@allbluecn/web-app 0.19.2 → 0.19.4

package/src/routes/_login/login/route.lazy.tsx

@@ -24,7 +24,7 @@ import { Checkbox } from '@/components/ui/checkbox'
 import { Field, FieldLabel } from '@/components/ui/field'
 import { Separator } from '@/components/ui/separator'
 import { AppField } from '@/components/forms'
-import { ArrowRight, Mail, Users, BarChart3, MessageSquare, TrendingUp } from 'lucide-react'
+import { ArrowRight, Mail } from 'lucide-react'
 import { AuthLayout, AuthLayoutLeft, AuthLayoutRight } from '@/components/auth/auth-layout'
 import { AuthHeader } from '@/components/auth/auth-header'
 import { AuthBrandPanel } from '@/components/auth/auth-brand-panel'
@@ -33,8 +33,10 @@ import { PasswordInput } from '@/components/auth/password-input'
 import { OAuthSection } from '@/components/auth/oauth-section'
 import { SsoSection } from '@/components/auth/sso-section'
 import { googleProvider } from '@/components/auth/auth-providers'
+import { buildAuthFeatures } from '@/components/auth/auth-features'
 import { loginSchema } from '@/routes/_login/schemas/-auth'
 import { m } from "@/paraglide/messages.js";
+import { submitCredentialsLogin } from '@/lib/auth/submit-credentials'
 
 export const Route = createLazyFileRoute('/_login/login')({
   component: LoginPage,
@@ -61,40 +63,7 @@ function LoginPage() {
     if (!ssoToken) return
     const submitSsoLogin = async () => {
       try {
-        const csrfRes = await fetch('/api/auth/csrf')
-        const { csrfToken } = await csrfRes.json()
-        const AUTH_PATHS = ['/login', '/register', '/forgot-password', '/reset-password']
-        let targetUrl: string
-        if (redirectTo?.includes('desktop_redirect=true')) {
-          targetUrl = '/api/auth/desktop-callback'
-        } else {
-          const isAuthPath = redirectTo && AUTH_PATHS.some(
-            (p) => redirectTo === p || redirectTo.startsWith(p + '?'),
-          )
-          targetUrl = redirectTo && !isAuthPath
-            ? (redirectTo.startsWith('http')
-              ? new URL(redirectTo).pathname + new URL(redirectTo).search
-              : redirectTo)
-            : '/dashboard'
-        }
-        const loginForm = document.createElement('form')
-        loginForm.method = 'POST'
-        loginForm.action = '/api/auth/callback/credentials'
-        loginForm.style.display = 'none'
-        const fields = [
-          { name: 'ssoToken', value: ssoToken },
-          { name: 'callbackUrl', value: targetUrl },
-          { name: 'csrfToken', value: csrfToken },
-        ]
-        for (const field of fields) {
-          const input = document.createElement('input')
-          input.type = 'hidden'
-          input.name = field.name
-          input.value = field.value
-          loginForm.appendChild(input)
-        }
-        document.body.appendChild(loginForm)
-        loginForm.submit()
+        await submitCredentialsLogin([{ name: 'ssoToken', value: ssoToken }], redirectTo)
       } catch {
         toast.error(m.auth_login_ssoFailed())
       }
@@ -104,49 +73,24 @@ function LoginPage() {
 
   const form = useForm({
     defaultValues: { email: '', password: '', remember: false },
-    validators: [{ run: loginSchema as any, triggers: ['change'] }],
+    validators: [{ run: loginSchema, triggers: ['change'] }],
     onSubmit: async ({ value }) => {
-      const csrfRes = await fetch('/api/auth/csrf')
-      const { csrfToken } = await csrfRes.json()
-      const AUTH_PATHS = ['/login', '/register', '/forgot-password', '/reset-password']
-      let targetUrl: string
-      if (redirectTo?.includes('desktop_redirect=true')) {
-        targetUrl = '/api/auth/desktop-callback'
-      } else {
-        const isAuthPath = redirectTo && AUTH_PATHS.some((p) => redirectTo === p || redirectTo.startsWith(p + '?'))
-        targetUrl = redirectTo && !isAuthPath
-          ? (redirectTo.startsWith('http') ? new URL(redirectTo).pathname + new URL(redirectTo).search : redirectTo)
-          : '/dashboard'
-      }
-      const loginForm = document.createElement('form')
-      loginForm.method = 'POST'
-      loginForm.action = '/api/auth/callback/credentials'
-      loginForm.style.display = 'none'
-      const fields = [
-        { name: 'email', value: value.email },
-        { name: 'password', value: value.password },
-        { name: 'remember', value: String(value.remember) },
-        { name: 'callbackUrl', value: targetUrl },
-        { name: 'csrfToken', value: csrfToken },
-      ]
-      for (const field of fields) {
-        const input = document.createElement('input')
-        input.type = 'hidden'
-        input.name = field.name
-        input.value = field.value
-        loginForm.appendChild(input)
+      try {
+        await submitCredentialsLogin(
+          [
+            { name: 'email', value: value.email },
+            { name: 'password', value: value.password },
+            { name: 'remember', value: String(value.remember) },
+          ],
+          redirectTo,
+        )
+      } catch {
+        toast.error(m.auth_login_serverError())
       }
-      document.body.appendChild(loginForm)
-      loginForm.submit()
     },
   })
 
-  const loginFeatures = [
-    { icon: Users, label: m.auth_features_userResearch(), desc: m.auth_features_userResearchDesc() },
-    { icon: BarChart3, label: m.auth_features_dataAnalysis(), desc: m.auth_features_dataAnalysisDesc() },
-    { icon: MessageSquare, label: m.auth_features_teamCollaboration(), desc: m.auth_features_teamCollaborationDesc() },
-    { icon: TrendingUp, label: m.auth_features_roadmap(), desc: m.auth_features_roadmapDesc() },
-  ]
+  const loginFeatures = buildAuthFeatures()
 
   return (
     <AuthLayout>

package/src/routes/_login/login/route.tsx

@@ -20,8 +20,6 @@ import { z } from 'zod'
 import { getAuthProviders } from '@/server/serverFns/auth/providers'
 import { checkAdminExistsFn } from '@/server/serverFns/auth/setup'
 
-const ADMIN_URL = process.env.ADMIN_URL || 'http://localhost:3001'
-
 export const Route = createFileRoute('/_login/login')({
   validateSearch: z.object({
     redirect: z.string().optional(),
@@ -30,9 +28,12 @@ export const Route = createFileRoute('/_login/login')({
     ssoError: z.string().optional(),
   }),
   beforeLoad: async () => {
+    // env 读取必须在 beforeLoad 内（服务端执行）：路由模块会被客户端加载，
+    // 顶层读 process.env 在浏览器 chunk 求值时直接 ReferenceError
+    const adminUrl = process.env.ADMIN_URL || 'http://localhost:3001'
     const result = await checkAdminExistsFn().catch(() => null)
     if (result?.hasAdmin === false) {
-      throw redirect({ href: `${ADMIN_URL}/setup` })
+      throw redirect({ href: `${adminUrl}/setup` })
     }
   },
   loader: () => getAuthProviders(),

package/src/routes/_login/register/route.lazy.tsx

@@ -21,7 +21,7 @@ import { toast } from '@/components/ui/toast'
 import { RainbowButton } from '@/components/magicui/rainbow-button'
 import { Separator } from '@/components/ui/separator'
 import { AppField } from '@/components/forms'
-import { ArrowRight, Mail, User, QrCode, Users, BarChart3, MessageSquare, TrendingUp } from 'lucide-react'
+import { ArrowRight, Mail, User, QrCode } from 'lucide-react'
 import { AuthLayout, AuthLayoutLeft, AuthLayoutRight } from '@/components/auth/auth-layout'
 import { AuthHeader } from '@/components/auth/auth-header'
 import { AuthBrandPanel } from '@/components/auth/auth-brand-panel'
@@ -29,8 +29,9 @@ import { IconInput } from '@/components/auth/icon-input'
 import { PasswordInput } from '@/components/auth/password-input'
 import { OAuthSection } from '@/components/auth/oauth-section'
 import { googleProvider } from '@/components/auth/auth-providers'
+import { buildAuthFeatures } from '@/components/auth/auth-features'
 import { registerFn } from '@/server/serverFns/auth/register'
-import { registerSchema } from '@/routes/_login/schemas/-auth'
+import { registerFormSchema } from '@/routes/_login/schemas/-auth'
 import { m } from "@/paraglide/messages.js";
 import { toastError } from "@/lib/toast-error";
 
@@ -42,12 +43,7 @@ function RegisterPage() {
   const router = useRouter()
   const { googleEnabled, registrationMode } = Route.useLoaderData()
   const { invite, email: emailFromUrl } = Route.useSearch()
-  const registerFeatures = [
-    { icon: Users, label: m.auth_features_userResearch(), desc: m.auth_features_userResearchDesc() },
-    { icon: BarChart3, label: m.auth_features_dataAnalysis(), desc: m.auth_features_dataAnalysisDesc() },
-    { icon: MessageSquare, label: m.auth_features_teamCollaboration(), desc: m.auth_features_teamCollaborationDesc() },
-    { icon: TrendingUp, label: m.auth_features_roadmap(), desc: m.auth_features_roadmapDesc() },
-  ]
+  const registerFeatures = buildAuthFeatures()
 
   const form = useForm({
     defaultValues: {
@@ -57,7 +53,7 @@ function RegisterPage() {
       confirmPassword: '',
       invitationCode: invite ?? '',
     },
-    validators: [{ run: registerSchema as any, triggers: ['change'] }],
+    validators: [{ run: registerFormSchema, triggers: ['change'] }],
     onSubmit: async ({ value }) => {
       if (registrationMode === 'invite' && !value.invitationCode?.trim()) {
         toast.error(m.common_form_invitationCodeRequired())

package/src/routes/_login/reset-password/route.lazy.tsx

@@ -20,11 +20,12 @@ import { useForm } from '@tanstack/react-form'
 import { toast } from '@/components/ui/toast'
 import { RainbowButton } from '@/components/magicui/rainbow-button'
 import { AppField } from '@/components/forms'
-import { ArrowRight, Users, BarChart3, MessageSquare, TrendingUp } from 'lucide-react'
+import { ArrowRight } from 'lucide-react'
 import { AuthLayout, AuthLayoutLeft, AuthLayoutRight } from '@/components/auth/auth-layout'
 import { AuthHeader } from '@/components/auth/auth-header'
 import { AuthBrandPanel } from '@/components/auth/auth-brand-panel'
 import { PasswordInput } from '@/components/auth/password-input'
+import { buildAuthFeatures } from '@/components/auth/auth-features'
 import { resetPasswordFn } from '@/server/serverFns/auth/reset-password'
 import { resetPasswordSchema } from '@/routes/_login/schemas/-auth'
 import { m } from "@/paraglide/messages.js";
@@ -37,16 +38,11 @@ export const Route = createLazyFileRoute('/_login/reset-password')({
 function ResetPasswordPage() {
   const router = useRouter()
   const { token } = useSearch({ from: '/_login/reset-password' })
-  const loginFeatures = [
-    { icon: Users, label: m.auth_features_userResearch(), desc: m.auth_features_userResearchDesc() },
-    { icon: BarChart3, label: m.auth_features_dataAnalysis(), desc: m.auth_features_dataAnalysisDesc() },
-    { icon: MessageSquare, label: m.auth_features_teamCollaboration(), desc: m.auth_features_teamCollaborationDesc() },
-    { icon: TrendingUp, label: m.auth_features_roadmap(), desc: m.auth_features_roadmapDesc() },
-  ]
+  const loginFeatures = buildAuthFeatures()
 
   const form = useForm({
     defaultValues: { password: '', confirmPassword: '' },
-    validators: [{ run: resetPasswordSchema as any, triggers: ['change'] }],
+    validators: [{ run: resetPasswordSchema, triggers: ['change'] }],
     onSubmit: async ({ value }) => {
       try {
         await resetPasswordFn({ data: { ...value, token } })

package/src/routes/_login/schemas/-auth.ts

@@ -58,6 +58,27 @@ export const registerSchema = z.object({
   path: ["confirmPassword"],
 })
 
+// 表单校验专用：invitationCode 必填 string。registerSchema 的 .default("") 会把
+// StandardSchema input 的 invitationCode 变为可选，与 TanStack Form 的表单值类型
+// （必填 string）不兼容，只能靠 as any 抹平；表单始终提供全部字段，此变体无
+// .default，类型端到端对齐（形状变更仍由 tsc 把关）。
+const invitationCodeRequiredRule = z
+  .string()
+  .refine((v) => v === "" || /^[A-Za-z0-9]{3,32}$/.test(v), {
+    message: m.common_form_invitationCodeFormat(),
+  })
+
+export const registerFormSchema = z.object({
+  username: usernameRule,
+  email: emailRule,
+  password: passwordRule,
+  confirmPassword: z.string(),
+  invitationCode: invitationCodeRequiredRule,
+}).refine((data) => data.password === data.confirmPassword, {
+  message: m.common_form_passwordMismatch(),
+  path: ["confirmPassword"],
+})
+
 export const forgotPasswordSchema = z.object({
   email: emailRule,
 })

package/src/routes/_login/verify-email/route.lazy.tsx

@@ -16,6 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createLazyFileRoute, Link } from '@tanstack/react-router'
+import { useEffect, useRef, useState } from 'react'
 import { toast } from '@/components/ui/toast'
 import { RainbowButton } from '@/components/magicui/rainbow-button'
 import { ArrowRight } from 'lucide-react'
@@ -30,8 +31,33 @@ export const Route = createLazyFileRoute('/_login/verify-email')({
   component: VerifyEmailPage,
 })
 
+// 重发冷却（秒）：防连点触发邮件轰炸（服务端另有 checkAuthRateLimit 限流兜底）
+const RESEND_COOLDOWN_SECONDS = 60
+
 function VerifyEmailPage() {
   const { verified } = Route.useRouteContext()
+  const [cooldown, setCooldown] = useState(0)
+  const cooldownTimer = useRef<ReturnType<typeof setInterval> | null>(null)
+
+  useEffect(() => {
+    return () => {
+      if (cooldownTimer.current) clearInterval(cooldownTimer.current)
+    }
+  }, [])
+
+  const startCooldown = () => {
+    setCooldown(RESEND_COOLDOWN_SECONDS)
+    if (cooldownTimer.current) clearInterval(cooldownTimer.current)
+    cooldownTimer.current = setInterval(() => {
+      setCooldown((s) => {
+        if (s <= 1) {
+          if (cooldownTimer.current) clearInterval(cooldownTimer.current)
+          return 0
+        }
+        return s - 1
+      })
+    }, 1000)
+  }
 
   const handleResend = async () => {
     try {
@@ -39,8 +65,10 @@ function VerifyEmailPage() {
       toast.success(
         r.alreadyVerified ? m.auth_verify_alreadyVerified() : m.auth_verify_resendSuccess(),
       )
+      if (!r.alreadyVerified) startCooldown()
     } catch (err) {
-      toastError(err, String(err))
+      // 原始错误仅进日志，用户只看通用失败文案（不外泄服务端原文）
+      toastError(err, m.auth_verify_resendFailed())
     }
   }
 
@@ -60,8 +88,10 @@ function VerifyEmailPage() {
         ) : (
           <>
             <AuthHeader title={m.auth_verify_invalid()} subtitle={m.auth_verify_invalidDesc()} />
-            <RainbowButton className="w-full" onClick={handleResend}>
-              {m.auth_verify_resend()}
+            <RainbowButton className="w-full" onClick={handleResend} disabled={cooldown > 0}>
+              {cooldown > 0
+                ? m.auth_verify_resendCooldown({ seconds: String(cooldown) })
+                : m.auth_verify_resend()}
             </RainbowButton>
             <div className="mt-4 flex items-center justify-center gap-2 text-sm text-muted-foreground">
               <span>{m.auth_verify_notLogged()}</span>

package/src/routes/_login/verify-email/route.tsx

@@ -16,10 +16,11 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
 import { confirmEmailVerificationFn } from '@/server/serverFns/auth/email-verification'
 
 export const Route = createFileRoute('/_login/verify-email')({
-  validateSearch: (s: { token?: string }) => ({ token: s.token ?? '' }),
+  validateSearch: z.object({ token: z.string().optional() }),
   beforeLoad: async ({ search }) => {
     if (!search.token) return { verified: false }
     const r = await confirmEmailVerificationFn({ data: { token: search.token } })

package/src/routes/_nav/-components/nav-not-found.tsx

@@ -22,28 +22,34 @@ import { Empty, EmptyContent, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTi
 import { Button } from '@/components/ui/button'
 import { FileQuestionIcon } from 'lucide-react'
 
-// pathname 首段 → notFoundPages_* i18n key 后缀
-const SECTION_KEYS: Record<string, string> = {
-  story: 'story', design: 'design', testcase: 'testcase',
-  bug: 'bug', inspiration: 'inspiration',
-}
-
-const SECTION_BACK: Record<string, string> = {
+// pathname 首段 → 分区 404 文案（强类型映射，缺 key 时 tsc 直接报错，
+// 不再用 (m as any) 动态拼 key 静默回退空串）
+const SECTION_BACK: Record<'story' | 'design' | 'testcase' | 'bug' | 'inspiration', string> = {
   story: '/story', design: '/design', testcase: '/test-cases',
   bug: '/bug', inspiration: '/inspiration',
 }
 
-function getSectionFromPath(pathname: string): { title: string; description: string; backLabel: string; backTo: string; section: string } | null {
+function sectionFromPathname(pathname: string): { title: string; description: string; backLabel: string; backTo: string } | null {
   const segment = pathname.split('/').filter(Boolean)[0]
-  const sectionKey = SECTION_KEYS[segment]
-  if (!sectionKey) return null
-  const p = ((m as any)['notFoundPages_' + sectionKey] ?? { title: '', description: '', backLabel: '' }) as { title: string; description: string; backLabel: string }
-  return { ...p, backTo: SECTION_BACK[sectionKey] || '/dashboard', section: sectionKey }
+  switch (segment) {
+    case 'story':
+      return { title: m.notFoundPages_story_title(), description: m.notFoundPages_story_description(), backLabel: m.notFoundPages_story_back(), backTo: SECTION_BACK.story }
+    case 'design':
+      return { title: m.notFoundPages_design_title(), description: m.notFoundPages_design_description(), backLabel: m.notFoundPages_design_back(), backTo: SECTION_BACK.design }
+    case 'testcase':
+      return { title: m.notFoundPages_testcase_title(), description: m.notFoundPages_testcase_description(), backLabel: m.notFoundPages_testcase_back(), backTo: SECTION_BACK.testcase }
+    case 'bug':
+      return { title: m.notFoundPages_bug_title(), description: m.notFoundPages_bug_description(), backLabel: m.notFoundPages_bug_back(), backTo: SECTION_BACK.bug }
+    case 'inspiration':
+      return { title: m.notFoundPages_inspiration_title(), description: m.notFoundPages_inspiration_description(), backLabel: m.notFoundPages_inspiration_back(), backTo: SECTION_BACK.inspiration }
+    default:
+      return null
+  }
 }
 
 export function NavNotFound() {
   const { pathname } = useLocation()
-  const section = getSectionFromPath(pathname)
+  const section = sectionFromPathname(pathname)
 
   return (
     <div className="flex flex-1 items-center justify-center">

package/src/routes/_nav/apps/anyhub/$id/route.lazy.tsx

@@ -27,6 +27,7 @@ export const Route = createLazyFileRoute('/_nav/apps/anyhub/$id')({
 function AnyHubDetailPage() {
   return (
     <div className="flex h-full flex-col">
+      {/* 预留 header 槽位（与 anyhub 索引页同款顶部占位，保持两页留白一致） */}
       <div className="flex shrink-0 items-center justify-between p-4" />
       <div className="min-h-0 flex-1 overflow-y-auto">
         <PlaceholderPage title={m.apps_detail_title()} icon={PackageOpen} />

package/src/routes/_nav/apps/anyhub/route.tsx

@@ -15,7 +15,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { Outlet, createFileRoute, useMatches } from '@tanstack/react-router'
+import { Outlet, createFileRoute, useRouterState } from '@tanstack/react-router'
 import { PlaceholderPage } from '@/components/shared-kit/pages/placeholder-page'
 import { Package } from 'lucide-react'
 
@@ -24,12 +24,14 @@ export const Route = createFileRoute('/_nav/apps/anyhub')({
 })
 
 function AnyHubLayout() {
-  const matches = useMatches()
-  const isIndex = matches[matches.length - 1]?.routeId === '/_nav/apps/anyhub'
+  // 以 URL 判定 index（避免 routeId 魔法字符串）
+  const pathname = useRouterState({ select: (s) => s.location.pathname })
+  const isIndex = pathname === '/apps/anyhub'
 
   if (isIndex) {
     return (
       <div className="flex h-full flex-col">
+        {/* 预留 header 槽位（与 $id 详情页同款顶部占位，保持两页留白一致） */}
         <div className="flex shrink-0 items-center justify-between p-4" />
         <div className="min-h-0 flex-1 overflow-y-auto">
           <PlaceholderPage title="AnyHub" icon={Package} />

package/src/routes/_nav/bugs/$bugId/route.lazy.tsx

@@ -58,8 +58,8 @@ function BugDetailContent({
   // 编辑成功后本地同步（loader 数据随下一次进入刷新）
   const [current, setCurrent] = useState(bug);
 
-  const goTo = (bugId: string) => {
-    navigate({ to: "/bugs/$bugId", params: { bugId } });
+  const goTo = async (bugId: string) => {
+    await navigate({ to: "/bugs/$bugId", params: { bugId } });
   };
 
   return (
@@ -72,8 +72,8 @@ function BugDetailContent({
         canArchive={!bug.archived}
         onPrevious={neighbors.prevId ? () => goTo(neighbors.prevId!) : undefined}
         onNext={neighbors.nextId ? () => goTo(neighbors.nextId!) : undefined}
-        onArchived={() => navigate({ to: "/bugs" })}
-        onDeleted={() => navigate({ to: "/bugs" })}
+        onArchived={async () => { await navigate({ to: "/bugs" }) }}
+        onDeleted={async () => { await navigate({ to: "/bugs" }) }}
         navTitle={`${bug.identifier} ${current.title}`}
       />
       <BugDetailBody

package/src/routes/_nav/bugs/$bugId/route.tsx

@@ -62,7 +62,7 @@ export const Route = createFileRoute("/_nav/bugs/$bugId")({
     const bug = await getBugDetailFn({ data: { bugId: params.bugId } });
     const [collab, users, labels, neighbors] = await Promise.all([
       collabPromise,
-      listUsersBriefFn({ data: bug.projectId ? { projectId: bug.projectId } : undefined }),
+      listUsersBriefFn({ data: bug.projectId ? { projectId: bug.projectId } : {} }),
       listLabelsFn(),
       getBugNeighborsFn({ data: { bugId: params.bugId } }),
     ]);

package/src/routes/_nav/changelog/route.tsx

@@ -1,13 +1,14 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { fetchChangelogFn } from '@/server/serverFns/changelog/fetch'
-import type { DeveloperLogEntry } from '@allbluecn/kernel'
 
 export const Route = createFileRoute('/_nav/changelog')({
   loader: async () => {
     try {
-      return { entries: await fetchChangelogFn() as DeveloperLogEntry[] }
-    } catch {
-      return { entries: [] as DeveloperLogEntry[] }
+      return { entries: await fetchChangelogFn() }
+    } catch (e) {
+      // 降级为空列表前先留痕（故障静默会让「无更新日志」与「加载失败」不可区分）
+      console.error('[changelog] fetchChangelogFn failed:', e instanceof Error ? e.message : String(e))
+      return { entries: [] as Awaited<ReturnType<typeof fetchChangelogFn>> }
     }
   },
 })

package/src/routes/_nav/dashboard/-components/avatar-group.tsx

@@ -15,6 +15,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { cn } from '@/lib/utils'
 import { UserAvatar } from '@/components/shared-kit'
 import type { AvatarConfig } from '@allbluecn/kernel'
 
@@ -30,11 +31,14 @@ interface AvatarGroupProps {
   members: TeamMember[]
 }
 
+/** 头像超出该数量折叠为 +N */
+const MAX_VISIBLE = 5
+
 export function AvatarGroup({ members }: AvatarGroupProps) {
   return (
     <div className="flex items-center">
-      {members.slice(0, 5).map((member, i) => (
-        <div key={member.email} className="relative" style={{ marginLeft: i > 0 ? '-8px' : 0, zIndex: members.length - i }}>
+      {members.slice(0, MAX_VISIBLE).map((member, i) => (
+        <div key={member.email} className={cn('relative', i > 0 && '-ml-2')} style={{ zIndex: members.length - i }}>
           <UserAvatar
             avatarConfig={member.avatarConfig}
             bgShape={member.bgShape}
@@ -44,9 +48,9 @@ export function AvatarGroup({ members }: AvatarGroupProps) {
           />
         </div>
       ))}
-      {members.length > 5 && (
-        <div className="relative flex h-6 w-6 items-center justify-center rounded-full bg-muted text-xs font-medium" style={{ marginLeft: '-8px', zIndex: 0 }}>
-          +{members.length - 5}
+      {members.length > MAX_VISIBLE && (
+        <div className="relative -ml-2 z-0 flex h-6 w-6 items-center justify-center rounded-full bg-muted text-xs font-medium">
+          +{members.length - MAX_VISIBLE}
         </div>
       )}
     </div>

package/src/routes/_nav/dashboard/route.lazy.tsx

@@ -17,7 +17,6 @@
 
 import { cn } from "@/lib/utils"
 import { ClientOnly, createLazyFileRoute } from '@tanstack/react-router'
-import { useEffect, useState } from 'react'
 import { StatsGrid } from './-components/stats-grid'
 import { ActivityFeed } from './-components/activity-feed'
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
@@ -26,6 +25,7 @@ import WebglLightRays from '@/components/react-bits/light-rays'
 import { AiChatPrompt } from '@/components/ai/ai-chat-prompt'
 import { ContributionGraphWithTooltip } from '@/components/shared-kit/data-viz/contribution-graph-tooltip'
 import { PluginWidgets } from '@/components/plugin-slots/plugin-widgets'
+import { useThemeMode } from '@/providers/theme-mode-provider'
 import { m } from "@/paraglide/messages.js";
 
 export const Route = createLazyFileRoute('/_nav/dashboard')({
@@ -40,29 +40,17 @@ export const Route = createLazyFileRoute('/_nav/dashboard')({
 function DashboardPage() {
   const { prds, activityData } = Route.useLoaderData()
   const context = Route.useRouteContext()
-  const [isDark, setIsDark] = useState(
-    typeof document !== 'undefined' && document.documentElement.classList.contains('dark'),
-  )
-
-  useEffect(() => {
-    setIsDark(document.documentElement.classList.contains('dark'))
-    const observer = new MutationObserver(() => {
-      setIsDark(document.documentElement.classList.contains('dark'))
-    })
-    observer.observe(document.documentElement, { attributes: true, attributeFilter: ['class'] })
-    return () => observer.disconnect()
-  }, [])
+  // 明暗跟随全局 ThemeModeProvider（auto 模式含系统外观 + 时段规则），
+  // 不再自建 MutationObserver 监听 documentElement class
+  const { resolved, mounted } = useThemeMode()
+  const isDark = mounted && resolved === 'dark'
 
   return (
     <div className="relative min-h-full overflow-hidden">
-      <div className= {cn("mask-[linear-gradient(to_bottom,white_80%,transparent)] pointer-events-none absolute inset-x-0 inset-0 h-142 top-0 overflow-hidden")} >
+      <div className={cn("mask-[linear-gradient(to_bottom,white_80%,transparent)] pointer-events-none absolute inset-0 h-142 top-0 overflow-hidden")} >
         <ClientOnly>{isDark ? <WebglLightRays /> : <MagicuiLightRays />}</ClientOnly>
       </div>
       <div className="relative z-10 space-y-6 p-6">
-        <div className="flex items-center justify-between">
-          {/* <QuickActions /> */}
-        </div>
-
         <AiChatPrompt hasAiKey={context?.session?.user?.hasAiKey} />
 
         <StatsGrid

package/src/routes/_nav/dashboard/route.tsx

@@ -29,7 +29,9 @@ export const Route = createFileRoute('/_nav/dashboard')({
         getActivityDataFn({ data: { timezone } }),
       ])
       return { prds, activityData }
-    } catch {
+    } catch (e) {
+      // 降级为空数据前先留痕（否则服务端故障被伪装成「用户没有数据」）
+      console.error('[dashboard] loader failed:', e instanceof Error ? e.message : String(e))
       return { prds: [], activityData: [] }
     }
   },

package/src/routes/_nav/design/canvas/$id/route.tsx

@@ -25,7 +25,8 @@ export const Route = createFileRoute('/_nav/design/canvas/$id')({
     if (result.error === 'unauthorized') {
       throw redirect({ to: '/login' })
     }
-    if (result.error === 'not_found') {
+    if (result.error === 'not_found' || !result.prd) {
+      // !result.prd：未知/新增错误码兜底，避免 undefined 下发组件树渲染崩溃
       throw notFound()
     }
     return {

package/src/routes/_nav/harness/$threadId.lazy.tsx

@@ -22,6 +22,9 @@ import type { UIMessage } from "@tanstack/ai-react"
 export const Route = createLazyFileRoute('/_nav/harness/$threadId')({
   component: function HarnessThreadRoute() {
     const { threadId } = Route.useParams()
+    // loader 推断类型是 serverFn 的 JSON 序列化形状（role 含 "tool"、parts 为
+    // JsonValue），与 HarnessWorkbenchPage 的 UIMessage 入参不结构兼容，
+    // 断言是承载性的（审计建议的「免断言」会使 tsc 报错）
     const messages = Route.useLoaderData() as { messages: UIMessage[] }
     // key 强制重建：HarnessWorkbenchPage 以 useState(initialThreadId) 持有会话状态，
     // route param 变化时组件实例被复用，无 key 会残留上一线程的消息

package/src/routes/_nav/knowledge/$kbId/doc/$docId/route.lazy.tsx

@@ -42,6 +42,9 @@ function PlaceholderPageConstrained({ title, icon, description }: { title: strin
 }
 
 function KnowledgeDocPage() {
+  // 断言是承载性的：loader 推断类型（getDocumentFn 序列化结果，tags/content 为
+  // JsonValue）与 KnowledgeDocEditor 的 DocumentData（tags: string[]）不结构兼容；
+  // 手写形状即「编辑器所需的最小契约」，字段漂移由 KnowledgeDocEditor 自身类型兜底
   const { doc, collab } = Route.useLoaderData() as {
     doc: {
       id: string

package/src/routes/_nav/knowledge/$kbId/index.tsx

@@ -23,7 +23,10 @@ export const Route = createFileRoute('/_nav/knowledge/$kbId/')({
     try {
       const doc = await getHomepageDocumentFn({ data: { kbId: params.kbId } })
       return { homepage: doc }
-    } catch {
+    } catch (e) {
+      // serverFn 对「无首页/无权限/服务端错误」统一抛 Error，此处降级为 null；
+      // 留痕避免故障伪装成「未设置首页」
+      console.error('[knowledge] getHomepageDocumentFn failed:', e instanceof Error ? e.message : String(e))
       return { homepage: null }
     }
   },