@allbluecn/web-app 0.21.0 → 0.22.0

package/src/server/resources.ts

@@ -39,6 +39,8 @@ const PLAN_LIMIT_SELECT = {
   sandboxMinutesMonthly: true,
   mediaGenerationsMonthly: true,
   galleryStorageMb: true,
+  installQuota: true,
+  blobStorageMb: true,
 } as const
 
 interface PlanLimits {
@@ -51,6 +53,8 @@ interface PlanLimits {
   sandboxMinutesMonthly: number | null
   mediaGenerationsMonthly: number | null
   galleryStorageMb: number | null
+  installQuota: number | null
+  blobStorageMb: number | null
 }
 
 async function resolveAccountPlanLimits(userId: string): Promise<{
@@ -119,9 +123,16 @@ export async function requireTeamSeats(
 export async function getResourceSnapshots(
   request: Request | undefined,
 ): Promise<ResourceSnapshots> {
-  const licensed = await verifyActiveLicense()
   const session = await requireAuth(request)
-  const userId = session.user.id
+  return getResourceSnapshotsForUser(session.user.id)
+}
+
+/**
+ * S6：无 Request 的快照/预检变体（服务端存储层调用，如 db-blob-store.put）。
+ * 口径与 getResourceSnapshots 完全一致（license/plan 解析相同）。
+ */
+export async function getResourceSnapshotsForUser(userId: string): Promise<ResourceSnapshots> {
+  const licensed = await verifyActiveLicense()
   let limits: PlanLimits | null
   let addonSeats = 0
   let seatLimit: number | 'unlimited' = 'unlimited'
@@ -156,6 +167,8 @@ export async function getResourceSnapshots(
     limits?.mediaGenerationsMonthly == null ? 'unlimited' : limits.mediaGenerationsMonthly
   const galleryStorageLimit =
     limits?.galleryStorageMb == null ? 'unlimited' : limits.galleryStorageMb
+  const installQuotaLimit = limits?.installQuota == null ? 'unlimited' : limits.installQuota
+  const blobStorageLimit = limits?.blobStorageMb == null ? 'unlimited' : limits.blobStorageMb
 
   // 席位口径与 requireTeamSeats 对齐（2026-10 审计 🟠：原实现 member 快照把 guest
   // 成员计入、guest 快照漏计已接受的 guest 成员且把 member 邀请计入——进度条虚高/
@@ -204,6 +217,8 @@ export async function getResourceSnapshots(
     agentUsage,
     skillUsage,
     sandboxDurationMsSum,
+    installUsage,
+    blobSizeSum,
   ] = await Promise.all([
     prisma.workspace.count({ where: { ownerId: userId } }),
     prisma.aiUsageLog.count({
@@ -215,7 +230,11 @@ export async function getResourceSnapshots(
       _sum: { durationMs: true },
       where: { userId, activity: 'sandbox', createdAt: { gte: startOfCurrentMonth() } },
     }),
+    // S6：安装按尝试计（含 installing/failed——防滥用量纲，失败安装同样消耗记录面）
+    prisma.anyHubApp.count({ where: { userId } }),
+    prisma.blob.aggregate({ _sum: { size: true }, where: { userId } }),
   ])
+  const MB = 1024 * 1024
 
   return {
     seats: { limit: seatLimit, usage: memberSeatUsage + memberPendingInvites },
@@ -238,6 +257,28 @@ export async function getResourceSnapshots(
       limit: galleryStorageLimit,
       usage: galleryStorageUsage,
     },
+    installQuota: { limit: installQuotaLimit, usage: installUsage },
+    blobStorageMb: {
+      limit: blobStorageLimit,
+      usage: Math.ceil((blobSizeSum._sum.size ?? 0) / MB),
+    },
+  }
+}
+
+/**
+ * S6：无 Request 的配额预检（存储汇点用，如 db-blob-store.put）。
+ * ⚠ TOCTOU 边界同 requireResource：统计性预检，非硬闸。
+ */
+export async function requireResourceForUser(
+  userId: string,
+  resource: keyof ResourceSnapshots,
+  amount: number = 1,
+): Promise<void> {
+  const snapshots = await getResourceSnapshotsForUser(userId)
+  const { limit, usage } = snapshots[resource]
+  if (limit === 'unlimited') return
+  if (usage + amount > limit) {
+    throw new ResourceLimitError(resource, limit, usage)
   }
 }
 

package/src/server/serverFns/__tests__/story-crud-labels-users.test.ts

@@ -177,17 +177,18 @@ describe("listUsersBriefFn", () => {
 });
 
 describe("listLabelsFn", () => {
-  it("按名称升序返回全部标签", async () => {
+  it("S24：按项目过滤（全局存量 ∪ 本项目），名称升序", async () => {
     M.label.findMany.mockResolvedValue([
       { id: "lb-2", name: "Beta", color: "#ff0000" },
       { id: "lb-1", name: "Alpha", color: null },
     ]);
 
-    const res = await listLabelsFn({ data: undefined });
+    const res = await listLabelsFn({ data: { projectId: "p1" } });
 
     expect(M.label.findMany).toHaveBeenCalledWith({
+      where: { OR: [{ projectId: null }, { projectId: "p1" }] },
       orderBy: { name: "asc" },
-      select: { id: true, name: true, color: true },
+      select: { id: true, name: true, color: true, projectId: true },
     });
     expect(res).toEqual([
       { id: "lb-2", name: "Beta", color: "#ff0000" },
@@ -195,47 +196,59 @@ describe("listLabelsFn", () => {
     ]);
   });
 
-  it("无标签时返回空数组", async () => {
+  it("S24：无 projectId → 仅存量全局标签", async () => {
     M.label.findMany.mockResolvedValue([]);
-    await expect(listLabelsFn({ data: undefined })).resolves.toEqual([]);
+    await expect(listLabelsFn({ data: {} })).resolves.toEqual([]);
+    expect(M.label.findMany).toHaveBeenCalledWith({
+      where: { projectId: null },
+      orderBy: { name: "asc" },
+      select: { id: true, name: true, color: true, projectId: true },
+    });
   });
 
   it("未登录拒绝且不查询", async () => {
     M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
-    await expect(listLabelsFn({ data: undefined })).rejects.toThrow("UNAUTHORIZED");
+    await expect(listLabelsFn({ data: {} })).rejects.toThrow("UNAUTHORIZED");
     expect(M.label.findMany).not.toHaveBeenCalled();
   });
 });
 
 describe("createLabelFn", () => {
-  it("透传名称与颜色给 upsertLabel 并使用当前用户", async () => {
+  it("S24：透传名称/颜色/projectId 给 upsertLabel 并使用当前用户", async () => {
     M.upsertLabel.mockResolvedValue({ id: "lb-9", name: "新标签", color: "#00ff00" });
 
-    const res = await createLabelFn({ data: { name: "新标签", color: "#00ff00" } });
+    const res = await createLabelFn({ data: { name: "新标签", color: "#00ff00", projectId: "p1" } });
 
-    expect(M.upsertLabel).toHaveBeenCalledWith("新标签", USER, "#00ff00");
+    expect(M.upsertLabel).toHaveBeenCalledWith("新标签", USER, "#00ff00", "p1");
     expect(res).toEqual({ id: "lb-9", name: "新标签", color: "#00ff00" });
   });
 
   it("未传颜色时以 undefined 透传", async () => {
     M.upsertLabel.mockResolvedValue({ id: "lb-9", name: "B", color: null });
-    await createLabelFn({ data: { name: "B" } });
-    expect(M.upsertLabel).toHaveBeenCalledWith("B", USER, undefined);
+    await createLabelFn({ data: { name: "B", projectId: "p1" } });
+    expect(M.upsertLabel).toHaveBeenCalledWith("B", USER, undefined, "p1");
+  });
+
+  it("S24：缺 projectId 被 validator 拒绝（新标签必挂项目）", async () => {
+    await expect(
+      createLabelFn({ data: { name: "X", projectId: "" } as unknown as { name: string; projectId: string } }),
+    ).rejects.toThrow();
+    expect(M.upsertLabel).not.toHaveBeenCalled();
   });
 
   it("非法颜色格式被 validator 拒绝（不写库）", async () => {
-    await expect(createLabelFn({ data: { name: "X", color: "red" } })).rejects.toThrow();
+    await expect(createLabelFn({ data: { name: "X", color: "red", projectId: "p1" } })).rejects.toThrow();
     expect(M.upsertLabel).not.toHaveBeenCalled();
   });
 
   it("空名称被 validator 拒绝", async () => {
-    await expect(createLabelFn({ data: { name: "" } })).rejects.toThrow();
+    await expect(createLabelFn({ data: { name: "", projectId: "p1" } })).rejects.toThrow();
     expect(M.upsertLabel).not.toHaveBeenCalled();
   });
 
   it("未登录拒绝且不写库", async () => {
     M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
-    await expect(createLabelFn({ data: { name: "X" } })).rejects.toThrow("UNAUTHORIZED");
+    await expect(createLabelFn({ data: { name: "X", projectId: "p1" } })).rejects.toThrow("UNAUTHORIZED");
     expect(M.upsertLabel).not.toHaveBeenCalled();
   });
 });

package/src/server/serverFns/activity.ts

@@ -131,3 +131,64 @@ export const getActivityDataFn = createServerFn({ method: 'GET' })
       level: computeLevel(count),
     }))
   })
+
+// ── S16（裁决：dashboard 真数据最小范围）──
+
+/** 统计卡四项：PRD 总数 / 今日完成动态 / 未读评论（占位 0，读模型未建）/ 已装应用 */
+export const getDashboardStatsFn = createServerFn({ method: "GET" }).handler(async () => {
+  const prisma = await getPrisma()
+  const request = getRequest()
+  const session = await requireAuth(request)
+  const userId = session.user.id
+  const now = new Date()
+
+  const [prdCount, todayDone, installedApps] = await Promise.all([
+    prisma.design.count({ where: { userId, isDeleted: false } }),
+    prisma.storyActivity.count({
+      where: {
+        userId,
+        action: "state_changed",
+        newValue: "done",
+        createdAt: { gte: startOfDay(now) },
+      },
+    }),
+    prisma.anyHubApp.count({ where: { userId } }),
+  ])
+
+  // 未读评论：读模型未建（跨实体已读位），占位 0——卡片保留，不假数据
+  return { prdCount, completedToday: todayDone, unreadComments: 0, installedApps }
+})
+
+const recentActivitiesSchema = z.object({ take: z.number().int().min(1).max(50).default(10) })
+
+/** 最近动态流：本人 storyActivity 最近 N 条（跨项目），action 经 ACTIVITY_LABEL
+ * 本地化在客户端做（shared 常量同源）。 */
+export const getRecentActivitiesFn = createServerFn({ method: "GET" })
+  .validator(recentActivitiesSchema)
+  .handler(async ({ data }) => {
+    const prisma = await getPrisma()
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const userId = session.user.id
+
+    const rows = await prisma.storyActivity.findMany({
+      where: { userId },
+      orderBy: { createdAt: "desc" },
+      take: data.take,
+      select: {
+        id: true,
+        action: true,
+        createdAt: true,
+        isAI: true,
+        story: { select: { identifier: true, name: true, projectId: true } },
+      },
+    })
+    return rows.map((r) => ({
+      id: r.id,
+      action: r.action,
+      isAI: r.isAI,
+      createdAt: r.createdAt.toISOString(),
+      storyIdentifier: r.story.identifier,
+      storyName: r.story.name,
+    }))
+  })

package/src/server/serverFns/anyhub/install.ts

@@ -21,6 +21,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import path from 'node:path'
 import { requireAuth } from '@/server/auth-helpers'
+import { requireResource } from '@/server/resources'
 import { isLocalPathAllowed } from '@/lib/anyhub/local-path'
 
 const installSchema = z.object({
@@ -52,6 +53,8 @@ export const installAnyHubAppFn = createServerFn({ method: 'POST' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
+    // S6：安装按尝试计（含 installing/failed），超档拒绝（裁决：三档 200/1000/5000）
+    await requireResource(request, 'installQuota', 1)
 
     if (data.source === 'marketplace' && !data.marketplaceAppId) throw new Error('缺少 marketplaceAppId')
     if (data.source === 'github' && !data.githubUrl) throw new Error('缺少 githubUrl')

package/src/server/serverFns/bug/bug-crud.ts

@@ -21,7 +21,6 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { ensureBuiltinIndependentProject, resolveStoryScopeProjectIds } from "@/server/builtin-project";
-import { isUserInTeam } from "@/server/team-access";
 import { diffDescriptionBlocks } from "@/lib/story/description-diff";
 import {
   BUG_STATES,
@@ -33,7 +32,6 @@ import {
 } from "@/shared/bug/constants";
 import { BUG_LIST_SELECT, BUG_USER_BRIEF_SELECT, castBugUsers } from "@/shared/bug/types";
 import { buildListWhere } from "./bug-list-query";
-import type { AvatarConfig } from "@allbluecn/kernel";
 import type { Prisma } from "@allbluecn/database";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";
 import { normalizeCollabSteps } from "@allbluecn/collab-core/steps";
@@ -42,43 +40,21 @@ import { withSequenceNumberRetry } from "@/server/lib/sequence-number-retry";
 import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
 import { assertProjectMembership as assertProjectMembershipShared } from "@/server/lib/project-membership";
 
+
+// S2：纯 helper 迁兄弟文件（bug-crud-helpers），此处 re-export 保持测试/消费方 import 路径不变
+import {
+  validateBugAssignee,
+  assertBugsInMemberProjects,
+  toBugActivityItem,
+  bugDescriptionToContent,
+} from "@/server/bug/bug-crud-helpers";
+export { validateBugAssignee, assertBugsInMemberProjects, toBugActivityItem, bugDescriptionToContent };
 // 白名单校验模式（与 story 同构）：DB 中 state/severity/source 为 String，写入侧用 z.enum 收敛
 const BUG_STATE_VALUES = BUG_STATES.map((s) => s.value) as [BugState, ...BugState[]];
 const BUG_SEVERITY_VALUES = BUG_SEVERITIES.map((s) => s.value) as [BugSeverity, ...BugSeverity[]];
 const BUG_SOURCE_VALUES = BUG_SOURCES.map((s) => s.value) as [BugSource, ...BugSource[]];
 
-async function validateBugAssignee(projectId: string, assigneeId: string | null | undefined) {
-  if (!assigneeId) return;
-  const prisma = await getPrisma();
-  const project = await prisma.project.findUnique({
-    where: { id: projectId },
-    select: { ownerId: true },
-  });
-  if (!project) throw new Error("项目不存在");
-  const ok = await isUserInTeam(project.ownerId, assigneeId);
-  if (!ok) throw new Error("负责人必须是团队成员");
-}
-
-// 批量写路径的成员圈定（R6）：与 deleteBugFn 同口径——目标 bugs 所属每个项目
-// 都须有当前用户的有效成员关系（status 非 suspended），任一无权即整体拒绝。
-// 判定在事务前完成，防止批量入口绕过单删的权限语义。
-async function assertBugsInMemberProjects(bugIds: string[], userId: string) {
-  const prisma = await getPrisma();
-  const rows = await prisma.bug.findMany({
-    where: { id: { in: bugIds } },
-    select: { projectId: true },
-  });
-  const projectIds = [...new Set(rows.map((r) => r.projectId))];
-  if (projectIds.length === 0) return;
-  const memberships = await prisma.projectMember.findMany({
-    where: { userId, projectId: { in: projectIds }, status: { not: "suspended" } },
-    select: { projectId: true },
-  });
-  const allowed = new Set(memberships.map((m) => m.projectId));
-  if (projectIds.some((p) => !allowed.has(p))) {
-    throw new Error("无权限操作该项目的 BUG");
-  }
-}
+
 
 // 按 projectId 直判变体（R8）：createBugFn 显式传 projectId 与 updateBugFn
 // （事务内已有 existing.projectId，免二次反查）使用；成员谓词与
@@ -87,36 +63,6 @@ async function assertBugsInMemberProjects(bugIds: string[], userId: string) {
 const assertProjectMembership = (projectId: string, userId: string) =>
   assertProjectMembershipShared(projectId, userId, "无权限操作该项目的 BUG");
 
-function toBugActivityItem(a: {
-  id: string;
-  action: string;
-  field: string | null;
-  oldValue: string | null;
-  newValue: string | null;
-  isAI: boolean;
-  createdAt: Date;
-  user: {
-    id: string;
-    username: string;
-    email: string;
-    avatarConfig: unknown;
-    bgShape: string | null;
-    bgColor: string | null;
-  } | null;
-}) {
-  return {
-    id: a.id,
-    action: a.action,
-    field: a.field,
-    oldValue: a.oldValue,
-    newValue: a.newValue,
-    isAI: a.isAI,
-    createdAt: a.createdAt.toISOString(),
-    user: a.user
-      ? { ...a.user, avatarConfig: (a.user.avatarConfig as AvatarConfig | null) ?? null }
-      : null,
-  };
-}
 
 const listSchema = z.object({
   projectId: z.string().optional(),
@@ -403,25 +349,6 @@ const BUG_Y_UPDATE_KEYS = new Set([
   "reproduceSteps",
 ]);
 
-/**
- * Bug.description（Text 列 JSON 串）→ {html, markdown} 门卫 content。
- * 与 components/story/types.ts parseStoryDescription 读取口径同构的镜像
- * （服务端不 import 组件模块）；历史裸串兜底为双轨原串。Bug.description 与
- * Story.description 存储同构（schema 注释），S12 裁决 UI 本期不接协同编辑，
- * 但旁路写（创建对话框等）仍须经理卫转发防互吞。
- */
-function bugDescriptionToContent(description: string): { html: string; markdown: string } {
-  try {
-    const parsed = JSON.parse(description) as { html?: unknown; markdown?: unknown };
-    if (typeof parsed.html === "string") {
-      const markdown = typeof parsed.markdown === "string" ? parsed.markdown : parsed.html;
-      return { html: parsed.html, markdown };
-    }
-  } catch {
-    // 历史裸串兜底
-  }
-  return { html: description, markdown: description };
-}
 
 export const updateBugFn = createServerFn({ method: "POST" })
   .validator(updateSchema)

package/src/server/serverFns/knowledge.ts

@@ -20,6 +20,8 @@ import { buildRoomName } from "@allbluecn/collab-core/rooms"
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
+import { jsonSizeOk, documentIdFromEmbeddingRowId, MAX_DOC_CONTENT_JSON_CHARS, MAX_DOC_PROPERTIES_JSON_CHARS } from '@/server/knowledge/knowledge-helpers'
+
 import { requireAuth } from '@/server/auth-helpers'
 import { indexDocumentById, resolveAiConfig, KB_EMBEDDINGS_TABLE } from '@/server/knowledge/knowledge-index-utils'
 import { generateEmbedding } from '@/server/ai-gateway/embedding'
@@ -300,17 +302,6 @@ export const getDocumentFn = createServerFn({ method: 'GET' })
 // 表格配置），不做结构收敛；仅加序列化体积上限防超大 JSON 写库（审计 2026-10-25）。
 // 注意：字段类型保持 z.any()（推断 any）而非 z.unknown()——content 会回显进
 // updateDocumentFn 返回值，unknown 过不了 serverFn 的 TSerializable 序列化校验。
-const MAX_DOC_CONTENT_JSON_CHARS = 2_000_000
-const MAX_DOC_PROPERTIES_JSON_CHARS = 256_000
-
-function jsonSizeOk(value: unknown, max: number): boolean {
-  if (value === undefined || value === null) return true
-  try {
-    return JSON.stringify(value).length <= max
-  } catch {
-    return false
-  }
-}
 
 const updateDocSchema = z
   .object({
@@ -606,12 +597,6 @@ const PUBLIC_SEARCH_DOMAINS = [
   { table: 'websiteBookmark', entityType: 'bookmark', label: '网站收藏' },
 ] as const
 
-/** 嵌入行 id 约定为 `${documentId}-${chunkIndex}`（knowledge-index-utils
- * indexDocumentEmbeddings 写入），chunkIndex 可为多位数字，取最后一个 "-" 前缀。 */
-function documentIdFromEmbeddingRowId(rowId: string): string {
-  const cut = rowId.lastIndexOf('-')
-  return cut > 0 ? rowId.slice(0, cut) : rowId
-}
 
 const searchPublicKnowledge = async (
   domain: (typeof PUBLIC_SEARCH_DOMAINS)[number],

package/src/server/serverFns/story/__tests__/kb-scope.test.ts

@@ -40,7 +40,7 @@ describe("kb-scope 可用范围判定", () => {
     });
   });
 
-  it("独立需求项目：自己的全部 ∪ 他人 team/general", () => {
+  it("独立需求项目：自己的全部 ∪ 他人 general（S42 fail-closed，不命中他人 team）", () => {
     const where = buildKbScopeWhere({
       projectId: "p2",
       projectDisplayId: "STORY",
@@ -49,7 +49,7 @@ describe("kb-scope 可用范围判定", () => {
     expect(where).toEqual({
       OR: [
         { userId: "u1" },
-        { visibility: { in: ["team", "general"] } },
+        { visibility: "general" },
       ],
     });
   });

package/src/server/serverFns/story/kb-scope.ts

@@ -36,19 +36,19 @@ export function isIndependentProject(displayId: string | null): boolean {
 /**
  * 需求可选知识库范围（Prisma where，用于 KnowledgeBase 查询）：
  * - 普通项目：visibility=general（跨用户）∪ 项目关联 KB（关联仅允许 team）
- * - 独立需求（STORY）：自己的全部 ∪ 他人 team/general
+ * - 独立需求（STORY）：自己的全部 ∪ 他人 general
  *
- * ⚠ 可见性语义注记（审计 ⚪ 2026-10-25，留待产品确认）：独立需求分支放行他人
- * `team` 可见性 KB——前提是本产品 `team` 取「平台内全员可发现」语义（与项目
- * KB 关联仅允许 team 的口径一致）；若 `team` 改为「所有者团队内可见」，此处
- * 须同步收紧为按团队过滤。
+ * S42（审计 ⚪ 2026-10-25，控制者裁决「按高收益方向」）：独立需求分支收窄为
+ * fail-closed——不再命中他人 `team` 可见性 KB。`team` 的真实语义（平台全员
+ * 可发现 vs 所有者团队内可见）尚未落地，按后者理解时旧口径即跨团队泄露面；
+ * 待团队语义落地后可放宽为按团队过滤。
  */
 export function buildKbScopeWhere(input: KbScopeInput): Prisma.KnowledgeBaseWhereInput {
   if (isIndependentProject(input.projectDisplayId)) {
     return {
       OR: [
         { userId: input.userId },
-        { visibility: { in: ["team", "general"] } },
+        { visibility: "general" },
       ],
     };
   }

package/src/server/serverFns/story/story-crud/labels.ts

@@ -15,26 +15,39 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { getPrisma } from "@allbluecn/database/get-prisma"
-import { createServerFn } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
+import { getPrisma } from "@allbluecn/database/get-prisma";
+import { getRequest } from "@tanstack/react-start/server";
+import { createServerFn } from "@tanstack/react-start";
 import { requireAuth } from "@/server/auth-helpers";
+import type { Prisma } from '@allbluecn/database'
 import { upsertLabel } from "@/server/story/story-crud/label-upsert";
 
 const labelCreateSchema = z.object({
   name: z.string().min(1).max(30),
   color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+  // S24：新标签必挂项目（裁决）。项目标签与存量全局标签在列表中并出。
+  projectId: z.string().min(1),
 });
 
-export const listLabelsFn = createServerFn({ method: "GET" }).handler(
-  async () => {
+/** S24：标签范围 = 存量全局（projectId IS NULL）∪ 本项目归属。 */
+export const listLabelsFn = createServerFn({ method: "GET" })
+  .validator(z.object({ projectId: z.string().optional() }))
+  .handler(async ({ data }) => {
     const prisma = await getPrisma()
     const request = getRequest();
     await requireAuth(request);
+    // null 字面量与 Prisma Nullable 字段类型不可比（TS 限制），Json 边界同款
+    // 单点断言收窄（S24）
+    const where = {
+      ...(data.projectId
+        ? { OR: [{ projectId: null }, { projectId: data.projectId }] }
+        : { projectId: null }),
+    } as unknown as Prisma.LabelWhereInput;
     return prisma.label.findMany({
+      where,
       orderBy: { name: "asc" },
-      select: { id: true, name: true, color: true },
+      select: { id: true, name: true, color: true, projectId: true },
     });
   },
 );
@@ -45,5 +58,5 @@ export const createLabelFn = createServerFn({ method: "POST" })
     const prisma = await getPrisma()
     const request = getRequest();
     const session = await requireAuth(request);
-    return upsertLabel(data.name, session.user.id, data.color);
+    return upsertLabel(data.name, session.user.id, data.color, data.projectId);
   });

package/src/server/story/story-crud/label-upsert.ts

@@ -18,16 +18,54 @@
 import { getPrisma } from "@allbluecn/database/get-prisma"
 import { pickLabelColor } from "./label-palette";
 
-export async function upsertLabel(name: string, createdById: string, color?: string) {
+/**
+ * S24：项目归属标签获取/创建。
+ * - projectId 给定（现行唯一路径）：按 (projectId, name) 查找，未命中创建
+ *   （部分唯一索引兜底并发——P2002 回退再查，竞态安全）。
+ * - 兼容签名（无 projectId）：仅匹配存量全局标签（projectId IS NULL），
+ *   不再新建全局标签（裁决：新标签必挂项目）。
+ */
+export async function upsertLabel(
+  name: string,
+  createdById: string,
+  color?: string,
+  projectId?: string,
+) {
   const prisma = await getPrisma();
-  return prisma.label.upsert({
-    where: { name },
-    update: {},
-    create: {
-      name,
-      color: color ?? pickLabelColor(name),
-      createdById,
-    },
+  if (!projectId) {
+    // 兼容路径：全局命名空间已关闭（裁决：新标签必挂项目），找不到即抛——
+    // 调用方语义都是「确保标签存在」，静默返回 null 会让调用方拿 null.id
+    const legacy = await prisma.label.findFirst({
+      where: { name, projectId: null },
+      select: { id: true, name: true, color: true },
+    });
+    if (!legacy) throw new Error("全局标签命名空间已关闭：新标签必须归属项目");
+    return legacy;
+  }
+  const found = await prisma.label.findFirst({
+    where: { name, projectId },
     select: { id: true, name: true, color: true },
   });
+  if (found) return found;
+  try {
+    return await prisma.label.create({
+      data: {
+        name,
+        color: color ?? pickLabelColor(name),
+        createdById,
+        projectId,
+      },
+      select: { id: true, name: true, color: true },
+    });
+  } catch (e) {
+    // 部分唯一索引 (projectId, name) 并发兜底：撞索引即回读
+    if ((e as { code?: string }).code === "P2002") {
+      const raced = await prisma.label.findFirst({
+        where: { name, projectId },
+        select: { id: true, name: true, color: true },
+      });
+      if (raced) return raced;
+    }
+    throw e;
+  }
 }

package/src/start.ts

@@ -143,6 +143,21 @@ export const startInstance = createStart(async () => {
   const requestMiddleware = [securityHeadersMiddleware, requestContextMiddleware, neonKeepaliveMiddleware, aiPortsMiddleware, apiCorsMiddleware, csrfMiddleware, auditRequestMiddleware]
   if (import.meta.env.SSR) {
     ensureGithubSyncTimer()
+    // S18（审计 A08 建议，裁决：仅 stdin 兜底）：桌面端 sidecar 由 Rust 壳拉起，
+    // 壳崩溃时子进程沦落孤儿继续监听端口，用户重开应用拉起新 sidecar 即端口
+    // 冲突/旧代码伺服。兜底：desktop 部署目标下 stdin EOF（父进程死亡时管道
+    // 关闭）即自杀退出——Vercel/容器部署无 stdin 或有外部管护，不受影响。
+    if (process.env.DEPLOY_TARGET === 'desktop' && !globalAny.__sidecarStdinGuard) {
+      globalAny.__sidecarStdinGuard = true
+      process.stdin.resume()
+      process.stdin.once('end', () => {
+        console.warn('[sidecar] stdin EOF：父进程已退出，Node sidecar 随之退出')
+        process.exit(0)
+      })
+      process.stdin.on('error', () => {
+        // stdin 不可读（无 TTY/管道被劫持等）时静默——兜底失效不炸服务
+      })
+    }
     const { registerServerSeam } = await import('@allbluecn/kernel')
     const { requireAuth, requireUserInDb } = await import('@/server/auth-helpers')
     const { getCurrentSession } = await import('@/lib/session')