@allbluecn/web-app 0.19.2 → 0.19.4

package/src/routes/design-files/$projectId/$artboardId/$filename.ts

@@ -20,6 +20,7 @@ import { readFile } from "node:fs/promises"
 import { resolve, normalize } from "node:path"
 import { existsSync } from "node:fs"
 import { requireAuth } from "@/server/auth-helpers"
+import { assertProjectMembership } from "@/server/lib/project-membership"
 
 const UPLOAD_ROOT = process.env.DESIGN_UPLOAD_DIR || "uploads/design"
 
@@ -36,8 +37,10 @@ export const Route = createFileRoute("/design-files/$projectId/$artboardId/$file
           )
         }
 
+        let userId: string
         try {
-          await requireAuth(request)
+          const session = await requireAuth(request)
+          userId = session.user!.id!
         } catch {
           return new Response("Unauthorized", { status: 401 })
         }
@@ -48,11 +51,20 @@ export const Route = createFileRoute("/design-files/$projectId/$artboardId/$file
           filename: string
         }
 
+        // 项目成员校验（审计 🟠：原仅 requireAuth 即可读任意项目设计文件）；
+        // 非成员与不存在同 404，防 projectId/artboardId 枚举
+        try {
+          await assertProjectMembership(projectId, userId)
+        } catch {
+          return new Response("Not Found", { status: 404 })
+        }
+
         const safeFilename = filename.replace(/\.\./g, "").replace(/\//g, "")
         const baseDir = resolve(UPLOAD_ROOT, projectId, artboardId)
         const filePath = normalize(resolve(baseDir, safeFilename))
+        // 纵深防御分支：safeFilename 已剥 .. 与 /，正常不可达；命中返回 400 而非 throw（审计 🟡）
         if (!filePath.startsWith(resolve(baseDir))) {
-          throw new Error("Path traversal detected")
+          return new Response("Bad Request", { status: 400 })
         }
 
         if (!existsSync(filePath)) {
@@ -65,7 +77,14 @@ export const Route = createFileRoute("/design-files/$projectId/$artboardId/$file
           ext === "svg" ? "image/svg+xml" : ext === "png" ? "image/png" : "application/octet-stream"
 
         return new Response(buffer, {
-          headers: { "Content-Type": contentType, "Cache-Control": "public, max-age=86400" },
+          headers: {
+            "Content-Type": contentType,
+            // 鉴权内容禁共享缓存（审计 🟡：public 允许忽略凭证的 CDN 缓存复放）；
+            // nosniff + 最小 CSP 兜底 SVG 直开的脚本执行面
+            "Cache-Control": "private, max-age=86400",
+            "X-Content-Type-Options": "nosniff",
+            "Content-Security-Policy": "default-src 'none'",
+          },
         })
       },
     },

package/src/routes/invite/$token/route.lazy.tsx

@@ -21,6 +21,7 @@ import { useMutation } from '@tanstack/react-query'
 import { toast } from '@/components/ui/toast'
 import { RainbowButton } from '@/components/magicui/rainbow-button'
 import { UserAvatar } from '@/components/shared-kit'
+import type { AvatarConfig } from '@allbluecn/kernel'
 import { AuthLayout, AuthLayoutLeft, AuthLayoutRight } from '@/components/auth/auth-layout'
 import { AuthBrandPanel } from '@/components/auth/auth-brand-panel'
 import { IconInput } from '@/components/auth/icon-input'
@@ -39,10 +40,9 @@ export const Route = createLazyFileRoute('/invite/$token')({
 type EmailCheckState = 'idle' | 'checking' | 'registered' | 'unregistered'
 
 function InvitePage() {
-  const { token, inv } = Route.useRouteContext()
+  // session 来自 __root beforeLoad 注入（merge 进 route context），无需断言
+  const { token, inv, session } = Route.useRouteContext()
   const navigate = useNavigate()
-  const ctx = Route.useRouteContext() as any
-  const session = ctx?.session
   const isLoggedIn = !!session?.user?.id
   const emailPrefilled = inv?.channel === 'email' && !!inv?.email
 
@@ -66,7 +66,8 @@ function InvitePage() {
 
   const checkEmail = useDebouncedCallback(async (email: string) => {
     try {
-      const { registered } = await checkInviteEmailRegisteredFn({ data: { email } })
+      // 服务端绑定有效邀请 token（防枚举），无效 token 走 catch 回 idle
+      const { registered } = await checkInviteEmailRegisteredFn({ data: { token, email } })
       setEmailCheck(registered ? 'registered' : 'unregistered')
     } catch {
       setEmailCheck('idle')
@@ -161,7 +162,7 @@ function InvitePage() {
       <AuthLayoutLeft>
         <div className="space-y-3 text-center">
           <UserAvatar
-            avatarConfig={owner.avatarConfig as any}
+            avatarConfig={(owner.avatarConfig ?? null) as AvatarConfig | null}
             bgColor={owner.bgColor}
             bgShape={owner.bgShape}
             className="mx-auto size-16"
@@ -184,11 +185,11 @@ function InvitePage() {
               <CardContent>
                 <div className="flex items-center gap-3">
                   <UserAvatar
-                    avatarConfig={session.user?.avatarConfig as any}
+                    avatarConfig={(session.user?.avatarConfig ?? null) as AvatarConfig | null}
                     bgColor={session.user?.bgColor}
                     bgShape={session.user?.bgShape}
                     className="shrink-0"
-                    name={session.user?.username ?? session.user?.name}
+                    name={session.user?.name ?? ''}
                     size="md"
                   />
                   <div className="min-w-0 flex-1">

package/src/routes/server/ai-stream.ts

@@ -73,8 +73,13 @@ export const Route = createFileRoute('/server/ai-stream')({
         }
 
         if (!(await hasAiKey(userId))) {
+          // 机器可读 code 供监控/后续协议化消费；content 为用户可见文案。
+          // ⚠ fallback 仍走裸 JSON 行：官方 toServerSentEventsStream 的 stripToSpec
+          // 会剥掉非 AG-UI 字段（content 会被剥除），换官方编码必须同步改客户端
+          // ai-extension.ts 的解析契约（A8x-tiptap 批协同），单侧改动即断 fallback 展示。
           const fallback = JSON.stringify({
             type: 'fallback',
+            code: 'no_key',
             content: 'AI 服务暂未配置：未检测到有效的 API Key。请前往「设置 → AI 设置」配置。',
           })
           const stream = new ReadableStream({
@@ -121,6 +126,7 @@ export const Route = createFileRoute('/server/ai-stream')({
           console.warn('[ai-stream] chat failed', err instanceof Error ? err.message : String(err))
           const fallback = JSON.stringify({
             type: 'fallback',
+            code: 'upstream_error',
             content: 'AI service is temporarily unavailable. Please try again later.',
           })
           const stream = new ReadableStream({

package/src/routes/server/ws.ts

@@ -23,9 +23,13 @@ export const Route = createFileRoute('/server/ws')({
     handlers: {
       GET: async ({ request }) => {
         const session = await getCurrentSession(request)
-        if (!session) return new Response('Unauthorized', { status: 401 })
+        // 口径对齐同批路由：session callback 降级可返回 user:null 的「有效 session」，
+        // 仅判 session 存在会放行（审计 🟡）
+        if (!session?.user?.id) return new Response('Unauthorized', { status: 401 })
 
         const url = new URL(request.url)
+        // TODO(ws)：entityIds 当前仅做参数校验（keepalive stub 的预留接口），后续
+        // 协作态推送按此过滤实体范围；接入前保留长度守卫
         const entityIds = url.searchParams.get('ids')?.split(',').filter(Boolean) || []
         if (!entityIds.length) return new Response('Missing ids parameter', { status: 400 })
 
@@ -43,7 +47,12 @@ export const Route = createFileRoute('/server/ws')({
 
             request.signal.addEventListener('abort', () => {
               clearInterval(interval)
-              controller.close()
+              // 流可能已因 enqueue 失败进入 errored 态，再 close 会抛错（审计 ⚪）
+              try {
+                controller.close()
+              } catch {
+                /* already closed/errored */
+              }
             })
           },
         })

package/src/routes/share/$versionId/route.lazy.tsx

@@ -32,11 +32,6 @@ export const Route = createLazyFileRoute('/share/$versionId')({
 
 function ShareVersionNotFound() {
   return (
-      <ShareVersionNotFoundInner />
-  )
-}
-
-function ShareVersionNotFoundInner() {return (
     <div className="flex h-screen items-center justify-center">
       <div className="text-center">
         <h1 className="text-2xl font-bold text-muted-foreground">{m.common_share_notFoundTitle()}</h1>
@@ -49,8 +44,9 @@ function ShareVersionNotFoundInner() {return (
 function ShareVersionPage() {
   const ctx = Route.useRouteContext()
   return (
-    <div className="min-h-screen bg-gray-50">
-      <header className="sticky top-0 z-50 bg-white border-b px-4 h-12 flex items-center gap-2 shadow-sm">
+    // 语义类跟随明暗主题（审计 🟡：bg-gray-50/bg-white 硬编码致暗黑模式刺眼白底）
+    <div className="min-h-screen bg-background text-foreground">
+      <header className="sticky top-0 z-50 bg-card border-b px-4 h-12 flex items-center gap-2 shadow-sm">
         <span className="text-sm font-medium">{ctx.prdName}</span>
         <span className="text-xs px-1.5 py-0.5 rounded bg-muted text-muted-foreground">{ctx.versionLabel}</span>
         {ctx.notes && <span className="text-xs text-muted-foreground ml-2">— {ctx.notes}</span>}

package/src/routes/share/compliance/$id/route.lazy.tsx

@@ -15,44 +15,15 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { useState, Suspense } from 'react'
 import { createLazyFileRoute } from '@tanstack/react-router'
-import { KnowledgeDocEditor } from '@/components/knowledge/editor/knowledge-doc-editor'
 import { COMPLIANCE_FIELDS } from '@/components/knowledge/public/legal-compliance-editor'
+import { PublicDocSharePage } from '@/components/share/public-doc-share-page'
 import type { PropertyValues } from '@/components/knowledge/doc-properties'
-import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { Star, Share2 } from 'lucide-react'
-import { cn } from '@/lib/utils'
-import { toggleFavoriteFn } from '@/server/serverFns/knowledge/public/favorite'
-import { toast } from '@/components/ui/toast'
-import { m } from "@/paraglide/messages.js";
 
 export const Route = createLazyFileRoute('/share/compliance/$id')({ component: PublicCompliancePage })
 
 function PublicCompliancePage() {
   const data = Route.useRouteContext()
-  const [favorited, setFavorited] = useState(false)
-  const handleFavorite = async () => {
-    try {
-      const r = await toggleFavoriteFn({ data: { entityType: 'compliance', entityId: data.id } })
-      setFavorited(r.favorited)
-      toast.success(r.favorited ? m.common_share_favoriteAdded() : m.common_share_favoriteRemoved())
-    } catch {
-      toast.error(m.common_share_loginRequired())
-    }
-  }
-
-  const docData = {
-    id: data.id,
-    kbId: '',
-    title: data.title,
-    content: { html: data.content ?? '', markdown: '' },
-    type: 'doc',
-    tags: Array.isArray(data.tags) ? (data.tags as string[]) : [],
-    updatedAt: data.updatedAt,
-    creator: data.user ?? null,
-  }
 
   const propertyValues: PropertyValues = {
     industry: data.industry ?? '',
@@ -61,40 +32,18 @@ function PublicCompliancePage() {
     sourceUrl: data.sourceUrl ?? '',
   }
 
-  const propertyFields = COMPLIANCE_FIELDS.filter((f) => {
-    const v = propertyValues[f.key]
-    return v !== null && v !== undefined && v !== ''
-  })
-
   return (
-    <div className="flex h-full flex-col">
-      <div className="flex-1 overflow-y-auto">
-        <Suspense fallback={null}>
-          <KnowledgeDocEditor
-            document={docData}
-            readOnly
-            propertyFields={propertyFields}
-            propertyValues={propertyValues}
-            actions={
-              <>
-                <Button variant="ghost" size="sm" onClick={handleFavorite} className="gap-1.5">
-                  <Star className={cn('h-4 w-4', favorited && 'fill-amber-400 text-amber-400')} />
-                  {favorited ? m.common_share_favorited() : m.common_share_favorite()}
-                </Button>
-                <Tooltip>
-                  <TooltipTrigger render={<Button variant="ghost" size="icon" onClick={() => {
-                      navigator.clipboard.writeText(window.location.href)
-                      toast.success(m.common_share_linkCopied())
-                    }} />}>
-                      <Share2 className="h-4 w-4" />
-                    </TooltipTrigger>
-                  <TooltipContent>{m.common_share_copyLink()}</TooltipContent>
-                </Tooltip>
-              </>
-            }
-          />
-        </Suspense>
-      </div>
-    </div>
+    <PublicDocSharePage
+      entityType="compliance"
+      entityId={data.id}
+      title={data.title}
+      content={data.content ?? null}
+      tags={data.tags}
+      updatedAt={data.updatedAt}
+      creator={data.user ?? null}
+      fields={COMPLIANCE_FIELDS}
+      propertyValues={propertyValues}
+      initialFavorited={data.favorited ?? false}
+    />
   )
 }

package/src/routes/share/compliance/$id/route.tsx

@@ -17,12 +17,17 @@
 
 import { createFileRoute, notFound } from '@tanstack/react-router'
 import { getPublicComplianceFn } from '@/server/serverFns/knowledge/public/compliance/public'
+import { getFavoriteIdsFn } from '@/server/serverFns/knowledge/public/favorite'
 
 export const Route = createFileRoute('/share/compliance/$id')({
   beforeLoad: async ({ params }) => {
     try {
       const data = await getPublicComplianceFn({ data: { id: params.id } })
-      return data
+      // 收藏初始态回读（审计 ⚪）：匿名/查询失败一律 false，不阻塞页面渲染
+      const favorited = await getFavoriteIdsFn({ data: { entityType: 'compliance' } })
+        .then((ids) => ids.includes(params.id))
+        .catch(() => false)
+      return { ...data, favorited }
     } catch {
       throw notFound()
     }

package/src/routes/share/law/$id/route.lazy.tsx

@@ -15,44 +15,15 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { useState, Suspense } from 'react'
 import { createLazyFileRoute } from '@tanstack/react-router'
-import { KnowledgeDocEditor } from '@/components/knowledge/editor/knowledge-doc-editor'
 import { LEGAL_FIELDS } from '@/components/knowledge/public/legal-compliance-editor'
+import { PublicDocSharePage } from '@/components/share/public-doc-share-page'
 import type { PropertyValues } from '@/components/knowledge/doc-properties'
-import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { Star, Share2 } from 'lucide-react'
-import { cn } from '@/lib/utils'
-import { toggleFavoriteFn } from '@/server/serverFns/knowledge/public/favorite'
-import { toast } from '@/components/ui/toast'
-import { m } from "@/paraglide/messages.js";
 
 export const Route = createLazyFileRoute('/share/law/$id')({ component: PublicLegalPage })
 
 function PublicLegalPage() {
   const data = Route.useRouteContext()
-  const [favorited, setFavorited] = useState(false)
-  const handleFavorite = async () => {
-    try {
-      const r = await toggleFavoriteFn({ data: { entityType: 'legal', entityId: data.id } })
-      setFavorited(r.favorited)
-      toast.success(r.favorited ? m.common_share_favoriteAdded() : m.common_share_favoriteRemoved())
-    } catch {
-      toast.error(m.common_share_loginRequired())
-    }
-  }
-
-  const docData = {
-    id: data.id,
-    kbId: '',
-    title: data.title,
-    content: { html: data.content ?? '', markdown: '' },
-    type: 'doc',
-    tags: Array.isArray(data.tags) ? (data.tags as string[]) : [],
-    updatedAt: data.updatedAt,
-    creator: data.user ?? null,
-  }
 
   const propertyValues: PropertyValues = {
     category: data.category ?? '',
@@ -64,40 +35,18 @@ function PublicLegalPage() {
     sourceUrl: data.sourceUrl ?? '',
   }
 
-  const propertyFields = LEGAL_FIELDS.filter((f) => {
-    const v = propertyValues[f.key]
-    return v !== null && v !== undefined && v !== ''
-  })
-
   return (
-    <div className="flex h-full flex-col">
-      <div className="flex-1 overflow-y-auto">
-        <Suspense fallback={null}>
-          <KnowledgeDocEditor
-            document={docData}
-            readOnly
-            propertyFields={propertyFields}
-            propertyValues={propertyValues}
-            actions={
-              <>
-                <Button variant="ghost" size="sm" onClick={handleFavorite} className="gap-1.5">
-                  <Star className={cn('h-4 w-4', favorited && 'fill-amber-400 text-amber-400')} />
-                  {favorited ? m.common_share_favorited() : m.common_share_favorite()}
-                </Button>
-                <Tooltip>
-                  <TooltipTrigger render={<Button variant="ghost" size="icon" onClick={() => {
-                      navigator.clipboard.writeText(window.location.href)
-                      toast.success(m.common_share_linkCopied())
-                    }} />}>
-                      <Share2 className="h-4 w-4" />
-                    </TooltipTrigger>
-                  <TooltipContent>{m.common_share_copyLink()}</TooltipContent>
-                </Tooltip>
-              </>
-            }
-          />
-        </Suspense>
-      </div>
-    </div>
+    <PublicDocSharePage
+      entityType="legal"
+      entityId={data.id}
+      title={data.title}
+      content={data.content ?? null}
+      tags={data.tags}
+      updatedAt={data.updatedAt}
+      creator={data.user ?? null}
+      fields={LEGAL_FIELDS}
+      propertyValues={propertyValues}
+      initialFavorited={data.favorited ?? false}
+    />
   )
 }

package/src/routes/share/law/$id/route.tsx

@@ -17,12 +17,17 @@
 
 import { createFileRoute, notFound } from '@tanstack/react-router'
 import { getPublicLegalFn } from '@/server/serverFns/knowledge/public/legal/public'
+import { getFavoriteIdsFn } from '@/server/serverFns/knowledge/public/favorite'
 
 export const Route = createFileRoute('/share/law/$id')({
   beforeLoad: async ({ params }) => {
     try {
       const data = await getPublicLegalFn({ data: { id: params.id } })
-      return data
+      // 收藏初始态回读（审计 ⚪）：匿名/查询失败一律 false，不阻塞页面渲染
+      const favorited = await getFavoriteIdsFn({ data: { entityType: 'legal' } })
+        .then((ids) => ids.includes(params.id))
+        .catch(() => false)
+      return { ...data, favorited }
     } catch {
       throw notFound()
     }

package/src/server/__tests__/agent-crud.test.ts

@@ -115,6 +115,14 @@ vi.mock('@/server/auth-helpers', () => ({
     }
     return session
   },
+  // A2x-1 批次新增的共享收窄（agent-crud/skill-crud 消费）
+  requireUserId: async () => {
+    const session = await mocks.getCurrentSession()
+    if (!session?.user?.id) {
+      throw new Error('UNAUTHORIZED')
+    }
+    return session.user.id
+  },
 }))
 
 import {

package/src/server/__tests__/chat-conversations.test.ts

@@ -53,6 +53,7 @@ vi.mock("@tanstack/react-start/server", () => ({
 }))
 
 vi.mock("@allbluecn/database", () => ({
+  Prisma: { JsonNull: "json-null" },
   prisma: {
     chatThread: {
       create: mocks.create,

package/src/server/__tests__/fetch-guard.test.ts

@@ -1,10 +1,17 @@
 import { describe, expect, it, vi } from "vitest";
 import {
   assertFetchableUrl,
+  assertFetchableUrlResolved,
   FetchGuardError,
   isDesktopRuntime,
 } from "../fetch-guard";
 
+// DNS 深检 mock：默认公网解析，用例内覆盖私网/失败形态
+const lookupMock = vi.fn(async () => [{ address: "93.184.216.34", family: 4 }]);
+vi.mock("node:dns/promises", () => ({
+  lookup: (...args: unknown[]) => lookupMock(...(args as [])),
+}));
+
 describe("assertFetchableUrl SSRF 主机防护", () => {
   it.each([
     "http://127.0.0.1:8080/api",
@@ -16,6 +23,11 @@ describe("assertFetchableUrl SSRF 主机防护", () => {
     "http://0.0.0.0/",
     "http://nas.local/favicon", // mDNS 组播域，可解析到局域网地址
     "http://api.local:3000/x",
+    "http://100.64.0.1/", // CGNAT（Tailscale 等 overlay 网段，2026-10 审计补）
+    "http://100.127.255.254/",
+    "http://198.18.0.9/", // 基准测试段（2026-10 审计补）
+    "http://198.19.255.254/",
+    "http://192.0.0.8/", // IETF 协议分配段（2026-10 审计补）
     "http://[::1]:8080/",
     "http://[fe80::1]/", // 链路本地
     "http://[::ffff:127.0.0.1]/", // IPv4-mapped IPv6 回环（SSRF 经典绕过）
@@ -124,3 +136,58 @@ describe("isDesktopRuntime 桌面端判定", () => {
     expect(isDesktopRuntime()).toBe(false);
   });
 });
+
+describe("assertFetchableUrlResolved DNS 解析后复检（2026-10 审计 🟠 加固）", () => {
+  it("域名 A 记录指向私网 → 拒绝（字面量判定放行的绕过面）", async () => {
+    lookupMock.mockImplementation(async () => [{ address: "127.0.0.1", family: 4 }]);
+    await expect(assertFetchableUrlResolved("https://evil.example/x")).rejects.toThrow(
+      FetchGuardError,
+    );
+  });
+
+  it("域名解析到云元数据段 → 拒绝", async () => {
+    lookupMock.mockImplementation(async () => [{ address: "169.254.169.254", family: 4 }]);
+    await expect(assertFetchableUrlResolved("https://evil.example/meta")).rejects.toThrow(
+      /元数据段/,
+    );
+  });
+
+  it("多条解析记录任一命中私网即拒（A/AAAA 全量复检）", async () => {
+    lookupMock.mockImplementation(async () => [
+      { address: "93.184.216.34", family: 4 },
+      { address: "fd00::1", family: 6 },
+    ]);
+    await expect(assertFetchableUrlResolved("https://dual.example/")).rejects.toThrow(
+      FetchGuardError,
+    );
+  });
+
+  it("解析结果全公网 → 放行并返回规范化 URL", async () => {
+    lookupMock.mockImplementation(async () => [{ address: "93.184.216.34", family: 4 }]);
+    const url = await assertFetchableUrlResolved("https://example.com/a");
+    expect(url.href).toBe("https://example.com/a");
+  });
+
+  it("IP 字面量目标不做 DNS 解析（同步判定已覆盖）", async () => {
+    lookupMock.mockClear();
+    await assertFetchableUrlResolved("https://93.184.216.34/x");
+    expect(lookupMock).not.toHaveBeenCalled();
+  });
+
+  it("解析无记录（ENOTFOUND 等异常）向上抛出，由调用方降级", async () => {
+    lookupMock.mockImplementation(async () => {
+      throw new Error("ENOTFOUND");
+    });
+    await expect(assertFetchableUrlResolved("https://gone.example/")).rejects.toThrow(
+      "ENOTFOUND",
+    );
+  });
+
+  it("allowPrivate=true 时解析复检同语义豁免（自托管内网域名场景）", async () => {
+    lookupMock.mockImplementation(async () => [{ address: "192.168.1.10", family: 4 }]);
+    const url = await assertFetchableUrlResolved("http://searx.home.internal:8888/search", {
+      allowPrivate: true,
+    });
+    expect(url.href).toBe("http://searx.home.internal:8888/search");
+  });
+});

package/src/{lib → server}/__tests__/rag.test.ts

@@ -42,7 +42,7 @@ vi.mock('@/lib/vector-store', () => ({
   }),
 }))
 
-import { indexDocument, ragSearch } from '@/lib/rag'
+import { indexDocument, ragSearch } from '@/server/rag'
 
 beforeEach(() => vi.clearAllMocks())
 

package/src/server/__tests__/resources.license.test.ts

@@ -71,7 +71,7 @@ function mockLicense(verifyStatus: {
 }
 
 describe('Resource 轴 license 仲裁', () => {
-  it('license 有效 → seats limit = license.seats（覆盖 billing 路径）', async () => {
+  it('license 有效 → seats limit = unlimited（与 requireTeamSeats 执行口径对齐，审计 🟠）', async () => {
     mockLicense({
       valid: true,
       reason: 'ok',
@@ -80,7 +80,8 @@ describe('Resource 轴 license 仲裁', () => {
       inGracePeriod: false,
     })
     const snapshots = await getResourceSnapshots(undefined)
-    expect(snapshots.seats).toMatchObject({ limit: 50, usage: 3 })
+    expect(snapshots.seats).toMatchObject({ limit: 'unlimited' })
+    expect(snapshots.guestSeats).toMatchObject({ limit: 'unlimited' })
     expect(snapshots.aiQuotaMonthly).toMatchObject({ limit: 'unlimited' })
   })
 

package/src/server/__tests__/resources.test.ts

@@ -72,8 +72,14 @@ const FREE_PLAN = {
 beforeEach(() => {
   vi.clearAllMocks()
   mockedAuth.mockResolvedValue(ACTIVE_SESSION)
-  mockedMemberCount.mockResolvedValue(3)
-  mockedInvitationCount.mockResolvedValue(1)
+  // 席位口径（审计 🟠 对齐 requireTeamSeats）：membership/invitation 的 count 按
+  // where.seatType 区分——member 池 3 成员 + 0 待接受邀请，guest 池 0 成员 + 1 待接受邀请
+  mockedMemberCount.mockImplementation(async (args?: { where?: { seatType?: string } }) =>
+    args?.where?.seatType === 'guest' ? 0 : 3,
+  )
+  mockedInvitationCount.mockImplementation(async (args?: { where?: { seatType?: string } }) =>
+    args?.where?.seatType === 'guest' ? 1 : 0,
+  )
   mockedAiCount.mockResolvedValue(10)
   mockedWorkspaceCount.mockResolvedValue(1)
   mockedSubFindUnique.mockResolvedValue(null)
@@ -81,16 +87,25 @@ beforeEach(() => {
 })
 
 describe('无订阅（free 缺省态）', () => {
-  it('seats limit 取 free plan maxSeats=5，usage 取当前 team 活跃成员数', async () => {
+  it('seats limit 取 free plan maxSeats=5，usage = member 成员数 + member 待接受邀请数', async () => {
     const snapshots = await getResourceSnapshots(undefined)
     expect(snapshots.seats.limit).toBe(5)
     expect(snapshots.seats.usage).toBe(3)
+    expect(mockedMemberCount).toHaveBeenCalledWith(
+      expect.objectContaining({ where: expect.objectContaining({ seatType: 'member' }) }),
+    )
+    expect(mockedInvitationCount).toHaveBeenCalledWith(
+      expect.objectContaining({ where: expect.objectContaining({ seatType: 'member' }) }),
+    )
   })
 
-  it('guestSeats limit 取 free plan maxGuestSeats=10，usage 取 pending 邀请数', async () => {
+  it('guestSeats limit 取 free plan maxGuestSeats=10，usage = guest 成员数 + guest 待接受邀请数', async () => {
     const snapshots = await getResourceSnapshots(undefined)
     expect(snapshots.guestSeats.limit).toBe(10)
     expect(snapshots.guestSeats.usage).toBe(1)
+    expect(mockedMemberCount).toHaveBeenCalledWith(
+      expect.objectContaining({ where: expect.objectContaining({ seatType: 'guest' }) }),
+    )
   })
 
   it('workspaces：free 限 1 个，usage 取用户拥有的 workspace 数', async () => {
@@ -131,6 +146,16 @@ describe('无订阅（free 缺省态）', () => {
     expect(snapshots.guestSeats.usage).toBe(0)
     expect(snapshots.workspaces.limit).toBe(1)
   })
+
+  it('席位快照按 seatType 过滤（审计 🟠：guest 成员不计入 member 池）', async () => {
+    mockedMemberCount.mockImplementation(async (args?: { where?: { seatType?: string } }) =>
+      args?.where?.seatType === 'guest' ? 2 : 3,
+    )
+    const snapshots = await getResourceSnapshots(undefined)
+    // member 池 = 3 member 成员 + 0 member 邀请；guest 池 = 2 guest 成员 + 1 guest 邀请
+    expect(snapshots.seats.usage).toBe(3)
+    expect(snapshots.guestSeats.usage).toBe(3)
+  })
 })
 
 describe('Pro 订阅（ACTIVE）', () => {