guanwei 1.3.4 → 1.3.5

package/server/src/services/dataDir.ts

@@ -48,14 +48,25 @@ const LEGACY_DIRS = [
 /** 解析数据文件路径（含旧目录一次性迁移） */
 export function dataFile(name: string): string {
   const target = path.join(DATA_DIR, name);
+  // SQLite WAL 模式下数据可能主要落在 -wal 文件里、主库文件本身很小；
+  // 比较体积时必须把 -wal/-shm 计入，否则会误判「目标库较小」而用旧库覆盖新库。
+  const sizeOf = (p: string): number => {
+    try {
+      let n = fs.statSync(p).size;
+      for (const suffix of ['-wal', '-shm']) {
+        try { n += fs.statSync(p + suffix).size; } catch { /* 无副文件 */ }
+      }
+      return n;
+    } catch { return 0; }
+  };
   try {
     const legacy = LEGACY_DIRS.map(d => path.join(d, name)).find(p => fs.existsSync(p) && fs.statSync(p).size > 0);
     const legacyOk = !!legacy;
     const targetExists = fs.existsSync(target);
-    const targetSize = targetExists ? fs.statSync(target).size : 0;
+    const targetSize = sizeOf(target);
     let needFill = !targetExists || targetSize === 0;
     // SQLite 库启发式：目标存在但显著小于旧库（如历史遗留的空壳库）→ 也迁移，避免真实记录被空库遮蔽
-    if (!needFill && /\.(db|sqlite|sqlite3)$/.test(name) && legacyOk && targetSize < fs.statSync(legacy!).size / 2) {
+    if (!needFill && /\.(db|sqlite|sqlite3)$/.test(name) && legacyOk && targetSize < sizeOf(legacy!) / 2) {
       needFill = true;
     }
     if (legacyOk && needFill) {
@@ -66,6 +77,10 @@ export function dataFile(name: string): string {
         console.log('[data] 目标库较小，已备份: ' + bak);
       }
       fs.copyFileSync(legacy!, target);
+      // 只复制主库：旧库的 WAL 副文件若一并留用会与新主库不匹配
+      for (const suffix of ['-wal', '-shm']) {
+        try { fs.rmSync(target + suffix, { force: true }); } catch { /* ignore */ }
+      }
       console.log('[data] 已从旧路径迁移: ' + legacy + ' → ' + target + ' (' + fs.statSync(target).size + ' bytes)');
     }
   } catch (e: any) {
@@ -74,7 +89,7 @@ export function dataFile(name: string): string {
   return target;
 }
 
-/** 用户档案库（JSON） */
+/** 旧用户档案库（JSON）：仅作一次性导入来源（见 services/usersStore.ensureInit） */
 export const USERS_DB = process.env.GUANWEI_USERS_DB || dataFile('db.json');
-/** 占卜记录库（SQLite） */
+/** 统一数据库（SQLite）：用户库 + 占卜记录 + 失败留档 */
 export const DIVINE_DB = process.env.GUANWEI_DB_FILE || dataFile('guanwei.db');

package/server/src/services/db.ts

@@ -0,0 +1,131 @@
+// 统一 SQLite 句柄（单一数据源）
+//
+// 背景（2026-09 W38 架构欠债 #4）：用户库曾是 JSON（db.json）、占卜记录是 SQLite（guanwei.db），
+// 两套存储两套写法：JSON 侧靠「进程内 Promise 串行 + 临时文件 rename」，SQLite 侧靠事务。
+// 现合并为**同一个 SQLite 库**：users / divinations / ai_fail_logs / meta 四张表，
+// 所有写操作走 BEGIN IMMEDIATE 事务，跨进程亦安全（busy_timeout + WAL）。
+//
+// 依赖：node:sqlite（Node 22 内置，零依赖）
+import { createRequire } from 'node:module';
+import { DIVINE_DB } from './dataDir.js';
+import fs from 'fs';
+import path from 'path';
+
+// node:sqlite 用 createRequire 运行时加载：
+//  - 前端测试（vitest/jsdom）会沿 import 链把 server 模块也走 Vite 打包，静态 import 会被判为
+//    「Cannot bundle built-in module "node:sqlite"」；require 形式可避免。运行时行为完全一致。
+//  - 顺带让「仅导入而不使用存储」的场景不加载 SQLite。
+type DatabaseSync = import('node:sqlite').DatabaseSync;
+type DatabaseSyncCtor = typeof import('node:sqlite').DatabaseSync;
+
+let DatabaseSyncImpl: DatabaseSyncCtor | null = null;
+function sqlite(): DatabaseSyncCtor {
+  if (!DatabaseSyncImpl) {
+    DatabaseSyncImpl = createRequire(import.meta.url)('node:sqlite').DatabaseSync as DatabaseSyncCtor;
+  }
+  return DatabaseSyncImpl;
+}
+
+let db: DatabaseSync | null = null;
+
+/** 取库句柄（首次调用建表 + 迁移） */
+export function getDb(): DatabaseSync {
+  if (db) return db;
+  fs.mkdirSync(path.dirname(DIVINE_DB), { recursive: true });
+  db = new (sqlite())(DIVINE_DB);
+  // WAL：读写不互斥（外部工具/测试可同时只读）；busy_timeout：多进程时等待而非立刻 SQLITE_BUSY
+  try { db.exec('PRAGMA journal_mode = WAL'); } catch (e: any) { console.warn('[db] WAL 未启用:', e?.message || e); }
+  try { db.exec('PRAGMA busy_timeout = 5000'); } catch { /* 老版本忽略 */ }
+  try { db.exec('PRAGMA foreign_keys = ON'); } catch { /* 同上 */ }
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS users (
+      username      TEXT PRIMARY KEY,
+      pass_hash     TEXT NOT NULL DEFAULT '',
+      created_at    INTEGER NOT NULL,
+      profile_json  TEXT NOT NULL DEFAULT '{}',
+      samples_json  TEXT NOT NULL DEFAULT '[]',
+      records_json  TEXT NOT NULL DEFAULT '[]',
+      token         TEXT,
+      token_expires INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_users_token ON users(token);
+
+    CREATE TABLE IF NOT EXISTS divinations (
+      id            TEXT PRIMARY KEY,
+      username      TEXT NOT NULL,
+      art_id        TEXT NOT NULL,
+      kind          TEXT NOT NULL,
+      question      TEXT,
+      profile_id    TEXT NOT NULL DEFAULT 'main',
+      profile_json  TEXT,
+      params_json   TEXT,
+      result_raw_json TEXT NOT NULL,
+      display_json  TEXT NOT NULL,
+      report_json   TEXT,
+      report_quality TEXT,
+      status        TEXT NOT NULL DEFAULT 'divined',
+      created_at    INTEGER NOT NULL,
+      updated_at    INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_div_user_time ON divinations(username, created_at DESC);
+
+    CREATE TABLE IF NOT EXISTS ai_fail_logs (
+      id          INTEGER PRIMARY KEY AUTOINCREMENT,
+      art_id      TEXT NOT NULL,
+      kind        TEXT NOT NULL,
+      divine_id   TEXT,
+      raw_output  TEXT,
+      fail_reason TEXT,
+      created_at  INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS meta (
+      k TEXT PRIMARY KEY,
+      v TEXT NOT NULL
+    );
+  `);
+  // 老库迁移：补 divinations.profile_id 列（2026-08-20 档案隔离）——必须在引用该列的索引之前
+  try {
+    db.exec("ALTER TABLE divinations ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'main'");
+  } catch (e: any) {
+    if (!/duplicate column/i.test(e.message || '')) console.error('[db] 迁移 profile_id 失败:', e.message);
+  }
+  db.exec('CREATE INDEX IF NOT EXISTS idx_div_user_profile ON divinations(username, profile_id, created_at DESC)');
+  return db;
+}
+
+/**
+ * 立即写事务：fn 内**不得 await**（node:sqlite 为同步 API）。
+ * BEGIN IMMEDIATE 立刻取写锁，避免「读后写」之间的竞态（并发注册/建档的唯一性由此保证）。
+ */
+export function withTx<T>(fn: () => T): T {
+  const d = getDb();
+  d.exec('BEGIN IMMEDIATE');
+  try {
+    const result = fn();
+    d.exec('COMMIT');
+    return result;
+  } catch (e) {
+    try { d.exec('ROLLBACK'); } catch { /* 回滚失败时以原异常为准 */ }
+    throw e;
+  }
+}
+
+/** 读取元信息（迁移标记等） */
+export function getMeta(k: string): string | null {
+  try {
+    const row = getDb().prepare('SELECT v FROM meta WHERE k = ?').get(k) as { v?: string } | undefined;
+    return row?.v ?? null;
+  } catch { return null; }
+}
+
+/** 写入元信息 */
+export function setMeta(k: string, v: string): void {
+  getDb().prepare('INSERT INTO meta (k, v) VALUES (?, ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v').run(k, v);
+}
+
+/** 仅测试/运维用：关闭句柄（下次调用重新打开） */
+export function closeDb(): void {
+  try { db?.close(); } catch { /* ignore */ }
+  db = null;
+}

package/server/src/services/divineStore.ts

@@ -1,60 +1,10 @@
 // 占卜数据存储（SQLite）：起占记录 / AI 报告 / 失败留档 / 占卜历史
-// 依赖：node:sqlite（Node 22 内置，零依赖）
-import { DatabaseSync } from 'node:sqlite';
-import { DIVINE_DB } from './dataDir.js';
-import fs from 'fs';
+// 句柄与建表统一由 services/db 提供（与用户库同库，见 db.ts）
+import { getDb, withTx } from './db.js';
 import { randomUUID } from 'node:crypto';
-import path from 'path';
-import { fileURLToPath } from 'url';
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const DB_FILE = DIVINE_DB;
-
-let db: DatabaseSync | null = null;
-
-export function getDb(): DatabaseSync {
-  if (db) return db;
-  fs.mkdirSync(path.dirname(DB_FILE), { recursive: true });
-  db = new DatabaseSync(DB_FILE);
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS divinations (
-      id            TEXT PRIMARY KEY,
-      username      TEXT NOT NULL,
-      art_id        TEXT NOT NULL,
-      kind          TEXT NOT NULL,
-      question      TEXT,
-      profile_id    TEXT NOT NULL DEFAULT 'main',
-      profile_json  TEXT,
-      params_json   TEXT,
-      result_raw_json TEXT NOT NULL,
-      display_json  TEXT NOT NULL,
-      report_json   TEXT,
-      report_quality TEXT,
-      status        TEXT NOT NULL DEFAULT 'divined',
-      created_at    INTEGER NOT NULL,
-      updated_at    INTEGER NOT NULL
-    );
-    CREATE INDEX IF NOT EXISTS idx_div_user_time ON divinations(username, created_at DESC);
-
-    CREATE TABLE IF NOT EXISTS ai_fail_logs (
-      id          INTEGER PRIMARY KEY AUTOINCREMENT,
-      art_id      TEXT NOT NULL,
-      kind        TEXT NOT NULL,
-      divine_id   TEXT,
-      raw_output  TEXT,
-      fail_reason TEXT,
-      created_at  INTEGER NOT NULL
-    );
-  `);
-  // 老库迁移：补 profile_id 列（2026-08-20 档案隔离）——必须在引用该列的索引之前
-  try {
-    db.exec("ALTER TABLE divinations ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'main'");
-  } catch (e: any) {
-    if (!/duplicate column/i.test(e.message || '')) console.error('[divineStore] 迁移 profile_id 失败:', e.message);
-  }
-  db.exec('CREATE INDEX IF NOT EXISTS idx_div_user_profile ON divinations(username, profile_id, created_at DESC)');
-  return db;
-}
+export { getDb };
+export { withTx };
 
 export interface DivineRecord {
   id: string;
@@ -156,6 +106,7 @@ export function markAiFailed(id: string | null, artId: string, kind: string, rea
 }
 
 // 占卜历史分页（时间倒序，摘要字段）
+// 同一毫秒内建立的记录（如冒烟/并发场景）以 rowid 兜底，保证分页顺序确定（原按 id 比较 uuid，顺序随机）
 export function listDivinations(username: string, page = 1, pageSize = 20, profileId?: string): { list: { divineId: string; artId: string; question: string | null; createdAt: number; hasReport: boolean; status: string; profileId: string }[]; total: number } {
   const d = getDb();
   const pageN = Math.max(1, page);
@@ -163,7 +114,7 @@ export function listDivinations(username: string, page = 1, pageSize = 20, profi
   const where = profileId ? 'WHERE username = ? AND profile_id = ?' : 'WHERE username = ?';
   const params = profileId ? [username, profileId] : [username];
   const totalRow = d.prepare('SELECT COUNT(*) AS c FROM divinations ' + where).get(...params) as any;
-  const rows = d.prepare('SELECT id, art_id, question, created_at, report_json, status, profile_id FROM divinations ' + where + ' ORDER BY created_at DESC, id DESC LIMIT ? OFFSET ?')
+  const rows = d.prepare('SELECT id, art_id, question, created_at, report_json, status, profile_id FROM divinations ' + where + ' ORDER BY created_at DESC, rowid DESC LIMIT ? OFFSET ?')
     .all(...params, size, (pageN - 1) * size) as any[];
   return {
     list: rows.map(r => ({

package/server/src/services/usersStore.ts

@@ -0,0 +1,221 @@
+// 用户库（SQLite）：账号 / 出生档案 / 示例档案 / 云同步记录 / 登录态 token
+//
+// 历史（2026-09）：原为 JSON 文件（db.json）+ 进程内 Promise 串行锁。合并到统一 SQLite 后：
+//  - 写操作走 BEGIN IMMEDIATE 事务：并发注册/建档不再互相覆盖，也不再依赖进程内锁
+//  - 与占卜记录同库：跨进程一致（WAL + busy_timeout），外部工具可只读查看
+//  - 旧 db.json 在 users 表为空时**一次性导入**（原文件保留，不删除，便于回滚）
+import crypto from 'crypto';
+import fs from 'fs';
+import { getDb, withTx, getMeta, setMeta } from './db.js';
+import { USERS_DB } from './dataDir.js';
+
+export interface Sample { id: string; name: string; profile: Record<string, unknown> }
+export interface UserRow {
+  username: string;
+  passHash: string;
+  createdAt: number;
+  profile: Record<string, unknown>;
+  samples: Sample[];
+  records: Record<string, unknown>[];
+  /** 登录态 token（注册/登录签发）；占位账号为建档凭据 claimToken */
+  token?: string;
+  tokenExpires?: number;
+}
+
+const COLS = 'username, pass_hash, created_at, profile_json, samples_json, records_json, token, token_expires';
+
+function parseJson<T>(s: unknown, fallback: T): T {
+  if (typeof s !== 'string' || !s) return fallback;
+  try {
+    const v = JSON.parse(s);
+    return (v ?? fallback) as T;
+  } catch { return fallback; }
+}
+
+function rowToUser(r: any): UserRow {
+  return {
+    username: String(r.username),
+    passHash: String(r.pass_hash || ''),
+    createdAt: Number(r.created_at || 0),
+    profile: parseJson<Record<string, unknown>>(r.profile_json, {}),
+    samples: parseJson<Sample[]>(r.samples_json, []),
+    records: parseJson<Record<string, unknown>[]>(r.records_json, []),
+    token: r.token ? String(r.token) : undefined,
+    tokenExpires: r.token_expires == null ? undefined : Number(r.token_expires),
+  };
+}
+
+// ─── token 工具（原 users.ts 逻辑，统一到此处，供 routes/auth 复用）───
+export function newToken(): string {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+/** 恒时比较 token（含过期校验）：false = 无效 */
+export function tokenMatches(user: Pick<UserRow, 'token' | 'tokenExpires'> | null | undefined, token: string | undefined): boolean {
+  if (!user || !token || !user.token) return false;
+  if (user.tokenExpires && Date.now() > user.tokenExpires) return false;   // 过期即失效
+  const a = Buffer.from(token), b = Buffer.from(user.token);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+// ─── 读 ───
+export function getUser(username: string): UserRow | null {
+  ensureInit();
+  if (!username) return null;
+  const row = getDb().prepare(`SELECT ${COLS} FROM users WHERE username = ?`).get(username) as any;
+  return row ? rowToUser(row) : null;
+}
+
+export function userCount(): number {
+  ensureInit();
+  return Number((getDb().prepare('SELECT COUNT(*) AS c FROM users').get() as any)?.c || 0);
+}
+
+/** token → 用户（仅返回 token 完全匹配者；不匹配/不存在 → null） */
+export function getUserByToken(token: string): UserRow | null {
+  ensureInit();
+  if (!token) return null;
+  const row = getDb().prepare(`SELECT ${COLS} FROM users WHERE token = ?`).get(token) as any;
+  if (!row) return null;
+  const user = rowToUser(row);
+  // 索引命中后再做一次恒时比较（防御性：避免长度差异等边信道）
+  return tokenMatches(user, token) ? user : null;
+}
+
+// ─── 写 ───
+export interface NewUser {
+  username: string; passHash?: string; profile?: Record<string, unknown>;
+  token?: string; tokenExpires?: number;
+}
+
+/** 新建账号（已存在 → false，不覆盖）；占位账号亦经此建（passHash 为空串） */
+export function createUserIfAbsent(u: NewUser): boolean {
+  ensureInit();
+  const res = getDb().prepare(
+    'INSERT OR IGNORE INTO users (username, pass_hash, created_at, profile_json, samples_json, records_json, token, token_expires) VALUES (?, ?, ?, ?, ?, ?, ?, ?)'
+  ).run(
+    u.username, u.passHash ?? '', Date.now(),
+    JSON.stringify(u.profile ?? {}), '[]', '[]',
+    u.token ?? null, u.tokenExpires ?? null,
+  );
+  return Number(res.changes || 0) > 0;
+}
+
+/** 占位账号升级为正式账号：写入密语哈希 + 轮换 token（须在事务内调用） */
+export function upgradePlaceholder(username: string, passHash: string, token: string, tokenExpires: number, profilePatch?: Record<string, unknown>): void {
+  const merged = profilePatch ? { ...(getUser(username)?.profile || {}), ...profilePatch } : null;
+  getDb().prepare('UPDATE users SET pass_hash = ?, token = ?, token_expires = ? WHERE username = ?')
+    .run(passHash, token, tokenExpires, username);
+  if (merged) setProfileJson(username, merged);
+}
+
+/** 轮换 token（登录成功时） */
+export function rotateToken(username: string, token: string, tokenExpires: number): void {
+  getDb().prepare('UPDATE users SET token = ?, token_expires = ? WHERE username = ?').run(token, tokenExpires, username);
+}
+
+/** 升级密语哈希（旧格式登录命中时） */
+export function setPassHash(username: string, passHash: string): void {
+  getDb().prepare('UPDATE users SET pass_hash = ? WHERE username = ?').run(passHash, username);
+}
+
+function setProfileJson(username: string, profile: Record<string, unknown>): void {
+  getDb().prepare('UPDATE users SET profile_json = ? WHERE username = ?').run(JSON.stringify(profile), username);
+}
+
+/** 档案合并写（浅合并）；返回新档案，用户不存在 → null */
+export function mergeProfile(username: string, patch: Record<string, unknown>): Record<string, unknown> | null {
+  ensureInit();
+  return withTx(() => {
+    const u = getUser(username);
+    if (!u) return null;
+    const merged = { ...u.profile, ...patch };
+    setProfileJson(username, merged);
+    return merged;
+  });
+}
+
+/** 示例档案：追加 */
+export function addSample(username: string, sample: Sample): Sample[] | null {
+  ensureInit();
+  return withTx(() => {
+    const u = getUser(username);
+    if (!u) return null;
+    const samples = [...u.samples, sample];
+    getDb().prepare('UPDATE users SET samples_json = ? WHERE username = ?').run(JSON.stringify(samples), username);
+    return samples;
+  });
+}
+
+/** 示例档案：删除 */
+export function removeSample(username: string, id: string): Sample[] | null {
+  ensureInit();
+  return withTx(() => {
+    const u = getUser(username);
+    if (!u) return null;
+    const samples = u.samples.filter(s => s.id !== id);
+    getDb().prepare('UPDATE users SET samples_json = ? WHERE username = ?').run(JSON.stringify(samples), username);
+    return samples;
+  });
+}
+
+/** 云同步记录：整表覆盖 */
+export function setRecords(username: string, records: Record<string, unknown>[]): number | null {
+  ensureInit();
+  return withTx(() => {
+    const u = getUser(username);
+    if (!u) return null;
+    getDb().prepare('UPDATE users SET records_json = ? WHERE username = ?').run(JSON.stringify(records), username);
+    return records.length;
+  });
+}
+
+// ─── 旧 JSON 库一次性导入 ───
+const IMPORT_MARK = 'users_imported_from_json';
+let inited = false;
+
+/** 幂等初始化：users 表为空且存在旧 db.json → 导入（原文件保留） */
+export function ensureInit(): void {
+  if (inited) return;
+  inited = true;
+  try {
+    const imported = getMeta(IMPORT_MARK);
+    if (imported) return;                       // 本库已导入过
+    if (userCountRaw() > 0) { setMeta(IMPORT_MARK, 'skip:users-exist'); return; }
+    let raw: string;
+    try { raw = fs.readFileSync(USERS_DB, 'utf-8'); } catch { return; }   // 无旧库：全新安装
+    const parsed = JSON.parse(raw);
+    const users: any[] = Array.isArray(parsed?.users) ? parsed.users : [];
+    if (!users.length) { setMeta(IMPORT_MARK, 'skip:json-empty'); return; }
+    let n = 0;
+    withTx(() => {
+      for (const u of users) {
+        if (!u || typeof u.username !== 'string' || !u.username) continue;
+        const ok = insertLegacy(u);
+        if (ok) n++;
+      }
+      setMeta(IMPORT_MARK, `imported:${n}:${USERS_DB}`);
+    });
+    console.log(`[usersStore] 已从旧 JSON 库导入 ${n} 个账号: ${USERS_DB}`);
+  } catch (e: any) {
+    console.error('[usersStore] 旧 JSON 库导入失败（跳过，不影响新库）:', e?.message || e);
+  }
+}
+
+function userCountRaw(): number {
+  return Number((getDb().prepare('SELECT COUNT(*) AS c FROM users').get() as any)?.c || 0);
+}
+
+function insertLegacy(u: any): boolean {
+  const res = getDb().prepare(
+    'INSERT OR IGNORE INTO users (username, pass_hash, created_at, profile_json, samples_json, records_json, token, token_expires) VALUES (?, ?, ?, ?, ?, ?, ?, ?)'
+  ).run(
+    String(u.username), String(u.passHash || ''), Number(u.createdAt || Date.now()),
+    JSON.stringify(u.profile && typeof u.profile === 'object' ? u.profile : {}),
+    JSON.stringify(Array.isArray(u.samples) ? u.samples : []),
+    JSON.stringify(Array.isArray(u.records) ? u.records : []),
+    u.token ? String(u.token) : null,
+    u.tokenExpires == null ? null : Number(u.tokenExpires),
+  );
+  return Number(res.changes || 0) > 0;
+}

package/src/pages/AuthPage.tsx

@@ -93,6 +93,9 @@ export default function AuthPage() {
           </div>
           <div className="field"><label>名号</label><input className="input-line" placeholder="取一雅号" value={username} onChange={e => setUsername(e.target.value)} /></div>
           <div className="field"><label>密语</label><input className="input-line" type="password" placeholder="四字以上" value={password} onChange={e => setPassword(e.target.value)} /></div>
+          <p className="muted" style={{ fontSize: '.78rem', marginTop: '-.4rem' }}>
+            本地档案仅作离线体验：口令只在本机校验（未上传服务端），<b>不具备真正的保密能力</b>；请勿在本地档案中填写敏感信息。
+          </p>
           <button className="btn-divine" onClick={submit}>{mode === 'register' ? '入 馆' : '入 座'}</button>
           {msg && <p className={"mt-3 " + (msgOk ? 'tag-cool' : 'tag-hot')}>{msg}</p>}
         </div>

package/src/services/api.ts

@@ -6,13 +6,21 @@ const API_BASE = (import.meta.env.VITE_API_BASE as string | undefined) || '/api'
 
 // 云同步 token（登录后 localStorage 会话中保存）：所有需要归属校验的请求带上，
 // 后端有 token 即以 token 解析用户，堵「自报 username」越权（H-NEW1 修复）
-function authHeaders(): Record<string, string> {
+function authHeaders(username?: string): Record<string, string> {
   try {
     const sess = JSON.parse(localStorage.getItem('guanwei_session') || 'null');
     if (sess?.token) return { 'X-Guanwei-Token': sess.token };
+    // 本地占位账号（未注册）：带上起占时下发的 claimToken，后端据此校验归属
+    const claim = (username && claimTokenOf(username)) || claimTokenOf(sess?.username || '') || currentClaimToken();
+    if (claim) return { 'X-Guanwei-Token': claim };
   } catch { /* ignore */ }
   return {};
 }
+
+/** 当前生效的占位账号凭据（单机本地流程通常只有一个） */
+function currentClaimToken(): string {
+  try { return localStorage.getItem(CLAIM_CURRENT_KEY) || ''; } catch { return ''; }
+}
 // 诊断：全局暴露当前 API 基址
 if (typeof window !== 'undefined') { (window as any).__API_BASE__ = API_BASE; }
 console.log('[观微] API_BASE =', API_BASE);
@@ -256,7 +264,7 @@ export interface DivineResult {
 export async function apiDivine(username: string, artId: string, inputs: unknown, profile?: unknown, question?: string, _profileId?: string): Promise<DivineResult> {
   const res = await fetch(API_BASE + '/divine', {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json', ...authHeaders() },
+    headers: { 'Content-Type': 'application/json', ...authHeaders(username) },
     body: JSON.stringify({ username, artId, inputs, profile, question }),
   });
   if (!res.ok) {
@@ -272,16 +280,23 @@ export async function apiDivine(username: string, artId: string, inputs: unknown
 }
 
 const CLAIM_KEY = (name: string) => 'guanwei_claim_' + name;
+const CLAIM_CURRENT_KEY = 'guanwei_claim_current';
 
 /** 保存/读取占位账号认领凭据（仅本地持有，随注册一次性使用） */
 export function saveClaimToken(username: string, token: string): void {
-  try { localStorage.setItem(CLAIM_KEY(username), token); } catch { /* ignore */ }
+  try {
+    localStorage.setItem(CLAIM_KEY(username), token);
+    localStorage.setItem(CLAIM_CURRENT_KEY, token);   // 供无 username 上下文的请求（如 AI 解读）回退使用
+  } catch { /* ignore */ }
 }
 export function claimTokenOf(username: string): string {
   try { return localStorage.getItem(CLAIM_KEY(username)) || ''; } catch { return ''; }
 }
 export function clearClaimToken(username: string): void {
-  try { localStorage.removeItem(CLAIM_KEY(username)); } catch { /* ignore */ }
+  try {
+    localStorage.removeItem(CLAIM_KEY(username));
+    if (localStorage.getItem(CLAIM_CURRENT_KEY) === localStorage.getItem(CLAIM_KEY(username))) localStorage.removeItem(CLAIM_CURRENT_KEY);
+  } catch { /* ignore */ }
 }
 
 export interface DivineHistoryItem {
@@ -294,19 +309,19 @@ export interface DivineHistoryItem {
 }
 
 export async function apiDivineHistory(username: string, page = 1, pageSize = 20, profileId?: string): Promise<{ list: DivineHistoryItem[]; total: number }> {
-  const res = await fetch(API_BASE + '/divine?username=' + encodeURIComponent(username) + '&page=' + page + '&pageSize=' + pageSize + (profileId ? '&profileId=' + encodeURIComponent(profileId) : ''), { headers: authHeaders() });
+  const res = await fetch(API_BASE + '/divine?username=' + encodeURIComponent(username) + '&page=' + page + '&pageSize=' + pageSize + (profileId ? '&profileId=' + encodeURIComponent(profileId) : ''), { headers: authHeaders(username) });
   if (!res.ok) return { list: [], total: 0 };
   return res.json();
 }
 
 export async function apiDivineDetail(id: string, username: string): Promise<Record<string, unknown> | null> {
-  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username), { headers: authHeaders() });
+  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username), { headers: authHeaders(username) });
   if (!res.ok) return null;
   return res.json();
 }
 
 export async function apiDivineDelete(id: string, username: string): Promise<boolean> {
-  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username), { method: 'DELETE', headers: authHeaders() });
+  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username), { method: 'DELETE', headers: authHeaders(username) });
   return res.ok;
 }
 

package/src/utils/userStore.ts

@@ -134,7 +134,7 @@ export function login(username: string, password: string): AuthResult {
 }
 
 // 向后端登录/注册换取云同步 token（失败静默——离线纯本地场景不受影响）
-// 前端注册/登录是本地体系；后端 db.json 无此用户时自动注册（同密码）以获取 token
+// 前端注册/登录是本地体系；后端用户库（SQLite users 表）无此用户时自动注册（同密码）以获取 token
 async function fetchServerToken(username: string, password: string): Promise<void> {
   try {
     let res = await fetch(API + '/login', {

package/scripts/check-boundary.mjs

@@ -1,80 +0,0 @@
-#!/usr/bin/env node
-// 仓库边界守卫：明确区分「公开区 / 内部区 / 打包区」，并拦截越界
-//
-//   公开区（git 跟踪 → GitHub 可见）   ：src/ server/src/ shared/ packages/ scripts/ tests/ .github/ README 等
-//   内部区（仅本地，git 忽略 → 不可见）：internal/（规划、监控、审计、SOP、草稿、真实案例）
-//   打包区（npm publish 内容）        ：package.json `files` 白名单（必须是公开区子集）
-//
-// 用法：node scripts/check-boundary.mjs        退出码 0=边界干净；1=越界
-// 接入：.github/workflows/ci.yml、scripts/preflight-release.sh
-import { execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-
-const tracked = execFileSync('git', ['ls-files'], { encoding: 'utf8' }).split('\n').filter(Boolean);
-
-// ── 1) 路径级：公开区不得出现内部/敏感路径 ──
-const FORBIDDEN_PATH = [
-  [/^internal\//, '内部区目录（应仅本地存在）'],
-  [/^docs\/.*\.md$/, '内部文档（内部文档应放 internal/docs/；docs/ 只留对外素材）'],
-  [/(^|\/)\.env(\.|$)/, '环境变量文件'],
-  [/\.(db|sqlite|sqlite3)$/, '运行时数据库'],
-  [/(^|\/)db\.json$/, '用户档案库'],
-  [/(^|\/)(id_rsa|.*\.pem)$/, '私钥'],
-  [/(^|\/)(\.audit|audit-tmp)/, '审计临时文件'],
-  [/^tests\/tmp-test-/, '本地临时测试（可能含真实案例）'],
-];
-const pathViolations = [];
-for (const f of tracked) {
-  if (/\.example$/.test(f)) continue;   // *.env.example 为公开模板（无值），可入库
-  for (const [re, why] of FORBIDDEN_PATH) if (re.test(f)) pathViolations.push(`${f}  ← ${why}`);
-}
-
-// ── 2) 内容级：公开区文件不得含密钥/隐私特征（跳过二进制与压缩产物）──
-const KEY_PATTERNS = [
-  [/sk-[A-Za-z0-9_-]{20,}/, '疑似 LLM API key'],
-  [/AIza[0-9A-Za-z_-]{30,}/, '疑似 Google API key'],
-  [/gsk_[A-Za-z0-9]{40,}/, '疑似 Groq key'],
-  [/gh[pousr]_[A-Za-z0-9]{30,}/, '疑似 GitHub token'],
-  [/_authToken\s*=\s*(?!\$\{)[A-Za-z0-9_.\-]{16,}/, 'npm 认证 token（真实值）'],
-];
-const SKIP_EXT = /\.(png|jpe?g|gif|ico|webp|woff2?|ttf|otf|pdf|zip|gz|mp4|db)$/i;
-const contentViolations = [];
-for (const f of tracked) {
-  if (SKIP_EXT.test(f)) continue;
-  let text;
-  try { if (fs.statSync(f).size > 4 * 1024 * 1024) continue; text = fs.readFileSync(f, 'utf8'); } catch { continue; }
-  for (const [re, why] of KEY_PATTERNS) if (re.test(text)) contentViolations.push(`${f}  ← ${why}`);
-}
-
-// ── 3) 打包区：npm files 白名单必须是公开区子集 ──
-const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-const files = pkg.files || [];
-const BAD_ALLOW = [
-  [/^internal/, '内部区不得进 npm 包'],
-  [/^docs/, 'docs/ 仅 GitHub 素材，无需进包'],
-  [/^tests/, '测试不入包'],
-  [/^\.github/, 'CI 配置不入包'],
-  [/^server\/src\/data/, '运行时数据不入包'],
-];
-const allowViolations = files.filter(f => BAD_ALLOW.some(([re]) => re.test(f))).map(f => `files 白名单含 ${f}`);
-
-// ── 报告 ──
-const count = (prefix) => tracked.filter(f => f === prefix || f.startsWith(prefix + '/')).length;
-const dist = Object.fromEntries(['src', 'shared', 'server', 'packages', 'scripts', 'tests', '.github']
-  .map(d => [d, count(d)]).filter(([, n]) => n > 0));
-
-console.log('公开区（git 跟踪）:', tracked.length, '个文件');
-console.log('  顶层分布:', JSON.stringify(dist));
-console.log('  内部区（仅本地）: internal/ 下', fs.existsSync('internal')
-  ? execFileSync('find', ['internal', '-type', 'f'], { encoding: 'utf8' }).split('\n').filter(Boolean).length
-  : 0, '个文件（git 忽略，永不公开）');
-console.log('打包区（npm files 白名单）:', files.length, '条 → 内容由 scripts/check-package.mjs 二次校验');
-
-const all = [...pathViolations, ...contentViolations, ...allowViolations];
-if (all.length) {
-  console.error('\n✗ 边界守卫未通过：');
-  for (const v of all.slice(0, 20)) console.error('  -', v);
-  process.exit(1);
-}
-console.log('\n✅ 边界干净：公开区无内部内容，打包区是公开区子集');