@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/serverFns/__tests__/story-types.test.ts

@@ -17,19 +17,18 @@
 
 
 // story 类型工具纯函数覆盖补全：castStoryUsers / castStoryUsersLight / castUserBrief /
-// toActivityItem / aggregateReactions / toValidDate / buildStoryTree /
+// toActivityItem / aggregateReactions / toValidDate /
 // checkDescendant。纯函数无 serverFn，仅 mock Prisma。关键断言：null 安全、空数组
 // 短路、树构建深度与后代判定边界。
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const M = vi.hoisted(() => ({
-  storyCount: vi.fn(),
   storyFindUnique: vi.fn(),
   storyFindMany: vi.fn(),
 }));
 
 vi.mock("@allbluecn/database", () => ({
-  prisma: { story: { count: M.storyCount, findUnique: M.storyFindUnique, findMany: M.storyFindMany } },
+  prisma: { story: { findUnique: M.storyFindUnique, findMany: M.storyFindMany } },
   Prisma: {},
 }));
 
@@ -39,7 +38,6 @@ import {
   ACTIVITY_SELECT,
   USER_BRIEF_SELECT,
   aggregateReactions,
-  buildStoryTree,
   castStoryUsers,
   castStoryUsersLight,
   castUserBrief,
@@ -218,49 +216,6 @@ describe("toValidDate", () => {
   });
 });
 
-describe("buildStoryTree", () => {
-  it("递归构建节点并逐级 depth+1，count 查询按 parentId 下钻", async () => {
-    M.storyCount.mockImplementation(({ where }: { where: { parentId: string } }) => {
-      const counts: Record<string, number> = { "st-1": 2, "st-2": 1 };
-      return Promise.resolve(counts[where.parentId] ?? 0);
-    });
-
-    const res = await buildStoryTree({
-      id: "st-1",
-      name: "根",
-      state: "todo",
-      parentId: null,
-      children: [
-        { id: "st-2", name: "子1", state: "backlog", parentId: "st-1", children: [
-          { id: "st-4", name: "孙1", state: "backlog", parentId: "st-2", children: [] },
-        ] },
-        { id: "st-3", name: "子2", state: "backlog", parentId: "st-1", children: [] },
-      ],
-    });
-
-    expect(res).toMatchObject({ id: "st-1", title: "根", status: "todo", depth: 0, childrenCount: 2, hasChildren: true });
-    expect(res.children).toBeDefined();
-    const children = res.children ?? [];
-    expect(children).toHaveLength(2);
-    expect(children[0]).toMatchObject({ id: "st-2", depth: 1, childrenCount: 1, hasChildren: true });
-    expect(children[0]?.children).toHaveLength(1);
-    expect(children[0]?.children?.[0]).toMatchObject({ id: "st-4", depth: 2, childrenCount: 0, hasChildren: false });
-    expect(children[1]).toMatchObject({ id: "st-3", depth: 1, childrenCount: 0, hasChildren: false });
-    expect(M.storyCount).toHaveBeenCalledWith({ where: { parentId: "st-1" } });
-  });
-
-  it("无 children 字段时不返回 children 键", async () => {
-    M.storyCount.mockResolvedValue(0);
-    const res = await buildStoryTree({ id: "st-9", name: "叶子", state: "done", parentId: null });
-    expect(res).toEqual({
-      id: "st-9", title: "叶子", status: "done", parentId: null,
-      depth: 0, hasChildren: false, childrenCount: 0,
-    });
-    // children 字段存在但值为 undefined（三元表达式显式赋值）
-    expect(res.children).toBeUndefined();
-  });
-});
-
 describe("checkDescendant", () => {
   // DB-01 两轮 findMany 形状：第一轮端点行，第二轮按端点项目批量取 id→parentId 图
   const mockChain = (chain: Record<string, string | null>, projectByStory: Record<string, string | null> = {}) => {
@@ -289,10 +244,11 @@ describe("checkDescendant", () => {
       where: { id: { in: ["st-1", "st-3"] } },
       select: { id: true, parentId: true, projectId: true },
     });
-    // 第二轮：项目内 id→parentId 图（窄投影）
+    // 第二轮：项目内 id→parentId 图（窄投影；take 上限防大项目整表入内存，审计 🟡）
     expect(M.storyFindMany).toHaveBeenCalledWith({
       where: { projectId: { in: ["pr-1"] } },
       select: { id: true, parentId: true },
+      take: 50_000,
     });
     // 不再有逐级 findUnique 爬链
     expect(M.storyFindUnique).not.toHaveBeenCalled();

package/src/server/serverFns/__tests__/update-page-guard.test.ts

@@ -71,6 +71,8 @@ vi.mock("@allbluecn/database/get-prisma", () => ({
 }));
 vi.mock("@allbluecn/kernel", () => ({
   getServerSeam: () => ({ requireAuth: H.fns.requireAuth }),
+  // database 主入口（pages.ts 的 Prisma 值导入连带加载）模块顶层注册 seam，mock 须提供
+  registerPrismaSeam: () => {},
 }));
 vi.mock("@/server/collab/write-guard", () => ({
   withCollabGuard: H.fns.withCollabGuard,

package/src/server/serverFns/__tests__/workspace-kb.test.ts

@@ -178,6 +178,7 @@ describe("listWorkspaceAvailableKbsFn", () => {
 describe("setWorkspaceKbsFn", () => {
   it("非 team 库拒绝且不写库", async () => {
     mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wkbFindMany.mockResolvedValue([]); // 本空间无已关联库
     mocks.kbFindMany.mockResolvedValue([{ id: "kb1" }]); // 请求 2 个只查回 1 个
     await expect(
       setWorkspaceKbsFn({ data: { workspaceId: "ws1", kbIds: ["kb1", "kb2"] } }),
@@ -185,8 +186,29 @@ describe("setWorkspaceKbsFn", () => {
     expect(mocks.transaction).not.toHaveBeenCalled();
   });
 
+  it("他人 team 库（未关联本空间）拒绝（审计 🟠：校验与候选口径一致，防凭 id 挂他人库）", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wkbFindMany.mockResolvedValue([]);
+    // OR: [已关联 ∪ 本人 team 库] 过滤后查不到他人库
+    mocks.kbFindMany.mockResolvedValue([]);
+    await expect(
+      setWorkspaceKbsFn({ data: { workspaceId: "ws1", kbIds: ["kb-other"] } }),
+    ).rejects.toThrow("团队可见");
+    expect(mocks.transaction).not.toHaveBeenCalled();
+    expect(mocks.kbFindMany).toHaveBeenCalledWith({
+      where: {
+        id: { in: ["kb-other"] },
+        visibility: "team",
+        isDeleted: false,
+        OR: [{ id: { in: [] } }, { userId: "u1" }],
+      },
+      select: { id: true },
+    });
+  });
+
   it("全量同步：删差集 + 增新增", async () => {
     mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wkbFindMany.mockResolvedValue([]);
     mocks.kbFindMany.mockResolvedValue([{ id: "kb1" }, { id: "kb2" }]);
     await setWorkspaceKbsFn({ data: { workspaceId: "ws1", kbIds: ["kb1", "kb2"] } });
     expect(mocks.wkbDeleteMany).toHaveBeenCalledWith({
@@ -246,7 +268,8 @@ describe("addQuickDocsFn", () => {
       { columnIndex: 0, sortOrder: 1 },
       { columnIndex: 1, sortOrder: 0 },
     ]);
-    // 存在性改为一次 findMany in 预取（只有 d2 存在）
+    // 存在性改为一次 findMany in 预取（只有 d2 存在）；范围限定本人 team 库
+    mocks.kbFindMany.mockResolvedValue([{ id: "kb1" }]);
     mocks.docFindMany.mockResolvedValue([{ id: "d2" }]);
     mocks.wqdCreateMany.mockResolvedValue({ count: 1 });
     const res = await addQuickDocsFn({
@@ -260,9 +283,14 @@ describe("addQuickDocsFn", () => {
     });
     expect(res.failed).toEqual([{ key: "d1", reason: "outOfScope" }]);
     expect(res.created).toEqual(["d2"]);
-    // 批量形状契约：一次 in 查询预取存在性（全部 docId 参与）+ 一次 createMany（只含有效行，落到 col2）
+    // 批量形状契约：一次 in 查询预取存在性（全部 docId 参与，kb 范围对齐候选侧
+    // listUserTeamKbIds——审计 🟠）+ 一次 createMany（只含有效行，落到 col2）
+    expect(mocks.kbFindMany).toHaveBeenCalledWith({
+      where: { visibility: "team", isDeleted: false, userId: "u1" },
+      select: { id: true },
+    });
     expect(mocks.docFindMany).toHaveBeenCalledWith({
-      where: { id: { in: ["d1", "d2"] }, isDeleted: false },
+      where: { id: { in: ["d1", "d2"] }, isDeleted: false, kb: { id: { in: ["kb1"] } } },
       select: { id: true },
     });
     expect(mocks.wqdCreateMany).toHaveBeenCalledTimes(1);
@@ -283,6 +311,38 @@ describe("addQuickDocsFn", () => {
     });
     expect(res.failed).toEqual([{ key: "ext:summary:s1", reason: "outOfScope" }]);
   });
+
+  it("通用组条目须属本人可见范围（审计 🟠：他人条目 outOfScope，本人收藏放行）", async () => {
+    mocks.wsFindUnique.mockResolvedValue(MEMBER_WS);
+    mocks.wqdFindMany.mockResolvedValue([]);
+    // 归属口径下推 DB（对齐 searchGeneralGroupDocs）：本人创建 ∪ 本人收藏
+    mocks.articleFavoriteFindMany.mockResolvedValue([{ entityId: "x9" }]);
+    mocks.legalFindMany.mockResolvedValue([{ id: "x9" }]);
+    mocks.wqdCreateMany.mockResolvedValue({ count: 1 });
+    const res = await addQuickDocsFn({
+      data: {
+        workspaceId: "ws1",
+        items: [
+          { externalGroup: "legal", externalId: "x1", displayTitle: "他人条目" },
+          { externalGroup: "legal", externalId: "x9", displayTitle: "收藏条目" },
+        ],
+      },
+    });
+    expect(mocks.articleFavoriteFindMany).toHaveBeenCalledWith({
+      where: { entityType: "legal", userId: "u1" },
+      select: { entityId: true },
+    });
+    expect(mocks.legalFindMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({
+          isDeleted: false,
+          OR: [{ userId: "u1" }, { id: { in: ["x9"] } }],
+        }),
+      }),
+    );
+    expect(res.failed).toEqual([{ key: "ext:legal:x1", reason: "outOfScope" }]);
+    expect(res.created).toEqual(["ext:legal:x9"]);
+  });
 });
 
 describe("renameQuickDocFn", () => {

package/src/server/serverFns/__tests__/workspace.test.ts

@@ -159,6 +159,7 @@ vi.mock("@allbluecn/database", () => ({
         },
         story: {
           deleteMany: mocks.storyDeleteMany,
+          findMany: mocks.storyFindMany,
         },
         knowledgeBase: {
           create: mocks.knowledgeBaseCreate,
@@ -429,7 +430,7 @@ describe("deleteWorkspaceFn", () => {
       where: { project: { workspaceId: "ws1" } },
       select: { id: true },
     });
-    expect(mocks.migrateStories).toHaveBeenCalledWith("u1", ["s1", "s2"]);
+    expect(mocks.migrateStories).toHaveBeenCalledWith("u1", ["s1", "s2"], expect.anything());
     expect(mocks.storyDeleteMany).not.toHaveBeenCalled();
     expect(mocks.projectDeleteMany).toHaveBeenCalledWith({
       where: { workspaceId: "ws1" },

package/src/server/serverFns/activity.ts

@@ -19,8 +19,9 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { requireAuth } from '@/server/auth-helpers'
-import { startOfDay, startOfMonth, subMonths, eachDayOfInterval } from 'date-fns'
+import { addDays, startOfDay, startOfMonth, subMonths, eachDayOfInterval } from 'date-fns'
 import { formatInTimeZone, toZonedTime, fromZonedTime } from 'date-fns-tz'
+import { z } from 'zod'
 
 export type ActivityData = {
   date: string
@@ -50,17 +51,33 @@ function startOfMonthInTimeZone(date: Date, timezone: string): Date {
   return fromZonedTime(monthStart, timezone)
 }
 
+/** 校验 IANA 时区名；非法/不支持一律回落默认时区，避免 toZonedTime 抛 RangeError 500 */
+function normalizeTimeZone(timezone: string | undefined): string {
+  if (!timezone) return FALLBACK_TIMEZONE
+  try {
+    new Intl.DateTimeFormat('en-US', { timeZone: timezone })
+    return timezone
+  } catch {
+    return FALLBACK_TIMEZONE
+  }
+}
+
+const activityQuerySchema = z.object({
+  timezone: z.string().max(64).optional(),
+})
+
 export const getActivityDataFn = createServerFn({ method: 'GET' })
-  .validator((data: { timezone?: string }) => data)
+  .validator(activityQuerySchema)
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const userId = session.user!.id!
-    const timezone = data.timezone || FALLBACK_TIMEZONE
+    const userId = session.user.id
+    const timezone = normalizeTimeZone(data.timezone)
 
     const now = new Date()
     const todayStart = startOfDayInTimeZone(now, timezone)
+    const tomorrowStart = startOfDayInTimeZone(addDays(now, 1), timezone)
     const rangeStart = startOfMonthInTimeZone(subMonths(now, 11), timezone)
 
     const dateRange = eachDayOfInterval({ start: rangeStart, end: todayStart })
@@ -72,23 +89,23 @@ export const getActivityDataFn = createServerFn({ method: 'GET' })
 
     const [prds, comments, loginLogs, chatThreads, knowledgeDocs] = await Promise.all([
       prisma.design.findMany({
-        where: { userId, createdAt: { gte: rangeStart, lte: todayStart } },
+        where: { userId, createdAt: { gte: rangeStart, lt: tomorrowStart } },
         select: { createdAt: true },
       }),
       prisma.comment.findMany({
-        where: { userId, createdAt: { gte: rangeStart, lte: todayStart } },
+        where: { userId, createdAt: { gte: rangeStart, lt: tomorrowStart } },
         select: { createdAt: true },
       }),
       prisma.loginLog.findMany({
-        where: { userId, createdAt: { gte: rangeStart, lte: todayStart } },
+        where: { userId, createdAt: { gte: rangeStart, lt: tomorrowStart } },
         select: { createdAt: true },
       }),
       prisma.chatThread.findMany({
-        where: { userId, createdAt: { gte: rangeStart, lte: todayStart } },
+        where: { userId, createdAt: { gte: rangeStart, lt: tomorrowStart } },
         select: { createdAt: true },
       }),
       prisma.knowledgeDocument.findMany({
-        where: { createdBy: userId, createdAt: { gte: rangeStart, lte: todayStart } },
+        where: { createdBy: userId, createdAt: { gte: rangeStart, lt: tomorrowStart } },
         select: { createdAt: true },
       }),
     ])

package/src/server/serverFns/agents/agent-crud.ts

@@ -20,18 +20,9 @@ import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { AGENT_TOOL_KEYS } from "@/server/ai-gateway/tools"
-import { getCurrentSession } from "@/lib/session"
 import { requireFeature } from "@/server/entitlements"
 import { requireResource } from "@/server/resources"
-
-type SessionUser = { id?: string }
-type Session = { user?: SessionUser | null }
-
-async function requireSessionUser(request: Request | undefined): Promise<string> {
-  const session = await getCurrentSession(request)
-  if (!session?.user?.id) throw new Error("未登录")
-  return session.user.id
-}
+import { requireUserId } from "@/server/auth-helpers"
 
 const agentInputSchema = z.object({
   name: z.string().min(1).max(64),
@@ -46,19 +37,25 @@ const agentInputSchema = z.object({
   knowledgeBaseIds: z.array(z.string()).optional(),
 })
 
-type AgentInput = z.infer<typeof agentInputSchema>
-
-export const listAgentsFn = createServerFn({ method: "GET" }).handler(async () => {
-    const prisma = await getPrisma()
-  const request = getRequest()
-  const userId = await requireSessionUser(request)
-
-  const agents = await prisma.userAgent.findMany({
-    where: { userId, isDeleted: false },
-    orderBy: { updatedAt: "desc" },
-  })
+type AgentRow = {
+  id: string
+  name: string
+  description: string | null
+  avatarEmoji: string | null
+  systemPrompt: string
+  allowedTools: unknown
+  model: string | null
+  temperature: number | null
+  greeting: string | null
+  suggestedPrompts: unknown
+  knowledgeBaseIds: unknown
+  isDefault: boolean
+  createdAt: Date
+  updatedAt: Date
+}
 
-  return agents.map((a) => ({
+function toAgentDTO(a: AgentRow) {
+  return {
     id: a.id,
     name: a.name,
     description: a.description,
@@ -73,7 +70,38 @@ export const listAgentsFn = createServerFn({ method: "GET" }).handler(async () =
     isDefault: a.isDefault,
     createdAt: a.createdAt,
     updatedAt: a.updatedAt,
-  }))
+  }
+}
+
+const AGENT_DTO_SELECT = {
+  id: true,
+  name: true,
+  description: true,
+  avatarEmoji: true,
+  systemPrompt: true,
+  allowedTools: true,
+  model: true,
+  temperature: true,
+  greeting: true,
+  suggestedPrompts: true,
+  knowledgeBaseIds: true,
+  isDefault: true,
+  createdAt: true,
+  updatedAt: true,
+} as const
+
+export const listAgentsFn = createServerFn({ method: "GET" }).handler(async () => {
+    const prisma = await getPrisma()
+  const request = getRequest()
+  const userId = await requireUserId(request)
+
+  const agents = await prisma.userAgent.findMany({
+    where: { userId, isDeleted: false },
+    orderBy: { updatedAt: "desc" },
+    select: AGENT_DTO_SELECT,
+  })
+
+  return agents.map(toAgentDTO)
 })
 
 export const createAgentFn = createServerFn({ method: "POST" })
@@ -81,7 +109,7 @@ export const createAgentFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     await requireFeature(request, "customAgents")
     await requireResource(request, "agentQuota", 1)
@@ -100,24 +128,10 @@ export const createAgentFn = createServerFn({ method: "POST" })
         suggestedPrompts: data.suggestedPrompts,
         knowledgeBaseIds: data.knowledgeBaseIds ?? [],
       },
+      select: AGENT_DTO_SELECT,
     })
 
-    return {
-      id: agent.id,
-      name: agent.name,
-      description: agent.description,
-      avatarEmoji: agent.avatarEmoji,
-      systemPrompt: agent.systemPrompt,
-      allowedTools: agent.allowedTools as string[],
-      model: agent.model,
-      temperature: agent.temperature,
-      greeting: agent.greeting,
-      suggestedPrompts: agent.suggestedPrompts as string[] | null,
-      knowledgeBaseIds: agent.knowledgeBaseIds as string[],
-      isDefault: agent.isDefault,
-      createdAt: agent.createdAt,
-      updatedAt: agent.updatedAt,
-    }
+    return toAgentDTO(agent)
   })
 
 const getAgentSchema = z.object({ id: z.string() })
@@ -127,29 +141,15 @@ export const getAgentFn = createServerFn({ method: "GET" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     const agent = await prisma.userAgent.findFirst({
       where: { id: data.id, userId, isDeleted: false },
+      select: AGENT_DTO_SELECT,
     })
     if (!agent) return null
 
-    return {
-      id: agent.id,
-      name: agent.name,
-      description: agent.description,
-      avatarEmoji: agent.avatarEmoji,
-      systemPrompt: agent.systemPrompt,
-      allowedTools: agent.allowedTools as string[],
-      model: agent.model,
-      temperature: agent.temperature,
-      greeting: agent.greeting,
-      suggestedPrompts: agent.suggestedPrompts as string[] | null,
-      knowledgeBaseIds: agent.knowledgeBaseIds as string[],
-      isDefault: agent.isDefault,
-      createdAt: agent.createdAt,
-      updatedAt: agent.updatedAt,
-    }
+    return toAgentDTO(agent)
   })
 
 const agentUpdateSchema = z.object({
@@ -196,12 +196,12 @@ export const updateAgentFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     // DB-03：属主校验合并进写入（updateMany 计数判定），1 次查询替代 2 次
     const update = buildAgentUpdatePayload(data)
     const res = await prisma.userAgent.updateMany({
-      where: { id: data.id, userId },
+      where: { id: data.id, userId, isDeleted: false },
       data: update,
     })
     if (res.count === 0) {
@@ -218,11 +218,11 @@ export const deleteAgentFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
     // DB-03：属主校验合并进写入（updateMany 计数判定）
     const res = await prisma.userAgent.updateMany({
-      where: { id: data.id, userId },
+      where: { id: data.id, userId, isDeleted: false },
       data: { isDeleted: true },
     })
     if (res.count === 0) {

package/src/server/serverFns/agents/bindings.ts

@@ -2,24 +2,16 @@ import { getPrisma } from "@allbluecn/database/get-prisma"
 import { createServerFn } from "@tanstack/react-start"
 import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
-import { getCurrentSession } from "@/lib/session"
 import { BIZ_AGENT_KEYS } from "@/server/ai-gateway/runs/biz-keys"
 import { resolveSystemPrompt } from "@/server/ai-gateway/prompts/registry"
-
-type Session = { user?: { id?: string } | null }
-
-async function requireSessionUser(request: Request | undefined): Promise<string> {
-  const session = await getCurrentSession(request)
-  if (!session?.user?.id) throw new Error("未登录")
-  return session.user.id
-}
+import { requireUserId } from "@/server/auth-helpers"
 
 const bizKeySchema = z.enum(BIZ_AGENT_KEYS)
 
 export const listBindingsFn = createServerFn({ method: "GET" }).handler(async () => {
     const prisma = await getPrisma()
   const request = getRequest()
-  const userId = await requireSessionUser(request)
+  const userId = await requireUserId(request)
 
   const rows = await prisma.businessAgentBinding.findMany({
     where: { userId },
@@ -54,8 +46,8 @@ export const upsertBindingFn = createServerFn({ method: "POST" })
   .validator(upsertBindingSchema)
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
-    const request = getRequest()
-    const userId = await requireSessionUser(request)
+  const request = getRequest()
+  const userId = await requireUserId(request)
 
     if (data.agentId === null) {
       await prisma.businessAgentBinding.deleteMany({
@@ -84,9 +76,10 @@ export const setDefaultAgentFn = createServerFn({ method: "POST" })
   .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest()
-    const userId = await requireSessionUser(request)
+    const userId = await requireUserId(request)
 
-    if (data.agentId === null) {
+    const agentId = data.agentId
+    if (agentId === null) {
       await prisma.userAgent.updateMany({
         where: { userId, isDefault: true },
         data: { isDefault: false },
@@ -94,21 +87,27 @@ export const setDefaultAgentFn = createServerFn({ method: "POST" })
       return { ok: true }
     }
 
-    await prisma.$transaction([
-      prisma.userAgent.updateMany({
+    // 交互式事务：agent 不属于本用户/不存在/已软删时抛错回滚，
+    // 避免「默认标记已清空但新默认未设置」的静默成功
+    await prisma.$transaction(async (tx) => {
+      await tx.userAgent.updateMany({
         where: { userId, isDefault: true },
         data: { isDefault: false },
-      }),
-      prisma.userAgent.updateMany({
-        where: { id: data.agentId, userId, isDeleted: false },
+      })
+      const res = await tx.userAgent.updateMany({
+        where: { id: agentId, userId, isDeleted: false },
         data: { isDefault: true },
-      }),
-    ])
+      })
+      if (res.count === 0) {
+        throw new Error("未找到该智能体")
+      }
+    })
     return { ok: true }
   })
 
+// 登录后智能体表单使用的内置 persona 提示词摘要（内容非机密，但端点仅面向已登录用户）
 export const getPersonaHintFn = createServerFn({ method: "GET" }).handler(async () => {
-    const prisma = await getPrisma()
+  await requireUserId(getRequest())
   const sections = await resolveSystemPrompt("harness.agent-persona", {})
   return { hint: sections[0] ?? "" }
 })