@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/sso/tokens.ts

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
+import { isSafeRelativeRedirect } from '@/lib/login-redirect'
 
 const DEFAULT_TTL_MS = 60_000
 
@@ -46,20 +47,31 @@ export function signSsoState(
   nonce: string,
   ttlMs: number = DEFAULT_TTL_MS,
 ): string {
+  // 开放重定向防线（2026-10 审计 🟠）：约束收敛在签发侧——仅允许站内相对
+  // 路径（isSafeRelativeRedirect，与 lib/login-redirect.ts 同一白名单口径，
+  // 含 `//` 与 `/\` 协议相对拒绝）。绝对 URL / 外域一律签发期抛错，Pro 侧
+  // 调用方应先经 resolveLoginCallbackUrl 归一化再传入。
+  if (!isSafeRelativeRedirect(returnUrl)) {
+    throw new Error(`[SSO] returnUrl 必须是站内相对路径：${returnUrl}`)
+  }
   const payload = `sso-state|${providerId}|${returnUrl}|${nonce}|${Date.now() + ttlMs}`
   return `${Buffer.from(payload, 'utf8').toString('base64url')}.${sign(payload)}`
 }
 
 export function verifySsoState(
   state: string,
-): { providerId: string; returnUrl: string } | null {
+): { providerId: string; returnUrl: string; nonce: string } | null {
   const payload = verify(state)
   if (!payload) return null
   const parts = payload.split('|')
   if (parts.length !== 5 || parts[0] !== 'sso-state') return null
-  const [, providerId, returnUrl, , expStr] = parts
+  const [, providerId, returnUrl, nonce, expStr] = parts
   if (Number(expStr) < Date.now()) return null
-  return { providerId, returnUrl }
+  // 纵深防御（审计 🟠）：历史遗留的含外域 returnUrl 的 state 一律拒绝
+  if (!isSafeRelativeRedirect(returnUrl)) return null
+  // nonce 随验签结果返回（审计 🟡）：一次性消费须由调用方落库仲裁（本模块
+  // 无状态，不持 nonce 存储）；调用方在完成 OAuth 交换后按 nonce 去重。
+  return { providerId, returnUrl, nonce }
 }
 
 export function signSsoToken(

package/src/server/story/permissions.ts

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 需求域「资源 → 项目 → 成员」守卫单一来源（审计 2026-10-25：story 域十余个 GET serverFn 仅
+// requireAuth 无成员校验，而同文件写路径均有；assertStoryProjectMember 在 5 个文件各持一份副本）。
+// 仅服务端；serverFn 文件只 import 不定义。
+
+import { getPrisma } from "@allbluecn/database/get-prisma";
+import { assertProjectMembership } from "@/server/lib/project-membership";
+
+export const STORY_FORBIDDEN_MESSAGE = "无权限操作该项目的需求";
+
+export function assertStoryProjectMembership(projectId: string, userId: string): Promise<void> {
+  return assertProjectMembership(projectId, userId, STORY_FORBIDDEN_MESSAGE);
+}
+
+/** 反查需求所属项目并校验成员资格；返回 projectId 供调用方复用（免二次反查） */
+export async function assertStoryProjectMember(storyId: string, userId: string): Promise<string> {
+  const prisma = await getPrisma();
+  const story = await prisma.story.findUnique({
+    where: { id: storyId },
+    select: { projectId: true },
+  });
+  if (!story) throw new Error("需求不存在");
+  await assertStoryProjectMembership(story.projectId, userId);
+  return story.projectId;
+}
+
+/** 批量：一组需求所属的每个项目都须为有效成员（依赖边可能跨项目） */
+export async function assertStoriesProjectMember(storyIds: readonly string[], userId: string): Promise<void> {
+  const unique = Array.from(new Set(storyIds));
+  if (unique.length === 0) return;
+  const prisma = await getPrisma();
+  const rows = await prisma.story.findMany({
+    where: { id: { in: unique } },
+    select: { projectId: true },
+  });
+  // 不存在的 id 不在此抛错（与原各文件副本语义一致，后续写入自会因 FK/找不到行失败）
+  for (const projectId of new Set(rows.map((r) => r.projectId))) {
+    await assertStoryProjectMembership(projectId, userId);
+  }
+}

package/src/server/story/types.ts

@@ -205,39 +205,6 @@ export function toValidDate(value: string): Date | null {
   return isNaN(d.getTime()) ? null : d;
 }
 
-export interface StoryTreeNode {
-  id: string;
-  title: string;
-  status: string;
-  parentId: string | null;
-  depth: number;
-  hasChildren: boolean;
-  childrenCount: number;
-  children?: StoryTreeNode[];
-}
-
-export async function buildStoryTree(story: any, depth = 0): Promise<StoryTreeNode> {
-  const prisma = await getPrisma()
-  const childrenCount = await prisma.story.count({
-    where: { parentId: story.id },
-  });
-
-  return {
-    id: story.id,
-    title: story.name,
-    status: story.state,
-    parentId: story.parentId,
-    depth,
-    hasChildren: childrenCount > 0,
-    childrenCount,
-    children: story.children
-      ? await Promise.all(
-          story.children.map((child: any) => buildStoryTree(child, depth + 1)),
-        )
-      : undefined,
-  };
-}
-
 /**
  * 判断 ancestorId 是否为 descendantId 的祖先（沿 parentId 向上爬链）。
  *
@@ -250,6 +217,12 @@ export async function buildStoryTree(story: any, depth = 0): Promise<StoryTreeNo
  * findUnique 补齐，命中判定与原实现一致。
  */
 const CHECK_DESCENDANT_MAX_DEPTH = 20;
+/**
+ * 第二轮全量拉取的行数上限（2026-10 审计 🟡）：大项目（数万 story）整表入内存建图。
+ * 超限截断后内存图缺节点——爬链遇到缺节点自动回退逐级 findUnique（既有兜底路径），
+ * 命中判定不变，仅超大项目退回 O(depth) 查询。
+ */
+const CHECK_DESCENDANT_MAX_ROWS = 50_000;
 
 export async function checkDescendant(
   ancestorId: string,
@@ -271,6 +244,7 @@ export async function checkDescendant(
     const rows = await prisma.story.findMany({
       where: { projectId: { in: projectIds } },
       select: { id: true, parentId: true },
+      take: CHECK_DESCENDANT_MAX_ROWS,
     });
     for (const row of rows) parentById.set(row.id, row.parentId);
   }

package/src/server/team-access.ts

@@ -6,11 +6,8 @@ export async function isUserInTeam(ownerId: string, userId: string): Promise<boo
   return m?.ownerId === ownerId
 }
 
-export const USER_BRIEF_SELECT = {
-  id: true,
-  username: true,
-  email: true,
-  avatarConfig: true,
-  bgShape: true,
-  bgColor: true,
-} as const
+// 用户摘要 select 单一来源收敛（2026-10 审计 🔵）：原与 story/types.ts 各持一份
+// 同字段字面量（id/username/email/avatarConfig/bgShape/bgColor），re-export 防两处漂移。
+// ⚠ 注意与 @/server/lib/user-brief 的区别：那是最小披露变体（不含 email，审计 🟠），
+// 本 select 含 email 是 team/collab-presence 等域的既有返回契约，合并口径待产品决策。
+export { USER_BRIEF_SELECT } from '@/server/story/types'

package/src/server/testcase/__tests__/auto-bug.test.ts

@@ -656,9 +656,10 @@ describe("指纹 P2002 回退", () => {
 
 describe("triage → auto-bug 接线", () => {
   function chainFx() {
-    // 第一次 findUnique（triage 读）与第二次（auto-bug 读）同形；execRun 首次无
-    // triage（队列守卫）→ AI 归因 → persist 后 auto-bug 重读带 triage（mock 链）
+    // execRun 读链：① triage 入口读（无 triage，队列守卫通过）→ AI 归因 →
+    // ② persistTriage 事务内 fresh 重读（审计 🟡，仍无 triage）→ ③ auto-bug 重读带 triage
     DB.execRunFindUnique
+      .mockResolvedValueOnce({ id: "er-1", report: { perStep: [] } })
       .mockResolvedValueOnce({ id: "er-1", report: { perStep: [] } })
       .mockResolvedValue(triagedReportRow());
     M.runChatAsAgent.mockResolvedValue(JSON.stringify(TRIAGE_VERDICT));
@@ -682,6 +683,8 @@ describe("triage → auto-bug 接线", () => {
 
   it("env_issue 归因不触发起草（不进 bug 链）", async () => {
     DB.execRunFindUnique
+      .mockResolvedValueOnce({ id: "er-1", report: { perStep: [] } })
+      // ② persistAndFlipToBlocked 事务内 fresh 重读（审计 🟡）：仍无 triage 才落账
       .mockResolvedValueOnce({ id: "er-1", report: { perStep: [] } })
       .mockResolvedValue({
         id: "er-1",

package/src/server/testcase/__tests__/automation-rerun.test.ts

@@ -156,6 +156,9 @@ const specResult = (over: Record<string, unknown> = {}) => ({
 
 beforeEach(() => {
   vi.clearAllMocks();
+  // 回环守卫（审计 🟠）env 隔离：targetEnv 缺省回落 localhost:3000（回环），
+  // 单测默认走 AI_BROWSER_ALLOW_LOOPBACK=true 逃生门，守卫行为单独用例钉死
+  process.env.AI_BROWSER_ALLOW_LOOPBACK = "true";
   DB.runFindUnique.mockResolvedValue(runRow());
   DB.runCaseFindMany.mockResolvedValue([runCaseRow()]);
   DB.artifactFindMany.mockResolvedValue([artifactRow()]);
@@ -172,6 +175,21 @@ beforeEach(() => {
 });
 
 describe("runAutomationRerun", () => {
+  it("回环守卫：targetEnv 缺省回落 localhost 且未显式放行 → 全例 blocked（不误报断言，审计 🟠）", async () => {
+    delete process.env.AI_BROWSER_ALLOW_LOOPBACK;
+    delete process.env.TESTCASE_E2E_BASE_URL;
+    DB.runFindUnique.mockResolvedValue(runRow({ targetEnv: null }));
+
+    const out = await runAutomationRerun({ runId: "run-1", projectId: P, userId: U, targetEnv: null });
+
+    expect(M.runVitestSpec).not.toHaveBeenCalled();
+    expect(M.runPlaywrightSpec).not.toHaveBeenCalled();
+    expect(out.executed).toBe(1);
+    const update = DB.runCaseUpdate.mock.calls[0][0] as { data: { status: string; actualResult: string } };
+    expect(update.data.status).toBe("blocked");
+    expect(update.data.actualResult).toContain("回环");
+  });
+
   it("e2e 产物走 runPlaywrightSpec（targetEnv URL 作 baseUrl）：RunCase passed + TestExecRun(mode=code) 来源标记 + 同事务 update", async () => {
     DB.runFindUnique.mockResolvedValue(runRow({ targetEnv: "http://staging.example.com" }));
 

package/src/server/testcase/__tests__/builtin-executor.test.ts

@@ -31,7 +31,8 @@
 //    fail→failed / uncertain→retest（RunCase 终态恒置写入）。
 // 4) provider 守卫（简报钉死）：resolveSandboxProvider 为 vercel 时禁用内置执行器
 //    （BuiltinExecutorUnavailableError，提示走外部 MCP agent），零 DB 写零浏览器启动。
-// 5) 网络白名单（browser-policy）：targetEnv 域（含子域）+ localhost 放行，其余
+// 5) 网络白名单（browser-policy）：targetEnv 域（含子域）放行；回环仅 desktop /
+//    显式 AI_BROWSER_ALLOW_LOOPBACK=true 放行（云端默认拒绝，SSRF 收口），其余
 //    route.abort 拦截并记录（networkLog 素材）；非 http(s) scheme 一律拒绝。
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
@@ -519,13 +520,26 @@ describe("testexec bizKey 与 testcase.exec prompt 接线", () => {
 });
 
 describe("browser-policy 网络白名单", () => {
-  it("isUrlAllowedByPolicy：targetEnv 域（含子域）与 localhost 放行，其余拦截", () => {
+  it("isUrlAllowedByPolicy：targetEnv 域（含子域）放行；回环仅显式 allowLoopback（desktop 形态）放行", () => {
     expect(isUrlAllowedByPolicy(`${TARGET_ENV}/login`, TARGET_ENV).allowed).toBe(true);
     expect(isUrlAllowedByPolicy("https://api.staging.example.com/v1", TARGET_ENV).allowed).toBe(
       true,
     );
-    expect(isUrlAllowedByPolicy("http://localhost:3000/api/auth", TARGET_ENV).allowed).toBe(true);
-    expect(isUrlAllowedByPolicy("http://127.0.0.1:3000/x", TARGET_ENV).allowed).toBe(true);
+    // 回环放行（desktop / 显式 AI_BROWSER_ALLOW_LOOPBACK=true 形态）
+    expect(
+      isUrlAllowedByPolicy("http://localhost:3000/api/auth", TARGET_ENV, { allowLoopback: true })
+        .allowed,
+    ).toBe(true);
+    expect(
+      isUrlAllowedByPolicy("http://127.0.0.1:3000/x", TARGET_ENV, { allowLoopback: true }).allowed,
+    ).toBe(true);
+    // 127.0.0.0/8 段与 0.0.0.0 同属回环（allowLoopback 时放行）
+    expect(
+      isUrlAllowedByPolicy("http://127.1.2.3:3000/x", TARGET_ENV, { allowLoopback: true }).allowed,
+    ).toBe(true);
+    expect(
+      isUrlAllowedByPolicy("http://0.0.0.0:3000/x", TARGET_ENV, { allowLoopback: true }).allowed,
+    ).toBe(true);
     // 裸 host 形态的 targetEnv（环境标识即域名）
     expect(isUrlAllowedByPolicy("https://staging.example.com/x", "staging.example.com").allowed).toBe(
       true,
@@ -537,9 +551,32 @@ describe("browser-policy 网络白名单", () => {
     );
     expect(isUrlAllowedByPolicy("ftp://staging.example.com/file", TARGET_ENV).allowed).toBe(false);
     expect(isUrlAllowedByPolicy("not a url", TARGET_ENV).allowed).toBe(false);
-    // targetEnv 为空 → 仅 localhost 放行
+    // targetEnv 为空 → 仅显式回环放行
     expect(isUrlAllowedByPolicy("https://staging.example.com/x", "").allowed).toBe(false);
-    expect(isUrlAllowedByPolicy("http://localhost:3000/x", "").allowed).toBe(true);
+    expect(
+      isUrlAllowedByPolicy("http://localhost:3000/x", "", { allowLoopback: true }).allowed,
+    ).toBe(true);
+  });
+
+  it("isUrlAllowedByPolicy：云端/自托管默认拒绝回环（SSRF 收口，审计 A3x-2）", () => {
+    // 缺省（DEPLOY_TARGET 未设 = 云端/自托管）且未显式开启时，回环一律拒绝
+    delete process.env.DEPLOY_TARGET;
+    delete process.env.AI_BROWSER_ALLOW_LOOPBACK;
+    for (const url of [
+      "http://localhost:3000/api/auth",
+      "http://127.0.0.1:3000/x",
+      "http://0.0.0.0/x",
+    ]) {
+      expect(isUrlAllowedByPolicy(url, TARGET_ENV).allowed).toBe(false);
+    }
+    // 显式逃生门：AI_BROWSER_ALLOW_LOOPBACK=true（自托管本机冒烟）
+    process.env.AI_BROWSER_ALLOW_LOOPBACK = "true";
+    expect(isUrlAllowedByPolicy("http://localhost:3000/x", TARGET_ENV).allowed).toBe(true);
+    delete process.env.AI_BROWSER_ALLOW_LOOPBACK;
+    // desktop 部署形态恒放行（用户自担）
+    process.env.DEPLOY_TARGET = "desktop";
+    expect(isUrlAllowedByPolicy("http://127.0.0.1:3000/x", TARGET_ENV).allowed).toBe(true);
+    delete process.env.DEPLOY_TARGET;
   });
 
   it("applyBrowserNetworkPolicy：page.route(\"**/*\") 全量拦截，放行 continue / 其余 abort+记录", async () => {

package/src/server/testcase/__tests__/list-query.test.ts

@@ -183,6 +183,17 @@ describe("buildListWhere filters 翻译（五字段）", () => {
     expect(where.AND).toEqual([{ OR: [{ assigneeId: null }, { assigneeId: { in: ["u2"] } }] }]);
   });
 
+  it("assigneeId is_not 混合 __none__ 与具体用户 → 非空且 notIn（审计 🟡：反选不得重新包含未指派）", () => {
+    const where = buildListWhere({
+      archived: false,
+      projectIds: ["p1"],
+      filters: JSON.stringify([{ property: "assigneeId", operator: "is_not", value: "__none__,u2" }]),
+    });
+    expect(where.AND).toEqual([
+      { AND: [{ assigneeId: { not: null } }, { assigneeId: { notIn: ["u2"] } }] },
+    ]);
+  });
+
   it("assigneeId is_empty / is_not_empty → null / not null", () => {
     const empty = buildListWhere({
       archived: false,

package/src/server/testcase/__tests__/run-summary.test.ts

@@ -116,9 +116,15 @@ const fakeTx = (overrides: {
   startedAt?: Date | null;
   runStatus?: string;
   update?: ReturnType<typeof vi.fn>;
+  updateMany?: ReturnType<typeof vi.fn>;
 }) => {
   const update = overrides.update ?? vi.fn();
+  // updateMany arbiter（审计 🟡）：默认仲裁命中（count=1），arbiter 落空用例单独注入
+  const updateMany =
+    overrides.updateMany ??
+    vi.fn().mockResolvedValue({ count: 1 });
   const tx = {
+    $queryRaw: vi.fn().mockResolvedValue([]),
     testRunCase: {
       findMany: vi.fn().mockResolvedValue(overrides.statuses),
     },
@@ -128,9 +134,10 @@ const fakeTx = (overrides: {
         startedAt: overrides.startedAt ?? null,
       }),
       update,
+      updateMany,
     },
   };
-  return { tx: tx as unknown as Prisma.TransactionClient, update };
+  return { tx: tx as unknown as Prisma.TransactionClient, update, updateMany };
 };
 
 describe("finalizeRunIfComplete（任务 15/24 共享落账入口）", () => {
@@ -138,7 +145,7 @@ describe("finalizeRunIfComplete（任务 15/24 共享落账入口）", () => {
   const startedAt = new Date("2026-01-01T00:30:00Z");
 
   it("全部终态 → run completed + summary 各计数正确（含 durationMs）", async () => {
-    const { tx, update } = fakeTx({
+    const { tx, updateMany } = fakeTx({
       // 五终态全集各一 + passed 再两条（untested 属初始非终态，余留即不落账——下一用例钉）
       statuses: [{ status: "passed" }, { status: "passed" }, { status: "failed" }, { status: "blocked" }, { status: "skipped" }, { status: "retest" }],
       startedAt,
@@ -150,9 +157,11 @@ describe("finalizeRunIfComplete（任务 15/24 共享落账入口）", () => {
       where: { runId: "run-1" },
       select: { status: true },
     });
-    expect(update).toHaveBeenCalledTimes(1);
-    expect(update).toHaveBeenCalledWith({
-      where: { id: "run-1" },
+    expect(tx.$queryRaw).toHaveBeenCalled();
+    expect(updateMany).toHaveBeenCalledTimes(1);
+    expect(updateMany).toHaveBeenCalledWith({
+      // arbiter 条件更新：仅 running 可落账（并发双过判定时 count=0 方放弃）
+      where: { id: "run-1", status: "running" },
       data: {
         status: "completed",
         summary: {
@@ -181,17 +190,17 @@ describe("finalizeRunIfComplete（任务 15/24 共享落账入口）", () => {
   });
 
   it("余留 untested → 返回 null 且零写入（调用方 no-op）", async () => {
-    const { tx, update } = fakeTx({ statuses: [{ status: "passed" }, { status: "untested" }] });
+    const { tx, updateMany } = fakeTx({ statuses: [{ status: "passed" }, { status: "untested" }] });
 
     const out = await finalizeRunIfComplete(tx, "run-1", completedAt);
 
     expect(out).toBeNull();
-    expect(update).not.toHaveBeenCalled();
+    expect(updateMany).not.toHaveBeenCalled();
     expect(tx.testRun.findUnique).not.toHaveBeenCalled();
   });
 
   it("aborted run 的 RunCase 全终态 → 不覆盖 aborted（运行态守卫，零写入）", async () => {
-    const { tx, update } = fakeTx({
+    const { tx, updateMany } = fakeTx({
       // 任务 15 abort 语义把余例置 skipped：全终态成立，但 run 已 aborted
       statuses: [{ status: "passed" }, { status: "skipped" }],
       runStatus: "aborted",
@@ -201,32 +210,55 @@ describe("finalizeRunIfComplete（任务 15/24 共享落账入口）", () => {
     const out = await finalizeRunIfComplete(tx, "run-1", completedAt);
 
     expect(out).toBeNull();
-    expect(update).not.toHaveBeenCalled();
+    expect(updateMany).not.toHaveBeenCalled();
   });
 
   it("run 不存在 → 返回 null 且零写入", async () => {
-    const { tx, update } = fakeTx({ statuses: [{ status: "passed" }] });
+    const { tx, updateMany } = fakeTx({ statuses: [{ status: "passed" }] });
     (tx.testRun.findUnique as ReturnType<typeof vi.fn>).mockResolvedValue(null);
 
     const out = await finalizeRunIfComplete(tx, "run-404", completedAt);
 
     expect(out).toBeNull();
-    expect(update).not.toHaveBeenCalled();
+    expect(updateMany).not.toHaveBeenCalled();
   });
 
   it("空 RunCase 集 → null 零写入", async () => {
-    const { tx, update } = fakeTx({ statuses: [] });
+    const { tx, updateMany } = fakeTx({ statuses: [] });
 
     expect(await finalizeRunIfComplete(tx, "run-1", completedAt)).toBeNull();
-    expect(update).not.toHaveBeenCalled();
+    expect(updateMany).not.toHaveBeenCalled();
   });
 
   it("startedAt 缺失 → durationMs=null 仍完成落账", async () => {
-    const { tx, update } = fakeTx({ statuses: [{ status: "passed" }], startedAt: null });
+    const { tx, updateMany } = fakeTx({ statuses: [{ status: "passed" }], startedAt: null });
 
     const summary = await finalizeRunIfComplete(tx, "run-1", completedAt);
 
     expect(summary).toMatchObject({ total: 1, passed: 1, passRate: 1, durationMs: null });
-    expect(update).toHaveBeenCalledTimes(1);
+    expect(updateMany).toHaveBeenCalledTimes(1);
+  });
+
+  it("arbiter 落空（并发已落账）→ 返回 null 零覆盖", async () => {
+    const { tx, updateMany } = fakeTx({
+      statuses: [{ status: "passed" }],
+      startedAt,
+      updateMany: vi.fn().mockResolvedValue({ count: 0 }),
+    });
+
+    const out = await finalizeRunIfComplete(tx, "run-1", completedAt);
+
+    expect(out).toBeNull();
+    expect(updateMany).toHaveBeenCalledTimes(1);
+  });
+
+  it("FOR UPDATE 行锁失败（sqlite/fake tx）→ 降级无锁判定照常落账", async () => {
+    const { tx, updateMany } = fakeTx({ statuses: [{ status: "passed" }], startedAt });
+    (tx.$queryRaw as ReturnType<typeof vi.fn>).mockRejectedValue(new Error("near \"FOR\": syntax error"));
+
+    const summary = await finalizeRunIfComplete(tx, "run-1", completedAt);
+
+    expect(summary).toMatchObject({ total: 1, passed: 1 });
+    expect(updateMany).toHaveBeenCalledTimes(1);
   });
 });

package/src/server/testcase/__tests__/sandbox-runner.test.ts

@@ -115,6 +115,9 @@ beforeEach(() => {
   vi.clearAllMocks();
   M.blobPut.mockResolvedValue({ id: "blob-1" });
   M.readSpecFile.mockResolvedValue(SPEC_CONTENT);
+  // 降级门（审计 🟠）env 隔离：默认未显式允许、非 desktop，单测逐用例显式开启
+  delete process.env.TESTCASE_ALLOW_LOCAL_SANDBOX;
+  delete process.env.DEPLOY_TARGET;
 });
 
 describe("runVitestSpec", () => {
@@ -288,7 +291,8 @@ describe("provider 守卫与降级（同任务 27 口径）", () => {
     }
   });
 
-  it("resolveSandboxProvider 抛错（未配置沙箱）→ 降级 local-process 直建 + degraded 标记", async () => {
+  it("resolveSandboxProvider 抛错 + TESTCASE_ALLOW_LOCAL_SANDBOX=true → 降级 local-process 直建 + degraded 标记", async () => {
+    process.env.TESTCASE_ALLOW_LOCAL_SANDBOX = "true";
     const { handle } = mockProvider("local-process", { degraded: true });
     handle.process.exec.mockResolvedValue({
       stdout: VITEST_JSON,
@@ -304,6 +308,28 @@ describe("provider 守卫与降级（同任务 27 口径）", () => {
     expect(r.provider).toBe("local-process");
     expect(r.passed).toBe(3);
   });
+
+  it("resolveSandboxProvider 抛错 + 未显式允许 → fail-closed SpecRunnerUnavailableError（不落宿主直执）", async () => {
+    mockProvider("local-process", { degraded: true });
+
+    await expect(runVitestSpec(SPEC_PATH)).rejects.toBeInstanceOf(SpecRunnerUnavailableError);
+    expect(M.localProcessSandbox).not.toHaveBeenCalled();
+  });
+
+  it("resolveSandboxProvider 抛错 + DEPLOY_TARGET=desktop（单机自担）→ 允许降级", async () => {
+    process.env.DEPLOY_TARGET = "desktop";
+    const { handle } = mockProvider("local-process", { degraded: true });
+    handle.process.exec.mockResolvedValue({
+      stdout: VITEST_JSON,
+      stderr: "",
+      exitCode: 0,
+    });
+
+    const r = await runVitestSpec(SPEC_PATH);
+
+    expect(M.localProcessSandbox).toHaveBeenCalledTimes(1);
+    expect(r.degraded).toBe(true);
+  });
 });
 
 describe("超时 kill 与日志治理", () => {

package/src/server/testcase/__tests__/triage.test.ts

@@ -233,6 +233,23 @@ describe("triageFailedRunCase 归因成功", () => {
     expect(result?.blocked).toBe(false);
   });
 
+  it("落账前并发已归因（fresh 重读见 triage）→ null 零写入（审计 🟡 竞态收窄）", async () => {
+    // 入口守卫读到的 report 无 triage（通过），LLM 归因期间并发方已落账——
+    // persistTriage 事务内 fresh 重读命中 triage → 放弃
+    DB.execRunFindUnique
+      .mockResolvedValueOnce(
+        execRunRow({ finalVerdict: "fail", consoleLog: ["Error: request failed"] }),
+      )
+      .mockResolvedValue(
+        execRunRow({ finalVerdict: "fail", triage: { category: "unknown", evidence: [], confidence: 0 } }),
+      );
+
+    const result = await triageFailedRunCase("rc-1");
+
+    expect(result).toBeNull();
+    expect(DB.execRunUpdate).not.toHaveBeenCalled();
+  });
+
   it("证据分段配额：console 刷屏时 perStep observed 仍保留（总量有界不尾切）", async () => {
     const bigLog = Array.from({ length: 100 }, (_, i) => `E${i}: ${"x".repeat(400)}`);
     DB.execRunFindUnique.mockResolvedValue(

package/src/server/testcase/auto-bug.ts

@@ -129,7 +129,9 @@ function extractCaseSeqToken(identifier: string | null | undefined): string {
 
 function buildTitle(seqToken: string, snapshotTitle: string, category: ExecutionFailureCategory): string {
   const full = `[${seqToken}] ${snapshotTitle} · ${TEST_BUG_CATEGORY_LABEL[category]}`;
-  return full.length > TITLE_MAX_LENGTH ? full.slice(0, TITLE_MAX_LENGTH) : full;
+  // 码点安全截断（2026-10 审计 ⚪：slice 按码元截断会把 emoji/代理对截半）
+  if (full.length <= TITLE_MAX_LENGTH) return full;
+  return [...full].slice(0, TITLE_MAX_LENGTH).join("");
 }
 
 /** description：归因证据 + 失败步截图 blob 引用（存储形状同 parseStoryDescription 兜底契约） */
@@ -266,7 +268,6 @@ export async function autoBugForTrialedRunCase(runCaseId: string): Promise<AutoB
       category: category as ExecutionFailureCategory,
       evidence,
       fingerprint,
-      firstFailedOrder,
     });
   } catch (error: unknown) {
     const detail = error instanceof Error ? error.message.replace(/\s+/g, " ") : String(error ?? "");
@@ -304,7 +305,6 @@ interface DraftContext {
   category: ExecutionFailureCategory;
   evidence: string[];
   fingerprint: string;
-  firstFailedOrder: number;
 }
 
 /** 未命中起草：事务（腾挪指纹→发号→建单→活动→RunCase 回写）+ 提交后通知/webhook */
@@ -326,6 +326,8 @@ async function draftBug(
     steps?: { steps?: Array<{ order?: unknown; action?: unknown; expected?: unknown }> } | null;
   };
   const snapshotSteps = Array.isArray(snapshot.steps?.steps) ? snapshot.steps!.steps! : [];
+  // joinFailedActuals 取值复用（2026-10 审计 🟢：原连续调用两次重复拼接）
+  const failedActuals = joinFailedActuals(runCase.stepResults);
   const reproduceSteps = {
     steps: snapshotSteps
       .filter(
@@ -337,9 +339,7 @@ async function draftBug(
         action: step.action,
         ...(step.expected !== undefined ? { expected: step.expected } : {}),
       })),
-    ...(joinFailedActuals(runCase.stepResults)
-      ? { actualResult: joinFailedActuals(runCase.stepResults) }
-      : {}),
+    ...(failedActuals ? { actualResult: failedActuals } : {}),
   };
   const seqToken = extractCaseSeqToken(runCase.case?.identifier);
   const snapshotTitle = typeof snapshot.title === "string" ? snapshot.title : "（未命名用例）";