guanwei 1.1.2 → 1.1.4

package/README.en.md

@@ -50,13 +50,14 @@ An open-source Chinese metaphysics application covering **nine arts of divinatio
 - Results computed by the backend and **persisted to SQLite**
 
 ### AI Deep Interpretation
-- 9 agents × skill orchestration (e.g. Ziwei: chart structure → star palaces → twelve houses → major cycles → life stages)
+- **9 role-based personas**: one persona per art (e.g. Ziwei: chart structure → star palaces → twelve houses → major cycles → life stages) with a skill list injected in a single prompt — true multi-agent orchestration is planned (guanwei-pro mode, see ROADMAP)
 - **Dual schemas**: natal-chart reports (raw reading / character / family / mind / life stages / career / love / wealth / health) and divination reports (situation / trend / timing)
 - **Chart-fact consistency**: the AI must quote chart data verbatim; the backend **verifies six-relations facts** (palace branch, main stars, borrowed stars, four transformations) and patches contradictions
 - **Stable readings**: cached chart-parsing step, low sampling temperature, evidence-anchored claims, de-duplication with word budgets
 - **Life-event calibration**: record known life events; the AI echoes them at the matching years and never contradicts them
 - Question–art **suitability analysis** (e.g. Qimen is not advised for romance questions)
 - Streaming generation + structured report cards; export to Markdown / PDF
+- **Classical citations (in progress)**: the duanyu library (`shared/core/data/duanyu.ts`) holds 16 verbatim classical excerpts, all still in `seed` status (pending word-by-word review); per policy they are not injected into the AI prompt until reviewed — current readings rely on model knowledge, with reviewed entries wired in progressively (see ROADMAP)
 
 ### Other
 - Classics pages, academy (history and knowledge of the nine arts)
@@ -126,7 +127,7 @@ Open http://localhost:5173 . Stop with `docker compose down`.
 
 Images: `ghcr.io/rubyccll/guanwei-guanwei-web` / `guanwei-guanwei-backend`; override ports with `WEB_PORT=5180 API_PORT=3020 docker compose up -d` if needed.
 
-#### Option 6: Local Node.js (≥ 22)
+#### Option 6: Local Node.js (≥ 22.5, node:sqlite built-in)
 
 ```bash
 ./scripts/setup.sh --key YOUR_API_KEY   # interactive mode: run ./scripts/setup.sh
@@ -184,7 +185,9 @@ npm test    # 181 tests (engines / rendering / interactions / storage / prompts)
 
 ## 🔐 Security
 - Keys live only in local `server/.env` (gitignored); Docker builds exclude `.env` via `.dockerignore`
+- Passwords are hashed with **scrypt (random salt)**; legacy hashes are upgraded on successful login
 - Test data is fully fictional/anonymized — no real personal information in this repository
+- ⚠️ **Deployment boundary**: this app targets **local/private self-hosting** and ships **no auth middleware** — user identity is only the `username` passed in requests (anyone knowing a username can read that user's profile via `GET /:username/profile`). **Do not expose it directly to the public internet**; put a reverse proxy with gateway auth in front (e.g. Nginx basic auth / Authelia / Cloudflare Access) if you need public access.
 
 ## 📄 Sample Output
 

package/README.md

@@ -20,7 +20,7 @@
 
 <p align="center">
   <b>Guanwei</b> — an open-source Chinese metaphysics application: eight-character Bazi, Ziwei Doushu, classical astrology, Qimen Dunjia, Liuyao, Da Liu Ren, Meihua, Xiaoliuren and Tarot — with AI-powered in-depth interpretation.
-  <br><i>东玄为主、中西合参的玄学占卜应用：九术排盘、AI 深度解读、古籍引证、学馆修习，一条链路贯通「排盘 → 解读 → 归档 → 回看」。</i>
+  <br><i>东玄为主、中西合参的玄学占卜应用：九术排盘、AI 深度解读、古籍学馆，一条链路贯通「排盘 → 解读 → 归档 → 回看」。</i>
 </p>
 
 > 占问所得，仅供修身养性、怡情遣兴之用，不构成任何决策依据。
@@ -56,13 +56,14 @@
 - 起占结果由后端计算并**持久化入库**（SQLite），六爻摇卦、塔罗抽牌等交互结果同样后端定稿
 
 ### AI 深度解读
-- 9 个 Agent × Skills 编排（如紫微：命盘结构 → 星曜落宫 → 十二宫 → 大限流年 → 人生阶段）
+- **9 术角色化解读**：每术独立 persona（紫微：命盘结构 → 星曜落宫 → 十二宫 → 大限流年 → 人生阶段），技能清单单轮注入（多 Agent 编排规划中，接入后作为 guanwei-pro 模式，见 ROADMAP）
 - **双轨 Schema**：命盘类（原始解读/性格/原生家庭/心智模式/人生阶段/事业/爱情/财富/健康）、占问类（现状/趋势/时机）
 - **盘面事实一致性约束**：AI 必须逐字引用排盘数据，不得编造；后端**六亲宫位事实校验 + 矛盾定向修正**（宫位地支/主星/借星/生年四化）
 - **解读稳定性**：Step1 盘面解析缓存复用、低温采样、论断锚定（主观程度词必须有盘面依据）、去重与字数预算
 - **人生经历校准**：可录入命主已知人生事件，AI 解读在对应流年处呼应、且不与已知经历矛盾
 - 问题-术数**适配性分析**（如奇门不适于问情爱）
 - 流式生成 + 结构化报告卡片，可导出 Markdown / 存为 PDF
+- **古籍引证（校核中）**：断语库 `shared/core/data/duanyu.ts` 收录古籍原文 16 条，当前为 seed 状态（待逐字校核），按规范未 reviewed 不注入 AI prompt——现阶段解读引证主要依赖模型知识，断语库校核完成后逐条接入（见 ROADMAP）
 
 ### 其他
 - 古籍页（背景动画、经典原文）、学馆（九术源流与知识）
@@ -143,7 +144,7 @@ guanwei start
 
 镜像：`ghcr.io/rubyccll/guanwei-guanwei-web` / `guanwei-guanwei-backend`；端口冲突时 `WEB_PORT=5180 API_PORT=3020 docker compose up -d` 覆盖。也可直接 `docker pull ghcr.io/rubyccll/guanwei-guanwei-web:latest`。
 
-#### 方式六：本地 Node.js（≥ 22）
+#### 方式六：本地 Node.js（≥ 22.5，需 node:sqlite 内置支持）
 
 ```bash
 ./scripts/setup.sh --key 你的APIKey   # 交互式可直接运行 ./scripts/setup.sh
@@ -207,8 +208,10 @@ cd server && npx tsx scripts/divineStoreSmoke.ts   # SQLite 存储冒烟
 
 ## 🔐 安全说明
 - 所有密钥仅存于本地 `server/.env`（已 gitignore），仓库只提供 `.env.example` 模板；Docker 镜像构建已排除 `.env`（.dockerignore）
+- 密码哈希使用 **scrypt（带随机盐）**，登录时兼容升级存量旧哈希
 - AI 报告质量门槛：结构评分不达标不入库，自动留档供改进提示词
 - 测试数据全部虚构/匿名化，不含真实用户隐私；真实案例仅存本地（git 忽略）
+- ⚠️ **部署边界（务必知晓）**：本项目定位为「本地/内网自部署」工具，**未内置登录鉴权体系**——用户身份仅靠传入的 username 区分，知道用户名即可读取该用户档案（`GET /:username/profile` 无口令校验）。**请勿直接暴露到公网**；如需公网访问，必须在前面架设反向代理 + 网关鉴权（如 Nginx basic auth / Authelia / Cloudflare Access 等），或在应用层另行加固。
 
 ## 📄 示例输出