部署集成(HEL-227): 合并登录门户/免密切换(HEL-226)到含 HEL-221 修复的部署线

施工(HEL-226): 实现登录门户与本机免密切换账号
用设备 Cookie 和授权表记住本机已验证账号，登录页按确认样图做成门户，不再把密码写进浏览器。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>
2026-08-29 11:34:03 +08:00 · 2026-08-29 11:24:39 +08:00 · 2026-08-28 15:01:22 +00:00
41 changed files with 1861 additions and 475 deletions
@@ -14,29 +14,13 @@
    v
 xiaobai-review 容器 :8765
    |-- /app              只读应用代码
    |   `-- backend/features/heaven/assets/heaven_knowledge.json
    |                     镜像内 seed（不受 data 挂载遮盖）
    `-- /app/data         宿主机 ./data 持久化挂载
        |-- review.db
        |-- iching_zh.json
        `-- heaven_knowledge.json   优先读取；缺失时回退到上方 seed
 ```
 账号、加密后的公共数据 Token、平台模型 API Key、生辰资料、行情快照和复盘数据均在
 `data/review.db`。解密密钥来自 `.env` 中的 `APP_ENCRYPTION_KEY`。数据库与
 密钥必须成对备份，任意一个丢失都无法恢复账号内的加密资料。
 问天静态知识文件：
 - `data/iching_zh.json`、`data/heaven_knowledge.json` 纳入 Git 与镜像构建；
  `.dockerignore` 不排除这两个文件（只排除 `data/*.db`、`data/cache/` 等运行时产物）。
 - Compose 把宿主机 `./data` 整目录挂到 `/app/data`，会遮盖镜像里同路径文件。
  因此宿主机 `data/` 应保留上述两个 JSON；若只缺 `heaven_knowledge.json`，
  服务会回退读取镜像内
  `backend/features/heaven/assets/heaven_knowledge.json`，解势仍可用。
 - 持久化位置：正式环境以宿主机项目目录下的 `./data/heaven_knowledge.json` 为准；
  补文件后无需改代码，重启容器即可加载。
 管理员私有的问师 Skill 保存在宿主机 `data/private-mentor-skills/`。该目录随 `data`
 挂载进入容器，但被 Git 与 Docker 构建上下文排除，不会进入 Gitea 或镜像。私有 Skill
 只对管理员账号返回和开放调用，也会随本指南的 `data` 备份一起保存。
@@ -23,10 +23,7 @@ COPY requirements.txt ./
 RUN python -m pip install --no-cache-dir -r requirements.txt
 COPY --chown=xiaobai:xiaobai . .
-RUN mkdir -p /app/data && chown -R xiaobai:xiaobai /app/data \
+RUN mkdir -p /app/data && chown -R xiaobai:xiaobai /app/data
    && test -f /app/data/heaven_knowledge.json \
    && test -f /app/data/iching_zh.json \
    && test -f /app/backend/features/heaven/assets/heaven_knowledge.json
 USER xiaobai
@@ -18,6 +18,8 @@ TOKEN_PATTERN = re.compile(r"^[A-Za-z0-9_-]{20,128}$")
 USERNAME_PATTERN = re.compile(r"^[A-Za-z0-9_\-\u4e00-\u9fff]{3,30}$")
 SESSION_COOKIE = "xiaobai_session"
 SESSION_MAX_AGE = 30 * 24 * 60 * 60
 DEVICE_COOKIE = "xiaobai_device"
 DEVICE_MAX_AGE = 180 * 24 * 60 * 60
 def load_local_env() -> None:
@@ -2,6 +2,7 @@ from .m0001_adopt_legacy import MIGRATION as M0001_ADOPT_LEGACY
 from .m0002_job_runs import MIGRATION as M0002_JOB_RUNS
 from .m0003_llm_audit import MIGRATION as M0003_LLM_AUDIT
 from .m0004_mentor_notes import MIGRATION as M0004_MENTOR_NOTES
 from .m0005_account_switch_grants import MIGRATION as M0005_ACCOUNT_SWITCH_GRANTS
 from .runner import Migration, MigrationError, MigrationRunner
 MIGRATIONS = (
@@ -9,6 +10,7 @@ MIGRATIONS = (
    M0002_JOB_RUNS,
    M0003_LLM_AUDIT,
    M0004_MENTOR_NOTES,
    M0005_ACCOUNT_SWITCH_GRANTS,
 )
 __all__ = ["MIGRATIONS", "Migration", "MigrationError", "MigrationRunner"]
@@ -0,0 +1,42 @@
 from __future__ import annotations
 import sqlite3
 from backend.database.migrations.runner import Migration
 def create_account_switch_grants(connection: sqlite3.Connection) -> None:
    connection.execute(
        """
        CREATE TABLE IF NOT EXISTS account_switch_grants (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            device_hash TEXT NOT NULL,
            user_id INTEGER NOT NULL,
            granted_at TEXT NOT NULL,
            last_used_at TEXT NOT NULL,
            expires_at TEXT NOT NULL,
            UNIQUE (device_hash, user_id),
            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
        )
        """
    )
    connection.execute(
        """
        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_device
        ON account_switch_grants(device_hash, last_used_at DESC)
        """
    )
    connection.execute(
        """
        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_expiry
        ON account_switch_grants(expires_at)
        """
    )
 MIGRATION = Migration(
    version="0005",
    name="create_account_switch_grants",
    action=create_account_switch_grants,
    signature="account-switch-grants:v1:device,user,granted,used,expires,unique",
 )
@@ -28,11 +28,11 @@ class AccountApplicationMixin:
    def update_membership(self, payload: dict[str, Any]) -> None:
        self.accounts.update_membership(payload)
-    def register_account(self, username: str, password: str) -> dict[str, Any]:
+    def register_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
-        return self.accounts.register(username, password)
+        return self.accounts.register(username, password, device_hash)
-    def login_account(self, username: str, password: str) -> dict[str, Any]:
+    def login_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
-        return self.accounts.login(username, password)
+        return self.accounts.login(username, password, device_hash)
    def change_password(self, current_password: str, new_password: str) -> None:
        self.accounts.change_password(current_password, new_password)
@@ -1,49 +1,108 @@
 from __future__ import annotations
 import json
 import secrets
 from http import HTTPStatus
 from backend.features.accounts.security import token_hash
 class AccountHttpMixin:
    def _device_hash(self) -> str:
        raw = self.device_token()
        return token_hash(raw) if raw else ""
    def _ensure_device_token(self) -> str:
        return self.device_token() or secrets.token_urlsafe(32)
    def _auth_success_headers(self, session_token: str, device_raw: str) -> list[tuple[str, str]]:
        return [
            ("Set-Cookie", self.session_cookie(session_token)),
            ("Set-Cookie", self.device_cookie(device_raw)),
        ]
    def _send_authenticated_session(self, result: dict, status: HTTPStatus, device_raw: str) -> None:
        self.send_json(
            {
                "ok": True,
                "authenticated": True,
                "user": result["user"],
                "csrf_token": result["csrf_token"],
            },
            status,
            self._auth_success_headers(result["session_token"], device_raw),
        )
    def auth_register(self) -> None:
        try:
            body = self.read_json_body()
            device_raw = self._ensure_device_token()
            result = self.application_service.register_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
                token_hash(device_raw),
            )
-            self.send_json(
+            self._send_authenticated_session(result, HTTPStatus.CREATED, device_raw)
                {
                    "ok": True,
                    "authenticated": True,
                    "user": result["user"],
                    "csrf_token": result["csrf_token"],
                },
                HTTPStatus.CREATED,
                {"Set-Cookie": self.session_cookie(result["session_token"])},
            )
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def auth_login(self) -> None:
        try:
            body = self.read_json_body()
            device_raw = self._ensure_device_token()
            result = self.application_service.login_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
                token_hash(device_raw),
            )
-            self.send_json(
+            self._send_authenticated_session(result, HTTPStatus.OK, device_raw)
                {
                    "ok": True,
                    "authenticated": True,
                    "user": result["user"],
                    "csrf_token": result["csrf_token"],
                },
                headers={"Set-Cookie": self.session_cookie(result["session_token"])},
            )
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
    def auth_accounts(self) -> None:
        current_user_id = None
        if self.require_auth(send_error=False):
            current_user_id = int(self.auth_user["id"])
        payload = self.application_service.accounts.list_device_accounts(
            self._device_hash(),
            current_user_id,
        )
        self.send_json({"ok": True, **payload})
    def auth_switch(self) -> None:
        try:
            body = self.read_json_body()
            try:
                user_id = int(body.get("user_id"))
            except (TypeError, ValueError):
                user_id = 0
            device_raw = self.device_token()
            result = self.application_service.accounts.switch_account(
                token_hash(device_raw) if device_raw else "",
                user_id,
            )
            self._send_authenticated_session(
                result,
                HTTPStatus.OK,
                device_raw or self._ensure_device_token(),
            )
        except PermissionError as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def auth_forget(self) -> None:
        try:
            body = self.read_json_body()
            try:
                user_id = int(body.get("user_id"))
            except (TypeError, ValueError):
                user_id = 0
            self.application_service.accounts.forget_account(self._device_hash(), user_id)
        except (ValueError, json.JSONDecodeError):
            pass
        self.send_json({"ok": True})
    def auth_me(self) -> None:
        service = self.application_service
        if not self.require_auth(send_error=False):
@@ -55,6 +114,15 @@ class AccountHttpMixin:
                }
            )
            return
        headers = None
        if not self.device_token():
            device_raw = secrets.token_urlsafe(32)
            service.accounts.remember_account(
                token_hash(device_raw),
                int(self.auth_user["id"]),
                fresh=True,
            )
            headers = [("Set-Cookie", self.device_cookie(device_raw))]
        self.send_json(
            {
                "ok": True,
@@ -66,15 +134,19 @@ class AccountHttpMixin:
                    "membership": service.membership(),
                },
                "csrf_token": str(self.auth_user["csrf_token"]),
-            }
+            },
            headers=headers,
        )
    def auth_logout(self) -> None:
        raw_token = self.session_token()
        user_id = int(getattr(self, "auth_user", {}).get("id") or 0)
        if raw_token:
            from backend.features.accounts.security import token_hash
            self.application_service.database.delete_session(token_hash(raw_token))
        self.application_service.accounts.revoke_current_device_grant(
            self._device_hash(),
            user_id,
        )
        self.send_json(
            {"ok": True},
            headers={"Set-Cookie": self.session_cookie("", clear=True)},
@@ -234,3 +234,96 @@ class AccountRepositoryMixin:
                (user_id,),
            )
            return cursor.rowcount > 0
    def cleanup_expired_switch_grants(self, now: str) -> int:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE expires_at <= ?",
                (now,),
            )
        return int(cursor.rowcount)
    def list_switch_grants(self, device_hash: str, now: str) -> list[dict[str, Any]]:
        with self.connect() as connection:
            rows = connection.execute(
                """
                SELECT u.id, u.username, u.role, u.llm_mode, u.membership_status,
                       u.membership_plan, u.membership_starts_at, u.membership_expires_at,
                       u.created_at, g.last_used_at, g.granted_at, g.expires_at
                FROM account_switch_grants AS g
                JOIN users AS u ON u.id = g.user_id
                WHERE g.device_hash = ? AND g.expires_at > ?
                ORDER BY g.last_used_at DESC, g.id DESC
                """,
                (device_hash, now),
            ).fetchall()
        return [dict(row) for row in rows]
    def get_switch_grant(self, device_hash: str, user_id: int) -> dict[str, Any] | None:
        with self.connect() as connection:
            row = connection.execute(
                """
                SELECT device_hash, user_id, granted_at, last_used_at, expires_at
                FROM account_switch_grants
                WHERE device_hash = ? AND user_id = ?
                """,
                (device_hash, user_id),
            ).fetchone()
        return dict(row) if row else None
    def upsert_switch_grant(
        self,
        device_hash: str,
        user_id: int,
        granted_at: str,
        last_used_at: str,
        expires_at: str,
    ) -> None:
        with self.connect() as connection:
            connection.execute(
                """
                INSERT INTO account_switch_grants
                    (device_hash, user_id, granted_at, last_used_at, expires_at)
                VALUES (?, ?, ?, ?, ?)
                ON CONFLICT(device_hash, user_id) DO UPDATE SET
                    granted_at = excluded.granted_at,
                    last_used_at = excluded.last_used_at,
                    expires_at = excluded.expires_at
                """,
                (device_hash, user_id, granted_at, last_used_at, expires_at),
            )
    def prune_switch_grants(self, device_hash: str, keep: int) -> int:
        with self.connect() as connection:
            rows = connection.execute(
                """
                SELECT id FROM account_switch_grants
                WHERE device_hash = ?
                ORDER BY last_used_at DESC, id DESC
                """,
                (device_hash,),
            ).fetchall()
            extra = [int(row["id"]) for row in rows[keep:]]
            if not extra:
                return 0
            connection.execute(
                f"DELETE FROM account_switch_grants WHERE id IN ({','.join('?' * len(extra))})",
                extra,
            )
        return len(extra)
    def delete_switch_grant(self, device_hash: str, user_id: int) -> bool:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE device_hash = ? AND user_id = ?",
                (device_hash, user_id),
            )
        return cursor.rowcount > 0
    def delete_switch_grants_for_user(self, user_id: int) -> int:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE user_id = ?",
                (user_id,),
            )
        return int(cursor.rowcount)
@@ -6,6 +6,9 @@ class AccountRoutesMixin:
        if parsed.path == "/api/auth/me":
            self.auth_me()
            return True
        if parsed.path == "/api/auth/accounts":
            self.auth_accounts()
            return True
        return False
    def _handle_accounts_get(self, parsed) -> bool:
@@ -77,15 +77,22 @@ class AccountService:
        access = self.access_supplier() or self.database.user_access(self.current_user_id) or {}
        return self.membership_for_access(access)
-    def register(self, username: str, password: str) -> dict[str, Any]:
+    GRANT_SLIDE_DAYS = 30
    GRANT_HARD_DAYS = 180
    MAX_GRANTS_PER_DEVICE = 5
    SWITCH_REAUTH_MESSAGE = "该账号需重新验证"
    def register(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
        username = username.strip()
        self.validate_input(username, password)
        with self.auth_lock:
            salt, password_digest = hash_password(password)
            user = self.database.create_user(username, salt, password_digest)
-        return self.create_session(user)
+        result = self.create_session(user)
        self.remember_account(device_hash, int(user["id"]), fresh=True)
        return result
-    def login(self, username: str, password: str) -> dict[str, Any]:
+    def login(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
        username = username.strip()
        if not username or not password:
            raise ValueError("账号名和密码不能为空。")
@@ -96,7 +103,9 @@ class AccountService:
            str(user.get("password_hash") or ""),
        ):
            raise ValueError("账号名或密码不正确。")
-        return self.create_session(user)
+        result = self.create_session(user)
        self.remember_account(device_hash, int(user["id"]), fresh=True)
        return result
    def change_password(self, current_password: str, new_password: str) -> None:
        current_password = str(current_password or "")
@@ -112,6 +121,86 @@ class AccountService:
        salt, digest = hash_password(new_password)
        if not self.database.update_user_password(self.current_user_id, salt, digest):
            raise ValueError("账号不存在。")
        self.database.delete_switch_grants_for_user(self.current_user_id)
    @staticmethod
    def _utc_now() -> datetime:
        return datetime.now(timezone.utc)
    @classmethod
    def _iso(cls, value: datetime) -> str:
        return value.isoformat(timespec="seconds")
    def remember_account(self, device_hash: str, user_id: int, *, fresh: bool = False) -> None:
        if not device_hash or user_id <= 0:
            return
        now = self._utc_now()
        now_text = self._iso(now)
        self.database.cleanup_expired_switch_grants(now_text)
        existing = None if fresh else self.database.get_switch_grant(device_hash, user_id)
        granted_at = parse_iso_datetime(existing["granted_at"]) if existing else now
        if granted_at is None:
            granted_at = now
        expires = min(
            now + timedelta(days=self.GRANT_SLIDE_DAYS),
            granted_at + timedelta(days=self.GRANT_HARD_DAYS),
        )
        if not existing:
            self.database.prune_switch_grants(device_hash, self.MAX_GRANTS_PER_DEVICE - 1)
        self.database.upsert_switch_grant(
            device_hash,
            user_id,
            self._iso(granted_at),
            now_text,
            self._iso(expires),
        )
    def list_device_accounts(
        self, device_hash: str, current_user_id: int | None = None
    ) -> dict[str, Any]:
        if not device_hash:
            return {"accounts": [], "current_user_id": current_user_id}
        now_text = self._iso(self._utc_now())
        self.database.cleanup_expired_switch_grants(now_text)
        accounts = []
        for row in self.database.list_switch_grants(device_hash, now_text):
            accounts.append(
                {
                    "user_id": int(row["id"]),
                    "username": str(row["username"]),
                    "role": str(row.get("role") or "user"),
                    "membership": self.membership_for_access(row),
                    "last_used_at": str(row.get("last_used_at") or ""),
                }
            )
        return {"accounts": accounts, "current_user_id": current_user_id}
    def switch_account(self, device_hash: str, user_id: int) -> dict[str, Any]:
        if not device_hash or user_id <= 0:
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        now = self._utc_now()
        now_text = self._iso(now)
        self.database.cleanup_expired_switch_grants(now_text)
        grant = self.database.get_switch_grant(device_hash, user_id)
        expires = parse_iso_datetime(grant.get("expires_at")) if grant else None
        if not grant or not expires or expires <= now:
            if grant:
                self.database.delete_switch_grant(device_hash, user_id)
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        user = self.database.user_access(user_id)
        if not user:
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        result = self.create_session(user)
        self.remember_account(device_hash, user_id)
        return result
    def forget_account(self, device_hash: str, user_id: int) -> None:
        if device_hash and user_id > 0:
            self.database.delete_switch_grant(device_hash, user_id)
    def revoke_current_device_grant(self, device_hash: str, user_id: int) -> None:
        if device_hash and user_id > 0:
            self.database.delete_switch_grant(device_hash, user_id)
    def create_session(self, user: dict[str, Any]) -> dict[str, Any]:
        session_token = secrets.token_urlsafe(32)
@@ -1,117 +0,0 @@
 {
  "version": "2026.08.05-5",
  "sources": {
    "zhouyi": {
      "title": "周易经文与十翼",
      "scope": "卦辞、爻辞、彖传、象传",
      "kind": "public_domain_primary",
      "note": "观势与观心只引用本项目已校录的卦爻原文，不把现代网络释文当作原典。"
    },
    "jingfang": {
      "title": "京氏易传",
      "scope": "八宫与纳甲体系来源",
      "kind": "public_domain_traditional",
      "note": "确定性程序采用京房纳甲、八宫世应的通行排法。"
    },
    "huozhulin": {
      "title": "火珠林",
      "scope": "纳甲筮法、六亲与日月关系",
      "kind": "public_domain_traditional",
      "note": "用于观心规则脉络，不直接复制后世简化断语。"
    },
    "zengshan": {
      "title": "增删卜易",
      "scope": "用神、世应、动变、日月旺衰",
      "kind": "public_domain_traditional",
      "note": "只采用可明确编码且有一致输入条件的规则；争议规则单独标记。"
    },
    "neijing": {
      "title": "黄帝内经·素问运气七篇",
      "scope": "五运、司天在泉、主客气与运气关系",
      "kind": "public_domain_primary",
      "note": "观气将原典关系转成当日自我观察语言，不宣称对股价存在因果作用。"
    }
  },
  "trend": {
    "method": "本卦说明当下结构，实际动爻说明变化关节，之卦说明所趋结构；多动爻全部保留，不以固定口诀删去用户实际得到的爻。",
    "rules": {
      "stable": "无动爻时以本卦整体、上下卦关系和大象为主，说明结构的延续条件，不把静止等同于永远不变。",
      "single": "一爻动时以该爻的时位、爻辞和象辞为变化核心，并用之卦检查变化后的结构。",
      "multiple": "多爻动时逐一保留相关爻义，先找共同方向与冲突，再结合之卦给出有条件的倾向；不得用固定套话把不同动爻压成同一结论。"
    }
  },
  "fortune": {
    "principle": "先立中运与司天在泉的年纲，再察当前客气加临主气，最后以日辰说明当日触发；不使用产品权重推导传统结论。",
    "movement": {
      "太过": "太过表示该运之气偏于有余，解释时同时观察其本气表现与对所胜、所生关系的牵动，不直接等同于吉或凶。",
      "不及": "不及表示该运之气偏于不足，解释时同时观察其所不胜来乘与所生受累的可能，不直接等同于弱势结论。"
    },
    "qi": {
      "厥阴风木": "厥阴取风木之动，侧重疏泄、升发、变化与不定；偏盛时可表现为动摇、急变或升散不收。",
      "少阴君火": "少阴取君火之明与热，侧重显化、温煦和内在驱动；偏盛时容易躁热，受制时则显而不畅。",
      "太阴湿土": "太阴取湿土之濡与承载，侧重黏滞、蓄积和转化；偏盛时容易困重迟缓，得化时则能承接。",
      "少阳相火": "少阳取相火之行与枢转，侧重外达、加速和往来；偏盛时容易浮越躁动，受阻时表现为枢机不利。",
      "阳明燥金": "阳明取燥金之收与清肃，侧重收敛、裁决和边界；偏盛时容易干急严峻，得润时则清明有序。",
      "太阳寒水": "太阳取寒水之藏与凝，侧重潜藏、收引和下行；偏盛时容易凝滞退缩，得温时则蓄势有根。"
    },
    "relations": {
      "same": "客主同气表示同类气相并，重点看是否相得而彰，还是同气偏盛而亢；不能机械判为有利。",
      "guest_generates_host": "客生主表示来气生助时令本气，气机较易衔接；仍需观察生助是否过度及年纲是否承接。",
      "host_generates_guest": "主生客表示时令本气向来气流转，有相生也有外泄；不能只取相生而忽略主气受耗。",
      "guest_controls_host": "客克主表示来气制约主气，传统称客胜为从；重点解释外来变化居上及原有节律受制。",
      "host_controls_guest": "主克客表示主气制约来气，传统称主胜为逆；重点解释时令与来气相持而不把相克直接断凶。"
    },
    "day_trigger": "日辰只说明当日关系如何被触发，不与中运、司天在泉或主客气并列重复计权。",
    "industry_boundary": "五行对应行业只作传统取象：可以说明本次已经出现的五行之气对相应行业形成的象征性关注、节奏或约束，但不得读取或猜测行业实时行情，不得预测涨跌，也不得把取象写成投资推荐。",
    "personal_boundary": "personal.natal_day_master才是用户本命日主；today_relative_to_natal_day_master中的pillars是当日历法，stem_relations只是当日年、月、日三柱天干相对本命日主的确定性关系标签。只能使用本次检索到的关系释义，不得自行重算十神、扩展五行生克、使用藏干、库气或支的燥湿属性，也不得把当日日柱称为用户命局，或由这些字段推断命局中某一十神偏重、身强身弱或喜用神。",
    "personal_relations": {
      "比肩": "比肩作为当日天干关系标签，只提示用户可能更在意自主判断、同类比较或坚持原有立场；不能据此判断命局强弱或现实事件。",
      "劫财": "劫财作为当日天干关系标签，只提示用户留意精力、注意力或可支配资源在同类事项间的分流与竞争感；不等同于破财或他人争夺。",
      "食神": "食神作为当日天干关系标签，只提示用户留意表达、输出、舒缓与完成感；不等同于收益或确定的轻松结果。",
      "伤官": "伤官作为当日天干关系标签，只提示用户留意质疑规则、急于表达或追求自主空间的倾向；不等同于冲突或违规。",
      "偏财": "偏财作为当日天干关系标签，只提示用户留意机会分配、灵活取舍与非固定资源的吸引力；不等同于意外获利。",
      "正财": "正财作为当日天干关系标签，只提示用户更关注可核对的结果、资源边界和务实落地；不等同于必得收益或现金变化。",
      "七杀": "七杀作为当日天干关系标签，只提示用户留意紧迫感、外部压力和快速决断冲动；不等同于危险必然发生。",
      "正官": "正官作为当日天干关系标签，只提示用户更在意规则、责任、秩序和可交付标准；不等同于结果必然受控。",
      "偏印": "偏印作为当日天干关系标签，只提示用户留意内省、非惯常信息和反复推敲的倾向；不等同于退缩、失眠或方向错误。",
      "正印": "正印作为当日天干关系标签，只提示用户更在意依据、支持、学习和安全边界；不等同于必然获得帮助。"
    }
  },
  "heart": {
    "presets": {
      "trade": "关于我心中的这笔交易，此刻最需要看清的机会、阻碍与风险是什么？",
      "mind": "此刻影响我交易判断的情绪、执念或盲点是什么？",
      "unthemed": "不设具体问题，只观此刻一念。"
    },
    "focus": {
      "trade": "以世爻、应爻、妻财爻及实际动变为主要检索对象，同时检查兄弟、官鬼和子孙的生克，不把任何单一六亲固定判吉凶。",
      "mind": "以世爻和实际动爻为主，观察官鬼所示压力、子孙所示舒解及内外生克；不把心境问题强行翻译成价格方向。",
      "unthemed": "不强选事项用神，以本卦、世爻、实际动爻和之卦作一般观照，不猜测用户没有提出的问题。",
      "custom": "先依据用户明确写出的股票交易问题选择相关六亲；无法明确归类时退回世爻、动爻和卦变的一般解释，不擅自补全问题。"
    },
    "evidence_order": [
      "用户问题与预设来源",
      "本卦及卦宫",
      "世应与所问相关六亲",
      "月建日辰、旬空及冲合生克",
      "实际动爻与变爻",
      "之卦与整体卦义",
      "六神辅助象义"
    ],
    "limits": "六神只作辅助象义；空亡、月破、日冲、合冲刑害均需结合用神、世应和动变，不得单项宣布结果。",
    "semantics": {
      "self_response": "世爻表示求测者当前立场与承受状态，应爻表示所问事项的外部一端或对照面。应爻不是固定的合作方、庄家或资金方；只有用户问题明确给出该角色时，才可作对应解释。",
      "calendar": "月建与日辰用于判断爻在起卦时刻的承受、生扶和制约。旬空表示该爻所象征的条件当下可能未落实、难发挥或有名无实，但不能单凭旬空判失败，也不能用填实日期预测何时涨跌或行动。月破、日冲、六合、六冲、六害和相刑同样必须与世应、相关六亲及动变合看。",
      "movement": "动爻说明关系正在变化；变爻说明变化后的承接方向。回头生、回头克和原变爻生克只描述力量关系，不自动对应现实中的借贷、融资、合作或某个具体人物。进神退神只说明同类地支变化的进退趋势，不直接宣布价格方向。",
      "six_spirits": "六神只补充表达色彩，不单独定成败。青龙不必然有利，白虎不必然紧急或凶险，朱雀不必然等同口舌，玄武不必然等同欺骗，勾陈与螣蛇也不得脱离爻位、六亲和动变独断。",
      "timing_boundary": "观心不作应期预测。可以说明某项条件在起卦时刻尚未落实或受制，但不得给出未来若干日、某干支日、出空或填实后必然发生什么。",
      "relatives": {
        "兄弟": "兄弟是与卦宫五行同类的关系。在股票交易问题中可作为竞争、同类力量或资源分流的候选象义，但不直接等同合作方、亏损或他人拿走资金。",
        "子孙": "子孙是卦宫所生的关系，可作为舒缓、产出、执行后的释放或对压力的制衡候选象义，但不直接等同收益、资金提供方或确定的利好。",
        "妻财": "妻财是卦宫所克的关系，在股票交易问题中可作为价值、收益预期、持仓利益或可支配资源的候选象义，但不直接等同现金、融资、自有资金或必得之财。",
        "官鬼": "官鬼是克制卦宫的关系，可作为压力、风险、规则约束或担忧的候选象义，但不直接等同借贷、坏消息、疾病或必然损失。",
        "父母": "父母是生助卦宫的关系，可作为信息、依据、计划、规则、凭据或保护条件的候选象义，但不直接等同政策、合同或某一条消息。"
      }
    }
  }
 }
@@ -3,24 +3,15 @@ from __future__ import annotations
 import json
 from http import HTTPStatus
 from backend.features.heaven.knowledge import HeavenKnowledgeError
 class HeavenHttpMixin:
    def _send_heaven_client_error(self, exc: Exception) -> None:
        payload: dict = {"error": str(exc)}
        code = getattr(exc, "error_code", None)
        if code:
            payload["code"] = str(code)
        self.send_json(payload, HTTPStatus.BAD_REQUEST)
    def heaven_hexagram(self) -> None:
        try:
            body = self.read_json_body()
            result = self.application_service.heaven_hexagram(body.get("lines"))
            self.send_json({"ok": True, "hexagram": result})
        except (ValueError, json.JSONDecodeError) as exc:
-            self._send_heaven_client_error(exc)
+            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def heaven_personal(self) -> None:
        try:
@@ -28,12 +19,12 @@ class HeavenHttpMixin:
            result = self.application_service.heaven_personal(body)
            self.send_json({"ok": True, "personal": result})
        except (ValueError, json.JSONDecodeError) as exc:
-            self._send_heaven_client_error(exc)
+            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def heaven_interpret(self) -> None:
        try:
            body = self.read_json_body()
            result = self.application_service.heaven_interpret(body)
            self.send_json({"ok": True, **result})
-        except (HeavenKnowledgeError, ValueError, json.JSONDecodeError) as exc:
+        except (ValueError, json.JSONDecodeError) as exc:
-            self._send_heaven_client_error(exc)
+            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
@@ -2,23 +2,12 @@ from __future__ import annotations
 import json
 from functools import lru_cache
 from pathlib import Path
 from typing import Any
 from backend.bootstrap.config import APP_DIR
 KNOWLEDGE_FILE = APP_DIR / "data" / "heaven_knowledge.json"
 # Baked into the image outside the ./data bind mount so volume overlay cannot hide it.
 KNOWLEDGE_SEED_FILE = Path(__file__).resolve().parent / "assets" / "heaven_knowledge.json"
 class HeavenKnowledgeError(ValueError):
    """Structured knowledge-file failure surfaced to HTTP as Chinese API errors."""
    def __init__(self, message: str, *, code: str) -> None:
        super().__init__(message)
        self.error_code = code
 def prepare_heaven_context(mode: str, calculation: dict[str, Any]) -> dict[str, Any]:
@@ -390,49 +379,9 @@ def _line_record(line: dict[str, Any]) -> dict[str, Any]:
    }
 def resolve_heaven_knowledge_path() -> Path:
    """Prefer the persisted data-dir file; fall back to the image-baked seed."""
    if KNOWLEDGE_FILE.is_file():
        return KNOWLEDGE_FILE
    if KNOWLEDGE_SEED_FILE.is_file():
        return KNOWLEDGE_SEED_FILE
    raise HeavenKnowledgeError(
        "问天知识文件缺失：未找到 heaven_knowledge.json。"
        "请确认宿主机 data 目录或镜像内 seed 文件完整。",
        code="heaven_knowledge_missing",
    )
@lru_cache(maxsize=1)
 def _knowledge_catalog() -> dict[str, Any]:
-    path = resolve_heaven_knowledge_path()
+    payload = json.loads(KNOWLEDGE_FILE.read_text(encoding="utf-8"))
    try:
        raw = path.read_text(encoding="utf-8")
    except OSError as exc:
        raise HeavenKnowledgeError(
            f"问天知识文件无法读取（{path.name}）：{exc.strerror or exc}",
            code="heaven_knowledge_missing",
        ) from exc
    try:
        payload = json.loads(raw)
    except json.JSONDecodeError as exc:
        raise HeavenKnowledgeError(
            f"问天知识文件 JSON 损坏（{path.name}），无法解析："
            f"第 {exc.lineno} 行附近。",
            code="heaven_knowledge_invalid",
        ) from exc
    if not isinstance(payload, dict):
        raise HeavenKnowledgeError(
            f"问天知识文件格式不正确（{path.name}）：根节点必须是对象。",
            code="heaven_knowledge_invalid",
        )
    if not payload.get("version") or not isinstance(payload.get("sources"), dict):
-        raise HeavenKnowledgeError(
+        raise ValueError("问天知识库格式不完整。")
            f"问天知识库格式不完整（{path.name}）：缺少 version 或 sources。",
            code="heaven_knowledge_invalid",
        )
    return payload
 def clear_heaven_knowledge_cache() -> None:
    _knowledge_catalog.cache_clear()
@@ -7,6 +7,8 @@ from urllib.parse import urlparse
 PUBLIC_POST_HANDLERS = {
    "/api/auth/register": "auth_register",
    "/api/auth/login": "auth_login",
    "/api/auth/switch": "auth_switch",
    "/api/auth/forget": "auth_forget",
 }
 AUTHENTICATED_POST_HANDLERS = {
@@ -9,7 +9,13 @@ from http.cookies import SimpleCookie
 from typing import Any
 from urllib.parse import unquote
-from backend.bootstrap.config import SESSION_COOKIE, SESSION_MAX_AGE, STATIC_DIR
+from backend.bootstrap.config import (
    DEVICE_COOKIE,
    DEVICE_MAX_AGE,
    SESSION_COOKIE,
    SESSION_MAX_AGE,
    STATIC_DIR,
 )
 from backend.features.accounts.security import token_hash
 from backend.http.context import correlation_id
 from backend.http.errors import normalize_error_payload
@@ -21,15 +27,21 @@ class HttpTransportMixin:
    application_service: Any
    route_registry: Any
-    def session_token(self) -> str:
+    def cookie_value(self, name: str) -> str:
        cookie = SimpleCookie()
        try:
            cookie.load(self.headers.get("Cookie", ""))
        except Exception:
            return ""
-        morsel = cookie.get(SESSION_COOKIE)
+        morsel = cookie.get(name)
        return morsel.value if morsel else ""
    def session_token(self) -> str:
        return self.cookie_value(SESSION_COOKIE)
    def device_token(self) -> str:
        return self.cookie_value(DEVICE_COOKIE)
    def require_auth(self, send_error: bool = True) -> bool:
        raw_token = self.session_token()
        service = self.application_service
@@ -79,15 +91,18 @@ class HttpTransportMixin:
            return self.require_member()
        return True
-    def session_cookie(self, value: str, clear: bool = False) -> str:
+    def _cookie_header(self, name: str, value: str, max_age: int) -> str:
-        max_age = 0 if clear else SESSION_MAX_AGE
+        cookie = f"{name}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
        cookie = (
            f"{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
        )
        if self.headers.get("X-Forwarded-Proto", "").lower() == "https":
            cookie += "; Secure"
        return cookie
    def session_cookie(self, value: str, clear: bool = False) -> str:
        return self._cookie_header(SESSION_COOKIE, value, 0 if clear else SESSION_MAX_AGE)
    def device_cookie(self, value: str, clear: bool = False) -> str:
        return self._cookie_header(DEVICE_COOKIE, value, 0 if clear else DEVICE_MAX_AGE)
    def read_json_body(self, allow_empty: bool = False) -> dict[str, Any]:
        length = int(self.headers.get("Content-Length", "0"))
        if length == 0 and allow_empty:
@@ -132,7 +147,7 @@ class HttpTransportMixin:
        self,
        payload: dict[str, Any],
        status: HTTPStatus = HTTPStatus.OK,
-        headers: dict[str, str] | None = None,
+        headers: dict[str, str] | list[tuple[str, str]] | tuple[tuple[str, str], ...] | None = None,
    ) -> None:
        request_id = getattr(self, "_correlation_id", "")
        if not request_id:
@@ -145,7 +160,8 @@ class HttpTransportMixin:
        self.send_header("Content-Length", str(len(content)))
        self.send_header("Cache-Control", "no-store")
        self.send_header("X-Request-ID", request_id)
-        for name, value in (headers or {}).items():
+        header_items = headers.items() if isinstance(headers, dict) else (headers or ())
        for name, value in header_items:
            self.send_header(name, value)
        self.end_headers()
        self.wfile.write(content)
@@ -128,6 +128,20 @@
      "feature": "auction",
      "access": "authenticated"
    },
    {
      "method": "GET",
      "path": "/api/auth/accounts",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/forget",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/login",
@@ -156,6 +170,13 @@
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/switch",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/backfill",
@@ -10,10 +10,10 @@
  },
  "counts": {
    "primary_pages": 16,
-    "api_exact_paths": 53,
+    "api_exact_paths": 56,
    "api_prefixes": 0,
    "api_patterns": 11,
-    "database_tables": 36,
+    "database_tables": 37,
    "frontend_page_fragments": 12
  },
  "pages": [
@@ -96,10 +96,13 @@
      "/api/assistant/chat",
      "/api/assistant/messages",
      "/api/auction",
      "/api/auth/accounts",
      "/api/auth/forget",
      "/api/auth/login",
      "/api/auth/logout",
      "/api/auth/me",
      "/api/auth/register",
      "/api/auth/switch",
      "/api/backfill",
      "/api/chart/intraday",
      "/api/dashboard",
@@ -189,6 +192,7 @@
    "assistant_messages",
    "heaven_readings",
    "job_runs",
    "account_switch_grants",
    "schema_migrations"
  ],
  "background_job_methods": [
@@ -370,10 +374,10 @@
    }
  ],
  "css_layers": [
-    "/shared/tokens.css?v=20260820-3",
+    "/shared/tokens.css?v=20260829-1",
    "/shared/base.css?v=20260806-1",
    "/shared/shell.css?v=20260820-8",
-    "/shared/auth.css?v=20260820-5",
+    "/shared/auth.css?v=20260829-1",
    "/shared/components/controls.css?v=20260820-2",
    "/shared/components/navigation.css?v=20260820-1",
    "/shared/components/cards.css?v=20260820-1",
@@ -446,8 +450,8 @@
    },
    {
      "path": "frontend/pages/heaven/page.js",
-      "bytes": 97268,
+      "bytes": 97189,
-      "lines": 2070
+      "lines": 2069
    },
    {
      "path": "frontend/shared/shell.css",
@@ -461,8 +465,8 @@
    },
    {
      "path": "frontend/index.html",
-      "bytes": 47871,
+      "bytes": 48037,
-      "lines": 661
+      "lines": 663
    },
    {
      "path": "backend/features/screener/catalog.py",
@@ -551,8 +555,8 @@
    },
    {
      "path": "frontend/shared/session.js",
-      "bytes": 13176,
+      "bytes": 12848,
-      "lines": 293
+      "lines": 283
    },
    {
      "path": "backend/features/market/insights_auction_data.py",
@@ -716,8 +720,8 @@
    },
    {
      "path": "backend/http/dispatch.py",
-      "bytes": 4118,
+      "bytes": 4196,
-      "lines": 115
+      "lines": 117
    },
    {
      "path": "frontend/shared/table.js",
@@ -734,16 +738,16 @@
      "bytes": 3369,
      "lines": 81
    },
    {
      "path": "frontend/app.js",
      "bytes": 3337,
      "lines": 95
    },
    {
      "path": "frontend/pages/themes/page.html",
      "bytes": 3316,
      "lines": 55
    },
    {
      "path": "frontend/app.js",
      "bytes": 3201,
      "lines": 93
    },
    {
      "path": "backend/features/market/insights_context.py",
      "bytes": 3175,
@@ -761,7 +765,7 @@
    },
    {
      "path": "backend/features/accounts/application.py",
-      "bytes": 2442,
+      "bytes": 2514,
      "lines": 63
    },
    {
@@ -849,6 +853,11 @@
      "bytes": 1143,
      "lines": 19
    },
    {
      "path": "backend/features/accounts/routes.py",
      "bytes": 908,
      "lines": 25
    },
    {
      "path": "backend/features/popularity/routes.py",
      "bytes": 822,
@@ -859,11 +868,6 @@
      "bytes": 817,
      "lines": 23
    },
    {
      "path": "backend/features/accounts/routes.py",
      "bytes": 803,
      "lines": 22
    },
    {
      "path": "backend/features/sentiment/routes.py",
      "bytes": 724,
@@ -25,8 +25,10 @@ async function initialize() {
  try {
    const session = await apiRequest("/api/auth/me");
    if (!session.authenticated) {
-      if (session.registration_required) selectAuthMode("register");
+      const params = new URLSearchParams();
-      showAuthGate();
+      if (session.registration_required) params.set("mode", "register");
      const query = params.toString();
      window.location.replace("/login/" + (query ? `?${query}` : ""));
      return;
    }
    await applyAuthenticatedSession(session);
@@ -24,7 +24,9 @@
    (() => {
      let theme = "light";
      try {
-        theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
+        const stored = localStorage.getItem("xiaobaiTheme");
        if (stored === "dark" || stored === "light") theme = stored;
        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
      } catch (_error) {
        theme = "light";
      }
@@ -32,10 +34,10 @@
      document.documentElement.style.colorScheme = theme;
    })();
  </script>
-  <link rel="stylesheet" href="/shared/tokens.css?v=20260820-3">
+  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-1">
  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
  <link rel="stylesheet" href="/shared/shell.css?v=20260820-8">
-  <link rel="stylesheet" href="/shared/auth.css?v=20260820-5">
+  <link rel="stylesheet" href="/shared/auth.css?v=20260829-1">
  <link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
  <link rel="stylesheet" href="/shared/components/navigation.css?v=20260820-1">
  <link rel="stylesheet" href="/shared/components/cards.css?v=20260820-1">
@@ -57,7 +59,7 @@
  <link rel="stylesheet" href="/pages/review/foundation.css?v=20260820-4">
 </head>
 <body>
-  <section id="authGate" class="auth-gate" aria-label="账号登录">
+  <section id="authGate" class="auth-gate" aria-label="账号登录" hidden>
    <div class="auth-shell">
      <div class="auth-brand">
        <div class="brand-mark" aria-hidden="true"><span class="brand-glyph">复</span></div>
@@ -0,0 +1,59 @@
 <!doctype html>
 <html lang="zh-CN">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="color-scheme" content="light dark">
  <title>登录 · 小白复盘</title>
  <script>
    (() => {
      let theme = "light";
      try {
        const stored = localStorage.getItem("xiaobaiTheme");
        if (stored === "dark" || stored === "light") theme = stored;
        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
      } catch (_error) {
        theme = "light";
      }
      document.documentElement.dataset.theme = theme;
      document.documentElement.style.colorScheme = theme;
    })();
  </script>
  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-1">
  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
  <link rel="stylesheet" href="/shared/auth.css?v=20260829-1">
  <link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
 </head>
 <body class="login-portal">
  <button id="loginThemeToggle" class="login-theme-toggle" type="button">🌙 夜间</button>
  <aside class="login-brand" aria-hidden="true">
    <div class="login-brand-mark"><span class="login-brand-glyph">复</span></div>
    <p class="login-brand-kicker">收盘之后 · 复盘开始</p>
    <h1 class="login-brand-title">小白复盘</h1>
    <p class="login-brand-lead">看懂情绪周期，把复盘变成下一次的先手。</p>
    <dl class="login-brand-stats">
      <div class="login-stat">
        <dt>市场情绪</dt>
        <dd>72 <span class="login-stat-tag">高热</span></dd>
      </div>
      <div class="login-stat">
        <dt>涨停</dt>
        <dd>63</dd>
      </div>
      <div class="login-stat">
        <dt>跌停</dt>
        <dd>4</dd>
      </div>
      <div class="login-stat">
        <dt>两市成交</dt>
        <dd>1.02万亿</dd>
      </div>
    </dl>
  </aside>
  <main class="login-stage">
    <section class="login-card" id="loginCard" aria-live="polite"></section>
  </main>
  <script src="/shared/api.js?v=20260803-2"></script>
  <script src="/login/page.js?v=20260829-1"></script>
 </body>
 </html>
@@ -0,0 +1,273 @@
 (function bootLoginPortal(global) {
  "use strict";
  const THEME_KEY = "xiaobaiTheme";
  const api = global.XiaobaiAPI;
  const card = document.querySelector("#loginCard");
  const themeButton = document.querySelector("#loginThemeToggle");
  const state = {
    view: "first",
    mode: "login",
    accounts: [],
    currentUserId: null,
    loading: false,
    confirmingId: null,
    error: "",
  };
  function escapeHtml(value) {
    return String(value ?? "").replace(/[&<>"']/g, (ch) => (
      { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch]
    ));
  }
  function preferredTheme() {
    try {
      const stored = global.localStorage.getItem(THEME_KEY);
      if (stored === "dark" || stored === "light") return stored;
    } catch (_error) {
      // Fall through to the system preference.
    }
    return global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches
      ? "dark"
      : "light";
  }
  function applyTheme(theme, persist) {
    const normalized = theme === "dark" ? "dark" : "light";
    document.documentElement.dataset.theme = normalized;
    document.documentElement.style.colorScheme = normalized;
    themeButton.textContent = normalized === "dark" ? "☀ 日间" : "🌙 夜间";
    themeButton.setAttribute("aria-label", normalized === "dark" ? "切换到日间模式" : "切换到夜间模式");
    if (persist) {
      try {
        global.localStorage.setItem(THEME_KEY, normalized);
      } catch (_error) {
        // Theme still applies for the current page when storage is unavailable.
      }
    }
  }
  function setError(message) {
    state.error = message || "";
  }
  function membershipLabel(account) {
    if (account.role === "admin") return account.membership?.subscribed ? "管理员 · 会员" : "管理员";
    return account.membership?.subscribed ? "会员" : "普通用户";
  }
  function enterApp() {
    const next = new URLSearchParams(global.location.search).get("next");
    global.location.replace(next && next.startsWith("/") ? next : "/");
  }
  function formMarkup(options) {
    const registering = state.mode === "register";
    const submitLabel = options.submitLabel
      || (state.loading ? "正在登录..." : registering ? "注册并进入" : options.add ? "添加并进入" : "登录");
    return [
      options.back
        ? '<button class="login-back" type="button" data-login-action="picker">返回账号列表</button>'
        : "",
      `<h2 class="login-card-title">${escapeHtml(options.title)}</h2>`,
      `<p class="login-card-lead">${escapeHtml(options.lead)}</p>`,
      '<div class="login-tabs" role="tablist">',
      `<button class="login-tab${state.mode === "login" ? " is-active" : ""}" type="button" data-auth-mode="login">登录</button>`,
      `<button class="login-tab${state.mode === "register" ? " is-active" : ""}" type="button" data-auth-mode="register">注册</button>`,
      "</div>",
      '<form class="login-form" id="loginForm">',
      '<label class="form-field"><span>账号名</span><input id="loginUsername" type="text" minlength="3" maxlength="30" autocomplete="username" required></label>',
      `<label class="form-field"><span>密码</span><input id="loginPassword" type="password" minlength="8" maxlength="128" autocomplete="${registering ? "new-password" : "current-password"}" required></label>`,
      `<label class="form-field" id="loginConfirmField"${registering ? "" : " hidden"}><span>确认密码</span><input id="loginPasswordConfirm" type="password" minlength="8" maxlength="128" autocomplete="new-password"${registering ? " required" : ""}></label>`,
      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : '<p class="login-error" hidden></p>',
      `<button class="button primary login-submit" type="submit"${state.loading ? " disabled" : ""}>`,
      state.loading ? '<span class="login-spinner" aria-hidden="true"></span>' : "",
      `<span>${escapeHtml(submitLabel)}</span></button>`,
      "</form>",
      '<p class="login-hint">密码连续输错 5 次将锁定 10 分钟。还没有账号？切换到「注册」创建。</p>',
    ].join("");
  }
  function accountRow(account) {
    const current = Number(account.user_id) === Number(state.currentUserId);
    const confirming = Number(state.confirmingId) === Number(account.user_id);
    const classes = `login-account-row${current ? " is-current" : ""}${confirming ? " is-confirming" : ""}`;
    if (state.view === "manage" && confirming) {
      return [
        `<div class="${classes}" data-user-id="${account.user_id}">`,
        `<p class="login-confirm-copy">移除「${escapeHtml(account.username)}」的本机记录？</p>`,
        '<div class="login-confirm-actions">',
        `<button class="button danger-button" type="button" data-forget-id="${account.user_id}">移除</button>`,
        '<button class="button" type="button" data-login-action="cancel-forget">取消</button>',
        "</div></div>",
      ].join("");
    }
    const action = state.view === "manage"
      ? `<button class="login-account-remove" type="button" data-confirm-id="${account.user_id}">移除</button>`
      : current
        ? '<span class="login-account-check" aria-hidden="true">✓</span>'
        : `<button class="login-account-enter" type="button" data-switch-id="${account.user_id}">进入</button>`;
    return [
      `<div class="${classes}" data-user-id="${account.user_id}">`,
      '<div class="login-account-meta">',
      `<strong>${escapeHtml(account.username)}</strong>`,
      `<span>${escapeHtml(membershipLabel(account))}${current ? " · 当前" : ""}</span>`,
      "</div>",
      action,
      "</div>",
    ].join("");
  }
  function pickerMarkup() {
    const count = state.accounts.length;
    const managing = state.view === "manage";
    return [
      `<h2 class="login-card-title">${managing ? "管理账号记录" : "选择账号"}</h2>`,
      `<p class="login-card-lead">这台电脑已记录 ${count} 个账号，可直接进入，无需再次输入密码。</p>`,
      managing
        ? '<button class="login-manage" type="button" data-login-action="picker">完成</button>'
        : "",
      `<div class="login-account-list">${state.accounts.map(accountRow).join("")}</div>`,
      managing
        ? ""
        : '<button class="login-add" type="button" data-login-action="add">＋ 添加账号</button>',
      managing
        ? ""
        : '<button class="login-manage" type="button" data-login-action="manage">管理已记录的账号</button>',
      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : "",
      '<p class="login-privacy"><span class="login-lock" aria-hidden="true">🔒</span>账号记录仅保存在这台电脑的浏览器中</p>',
    ].join("");
  }
  function render() {
    card.classList.toggle("is-loading", state.loading);
    if (state.view === "first" || state.view === "add") {
      card.innerHTML = formMarkup({
        title: state.view === "add" ? "添加账号" : "欢迎回来",
        lead: "登录后进入你的复盘空间",
        add: state.view === "add",
        back: state.view === "add",
      });
    } else {
      card.innerHTML = pickerMarkup();
    }
    bindCard();
  }
  function bindCard() {
    card.querySelectorAll("[data-auth-mode]").forEach((button) => {
      button.addEventListener("click", () => {
        state.mode = button.dataset.authMode === "register" ? "register" : "login";
        setError("");
        render();
      });
    });
    card.querySelectorAll("[data-login-action]").forEach((button) => {
      button.addEventListener("click", () => {
        const action = button.dataset.loginAction;
        if (action === "picker") {
          state.view = state.accounts.length ? "picker" : "first";
          state.confirmingId = null;
        } else if (action === "add") {
          state.view = "add";
          state.mode = "login";
        } else if (action === "manage") {
          state.view = "manage";
        } else if (action === "cancel-forget") {
          state.confirmingId = null;
        }
        setError("");
        render();
      });
    });
    card.querySelectorAll("[data-switch-id]").forEach((button) => {
      button.addEventListener("click", () => switchAccount(Number(button.dataset.switchId)));
    });
    card.querySelectorAll("[data-confirm-id]").forEach((button) => {
      button.addEventListener("click", () => {
        state.confirmingId = Number(button.dataset.confirmId);
        render();
      });
    });
    card.querySelectorAll("[data-forget-id]").forEach((button) => {
      button.addEventListener("click", () => forgetAccount(Number(button.dataset.forgetId)));
    });
    const form = card.querySelector("#loginForm");
    if (form) form.addEventListener("submit", submitCredentials);
  }
  async function loadAccounts() {
    const payload = await api.request("/api/auth/accounts");
    state.accounts = payload.accounts || [];
    state.currentUserId = payload.current_user_id ?? null;
    const params = new URLSearchParams(global.location.search);
    if (params.get("mode") === "register") state.mode = "register";
    if (params.get("notice")) setError(params.get("notice"));
    if (state.accounts.length) state.view = "picker";
    else state.view = "first";
  }
  async function submitCredentials(event) {
    event.preventDefault();
    const username = document.querySelector("#loginUsername").value.trim();
    const password = document.querySelector("#loginPassword").value;
    if (state.mode === "register" && password !== document.querySelector("#loginPasswordConfirm").value) {
      setError("两次输入的密码不一致。");
      render();
      return;
    }
    state.loading = true;
    setError("");
    render();
    try {
      await api.request(`/api/auth/${state.mode}`, "POST", { username, password });
      enterApp();
    } catch (error) {
      state.loading = false;
      setError(error.message || "账号操作失败");
      render();
    }
  }
  async function switchAccount(userId) {
    state.loading = true;
    setError("");
    render();
    try {
      await api.request("/api/auth/switch", "POST", { user_id: userId });
      enterApp();
    } catch (error) {
      state.loading = false;
      setError(error.message || "该账号需重新验证");
      render();
    }
  }
  async function forgetAccount(userId) {
    try {
      await api.request("/api/auth/forget", "POST", { user_id: userId });
      state.accounts = state.accounts.filter((item) => Number(item.user_id) !== Number(userId));
      state.confirmingId = null;
      if (!state.accounts.length) state.view = "first";
      setError("");
      render();
    } catch (error) {
      setError(error.message || "移除失败");
      render();
    }
  }
  themeButton.addEventListener("click", () => {
    applyTheme(document.documentElement.dataset.theme === "dark" ? "light" : "dark", true);
  });
  applyTheme(preferredTheme(), false);
  loadAccounts()
    .then(render)
    .catch((error) => {
      setError(error.message || "无法连接本地服务");
      state.view = "first";
      render();
    });
 })(window);
@@ -246,6 +246,29 @@ body {
  padding-top: 8px;
 }
 .m-auth-accounts {
  display: grid;
  gap: 8px;
  margin-bottom: 16px;
 }
 .m-auth-account {
  display: flex;
  align-items: center;
  justify-content: space-between;
  min-height: 48px;
  padding: 0 14px;
  border: 1px solid var(--border);
  border-radius: 10px;
  background: var(--surface);
  color: var(--text-primary);
 }
 .m-auth-account span {
  color: var(--action);
  font-size: var(--font-size-label);
 }
 .m-auth-brand {
  text-align: center;
  margin: 24px 0 20px;
@@ -15,7 +15,9 @@
      (() => {
        let theme = "light";
        try {
-          theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
+          const stored = localStorage.getItem("xiaobaiTheme");
          if (stored === "dark" || stored === "light") theme = stored;
          else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
        } catch (_error) {
          theme = "light";
        }
@@ -5,10 +5,15 @@
  function readTheme() {
    try {
-      return global.localStorage.getItem(THEME_KEY) === "dark" ? "dark" : "light";
+      const stored = global.localStorage.getItem(THEME_KEY);
      if (stored === "dark" || stored === "light") return stored;
    } catch (_error) {
      return "light";
    }
    if (global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches) {
      return "dark";
    }
    return "light";
  }
  function applyTheme(theme) {
@@ -250,6 +250,7 @@
      '<h2>小白复盘</h2>',
      '<p>登录后进入你的复盘空间</p>',
      "</div>",
      '<div class="m-auth-accounts" id="m-auth-accounts" hidden></div>',
      '<div class="m-auth-tabs">',
      '<button class="m-auth-tab active" type="button" data-auth-mode="login">登录</button>',
      '<button class="m-auth-tab" type="button" data-auth-mode="register">注册</button>',
@@ -265,6 +266,7 @@
    ].join("");
    authMode = "login";
    bindAuth();
    loadMobileAccounts();
  }
  function setAuthMode(mode) {
@@ -287,6 +289,34 @@
    document.getElementById("m-auth-form").addEventListener("submit", submitAuth);
  }
  async function loadMobileAccounts() {
    const host = document.getElementById("m-auth-accounts");
    if (!host || !global.MobileSession.listAccounts) return;
    try {
      const payload = await global.MobileSession.listAccounts();
      const accounts = payload.accounts || [];
      if (!accounts.length) return;
      host.hidden = false;
      host.innerHTML = accounts.map(function (account) {
        return '<button class="m-auth-account" type="button" data-switch-id="' + account.user_id + '">' +
          '<strong>' + escapeHtml(account.username) + '</strong>' +
          '<span>直接进入</span></button>';
      }).join("");
      host.querySelectorAll("[data-switch-id]").forEach(function (button) {
        button.addEventListener("click", async function () {
          try {
            await global.MobileSession.switchAccount(Number(button.dataset.switchId));
            replace(DEFAULT_HASH);
          } catch (error) {
            showAuthError(document.getElementById("m-auth-error"), error.message || "该账号需重新验证");
          }
        });
      });
    } catch (_error) {
      host.hidden = true;
    }
  }
  function showAuthError(element, message) {
    element.textContent = message;
    element.classList.remove("m-motion-fade-in");
@@ -47,5 +47,30 @@
    return Boolean(state.user && state.user.role === "admin");
  }
-  global.MobileSession = { state: state, me: me, login: login, register: register, logout: logout, isAdmin: isAdmin };
+  async function listAccounts() {
    return global.MobileAPI.request("/api/auth/accounts");
  }
  async function switchAccount(userId) {
    const payload = await global.MobileAPI.request("/api/auth/switch", "POST", {
      user_id: userId
    });
    return applySession(payload);
  }
  async function forgetAccount(userId) {
    await global.MobileAPI.request("/api/auth/forget", "POST", { user_id: userId });
  }
  global.MobileSession = {
    state: state,
    me: me,
    login: login,
    register: register,
    logout: logout,
    listAccounts: listAccounts,
    switchAccount: switchAccount,
    forgetAccount: forgetAccount,
    isAdmin: isAdmin
  };
 })(window);
@@ -1363,8 +1363,7 @@ async function interpretHeaven(mode) {
  } catch (error) {
    stopHeavenReadingAnimation();
    state.heavenReadingLoading = false;
-    const detail = error?.payload?.message || error?.payload?.error || error.message;
+    state.heavenReadingError = error.message || "问天解读失败";
    state.heavenReadingError = detail || "问天解读失败";
    renderHeavenReadingDialog();
    showHeavenNotice(state.heavenReadingError);
    showToast(state.heavenReadingError);
@@ -1011,9 +1011,9 @@
  border-radius: 6px;
-  background: var(--r2-ink);
+  background: var(--sentiment-tooltip-bg);
-  color: var(--text-inverse);
+  color: var(--sentiment-tooltip-fg);
  font-size: 11px;
@@ -1021,6 +1021,8 @@
 }
 .sentiment-chart-tooltip b {
  color: inherit;
  font-weight: 700;
 }
@@ -1568,10 +1570,6 @@
  #sentimentCycleView .sentiment-component-item {
    padding: 4px 0px;
  }
  #sentimentCycleView .sentiment-component-item small {
    display: none;
  }
 }
@media (min-width: 768px) {
@@ -1764,3 +1762,72 @@
    grid-template-columns: repeat(2, minmax(0, 1fr));
  }
 }
@media (min-width: 1024px) {
  #sentimentCycleView .redesigned-emotion-grid {
    align-items: stretch;
    height: var(--sentiment-analysis-height);
    max-height: var(--sentiment-analysis-height);
    overflow: hidden;
  }
  .redesigned-sentiment-view .sentiment-analysis-main,
  .redesigned-sentiment-view .sentiment-analysis-rail {
    align-self: stretch;
    height: 100%;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-trend-panel {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-chart-shell {
    flex: 1 1 auto;
    height: auto;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-chart-shell canvas {
    height: 100%;
  }
  .redesigned-sentiment-view .sentiment-cycle-summary {
    flex: 0 0 auto;
  }
  .redesigned-sentiment-view .sentiment-components-panel {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-component-list {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    justify-content: space-evenly;
    min-height: 0px;
  }
 }
@@ -1,10 +1,39 @@
 let sentimentChartAnimationFrame = null;
 let sentimentChartResizeObserver = null;
 let sentimentChartLastSize = "";
 window.XiaobaiPageModules.register("sentiment", ["sentimentCycleView"], {
  bind: bindSentimentEvents,
  enter: ["loadSentiment"],
 });
 function sentimentChartSizeKey(target) {
  if (!target) return "";
  const rect = target.getBoundingClientRect();
  return `${Math.round(rect.width)}x${Math.round(rect.height)}x${window.devicePixelRatio || 1}`;
 }
 function observeSentimentTrendChart() {
  const shell = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
  if (!shell) return;
  if (!sentimentChartResizeObserver) {
    sentimentChartResizeObserver = new ResizeObserver(() => {
      if (sentimentChartAnimationFrame) return;
      if (state.activeView !== "sentimentCycleView") return;
      const rows = state.sentimentHistory?.rows;
      if (!rows?.length) return;
      const current = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
      const nextKey = sentimentChartSizeKey(current);
      if (!nextKey || nextKey === sentimentChartLastSize) return;
      drawSentimentTrendChart(rows, 1);
    });
  } else {
    sentimentChartResizeObserver.disconnect();
  }
  sentimentChartLastSize = sentimentChartSizeKey(shell);
  sentimentChartResizeObserver.observe(shell);
 }
 async function loadSentimentHistory(force = false) {
  if (!state.dashboard || state.sentimentLoading) return;
  const key = `${elements.tradeDate.value}:${state.sentimentRange}`;
@@ -126,6 +155,7 @@ function animateSentimentTrendChart(rows) {
  if (sentimentChartAnimationFrame) cancelAnimationFrame(sentimentChartAnimationFrame);
  if (!motionEnabled()) {
    drawSentimentTrendChart(rows, 1);
    observeSentimentTrendChart();
    return;
  }
  const startedAt = performance.now();
@@ -135,7 +165,10 @@ function animateSentimentTrendChart(rows) {
    const progress = 1 - (1 - rawProgress) ** 3;
    drawSentimentTrendChart(rows, progress);
    if (rawProgress < 1) sentimentChartAnimationFrame = requestAnimationFrame(frame);
-    else sentimentChartAnimationFrame = null;
+    else {
      sentimentChartAnimationFrame = null;
      observeSentimentTrendChart();
    }
  };
  sentimentChartAnimationFrame = requestAnimationFrame(frame);
 }
@@ -144,9 +177,9 @@ function drawSentimentTrendChart(rows, progress = 1) {
  const canvas = document.querySelector("#sentimentTrendChart");
  if (!canvas || !rows.length || state.activeView !== "sentimentCycleView") return;
  const rect = canvas.getBoundingClientRect();
-  if (!rect.width) return;
+  if (rect.width < 8 || rect.height < 8) return;
-  const width = Math.max(320, rect.width);
+  const width = rect.width;
-  const height = Math.max(220, rect.height);
+  const height = rect.height;
  const ratio = window.devicePixelRatio || 1;
  canvas.width = Math.round(width * ratio);
  canvas.height = Math.round(height * ratio);
@@ -258,6 +291,7 @@ function drawSentimentTrendChart(rows, progress = 1) {
    const dateText = displayCompactDate(row.trade_date).slice(5);
    context.fillText(dateText, x(index), height - padding.bottom + 10);
  });
  sentimentChartLastSize = sentimentChartSizeKey(canvas.closest(".sentiment-chart-shell"));
 }
 function bindSentimentChartTooltip(rows) {
@@ -46,29 +46,12 @@
    }
  }
  function readableRequestError(error) {
    const message = String(error?.message || "");
    if (
      error instanceof TypeError
      || /failed to fetch|networkerror|load failed|network request failed/i.test(message)
    ) {
      return "网络请求失败，服务暂时不可用，请稍后重试。";
    }
    return message || "请求失败";
  }
  async function request(url, method = "GET", body = null, options = {}) {
-    let response;
+    const response = await fetch(url, requestOptions(method, body, options.signal));
    try {
      response = await fetch(url, requestOptions(method, body, options.signal));
    } catch (error) {
      throw new ApiError(readableRequestError(error), 0, null);
    }
    const payload = await parseJson(response);
    handleUnauthorized(response, url);
    if (!response.ok || payload.error) {
-      const message = payload.message || payload.error || "请求失败";
+      throw new ApiError(payload.error || "请求失败", response.status, payload);
      throw new ApiError(message, response.status, payload);
    }
    return payload;
  }
@@ -1667,3 +1667,445 @@ button.account-role-badge:focus-visible {
    display: inline-flex;
  }
 }
 .login-portal {
  min-height: 100vh;
  display: flex;
  background: var(--canvas);
  color: var(--text-primary);
 }
 .login-theme-toggle {
  position: fixed;
  z-index: 2;
  top: 16px;
  right: 20px;
  min-height: 32px;
  padding: 0 12px;
  border: 1px solid var(--border-strong);
  border-radius: var(--size-radius-md);
  background: var(--surface);
  color: var(--text-secondary);
  font-size: var(--font-size-label);
  cursor: pointer;
 }
 .login-brand {
  width: clamp(420px, 34vw, 560px);
  flex: 0 0 auto;
  padding: 44px 48px 36px;
  background: var(--login-brand-gradient);
  color: #f4f7ff;
 }
 .login-brand-mark {
  display: flex;
  align-items: center;
  justify-content: center;
  width: 56px;
  height: 56px;
  border-radius: 16px;
  background: rgba(255, 255, 255, 0.12);
 }
 .login-brand-glyph {
  font-size: 24px;
  font-weight: var(--font-weight-semibold);
 }
 .login-brand-kicker {
  margin: 28px 0 8px;
  font-size: var(--font-size-caption);
  letter-spacing: 0.08em;
  opacity: 0.78;
 }
 .login-brand-title {
  margin: 0;
  font-size: 36px;
  font-weight: var(--font-weight-semibold);
 }
 .login-brand-lead {
  margin: 12px 0 0;
  max-width: 18em;
  font-size: var(--font-size-body);
  line-height: 1.7;
  opacity: 0.86;
 }
 .login-brand-stats {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 16px 20px;
  margin: 40px 0 0;
 }
 .login-stat {
  margin: 0;
 }
 .login-stat dt {
  color: rgba(244, 247, 255, 0.64);
  font-size: var(--font-size-caption);
 }
 .login-stat dd {
  margin: 4px 0 0;
  font-size: 20px;
  font-weight: var(--font-weight-semibold);
 }
 .login-stat-tag {
  margin-left: 6px;
  font-size: var(--font-size-caption);
  font-weight: var(--font-weight-regular);
 }
 .login-stage {
  flex: 1 1 auto;
  display: grid;
  place-items: center;
  padding: 48px 24px;
 }
 .login-card {
  width: 400px;
  max-width: calc(100vw - 48px);
  padding: 32px;
  border: 1px solid var(--border-strong);
  border-radius: var(--size-radius-dialog);
  background: var(--surface);
  box-shadow: var(--shadow-raised);
 }
 .login-card.is-loading .login-form {
  pointer-events: none;
  opacity: 0.72;
 }
 .login-card-title {
  margin: 0;
  font-size: 22px;
  font-weight: var(--font-weight-semibold);
 }
 .login-card-lead {
  margin: 8px 0 0;
  color: var(--text-secondary);
  font-size: var(--font-size-label);
  line-height: 1.6;
 }
 .login-tabs {
  display: grid;
  grid-template-columns: 1fr 1fr;
  margin-top: 24px;
  border-bottom: 1px solid var(--line);
 }
 .login-tab {
  min-height: 40px;
  border: 0;
  border-bottom: 2px solid transparent;
  background: transparent;
  color: var(--text-secondary);
  cursor: pointer;
 }
 .login-tab.is-active {
  border-bottom-color: var(--action);
  color: var(--action);
  font-weight: var(--font-weight-medium);
 }
 .login-form {
  display: grid;
  gap: 14px;
  margin-top: 20px;
 }
 .login-portal .form-field input {
  height: 38px;
 }
 .login-submit {
  width: 100%;
  height: 40px;
  min-height: 40px;
 }
 .login-spinner {
  width: 14px;
  height: 14px;
  border: 2px solid currentColor;
  border-right-color: transparent;
  border-radius: 50%;
  animation: login-spin 0.7s linear infinite;
 }
@keyframes login-spin {
  to {
    transform: rotate(360deg);
  }
 }
 .login-error {
  margin: 0;
  color: var(--danger);
  font-size: var(--font-size-caption);
 }
 .login-error[hidden] {
  display: none;
 }
 .login-hint,
 .login-privacy {
  margin: 16px 0 0;
  color: var(--text-tertiary);
  font-size: var(--font-size-caption);
  line-height: 1.6;
 }
 .login-portal .login-privacy {
  display: flex;
  align-items: center;
  gap: 6px;
 }
 .login-lock {
  font-size: 12px;
 }
 .login-back,
 .login-add,
 .login-manage,
 .login-account-enter,
 .login-account-remove {
  border: 0;
  background: transparent;
  color: var(--action);
  cursor: pointer;
 }
 .login-portal .login-back {
  margin-bottom: 12px;
  padding: 0;
  font-size: var(--font-size-label);
 }
 .login-portal .login-add {
  display: block;
  width: 100%;
  min-height: 40px;
  margin-top: 8px;
  text-align: left;
 }
 .login-portal .login-manage {
  display: block;
  width: 100%;
  min-height: 40px;
  margin-top: 8px;
  text-align: left;
  color: var(--text-secondary);
 }
 .login-account-list {
  display: grid;
  gap: 8px;
  margin-top: 20px;
 }
 .login-account-row {
  display: flex;
  align-items: center;
  justify-content: space-between;
  min-height: 58px;
  padding: 0 14px;
  border: 1px solid var(--border);
  border-radius: var(--size-radius-md);
  background: var(--surface);
 }
 .login-account-row.is-current {
  border-color: var(--action);
 }
 .login-account-row.is-confirming {
  display: grid;
  gap: 10px;
  padding: 12px 14px;
 }
 .login-account-meta {
  display: grid;
  gap: 2px;
 }
 .login-account-meta strong {
  font-weight: var(--font-weight-medium);
 }
 .login-account-meta span {
  color: var(--text-tertiary);
  font-size: var(--font-size-caption);
 }
 .login-account-check {
  color: var(--action);
  font-size: 16px;
 }
 .login-confirm-copy {
  margin: 0;
  font-size: var(--font-size-label);
 }
 .login-confirm-actions {
  display: flex;
  gap: 8px;
 }
@media (max-width: 900px) {
  .login-portal {
    flex-direction: column;
  }
  .login-brand {
    width: 100%;
    padding: 20px 20px 16px;
  }
  .login-brand-lead,
  .login-brand-stats {
    display: none;
  }
  .login-brand-title {
    font-size: 22px;
  }
  .login-brand-kicker {
    margin-top: 12px;
  }
  .login-stage {
    padding: 28px 16px 40px;
  }
 }
@@ -53,12 +53,10 @@ async function applyAuthenticatedSession(session) {
 function showAuthGate(message = "") {
  state.user = null;
  state.csrfToken = "";
-  const gate = document.querySelector("#authGate");
+  const params = new URLSearchParams();
-  gate.hidden = false;
+  if (message) params.set("notice", message);
-  const errorElement = document.querySelector("#authError");
+  const query = params.toString();
-  errorElement.textContent = message;
+  window.location.replace("/login/" + (query ? `?${query}` : ""));
  errorElement.hidden = !message;
  document.querySelector("#authUsername").focus();
 }
 async function logoutAccount() {
@@ -197,16 +195,8 @@ async function changeAccountPassword(event) {
 }
 async function switchAccount() {
  const button = document.querySelector("#switchAccountMenuButton");
  button.disabled = true;
  toggleAccountDropdown(false);
-  try {
+  window.location.assign("/login/");
    await apiRequest("/api/auth/logout", "POST", {});
    window.location.reload();
  } catch (error) {
    showToast(error.message || "切换账号失败");
    button.disabled = false;
  }
 }
@@ -146,6 +146,7 @@
  --shadow-float: var(--elevation-float);
  --duration-fast: 150ms;
  --duration-normal: 220ms;
  --login-brand-gradient: linear-gradient(165deg, #0c1e4a, #16307c, #2153cc);
  --font-size-aux: 11.5px;
  --font-size-caption: 12.5px;
@@ -210,6 +211,9 @@
  --pool-table-max-height: calc(var(--content-height) - var(--topbar-height) - var(--page-pad-y) - var(--page-pad-y) - var(--card-gap));
  --sentiment-history-max-height: 510px;
  --sentiment-history-min-height: 220px;
  --sentiment-analysis-height: 600px;
  --sentiment-tooltip-bg: var(--text-primary);
  --sentiment-tooltip-fg: var(--text-inverse);
  --primary-share: 1.45fr;
  --secondary-share: .75fr;
  --mobile-nav-height: 64px;
@@ -505,10 +509,13 @@
  --chart-repair: #e2ad58;
  --chart-ma-10: #d39a45;
  --chart-ma-20: #9aa5af;
  --sentiment-tooltip-bg: #26293e;
  --sentiment-tooltip-fg: #e8eaed;
  --on-action: #101418;
  --warning-line: #6d5a38;
  --warning-line-strong: #66502d;
  --control-shadow: 0 1px 3px rgba(0, 0, 0, .3);
  --login-brand-gradient: linear-gradient(165deg, #080c18, #0e1730, #14224a);
  --dialog-backdrop: var(--backdrop);
  --ladder-level-1: #2d2426;
  --ladder-level-2: #2b2822;
@@ -47,6 +47,72 @@ function session(role = "admin", subscribed = true) {
  };
 }
 function sentimentHistoryPayload(days = 20) {
  const phases = ["冰点", "修复", "发酵", "高潮", "分化", "退潮"];
  const rows = Array.from({ length: days }, (_, index) => {
    const score = 28 + ((index * 7) % 55);
    return {
      trade_date: `2026-08-${String(index + 1).padStart(2, "0")}`,
      score,
      label: "情绪观察",
      phase: phases[index % phases.length],
      direction: index % 2 ? "升温" : "降温",
      day_change: index % 2 ? 3.2 : -2.1,
      seal_rate: 71.5,
      limit_up_count: 40 + index,
      first_board_count: 18,
      second_board_count: 8,
      three_plus_count: 4,
      max_height: 5,
      broken_count: 12,
      limit_down_count: 3,
      previous_limit_count: 38,
      previous_positive_count: 22,
      previous_positive_rate: 57.9,
      average_previous_change: 1.2,
      normalization: "固定锚点",
      components: {
        breadth: { label: "市场宽度", score: 55.8, weight: 20, summary: "红盘家数回升" },
        limit: { label: "涨停连板", score: 79.6, weight: 25, summary: "连板生态改善" },
        profit: { label: "赚钱效应", score: 67.0, weight: 30, summary: "昨日反馈尚可" },
        ladder: { label: "涨幅结构", score: 81.5, weight: 15, summary: "高度仍在扩张" },
        amount: { label: "成交活跃度", score: 46.1, weight: 10, summary: "量能略低于均值" },
      },
    };
  });
  return { available_days: days, rows };
 }
 async function renderSentimentFixture(page, days = 20) {
  await page.evaluate((payload) => {
    state.sentimentHistory = payload;
    renderSentimentHistory();
  }, sentimentHistoryPayload(days));
  await page.locator('[data-view="sentimentCycleView"]').first().click();
  await page.waitForTimeout(900);
 }
 function readSentimentLayout() {
  const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
  const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
  const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
  const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
  const chart = document.querySelector(".sentiment-chart-shell").getBoundingClientRect();
  const detail = document.querySelector(".sentiment-detail-toolbar").getBoundingClientRect();
  const table = document.querySelector(".sentiment-history-frame").getBoundingClientRect();
  const small = document.querySelector(".sentiment-component-item small");
  return {
    topDelta: Math.abs(trend.top - summary.top),
    bottomDelta: Math.abs(trend.bottom - components.bottom),
    analysisHeight: analysis.height,
    chartHeight: chart.height,
    detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom) - 0.5,
    tableVisible: table.top < window.innerHeight && table.bottom > detail.bottom,
    smallVisible: small ? getComputedStyle(small).display !== "none" : false,
    overflowX: document.documentElement.scrollWidth > document.documentElement.clientWidth + 1,
  };
 }
 function waitForApplicationRuntime(page) {
  return expect(page.locator("body")).toHaveAttribute("data-runtime-ready", "true");
 }
@@ -721,6 +787,7 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  await expect(page.locator(".sentiment-stage-guide, [data-sentiment-stage]")).toHaveCount(0);
  await expect(page.locator("#sentimentPhaseAdvice")).toHaveText("情绪指标继续走弱。");
  const alignment = await page.evaluate(() => {
    const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
    const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
    const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
    const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
@@ -732,6 +799,8 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    const statusStyle = getComputedStyle(document.querySelector(".sentiment-block .sentiment-text"));
    return {
      columnsAligned: Math.abs(trend.top - summary.top) < 1,
      bottomsAligned: Math.abs(trend.bottom - components.bottom) < 1,
      analysisHeight: analysis.height,
      railAligned: Math.abs(summary.x - components.x) < 1 && Math.abs(summary.width - components.width) < 1 && components.top > summary.bottom,
      detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom),
      chartHeight: chart.height,
@@ -743,6 +812,8 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    };
  });
  expect(alignment.columnsAligned).toBe(true);
  expect(alignment.bottomsAligned).toBe(true);
  expect(Math.abs(alignment.analysisHeight - 600)).toBeLessThanOrEqual(1);
  expect(alignment.railAligned).toBe(true);
  expect(alignment.detailAfterAnalysis).toBe(true);
  expect(alignment.chartHeight).toBeGreaterThanOrEqual(340);
@@ -780,6 +851,68 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  }
 });
 test("sentiment cycle keeps 600px equal-height layout across zoom viewports", async ({ page }, testInfo) => {
  const shotDir = testInfo.outputPath("hel-221-shots");
  await mockApplication(page, session("user", true));
  const viewports = [
    { name: "zoom-100", width: 2560, height: 1440 },
    { name: "zoom-110", width: 2327, height: 1309 },
    { name: "zoom-125", width: 2048, height: 1152 },
  ];
  for (const viewport of viewports) {
    await page.setViewportSize({ width: viewport.width, height: viewport.height });
    await page.goto("/index.html");
    await renderSentimentFixture(page, 20);
    const layout = await page.evaluate(readSentimentLayout);
    expect(layout.topDelta, viewport.name).toBeLessThanOrEqual(1);
    expect(layout.bottomDelta, viewport.name).toBeLessThanOrEqual(1);
    expect(Math.abs(layout.analysisHeight - 600), viewport.name).toBeLessThanOrEqual(1);
    expect(layout.chartHeight, viewport.name).toBeGreaterThanOrEqual(450);
    expect(layout.detailAfterAnalysis, viewport.name).toBe(true);
    expect(layout.tableVisible, viewport.name).toBe(true);
    expect(layout.smallVisible, viewport.name).toBe(true);
    expect(layout.overflowX, viewport.name).toBe(false);
    await page.screenshot({
      path: `${shotDir}/day-${viewport.name}.png`,
      fullPage: true,
    });
  }
  await page.setViewportSize({ width: 2560, height: 1440 });
  await page.locator("#themeToggle").click();
  await expect(page.locator("html")).toHaveAttribute("data-theme", "dark");
  await page.waitForTimeout(200);
  const nightLayout = await page.evaluate(readSentimentLayout);
  expect(nightLayout.topDelta).toBeLessThanOrEqual(1);
  expect(nightLayout.bottomDelta).toBeLessThanOrEqual(1);
  expect(Math.abs(nightLayout.analysisHeight - 600)).toBeLessThanOrEqual(1);
  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
  const tooltip = page.locator("#sentimentChartTooltip");
  await expect(tooltip).toBeVisible();
  await expect(tooltip).toContainText("温度");
  const tooltipStyle = await tooltip.evaluate((node) => {
    const style = getComputedStyle(node);
    const bold = getComputedStyle(node.querySelector("b") || node);
    return { background: style.backgroundColor, color: style.color, bold: bold.color };
  });
  expect(tooltipStyle.background).toBe("rgb(38, 41, 62)");
  expect(tooltipStyle.color).toBe("rgb(232, 234, 237)");
  expect(tooltipStyle.bold).toBe("rgb(232, 234, 237)");
  await page.screenshot({ path: `${shotDir}/night-zoom-100.png`, fullPage: true });
  await page.locator("#themeToggle").click();
  await expect(page.locator("html")).toHaveAttribute("data-theme", "light");
  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
  await expect(tooltip).toBeVisible();
  const lightTooltip = await tooltip.evaluate((node) => {
    const style = getComputedStyle(node);
    return { background: style.backgroundColor, color: style.color };
  });
  expect(lightTooltip.background).toBe("rgb(31, 35, 41)");
  expect(lightTooltip.color).toBe("rgb(255, 255, 255)");
 });
 test("limit-up pool separates stock identity and restores the reason column", async ({ page }) => {
  await mockApplication(page, session("user", true));
  await page.goto("/index.html");
@@ -0,0 +1,151 @@
 const { test, expect } = require("@playwright/test");
 function loginPayload(user) {
  return {
    ok: true,
    authenticated: true,
    csrf_token: "portal-csrf",
    user,
  };
 }
 async function mockLoginPortal(page, options = {}) {
  const accounts = options.accounts || [];
  let currentUserId = options.currentUserId ?? null;
  await page.route("**/api/**", async (route) => {
    const url = new URL(route.request().url());
    const method = route.request().method();
    if (url.pathname === "/api/auth/accounts") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({ ok: true, accounts, current_user_id: currentUserId }),
      });
      return;
    }
    if (url.pathname === "/api/auth/switch" && method === "POST") {
      const body = route.request().postDataJSON() || {};
      const account = accounts.find((item) => Number(item.user_id) === Number(body.user_id));
      if (!account || options.switchFails) {
        await route.fulfill({
          status: 401,
          contentType: "application/json",
          body: JSON.stringify({ error: "该账号需重新验证" }),
        });
        return;
      }
      currentUserId = account.user_id;
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify(loginPayload(account)),
      });
      return;
    }
    if (url.pathname === "/api/auth/forget" && method === "POST") {
      const body = route.request().postDataJSON() || {};
      const index = accounts.findIndex((item) => Number(item.user_id) === Number(body.user_id));
      if (index >= 0) accounts.splice(index, 1);
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({ ok: true }),
      });
      return;
    }
    if ((url.pathname === "/api/auth/login" || url.pathname === "/api/auth/register") && method === "POST") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify(loginPayload({
          id: 9,
          username: "new_user",
          role: "user",
          membership: { active: false, subscribed: false, is_admin: false },
        })),
      });
      return;
    }
    if (url.pathname === "/api/auth/me") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({
          ok: true,
          authenticated: Boolean(currentUserId),
          csrf_token: "portal-csrf",
          user: accounts.find((item) => Number(item.user_id) === Number(currentUserId)) || null,
        }),
      });
      return;
    }
    await route.fulfill({
      status: 200,
      contentType: "application/json",
      body: JSON.stringify({ ok: true }),
    });
  });
 }
 const SAVED_ACCOUNTS = [
  {
    user_id: 1,
    username: "alpha_user",
    role: "admin",
    membership: { active: true, subscribed: true, is_admin: true },
    last_used_at: "2026-08-29T01:00:00+00:00",
  },
  {
    user_id: 2,
    username: "beta_user",
    role: "user",
    membership: { active: false, subscribed: false, is_admin: false },
    last_used_at: "2026-08-28T01:00:00+00:00",
  },
 ];
 test("first-time login portal asks for a password and hides environment copy", async ({ page }) => {
  await mockLoginPortal(page, { accounts: [] });
  await page.goto("/login/");
  await expect(page.locator(".login-card-title")).toHaveText("欢迎回来");
  await expect(page.locator("#loginUsername")).toBeVisible();
  await expect(page.locator(".login-submit")).toHaveText("登录");
  await expect(page.locator("body")).not.toContainText("内网个人版");
  await expect(page.locator("body")).not.toContainText("192.168.200.11");
 });
 test("saved accounts can switch directly and show a re-auth message on failure", async ({ page }) => {
  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
  await page.goto("/login/");
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
  await expect(page.locator(".login-account-row")).toHaveCount(2);
  const switched = page.waitForRequest((request) => (
    request.url().includes("/api/auth/switch") && request.method() === "POST"
  ));
  await page.locator('[data-switch-id="2"]').click();
  const request = await switched;
  expect(JSON.parse(request.postData() || "{}")).toEqual({ user_id: 2 });
 });
 test("failed account switch stays on the portal with the original copy", async ({ page }) => {
  await mockLoginPortal(page, {
    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
    switchFails: true,
  });
  await page.goto("/login/");
  await page.locator('[data-switch-id="2"]').click();
  await expect(page.locator(".login-error")).toHaveText("该账号需重新验证");
  await expect(page).toHaveURL(/\/login\/?/);
 });
 test("managing accounts removes a local record after inline confirmation", async ({ page }) => {
  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
  await page.goto("/login/");
  await page.locator('[data-login-action="manage"]').click();
  await expect(page.locator(".login-card-title")).toHaveText("管理账号记录");
  await page.locator('[data-confirm-id="2"]').click();
  await expect(page.locator(".login-confirm-copy")).toContainText("beta_user");
  await page.locator('[data-forget-id="2"]').click();
  await expect(page.locator(".login-account-row")).toHaveCount(1);
  await expect(page.locator(".login-account-row")).toContainText("alpha_user");
 });
@@ -0,0 +1,132 @@
 from __future__ import annotations
 import threading
 import unittest
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from backend.features.accounts.security import SecretVault, token_hash
 from backend.features.accounts.service import AccountService
 from database import ReviewDatabase
 class AccountSwitchGrantTests(unittest.TestCase):
    def setUp(self) -> None:
        self.temp = TemporaryDirectory()
        self.database = ReviewDatabase(Path(self.temp.name) / "review.db")
        self.bound_user_id = 0
        self.service = AccountService(
            database=self.database,
            vault=SecretVault(SecretVault.generate_key()),
            current_user_supplier=lambda: self.bound_user_id,
            access_supplier=lambda: self.database.user_access(self.bound_user_id) or {},
            bind_user=self._bind,
            personal_field_builder=lambda *args, **kwargs: {},
            auth_lock=threading.Lock(),
        )
        self.device_a = token_hash("device-a-token")
        self.device_b = token_hash("device-b-token")
    def tearDown(self) -> None:
        self.temp.cleanup()
    def _bind(self, user_id: int) -> None:
        self.bound_user_id = int(user_id)
    def _register(self, username: str, device_hash: str = "") -> dict:
        return self.service.register(username, "Password123", device_hash or self.device_a)
    def test_login_records_accounts_for_the_current_device_only(self) -> None:
        first = self._register("alpha_user")
        second = self._register("beta_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        listed = self.service.list_device_accounts(self.device_a)
        names = [item["username"] for item in listed["accounts"]]
        self.assertEqual(names, ["beta_user", "alpha_user"])
        self.assertEqual(
            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
            "alpha_user",
        )
        self.assertEqual(self.service.list_device_accounts("")["accounts"], [])
        self.assertEqual(first["user"]["username"], "alpha_user")
        self.assertEqual(second["user"]["username"], "beta_user")
    def test_switch_uses_device_grant_and_keeps_the_original_authorization(self) -> None:
        first = self._register("alpha_user")
        self._register("beta_user")
        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
        self.assertEqual(switched["user"]["username"], "alpha_user")
        remaining = {
            item["username"]
            for item in self.service.list_device_accounts(self.device_a)["accounts"]
        }
        self.assertEqual(remaining, {"alpha_user", "beta_user"})
    def test_switch_without_a_valid_grant_requires_reauthentication(self) -> None:
        user = self._register("alpha_user")
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_b, int(user["user"]["id"]))
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account("", int(user["user"]["id"]))
    def test_forget_only_removes_the_current_device_grant(self) -> None:
        user = self._register("alpha_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        self.service.forget_account(self.device_a, int(user["user"]["id"]))
        self.service.forget_account(self.device_a, int(user["user"]["id"]))
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        self.assertEqual(
            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
            "alpha_user",
        )
    def test_logout_revokes_only_the_current_account_on_this_device(self) -> None:
        first = self._register("alpha_user")
        second = self._register("beta_user")
        self.service.revoke_current_device_grant(self.device_a, int(second["user"]["id"]))
        names = {
            item["username"]
            for item in self.service.list_device_accounts(self.device_a)["accounts"]
        }
        self.assertEqual(names, {"alpha_user"})
        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
        self.assertEqual(switched["user"]["id"], first["user"]["id"])
    def test_password_change_revokes_grants_on_every_device(self) -> None:
        user = self._register("alpha_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        self._bind(int(user["user"]["id"]))
        self.service.change_password("Password123", "Password456")
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        self.assertEqual(self.service.list_device_accounts(self.device_b)["accounts"], [])
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_a, int(user["user"]["id"]))
    def test_device_keeps_at_most_five_accounts(self) -> None:
        usernames = [f"user_{index}" for index in range(6)]
        ids = [self._register(name)["user"]["id"] for name in usernames]
        listed = self.service.list_device_accounts(self.device_a)["accounts"]
        self.assertEqual(len(listed), 5)
        kept = {item["user_id"] for item in listed}
        self.assertNotIn(ids[0], kept)
        self.assertTrue(set(ids[1:]).issubset(kept))
    def test_expired_grants_are_removed_lazily(self) -> None:
        user = self._register("alpha_user")
        past = (datetime.now(timezone.utc) - timedelta(days=1)).isoformat(timespec="seconds")
        self.database.upsert_switch_grant(
            self.device_a,
            int(user["user"]["id"]),
            past,
            past,
            past,
        )
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_a, int(user["user"]["id"]))
 if __name__ == "__main__":
    unittest.main()
@@ -25,6 +25,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                        ("0002", "create_job_runs"),
                        ("0003", "extend_llm_audit"),
                        ("0004", "add_mentor_note"),
                        ("0005", "create_account_switch_grants"),
                    ],
                )
                columns = {
@@ -39,7 +40,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 4)
+            self.assertEqual(count, 5)
    def test_database_with_recorded_0004_and_note_column_starts_without_reapply(
        self,
@@ -60,7 +61,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 4)
+            self.assertEqual(count, 5)
    def test_old_database_without_0004_upgrades_and_adds_note_column(self) -> None:
        with tempfile.TemporaryDirectory() as root:
@@ -87,7 +88,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                        "PRAGMA table_info(mentor_preferences)"
                    )
                ]
-            self.assertEqual(versions, {"0001", "0002", "0003", "0004"})
+            self.assertEqual(versions, {"0001", "0002", "0003", "0004", "0005"})
            self.assertIn("note", note_rows)
    def test_database_with_unknown_migration_is_rejected(self) -> None:
@@ -344,6 +344,22 @@ class FrontendContractTests(unittest.TestCase):
        self.assertIn("max-height: var(--sentiment-history-max-height);", self.sentiment_styles)
        self.assertIn("overflow: auto;", self.sentiment_styles)
    def test_sentiment_equal_height_and_tooltip_tokens(self):
        self.assertIn("--sentiment-analysis-height: 600px;", self.tokens)
        self.assertIn("--sentiment-tooltip-bg: var(--text-primary);", self.tokens)
        self.assertIn("--sentiment-tooltip-fg: var(--text-inverse);", self.tokens)
        self.assertIn("--sentiment-tooltip-bg: #26293e;", self.tokens)
        self.assertIn("--sentiment-tooltip-fg: #e8eaed;", self.tokens)
        self.assertIn("height: var(--sentiment-analysis-height);", self.sentiment_styles)
        self.assertIn("max-height: var(--sentiment-analysis-height);", self.sentiment_styles)
        self.assertIn("justify-content: space-evenly;", self.sentiment_styles)
        self.assertIn("background: var(--sentiment-tooltip-bg);", self.sentiment_styles)
        self.assertIn("color: var(--sentiment-tooltip-fg);", self.sentiment_styles)
        self.assertIn("new ResizeObserver", self.script)
        self.assertIn("#sentimentCycleView .redesigned-emotion-grid {", self.sentiment_styles)
        self.assertNotIn("height: 100vh", self.sentiment_styles)
        self.assertNotIn("min-height: 100%", self.sentiment_styles)
    def test_mentor_final_visual_fix_contract(self):
        shell_styles = (STATIC_DIR / "shared" / "shell.css").read_text(encoding="utf-8")
        mentor_html = (STATIC_DIR / "pages" / "mentor" / "page.html").read_text(encoding="utf-8")
@@ -65,8 +65,11 @@ class GovernanceRegistryTests(unittest.TestCase):
            public,
            {
                ("GET", "/api/health"),
                ("GET", "/api/auth/accounts"),
                ("POST", "/api/auth/login"),
                ("POST", "/api/auth/register"),
                ("POST", "/api/auth/switch"),
                ("POST", "/api/auth/forget"),
            },
        )
@@ -1,162 +1,13 @@
 from __future__ import annotations
 import json
 import tempfile
 import unittest
 from http import HTTPStatus
 from pathlib import Path
 from unittest.mock import patch
 from backend.features.heaven.engine import build_five_phase_field, hexagram_from_lines
-from backend.features.heaven.http import HeavenHttpMixin
+from backend.features.heaven.knowledge import prepare_heaven_context
 from backend.features.heaven.knowledge import (
    HeavenKnowledgeError,
    clear_heaven_knowledge_cache,
    prepare_heaven_context,
    resolve_heaven_knowledge_path,
    _knowledge_catalog,
 )
 from backend.features.heaven.six_yao import build_six_yao_chart
 class HeavenKnowledgeTests(unittest.TestCase):
    def tearDown(self) -> None:
        clear_heaven_knowledge_cache()
    def test_catalog_loads_from_trusted_repo_file(self):
        clear_heaven_knowledge_cache()
        path = resolve_heaven_knowledge_path()
        catalog = _knowledge_catalog()
        self.assertTrue(path.is_file())
        self.assertEqual(path.name, "heaven_knowledge.json")
        self.assertTrue(str(catalog.get("version") or "").startswith("2026."))
        self.assertIn("zhouyi", catalog["sources"])
        self.assertIn("neijing", catalog["sources"])
        self.assertEqual(len(catalog["fortune"]["qi"]), 6)
        self.assertEqual(len(catalog["fortune"]["personal_relations"]), 10)
    def test_missing_knowledge_file_raises_chinese_structured_error(self):
        clear_heaven_knowledge_cache()
        missing = Path(tempfile.mkdtemp()) / "missing-heaven_knowledge.json"
        with patch(
            "backend.features.heaven.knowledge.KNOWLEDGE_FILE", missing
        ), patch(
            "backend.features.heaven.knowledge.KNOWLEDGE_SEED_FILE",
            missing.with_name("missing-seed.json"),
        ):
            with self.assertRaises(HeavenKnowledgeError) as raised:
                _knowledge_catalog()
        self.assertEqual(raised.exception.error_code, "heaven_knowledge_missing")
        self.assertIn("缺失", str(raised.exception))
    def test_corrupt_knowledge_json_raises_chinese_structured_error(self):
        clear_heaven_knowledge_cache()
        with tempfile.TemporaryDirectory() as temp_dir:
            broken = Path(temp_dir) / "heaven_knowledge.json"
            broken.write_text("{not-json", encoding="utf-8")
            with patch(
                "backend.features.heaven.knowledge.KNOWLEDGE_FILE", broken
            ), patch(
                "backend.features.heaven.knowledge.KNOWLEDGE_SEED_FILE",
                Path(temp_dir) / "unused-seed.json",
            ):
                with self.assertRaises(HeavenKnowledgeError) as raised:
                    _knowledge_catalog()
        self.assertEqual(raised.exception.error_code, "heaven_knowledge_invalid")
        self.assertIn("损坏", str(raised.exception))
    def test_interpret_http_returns_structured_chinese_error_for_missing_file(self):
        class FakeHandler(HeavenHttpMixin):
            def __init__(self) -> None:
                self.payload = None
                self.status = None
                self.application_service = type(
                    "Svc",
                    (),
                    {
                        "heaven_interpret": staticmethod(
                            lambda _body: (_ for _ in ()).throw(
                                HeavenKnowledgeError(
                                    "问天知识文件缺失：未找到 heaven_knowledge.json。",
                                    code="heaven_knowledge_missing",
                                )
                            )
                        )
                    },
                )()
            def read_json_body(self):
                return {"mode": "trend", "trade_date": "2026-08-04"}
            def send_json(self, payload, status=HTTPStatus.OK, headers=None):
                self.payload = payload
                self.status = status
        handler = FakeHandler()
        handler.heaven_interpret()
        self.assertEqual(handler.status, HTTPStatus.BAD_REQUEST)
        self.assertIn("缺失", handler.payload["error"])
        self.assertEqual(handler.payload["code"], "heaven_knowledge_missing")
    def test_interpret_http_returns_structured_chinese_error_for_corrupt_json(self):
        class FakeHandler(HeavenHttpMixin):
            def __init__(self) -> None:
                self.payload = None
                self.status = None
                self.application_service = type(
                    "Svc",
                    (),
                    {
                        "heaven_interpret": staticmethod(
                            lambda _body: (_ for _ in ()).throw(
                                HeavenKnowledgeError(
                                    "问天知识文件 JSON 损坏（heaven_knowledge.json），无法解析：第 1 行附近。",
                                    code="heaven_knowledge_invalid",
                                )
                            )
                        )
                    },
                )()
            def read_json_body(self):
                return {"mode": "trend", "trade_date": "2026-08-04"}
            def send_json(self, payload, status=HTTPStatus.OK, headers=None):
                self.payload = payload
                self.status = status
        handler = FakeHandler()
        handler.heaven_interpret()
        self.assertEqual(handler.status, HTTPStatus.BAD_REQUEST)
        self.assertIn("损坏", handler.payload["error"])
        self.assertEqual(handler.payload["code"], "heaven_knowledge_invalid")
    def test_seed_fallback_when_data_file_missing(self):
        clear_heaven_knowledge_cache()
        with tempfile.TemporaryDirectory() as temp_dir:
            seed = Path(temp_dir) / "seed.json"
            seed.write_text(
                json.dumps(
                    {
                        "version": "test-seed",
                        "sources": {"zhouyi": {"title": "周易"}},
                        "trend": {"method": "m", "rules": {"stable": "s", "single": "a", "multiple": "b"}},
                        "fortune": {},
                        "heart": {},
                    },
                    ensure_ascii=False,
                ),
                encoding="utf-8",
            )
            missing_data = Path(temp_dir) / "data-heaven_knowledge.json"
            with patch(
                "backend.features.heaven.knowledge.KNOWLEDGE_FILE", missing_data
            ), patch(
                "backend.features.heaven.knowledge.KNOWLEDGE_SEED_FILE", seed
            ):
                catalog = _knowledge_catalog()
        self.assertEqual(catalog["version"], "test-seed")
    def test_fortune_context_excludes_weighted_summary_and_adds_bounded_industry_symbols(self):
        field = build_five_phase_field("2026-08-04")
        prepared = prepare_heaven_context(
@@ -50,7 +50,13 @@ def _owner(path: str) -> str:
 def _role(method: str, path: str) -> str:
-    if path == "/api/health" or path in {"/api/auth/register", "/api/auth/login"}:
+    if path == "/api/health" or path in {
        "/api/auth/register",
        "/api/auth/login",
        "/api/auth/accounts",
        "/api/auth/switch",
        "/api/auth/forget",
    }:
        return "public"
    from api_access import required_role