From ff7c12802308fdb4a449f00b302198c12bc13501 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=96=BD=E5=B7=A5=E5=91=98?=
 <4846a27a-ba87-49c9-939d-7275f63efcc7@agents.multica.local>
Date: Mon, 24 Aug 2026 21:45:47 +0800
Subject: [PATCH] =?UTF-8?q?fix(HEL-99):=20=E6=89=8B=E6=9C=BA=E7=AB=AF=20fe?=
 =?UTF-8?q?tch=20=E5=87=BA=E5=8F=A3=E6=94=B6=E6=95=9B=E5=88=B0=20shared/ap?=
 =?UTF-8?q?i.js=20+=20=E6=9E=B6=E6=9E=84=E6=B8=85=E5=8D=95=E5=88=B7?=
 =?UTF-8?q?=E6=96=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: multica-agent <github@multica.ai>
---
 app/config/architecture-inventory.json |  4 +--
 app/frontend/m/index.html              |  1 +
 app/frontend/m/js/api.js               | 39 ++++++++------------------
 3 files changed, 14 insertions(+), 30 deletions(-)

diff --git a/app/config/architecture-inventory.json b/app/config/architecture-inventory.json
index d81168f..e725ad6 100644
--- a/app/config/architecture-inventory.json
+++ b/app/config/architecture-inventory.json
@@ -461,8 +461,8 @@
     },
     {
       "path": "frontend/index.html",
-      "bytes": 47131,
-      "lines": 646
+      "bytes": 47871,
+      "lines": 661
     },
     {
       "path": "backend/features/screener/catalog.py",
diff --git a/app/frontend/m/index.html b/app/frontend/m/index.html
index 8592acf..63c6916 100644
--- a/app/frontend/m/index.html
+++ b/app/frontend/m/index.html
@@ -36,6 +36,7 @@
     <nav id="m-tabbar" class="m-tabbar" aria-label="主导航" hidden></nav>
   </div>
   <script src="config/nav.config.js"></script>
+  <script src="../shared/api.js"></script>
   <script src="js/api.js"></script>
   <script src="js/session.js"></script>
   <script src="js/router.js"></script>
diff --git a/app/frontend/m/js/api.js b/app/frontend/m/js/api.js
index 75ea210..07237e2 100644
--- a/app/frontend/m/js/api.js
+++ b/app/frontend/m/js/api.js
@@ -1,41 +1,24 @@
 (function (global) {
   "use strict";
 
+  // 手机端 API 薄封装：唯一 fetch 出口收敛到 shared/api.js（XiaobaiAPI）。
+  // 本文件不再直接调用 fetch，仅负责把 CSRF Token 配置进共享出口并转发请求，
+  // 保持既有 MobileAPI.request(url[, method, body]) 调用面不变。
+
   let csrfToken = "";
 
   function setCsrfToken(token) {
     csrfToken = token || "";
-  }
-
-  function requestOptions(method, body) {
-    const normalized = String(method || "GET").toUpperCase();
-    const options = { method: normalized, headers: {} };
-    if (!["GET", "HEAD", "OPTIONS"].includes(normalized) && csrfToken) {
-      options.headers["X-CSRF-Token"] = csrfToken;
-    }
-    if (body !== null && body !== undefined) {
-      options.headers["Content-Type"] = "application/json";
-      options.body = JSON.stringify(body);
-    }
-    return options;
+    global.XiaobaiAPI.configure({
+      csrfToken: function () {
+        return csrfToken;
+      }
+    });
   }
 
   async function request(url, method, body) {
-    const response = await fetch(url, requestOptions(method, body));
-    let payload = {};
-    try {
-      payload = await response.json();
-    } catch (_error) {
-      payload = {};
-    }
-    if (!response.ok || payload.error) {
-      const error = new Error(payload.error || "请求失败");
-      error.status = response.status;
-      error.payload = payload;
-      throw error;
-    }
-    return payload;
+    return global.XiaobaiAPI.request(url, method, body);
   }
 
-  global.MobileAPI = { setCsrfToken, request };
+  global.MobileAPI = { setCsrfToken: setCsrfToken, request: request };
 })(window);