@allbluecn/web-app 0.23.6 → 0.24.0

package/src/lib/__tests__/session.test.ts

@@ -8,7 +8,7 @@
 // 不触真实 JWT 解密、不真读写 DESKTOP_USER_DATA_DIR 下的 remote-auth.json
 // （#578 fs 实现勿真写盘）。desktop 判定走 DEPLOY_TARGET env stub
 // （isDesktopServer 调用时读 env，见 desktop-guest.ts:40）。
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { getCurrentSession } from '../session'
 import type { Session } from '../session'
 
@@ -45,6 +45,11 @@ const REMOTE_AUTH = {
 const REQ = () => new Request('http://localhost/api/auth/session')
 
 describe('getCurrentSession 桌面回落（A10 优先级链）', () => {
+  beforeEach(() => {
+    // 真实桌面后端由 Electron 主进程注入该 env（fail-open 自检的正常路径）
+    vi.stubEnv('DESKTOP_USER_DATA_DIR', '/tmp/allblue-desktop-test')
+  })
+
   afterEach(() => {
     vi.unstubAllEnvs()
     vi.clearAllMocks()
@@ -72,10 +77,45 @@ describe('getCurrentSession 桌面回落（A10 优先级链）', () => {
     expect(session?.expires).toBe('never')
   })
 
-  it('①c authjs 无效 + desktop + remoteAuth 无 → null', async () => {
+  it('①c authjs 无效 + desktop + remoteAuth 无 → guest 本地影子身份（桌面免登录）', async () => {
     vi.stubEnv('DEPLOY_TARGET', 'desktop')
     getSessionMock.mockResolvedValue(null)
     readRemoteAuthMock.mockResolvedValue(null)
+    const session = await getCurrentSession(REQ())
+    // 桌面端不存在「未登录」态：guest 是本地合法身份，必须在本鉴权单点补齐
+    // （否则 account-team / design-detail 等软鉴权端点把 guest 判成未登录 →
+    // 路由 beforeLoad 收 unauthorized → 自动跳 /login，实测 P0）
+    expect(session?.user?.id).toBe('local-guest')
+    expect(session?.user?.isGuest).toBe(true)
+    expect(session?.expires).toBe('never')
+  })
+
+  it('①d authjs 读取出错 + desktop + remoteAuth 有 → 先回落云身份（不静默降级 guest）', async () => {
+    vi.stubEnv('DEPLOY_TARGET', 'desktop')
+    getSessionMock.mockRejectedValue(new Error('JWTSessionError'))
+    readRemoteAuthMock.mockResolvedValue(REMOTE_AUTH)
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const session = await getCurrentSession(REQ())
+    // cloud 态遇坏 cookie / AUTH_SECRET 轮换：必须保住云身份归属——若直接回 guest，
+    // 界面看起来「数据全空」，期间写入还会落到 local-guest 属主（错主不可逆）
+    expect(session?.user?.id).toBe('cloud-user-abc')
+    expect(session?.user?.isGuest).toBe(false)
+    expect(readRemoteAuthMock).toHaveBeenCalled()
+  })
+
+  it('①e authjs 读取出错 + desktop + remoteAuth 无 → 回落 guest，本地不掉线', async () => {
+    vi.stubEnv('DEPLOY_TARGET', 'desktop')
+    getSessionMock.mockRejectedValue(new Error('JWTSessionError'))
+    readRemoteAuthMock.mockResolvedValue(null)
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const session = await getCurrentSession(REQ())
+    expect(session?.user?.id).toBe('local-guest')
+  })
+
+  it('①f authjs 读取出错 + 非 desktop → null（web 未登录语义不变）', async () => {
+    vi.stubEnv('DEPLOY_TARGET', '')
+    getSessionMock.mockRejectedValue(new Error('JWTSessionError'))
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
     expect(await getCurrentSession(REQ())).toBeNull()
   })
 
@@ -93,3 +133,46 @@ describe('getCurrentSession 桌面回落（A10 优先级链）', () => {
     expect(readRemoteAuthMock).not.toHaveBeenCalled()
   })
 })
+
+describe('桌面 guest 回落的安全自检（fail-open 告警，进程级一次）', () => {
+  // 模块级 warn-once 标记随实例存在：每个用例用 resetModules + 动态 import
+  // 拿全新实例，否则第二条会被前一条的标记吞掉
+  async function importFreshSession(env: { desktopUserDataDir?: string }) {
+    vi.resetModules()
+    vi.stubEnv('DEPLOY_TARGET', 'desktop')
+    vi.stubEnv('DESKTOP_USER_DATA_DIR', env.desktopUserDataDir ?? '')
+    vi.doMock('start-authjs', () => ({ getSession: async () => null }))
+    vi.doMock('@/lib/auth/auth.config', () => ({ getAuthConfig: async () => ({}) }))
+    vi.doMock('@/server/remote-auth', () => ({ readRemoteAuth: async () => null }))
+    return import('../session')
+  }
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.restoreAllMocks()
+  })
+
+  it('DEPLOY_TARGET=desktop 且无 DESKTOP_USER_DATA_DIR → console.error 一次（cloud 部署误设信号）', async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const { getCurrentSession: fresh } = await importFreshSession({})
+    expect((await fresh(REQ()))?.user?.id).toBe('local-guest')
+    expect((await fresh(REQ()))?.user?.id).toBe('local-guest')
+
+    const securityAlerts = errorSpy.mock.calls.filter((args) => String(args[0]).includes('DESKTOP_USER_DATA_DIR'))
+    expect(securityAlerts).toHaveLength(1)
+    expect(String(securityAlerts[0]?.[0])).toContain('安全边界')
+  })
+
+  it('已注入 DESKTOP_USER_DATA_DIR（正常桌面壳）→ 不告警', async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const { getCurrentSession: fresh } = await importFreshSession({ desktopUserDataDir: '/tmp/allblue-desktop' })
+    expect((await fresh(REQ()))?.user?.id).toBe('local-guest')
+
+    const securityAlerts = errorSpy.mock.calls.filter((args) => String(args[0]).includes('DESKTOP_USER_DATA_DIR'))
+    expect(securityAlerts).toHaveLength(0)
+  })
+})

package/src/lib/auth/__tests__/page-gate.test.ts

@@ -1,5 +1,16 @@
-import { describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { isRedirect } from '@tanstack/react-router'
+
+// 桌面判定双通道（SSR/服务端导航读 DEPLOY_TARGET，客户端导航读 desktopBridge
+// 运行时事实）：两者任一为真都不应把本地用户踢去 /login（桌面免登录 P0）
+const H = vi.hoisted(() => ({ desktopServer: false, desktopClient: false }))
+
+vi.mock('@/server/desktop-guest', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/server/desktop-guest')>()
+  return { ...actual, isDesktopServer: () => H.desktopServer }
+})
+vi.mock('@/lib/desktop-env', () => ({ isDesktopClient: () => H.desktopClient }))
+
 import { requireSessionPage } from '../page-gate'
 
 function makeArgs(session: { user?: { id?: string } } | null) {
@@ -10,6 +21,11 @@ function makeArgs(session: { user?: { id?: string } } | null) {
 }
 
 describe('requireSessionPage', () => {
+  beforeEach(() => {
+    H.desktopServer = false
+    H.desktopClient = false
+  })
+
   it('已登录放行（不抛错）', () => {
     expect(() => requireSessionPage(makeArgs({ user: { id: 'u1' } }))).not.toThrow()
   })
@@ -26,4 +42,24 @@ describe('requireSessionPage', () => {
     expect(options?.to).toBe('/login')
     expect(options?.search?.redirect).toBe('/settings/account')
   })
+
+  it('桌面（服务端 SSR：DEPLOY_TARGET=desktop）：未登录也放行', () => {
+    H.desktopServer = true
+    expect(() => requireSessionPage(makeArgs(null))).not.toThrow()
+  })
+
+  it('桌面（客户端导航：desktopBridge 在场）：未登录也放行', () => {
+    H.desktopClient = true
+    expect(() => requireSessionPage(makeArgs(null))).not.toThrow()
+  })
+
+  it('web（两通道都为假）：行为不变，未登录仍跳 /login', () => {
+    let caught: unknown
+    try {
+      requireSessionPage(makeArgs(null))
+    } catch (e) {
+      caught = e
+    }
+    expect(isRedirect(caught as never)).toBe(true)
+  })
 })

package/src/lib/auth/anonymous-safe.ts

@@ -1,4 +1,5 @@
 import type { AnyRouter } from '@tanstack/react-router'
+import { isDesktopClient } from '@/lib/desktop-env'
 
 const UNAUTHORIZED_NAME = 'UnauthorizedError'
 const UNAUTHORIZED_STATUS = 401
@@ -30,6 +31,10 @@ export function navigateToLoginOnUnauthorized(
   router: Pick<AnyRouter, 'state' | 'navigate'>,
 ): boolean {
   if (!isUnauthorizedError(error)) return false
+  // 桌面端免登录：401 不等于「需要登录」（本地 guest 已是合法身份；个别端点的
+  // 401 是数据/云态问题），自动跳登录会把用户从正在编辑的页面踢走。登录云端
+  // 由用户在 settings/sync 自主发起，本兜底在桌面壳内不动作。
+  if (isDesktopClient()) return false
   const loc = router.state.location
   router.navigate({
     to: '/login',

package/src/lib/auth/page-gate.ts

@@ -1,14 +1,24 @@
 import { redirect } from '@tanstack/react-router'
+import { isDesktopServer } from '@/server/desktop-guest'
+import { isDesktopClient } from '@/lib/desktop-env'
 
 interface SessionLike {
   user?: { id?: string } | null
 }
 
-/** 「需登录页面」beforeLoad gate：未登录跳登录并携带回跳。直接用于路由 beforeLoad。 */
+/**
+ * 「需登录页面」beforeLoad gate：未登录跳登录并携带回跳。直接用于路由 beforeLoad。
+ *
+ * 桌面端（Electron + 本地 PGlite）免登录：guest 影子会话即合法本地身份，是否
+ * 登录云端由用户在 settings/sync 自主决定——一律放行，不自动踢 /login。
+ * 判定必须同时覆盖两种执行环境：SSR/服务端导航（isDesktopServer，读
+ * DEPLOY_TARGET）与客户端导航（isDesktopClient，读 desktopBridge 运行时事实）。
+ */
 export function requireSessionPage(args: {
   context: { session: SessionLike | null }
   location: { pathname: string; searchStr: string }
 }): void {
+  if (isDesktopServer() || isDesktopClient()) return
   if (!args.context.session?.user?.id) {
     throw redirect({
       to: '/login',

package/src/lib/changelog/sdk-versions.ts

@@ -112,7 +112,7 @@ export const SDK_GROUPS: SdkGroup[] = [
     "items": [
       {
         "name": "@allbluecn/web-app",
-        "version": "v0.23.6",
+        "version": "v0.24.0",
         "lastUpdate": "Nov 1, 2026",
         "source": "apps/web/package.json",
         "docsUrl": "https://github.com/allbluecn/allblue"

package/src/lib/desktop-env.ts

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// 桌面端运行时判定（客户端安全）：Electron preload 注入的 window.desktopBridge
+// 是「当前页面确实跑在桌面壳里」的运行时事实。
+//
+// 为什么不能只用 isDesktopServer()：它读 process.env.DEPLOY_TARGET，只在
+// sidecar（Node 服务端）进程里成立。TanStack Router 的 beforeLoad 在**客户端
+// 导航时也会重跑**，浏览器上下文没有 DEPLOY_TARGET → false → requireSessionPage
+// 把桌面 guest 误判成「未登录」踢去 /login（桌面本地优先实测缺陷）。
+//
+// 为什么不用 isDesktopEdition()（VITE_DEPLOY_TARGET 构建期常量）：那是「构建
+// 目标」判定；Electron 壳以运行时 env 启动 sidecar 时 bundle 未必内联 desktop，
+// 会 false negative。桥对象的判定口径与 session-guard / sync-indicator /
+// cloud-login 一致（它们都以 getDesktopBridge() 为准）。
+//
+// SSR 恒 false（无 window）：服务端侧由 isDesktopServer() 覆盖，两者在
+// beforeLoad 里「服务端 SSR 放行 + 客户端导航放行」形成闭环，无 hydration 分叉。
+import { getDesktopBridge } from './desktop-bridge-types'
+
+/** 是否运行在桌面壳渲染进程（客户端）；SSR / 浏览器恒 false */
+export function isDesktopClient(): boolean {
+  return getDesktopBridge() !== null
+}

package/src/lib/desktop-logout.ts

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 桌面云态登出编排（桌面本地优先 P2-A9 反向转移，从 sidebar-03/user-menu.tsx
+// 抽出为可测纯编排：零 React / 零 i18n / 零 DOM 依赖，副作用全由调用方注入）。
+//
+// 编排顺序（裁定口径，改动需同步单测）：
+// ① 置转移锁（复用 bind 锁文件——引擎每 tick 判定同源，「转移进行中引擎勿 tick」；
+//   旧壳无此 IPC ⇒ lock 省略，视为置锁成功，锁为双保险）；
+// ② transfer（serverFn reverseTransferOwnershipFn：校验 remoteAuth/会话本人 →
+//   单事务 cloud→guest + outbox/row_state 同事务清空 + 重建 guest 行；事务提交后
+//   server 侧已清 remote-auth——崩窗口收敛）；
+// ③ 双会话清理：logoutRemote（幂等 re-clear remote-auth）+ clearCloudSession
+//   （清 cloud-session.json，引擎 guest 守卫回 idle）→ 解锁（先清云会话再解锁，
+//   引擎恢复 tick 前云会话已不可用）；
+// ④ clearQueries + 整页 reload（reload 后 getSessionFn 回落 guest 会话）。
+//
+// 失败路径（保持既有语义）：
+// - 置锁失败（抛错或 ok=false）：notify('failed') + 返回 lock-failed，不转移、不
+//   reload（留在云态，数据仍是云属主，可重试）；
+// - 转移失败：尽力解锁 + notify('failed') + 返回 transfer-failed，不清会话、不
+//   reload（单事务已回滚，重试幂等）；
+// - 会话清理/解锁失败：全部 best-effort 吞掉，**不阻塞** ④（云会话已由 serverFn
+//   侧清理，解锁抛错也不阻止 reload——reload 后引擎按 guest 守卫重新判定）。
+
+/** 用户可见提示事件（文案由调用方决定，本模块不持有 i18n） */
+export type DesktopLogoutNotice = 'in-progress' | 'failed'
+
+/** 编排终态：lock-failed / transfer-failed 表示留在云态（未 reload） */
+export type DesktopLogoutStatus = 'done' | 'lock-failed' | 'transfer-failed'
+
+export interface DesktopLogoutDeps {
+  /** 置转移锁（旧壳无 IPC ⇒ 省略 = 视为成功） */
+  lock?: () => Promise<{ ok: boolean; error?: string }>
+  /** 反向转移（失败必须抛出，单事务回滚语义由 serverFn 保证） */
+  transfer: (cloudUserId: string) => Promise<unknown>
+  /** 清 remote-auth（幂等 best-effort，失败不得阻塞后续） */
+  logoutRemote: () => Promise<unknown>
+  /** 清 cloud-session.json（旧壳无 IPC ⇒ 省略 = no-op） */
+  clearCloudSession?: () => Promise<unknown>
+  /** 解转移锁（失败不得阻塞后续） */
+  unlock?: () => Promise<unknown>
+  /** 清 react-query 缓存 */
+  clearQueries: () => void
+  /** 整页 reload */
+  reload: () => void
+  /** 提示回调（in-progress 在置锁前，failed 在失败路径） */
+  notify?: (notice: DesktopLogoutNotice) => void
+}
+
+/**
+ * 执行桌面云态登出编排。**调用方负责在桌面壳存在且无本地 authjs 会话时调用**
+ * （云态判别式），本地凭据登出仍走 signOut 链。
+ */
+export async function runDesktopLogout(
+  cloudUserId: string,
+  deps: DesktopLogoutDeps,
+): Promise<DesktopLogoutStatus> {
+  deps.notify?.('in-progress')
+
+  // ① 转移锁
+  let lockOk = true
+  if (deps.lock) {
+    try {
+      lockOk = (await deps.lock()).ok
+    } catch {
+      lockOk = false
+    }
+  }
+  if (!lockOk) {
+    deps.notify?.('failed')
+    return 'lock-failed'
+  }
+
+  // ② 反向转移（失败：单事务回滚留在云态，尽力解锁后可重试）
+  try {
+    await deps.transfer(cloudUserId)
+  } catch {
+    await bestEffort(deps.unlock)
+    deps.notify?.('failed')
+    return 'transfer-failed'
+  }
+
+  // ③ 双会话清理 + 解锁（全部尽力而为：serverFn 已清 remote-auth，此处兜底）
+  await bestEffort(deps.logoutRemote)
+  await bestEffort(deps.clearCloudSession)
+  await bestEffort(deps.unlock)
+
+  // ④ 缓存清空 + 整页刷新（reload 后 desktop-state 回 guest）
+  deps.clearQueries()
+  deps.reload()
+  return 'done'
+}
+
+/** best-effort：缺省跳过、抛错吞掉（失败路径不得阻塞主流程） */
+async function bestEffort(action?: () => Promise<unknown>): Promise<void> {
+  if (!action) return
+  try {
+    await action()
+  } catch {
+    /* 尽力而为 */
+  }
+}

package/src/lib/hotkeys/__tests__/registry.test.ts

@@ -23,8 +23,8 @@ import { appHotkeys, findAppHotkeyConflicts, formatAppHotkeyForBadge, CATEGORY_O
 const DECLARED_IDS = Object.keys(appHotkeys) as AppHotkeyId[]
 
 describe("appHotkeys（defineAppHotkeys 官方声明）", () => {
-  it("恰好 26 条声明，且 id 与迁移前注册表对齐（+ B5 agent-abort）", () => {
-    expect(DECLARED_IDS).toHaveLength(26)
+  it("恰好 25 条声明，且 id 与迁移前注册表对齐", () => {
+    expect(DECLARED_IDS).toHaveLength(25)
     expect(DECLARED_IDS).toEqual(
       expect.arrayContaining([
         "shortcuts-panel",
@@ -34,7 +34,6 @@ describe("appHotkeys（defineAppHotkeys 官方声明）", () => {
         "copy-message",
         "chat-prev",
         "chat-next",
-        "agent-abort",
         "command-palette",
         "toggle-theme",
         "goto-dashboard",
@@ -83,15 +82,9 @@ describe("appHotkeys（defineAppHotkeys 官方声明）", () => {
     }
   })
 
-  it("非序列条目为 10 条 chord（Mod+/ 等）", () => {
+  it("非序列条目为 9 条 chord（Mod+/ 等）", () => {
     const chords = DECLARED_IDS.map((id) => appHotkeys[id]!).filter((e) => typeof e.hotkey === "string")
-    expect(chords).toHaveLength(10)
-  })
-
-  it("agent-abort（本地文件助手中止运行）：Mod+. 聊天分类——输入框内同样生效（ignoreInputs auto 对 Mod 组合放行）", () => {
-    const entry = appHotkeys["agent-abort"]
-    expect(entry.hotkey).toBe("Mod+.")
-    expect(entry.meta).toEqual({ descriptionKey: "common_hotkey_desc_agentAbort", category: "聊天" })
+    expect(chords).toHaveLength(9)
   })
 
   it("现网声明零冲突（findAppHotkeyConflicts）", () => {

package/src/lib/hotkeys/registry.ts

@@ -74,14 +74,6 @@ export const appHotkeys = defineAppHotkeys({
     hotkey: "ArrowDown",
     meta: { descriptionKey: "common_hotkey_desc_chatNext", category: "聊天" },
   },
-  // 本地文件助手（桌面 P3-B5）中止运行：绑定点 components/desktop-agent/agent-chat.tsx
-  // （仅运行中 enabled）。Mod+. 取 macOS「Command-句点 = 取消」惯例；Escape 已被
-  // close-panel 全局占用（同 scope 即冲突）。Mod 组合在 ignoreInputs auto 下输入框
-  // 内同样生效（边输入边中止）
-  "agent-abort": {
-    hotkey: "Mod+.",
-    meta: { descriptionKey: "common_hotkey_desc_agentAbort", category: "聊天" },
-  },
   "command-palette": {
     hotkey: "Mod+K",
     meta: { descriptionKey: "common_hotkey_desc_commandPalette", category: "导航" },

package/src/lib/session.ts

@@ -22,6 +22,11 @@ import { getAuthConfig } from './auth/auth.config'
 // desktop-session-merge 为纯数据组装 + remote-auth 纯 fs 读取（node:fs +
 // env 守卫），无 prisma/server 重依赖链，客户端/云端部署零副作用。
 import { getDesktopRemoteSession } from '@/server/desktop-session-merge'
+// 桌面免登录（本地优先 P0 修复）：guest 影子身份是本地合法身份，必须在**鉴权
+// 单点**生效——requireAuth / server seam / 各 serverFn 的软鉴权（getAccountTeamFn、
+// design/detail 等）全部复用本函数，只在这里补一次即可让全站口径一致；否则
+// 这些端点把 guest 判成未登录，路由 beforeLoad 收到 unauthorized 后踢 /login。
+import { buildGuestSession, isDesktopServer } from '@/server/desktop-guest'
 
 export type SessionUser = NonNullable<AuthSession['user']> & {
   id?: string
@@ -43,6 +48,51 @@ export type SessionUser = NonNullable<AuthSession['user']> & {
 
 export type Session = Omit<AuthSession, 'user'> & { user?: SessionUser | null }
 
+/** desktop guest 降级的 warn-once 标记（进程级；沿用 requireAuth 的排查线索语义：
+ *  桌面单机 guest 合法，但服务器部署误设 DEPLOY_TARGET=desktop 时匿名请求会变成
+ *  共享 guest 身份（fail-open）——至少留一条日志） */
+let warnedDesktopGuest = false
+
+/** fail-open 安全自检的 warn/error-once 标记（进程级） */
+let warnedDesktopSecurity = false
+
+/**
+ * 桌面回落入口的安全自检（进程级一次）。
+ *
+ * `DEPLOY_TARGET=desktop` 在本仓是**安全边界**而不只是功能开关：它让匿名请求
+ * 变成共享的本地 guest 身份（AI / SSE / anyhub 文件代理等全部 getCurrentSession
+ * 消费点一起生效）。真正的桌面后端由 Electron 主进程注入 `DESKTOP_USER_DATA_DIR`
+ * （PGlite 数据目录 + remote-auth.json 的根）——该 env 缺失而 DEPLOY_TARGET 仍是
+ * desktop，最可能的解释是「云部署误设了 DEPLOY_TARGET」。
+ *
+ * 当前口径：**只 console.error 告警，不硬失败**（开发/测试也放行）。生产环境是否
+ * 直接拒绝启动/拒绝 guest 回落由控制者另行裁决；在此之前保留可用的同时留下显眼
+ * 线索。硬失败点应加在本函数之后（返回 guest 之前）。
+ */
+function checkDesktopFallbackEnvOnce(): void {
+  if (warnedDesktopSecurity) return
+  warnedDesktopSecurity = true
+  if (process.env.DESKTOP_USER_DATA_DIR) return
+  console.error(
+    '[session] 安全告警：DEPLOY_TARGET=desktop 但未设置 DESKTOP_USER_DATA_DIR。\n' +
+      '  DEPLOY_TARGET=desktop 是安全边界：匿名请求会被当作本地 guest 身份（AI / SSE / 文件代理等全部放行）。\n' +
+      '  若非桌面单机部署，请立即移除 DEPLOY_TARGET=desktop 以恢复鉴权；\n' +
+      '  桌面壳会由 Electron 主进程注入 DESKTOP_USER_DATA_DIR（PGlite 目录 / remote-auth.json 根）。',
+  )
+}
+
+function guestSession() {
+  checkDesktopFallbackEnvOnce()
+  if (!warnedDesktopGuest) {
+    warnedDesktopGuest = true
+    console.warn(
+      '[session] DEPLOY_TARGET=desktop：无会话请求已回落到本地 guest 身份。' +
+        '若这是服务器/云端部署，请移除 DEPLOY_TARGET=desktop 以恢复鉴权。',
+    )
+  }
+  return buildGuestSession()
+}
+
 export async function getCurrentSession(request?: Request): Promise<Session | null> {
   if (!request) return null
   try {
@@ -56,12 +106,32 @@ export async function getCurrentSession(request?: Request): Promise<Session | nu
     // 604 处自动受益；非 desktop 恒 null（desktop 判定先于 fs 读取，零 IO）。
     const remoteSession = await getDesktopRemoteSession()
     if (remoteSession) return remoteSession
+    // 桌面免登录（本地优先 P0）：既无 cloud 身份也未登录时，guest 影子用户即
+    // 本机当前用户（与 getSessionFn / requireAuth 的 guest 分支同一身份）。
+    // 放在本单点而非各端点：否则 account-team / design-detail 等「软鉴权」端点
+    // 把 guest 判成未登录 → beforeLoad unauthorized → 自动跳 /login（实测 P0）。
+    if (isDesktopServer()) return guestSession()
     return session
   } catch (error) {
     // JWT 解密失败（AUTH_SECRET 轮换 / 跨应用同名 cookie 污染）等效于无 session：
     // 返回 null 走未登录分支；@auth/core 会自行清理坏 cookie。
     // 不兜底时 JWTSessionError 会炸穿所有未捕获的调用点（route beforeLoad / serverFn）。
     console.warn('[session] 读取 session 失败（坏 cookie 或 auth 配置异常），降级为未登录:', error instanceof Error ? error.message : error)
+    // 桌面端不存在「未登录」态：坏 cookie / 鉴权配置异常不得让本地用户掉线
+    // （否则首屏 session 为 null → 页面守卫与控制台全是登录引导）。
+    //
+    // 但「authjs 抛错」≠「本机无身份」：桌面 cloud 态的真身份在 remote-auth.json，
+    // 必须先试云身份再回落 guest——直接回 guest 会让云账号用户看起来「数据全空」，
+    // 期间写入还会落到 local-guest 属主（数据错主，后续反向转移也救不回来）。
+    if (isDesktopServer()) {
+      try {
+        const remoteSession = await getDesktopRemoteSession()
+        if (remoteSession) return remoteSession
+      } catch (remoteError) {
+        console.warn('[session] 桌面云身份回落失败，降级本地 guest:', remoteError instanceof Error ? remoteError.message : remoteError)
+      }
+      return guestSession()
+    }
     return null
   }
 }

package/src/paraglide/README.md

@@ -2,7 +2,7 @@
 
 > Auto-generated i18n message functions. Import `messages.js` to use translated strings.
 
-Compiled from: `/Users/urmynami/HelloAI/AllBlue-Workspace/AllBlue/.worktrees/feat-local-first/apps/web/project.inlang`
+Compiled from: `/Users/urmynami/HelloAI/AllBlue-Workspace/AllBlue/.worktrees/feat-harness-local-agent/apps/web/project.inlang`
 
 
 ## What is this folder?

package/src/paraglide/messages/_index.d.ts

@@ -26,7 +26,6 @@ export * from "./agent_desktop_errorgeneric1.js";
 export * from "./agent_desktop_errorunauthorized1.js";
 export * from "./agent_desktop_errorunavailable1.js";
 export * from "./agent_desktop_pagedescription1.js";
-export * from "./agent_desktop_title.js";
 export * from "./agent_desktop_toolcountfiles2.js";
 export * from "./agent_desktop_toolcounthits2.js";
 export * from "./agent_desktop_toolcountlines2.js";
@@ -1837,7 +1836,6 @@ export * from "./common_hotkey_cat_chat.js";
 export * from "./common_hotkey_cat_edit.js";
 export * from "./common_hotkey_cat_navigation.js";
 export * from "./common_hotkey_cat_view.js";
-export * from "./common_hotkey_desc_agentabort1.js";
 export * from "./common_hotkey_desc_chatnext1.js";
 export * from "./common_hotkey_desc_chatprev1.js";
 export * from "./common_hotkey_desc_closepanel1.js";
@@ -2548,9 +2546,21 @@ export * from "./harness_dock_storyempty1.js";
 export * from "./harness_dock_storynotfound2.js";
 export * from "./harness_dock_todo.js";
 export * from "./harness_dock_unknownresource1.js";
+export * from "./harness_engine_cloud.js";
+export * from "./harness_engine_label.js";
+export * from "./harness_engine_local.js";
+export * from "./harness_engine_localbadge1.js";
+export * from "./harness_engine_localhint1.js";
+export * from "./harness_engine_localnoattachments2.js";
+export * from "./harness_engine_switchlocked1.js";
 export * from "./harness_exportspec1.js";
 export * from "./harness_exportspechtml2.js";
 export * from "./harness_ghostthinking1.js";
+export * from "./harness_localworkspace_choose1.js";
+export * from "./harness_localworkspace_dialogdescription2.js";
+export * from "./harness_localworkspace_dialogtitle2.js";
+export * from "./harness_localworkspace_manage1.js";
+export * from "./harness_localworkspace_required1.js";
 export * from "./harness_media_code.js";
 export * from "./harness_media_nocode1.js";
 export * from "./harness_media_nospec1.js";

package/src/paraglide/messages/_index.js

@@ -28,7 +28,6 @@ export * from './agent_desktop_errorgeneric1.js'
 export * from './agent_desktop_errorunauthorized1.js'
 export * from './agent_desktop_errorunavailable1.js'
 export * from './agent_desktop_pagedescription1.js'
-export * from './agent_desktop_title.js'
 export * from './agent_desktop_toolcountfiles2.js'
 export * from './agent_desktop_toolcounthits2.js'
 export * from './agent_desktop_toolcountlines2.js'
@@ -1839,7 +1838,6 @@ export * from './common_hotkey_cat_chat.js'
 export * from './common_hotkey_cat_edit.js'
 export * from './common_hotkey_cat_navigation.js'
 export * from './common_hotkey_cat_view.js'
-export * from './common_hotkey_desc_agentabort1.js'
 export * from './common_hotkey_desc_chatnext1.js'
 export * from './common_hotkey_desc_chatprev1.js'
 export * from './common_hotkey_desc_closepanel1.js'
@@ -2550,9 +2548,21 @@ export * from './harness_dock_storyempty1.js'
 export * from './harness_dock_storynotfound2.js'
 export * from './harness_dock_todo.js'
 export * from './harness_dock_unknownresource1.js'
+export * from './harness_engine_cloud.js'
+export * from './harness_engine_label.js'
+export * from './harness_engine_local.js'
+export * from './harness_engine_localbadge1.js'
+export * from './harness_engine_localhint1.js'
+export * from './harness_engine_localnoattachments2.js'
+export * from './harness_engine_switchlocked1.js'
 export * from './harness_exportspec1.js'
 export * from './harness_exportspechtml2.js'
 export * from './harness_ghostthinking1.js'
+export * from './harness_localworkspace_choose1.js'
+export * from './harness_localworkspace_dialogdescription2.js'
+export * from './harness_localworkspace_dialogtitle2.js'
+export * from './harness_localworkspace_manage1.js'
+export * from './harness_localworkspace_required1.js'
 export * from './harness_media_code.js'
 export * from './harness_media_nocode1.js'
 export * from './harness_media_nospec1.js'

package/src/paraglide/messages/{agent_desktop_title.d.ts → harness_engine_cloud.d.ts}

@@ -1,16 +1,16 @@
 /**
 * | output |
 * | --- |
-* | "Local File Assistant" |
+* | "Cloud model" |
 *
-* @param {Agent_Desktop_TitleInputs} inputs
+* @param {Harness_Engine_CloudInputs} inputs
 * @param {{ locale?: "zh" | "en" }} options
 * @returns {LocalizedString}
 */
-export const agent_desktop_title: ((inputs?: Agent_Desktop_TitleInputs, options?: {
+export const harness_engine_cloud: ((inputs?: Harness_Engine_CloudInputs, options?: {
     locale?: "zh" | "en";
-}) => LocalizedString) & import("../runtime.js").MessageMetadata<Agent_Desktop_TitleInputs, {
+}) => LocalizedString) & import("../runtime.js").MessageMetadata<Harness_Engine_CloudInputs, {
     locale?: "zh" | "en";
 }, {}>;
 export type LocalizedString = import("../runtime.js").LocalizedString;
-export type Agent_Desktop_TitleInputs = {};
+export type Harness_Engine_CloudInputs = {};

package/src/paraglide/messages/harness_engine_cloud.js

@@ -0,0 +1,29 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Harness_Engine_CloudInputs */
+
+const zh_harness_engine_cloud = /** @type {(inputs: Harness_Engine_CloudInputs) => LocalizedString} */ () => {
+	return /** @type {LocalizedString} */ (`云端模型`)
+};
+
+const en_harness_engine_cloud = /** @type {(inputs: Harness_Engine_CloudInputs) => LocalizedString} */ () => {
+	return /** @type {LocalizedString} */ (`Cloud model`)
+};
+
+/**
+* | output |
+* | --- |
+* | "Cloud model" |
+*
+* @param {Harness_Engine_CloudInputs} inputs
+* @param {{ locale?: "zh" | "en" }} options
+* @returns {LocalizedString}
+*/
+export const harness_engine_cloud = /** @type {((inputs?: Harness_Engine_CloudInputs, options?: { locale?: "zh" | "en" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Harness_Engine_CloudInputs, { locale?: "zh" | "en" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_harness_engine_cloud(inputs)
+	return zh_harness_engine_cloud(inputs)
+});