@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/ai-gateway/__tests__/tool-error-sanitize.test.ts

@@ -0,0 +1,119 @@
+// @vitest-environment node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 工具 error 回传清洗回归（审计 ⚪：`error: String(e)` 把原始异常串回给 LLM，
+// 可能携带 Prisma/内部细节——现在只有 ToolValidationError 原样透传）。
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const mocks = vi.hoisted(() => ({
+  doc: { findFirst: vi.fn(), update: vi.fn(), create: vi.fn(), delete: vi.fn(), findMany: vi.fn() },
+  kb: { findFirst: vi.fn() },
+  user: { findUnique: vi.fn() },
+  ragSearch: vi.fn(),
+  resolveKnowledgeAiConfig: vi.fn(async () => ({})),
+  indexDocumentEmbeddings: vi.fn(async () => 1),
+  deleteEmbeddings: vi.fn(async () => undefined),
+  templateFindUnique: vi.fn(),
+}))
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    knowledgeDocument: mocks.doc,
+    knowledgeBase: mocks.kb,
+    user: mocks.user,
+    systemPromptTemplate: { findUnique: mocks.templateFindUnique },
+  },
+}))
+
+vi.mock("../runtime", () => ({
+  getPorts: () => ({
+    infra: {
+      ragSearch: mocks.ragSearch,
+      resolveKnowledgeAiConfig: mocks.resolveKnowledgeAiConfig,
+      indexDocumentEmbeddings: mocks.indexDocumentEmbeddings,
+      deleteEmbeddings: mocks.deleteEmbeddings,
+    },
+  }),
+}))
+
+import "../prompts/builtin"
+
+import { ToolValidationError, toToolErrorMessage } from "../tools/tool-errors"
+import { baseServerTools } from "../tools/server"
+import type { AppContext } from "../types"
+
+const ctx: AppContext = {
+  userId: "u-1",
+  db: undefined as unknown as AppContext["db"],
+}
+
+const runDocumentAction = baseServerTools.find((t) => t.name === "document_action")!
+  .execute as unknown as (
+  input: Record<string, unknown>,
+  opts: { context: AppContext },
+) => Promise<{ success: boolean; error?: string }>
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe("toToolErrorMessage", () => {
+  it("ToolValidationError 原样透传（面向 LLM 的校验消息）", () => {
+    expect(toToolErrorMessage(new ToolValidationError("documentId 不存在或无权限"))).toBe(
+      "documentId 不存在或无权限",
+    )
+  })
+
+  it("未预期异常收敛为简短消息，不泄漏内部细节", () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+    expect(
+      toToolErrorMessage(new Error("Invalid `prisma.knowledgeDocument.update()` invocation:\n{...raw schema...}")),
+    ).toBe("操作失败，请稍后重试")
+    expect(errSpy).toHaveBeenCalledOnce()
+    errSpy.mockRestore()
+  })
+})
+
+describe("document_action catch 清洗", () => {
+  it("prisma update 抛未预期异常 → 通用消息回传，原始细节不进 LLM", async () => {
+    mocks.doc.findFirst.mockResolvedValue({ id: "d-1", kbId: "kb-1" })
+    mocks.doc.update.mockRejectedValue(
+      new Error("Invalid `prisma.knowledgeDocument.update()` invocation: secret-internal-detail"),
+    )
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+
+    const out = await runDocumentAction(
+      { action: "update", documentId: "d-1", title: "x" },
+      { context: ctx },
+    )
+
+    expect(out.success).toBe(false)
+    expect(out.error).toBe("操作失败，请稍后重试")
+    expect(out.error).not.toContain("secret-internal-detail")
+    errSpy.mockRestore()
+  })
+
+  it("归属校验失败（ToolValidationError）→ 原样透传给 LLM", async () => {
+    mocks.doc.findFirst.mockResolvedValue(null)
+    const out = await runDocumentAction(
+      { action: "update", documentId: "d-foreign", title: "x" },
+      { context: ctx },
+    )
+    expect(out).toEqual({ success: false, error: "documentId 不存在或无权限" })
+  })
+})

package/src/server/ai-gateway/__tests__/tools-authorization.test.ts

@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// AI 工具链的资源归属（审计 2026-10-25 🔴 document_action 裸 id 越权 /
+// 🟠 reindex 无属主 / 🟠 knowledge_search 空绑定 fail-open）。
+// 工具 handler 是落库最后一环，不依赖上游 chat-stream-builder 兜底，自查归属。
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const mocks = vi.hoisted(() => ({
+  user: { findUnique: vi.fn() },
+  kb: { findFirst: vi.fn() },
+  doc: { findMany: vi.fn(), findFirst: vi.fn(), create: vi.fn(), update: vi.fn(), delete: vi.fn() },
+  ragSearch: vi.fn(),
+  resolveKnowledgeAiConfig: vi.fn(async () => ({})),
+  indexDocumentEmbeddings: vi.fn(async () => 1),
+  deleteEmbeddings: vi.fn(async () => undefined),
+  templateFindUnique: vi.fn(),
+}))
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    user: mocks.user,
+    knowledgeBase: mocks.kb,
+    knowledgeDocument: mocks.doc,
+    systemPromptTemplate: { findUnique: mocks.templateFindUnique },
+  },
+}))
+
+vi.mock("../runtime", () => ({
+  getPorts: () => ({
+    infra: {
+      ragSearch: mocks.ragSearch,
+      resolveKnowledgeAiConfig: mocks.resolveKnowledgeAiConfig,
+      indexDocumentEmbeddings: mocks.indexDocumentEmbeddings,
+      deleteEmbeddings: mocks.deleteEmbeddings,
+    },
+  }),
+}))
+
+import "../prompts/builtin"
+
+import { baseServerTools, executeKnowledgeSearch } from "../tools/server"
+import type { AppContext } from "../types"
+
+type Executor = (input: Record<string, unknown>, opts: { context: AppContext }) => Promise<unknown>
+const toolExecute = (name: string): Executor => {
+  const tool = baseServerTools.find((t) => t.name === name)
+  if (!tool) throw new Error(`tool ${name} missing`)
+  return tool.execute as unknown as Executor
+}
+
+const USER = "u-1"
+const ctxWith = (knowledgeBaseIds?: string[]): AppContext => ({
+  userId: USER,
+  db: undefined as unknown as AppContext["db"],
+  ...(knowledgeBaseIds !== undefined ? { knowledgeBaseIds } : {}),
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.user.findUnique.mockResolvedValue({ aiApiKey: null, aiProvider: null })
+  mocks.ragSearch.mockResolvedValue([])
+  mocks.doc.findMany.mockResolvedValue([])
+})
+
+describe("knowledge_search 作用域", () => {
+  it("空绑定 + 模型给了 kbId → fail-closed：不检索", async () => {
+    const out = await executeKnowledgeSearch({ query: "q", knowledgeBaseId: "kb-x" }, { context: ctxWith([]) })
+    expect(out).toEqual({ results: [], context: "" })
+    expect(mocks.ragSearch).not.toHaveBeenCalled()
+  })
+
+  it("有绑定 + 模型给了范围外 kbId → 收敛到绑定首项", async () => {
+    await executeKnowledgeSearch({ query: "q", knowledgeBaseId: "kb-x" }, { context: ctxWith(["kb-1", "kb-2"]) })
+    expect(mocks.ragSearch).toHaveBeenCalledTimes(1)
+    expect(mocks.ragSearch.mock.calls[0]![5]).toBe("kb-1")
+  })
+
+  it("无绑定上下文 + kbId 不在当前用户可读范围 → 不检索", async () => {
+    mocks.kb.findFirst.mockResolvedValue(null)
+    const out = await executeKnowledgeSearch({ query: "q", knowledgeBaseId: "kb-foreign" }, { context: ctxWith() })
+    expect(out).toEqual({ results: [], context: "" })
+    expect(mocks.ragSearch).not.toHaveBeenCalled()
+    expect(mocks.kb.findFirst).toHaveBeenCalledWith({
+      where: {
+        id: "kb-foreign",
+        isDeleted: false,
+        OR: [{ userId: USER }, { visibility: { in: ["team", "general"] } }],
+      },
+      select: { id: true },
+    })
+  })
+
+  it("无绑定上下文 + kbId 可读 → 检索该 KB", async () => {
+    mocks.kb.findFirst.mockResolvedValue({ id: "kb-team" })
+    await executeKnowledgeSearch({ query: "q", knowledgeBaseId: "kb-team" }, { context: ctxWith() })
+    expect(mocks.ragSearch).toHaveBeenCalledTimes(1)
+    expect(mocks.ragSearch.mock.calls[0]![5]).toBe("kb-team")
+  })
+})
+
+describe("document_action 归属", () => {
+  const run = toolExecute("document_action")
+
+  it("create：kbId 非本人所有 → 拒绝，不写入", async () => {
+    mocks.kb.findFirst.mockResolvedValue(null)
+    const out = await run({ action: "create", knowledgeBaseId: "kb-foreign", title: "t" }, { context: ctxWith() })
+    expect(out).toEqual({ success: false, error: "knowledgeBaseId 不存在或无权限" })
+    expect(mocks.doc.create).not.toHaveBeenCalled()
+    expect(mocks.kb.findFirst).toHaveBeenCalledWith({
+      where: { id: "kb-foreign", userId: USER, isDeleted: false },
+      select: { id: true },
+    })
+  })
+
+  it("create：线程有绑定时 kbId 必须在绑定内", async () => {
+    const out = await run({ action: "create", knowledgeBaseId: "kb-9", title: "t" }, { context: ctxWith(["kb-1"]) })
+    expect(out).toMatchObject({ success: false, error: expect.stringContaining("绑定") })
+    expect(mocks.kb.findFirst).not.toHaveBeenCalled()
+    expect(mocks.doc.create).not.toHaveBeenCalled()
+  })
+
+  it("create：parentId 不属于同一 KB → 拒绝", async () => {
+    mocks.kb.findFirst.mockResolvedValue({ id: "kb-1" })
+    mocks.doc.findFirst.mockResolvedValue(null)
+    const out = await run(
+      { action: "create", knowledgeBaseId: "kb-1", parentId: "doc-foreign", title: "t" },
+      { context: ctxWith(["kb-1"]) },
+    )
+    expect(out).toMatchObject({ success: false, error: expect.stringContaining("parentId") })
+    expect(mocks.doc.create).not.toHaveBeenCalled()
+  })
+
+  it("create：属主 + 绑定内 → 写入并带 createdBy", async () => {
+    mocks.kb.findFirst.mockResolvedValue({ id: "kb-1" })
+    mocks.doc.create.mockResolvedValue({ id: "d-new", kbId: "kb-1", title: "t", content: "" })
+    const out = await run({ action: "create", knowledgeBaseId: "kb-1", title: "t" }, { context: ctxWith(["kb-1"]) })
+    expect(out).toEqual({ success: true, documentId: "d-new" })
+    expect(mocks.doc.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({ kbId: "kb-1", createdBy: USER }),
+    })
+  })
+
+  it("update：文档 KB 非本人所有 → 拒绝，不更新", async () => {
+    mocks.doc.findFirst.mockResolvedValue(null)
+    const out = await run({ action: "update", documentId: "d-foreign", title: "x" }, { context: ctxWith() })
+    expect(out).toEqual({ success: false, error: "documentId 不存在或无权限" })
+    expect(mocks.doc.update).not.toHaveBeenCalled()
+    expect(mocks.doc.findFirst).toHaveBeenCalledWith({
+      where: { id: "d-foreign", isDeleted: false, kb: { userId: USER, isDeleted: false } },
+      select: { id: true, kbId: true },
+    })
+  })
+
+  it("delete：文档 KB 非本人所有 → 拒绝，不删除、不删向量", async () => {
+    mocks.doc.findFirst.mockResolvedValue(null)
+    const out = await run({ action: "delete", documentId: "d-foreign" }, { context: ctxWith() })
+    expect(out).toEqual({ success: false, error: "documentId 不存在或无权限" })
+    expect(mocks.doc.delete).not.toHaveBeenCalled()
+    expect(mocks.deleteEmbeddings).not.toHaveBeenCalled()
+  })
+
+  it("delete：本人文档但不在线程绑定 KB 内 → 拒绝", async () => {
+    mocks.doc.findFirst.mockResolvedValue({ id: "d-1", kbId: "kb-2" })
+    const out = await run({ action: "delete", documentId: "d-1" }, { context: ctxWith(["kb-1"]) })
+    expect(out).toMatchObject({ success: false, error: expect.stringContaining("绑定") })
+    expect(mocks.doc.delete).not.toHaveBeenCalled()
+  })
+
+  it("delete：属主 → 删除并清向量", async () => {
+    mocks.doc.findFirst.mockResolvedValue({ id: "d-1", kbId: "kb-1" })
+    mocks.doc.delete.mockResolvedValue({})
+    const out = await run({ action: "delete", documentId: "d-1" }, { context: ctxWith(["kb-1"]) })
+    expect(out).toEqual({ success: true, documentId: "d-1" })
+    expect(mocks.doc.delete).toHaveBeenCalledWith({ where: { id: "d-1" } })
+    expect(mocks.deleteEmbeddings).toHaveBeenCalledWith("knowledge_embeddings", "documentId", "d-1")
+  })
+})
+
+describe("reindex_knowledge_base 归属", () => {
+  const run = toolExecute("reindex_knowledge_base")
+
+  it("非属主 KB → 抛错，不清空向量", async () => {
+    mocks.kb.findFirst.mockResolvedValue(null)
+    await expect(run({ knowledgeBaseId: "kb-foreign" }, { context: ctxWith() })).rejects.toThrow("无权限")
+    expect(mocks.deleteEmbeddings).not.toHaveBeenCalled()
+    expect(mocks.doc.findMany).not.toHaveBeenCalled()
+  })
+
+  it("属主 → 清空后逐文档重建", async () => {
+    mocks.kb.findFirst.mockResolvedValue({ id: "kb-1" })
+    mocks.doc.findMany.mockResolvedValue([{ id: "d-1", title: "t", content: "c", kbId: "kb-1" }])
+    const out = await run({ knowledgeBaseId: "kb-1" }, { context: ctxWith() })
+    expect(out).toEqual({ indexed: 1, documentCount: 1 })
+    expect(mocks.deleteEmbeddings).toHaveBeenCalledWith("knowledge_embeddings", "kbId", "kb-1")
+  })
+})

package/src/server/ai-gateway/adapter.ts

@@ -32,11 +32,19 @@ import { prisma } from "@allbluecn/database"
 import type { AiConfig } from "./types"
 import { getPorts } from "./runtime"
 import { envApiKey, ENV_OPENAI_API_KEY, ENV_OPENROUTER_API_KEY } from "./env-key"
+import { assertFetchableUrl, isDesktopRuntime } from "@/server/fetch-guard"
 
 const PLACEHOLDER_KEYS = new Set(["sk-your-api-key-here", "", "sk-or-your-api-key-here"])
 
+// 条目含明文 apiKey：读取时惰性过期 + 容量上限，避免过期密钥长期滞留内存
 const configCache = new Map<string, { data: AiConfig; at: number }>()
 const CACHE_TTL = 30_000
+const CONFIG_CACHE_MAX_ENTRIES = 500
+
+/** 用户更新/删除 API Key 后由调用方失效缓存（30s TTL 之外的一致性手段） */
+export function invalidateAiConfigCache(userId: string): void {
+  configCache.delete(userId)
+}
 
 function isValidKey(key: string | null | undefined): key is string {
   return !!key && !PLACEHOLDER_KEYS.has(key)
@@ -66,6 +74,8 @@ export async function resolveAiConfig(userId?: string): Promise<AiConfig | null>
   if (userId) {
     const cached = configCache.get(userId)
     if (cached && Date.now() - cached.at < CACHE_TTL) return cached.data
+    // 过期条目（含明文 apiKey）即刻清除，而非等下一次 set 覆盖
+    if (cached) configCache.delete(userId)
 
     const dbUser = await prisma.user.findUnique({
       where: { id: userId },
@@ -78,6 +88,11 @@ export async function resolveAiConfig(userId?: string): Promise<AiConfig | null>
         model: dbUser.aiModel || "openai/gpt-4o-mini",
         source: "user",
       }
+      if (configCache.size >= CONFIG_CACHE_MAX_ENTRIES) {
+        // 简易 FIFO 淘汰（Map 迭代序即插入序），防止键空间随用户数无界增长
+        const oldest = configCache.keys().next().value
+        if (oldest !== undefined) configCache.delete(oldest)
+      }
       configCache.set(userId, { data: config, at: Date.now() })
       return config
     }
@@ -107,6 +122,8 @@ export async function hasAiKey(userId?: string): Promise<boolean> {
 }
 
 export function createAdapter(config: AiConfig) {
+  // 不做 SSRF 出口校验：AiConfig.baseUrl 仅来自 env AI_BASE_URL（resolveAiConfig
+  // 的用户 DB 路径不落 baseUrl），属运维配置而非用户可控输入，不构成 SSRF 面。
   return createOpenRouterText(
     config.model as Parameters<typeof createOpenRouterText>[0],
     config.apiKey,
@@ -139,6 +156,21 @@ export async function createProviderAdapter(
   const baseUrl = opts.baseUrl || provider.defaultBaseUrl || undefined
   const kind = provider.adapterKind
 
+  // SEC-08：baseUrl 出口校验（与 connectivity-check 对齐）。resolved baseUrl 是
+  // 用户可控 URL——AiProviderConfig.baseUrl 为用户配置，custom provider 的
+  // defaultBaseUrl 同样由任意登录用户经 createCustomProviderFn 写入（isLocal
+  // 恒 false）。服务端将以该 URL 为目标 fetch 并携带用户 apiKey，必须拦私网/
+  // 回环/链路本地/云元数据。放行口径：桌面端单机形态（本地 Ollama）恒放行私网；
+  // 云端仅当命中种子 isLocal provider（唯一为固定 defaultBaseUrl=localhost:11434
+  // 的 Ollama 预设，用户无法改写，与 providers.ts「本地部署无需校验」的既有
+  // 产品语义对齐）且用户未自行覆盖 baseUrl 时放行。
+  if (baseUrl) {
+    assertFetchableUrl(baseUrl, {
+      allowPrivate:
+        isDesktopRuntime() || (provider.isLocal === true && !opts.baseUrl),
+    })
+  }
+
   let adapter: AnyTextAdapter
   switch (kind) {
     case "openai":
@@ -323,13 +355,7 @@ export async function runChatWithModel(
     outputSchema?: SchemaInput
   },
 ): Promise<string> {
-  const stream = await runChatStream(messages, {
-    ...options,
-    model: options.model,
-  })
-  if (options.outputSchema) {
-    return await streamToStructuredText(stream)
-  }
-  // 1.0 起 streamToText 返回 ChatResult { text, chunks }，取拼接文本。
-  return (await streamToText(stream)).text
+  // 与 runChat 完全同构（options spread 本就携带 model），委托避免两份
+  // streamToStructuredText 分支漂移；保留具名导出维持既有调用方契约。
+  return runChat(messages, options)
 }

package/src/server/ai-gateway/chat-handler.ts

@@ -27,7 +27,7 @@ import { hasNativeWebSearch } from "./provider-tools"
 import { assertSandboxEntitled } from "./sandbox/entitlement"
 import { fenceLlmData } from "./llm-fence"
 import { scheduleLazyReap } from "./durability/reaper-lazy"
-import { isSearxngEnabled } from "@/server/serverFns/web-search"
+import { isSearxngEnabled } from "@/server/web-search"
 import {
   type ResolvedPromptSection,
   PromptKeyNotFoundError,
@@ -59,27 +59,25 @@ async function assertKbOwnership(
 ): Promise<string[]> {
   if (knowledgeBaseIds.length === 0) return knowledgeBaseIds
 
-  // 查询用户可直接访问的 KB（自有 + 工作空间共享）
-  const [ownedKbIds, workspaceKbIds] = await Promise.all([
-    prisma.knowledgeBase
-      .findMany({
-        where: { userId, isDeleted: false },
-        select: { id: true },
-      })
-      .then((rows) => rows.map((r) => r.id)),
-    prisma.workspaceKnowledgeBase
-      .findMany({
-        where: {
-          workspace: {
-            members: { some: { userId, status: "active" } },
-          },
+  // 反向校验（审计 2026-10-25 ⚪）：只查入参命中的 KB（查询量与入参成正比），
+  // 不再全量拉用户 KB + 全部工作空间共享 KB。命中任一来源（自有 / 工作空间共享）即可访问。
+  const [ownedRows, sharedRows] = await Promise.all([
+    prisma.knowledgeBase.findMany({
+      where: { id: { in: knowledgeBaseIds }, userId, isDeleted: false },
+      select: { id: true },
+    }),
+    prisma.workspaceKnowledgeBase.findMany({
+      where: {
+        kbId: { in: knowledgeBaseIds },
+        workspace: {
+          members: { some: { userId, status: "active" } },
         },
-        select: { kbId: true },
-      })
-      .then((rows) => rows.map((r) => r.kbId)),
+      },
+      select: { kbId: true },
+    }),
   ])
 
-  const accessible = new Set([...ownedKbIds, ...workspaceKbIds])
+  const accessible = new Set([...ownedRows.map((r) => r.id), ...sharedRows.map((r) => r.kbId)])
   const filtered = knowledgeBaseIds.filter((id) => accessible.has(id))
   const dropped = knowledgeBaseIds.filter((id) => !accessible.has(id))
 
@@ -248,7 +246,9 @@ const attachmentSchema = z.union([
     type: z.literal("image"),
     source: z.object({
       type: z.literal("data"),
-      value: z.string().min(1),
+      // data URL 上限 ≈ 8MB 二进制（base64 膨胀 4/3 后约 12M 字符），
+      // 防单条附件把请求体/内存/持久化打成 DoS 面；更大文件走 blob ref 上传链
+      value: z.string().min(1).max(12_000_000),
       mimeType: z.string().min(1).max(200),
     }),
   }),
@@ -260,35 +260,55 @@ const attachmentSchema = z.union([
   }),
 ])
 
+// messages 最小形状校验（审计 2026-10-25 🟠：z.any() 属校验缺位）。role 之外的
+// 字段（parts/metadata/id 等）不做收紧——形态随 TanStack AI 契约演进，passthrough
+// 原样透传给 chat()；条数与单条序列化体积设上限，防低成本内存/token DoS。
+const CHAT_MAX_MESSAGES = 200
+const CHAT_MAX_MESSAGE_JSON_CHARS = 131_072 // 128KB / 条
+const chatMessageSchema = z
+  .object({
+    role: z.string().min(1).max(40),
+  })
+  .passthrough()
+const chatMessagesSchema = z
+  .array(chatMessageSchema)
+  .max(CHAT_MAX_MESSAGES)
+  .refine(
+    (msgs) =>
+      msgs.every((m) => JSON.stringify(m).length <= CHAT_MAX_MESSAGE_JSON_CHARS),
+    { message: `单条消息超过 ${CHAT_MAX_MESSAGE_JSON_CHARS} 字符上限` },
+  )
+
 export const chatBodySchema = z.object({
-  messages: z.array(z.any()).default([]),
-  allowedTools: z.array(z.string()).default([]),
-  knowledgeBaseIds: z.array(z.string()).default([]),
+  messages: chatMessagesSchema.default([]),
+  allowedTools: z.array(z.string()).max(50).default([]),
+  knowledgeBaseIds: z.array(z.string()).max(50).default([]),
   temperature: z.number().optional(),
   webSearchEnabled: z.boolean().default(true),
   /** 编排模式开关（客户端 UI）。服务端 env 未开或沙箱探测失败时静默回落，不会报错。 */
   codeModeEnabled: z.boolean().default(false),
   /** 沙箱执行开关（客户端 UI）。需 threadId 在场才装配；服务端无 provider 配置时抛错。 */
   sandbox: z.boolean().default(false),
-  model: z.string().optional(),
+  model: z.string().max(200).optional(),
   /** 客户端选中模型的 adapterKind（BYOK 档用于定位 x-byok-<kind> header） */
-  provider: z.string().optional(),
-   workspaceId: z.string().optional(),
+  provider: z.string().max(100).optional(),
+   workspaceId: z.string().max(100).optional(),
     workspaceContext: z.union([
-      z.object({ type: z.literal("github"), owner: z.string(), repo: z.string(), defaultBranch: z.string() }),
-      z.object({ type: z.literal("local"), path: z.string() }),
-      z.object({ type: z.literal("cloud"), workspaceId: z.string() }),
+      z.object({ type: z.literal("github"), owner: z.string().max(200), repo: z.string().max(200), defaultBranch: z.string().max(200) }),
+      z.object({ type: z.literal("local"), path: z.string().max(1000) }),
+      z.object({ type: z.literal("cloud"), workspaceId: z.string().max(100) }),
     ]).optional(),
-   threadId: z.string().min(1).optional(),
-  runId: z.string().optional(),
-  parentRunId: z.string().optional(),
-  resume: z.array(z.any()).optional(),
-  promptKey: z.string().optional(),
+   threadId: z.string().min(1).max(200).optional(),
+  runId: z.string().max(200).optional(),
+  parentRunId: z.string().max(200).optional(),
+  // resume 为 durable run 重放载荷（chunk 数组）：限条数，单条体积随 chunk 契约
+  resume: z.array(z.unknown()).max(100).optional(),
+  promptKey: z.string().max(200).optional(),
   /**
    * 附件列表：图片走 dataURL parts，非图片走服务端 BlobStore ref。
    * fail-closed：未知 type 直接解析失败；blob ref 归属校验由消费方按 userId 兜底。
    */
-  attachments: z.array(attachmentSchema).default([]),
+  attachments: z.array(attachmentSchema).max(10).default([]),
   /**
    * 当前页面路径（全局侧边栏上报）。只接收 pathname，板块名与文案由服务端拼装；
    * 非法形状在 buildPageContext 内丢弃并告警，绝不进入系统提示词。
@@ -298,21 +318,24 @@ export const chatBodySchema = z.object({
     .optional(),
 })
 
-function extractText(msg: {
-  content?: unknown
-  parts?: unknown
-}): string {
-  if (typeof msg.content === "string") return msg.content
-  if (Array.isArray(msg.content)) {
-    return msg.content
+// 入参保持 unknown 宽容：调用方传入 zod passthrough 解析后的消息对象，
+// 字段存在性由内部守卫判断
+function extractText(msg: unknown): string {
+  const m = (typeof msg === "object" && msg !== null ? msg : {}) as {
+    content?: unknown
+    parts?: unknown
+  }
+  if (typeof m.content === "string") return m.content
+  if (Array.isArray(m.content)) {
+    return m.content
       .filter(
         (p: any) => p?.type === "text" && typeof p?.content === "string",
       )
       .map((p: any) => p.content as string)
       .join("")
   }
-  if (Array.isArray(msg.parts)) {
-    return msg.parts
+  if (Array.isArray(m.parts)) {
+    return m.parts
       .filter(
         (p: any) => p?.type === "text" && typeof p?.content === "string",
       )
@@ -389,9 +412,12 @@ export async function* handleChatRequest(
 
   const raw = await (options?.body ?? request.json())
   const body = { ...raw, ...(raw.forwardedProps ?? {}) }
+  // 服务端 overrides 最后落笔（审计 2026-10-25 🟠，原顺序 body 在后展开会把服务端
+  // 值覆盖掉）：allowedTools / knowledgeBaseIds / temperature 是 serverFn/agent 侧
+  // 下发的服务端约束，客户端 body 不得放宽——否则 agent 收紧的工具白名单被击穿。
   const parsed = chatBodySchema.safeParse({
-    ...mergeChatOverrides(options?.overrides),
     ...body,
+    ...mergeChatOverrides(options?.overrides),
   })
   if (!parsed.success) {
     const issue = parsed.error.issues[0]
@@ -552,7 +578,8 @@ async function* forwardToSaas(
       Authorization: `Bearer ${route.token}`,
     },
     body: JSON.stringify(fwdBody),
-    signal: request.signal,
+    // 客户端断开 + 120s 墙钟双闸：SaaS 端挂起且客户端不断开时连接不再无限悬挂
+    signal: AbortSignal.any([request.signal, AbortSignal.timeout(120_000)]),
   })
   if (!res.ok || !res.body) {
     throw new Error(`SaaS 托管 AI 转发失败: ${res.status}`)
@@ -560,6 +587,7 @@ async function* forwardToSaas(
 
   const decoder = new TextDecoder()
   let buffer = ''
+  let malformedFrames = 0
 
   const reader = res.body.getReader()
   try {
@@ -578,11 +606,18 @@ async function* forwardToSaas(
         try {
           yield JSON.parse(raw) as StreamChunk
         } catch {
+          // 坏帧计数而非纯静默（审计 2026-10-25 🟡）：代理转发丢 chunk 需可观测
+          malformedFrames += 1
           continue
         }
       }
     }
   } finally {
     reader.releaseLock()
+    if (malformedFrames > 0) {
+      console.warn(
+        `[AI] forwardToSaas: ${malformedFrames} 个 SSE 帧解析失败被丢弃（saas=${route.saasUrl}）`,
+      )
+    }
   }
 }