@allbluecn/web-app 0.22.4 → 0.23.1

package/src/server/ai-gateway/__tests__/pgvector-memory-adapter.test.ts

@@ -397,6 +397,36 @@ describe("pgvector MemoryAdapter.inspect / listFacts", () => {
   })
 })
 
+describe("pgvector MemoryAdapter tenantId 隔离键折叠", () => {
+  it("save 以 <tenantId>:<userId> 落库（官方 tenantId 隔离契约的存储侧）", async () => {
+    const adapter = makeAdapter()
+
+    await adapter.save(
+      { userId: "u1", threadId: "t1", tenantId: "acme" },
+      { user: "足够长的用户输入内容", assistant: "回复" },
+    )
+
+    const [, , ownerKey] = mocks.executeRaw.mock.calls[0]!
+    expect(String(ownerKey)).toBe("acme:u1")
+  })
+
+  it("recall 按 <tenantId>:<userId> 过滤——同 userId 跨 tenantId 互不可见", async () => {
+    const adapter = makeAdapter()
+
+    await adapter.recall({ userId: "u1", threadId: "t1", tenantId: "other" }, "查询")
+
+    expect(String(mocks.queryRaw.mock.calls[0]![1])).toBe("other:u1")
+  })
+
+  it("无 tenantId 的 scope 保持裸 userId（既有路径零影响）", async () => {
+    const adapter = makeAdapter()
+
+    await adapter.recall(scope, "查询")
+
+    expect(String(mocks.queryRaw.mock.calls[0]![1])).toBe("user-1")
+  })
+})
+
 describe("memory scope 归属校验", () => {
   const fakeCtx = { threadId: "thread-a" } as never
 

package/src/server/ai-gateway/__tests__/pgvector-memory-conformance.test.ts

@@ -0,0 +1,92 @@
+// @vitest-environment node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { afterAll, beforeAll, describe, vi } from "vitest"
+import { runMemoryAdapterContract } from "@tanstack/ai-memory/testkit"
+import { prisma } from "@allbluecn/database"
+
+const mocks = vi.hoisted(() => ({
+  generateEmbedding: vi.fn(),
+}))
+
+// 真实 embedding 依赖外部 API key + 网络，与契约无关（契约定的是「同一文本
+// 换来同一向量、相似文本向量相近」的隔离/往返语义）。用确定性 token 哈希
+// 词袋向量替身：1536 维对齐 memory_facts.embedding 的 vector(1536) 列类型，
+// 相似文本（共享 token）余弦相似度可预期地高于相似度阈值，round-trip 用例
+// 才能走真实 pgvector SQL（<=> 距离排序）而非被 mock 掉。
+vi.mock("../embedding", () => ({ generateEmbedding: mocks.generateEmbedding }))
+
+import { createPgVectorMemoryAdapter } from "../memory/pgvector-adapter"
+
+const EMBEDDING_DIMENSIONS = 1536
+
+function hashToken(token: string): number {
+  // FNV-1a 32-bit：确定性哈希，跨进程稳定（不能用 Math.random / crypto）
+  let hash = 0x811c9dc5
+  for (let i = 0; i < token.length; i++) {
+    hash ^= token.charCodeAt(i)
+    hash = Math.imul(hash, 0x01000193)
+  }
+  return hash >>> 0
+}
+
+function testEmbedding(text: string): number[] {
+  const vector = new Array<number>(EMBEDDING_DIMENSIONS).fill(0)
+  const tokens = text.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean)
+  for (const token of tokens) vector[hashToken(token) % EMBEDDING_DIMENSIONS] += 1
+  const norm = Math.sqrt(vector.reduce((sum, v) => sum + v * v, 0)) || 1
+  return vector.map((v) => v / norm)
+}
+
+mocks.generateEmbedding.mockImplementation(async (text: string) => testEmbedding(text))
+
+/**
+ * 官方 memory adapter 契约（@tanstack/ai-memory testkit）验证 pgvector
+ * MemoryAdapter 满足 save/recall 往返、scope 隔离（含 tenantId）、receipt
+ * 形状与可选 introspection 不变量。通过即 middleware 可直接挂载。
+ *
+ * `runMemoryAdapterContract` 同步返回 void——内部自注册 Vitest describe/it，
+ * 调用方**不能**再用 `it` 包裹或 `await`（与 persistence conformance 同规）。
+ *
+ * ⚠ 隔离键：契约用固定 scope（u1 / u2 / alice / bob / u×tenant），adapter 把
+ * tenantId 折叠进 userId 隔离键（`<tenantId>:<userId>`），beforeAll/afterAll
+ * 按这套固定键清理（幂等，中断轮次可自愈），不触碰业务数据。
+ *
+ * CI/本地手动执行（需 DATABASE_URL 指向带 pgvector 的库）：
+ *   DATABASE_URL=postgresql://allblue:allblue@localhost:5432/allblue \
+ *     npx vitest run --project unit src/server/ai-gateway/__tests__/pgvector-memory-conformance.test.ts
+ */
+const CONTRACT_OWNER_KEYS = ["u1", "u2", "alice", "bob", "tenant-a:u", "tenant-b:u"]
+
+describe.skipIf(!process.env.DATABASE_URL)("pgvector memory adapter conformance", () => {
+  beforeAll(async () => {
+    for (const key of CONTRACT_OWNER_KEYS) {
+      await prisma.$executeRaw`DELETE FROM "memory_facts" WHERE "userId" = ${key}`
+    }
+  })
+
+  afterAll(async () => {
+    for (const key of CONTRACT_OWNER_KEYS) {
+      await prisma
+        .$executeRaw`DELETE FROM "memory_facts" WHERE "userId" = ${key}`.catch(() => {})
+    }
+    await prisma.$disconnect().catch(() => {})
+  })
+
+  runMemoryAdapterContract("AllBlue pgvector adapter", () => createPgVectorMemoryAdapter())
+})

package/src/server/ai-gateway/__tests__/source-mode.test.ts

@@ -4,7 +4,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 const { prismaMock } = vi.hoisted(() => ({
   prismaMock: {
     user: { findUnique: vi.fn(), update: vi.fn() },
-    desktopSetting: { findUnique: vi.fn(), upsert: vi.fn() },
+    desktopSetting: { findUnique: vi.fn(), upsert: vi.fn(), delete: vi.fn() },
   },
 }))
 
@@ -21,23 +21,62 @@ vi.mock('../runtime', () => ({
 
 import { resolveSourceMode, setSourceMode } from '../source-mode'
 
+// 产物键值逐字断言：guest 键隔离后的新键与被迁移的旧全局键
+const NEW_KEY = 'aiSourceMode:local-guest'
+const LEGACY_KEY = 'aiSourceMode'
+const GUEST = { userId: 'local-guest', isGuest: true } as const
+
 describe('resolveSourceMode', () => {
   beforeEach(() => vi.clearAllMocks())
 
-  it('登录用户读 User.aiSourceMode', async () => {
+  it('登录用户读 User.aiSourceMode（非 guest 路径不受键隔离影响）', async () => {
     prismaMock.user.findUnique.mockResolvedValue({ aiSourceMode: 'hosted' })
     expect(await resolveSourceMode({ userId: 'u1', isGuest: false })).toBe('hosted')
     expect(prismaMock.user.findUnique).toHaveBeenCalledWith({
       where: { id: 'u1' }, select: { aiSourceMode: true },
     })
+    expect(prismaMock.desktopSetting.findUnique).not.toHaveBeenCalled()
   })
 
-  it('desktop 游客读 DesktopSetting KV', async () => {
+  it('desktop 游客读隔离键 aiSourceMode:local-guest', async () => {
     prismaMock.desktopSetting.findUnique.mockResolvedValue({ value: 'local-agent' })
-    expect(await resolveSourceMode({ userId: 'local-guest', isGuest: true })).toBe('local-agent')
+    expect(await resolveSourceMode(GUEST)).toBe('local-agent')
+    expect(prismaMock.desktopSetting.findUnique).toHaveBeenCalledWith({ where: { key: NEW_KEY } })
+    expect(prismaMock.desktopSetting.findUnique).not.toHaveBeenCalledWith({ where: { key: LEGACY_KEY } })
     expect(prismaMock.user.findUnique).not.toHaveBeenCalled()
   })
 
+  it('迁移读：新键缺失 + 旧键存在 → 返回旧键值（读路径不写不删）', async () => {
+    prismaMock.desktopSetting.findUnique
+      .mockResolvedValueOnce(null) // 新键查询：无行
+      .mockResolvedValueOnce({ value: 'byok' }) // 旧键查询：有行
+    expect(await resolveSourceMode(GUEST)).toBe('byok')
+    expect(prismaMock.desktopSetting.findUnique).toHaveBeenNthCalledWith(1, { where: { key: NEW_KEY } })
+    expect(prismaMock.desktopSetting.findUnique).toHaveBeenNthCalledWith(2, { where: { key: LEGACY_KEY } })
+    expect(prismaMock.desktopSetting.upsert).not.toHaveBeenCalled()
+    expect(prismaMock.desktopSetting.delete).not.toHaveBeenCalled()
+  })
+
+  it('迁移读：新键已存在时不查旧键', async () => {
+    prismaMock.desktopSetting.findUnique.mockResolvedValue({ value: 'hosted' })
+    expect(await resolveSourceMode(GUEST)).toBe('hosted')
+    expect(prismaMock.desktopSetting.findUnique).toHaveBeenCalledTimes(1)
+    expect(prismaMock.desktopSetting.findUnique).toHaveBeenCalledWith({ where: { key: NEW_KEY } })
+  })
+
+  it('迁移读：新键与旧键均缺失 → null（默认 byok 行为）', async () => {
+    prismaMock.desktopSetting.findUnique.mockResolvedValue(null)
+    expect(await resolveSourceMode(GUEST)).toBeNull()
+    expect(prismaMock.desktopSetting.findUnique).toHaveBeenCalledTimes(2)
+  })
+
+  it('迁移读：旧键脏值 → null（对称收窄）', async () => {
+    prismaMock.desktopSetting.findUnique
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce({ value: 'invalid-mode' })
+    expect(await resolveSourceMode(GUEST)).toBeNull()
+  })
+
   it('无记录返回 null（默认 byok 行为）', async () => {
     prismaMock.user.findUnique.mockResolvedValue({ aiSourceMode: null })
     expect(await resolveSourceMode({ userId: 'u1', isGuest: false })).toBeNull()
@@ -65,13 +104,15 @@ describe('setSourceMode', () => {
     expect(invalidateMock).toHaveBeenCalledWith('u1')
   })
 
-  it('游客写 DesktopSetting KV（不碰 User 表，避免 P2025）', async () => {
-    await setSourceMode({ userId: 'local-guest', isGuest: true }, 'local-agent')
+  it('游客写隔离键 aiSourceMode:local-guest（迁移读后写入落新键，旧键不删除）', async () => {
+    await setSourceMode(GUEST, 'local-agent')
     expect(prismaMock.desktopSetting.upsert).toHaveBeenCalledWith({
-      where: { key: 'aiSourceMode' },
-      create: { key: 'aiSourceMode', value: 'local-agent' },
+      where: { key: NEW_KEY },
+      create: { key: NEW_KEY, value: 'local-agent' },
       update: { value: 'local-agent' },
     })
+    expect(prismaMock.desktopSetting.delete).not.toHaveBeenCalled()
     expect(prismaMock.user.update).not.toHaveBeenCalled()
+    expect(invalidateMock).not.toHaveBeenCalled()
   })
 })

package/src/server/ai-gateway/ai-output-guard.ts

@@ -15,12 +15,16 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import { contentGuardMiddleware } from "@tanstack/ai/middlewares"
+
 /**
  * AI 输出泄露扫描（ai-output-guard）
  *
  * 注入攻击可能在 LLM 输出中回显 per-user API key、系统提示词或内网地址。
- * 本模块提供纯函数 `scanAiOutputForSecrets`，后续可挂到 TanStack AI 的
- * middleware `onFinish` 钩子对完整输出做一次输出侧拦截。
+ * 本模块提供纯函数 `scanAiOutputForSecrets`（检出）与 `redactAiOutputSecrets`
+ * （脱敏替换），并由 `createAiOutputGuardMiddleware` 包进官方
+ * `contentGuardMiddleware`，挂入 chat-stream-builder 的中间件链对流式输出
+ * 做输出侧拦截。
  *
  * 设计权衡（有意为之，勿当 bug 修掉）：
  * 1. 只回传命中的规则 type，不回传匹配原文——扫描结果本身若被日志/告警
@@ -75,3 +79,47 @@ export function scanAiOutputForSecrets(text: string): AiOutputScanResult {
   }
   return { leaked: hits.length > 0, hits }
 }
+
+/**
+ * 对一段 AI 输出文本做密钥脱敏：命中规则的部分替换为 `[REDACTED:<type>]`
+ * （占位符约定与 log-redact.ts 一致）。与 `scanAiOutputForSecrets` 共用同一
+ * RULES 单一来源——新增规则时检出与脱敏同步生效，不会出现「扫得出但抹不掉」。
+ */
+export function redactAiOutputSecrets(text: string): string {
+  let out = text
+  for (const rule of RULES) {
+    rule.pattern.lastIndex = 0
+    out = out.replace(rule.pattern, `[REDACTED:${rule.type}]`)
+  }
+  return out
+}
+
+/**
+ * 把密钥脱敏包进官方 contentGuardMiddleware（chat-stream-builder 中间件链挂载）。
+ *
+ * - 拦截策略保守：默认替换脱敏（blockOnMatch 缺省 false），不终止整条消息。
+ * - strategy 用 buffered：规则可命中跨 chunk 分片的密钥（delta 策略会漏）。
+ *   bufferSize 取 200：buffered 只保证「已流入安全窗口」的文本被检查，密钥形态
+ *   实际长度普遍在 200 字符内（规则本身无上界，残余风险仅限超长 secret 的
+ *   流中前缀，流结束 flush 仍会全量脱敏）。
+ * - onFiltered 只记录命中类型，不落原文（泄露面约定同上）。
+ *
+ * 必须每次 chat() 装配时新建实例（buffered 策略的缓冲状态存于闭包，单例会
+ * 在并发 run 间串写）。
+ */
+export function createAiOutputGuardMiddleware() {
+  const loggedMessageIds = new Set<string>()
+  return contentGuardMiddleware({
+    rules: [{ fn: redactAiOutputSecrets }],
+    strategy: "buffered",
+    bufferSize: 200,
+    onFiltered: (info) => {
+      if (loggedMessageIds.has(info.messageId)) return
+      loggedMessageIds.add(info.messageId)
+      const { hits } = scanAiOutputForSecrets(info.original)
+      console.warn(
+        `[AI] 输出含疑似密钥已脱敏 messageId=${info.messageId} hits=${hits.join(",")}`,
+      )
+    },
+  })
+}

package/src/server/ai-gateway/chat-stream-builder.ts

@@ -35,6 +35,7 @@ import {
   createUsageLogMiddleware,
   resolveUsageWorkspaceId,
 } from './middlewares'
+import { createAiOutputGuardMiddleware } from './ai-output-guard'
 import { planApprovalInterrupt } from './tools/plan-submit'
 import { withPersistence } from '@tanstack/ai-persistence'
 import type { AppContext } from './types'
@@ -274,6 +275,8 @@ export async function buildChatStreamWithTools(
       toolCacheMiddleware({
         toolNames: ["web_search", "knowledge_search"],
       }),
+      // 输出侧密钥拦截在持久化/计量之前：DB 快照与下游拿到的都是脱敏后文本
+      createAiOutputGuardMiddleware(),
       createToolBudgetMiddleware(),
       createPlanApprovalMiddleware(),
       compactionMiddleware(resolveCompactionOptions()),

package/src/server/ai-gateway/media/index.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto"
 import { Buffer } from "node:buffer"
-import { generateImage, generateVideo, getVideoJobStatus, generateSpeech, generateTranscription } from "@tanstack/ai"
-import type { PersistedArtifactRef, ImageGenerationResult, TranscriptionResult } from "@tanstack/ai"
+import { generateImage, generateVideo, generateSpeech, generateTranscription } from "@tanstack/ai"
+import type { PersistedArtifactRef, ImageGenerationResult, MediaPrompt, StreamChunk, TranscriptionResult } from "@tanstack/ai"
 import { withGenerationPersistence, defineGenerationRunStore } from "@tanstack/ai-persistence"
 import type { GenerationRunRecord } from "@tanstack/ai-persistence"
 import { prisma, type Prisma } from "@allbluecn/database"
@@ -38,13 +38,6 @@ function json(value: unknown): Prisma.InputJsonValue {
   return JSON.parse(JSON.stringify(value))
 }
 
-/** 与 SDK 非流式 generateVideo 派生 run id 对齐（videoRunIdForJob，SDK 未导出）：
- *  `video:<encodeURIComponent(provider)>:<encodeURIComponent(jobId)>`。
- *  本地拼法与 pollVideoForUser 的查询 key 共用同一来源，避免两份拼法漂移。 */
-function videoRunStoreKey(adapterName: string, jobId: string) {
-  return `video:${encodeURIComponent(adapterName)}:${encodeURIComponent(jobId)}`
-}
-
 export function createGenerationRunStore(opts: Pick<MediaGenOptions, "userId" | "threadId">, input?: unknown) {
   const scope = { userId: opts.userId, threadId: opts.threadId }
   const mapRow = (row: Prisma.GenerationRunGetPayload<{ select: typeof runSelect }>): GenerationRunRecord => ({
@@ -159,33 +152,47 @@ export async function generateImageForUser(opts: MediaGenOptions & {
   return { ...result, runId }
 }
 
-export async function generateVideoForUser(opts: MediaGenOptions & { prompt: string; duration?: number; size?: string; referenceImage?: string }) {
+/**
+ * 流式视频生成（官方 generateVideo stream 模式）：一次调用覆盖
+ * create → poll → complete 全生命周期，AsyncIterable<StreamChunk> 事件序列为
+ * RUN_STARTED → CUSTOM(video:job:created) → CUSTOM(video:status)* →
+ * CUSTOM(generation:result) → RUN_FINISHED（失败 RUN_ERROR），与
+ * useGenerateVideo 客户端逐事件对应。run 记录 id = 调用方 runId（流式模式由
+ * RUN_STARTED 段落库），非流式 submit 的 videoRunStoreKey 派生口径不适用。
+ *
+ * prompt 为 MediaPrompt 时，url source 经 imageDataUrl 归一（SSRF 守卫 + data:
+ * 转换，与 referenceImage 同口径；Sora/Veo 等仅收字节输入的 provider 因此兼容）。
+ */
+export async function streamVideoForUser(opts: MediaGenOptions & { prompt: MediaPrompt; duration?: number; size?: string; referenceImage?: string; runId?: string }): Promise<AsyncIterable<StreamChunk>> {
   await requireThread(opts)
   const adapter = resolveVideoAdapter(opts)
   if (adapter.kind === "unavailable") throw new Error(`Video generation is not available for adapter kind: ${opts.adapterKind}`)
-  const reference = opts.referenceImage ? await imageDataUrl(opts.referenceImage) : undefined
-  const prompt = reference
-    ? [
-        { type: "text" as const, content: opts.prompt },
-        { type: "image" as const, source: { type: "url" as const, value: reference }, metadata: { role: "start_frame" as const } },
-      ]
-    : opts.prompt
-  const result = await generateVideo({ adapter, prompt, duration: opts.duration, size: opts.size, threadId: opts.threadId,
+  const [reference, prompt] = await Promise.all([
+    opts.referenceImage ? imageDataUrl(opts.referenceImage) : undefined,
+    normalizeMediaPrompt(opts.prompt),
+  ])
+  const startFrame = reference
+    ? { type: "image" as const, source: { type: "url" as const, value: reference }, metadata: { role: "start_frame" as const } }
+    : undefined
+  const mediaPrompt: MediaPrompt = !startFrame
+    ? prompt
+    : typeof prompt === "string"
+      ? [{ type: "text", content: prompt }, startFrame]
+      : [startFrame, ...prompt]
+  return generateVideo({ adapter, prompt: mediaPrompt, duration: opts.duration, size: opts.size, threadId: opts.threadId,
+    ...(opts.runId ? { runId: opts.runId } : {}),
+    stream: true,
     middleware: [withGenerationPersistence({ stores: { generationRuns: createGenerationRunStore(opts, { prompt: opts.prompt, referenceImage: opts.referenceImage }) } })],
   })
-  return { ...result, runId: videoRunStoreKey(adapter.name, result.jobId) }
 }
 
-export async function pollVideoForUser(opts: MediaGenOptions & { jobId: string }) {
-  await requireThread(opts)
-  const adapter = resolveVideoAdapter(opts)
-  if (adapter.kind === "unavailable") throw new Error(`Video generation is not available for adapter kind: ${opts.adapterKind}`)
-  const store = createGenerationRunStore(opts)
-  const run = await store.get(videoRunStoreKey(adapter.name, opts.jobId))
-  if (!run || run.activity !== "video" || run.model !== opts.model) throw new Error("Video run not found")
-  return getVideoJobStatus({ adapter, jobId: opts.jobId, threadId: opts.threadId,
-    middleware: [withGenerationPersistence({ stores: { generationRuns: store } })],
-  })
+/** url source 一律经 imageDataUrl（SSRF 守卫 + data: 归一 + 大小上限），字符串原样 */
+async function normalizeMediaPrompt(prompt: MediaPrompt): Promise<MediaPrompt> {
+  if (typeof prompt === "string") return prompt
+  return Promise.all(prompt.map(async (part) => {
+    if (part.type !== "image" || part.source.type !== "url") return part
+    return { ...part, source: { type: "url" as const, value: await imageDataUrl(part.source.value) } }
+  }))
 }
 
 export async function generateSpeechForUser(opts: MediaGenOptions & { text: string; voice?: string; format?: "mp3" | "opus" | "aac" | "flac" | "wav" | "pcm" }) {

package/src/server/ai-gateway/media/trim-input.ts

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/**
+ * 画廊列表 input 快照裁剪（任务 15 审查 ①）：流式视频 run 的持久化 input 含
+ * `prompt: MediaPrompt`（参考帧路径会把 ≤10MB data URL 塞进图片分片）与可选
+ * `referenceImage`（路由 schema 上限 16MB），listGenerationRunsFn 若全量透传，
+ * 24 条/页的响应会膨胀到数百 MB，而列表消费面（getSourcePrompt）只读字符串与
+ * text 分片。故：媒体分片（image/video/audio part）整片剔除、referenceImage 键
+ * 剔除、任意位置出现的 data: 字符串剔除；文本与轻量标量（size/text/
+ * numberOfImages 等）保留。独立纯模块：无服务端重依赖，serverFn 与测试可直接
+ * 消费，不经 media/index.ts 的 prisma 依赖链。
+ *
+ * 只作用于列表出口——持久化快照（createGenerationRunStore 落库）不受影响。
+ *
+ * 泛型签名：输出是输入的深子集（只删不增不变形，JSON 域内形状保持），
+ * 调用方（Prisma JsonValue）经 TanStack Start 可序列化校验不受影响。
+ */
+export function trimGenerationRunInput<T>(input: T): T | undefined {
+  if (typeof input === "string") return (input.startsWith("data:") ? undefined : input) as T | undefined
+  if (Array.isArray(input)) {
+    const mapped = (input as unknown[]).map((entry) => trimGenerationRunInput(entry)).filter((entry) => entry !== undefined)
+    return (mapped.length ? mapped : undefined) as T | undefined
+  }
+  if (input && typeof input === "object") {
+    const record = input as Record<string, unknown>
+    // 媒体分片按类型整片剔除（其 source.value 为 data: URL，列表无消费面）
+    if (record.type === "image" || record.type === "video" || record.type === "audio") return undefined
+    const out: Record<string, unknown> = {}
+    for (const [key, value] of Object.entries(record)) {
+      if (key === "referenceImage") continue
+      const trimmed = trimGenerationRunInput(value)
+      if (trimmed !== undefined) out[key] = trimmed
+    }
+    return (Object.keys(out).length ? out : undefined) as T | undefined
+  }
+  return input
+}

package/src/server/ai-gateway/memory/pgvector-adapter.ts

@@ -80,6 +80,18 @@ function buildFactContent(turn: MemoryTurn): string {
   return [turn.user.trim(), turn.assistant.trim()].filter(Boolean).join("\n")
 }
 
+/**
+ * 记忆隔离键：tenantId 在场时折叠进 userId（`<tenantId>:<userId>`）。
+ *
+ * memory_facts 表只有 userId 隔离列（无 tenantId 列）；官方 MemoryScope 把
+ * tenantId 定义为租户边界，testkit 契约（runMemoryAdapterContract）明确要求
+ * 同 threadId+userId 跨 tenantId 互不可见。AllBlue 自身不传 tenantId（单租户
+ * 部署），该折叠对既有路径零影响；未来多租户接入时无需再动表结构。
+ */
+function scopeOwnerKey(scope: { userId?: string; tenantId?: string }): string {
+  return scope.tenantId ? `${scope.tenantId}:${scope.userId}` : (scope.userId ?? "")
+}
+
 // pgvector 原生表由 raw SQL 读写（Prisma 无法表达 vector 类型）
 export function createPgVectorMemoryAdapter(
   options: PgVectorMemoryAdapterOptions = {},
@@ -95,16 +107,16 @@ const MEMORY_FACTS_USER_CAP = 200
   const takenAt = () => (options.now ?? (() => new Date().toISOString()))()
 
   async function listFactsByUser(
-    userId: string,
+    ownerKey: string,
     limit: number,
   ): Promise<Array<StoredFactRow>> {
     return (await prisma.$queryRaw<Array<StoredFactRow>>`
-      SELECT "id", "content", "threadId", "createdAt" FROM "memory_facts" WHERE "userId" = ${userId} ORDER BY "createdAt" DESC LIMIT ${limit}`
+      SELECT "id", "content", "threadId", "createdAt" FROM "memory_facts" WHERE "userId" = ${ownerKey} ORDER BY "createdAt" DESC LIMIT ${limit}`
     )
   }
 
   async function searchFacts(
-    userId: string,
+    ownerKey: string,
     query: string,
   ): Promise<Array<StoredFactRow>> {
     const embedding = await generateEmbedding(query)
@@ -112,13 +124,13 @@ const MEMORY_FACTS_USER_CAP = 200
     const embeddingStr = formatVector(embedding)
     return (await prisma.$queryRaw<Array<StoredFactRow>>`
       SELECT "id", "content", "threadId", "createdAt", 1 - (embedding <=> ${embeddingStr}::vector) AS similarity
-      FROM "memory_facts" WHERE "userId" = ${userId} ORDER BY embedding <=> ${embeddingStr}::vector LIMIT ${candidateLimit}`
+      FROM "memory_facts" WHERE "userId" = ${ownerKey} ORDER BY embedding <=> ${embeddingStr}::vector LIMIT ${candidateLimit}`
     )
   }
 
-  async function countFacts(userId: string): Promise<MemoryStatsRow> {
+  async function countFacts(ownerKey: string): Promise<MemoryStatsRow> {
     const rows = await prisma.$queryRaw<Array<MemoryStatsRow>>`
-      SELECT COUNT(*)::int AS "c", COALESCE(MAX("createdAt"), NOW()) AS "lastWrite" FROM "memory_facts" WHERE "userId" = ${userId}`
+      SELECT COUNT(*)::int AS "c", COALESCE(MAX("createdAt"), NOW()) AS "lastWrite" FROM "memory_facts" WHERE "userId" = ${ownerKey}`
     return rows[0] ?? { c: 0, lastWrite: null }
   }
 
@@ -132,12 +144,13 @@ const MEMORY_FACTS_USER_CAP = 200
 
       let hits: Array<StoredFactRow & { score: number }>
       try {
+        const ownerKey = scopeOwnerKey(scope)
         // 零记忆快路径：召回在 chat 链路的每个 turn 都会执行，先跑一次
         // 计数，尚无沉淀的用户直接返回空注入，省掉一次 embedding 调用。
-        if (Number((await countFacts(scope.userId)).c) === 0) {
+        if (Number((await countFacts(ownerKey)).c) === 0) {
           return { systemPrompt: "" }
         }
-        hits = (await searchFacts(scope.userId, query))
+        hits = (await searchFacts(ownerKey, query))
           .map((row) => ({ ...row, score: Number(row.similarity ?? 0) }))
           .filter((row) => row.score >= similarityThreshold)
           .slice(0, topK)
@@ -174,6 +187,7 @@ const MEMORY_FACTS_USER_CAP = 200
 
       const content = buildFactContent(turn)
       try {
+        const ownerKey = scopeOwnerKey(scope)
         const embedding = await generateEmbedding(content)
         if (!Array.isArray(embedding) || embedding.length === 0) {
           return [{ ok: false, error: "embedding returned an empty vector" }]
@@ -181,16 +195,16 @@ const MEMORY_FACTS_USER_CAP = 200
         const id = randomUUID()
         await prisma.$executeRaw`
           INSERT INTO "memory_facts" ("id", "userId", "threadId", "content", "embedding")
-          VALUES (${id}, ${scope.userId}, ${scope.threadId}, ${content}, ${formatVector(embedding)}::vector)`
+          VALUES (${id}, ${ownerKey}, ${scope.threadId}, ${content}, ${formatVector(embedding)}::vector)`
         // S25（裁决：按高收益方向）：per-user 上限窗口——超限淘汰最旧，防无限
         // 增长；相似度去重复杂度不成比例，不做。上限写死 200（长期记忆召回
         // 取 TOP-K 远小于此，裁剪只影响被淘汰的最旧事实）。
         await prisma.$executeRaw`
           DELETE FROM "memory_facts"
-          WHERE "userId" = ${scope.userId}
+          WHERE "userId" = ${ownerKey}
             AND "id" NOT IN (
               SELECT "id" FROM "memory_facts"
-              WHERE "userId" = ${scope.userId}
+              WHERE "userId" = ${ownerKey}
               ORDER BY "createdAt" DESC
               LIMIT ${MEMORY_FACTS_USER_CAP}
             )`
@@ -216,7 +230,7 @@ const MEMORY_FACTS_USER_CAP = 200
       if (!scope.userId) {
         return { takenAt: takenAt(), data: { userId: null, threadId: scope.threadId, count: 0 } }
       }
-      const stats = await countFacts(scope.userId)
+      const stats = await countFacts(scopeOwnerKey(scope))
       return {
         takenAt: takenAt(),
         data: {
@@ -230,7 +244,7 @@ const MEMORY_FACTS_USER_CAP = 200
 
     async listFacts(scope): Promise<Array<MemoryFact>> {
       if (!scope.userId) return []
-      const rows = await listFactsByUser(scope.userId, listFactsLimit)
+      const rows = await listFactsByUser(scopeOwnerKey(scope), listFactsLimit)
       return rows.map((row) => ({
         id: row.id,
         text: row.content,