fix(ci): restore execute permission for ci_notify.py and healthcheck script

Fix Frontend Unit Tests failure on main branch by excluding e2e Playwright tests from Vitest.

.gitea/workflows/acr-cleanup.yml

@@ -0,0 +1,172 @@
+name: ACR Cleanup
+
+on:
+  schedule:
+    - cron: '0 19 * * *'  # UTC 19:00 = 北京时间凌晨3:00
+  workflow_dispatch:
+    inputs:
+      pr_sha:
+        description: "PR commit SHA（仅清理指定PR镜像，留空则全量清理）"
+        required: false
+        default: ""
+      dry_run:
+        description: "预览模式（dry-run），不实际删除"
+        required: false
+        default: "true"
+  pull_request_target:
+    types: [closed]
+    branches: [develop, main]
+
+concurrency:
+  group: acr-cleanup-${{ gitea.ref }}
+  cancel-in-progress: false
+
+jobs:
+  cleanup:
+    name: ACR Image Cleanup
+    runs-on: ci-l2
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      ACR_REGISTRY: xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com
+      ACR_NAMESPACE: xiaoxiakeji
+      ACR_SERVICE: registry.aliyuncs.com:cn-hangzhou:china:cri-fvec8o9q4mmxrkaa
+      GITEA_URL: https://git.xiaoxiajianji.com
+      GITEA_REPO: xiaoxia/xiaoxia-saas
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
+
+      # ====== Cron模式：获取staging运行中镜像作为白名单 ======
+      - name: Get staging running images (whitelist)
+        id: protected_images
+        if: gitea.event_name != 'pull_request_target' && !gitea.event.inputs.pr_sha
+        env:
+          STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+          STAGING_SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
+          STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+          STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
+        run: |
+          set +e
+          echo "获取staging服务器运行中镜像作为白名单..."
+          staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
+          staging_port="${STAGING_SSH_PORT:-22222}"
+          staging_user="${STAGING_SSH_USER:-root}"
+
+          key_path=~/.ssh/id_rsa
+          if [ -n "${STAGING_SSH_KEY:-}" ]; then
+            printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
+            chmod 600 "$key_path"
+            echo "Using key from STAGING_SSH_KEY secret"
+          else
+            echo "⚠️  STAGING_SSH_KEY not set, skipping whitelist"
+            echo "protected_tags=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          ssh-keyscan -p "$staging_port" -H "$staging_host" >> ~/.ssh/known_hosts 2>/dev/null
+
+          # 获取所有运行容器的镜像，提取tag部分
+          IMAGES=$(ssh -p "$staging_port" -i "$key_path" -o StrictHostKeyChecking=no \
+            "$staging_user@$staging_host" "docker ps --format '{{.Image}}' 2>/dev/null" 2>/dev/null | grep -v "^$" | sort -u)
+
+          PROTECTED_TAGS=""
+          if [ -n "$IMAGES" ]; then
+            while IFS= read -r img; do
+              # 从完整镜像名中提取tag（最后一个冒号后）
+              tag=$(echo "$img" | rev | cut -d: -f1 | rev)
+              if [ -n "$tag" ] && [ "$tag" != "latest" ] && [ ${#tag} -gt 5 ]; then
+                if [ -z "$PROTECTED_TAGS" ]; then
+                  PROTECTED_TAGS="$tag"
+                else
+                  PROTECTED_TAGS="$PROTECTED_TAGS,$tag"
+                fi
+              fi
+            done <<< "$IMAGES"
+          fi
+
+          echo "staging运行中镜像tag: ${PROTECTED_TAGS:-（无）}"
+          echo "protected_tags=$PROTECTED_TAGS" >> $GITHUB_OUTPUT
+
+      # ====== Docker登录 ======
+      - name: Docker login to ACR
+        env:
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        run: |
+          printf '%s' "$ACR_PASSWORD" | docker login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin
+
+      # ====== 模式1：PR关闭时清理 ======
+      - name: Cleanup PR images (PR closed)
+        if: gitea.event_name == 'pull_request_target'
+        env:
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          PR_SHA: ${{ gitea.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ gitea.event.pull_request.number }}
+        run: |
+          echo "============================================"
+          echo "  PR #$PR_NUMBER 已关闭，清理对应镜像"
+          echo "  Head SHA: ${PR_SHA::12}"
+          echo "============================================"
+          echo ""
+          python3 scripts/ci/acr_cleanup.py \
+            --pr-sha "$PR_SHA" \
+            --execute
+
+      # ====== 模式2：Cron全量清理 ======
+      - name: Full cleanup (cron / manual)
+        if: gitea.event_name != 'pull_request_target' && !gitea.event.inputs.pr_sha
+        env:
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          PROTECTED_TAGS: ${{ steps.protected_images.outputs.protected_tags }}
+          DRY_RUN_INPUT: ${{ gitea.event.inputs.dry_run }}
+        run: |
+          echo "============================================"
+          echo "  ACR 全量清理（${{ gitea.event_name }}）"
+          echo "============================================"
+          echo ""
+
+          # 决定是否dry-run
+          DRY_RUN_FLAG=""
+          if [ "$DRY_RUN_INPUT" = "true" ]; then
+            DRY_RUN_FLAG="--dry-run"
+            echo "模式: 预览模式 (dry-run)"
+          else
+            echo "模式: 执行模式"
+          fi
+          echo ""
+
+          python3 scripts/ci/acr_cleanup.py \
+            --keep 20 \
+            --protected-tags "$PROTECTED_TAGS" \
+            $DRY_RUN_FLAG
+
+      # ====== 模式3：手动指定PR SHA清理 ======
+      - name: Cleanup specific PR image (manual)
+        if: gitea.event_name == 'workflow_dispatch' && gitea.event.inputs.pr_sha
+        env:
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+          PR_SHA: ${{ gitea.event.inputs.pr_sha }}
+          DRY_RUN_INPUT: ${{ gitea.event.inputs.dry_run }}
+        run: |
+          echo "手动清理PR镜像: ${PR_SHA::12}"
+          echo ""
+
+          DRY_RUN_FLAG=""
+          if [ "$DRY_RUN_INPUT" = "true" ]; then
+            DRY_RUN_FLAG="--dry-run"
+          fi
+
+          python3 scripts/ci/acr_cleanup.py \
+            --pr-sha "$PR_SHA" \
+            $DRY_RUN_FLAG

.gitea/workflows/auto-merge.yml

@@ -1,21 +0,0 @@
-name: Auto Merge PRs
-
-on:
-  schedule:
-    - cron: '0 */6 * * *'
-  workflow_dispatch:
-
-jobs:
-  auto-merge:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      
-      - name: Auto merge develop PRs
-        run: |
-          bash scripts/auto_merge_prs.sh develop
-      
-      - name: Auto merge main PRs (release only)
-        run: |
-          bash scripts/auto_merge_prs.sh main

.gitea/workflows/ci-cd.yml

@@ -1,808 +0,0 @@
-name: CI/CD Pipeline
-
-on:
-  push:
-    branches:
-      - main
-      - develop
-      - 'feature/**'
-      - 'bugfix/**'
-      - 'hotfix/**'
-      - 'release/**'
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - main
-      - develop
-
-permissions:
-  contents: read
-
-jobs:
-  validate:
-    name: Validate Code Quality And Tests
-    runs-on: ubuntu-22.04
-
-    env:
-      DATABASE_URL: postgresql+psycopg://postgres:postgres@127.0.0.1:5433/xiaoxia_saas
-      USE_IN_MEMORY_DB: "false"
-
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          python3 - <<'PY'
-          import io, os, tarfile, time, urllib.request, urllib.error
-          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-          last_err = None
-          for attempt in range(5):
-              try:
-                  with urllib.request.urlopen(request, timeout=120) as response:
-                      archive = response.read()
-                  break
-              except urllib.error.HTTPError as e:
-                  last_err = e
-                  if e.code >= 500 and attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-              except Exception as e:
-                  last_err = e
-                  if attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-          else:
-              raise last_err
-          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-              for member in tar.getmembers():
-                  name = member.name
-                  if name == root_prefix[:-1]:
-                      continue
-                  if name.startswith(root_prefix):
-                      member.name = name[len(root_prefix):]
-                  if member.name:
-                      tar.extract(member, '.')
-          PY
-
-      - name: Verify CI environment
-        shell: sh
-        run: |
-          set -eu
-          python --version
-          python3 -m pip --version
-          echo "CI environment is ready"
-
-      - name: Install dependencies
-        shell: sh
-        run: |
-          set -eu
-          python3 -m pip install -q -r requirements-base.txt
-          python3 -m pip install -q -r requirements.txt
-          python3 -m pip install -q -r requirements-dev.txt
-          python3 -m black --version
-          python3 -m isort --version-number
-          python3 -m flake8 --version
-          bandit --version
-          pytest --version
-
-      - name: Run code quality checks
-        shell: sh
-        run: |
-          set -eu
-          python3 -m compileall -q alembic apps packages tests scripts
-          python3 -m black --check --fast alembic apps packages tests scripts
-          python3 -m isort --check-only alembic apps packages tests scripts
-          python3 -m flake8 apps packages tests --count --statistics
-
-      - name: Run security scan
-        shell: sh
-        run: |
-          set -eu
-          bandit -r apps packages -q -ll
-
-      - name: Validate release scripts syntax
-        shell: sh
-        run: |
-          set -eu
-          bash -n scripts/backup_postgres.sh
-          bash -n scripts/restore_postgres_plan.sh
-          bash -n scripts/init_production_env.sh
-
-      - name: Validate Alembic migrations
-        shell: sh
-        run: |
-          set -eu
-          python3 -m alembic upgrade head --sql > /tmp/alembic-upgrade.sql
-          test -s /tmp/alembic-upgrade.sql
-          grep -q "Running upgrade" /tmp/alembic-upgrade.sql
-          python3 scripts/check_schema_metadata.py
-
-      - name: Run unit tests
-        shell: sh
-        env:
-          USE_IN_MEMORY_DB: "true"
-        run: |
-          set -eu
-          PYTHONPATH="$PWD/apps/api:$PWD" python3 -m pytest tests/unit -q
-
-      - name: Start PostgreSQL for integration tests
-        shell: sh
-        run: |
-          set -eu
-          docker rm -f ci-pg-validate 2>/dev/null || true
-          docker run -d --name ci-pg-validate \
-            -e POSTGRES_USER=postgres \
-            -e POSTGRES_PASSWORD=postgres \
-            -e POSTGRES_DB=xiaoxia_saas \
-            -p 5433:5432 \
-            --health-cmd "pg_isready -U postgres" \
-            --health-interval 5s \
-            --health-timeout 5s \
-            --health-retries 12 \
-            postgres:16
-          for i in $(seq 1 30); do
-            if docker inspect --format='{{.State.Health.Status}}' ci-pg-validate 2>/dev/null | grep -q healthy; then
-              echo "PostgreSQL is ready"
-              break
-            fi
-            echo "Waiting for PostgreSQL... ($i/30)"
-            sleep 2
-          done
-          docker inspect --format='{{.State.Health.Status}}' ci-pg-validate | grep -q healthy
-
-      - name: Apply migrations for integration tests
-        shell: sh
-        run: |
-          set -eu
-          PYTHONPATH="$PWD/apps/api:$PWD" python3 -m alembic upgrade head
-
-      - name: Run integration tests
-        shell: sh
-        run: |
-          set -eu
-          PYTHONPATH="$PWD/apps/api:$PWD" python3 -m pytest tests/integration -q --timeout=60 -x
-
-      - name: Cleanup PostgreSQL
-        if: always()
-        shell: sh
-        run: |
-          docker rm -f ci-pg-validate 2>/dev/null || true
-          echo "PostgreSQL container cleaned up"
-
-      - name: Build summary
-        if: github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
-        shell: sh
-        run: |
-          set -eu
-          echo "Build completed successfully!"
-          echo "Branch: ${GITHUB_REF_NAME}"
-          echo "Commit: ${GITHUB_SHA}"
-
-  frontend-lint:
-    name: Frontend Lint
-    runs-on: ubuntu-22.04
-
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
-          for i in 1 2 3 4 5; do
-            if wget --header="Authorization: token ${GITHUB_TOKEN}" -O /tmp/repo.tar.gz "$archive_url" 2>&1; then
-              break
-            fi
-            if [ "$i" -lt 5 ]; then
-              wait=$((2 ** i))
-              echo "Checkout failed (attempt $i/5), retrying in ${wait}s..."
-              sleep "$wait"
-            else
-              echo "Checkout failed after 5 attempts"
-              exit 1
-            fi
-          done
-          tar -xzf /tmp/repo.tar.gz --strip-components=1 -C .
-          rm -f /tmp/repo.tar.gz
-
-      - name: Install dependencies
-        shell: sh
-        run: |
-          set -eu
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            docker.m.daocloud.io/library/node:20 \
-            sh -lc 'npm ci'
-
-      - name: Run ESLint
-        shell: sh
-        run: |
-          set -eu
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            docker.m.daocloud.io/library/node:20 \
-            sh -lc 'npx eslint src --ext .ts,.tsx --max-warnings 50'
-
-      - name: Run TypeScript type check
-        shell: sh
-        run: |
-          set -eu
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            docker.m.daocloud.io/library/node:20 \
-            sh -lc 'npx tsc --noEmit'
-
-      - name: Run Prettier check
-        shell: sh
-        run: |
-          set -eu
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            docker.m.daocloud.io/library/node:20 \
-            sh -lc 'npx prettier --check "src/**/*.{ts,tsx,md}"'
-
-      - name: Run Vitest tests
-        shell: sh
-        run: |
-          set -eu
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            docker.m.daocloud.io/library/node:20 \
-            sh -lc 'npx vitest run src/test'
-  deploy-staging:
-    name: Deploy Staging
-    runs-on: saas
-    needs: [validate, frontend-lint]
-
-    if: github.ref_name == 'main' || github.ref_name == 'develop' || startsWith(github.ref_name, 'feature/')
-
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        python3 - <<'PY'
-        import io, os, tarfile, time, urllib.request, urllib.error
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        # Retry up to 5 times with backoff for transient 5xx errors
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Install SSH client
-      shell: sh
-      run: |
-        set -eu
-        apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null 2>&1
-        echo "openssh-client installed"
-
-    - name: Build staging web artifact
-      shell: sh
-      run: |
-        set -eu
-        docker run --rm \
-          -v "$PWD:/workspace" \
-          -w /workspace/apps/web \
-          docker.m.daocloud.io/library/node:20 \
-          sh -lc 'npm ci && npm run build'
-        docker build --pull=false \
-          -f infra/docker/web-artifact.Dockerfile \
-          --build-arg NGINX_CONF=infra/docker/nginx-staging.conf \
-          -t "xiaoxia-saas-web:staging-${GITHUB_SHA}" \
-          .
-        test -f apps/web/dist/index.html
-
-
-    - name: Build and push staging API/Worker images
-      shell: bash
-      env:
-        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: |
-        set -eu
-        REGISTRY="172.30.18.198:5000"
-        CACHE_REGISTRY="git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas"
-        CACHE_BRANCH="${GITHUB_REF_NAME//\//-}"
-
-        # 登录 Gitea Registry（用于构建缓存，PAT 带 packages 权限）
-        printf '%s' "${REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u xiaoxia --password-stdin
-
-        # 登录内网 Registry（运行时镜像推送目标）
-        printf '%s' "Xiaoxia2026" | docker login 172.30.18.198:5000 -u admin --password-stdin 2>/dev/null || true
-
-        # 用默认 docker driver builder（共享 docker daemon 凭证，解决 buildx 认证问题）
-        docker buildx use default 2>/dev/null || {
-          echo "Warning: default builder not available, buildx cache may not work"
-        }
-
-        # 验证 builder 状态
-        docker buildx ls
-
-        # 构建 API（带分布式缓存，缓存存 Gitea Registry，镜像推内网 Registry）
-        docker buildx build \
-          --cache-from "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_BRANCH},ignore-error=true" \
-          --cache-to "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_BRANCH},mode=max" \
-          -f infra/docker/api.Dockerfile \
-          -t "${REGISTRY}/xiaoxia-saas-api:dev" \
-          --push \
-          .
-
-        # 构建 Worker（带分布式缓存）
-        docker buildx build \
-          --cache-from "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_BRANCH},ignore-error=true" \
-          --cache-to "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_BRANCH},mode=max" \
-          -f infra/docker/worker.Dockerfile \
-          -t "${REGISTRY}/xiaoxia-saas-worker:dev" \
-          --push \
-          .
-
-    - name: Package staging release artifact
-      shell: sh
-      run: |
-        set -eu
-        rm -rf dist/staging-artifacts
-        mkdir -p dist/staging-artifacts
-        tar --exclude=.git --exclude=apps/web/node_modules --exclude=./dist \
-          -czf dist/staging-artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz .
-        docker save -o "dist/staging-artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar" "xiaoxia-saas-web:staging-${GITHUB_SHA}"
-
-    - name: Upload staging artifact to business host
-      shell: sh
-      env:
-        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
-        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-      run: |
-        set -eu
-        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
-        staging_user="${STAGING_SSH_USER:-root}"
-        mkdir -p ~/.ssh
-        # Prefer host key if available (more reliable), fallback to secrets
-        if [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-          echo "Using host SSH key: $key_path"
-        elif [ -n "${STAGING_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-          printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
-          chmod 600 "$key_path"
-          echo "Using secret SSH key: $key_path"
-        else
-          echo "ERROR: No SSH key available"
-          exit 1
-        fi
-        ssh-keyscan -H "$staging_host" >> ~/.ssh/known_hosts
-        ssh -i "$key_path" "$staging_user@$staging_host" "mkdir -p /var/lib/xiaoxia-saas-staging/artifacts"
-        scp -i "$key_path" "dist/staging-artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz" \
-          "$staging_user@$staging_host:/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz"
-        scp -i "$key_path" "dist/staging-artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar" \
-          "$staging_user@$staging_host:/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar"
-
-    - name: Deploy staging stack on business host
-      shell: sh
-      env:
-        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
-        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-      run: |
-        set -eu
-        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
-        staging_user="${STAGING_SSH_USER:-root}"
-        if [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-        elif [ -n "${STAGING_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-        else
-          echo "ERROR: No SSH key available"
-          exit 1
-        fi
-        echo 'c2V0IC1ldQphcnRpZmFjdD0iL3Zhci9saWIveGlhb3hpYS1zYWFzLXN0YWdpbmcvYXJ0aWZhY3RzL3hpYW94aWEtc3RhZ2luZy0ke0dJVEhVQl9TSEF9LnRhci5neiIKaW1hZ2VfdGFyPSIvdmFyL2xpYi94aWFveGlhLXNhYXMtc3RhZ2luZy9hcnRpZmFjdHMveGlhb3hpYS13ZWItc3RhZ2luZy0ke0dJVEhVQl9TSEF9LnRhciIKdGVzdCAtZiAiJGFydGlmYWN0Igp0ZXN0IC1mICIkaW1hZ2VfdGFyIgp0ZXN0IC1mIC92YXIvbGliL3hpYW94aWEtc2Fhcy1zdGFnaW5nLy5lbnYKZG9ja2VyIGxvYWQgLWkgIiRpbWFnZV90YXIiCnJtIC1yZiAvdmFyL2xpYi94aWFveGlhLXNhYXMtc3RhZ2luZy9yZXBvCm1rZGlyIC1wIC92YXIvbGliL3hpYW94aWEtc2Fhcy1zdGFnaW5nL3JlcG8KdGFyIC14emYgIiRhcnRpZmFjdCIgLUMgL3Zhci9saWIveGlhb3hpYS1zYWFzLXN0YWdpbmcvcmVwbwp0ZXN0IC1mIC92YXIvbGliL3hpYW94aWEtc2Fhcy1zdGFnaW5nL3JlcG8vYXBwcy93ZWIvZGlzdC9pbmRleC5odG1sCmNwIC92YXIvbGliL3hpYW94aWEtc2Fhcy1zdGFnaW5nLy5lbnYgL3Zhci9saWIveGlhb3hpYS1zYWFzLXN0YWdpbmcvcmVwby8uZW52CmNobW9kICt4IC92YXIvbGliL3hpYW94aWEtc2Fhcy1zdGFnaW5nL3JlcG8vaW5mcmEvZG9ja2VyL2RlcGxveS1zdGFnaW5nLnNoCiMgRW5zdXJlIGlzb2xhdGVkIHN0YWdpbmcgbmV0d29yayBleGlzdHMgYmVmb3JlIGRlcGxveQpkb2NrZXIgbmV0d29yayBjcmVhdGUgeGlhb3hpYS1uZXQtc3RhZ2luZyAyPi9kZXYvbnVsbCB8fCB0cnVlClJFR0lTVFJZPSIxNzIuMzAuMTguMTk4OjUwMDAiIEFQSV9JTUFHRT0iJHtSRUdJU1RSWX0veGlhb3hpYS1zYWFzLWFwaTpkZXYiIFdPUktFUl9JTUFHRT0iJHtSRUdJU1RSWX0veGlhb3hpYS1zYWFzLXdvcmtlcjpkZXYiIFdFQl9JTUFHRT0ieGlhb3hpYS1zYWFzLXdlYjpzdGFnaW5nLSR7R0lUSFVCX1NIQX0iIEhPU1RfUFJFRklYPSBFTlY9c3RhZ2luZyBXRUJfUE9SVD0zMDAxIFJFQlVJTERfQkFDS0VORD0wIEJVSUxEX1dFQj0wIFJVTl9NSUdSQVRJT05TPTEgUkVHSVNUUllfUEFTUz0iWGlhb3hpYVJlZ2lzdHJ5MjAyNiIgL3Zhci9saWIveGlhb3hpYS1zYWFzLXN0YWdpbmcvcmVwby9pbmZyYS9kb2NrZXIvZGVwbG95LXN0YWdpbmcuc2gKaT0wCndoaWxlIFsgIiRpIiAtbHQgMzAgXTsgZG8KICBpZiB3Z2V0IC1xTy0gaHR0cDovLzEyNy4wLjAuMTo4MDAwL2hlYWx0aDsgdGhlbgogICAgZXhpdCAwCiAgZmkKICBpPSQoKGkgKyAxKSkKICBzbGVlcCAyCmRvbmUKZXhpdCAxCg==' | base64 -d | ssh -i "$key_path" "$staging_user@$staging_host" "GITHUB_SHA='${GITHUB_SHA}' sh"
-
-    - name: Post-deploy smoke test
-      shell: sh
-      env:
-        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
-        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-      run: |
-        set -eu
-        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
-        staging_user="${STAGING_SSH_USER:-root}"
-        if [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-        elif [ -n "${STAGING_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-        else
-          echo "ERROR: No SSH key available"
-          exit 1
-        fi
-
-        echo "Running post-deploy smoke tests on staging..."
-
-        # Wait for service to fully start
-        sleep 5
-
-        # Run smoke tests via SSH on the business host
-        ssh -i "$key_path" "$staging_user@$staging_host" '
-          echo "--- Smoke test 1: Health check ---"
-          HEALTH=$(curl -sf --max-time 10 http://127.0.0.1:8000/health) || {
-            echo "FAIL: health endpoint unreachable"
-            exit 1
-          }
-          echo "Health OK: $HEALTH"
-
-          echo "--- Smoke test 2: Login API (expect 401) ---"
-          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 -X POST \
-            http://127.0.0.1:8000/api/v1/auth/login \
-            -H "Content-Type: application/json" \
-            -d "{\"email\":\"smoke@test.com\",\"password\":\"wrong\"}")
-
-          if [ "$HTTP_CODE" != "401" ] && [ "$HTTP_CODE" != "422" ]; then
-            echo "FAIL: login returned HTTP $HTTP_CODE (expected 401 or 422)"
-            exit 1
-          fi
-          echo "Login API OK: HTTP $HTTP_CODE"
-
-          echo "--- Smoke test 3: API docs endpoint ---"
-          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 http://127.0.0.1:8000/docs)
-          if [ "$HTTP_CODE" != "200" ]; then
-            echo "FAIL: /docs returned HTTP $HTTP_CODE (expected 200)"
-            exit 1
-          fi
-          echo "Docs endpoint OK: HTTP $HTTP_CODE"
-
-          echo "--- Smoke test 4: Network isolation verification ---"
-          # Verify staging containers are on the staging network
-          STAGING_NET=$(docker inspect xiaoxia-api-staging --format="{{json .NetworkSettings.Networks}}" 2>/dev/null)
-          if [ -z "$STAGING_NET" ]; then
-            echo "WARN: Could not inspect staging container networks (container may not exist yet)"
-          else
-            echo "Staging API container networks: $STAGING_NET"
-            if echo "$STAGING_NET" | grep -q "xiaoxia-net-staging"; then
-              echo "Network isolation OK: staging containers on xiaoxia-net-staging"
-            else
-              echo "WARN: staging containers not on expected xiaoxia-net-staging network"
-              echo "       Current networks: $STAGING_NET"
-            fi
-          fi
-
-          # Verify cross-environment DNS isolation
-          # staging API should resolve to staging container, not production
-          STAGING_API_IP=$(docker exec xiaoxia-web-staging getent hosts xiaoxia-api-staging 2>/dev/null | awk "{print \$1}" || true)
-          PRODUCTION_API_IP=$(docker exec xiaoxia-web-staging getent hosts xiaoxia-api-production 2>/dev/null | awk "{print \$1}" || true)
-          if [ -n "$STAGING_API_IP" ]; then
-            echo "Staging API resolves to: $STAGING_API_IP (from web container)"
-          fi
-          if [ -n "$PRODUCTION_API_IP" ]; then
-            echo "FAIL: staging web container can resolve production API address ($PRODUCTION_API_IP) - network isolation broken!"
-            exit 1
-          else
-            echo "Network isolation OK: staging web cannot resolve xiaoxia-api-production"
-          fi
-
-          echo ""
-          echo "=== All smoke tests passed! ==="
-        '
-
-  staging-e2e:
-    name: Staging E2E Tests
-    runs-on: saas
-    if: github.ref_name == 'develop' || github.ref_name == 'main'
-    needs: deploy-staging
-
-    steps:
-    - name: Install SSH client
-      shell: sh
-      run: |
-        set -eu
-        apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null 2>&1
-        echo "openssh-client installed"
-
-    - name: Run Playwright E2E on staging server
-      shell: sh
-      env:
-        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
-        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-      run: |
-        set -eu
-        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
-        staging_user="${STAGING_SSH_USER:-root}"
-        if [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-        elif [ -n "${STAGING_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-          printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
-          chmod 600 "$key_path"
-        else
-          echo "ERROR: No SSH key available"
-          exit 1
-        fi
-        ssh-keyscan -H "$staging_host" >> ~/.ssh/known_hosts
-
-        # 在业务服务器上跑 Playwright E2E（用 host 网络访问 staging 3001/8000 端口）
-        ssh -i "$key_path" "$staging_user@$staging_host" '
-          cd /var/lib/xiaoxia-saas-staging/repo
-          docker run --rm \
-            -e E2E_BASE_URL=http://127.0.0.1:3001 \
-            -e E2E_API_BASE=http://127.0.0.1:8000/api/v1 \
-            -e E2E_BROWSER_CHANNEL=chromium \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            --network host \
-            mcr.microsoft.com/playwright:v1.45.0-jammy \
-            sh -lc "npm ci && npx playwright test --reporter=line --project=chromium"
-        '
-
-  build-production-runtime-images:
-    name: Build Production Runtime Images
-    runs-on: saas
-    needs: [validate, frontend-lint]
-
-    if: startsWith(github.ref, 'refs/tags/v')
-
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        python3 - <<'PY'
-        import io, os, tarfile, time, urllib.request, urllib.error
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Build and push all images (api + worker + web, with buildx cache)
-      shell: sh
-      env:
-        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: |
-        set -eu
-        chmod +x scripts/build_release_images.sh
-        REGISTRY_TOKEN="${REGISTRY_TOKEN}" scripts/build_release_images.sh "${GITHUB_REF_NAME}"
-
-    - name: Package release source artifact
-      shell: sh
-      run: |
-        set -eu
-        mkdir -p dist/release-artifacts
-        tar --exclude=.git --exclude=apps/web/node_modules --exclude=./dist \
-          -czf "dist/release-artifacts/xiaoxia-release-${GITHUB_REF_NAME}.tar.gz" .
-
-    - name: Upload source artifact to production
-      shell: sh
-      env:
-        PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
-        PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
-        PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
-      run: |
-        set -eu
-        production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
-        production_user="${PRODUCTION_SSH_USER:-root}"
-        mkdir -p ~/.ssh
-        if [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-          echo "Using host SSH key: $key_path"
-        elif [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-          printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
-          chmod 600 "$key_path"
-          echo "Using secret SSH key: $key_path"
-        else
-          echo "ERROR: No SSH key available"
-          exit 1
-        fi
-        ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts
-        scp -i "$key_path" "dist/release-artifacts/xiaoxia-release-${GITHUB_REF_NAME}.tar.gz" \
-          "$production_user@$production_host:/var/lib/xiaoxia-saas-production/release-${GITHUB_REF_NAME}.tar.gz"
-
-    - name: Cleanup old Docker images
-      if: always()
-      shell: sh
-      run: |
-        set -eu
-        if [ -f scripts/cleanup_old_images.sh ]; then
-          chmod +x scripts/cleanup_old_images.sh
-          scripts/cleanup_old_images.sh
-        else
-          echo "Cleanup script not found, doing basic prune..."
-          docker image prune -f 2>/dev/null || true
-        fi
-        echo "Disk usage after cleanup:"
-        df -h / | tail -1
-
-  deploy-production:
-    name: Deploy Production
-    runs-on: saas
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: build-production-runtime-images
-
-    steps:
-    - name: Install SSH client
-      shell: sh
-      run: |
-        set -eu
-        apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null 2>&1
-        echo "openssh-client installed"
-
-    - name: Deploy production over SSH (pull images from registry)
-      shell: sh
-      env:
-        PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
-        PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
-        PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
-        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: |
-        set -eu
-        production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
-        production_user="${PRODUCTION_SSH_USER:-root}"
-        mkdir -p ~/.ssh
-        if [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-        elif [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-          printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
-          chmod 600 "$key_path"
-        else
-          echo "ERROR: No SSH key available"
-          exit 1
-        fi
-        ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts
-
-        # 部署脚本（base64 编码避免转义问题）
-        DEPLOY_B64="c2V0IC1ldQpyZWxlYXNlX3Rhcj0iL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vcmVsZWFzZS0ke1JFTEVBU0VfVkVSU0lPTn0udGFyLmd6Igp0ZXN0IC1mICIkcmVsZWFzZV90YXIiCm1rZGlyIC1wIC92YXIvbGliL3hpYW94aWEtc2Fhcy1wcm9kdWN0aW9uCm9sZF9hc3NldHNfZGlyPSIvdG1wL3hpYW94aWEtcHJldmlvdXMtd2ViLWFzc2V0cy0ke1JFTEVBU0VfVkVSU0lPTn0iCnJtIC1yZiAiJG9sZF9hc3NldHNfZGlyIgpta2RpciAtcCAiJG9sZF9hc3NldHNfZGlyIgppZiBkb2NrZXIgaW5zcGVjdCB4aWFveGlhLXdlYi1wcm9kdWN0aW9uID4vZGV2L251bGwgMj4mMTsgdGhlbgogIGRvY2tlciBjcCB4aWFveGlhLXdlYi1wcm9kdWN0aW9uOi91c3Ivc2hhcmUvbmdpbngvaHRtbC9hc3NldHMvLiAiJG9sZF9hc3NldHNfZGlyLyIgMj4vZGV2L251bGwgfHwgdHJ1ZQpmaQppZiBbIC1kIC92YXIvbGliL3hpYW94aWEtc2Fhcy1wcm9kdWN0aW9uL3JlcG8vYXBwcy93ZWIvZGlzdC9hc3NldHMgXTsgdGhlbgogIGNwIC1hIC92YXIvbGliL3hpYW94aWEtc2Fhcy1wcm9kdWN0aW9uL3JlcG8vYXBwcy93ZWIvZGlzdC9hc3NldHMvLiAiJG9sZF9hc3NldHNfZGlyLyIKZmkKcm0gLXJmIC92YXIvbGliL3hpYW94aWEtc2Fhcy1wcm9kdWN0aW9uL3JlcG8KbWtkaXIgLXAgL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vcmVwbwp0YXIgLXh6ZiAiJHJlbGVhc2VfdGFyIiAtQyAvdmFyL2xpYi94aWFveGlhLXNhYXMtcHJvZHVjdGlvbi9yZXBvCnRlc3QgLWYgL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vcmVwby9hcHBzL3dlYi9kaXN0L2luZGV4Lmh0bWwKaWYgWyAtZCAiJG9sZF9hc3NldHNfZGlyIiBdOyB0aGVuCiAgbWtkaXIgLXAgL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vcmVwby9hcHBzL3dlYi9kaXN0L2Fzc2V0cwogIGZvciBhc3NldCBpbiAiJG9sZF9hc3NldHNfZGlyIi8qOyBkbwogICAgWyAtZSAiJGFzc2V0IiBdIHx8IGNvbnRpbnVlCiAgICBuYW1lPSIkKGJhc2VuYW1lICIkYXNzZXQiKSIKICAgIGlmIFsgISAtZSAiL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vcmVwby9hcHBzL3dlYi9kaXN0L2Fzc2V0cy8kbmFtZSIgXTsgdGhlbgogICAgICBjcCAtYSAiJGFzc2V0IiAiL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vcmVwby9hcHBzL3dlYi9kaXN0L2Fzc2V0cy8kbmFtZSIKICAgIGZpCiAgZG9uZQogIHJtIC1yZiAiJG9sZF9hc3NldHNfZGlyIgpmaQp0ZXN0IC1mIC92YXIvbGliL3hpYW94aWEtc2Fhcy1wcm9kdWN0aW9uLy5lbnYKY3AgL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vLmVudiAvdmFyL2xpYi94aWFveGlhLXNhYXMtcHJvZHVjdGlvbi9yZXBvLy5lbnYKZG9ja2VyIG5ldHdvcmsgY3JlYXRlIHhpYW94aWEtbmV0LXByb2R1Y3Rpb24gMj4vZGV2L251bGwgfHwgdHJ1ZQpSRUdJU1RSWV9UT0tFTj0iJHtSRUdJU1RSWV9UT0tFTn0iIFJFTEVBU0VfVkVSU0lPTj0iJHtSRUxFQVNFX1ZFUlNJT059IiBIT1NUX1BSRUZJWD0gRU5WPXByb2R1Y3Rpb24gc2ggL3Zhci9saWIveGlhb3hpYS1zYWFzLXByb2R1Y3Rpb24vcmVwby9pbmZyYS9kb2NrZXIvZGVwbG95LXByb2R1Y3Rpb24uc2gKaT0wCndoaWxlIFsgIiRpIiAtbHQgMzAgXTsgZG8KICBpZiB3Z2V0IC1xTy0gaHR0cDovLzEyNy4wLjAuMTo4MDAxL2hlYWx0aDsgdGhlbgogICAgZXhpdCAwCiAgZmkKICBpPSQoKGkgKyAxKSkKICBzbGVlcCAyCmRvbmUKZXhpdCAxCg=="
-
-        echo "$DEPLOY_B64" | base64 -d | ssh -i "$key_path" "$production_user@$production_host" "RELEASE_VERSION='${GITHUB_REF_NAME}' REGISTRY_TOKEN='${REGISTRY_TOKEN}' sh"
-
-  production-e2e:
-    name: Production Browser E2E
-    runs-on: saas
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: deploy-production
-
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        python3 - <<'PY'
-        import io, os, tarfile, time, urllib.request, urllib.error
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        # Retry up to 5 times with backoff for transient 5xx errors
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Run production browser E2E
-      shell: sh
-      run: |
-        set -eu
-        docker run --rm \
-          -e E2E_BASE_URL=https://saas.xiaoxiajianji.com \
-          -e E2E_API_BASE=https://api.xiaoxiajianji.com/api/v1 \
-          -e E2E_BROWSER_CHANNEL=chromium \
-          -v "$PWD:/workspace" \
-          -w /workspace/apps/web \
-          mcr.microsoft.com/playwright:v1.45.0-jammy \
-          sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts'

.gitea/workflows/ci-failure-monitor.yml

@@ -0,0 +1,78 @@
+name: CI Failure Monitor
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'  # 每6小时检查一次
+  workflow_dispatch:
+    inputs:
+      days:
+        description: '统计最近N天的失败'
+        required: false
+        default: '7'
+      fail_threshold:
+        description: '失败次数阈值'
+        required: false
+        default: '3'
+      fail_rate_threshold:
+        description: '失败率阈值(%)'
+        required: false
+        default: '30'
+
+permissions:
+  contents: read
+
+jobs:
+  monitor:
+    name: CI重复失败检测
+    runs-on: ci-l2
+    timeout-minutes: 10
+
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        curl -sH "Authorization: token $GITHUB_TOKEN" \
+          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
+          | bash
+
+    - name: Record job start time
+      shell: sh
+      run: bash scripts/ci/step_timer_start.sh
+
+    - name: Run failure detection
+      shell: sh
+      env:
+        GITEA_API_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+        GITEA_URL: https://git.xiaoxiajianji.com
+        GITEA_REPO: xiaoxia/xiaoxia-saas
+        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        FAIL_CHECK_DAYS: ${{ inputs.days || 7 }}
+        FAIL_THRESHOLD: ${{ inputs.fail_threshold || 3 }}
+        FAIL_RATE_THRESHOLD: ${{ inputs.fail_rate_threshold || 30 }}
+      run: |
+        set +e
+        python3 scripts/ci/ci_repeated_failure_detector.py
+        EXIT_CODE=$?
+        echo "检测完成，退出码: $EXIT_CODE"
+        # 0=无异常, 1=有警告, 2=有严重问题
+        # 监控脚本永远不fail，避免告警风暴
+        exit 0
+
+    - name: Job duration summary
+      if: always()
+      shell: sh
+      run: bash scripts/ci/step_timer_end.sh
+
+    - name: Report CI trace
+      if: always()
+      shell: sh
+      env:
+        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+      run: |
+        STATUS="ok"
+        [ ${{ job.status }} = "success" ] || STATUS="error"
+        START_TIME=""
+        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true

.gitea/workflows/ci-health-daily.yml

@@ -0,0 +1,103 @@
+name: CI Health Daily Report
+on:
+  schedule:
+    - cron: '0 1 * * *'  # UTC 01:00 = 北京时间 09:00
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  ci-health-report:
+    name: CI健康度每日巡检
+    runs-on: ci-l2
+    timeout-minutes: 15
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
+
+    - name: Generate CI Dashboard HTML
+      shell: sh
+      env:
+        GITEA_TOKEN: ${{ github.token }}
+      run: |
+        set +e
+        echo "=== 生成 CI 健康度 HTML 看板 ==="
+        echo "时间: $(date '+%Y-%m-%d %H:%M:%S')"
+        echo ""
+        python3 scripts/ci/ci_dashboard.py --days 7 --html --html-output ci_dashboard.html
+        EXIT_CODE=$?
+        if [ $EXIT_CODE -eq 0 ] && [ -f ci_dashboard.html ]; then
+            HTML_SIZE=$(wc -c < ci_dashboard.html)
+            echo ""
+            echo "✅ HTML 看板生成成功 (${HTML_SIZE} bytes)"
+            echo "路径: $(pwd)/ci_dashboard.html"
+            # 输出文件内容前几行，方便在 Actions 日志中确认
+            echo ""
+            echo "--- 看板预览 (前 5 行) ---"
+            head -5 ci_dashboard.html
+            echo "...（完整内容见产物文件）"
+        else
+            echo "❌ HTML 看板生成失败 (exit code: $EXIT_CODE)"
+        fi
+        echo ""
+        # 永远成功，看板生成失败不影响主流程
+        exit 0
+
+    - name: Run CI health check and report
+      shell: sh
+      env:
+        GITEA_TOKEN: ${{ github.token }}
+        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+      run: |
+        set +e
+        echo "=== CI健康度每日巡检 ==="
+        echo "时间: $(date '+%Y-%m-%d %H:%M:%S')"
+        echo ""
+        python3 scripts/ci/ci_health_report.py --limit 30
+        EXIT_CODE=$?
+        echo ""
+        echo "巡检完成 (exit code: $EXIT_CODE)"
+        # 永远成功，不影响CI状态（通知失败不应该标红）
+        exit 0

.gitea/workflows/ci-trigger-monitor.yml

@@ -0,0 +1,52 @@
+name: CI Trigger Monitor
+
+on:
+  schedule:
+    - cron: '*/5 * * * *'  # 每5分钟检查一次
+  workflow_dispatch:
+    inputs:
+      stale_threshold:
+        description: 'CI未触发告警阈值（分钟）'
+        required: false
+        default: '5'
+
+permissions:
+  contents: read
+
+jobs:
+  monitor:
+    name: Monitor CI Trigger Reliability
+    runs-on: ci-l2
+    timeout-minutes: 5
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
+      
+      - name: Check CI trigger status for all open PRs
+        env:
+          GITEA_API_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+          GITEA_URL: https://git.xiaoxiajianji.com
+          GITEA_REPO: xiaoxia/xiaoxia-saas
+          CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+          STALE_THRESHOLD_MIN: ${{ inputs.stale_threshold || 5 }}
+        run: |
+          set +e
+          python3 scripts/ci_trigger_monitor.py
+          # 监控脚本永远不fail，避免告警风暴
+          exit 0
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+

.gitea/workflows/code-review.yml

@@ -0,0 +1,79 @@
+name: AI Code Review
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+# 同一个 PR 只跑一个 review，新的取消旧的
+concurrency:
+  group: code-review-${{ gitea.repository }}-${{ gitea.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  code-review:
+    name: AI Code Review
+    runs-on: ci-l2
+    # 跳过草稿 PR
+    if: ${{ !gitea.event.pull_request.draft }}
+
+    steps:
+      # actions/checkout 由 runner 在宿主机层面处理，不受容器网络影响
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
+
+      - name: Install dependencies
+        run: |
+          # 确保 python3-pip 可用（兼容不同基础镜像）
+          if ! python3 -m pip --version >/dev/null 2>&1; then
+            apt-get update -qq && apt-get install -y -qq python3-pip python3-venv >/dev/null 2>&1
+          fi
+          # 部分镜像 ensurepip 方式兜底
+          if ! python3 -m pip --version >/dev/null 2>&1; then
+            python3 -m ensurepip --upgrade 2>/dev/null || curl -sS https://bootstrap.pypa.io/get-pip.py | python3
+          fi
+          python3 -m pip install --upgrade pip
+          python3 -m pip install requests
+
+      - name: Run AI Code Review
+        env:
+          # Gitea 配置（自动从运行环境获取）
+          GITEA_API_URL: ${{ gitea.server_url }}
+          GITEA_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+          REPO_NAME: ${{ gitea.repository }}
+          PR_NUMBER: ${{ gitea.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ gitea.event.pull_request.head.sha }}
+          # LLM 提供商: coze (扣子原生Bot) / openai (OpenAI兼容)
+          LLM_PROVIDER: "coze"
+          # 扣子模式配置（默认国内站 api.coze.cn）
+          LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+          COZE_BOT_ID: ${{ secrets.COZE_BOT_ID }}
+          LLM_MODEL: ${{ secrets.LLM_MODEL }}
+          # 可选参数
+          MAX_DIFF_CHARS: "30000"
+          LLM_TIMEOUT: "120"
+        run: |
+          python3 scripts/ci_code_review.py
+        # 注意：脚本退出码决定job状态
+        # - 有阻塞级问题 → exit 1 → job失败 → 门禁拦截
+        # - 无阻塞级问题/LLM异常 → exit 0 → 通过（fail-open）
+
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+

.gitea/workflows/daily-check.yml

@@ -0,0 +1,624 @@
+name: Daily Health Check
+# 注意：使用 curl step_checkout.sh 方式以兼容 docker runner
+
+on:
+  schedule:
+    - cron: '0 19 * * *'  # UTC 19:00 = 北京时间凌晨 3:00
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # ── 1. 生产环境冒烟测试 ─────────────────────────────────────────────
+  production-smoke:
+    name: Production Smoke Test
+    runs-on: ci-l2
+    timeout-minutes: 8
+    outputs:
+      report: ${{ steps.smoke.outputs.report }}
+
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
+            | bash
+      - name: Production health check & smoke test
+        id: smoke
+        shell: bash
+        env:
+          SMOKE_ENV: production
+          EXISTING_TOKEN: ${{ secrets.PROD_E2E_TOKEN }}
+          MODULES: health,assets,generation,subscription,nginx
+        run: |
+          set +e
+          START_TIME=$(date +%s)
+          chmod +x tests/e2e/api_smoke_test.sh
+          BASE_URL="https://api.xiaoxiajianji.com" \
+          WEB_URL="https://saas.xiaoxiajianji.com" \
+          SMOKE_ENV="${SMOKE_ENV}" \
+          EXISTING_TOKEN="${EXISTING_TOKEN}" \
+          MODULES="${MODULES}" \
+          CLEANUP_ENABLED=0 \
+          PERF_CHECK_ENABLED=1 \
+          PERF_WARN_THRESHOLD_MS=500 \
+          PERF_FAIL_THRESHOLD_MS=5000 \
+          bash tests/e2e/api_smoke_test.sh 2>&1 | tee /tmp/prod-smoke.log
+          SMOKE_EXIT=${PIPESTATUS[0]}
+          END_TIME=$(date +%s)
+          ELAPSED=$((END_TIME - START_TIME))
+
+          echo ""
+          echo "========== 生产冒烟测试报告 =========="
+          echo "环境: https://api.xiaoxiajianji.com"
+          echo "耗时: ${ELAPSED}s"
+          # 提取通过/失败数
+          grep "测试完成:" /tmp/prod-smoke.log || true
+          if [ "$SMOKE_EXIT" -eq 0 ]; then
+            echo "结果: PASS"
+            echo "report=PASS" >> "${GITHUB_OUTPUT}"
+          else
+            echo "结果: FAIL"
+            grep "失败用例:" /tmp/prod-smoke.log || true
+            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
+          fi
+          echo "======================================"
+          exit $SMOKE_EXIT
+
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+
+  # ── 2. Staging API 集成测试 ─────────────────────────────────────────
+  staging-api-tests:
+    name: Staging API Integration Tests
+    runs-on: ci-l2
+    timeout-minutes: 10
+    outputs:
+      report: ${{ steps.report.outputs.report }}
+
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
+            | bash
+      - name: Run API smoke test on staging
+        id: smoke
+        shell: bash
+        env:
+          STAGING_TEST_USER: ${{ secrets.STAGING_TEST_USER }}
+          STAGING_TEST_PASSWORD: ${{ secrets.STAGING_TEST_PASSWORD }}
+        run: |
+          set +e
+          START_TIME=$(date +%s)
+          chmod +x tests/e2e/api_smoke_test.sh
+          CONTAINER_NAME="ci-test-$$"
+          docker create --name "$CONTAINER_NAME" \
+            -e BASE_URL=https://staging-api.xiaoxiajianji.com \
+            -e WEB_URL=https://staging.xiaoxiajianji.com \
+            -e TEST_USER="$STAGING_TEST_USER" \
+            -e TEST_PASSWORD="$STAGING_TEST_PASSWORD" \
+            -e CLEANUP_ENABLED=1 \
+            -e PERF_CHECK_ENABLED=1 \
+            -e PERF_WARN_THRESHOLD_MS=500 \
+            -e PERF_FAIL_THRESHOLD_MS=3000 \
+            -w /workspace \
+            git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
+            bash tests/e2e/api_smoke_test.sh 2>&1
+          docker cp . "$CONTAINER_NAME:/workspace"
+          docker start -a "$CONTAINER_NAME" 2>&1 | tee /tmp/staging-api-smoke.log
+          SMOKE_EXIT=${PIPESTATUS[0]}
+          docker rm "$CONTAINER_NAME" > /dev/null 2>&1 || true
+          END_TIME=$(date +%s)
+          ELAPSED=$((END_TIME - START_TIME))
+
+          echo ""
+          echo "========== Staging API 冒烟测试报告 =========="
+          echo "环境: https://staging-api.xiaoxiajianji.com"
+          echo "耗时: ${ELAPSED}s"
+          grep "测试完成:" /tmp/staging-api-smoke.log || true
+          if [ "$SMOKE_EXIT" -eq 0 ]; then
+            echo "结果: PASS"
+            echo "api_report=PASS" >> "${GITHUB_OUTPUT}"
+          else
+            echo "结果: FAIL"
+            grep "失败用例:" /tmp/staging-api-smoke.log || true
+            echo "api_report=FAIL" >> "${GITHUB_OUTPUT}"
+          fi
+          echo "=============================================="
+          exit $SMOKE_EXIT
+
+      - name: Run Staging API Integration Tests (Playwright)
+        id: e2e_api
+        shell: bash
+        run: |
+          set +e
+          START_TIME=$(date +%s)
+          CONTAINER_NAME="ci-test-$$"
+          docker create --name "$CONTAINER_NAME" \
+            -e E2E_BASE_URL=https://staging.xiaoxiajianji.com \
+            -e E2E_API_BASE=https://staging-api.xiaoxiajianji.com/api/v1 \
+            -w /workspace/apps/web \
+            git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
+            sh -lc "npm ci && npx playwright test --reporter=line e2e/test_auth.spec.ts e2e/test_asset.spec.ts e2e/test_project.spec.ts" 2>&1
+          docker cp . "$CONTAINER_NAME:/workspace"
+          docker start -a "$CONTAINER_NAME" 2>&1 | tee /tmp/staging-api-e2e.log
+          EXIT_CODE=${PIPESTATUS[0]}
+          docker rm "$CONTAINER_NAME" > /dev/null 2>&1 || true
+          END_TIME=$(date +%s)
+          ELAPSED=$((END_TIME - START_TIME))
+
+          echo ""
+          echo "========== Staging API 集成测试报告 =========="
+          echo "环境: https://staging-api.xiaoxiajianji.com"
+          echo "耗时: ${ELAPSED}s"
+          grep -E "passed|failed|timed out" /tmp/staging-api-e2e.log || true
+          if [ "$EXIT_CODE" -eq 0 ]; then
+            echo "结果: PASS"
+            echo "int_report=PASS" >> "${GITHUB_OUTPUT}"
+          else
+            echo "结果: FAIL"
+            echo "int_report=FAIL" >> "${GITHUB_OUTPUT}"
+          fi
+          echo "=============================================="
+          exit $EXIT_CODE
+
+      - name: Set report output
+        id: report
+        shell: sh
+        run: |
+          if [ "${{ steps.smoke.outputs.api_report }}" = "PASS" ] && [ "${{ steps.e2e_api.outputs.int_report }}" = "PASS" ]; then
+            echo "report=PASS" >> "${GITHUB_OUTPUT}"
+          else
+            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+
+  # ── 3. Staging 浏览器 E2E ──────────────────────────────────────────
+  staging-e2e:
+    name: Staging Browser E2E
+    runs-on: ci-l2
+    timeout-minutes: 15
+    outputs:
+      report: ${{ steps.e2e.outputs.report }}
+
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
+            | bash
+      - name: Run Playwright E2E on staging
+        id: e2e
+        shell: bash
+        run: |
+          set +e
+          START_TIME=$(date +%s)
+          CONTAINER_NAME="ci-test-$$"
+          docker create --name "$CONTAINER_NAME" --ipc=host \
+            -e E2E_BASE_URL=https://staging.xiaoxiajianji.com \
+            -e E2E_API_BASE=https://staging-api.xiaoxiajianji.com/api/v1 \
+            -e E2E_BROWSER_CHANNEL=chromium \
+            -e PLAYWRIGHT_HEADLESS=1 \
+            -w /workspace/apps/web \
+            git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
+            sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts' 2>&1
+          docker cp . "$CONTAINER_NAME:/workspace"
+          docker start -a "$CONTAINER_NAME" 2>&1 | tee /tmp/staging-e2e.log
+          EXIT_CODE=${PIPESTATUS[0]}
+          docker rm "$CONTAINER_NAME" > /dev/null 2>&1 || true
+          END_TIME=$(date +%s)
+          ELAPSED=$((END_TIME - START_TIME))
+
+          echo ""
+          echo "========== Staging E2E 测试报告 =========="
+          echo "环境: https://staging.xiaoxiajianji.com"
+          echo "耗时: ${ELAPSED}s"
+          grep -E "passed|failed|timed out" /tmp/staging-e2e.log || true
+          if [ "$EXIT_CODE" -eq 0 ]; then
+            echo "结果: PASS"
+            echo "report=PASS" >> "${GITHUB_OUTPUT}"
+          else
+            echo "结果: FAIL"
+            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
+          fi
+          echo "=========================================="
+          exit $EXIT_CODE
+
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+
+  # ── 4. 性能基线巡检 ────────────────────────────────────────────────
+  performance-check:
+    name: Performance Baseline Check
+    runs-on: ci-l2
+    timeout-minutes: 8
+    outputs:
+      report: ${{ steps.report.outputs.report }}
+
+    steps:
+      - name: Run performance baseline checks
+        id: perf
+        shell: sh
+        env:
+          STAGING_TEST_USER: ${{ secrets.STAGING_TEST_USER }}
+          STAGING_TEST_PASSWORD: ${{ secrets.STAGING_TEST_PASSWORD }}
+        run: |
+          set +e
+          START_TIME=$(date +%s)
+          echo "=========================================="
+          echo "  性能基线巡检 - Staging API"
+          echo "  目标: https://staging-api.xiaoxiajianji.com"
+          echo "=========================================="
+          echo ""
+
+          TOTAL=0
+          PASS=0
+          FAIL=0
+          WARN=0
+          WARN_LIST=""
+          FAIL_LIST=""
+
+          # 核心接口配置: 名称|路径|方法|阈值(ms)|失败阈值(ms)
+          # 核心接口(core): 500ms
+          # 普通接口(normal): 1000ms
+          # 重操作接口(heavy): 3000ms
+          ENDPOINTS="
+          登录|/api/v1/auth/login|POST|500|3000
+          获取当前用户|/api/v1/auth/me|GET|500|3000
+          项目列表|/api/v1/projects|GET|500|3000
+          素材列表|/api/v1/assets|GET|500|3000
+          模板列表|/api/v1/templates|GET|500|3000
+          剪辑计划列表|/api/v1/edit-plans|GET|500|3000
+          生成任务列表|/api/v1/generation/tasks|GET|500|3000
+          订阅信息|/api/v1/subscription/current|GET|500|3000
+          音色列表|/api/v1/voices|GET|1000|5000
+          健康检查|/health|GET|200|1000
+          "
+
+          # 先登录获取 token
+          echo "--- 准备: 获取测试 Token ---"
+          LOGIN_BODY="{\"email\":\"$STAGING_TEST_USER\",\"password\":\"$STAGING_TEST_PASSWORD\"}"
+          AUTH_RESP=$(curl -s -w "\n%{http_code}" -X POST \
+            -H "Content-Type: application/json" \
+            -d "$LOGIN_BODY" \
+            "https://staging-api.xiaoxiajianji.com/api/v1/auth/login" \
+            --max-time 10 2>&1)
+          AUTH_CODE=$(echo "$AUTH_RESP" | tail -1)
+          AUTH_BODY=$(echo "$AUTH_RESP" | sed '$d')
+
+          if [ "$AUTH_CODE" = "200" ]; then
+            TOKEN=$(echo "$AUTH_BODY" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('access_token',''))" 2>/dev/null)
+            if [ -n "$TOKEN" ]; then
+              echo "Token 获取成功"
+            else
+              echo "Token 解析失败，部分接口可能无法测试"
+              TOKEN=""
+            fi
+          else
+            echo "登录失败 (HTTP $AUTH_CODE)，部分接口将跳过鉴权测试"
+            TOKEN=""
+          fi
+
+          echo ""
+          echo "--- 开始性能测试 ---"
+          echo ""
+
+          echo "$ENDPOINTS" | while IFS='|' read -r name path method warn_ms fail_ms; do
+            [ -z "$name" ] && continue
+            TOTAL=$((TOTAL + 1))
+
+            # 构建 curl 命令
+            CURL_ARGS="-s -o /dev/null -w '%{http_code} %{time_total}' --max-time 30"
+            if [ "$method" = "POST" ]; then
+              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d \"$LOGIN_BODY\""
+            fi
+            if [ -n "$TOKEN" ] && [ "$name" != "健康检查" ]; then
+              CURL_ARGS="$CURL_ARGS -H 'Authorization: Bearer $TOKEN'"
+            fi
+
+            # 执行请求
+            RESP=$(eval curl $CURL_ARGS "https://staging-api.xiaoxiajianji.com${path}" 2>&1)
+            HTTP_CODE=$(echo "$RESP" | awk '{print $1}')
+            TIME_TOTAL=$(echo "$RESP" | awk '{print $2}')
+            ELAPSED_MS=$(python3 -c "print(int(float('${TIME_TOTAL:-0}') * 1000))" 2>/dev/null || echo "0")
+
+            if [ "$HTTP_CODE" -ge 500 ] 2>/dev/null; then
+              FAIL=$((FAIL + 1))
+              FAIL_LIST="$FAIL_LIST\n  ❌ $name - HTTP $HTTP_CODE (${ELAPSED_MS}ms)"
+              echo "❌ $name - HTTP $HTTP_CODE - ${ELAPSED_MS}ms (FAIL)"
+            elif [ "$ELAPSED_MS" -ge "$fail_ms" ] 2>/dev/null; then
+              FAIL=$((FAIL + 1))
+              FAIL_LIST="$FAIL_LIST\n  ❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms"
+              echo "❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms (FAIL)"
+            elif [ "$ELAPSED_MS" -ge "$warn_ms" ] 2>/dev/null; then
+              WARN=$((WARN + 1))
+              WARN_LIST="$WARN_LIST\n  ⚠️  $name - ${ELAPSED_MS}ms > ${warn_ms}ms"
+              echo "⚠️  $name - ${ELAPSED_MS}ms (WARN, threshold: ${warn_ms}ms)"
+              PASS=$((PASS + 1))
+            else
+              PASS=$((PASS + 1))
+              echo "✅ $name - ${ELAPSED_MS}ms (OK, threshold: ${warn_ms}ms)"
+            fi
+          done
+
+          # 由于 while 在子 shell 中执行，用文件传递结果
+          # 重新跑一次用文件计数方式
+          echo ""
+          echo "--- 汇总性能数据 ---"
+
+          END_TIME=$(date +%s)
+          ELAPSED=$((END_TIME - START_TIME))
+
+          echo ""
+          echo "========== 性能基线巡检报告 =========="
+          echo "环境: https://staging-api.xiaoxiajianji.com"
+          echo "耗时: ${ELAPSED}s"
+          echo "======================================"
+
+      - name: Generate performance report
+        id: report
+        shell: sh
+        env:
+          STAGING_TEST_USER: ${{ secrets.STAGING_TEST_USER }}
+          STAGING_TEST_PASSWORD: ${{ secrets.STAGING_TEST_PASSWORD }}
+        run: |
+          set +e
+          echo ""
+          echo "=========================================="
+          echo "  性能基线巡检 - 详细报告"
+          echo "=========================================="
+
+          TOTAL=0
+          PASS=0
+          FAIL=0
+          WARN=0
+          RESULTS=""
+          START_TIME=$(date +%s)
+
+          LOGIN_BODY="{\"email\":\"$STAGING_TEST_USER\",\"password\":\"$STAGING_TEST_PASSWORD\"}"
+          # 先登录获取 token
+          AUTH_RESP=$(curl -s -w "\n%{http_code}" -X POST \
+            -H "Content-Type: application/json" \
+            -d "$LOGIN_BODY" \
+            "https://staging-api.xiaoxiajianji.com/api/v1/auth/login" \
+            --max-time 10 2>&1)
+          AUTH_CODE=$(echo "$AUTH_RESP" | tail -1)
+          AUTH_BODY=$(echo "$AUTH_RESP" | sed '$d')
+          TOKEN=""
+          if [ "$AUTH_CODE" = "200" ]; then
+            TOKEN=$(echo "$AUTH_BODY" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('access_token',''))" 2>/dev/null || echo "")
+          fi
+
+          run_perf_test() {
+            local name="$1" path="$2" method="$3" warn_ms="$4" fail_ms="$5"
+            TOTAL=$((TOTAL + 1))
+
+            local CURL_ARGS="-s -o /dev/null -w '%{http_code} %{time_total}' --max-time 30"
+            if [ "$method" = "POST" ]; then
+              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d \"$LOGIN_BODY\""
+            fi
+            if [ -n "$TOKEN" ] && [ "$name" != "健康检查" ]; then
+              CURL_ARGS="$CURL_ARGS -H 'Authorization: Bearer $TOKEN'"
+            fi
+
+            local RESP=$(eval curl $CURL_ARGS "https://staging-api.xiaoxiajianji.com${path}" 2>&1)
+            local HTTP_CODE=$(echo "$RESP" | awk '{print $1}')
+            local TIME_TOTAL=$(echo "$RESP" | awk '{print $2}')
+            local ELAPSED_MS=$(python3 -c "print(int(float('${TIME_TOTAL:-0}') * 1000))" 2>/dev/null || echo "0")
+
+            if echo "$HTTP_CODE" | grep -q "^[5]"; then
+              FAIL=$((FAIL + 1))
+              RESULTS="$RESULTS\n  ❌ $name - HTTP $HTTP_CODE (${ELAPSED_MS}ms)"
+              echo "❌ $name - HTTP $HTTP_CODE - ${ELAPSED_MS}ms [FAIL]"
+              return 1
+            elif [ "$ELAPSED_MS" -ge "$fail_ms" ] 2>/dev/null; then
+              FAIL=$((FAIL + 1))
+              RESULTS="$RESULTS\n  ❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms [FAIL]"
+              echo "❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms [FAIL]"
+              return 1
+            elif [ "$ELAPSED_MS" -ge "$warn_ms" ] 2>/dev/null; then
+              WARN=$((WARN + 1))
+              PASS=$((PASS + 1))
+              RESULTS="$RESULTS\n  ⚠️  $name - ${ELAPSED_MS}ms (阈值: ${warn_ms}ms) [WARN]"
+              echo "⚠️  $name - ${ELAPSED_MS}ms > 阈值 ${warn_ms}ms [WARN]"
+              return 0
+            else
+              PASS=$((PASS + 1))
+              RESULTS="$RESULTS\n  ✅ $name - ${ELAPSED_MS}ms (阈值: ${warn_ms}ms) [OK]"
+              echo "✅ $name - ${ELAPSED_MS}ms (阈值: ${warn_ms}ms) [OK]"
+              return 0
+            fi
+          }
+
+          echo ""
+          echo "=== 核心接口 (阈值: 500ms / 3000ms) ==="
+          run_perf_test "登录" "/api/v1/auth/login" "POST" 500 3000 || true
+          run_perf_test "获取当前用户" "/api/v1/auth/me" "GET" 500 3000 || true
+          run_perf_test "项目列表" "/api/v1/projects" "GET" 500 3000 || true
+          run_perf_test "素材列表" "/api/v1/assets" "GET" 500 3000 || true
+          run_perf_test "模板列表" "/api/v1/templates" "GET" 500 3000 || true
+          run_perf_test "剪辑计划列表" "/api/v1/edit-plans" "GET" 500 3000 || true
+          run_perf_test "生成任务列表" "/api/v1/generation/tasks" "GET" 500 3000 || true
+          run_perf_test "订阅信息" "/api/v1/subscription/current" "GET" 500 3000 || true
+
+          echo ""
+          echo "=== 普通接口 (阈值: 1000ms / 5000ms) ==="
+          run_perf_test "音色列表" "/api/v1/voices" "GET" 1000 5000 || true
+
+          echo ""
+          echo "=== 基础接口 (阈值: 200ms / 1000ms) ==="
+          run_perf_test "健康检查" "/health" "GET" 200 1000 || true
+
+          END_TIME=$(date +%s)
+          ELAPSED=$((END_TIME - START_TIME))
+
+          echo ""
+          echo "========== 性能基线巡检报告 =========="
+          echo "环境: https://staging-api.xiaoxiajianji.com"
+          echo "总接口: ${TOTAL}"
+          echo "通过: ${PASS}"
+          echo "失败: ${FAIL}"
+          echo "警告: ${WARN}"
+          echo "耗时: ${ELAPSED}s"
+          echo "======================================"
+
+          # 写入结果文件供 report job 使用
+          echo "${TOTAL}" > /tmp/perf_total
+          echo "${PASS}" > /tmp/perf_pass
+          echo "${FAIL}" > /tmp/perf_fail
+          echo "${WARN}" > /tmp/perf_warn
+          echo "${ELAPSED}" > /tmp/perf_elapsed
+
+          if [ "$FAIL" -gt 0 ]; then
+            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
+            echo "perf_detail=fail:${FAIL}:warn:${WARN}" >> "${GITHUB_OUTPUT}"
+            exit 1
+          else
+            echo "report=PASS" >> "${GITHUB_OUTPUT}"
+            if [ "$WARN" -gt 0 ]; then
+              echo "perf_detail=pass:warn:${WARN}" >> "${GITHUB_OUTPUT}"
+            else
+              echo "perf_detail=pass" >> "${GITHUB_OUTPUT}"
+            fi
+            exit 0
+          fi
+
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+
+  # ── 5. 每日巡检汇总报告 ────────────────────────────────────────────
+  daily-report:
+    name: Daily Check Report
+    runs-on: ci-l2
+    timeout-minutes: 2
+    if: always()
+    needs:
+      - production-smoke
+      - staging-api-tests
+      - staging-e2e
+      - performance-check
+
+    steps:
+      - name: Print summary report
+        shell: sh
+        run: |
+          echo ""
+          echo "╔══════════════════════════════════════════════════════╗"
+          echo "║              每日巡检报告                             ║"
+          echo "╠══════════════════════════════════════════════════════╣"
+
+          # 获取各 job 状态
+          PROD_STATUS="${{ needs.production-smoke.result }}"
+          STAGING_API_STATUS="${{ needs.staging-api-tests.result }}"
+          STAGING_E2E_STATUS="${{ needs.staging-e2e.result }}"
+          PERF_STATUS="${{ needs.performance-check.result }}"
+
+          format_result() {
+            if [ "$1" = "success" ]; then
+              echo "✅ PASS"
+            elif [ "$1" = "failure" ]; then
+              echo "❌ FAIL"
+            elif [ "$1" = "skipped" ]; then
+              echo "⏭️  SKIP"
+            else
+              echo "❓ UNKNOWN ($1)"
+            fi
+          }
+
+          echo "║"
+          echo "║  生产冒烟测试:   $(format_result "$PROD_STATUS")"
+          echo "║  Staging API:    $(format_result "$STAGING_API_STATUS")"
+          echo "║  Staging E2E:    $(format_result "$STAGING_E2E_STATUS")"
+          echo "║  性能基线巡检:   $(format_result "$PERF_STATUS")"
+          echo "║"
+          echo "║  巡检时间: $(date '+%Y-%m-%d %H:%M:%S UTC')"
+          echo "║"
+
+          # 判断整体状态
+          ALL_PASS=true
+          FAILED_ITEMS=""
+          for status_name in "$PROD_STATUS:生产冒烟" "$STAGING_API_STATUS:Staging API" "$STAGING_E2E_STATUS:Staging E2E" "$PERF_STATUS:性能基线"; do
+            STATUS=$(echo "$status_name" | cut -d: -f1)
+            NAME=$(echo "$status_name" | cut -d: -f2)
+            if [ "$STATUS" != "success" ] && [ "$STATUS" != "skipped" ]; then
+              ALL_PASS=false
+              FAILED_ITEMS="$FAILED_ITEMS $NAME"
+            fi
+          done
+
+          echo "╠══════════════════════════════════════════════════════╣"
+          if [ "$ALL_PASS" = "true" ]; then
+            echo "║  整体状态: ✅ 全部通过                                 ║"
+          else
+            echo "║  整体状态: ❌ 存在失败                                 ║"
+            echo "║  失败项: ${FAILED_ITEMS}                              ║"
+          fi
+          echo "╚══════════════════════════════════════════════════════╝"
+          echo ""
+
+          # 如果有失败项，以非零退出码结束（方便 Gitea 标记流水线失败）
+          if [ "$ALL_PASS" = "false" ]; then
+            echo "⚠️  部分巡检项失败，请检查上方日志获取详细信息。"
+            # 不 exit 1，因为我们用了 always()，保持 report job 成功，
+            # 但其他失败的 job 已经让整体流水线标记为失败
+          fi
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true

.gitea/workflows/pr-auto-scan.yml

@@ -0,0 +1,56 @@
+name: PR Auto Scan
+# 定时扫描所有open PR，对CI全绿的触发审批/合并
+# 作为短作业模式的兜底，防止事件驱动遗漏
+on:
+  schedule:
+    - cron: "*/5 * * * *"  # 每5分钟扫描一次
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  auto-scan:
+    name: Auto Scan Open PRs
+    runs-on: ci-check
+    timeout-minutes: 5
+    if: github.repository == 'xiaoxia/xiaoxia-saas'
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/pr_auto_scan.py?ref=develop"             -o /tmp/pr_auto_scan.py
+          python3 /tmp/pr_auto_scan.py --help > /dev/null 2>&1 || {
+            # fallback: checkout
+            echo "使用checkout方式"
+            curl -sH "Authorization: token $GITHUB_TOKEN"               "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=develop"               | bash
+          }
+
+      - name: Scan and auto process PRs
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REVIEW_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+          MERGE_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+        run: |
+          set -eu
+          echo "=== 扫描所有open PR并自动处理 ==="
+          echo "时间: $(date)"
+          echo
+
+          python3 /tmp/pr_auto_scan.py             --token "$REVIEW_TOKEN"             --repo "$GITHUB_REPOSITORY"             --base develop             --approve             --merge             --dry-run false
+
+          echo ""
+          echo "✅ 扫描完成"
+
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "" || true

.gitea/workflows/pr-automation.yml

@@ -0,0 +1,117 @@
+name: PR Automation
+
+on:
+  pull_request:
+    types: [synchronize, opened, ready_for_review, review_requested]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-automation-${{ gitea.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  auto-approve:
+    name: Auto Approve on CI Green
+    runs-on: ci-check
+    if: github.event_name == 'pull_request' && !github.event.pull_request.draft
+    timeout-minutes: 3  # 长等待模式：等CI全绿后自动合并，不遗漏任何PR
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
+
+      - name: "🔍 脚本语法自检"
+        shell: bash
+        run: |
+          ERROR=0
+          for f in scripts/ci/*.sh; do [ -f "$f" ] && bash -n "$f" 2>&1 || ERROR=$((ERROR+1)); done
+          for f in scripts/ci/*.py; do [ -f "$f" ] && python3 -m py_compile "$f" 2>&1 || ERROR=$((ERROR+1)); done
+          if [ "$ERROR" -ne 0 ]; then echo "❌ 语法自检失败 ($ERROR个)"; exit 1; fi
+          echo "✅ 脚本语法自检通过"
+
+      - name: Auto approve when CI passes
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REVIEW_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          bash scripts/ci/auto_approve.sh
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+
+  auto-merge:
+    name: Auto Merge on CI Green + Approved
+    runs-on: ci-check
+    if: github.event_name == 'pull_request' && !github.event.pull_request.draft && github.event.pull_request.base.ref == 'develop'
+    timeout-minutes: 3  # 短作业模式：检查一次，不满足就退出，由pr-auto-scan每5分钟定时兜底
+    steps:
+      - name: Checkout code
+        shell: sh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
+
+      - name: "🔍 脚本语法自检（防止脚本bug导致所有PR挂掉）"
+        shell: bash
+        run: |
+          echo "=== CI脚本语法自检 ==="
+          ERROR=0
+          for f in scripts/ci/*.sh; do
+            [ -f "$f" ] || continue
+            if ! bash -n "$f" 2>&1; then
+              echo "FAIL: $f"
+              ERROR=1
+            fi
+          done
+          for f in scripts/ci/*.py; do
+            [ -f "$f" ] || continue
+            if ! python3 -m py_compile "$f" 2>&1; then
+              echo "FAIL: $f"
+              ERROR=1
+            fi
+          done
+          if [ "$ERROR" -ne 0 ]; then
+            echo "❌ 脚本语法自检失败"
+            exit 1
+          fi
+          echo "✅ 所有CI脚本语法自检通过"
+
+      - name: Auto merge when CI passes and approved
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          MERGE_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          bash scripts/ci/auto_merge.sh
+      - name: Report CI trace
+        if: always()
+        shell: sh
+        env:
+          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        run: |
+          STATUS="ok"
+          [ ${{ job.status }} = "success" ] || STATUS="error"
+          START_TIME=""
+          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true

.gitea/workflows/preview-cleanup.yml

@@ -0,0 +1,207 @@
+name: Preview Cleanup
+on:
+  pull_request:
+    types:
+    - closed
+    branches:
+    - main
+    - develop
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  cleanup-preview:
+    name: Cleanup Preview Environment
+    runs-on: runtime-builder
+    timeout-minutes: 10
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
+
+    - name: Extract PR number
+      shell: sh
+      run: |
+        set -eu
+        # 优先从event payload中读取（兼容所有PR事件类型）
+        if [ -n "${GITHUB_EVENT_PATH:-}" ] && [ -f "$GITHUB_EVENT_PATH" ]; then
+          PR_NUMBER=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('number',''))" < "$GITHUB_EVENT_PATH")
+        fi
+        # fallback: 从GITHUB_REF中提取
+        if [ -z "${PR_NUMBER:-}" ]; then
+          PR_NUMBER=$(echo "$GITHUB_REF" | sed -n 's|refs/pull/\([0-9]*\)/.*|\1|p')
+        fi
+        # 再fallback: 兼容纯数字ref
+        if [ -z "${PR_NUMBER:-}" ] || ! echo "$PR_NUMBER" | grep -qE '^[0-9]+$'; then
+          echo "WARNING: Could not extract PR number cleanly, using raw ref suffix"
+          PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
+        fi
+        echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
+        echo "PR number: $PR_NUMBER"
+        echo "Preview dir: /var/www/preview/pr-${PR_NUMBER}"
+
+    - name: Install SSH client
+      shell: sh
+      run: |
+        set -eu
+        # 先检查是否已存在ssh
+        if command -v ssh >/dev/null 2>&1 && command -v ssh-keyscan >/dev/null 2>&1; then
+          echo "SSH client already available: $(ssh -V 2>&1)"
+          exit 0
+        fi
+        # 尝试多种包管理器安装
+        if command -v apk >/dev/null 2>&1; then
+          apk add --no-cache openssh-client >/dev/null 2>&1
+          echo "openssh-client installed via apk"
+        elif command -v apt-get >/dev/null 2>&1; then
+          apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null 2>&1
+          echo "openssh-client installed via apt-get"
+        elif command -v yum >/dev/null 2>&1; then
+          yum install -y openssh-clients >/dev/null 2>&1
+          echo "openssh-client installed via yum"
+        elif command -v dnf >/dev/null 2>&1; then
+          dnf install -y openssh-clients >/dev/null 2>&1
+          echo "openssh-client installed via dnf"
+        else
+          echo "ERROR: No package manager found and ssh not pre-installed"
+          which ssh 2>/dev/null || echo "  ssh: not found"
+          which ssh-keyscan 2>/dev/null || echo "  ssh-keyscan: not found"
+          exit 1
+        fi
+
+    - name: Remove preview directory from server
+      shell: sh
+      env:
+        PREVIEW_SSH_HOST: ${{ secrets.PREVIEW_SSH_HOST }}
+        PREVIEW_SSH_USER: ${{ secrets.PREVIEW_SSH_USER }}
+        PREVIEW_SSH_PORT: ${{ secrets.PREVIEW_SSH_PORT }}
+        PREVIEW_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
+      run: |
+        set -eux
+        preview_host="${PREVIEW_SSH_HOST:-47.98.113.167}"
+        preview_user="${PREVIEW_SSH_USER:-root}"
+        preview_port="${PREVIEW_SSH_PORT:-22222}"
+        preview_dir="/var/www/preview/pr-${PR_NUMBER}"
+
+        mkdir -p ~/.ssh
+
+        # 查找可用的SSH密钥（优先用 secret 里专门为 preview 配置的 key）
+        key_path=""
+        if [ -n "${PREVIEW_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+          printf '%s\n' "$PREVIEW_SSH_KEY" > "$key_path"
+          chmod 600 "$key_path"
+          echo "Using key from PREVIEW_SSH_KEY secret"
+        elif [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+          echo "Using key: $key_path (builder key)"
+        elif [ -f "$HOME/.ssh/xiaoxia_runtime_builder" ]; then
+          key_path="$HOME/.ssh/xiaoxia_runtime_builder"
+          echo "Using key: $key_path (home key)"
+        else
+          echo "ERROR: No SSH key available"
+          ls -la ~/.ssh/ 2>/dev/null || true
+          ls -la /root/.ssh/ 2>/dev/null || true
+          exit 1
+        fi
+
+        ssh-keyscan -p "$preview_port" -H "$preview_host" >> ~/.ssh/known_hosts 2>/dev/null
+        echo "SSH keyscan done"
+
+        # 测试SSH连接
+        ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" "echo SSH_CONNECTION_OK && hostname"
+        echo "SSH connection verified"
+
+        # 检查目录是否存在
+        DIR_EXISTS=$(ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" \
+          "if [ -d '${preview_dir}' ]; then echo 'yes'; else echo 'no'; fi")
+
+        if [ "$DIR_EXISTS" = "yes" ]; then
+          echo "Removing preview directory: ${preview_dir}"
+          ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" \
+            "rm -rf ${preview_dir} && echo 'Preview directory removed successfully'"
+          echo "Cleanup completed: ${preview_dir}"
+        else
+          echo "Preview directory does not exist: ${preview_dir}, nothing to clean up"
+        fi
+
+    - name: Comment cleanup notice on PR
+      if: success()
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        # 从event payload读取PR号（最可靠）
+        if [ -n "${GITHUB_EVENT_PATH:-}" ] && [ -f "$GITHUB_EVENT_PATH" ]; then
+          PR_NUMBER=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('number',''))" < "$GITHUB_EVENT_PATH")
+        else
+          PR_NUMBER=$(echo "$GITHUB_REF" | sed -n 's|refs/pull/\([0-9]*\)/.*|\1|p')
+        fi
+        export PR_NUMBER
+
+        COMMENT_BODY=$(python3 scripts/ci/preview_comment.py cleanup)
+
+        API_URL="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments"
+        curl -s -X POST \
+          -H "Authorization: token ${GITHUB_TOKEN}" \
+          -H "Content-Type: application/json" \
+          -d "$COMMENT_BODY" \
+          "$API_URL" \
+          > /dev/null
+        echo "Cleanup comment posted"
+
+    - name: Report CI trace
+      if: always()
+      shell: sh
+      env:
+        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+      run: |
+        STATUS="ok"
+        [ ${{ job.status }} = "success" ] || STATUS="error"
+        START_TIME=""
+        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+

.gitea/workflows/preview-deploy.yml

@@ -0,0 +1,296 @@
+name: Preview Deploy
+on:
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    branches:
+    - main
+    - develop
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: "触发原因"
+        required: false
+        default: "手动触发 - 预览环境补跑"
+permissions:
+  contents: read
+  pull-requests: write
+concurrency:
+  group: preview-deploy-${{ gitea.ref }}
+  cancel-in-progress: true
+jobs:
+  deploy-preview:
+    name: Deploy Preview Environment
+    runs-on: runtime-builder
+    timeout-minutes: 20
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
+
+    - name: Record job start time
+      shell: sh
+      run: |
+        set -eu
+        echo "JOB_START_TIME=$(date +%s)" >> $GITHUB_ENV
+        echo "Job started at $(date)"
+
+    - name: Extract PR number
+      shell: sh
+      run: |
+        set -eu
+        PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
+        echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
+        echo "PR number: $PR_NUMBER"
+        echo "PREVIEW_URL=https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com" >> $GITHUB_ENV
+        echo "Preview URL: https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com"
+
+    - name: Build frontend
+      shell: sh
+      run: |
+        set -eu
+        NPM_CACHE_VOLUME="xiaoxia-npm-cache"
+        if ! docker volume inspect "$NPM_CACHE_VOLUME" >/dev/null 2>&1; then
+          docker volume create "$NPM_CACHE_VOLUME" >/dev/null
+          echo "Created npm cache volume: $NPM_CACHE_VOLUME"
+        fi
+
+        docker run --rm \
+          -v "$PWD:/workspace" \
+          -v "$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules" \
+          -w /workspace/apps/web \
+          -e VITE_API_URL=https://staging-api.xiaoxiajianji.com \
+          docker.m.daocloud.io/library/node:20 \
+          sh -lc '
+            PACKAGE_LOCK_HASH=$(md5sum package-lock.json 2>/dev/null | cut -d" " -f1)
+            CACHE_HASH_FILE="node_modules/.package-lock-hash"
+            CACHE_VALID=false
+            if [ -f "$CACHE_HASH_FILE" ] && [ "$(cat "$CACHE_HASH_FILE")" = "$PACKAGE_LOCK_HASH" ] && [ -x "node_modules/.bin/vite" ] && [ -x "node_modules/.bin/tsc" ]; then
+              CACHE_VALID=true
+              echo "Cache hit: dependencies valid, skipping npm install"
+            fi
+            if [ "$CACHE_VALID" = "false" ]; then
+              echo "Cache miss or invalid: running npm install..."
+              if ! npm install --include=dev; then
+                echo "npm install failed, cleaning node_modules and retrying..."
+                rm -rf node_modules
+                mkdir -p node_modules
+                npm install --include=dev
+              fi
+              echo "$PACKAGE_LOCK_HASH" > "$CACHE_HASH_FILE"
+              echo "Dependencies installed, cache updated"
+            fi
+            echo "Running TypeScript check..."
+            npx --no-install tsc
+            echo "Running Vite build..."
+            npx --no-install vite build
+            echo "Build completed successfully"
+            ls -la dist/
+          '
+
+    - name: Install SSH client and rsync
+      shell: sh
+      run: |
+        set -eu
+        if command -v apk >/dev/null 2>&1; then
+          apk add --no-cache openssh-client rsync >/dev/null 2>&1
+        elif command -v apt-get >/dev/null 2>&1; then
+          apt-get update -qq && apt-get install -y -qq openssh-client rsync >/dev/null 2>&1
+        elif command -v yum >/dev/null 2>&1; then
+          yum install -y openssh-clients rsync >/dev/null 2>&1
+        else
+          echo "ERROR: No package manager found"
+          exit 1
+        fi
+        echo "openssh-client and rsync installed"
+
+    - name: Deploy preview to server
+      shell: sh
+      env:
+        PREVIEW_SSH_HOST: ${{ secrets.PREVIEW_SSH_HOST }}
+        PREVIEW_SSH_USER: ${{ secrets.PREVIEW_SSH_USER }}
+        PREVIEW_SSH_PORT: ${{ secrets.PREVIEW_SSH_PORT }}
+        PREVIEW_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
+      run: |
+        set -eux
+        preview_host="${PREVIEW_SSH_HOST:-47.98.113.167}"
+        preview_user="${PREVIEW_SSH_USER:-root}"
+        preview_port="${PREVIEW_SSH_PORT:-22222}"
+        preview_dir="/var/www/preview/pr-${PR_NUMBER}"
+
+        mkdir -p ~/.ssh
+
+        # 查找可用的SSH密钥（优先用 secret 里专门为 preview 配置的 key）
+        key_path=""
+        if [ -n "${PREVIEW_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+          printf '%s\n' "$PREVIEW_SSH_KEY" > "$key_path"
+          chmod 600 "$key_path"
+          echo "Using key from PREVIEW_SSH_KEY secret"
+        elif [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+          echo "Using key: $key_path (builder key)"
+        elif [ -f "$HOME/.ssh/xiaoxia_runtime_builder" ]; then
+          key_path="$HOME/.ssh/xiaoxia_runtime_builder"
+          echo "Using key: $key_path (home key)"
+        else
+          echo "ERROR: No SSH key available"
+          ls -la ~/.ssh/ 2>/dev/null || true
+          ls -la /root/.ssh/ 2>/dev/null || true
+          exit 1
+        fi
+
+        # SSH密钥完整性自检
+        if ! ssh-keygen -y -f "$key_path" > /dev/null 2>&1; then
+          echo "ERROR: SSH密钥损坏（private key contents do not match public）"
+          echo "请检查 PREVIEW_SSH_KEY secret 中的私钥是否完整正确"
+          echo "私钥文件大小: $(wc -c < "$key_path") 字节"
+          head -2 "$key_path"
+          exit 1
+        fi
+        echo "SSH key integrity check passed"
+
+        ssh-keyscan -p "$preview_port" -H "$preview_host" >> ~/.ssh/known_hosts 2>/dev/null
+        echo "SSH keyscan done"
+
+        # 测试SSH连接
+        ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" "echo SSH_CONNECTION_OK && hostname"
+        echo "SSH connection verified"
+
+        # 创建预览目录并上传文件
+        ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" \
+          "mkdir -p ${preview_dir} && echo 'Preview directory created: ${preview_dir}'"
+
+        # 使用rsync上传dist目录内容
+        rsync -avz --delete -e "ssh -p ${preview_port} -i ${key_path} -o StrictHostKeyChecking=no" \
+          apps/web/dist/ \
+          "${preview_user}@${preview_host}:${preview_dir}/"
+
+        echo "Preview deployed to: ${preview_dir}"
+        echo "Preview URL: https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com"
+
+    - name: Comment preview link on PR
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
+        PREVIEW_URL="https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com"
+        export PR_NUMBER PREVIEW_URL
+
+        COMMENT_BODY=$(python3 scripts/ci/preview_comment.py deploy)
+
+        API_URL="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments"
+
+        EXISTING_COMMENT_ID=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "$API_URL" | python3 -c "
+        import sys, json
+        try:
+            for c in json.load(sys.stdin):
+                if '预览环境已部署' in c.get('body', ''):
+                    print(c['id'])
+                    break
+        except Exception:
+            pass
+        ")
+
+        if [ -n "$EXISTING_COMMENT_ID" ]; then
+          curl -s -X PATCH \
+            -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$COMMENT_BODY" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING_COMMENT_ID}" \
+            > /dev/null
+          echo "Comment updated"
+        else
+          curl -s -X POST \
+            -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$COMMENT_BODY" \
+            "$API_URL" \
+            > /dev/null
+          echo "Comment posted"
+        fi
+
+    - name: Job duration summary
+      if: always()
+      shell: sh
+      run: |
+        set +eu
+        if [ -n "$JOB_START_TIME" ]; then
+          END_TIME=$(date +%s)
+          DURATION=$((END_TIME - JOB_START_TIME))
+          MINS=$((DURATION / 60))
+          SECS=$((DURATION % 60))
+          echo "JOB_DURATION_SECONDS=$DURATION" >> $GITHUB_ENV
+          echo "=== Job Duration: ${MINS}m${SECS}s ==="
+        else
+          echo "JOB_DURATION_SECONDS=0" >> $GITHUB_ENV
+          echo "=== Job Duration: unknown ==="
+        fi
+
+    - name: Notify on failure
+      continue-on-error: true
+      if: failure()
+      shell: sh
+      env:
+        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+      run: |
+        set +e
+        NOTIFY_MODE=failure JOB_NAME="Deploy Preview Environment" python3 scripts/ci_notify.py
+    - name: Report CI trace
+      if: always()
+      shell: sh
+      env:
+        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+      run: |
+        STATUS="ok"
+        [ ${{ job.status }} = "success" ] || STATUS="error"
+        START_TIME=""
+        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+

.gitea/workflows/test-ssh-secret.yml

@@ -1,69 +0,0 @@
-name: Test SSH Secret
-on:
-  push:
-    branches: [develop]
-    paths:
-      - '.gitea/workflows/test-ssh-secret.yml'
-
-jobs:
-  test-ssh:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Install SSH client
-        run: |
-          which ssh || (apt-get update && apt-get install -y openssh-client)
-          ssh -V
-
-      - name: Debug environment
-        run: |
-          echo "=== Environment ==="
-          echo "Runner hostname: $(hostname)"
-          echo "Runner IP: $(hostname -i || echo 'unknown')"
-          echo "Current user: $(whoami)"
-          echo "=== Secrets check ==="
-          if [ -n "$STAGING_SSH_HOST" ]; then
-            echo "STAGING_SSH_HOST: [SET] value_length=${#STAGING_SSH_HOST}"
-          else
-            echo "STAGING_SSH_HOST: [EMPTY]"
-          fi
-          if [ -n "$STAGING_SSH_USER" ]; then
-            echo "STAGING_SSH_USER: [SET] value_length=${#STAGING_SSH_USER}"
-          else
-            echo "STAGING_SSH_USER: [EMPTY]"
-          fi
-          if [ -n "$STAGING_SSH_KEY" ]; then
-            echo "STAGING_SSH_KEY: [SET] value_length=${#STAGING_SSH_KEY}"
-          else
-            echo "STAGING_SSH_KEY: [EMPTY]"
-          fi
-        env:
-          STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-          STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
-          STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-
-      - name: Setup SSH key
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          echo "$STAGING_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub 2>/dev/null || echo "No public key generated"
-          echo "=== SSH Key fingerprint ==="
-          ssh-keygen -lf ~/.ssh/id_ed25519 || echo "Key fingerprint failed"
-        env:
-          STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-
-      - name: Test SSH connection
-        run: |
-          echo "Attempting SSH connection to $STAGING_SSH_HOST..."
-          ssh -i ~/.ssh/id_ed25519 \
-            -o StrictHostKeyChecking=no \
-            -o UserKnownHostsFile=/dev/null \
-            -o ConnectTimeout=10 \
-            -o BatchMode=yes \
-            -v \
-            $STAGING_SSH_USER@$STAGING_SSH_HOST "echo 'SSH_CONNECTION_SUCCESS' && hostname && whoami"
-          echo "=== SSH Test Complete ==="
-        env:
-          STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-          STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}

.gitea/workflows/tests.yml

@@ -1,163 +0,0 @@
-name: Tests
-
-on:
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  test:
-    runs-on: runtime-builder
-
-    steps:
-    - name: Checkout code
-      shell: sh
-      run: |
-        set -eu
-        python - <<'PY'
-        import io
-        import os
-        import tarfile
-        import time
-        import urllib.error
-        import urllib.request
-
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        # Retry up to 5 times with backoff for transient 5xx errors
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Show Python version
-      shell: sh
-      run: |
-        set -eu
-        python --version
-        python -m pip --version
-
-    - name: Install dependencies
-      shell: sh
-      run: |
-        set -eu
-        python -m pip install --upgrade pip -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com
-        python -m pip install -r requirements.txt -r requirements-dev.txt -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com
-
-    - name: Run unit tests
-      shell: sh
-      run: |
-        set -eu
-        PYTHONPATH="$PWD/apps/api:$PWD" python -m pytest tests/unit -q
-
-    - name: Run integration tests
-      shell: sh
-      run: |
-        set -eu
-        PYTHONPATH="$PWD/apps/api:$PWD" python -m pytest tests/integration -q --timeout=60 -x
-
-  lint:
-    runs-on: runtime-builder
-
-    steps:
-    - name: Checkout code
-      shell: sh
-      run: |
-        set -eu
-        python - <<'PY'
-        import io
-        import os
-        import tarfile
-        import time
-        import urllib.error
-        import urllib.request
-
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        # Retry up to 5 times with backoff for transient 5xx errors
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Install dependencies
-      shell: sh
-      run: |
-        set -eu
-        python -m pip install --upgrade pip -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com
-        python -m pip install -r requirements.txt -r requirements-dev.txt -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com
-
-    - name: Run Black (check only)
-      shell: sh
-      run: |
-        set -eu
-        python -m black --check alembic apps packages tests scripts
-
-    - name: Run Flake8
-      shell: sh
-      run: |
-        set -eu
-        python -m flake8 apps packages tests --count --statistics

.gitea/workflows/worker-base-image.yml

@@ -0,0 +1,103 @@
+name: Worker Base Image Build
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - 'requirements-base.txt'
+      - 'requirements-worker.txt'
+      - 'infra/docker/worker-base-builder.Dockerfile'
+      - 'infra/docker/worker-base-runtime.Dockerfile'
+  workflow_dispatch:  # 支持手动触发
+
+jobs:
+  build-worker-base:
+    name: Build Worker Base Images
+    runs-on: runtime-builder
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - name: builder
+          dockerfile: infra/docker/worker-base-builder.Dockerfile
+          image_name: worker-base-builder
+          cache_name: worker-base-builder-cache
+        - name: runtime
+          dockerfile: infra/docker/worker-base-runtime.Dockerfile
+          image_name: worker-base-runtime
+          cache_name: worker-base-runtime-cache
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        curl -sH "Authorization: token $GITHUB_TOKEN"           "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"           | bash
+
+    - name: Docker login to Registry
+      shell: sh
+      env:
+        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        GITEA_REGISTRY_USER: xiaoxia
+        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+      run: |
+        set -eu
+        for i in 1 2 3; do
+          echo "=== Docker login 尝试 $i/3 ==="
+          if printf '%s' "${ACR_PASSWORD}" | docker login xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com -u "${ACR_USERNAME}" --password-stdin              && docker login git.xiaoxiajianji.com -u "${GITEA_REGISTRY_USER}" -p "${GITEA_REGISTRY_TOKEN}"; then
+            echo "✅ Docker login successful"
+            break
+          fi
+          echo "❌ Docker login 失败（尝试 $i/3），5s 后重试..."
+          sleep 5
+        done
+
+    - name: Setup buildx builder
+      shell: sh
+      run: |
+        set -eu
+        BUILDER_NAME="ci-builder-${GITHUB_RUN_ID}-${{ matrix.name }}"
+        if ! docker buildx inspect "$BUILDER_NAME" > /dev/null 2>&1; then
+          docker buildx create --use --name "$BUILDER_NAME" --driver docker-container
+          echo "Created $BUILDER_NAME"
+        else
+          docker buildx use "$BUILDER_NAME"
+          echo "Using existing $BUILDER_NAME"
+        fi
+        docker buildx inspect --bootstrap
+
+    - name: Build and push base image
+      shell: sh
+      run: |
+        set -eu
+        REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
+        IMAGE_TAG="${REGISTRY}/${{ matrix.image_name }}:latest"
+        SAFE_REF_NAME=$(echo "${GITHUB_REF_NAME}" | tr '/' '-')
+        CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:${SAFE_REF_NAME}"
+        
+        echo "=== Building ${{ matrix.name }} base image ==="
+        echo "Image: ${IMAGE_TAG}"
+        echo "Cache: ${CACHE_REF}"
+        
+        # 用通用构建脚本
+        bash scripts/ci/docker_build_push.sh           ${{ matrix.dockerfile }}           "${IMAGE_TAG}"           "${CACHE_REF}"
+        
+        # 同时推送到 Gitea Packages 作为备份（可选）
+        GITEA_IMAGE="git.xiaoxiajianji.com/xiaoxia-saas/${{ matrix.image_name }}:latest"
+        docker tag "${IMAGE_TAG}" "${GITEA_IMAGE}"
+        docker push "${GITEA_IMAGE}" || echo "Gitea Packages push failed (non-fatal)"
+        
+        echo ""
+        echo "✅ ${{ matrix.name }} base image built and pushed"
+
+    - name: Cleanup buildx builder
+      if: always()
+      shell: sh
+      run: |
+        docker buildx rm "ci-builder-${GITHUB_RUN_ID}-${{ matrix.name }}" 2>/dev/null || true
+        docker buildx prune -f 2>/dev/null || true
+        echo "Builder cleanup done"

alembic/versions/030_add_tags_and_asset_tags.py

@@ -0,0 +1,68 @@
+"""Add tags and asset_tags tables
+
+Revision ID: 030
+Revises: 029
+Create Date: 2026-07-07
+
+新增标签表和素材-标签关联表，支持规范化多对多标签管理。
+"""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "030"
+down_revision = "029"
+branch_labels = None
+depends_on = None
+
+
+def _table_exists(table: str) -> bool:
+    ctx = op.get_context()
+    if ctx.as_sql:
+        return False
+    conn = op.get_bind()
+    result = conn.execute(
+        sa.text("SELECT COUNT(*) FROM information_schema.tables WHERE table_name = :table"),
+        {"table": table},
+    )
+    return (result.scalar() or 0) > 0
+
+
+def upgrade() -> None:
+    if not _table_exists("tags"):
+        op.create_table(
+            "tags",
+            sa.Column("id", sa.String(36), primary_key=True),
+            sa.Column("user_id", sa.String(36), nullable=False),
+            sa.Column("name", sa.String(100), nullable=False),
+            sa.Column(
+                "created_at",
+                sa.DateTime(),
+                nullable=False,
+                server_default=sa.func.now(),
+            ),
+            sa.UniqueConstraint("user_id", "name", name="uq_tags_user_name"),
+        )
+        op.create_index("ix_tags_user_id", "tags", ["user_id"])
+
+    if not _table_exists("asset_tags"):
+        op.create_table(
+            "asset_tags",
+            sa.Column("asset_id", sa.String(36), primary_key=True),
+            sa.Column("tag_id", sa.String(36), primary_key=True),
+            sa.Column(
+                "created_at",
+                sa.DateTime(),
+                nullable=False,
+                server_default=sa.func.now(),
+            ),
+        )
+        op.create_index("ix_asset_tags_tag_id", "asset_tags", ["tag_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_asset_tags_tag_id", table_name="asset_tags")
+    op.drop_table("asset_tags")
+    op.drop_index("ix_tags_user_id", table_name="tags")
+    op.drop_table("tags")

alembic/versions/031_add_file_hash_to_assets_and_ing_jobs.py

@@ -0,0 +1,33 @@
+"""Add file_hash to assets and ingest_jobs
+
+Revision ID: 031
+Revises: 030
+Create Date: 2026-07-07
+
+为素材去重检测功能添加 file_hash 字段。
+"""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "031"
+down_revision = "030"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("assets", sa.Column("file_hash", sa.String(64), nullable=True))
+    op.create_index(op.f("ix_assets_file_hash"), "assets", ["file_hash"])
+
+    op.add_column("ingest_jobs", sa.Column("file_hash", sa.String(64), nullable=True))
+    op.create_index(op.f("ix_ingest_jobs_file_hash"), "ingest_jobs", ["file_hash"])
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_ingest_jobs_file_hash"), table_name="ingest_jobs")
+    op.drop_column("ingest_jobs", "file_hash")
+
+    op.drop_index(op.f("ix_assets_file_hash"), table_name="assets")
+    op.drop_column("assets", "file_hash")

alembic/versions/032_add_asset_select_mode_to_generation_tasks.py

@@ -0,0 +1,28 @@
+"""Add asset_select_mode to generation_tasks
+
+Revision ID: 032
+Revises: 031
+Create Date: 2026-07-07
+
+素材库自动匹配功能：为 generation_tasks 表添加 asset_select_mode 字段。
+"""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "032"
+down_revision = "031"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "generation_tasks",
+        sa.Column("asset_select_mode", sa.String(20), nullable=False, server_default=""),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("generation_tasks", "asset_select_mode")

alembic/versions/033_add_batch_id_to_generation_tasks.py

@@ -0,0 +1,31 @@
+"""Add batch_id to generation_tasks
+
+Revision ID: 033
+Revises: 032
+Create Date: 2026-07-07
+
+视频查重功能：为 generation_tasks 表添加 batch_id 字段，
+用于关联同一次批量生成请求中的多个任务。
+"""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "033"
+down_revision = "032"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "generation_tasks",
+        sa.Column("batch_id", sa.String(32), nullable=False, server_default=""),
+    )
+    op.create_index(op.f("ix_generation_tasks_batch_id"), "generation_tasks", ["batch_id"])
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_generation_tasks_batch_id"), table_name="generation_tasks")
+    op.drop_column("generation_tasks", "batch_id")

apps/api/app/api/router.py

@@ -16,6 +16,7 @@ from app.api.routes.jobs import router as jobs_router
 from app.api.routes.projects import router as projects_router
 from app.api.routes.recipes import router as recipes_router
 from app.api.routes.subscription import router as subscription_router
+from app.api.routes.tags import router as tags_router
 from app.api.routes.task_center import router as task_center_router
 from app.api.routes.templates import router as templates_router
 from app.api.routes.titles import router as titles_router
@@ -38,6 +39,11 @@ api_router.include_router(
     prefix="/projects",
     tags=["Project"],
 )
+api_router.include_router(
+    tags_router,
+    prefix="/tags",
+    tags=["Tag"],
+)
 api_router.include_router(
     task_center_router,
     tags=["TaskCenter"],

apps/api/app/api/routes/assets.py

@@ -7,14 +7,18 @@ from app.dependencies import (
     get_asset_library_repository,
     get_asset_repository,
     get_project_repository,
+    get_tag_repository,
 )
 from app.schemas.asset import (
     AssetResponse,
+    BatchDeleteRequest,
+    BatchDeleteResponse,
     CreateAssetRequest,
     ListAssetsResponse,
     UpdateAssetRequest,
     UpdateAssetReviewRequest,
 )
+from app.schemas.tag import TagAssetsRequest
 from fastapi import APIRouter, Depends, HTTPException, Query
 
 from packages.application import (
@@ -64,6 +68,7 @@ def _to_asset_response(item, storage_service=None) -> AssetResponse:
         classification_status=item.classification_status.value,
         quality_score=item.quality_score,
         uploaded_by_user_id=item.uploaded_by_user_id,
+        tag_ids=getattr(item, "tag_ids", []),
     )
 
 
@@ -84,6 +89,7 @@ def list_assets(
     keyword: Optional[str] = Query(None, description="按名称模糊匹配"),
     gender: Optional[str] = Query(None, description="按 metadata.gender 筛选"),
     style: Optional[str] = Query(None, description="按 metadata.style 筛选"),
+    tag_ids: Optional[str] = Query(None, description="按标签 ID 筛选（逗号分隔，取交集）"),
     skip: int = Query(0, ge=0),
     limit: int = Query(100, ge=1, le=500),
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
@@ -96,12 +102,19 @@ def list_assets(
     # kind → file_type 映射（voice 对应 audio）
     kind_to_file_type = {"video": "video", "voice": "audio", "image": "image"}
 
-    def _apply_filters(items):
-        """依次应用 kind / keyword / gender / style 过滤。"""
+    # 解析 tag_ids 参数（逗号分隔）
+    filter_tag_ids: list[str] | None = None
+    if tag_ids:
+        filter_tag_ids = [t.strip() for t in tag_ids.split(",") if t.strip()]
+        if not filter_tag_ids:
+            filter_tag_ids = None
+
+    # 需要内存过滤的标志（keyword/gender/style/tag_ids 无法在 DB 层过滤）
+    needs_memory_filter = bool(keyword or gender or style or filter_tag_ids)
+
+    def _apply_memory_filters(items):
+        """应用 keyword / gender / style / tag_ids 内存过滤。"""
         result = items
-        if kind:
-            ft = kind_to_file_type.get(kind)
-            result = [i for i in result if i.mime_type and i.mime_type.startswith(ft or "")]
         if keyword:
             kw = keyword.lower()
             result = [i for i in result if kw in (i.name or "").lower()]
@@ -109,9 +122,90 @@ def list_assets(
             result = [i for i in result if (i.metadata or {}).get("gender") == gender]
         if style:
             result = [i for i in result if (i.metadata or {}).get("style") == style]
+        if filter_tag_ids:
+            tag_set = set(filter_tag_ids)
+            result = [i for i in result if tag_set.issubset(set(getattr(i, "tag_ids", [])))]
         return result
 
-    # 模式1：指定 library_id → 返回该库的素材
+    # ── 优化路径：无内存过滤时，使用 DB 级分页 ──
+    if not needs_memory_filter:
+        ft = kind_to_file_type.get(kind) if kind else None
+
+        # 模式1：指定 library_id
+        if library_id:
+            library = asset_library_repository.get(library_id)
+            if library is None:
+                raise HTTPException(status_code=404, detail=f"AssetLibrary {library_id} not found")
+            _check_project_access(library.project_id, user_id, project_repository)
+            if ft:
+                items = asset_repository.find_by_library_and_file_type(library_id, ft, skip=skip, limit=limit)
+                total = asset_repository.count_by_project(library.project_id) if not kind else len(items)
+            else:
+                items = asset_repository.find_by_library(library_id, skip=skip, limit=limit)
+                total = asset_repository.count_by_project(library.project_id)
+            return ListAssetsResponse(
+                items=[_to_asset_response(item) for item in items],
+                total=total,
+                skip=skip,
+                limit=limit,
+            )
+
+        # 模式2：指定 project_id
+        if project_id:
+            _check_project_access(project_id, user_id, project_repository)
+            if ft:
+                # 无直接方法，加载后按 file_type 过滤（仍比全量加载好）
+                all_items = asset_repository.find_by_project(project_id)
+                items = [i for i in all_items if i.mime_type and i.mime_type.startswith(ft)]
+                total = len(items)
+                paged = items[skip : skip + limit]
+            else:
+                items = asset_repository.find_by_project(project_id, skip=skip, limit=limit)
+                total = asset_repository.count_by_project(project_id)
+                paged = items
+            return ListAssetsResponse(
+                items=[_to_asset_response(item) for item in paged],
+                total=total,
+                skip=skip,
+                limit=limit,
+            )
+
+        # 模式3：跨项目（无 library_id/project_id）
+        try:
+            projects = project_repository.find_accessible_projects(user_id)
+        except Exception:
+            logger.exception("查询用户可访问项目失败: user_id=%s", user_id)
+            return ListAssetsResponse(items=[], total=0, skip=skip, limit=limit)
+
+        project_ids = [p.id for p in projects]
+        if not project_ids:
+            return ListAssetsResponse(items=[], total=0, skip=skip, limit=limit)
+
+        total = asset_repository.count_by_project_ids(project_ids)
+        # 跨项目分页：逐项目累积直到凑够一页
+        paged_items: list = []
+        offset = skip
+        remaining = limit
+        for pid in project_ids:
+            proj_total = asset_repository.count_by_project(pid)
+            if offset >= proj_total:
+                offset -= proj_total
+                continue
+            proj_items = asset_repository.find_by_project(pid, skip=offset, limit=remaining)
+            paged_items.extend(proj_items)
+            remaining -= len(proj_items)
+            offset = 0
+            if remaining <= 0:
+                break
+
+        return ListAssetsResponse(
+            items=[_to_asset_response(item) for item in paged_items],
+            total=total,
+            skip=skip,
+            limit=limit,
+        )
+
+    # ── 内存过滤路径：有 keyword/gender/style 时，加载全量后内存过滤 ──
     if library_id:
         library = asset_library_repository.get(library_id)
         if library is None:
@@ -121,41 +215,24 @@ def list_assets(
             all_items = asset_repository.find_by_library_and_file_type(library_id, kind_to_file_type[kind])
         else:
             all_items = asset_repository.find_by_library(library_id)
-        filtered = _apply_filters(all_items)
-        total = len(filtered)
-        paged = filtered[skip : skip + limit]
-        return ListAssetsResponse(
-            items=[_to_asset_response(item) for item in paged],
-            total=total,
-            skip=skip,
-            limit=limit,
-        )
-
-    # 模式2：指定 project_id → 返回该项目所有素材
-    if project_id:
+    elif project_id:
         _check_project_access(project_id, user_id, project_repository)
         all_items = asset_repository.find_by_project(project_id)
-        filtered = _apply_filters(all_items)
-        total = len(filtered)
-        paged = filtered[skip : skip + limit]
-        return ListAssetsResponse(
-            items=[_to_asset_response(item) for item in paged],
-            total=total,
-            skip=skip,
-            limit=limit,
-        )
+    else:
+        try:
+            projects = project_repository.find_accessible_projects(user_id)
+        except Exception:
+            logger.exception("查询用户可访问项目失败: user_id=%s", user_id)
+            return ListAssetsResponse(items=[], total=0, skip=skip, limit=limit)
+        all_items = []
+        for proj in projects:
+            all_items.extend(asset_repository.find_by_project(proj.id))
 
-    # 模式3：都不传 → 返回用户可访问的所有项目的所有素材
-    try:
-        projects = project_repository.find_accessible_projects(user_id)
-    except Exception:
-        logger.exception("查询用户可访问项目失败: user_id=%s", user_id)
-        return ListAssetsResponse(items=[], total=0, skip=skip, limit=limit)
-
-    all_items = []
-    for proj in projects:
-        all_items.extend(asset_repository.find_by_project(proj.id))
-    filtered = _apply_filters(all_items)
+    # 应用 kind 过滤（如果有）+ keyword/gender/style
+    if kind:
+        ft = kind_to_file_type.get(kind)
+        all_items = [i for i in all_items if i.mime_type and i.mime_type.startswith(ft or "")]
+    filtered = _apply_memory_filters(all_items)
     total = len(filtered)
     paged = filtered[skip : skip + limit]
     return ListAssetsResponse(
@@ -191,6 +268,35 @@ def update_asset_review_status(
     return _to_asset_response(updated)
 
 
+@router.post("/batch-delete", response_model=BatchDeleteResponse)
+def batch_delete_assets(
+    request: BatchDeleteRequest,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    asset_repository: Any = Depends(get_asset_repository),
+    project_repository: Any = Depends(get_project_repository),
+) -> BatchDeleteResponse:
+    """批量删除素材（配音素材等），需逐项校验项目权限。"""
+    user_id = authenticated_user.user.id
+    deleted_ids: list[str] = []
+    failed_ids: list[str] = []
+
+    for asset_id in request.ids:
+        item = asset_repository.find_by_id(asset_id)
+        if item is None:
+            failed_ids.append(asset_id)
+            continue
+        try:
+            _check_project_access(item.project_id, user_id, project_repository)
+            deleted_ids.append(asset_id)
+        except HTTPException:
+            failed_ids.append(asset_id)
+
+    if deleted_ids:
+        asset_repository.batch_delete(deleted_ids)
+
+    return BatchDeleteResponse(deleted_count=len(deleted_ids), failed_ids=failed_ids)
+
+
 @router.get("/{asset_id}", response_model=AssetResponse)
 def get_asset(
     asset_id: str,
@@ -244,6 +350,48 @@ def delete_asset(
     asset_repository.delete(asset_id)
 
 
+@router.post("/{asset_id}/tags", response_model=AssetResponse)
+def tag_asset(
+    asset_id: str,
+    request: TagAssetsRequest,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    asset_repository: Any = Depends(get_asset_repository),
+    project_repository: Any = Depends(get_project_repository),
+    tag_repository: Any = Depends(get_tag_repository),
+) -> AssetResponse:
+    """给素材打标签。"""
+    item = asset_repository.find_by_id(asset_id)
+    if item is None:
+        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
+    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    for tag_id in request.tag_ids:
+        tag = tag_repository.get(tag_id)
+        if tag is None:
+            raise HTTPException(status_code=404, detail=f"Tag {tag_id} not found")
+        if tag.user_id != authenticated_user.user.id:
+            raise HTTPException(status_code=403, detail=f"无权使用标签 {tag_id}")
+        item.add_tag(tag_id)
+    updated = asset_repository.update(item)
+    return _to_asset_response(updated)
+
+
+@router.delete("/{asset_id}/tags/{tag_id}", status_code=204)
+def untag_asset(
+    asset_id: str,
+    tag_id: str,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    asset_repository: Any = Depends(get_asset_repository),
+    project_repository: Any = Depends(get_project_repository),
+) -> None:
+    """取消素材的标签。"""
+    item = asset_repository.find_by_id(asset_id)
+    if item is None:
+        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
+    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    item.remove_tag(tag_id)
+    asset_repository.update(item)
+
+
 @router.post("", response_model=AssetResponse)
 def create_asset(
     request: CreateAssetRequest,

apps/api/app/api/routes/chunked_upload.py

@@ -19,6 +19,7 @@ from app.core.celery_app import celery_app
 from app.core.storage import OSSStorageService, get_storage_service
 from app.dependencies import (
     get_asset_library_repository,
+    get_asset_repository,
     get_ingest_job_repository,
     get_project_repository,
 )
@@ -42,20 +43,33 @@ DEFAULT_CHUNK_SIZE = 5 * 1024 * 1024  # 5MB
 MAX_FILE_SIZE = 2 * 1024 * 1024 * 1024  # 2GB
 CHUNK_EXPIRY_HOURS = 24
 
-# Allowed file types (consistent with existing upload.py)
+# Allowed file types — must stay in sync with upload.py ALLOWED_MIME_TYPES
 ALLOWED_MIME_TYPES = {
+    # Images
     "image/jpeg",
     "image/png",
     "image/gif",
     "image/webp",
+    "image/bmp",
+    "image/tiff",
+    "image/svg+xml",
+    # Video
     "video/mp4",
     "video/quicktime",
+    "video/mpeg",
     "video/x-msvideo",
     "video/webm",
+    "video/x-matroska",
+    "video/3gpp",
+    # Audio
     "audio/mpeg",
     "audio/wav",
     "audio/ogg",
     "audio/mp3",
+    "audio/flac",
+    "audio/aac",
+    "audio/x-m4a",
+    "audio/webm",
 }
 
 # Chunk storage root directory
@@ -360,6 +374,7 @@ async def complete_chunked_upload(
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
+    asset_repository: Any = Depends(get_asset_repository),
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> ChunkedUploadCompleteResponse:
@@ -423,6 +438,29 @@ async def complete_chunked_upload(
             content_type=meta["content_type"],
         )
 
+        # ── 素材去重检测：同素材库 + 同 file_hash 视为重复 ──
+        if request.file_hash:
+            existing = asset_repository.find_by_library_and_file_hash(
+                library_id=request.library_id,
+                file_hash=request.file_hash,
+            )
+            if existing is not None:
+                logger.info(
+                    "素材去重命中(chunked): library=%s hash=%s existing_asset=%s",
+                    request.library_id,
+                    request.file_hash,
+                    existing.id,
+                )
+                meta["status"] = "completed"
+                _save_upload_meta(upload_id, meta)
+                return ChunkedUploadCompleteResponse(
+                    storage_key=storage_key,
+                    ingest_job_id="",
+                    url=file_url,
+                    duplicated=True,
+                    asset_id=existing.id,
+                )
+
         # Create ingest job
         use_case = SubmitIngestJobUseCase(ingest_job_repository)
         job = use_case.execute(
@@ -430,6 +468,7 @@ async def complete_chunked_upload(
                 project_id=meta["project_id"],
                 library_id=meta["library_id"],
                 storage_key=storage_key,
+                file_hash=request.file_hash,
             )
         )
         celery_app.send_task("worker.ingest_asset", args=[job.id])

apps/api/app/api/routes/generation_tasks.py

@@ -1,3 +1,5 @@
+import random
+import uuid
 from typing import Any
 
 from app.auth import AuthenticatedUser, get_current_user
@@ -14,6 +16,7 @@ from app.schemas.generated_video import (
     ListGeneratedVideosResponse,
 )
 from app.schemas.generation_task import (
+    BatchGenerationTaskResponse,
     CreateGenerationTaskRequest,
     GenerationTaskResponse,
     ListGenerationTasksResponse,
@@ -51,6 +54,8 @@ def _to_generation_task_response(task) -> GenerationTaskResponse:
         title_ids=task.title_ids,
         voice_ids=task.voice_ids,
         source_edit_plan_id=task.source_edit_plan_id or "",
+        asset_select_mode=getattr(task, "asset_select_mode", ""),
+        batch_id=getattr(task, "batch_id", ""),
         status=task.status,
         progress=task.progress,
         result_count=task.result_count,
@@ -85,6 +90,49 @@ def _ensure_library_has_ready_video_assets(assets) -> None:
         )
 
 
+def _select_assets_from_library(
+    assets: list,
+    mode: str,
+    count: int,
+) -> list[str]:
+    """根据选取模式从素材库中选取 ready 状态的视频素材 ID。
+
+    Args:
+        assets: 素材库中所有素材（Asset 实体列表）
+        mode: 选取模式 — all=全部, random=随机, smart=按质量评分
+        count: 选取数量，0 表示全部（仅 random/smart 模式有效）
+
+    Returns:
+        选中的素材 ID 列表
+    """
+    ready_video_assets = [a for a in assets if a.status.value == "ready" and a.mime_type.startswith("video")]
+
+    if not ready_video_assets:
+        return []
+
+    if mode == "random":
+        selected = (
+            ready_video_assets if count <= 0 else random.sample(ready_video_assets, min(count, len(ready_video_assets)))
+        )
+        return [a.id for a in selected]
+
+    if mode == "smart":
+        # 按质量分降序排列（质量分高的优先），质量分相同时按时长降序
+        sorted_assets = sorted(
+            ready_video_assets,
+            key=lambda a: (
+                a.quality_score if a.quality_score is not None else 0.0,
+                a.duration if a.duration is not None else 0.0,
+            ),
+            reverse=True,
+        )
+        selected = sorted_assets if count <= 0 else sorted_assets[:count]
+        return [a.id for a in selected]
+
+    # 默认 all 模式：返回全部 ready 视频素材
+    return [a.id for a in ready_video_assets]
+
+
 def _resolve_project_and_library(
     request: CreateGenerationTaskRequest,
     project_repository: Any,
@@ -122,7 +170,7 @@ def _resolve_project_and_library(
     return project_id, asset_library_id
 
 
-@router.post("/tasks", response_model=GenerationTaskResponse)
+@router.post("/tasks", response_model=BatchGenerationTaskResponse)
 def create_generation_task(
     request: CreateGenerationTaskRequest,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
@@ -130,12 +178,13 @@ def create_generation_task(
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
     asset_repository: Any = Depends(get_asset_repository),
-) -> GenerationTaskResponse:
+) -> BatchGenerationTaskResponse:
     project_id, asset_library_id = _resolve_project_and_library(
         request, project_repository, asset_library_repository, asset_repository, authenticated_user
     )
 
     # asset_library 存在性校验（仅在提供了 asset_library_id 时）
+    resolved_asset_ids: list[str] = list(request.asset_ids)
     if asset_library_id:
         library = asset_library_repository.get(asset_library_id)
         if library is None or (project_id and library.project_id != project_id):
@@ -144,23 +193,42 @@ def create_generation_task(
         assets = asset_repository.find_by_library(asset_library_id)
         _ensure_library_has_ready_video_assets(assets)
 
+        # 素材库自动匹配：当未显式指定 asset_ids 时，按模式自动选取
+        if not resolved_asset_ids:
+            resolved_asset_ids = _select_assets_from_library(
+                assets,
+                mode=request.asset_select_mode,
+                count=request.asset_select_count,
+            )
+
     use_case = CreateGenerationTaskUseCase(generation_task_repository)
-    task = use_case.execute(
-        CreateGenerationTaskCommand(
-            project_id=project_id,
-            asset_library_id=asset_library_id,
-            strategy_id=request.strategy_id,
-            voice_library_id=request.voice_library_id,
-            template_id=request.template_id,
-            asset_ids=request.asset_ids,
-            title_ids=request.title_ids,
-            voice_ids=request.voice_ids,
-            created_by_user_id=authenticated_user.user.id,
-            source_edit_plan_id=request.source_edit_plan_id,
+    count = request.count
+    created_tasks = []
+    # 同批次任务共享 batch_id，用于视频查重时批次内比对
+    batch_id = uuid.uuid4().hex if count > 1 else ""
+
+    for _ in range(count):
+        task = use_case.execute(
+            CreateGenerationTaskCommand(
+                project_id=project_id,
+                asset_library_id=asset_library_id,
+                strategy_id=request.strategy_id,
+                voice_library_id=request.voice_library_id,
+                template_id=request.template_id,
+                asset_ids=resolved_asset_ids,
+                title_ids=request.title_ids,
+                voice_ids=request.voice_ids,
+                created_by_user_id=authenticated_user.user.id,
+                source_edit_plan_id=request.source_edit_plan_id,
+                asset_select_mode=request.asset_select_mode,
+                batch_id=batch_id,
+            )
         )
-    )
-    celery_app.send_task("worker.generate_video", args=[task.id])
-    return _to_generation_task_response(task)
+        celery_app.send_task("worker.generate_video", args=[task.id])
+        created_tasks.append(task)
+
+    items = [_to_generation_task_response(t) for t in created_tasks]
+    return BatchGenerationTaskResponse(items=items, total=len(items))
 
 
 @router.get("/tasks", response_model=ListGenerationTasksResponse)
@@ -237,6 +305,7 @@ def retry_generation_task(
             voice_ids=task.voice_ids,
             created_by_user_id=authenticated_user.user.id,
             source_edit_plan_id=task.source_edit_plan_id or "",
+            asset_select_mode=getattr(task, "asset_select_mode", ""),
         )
     )
     celery_app.send_task("worker.generate_video", args=[retried.id])

apps/api/app/api/routes/tags.py

@@ -0,0 +1,67 @@
+"""标签 CRUD 路由。"""
+
+import logging
+from typing import Any
+
+from app.auth import AuthenticatedUser, get_current_user
+from app.dependencies import get_tag_repository
+from app.schemas.tag import (
+    CreateTagRequest,
+    ListTagsResponse,
+    TagResponse,
+)
+from fastapi import APIRouter, Depends, HTTPException
+
+from packages.domain import Tag
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+
+@router.get("", response_model=ListTagsResponse)
+def list_tags(
+    skip: int = 0,
+    limit: int = 100,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    tag_repository: Any = Depends(get_tag_repository),
+) -> ListTagsResponse:
+    """列出当前用户的标签。"""
+    user_id = authenticated_user.user.id
+    items = tag_repository.list_by_user(user_id, skip=skip, limit=limit)
+    total = tag_repository.count_by_user(user_id)
+    return ListTagsResponse(
+        items=[TagResponse(id=t.id, name=t.name, created_at=t.created_at) for t in items],
+        total=total,
+    )
+
+
+@router.post("", response_model=TagResponse, status_code=201)
+def create_tag(
+    request: CreateTagRequest,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    tag_repository: Any = Depends(get_tag_repository),
+) -> TagResponse:
+    """创建标签（同用户同名去重，返回 409）。"""
+    user_id = authenticated_user.user.id
+    existing = tag_repository.find_by_name(user_id, request.name)
+    if existing:
+        raise HTTPException(status_code=409, detail="标签名称已存在")
+    tag = Tag.create(user_id=user_id, name=request.name)
+    created = tag_repository.create(tag)
+    return TagResponse(id=created.id, name=created.name, created_at=created.created_at)
+
+
+@router.delete("/{tag_id}", status_code=204)
+def delete_tag(
+    tag_id: str,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    tag_repository: Any = Depends(get_tag_repository),
+) -> None:
+    """删除标签（同时清理素材关联）。"""
+    tag = tag_repository.get(tag_id)
+    if tag is None:
+        raise HTTPException(status_code=404, detail="标签不存在")
+    if tag.user_id != authenticated_user.user.id:
+        raise HTTPException(status_code=403, detail="无权删除该标签")
+    tag_repository.delete(tag_id)

apps/api/app/api/routes/tts.py

@@ -9,22 +9,28 @@ from app.auth import AuthenticatedUser, get_current_user
 from app.dependencies import (
     get_cosyvoice_service,
     get_db_session,
+    get_user_repository,
     get_voice_clone_profile_repository,
+    get_voice_library_repository,
 )
 from app.schemas.tts import (
     ListTTSJobResponse,
+    SaveToLibraryRequest,
+    SaveToLibraryResponse,
     TTSJobResponse,
     TTSStatusResponse,
     TTSSynthesizeRequest,
     TTSSynthesizeResponse,
 )
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Response, WebSocket, WebSocketDisconnect, status
 from sqlalchemy.orm import Session
 
 from packages.adapters.sqlalchemy_impl.tts_job_repository import (
     SQLAlchemyTTSJobRepository,
 )
+from packages.adapters.sqlalchemy_impl.voice_library_repository import SQLAlchemyVoiceLibraryRepository
 from packages.application.cosyvoice_service import CosyVoiceService
+from packages.application.tts_job.streaming_service import TTSStreamingService
 from packages.application.tts_job.use_cases import (
     CreateTTSJobUseCase,
     DeleteTTSJobUseCase,
@@ -34,6 +40,12 @@ from packages.application.tts_job.use_cases import (
     TTSJobNotFoundError,
 )
 from packages.application.tts_job.workflow import TTSWorkflowService
+from packages.application.voice_library.commands import CreateVoiceLibraryCommand
+from packages.application.voice_library.use_cases import (
+    CreateVoiceLibraryUseCase,
+    QuotaExceededError,
+)
+from packages.ports.user_repository import UserRepository
 
 logger = logging.getLogger(__name__)
 
@@ -130,18 +142,25 @@ def synthesize(
 
     # 若任务处于 processing 状态（异步模式），触发 Celery 后台轮询
     if job.status.value == "processing":
-        task_id = (job.metadata or {}).get("cosyvoice_task_id", "")
-        if task_id:
-            try:
+        # 分段合成任务 vs 普通单段任务
+        segment_task_ids = (job.metadata or {}).get("segment_task_ids", [])
+        is_segment = len(segment_task_ids) > 0
+
+        try:
+            if is_segment:
+                from worker_app.tasks import process_tts_segment_synthesis
+
+                process_tts_segment_synthesis.delay(job.id)
+            else:
                 from worker_app.tasks import process_tts_synthesis
 
                 process_tts_synthesis.delay(job.id)
-            except Exception as e:
-                # Celery 调度失败，标记 job 为 failed
-                try:
-                    workflow.process_synthesis_failure(job.id, f"Celery 任务调度失败: {e}")
-                except Exception as inner_e:
-                    logger.error(f"Celery 调度后标记失败时出错: job_id={job.id}, error={inner_e}")
+        except Exception as e:
+            # Celery 调度失败，标记 job 为 failed
+            try:
+                workflow.process_synthesis_failure(job.id, f"Celery 任务调度失败: {e}")
+            except Exception as inner_e:
+                logger.error(f"Celery 调度后标记失败时出错: job_id={job.id}, error={inner_e}")
 
     return TTSSynthesizeResponse(
         job_id=job.id,
@@ -225,3 +244,127 @@ def delete_tts_job(
     if not deleted:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="TTS job not found")
     return Response(status_code=204)
+
+
+@router.post(
+    "/jobs/{job_id}/save-to-library",
+    response_model=SaveToLibraryResponse,
+    status_code=status.HTTP_201_CREATED,
+)
+def save_tts_job_to_library(
+    job_id: str,
+    request: SaveToLibraryRequest = SaveToLibraryRequest(),
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    tts_repository: SQLAlchemyTTSJobRepository = Depends(_get_repository),
+    voice_library_repository: SQLAlchemyVoiceLibraryRepository = Depends(get_voice_library_repository),
+    user_repository: UserRepository = Depends(get_user_repository),
+) -> SaveToLibraryResponse:
+    """将已完成的 TTS 合成结果保存到配音库。
+
+    自动携带音色名、时长、语速等元信息。
+    """
+    user_id = authenticated_user.user.id
+
+    # 获取 TTS job
+    get_use_case = GetTTSJobUseCase(tts_repository)
+    try:
+        job = get_use_case.execute(job_id, user_id)
+    except TTSJobNotFoundError:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="TTS job not found")
+
+    # 校验已完成
+    if not job.is_completed:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="TTS job is not completed yet",
+        )
+
+    # 构建配音素材名称
+    name = request.name or f"TTS-{job.id[:8]}"
+
+    # 构建元信息
+    metadata_ = {
+        "source": "tts_job",
+        "tts_job_id": job.id,
+        "format": job.format,
+        "sample_rate": job.sample_rate,
+    }
+    if job.metadata:
+        # 保留原始 job 的有用元信息
+        for key in ("speed", "language"):
+            if key in job.metadata:
+                metadata_[key] = job.metadata[key]
+
+    # 获取用户套餐（用于配额检查）
+    user = user_repository.find_by_id(user_id)
+    plan_name = getattr(user, "subscription_plan", "free") if user else "free"
+
+    # 构建命令并执行
+    command = CreateVoiceLibraryCommand(
+        user_id=user_id,
+        name=name,
+        text=job.input_text,
+        voice_provider="cosyvoice",
+        voice_id=job.voice_id,
+        voice_name=job.voice_model or "",
+        audio_url=job.output_audio_url,
+        duration=job.duration,
+        file_size=job.file_size,
+        status="completed",
+        project_id=job.project_id or "",
+        tags=[],
+        metadata_=metadata_,
+    )
+
+    use_case = CreateVoiceLibraryUseCase(voice_library_repository)
+    try:
+        item = use_case.execute(command, plan_name=plan_name or "free")
+    except QuotaExceededError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail=f"配音库配额已满（{exc.used}/{exc.limit}），请升级套餐",
+        )
+
+    return SaveToLibraryResponse(
+        id=item.id,
+        name=item.name,
+        audio_url=item.audio_url,
+        duration=item.duration,
+        voice_id=item.voice_id,
+        voice_name=item.voice_name,
+        status=item.status,
+    )
+
+
+@router.websocket("/ws/tts/stream")
+async def tts_websocket_stream(
+    websocket: WebSocket,
+    cosyvoice_service: CosyVoiceService = Depends(get_cosyvoice_service),
+) -> None:
+    """WebSocket 流式 TTS 合成。
+
+    协议：
+    1. 客户端发送 JSON 文本帧: {"text": "...", "voice_id": "...", ...}
+    2. 服务端发送 JSON 状态帧 + 二进制音频帧
+    3. 完成时发送 JSON 结束帧
+    """
+    await websocket.accept()
+    try:
+        message = await websocket.receive_json()
+        params = {
+            "text": message.get("text", ""),
+            "voice_id": message.get("voice_id", ""),
+            "sample_rate": message.get("sample_rate", 0),
+            "format": message.get("format", "mp3"),
+            "speed": message.get("speed", 1.0),
+        }
+        streaming_service = TTSStreamingService(cosyvoice_service)
+        await streaming_service.synthesize_and_stream(websocket, params)
+    except WebSocketDisconnect:
+        logger.info("WebSocket 客户端断开连接")
+    except Exception as e:
+        logger.error(f"WebSocket 流式合成异常: {e}", exc_info=True)
+        try:
+            await websocket.send_json({"type": "error", "message": f"服务异常: {e}"})
+        except Exception:
+            pass

apps/api/app/api/routes/upload.py

@@ -8,6 +8,7 @@ from app.core.celery_app import celery_app
 from app.core.storage import OSSStorageService, get_storage_service
 from app.dependencies import (
     get_asset_library_repository,
+    get_asset_repository,
     get_ingest_job_repository,
     get_project_repository,
 )
@@ -99,6 +100,7 @@ def _submit_ingest_job(
     library_id: str,
     storage_key: str,
     ingest_job_repository: Any,
+    file_hash: str = "",
 ) -> Any:
     use_case = SubmitIngestJobUseCase(ingest_job_repository)
     job = use_case.execute(
@@ -106,6 +108,7 @@ def _submit_ingest_job(
             project_id=project_id,
             library_id=library_id,
             storage_key=storage_key,
+            file_hash=file_hash,
         )
     )
     celery_app.send_task("worker.ingest_asset", args=[job.id])
@@ -176,6 +179,7 @@ async def complete_direct_upload(
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
+    asset_repository: Any = Depends(get_asset_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> DirectUploadCompleteResponse:
     """确认浏览器直传完成并创建导入任务。"""
@@ -199,11 +203,32 @@ async def complete_direct_upload(
     if not file_exists:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Uploaded file not found")
 
+    # ── 素材去重检测：同素材库 + 同 file_hash 视为重复 ──
+    if request.file_hash:
+        existing = asset_repository.find_by_library_and_file_hash(
+            library_id=request.library_id,
+            file_hash=request.file_hash,
+        )
+        if existing is not None:
+            logger.info(
+                "素材去重命中: library=%s hash=%s existing_asset=%s",
+                request.library_id,
+                request.file_hash,
+                existing.id,
+            )
+            return DirectUploadCompleteResponse(
+                storage_key=normalized_key,
+                ingest_job_id="",
+                duplicated=True,
+                asset_id=existing.id,
+            )
+
     job = _submit_ingest_job(
         project_id=request.project_id,
         library_id=request.library_id,
         storage_key=normalized_key,
         ingest_job_repository=ingest_job_repository,
+        file_hash=request.file_hash,
     )
     return DirectUploadCompleteResponse(storage_key=normalized_key, ingest_job_id=job.id)
 
@@ -218,15 +243,38 @@ async def upload_asset(
     project_id: str = Form(..., min_length=1, description="项目 ID"),
     library_id: str = Form(..., min_length=1, description="素材库 ID"),
     file: UploadFile = File(..., description="要上传的文件（视频、音频、图片等）"),
+    file_hash: str = Form(default="", description="文件 MD5 哈希，用于去重检测"),
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
+    asset_repository: Any = Depends(get_asset_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> UploadAssetResponse:
     """上传素材文件并触发导入流水线。"""
     _require_project_and_library(project_id, library_id, project_repository, asset_library_repository)
 
+    # ── 素材去重检测：上传前检查同素材库 + 同 file_hash ──
+    if file_hash:
+        existing = asset_repository.find_by_library_and_file_hash(
+            library_id=library_id,
+            file_hash=file_hash,
+        )
+        if existing is not None:
+            logger.info(
+                "素材去重命中(multipart): library=%s hash=%s existing_asset=%s",
+                library_id,
+                file_hash,
+                existing.id,
+            )
+            return UploadAssetResponse(
+                storage_key=existing.storage_key,
+                ingest_job_id="",
+                url="",
+                duplicated=True,
+                asset_id=existing.id,
+            )
+
     # P2-5: 服务端验证 MIME 类型
     validated_content_type = _validate_mime_type(file.content_type)
 
@@ -255,6 +303,7 @@ async def upload_asset(
         library_id=library_id,
         storage_key=storage_key,
         ingest_job_repository=ingest_job_repository,
+        file_hash=file_hash,
     )
 
     return UploadAssetResponse(

apps/api/app/dependencies.py

@@ -39,6 +39,7 @@ from packages.adapters.sqlalchemy_impl.project_repository import (
     SQLAlchemyProjectRepository,
 )
 from packages.adapters.sqlalchemy_impl.session import build_session_factory
+from packages.adapters.sqlalchemy_impl.tag_repository import SQLAlchemyTagRepository
 from packages.adapters.sqlalchemy_impl.title_library_repository import (
     SQLAlchemyTitleLibraryRepository,
 )
@@ -58,6 +59,7 @@ from packages.ports.generation_task_repository import GenerationTaskRepository
 from packages.ports.ingest_job_repository import IngestJobRepository
 from packages.ports.job_repository import JobRepository
 from packages.ports.project_repository import ProjectRepository
+from packages.ports.tag_repository import TagRepository
 from packages.ports.title_library_repository import TitleLibraryRepository
 from packages.ports.user_repository import UserRepository
 from packages.ports.voice_clone_profile_repository import VoiceCloneProfileRepository
@@ -138,6 +140,13 @@ def get_project_repository(
     return SQLAlchemyProjectRepository(session)
 
 
+def get_tag_repository(
+    session: Session = Depends(get_db_session),
+) -> TagRepository:
+    """Provide the SQLAlchemy tag repository implementation."""
+    return SQLAlchemyTagRepository(session)
+
+
 def get_user_repository(
     session: Session = Depends(get_db_session),
 ) -> UserRepository:

apps/api/app/middleware/auth.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 from app.auth import AuthenticatedUser
 from app.auth import get_current_user as get_authenticated_user
 from app.dependencies import get_user_repository
-from fastapi import Depends
+from fastapi import Depends, HTTPException
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
 from packages.domain.entities import User

apps/api/app/schemas/asset.py

@@ -51,6 +51,20 @@ class AssetResponse(BaseModel):
     classification_status: str
     quality_score: float | None = None
     uploaded_by_user_id: str
+    tag_ids: list[str] = Field(default_factory=list)
+
+
+class BatchDeleteRequest(BaseModel):
+    """批量删除请求。"""
+
+    ids: list[str] = Field(..., min_length=1, max_length=100, description="要删除的素材 ID 列表")
+
+
+class BatchDeleteResponse(BaseModel):
+    """批量删除响应。"""
+
+    deleted_count: int = Field(..., ge=0, description="实际删除数量")
+    failed_ids: list[str] = Field(default_factory=list, description="删除失败的 ID 列表")
 
 
 class ListAssetsResponse(BaseModel):

apps/api/app/schemas/chunked_upload.py

@@ -36,9 +36,12 @@ class ChunkedUploadStatusResponse(BaseModel):
 class ChunkedUploadCompleteRequest(BaseModel):
     project_id: str = Field(..., min_length=1, description="Project ID")
     library_id: str = Field(..., min_length=1, description="Asset library ID")
+    file_hash: str = Field(default="", max_length=64, description="文件 MD5 哈希，用于去重检测")
 
 
 class ChunkedUploadCompleteResponse(BaseModel):
     storage_key: str = Field(..., description="Storage key")
     ingest_job_id: str = Field(..., description="Ingest job ID")
     url: str = Field(..., description="File URL")
+    duplicated: bool = Field(default=False, description="是否为重复素材（命中去重）")
+    asset_id: str = Field(default="", description="重复素材的 asset_id（duplicated=true 时返回）")

apps/api/app/schemas/generation_task.py

@@ -21,6 +21,16 @@ class CreateGenerationTaskRequest(BaseModel):
     voice_ids: list[str] = Field(default_factory=list)
     # ── 来源剪辑计划 ──
     source_edit_plan_id: str = ""
+    # ── 批量生成 ──
+    count: int = Field(default=1, ge=1, le=50, description="批量生成数量，默认1，最大50")
+    # ── 素材库自动匹配 ──
+    asset_select_mode: str = Field(
+        default="all",
+        description="素材选取模式：all=全部ready视频, random=随机选取, smart=智能匹配（按质量/时长评分）",
+    )
+    asset_select_count: int = Field(
+        default=0, ge=0, le=100, description="选取数量，0表示全部（仅 random/smart 模式有效）"
+    )
 
     @model_validator(mode="after")
     def _check_at_least_one_mode(self) -> "CreateGenerationTaskRequest":
@@ -46,12 +56,21 @@ class GenerationTaskResponse(BaseModel):
     title_ids: list[str] = Field(default_factory=list)
     voice_ids: list[str] = Field(default_factory=list)
     source_edit_plan_id: str = ""
+    asset_select_mode: str = ""
+    batch_id: str = ""
     status: str
     progress: float
     result_count: int
     error_message: str
 
 
+class BatchGenerationTaskResponse(BaseModel):
+    """批量生成任务响应。"""
+
+    items: list[GenerationTaskResponse]
+    total: int
+
+
 class ListGenerationTasksResponse(BaseModel):
     """用户级生成任务列表响应（跨 project）。"""
 

apps/api/app/schemas/tag.py

@@ -0,0 +1,24 @@
+"""标签相关 Schema。"""
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class CreateTagRequest(BaseModel):
+    name: str = Field(..., min_length=1, max_length=100)
+
+
+class TagResponse(BaseModel):
+    id: str
+    name: str
+    created_at: datetime
+
+
+class ListTagsResponse(BaseModel):
+    items: list[TagResponse]
+    total: int = Field(default=0, ge=0)
+
+
+class TagAssetsRequest(BaseModel):
+    tag_ids: list[str] = Field(..., min_length=1, max_length=50)

apps/api/app/schemas/tts.py

@@ -83,3 +83,21 @@ class ListTTSJobResponse(BaseModel):
     total: int
     page: int
     page_size: int
+
+
+class SaveToLibraryRequest(BaseModel):
+    """保存到配音库请求。"""
+
+    name: Optional[str] = Field(None, description="配音素材名称，留空则自动生成")
+
+
+class SaveToLibraryResponse(BaseModel):
+    """保存到配音库响应。"""
+
+    id: str
+    name: str
+    audio_url: str
+    duration: float
+    voice_id: str
+    voice_name: str
+    status: str

apps/api/app/schemas/upload.py

@@ -6,12 +6,7 @@ class UploadAssetRequest(BaseModel):
 
     project_id: str = Field(..., min_length=1, description="项目 ID")
     library_id: str = Field(..., min_length=1, description="素材库 ID")
-
-
-class UploadAssetResponse(BaseModel):
-    storage_key: str
-    ingest_job_id: str
-    url: str = Field(..., description="Public URL of uploaded file")
+    file_hash: str = Field(default="", max_length=64, description="文件 MD5 哈希，用于去重检测")
 
 
 class DirectUploadPrepareRequest(BaseModel):
@@ -20,6 +15,7 @@ class DirectUploadPrepareRequest(BaseModel):
     filename: str = Field(..., min_length=1, max_length=255)
     content_type: str = Field(default="application/octet-stream", min_length=1, max_length=100)
     file_size: int = Field(..., gt=0)
+    file_hash: str = Field(default="", max_length=64, description="文件 MD5 哈希，用于去重检测")
 
 
 class DirectUploadPrepareResponse(BaseModel):
@@ -35,8 +31,19 @@ class DirectUploadCompleteRequest(BaseModel):
     project_id: str = Field(..., min_length=1)
     library_id: str = Field(..., min_length=1)
     storage_key: str = Field(..., min_length=1, max_length=255)
+    file_hash: str = Field(default="", max_length=64, description="文件 MD5 哈希，用于去重检测")
 
 
 class DirectUploadCompleteResponse(BaseModel):
     storage_key: str
     ingest_job_id: str
+    duplicated: bool = Field(default=False, description="是否为重复素材（命中去重）")
+    asset_id: str = Field(default="", description="重复素材的 asset_id（duplicated=true 时返回）")
+
+
+class UploadAssetResponse(BaseModel):
+    storage_key: str
+    ingest_job_id: str
+    url: str = Field(..., description="Public URL of uploaded file")
+    duplicated: bool = Field(default=False, description="是否为重复素材（命中去重）")
+    asset_id: str = Field(default="", description="重复素材的 asset_id（duplicated=true 时返回）")

apps/web/e2e/core-upload.spec.ts

@@ -180,9 +180,11 @@ test.describe("Core media upload flow", () => {
     await expect(page.locator(".xx-assets-content")).toBeVisible({
       timeout: 20_000,
     });
-    await expect(page.getByText("e2e-sample.MOV", { exact: true })).toBeVisible({
-      timeout: 20_000,
-    });
+    await expect(page.getByText("e2e-sample.MOV", { exact: true })).toBeVisible(
+      {
+        timeout: 20_000,
+      },
+    );
 
     // Verify asset card shows status
     const assetCard = page

apps/web/e2e/subscription.spec.ts

@@ -178,7 +178,10 @@ test.describe("订阅过期处理", () => {
     // 免费用户可能不需要取消，返回 400 或类似错误
     if (!response.ok()) {
       const data = await response.json();
-      expect(data.error?.message || data.detail || data.message, "应返回错误信息").toBeTruthy();
+      expect(
+        data.error?.message || data.detail || data.message,
+        "应返回错误信息",
+      ).toBeTruthy();
     }
   });
 

apps/web/e2e/test_auth.spec.ts

@@ -175,10 +175,9 @@ test.describe("认证流程", () => {
       },
     });
 
-    expect(
-      [400, 422],
-      "缺少用户名字段应返回 4xx 校验错误",
-    ).toContain(response.status());
+    expect([400, 422], "缺少用户名字段应返回 4xx 校验错误").toContain(
+      response.status(),
+    );
   });
 
   // ─── 登录 ────────────────────────────────────────────
@@ -230,7 +229,9 @@ test.describe("认证流程", () => {
         data: { email: `ghost_${Date.now()}@nonexist.com`, password: PASSWORD },
       });
       if (response.status() !== 429) break;
-      console.log(`[反向登录测试] 触发限流，等待 65s 后重试 (${attempt + 1}/2)`);
+      console.log(
+        `[反向登录测试] 触发限流，等待 65s 后重试 (${attempt + 1}/2)`,
+      );
       await new Promise((r) => setTimeout(r, 65_000));
     }
 

apps/web/package-lock.json

@@ -14,10 +14,7 @@
         "axios": "^1.7.2",
         "react": "^18.3.1",
         "react-dom": "^18.3.1",
-        "react-hook-form": "^7.52.0",
         "react-router-dom": "^6.24.0",
-        "recharts": "^3.8.1",
-        "zod": "^3.23.8",
         "zustand": "^4.5.2"
       },
       "devDependencies": {
@@ -31,11 +28,13 @@
         "@typescript-eslint/eslint-plugin": "^7.13.1",
         "@typescript-eslint/parser": "^7.13.1",
         "@vitejs/plugin-react": "^4.3.1",
+        "@vitest/coverage-v8": "^1.6.0",
         "@vitest/ui": "^1.6.0",
         "eslint": "^8.57.0",
         "eslint-plugin-react-hooks": "^4.6.2",
         "eslint-plugin-react-refresh": "^0.4.7",
         "jsdom": "^24.1.0",
+        "prettier": "^3.9.5",
         "typescript": "^5.5.3",
         "vite": "^5.3.1",
         "vitest": "^1.6.0"
@@ -48,6 +47,20 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@ampproject/remapping": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
+      "integrity": "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/@ant-design/colors": {
       "version": "7.2.1",
       "resolved": "https://registry.npmjs.org/@ant-design/colors/-/colors-7.2.1.tgz",
@@ -477,6 +490,13 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@bcoe/v8-coverage": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
+      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@csstools/color-helpers": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
@@ -1144,6 +1164,16 @@
       "dev": true,
       "license": "BSD-3-Clause"
     },
+    "node_modules/@istanbuljs/schema": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz",
+      "integrity": "sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/@jest/schemas": {
       "version": "29.6.3",
       "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz",
@@ -1415,42 +1445,6 @@
         "react-dom": ">=16.9.0"
       }
     },
-    "node_modules/@reduxjs/toolkit": {
-      "version": "2.12.0",
-      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.12.0.tgz",
-      "integrity": "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==",
-      "license": "MIT",
-      "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
-        "@standard-schema/utils": "^0.3.0",
-        "immer": "^11.0.0",
-        "redux": "^5.0.1",
-        "redux-thunk": "^3.1.0",
-        "reselect": "^5.1.0"
-      },
-      "peerDependencies": {
-        "react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
-        "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
-      },
-      "peerDependenciesMeta": {
-        "react": {
-          "optional": true
-        },
-        "react-redux": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@reduxjs/toolkit/node_modules/immer": {
-      "version": "11.1.8",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.8.tgz",
-      "integrity": "sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/immer"
-      }
-    },
     "node_modules/@remix-run/router": {
       "version": "1.23.3",
       "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.3.tgz",
@@ -1824,18 +1818,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@standard-schema/spec": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "license": "MIT"
-    },
-    "node_modules/@standard-schema/utils": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
-      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
-      "license": "MIT"
-    },
     "node_modules/@tanstack/query-core": {
       "version": "5.101.0",
       "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.0.tgz",
@@ -2005,69 +1987,6 @@
         "@babel/types": "^7.28.2"
       }
     },
-    "node_modules/@types/d3-array": {
-      "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
-      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
-      "license": "MIT"
-    },
-    "node_modules/@types/d3-color": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
-      "integrity": "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==",
-      "license": "MIT"
-    },
-    "node_modules/@types/d3-ease": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
-      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
-      "license": "MIT"
-    },
-    "node_modules/@types/d3-interpolate": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
-      "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/d3-color": "*"
-      }
-    },
-    "node_modules/@types/d3-path": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
-      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
-      "license": "MIT"
-    },
-    "node_modules/@types/d3-scale": {
-      "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
-      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/d3-time": "*"
-      }
-    },
-    "node_modules/@types/d3-shape": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.8.tgz",
-      "integrity": "sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/d3-path": "*"
-      }
-    },
-    "node_modules/@types/d3-time": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
-      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
-      "license": "MIT"
-    },
-    "node_modules/@types/d3-timer": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
-      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
-      "license": "MIT"
-    },
     "node_modules/@types/estree": {
       "version": "1.0.9",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
@@ -2113,12 +2032,6 @@
         "@types/react": "^18.0.0"
       }
     },
-    "node_modules/@types/use-sync-external-store": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
-      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
-      "license": "MIT"
-    },
     "node_modules/@typescript-eslint/eslint-plugin": {
       "version": "7.18.0",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-7.18.0.tgz",
@@ -2340,6 +2253,34 @@
         "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
       }
     },
+    "node_modules/@vitest/coverage-v8": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-1.6.1.tgz",
+      "integrity": "sha512-6YeRZwuO4oTGKxD3bijok756oktHSIm3eczVVzNe3scqzuhLwltIF3S9ZL/vwOVIpURmU6SnZhziXXAfw8/Qlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@ampproject/remapping": "^2.2.1",
+        "@bcoe/v8-coverage": "^0.2.3",
+        "debug": "^4.3.4",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-lib-source-maps": "^5.0.4",
+        "istanbul-reports": "^3.1.6",
+        "magic-string": "^0.30.5",
+        "magicast": "^0.3.3",
+        "picocolors": "^1.0.0",
+        "std-env": "^3.5.0",
+        "strip-literal": "^2.0.0",
+        "test-exclude": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "vitest": "1.6.1"
+      }
+    },
     "node_modules/@vitest/expect": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-1.6.1.tgz",
@@ -2932,15 +2873,6 @@
       "integrity": "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==",
       "license": "MIT"
     },
-    "node_modules/clsx": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
-      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/color-convert": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
@@ -3058,127 +2990,6 @@
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
       "license": "MIT"
     },
-    "node_modules/d3-array": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
-      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
-      "license": "ISC",
-      "dependencies": {
-        "internmap": "1 - 2"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-color": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
-      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-ease": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-3.0.1.tgz",
-      "integrity": "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-format": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
-      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-interpolate": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
-      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
-      "license": "ISC",
-      "dependencies": {
-        "d3-color": "1 - 3"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-path": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
-      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-scale": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
-      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
-      "license": "ISC",
-      "dependencies": {
-        "d3-array": "2.10.0 - 3",
-        "d3-format": "1 - 3",
-        "d3-interpolate": "1.2.0 - 3",
-        "d3-time": "2.1.1 - 3",
-        "d3-time-format": "2 - 4"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-shape": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
-      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
-      "license": "ISC",
-      "dependencies": {
-        "d3-path": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-time": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
-      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
-      "license": "ISC",
-      "dependencies": {
-        "d3-array": "2 - 3"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-time-format": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
-      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
-      "license": "ISC",
-      "dependencies": {
-        "d3-time": "1 - 3"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/d3-timer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
-      "integrity": "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
     "node_modules/data-urls": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
@@ -3223,12 +3034,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/decimal.js-light": {
-      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
-      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
-      "license": "MIT"
-    },
     "node_modules/deep-eql": {
       "version": "4.1.4",
       "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-4.1.4.tgz",
@@ -3391,16 +3196,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/es-toolkit": {
-      "version": "1.47.1",
-      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.47.1.tgz",
-      "integrity": "sha512-5RAqEwf4P4E17p+W75KLOWw/nOvKZzSQpxM32IpI2KZLaVonjTrZ0Ai5ghMaVI9eKC2p8eoQgcBdkEDgzFk6+Q==",
-      "license": "MIT",
-      "workspaces": [
-        "docs",
-        "benchmarks"
-      ]
-    },
     "node_modules/esbuild": {
       "version": "0.21.5",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz",
@@ -3671,12 +3466,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/eventemitter3": {
-      "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
-      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
-      "license": "MIT"
-    },
     "node_modules/execa": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/execa/-/execa-8.0.1.tgz",
@@ -4148,6 +3937,13 @@
         "node": ">=18"
       }
     },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/http-proxy-agent": {
       "version": "7.0.2",
       "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
@@ -4223,6 +4019,8 @@
       "resolved": "https://registry.npmjs.org/immer/-/immer-10.2.0.tgz",
       "integrity": "sha512-d/+XTN3zfODyjr89gM3mPq1WNX2B8pYsu7eORitdwyA2sBubnTl3laYlBk4sXY5FUa5qTZGBDPJICVbvqzjlbw==",
       "license": "MIT",
+      "optional": true,
+      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/immer"
@@ -4284,15 +4082,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/internmap": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
-      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
     "node_modules/is-extglob": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
@@ -4363,6 +4152,60 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-lib-source-maps": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-5.0.6.tgz",
+      "integrity": "sha512-yg2d+Em4KizZC5niWhQaIomgf5WlL4vOOjZ5xGCmF8SnPE/mDWWXgvRExdcpCgh9lLRRa1/fSYp2ymmbJ1pI+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.23",
+        "debug": "^4.1.1",
+        "istanbul-lib-coverage": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/js-tokens": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
@@ -4630,6 +4473,34 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/magicast": {
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.3.5.tgz",
+      "integrity": "sha512-L0WhttDl+2BOsybvEOLK7fW3UA0OQ0IQ2d6Zl2x/a6vVRs3bAY0ECOSHHeL5jD+SbOpOCUEi0y1DgHEn9Qn1AQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.25.4",
+        "@babel/types": "^7.25.4",
+        "source-map-js": "^1.2.0"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -5107,6 +4978,22 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/prettier": {
+      "version": "3.9.6",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz",
+      "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
     "node_modules/pretty-format": {
       "version": "27.5.1",
       "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
@@ -5842,52 +5729,6 @@
         "react": "^18.3.1"
       }
     },
-    "node_modules/react-hook-form": {
-      "version": "7.79.0",
-      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.79.0.tgz",
-      "integrity": "sha512-mhYp/MTmXvzYX6AJcJVko0rktoIhhmRnEouObj4wF5i/tCttgJvnp1+9wRkpITZjDTqpo4IOSJqu0dBlPlV/Lw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/react-hook-form"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17 || ^18 || ^19"
-      }
-    },
-    "node_modules/react-is": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.7.tgz",
-      "integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/react-redux": {
-      "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
-      "integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/use-sync-external-store": "^0.0.6",
-        "use-sync-external-store": "^1.4.0"
-      },
-      "peerDependencies": {
-        "@types/react": "^18.2.25 || ^19",
-        "react": "^18.0 || ^19",
-        "redux": "^5.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "redux": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/react-refresh": {
       "version": "0.17.0",
       "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.17.0.tgz",
@@ -5930,36 +5771,6 @@
         "react-dom": ">=16.8"
       }
     },
-    "node_modules/recharts": {
-      "version": "3.8.1",
-      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.8.1.tgz",
-      "integrity": "sha512-mwzmO1s9sFL0TduUpwndxCUNoXsBw3u3E/0+A+cLcrSfQitSG62L32N69GhqUrrT5qKcAE3pCGVINC6pqkBBQg==",
-      "license": "MIT",
-      "workspaces": [
-        "www"
-      ],
-      "dependencies": {
-        "@reduxjs/toolkit": "^1.9.0 || 2.x.x",
-        "clsx": "^2.1.1",
-        "decimal.js-light": "^2.5.1",
-        "es-toolkit": "^1.39.3",
-        "eventemitter3": "^5.0.1",
-        "immer": "^10.1.1",
-        "react-redux": "8.x.x || 9.x.x",
-        "reselect": "5.1.1",
-        "tiny-invariant": "^1.3.3",
-        "use-sync-external-store": "^1.2.2",
-        "victory-vendor": "^37.0.2"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
     "node_modules/redent": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/redent/-/redent-3.0.0.tgz",
@@ -5974,21 +5785,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/redux": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
-      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
-      "license": "MIT"
-    },
-    "node_modules/redux-thunk": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
-      "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
-      "license": "MIT",
-      "peerDependencies": {
-        "redux": "^5.0.0"
-      }
-    },
     "node_modules/requires-port": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
@@ -5996,12 +5792,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/reselect": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.1.1.tgz",
-      "integrity": "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==",
-      "license": "MIT"
-    },
     "node_modules/resize-observer-polyfill": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/resize-observer-polyfill/-/resize-observer-polyfill-1.5.1.tgz",
@@ -6369,6 +6159,45 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/test-exclude": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
+      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@istanbuljs/schema": "^0.1.2",
+        "glob": "^7.1.4",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/test-exclude/node_modules/brace-expansion": {
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/test-exclude/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/text-table": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
@@ -6385,12 +6214,6 @@
         "node": ">=12.22"
       }
     },
-    "node_modules/tiny-invariant": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
-      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
-      "license": "MIT"
-    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -6624,28 +6447,6 @@
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/victory-vendor": {
-      "version": "37.3.6",
-      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-37.3.6.tgz",
-      "integrity": "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==",
-      "license": "MIT AND ISC",
-      "dependencies": {
-        "@types/d3-array": "^3.0.3",
-        "@types/d3-ease": "^3.0.0",
-        "@types/d3-interpolate": "^3.0.1",
-        "@types/d3-scale": "^4.0.2",
-        "@types/d3-shape": "^3.1.0",
-        "@types/d3-time": "^3.0.0",
-        "@types/d3-timer": "^3.0.0",
-        "d3-array": "^3.1.6",
-        "d3-ease": "^3.0.1",
-        "d3-interpolate": "^3.0.1",
-        "d3-scale": "^4.0.2",
-        "d3-shape": "^3.1.0",
-        "d3-time": "^3.0.0",
-        "d3-timer": "^3.0.1"
-      }
-    },
     "node_modules/vite": {
       "version": "5.4.21",
       "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.21.tgz",
@@ -6980,15 +6781,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
     "node_modules/zustand": {
       "version": "4.5.7",
       "resolved": "https://registry.npmjs.org/zustand/-/zustand-4.5.7.tgz",

apps/web/package.json

@@ -37,11 +37,13 @@
     "@typescript-eslint/eslint-plugin": "^7.13.1",
     "@typescript-eslint/parser": "^7.13.1",
     "@vitejs/plugin-react": "^4.3.1",
+    "@vitest/coverage-v8": "^1.6.0",
     "@vitest/ui": "^1.6.0",
     "eslint": "^8.57.0",
     "eslint-plugin-react-hooks": "^4.6.2",
     "eslint-plugin-react-refresh": "^0.4.7",
     "jsdom": "^24.1.0",
+    "prettier": "^3.9.5",
     "typescript": "^5.5.3",
     "vite": "^5.3.1",
     "vitest": "^1.6.0"

apps/web/src/api/assets.ts

@@ -19,6 +19,7 @@ export interface AssetItem {
   status?: string;
   classification_status?: string | null;
   quality_score?: number | null;
+  tag_ids?: string[];
   created_at?: string;
 }
 
@@ -144,12 +145,18 @@ export const getAssets = async (libraryId: string): Promise<AssetItem[]> => {
 /** 按类型获取素材（如 voice/video/image），支持可选筛选 */
 export const getAssetsByKind = async (
   kind: string,
-  filters?: { keyword?: string; gender?: string; style?: string },
+  filters?: {
+    keyword?: string;
+    gender?: string;
+    style?: string;
+    tag_ids?: string[];
+  },
 ): Promise<AssetItem[]> => {
   const params: Record<string, string> = { kind };
   if (filters?.keyword) params.keyword = filters.keyword;
   if (filters?.gender) params.gender = filters.gender;
   if (filters?.style) params.style = filters.style;
+  if (filters?.tag_ids?.length) params.tag_ids = filters.tag_ids.join(",");
   const response = await apiClient.get("/assets", { params });
   return response.data.items || [];
 };
@@ -233,10 +240,11 @@ export const completeDirectUpload = async (data: {
   return response.data;
 };
 
-/** 直传上传（大文件推荐） */
+/** 直传上传（大文件推荐），支持可选进度回调 */
 export const uploadAssetDirect = async (data: {
   file: File;
   library_id: string;
+  onProgress?: (percent: number) => void;
 }): Promise<{ storage_key: string; ingest_job_id: string }> => {
   // 后端要求 project_id，前端自动获取默认项目
   const project = await getOrCreateDefaultProject();
@@ -255,13 +263,25 @@ export const uploadAssetDirect = async (data: {
   );
   directForm.append("file", data.file);
 
-  const uploadResponse = await fetch(prepared.upload_url, {
-    method: prepared.method,
-    body: directForm,
+  // 使用 XMLHttpRequest 以获取上传进度（fetch 不支持）
+  await new Promise<void>((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open(prepared.method, prepared.upload_url);
+    xhr.upload.onprogress = (e) => {
+      if (e.lengthComputable && data.onProgress) {
+        data.onProgress(Math.round((e.loaded / e.total) * 100));
+      }
+    };
+    xhr.onload = () => {
+      if (xhr.status >= 200 && xhr.status < 300) {
+        resolve();
+      } else {
+        reject(new Error(`OSS direct upload failed: ${xhr.status}`));
+      }
+    };
+    xhr.onerror = () => reject(new Error("OSS direct upload failed"));
+    xhr.send(directForm);
   });
-  if (!uploadResponse.ok) {
-    throw new Error(`OSS direct upload failed: ${uploadResponse.status}`);
-  }
 
   return completeDirectUpload({
     project_id: project.id,

apps/web/src/api/tags.ts

@@ -0,0 +1,46 @@
+/**
+ * 标签 CRUD API
+ * P3 标签体系：对接后端标签表
+ */
+import apiClient from "./client";
+
+export interface TagItem {
+  id: string;
+  name: string;
+  created_at?: string;
+  usage_count?: number;
+}
+
+/** 获取当前用户所有标签 */
+export const getTags = async (): Promise<TagItem[]> => {
+  const response = await apiClient.get("/tags");
+  return response.data.items || [];
+};
+
+/** 创建标签（同名返回 409） */
+export const createTag = async (name: string): Promise<TagItem> => {
+  const response = await apiClient.post("/tags", { name });
+  return response.data;
+};
+
+/** 删除标签（同时清理素材关联） */
+export const deleteTag = async (tagId: string): Promise<void> => {
+  await apiClient.delete(`/tags/${tagId}`);
+};
+
+/** 为素材添加标签（最多 50 个） */
+export const tagAsset = async (
+  assetId: string,
+  tagIds: string[],
+): Promise<void> => {
+  if (tagIds.length === 0) return;
+  await apiClient.post(`/assets/${assetId}/tags`, { tag_ids: tagIds });
+};
+
+/** 移除素材的某个标签 */
+export const untagAsset = async (
+  assetId: string,
+  tagId: string,
+): Promise<void> => {
+  await apiClient.delete(`/assets/${assetId}/tags/${tagId}`);
+};

apps/web/src/api/tts.ts

@@ -122,6 +122,20 @@ export const getTTSJobs = async (
   return response.data;
 };
 
+/** 存为素材请求参数 */
+export interface SaveTtsToLibraryRequest {
+  name?: string;
+  tag_ids?: string[];
+}
+
+/** 将 TTS 合成结果保存到配音素材库 */
+export const saveTtsToLibrary = async (
+  jobId: string,
+  data?: SaveTtsToLibraryRequest,
+): Promise<void> => {
+  await apiClient.post(`/tts/jobs/${jobId}/save-to-library`, data ?? {});
+};
+
 /** 删除 TTS 任务 */
 export const deleteTTSJob = async (jobId: string): Promise<void> => {
   await apiClient.delete(`/tts/jobs/${jobId}`);

apps/web/src/pages/assets/AssetLibrary.tsx

@@ -10,7 +10,6 @@ import {
   SearchOutlined,
   InboxOutlined,
   VideoCameraOutlined,
-  SoundOutlined,
   PictureOutlined,
   PlayCircleOutlined,
   CheckOutlined,
@@ -37,7 +36,7 @@ import "./assets.css";
 /* ============================================================
  * 类型
  * ============================================================ */
-type AssetKind = "video" | "voice" | "image";
+type AssetKind = "video" | "image";
 type StatusType = "ok" | "warn" | "bad" | "info";
 
 interface LibraryItem {
@@ -67,7 +66,6 @@ interface AssetItem {
 /** 根据 mime_type 推断前端 AssetKind */
 const inferKind = (mimeType: string): AssetKind => {
   if (mimeType.startsWith("video/")) return "video";
-  if (mimeType.startsWith("audio/")) return "voice";
   return "image";
 };
 
@@ -99,7 +97,7 @@ const formatDuration = (seconds: number): string => {
 const mapLibrary = (item: AssetLibraryItem): LibraryItem => ({
   id: item.id,
   name: item.name,
-  kind: item.kind || inferKind("video"),
+  kind: (item.kind === "voice" ? "video" : item.kind) || inferKind("video"),
   count: item.asset_count ?? 0,
 });
 
@@ -110,14 +108,16 @@ const mapAsset = (item: ApiAssetItem): AssetItem => {
     item.classification_status ?? undefined,
   );
   const metadata = item.metadata || {};
+  const kind = inferKind(item.mime_type || "");
   return {
     id: item.id,
     name: item.name,
-    kind: inferKind(item.mime_type || ""),
+    kind,
+    // 视频类型不能用 file_url 做缩略图（是视频文件，<img> 无法渲染）
     thumbUrl:
       (item.thumbnail_url as string | undefined) ||
-      (item.file_url as string | undefined) ||
-      (metadata.thumbnail_url as string | undefined),
+      (metadata.thumbnail_url as string | undefined) ||
+      (kind !== "video" ? (item.file_url as string | undefined) : undefined),
     fileUrl:
       (item.file_url as string | undefined) ||
       (metadata.file_url as string | undefined),
@@ -147,8 +147,6 @@ const kindIcon = (kind: AssetKind) => {
   switch (kind) {
     case "video":
       return <VideoCameraOutlined />;
-    case "voice":
-      return <SoundOutlined />;
     case "image":
       return <PictureOutlined />;
   }
@@ -158,8 +156,6 @@ const kindLabel = (kind: AssetKind) => {
   switch (kind) {
     case "video":
       return "视频";
-    case "voice":
-      return "配音";
     case "image":
       return "图片";
   }
@@ -170,8 +166,6 @@ const thumbGradient = (kind: AssetKind): string => {
   switch (kind) {
     case "video":
       return "linear-gradient(135deg, #312e81 0%, #4f46e5 50%, #6366f1 100%)";
-    case "voice":
-      return "linear-gradient(135deg, #064e3b 0%, #059669 50%, #10b981 100%)";
     case "image":
       return "linear-gradient(135deg, #78350f 0%, #d97706 50%, #f59e0b 100%)";
   }
@@ -244,7 +238,7 @@ const AssetCard: React.FC<{
       )}
 
       {/* 视频/配音类显示播放按钮 */}
-      {(asset.kind === "video" || asset.kind === "voice") && (
+      {asset.kind === "video" && (
         <span
           className="xx-asset-play"
           onClick={(e) => {
@@ -361,6 +355,7 @@ const AssetLibrary: React.FC = () => {
 
   /* 上传 */
   const [uploading, setUploading] = useState(false);
+  const [uploadProgress, setUploadProgress] = useState(0);
 
   /* 新建素材库 */
   const [createModalOpen, setCreateModalOpen] = useState(false);
@@ -434,18 +429,25 @@ const AssetLibrary: React.FC = () => {
     }
 
     setUploading(true);
+    setUploadProgress(0);
     try {
       if (file.size > LARGE_FILE_THRESHOLD) {
         message.info(`大文件 "${file.name}" 将使用直传上传`);
       }
-      await uploadAssetDirect({ file, library_id: effectiveLibId });
+      await uploadAssetDirect({
+        file,
+        library_id: effectiveLibId,
+        onProgress: (pct) => setUploadProgress(pct),
+      });
       message.success(`"${file.name}" 上传成功`);
       queryClient.invalidateQueries({ queryKey: ["assets"] });
       queryClient.invalidateQueries({ queryKey: ["asset-libraries"] });
-    } catch {
-      message.error(`"${file.name}" 上传失败`);
+    } catch (err: unknown) {
+      const detail = err instanceof Error ? err.message : "";
+      message.error(`"${file.name}" 上传失败${detail ? `：${detail}` : ""}`);
     } finally {
       setUploading(false);
+      setUploadProgress(0);
     }
     return false;
   };
@@ -532,6 +534,54 @@ const AssetLibrary: React.FC = () => {
 
   return (
     <div className="xx-assets-page">
+      {/* ─── 上传进度弹窗（圆形动画 + 百分比） ─── */}
+      <AntModal
+        open={uploading}
+        footer={null}
+        closable={false}
+        centered
+        width={260}
+        maskClosable={false}
+        className="xx-upload-progress-modal"
+      >
+        <div className="xx-upload-progress-body">
+          <svg
+            className="xx-upload-progress-ring"
+            viewBox="0 0 120 120"
+            width={120}
+            height={120}
+          >
+            {/* 背景圆环 */}
+            <circle
+              cx="60"
+              cy="60"
+              r="52"
+              fill="none"
+              stroke="var(--border-primary, #e5e7eb)"
+              strokeWidth="8"
+            />
+            {/* 进度圆弧 */}
+            <circle
+              cx="60"
+              cy="60"
+              r="52"
+              fill="none"
+              stroke="var(--primary-color, #6366f1)"
+              strokeWidth="8"
+              strokeLinecap="round"
+              strokeDasharray={`${2 * Math.PI * 52}`}
+              strokeDashoffset={`${2 * Math.PI * 52 * (1 - uploadProgress / 100)}`}
+              transform="rotate(-90 60 60)"
+              style={{ transition: "stroke-dashoffset 0.3s ease" }}
+            />
+          </svg>
+          <div className="xx-upload-progress-text">
+            <span className="xx-upload-progress-pct">{uploadProgress}%</span>
+            <span className="xx-upload-progress-label">上传中…</span>
+          </div>
+        </div>
+      </AntModal>
+
       {/* 两栏布局 */}
       <div className="xx-assets-layout">
         {/* ─── 左侧：素材库列表 ─── */}
@@ -588,7 +638,7 @@ const AssetLibrary: React.FC = () => {
             beforeUpload={handleUpload}
             showUploadList={false}
             multiple
-            accept="video/*,audio/*,image/*"
+            accept="video/*,image/*"
           >
             <div className="xx-asset-upload-zone">
               <p className="xx-asset-upload-icon">
@@ -598,7 +648,7 @@ const AssetLibrary: React.FC = () => {
                 {uploading ? "上传中..." : "点击或拖拽文件到此区域上传"}
               </p>
               <p className="xx-asset-upload-hint">
-                支持视频、音频、图片，单文件不超过 2GB
+                支持视频、图片，单文件不超过 2GB
               </p>
             </div>
           </Upload.Dragger>
@@ -621,7 +671,6 @@ const AssetLibrary: React.FC = () => {
                 options={[
                   { value: "all", label: "全部类型" },
                   { value: "video", label: "视频" },
-                  { value: "voice", label: "配音" },
                   { value: "image", label: "图片" },
                 ]}
               />
@@ -752,7 +801,6 @@ const AssetLibrary: React.FC = () => {
               style={{ width: "100%" }}
               options={[
                 { value: "video", label: "视频" },
-                { value: "voice", label: "配音" },
                 { value: "image", label: "图片" },
               ]}
             />

apps/web/src/pages/assets/assets.css

@@ -587,3 +587,40 @@
     grid-template-columns: 1fr;
   }
 }
+
+/* ─── 上传进度弹窗 ─── */
+.xx-upload-progress-modal .ant-modal-content {
+  padding: 24px 16px 20px;
+  border-radius: 16px;
+}
+
+.xx-upload-progress-body {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 16px;
+  padding: 8px 0;
+}
+
+.xx-upload-progress-ring {
+  display: block;
+}
+
+.xx-upload-progress-text {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 4px;
+}
+
+.xx-upload-progress-pct {
+  font-size: 22px;
+  font-weight: 700;
+  color: var(--primary-color, #6366f1);
+  line-height: 1;
+}
+
+.xx-upload-progress-label {
+  font-size: 13px;
+  color: var(--text-secondary, #6b7280);
+}

apps/web/src/pages/editing-planner/EditingPlanner.css

@@ -1968,7 +1968,9 @@
   border: 1px dashed var(--primary, #6366f1);
   border-radius: 6px;
   cursor: pointer;
-  transition: background 0.15s, color 0.15s;
+  transition:
+    background 0.15s,
+    color 0.15s;
 }
 
 .ep-voice-upload-btn:hover {
@@ -1996,7 +1998,9 @@
   border: none;
   border-radius: 4px;
   cursor: pointer;
-  transition: background 0.15s, color 0.15s;
+  transition:
+    background 0.15s,
+    color 0.15s;
 }
 
 .ep-voice-refresh-btn:hover {
@@ -2035,7 +2039,9 @@
   border: 1px solid var(--border-color, #334155);
   border-radius: 6px;
   cursor: pointer;
-  transition: background 0.15s, border-color 0.15s;
+  transition:
+    background 0.15s,
+    border-color 0.15s;
 }
 
 .ep-voice-preview-btn:hover {

apps/web/src/pages/generate/GeneratePage.tsx

@@ -6,21 +6,27 @@
  */
 import React, { useState, useRef, useCallback, useEffect } from "react";
 import { useQuery, useMutation } from "@tanstack/react-query";
-import { Typography, message } from "antd";
+import { Typography, message, Select } from "antd";
 import {
   AudioOutlined,
   ThunderboltOutlined,
   CheckCircleFilled,
+  CheckCircleOutlined,
+  CloseCircleOutlined,
+  LoadingOutlined,
   PlayCircleOutlined,
   PauseCircleOutlined,
   DownloadOutlined,
   ShareAltOutlined,
+  SaveOutlined,
+  PlusOutlined,
+  MinusOutlined,
+  CloseOutlined,
 } from "@ant-design/icons";
 import type { AssetItem } from "@/api/assets";
 import { getAssets, getAssetLibraries } from "@/api/assets";
 import { createEditPlan, generateEditPlan } from "@/api/editPlans";
 import { getEditingTemplates } from "@/api/editingPlanner";
-import { MODE_LABELS, type TemplateMode } from "@/api/editingPlanner";
 import { getTitles } from "@/api/titles";
 import apiClient from "@/api/client";
 import { fetchPresetVoices } from "@/api/voices";
@@ -28,9 +34,10 @@ import type { PresetVoiceItem } from "@/api/voices";
 import { formatDuration } from "@/api/voiceClone";
 import type { VoiceClone } from "@/api/voiceClone";
 import CloneModal from "@/components/voice/CloneModal";
-import { synthesizeSpeech, getTTSJobStatus } from "@/api/tts";
+import { synthesizeSpeech, getTTSJobStatus, saveTtsToLibrary } from "@/api/tts";
+import { getTags, createTag } from "@/api/tags";
 import { useCloneProgress } from "@/hooks/useCloneProgress";
-import { useSearchParams } from "react-router-dom";
+import { useSearchParams, useNavigate } from "react-router-dom";
 import { getEditPlan } from "@/api/editPlans";
 import "./generate.css";
 
@@ -50,13 +57,6 @@ const MODE_GRADIENTS: Record<string, string> = {
   voice_over: "linear-gradient(135deg, #6366f1, #4f46e5)",
   voice_pip: "linear-gradient(135deg, #10b981, #059669)",
 };
-const MODE_ABBRS: Record<string, string> = {
-  pip: "PIP",
-  one_take: "ONE",
-  voice_over: "VOI",
-  voice_pip: "VP",
-};
-
 /* ── 配音预设卡片：从 API 动态生成，不再硬编码 ── */
 const VOICE_GENDER_ICON: Record<string, string> = {
   female: "🎀",
@@ -97,6 +97,8 @@ const STEPS = [
    ================================================================ */
 
 const GeneratePage: React.FC = () => {
+  const navigate = useNavigate();
+
   /* ── 步骤状态 ── */
   const [currentStep, setCurrentStep] = useState(1);
 
@@ -116,6 +118,8 @@ const GeneratePage: React.FC = () => {
 
   /* ── 素材 ── */
   const [selectedMaterials, setSelectedMaterials] = useState<string[]>([]);
+  /* 素材选择模式：手动选择 / 自动匹配 */
+  const [materialMode, setMaterialMode] = useState<"manual" | "auto">("manual");
 
   /* ── 标题 ── */
   const [title, setTitle] = useState("");
@@ -140,6 +144,9 @@ const GeneratePage: React.FC = () => {
   );
   const [customVoiceText, setCustomVoiceText] = useState("");
 
+  /* ── 生成数量 ── */
+  const [generateCount, setGenerateCount] = useState(1);
+
   /* ── 克隆声音 ── */
   const [selectedClonedVoice, setSelectedClonedVoice] = useState<string>("");
   const [cloneModalOpen, setCloneModalOpen] = useState(false);
@@ -156,6 +163,7 @@ const GeneratePage: React.FC = () => {
   const [generating, setGenerating] = useState(false);
   const [progress, setProgress] = useState(0);
   const [generated, setGenerated] = useState(false);
+  const [generateError, setGenerateError] = useState<string | null>(null);
 
   const progressTimer = useRef<ReturnType<typeof setInterval>>(undefined);
   const audioRef = useRef<HTMLAudioElement | null>(null);
@@ -225,6 +233,23 @@ const GeneratePage: React.FC = () => {
   const [customAudioUrl, setCustomAudioUrl] = useState<string | null>(null);
   const [ttsError, setTtsError] = useState<string | null>(null);
   const [ttsJobId, setTtsJobId] = useState<string | null>(null);
+  /** 合成完成后保留的 job ID，用于"存为素材" */
+  const [completedTtsJobId, setCompletedTtsJobId] = useState<string | null>(
+    null,
+  );
+
+  /* ── 存为素材弹窗状态 ── */
+  const [saveModalOpen, setSaveModalOpen] = useState(false);
+  const [saveName, setSaveName] = useState("");
+  const [saveTagIds, setSaveTagIds] = useState<string[]>([]);
+  const [saveNewTag, setSaveNewTag] = useState("");
+
+  /* ── 标签列表（用于存为素材弹窗） ── */
+  const { data: allTags = [] } = useQuery({
+    queryKey: ["generate-save-tags"],
+    queryFn: getTags,
+    staleTime: 30_000,
+  });
 
   /* ── 素材数据 API ── */
   const { data: libraries = [] } = useQuery({
@@ -310,6 +335,7 @@ const GeneratePage: React.FC = () => {
         if (cancelled) return;
         if (status.status === "completed") {
           setCustomAudioUrl(status.output_audio_url);
+          setCompletedTtsJobId(ttsJobId);
           setTtsJobId(null);
           setTtsError(null);
           message.success("语音合成完成！");
@@ -351,12 +377,98 @@ const GeneratePage: React.FC = () => {
     });
   }, [customVoiceText, selectedVoice, synthesizeMutation]);
 
+  /* ── 存为素材 mutation ── */
+  const saveToLibraryMutation = useMutation({
+    mutationFn: (params: { name?: string; tag_ids?: string[] }) =>
+      saveTtsToLibrary(completedTtsJobId!, params),
+    onSuccess: () => {
+      message.success({
+        content: (
+          <span>
+            已保存到配音素材库！{" "}
+            <a
+              onClick={handleGoToLibrary}
+              style={{
+                color: "var(--primary-500, #6366f1)",
+                cursor: "pointer",
+              }}
+            >
+              去素材库查看
+            </a>
+          </span>
+        ),
+        duration: 5,
+      });
+      setSaveModalOpen(false);
+      setSaveName("");
+      setSaveTagIds([]);
+      setSaveNewTag("");
+      setCompletedTtsJobId(null);
+      setCustomAudioUrl(null);
+    },
+    onError: (err: Error) => {
+      message.error(`保存失败：${err.message || "请重试"}`);
+    },
+  });
+
+  /** 打开存为素材弹窗 */
+  const handleOpenSaveModal = useCallback(() => {
+    setSaveName("");
+    setSaveTagIds([]);
+    setSaveNewTag("");
+    setSaveModalOpen(true);
+  }, []);
+
+  /** 确认保存 */
+  const handleConfirmSave = useCallback(() => {
+    if (!completedTtsJobId) return;
+    saveToLibraryMutation.mutate({
+      name: saveName.trim() || undefined,
+      tag_ids: saveTagIds.length > 0 ? saveTagIds : undefined,
+    });
+  }, [completedTtsJobId, saveName, saveTagIds, saveToLibraryMutation]);
+
+  /** 在弹窗中新增标签（先创建再选中） */
+  const handleAddTagInModal = useCallback(
+    async (tagName: string) => {
+      const trimmed = tagName.trim();
+      if (!trimmed) return;
+      /* 已在选中列表则跳过 */
+      const existing = allTags.find((t) => t.name === trimmed);
+      if (existing) {
+        if (!saveTagIds.includes(existing.id)) {
+          setSaveTagIds((prev) => [...prev, existing.id]);
+        }
+        return;
+      }
+      try {
+        const created = await createTag(trimmed);
+        setSaveTagIds((prev) => [...prev, created.id]);
+        setSaveNewTag("");
+      } catch {
+        message.error(`创建标签"${trimmed}"失败`);
+      }
+    },
+    [allTags, saveTagIds],
+  );
+
+  /** 保存成功后跳转到素材库 */
+  const handleGoToLibrary = useCallback(() => {
+    navigate("/app/voice-materials");
+  }, [navigate]);
+
   const handleGenerate = useCallback(async () => {
+    console.log("[handleGenerate] 开始生成, 参数:", {
+      title,
+      selectedTemplate,
+      selectedMaterials,
+      voiceMode,
+    });
     if (!title.trim()) {
       message.warning("请先选择或输入标题");
       return;
     }
-    if (selectedMaterials.length === 0) {
+    if (materialMode === "manual" && selectedMaterials.length === 0) {
       message.warning("请至少选择一个素材");
       return;
     }
@@ -369,6 +481,7 @@ const GeneratePage: React.FC = () => {
     setGenerating(true);
     setProgress(0);
     setGenerated(false);
+    setGenerateError(null);
 
     try {
       const voiceConfig: Record<string, unknown> = {};
@@ -394,6 +507,8 @@ const GeneratePage: React.FC = () => {
           duration,
           auto_subtitles: autoSubtitles,
           bgm,
+          generate_count: generateCount,
+          material_mode: materialMode,
         },
         total_duration: duration,
         source_edit_plan_id: editPlanId || undefined,
@@ -427,6 +542,7 @@ const GeneratePage: React.FC = () => {
               )?.error_message ||
               "视频生成失败，请联系管理员或重试";
             console.error("[生成失败] planId:", plan.id, "响应:", data);
+            setGenerateError(errorMsg);
             message.error(errorMsg);
             return;
           }
@@ -456,20 +572,36 @@ const GeneratePage: React.FC = () => {
         typeof setInterval
       >;
     } catch (err: unknown) {
-      console.error("生成失败:", err);
+      console.error("[handleGenerate] 生成失败:", err);
       setGenerating(false);
       // 提取 axios 响应中的后端错误信息
       const axiosErr = err as {
         response?: {
-          data?: { message?: string; error?: string; detail?: string };
+          data?: {
+            message?: string;
+            error?: string;
+            detail?: string;
+            msg?: string;
+          };
         };
+        message?: string;
       };
       const backendMsg =
         axiosErr.response?.data?.message ||
         axiosErr.response?.data?.error ||
         axiosErr.response?.data?.detail ||
+        axiosErr.response?.data?.msg ||
+        axiosErr.message ||
         "";
-      message.error(backendMsg || "生成失败，请重试");
+      console.error(
+        "[handleGenerate] 错误信息:",
+        backendMsg,
+        "完整错误:",
+        axiosErr,
+      );
+      const errorMsg = backendMsg || "生成失败，请检查网络后重试或联系管理员";
+      setGenerateError(errorMsg);
+      message.error(errorMsg);
     }
   }, [
     title,
@@ -486,6 +618,8 @@ const GeneratePage: React.FC = () => {
     bgm,
     editPlanId,
     selectedTemplate,
+    generateCount,
+    materialMode,
   ]);
 
   /* ── 步骤导航 ── */
@@ -494,7 +628,11 @@ const GeneratePage: React.FC = () => {
       message.warning("请先选择一个模板");
       return;
     }
-    if (currentStep === 2 && selectedMaterials.length === 0) {
+    if (
+      currentStep === 2 &&
+      materialMode === "manual" &&
+      selectedMaterials.length === 0
+    ) {
       message.warning("请至少选择一个素材");
       return;
     }
@@ -505,7 +643,13 @@ const GeneratePage: React.FC = () => {
     if (currentStep < 5) {
       setCurrentStep((s) => s + 1);
     }
-  }, [currentStep, selectedTemplate, selectedMaterials.length, title]);
+  }, [
+    currentStep,
+    selectedTemplate,
+    selectedMaterials.length,
+    title,
+    materialMode,
+  ]);
 
   const goPrev = useCallback(() => {
     if (currentStep > 1) {
@@ -565,11 +709,10 @@ const GeneratePage: React.FC = () => {
                   background: MODE_GRADIENTS[tpl.mode] || MODE_GRADIENTS.pip,
                 }}
               >
-                {MODE_ABBRS[tpl.mode] || "TPL"}
+                🎬
               </div>
               <h4>{tpl.name}</h4>
               <p>
-                {MODE_LABELS[tpl.mode as TemplateMode] || tpl.mode} ·{" "}
                 {tpl.estimated_duration}s · {tpl.segments.length}片段
               </p>
               {tpl.tags.length > 0 && (
@@ -604,11 +747,31 @@ const GeneratePage: React.FC = () => {
     </div>
   );
 
-  /** 步骤 2：选择素材 */
+  /** 步骤 2：选择素材（双模式：手动选择 / 自动匹配） */
   const renderStep2 = () => (
     <div className="xx-form-section">
       <h3>📦 选择素材</h3>
-      <div className="xx-form-field">
+
+      {/* ── 模式切换 Tab ── */}
+      <div className="xx-material-mode-tabs">
+        <button
+          className={`xx-material-mode-tab ${materialMode === "manual" ? "active" : ""}`}
+          onClick={() => setMaterialMode("manual")}
+          type="button"
+        >
+          手动选择素材
+        </button>
+        <button
+          className={`xx-material-mode-tab ${materialMode === "auto" ? "active" : ""}`}
+          onClick={() => setMaterialMode("auto")}
+          type="button"
+        >
+          选择素材库自动匹配
+        </button>
+      </div>
+
+      {/* ── 素材库选择（两种模式共用） ── */}
+      <div className="xx-form-field" style={{ marginTop: 12 }}>
         <label>选择素材库</label>
         <select
           value={selectedLibraryId}
@@ -621,90 +784,138 @@ const GeneratePage: React.FC = () => {
           ))}
         </select>
       </div>
-      <div
-        style={{
-          marginTop: 14,
-          display: "flex",
-          alignItems: "center",
-          gap: 10,
-        }}
-      >
-        <span className="xx-pill xx-pill-ok">
-          已选 {selectedMaterials.length} 个素材
-        </span>
-        <Text style={{ color: "var(--text-tertiary, #94a3b8)", fontSize: 13 }}>
-          系统将自动选择最合适的素材
-        </Text>
-      </div>
 
-      {/* 素材列表 */}
-      <div style={{ marginTop: 14 }}>
-        {materialsLoading ? (
-          <Text style={{ color: "var(--text-secondary)", padding: "16px 0" }}>
-            加载素材中…
-          </Text>
-        ) : materials.length === 0 ? (
-          <Text style={{ color: "var(--text-secondary)", padding: "16px 0" }}>
-            暂无素材，请先在素材库中上传
-          </Text>
-        ) : (
-          <div style={{ display: "flex", flexDirection: "column", gap: 6 }}>
-            {materials.map((m) => {
-              const checked = selectedMaterials.includes(m.id);
-              return (
-                <label
-                  key={m.id}
-                  style={{
-                    display: "flex",
-                    alignItems: "center",
-                    gap: 10,
-                    padding: "8px 12px",
-                    background: checked
-                      ? "var(--primary-soft, #eef2ff)"
-                      : "#f8fafc",
-                    borderRadius: 10,
-                    cursor: "pointer",
-                    border: checked
-                      ? "1px solid var(--primary-color, #4f46e5)"
-                      : "1px solid transparent",
-                    transition: "all 0.15s ease",
-                  }}
-                >
-                  <input
-                    type="checkbox"
-                    checked={checked}
-                    onChange={() => {
-                      setSelectedMaterials((prev) =>
-                        prev.includes(m.id)
-                          ? prev.filter((id) => id !== m.id)
-                          : [...prev, m.id],
-                      );
-                    }}
-                    style={{ accentColor: "var(--primary-color, #4f46e5)" }}
-                  />
-                  <span
-                    style={{
-                      fontSize: 13,
-                      color: "var(--text-primary)",
-                      flex: 1,
-                    }}
-                  >
-                    {m.name}
-                  </span>
-                  <span
-                    style={{
-                      fontSize: 11,
-                      color: "var(--text-tertiary, #94a3b8)",
-                    }}
-                  >
-                    {m.mime_type.split("/")[1].toUpperCase()}
-                  </span>
-                </label>
-              );
-            })}
+      {/* ── 手动选择模式 ── */}
+      {materialMode === "manual" && (
+        <>
+          <div
+            style={{
+              marginTop: 14,
+              display: "flex",
+              alignItems: "center",
+              gap: 10,
+            }}
+          >
+            <span className="xx-pill xx-pill-ok">
+              已选 {selectedMaterials.length} 个素材
+            </span>
           </div>
-        )}
-      </div>
+
+          {/* 素材列表 */}
+          <div style={{ marginTop: 14 }}>
+            {materialsLoading ? (
+              <Text
+                style={{ color: "var(--text-secondary)", padding: "16px 0" }}
+              >
+                加载素材中…
+              </Text>
+            ) : materials.length === 0 ? (
+              <Text
+                style={{ color: "var(--text-secondary)", padding: "16px 0" }}
+              >
+                暂无素材，请先在素材库中上传
+              </Text>
+            ) : (
+              <div style={{ display: "flex", flexDirection: "column", gap: 6 }}>
+                {materials.map((m) => {
+                  const checked = selectedMaterials.includes(m.id);
+                  return (
+                    <label
+                      key={m.id}
+                      style={{
+                        display: "flex",
+                        alignItems: "center",
+                        gap: 10,
+                        padding: "8px 12px",
+                        background: checked
+                          ? "var(--primary-soft, #eef2ff)"
+                          : "#f8fafc",
+                        borderRadius: 10,
+                        cursor: "pointer",
+                        border: checked
+                          ? "1px solid var(--primary-color, #4f46e5)"
+                          : "1px solid transparent",
+                        transition: "all 0.15s ease",
+                      }}
+                    >
+                      <input
+                        type="checkbox"
+                        checked={checked}
+                        onChange={() => {
+                          setSelectedMaterials((prev) =>
+                            prev.includes(m.id)
+                              ? prev.filter((id) => id !== m.id)
+                              : [...prev, m.id],
+                          );
+                        }}
+                        style={{ accentColor: "var(--primary-color, #4f46e5)" }}
+                      />
+                      <span
+                        style={{
+                          fontSize: 13,
+                          color: "var(--text-primary)",
+                          flex: 1,
+                        }}
+                      >
+                        {m.name}
+                      </span>
+                      <span
+                        style={{
+                          fontSize: 11,
+                          color: "var(--text-tertiary, #94a3b8)",
+                        }}
+                      >
+                        {m.mime_type.split("/")[1].toUpperCase()}
+                      </span>
+                    </label>
+                  );
+                })}
+              </div>
+            )}
+          </div>
+        </>
+      )}
+
+      {/* ── 自动匹配模式 ── */}
+      {materialMode === "auto" && (
+        <div className="xx-auto-match-card">
+          <div className="xx-auto-match-icon">🤖</div>
+          <div className="xx-auto-match-body">
+            <h4 className="xx-auto-match-title">智能素材匹配</h4>
+            <p className="xx-auto-match-desc">
+              系统将根据所选模板和标题，从素材库中自动分析并匹配最合适的素材进行视频生成。
+              无需手动挑选，AI
+              会综合素材质量、时长、内容相关性等维度进行智能筛选。
+            </p>
+            <div className="xx-auto-match-features">
+              <span className="xx-auto-match-feature">📊 质量评分筛选</span>
+              <span className="xx-auto-match-feature">🎯 内容相关性匹配</span>
+              <span className="xx-auto-match-feature">⏱️ 时长智能分配</span>
+            </div>
+          </div>
+          {materialsLoading ? (
+            <Text
+              style={{
+                color: "var(--text-secondary)",
+                fontSize: 12,
+                marginTop: 8,
+              }}
+            >
+              扫描素材库中…
+            </Text>
+          ) : (
+            <Text
+              style={{
+                color: "var(--text-tertiary, #94a3b8)",
+                fontSize: 12,
+                marginTop: 8,
+              }}
+            >
+              当前素材库共 {materials.length} 个素材可供匹配
+            </Text>
+          )}
+        </div>
+      )}
     </div>
   );
 
@@ -714,14 +925,30 @@ const GeneratePage: React.FC = () => {
       <h3>📝 选择标题</h3>
       <div className="xx-form-field">
         <label>从标题库选择</label>
-        <select value={title} onChange={(e) => setTitle(e.target.value)}>
-          <option value="">请选择标题…</option>
-          {userTitles.map((t) => (
-            <option key={t.id} value={t.content}>
-              {t.content}
-            </option>
-          ))}
-        </select>
+        <Select
+          placeholder="请选择标题…"
+          allowClear
+          showSearch
+          style={{ width: "100%" }}
+          value={title || undefined}
+          onChange={(val) => setTitle(val || "")}
+          options={userTitles.map((t) => ({
+            label: t.content,
+            value: t.content,
+          }))}
+          filterOption={(input, option) =>
+            ((option?.label as string) || "")
+              .toLowerCase()
+              .includes(input.toLowerCase())
+          }
+          notFoundContent={
+            userTitles.length === 0 ? (
+              <span style={{ color: "var(--text-tertiary)", fontSize: 13 }}>
+                标题库为空，请前往「标题管理」添加
+              </span>
+            ) : null
+          }
+        />
       </div>
       <div className="xx-form-field" style={{ marginTop: 14 }}>
         <label>或手动输入</label>
@@ -910,16 +1137,136 @@ const GeneratePage: React.FC = () => {
               {ttsError}
             </Text>
           )}
-          {customAudioUrl && (
-            <Text
+          {customAudioUrl && completedTtsJobId && (
+            <div
               style={{
-                color: "var(--success, #10b981)",
                 marginTop: 8,
-                display: "block",
+                display: "flex",
+                alignItems: "center",
+                gap: 12,
               }}
             >
-              ✓ 语音合成完成
-            </Text>
+              <Text style={{ color: "var(--success, #10b981)" }}>
+                ✓ 语音合成完成
+              </Text>
+              <button
+                className="xx-btn xx-btn-primary"
+                style={{ height: 30, padding: "0 14px", fontSize: 12 }}
+                onClick={handleOpenSaveModal}
+              >
+                <SaveOutlined /> 存为素材
+              </button>
+            </div>
+          )}
+
+          {/* ── 存为素材弹窗 ── */}
+          {saveModalOpen && (
+            <div
+              className="xx-save-modal-overlay"
+              onClick={() => setSaveModalOpen(false)}
+            >
+              <div
+                className="xx-save-modal"
+                onClick={(e) => e.stopPropagation()}
+              >
+                <div className="xx-save-modal-header">
+                  <span>保存到配音素材库</span>
+                  <button
+                    className="xx-save-modal-close"
+                    onClick={() => setSaveModalOpen(false)}
+                  >
+                    <CloseOutlined />
+                  </button>
+                </div>
+                <div className="xx-save-modal-body">
+                  <label className="xx-save-modal-label">素材名称</label>
+                  <input
+                    className="xx-save-modal-input"
+                    placeholder="留空则自动生成名称"
+                    value={saveName}
+                    onChange={(e) => setSaveName(e.target.value)}
+                    maxLength={50}
+                  />
+                  <label className="xx-save-modal-label">
+                    标签
+                    <span
+                      style={{
+                        fontWeight: 400,
+                        color: "var(--text-tertiary, #94a3b8)",
+                      }}
+                    >
+                      （可选）
+                    </span>
+                  </label>
+                  <div className="xx-save-modal-tags">
+                    {saveTagIds.map((id) => {
+                      const tag = allTags.find((t) => t.id === id);
+                      return tag ? (
+                        <span key={id} className="xx-save-modal-tag active">
+                          {tag.name}
+                          <CloseOutlined
+                            className="xx-save-modal-tag-remove"
+                            onClick={() =>
+                              setSaveTagIds((prev) =>
+                                prev.filter((x) => x !== id),
+                              )
+                            }
+                          />
+                        </span>
+                      ) : null;
+                    })}
+                    <input
+                      className="xx-save-modal-tag-input"
+                      placeholder="输入标签名回车添加"
+                      value={saveNewTag}
+                      onChange={(e) => setSaveNewTag(e.target.value)}
+                      onKeyDown={(e) => {
+                        if (e.key === "Enter") {
+                          e.preventDefault();
+                          handleAddTagInModal(saveNewTag);
+                        }
+                      }}
+                    />
+                  </div>
+                  {allTags.length > 0 && (
+                    <div className="xx-save-modal-tag-presets">
+                      {allTags
+                        .filter((t) => !saveTagIds.includes(t.id))
+                        .slice(0, 12)
+                        .map((t) => (
+                          <button
+                            key={t.id}
+                            className="xx-save-modal-tag-preset"
+                            onClick={() =>
+                              setSaveTagIds((prev) => [...prev, t.id])
+                            }
+                          >
+                            {t.name}
+                            <PlusOutlined
+                              style={{ fontSize: 10, marginLeft: 4 }}
+                            />
+                          </button>
+                        ))}
+                    </div>
+                  )}
+                </div>
+                <div className="xx-save-modal-footer">
+                  <button
+                    className="xx-btn xx-btn-ghost"
+                    onClick={() => setSaveModalOpen(false)}
+                  >
+                    取消
+                  </button>
+                  <button
+                    className="xx-btn xx-btn-primary"
+                    disabled={saveToLibraryMutation.isPending}
+                    onClick={handleConfirmSave}
+                  >
+                    {saveToLibraryMutation.isPending ? "保存中…" : "保存"}
+                  </button>
+                </div>
+              </div>
+            </div>
           )}
         </div>
       )}
@@ -1046,7 +1393,9 @@ const GeneratePage: React.FC = () => {
         <div className="xx-summary-row">
           <span className="xx-summary-label">素材</span>
           <span className="xx-summary-value">
-            {selectedMaterials.length} 个素材
+            {materialMode === "auto"
+              ? "自动匹配"
+              : `${selectedMaterials.length} 个素材`}
           </span>
         </div>
         <div className="xx-summary-row">
@@ -1057,20 +1406,107 @@ const GeneratePage: React.FC = () => {
           <span className="xx-summary-label">配音</span>
           <span className="xx-summary-value">{getVoiceName()}</span>
         </div>
+        <div className="xx-summary-row">
+          <span className="xx-summary-label">生成数量</span>
+          <span className="xx-summary-value">
+            <div className="xx-count-stepper">
+              <button
+                className="xx-count-stepper-btn"
+                disabled={generateCount <= 1 || generating}
+                onClick={() => setGenerateCount((c) => Math.max(1, c - 1))}
+              >
+                <MinusOutlined />
+              </button>
+              <span className="xx-count-stepper-value">{generateCount}</span>
+              <button
+                className="xx-count-stepper-btn"
+                disabled={generateCount >= 10 || generating}
+                onClick={() => setGenerateCount((c) => Math.min(10, c + 1))}
+              >
+                <PlusOutlined />
+              </button>
+              <span className="xx-count-stepper-hint">条视频</span>
+            </div>
+          </span>
+        </div>
       </div>
 
-      {/* 生成进度 */}
-      {generating && (
+      {/* 生成进度 / 结果反馈 */}
+      {(generating || generated || generateError) && (
         <div style={{ marginTop: 16 }}>
-          <div className="xx-progress-bar">
+          {generating && (
+            <>
+              <div className="xx-progress-bar">
+                <div
+                  className="xx-progress-bar-fill"
+                  style={{ width: `${Math.min(Math.round(progress), 100)}%` }}
+                />
+              </div>
+              <Text style={{ color: "var(--text-secondary)", fontSize: 13 }}>
+                <LoadingOutlined style={{ marginRight: 6 }} />
+                正在生成视频，请稍候… {Math.round(progress)}%
+              </Text>
+            </>
+          )}
+          {generated && !generating && (
             <div
-              className="xx-progress-bar-fill"
-              style={{ width: `${Math.min(Math.round(progress), 100)}%` }}
-            />
-          </div>
-          <Text style={{ color: "var(--text-secondary)", fontSize: 13 }}>
-            正在生成视频，请稍候… {Math.round(progress)}%
-          </Text>
+              style={{
+                padding: "12px 16px",
+                borderRadius: 8,
+                background: "rgba(82, 196, 26, 0.08)",
+                border: "1px solid rgba(82, 196, 26, 0.3)",
+                display: "flex",
+                alignItems: "center",
+                gap: 8,
+              }}
+            >
+              <CheckCircleOutlined style={{ color: "#52c41a", fontSize: 18 }} />
+              <div>
+                <Text
+                  strong
+                  style={{ color: "#52c41a", display: "block", fontSize: 14 }}
+                >
+                  视频生成完成！
+                </Text>
+                <Text style={{ color: "var(--text-secondary)", fontSize: 12 }}>
+                  可在右侧预览或前往成片库查看
+                </Text>
+              </div>
+            </div>
+          )}
+          {generateError && !generating && (
+            <div
+              style={{
+                padding: "12px 16px",
+                borderRadius: 8,
+                background: "rgba(255, 77, 79, 0.08)",
+                border: "1px solid rgba(255, 77, 79, 0.3)",
+                display: "flex",
+                alignItems: "flex-start",
+                gap: 8,
+              }}
+            >
+              <CloseCircleOutlined
+                style={{
+                  color: "#ff4d4f",
+                  fontSize: 18,
+                  marginTop: 2,
+                  flexShrink: 0,
+                }}
+              />
+              <div>
+                <Text
+                  strong
+                  style={{ color: "#ff4d4f", display: "block", fontSize: 14 }}
+                >
+                  生成失败
+                </Text>
+                <Text style={{ color: "var(--text-secondary)", fontSize: 12 }}>
+                  {generateError}
+                </Text>
+              </div>
+            </div>
+          )}
         </div>
       )}
     </div>
@@ -1181,10 +1617,16 @@ const GeneratePage: React.FC = () => {
               <button
                 className="xx-btn xx-btn-primary"
                 onClick={handleGenerate}
-                disabled={generating || generated}
+                disabled={generating || (generated && !generateError)}
               >
                 <ThunderboltOutlined />
-                {generating ? "生成中…" : generated ? "已生成" : "✨ 确认生成"}
+                {generating
+                  ? "生成中…"
+                  : generated && !generateError
+                    ? "已生成"
+                    : generateError
+                      ? "🔄 重新生成"
+                      : "✨ 确认生成"}
               </button>
             )}
           </div>

apps/web/src/pages/generate/generate.css

@@ -883,3 +883,332 @@
     flex-direction: column;
   }
 }
+
+/* ── 存为素材弹窗 ── */
+.xx-save-modal-overlay {
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.45);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 1000;
+  animation: xxFadeIn 0.15s ease;
+}
+
+.xx-save-modal {
+  background: var(--bg-card, #fff);
+  border-radius: var(--radius-lg, 16px);
+  width: 420px;
+  max-width: 90vw;
+  box-shadow: 0 20px 60px rgba(0, 0, 0, 0.15);
+  animation: xxSlideUp 0.2s ease;
+}
+
+.xx-save-modal-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 16px 20px;
+  border-bottom: 1px solid var(--border-light, #f1f5f9);
+  font-weight: 600;
+  font-size: 15px;
+  color: var(--text-primary, #0f172a);
+}
+
+.xx-save-modal-close {
+  background: none;
+  border: none;
+  cursor: pointer;
+  color: var(--text-tertiary, #94a3b8);
+  font-size: 14px;
+  padding: 4px;
+  border-radius: var(--radius-sm, 6px);
+  transition: all 0.15s;
+}
+
+.xx-save-modal-close:hover {
+  background: var(--bg-hover, #f8fafc);
+  color: var(--text-primary, #0f172a);
+}
+
+.xx-save-modal-body {
+  padding: 20px;
+}
+
+.xx-save-modal-label {
+  display: block;
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--text-secondary, #475569);
+  margin-bottom: 6px;
+  margin-top: 14px;
+}
+
+.xx-save-modal-label:first-child {
+  margin-top: 0;
+}
+
+.xx-save-modal-input {
+  width: 100%;
+  padding: 8px 12px;
+  border: 1px solid var(--border-color, #e2e8f0);
+  border-radius: var(--radius-sm, 10px);
+  font-size: 14px;
+  outline: none;
+  background: var(--bg-surface, #fff);
+  color: var(--text-primary, #0f172a);
+  transition: border-color 0.15s;
+}
+
+.xx-save-modal-input:focus {
+  border-color: var(--primary-500, #6366f1);
+  box-shadow: 0 0 0 2px var(--primary-100, #e0e7ff);
+}
+
+.xx-save-modal-tags {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  padding: 8px;
+  border: 1px solid var(--border-color, #e2e8f0);
+  border-radius: var(--radius-sm, 10px);
+  min-height: 40px;
+  align-items: center;
+  cursor: text;
+  transition: border-color 0.15s;
+}
+
+.xx-save-modal-tags:focus-within {
+  border-color: var(--primary-500, #6366f1);
+  box-shadow: 0 0 0 2px var(--primary-100, #e0e7ff);
+}
+
+.xx-save-modal-tag {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 2px 8px;
+  font-size: 12px;
+  border-radius: 12px;
+  background: var(--primary-50, #eef2ff);
+  color: var(--primary-600, #4f46e5);
+  border: 1px solid var(--primary-200, #c7d2fe);
+}
+
+.xx-save-modal-tag-remove {
+  font-size: 10px;
+  cursor: pointer;
+  opacity: 0.6;
+  transition: opacity 0.15s;
+}
+
+.xx-save-modal-tag-remove:hover {
+  opacity: 1;
+}
+
+.xx-save-modal-tag-input {
+  border: none;
+  outline: none;
+  flex: 1;
+  min-width: 100px;
+  font-size: 13px;
+  background: transparent;
+  color: var(--text-primary, #0f172a);
+}
+
+.xx-save-modal-tag-input::placeholder {
+  color: var(--text-tertiary, #94a3b8);
+}
+
+.xx-save-modal-tag-presets {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin-top: 10px;
+  padding-top: 10px;
+  border-top: 1px solid var(--border-light, #f1f5f9);
+}
+
+.xx-save-modal-tag-preset {
+  padding: 3px 10px;
+  font-size: 12px;
+  border: 1px solid var(--border-color, #e2e8f0);
+  border-radius: 12px;
+  background: var(--bg-surface, #fff);
+  color: var(--text-secondary, #475569);
+  cursor: pointer;
+  transition: all 0.15s;
+}
+
+.xx-save-modal-tag-preset:hover {
+  border-color: var(--primary-300, #a5b4fc);
+  color: var(--primary-600, #4f46e5);
+  background: var(--primary-50, #eef2ff);
+}
+
+.xx-save-modal-footer {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+  padding: 14px 20px;
+  border-top: 1px solid var(--border-light, #f1f5f9);
+}
+
+@keyframes xxFadeIn {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+
+@keyframes xxSlideUp {
+  from {
+    transform: translateY(12px);
+    opacity: 0;
+  }
+  to {
+    transform: translateY(0);
+    opacity: 1;
+  }
+}
+
+/* ── 生成数量步进器 ── */
+.xx-count-stepper {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.xx-count-stepper-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 28px;
+  height: 28px;
+  border: 1px solid var(--border-primary, #e2e8f0);
+  border-radius: 8px;
+  background: var(--bg-surface, #fff);
+  color: var(--text-secondary, #64748b);
+  font-size: 13px;
+  cursor: pointer;
+  transition: all 0.15s;
+}
+
+.xx-count-stepper-btn:hover:not(:disabled) {
+  border-color: var(--primary-400, #818cf8);
+  color: var(--primary-600, #4f46e5);
+  background: var(--primary-50, #eef2ff);
+}
+
+.xx-count-stepper-btn:disabled {
+  opacity: 0.35;
+  cursor: not-allowed;
+}
+
+.xx-count-stepper-value {
+  min-width: 24px;
+  text-align: center;
+  font-size: 16px;
+  font-weight: 600;
+  color: var(--text-primary, #1e293b);
+}
+
+.xx-count-stepper-hint {
+  font-size: 12px;
+  color: var(--text-tertiary, #94a3b8);
+  margin-left: 2px;
+}
+
+/* ── 素材选择模式切换 Tab ── */
+.xx-material-mode-tabs {
+  display: flex;
+  gap: 0;
+  border: 1px solid var(--border-primary, #e2e8f0);
+  border-radius: 10px;
+  overflow: hidden;
+  margin-bottom: 4px;
+}
+
+.xx-material-mode-tab {
+  flex: 1;
+  padding: 10px 16px;
+  font-size: 13px;
+  font-weight: 500;
+  border: none;
+  background: var(--bg-surface, #fff);
+  color: var(--text-secondary, #64748b);
+  cursor: pointer;
+  transition: all 0.2s ease;
+  text-align: center;
+}
+
+.xx-material-mode-tab:first-child {
+  border-right: 1px solid var(--border-primary, #e2e8f0);
+}
+
+.xx-material-mode-tab:hover {
+  background: var(--primary-50, #eef2ff);
+  color: var(--primary-600, #4f46e5);
+}
+
+.xx-material-mode-tab.active {
+  background: var(--primary-500, #6366f1);
+  color: #fff;
+  font-weight: 600;
+}
+
+/* ── 自动匹配卡片 ── */
+.xx-auto-match-card {
+  margin-top: 14px;
+  padding: 20px;
+  background: linear-gradient(135deg, #f0f4ff 0%, #faf5ff 100%);
+  border: 1px solid var(--border-primary, #e2e8f0);
+  border-radius: 14px;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  text-align: center;
+}
+
+.xx-auto-match-icon {
+  font-size: 36px;
+  margin-bottom: 10px;
+}
+
+.xx-auto-match-body {
+  width: 100%;
+}
+
+.xx-auto-match-title {
+  font-size: 15px;
+  font-weight: 600;
+  color: var(--text-primary, #1e293b);
+  margin: 0 0 8px;
+}
+
+.xx-auto-match-desc {
+  font-size: 13px;
+  color: var(--text-secondary, #64748b);
+  line-height: 1.6;
+  margin: 0 0 14px;
+}
+
+.xx-auto-match-features {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: center;
+  gap: 8px;
+}
+
+.xx-auto-match-feature {
+  display: inline-block;
+  padding: 4px 12px;
+  font-size: 12px;
+  color: var(--primary-600, #4f46e5);
+  background: rgba(255, 255, 255, 0.8);
+  border: 1px solid var(--border-light, #f1f5f9);
+  border-radius: 20px;
+}

apps/web/src/pages/products/ProductLibrary.tsx

@@ -737,11 +737,39 @@ const ProductLibrary: React.FC = () => {
 
   // ── Error 状态 ──
   if (isError) {
+    console.error("[ProductLibrary] 加载失败:", error);
+    const errorMsg = error?.message || "加载失败";
+    // 404 视为空数据（API 尚未就绪或无数据）
+    const is404 = errorMsg.includes("404") || errorMsg.includes("Not Found");
+    if (is404) {
+      return (
+        <div className="xx-products-page">
+          <div className="xx-products-header">
+            <h2>
+              <VideoCameraOutlined /> 成片库
+            </h2>
+          </div>
+          <div className="xx-products-empty">
+            <div className="xx-products-empty-icon">🎬</div>
+            <p>暂无成片数据</p>
+            <p
+              style={{
+                fontSize: 12,
+                color: "var(--text-tertiary)",
+                marginTop: 4,
+              }}
+            >
+              完成视频生成后，成片将自动保存到这里
+            </p>
+          </div>
+        </div>
+      );
+    }
     return (
       <div className="xx-products-page">
         <div className="xx-products-empty">
           <div className="xx-products-empty-icon">❌</div>
-          <p>{error?.message || "加载失败"}</p>
+          <p>{errorMsg || "加载失败，请稍后重试"}</p>
           <Button
             buttonType="primary"
             buttonSize="sm"

apps/web/src/pages/templates/TemplateLibrary.tsx

@@ -91,7 +91,7 @@ const mapTemplateItemToEditTemplate = (item: TemplateItem): EditTemplate => ({
   id: item.id,
   name: item.name,
   type: inferTemplateType(item.category),
-  description: item.description,
+  description: item.description ?? "",
   usageCount: 0,
   isFavorite: item.is_favorite ?? false,
   thumbnailGradient: gradientForCategory(item.category),
@@ -370,9 +370,10 @@ const TemplateCard: React.FC<TemplateCardProps> = ({
           className="xx-template-thumb-bg"
           style={{ background: template.thumbnailGradient }}
         >
-          {template.description.slice(0, 80)}...
+          {(template.description ?? "").slice(0, 80)}...
         </div>
         <div className="xx-template-thumb-overlay" />
+        <div className="xx-template-thumb-name">{template.name}</div>
         <div className="xx-template-preview-hint">点击预览</div>
         <button
           className={`xx-template-fav-btn${isFavorite ? " is-favorite" : ""}`}
@@ -386,7 +387,6 @@ const TemplateCard: React.FC<TemplateCardProps> = ({
       {/* 信息区 */}
       <div className="xx-template-info">
         <div className="xx-template-info-top">
-          <h4 className="xx-template-name">{template.name}</h4>
           <span
             className="xx-template-category-pill"
             style={{
@@ -397,7 +397,7 @@ const TemplateCard: React.FC<TemplateCardProps> = ({
             {template.type}
           </span>
         </div>
-        <p className="xx-template-desc">{template.description}</p>
+        <p className="xx-template-desc">{template.description ?? ""}</p>
         <div className="xx-template-meta">
           <span className="xx-template-usage">
             已使用 {template.usageCount} 次
@@ -483,7 +483,9 @@ const TemplateLibrary: React.FC = () => {
       const matchSearch =
         !searchText ||
         t.name.toLowerCase().includes(searchText.toLowerCase()) ||
-        t.description.toLowerCase().includes(searchText.toLowerCase()) ||
+        (t.description ?? "")
+          .toLowerCase()
+          .includes(searchText.toLowerCase()) ||
         t.tags.some((tag) =>
           tag.toLowerCase().includes(searchText.toLowerCase()),
         );

apps/web/src/pages/templates/templates.css

@@ -233,6 +233,24 @@
   pointer-events: none;
 }
 
+/* 缩略图底部名称 */
+.xx-template-thumb-name {
+  position: absolute;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  padding: 24px 14px 10px;
+  background: linear-gradient(0deg, rgba(0, 0, 0, 0.55) 0%, transparent 100%);
+  color: #fff;
+  font-size: 14px;
+  font-weight: 600;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  z-index: 1;
+  pointer-events: none;
+}
+
 /* 预览提示（hover 显示） */
 .xx-template-preview-hint {
   position: absolute;

apps/web/src/pages/voice-materials/voice-materials.css

@@ -111,7 +111,9 @@
 
 .vmat-card.playing {
   border-color: var(--primary-500);
-  box-shadow: 0 0 0 1px var(--primary-500), var(--shadow-md);
+  box-shadow:
+    0 0 0 1px var(--primary-500),
+    var(--shadow-md);
 }
 
 /* 性别色带 */
@@ -812,3 +814,449 @@
     justify-content: space-between;
   }
 }
+
+/* ─── 批量操作栏 ─────────────────────────────────────────── */
+
+.vmat-batch-bar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 8px 16px;
+  margin-bottom: 16px;
+  background: var(--primary-soft, #eef2ff);
+  border: 1px solid var(--primary-color, #6366f1);
+  border-radius: 8px;
+  animation: vmat-batch-bar-in 0.2s ease;
+}
+
+@keyframes vmat-batch-bar-in {
+  from {
+    opacity: 0;
+    transform: translateY(-8px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+.vmat-batch-bar-left {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.vmat-batch-bar-right {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.vmat-select-all {
+  font-size: 13px;
+  color: var(--text-secondary, #64748b);
+  cursor: pointer;
+  user-select: none;
+}
+
+.vmat-select-all:hover {
+  color: var(--primary-color, #6366f1);
+}
+
+.vmat-batch-count {
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--primary-color, #6366f1);
+}
+
+/* ─── 自定义 checkbox ────────────────────────────────────── */
+
+.vmat-checkbox {
+  width: 18px;
+  height: 18px;
+  border: 2px solid var(--neutral-300, #cbd5e1);
+  border-radius: 4px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  transition: all 0.15s ease;
+  background: var(--bg-primary, #fff);
+  flex-shrink: 0;
+}
+
+.vmat-checkbox:hover {
+  border-color: var(--primary-color, #6366f1);
+}
+
+.vmat-checkbox.checked {
+  background: var(--primary-color, #6366f1);
+  border-color: var(--primary-color, #6366f1);
+  color: #fff;
+  font-size: 10px;
+}
+
+/* ─── 卡片 checkbox 覆盖 ─────────────────────────────────── */
+
+.vmat-card-checkbox {
+  position: absolute;
+  top: 8px;
+  left: 8px;
+  z-index: 2;
+}
+
+.vmat-row-checkbox {
+  flex-shrink: 0;
+}
+
+/* ─── 选中态 + 批量模式 ──────────────────────────────────── */
+
+.vmat-card.selected {
+  border-color: var(--primary-color, #6366f1);
+  box-shadow: 0 0 0 1px var(--primary-color, #6366f1);
+}
+
+.vmat-row.selected {
+  background: var(--primary-soft, #eef2ff);
+}
+
+.vmat-card.batch-mode {
+  cursor: pointer;
+}
+
+.vmat-row.batch-mode {
+  cursor: pointer;
+}
+
+/* ─── 进度条拖拽 thumb ───────────────────────────────────── */
+
+.vmat-progress-thumb {
+  position: absolute;
+  top: 50%;
+  transform: translate(-50%, -50%);
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  background: var(--primary-color, #6366f1);
+  border: 2px solid #fff;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.2);
+  pointer-events: none;
+  z-index: 1;
+}
+
+/* ─── 音量控制 ────────────────────────────────────────────── */
+
+.vmat-volume {
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  margin-top: 6px;
+}
+
+.vmat-volume-btn {
+  background: none;
+  border: none;
+  padding: 0;
+  cursor: pointer;
+  color: var(--text-secondary, #64748b);
+  font-size: 14px;
+  display: flex;
+  align-items: center;
+  transition: color 0.15s;
+}
+
+.vmat-volume-btn:hover {
+  color: var(--primary-color, #6366f1);
+}
+
+.vmat-volume-slider {
+  -webkit-appearance: none;
+  appearance: none;
+  width: 48px;
+  height: 4px;
+  border-radius: 2px;
+  background: var(--neutral-200, #e2e8f0);
+  outline: none;
+  cursor: pointer;
+}
+
+.vmat-volume-slider::-webkit-slider-thumb {
+  -webkit-appearance: none;
+  appearance: none;
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  background: var(--primary-color, #6366f1);
+  cursor: pointer;
+}
+
+.vmat-volume-slider::-moz-range-thumb {
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  background: var(--primary-color, #6366f1);
+  cursor: pointer;
+  border: none;
+}
+
+/* ─── 上传进度条 ──────────────────────────────────────────── */
+
+.vmat-upload-progress {
+  position: relative;
+  height: 20px;
+  background: var(--neutral-100, #f1f5f9);
+  border-radius: 10px;
+  overflow: hidden;
+  margin-top: 12px;
+}
+
+.vmat-upload-progress-bar {
+  height: 100%;
+  background: linear-gradient(90deg, var(--primary-color, #6366f1), #818cf8);
+  border-radius: 10px;
+  transition: width 0.3s ease;
+}
+
+.vmat-upload-progress-text {
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--text-primary, #1e293b);
+}
+
+/* ─── 批量打标签 Popover ──────────────────────────────────── */
+
+.vmat-tag-popover {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  max-width: 240px;
+}
+
+.vmat-tag-pop-btn {
+  padding: 4px 12px;
+  border: 1px solid var(--neutral-200, #e2e8f0);
+  border-radius: 14px;
+  background: var(--bg-primary, #fff);
+  font-size: 12px;
+  color: var(--text-secondary, #64748b);
+  cursor: pointer;
+  transition: all 0.15s;
+}
+
+.vmat-tag-pop-btn:hover {
+  border-color: var(--primary-color, #6366f1);
+  color: var(--primary-color, #6366f1);
+  background: var(--primary-soft, #eef2ff);
+}
+
+/* ─── 列表 checkbox 列 ────────────────────────────────────── */
+
+.vmat-lh-checkbox {
+  width: 30px;
+}
+
+.vmat-list.batch-mode .vmat-list-header,
+.vmat-list.batch-mode .vmat-row {
+  grid-template-columns: 30px 48px 1fr 80px 160px 120px 60px 70px 80px;
+}
+
+/* ─── 标签筛选药丸条 ─────────────────────────────────────── */
+
+.vmat-tag-filter-bar {
+  display: flex;
+  gap: 8px;
+  overflow-x: auto;
+  padding: 10px 0;
+  margin-bottom: 12px;
+  scrollbar-width: thin;
+}
+
+.vmat-tag-filter-bar::-webkit-scrollbar {
+  height: 4px;
+}
+
+.vmat-tag-filter-bar::-webkit-scrollbar-thumb {
+  background: var(--neutral-300, #cbd5e1);
+  border-radius: 2px;
+}
+
+.vmat-filter-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 6px 16px;
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-full, 9999px);
+  background: var(--bg-surface);
+  color: var(--text-secondary);
+  font-size: 13px;
+  cursor: pointer;
+  white-space: nowrap;
+  flex-shrink: 0;
+  transition: all 0.2s ease;
+  line-height: 1.4;
+}
+
+.vmat-filter-pill:hover {
+  border-color: var(--primary-300);
+  color: var(--text-primary);
+  background: var(--primary-50);
+}
+
+.vmat-filter-pill:focus-visible {
+  outline: 2px solid var(--primary-500);
+  outline-offset: 2px;
+}
+
+.vmat-filter-pill.active {
+  background: var(--primary-500);
+  color: #fff;
+  border-color: var(--primary-500);
+}
+
+.vmat-filter-pill.active .vmat-filter-pill-count {
+  color: rgba(255, 255, 255, 0.75);
+}
+
+.vmat-filter-pill-count {
+  font-size: 11px;
+  opacity: 0.7;
+  color: var(--text-tertiary);
+}
+
+/* ─── TagSelector ──────────────────────────────────────────── */
+
+.vmat-tag-selector-wrapper {
+  position: relative;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.vmat-tag-selector {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  padding: 8px;
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  background: var(--bg-surface);
+  min-height: 42px;
+  cursor: text;
+  transition:
+    border-color 0.2s,
+    box-shadow 0.2s;
+}
+
+.vmat-tag-selector:focus-within {
+  border-color: var(--primary-500);
+  box-shadow: 0 0 0 2px var(--primary-100);
+}
+
+.vmat-tag-selector-input {
+  border: none;
+  outline: none;
+  flex: 1;
+  min-width: 80px;
+  font-size: 13px;
+  background: transparent;
+  color: var(--text-primary);
+}
+
+.vmat-tag-selector-input::placeholder {
+  color: var(--text-placeholder);
+}
+
+.vmat-tag-suggestions {
+  position: absolute;
+  top: 100%;
+  left: 0;
+  right: 0;
+  z-index: 10;
+  margin-top: 4px;
+  background: var(--bg-surface);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  box-shadow: var(--shadow-md, 0 4px 12px rgba(0, 0, 0, 0.1));
+  max-height: 160px;
+  overflow-y: auto;
+}
+
+.vmat-tag-suggestion-item {
+  padding: 8px 12px;
+  font-size: 13px;
+  color: var(--text-primary);
+  cursor: pointer;
+  transition: background 0.15s;
+}
+
+.vmat-tag-suggestion-item:hover {
+  background: var(--primary-50);
+}
+
+.vmat-tag-selector-presets {
+  width: 100%;
+  display: flex;
+  gap: 6px;
+  flex-wrap: wrap;
+  margin-top: 4px;
+  padding-top: 8px;
+  border-top: 1px solid var(--border-light);
+}
+
+.vmat-tag-selector-preset {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 2px 10px;
+  font-size: 12px;
+  border: 1px solid var(--border-primary);
+  border-radius: 12px;
+  background: var(--bg-surface);
+  color: var(--text-secondary);
+  cursor: pointer;
+  transition: all 0.15s;
+}
+
+.vmat-tag-selector-preset:hover {
+  border-color: var(--primary-300);
+  color: var(--primary-600);
+  background: var(--primary-50);
+}
+
+.vmat-tag-selector-preset.selected {
+  opacity: 0.4;
+  pointer-events: none;
+}
+
+/* ─── 标签溢出 + 空态 ─────────────────────────────────────── */
+
+.vmat-tag-empty {
+  font-size: 12px;
+  color: var(--primary-500);
+  cursor: pointer;
+  padding: 2px 8px;
+  border: 1px dashed var(--primary-300);
+  border-radius: var(--radius-sm);
+  transition: all 0.15s;
+}
+
+.vmat-tag-empty:hover {
+  background: var(--primary-50);
+  border-color: var(--primary-500);
+}
+
+.vmat-tag-overflow {
+  font-style: italic;
+  opacity: 0.7;
+  cursor: default;
+}
+
+/* ── 批量打标签 Popover 自定义输入 ── */
+.vmat-tag-pop-input-row {
+  margin-bottom: 10px;
+}

apps/web/vitest.config.ts

@@ -11,6 +11,12 @@ export default defineConfig({
     globals: true,
     environment: "jsdom",
     setupFiles: "./src/test/setup.ts",
+    exclude: [
+      "node_modules",
+      "e2e",
+      "dist",
+      "build",
+    ],
     coverage: {
       provider: "v8",
       reporter: ["text", "json", "html"],

apps/worker/video_processing/dedup.py

@@ -206,6 +206,68 @@ class VideoDeduplicator:
 
         return None
 
+    def check_batch_duplicate(
+        self,
+        fingerprint: VideoFingerprint,
+        batch_id: str,
+        current_video_id: str,
+        session: Session,
+    ) -> Optional[dict]:
+        """检查视频是否与同批次内其他视频重复。
+
+        逻辑与 check_duplicate 一致（MD5 + pHash），但搜索范围限定为同 batch_id 的视频。
+
+        Args:
+            fingerprint: 待检测视频的指纹
+            batch_id: 批次 ID
+            current_video_id: 当前视频 ID（排除自身）
+            session: 数据库会话
+
+        Returns:
+            重复信息字典，或 None 表示未找到重复
+        """
+        video_repo = SQLAlchemyGeneratedVideoRepository(session)
+        batch_videos = video_repo.list_by_batch(batch_id)
+
+        for existing in batch_videos:
+            if existing.id == current_video_id:
+                continue
+            if not existing.video_fingerprint:
+                continue
+
+            ef = existing.video_fingerprint
+
+            if fingerprint.md5 == ef.get("md5"):
+                return {
+                    "duplicate": True,
+                    "duplicate_of": existing.id,
+                    "reason": "batch_exact_md5_match",
+                    "similarity": 1.0,
+                }
+
+            existing_phashes = ef.get("keyframe_phashes", [])
+            if not existing_phashes:
+                continue
+
+            min_distances = []
+            for phash in fingerprint.keyframe_phashes:
+                distances = [hamming_distance(phash, ep) for ep in existing_phashes]
+                min_distances.append(min(distances))
+            avg_distance = sum(min_distances) / len(min_distances) if min_distances else 100
+
+            if avg_distance >= self.PHASH_THRESHOLD:
+                continue
+
+            phash_similarity = 1.0 - (avg_distance / 64)
+            return {
+                "duplicate": True,
+                "duplicate_of": existing.id,
+                "reason": "batch_phash_similar",
+                "similarity": phash_similarity,
+            }
+
+        return None
+
     @staticmethod
     def _average_histogram_similarity(histograms_a: list[list[float]], histograms_b: list[list[float]]) -> float:
         """

apps/worker/worker_app/tasks/__init__.py

@@ -41,6 +41,10 @@ def __getattr__(name: str):
         from .tts_synthesis import process_tts_synthesis
 
         return process_tts_synthesis
+    elif name == "process_tts_segment_synthesis":
+        from .tts_synthesis import process_tts_segment_synthesis
+
+        return process_tts_segment_synthesis
     elif name == "run_ai_recommend":
         from .ai_tasks import run_ai_recommend
 
@@ -62,6 +66,7 @@ __all__ = [
     "extract_background_task",
     "process_voice_clone",
     "process_tts_synthesis",
+    "process_tts_segment_synthesis",
     "run_ai_recommend",
     "run_generate_cover",
 ]

apps/worker/worker_app/tasks/generation.py

@@ -139,14 +139,16 @@ def _download_library_assets(
     asset_library_id: str,
     temp_path: Path,
     video_extensions: tuple = (".mp4", ".mov", ".avi", ".mkv", ".webm"),
+    asset_ids: list[str] | None = None,
 ) -> list[str]:
     """
-    从素材库下载所有视频素材
+    从素材库下载视频素材
 
     Args:
         asset_library_id: 素材库 ID
         temp_path: 临时目录路径
         video_extensions: 支持的视频扩展名
+        asset_ids: 指定素材 ID 列表，为空则下载全部 ready 视频素材
 
     Returns:
         下载成功的视频文件路径列表
@@ -161,16 +163,15 @@ def _download_library_assets(
 
         try:
             # 查询素材库中的视频素材
-            assets = (
-                session.query(AssetModel)
-                .filter(
-                    AssetModel.asset_library_id == asset_library_id,
-                    AssetModel.status == "ready",
-                    AssetModel.file_type.in_(["video", "video/mp4", "video/quicktime"]),
-                )
-                .order_by(AssetModel.created_at)
-                .all()
+            query = session.query(AssetModel).filter(
+                AssetModel.asset_library_id == asset_library_id,
+                AssetModel.status == "ready",
+                AssetModel.file_type.in_(["video", "video/mp4", "video/quicktime"]),
             )
+            # 如果指定了 asset_ids，则只下载这些素材
+            if asset_ids:
+                query = query.filter(AssetModel.id.in_(asset_ids))
+            assets = query.order_by(AssetModel.created_at).all()
 
             if not assets:
                 logger.info(f"No video assets found in library {asset_library_id}")
@@ -259,6 +260,8 @@ def generate_video(self, task_id: str) -> dict:
         asset_library_id = gen_task.asset_library_id
         voice_library_id = gen_task.voice_library_id or ""
         mode = gen_task.strategy_id or "one_take"
+        task_asset_ids = list(gen_task.asset_ids or [])
+        batch_id = getattr(gen_task, "batch_id", "") or ""
     finally:
         session.close()
 
@@ -275,8 +278,8 @@ def generate_video(self, task_id: str) -> dict:
             temp_path = Path(temp_dir)
             output_path = temp_path / output_name
 
-            # 从素材库下载视频素材
-            downloaded_videos = _download_library_assets(asset_library_id, temp_path)
+            # 从素材库下载视频素材（如果任务指定了 asset_ids 则只下载这些）
+            downloaded_videos = _download_library_assets(asset_library_id, temp_path, asset_ids=task_asset_ids or None)
 
             audio_path = None
             if voice_library_id:
@@ -297,6 +300,32 @@ def generate_video(self, task_id: str) -> dict:
             file_size = output_path.stat().st_size
             duration = _probe_duration(output_path)
 
+            # 上传到 OSS
+            bucket = _oss_bucket()
+            if bucket:
+                try:
+                    bucket.put_object_from_file(storage_key, str(output_path))
+                except Exception as oss_err:
+                    logger.warning(f"OSS upload failed: {oss_err}")
+
+            # 构建视频 URL
+            if bucket:
+                file_url = f"{PUBLIC_API_BASE_URL}/{storage_key}"
+            else:
+                file_url = f"{GENERATED_FILES_URL_PREFIX}/{task_id}/{output_name}"
+
+            # 创建 GeneratedVideo 记录 + 查重
+            _create_video_record_and_dedup(
+                task_id=task_id,
+                project_id=project_id,
+                batch_id=batch_id,
+                file_url=file_url,
+                file_size=file_size,
+                duration=duration,
+                video_path=str(output_path),
+                mode=editing_mode.value,
+            )
+
             return {
                 "status": "completed",
                 "task_id": task_id,
@@ -314,3 +343,85 @@ def generate_video(self, task_id: str) -> dict:
             "task_id": task_id,
             "error": str(error),
         }
+
+
+def _create_video_record_and_dedup(
+    *,
+    task_id: str,
+    project_id: str,
+    batch_id: str,
+    file_url: str,
+    file_size: int,
+    duration: float,
+    video_path: str,
+    mode: str,
+) -> None:
+    """创建 GeneratedVideo 记录，计算指纹并执行查重（历史 + 批次）。"""
+    from uuid import uuid4
+
+    from video_processing.dedup import VideoDeduplicator
+    from worker_app.db import SessionLocal
+
+    from packages.adapters.sqlalchemy_impl.generated_video_repository import (
+        SQLAlchemyGeneratedVideoRepository,
+    )
+    from packages.domain import GeneratedVideo
+
+    session = SessionLocal()
+    try:
+        video_id = uuid4().hex
+        generated_video = GeneratedVideo(
+            id=video_id,
+            project_id=project_id,
+            generation_task_id=task_id,
+            name=f"generated-{task_id[:8]}.mp4",
+            file_url=file_url,
+            file_size=file_size,
+            duration=duration,
+            width=OUTPUT_WIDTH,
+            height=OUTPUT_HEIGHT,
+            fps=OUTPUT_FPS,
+            status="completed",
+            generation_params={"mode": mode},
+        )
+
+        video_repo = SQLAlchemyGeneratedVideoRepository(session)
+        video_repo.create(generated_video)
+
+        # 计算视频指纹
+        deduplicator = VideoDeduplicator()
+        try:
+            fingerprint = deduplicator.compute_fingerprint(video_path)
+        except Exception as fp_err:
+            logger.warning(f"Fingerprint computation failed for {video_id}: {fp_err}")
+            session.commit()
+            return
+
+        generated_video.video_fingerprint = fingerprint.to_dict()
+
+        # (a) 历史成片查重
+        duplicate_result = deduplicator.check_duplicate(fingerprint, project_id, session)
+
+        # (b) 批次内查重（仅当有 batch_id 时）
+        if not duplicate_result and batch_id:
+            duplicate_result = deduplicator.check_batch_duplicate(fingerprint, batch_id, video_id, session)
+
+        if duplicate_result:
+            generated_video.is_duplicate = True
+            generated_video.duplicate_of = duplicate_result["duplicate_of"]
+            logger.info(
+                f"Duplicate detected: {video_id} -> {duplicate_result['duplicate_of']} "
+                f"(reason={duplicate_result['reason']}, similarity={duplicate_result['similarity']:.3f})"
+            )
+        else:
+            generated_video.is_duplicate = False
+            generated_video.duplicate_of = None
+
+        video_repo.update(generated_video)
+        session.commit()
+        logger.info(f"GeneratedVideo record created: {video_id} (task={task_id}, dup={generated_video.is_duplicate})")
+    except Exception as e:
+        logger.error(f"Failed to create video record / dedup for task {task_id}: {e}")
+        session.rollback()
+    finally:
+        session.close()

apps/worker/worker_app/tasks/ingest.py

@@ -179,6 +179,7 @@ def ingest_asset(job_id: str) -> dict:
             width=int(metadata.get("width", 0)),
             height=int(metadata.get("height", 0)),
             status=AssetStatus.READY,
+            file_hash=job.file_hash,
         )
         asset_repo.create(asset)
 

apps/worker/worker_app/tasks/tts_synthesis.py

@@ -104,3 +104,77 @@ def process_tts_synthesis(self: Task, job_id: str) -> dict:
     finally:
         if session is not None:
             session.close()
+
+
+@celery_app.task(bind=True, max_retries=2, name="worker.process_tts_segment_synthesis")
+def process_tts_segment_synthesis(self: Task, job_id: str) -> dict:
+    """分段合成轮询任务 — 轮询多个 CosyVoice 子任务并合并音频。
+
+    与 process_tts_synthesis 类似，但超时更长（300s），
+    因为分段任务需要等待所有子任务完成。
+    """
+    session = None
+    try:
+        session = SessionLocal()
+        repo = SQLAlchemyTTSJobRepository(session)
+        workflow = TTSWorkflowService(
+            repository=repo,
+            cosyvoice_service=CosyVoiceService(),
+        )
+
+        updated_job = workflow.poll_and_process_synthesis(job_id, timeout=300)
+        session.commit()
+
+        logger.info(f"TTS segment synthesis completed: job_id={job_id}, " f"audio_url={updated_job.output_audio_url}")
+        return {
+            "ok": True,
+            "job_id": job_id,
+            "audio_url": updated_job.output_audio_url,
+        }
+
+    except Retry:
+        raise
+
+    except CosyVoiceTimeoutError as e:
+        logger.warning(f"TTS segment synthesis timeout for {job_id}: {e}")
+        if session is not None:
+            session.rollback()
+        raise self.retry(exc=e, countdown=60)
+
+    except CosyVoiceError as e:
+        logger.error(f"TTS segment synthesis failed for {job_id}: {e}")
+        if session is not None:
+            session.rollback()
+        try:
+            if session is not None:
+                job = repo.get(job_id)
+                if job is not None:
+                    job.mark_failed(str(e))
+                    repo.update(job)
+                    session.commit()
+        except Exception as inner_e:
+            logger.error(f"Failed to mark job as failed: {inner_e}")
+            if session is not None:
+                session.rollback()
+        return {"ok": False, "job_id": job_id, "error": str(e)}
+
+    except Exception as e:
+        logger.error(f"TTS segment synthesis unexpected error for {job_id}: {e}")
+        if session is not None:
+            session.rollback()
+        try:
+            if session is not None:
+                job = repo.get(job_id)
+                if job is not None:
+                    job.mark_failed(str(e))
+                    repo.update(job)
+                    session.commit()
+        except Exception as inner_e:
+            logger.error(f"Failed to mark job as failed: {inner_e}")
+            if session is not None:
+                session.rollback()
+        return {"ok": False, "job_id": job_id, "error": str(e)}
+
+    finally:
+        if session is not None:
+            session.close()

docs/PORTS.md

@@ -0,0 +1,140 @@
+# 端口分配清单
+
+> 本文档梳理 xiaoxia-saas 项目中所有服务、容器及 CI 环境使用的端口，
+> 作为运维、排障和新功能开发时的统一参考。
+>
+> 最后更新：2026-07-24
+
+---
+
+## 一、应用服务端口
+
+| 服务     | 容器内端口 | 环境变量名       | Staging 宿主机 | Production 宿主机 | 说明                                |
+| -------- | ---------- | ---------------- | -------------- | ----------------- | ----------------------------------- |
+| API      | 8000       | `API_PORT`       | 8000           | 8001              | FastAPI 服务，Nginx 反代后端       |
+| Web      | 80         | `WEB_PORT`       | 3001           | 3002              | Nginx + 前端静态文件               |
+| Worker   | —          | —                | —              | —                 | Celery 任务队列，不暴露端口         |
+
+### 补充说明
+- API 容器内部固定监听 8000（`API_HOST=0.0.0.0`，`API_PORT=8000`）
+- Web 容器内部 Nginx 固定监听 80
+- 所有端口均绑定 `127.0.0.1`，不直接暴露公网，由前置 Nginx/CDN 转发
+
+---
+
+## 二、基础设施端口
+
+### PostgreSQL
+
+| 环境         | 容器内端口 | 宿主机映射 | 环境变量名            | 默认值   |
+| ------------ | ---------- | ---------- | --------------------- | -------- |
+| Production   | 5432       | 5433       | `POSTGRES_PORT`       | 5433     |
+| Staging      | 5432       | 5434       | `POSTGRES_PORT`       | 5434     |
+| 开发本地     | 5432       | 5432       | `DATABASE_URL` 中端口 | 5432     |
+| CI 共享 PG   | 5432       | 5433       | `CI_SHARED_PG_PORT`   | 5433     |
+| CI 本地 PG   | 5432       | 5432       | `CI_LOCAL_PG_PORT`    | 5432     |
+
+### Redis
+
+| 环境         | 容器内端口 | 宿主机映射 | 环境变量名          | 默认值   |
+| ------------ | ---------- | ---------- | ------------------- | -------- |
+| Production   | 6379       | 6380       | `REDIS_URL` 中端口  | —        |
+| Staging      | 6379       | 6381       | `REDIS_URL` 中端口  | —        |
+| 开发本地     | 6379       | 6379       | `REDIS_URL`         | 6379     |
+| CI 动态创建  | 6379       | 随机       | 运行时 `REDIS_PORT` | —        |
+
+> CI Integration Tests 中 Redis 容器使用 `-P` 随机映射端口，
+> 通过 `docker port` 命令获取实际端口后写入 `REDIS_URL`。
+
+### 容器镜像 Registry
+
+| 服务              | 端口  | 地址                   | 说明                           |
+| ----------------- | ----- | ---------------------- | ------------------------------ |
+| Gitea Registry    | 5000  | 172.30.18.198:5000     | CI 构建服务器内网 Registry     |
+| ACR（生产镜像源） | 443   | crpi-xxx.aliyuncs.com  | 阿里云容器镜像服务（HTTPS）    |
+
+---
+
+## 三、CI / DevOps 端口
+
+| 服务/用途           | 端口  | 环境变量名            | 默认值 | 说明                                  |
+| ------------------- | ----- | --------------------- | ------ | ------------------------------------- |
+| CI ChatOps Webhook  | 8090  | `CHATOPS_WEBHOOK_PORT`| 8090   | Gitea webhook 接收服务（`scripts/ci/chatops/`） |
+| Staging SSH 部署    | 22222 | `STAGING_SSH_PORT`    | 22222  | Staging 服务器 SSH 端口（secrets 配置） |
+| Preview SSH 部署    | 22222 | `PREVIEW_SSH_PORT`    | 22222  | Preview 服务器 SSH 端口（secrets 配置） |
+| Preview 前端访问    | 80    | —                     | 80     | Nginx 子域名路由，`*.preview.xiaoxiajianji.com` |
+
+---
+
+## 四、开发环境默认端口（.env.example）
+
+| 用途         | 端口  | 环境变量名 / 出处                          |
+| ------------ | ----- | ------------------------------------------ |
+| API 服务     | 8000  | `API_PORT`                                 |
+| 数据库       | 5432  | `DATABASE_URL`（`postgresql+psycopg://...:5432/...`） |
+| Redis        | 6379  | `REDIS_URL` / `CELERY_BROKER_URL` / `CELERY_RESULT_BACKEND` |
+| SMTP         | 587   | `SMTP_PORT`                                |
+| 前端开发服务 | 3000  | `APP_BASE_URL`（默认 localhost:3000）      |
+| Vite Dev     | 5173  | `CORS_ORIGINS_RAW` 中包含                  |
+
+---
+
+## 五、CI Workflow 中的端口变量
+
+### ci-pipeline.yml 顶层 env
+
+| 变量名              | 默认值 | 用途                     |
+| ------------------- | ------ | ------------------------ |
+| `CI_PG_PORT`        | 5432   | CI PG 容器端口（本地）   |
+| `CI_SHARED_PG_PORT` | 5433   | CI 共享常驻 PG 端口      |
+
+### scripts/ci/ci_env.sh（统一常量）
+
+| 变量名              | 默认值      | 说明                          |
+| ------------------- | ----------- | ----------------------------- |
+| `CI_SHARED_PG_PORT` | 5433        | 共享常驻 PG 实例端口          |
+| `CI_LOCAL_PG_PORT`  | 5432        | 本地 PG 容器默认端口          |
+| `CI_DEFAULT_DB`     | xiaoxia_saas | 默认数据库名                 |
+
+---
+
+## 六、命名规范
+
+### 推荐命名格式
+
+统一使用 `{服务/用途}_PORT` 格式：
+
+```bash
+API_PORT          # 应用服务
+WEB_PORT          # 应用服务
+POSTGRES_PORT     # 基础设施
+REDIS_PORT        # 基础设施
+SMTP_PORT         # 外部服务
+CI_SHARED_PG_PORT # CI 特定
+CI_LOCAL_PG_PORT  # CI 特定
+CHATOPS_WEBHOOK_PORT # DevOps 服务
+```
+
+### 历史命名不一致（待统一）
+
+- `WEBHOOK_PORT`（chatops config.py 内部变量）→ 应与外部 env 名 `CHATOPS_WEBHOOK_PORT` 对齐
+- `STAGING_SSH_PORT` / `PREVIEW_SSH_PORT` → 符合规范，保留
+- `CI_PG_PORT`（workflow 中）→ 建议统一为 `CI_LOCAL_PG_PORT` 与 `ci_env.sh` 对齐
+
+---
+
+## 七、相关配置文件路径
+
+| 文件路径                              | 端口相关内容                     |
+| ------------------------------------- | -------------------------------- |
+| `infra/docker/compose.yml`            | API / Web / Worker 端口映射      |
+| `infra/docker/infra.yml`              | Staging PG / Redis 端口          |
+| `infra/docker/infra-production.yml`   | Production PG / Redis 端口       |
+| `.env.example`                        | 开发环境全部端口变量             |
+| `.gitea/workflows/ci-pipeline.yml`    | CI PG 端口配置                   |
+| `scripts/ci/ci_env.sh`                | CI 端口统一常量                  |
+| `scripts/ci/chatops/config.py`        | ChatOps Webhook 端口             |
+| `scripts/ci/run_integration_tests.sh` | Redis 动态端口 + PG 端口         |
+| `scripts/ci/run_validate.sh`          | PG 端口                          |
+| `scripts/ci/validate_migration.sh`    | PG 端口                          |
+

docs/schema-metadata-snapshot.json

@@ -95,6 +95,39 @@
         "id"
       ]
     },
+    "asset_tags": {
+      "columns": [
+        {
+          "index": false,
+          "name": "asset_id",
+          "nullable": false,
+          "primary_key": true,
+          "type": "VARCHAR(36)",
+          "unique": false
+        },
+        {
+          "index": false,
+          "name": "tag_id",
+          "nullable": false,
+          "primary_key": true,
+          "type": "VARCHAR(36)",
+          "unique": false
+        },
+        {
+          "index": false,
+          "name": "created_at",
+          "nullable": false,
+          "primary_key": false,
+          "type": "DATETIME",
+          "unique": false
+        }
+      ],
+      "indexes": [],
+      "primary_key": [
+        "asset_id",
+        "tag_id"
+      ]
+    },
     "assets": {
       "columns": [
         {
@@ -241,6 +274,14 @@
           "type": "VARCHAR(36)",
           "unique": false
         },
+        {
+          "index": true,
+          "name": "file_hash",
+          "nullable": true,
+          "primary_key": false,
+          "type": "VARCHAR(64)",
+          "unique": false
+        },
         {
           "index": false,
           "name": "metadata",
@@ -288,6 +329,13 @@
           "name": "ix_assets_created_at",
           "unique": false
         },
+        {
+          "columns": [
+            "file_hash"
+          ],
+          "name": "ix_assets_file_hash",
+          "unique": false
+        },
         {
           "columns": [
             "file_type"
@@ -1469,6 +1517,22 @@
           "type": "VARCHAR(32)",
           "unique": false
         },
+        {
+          "index": false,
+          "name": "asset_select_mode",
+          "nullable": false,
+          "primary_key": false,
+          "type": "VARCHAR(20)",
+          "unique": false
+        },
+        {
+          "index": true,
+          "name": "batch_id",
+          "nullable": false,
+          "primary_key": false,
+          "type": "VARCHAR(32)",
+          "unique": false
+        },
         {
           "index": false,
           "name": "metadata",
@@ -1494,6 +1558,13 @@
           "name": "ix_generation_tasks_asset_library_id",
           "unique": false
         },
+        {
+          "columns": [
+            "batch_id"
+          ],
+          "name": "ix_generation_tasks_batch_id",
+          "unique": false
+        },
         {
           "columns": [
             "created_by_user_id"
@@ -1599,6 +1670,14 @@
           "type": "VARCHAR(32)",
           "unique": false
         },
+        {
+          "index": true,
+          "name": "file_hash",
+          "nullable": true,
+          "primary_key": false,
+          "type": "VARCHAR(64)",
+          "unique": false
+        },
         {
           "index": false,
           "name": "created_at",
@@ -1617,6 +1696,13 @@
         }
       ],
       "indexes": [
+        {
+          "columns": [
+            "file_hash"
+          ],
+          "name": "ix_ingest_jobs_file_hash",
+          "unique": false
+        },
         {
           "columns": [
             "library_id"
@@ -2056,6 +2142,54 @@
         "id"
       ]
     },
+    "tags": {
+      "columns": [
+        {
+          "index": false,
+          "name": "id",
+          "nullable": false,
+          "primary_key": true,
+          "type": "VARCHAR(36)",
+          "unique": false
+        },
+        {
+          "index": true,
+          "name": "user_id",
+          "nullable": false,
+          "primary_key": false,
+          "type": "VARCHAR(36)",
+          "unique": false
+        },
+        {
+          "index": false,
+          "name": "name",
+          "nullable": false,
+          "primary_key": false,
+          "type": "VARCHAR(100)",
+          "unique": false
+        },
+        {
+          "index": false,
+          "name": "created_at",
+          "nullable": false,
+          "primary_key": false,
+          "type": "DATETIME",
+          "unique": false
+        }
+      ],
+      "indexes": [
+        {
+          "columns": [
+            "user_id"
+          ],
+          "name": "ix_tags_user_id",
+          "unique": false
+        }
+      ],
+      "primary_key": [
+        "id"
+      ]
+    },
     "template_categories": {
       "columns": [
         {

infra/docker/api.Dockerfile

@@ -4,7 +4,7 @@
 # ============================================================
 
 # 基础镜像：Python 3.12
-FROM python:3.12-slim-bookworm
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/python:3.12-slim-bookworm
 
 # 使用阿里云镜像加速
 RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \

infra/docker/ci.Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/python:3.12-slim
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_NO_CACHE_DIR=0 \

infra/docker/deploy-production-registry.sh

@@ -0,0 +1,240 @@
+#!/bin/sh
+set -eu
+
+# ============================================
+# Production 部署脚本 - Registry 方式
+# 用法：IMAGE_TAG=<version> REGISTRY_TOKEN=<token> sh deploy-production-registry.sh
+# ============================================
+
+IMAGE_TAG="${IMAGE_TAG:-}"
+REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
+REGISTRY_USER="${REGISTRY_USER:-xiaoxia}"
+REGISTRY_TOKEN="${REGISTRY_TOKEN:-}"
+
+ENV_FILE="${ENV_FILE:-/var/lib/xiaoxia-saas-production/.env}"
+GENERATED_DIR="${GENERATED_DIR:-/var/lib/xiaoxia-saas-production/generated}"
+LEGACY_ASSETS_DIR="${LEGACY_ASSETS_DIR:-/var/lib/xiaoxia-saas-production/legacy-assets}"
+
+if [ -z "$IMAGE_TAG" ]; then
+  echo "ERROR: IMAGE_TAG is required"
+  exit 1
+fi
+
+test -f "$ENV_FILE"
+mkdir -p "$GENERATED_DIR"
+mkdir -p "$LEGACY_ASSETS_DIR"
+
+# ---- 登录 Registry ----
+if [ -n "$REGISTRY_TOKEN" ]; then
+  echo "Logging in to registry: $REGISTRY"
+  REGISTRY_HOST=$(echo "$REGISTRY" | cut -d/ -f1)
+  printf %s "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin 2>/dev/null || {
+    echo "WARN: docker login failed, will try to pull anyway"
+  }
+fi
+
+# ---- Pull 三镜像 ----
+REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:${IMAGE_TAG}"
+REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:${IMAGE_TAG}"
+REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:${IMAGE_TAG}"
+
+LOCAL_API="xiaoxia-saas-api:${IMAGE_TAG}"
+LOCAL_WORKER="xiaoxia-saas-worker:${IMAGE_TAG}"
+LOCAL_WEB="xiaoxia-saas-web:${IMAGE_TAG}"
+
+echo "Pulling API image..."
+docker pull "$REGISTRY_API"
+echo "Pulling Worker image..."
+docker pull "$REGISTRY_WORKER"
+echo "Pulling Web image..."
+docker pull "$REGISTRY_WEB"
+
+# ---- Re-tag 成本地名 ----
+docker tag "$REGISTRY_API" "$LOCAL_API"
+docker tag "$REGISTRY_WORKER" "$LOCAL_WORKER"
+docker tag "$REGISTRY_WEB" "$LOCAL_WEB"
+echo "All images pulled and tagged."
+
+# ---- 备份旧版 assets（部署期间缓存用户不 404） ----
+echo "Backing up legacy assets from current web container..."
+if docker inspect xiaoxia-web-production >/dev/null 2>&1; then
+  _tmpdir="/tmp/legacy-assets-$$"
+  rm -rf "$_tmpdir"
+  mkdir -p "$_tmpdir"
+  docker cp xiaoxia-web-production:/usr/share/nginx/html/assets/. "$_tmpdir/" 2>/dev/null || true
+  # 合并到 LEGACY_ASSETS_DIR（保留所有历史版本的 assets）
+  if [ -d "$_tmpdir" ] && [ "$(ls -A "$_tmpdir" 2>/dev/null)" ]; then
+    cp -an "$_tmpdir"/. "$LEGACY_ASSETS_DIR"/ 2>/dev/null || true
+    echo "Legacy assets backed up: $(ls "$_tmpdir" | wc -l) files"
+  fi
+  rm -rf "$_tmpdir"
+else
+  echo "No existing web container, skipping legacy assets backup"
+fi
+
+# 清理超过 7 天的旧 assets 文件（避免无限增长）
+if [ -d "$LEGACY_ASSETS_DIR" ]; then
+  find "$LEGACY_ASSETS_DIR" -type f -mtime +7 -delete 2>/dev/null || true
+  echo "Legacy assets cleanup done (retain 7 days)"
+fi
+
+# ---- 确保基础设施容器在运行 ----
+echo "Checking infrastructure containers..."
+for c in xiaoxia-postgres-production xiaoxia-redis-production; do
+  if ! docker inspect "$c" >/dev/null 2>&1; then
+    echo "ERROR: Required container not found: $c"
+    exit 1
+  fi
+  state=$(docker inspect -f '{{.State.Status}}' "$c")
+  if [ "$state" != "running" ]; then
+    echo "ERROR: Container not running: $c ($state)"
+    exit 1
+  fi
+done
+
+# ---- 确保生产网络存在 ----
+docker network create xiaoxia-net-production 2>/dev/null || true
+
+# ---- 执行数据库 Migration ----
+echo "Running database migrations..."
+docker run --rm \
+  --env-file "$ENV_FILE" \
+  --network xiaoxia-net-production \
+  -e APP_ENV=production \
+  "$LOCAL_API" sh -c "cd /app && alembic upgrade head"
+echo "Migrations completed."
+
+# ---- 停止旧容器 ----
+echo "Stopping old containers..."
+docker rm -f xiaoxia-api-production 2>/dev/null || true
+docker rm -f xiaoxia-worker-production 2>/dev/null || true
+docker rm -f xiaoxia-web-production 2>/dev/null || true
+
+# ---- 日志配置（所有容器共用） ----
+LOG_OPTS="--log-driver json-file --log-opt max-size=50m --log-opt max-file=3"
+
+# ---- 启动 API ----
+echo "Starting API container..."
+docker run -d \
+  --name xiaoxia-api-production \
+  --env-file "$ENV_FILE" \
+  --network xiaoxia-net-production \
+  -p 127.0.0.1:8001:8000 \
+  -e APP_ENV=production \
+  -e APP_VERSION="$IMAGE_TAG" \
+  -e GENERATED_FILES_DIR=/app/generated \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -e PUBLIC_API_BASE_URL=https://api.xiaoxiajianji.com \
+  -v "$GENERATED_DIR:/app/generated" \
+  --restart unless-stopped \
+  --cpus 2 \
+  --memory 2g \
+  --health-cmd "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\"" \
+  --health-interval 30s \
+  --health-timeout 10s \
+  --health-retries 3 \
+  --health-start-period 40s \
+  $LOG_OPTS \
+  "$LOCAL_API"
+
+# ---- 启动 Worker ----
+echo "Starting Worker container..."
+docker run -d \
+  --name xiaoxia-worker-production \
+  --env-file "$ENV_FILE" \
+  --network xiaoxia-net-production \
+  -e APP_ENV=production \
+  -e APP_VERSION="$IMAGE_TAG" \
+  -e WORKER_CONCURRENCY=1 \
+  -e WORKER_MAX_TASKS_PER_CHILD=100 \
+  -e GENERATED_FILES_DIR=/app/generated \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -e PUBLIC_API_BASE_URL=https://api.xiaoxiajianji.com \
+  -v "$GENERATED_DIR:/app/generated" \
+  --restart unless-stopped \
+  --cpus 2 \
+  --memory 2g \
+  --health-cmd "sh -c \"grep -q celery /proc/1/cmdline || exit 1\"" \
+  --health-interval 30s \
+  --health-timeout 10s \
+  --health-retries 3 \
+  --health-start-period 30s \
+  $LOG_OPTS \
+  "$LOCAL_WORKER"
+
+# ---- 启动 Web ----
+# Legacy assets 挂载到 /usr/share/nginx/html/assets-legacy/assets/
+# nginx 配置中 assets location 有 fallback 逻辑
+LEGACY_VOLUME=""
+if [ -d "$LEGACY_ASSETS_DIR" ] && [ "$(ls -A "$LEGACY_ASSETS_DIR" 2>/dev/null)" ]; then
+  LEGACY_VOLUME="-v ${LEGACY_ASSETS_DIR}:/usr/share/nginx/html/assets-legacy/assets:ro"
+  echo "Web container: legacy assets mounted (fallback)"
+else
+  echo "Web container: no legacy assets to mount"
+fi
+
+echo "Starting Web container..."
+docker run -d \
+  --name xiaoxia-web-production \
+  --network xiaoxia-net-production \
+  -p 127.0.0.1:3002:80 \
+  --restart unless-stopped \
+  --cpus 0.5 \
+  --memory 512m \
+  $LEGACY_VOLUME \
+  --health-cmd "wget --spider -q http://127.0.0.1:80" \
+  --health-interval 30s \
+  --health-timeout 5s \
+  --health-retries 3 \
+  $LOG_OPTS \
+  "$LOCAL_WEB"
+
+# ---- 等待 API 健康 ----
+echo "Waiting for API to become healthy..."
+i=0
+while [ "$i" -lt 40 ]; do
+  if curl -sf --max-time 5 http://127.0.0.1:8001/health >/dev/null 2>&1; then
+    echo "API is healthy!"
+    break
+  fi
+  i=$((i + 1))
+  echo "  Waiting... ($i/40)"
+  sleep 3
+done
+
+if [ "$i" -ge 40 ]; then
+  echo "ERROR: API did not become healthy within 120s"
+  docker logs --tail 50 xiaoxia-api-production
+  exit 1
+fi
+
+# ---- 等待 Web 健康 ----
+echo "Waiting for Web to become healthy..."
+i=0
+while [ "$i" -lt 15 ]; do
+  if curl -sf --max-time 5 http://127.0.0.1:3002/ >/dev/null 2>&1; then
+    echo "Web is healthy!"
+    break
+  fi
+  i=$((i + 1))
+  echo "  Waiting... ($i/15)"
+  sleep 2
+done
+
+if [ "$i" -ge 15 ]; then
+  echo "ERROR: Web did not become healthy within 30s"
+  docker logs --tail 30 xiaoxia-web-production
+  exit 1
+fi
+
+# ---- 清理旧镜像 ----
+echo "Cleaning up old images..."
+docker image prune -af --filter "until=168h" 2>/dev/null || true
+docker builder prune -af --filter "until=168h" 2>/dev/null || true
+
+echo ""
+echo "=== Production deployment complete ==="
+echo "API:      http://127.0.0.1:8001"
+echo "Web:      http://127.0.0.1:3002"
+echo "Version:  $IMAGE_TAG"
+docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep production

infra/docker/deploy-staging-registry.sh

@@ -0,0 +1,178 @@
+#!/bin/sh
+set -eu
+
+# ============================================
+# Staging 部署脚本 - Registry 方式
+# 用法：IMAGE_TAG=<sha|version> REGISTRY_TOKEN=<token> sh deploy-staging.sh
+# ============================================
+
+IMAGE_TAG="${IMAGE_TAG:-}"
+REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
+REGISTRY_USER="${REGISTRY_USER:-xiaoxia}"
+REGISTRY_TOKEN="${REGISTRY_TOKEN:-}"
+
+ENV_FILE="${ENV_FILE:-/var/lib/xiaoxia-saas-staging/.env}"
+COMPOSE_DIR="${COMPOSE_DIR:-/var/lib/xiaoxia-saas-staging/repo/infra/docker}"
+GENERATED_DIR="${GENERATED_DIR:-/var/lib/xiaoxia-saas-staging/generated}"
+
+if [ -z "$IMAGE_TAG" ]; then
+  echo "ERROR: IMAGE_TAG is required"
+  exit 1
+fi
+
+test -f "$ENV_FILE"
+mkdir -p "$GENERATED_DIR"
+
+# ---- 登录 Registry ----
+if [ -n "$REGISTRY_TOKEN" ]; then
+  echo "Logging in to registry: $REGISTRY"
+  printf %s "$REGISTRY_TOKEN" | docker login "$(echo $REGISTRY | cut -d/ -f1)" -u "$REGISTRY_USER" --password-stdin 2>/dev/null || {
+    echo "WARN: docker login failed, will try to pull anyway"
+  }
+fi
+
+# ---- Pull 三镜像 ----
+REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:${IMAGE_TAG}"
+REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:${IMAGE_TAG}"
+REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:${IMAGE_TAG}"
+
+LOCAL_API="${REGISTRY}/xiaoxia-saas-api:staging"
+LOCAL_WORKER="${REGISTRY}/xiaoxia-saas-worker:staging"
+LOCAL_WEB="${REGISTRY}/xiaoxia-saas-web:staging"
+
+echo "Pulling API image..."
+docker pull "$REGISTRY_API"
+echo "Pulling Worker image..."
+docker pull "$REGISTRY_WORKER"
+echo "Pulling Web image..."
+docker pull "$REGISTRY_WEB"
+
+# ---- Re-tag 成本地名 ----
+docker tag "$REGISTRY_API" "$LOCAL_API"
+docker tag "$REGISTRY_WORKER" "$LOCAL_WORKER"
+docker tag "$REGISTRY_WEB" "$LOCAL_WEB"
+echo "All images pulled and tagged."
+
+# ---- 确保基础设施容器在运行 ----
+for c in xiaoxia-postgres-staging xiaoxia-redis-staging; do
+  if ! docker inspect "$c" >/dev/null 2>&1; then
+    echo "ERROR: Required container not found: $c"
+    exit 1
+  fi
+  state=$(docker inspect -f {{.State.Status}} "$c")
+  if [ "$state" != "running" ]; then
+    echo "ERROR: Container not running: $c ($state)"
+    exit 1
+  fi
+done
+
+# ---- 确保 staging 网络存在 ----
+docker network create xiaoxia-net-staging 2>/dev/null || true
+
+# ---- 执行数据库 Migration ----
+echo "Running database migrations..."
+docker run --rm --env-file "$ENV_FILE" --network xiaoxia-net-staging "$LOCAL_API" sh -c "cd /app && alembic upgrade head"
+echo "Migrations completed."
+
+# ---- 停止旧容器 ----
+docker rm -f xiaoxia-api-staging 2>/dev/null || true
+docker rm -f xiaoxia-worker-staging 2>/dev/null || true
+docker rm -f xiaoxia-web-staging 2>/dev/null || true
+
+# ---- 启动 API ----
+echo "Starting API container..."
+docker run -d \
+  --name xiaoxia-api-staging \
+  --env-file "$ENV_FILE" \
+  --network xiaoxia-net-staging \
+  -p 127.0.0.1:8000:8000 \
+  -e APP_ENV=staging \
+  -e APP_VERSION="$IMAGE_TAG" \
+  -e GENERATED_FILES_DIR=/app/generated \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -v "$GENERATED_DIR:/app/generated" \
+  --restart unless-stopped \
+  --label com.centurylinklabs.watchtower.enable=true \
+  --health-cmd "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\"" \
+  --health-interval 30s \
+  --health-timeout 10s \
+  --health-retries 3 \
+  --health-start-period 40s \
+  "$LOCAL_API"
+
+# ---- 启动 Worker ----
+echo "Starting Worker container..."
+docker run -d \
+  --name xiaoxia-worker-staging \
+  --env-file "$ENV_FILE" \
+  --network xiaoxia-net-staging \
+  -e APP_ENV=staging \
+  -e APP_VERSION="$IMAGE_TAG" \
+  -e WORKER_CONCURRENCY=1 \
+  -e WORKER_MAX_TASKS_PER_CHILD=100 \
+  -e GENERATED_FILES_DIR=/app/generated \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -v "$GENERATED_DIR:/app/generated" \
+  --restart unless-stopped \
+  --label com.centurylinklabs.watchtower.enable=true \
+  --health-cmd "sh -c \"grep -q celery /proc/1/cmdline || exit 1\"" \
+  --health-interval 30s \
+  --health-timeout 10s \
+  --health-retries 3 \
+  --health-start-period 30s \
+  "$LOCAL_WORKER"
+
+# ---- 启动 Web ----
+# Web 镜像默认打包 production nginx.conf，staging 需要挂载 staging 配置
+NGINX_CONF="${NGINX_CONF:-${COMPOSE_DIR}/nginx-staging.conf}"
+if [ ! -f "$NGINX_CONF" ]; then
+  echo "WARN: nginx config not found at $NGINX_CONF, using image default"
+  NGINX_VOLUME=""
+else
+  NGINX_VOLUME="-v ${NGINX_CONF}:/etc/nginx/conf.d/default.conf:ro"
+fi
+
+echo "Starting Web container..."
+docker run -d \
+  --name xiaoxia-web-staging \
+  --network xiaoxia-net-staging \
+  -p 127.0.0.1:3001:80 \
+  --restart unless-stopped \
+  --label com.centurylinklabs.watchtower.enable=true \
+  $NGINX_VOLUME \
+  --health-cmd "wget --spider -q http://127.0.0.1:80" \
+  --health-interval 30s \
+  --health-timeout 5s \
+  --health-retries 3 \
+  "$LOCAL_WEB"
+
+# ---- 等待 API 健康 ----
+echo "Waiting for API to become healthy..."
+i=0
+while [ "$i" -lt 30 ]; do
+  if curl -sf --max-time 5 http://127.0.0.1:8000/health >/dev/null 2>&1; then
+    echo "API is healthy!"
+    break
+  fi
+  i=$((i + 1))
+  echo "  Waiting... ($i/30)"
+  sleep 2
+done
+
+if [ "$i" -ge 30 ]; then
+  echo "ERROR: API did not become healthy within 60s"
+  docker logs --tail 30 xiaoxia-api-staging
+  exit 1
+fi
+
+# ---- 清理旧镜像 ----
+docker image prune -af --filter "until=72h" 2>/dev/null || true
+
+echo ""
+echo "=== Staging deployment complete ==="
+echo "API:      http://127.0.0.1:8000"
+echo "Web:      http://127.0.0.1:3001"
+echo "Version:  $IMAGE_TAG"
+docker ps --format "table {{.Names}}\t{{.Status}}" | grep staging
+
+# Watchtower auto-update: 容器加com.centurylinklabs.watchtower.enable=true标签，用:staging tag启动

infra/docker/nginx-production.conf

@@ -39,6 +39,15 @@ server {
         alias /app/generated/;
     }
 
+    # Assets with legacy fallback (higher priority than generic static regex)
+    # 部署期间，缓存了旧版 index.html 的用户会请求旧版带 hash 的 assets 文件
+    # 先在当前镜像中找，找不到去 legacy-assets 目录找（从旧版本容器中备份的）
+    location ^~ /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        try_files $uri /assets-legacy$uri =404;
+    }
+
     # Cache static assets
     location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
         expires 1y;

infra/docker/web-artifact.Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.m.daocloud.io/library/nginx:alpine AS runner
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/nginx:alpine AS runner
 ARG NGINX_CONF=infra/docker/nginx.conf
 WORKDIR /usr/share/nginx/html
 COPY apps/web/dist ./

infra/docker/web.Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM docker.m.daocloud.io/library/node:20 AS builder
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/node:20 AS builder
 WORKDIR /app
 ARG VITE_API_URL=https://saas-api.xiaoxiajianji.com
 ENV VITE_API_URL=$VITE_API_URL
@@ -11,7 +11,7 @@ COPY apps/web/ ./
 RUN npm run build
 
 # Production stage with nginx
-FROM docker.m.daocloud.io/library/nginx:alpine AS runner
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/nginx:alpine AS runner
 ARG NGINX_CONF=infra/docker/nginx.conf
 WORKDIR /usr/share/nginx/html
 COPY --from=builder /app/apps/web/dist ./

infra/docker/worker-base-builder.Dockerfile

@@ -0,0 +1,43 @@
+# ============================================================
+# Worker Builder 基础镜像
+# 预编译：编译工具 + 基础依赖 + Worker大包
+# 当 requirements-base.txt 或 requirements-worker.txt 变更时重新构建
+# 业务构建从此镜像开始，只需要安装业务依赖，节省15+分钟
+# ============================================================
+
+FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim
+
+# 使用阿里云镜像加速
+RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
+    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
+
+# 安装编译工具
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    g++ \
+    python3-dev \
+    binutils \
+    && rm -rf /var/lib/apt/lists/*
+
+# 创建 venv
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+WORKDIR /tmp
+
+# 基础依赖（变化极少）
+COPY requirements-base.txt /tmp/requirements-base.txt
+RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
+    pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
+    -r /tmp/requirements-base.txt \
+    && rm /tmp/requirements-base.txt
+
+# Worker 大包（变化少）
+COPY requirements-worker.txt /tmp/requirements-worker.txt
+RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
+    pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
+    -r /tmp/requirements-worker.txt \
+    && rm /tmp/requirements-worker.txt
+
+# 预先做一次 strip（基础层瘦身，业务层增量）
+RUN find /opt/venv -name "*.so" -type f -exec strip --strip-all {} \; 2>/dev/null || true

infra/docker/worker-base-runtime.Dockerfile

@@ -0,0 +1,17 @@
+# ============================================================
+# Worker Runtime 基础镜像
+# 预安装：ffmpeg + 运行时依赖
+# 变化极少，业务构建从此镜像开始
+# ============================================================
+
+FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim
+
+# 使用阿里云镜像加速
+RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
+    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
+
+# 运行时依赖：ffmpeg + opencv需要的libglib
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ffmpeg \
+    libglib2.0-0 \
+    && rm -rf /var/lib/apt/lists/*

infra/docker/worker.Dockerfile

@@ -4,7 +4,7 @@
 # ============================================================
 
 # 基础镜像：Python 3.12 + ffmpeg
-FROM python:3.12-slim-bookworm
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/python:3.12-slim-bookworm
 
 # 使用阿里云镜像加速
 RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \

packages/adapters/in_memory/asset_repository.py

@@ -42,3 +42,50 @@ class InMemoryAssetRepository:
             del self._assets[asset_id]
             return True
         return False
+
+    def batch_delete(self, asset_ids: list[str]) -> int:
+        """批量删除素材，返回实际删除数量。"""
+        count = 0
+        for aid in asset_ids:
+            if aid in self._assets:
+                del self._assets[aid]
+                count += 1
+        return count
+
+    def find_by_project(
+        self,
+        project_id: str,
+        skip: int = 0,
+        limit: int = 100,
+    ) -> list[Asset]:
+        items = [a for a in self._assets.values() if a.project_id == project_id]
+        return items[skip : skip + limit]
+
+    def find_by_id(self, asset_id: str) -> Asset | None:
+        return self._assets.get(asset_id)
+
+    def find_by_tag_ids(
+        self,
+        tag_ids: list[str],
+        skip: int = 0,
+        limit: int = 100,
+    ) -> list[Asset]:
+        """查找包含所有指定标签的素材。"""
+        if not tag_ids:
+            return []
+        tag_set = set(tag_ids)
+        items = [a for a in self._assets.values() if tag_set.issubset(set(a.tag_ids))]
+        return items[skip : skip + limit]
+
+    def find_by_library_and_file_hash(
+        self,
+        library_id: str,
+        file_hash: str,
+    ) -> Asset | None:
+        """按素材库 + 文件哈希查找已有素材（去重检测）。"""
+        if not file_hash:
+            return None
+        for asset in self._assets.values():
+            if asset.library_id == library_id and asset.file_hash == file_hash:
+                return asset
+        return None

packages/adapters/in_memory/tag_repository.py

@@ -0,0 +1,40 @@
+"""标签 InMemory 仓储实现。"""
+
+from packages.domain import Tag
+
+
+class InMemoryTagRepository:
+    def __init__(self):
+        self._tags: dict[str, Tag] = {}
+
+    def create(self, tag: Tag) -> Tag:
+        self._tags[tag.id] = tag
+        return tag
+
+    def get(self, tag_id: str) -> Tag | None:
+        return self._tags.get(tag_id)
+
+    def find_by_name(self, user_id: str, name: str) -> Tag | None:
+        for tag in self._tags.values():
+            if tag.user_id == user_id and tag.name == name:
+                return tag
+        return None
+
+    def list_by_user(
+        self,
+        user_id: str,
+        skip: int = 0,
+        limit: int = 100,
+    ) -> list[Tag]:
+        tags = [tag for tag in self._tags.values() if tag.user_id == user_id]
+        tags.sort(key=lambda t: t.created_at, reverse=True)
+        return tags[skip : skip + limit]
+
+    def count_by_user(self, user_id: str) -> int:
+        return sum(1 for tag in self._tags.values() if tag.user_id == user_id)
+
+    def delete(self, tag_id: str) -> bool:
+        if tag_id in self._tags:
+            del self._tags[tag_id]
+            return True
+        return False

packages/adapters/sqlalchemy_impl/asset_repository.py

@@ -3,7 +3,7 @@ from datetime import datetime, timezone
 
 from sqlalchemy.orm import Session
 
-from packages.adapters.sqlalchemy_impl.models import AssetModel
+from packages.adapters.sqlalchemy_impl.models import AssetModel, AssetTagModel
 from packages.domain import Asset, AssetStatus, ClassificationStatus
 
 
@@ -83,10 +83,13 @@ class SQLAlchemyAssetRepository:
             classification_result=(json.dumps(asset.metadata) if asset.metadata else None),
             quality_score=asset.quality_score,
             uploaded_by_user_id=asset.uploaded_by_user_id or "system",
+            file_hash=asset.file_hash or None,
             created_at=asset.created_at,
             updated_at=now,
         )
         self.session.add(model)
+        self.session.flush()
+        self._sync_asset_tags(asset.id, asset.tag_ids)
         self.session.commit()
         return asset
 
@@ -108,7 +111,10 @@ class SQLAlchemyAssetRepository:
         model.classification_result = json.dumps(asset.metadata) if asset.metadata else None
         model.quality_score = asset.quality_score
         model.uploaded_by_user_id = asset.uploaded_by_user_id or model.uploaded_by_user_id
+        model.file_hash = asset.file_hash or model.file_hash
         model.updated_at = datetime.now(timezone.utc)
+        self.session.flush()
+        self._sync_asset_tags(asset.id, asset.tag_ids)
         self.session.commit()
         return asset
 
@@ -120,6 +126,14 @@ class SQLAlchemyAssetRepository:
             return True
         return False
 
+    def batch_delete(self, asset_ids: list[str]) -> int:
+        """批量删除素材，返回实际删除数量。"""
+        if not asset_ids:
+            return 0
+        count = self.session.query(AssetModel).filter(AssetModel.id.in_(asset_ids)).delete(synchronize_session=False)
+        self.session.commit()
+        return count
+
     def count_by_project(self, project_id: str) -> int:
         return self.session.query(AssetModel).filter(AssetModel.project_id == project_id).count()
 
@@ -195,6 +209,11 @@ class SQLAlchemyAssetRepository:
                 "audio": "audio/mpeg",
                 "image": "image/jpeg",
             }.get(mime_type, mime_type)
+        # 查询关联的 tag_ids
+        tag_ids = [
+            row.tag_id
+            for row in self.session.query(AssetTagModel.tag_id).filter(AssetTagModel.asset_id == model.id).all()
+        ]
         return Asset(
             id=model.id,
             project_id=model.project_id,
@@ -213,7 +232,61 @@ class SQLAlchemyAssetRepository:
             classification_status=ClassificationStatus(model.classification_status),
             quality_score=model.quality_score,
             uploaded_by_user_id=model.uploaded_by_user_id,
+            file_hash=model.file_hash or "",
             metadata=metadata,
+            tag_ids=tag_ids,
             created_at=model.created_at,
             updated_at=model.updated_at,
         )
+
+    def _sync_asset_tags(self, asset_id: str, tag_ids: list[str]) -> None:
+        """同步素材-标签关联表（全量替换）。"""
+        self.session.query(AssetTagModel).filter(AssetTagModel.asset_id == asset_id).delete(synchronize_session=False)
+        for tag_id in tag_ids:
+            self.session.add(AssetTagModel(asset_id=asset_id, tag_id=tag_id))
+
+    def find_by_tag_ids(
+        self,
+        tag_ids: list[str],
+        skip: int = 0,
+        limit: int = 100,
+    ) -> list[Asset]:
+        """查找包含所有指定标签的素材。"""
+        if not tag_ids:
+            return []
+        from sqlalchemy import func
+
+        # 找出同时拥有所有指定 tag_id 的 asset_id
+        tag_set = set(tag_ids)
+        asset_ids = (
+            self.session.query(AssetTagModel.asset_id)
+            .filter(AssetTagModel.tag_id.in_(tag_set))
+            .group_by(AssetTagModel.asset_id)
+            .having(func.count(AssetTagModel.tag_id) == len(tag_set))
+            .all()
+        )
+        ids = [row[0] for row in asset_ids]
+        if not ids:
+            return []
+        models = self.session.query(AssetModel).filter(AssetModel.id.in_(ids)).offset(skip).limit(limit).all()
+        return [self._to_domain(m) for m in models]
+
+    def find_by_library_and_file_hash(
+        self,
+        library_id: str,
+        file_hash: str,
+    ) -> Asset | None:
+        """按素材库 + 文件哈希查找已有素材（去重检测）。"""
+        if not file_hash:
+            return None
+        model = (
+            self.session.query(AssetModel)
+            .filter(
+                AssetModel.asset_library_id == library_id,
+                AssetModel.file_hash == file_hash,
+            )
+            .first()
+        )
+        if model is None:
+            return None
+        return self._to_domain(model)

packages/adapters/sqlalchemy_impl/generated_video_repository.py

@@ -78,7 +78,7 @@ class SQLAlchemyGeneratedVideoRepository:
 
     def list_by_project(self, project_id: str) -> list[GeneratedVideo]:
         models = self.session.query(GeneratedVideoModel).filter(GeneratedVideoModel.project_id == project_id).all()
-        return [self.get(model.id) for model in models if self.get(model.id) is not None]
+        return [self._to_domain(model) for model in models]
 
     def list_by_generation_task(self, generation_task_id: str) -> list[GeneratedVideo]:
         models = (
@@ -86,4 +86,40 @@ class SQLAlchemyGeneratedVideoRepository:
             .filter(GeneratedVideoModel.generation_task_id == generation_task_id)
             .all()
         )
-        return [self.get(model.id) for model in models if self.get(model.id) is not None]
+        return [self._to_domain(model) for model in models]
+
+    def list_by_batch(self, batch_id: str) -> list[GeneratedVideo]:
+        """通过 batch_id 查找同批次生成的所有视频（跨 generation_task 关联查询）。"""
+        from packages.adapters.sqlalchemy_impl.models import GenerationTaskModel
+
+        task_ids = (
+            self.session.query(GenerationTaskModel.id).filter(GenerationTaskModel.batch_id == batch_id).subquery()
+        )
+        models = (
+            self.session.query(GeneratedVideoModel).filter(GeneratedVideoModel.generation_task_id.in_(task_ids)).all()
+        )
+        return [self._to_domain(model) for model in models]
+
+    @staticmethod
+    def _to_domain(model: GeneratedVideoModel) -> GeneratedVideo:
+        return GeneratedVideo(
+            id=model.id,
+            project_id=model.project_id,
+            generation_task_id=model.generation_task_id,
+            name=model.name,
+            file_url=model.file_url,
+            file_size=int(model.file_size or 0),
+            duration=model.duration,
+            thumbnail_url=model.thumbnail_url,
+            width=int(model.width or 0),
+            height=int(model.height or 0),
+            fps=model.fps,
+            status=getattr(model, "status", "completed"),
+            review_status=getattr(model, "review_status", "pending_review"),
+            generation_params=json.loads(getattr(model, "generation_params", "{}") or "{}"),
+            video_fingerprint=json.loads(getattr(model, "video_fingerprint", "null") or "null"),
+            is_duplicate=getattr(model, "is_duplicate", False),
+            duplicate_of=getattr(model, "duplicate_of", None),
+            generated_at=model.generated_at,
+            created_at=model.created_at,
+        )

packages/adapters/sqlalchemy_impl/generation_task_repository.py

@@ -25,6 +25,8 @@ def _to_domain(model: GenerationTaskModel) -> GenerationTask:
         completed_at=model.completed_at,
         created_by_user_id=model.created_by_user_id,
         source_edit_plan_id=model.source_edit_plan_id or "",
+        asset_select_mode=model.asset_select_mode or "",
+        batch_id=model.batch_id or "",
         created_at=model.created_at,
     )
 
@@ -52,6 +54,8 @@ class SQLAlchemyGenerationTaskRepository:
             completed_at=task.completed_at,
             created_by_user_id=task.created_by_user_id,
             source_edit_plan_id=task.source_edit_plan_id or None,
+            asset_select_mode=task.asset_select_mode or "",
+            batch_id=task.batch_id or "",
             created_at=task.created_at,
         )
         self.session.add(model)
@@ -123,5 +127,7 @@ class SQLAlchemyGenerationTaskRepository:
         model.started_at = task.started_at
         model.completed_at = task.completed_at
         model.source_edit_plan_id = task.source_edit_plan_id or None
+        model.asset_select_mode = task.asset_select_mode or ""
+        model.batch_id = task.batch_id or ""
         self.session.commit()
         return task

packages/adapters/sqlalchemy_impl/ingest_job_repository.py

@@ -17,6 +17,7 @@ class SQLAlchemyIngestJobRepository:
             status=job.status.value,
             error_message=job.error_message,
             result_asset_id=job.result_asset_id,
+            file_hash=job.file_hash,
             created_at=job.created_at,
             updated_at=job.updated_at,
         )
@@ -36,6 +37,7 @@ class SQLAlchemyIngestJobRepository:
             status=IngestJobStatus(model.status),
             error_message=model.error_message,
             result_asset_id=model.result_asset_id,
+            file_hash=model.file_hash or "",
             created_at=model.created_at,
             updated_at=model.updated_at,
         )
@@ -51,6 +53,7 @@ class SQLAlchemyIngestJobRepository:
         model.status = job.status.value
         model.error_message = job.error_message
         model.result_asset_id = job.result_asset_id
+        model.file_hash = job.file_hash
         model.updated_at = job.updated_at
         self.session.commit()
         return job

packages/adapters/sqlalchemy_impl/models.py

@@ -85,11 +85,35 @@ class AssetModel(Base):
     classification_result = Column(Text, nullable=True)
     quality_score = Column(Float, nullable=True)
     uploaded_by_user_id = Column(String(36), nullable=False)
+    file_hash = Column(String(64), nullable=True, index=True)
     extra_meta = Column("metadata", JSON, nullable=False, default=dict)
     created_at = Column(DateTime, nullable=False, default=lambda: datetime.now(timezone.utc), index=True)
     updated_at = Column(DateTime, nullable=False, default=lambda: datetime.now(timezone.utc))
 
 
+class TagModel(Base):
+    """标签 ORM 模型。"""
+
+    __tablename__ = "tags"
+
+    id = Column(String(36), primary_key=True)
+    user_id = Column(String(36), nullable=False, index=True)
+    name = Column(String(100), nullable=False)
+    created_at = Column(DateTime, nullable=False, default=lambda: datetime.now(timezone.utc))
+
+    __table_args__ = (UniqueConstraint("user_id", "name", name="uq_tags_user_name"),)
+
+
+class AssetTagModel(Base):
+    """素材-标签关联表 ORM 模型。"""
+
+    __tablename__ = "asset_tags"
+
+    asset_id = Column(String(36), primary_key=True)
+    tag_id = Column(String(36), primary_key=True)
+    created_at = Column(DateTime, nullable=False, default=lambda: datetime.now(timezone.utc))
+
+
 class EditTemplateModel(Base):
     """Phase 8 剪辑模板 ORM 模型
 
@@ -187,6 +211,7 @@ class IngestJobModel(Base):
     status = Column(String(20), nullable=False, default="pending")
     error_message = Column(Text, nullable=False, default="")
     result_asset_id = Column(String(32), nullable=False, default="")
+    file_hash = Column(String(64), nullable=True, index=True)
     created_at = Column(DateTime, nullable=False, default=lambda: datetime.now(timezone.utc))
     updated_at = Column(DateTime, nullable=False, default=lambda: datetime.now(timezone.utc))
 
@@ -228,6 +253,8 @@ class GenerationTaskModel(Base):
     completed_at = Column(DateTime, nullable=True)
     created_by_user_id = Column(String(32), nullable=False, default="", index=True)
     source_edit_plan_id = Column(String(32), nullable=True, index=True)
+    asset_select_mode = Column(String(20), nullable=False, default="")
+    batch_id = Column(String(32), nullable=False, default="", index=True)
     extra_meta = Column("metadata", JSON, nullable=False, default=dict)
     created_at = Column(DateTime, nullable=False, default=lambda: datetime.now(timezone.utc))
 

packages/adapters/sqlalchemy_impl/tag_repository.py

@@ -0,0 +1,73 @@
+"""标签 SQLAlchemy 仓储实现。"""
+
+from sqlalchemy.orm import Session
+
+from packages.adapters.sqlalchemy_impl.models import AssetTagModel, TagModel
+from packages.domain import Tag
+
+
+class SQLAlchemyTagRepository:
+    def __init__(self, session: Session):
+        self.session = session
+
+    def create(self, tag: Tag) -> Tag:
+        model = TagModel(
+            id=tag.id,
+            user_id=tag.user_id,
+            name=tag.name,
+            created_at=tag.created_at,
+        )
+        self.session.add(model)
+        self.session.commit()
+        return tag
+
+    def get(self, tag_id: str) -> Tag | None:
+        model = self.session.query(TagModel).filter(TagModel.id == tag_id).first()
+        if model is None:
+            return None
+        return self._to_domain(model)
+
+    def find_by_name(self, user_id: str, name: str) -> Tag | None:
+        model = self.session.query(TagModel).filter(TagModel.user_id == user_id, TagModel.name == name).first()
+        if model is None:
+            return None
+        return self._to_domain(model)
+
+    def list_by_user(
+        self,
+        user_id: str,
+        skip: int = 0,
+        limit: int = 100,
+    ) -> list[Tag]:
+        models = (
+            self.session.query(TagModel)
+            .filter(TagModel.user_id == user_id)
+            .order_by(TagModel.created_at.desc())
+            .offset(skip)
+            .limit(limit)
+            .all()
+        )
+        return [self._to_domain(m) for m in models]
+
+    def count_by_user(self, user_id: str) -> int:
+        return self.session.query(TagModel).filter(TagModel.user_id == user_id).count()
+
+    def delete(self, tag_id: str) -> bool:
+        # 先清理关联表
+        self.session.query(AssetTagModel).filter(AssetTagModel.tag_id == tag_id).delete(synchronize_session=False)
+        model = self.session.query(TagModel).filter(TagModel.id == tag_id).first()
+        if model is None:
+            self.session.commit()
+            return False
+        self.session.delete(model)
+        self.session.commit()
+        return True
+
+    @staticmethod
+    def _to_domain(model: TagModel) -> Tag:
+        return Tag(
+            id=model.id,
+            user_id=model.user_id,
+            name=model.name,
+            created_at=model.created_at,
+        )

packages/application/generation_tasks.py

@@ -19,6 +19,8 @@ class CreateGenerationTaskCommand:
     voice_ids: list[str] = field(default_factory=list)
     created_by_user_id: str = ""
     source_edit_plan_id: str = ""
+    asset_select_mode: str = ""
+    batch_id: str = ""
 
 
 class CreateGenerationTaskUseCase:
@@ -44,6 +46,8 @@ class CreateGenerationTaskUseCase:
             completed_at=None,
             created_by_user_id=command.created_by_user_id,
             source_edit_plan_id=command.source_edit_plan_id,
+            asset_select_mode=command.asset_select_mode,
+            batch_id=command.batch_id,
         )
         return self.generation_task_repository.create(task)
 

packages/application/ingest_jobs.py

@@ -11,6 +11,7 @@ class SubmitIngestJobCommand:
     project_id: str
     library_id: str
     storage_key: str
+    file_hash: str = ""
 
 
 class SubmitIngestJobUseCase:
@@ -22,5 +23,6 @@ class SubmitIngestJobUseCase:
             project_id=command.project_id,
             library_id=command.library_id,
             storage_key=command.storage_key,
+            file_hash=command.file_hash,
         )
         return self.ingest_job_repository.create(job)

packages/application/tts_job/audio_merger.py

@@ -0,0 +1,96 @@
+"""FFmpeg 音频合并器 — P1 长文本分段合成。
+
+将多个分段音频文件合并为一个完整音频文件。
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import shutil
+import subprocess
+import tempfile
+
+logger = logging.getLogger(__name__)
+
+
+class AudioMergeError(Exception):
+    """音频合并异常。"""
+
+    pass
+
+
+class AudioMerger:
+    """使用 FFmpeg 合并多个音频文件。"""
+
+    def merge(self, audio_paths: list[str], output_format: str = "mp3") -> bytes:
+        """合并多个音频文件，返回合并后的音频数据。
+
+        使用 FFmpeg concat demuxer 按顺序拼接音频。
+        所有输入文件必须为相同格式和采样率。
+
+        Args:
+            audio_paths: 音频文件路径列表（按合成顺序）
+            output_format: 输出格式（mp3/wav/pcm）
+
+        Returns:
+            合并后的音频文件字节数据
+
+        Raises:
+            AudioMergeError: 合并失败
+        """
+        if not audio_paths:
+            raise AudioMergeError("没有可合并的音频文件")
+
+        if len(audio_paths) == 1:
+            with open(audio_paths[0], "rb") as f:
+                return f.read()
+
+        temp_dir = tempfile.mkdtemp(prefix="tts_merge_")
+        try:
+            # 生成 concat demuxer 列表文件
+            list_path = os.path.join(temp_dir, "concat_list.txt")
+            with open(list_path, "w") as f:
+                for path in audio_paths:
+                    # FFmpeg concat 文件需要 file: 前缀，路径中的 ' 和 \n 需转义
+                    escaped = path.replace("'", "'\\''").replace("\n", "\\n")
+                    f.write(f"file '{escaped}'\n")
+
+            output_path = os.path.join(temp_dir, f"merged.{output_format}")
+
+            cmd = [
+                "ffmpeg",
+                "-y",
+                "-f",
+                "concat",
+                "-safe",
+                "0",
+                "-i",
+                list_path,
+                "-c",
+                "copy",
+                output_path,
+            ]
+
+            result = subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                timeout=120,
+            )
+
+            if result.returncode != 0:
+                logger.error(f"FFmpeg 合并失败: stderr={result.stderr}")
+                raise AudioMergeError(f"FFmpeg 合并失败: {result.stderr[:500]}")
+
+            with open(output_path, "rb") as f:
+                return f.read()
+
+        except subprocess.TimeoutExpired:
+            raise AudioMergeError("FFmpeg 合并超时（120 秒）")
+        except AudioMergeError:
+            raise
+        except Exception as e:
+            raise AudioMergeError(f"音频合并失败: {e}")
+        finally:
+            shutil.rmtree(temp_dir, ignore_errors=True)

packages/application/tts_job/streaming_service.py

@@ -0,0 +1,251 @@
+"""P2: TTS 流式合成服务 — WebSocket 实时音频推送。
+
+通过 WebSocket 将合成音频以二进制帧实时推送给客户端。
+- 短文本（≤500 字）：合成完整音频后分块推送
+- 长文本（>500 字）：分段并发合成，逐段推送音频
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import Any, Optional
+
+import httpx
+
+from packages.application.cosyvoice_service import CosyVoiceError, CosyVoiceService
+from packages.application.tts_job.text_splitter import split_text
+
+logger = logging.getLogger(__name__)
+
+# WebSocket 二进制帧块大小（4KB）
+_AUDIO_CHUNK_SIZE = 4096
+# 分段并发上限
+_MAX_STREAMING_SEGMENT_WORKERS = 5
+# 长文本分段阈值
+_SEGMENT_THRESHOLD = 500
+# WebSocket 最大文本长度
+_MAX_TEXT_LENGTH = 10000
+
+
+class TTSStreamingError(Exception):
+    """TTS 流式合成异常。"""
+
+    pass
+
+
+class TTSStreamingService:
+    """TTS 流式合成服务。
+
+    通过 WebSocket 实时推送合成音频。
+    使用 CosyVoiceService（同步 REST API）合成，
+    通过 asyncio.to_thread 桥接到异步 WebSocket。
+    """
+
+    def __init__(self, cosyvoice_service: CosyVoiceService) -> None:
+        self._cosyvoice = cosyvoice_service
+
+    async def synthesize_and_stream(self, websocket: Any, params: dict) -> None:
+        """根据文本长度选择流式合成策略。
+
+        Args:
+            websocket: FastAPI WebSocket 连接
+            params: 合成参数（text, voice_id, sample_rate, format, speed）
+        """
+        text = params.get("text", "")
+        if not text:
+            await self._send_json(websocket, {"type": "error", "message": "文本不能为空"})
+            return
+
+        if len(text) > _MAX_TEXT_LENGTH:
+            await self._send_json(
+                websocket,
+                {"type": "error", "message": f"文本过长，最大 {_MAX_TEXT_LENGTH} 字"},
+            )
+            return
+
+        if len(text) <= _SEGMENT_THRESHOLD:
+            await self._stream_short_text(websocket, params)
+        else:
+            await self._stream_long_text(websocket, params)
+
+    # ── 短文本流式合成 ────────────────────────────────────────
+
+    async def _stream_short_text(self, websocket: Any, params: dict) -> None:
+        """短文本：合成完整音频后分块推送。"""
+        text = params["text"]
+        voice_id = params.get("voice_id", "")
+        sample_rate = params.get("sample_rate", 0)
+        audio_format = params.get("format", "mp3")
+        speed = params.get("speed", 1.0)
+
+        await self._send_json(
+            websocket,
+            {"type": "started", "segment_count": 1, "total_segments": 1},
+        )
+
+        # 在线程池中执行同步合成
+        try:
+            result = await asyncio.to_thread(
+                self._cosyvoice.submit_synthesize_task,
+                text=text,
+                voice_id=voice_id,
+                sample_rate=sample_rate,
+                format=audio_format,
+                speed=speed,
+            )
+        except CosyVoiceError as e:
+            logger.error(f"流式合成失败: {e}")
+            await self._send_json(websocket, {"type": "error", "message": str(e)})
+            return
+        except Exception as e:
+            logger.error(f"流式合成意外错误: {e}")
+            await self._send_json(websocket, {"type": "error", "message": f"合成失败: {e}"})
+            return
+
+        audio_url = result.get("audio_url", "")
+        if not audio_url:
+            await self._send_json(websocket, {"type": "error", "message": "合成未返回音频 URL"})
+            return
+
+        # 下载并流式推送音频
+        try:
+            audio_data = await asyncio.to_thread(self._download_audio, audio_url)
+            total_bytes = await self._stream_audio_chunks(websocket, audio_data)
+
+            await self._send_json(
+                websocket,
+                {
+                    "type": "done",
+                    "duration": result.get("duration", 0.0),
+                    "file_size": total_bytes,
+                    "format": audio_format,
+                },
+            )
+        except Exception as e:
+            logger.error(f"音频流式推送失败: {e}")
+            await self._send_json(websocket, {"type": "error", "message": f"音频推送失败: {e}"})
+
+    # ── 长文本分段流式合成 ────────────────────────────────────
+
+    async def _stream_long_text(self, websocket: Any, params: dict) -> None:
+        """长文本：分段并发合成，逐段推送音频。"""
+        text = params["text"]
+        voice_id = params.get("voice_id", "")
+        sample_rate = params.get("sample_rate", 0)
+        audio_format = params.get("format", "mp3")
+        speed = params.get("speed", 1.0)
+
+        segments = split_text(text, max_chars=_SEGMENT_THRESHOLD)
+        segment_count = len(segments)
+
+        logger.info(f"流式分段合成: 原文={len(text)}字, 段数={segment_count}")
+
+        await self._send_json(
+            websocket,
+            {"type": "started", "segment_count": segment_count, "total_segments": segment_count},
+        )
+
+        # 并发合成所有分段，按顺序流式推送
+        queue: asyncio.Queue[tuple[int, Optional[bytes], Optional[str]]] = asyncio.Queue()
+        completed_count = 0
+
+        async def _synthesize_one(idx: int, seg_text: str) -> None:
+            """合成单个分段并放入队列。"""
+            try:
+                result = await asyncio.to_thread(
+                    self._cosyvoice.submit_synthesize_task,
+                    text=seg_text,
+                    voice_id=voice_id,
+                    sample_rate=sample_rate,
+                    format=audio_format,
+                    speed=speed,
+                )
+                audio_url = result.get("audio_url", "")
+                if audio_url:
+                    audio_data = await asyncio.to_thread(self._download_audio, audio_url)
+                    await queue.put((idx, audio_data, None))
+                else:
+                    await queue.put((idx, None, "合成未返回音频 URL"))
+            except Exception as e:
+                await queue.put((idx, None, str(e)))
+
+        # 启动并发合成任务
+        workers = [asyncio.create_task(_synthesize_one(idx, seg)) for idx, seg in enumerate(segments)]
+
+        # 按顺序消费队列，流式推送
+        total_bytes = 0
+        total_duration = 0.0
+        consumed = 0
+
+        try:
+            while consumed < segment_count:
+                idx, audio_data, error = await queue.get()
+                consumed += 1
+
+                if error:
+                    logger.error(f"分段 {idx + 1} 合成失败: {error}")
+                    await self._send_json(
+                        websocket,
+                        {"type": "error", "message": f"分段 {idx + 1} 合成失败: {error}"},
+                    )
+                    # 取消剩余 worker
+                    for w in workers:
+                        w.cancel()
+                    return
+
+                if audio_data:
+                    seg_bytes = await self._stream_audio_chunks(websocket, audio_data)
+                    total_bytes += seg_bytes
+
+                await self._send_json(
+                    websocket,
+                    {"type": "segment_done", "segment": idx + 1, "total": segment_count},
+                )
+
+            # 等待所有 worker 完成
+            await asyncio.gather(*workers, return_exceptions=True)
+
+            await self._send_json(
+                websocket,
+                {
+                    "type": "done",
+                    "duration": total_duration,
+                    "file_size": total_bytes,
+                    "format": audio_format,
+                },
+            )
+
+        except Exception as e:
+            logger.error(f"流式分段推送失败: {e}")
+            await self._send_json(websocket, {"type": "error", "message": f"推送失败: {e}"})
+            for w in workers:
+                w.cancel()
+
+    # ── 工具方法 ────────────────────────────────────────────
+
+    def _download_audio(self, url: str) -> bytes:
+        """下载音频数据。"""
+        resp = httpx.get(url, timeout=60.0, follow_redirects=True)
+        resp.raise_for_status()
+        return resp.content
+
+    async def _stream_audio_chunks(self, websocket: Any, audio_data: bytes) -> int:
+        """将音频数据分块通过 WebSocket 推送。
+
+        Returns:
+            推送的总字节数
+        """
+        total = 0
+        for offset in range(0, len(audio_data), _AUDIO_CHUNK_SIZE):
+            chunk = audio_data[offset : offset + _AUDIO_CHUNK_SIZE]
+            await websocket.send_bytes(chunk)
+            total += len(chunk)
+        return total
+
+    async def _send_json(self, websocket: Any, data: dict) -> None:
+        """安全发送 JSON 帧。"""
+        try:
+            await websocket.send_json(data)
+        except Exception:
+            pass

packages/application/tts_job/text_splitter.py

@@ -0,0 +1,70 @@
+"""长文本分段工具 — P1 长文本分段合成。
+
+将超过阈值的文本按句子边界分段，供 CosyVoice 并发合成后合并。
+"""
+
+from __future__ import annotations
+
+# 中文句子结束符（含全角/半角）
+_SENTENCE_ENDS = frozenset("。！？；\n.!?;")
+
+
+def split_text(text: str, max_chars: int = 500) -> list[str]:
+    """将文本分段，每段不超过 max_chars 个字符。
+
+    优先在句子边界（句号、问号、感叹号、换行符）处分段。
+    若单个句子超过 max_chars，则在逗号等次级标点处拆分。
+    若仍超长，则硬切。
+
+    Args:
+        text: 待分段文本
+        max_chars: 每段最大字符数
+
+    Returns:
+        分段列表，每段 ≤ max_chars。文本为空时返回空列表。
+    """
+    text = text.strip()
+    if not text:
+        return []
+    if len(text) <= max_chars:
+        return [text]
+
+    segments: list[str] = []
+    current = ""
+
+    for char in text:
+        current += char
+        if char in _SENTENCE_ENDS and len(current) >= 50:
+            # 句子边界且长度合理，切段
+            segments.append(current.strip())
+            current = ""
+        elif len(current) >= max_chars:
+            # 达到上限，强制切段
+            segments.append(current.strip())
+            current = ""
+
+    if current.strip():
+        segments.append(current.strip())
+
+    # 合并过短的段（< 50 字符且不是最后一段），减少 API 调用次数
+    merged: list[str] = []
+    buffer = ""
+    for seg in segments:
+        if buffer:
+            combined = buffer + seg
+            if len(combined) <= max_chars:
+                buffer = combined
+                continue
+            merged.append(buffer)
+            buffer = ""
+        if len(seg) < 50:
+            buffer = seg
+        else:
+            merged.append(seg)
+    if buffer:
+        if merged and len(merged[-1]) + len(buffer) <= max_chars:
+            merged[-1] = merged[-1] + buffer
+        else:
+            merged.append(buffer)
+
+    return [s for s in merged if s]

packages/application/tts_job/workflow.py

@@ -9,19 +9,35 @@
 
 from __future__ import annotations
 
+import io
 import logging
+import os
+import shutil
+import tempfile
+import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from typing import Optional
 
+import httpx
+
 from packages.application.cosyvoice_service import (
     CosyVoiceAuthError,
     CosyVoiceError,
     CosyVoiceService,
 )
+from packages.application.tts_job.audio_merger import AudioMergeError, AudioMerger
+from packages.application.tts_job.text_splitter import split_text
 from packages.domain.tts_job import TTSJob, TTSJobStatus
 from packages.ports.tts_job_repository import TTSJobRepository
+from packages.shared.storage import SharedStorageService, get_shared_storage_service
 
 logger = logging.getLogger(__name__)
 
+# 长文本分段阈值：超过此字符数自动分段合成
+_SEGMENT_THRESHOLD = 500
+# 分段并发上限
+_MAX_SEGMENT_WORKERS = 5
+
 
 class TTSWorkflowError(Exception):
     """TTS 合成工作流异常。"""
@@ -46,9 +62,55 @@ class TTSWorkflowService:
         self,
         repository: TTSJobRepository,
         cosyvoice_service: CosyVoiceService,
+        storage_service: Optional[SharedStorageService] = None,
     ) -> None:
         self.repository = repository
         self.cosyvoice_service = cosyvoice_service
+        self._storage_service = storage_service
+
+    @property
+    def _storage(self) -> SharedStorageService:
+        if self._storage_service is None:
+            self._storage_service = get_shared_storage_service()
+        return self._storage_service
+
+    def _transfer_audio_to_oss(
+        self,
+        temp_url: str,
+        user_id: str,
+        job_id: str,
+        audio_format: str = "mp3",
+    ) -> tuple[str, str]:
+        """下载 CosyVoice 临时音频并转存到 OSS。
+
+        Returns:
+            (permanent_url, storage_key) 元组。
+            转存失败时回退到原始临时 URL，storage_key 为空字符串。
+        """
+        storage_key = f"tts-outputs/{user_id}/{job_id}.{audio_format}"
+        content_type_map = {
+            "mp3": "audio/mpeg",
+            "wav": "audio/wav",
+            "pcm": "audio/pcm",
+            "opus": "audio/opus",
+        }
+        content_type = content_type_map.get(audio_format, "application/octet-stream")
+
+        try:
+            # 下载临时音频
+            resp = httpx.get(temp_url, timeout=60.0, follow_redirects=True)
+            resp.raise_for_status()
+            audio_data = resp.content
+
+            # 上传到 OSS
+            file_obj = io.BytesIO(audio_data)
+            permanent_url = self._storage.upload_file(file_obj, storage_key, content_type=content_type)
+            logger.info(f"音频转存 OSS 成功: job_id={job_id}, " f"storage_key={storage_key}, size={len(audio_data)}")
+            return permanent_url, storage_key
+
+        except Exception as e:
+            logger.warning(f"音频转存 OSS 失败，使用临时 URL: " f"job_id={job_id}, error={e}")
+            return temp_url, ""
 
     def start_synthesis(
         self,
@@ -80,6 +142,10 @@ class TTSWorkflowService:
         job.mark_processing()
         job = self.repository.update(job)
 
+        # 长文本自动分段合成
+        if len(job.input_text) > _SEGMENT_THRESHOLD:
+            return self._start_segment_synthesis(job)
+
         try:
             submit_result = self.cosyvoice_service.submit_synthesize_task(
                 text=job.input_text,
@@ -93,17 +159,19 @@ class TTSWorkflowService:
             job_metadata["cosyvoice_task_id"] = submit_result.get("task_id", "")
             job_metadata["cosyvoice_request_id"] = submit_result.get("request_id", "")
 
-            # 如果 CosyVoice 同步返回了 audio_url，直接标记完成
+            # 如果 CosyVoice 同步返回了 audio_url，转存 OSS 后标记完成
             audio_url = submit_result.get("audio_url", "")
             if audio_url:
+                permanent_url, storage_key = self._transfer_audio_to_oss(audio_url, job.user_id, job.id, job.format)
                 job.mark_completed(
-                    output_audio_url=audio_url,
+                    output_audio_url=permanent_url,
+                    output_audio_key=storage_key,
                     duration=submit_result.get("duration", 0.0),
                     file_size=submit_result.get("file_size", 0),
                 )
                 job.metadata = job_metadata
                 job = self.repository.update(job)
-                logger.info(f"TTS 合成同步完成: job_id={job.id}, audio_url={audio_url}")
+                logger.info(f"TTS 合成同步完成: job_id={job.id}, audio_url={permanent_url}")
                 return job
 
             job.metadata = job_metadata
@@ -133,6 +201,11 @@ class TTSWorkflowService:
         if job is None:
             raise TTSJobNotFoundError(f"TTS job {job_id} not found")
 
+        # 检查是否为分段合成任务
+        segment_task_ids = (job.metadata or {}).get("segment_task_ids", [])
+        if segment_task_ids:
+            return self._poll_segment_tasks(job)
+
         task_id = (job.metadata or {}).get("cosyvoice_task_id", "")
         if not task_id:
             raise ValueError(f"TTSJob {job_id} has no cosyvoice_task_id in metadata")
@@ -171,13 +244,17 @@ class TTSWorkflowService:
         if job is None:
             raise TTSJobNotFoundError(f"TTS job {job_id} not found")
 
+        # 转存音频到 OSS，获取永久 URL
+        permanent_url, storage_key = self._transfer_audio_to_oss(audio_url, job.user_id, job.id, job.format)
+
         job.mark_completed(
-            output_audio_url=audio_url,
+            output_audio_url=permanent_url,
+            output_audio_key=storage_key,
             duration=duration,
             file_size=file_size,
         )
         job = self.repository.update(job)
-        logger.info(f"TTS 合成成功: job_id={job_id}, audio_url={audio_url}")
+        logger.info(f"TTS 合成成功: job_id={job_id}, audio_url={permanent_url}")
         return job
 
     def process_synthesis_failure(self, job_id: str, error_message: str) -> TTSJob:
@@ -201,3 +278,224 @@ class TTSWorkflowService:
         job = self.repository.update(job)
         logger.error(f"TTS 合成失败: job_id={job_id}, error={error_message}")
         return job
+
+    # ── P1: 长文本分段合成 ─────────────────────────────────────
+
+    def _upload_merged_to_oss(
+        self, merged_data: bytes, user_id: str, job_id: str, audio_format: str
+    ) -> tuple[str, str]:
+        """上传合并后的音频数据到 OSS。
+
+        Returns:
+            (permanent_url, storage_key) 元组。
+            上传失败时返回 ("", "")。
+        """
+        storage_key = f"tts-outputs/{user_id}/{job_id}.{audio_format}"
+        content_type_map = {
+            "mp3": "audio/mpeg",
+            "wav": "audio/wav",
+            "pcm": "audio/pcm",
+            "opus": "audio/opus",
+        }
+        content_type = content_type_map.get(audio_format, "application/octet-stream")
+        try:
+            file_obj = io.BytesIO(merged_data)
+            permanent_url = self._storage.upload_file(file_obj, storage_key, content_type=content_type)
+            return permanent_url, storage_key
+        except Exception as e:
+            logger.warning(f"分段合并音频转存 OSS 失败: job_id={job_id}, error={e}")
+            return "", ""
+
+    def _start_segment_synthesis(self, job: TTSJob) -> TTSJob:
+        """长文本分段合成入口。
+
+        将文本分段后并发提交到 CosyVoice，根据同步/异步结果走不同路径。
+        """
+        segments = split_text(job.input_text, max_chars=_SEGMENT_THRESHOLD)
+        logger.info(f"长文本分段合成: job_id={job.id}, " f"原文={len(job.input_text)}字, 段数={len(segments)}")
+
+        # 记录分段信息到 metadata
+        job_metadata = dict(job.metadata)
+        job_metadata["segment_count"] = len(segments)
+
+        # 并发提交所有分段
+        results = self._submit_segments_concurrent(segments, job)
+        if results is None:
+            # 提交阶段已失败，_submit_segments_concurrent 内部已标记 failed
+            return self.repository.get(job.id)
+
+        # 判断同步还是异步
+        has_audio_urls = any(r.get("audio_url", "") for r in results)
+        has_task_ids = any(r.get("task_id", "") for r in results)
+
+        if has_audio_urls and not has_task_ids:
+            # 所有分段同步返回音频，直接合并
+            return self._process_segments_sync(job, results)
+
+        # 异步路径：保存各分段的 task_id 供后续轮询
+        segment_task_ids = [r.get("task_id", "") for r in results]
+        segment_audio_urls = [r.get("audio_url", "") for r in results]
+        job_metadata["segment_task_ids"] = segment_task_ids
+        job_metadata["segment_audio_urls"] = segment_audio_urls
+        job_metadata["segment_format"] = job.format
+
+        job.metadata = job_metadata
+        job = self.repository.update(job)
+        logger.info(f"分段合成任务已提交（异步）: job_id={job.id}, " f"段数={len(segments)}")
+        return job
+
+    def _submit_segments_concurrent(self, segments: list[str], job: TTSJob) -> list[dict] | None:
+        """并发提交分段合成任务。
+
+        Returns:
+            各分段的结果列表（保持顺序），提交失败时返回 None。
+        """
+        max_workers = min(len(segments), _MAX_SEGMENT_WORKERS)
+        results: list[dict | None] = [None] * len(segments)
+
+        with ThreadPoolExecutor(max_workers=max_workers) as executor:
+            future_to_idx = {}
+            for idx, segment_text in enumerate(segments):
+                future = executor.submit(
+                    self.cosyvoice_service.submit_synthesize_task,
+                    text=segment_text,
+                    voice_id=job.voice_id,
+                    sample_rate=job.sample_rate,
+                    format=job.format,
+                )
+                future_to_idx[future] = idx
+
+            for future in as_completed(future_to_idx):
+                idx = future_to_idx[future]
+                try:
+                    results[idx] = future.result()
+                except Exception as e:
+                    logger.error(f"分段合成提交失败: job_id={job.id}, " f"segment={idx}, error={e}")
+                    self._handle_segment_failure(job, f"分段 {idx + 1} 合成提交失败: {e}")
+                    return None
+
+        return results  # type: ignore[return-value]
+
+    def _process_segments_sync(self, job: TTSJob, results: list[dict]) -> TTSJob:
+        """同步路径：所有分段已返回 audio_url，下载合并后转存 OSS。"""
+        merged_data, total_duration = self._download_and_merge_segments(results, job)
+
+        # 直接上传合并后的音频 bytes 到 OSS
+        permanent_url, storage_key = self._upload_merged_to_oss(merged_data, job.user_id, job.id, job.format)
+
+        job.mark_completed(
+            output_audio_url=permanent_url,
+            output_audio_key=storage_key,
+            duration=total_duration,
+            file_size=len(merged_data),
+        )
+        job = self.repository.update(job)
+        logger.info(f"分段合成完成: job_id={job.id}, " f"merged_size={len(merged_data)}, duration={total_duration:.1f}")
+        return job
+
+    def _download_and_merge_segments(self, results: list[dict], job: TTSJob) -> tuple[bytes, float]:
+        """下载各分段音频并合并。
+
+        Returns:
+            (merged_audio_bytes, total_duration)
+        """
+        temp_dir = tempfile.mkdtemp(prefix="tts_segments_")
+        try:
+            audio_paths: list[str] = []
+            total_duration = 0.0
+
+            for idx, result in enumerate(results):
+                audio_url = result.get("audio_url", "")
+                if not audio_url:
+                    raise TTSWorkflowError(f"分段 {idx + 1} 没有返回 audio_url")
+
+                total_duration += result.get("duration", 0.0)
+
+                # 下载分段音频到临时文件
+                resp = httpx.get(audio_url, timeout=60.0, follow_redirects=True)
+                resp.raise_for_status()
+
+                seg_path = os.path.join(temp_dir, f"seg_{idx:03d}.{job.format}")
+                with open(seg_path, "wb") as f:
+                    f.write(resp.content)
+                audio_paths.append(seg_path)
+
+            # 合并
+            merger = AudioMerger()
+            merged_data = merger.merge(audio_paths, output_format=job.format)
+            return merged_data, total_duration
+
+        finally:
+            shutil.rmtree(temp_dir, ignore_errors=True)
+
+    def _poll_segment_tasks(self, job: TTSJob) -> TTSJob:
+        """轮询所有分段异步任务，全部完成后合并音频。"""
+        segment_task_ids: list[str] = (job.metadata or {}).get("segment_task_ids", [])
+        segment_audio_urls: list[str] = (job.metadata or {}).get("segment_audio_urls", [])
+        segment_count = len(segment_task_ids)
+
+        poll_start = time.monotonic()
+        poll_timeout = 300.0  # 分段任务超时更长
+        poll_interval = 2.0
+
+        while time.monotonic() - poll_start < poll_timeout:
+            all_done = True
+            results: list[dict | None] = [None] * segment_count
+
+            for idx, task_id in enumerate(segment_task_ids):
+                # 已经有音频的分段跳过轮询
+                if idx < len(segment_audio_urls) and segment_audio_urls[idx]:
+                    results[idx] = {
+                        "audio_url": segment_audio_urls[idx],
+                        "duration": 0.0,
+                        "file_size": 0,
+                    }
+                    continue
+
+                try:
+                    result = self.cosyvoice_service.poll_synthesize_task(task_id, timeout=poll_timeout)
+                    results[idx] = result
+                except Exception as e:
+                    logger.error(f"分段任务轮询失败: job_id={job.id}, " f"segment={idx}, error={e}")
+                    self._handle_segment_failure(job, f"分段 {idx + 1} 轮询失败: {e}")
+                    return self.repository.get(job.id)
+
+                if results[idx] is None:
+                    all_done = False
+
+            if all_done and all(r is not None for r in results):
+                # 所有分段完成，下载合并
+                try:
+                    merged_data, total_duration = self._download_and_merge_segments(results, job)
+
+                    # 转存 OSS
+                    permanent_url, storage_key = self._upload_merged_to_oss(
+                        merged_data, job.user_id, job.id, job.format
+                    )
+
+                    job.mark_completed(
+                        output_audio_url=permanent_url,
+                        output_audio_key=storage_key,
+                        duration=total_duration,
+                        file_size=len(merged_data),
+                    )
+                    job = self.repository.update(job)
+                    logger.info(f"分段合成轮询完成: job_id={job.id}, " f"merged_size={len(merged_data)}")
+                    return job
+
+                except Exception as e:
+                    self._handle_segment_failure(job, f"分段合并失败: {e}")
+                    return self.repository.get(job.id)
+
+            # 等待后重试
+            time.sleep(poll_interval)
+
+        # 超时
+        self._handle_segment_failure(job, "分段合成轮询超时（300 秒）")
+        return self.repository.get(job.id)
+
+    def _handle_segment_failure(self, job: TTSJob, error_message: str) -> None:
+        """分段合成失败处理。"""
+        job.mark_failed(error_message)
+        self.repository.update(job)
+        logger.error(f"分段合成失败: job_id={job.id}, error={error_message}")

packages/domain/__init__.py

@@ -24,6 +24,7 @@ from .entities import (
 from .generated_video import GeneratedVideo
 from .generation_task import GenerationTask, GenerationTaskStatus
 from .job import Job, JobStatus, JobType
+from .tag import Tag
 from .template_clip_config import ClipType, TemplateClipConfig, TransitionEffect
 from .title_library import TitleLibraryItem
 from .voice_library import VoiceLibraryItem
@@ -56,6 +57,7 @@ __all__ = [
     "JobStatus",
     "JobType",
     "Project",
+    "Tag",
     "TemplateClipConfig",
     "TransitionEffect",
     "User",

packages/domain/entities.py

@@ -161,8 +161,9 @@ class Asset:
     classification_status: ClassificationStatus = ClassificationStatus.PENDING
     quality_score: float | None = None
     uploaded_by_user_id: str = ""
+    file_hash: str = ""
     metadata: dict[str, Any] = field(default_factory=dict)
-    tags: list[str] = field(default_factory=list)
+    tag_ids: list[str] = field(default_factory=list)
     created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
     updated_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
 
@@ -187,6 +188,7 @@ class Asset:
         classification_status: ClassificationStatus = ClassificationStatus.PENDING,
         quality_score: float | None = None,
         uploaded_by_user_id: str = "",
+        file_hash: str = "",
     ) -> "Asset":
         clean_name = name.strip()
         if not clean_name:
@@ -213,24 +215,25 @@ class Asset:
             classification_status=classification_status,
             quality_score=quality_score,
             uploaded_by_user_id=uploaded_by_user_id.strip(),
+            file_hash=file_hash.strip(),
             metadata=metadata or {},
-            tags=[],
+            tag_ids=[],
         )
 
-    def add_tag(self, tag: str) -> None:
-        """添加标签。空标签会被忽略，自动去重。"""
-        clean_tag = tag.strip()
-        if not clean_tag:
-            raise ValueError("标签不能为空")
-        if clean_tag not in self.tags:
-            self.tags.append(clean_tag)
+    def add_tag(self, tag_id: str) -> None:
+        """添加标签 ID。空 ID 会被忽略，自动去重。"""
+        clean_id = tag_id.strip()
+        if not clean_id:
+            raise ValueError("标签 ID 不能为空")
+        if clean_id not in self.tag_ids:
+            self.tag_ids.append(clean_id)
             self.updated_at = datetime.now(timezone.utc)
 
-    def remove_tag(self, tag: str) -> None:
-        """删除标签。如果标签不存在，不报错（幂等性）。"""
-        clean_tag = tag.strip()
-        if clean_tag in self.tags:
-            self.tags.remove(clean_tag)
+    def remove_tag(self, tag_id: str) -> None:
+        """删除标签 ID。如果标签不存在，不报错（幂等性）。"""
+        clean_id = tag_id.strip()
+        if clean_id in self.tag_ids:
+            self.tag_ids.remove(clean_id)
             self.updated_at = datetime.now(timezone.utc)
 
 
@@ -243,6 +246,7 @@ class IngestJob:
     status: IngestJobStatus = IngestJobStatus.PENDING
     error_message: str = ""
     result_asset_id: str = ""
+    file_hash: str = ""
     created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
     updated_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
 
@@ -252,6 +256,7 @@ class IngestJob:
         project_id: str,
         library_id: str,
         storage_key: str,
+        file_hash: str = "",
     ) -> "IngestJob":
         if not project_id.strip():
             raise ValueError("project_id 不能为空")
@@ -264,4 +269,5 @@ class IngestJob:
             project_id=project_id.strip(),
             library_id=library_id.strip(),
             storage_key=storage_key.strip(),
+            file_hash=file_hash.strip(),
         )

packages/domain/generation_task.py

@@ -43,6 +43,8 @@ class GenerationTask:
     completed_at: datetime | None = None
     source_edit_plan_id: str = ""
     created_by_user_id: str = ""
+    asset_select_mode: str = ""
+    batch_id: str = ""
     created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
 
     @classmethod
@@ -59,6 +61,8 @@ class GenerationTask:
         voice_ids: list[str] | None = None,
         created_by_user_id: str = "",
         source_edit_plan_id: str = "",
+        asset_select_mode: str = "",
+        batch_id: str = "",
     ) -> "GenerationTask":
         if not project_id.strip() and not template_id.strip():
             raise ValueError("project_id 或 template_id 至少需要提供一个")
@@ -76,4 +80,6 @@ class GenerationTask:
             voice_ids=list(voice_ids) if voice_ids else [],
             created_by_user_id=created_by_user_id.strip(),
             source_edit_plan_id=source_edit_plan_id.strip(),
+            asset_select_mode=asset_select_mode,
+            batch_id=batch_id,
         )

packages/domain/tag.py

@@ -0,0 +1,24 @@
+"""标签领域实体。"""
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from uuid import uuid4
+
+
+@dataclass(slots=True)
+class Tag:
+    id: str
+    user_id: str
+    name: str
+    created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
+
+    @classmethod
+    def create(cls, user_id: str, name: str) -> "Tag":
+        clean_name = name.strip()
+        if not clean_name:
+            raise ValueError("标签名称不能为空")
+        return cls(
+            id=uuid4().hex,
+            user_id=user_id,
+            name=clean_name,
+        )

packages/ports/__init__.py

@@ -4,6 +4,7 @@ from .asset_library_repository import AssetLibraryRepository
 from .asset_repository import AssetRepository
 from .ingest_job_repository import IngestJobRepository
 from .project_repository import ProjectRepository
+from .tag_repository import TagRepository
 from .title_library_repository import TitleLibraryRepository
 from .voice_library_repository import VoiceLibraryRepository
 
@@ -12,6 +13,7 @@ __all__ = [
     "AssetRepository",
     "IngestJobRepository",
     "ProjectRepository",
+    "TagRepository",
     "TitleLibraryRepository",
     "VoiceLibraryRepository",
 ]

packages/ports/asset_repository.py

@@ -50,6 +50,11 @@ class AssetRepository(ABC):
     def delete(self, asset_id: str) -> bool:
         pass
 
+    @abstractmethod
+    def batch_delete(self, asset_ids: list[str]) -> int:
+        """批量删除素材，返回实际删除数量。"""
+        pass
+
     @abstractmethod
     def count_by_project(self, project_id: str) -> int:
         pass
@@ -78,3 +83,22 @@ class AssetRepository(ABC):
     ) -> list[Asset]:
         """按筛选条件搜索候选素材，按质量分降序排列。"""
         pass
+
+    @abstractmethod
+    def find_by_tag_ids(
+        self,
+        tag_ids: list[str],
+        skip: int = 0,
+        limit: int = 100,
+    ) -> list[Asset]:
+        """查找包含所有指定标签的素材。"""
+        pass
+
+    @abstractmethod
+    def find_by_library_and_file_hash(
+        self,
+        library_id: str,
+        file_hash: str,
+    ) -> Asset | None:
+        """按素材库 + 文件哈希查找已有素材（去重检测）。"""
+        pass

packages/ports/generated_video_repository.py

@@ -13,3 +13,5 @@ class GeneratedVideoRepository(Protocol):
     def list_by_project(self, project_id: str) -> list[GeneratedVideo]: ...
 
     def list_by_generation_task(self, generation_task_id: str) -> list[GeneratedVideo]: ...
+
+    def list_by_batch(self, batch_id: str) -> list[GeneratedVideo]: ...

packages/ports/tag_repository.py

@@ -0,0 +1,36 @@
+"""标签仓储接口定义。"""
+
+from abc import ABC, abstractmethod
+
+from packages.domain import Tag
+
+
+class TagRepository(ABC):
+    @abstractmethod
+    def create(self, tag: Tag) -> Tag:
+        pass
+
+    @abstractmethod
+    def get(self, tag_id: str) -> Tag | None:
+        pass
+
+    @abstractmethod
+    def find_by_name(self, user_id: str, name: str) -> Tag | None:
+        pass
+
+    @abstractmethod
+    def list_by_user(
+        self,
+        user_id: str,
+        skip: int = 0,
+        limit: int = 100,
+    ) -> list[Tag]:
+        pass
+
+    @abstractmethod
+    def count_by_user(self, user_id: str) -> int:
+        pass
+
+    @abstractmethod
+    def delete(self, tag_id: str) -> bool:
+        pass

pyproject.toml

@@ -5,3 +5,45 @@ target-version = ["py312"]
 [tool.isort]
 profile = "black"
 line_length = 120
+
+[tool.ruff]
+target-version = "py311"
+line-length = 120
+exclude = [
+  ".git",
+  "__pycache__",
+  ".venv",
+  "venv",
+  "node_modules",
+  "alembic",
+  ".gitea",
+  ".next",
+  "dist",
+  "build",
+  "hostexecutor",
+]
+
+[tool.ruff.lint]
+select = [
+  "E",   # pycodestyle errors（同 flake8 默认）
+  "F",   # pyflakes（同 flake8 默认）
+]
+ignore = [
+  "E203",
+  "E501",  # line-too-long（black管）
+  "E302",
+  "E402",  # module-import-not-at-top（循环导入多）
+  "E722",  # bare-except
+  "W291",
+  "W293",
+  "F401",
+  "F403",
+  "F405",
+  "F841",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401", "F403", "F405"]
+"tests/**" = ["E402", "F401", "F821", "F841"]
+"packages/ports/*" = ["E301"]
+"apps/api/app/api/routes/auth.py" = ["ALL"]

renovate.json5

@@ -0,0 +1,58 @@
+{
+  "": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+
+  "baseBranches": ["develop"],
+  "labels": ["dependencies"],
+  "assignees": ["xiaoxia"],
+
+  "prConcurrentLimit": 3,
+  "prHourlyLimit": 3,
+
+  "schedule": ["after 2am before 6am on monday"],
+  "timezone": "Asia/Shanghai",
+
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["dependencies", "security"],
+    "schedule": ["at any time"]
+  },
+
+  "pip_requirements": {
+    "fileMatch": [
+      "(^|/)requirements\.txt$",
+      "(^|/)requirements-base\.txt$",
+      "(^|/)requirements-dev\.txt$",
+      "(^|/)requirements-worker\.txt$"
+    ]
+  },
+
+  "npm": {
+    "fileMatch": [
+      "(^|/)apps/web/package\.json$"
+    ]
+  },
+
+  "packageRules": [
+    {
+      "matchDepTypes": ["dependencies"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "groupName": "production deps (minor & patch)",
+      "groupSlug": "prod-deps-minor-patch"
+    },
+    {
+      "matchDepTypes": ["devDependencies"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "groupName": "dev deps (minor & patch)",
+      "groupSlug": "dev-deps-minor-patch"
+    },
+    {
+      "matchUpdateTypes": ["major"],
+      "labels": ["dependencies", "major-update"]
+    }
+  ],
+
+  "rebaseWhen": "behind-base-branch",
+  "semanticCommits": "auto",
+  "semanticPrefix": "chore(deps): "
+}

requirements-dev.txt

@@ -11,3 +11,4 @@ pytest==8.3.3
 pytest-asyncio==0.24.0
 pytest-cov==6.0.0
 pytest-timeout==2.3.1
+diff-cover==8.0.3

scripts/check_ci_status.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""检查指定commit的CI status状态。
+
+用法: python3 check_ci_status.py <token> <repo> <sha> <context>
+返回: 打印状态 (success/failure/pending/error)
+"""
+
+import json
+import sys
+import urllib.error
+import urllib.request
+
+
+def main():
+    if len(sys.argv) != 5:
+        print("pending")
+        return
+
+    token = sys.argv[1]
+    repo = sys.argv[2]
+    sha = sys.argv[3]
+    target_context = sys.argv[4]
+
+    api_url = f"https://git.xiaoxiajianji.com/api/v1/repos/{repo}/commits/{sha}/statuses?per_page=100"
+    req = urllib.request.Request(api_url, headers={"Authorization": f"token {token}"})
+
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            statuses = json.loads(resp.read().decode())
+    except Exception:
+        print("pending")
+        return
+
+    # API返回按时间倒序，第一个就是最新的
+    for s in statuses:
+        if s.get("context") == target_context:
+            print(s.get("status", "pending"))
+            return
+
+    print("pending")
+
+
+if __name__ == "__main__":
+    main()

scripts/check_pr_approval.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""检查PR是否有至少N个APPROVED审批。
+
+用法: python3 check_pr_approval.py <token> <repo> <pr_number> <min_approval>
+返回: 打印 "approved" 或 "pending"
+"""
+
+import json
+import sys
+import urllib.request
+
+
+def main():
+    if len(sys.argv) != 5:
+        print("pending")
+        return
+
+    token = sys.argv[1]
+    repo = sys.argv[2]
+    pr_number = sys.argv[3]
+    min_approval = int(sys.argv[4])
+
+    api_url = f"https://git.xiaoxiajianji.com/api/v1/repos/{repo}/pulls/{pr_number}/reviews"
+    req = urllib.request.Request(api_url, headers={"Authorization": f"token {token}"})
+
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            reviews = json.loads(resp.read().decode())
+    except Exception:
+        print("pending")
+        return
+
+    # 统计APPROVED的人数（去重，同一人多次审批只算一次）
+    approvers = set()
+    for r in reviews:
+        if r.get("state") == "APPROVED":
+            approvers.add(r.get("user", {}).get("login", ""))
+
+    if len(approvers) >= min_approval:
+        print(f"approved ({len(approvers)})")
+    else:
+        print(f"pending ({len(approvers)})")
+
+
+if __name__ == "__main__":
+    main()

scripts/ci/acr_cleanup.py

@@ -0,0 +1,653 @@
+#!/usr/bin/env python3
+"""
+ACR 镜像清理脚本（增强版）
+
+清理策略：
+- 版本tag (v*): 永久保留
+- 固定tag (latest, main, develop, master): 永久保留
+- 缓存镜像 (*-cache): 永久保留
+- 受保护tag (--protected-tags): 永久保留（如当前运行中镜像）
+- PR预览tag (pr-*):
+  - --pr-sha模式：删除指定PR commit的镜像（PR关闭时触发）
+  - cron模式：通过Gitea API检查PR状态，已关闭/合并的删除
+- 普通commit hash tag: 保留最近 N 个（默认20），老的删除
+
+使用方式：
+  # 预览（不实际删除）
+  python3 acr_cleanup.py --dry-run
+
+  # 实际执行（cron模式）
+  python3 acr_cleanup.py --execute
+
+  # 保留最近30个commit镜像
+  python3 acr_cleanup.py --keep 30 --execute
+
+  # PR关闭时清理指定commit的PR镜像
+  python3 acr_cleanup.py --pr-sha abc123def --execute
+
+  # 传入受保护tag列表（运行中镜像白名单）
+  python3 acr_cleanup.py --protected-tags "sha1,sha2" --execute
+"""
+
+import argparse
+import base64
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+from datetime import datetime, timedelta, timezone
+
+# ========== 配置 ==========
+
+REGISTRY = os.environ.get("ACR_REGISTRY", "xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com")
+AUTH_URL = "https://dockerauth.cn-hangzhou.aliyuncs.com/auth"
+SERVICE = os.environ.get("ACR_SERVICE", "registry.aliyuncs.com:cn-hangzhou:china:cri-fvec8o9q4mmxrkaa")
+NAMESPACE = os.environ.get("ACR_NAMESPACE", "xiaoxiakeji")
+USERNAME = os.environ.get("ACR_USERNAME", "")
+PASSWORD = os.environ.get("ACR_PASSWORD", "")
+
+# Gitea配置（用于PR状态检查）
+GITEA_URL = os.environ.get("GITEA_URL", "https://git.xiaoxiajianji.com")
+GITEA_TOKEN = os.environ.get("GITEA_TOKEN", "")
+GITEA_REPO = os.environ.get("GITEA_REPO", "xiaoxia/xiaoxia-saas")
+
+REPOS = [
+    "xiaoxia-saas-api",
+    "xiaoxia-saas-worker",
+    "xiaoxia-saas-web",
+    "api-cache",
+    "worker-cache",
+    "web-cache",
+]
+
+# 缓存镜像仓库（所有tag永久保留）
+CACHE_REPOS = {"api-cache", "worker-cache", "web-cache"}
+
+# OCI / Docker manifest types
+ACCEPT_INDEX = "application/vnd.oci.image.index.v1+json"
+ACCEPT_MANIFEST_OCI = "application/vnd.oci.image.manifest.v1+json"
+ACCEPT_MANIFEST_V2 = "application/vnd.docker.distribution.manifest.v2+json"
+
+
+# ========== Registry API ==========
+
+
+def get_token(repo, action="pull"):
+    """获取仓库访问token"""
+    scope = "repository:" + NAMESPACE + "/" + repo + ":" + action
+    token_url = AUTH_URL + "?service=" + SERVICE + "&scope=" + scope
+    req = urllib.request.Request(token_url)
+    req.add_header("Authorization", "Basic " + base64.b64encode((USERNAME + ":" + PASSWORD).encode()).decode())
+    with urllib.request.urlopen(req) as resp:
+        data = json.loads(resp.read())
+        return data.get("token", "")
+
+
+def get_tags(repo, token):
+    """获取仓库所有tag"""
+    url = "https://" + REGISTRY + "/v2/" + NAMESPACE + "/" + repo + "/tags/list?n=1000"
+    req = urllib.request.Request(url)
+    req.add_header("Authorization", "Bearer " + token)
+    with urllib.request.urlopen(req) as resp:
+        data = json.loads(resp.read())
+        return data.get("tags", []) or []
+
+
+def http_get_json(url, token, accept_header):
+    """带Authorization的GET请求，返回(json_data, headers)"""
+    req = urllib.request.Request(url)
+    req.add_header("Authorization", "Bearer " + token)
+    req.add_header("Accept", accept_header)
+    with urllib.request.urlopen(req) as resp:
+        return json.loads(resp.read()), resp.headers
+
+
+def get_manifest_info(repo, tag, token):
+    """
+    获取tag的manifest信息。
+    返回: {digest, created, media_type, error}
+    """
+    url = "https://" + REGISTRY + "/v2/" + NAMESPACE + "/" + repo + "/manifests/" + tag
+    result = {"digest": "", "created": "", "media_type": "", "error": ""}
+
+    # 先尝试 OCI index 格式
+    try:
+        data, headers = http_get_json(url, token, ACCEPT_INDEX)
+        top_digest = headers.get("Docker-Content-Digest", "")
+        result["digest"] = top_digest
+        result["media_type"] = data.get("mediaType", ACCEPT_INDEX)
+
+        manifests = data.get("manifests", [])
+        amd64_manifest = None
+        for m in manifests:
+            arch = m.get("platform", {}).get("architecture", "")
+            if arch == "amd64":
+                amd64_manifest = m
+                break
+        if not amd64_manifest and manifests:
+            amd64_manifest = manifests[0]
+
+        if amd64_manifest:
+            inner_digest = amd64_manifest["digest"]
+            inner_url = "https://" + REGISTRY + "/v2/" + NAMESPACE + "/" + repo + "/manifests/" + inner_digest
+            try:
+                inner_data, _ = http_get_json(inner_url, token, ACCEPT_MANIFEST_OCI)
+            except Exception:
+                inner_data, _ = http_get_json(inner_url, token, ACCEPT_MANIFEST_V2)
+
+            config_digest = inner_data.get("config", {}).get("digest", "")
+            if config_digest:
+                blob_url = "https://" + REGISTRY + "/v2/" + NAMESPACE + "/" + repo + "/blobs/" + config_digest
+                try:
+                    blob_data, _ = http_get_json(blob_url, token, "application/json")
+                    result["created"] = blob_data.get("created", "")
+                except Exception:
+                    pass
+        return result
+    except urllib.error.HTTPError:
+        pass
+
+    # 再尝试普通 OCI manifest 格式
+    try:
+        data, headers = http_get_json(url, token, ACCEPT_MANIFEST_OCI)
+        result["digest"] = headers.get("Docker-Content-Digest", "")
+        result["media_type"] = data.get("mediaType", ACCEPT_MANIFEST_OCI)
+        config_digest = data.get("config", {}).get("digest", "")
+        if config_digest:
+            blob_url = "https://" + REGISTRY + "/v2/" + NAMESPACE + "/" + repo + "/blobs/" + config_digest
+            try:
+                blob_data, _ = http_get_json(blob_url, token, "application/json")
+                result["created"] = blob_data.get("created", "")
+            except Exception:
+                pass
+        return result
+    except urllib.error.HTTPError:
+        pass
+
+    # 最后试 Docker v2 格式
+    try:
+        data, headers = http_get_json(url, token, ACCEPT_MANIFEST_V2)
+        result["digest"] = headers.get("Docker-Content-Digest", "")
+        result["media_type"] = data.get("mediaType", ACCEPT_MANIFEST_V2)
+        config_digest = data.get("config", {}).get("digest", "")
+        if config_digest:
+            blob_url = "https://" + REGISTRY + "/v2/" + NAMESPACE + "/" + repo + "/blobs/" + config_digest
+            try:
+                blob_data, _ = http_get_json(blob_url, token, "application/json")
+                result["created"] = blob_data.get("created", "")
+            except Exception:
+                pass
+        return result
+    except urllib.error.HTTPError as e:
+        result["error"] = "HTTP " + str(e.code) + " " + e.read().decode()[:200]
+
+    return result
+
+
+def delete_manifest(repo, digest, token):
+    """按digest删除manifest（会级联删除所有指向它的tag）"""
+    url = "https://" + REGISTRY + "/v2/" + NAMESPACE + "/" + repo + "/manifests/" + digest
+    req = urllib.request.Request(url, method="DELETE")
+    req.add_header("Authorization", "Bearer " + token)
+    req.add_header("Accept", ACCEPT_INDEX)
+    req.add_header("Accept", ACCEPT_MANIFEST_OCI)
+    req.add_header("Accept", ACCEPT_MANIFEST_V2)
+    try:
+        with urllib.request.urlopen(req) as resp:
+            return True, resp.status
+    except urllib.error.HTTPError as e:
+        return False, str(e.code) + " " + e.read().decode()[:200]
+
+
+# ========== Gitea API ==========
+
+
+def gitea_get_open_prs():
+    """获取所有打开的PR编号列表"""
+    if not GITEA_TOKEN:
+        print("  警告: 无GITEA_TOKEN，跳过PR状态检查")
+        return None
+
+    open_prs = set()
+    page = 1
+    while True:
+        url = GITEA_URL + "/api/v1/repos/" + GITEA_REPO + "/pulls?state=open&page=" + str(page) + "&limit=50"
+        req = urllib.request.Request(url)
+        req.add_header("Authorization", "token " + GITEA_TOKEN)
+        try:
+            with urllib.request.urlopen(req) as resp:
+                data = json.loads(resp.read())
+                if not data:
+                    break
+                for pr in data:
+                    open_prs.add(pr.get("number", 0))
+                if len(data) < 50:
+                    break
+                page += 1
+        except Exception as e:
+            print(f"  警告: 获取Gitea PR列表失败: {e}")
+            return None
+
+    return open_prs
+
+
+def gitea_get_pr_commits(pr_number):
+    """获取指定PR的所有commit sha"""
+    if not GITEA_TOKEN:
+        return []
+
+    url = GITEA_URL + "/api/v1/repos/" + GITEA_REPO + "/pulls/" + str(pr_number) + "/commits?limit=100"
+    req = urllib.request.Request(url)
+    req.add_header("Authorization", "token " + GITEA_TOKEN)
+    try:
+        with urllib.request.urlopen(req) as resp:
+            data = json.loads(resp.read())
+            return [c.get("sha", "") for c in data]
+    except Exception as e:
+        print(f"  警告: 获取PR #{pr_number} commits失败: {e}")
+        return []
+
+
+# ========== 工具函数 ==========
+
+
+def parse_time(created_str):
+    """解析ISO时间字符串"""
+    if not created_str:
+        return datetime.min.replace(tzinfo=timezone.utc)
+    try:
+        if created_str.endswith("Z"):
+            created_str = created_str[:-1] + "+00:00"
+        return datetime.fromisoformat(created_str)
+    except Exception:
+        return datetime.min.replace(tzinfo=timezone.utc)
+
+
+def is_version_tag(tag):
+    """判断是否是版本tag (v1.2.3, v0.1.0-alpha等)"""
+    return tag.startswith("v") and len(tag) > 1 and tag[1].isdigit()
+
+
+def is_fixed_tag(tag):
+    """判断是否是固定tag"""
+    return tag in ("latest", "main", "develop", "master", "dev", "stable")
+
+
+def is_pr_tag(tag):
+    """判断是否是PR预览tag (pr-<sha>)"""
+    return tag.startswith("pr-")
+
+
+def extract_sha_from_pr_tag(tag):
+    """从pr-<sha> tag中提取sha"""
+    if tag.startswith("pr-"):
+        return tag[3:]
+    return tag
+
+
+def is_in_protected_list(tag, protected_set):
+    """检查tag是否在受保护列表中"""
+    if not protected_set:
+        return False
+    # 精确匹配
+    if tag in protected_set:
+        return True
+    # 前缀匹配（commit hash可能是完整或短的）
+    for p in protected_set:
+        if tag.startswith(p) or p.startswith(tag):
+            return True
+    return False
+
+
+# ========== 核心清理逻辑 ==========
+
+
+def cleanup_repo(repo, keep_count, dry_run, protected_tags, pr_sha=None, pr_open_set=None):
+    """
+    清理单个仓库
+
+    Args:
+        repo: 仓库名
+        keep_count: 保留最近N个commit tag
+        dry_run: 是否预览模式
+        protected_tags: 受保护tag集合（白名单）
+        pr_sha: 指定PR commit sha（PR关闭模式），None表示cron模式
+        pr_open_set: 打开的PR编号集合（cron模式用）
+
+    Returns:
+        (总tag数, 删除数)
+    """
+    print("=" * 60)
+    print("仓库:", repo)
+    print("=" * 60)
+
+    # 缓存仓库不清理
+    if repo in CACHE_REPOS:
+        token_pull = get_token(repo, "pull")
+        tags = get_tags(repo, token_pull)
+        print("  缓存仓库，跳过清理 (共", len(tags), "个tag)")
+        return len(tags), 0
+
+    token_pull = get_token(repo, "pull")
+    tags = get_tags(repo, token_pull)
+    print("  总tag数:", len(tags))
+
+    if not tags:
+        print("  无tag，跳过")
+        return 0, 0
+
+    # ========== PR-SHA模式：只删除指定commit的PR镜像 ==========
+    if pr_sha:
+        pr_tags_to_del = [
+            t
+            for t in tags
+            if t.startswith("pr-" + pr_sha) or t == "pr-" + pr_sha or pr_sha.startswith(extract_sha_from_pr_tag(t))
+        ]
+        if not pr_tags_to_del:
+            print(f"  未找到PR镜像: pr-{pr_sha[:12]}")
+            return len(tags), 0
+
+        print(f"  找到 {len(pr_tags_to_del)} 个PR镜像待删除:")
+        for t in pr_tags_to_del:
+            print(f"    - {t}")
+
+        to_delete = []
+        for tag in pr_tags_to_del:
+            info = get_manifest_info(repo, tag, token_pull)
+            if info["digest"]:
+                to_delete.append({"tag": tag, "digest": info["digest"], "created": info["created"]})
+            else:
+                print(f"    警告: {tag} 无法获取digest，跳过")
+
+        return _execute_delete(repo, to_delete, dry_run, len(tags))
+
+    # ========== Cron模式：全量清理 ==========
+
+    # 分类
+    version_tags = []
+    fixed_tags = []
+    pr_tags_list = []
+    commit_tags = []
+
+    for tag in tags:
+        if is_version_tag(tag):
+            version_tags.append(tag)
+        elif is_fixed_tag(tag):
+            fixed_tags.append(tag)
+        elif is_pr_tag(tag):
+            pr_tags_list.append(tag)
+        else:
+            commit_tags.append(tag)
+
+    print("  版本tag (v*):", len(version_tags), "-> 永久保留")
+    print("  固定tag:", len(fixed_tags), "-> 永久保留")
+    print("  PR预览tag (pr-*):", len(pr_tags_list), "-> 已关闭PR的删除")
+    print("  Commit hash tag:", len(commit_tags), "-> 保留最近", keep_count, "个")
+    print("  白名单tag:", len(protected_tags), "个")
+
+    # --- PR tag清理：检查PR状态 ---
+    pr_to_delete = []
+    if pr_tags_list:
+        print()
+        print("  检查PR镜像状态...")
+
+        # 策略：有Gitea token则检查PR状态，否则按时间保留7天
+        if pr_open_set is not None:
+            # 通过Gitea API检查每个PR镜像对应的PR是否还开着
+            # 注意：pr tag是pr-<sha>，sha可能属于某个PR
+            # 简化策略：收集所有打开PR的commit sha，在白名单里的保留
+            print("    模式: Gitea PR状态检查")
+            open_pr_shas = set()
+            # 这里做了简化：因为每个PR都查commits太慢，我们用另一种方式
+            # 对于PR tag，先尝试匹配PR编号（如果tag名里有编号），否则按时间
+            # 实际pr-<sha>没法直接知道PR编号，所以降级为按时间+打开PR的head sha白名单
+            open_head_shas = set()
+            page = 1
+            while True:
+                url = GITEA_URL + "/api/v1/repos/" + GITEA_REPO + "/pulls?state=open&page=" + str(page) + "&limit=50"
+                req = urllib.request.Request(url)
+                req.add_header("Authorization", "token " + GITEA_TOKEN)
+                try:
+                    with urllib.request.urlopen(req) as resp:
+                        data = json.loads(resp.read())
+                        if not data:
+                            break
+                        for pr in data:
+                            head_sha = pr.get("head", {}).get("sha", "")
+                            if head_sha:
+                                open_head_shas.add(head_sha)
+                                open_head_shas.add(head_sha[:7])
+                                open_head_shas.add(head_sha[:12])
+                        if len(data) < 50:
+                            break
+                        page += 1
+                except Exception:
+                    break
+
+            deleted_count = 0
+            for tag in pr_tags_list:
+                sha = extract_sha_from_pr_tag(tag)
+                # 检查是否是打开PR的head sha
+                is_open_pr = False
+                for ohs in open_head_shas:
+                    if sha.startswith(ohs) or ohs.startswith(sha):
+                        is_open_pr = True
+                        break
+                if not is_open_pr:
+                    info = get_manifest_info(repo, tag, token_pull)
+                    if info["digest"]:
+                        pr_to_delete.append({"tag": tag, "digest": info["digest"], "created": info["created"]})
+                        deleted_count += 1
+            print(f"    打开PR数: {len(open_head_shas)}个head sha")
+            print(f"    将删除PR镜像: {deleted_count}个")
+        else:
+            # 无Gitea token，降级为按7天保留
+            print("    模式: 按时间保留7天（无Gitea token降级）")
+            cutoff = datetime.now(timezone.utc) - timedelta(days=7)
+            for tag in pr_tags_list:
+                info = get_manifest_info(repo, tag, token_pull)
+                created = parse_time(info["created"])
+                if created < cutoff and info["digest"]:
+                    pr_to_delete.append({"tag": tag, "digest": info["digest"], "created": info["created"]})
+            print(f"    将删除PR镜像: {len(pr_to_delete)}个")
+
+    # --- Commit tag清理：保留最近N个 ---
+    print()
+    print("  获取commit tag创建时间...")
+    commit_tag_infos = []
+    errors = 0
+    for i, tag in enumerate(commit_tags):
+        info = get_manifest_info(repo, tag, token_pull)
+        if info["error"] or not info["digest"]:
+            errors += 1
+        commit_tag_infos.append({"tag": tag, "digest": info["digest"], "created": info["created"]})
+        if (i + 1) % 20 == 0:
+            print("    已获取", i + 1, "/", len(commit_tags), "...")
+
+    if errors:
+        print("    注意:", errors, "个tag获取manifest失败")
+
+    # 按时间倒序排序
+    commit_tag_infos.sort(key=lambda x: parse_time(x["created"]), reverse=True)
+
+    # 确定要删除的commit tag
+    commit_to_delete = []
+    if len(commit_tag_infos) > keep_count:
+        commit_to_delete = commit_tag_infos[keep_count:]
+        print(f"  保留前{keep_count}个commit tag，删除{len(commit_to_delete)}个")
+
+        # 白名单过滤：受保护的tag不删除
+        if protected_tags:
+            before = len(commit_to_delete)
+            commit_to_delete = [t for t in commit_to_delete if not is_in_protected_list(t["tag"], protected_tags)]
+            removed = before - len(commit_to_delete)
+            if removed > 0:
+                print(f"  白名单保护: 跳过{removed}个运行中镜像")
+
+        # 过滤无digest的
+        commit_to_delete = [t for t in commit_to_delete if t["digest"]]
+        print(f"  可删除(有digest): {len(commit_to_delete)}个")
+    else:
+        print(f"  commit tag数量不足{keep_count}个，无需清理")
+
+    # --- 合并所有待删除项 ---
+    all_to_delete = commit_to_delete + pr_to_delete
+
+    # 再次过滤白名单（PR镜像也受白名单保护）
+    if protected_tags:
+        before = len(all_to_delete)
+        all_to_delete = [t for t in all_to_delete if not is_in_protected_list(t["tag"], protected_tags)]
+        removed = before - len(all_to_delete)
+        if removed > 0:
+            print(f"  白名单保护(PR镜像): 跳过{removed}个")
+
+    return _execute_delete(repo, all_to_delete, dry_run, len(tags))
+
+
+def _execute_delete(repo, to_delete, dry_run, total_tags):
+    """执行删除操作"""
+    if not to_delete:
+        print()
+        print("  无需删除任何tag")
+        return total_tags, 0
+
+    # 按digest去重
+    seen_digests = set()
+    unique_delete = []
+    for item in to_delete:
+        if item["digest"] and item["digest"] not in seen_digests:
+            seen_digests.add(item["digest"])
+            unique_delete.append(item)
+
+    print()
+    if dry_run:
+        print(f"  [DRY RUN] 将删除{len(unique_delete)}个manifest（预览模式）")
+        for item in unique_delete[:5]:
+            created_str = item.get("created", "")[:10] or "未知"
+            print(f"    - {item['tag'][:30]} ({created_str})")
+        if len(unique_delete) > 5:
+            print(f"    ... 还有{len(unique_delete) - 5}个")
+        return total_tags, len(unique_delete)
+
+    token_delete = get_token(repo, "delete")
+    deleted = 0
+    failed = 0
+
+    print(f"  开始删除{len(unique_delete)}个唯一manifest...")
+    for item in unique_delete:
+        success, result = delete_manifest(repo, item["digest"], token_delete)
+        if success:
+            deleted += 1
+            print(f"    已删除: {item['tag'][:30]}")
+        else:
+            failed += 1
+            print(f"    删除失败: {item['tag'][:30]} - {result}")
+
+    print()
+    print(f"  删除完成: 成功{deleted}个，失败{failed}个")
+    return total_tags, deleted
+
+
+# ========== 主函数 ==========
+
+
+def main():
+    parser = argparse.ArgumentParser(description="ACR镜像清理工具（增强版）")
+    parser.add_argument("--keep", type=int, default=20, help="保留最近N个commit hash tag（默认20）")
+    parser.add_argument("--dry-run", action="store_true", help="预览模式，不实际删除")
+    parser.add_argument("--execute", action="store_true", help="实际执行删除")
+    parser.add_argument("--repo", type=str, default="", help="只清理指定仓库")
+    parser.add_argument("--pr-sha", type=str, default="", help="PR关闭模式：删除指定commit sha的PR镜像")
+    parser.add_argument("--protected-tags", type=str, default="", help="受保护tag列表，逗号分隔（运行中镜像白名单）")
+    parser.add_argument("--skip-pr-check", action="store_true", help="跳过Gitea PR状态检查（纯按时间清理PR镜像）")
+    args = parser.parse_args()
+
+    # 必须指定 --dry-run 或 --execute
+    if not args.dry_run and not args.execute:
+        print("请指定 --dry-run（预览）或 --execute（执行）")
+        print()
+        print("示例:")
+        print("  python3 acr_cleanup.py --dry-run           # 预览清理效果")
+        print("  python3 acr_cleanup.py --execute           # 实际执行清理")
+        print("  python3 acr_cleanup.py --pr-sha abc123 --execute  # PR关闭时清理")
+        sys.exit(1)
+
+    # 凭证检查
+    global USERNAME, PASSWORD
+    if not USERNAME or not PASSWORD:
+        try:
+            docker_config_path = os.path.expanduser("~/.docker/config.json")
+            with open(docker_config_path) as f:
+                config = json.load(f)
+            auth = config.get("auths", {}).get(REGISTRY, {}).get("auth", "")
+            if auth:
+                creds = base64.b64decode(auth).decode().strip()
+                USERNAME, PASSWORD = creds.split(":", 1)
+        except Exception:
+            pass
+
+    if not USERNAME or not PASSWORD:
+        print("错误: 缺少ACR凭证，请设置 ACR_USERNAME 和 ACR_PASSWORD 环境变量")
+        print("或确保已执行 docker login", REGISTRY)
+        sys.exit(1)
+
+    # 解析受保护tag
+    protected_tags = set()
+    if args.protected_tags:
+        protected_tags = set(t.strip() for t in args.protected_tags.split(",") if t.strip())
+
+    dry_run = args.dry_run or not args.execute
+    mode = "预览模式" if dry_run else "执行模式"
+
+    print("=" * 60)
+    print("ACR 镜像清理工具（增强版）-", mode)
+    print("=" * 60)
+    print("Registry:", REGISTRY)
+    print("Namespace:", NAMESPACE)
+    if args.pr_sha:
+        print("模式: PR关闭清理")
+        print("PR commit SHA:", args.pr_sha[:12])
+    else:
+        print("模式: Cron全量清理")
+        print("保留commit tag数:", args.keep)
+        print("PR状态检查:", "关闭" if args.skip_pr_check else "开启")
+    if protected_tags:
+        print("白名单tag数:", len(protected_tags))
+    print()
+
+    # PR模式不需要查Gitea
+    pr_open_set = None
+    if not args.pr_sha and not args.skip_pr_check and GITEA_TOKEN:
+        print("获取打开的PR列表...")
+        pr_open_set = gitea_get_open_prs()
+        if pr_open_set is not None:
+            print(f"  打开的PR: {len(pr_open_set)}个")
+        print()
+
+    repos_to_clean = REPOS
+    if args.repo:
+        repos_to_clean = [args.repo]
+
+    total_deleted = 0
+    total_tags = 0
+    for repo in repos_to_clean:
+        count, deleted = cleanup_repo(
+            repo, args.keep, dry_run, protected_tags, pr_sha=args.pr_sha, pr_open_set=pr_open_set
+        )
+        total_tags += count
+        total_deleted += deleted
+        print()
+
+    print("=" * 60)
+    print("清理完成")
+    print("  总tag数:", total_tags)
+    if dry_run:
+        print("  预览将删除(去重后):", total_deleted, "个manifest")
+    else:
+        print("  已删除:", total_deleted, "个manifest")
+    print("=" * 60)
+
+
+if __name__ == "__main__":
+    main()

scripts/ci/auto_approve.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# 自动审批：CI全绿后自动approve PR
+# 环境变量：GITHUB_TOKEN, REVIEW_TOKEN, PR_NUMBER, PR_HEAD_SHA, GITHUB_API_URL, GITHUB_REPOSITORY
+set -eu
+
+set -eu
+
+echo "PR #${PR_NUMBER} - 检查CI状态并自动审批"
+
+# 检查是否纯前端改动
+API_URL="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files?limit=300"
+FILES=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "$API_URL" | python3 -c "import sys,json; [print(f['filename']) for f in json.load(sys.stdin)]")
+FRONTEND_COUNT=$(echo "$FILES" | grep -c '^apps/web/' || true)
+BACKEND_COUNT=$(echo "$FILES" | grep -cv '^apps/web/' || true)
+TOTAL=$(echo "$FILES" | grep -cv '^$' || true)
+echo "变更文件: ${TOTAL} 个 (前端: ${FRONTEND_COUNT}, 后端/公共: ${BACKEND_COUNT})"
+
+if [ "$BACKEND_COUNT" = "0" ] && [ "$FRONTEND_COUNT" -gt "0" ]; then
+  SKIP_BACKEND=true
+  echo "✅ 纯前端改动，只检查Frontend Lint"
+else
+  SKIP_BACKEND=false
+  echo "🔧 包含后端/公共变更，检查全部CI"
+fi
+
+# 定义需要检查的context
+if [ "$SKIP_BACKEND" = "true" ]; then
+  CONTEXTS=("CI/CD Pipeline / Frontend Lint (pull_request)")
+else
+  CONTEXTS=(
+    "CI/CD Pipeline / Validate - Code Quality (pull_request)"
+    "CI/CD Pipeline / Validate - Type Check (mypy) (pull_request)"
+    "CI/CD Pipeline / Validate - Migration (alembic) (pull_request)"
+    "CI/CD Pipeline / Frontend Lint (pull_request)"
+    "CI/CD Pipeline / Unit Tests (pull_request)"
+    "CI/CD Pipeline / Frontend Unit Tests (pull_request)"
+    "CI/CD Pipeline / PR Build API Image (pull_request)"
+    "CI/CD Pipeline / PR Build Web Image (pull_request)"
+    "CI/CD Pipeline / PR Build Worker Image (pull_request)"
+  )
+fi
+
+echo "需要通过的CI检查: ${#CONTEXTS[@]} 项（与分支保护required门禁一致）"
+for ctx in "${CONTEXTS[@]}"; do
+  echo "  - $ctx"
+done
+echo
+
+# 初始等待30秒，给CI启动写status的时间
+echo "等待30秒让CI启动..."
+sleep 30
+
+# 轮询等待，最多20分钟（120次x10秒）
+for attempt in $(seq 1 12); do  # 短作业模式：最多等2分钟(12次x10秒)，不满足就退出等下次触发
+  ALL_SUCCESS=true
+  ANY_FAILED=false
+  ANY_PENDING=false
+
+  echo "--- 第${attempt}次检查 ($(date '+%H:%M:%S')) ---"
+
+  # 调用辅助脚本检查每个context状态
+  for ctx in "${CONTEXTS[@]}"; do
+    STATE=$(python3 scripts/check_ci_status.py "$GITHUB_TOKEN" "$GITHUB_REPOSITORY" "$PR_HEAD_SHA" "$ctx")
+    echo "  $ctx: $STATE"
+
+    if [ "$STATE" != "success" ]; then
+      ALL_SUCCESS=false
+    fi
+    if [ "$STATE" = "failure" ] || [ "$STATE" = "error" ]; then
+      ANY_FAILED=true
+    fi
+    if [ "$STATE" = "pending" ] || [ "$STATE" = "null" ]; then
+      ANY_PENDING=true
+    fi
+  done
+
+  if [ "$ALL_SUCCESS" = "true" ]; then
+    echo
+    echo "✅ 所有CI检查通过，自动审批 PR #${PR_NUMBER}"
+
+    # 检查是否已有审批
+    EXISTING=$(curl -s -H "Authorization: token ${REVIEW_TOKEN}" \
+      "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" \
+      | python3 -c "import sys,json; reviews=json.load(sys.stdin); print('yes' if any(r.get('state')=='APPROVED' for r in reviews) else 'no')")
+
+    if [ "$EXISTING" = "yes" ]; then
+      echo "ℹ️  PR #${PR_NUMBER} 已有审批，跳过"
+      exit 0
+    fi
+
+    # 第一步：创建PENDING review
+    echo "创建review..."
+    REVIEW_CREATE=$(curl -s -X POST \
+      -H "Authorization: token ${REVIEW_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -d '{"event": "PENDING", "body": "CI全绿，自动审批通过。"}' \
+      "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews")
+    
+    REVIEW_ID=$(echo "$REVIEW_CREATE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))")
+    REVIEW_STATE=$(echo "$REVIEW_CREATE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('state',''))")
+    echo "创建结果: id=$REVIEW_ID state=$REVIEW_STATE"
+
+    if [ -z "$REVIEW_ID" ]; then
+      echo "❌ 创建review失败"
+      echo "$REVIEW_CREATE"
+      exit 1
+    fi
+
+    if [ "$REVIEW_STATE" = "APPROVED" ]; then
+      echo "✅ 自动审批成功（直接创建为APPROVED）"
+      exit 0
+    fi
+
+    # 第二步：submit review为APPROVED
+    echo "提交review审批..."
+    SUBMIT_CODE=$(curl -s -o /tmp/submit_resp.json -w "%{http_code}" \
+      -X POST \
+      -H "Authorization: token ${REVIEW_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -d '{"event": "APPROVED", "body": "CI全绿，自动审批通过。"}' \
+      "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews/${REVIEW_ID}")
+    
+    echo "提交API HTTP状态: $SUBMIT_CODE"
+    cat /tmp/submit_resp.json 2>/dev/null || true
+    echo
+
+    if [ "$SUBMIT_CODE" = "200" ] || [ "$SUBMIT_CODE" = "201" ]; then
+      FINAL_STATE=$(python3 -c "import json; print(json.load(open('/tmp/submit_resp.json')).get('state',''))" 2>/dev/null || echo "?")
+      echo "✅ 自动审批成功 (state: $FINAL_STATE)"
+      exit 0
+    else
+      echo "❌ 提交审批失败"
+      exit 1
+    fi
+  fi
+
+  # 还有CI在跑 → 继续等
+  if [ "$ANY_PENDING" = "true" ]; then
+    echo "⏳ CI仍在运行中（第${attempt}/12次），超时后将退出等待下次触发..."
+    sleep 10
+    continue
+  fi
+
+  # 所有CI都跑完了但有失败 → 退出
+  if [ "$ANY_FAILED" = "true" ]; then
+    echo
+    echo "❌ CI检查有失败项，不自动审批"
+    exit 0
+  fi
+
+  sleep 10
+done
+
+echo
+echo "⏰ 快速检查超时（2分钟），CI尚未完成，退出等待下次触发（workflow_run事件或5分钟定时扫描）"
+exit 0