容器重叠时 atom 归先遍历者（归属随 elements 数组顺序漂移）。
+ * 适用于原型画板的粗粒度大纲导航，非精确 DOM 层级视图。
+ */
 export function buildOutline(elements: CanvasElement[]): OutlineNode[] {
   const containers = elements.filter(e => isContainer(e));
   const atoms = elements.filter(e => !isContainer(e));

package/src/lib/plugin-runtime/bridge.ts

@@ -15,18 +15,66 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-// 主线程 bridge：处理 Worker 发来的 fetch 代理请求
-// 调用服务端 serverFn 进行白名单校验 + fetch
+// 主线程 bridge：处理 Worker 发来的 fetch 代理请求。
+//
+// ⚠ 安全边界（审计修复）：Worker 沙箱是功能性隔离而非安全边界（globalThis
+// 可绕过，见 worker-realm-source.ts 头注释），本代理是插件代码唯一的网络出口，
+// 必须在这里收口：
+//  ① URL 白名单（协议 + 域名）——拒绝任意 URL 的 SSRF/内网探测；
+//  ② 同源请求剥离 cookie（credentials: "omit"）——插件不得借用用户会话；
+//  ③ redirect: "error"——防 302 重定向绕过白名单校验；
+//  ④ 15s 超时——慢/挂起目标不长期占用 promise；
+//  ⑤ 响应必须回传 reqId——worker 侧按 reqId 匹配，缺失则插件 fetch 永挂起。
+
+/** 允许插件 fetch 的远程域名白名单（精确匹配或以 . 开头的后缀匹配） */
+const PLUGIN_FETCH_ALLOWED_HOSTS: readonly string[] = [
+  "api.github.com",
+  "raw.githubusercontent.com",
+  "registry.npmjs.org",
+]
+
+const PLUGIN_FETCH_TIMEOUT_MS = 15_000
+
+function isAllowedPluginFetchUrl(rawUrl: string): boolean {
+  let parsed: URL
+  try {
+    parsed = new URL(rawUrl)
+  } catch {
+    return false
+  }
+  if (parsed.protocol !== "https:") return false
+  const host = parsed.hostname.toLowerCase()
+  return PLUGIN_FETCH_ALLOWED_HOSTS.some((allowed) =>
+    allowed.startsWith(".")
+      ? host.endsWith(allowed) || host === allowed.slice(1)
+      : host === allowed,
+  )
+}
 
 export async function handleFetchProxy(
   worker: Worker,
-  data: { url: string; method: string; headers: Record<string, string>; body?: string }
+  data: { reqId?: unknown; url: string; method: string; headers: Record<string, string>; body?: string }
 ): Promise<void> {
+  const fail = (message: string) => {
+    // reqId 必须回传：worker 侧 `e.data.reqId === reqId` 匹配，缺失即永挂起
+    worker.postMessage({ type: "fetch-response", reqId: data.reqId, error: message })
+  }
+
+  if (!isAllowedPluginFetchUrl(data.url)) {
+    fail(`[plugin-fetch] URL 不在白名单内（仅 https + 显式允许域）: ${data.url}`)
+    return
+  }
+
   try {
     const response = await fetch(data.url, {
       method: data.method,
       headers: data.headers,
       body: data.body,
+      // 同源请求默认 same-origin 会携带用户 session cookie——插件不得借用用户身份
+      credentials: "omit",
+      // 302 重定向可把请求带到白名单外的主机，禁止跟随
+      redirect: "error",
+      signal: AbortSignal.timeout(PLUGIN_FETCH_TIMEOUT_MS),
     });
 
     const responseHeaders: Record<string, string> = {};
@@ -38,14 +86,12 @@ export async function handleFetchProxy(
 
     worker.postMessage({
       type: "fetch-response",
+      reqId: data.reqId,
       status: response.status,
       headers: responseHeaders,
       body: responseBody,
     });
   } catch (error) {
-    worker.postMessage({
-      type: "fetch-response",
-      error: error instanceof Error ? error.message : String(error),
-    });
+    fail(error instanceof Error ? error.message : String(error));
   }
 }

package/src/lib/plugin-runtime/plugin-client-tools.ts

@@ -37,17 +37,26 @@ import {
   buildPluginDynamicToolDef,
 } from "@/lib/plugin-runtime/plugin-tool-defs";
 
-const pluginRunClientTool = pluginRunDef.client((args) =>
-  executePluginClientTool("plugin_run", args)
-);
+// executePluginClientTool 返回 unknown（分派器统一签名）；各工具的产出形状
+// 由对应 outputSchema 固定，此处按 schema 形状收窄
+const pluginRunClientTool = pluginRunDef.client(async (args) => {
+  const result = await executePluginClientTool("plugin_run", args)
+  return result as {
+    started: boolean
+    tools: { name: string; description: string; inputSchema: unknown }[]
+    error?: string
+  }
+});
 
-const pluginStopClientTool = pluginStopDef.client((args) =>
-  executePluginClientTool("plugin_stop", args)
-);
+const pluginStopClientTool = pluginStopDef.client(async (args) => {
+  const result = await executePluginClientTool("plugin_stop", args)
+  return result as { stopped: boolean }
+});
 
-const pluginUndefineClientTool = pluginUndefineDef.client((args) =>
-  executePluginClientTool("plugin_undefine", args)
-);
+const pluginUndefineClientTool = pluginUndefineDef.client(async (args) => {
+  const result = await executePluginClientTool("plugin_undefine", args)
+  return result as { deleted: boolean }
+});
 
 export function buildPluginClientTools(): AnyClientTool[] {
   const tools: AnyClientTool[] = [
@@ -71,19 +80,33 @@ export function buildPluginClientTools(): AnyClientTool[] {
 
 export async function executePluginClientTool(
   toolName: string,
-  args: any
-): Promise<any> {
+  args: unknown
+): Promise<unknown> {
   if (toolName === "plugin_run") {
-    return { started: true, tools: [] };
+    // 预留占位：真实装载需客户端取回插件源码（codeHost 存 DB，server 端
+    // plugin_run 仅置 running 状态不下发代码）。原实现假成功（started:true
+    // 无 tools）会误导 AI 以为已生效——改为显式失败语义（schema 允许
+    // started:false + error），待「取码 serverFn + loadPlugin 接线」补齐。
+    return {
+      started: false,
+      tools: [],
+      error: "not implemented: 浏览器端插件装载链路未接线（预留接口）",
+    };
   }
 
   if (toolName === "plugin_stop") {
-    stopPlugin(args.name);
+    const name = (args as { name?: unknown })?.name;
+    if (typeof name !== "string" || !name) {
+      throw new Error("plugin_stop requires args.name: string");
+    }
+    stopPlugin(name);
     return { stopped: true };
   }
 
   if (toolName === "plugin_undefine") {
-    return { deleted: true };
+    // 预留占位：软删除由 server 端 plugin_undefine 真实现；客户端半无 DB
+    // 通道，原 `{ deleted: true }` 是假成功，改显式 false
+    return { deleted: false };
   }
 
   const match = toolName.match(/^plugin__([^_]+(?:_[^_]+)*)__(.+)$/);

package/src/lib/plugin-runtime/plugin-client.ts

@@ -10,12 +10,15 @@
 // This program is distributed in the hope that it will be useful,
 // but WITHOUT ANY WARRANTY; without even the implied warranty of
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affordable General Public License for more details.
+// GNU Affero General Public License for more details.
 //
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // 主线程插件运行时管理器（module-level singleton）
+//
+// ⚠ 本模块只做「运行期管理」，不做安全边界：Worker 沙箱为功能性隔离（见
+// worker-realm-source.ts 头注释），网络出口统一收口在 bridge.ts 白名单代理。
 
 import { handleFetchProxy } from "./bridge";
 import { WORKER_REALM_SOURCE } from "./worker-realm-source";
@@ -23,7 +26,8 @@ import { WORKER_REALM_SOURCE } from "./worker-realm-source";
 export interface PluginToolDef {
   name: string;
   description: string;
-  inputSchema: any;
+  // 工具 schema 为 JSON Schema 形态（插件侧产出），结构开放：record 约束 + unknown 值
+  inputSchema: Record<string, unknown>;
 }
 
 interface PluginWorkerEntry {
@@ -40,9 +44,28 @@ export interface PluginEvalResult {
 }
 
 const workerPool = new Map<string, PluginWorkerEntry>();
-const logListeners: Array<(pluginId: string, message: string) => void> = [];
 
-function createWorker(pluginId: string, code: string): PluginWorkerEntry {
+/** 销毁 entry（terminate + revoke），供超时/报错/重载/停止各路径复用 */
+function disposeEntry(entry: PluginWorkerEntry): void {
+  entry.worker.terminate();
+  URL.revokeObjectURL(entry.objectURL);
+}
+
+/** 同 id 重复 loadPlugin 时旧 entry 成为孤儿（永不可再被 stopPlugin 触达），
+ *  装载前必须先销毁（防 Worker/Blob 泄漏 + 旧插件代码继续存活响应） */
+function disposeExisting(pluginId: string): void {
+  const existing = workerPool.get(pluginId);
+  if (existing) {
+    disposeEntry(existing);
+    workerPool.delete(pluginId);
+  }
+}
+
+/** invokeTool 请求序号：Date.now() 同毫秒两次调用 reqId 相同，tool-result
+ *  会同时命中两个 handler（错误分发） */
+let invokeSeq = 0;
+
+function createWorker(pluginId: string): PluginWorkerEntry {
   const blob = new Blob([WORKER_REALM_SOURCE], { type: "text/javascript" });
   const objectURL = URL.createObjectURL(blob);
   const worker = new Worker(objectURL, { type: "module" });
@@ -59,12 +82,12 @@ export async function loadPlugin(plugin: {
     return { ok: false, tools: [], error: "Plugin has no code" };
   }
 
-  const entry = createWorker(plugin.id, code);
+  disposeExisting(plugin.id);
+  const entry = createWorker(plugin.id);
 
   return new Promise<PluginEvalResult>((resolve) => {
     const timeout = setTimeout(() => {
-      entry.worker.terminate();
-      URL.revokeObjectURL(entry.objectURL);
+      disposeEntry(entry);
       resolve({ ok: false, tools: [], error: "Plugin evaluation timeout" });
     }, 30_000);
 
@@ -78,8 +101,7 @@ export async function loadPlugin(plugin: {
         resolve({ ok: true, tools: entry.tools });
       } else if (type === "eval-error") {
         clearTimeout(timeout);
-        entry.worker.terminate();
-        URL.revokeObjectURL(entry.objectURL);
+        disposeEntry(entry);
         resolve({ ok: false, tools: [], error: e.data.error });
       } else if (type === "fetch-proxy") {
         void handleFetchProxy(entry.worker, e.data);
@@ -88,25 +110,26 @@ export async function loadPlugin(plugin: {
 
     entry.worker.onerror = (e) => {
       clearTimeout(timeout);
-      entry.worker.terminate();
-      URL.revokeObjectURL(entry.objectURL);
+      disposeEntry(entry);
       resolve({ ok: false, tools: [], error: e.message });
     };
 
+    // 插件代码经 postMessage 下发（createWorker 不参与代码装载）
     entry.worker.postMessage({ type: "plugin-eval", src: code });
   });
 }
 
 export function stopPlugin(pluginId: string): void {
   const entry = workerPool.get(pluginId);
-  if (entry) {
-    entry.worker.postMessage({ type: "stop" });
-    setTimeout(() => {
-      entry.worker.terminate();
-      URL.revokeObjectURL(entry.objectURL);
-      workerPool.delete(pluginId);
-    }, 1000);
-  }
+  if (!entry) return;
+  // 先同步摘除映射：快速 stop→loadPlugin 重启时，新 entry 不会被本函数的
+  // 延迟销毁误删（原 1s 后无条件 workerPool.delete(pluginId) 会删掉新 entry）
+  workerPool.delete(pluginId);
+  entry.worker.postMessage({ type: "stop" });
+  // 延迟 terminate：给 stop 清理（disposers 等）留一拍执行窗口
+  setTimeout(() => {
+    disposeEntry(entry);
+  }, 1000);
 }
 
 export async function invokeTool(
@@ -119,9 +142,11 @@ export async function invokeTool(
     throw new Error(`Plugin not loaded: ${pluginId}`);
   }
 
-  const reqId = Date.now();
+  const reqId = ++invokeSeq;
   return new Promise((resolve, reject) => {
     const timeout = setTimeout(() => {
+      // 超时必须摘除 handler：worker 永不回复时每次超时都会泄漏一个监听器
+      entry.worker.removeEventListener("message", handler);
       reject(new Error("Plugin tool invocation timeout"));
     }, 30_000);
 
@@ -142,14 +167,6 @@ export async function invokeTool(
   });
 }
 
-export function onLog(cb: (pluginId: string, message: string) => void): () => void {
-  logListeners.push(cb);
-  return () => {
-    const idx = logListeners.indexOf(cb);
-    if (idx >= 0) logListeners.splice(idx, 1);
-  };
-}
-
 export function getLoadedPlugins(): Array<{
   pluginId: string;
   tools: PluginToolDef[];

package/src/lib/plugin-runtime/worker-realm-source.ts

@@ -16,7 +16,19 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 // Worker 引导脚本源码（作为字符串嵌入 Blob URL 注入 Worker）
-// 此文件导出字符串常量，plugin-client.ts 消费
+// 此文件导出字符串常量，plugin-client.ts 消费（唯一源——旧 TS 版 worker-realm.ts
+// 已删除，双源漂移见审计 🔵 条目）。
+//
+// ⚠ 隔离定位（审计修复）：Worker 沙箱是「功能性隔离」而非安全边界——裸标识符
+// 仍可达 Worker 全局（XMLHttpRequest/location/navigator 等），无法在此形态下做
+// 完整白名单注入。已做的硬化：
+//  ① 参数遮蔽 self/fetch/globalThis：插件内 `globalThis.fetch`/`globalThis
+//     .postMessage` 拿到的是受限代理（fetch 指向走主线程白名单代理的
+//     pluginFetch；postMessage/onmessage 不可达，防劫持消息通道）；
+//  ② 网络唯一出口 = 主线程 bridge.ts 的白名单代理（禁 cookie / 禁重定向 /
+//     域名白名单 / 超时）；
+//  ③ 真·安全边界需跨源专用 Worker + CSP，属独立架构任务。
+// 旧 createTrap/trappedMethods 死代码已删（从未被注入调用，拦截意图从未生效）。
 
 export const WORKER_REALM_SOURCE = `
 "use strict";
@@ -74,19 +86,24 @@ const taggedConsole = {
   debug: (...args) => console.debug("[plugin]", ...args),
 };
 
-const trappedMethods = ["require", "process", "setImmediate", "clearImmediate"];
+// fetch 代理请求序号（自增）：Date.now() 同毫秒并发请求会撞 reqId，
+// 后到的响应会错误分发给先前的调用方
+let fetchSeq = 0;
 
 const pluginFetch = async (input, init) => {
+  const url = typeof input === "string" ? input : String(input);
+  if (init?.body !== undefined && init?.body !== null && typeof init.body !== "string") {
+    throw new TypeError("[plugin-fetch] body 仅支持 string（Blob/ArrayBuffer/FormData 无法跨 postMessage 保真传输）");
+  }
+  const reqId = ++fetchSeq;
   return new Promise((resolve, reject) => {
-    const url = typeof input === "string" ? input : input.toString();
-    const reqId = Date.now();
     self.postMessage({
       type: "fetch-proxy",
       reqId,
       url,
       method: init?.method ?? "GET",
       headers: init?.headers ?? {},
-      body: init?.body ? String(init.body) : undefined,
+      body: init?.body ?? undefined,
     });
     const handler = (e) => {
       if (e.data?.type === "fetch-response" && e.data.reqId === reqId) {
@@ -99,25 +116,40 @@ const pluginFetch = async (input, init) => {
   });
 };
 
-const createTrap = () => new Proxy({}, {
-  get(_t, prop) {
-    if (trappedMethods.includes(prop)) throw new Error("[plugin-trap] " + prop + " not allowed");
+// globalThis 遮蔽（参数名遮蔽全局）：插件内拿到的 globalThis 只暴露受限面，
+// fetch 走代理、postMessage 等通道不可达
+const sandboxGlobal = new Proxy({}, {
+  get(_target, prop) {
+    if (prop === "fetch") return pluginFetch;
+    if (prop === "btoa") return btoa;
+    if (prop === "atob") return atob;
     return undefined;
   },
+  set() { return false; },
 });
 
-self.onmessage = (e) => {
+// 异步工具执行墙钟（防插件 handler 永挂起占用消息循环）
+const TOOL_INVOKE_TIMEOUT_MS = 30_000;
+const withTimeout = (promise, label) => Promise.race([
+  promise,
+  new Promise((_, reject) => setTimeout(
+    () => reject(new Error(label + " timeout (" + TOOL_INVOKE_TIMEOUT_MS + "ms)")),
+    TOOL_INVOKE_TIMEOUT_MS,
+  )),
+]);
+
+self.onmessage = async (e) => {
   const { type, src, ...rest } = e.data;
 
   if (type === "plugin-eval") {
     try {
       const fn = new Function(
         "ctx", "harness", "console", "btoa", "atob",
-        "TextEncoder", "TextDecoder", "fetch", "self", src
+        "TextEncoder", "TextDecoder", "fetch", "self", "globalThis", src
       );
       const result = fn(
         ctx, harness, taggedConsole, btoa, atob,
-        TextEncoder, TextDecoder, pluginFetch, undefined
+        TextEncoder, TextDecoder, pluginFetch, undefined, sandboxGlobal
       );
 
       if (typeof result === "function") result(ctx);
@@ -142,19 +174,23 @@ self.onmessage = (e) => {
   if (type === "tool-invoke") {
     const { toolName, args, reqId } = rest;
     try {
+      // await Promise.resolve：异步工具 handler 返回 Promise 时先 settle 再
+      // postMessage（Promise 本体不可 structured clone，直接发必 DataCloneError，
+      // 异步工具曾因此全部报错）；结果本身不可克隆时同样落 error 分支
       const handler = rpcHandlers[toolName];
+      let result;
       if (handler) {
-        const result = handler(args);
-        self.postMessage({ type: "tool-result", reqId, result });
+        result = await withTimeout(Promise.resolve(handler(args)), "tool handler");
       } else {
         const tool = registeredTools.find((t) => t.name === toolName);
         if (tool?.execute) {
-          const result = tool.execute(args);
-          self.postMessage({ type: "tool-result", reqId, result });
+          result = await withTimeout(Promise.resolve(tool.execute(args)), "tool execute");
         } else {
           self.postMessage({ type: "tool-result", reqId, error: "No handler for: " + toolName });
+          return;
         }
       }
+      self.postMessage({ type: "tool-result", reqId, result });
     } catch (error) {
       self.postMessage({ type: "tool-result", reqId, error: error instanceof Error ? error.message : String(error) });
     }

package/src/lib/project-display-id.ts

@@ -17,6 +17,7 @@
 
 import { pinyin } from "pinyin-pro";
 import { BUILTIN_INDEPENDENT_DISPLAY_ID } from "./builtin-project";
+import { m } from "@/paraglide/messages.js";
 
 /**
  * 从项目名提取 displayId：字母数字原样保留，汉字转拼音首字母，
@@ -41,8 +42,11 @@ export function extractDisplayId(name: string): string {
  * @returns null 表示有效，否则返回错误信息。
  */
 export function validateDisplayId(id: string): string | null {
-  if (!id) return '项目ID不能为空'
-  if (!/^[A-Z0-9]{1,10}$/.test(id)) return '仅全大写字母数字，最多10位'
-  if (id === BUILTIN_INDEPENDENT_DISPLAY_ID) return `${BUILTIN_INDEPENDENT_DISPLAY_ID} 为系统保留 ID，不可使用`
+  // 错误信息直接展示给用户，经 paraglide 按 locale 解析（原硬编码中文）
+  if (!id) return m.common_project_displayId_required()
+  if (!/^[A-Z0-9]{1,10}$/.test(id)) return m.common_project_displayId_format()
+  if (id === BUILTIN_INDEPENDENT_DISPLAY_ID) {
+    return m.common_project_displayId_reserved({ id: BUILTIN_INDEPENDENT_DISPLAY_ID })
+  }
   return null
 }

package/src/lib/project-module-meta.ts

@@ -22,44 +22,67 @@ import {
   FlaskConical,
   Bug,
 } from "lucide-react";
+import { m } from "@/paraglide/messages.js";
 import type {
   ProjectModuleKey,
   ProjectModuleOverview,
 } from "@/types/project";
 
-// 5 个板块元数据（key 与路由 $module 对应）
+// 5 个板块元数据（key 与路由 $module 对应）。
+// title/description 用户可见：getter 形态每次读取时经 paraglide 解析
+//（模块级常量求值一次会把 locale 固化在 import 时刻，SSR 并发请求还会串 locale）
 export const PROJECT_MODULE_META: Record<
   ProjectModuleKey,
   Omit<ProjectModuleOverview, "count" | "lastUpdatedAt" | "link">
 > = {
   requirement: {
     key: "requirement",
-    title: "需求",
-    description: "收集与跟踪产品需求池",
+    get title() {
+      return m.common_project_module_requirement_title();
+    },
+    get description() {
+      return m.common_project_module_requirement_desc();
+    },
     icon: ClipboardList,
   },
   prd: {
     key: "prd",
-    title: "PRD",
-    description: "产品需求文档与原型画板",
+    get title() {
+      return m.common_project_module_prd_title();
+    },
+    get description() {
+      return m.common_project_module_prd_desc();
+    },
     icon: Package2,
   },
   design: {
     key: "design",
-    title: "设计",
-    description: "UI 设计稿与画板资源",
+    get title() {
+      return m.common_project_module_design_title();
+    },
+    get description() {
+      return m.common_project_module_design_desc();
+    },
     icon: Palette,
   },
   testcase: {
     key: "testcase",
-    title: "测例",
-    description: "测试用例与执行计划",
+    get title() {
+      return m.common_project_module_testcase_title();
+    },
+    get description() {
+      return m.common_project_module_testcase_desc();
+    },
     icon: FlaskConical,
   },
   bug: {
     key: "bug",
-    title: "BUG",
-    description: "缺陷跟踪与修复进度",
+    get title() {
+      return m.common_project_module_bug_title();
+    },
+    get description() {
+      return m.common_project_module_bug_desc();
+    },
     icon: Bug,
   },
 };