From fc0417ceb92f346ea6b7a2c00646645014dc7045 Mon Sep 17 00:00:00 2001
From: AAEE86 <ppk0227@hotmail.com>
Date: Mon, 7 Sep 2026 09:03:51 +0800
Subject: [PATCH 1/2] fix(frontend): resolve ESLint issues

---
 frontend/src/api/client.ts                    |   3 +-
 .../ProviderKeyBatchImportDialog.vue          | 166 ++++--
 .../ProviderKeyImportSettingsFields.vue       |  16 +-
 frontend/src/stores/auth.ts                   |   3 +-
 frontend/src/utils/navigationSecurity.ts      |   4 +-
 frontend/src/views/admin/RoutingProfiles.vue  | 488 +++++++++---------
 6 files changed, 381 insertions(+), 299 deletions(-)

diff --git a/frontend/src/api/client.ts b/frontend/src/api/client.ts
index 64a1f92da..f26ec8724 100644
--- a/frontend/src/api/client.ts
+++ b/frontend/src/api/client.ts
@@ -392,8 +392,7 @@ class ApiClient {
 
     this.isRefreshing = true
     const requestAuthStateVersion = this.authStateVersion
-    let restorePromise!: Promise<string>
-    restorePromise = (async () => {
+    const restorePromise = (async () => {
       const accessToken = await this.coordinatedRefresh()
       if (requestAuthStateVersion !== this.authStateVersion) {
         throw new Error('Auth state changed during session restore')
diff --git a/frontend/src/features/providers/components/ProviderKeyBatchImportDialog.vue b/frontend/src/features/providers/components/ProviderKeyBatchImportDialog.vue
index 4704e41f3..29d35ec00 100644
--- a/frontend/src/features/providers/components/ProviderKeyBatchImportDialog.vue
+++ b/frontend/src/features/providers/components/ProviderKeyBatchImportDialog.vue
@@ -9,7 +9,10 @@
     @update:model-value="handleDialogUpdate"
   >
     <div class="space-y-3.5">
-      <nav class="grid grid-cols-3 gap-1.5 rounded-xl bg-muted/40 p-1.5" aria-label="批量导入步骤">
+      <nav
+        class="grid grid-cols-3 gap-1.5 rounded-xl bg-muted/40 p-1.5"
+        aria-label="批量导入步骤"
+      >
         <button
           v-for="step in steps"
           :key="step.id"
@@ -37,8 +40,12 @@
           <div class="flex min-w-0 items-center gap-3">
             <span class="flex h-7 w-7 shrink-0 items-center justify-center rounded-md bg-foreground text-xs font-semibold text-background">1</span>
             <div class="min-w-0">
-              <h3 class="text-balance text-sm font-semibold text-foreground">粘贴名称与 Key</h3>
-              <p class="text-pretty text-[11px] leading-4 text-muted-foreground">每行一条，仅接受四个短横线分隔</p>
+              <h3 class="text-balance text-sm font-semibold text-foreground">
+                粘贴名称与 Key
+              </h3>
+              <p class="text-pretty text-[11px] leading-4 text-muted-foreground">
+                每行一条，仅接受四个短横线分隔
+              </p>
             </div>
           </div>
           <Badge
@@ -50,34 +57,40 @@
         </header>
 
         <div class="min-w-0">
-            <Label for="provider-key-batch-input" class="sr-only">Key 列表</Label>
-            <Textarea
-              id="provider-key-batch-input"
-              v-model="inputText"
-              class="h-[280px] min-h-[220px] max-h-[520px] !resize-y !rounded-none !border-0 !bg-transparent !px-4 !py-4 font-mono text-[13px] leading-6 !shadow-none !ring-0 focus-visible:!ring-0"
-              spellcheck="false"
-              placeholder="主账号----sk-xxxx&#10;备用账号----sk-yyyy"
-            />
+          <Label
+            for="provider-key-batch-input"
+            class="sr-only"
+          >Key 列表</Label>
+          <Textarea
+            id="provider-key-batch-input"
+            v-model="inputText"
+            class="h-[280px] min-h-[220px] max-h-[520px] !resize-y !rounded-none !border-0 !bg-transparent !px-4 !py-4 font-mono text-[13px] leading-6 !shadow-none !ring-0 focus-visible:!ring-0"
+            spellcheck="false"
+            placeholder="主账号----sk-xxxx&#10;备用账号----sk-yyyy"
+          />
+          <div
+            v-if="parsed.errors.length > 0"
+            class="mx-4 mb-3 space-y-1 rounded-lg bg-destructive/5 px-3 py-2 text-[11px] text-destructive ring-1 ring-destructive/20"
+          >
             <div
-              v-if="parsed.errors.length > 0"
-              class="mx-4 mb-3 space-y-1 rounded-lg bg-destructive/5 px-3 py-2 text-[11px] text-destructive ring-1 ring-destructive/20"
+              v-for="(item, index) in parsed.errors.slice(0, 6)"
+              :key="`${item.lineNumber}-${index}`"
             >
-              <div
-                v-for="(item, index) in parsed.errors.slice(0, 6)"
-                :key="`${item.lineNumber}-${index}`"
-              >
-                {{ item.lineNumber ? `第 ${item.lineNumber} 行：` : '' }}{{ item.message }}
-              </div>
-              <div v-if="parsed.errors.length > 6" class="font-medium">
-                另有 {{ parsed.errors.length - 6 }} 个问题
-              </div>
+              {{ item.lineNumber ? `第 ${item.lineNumber} 行：` : '' }}{{ item.message }}
             </div>
-            <div class="flex flex-wrap items-center gap-2 border-t border-border/50 bg-muted/10 px-4 py-2.5 text-[11px] text-muted-foreground">
-              <span class="rounded-md bg-muted px-2 py-1 font-mono text-foreground/80">名称----Key</span>
-              <span>名称和 Key 都不能为空</span>
-              <span class="ml-auto hidden tabular-nums sm:inline">已识别 {{ parsed.items.length }} 条</span>
+            <div
+              v-if="parsed.errors.length > 6"
+              class="font-medium"
+            >
+              另有 {{ parsed.errors.length - 6 }} 个问题
             </div>
           </div>
+          <div class="flex flex-wrap items-center gap-2 border-t border-border/50 bg-muted/10 px-4 py-2.5 text-[11px] text-muted-foreground">
+            <span class="rounded-md bg-muted px-2 py-1 font-mono text-foreground/80">名称----Key</span>
+            <span>名称和 Key 都不能为空</span>
+            <span class="ml-auto hidden tabular-nums sm:inline">已识别 {{ parsed.items.length }} 条</span>
+          </div>
+        </div>
       </section>
 
       <section
@@ -98,7 +111,10 @@
               >{{ item }}</span>
             </span>
           </span>
-          <Badge :variant="selectedApiFormats.length > 0 ? 'success' : 'destructive'" class="ml-auto shrink-0 tabular-nums">
+          <Badge
+            :variant="selectedApiFormats.length > 0 ? 'success' : 'destructive'"
+            class="ml-auto shrink-0 tabular-nums"
+          >
             {{ selectedApiFormats.length }} 种格式
           </Badge>
         </header>
@@ -123,12 +139,18 @@
         <header class="flex min-h-[72px] items-center gap-3 border-b border-border/60 bg-muted/15 px-4 py-3">
           <span class="flex h-7 w-7 shrink-0 items-center justify-center rounded-md bg-foreground text-xs font-semibold text-background">3</span>
           <div class="min-w-0 flex-1">
-            <h3 class="text-balance text-sm font-semibold">逐项确认</h3>
-            <p class="text-pretty text-[11px] leading-4 text-muted-foreground">展开任意 Key 可修改内容或设置单独配置</p>
+            <h3 class="text-balance text-sm font-semibold">
+              逐项确认
+            </h3>
+            <p class="text-pretty text-[11px] leading-4 text-muted-foreground">
+              展开任意 Key 可修改内容或设置单独配置
+            </p>
           </div>
           <div class="shrink-0 text-right text-[11px] text-muted-foreground">
             <div><span class="font-semibold tabular-nums text-foreground">{{ reviewItems.length }}</span> 个 Key</div>
-            <div v-if="customizedItemCount > 0"><span class="tabular-nums">{{ customizedItemCount }}</span> 个单独配置</div>
+            <div v-if="customizedItemCount > 0">
+              <span class="tabular-nums">{{ customizedItemCount }}</span> 个单独配置
+            </div>
           </div>
         </header>
 
@@ -156,9 +178,13 @@
                     v-if="reviewErrorsByIndex.has(entry.index)"
                     variant="destructive"
                     class="shrink-0 text-[10px]"
-                  >需修正</Badge>
+                  >
+                    需修正
+                  </Badge>
+                </div>
+                <div class="mt-0.5 truncate font-mono text-[10px] text-muted-foreground">
+                  {{ maskSecret(entry.item.apiKey) }}
                 </div>
-                <div class="mt-0.5 truncate font-mono text-[10px] text-muted-foreground">{{ maskSecret(entry.item.apiKey) }}</div>
               </div>
               <div class="hidden shrink-0 items-center gap-1.5 sm:flex">
                 <span class="rounded-md bg-muted px-2 py-0.5 text-[10px] text-muted-foreground">{{ effectiveAuthLabel(entry.item) }}</span>
@@ -186,18 +212,30 @@
               <div class="grid gap-3 sm:grid-cols-2">
                 <div class="space-y-1.5">
                   <Label class="text-xs">名称</Label>
-                  <Input v-model="entry.item.name" class="h-10" placeholder="必填" />
+                  <Input
+                    v-model="entry.item.name"
+                    class="h-10"
+                    placeholder="必填"
+                  />
                 </div>
                 <div class="space-y-1.5">
                   <Label class="text-xs">Key</Label>
-                  <Input v-model="entry.item.apiKey" class="h-10 font-mono text-xs" placeholder="必填" />
+                  <Input
+                    v-model="entry.item.apiKey"
+                    class="h-10 font-mono text-xs"
+                    placeholder="必填"
+                  />
                 </div>
               </div>
 
               <div class="flex min-h-12 items-center justify-between gap-3 rounded-lg bg-background px-3 shadow-[0_0_0_1px_rgb(0_0_0/0.06)] dark:shadow-[0_0_0_1px_rgb(255_255_255/0.08)]">
                 <div>
-                  <div class="text-xs font-medium">单独配置此 Key</div>
-                  <div class="text-[11px] text-muted-foreground">开启后覆盖第二步中的统一配置</div>
+                  <div class="text-xs font-medium">
+                    单独配置此 Key
+                  </div>
+                  <div class="text-[11px] text-muted-foreground">
+                    开启后覆盖第二步中的统一配置
+                  </div>
                 </div>
                 <Switch
                   :model-value="entry.item.customized"
@@ -220,7 +258,12 @@
                 v-if="reviewErrorsByIndex.has(entry.index)"
                 class="space-y-1 rounded-lg bg-destructive/5 px-3 py-2 text-[11px] text-destructive"
               >
-                <div v-for="message in reviewErrorsByIndex.get(entry.index)" :key="message">{{ message }}</div>
+                <div
+                  v-for="message in reviewErrorsByIndex.get(entry.index)"
+                  :key="message"
+                >
+                  {{ message }}
+                </div>
               </div>
             </div>
           </article>
@@ -230,12 +273,24 @@
           v-if="reviewPageCount > 1"
           class="flex min-h-12 items-center justify-between gap-3 border-t border-border/60 bg-muted/10 px-3 sm:px-4"
         >
-          <Button variant="ghost" size="sm" class="h-9" :disabled="reviewPage === 1" @click="changeReviewPage(reviewPage - 1)">
+          <Button
+            variant="ghost"
+            size="sm"
+            class="h-9"
+            :disabled="reviewPage === 1"
+            @click="changeReviewPage(reviewPage - 1)"
+          >
             <ChevronLeft class="mr-1 h-4 w-4" />
             上一页
           </Button>
           <span class="text-[11px] tabular-nums text-muted-foreground">{{ reviewPage }} / {{ reviewPageCount }}</span>
-          <Button variant="ghost" size="sm" class="h-9" :disabled="reviewPage === reviewPageCount" @click="changeReviewPage(reviewPage + 1)">
+          <Button
+            variant="ghost"
+            size="sm"
+            class="h-9"
+            :disabled="reviewPage === reviewPageCount"
+            @click="changeReviewPage(reviewPage + 1)"
+          >
             下一页
             <ChevronRight class="ml-1 h-4 w-4" />
           </Button>
@@ -245,14 +300,35 @@
 
     <template #footer>
       <div class="flex w-full flex-col-reverse gap-2 sm:flex-row sm:justify-end">
-        <Button class="w-full sm:w-auto" variant="outline" :disabled="importing" @click="handleBack">
-          <ArrowLeft v-if="currentStep > 1" class="mr-2 h-4 w-4" />
+        <Button
+          class="w-full sm:w-auto"
+          variant="outline"
+          :disabled="importing"
+          @click="handleBack"
+        >
+          <ArrowLeft
+            v-if="currentStep > 1"
+            class="mr-2 h-4 w-4"
+          />
           {{ currentStep === 1 ? '取消' : '上一步' }}
         </Button>
-        <Button class="w-full sm:w-auto" :disabled="primaryActionDisabled" @click="handlePrimaryAction">
-          <Loader2 v-if="importing" class="mr-2 h-4 w-4 animate-spin" />
-          <ListPlus v-else-if="currentStep === 3" class="mr-2 h-4 w-4" />
-          <ArrowRight v-else class="mr-2 h-4 w-4" />
+        <Button
+          class="w-full sm:w-auto"
+          :disabled="primaryActionDisabled"
+          @click="handlePrimaryAction"
+        >
+          <Loader2
+            v-if="importing"
+            class="mr-2 h-4 w-4 animate-spin"
+          />
+          <ListPlus
+            v-else-if="currentStep === 3"
+            class="mr-2 h-4 w-4"
+          />
+          <ArrowRight
+            v-else
+            class="mr-2 h-4 w-4"
+          />
           {{ primaryActionLabel }}
         </Button>
       </div>
diff --git a/frontend/src/features/providers/components/ProviderKeyImportSettingsFields.vue b/frontend/src/features/providers/components/ProviderKeyImportSettingsFields.vue
index bb77e60bf..d0824f778 100644
--- a/frontend/src/features/providers/components/ProviderKeyImportSettingsFields.vue
+++ b/frontend/src/features/providers/components/ProviderKeyImportSettingsFields.vue
@@ -28,8 +28,12 @@
             <SelectValue />
           </SelectTrigger>
           <SelectContent>
-            <SelectItem value="api_key">API Key</SelectItem>
-            <SelectItem value="bearer">Bearer Token</SelectItem>
+            <SelectItem value="api_key">
+              API Key
+            </SelectItem>
+            <SelectItem value="bearer">
+              Bearer Token
+            </SelectItem>
           </SelectContent>
         </Select>
       </div>
@@ -112,8 +116,12 @@
 
     <div class="flex min-h-12 items-center justify-between gap-3 rounded-lg bg-background px-3 shadow-[0_0_0_1px_rgb(0_0_0/0.06),0_1px_2px_rgb(0_0_0/0.04)] dark:shadow-[0_0_0_1px_rgb(255_255_255/0.08)]">
       <div>
-        <div class="text-xs font-medium">导入后立即启用</div>
-        <div class="text-[11px] text-muted-foreground">关闭后仍会创建，但不会进入调度</div>
+        <div class="text-xs font-medium">
+          导入后立即启用
+        </div>
+        <div class="text-[11px] text-muted-foreground">
+          关闭后仍会创建，但不会进入调度
+        </div>
       </div>
       <Switch
         :model-value="settings.is_active"
diff --git a/frontend/src/stores/auth.ts b/frontend/src/stores/auth.ts
index 241b2ffee..e083cb988 100644
--- a/frontend/src/stores/auth.ts
+++ b/frontend/src/stores/auth.ts
@@ -60,8 +60,7 @@ export const useAuthStore = defineStore('auth', () => {
     sessionRestoreAttempted = true
     const requestAuthStateVersion = authStateVersion
     const requestToken = token.value
-    let request!: Promise<boolean>
-    request = (async () => {
+    const request = (async () => {
       try {
         const accessToken = await apiClient.restoreSession(notifyOtherTabs)
         if (requestAuthStateVersion !== authStateVersion) {
diff --git a/frontend/src/utils/navigationSecurity.ts b/frontend/src/utils/navigationSecurity.ts
index 77e13a852..eb3d45706 100644
--- a/frontend/src/utils/navigationSecurity.ts
+++ b/frontend/src/utils/navigationSecurity.ts
@@ -1,5 +1,5 @@
 const INTERNAL_NAVIGATION_BASE = 'https://aether.invalid'
-const UNSAFE_EXTERNAL_URL_CHARACTERS = /[\\\u0000-\u001f\u007f]/
+const UNSAFE_EXTERNAL_URL_CHARACTERS = /[\\\p{C}]/u
 
 function safeAbsoluteExternalUrl(
   value: string | null | undefined,
@@ -38,7 +38,7 @@ export function safeInternalNavigationPath(value: string | null | undefined): st
     !candidate.startsWith('/')
     || candidate.startsWith('//')
     || candidate.includes('\\')
-    || /[\u0000-\u001f\u007f]/.test(candidate)
+    || /\p{C}/u.test(candidate)
   ) {
     return null
   }
diff --git a/frontend/src/views/admin/RoutingProfiles.vue b/frontend/src/views/admin/RoutingProfiles.vue
index c9d7fdfdf..6b58f816f 100644
--- a/frontend/src/views/admin/RoutingProfiles.vue
+++ b/frontend/src/views/admin/RoutingProfiles.vue
@@ -403,82 +403,82 @@
               </p>
             </div>
             <div class="grid grid-cols-1 gap-2 md:grid-cols-2 xl:grid-cols-4">
-                <div
-                  class="order-1 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
-                  data-testid="keep-priority-on-conversion"
-                >
-                  <div class="flex min-w-0 items-center gap-1.5">
-                    <span class="font-medium">格式转换保持优先级</span>
-                    <HelpHint
-                      label="格式转换保持优先级"
-                      text="开启后，跨 API 格式转换的候选不会被降级到同格式候选之后；Provider 自身的同名开关仍单独生效。"
-                    />
-                  </div>
-                  <Switch
-                    :model-value="keepPriorityOnConversion"
-                    :disabled="saving"
-                    aria-label="格式转换保持优先级"
-                    @update:model-value="updateKeepPriorityOnConversion"
+              <div
+                class="order-1 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
+                data-testid="keep-priority-on-conversion"
+              >
+                <div class="flex min-w-0 items-center gap-1.5">
+                  <span class="font-medium">格式转换保持优先级</span>
+                  <HelpHint
+                    label="格式转换保持优先级"
+                    text="开启后，跨 API 格式转换的候选不会被降级到同格式候选之后；Provider 自身的同名开关仍单独生效。"
                   />
                 </div>
-                <div
-                  class="order-4 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
-                  data-testid="sticky-key-attempts"
-                >
-                  <div class="flex min-w-0 items-center gap-1.5">
-                    <span class="font-medium">错误重试次数</span>
-                    <HelpHint
-                      label="错误重试次数"
-                      text="首个候选（缓存亲和命中的 Key）的总尝试次数。2 表示失败后同 Key 重试 1 次再转移；0 或 1 表示不重试。"
-                    />
-                  </div>
-                  <Input
-                    :model-value="stickyKeyAttempts"
-                    type="number"
-                    min="0"
-                    max="99"
-                    class="w-20 shrink-0"
-                    :disabled="saving"
-                    aria-label="错误重试次数"
-                    @update:model-value="updateStickyKeyAttempts"
+                <Switch
+                  :model-value="keepPriorityOnConversion"
+                  :disabled="saving"
+                  aria-label="格式转换保持优先级"
+                  @update:model-value="updateKeepPriorityOnConversion"
+                />
+              </div>
+              <div
+                class="order-4 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
+                data-testid="sticky-key-attempts"
+              >
+                <div class="flex min-w-0 items-center gap-1.5">
+                  <span class="font-medium">错误重试次数</span>
+                  <HelpHint
+                    label="错误重试次数"
+                    text="首个候选（缓存亲和命中的 Key）的总尝试次数。2 表示失败后同 Key 重试 1 次再转移；0 或 1 表示不重试。"
                   />
                 </div>
-                <div
-                  class="order-3 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
-                  data-testid="cf-heartbeat"
-                >
-                  <div class="flex min-w-0 items-center gap-1.5">
-                    <span class="font-medium">CF保持心跳</span>
-                    <HelpHint
-                      label="CF保持心跳"
-                      text="同步生图和标准文本非流式失败时保持外层 HTTP 状态为 200，并在响应体中返回错误。"
-                    />
-                  </div>
-                  <Switch
-                    :model-value="cfHeartbeat"
-                    :disabled="saving"
-                    aria-label="CF保持心跳"
-                    @update:model-value="updateExecutionPolicy('enable_cf_heartbeat', $event)"
+                <Input
+                  :model-value="stickyKeyAttempts"
+                  type="number"
+                  min="0"
+                  max="99"
+                  class="w-20 shrink-0"
+                  :disabled="saving"
+                  aria-label="错误重试次数"
+                  @update:model-value="updateStickyKeyAttempts"
+                />
+              </div>
+              <div
+                class="order-3 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
+                data-testid="cf-heartbeat"
+              >
+                <div class="flex min-w-0 items-center gap-1.5">
+                  <span class="font-medium">CF保持心跳</span>
+                  <HelpHint
+                    label="CF保持心跳"
+                    text="同步生图和标准文本非流式失败时保持外层 HTTP 状态为 200，并在响应体中返回错误。"
                   />
                 </div>
-                <div
-                  class="order-2 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
-                  data-testid="cyber-continue-failover"
-                >
-                  <div class="flex min-w-0 items-center gap-1.5">
-                    <span class="font-medium">Cyber继续转移</span>
-                    <HelpHint
-                      label="Cyber继续转移"
-                      text="响应开始前遇到 Cyber Policy 错误时继续故障转移。"
-                    />
-                  </div>
-                  <Switch
-                    :model-value="cyberContinueFailover"
-                    :disabled="saving"
-                    aria-label="Cyber继续转移"
-                    @update:model-value="updateExecutionPolicy('cyber_continue_failover', $event)"
+                <Switch
+                  :model-value="cfHeartbeat"
+                  :disabled="saving"
+                  aria-label="CF保持心跳"
+                  @update:model-value="updateExecutionPolicy('enable_cf_heartbeat', $event)"
+                />
+              </div>
+              <div
+                class="order-2 flex min-h-12 items-center justify-between gap-3 rounded-lg border border-border/60 px-3 py-2 text-sm"
+                data-testid="cyber-continue-failover"
+              >
+                <div class="flex min-w-0 items-center gap-1.5">
+                  <span class="font-medium">Cyber继续转移</span>
+                  <HelpHint
+                    label="Cyber继续转移"
+                    text="响应开始前遇到 Cyber Policy 错误时继续故障转移。"
                   />
                 </div>
+                <Switch
+                  :model-value="cyberContinueFailover"
+                  :disabled="saving"
+                  aria-label="Cyber继续转移"
+                  @update:model-value="updateExecutionPolicy('cyber_continue_failover', $event)"
+                />
+              </div>
             </div>
           </section>
 
@@ -574,192 +574,192 @@
               请先在下方选择一个模型，再配置该模型的优先级模式和调度策略。
             </p>
 
-          <section
-            v-if="sortingScope === 'unified'"
-            class="space-y-4"
-          >
-            <RoutingPriorityPolicyEditor
-              :config="draft.config_json"
-              :model="DEFAULT_ROUTING_POLICY_MODEL"
-              :show-priority-mode="false"
-              :show-scheduling-mode="false"
-              subtitle="统一作用于当前策略的所有模型"
-              @update:config="updateDraftConfig"
-            />
-          </section>
+            <section
+              v-if="sortingScope === 'unified'"
+              class="space-y-4"
+            >
+              <RoutingPriorityPolicyEditor
+                :config="draft.config_json"
+                :model="DEFAULT_ROUTING_POLICY_MODEL"
+                :show-priority-mode="false"
+                :show-scheduling-mode="false"
+                subtitle="统一作用于当前策略的所有模型"
+                @update:config="updateDraftConfig"
+              />
+            </section>
 
-          <section v-else>
-            <div class="mb-3">
-              <h3 class="text-sm font-medium">
-                按模型配置
-              </h3>
-              <p class="mt-1 text-xs text-muted-foreground">
-                选择模型后，在下方配置该模型的提供商排序。
-              </p>
-            </div>
-            <div class="flex max-h-[560px] flex-col gap-3 overflow-hidden rounded-lg border border-border/60 p-3">
-              <div class="grid grid-cols-2 gap-3">
-                <Input
-                  v-model="globalModelSearch"
-                  placeholder="搜索模型"
-                  class="w-full"
-                />
-                <div class="grid grid-cols-2 gap-1 rounded-lg bg-muted/40 p-1 text-xs">
-                  <button
-                    v-for="filter in modelFilters"
-                    :key="filter.value"
-                    type="button"
-                    class="h-9 rounded-md px-3 font-medium transition-colors"
-                    :class="modelFilter === filter.value
-                      ? 'bg-primary/10 text-primary shadow-sm ring-1 ring-border'
-                      : 'text-muted-foreground hover:bg-background/60 hover:text-foreground'"
-                    @click="modelFilter = filter.value"
-                  >
-                    {{ filter.label }}
-                  </button>
+            <section v-else>
+              <div class="mb-3">
+                <h3 class="text-sm font-medium">
+                  按模型配置
+                </h3>
+                <p class="mt-1 text-xs text-muted-foreground">
+                  选择模型后，在下方配置该模型的提供商排序。
+                </p>
+              </div>
+              <div class="flex max-h-[560px] flex-col gap-3 overflow-hidden rounded-lg border border-border/60 p-3">
+                <div class="grid grid-cols-2 gap-3">
+                  <Input
+                    v-model="globalModelSearch"
+                    placeholder="搜索模型"
+                    class="w-full"
+                  />
+                  <div class="grid grid-cols-2 gap-1 rounded-lg bg-muted/40 p-1 text-xs">
+                    <button
+                      v-for="filter in modelFilters"
+                      :key="filter.value"
+                      type="button"
+                      class="h-9 rounded-md px-3 font-medium transition-colors"
+                      :class="modelFilter === filter.value
+                        ? 'bg-primary/10 text-primary shadow-sm ring-1 ring-border'
+                        : 'text-muted-foreground hover:bg-background/60 hover:text-foreground'"
+                      @click="modelFilter = filter.value"
+                    >
+                      {{ filter.label }}
+                    </button>
+                  </div>
                 </div>
-              </div>
 
-              <div
-                v-if="loadingGlobalModels"
-                class="rounded-md border border-dashed border-border/70 px-3 py-6 text-center text-xs text-muted-foreground"
-              >
-                正在加载模型
-              </div>
-              <div
-                v-else-if="globalModelsError"
-                class="rounded-md border border-destructive/30 bg-destructive/5 px-3 py-2 text-xs text-destructive"
-              >
-                {{ globalModelsError }}
-              </div>
-              <div
-                v-else-if="modelRows.length === 0"
-                class="rounded-md border border-dashed border-border/70 px-3 py-6 text-center text-xs text-muted-foreground"
-              >
-                {{ globalModelSearch.trim() ? '未匹配到模型' : modelFilter === 'configured' ? '暂无已配置模型' : '暂无未配置模型' }}
-              </div>
-              <div
-                v-else
-                class="min-h-0 flex-1 space-y-2 overflow-y-auto pr-1"
-              >
                 <div
-                  v-for="row in modelRows"
-                  :key="row.name"
-                  class="rounded-lg border transition-colors"
-                  :class="selectedPerModelName === row.name
-                    ? 'border-primary/50 bg-primary/5'
-                    : 'border-border/60'"
+                  v-if="loadingGlobalModels"
+                  class="rounded-md border border-dashed border-border/70 px-3 py-6 text-center text-xs text-muted-foreground"
+                >
+                  正在加载模型
+                </div>
+                <div
+                  v-else-if="globalModelsError"
+                  class="rounded-md border border-destructive/30 bg-destructive/5 px-3 py-2 text-xs text-destructive"
+                >
+                  {{ globalModelsError }}
+                </div>
+                <div
+                  v-else-if="modelRows.length === 0"
+                  class="rounded-md border border-dashed border-border/70 px-3 py-6 text-center text-xs text-muted-foreground"
+                >
+                  {{ globalModelSearch.trim() ? '未匹配到模型' : modelFilter === 'configured' ? '暂无已配置模型' : '暂无未配置模型' }}
+                </div>
+                <div
+                  v-else
+                  class="min-h-0 flex-1 space-y-2 overflow-y-auto pr-1"
                 >
-                  <div class="flex w-full items-center gap-3 px-4 py-3">
-                    <button
-                      type="button"
-                      class="flex min-w-0 flex-1 items-center gap-3 text-left text-sm"
-                      @click="selectGlobalModel(row.name)"
-                    >
-                      <span
-                        v-if="row.configured"
-                        class="h-2 w-2 shrink-0 rounded-full bg-primary"
-                        aria-hidden="true"
-                      />
-                      <Plus
-                        v-else
-                        class="h-3.5 w-3.5 shrink-0 text-muted-foreground"
-                        aria-hidden="true"
-                      />
-                      <span class="min-w-0 flex-1">
-                        <span class="block truncate font-medium">{{ row.displayName }}</span>
-                        <span class="block truncate text-xs text-muted-foreground">{{ row.name }}</span>
-                      </span>
-                    </button>
-                    <template v-if="selectedPerModelName === row.name && activePerModelPolicy">
-                      <DropdownMenu>
-                        <DropdownMenuTrigger as-child>
-                          <Button
-                            type="button"
-                            variant="ghost"
-                            size="icon"
-                            class="h-8 w-8 shrink-0 text-muted-foreground/70 hover:text-foreground"
-                            :disabled="copySourceCandidates.length === 0"
-                            title="加载其他模型配置"
-                          >
-                            <Copy class="h-4 w-4" />
-                          </Button>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent
-                          align="end"
-                          class="max-h-[320px] overflow-y-auto"
-                        >
-                          <DropdownMenuItem
-                            v-for="source in copySourceCandidates"
-                            :key="source.model"
-                            @select="copyModelConfig(source.model)"
-                          >
-                            <span class="min-w-0">
-                              <span class="block truncate text-sm font-medium">{{ source.label }}</span>
-                              <span class="block truncate text-xs text-muted-foreground">{{ source.model }}</span>
-                            </span>
-                          </DropdownMenuItem>
-                        </DropdownMenuContent>
-                      </DropdownMenu>
-                      <Button
-                        type="button"
-                        variant="ghost"
-                        size="icon"
-                        class="h-8 w-8 shrink-0 text-muted-foreground/70 hover:text-foreground"
-                        :disabled="!canSaveCurrentModel"
-                        title="保存到草稿"
-                        @click="saveCurrentModel"
-                      >
-                        <Save class="h-4 w-4" />
-                      </Button>
-                      <Button
-                        v-if="hasModelPolicy(activePerModelPolicy.model)"
-                        type="button"
-                        variant="ghost"
-                        size="icon"
-                        class="h-8 w-8 shrink-0"
-                        :class="canRemoveCurrentModel ? 'text-muted-foreground/70 hover:text-destructive' : 'text-muted-foreground/30'"
-                        :disabled="!canRemoveCurrentModel"
-                        :title="canRemoveCurrentModel ? '移除当前模型排序' : '当前有未保存改动，不能移除'"
-                        @click="removePerModelPolicy(activePerModelPolicy.model)"
-                      >
-                        <Trash2 class="h-4 w-4" />
-                      </Button>
-                    </template>
-                    <button
-                      type="button"
-                      class="shrink-0"
-                      @click="selectGlobalModel(row.name)"
-                    >
-                      <ChevronDown
-                        class="h-4 w-4 text-muted-foreground transition-transform"
-                        :class="selectedPerModelName === row.name ? 'rotate-180' : ''"
-                      />
-                    </button>
-                  </div>
-
                   <div
-                    v-if="selectedPerModelName === row.name && activePerModelPolicy"
-                    class="border-t border-border/60 p-4"
+                    v-for="row in modelRows"
+                    :key="row.name"
+                    class="rounded-lg border transition-colors"
+                    :class="selectedPerModelName === row.name
+                      ? 'border-primary/50 bg-primary/5'
+                      : 'border-border/60'"
                   >
-                    <RoutingPriorityPolicyEditor
-                      :config="activeConfigForReading"
-                      :model="activePerModelPolicy.model"
-                      :model-id="globalModelIdFor(activePerModelPolicy.model)"
-                      :priority-mode="modelPriorityMode(activePerModelPolicy.model)"
-                      :scheduling-mode="modelSchedulingMode(activePerModelPolicy.model)"
-                      :show-priority-mode="false"
-                      :show-scheduling-mode="false"
-                      :subtitle="`仅作用于 ${activePerModelPolicy.model}`"
-                      @update:config="updateEditingConfig"
-                      @update:priority-mode="mode => updateModelPriorityMode(activePerModelPolicy.model, mode)"
-                      @update:scheduling-mode="mode => updateModelSchedulingMode(activePerModelPolicy.model, mode)"
-                    />
+                    <div class="flex w-full items-center gap-3 px-4 py-3">
+                      <button
+                        type="button"
+                        class="flex min-w-0 flex-1 items-center gap-3 text-left text-sm"
+                        @click="selectGlobalModel(row.name)"
+                      >
+                        <span
+                          v-if="row.configured"
+                          class="h-2 w-2 shrink-0 rounded-full bg-primary"
+                          aria-hidden="true"
+                        />
+                        <Plus
+                          v-else
+                          class="h-3.5 w-3.5 shrink-0 text-muted-foreground"
+                          aria-hidden="true"
+                        />
+                        <span class="min-w-0 flex-1">
+                          <span class="block truncate font-medium">{{ row.displayName }}</span>
+                          <span class="block truncate text-xs text-muted-foreground">{{ row.name }}</span>
+                        </span>
+                      </button>
+                      <template v-if="selectedPerModelName === row.name && activePerModelPolicy">
+                        <DropdownMenu>
+                          <DropdownMenuTrigger as-child>
+                            <Button
+                              type="button"
+                              variant="ghost"
+                              size="icon"
+                              class="h-8 w-8 shrink-0 text-muted-foreground/70 hover:text-foreground"
+                              :disabled="copySourceCandidates.length === 0"
+                              title="加载其他模型配置"
+                            >
+                              <Copy class="h-4 w-4" />
+                            </Button>
+                          </DropdownMenuTrigger>
+                          <DropdownMenuContent
+                            align="end"
+                            class="max-h-[320px] overflow-y-auto"
+                          >
+                            <DropdownMenuItem
+                              v-for="source in copySourceCandidates"
+                              :key="source.model"
+                              @select="copyModelConfig(source.model)"
+                            >
+                              <span class="min-w-0">
+                                <span class="block truncate text-sm font-medium">{{ source.label }}</span>
+                                <span class="block truncate text-xs text-muted-foreground">{{ source.model }}</span>
+                              </span>
+                            </DropdownMenuItem>
+                          </DropdownMenuContent>
+                        </DropdownMenu>
+                        <Button
+                          type="button"
+                          variant="ghost"
+                          size="icon"
+                          class="h-8 w-8 shrink-0 text-muted-foreground/70 hover:text-foreground"
+                          :disabled="!canSaveCurrentModel"
+                          title="保存到草稿"
+                          @click="saveCurrentModel"
+                        >
+                          <Save class="h-4 w-4" />
+                        </Button>
+                        <Button
+                          v-if="hasModelPolicy(activePerModelPolicy.model)"
+                          type="button"
+                          variant="ghost"
+                          size="icon"
+                          class="h-8 w-8 shrink-0"
+                          :class="canRemoveCurrentModel ? 'text-muted-foreground/70 hover:text-destructive' : 'text-muted-foreground/30'"
+                          :disabled="!canRemoveCurrentModel"
+                          :title="canRemoveCurrentModel ? '移除当前模型排序' : '当前有未保存改动，不能移除'"
+                          @click="removePerModelPolicy(activePerModelPolicy.model)"
+                        >
+                          <Trash2 class="h-4 w-4" />
+                        </Button>
+                      </template>
+                      <button
+                        type="button"
+                        class="shrink-0"
+                        @click="selectGlobalModel(row.name)"
+                      >
+                        <ChevronDown
+                          class="h-4 w-4 text-muted-foreground transition-transform"
+                          :class="selectedPerModelName === row.name ? 'rotate-180' : ''"
+                        />
+                      </button>
+                    </div>
+
+                    <div
+                      v-if="selectedPerModelName === row.name && activePerModelPolicy"
+                      class="border-t border-border/60 p-4"
+                    >
+                      <RoutingPriorityPolicyEditor
+                        :config="activeConfigForReading"
+                        :model="activePerModelPolicy.model"
+                        :model-id="globalModelIdFor(activePerModelPolicy.model)"
+                        :priority-mode="modelPriorityMode(activePerModelPolicy.model)"
+                        :scheduling-mode="modelSchedulingMode(activePerModelPolicy.model)"
+                        :show-priority-mode="false"
+                        :show-scheduling-mode="false"
+                        :subtitle="`仅作用于 ${activePerModelPolicy.model}`"
+                        @update:config="updateEditingConfig"
+                        @update:priority-mode="mode => updateModelPriorityMode(activePerModelPolicy.model, mode)"
+                        @update:scheduling-mode="mode => updateModelSchedulingMode(activePerModelPolicy.model, mode)"
+                      />
+                    </div>
                   </div>
                 </div>
               </div>
-            </div>
-          </section>
+            </section>
           </section>
         </div>
       </Card>

From 2f929e74c72f0430a619705063a69654ef343717 Mon Sep 17 00:00:00 2001
From: elky <elky0401@gmail.com>
Date: Mon, 7 Sep 2026 09:57:53 +0800
Subject: [PATCH 2/2] fix(frontend): preserve session cleanup and Unicode
 navigation

---
 frontend/src/stores/__tests__/auth.spec.ts    | 45 +++++++++++++++++++
 frontend/src/stores/auth.ts                   | 10 ++---
 .../__tests__/navigationSecurity.spec.ts      | 39 ++++++++++++++++
 frontend/src/utils/navigationSecurity.ts      |  4 +-
 4 files changed, 91 insertions(+), 7 deletions(-)

diff --git a/frontend/src/stores/__tests__/auth.spec.ts b/frontend/src/stores/__tests__/auth.spec.ts
index 39bff8e97..54408e250 100644
--- a/frontend/src/stores/__tests__/auth.spec.ts
+++ b/frontend/src/stores/__tests__/auth.spec.ts
@@ -100,6 +100,51 @@ describe('auth store logout', () => {
     expect(clearAuthMock).toHaveBeenCalledWith(false, false)
   })
 
+  it.each(['synchronous', 'asynchronous'] as const)(
+    'allows a forced retry after a %s restore failure',
+    async (failureMode) => {
+      const failure = new Error('temporary refresh failure')
+      if (failureMode === 'synchronous') {
+        restoreSessionMock.mockImplementationOnce(() => {
+          throw failure
+        })
+      } else {
+        restoreSessionMock.mockRejectedValueOnce(failure)
+      }
+      restoreSessionMock.mockResolvedValueOnce('retry-access-token')
+      const store = useAuthStore()
+
+      await expect(store.restoreSession()).resolves.toBe(false)
+      expect(clearAuthMock).toHaveBeenCalledWith(false, false)
+
+      await expect(store.restoreSession(true)).resolves.toBe(true)
+      expect(store.token).toBe('retry-access-token')
+      expect(restoreSessionMock).toHaveBeenCalledTimes(2)
+    },
+  )
+
+  it('deduplicates in-flight restores and allows a refresh after completion', async () => {
+    let resolveRestore!: (token: string) => void
+    const pendingRestore = new Promise<string>((resolve) => {
+      resolveRestore = resolve
+    })
+    restoreSessionMock.mockReturnValueOnce(pendingRestore)
+    const store = useAuthStore()
+
+    const firstRestore = store.restoreSession()
+    const secondRestore = store.restoreSession()
+    expect(restoreSessionMock).toHaveBeenCalledTimes(1)
+
+    resolveRestore('restored-access-token')
+    await expect(Promise.all([firstRestore, secondRestore])).resolves.toEqual([true, true])
+    expect(store.token).toBe('restored-access-token')
+
+    restoreSessionMock.mockResolvedValueOnce('refreshed-access-token')
+    await expect(store.restoreSession(true)).resolves.toBe(true)
+    expect(store.token).toBe('refreshed-access-token')
+    expect(restoreSessionMock).toHaveBeenCalledTimes(2)
+  })
+
   it('preserves an existing access token when a forced restore fails', async () => {
     getTokenMock.mockReturnValue('still-valid-access-token')
     restoreSessionMock.mockRejectedValue(new Error('temporary refresh conflict'))
diff --git a/frontend/src/stores/auth.ts b/frontend/src/stores/auth.ts
index e083cb988..62c454415 100644
--- a/frontend/src/stores/auth.ts
+++ b/frontend/src/stores/auth.ts
@@ -81,12 +81,12 @@ export const useAuthStore = defineStore('auth', () => {
           }
         }
         return false
-      } finally {
-        if (sessionRestorePromise === request) {
-          sessionRestorePromise = null
-        }
       }
-    })()
+    })().finally(() => {
+      if (sessionRestorePromise === request) {
+        sessionRestorePromise = null
+      }
+    })
 
     sessionRestorePromise = request
     return request
diff --git a/frontend/src/utils/__tests__/navigationSecurity.spec.ts b/frontend/src/utils/__tests__/navigationSecurity.spec.ts
index 41310cdef..3b35c057b 100644
--- a/frontend/src/utils/__tests__/navigationSecurity.spec.ts
+++ b/frontend/src/utils/__tests__/navigationSecurity.spec.ts
@@ -6,6 +6,12 @@ import {
   safeInternalNavigationPath,
 } from '../navigationSecurity'
 
+const unicodeSegments = ['👩\u200d💻', 'راهنمای\u200cکاربر', '\ue000']
+const controlCodePoints = [
+  ...Array.from({ length: 32 }, (_value, index) => index),
+  ...Array.from({ length: 33 }, (_value, index) => index + 0x7f),
+]
+
 describe('safeInternalNavigationPath', () => {
   it('keeps normalized same-origin paths, queries, and fragments', () => {
     expect(safeInternalNavigationPath('/dashboard/../dashboard/api-keys?tab=active#key-1')).toBe(
@@ -13,6 +19,17 @@ describe('safeInternalNavigationPath', () => {
     )
   })
 
+  it.each(unicodeSegments)('keeps valid Unicode query values: %s', (segment) => {
+    expect(safeInternalNavigationPath(`/dashboard?search=${segment}`)).toBe(
+      `/dashboard?search=${encodeURIComponent(segment)}`,
+    )
+  })
+
+  it.each(controlCodePoints)('rejects control character code point %i', (codePoint) => {
+    expect(safeInternalNavigationPath(`/dashboard/before${String.fromCodePoint(codePoint)}after`))
+      .toBeNull()
+  })
+
   it.each([
     'https://attacker.example/steal',
     '//attacker.example/steal',
@@ -32,6 +49,17 @@ describe('safeExternalHttpsUrl', () => {
     )
   })
 
+  it.each(unicodeSegments)('allows valid Unicode URL paths: %s', (segment) => {
+    expect(safeExternalHttpsUrl(`https://provider.example/docs/${segment}`)).toBe(
+      `https://provider.example/docs/${encodeURIComponent(segment)}`,
+    )
+  })
+
+  it.each(controlCodePoints)('rejects control character code point %i', (codePoint) => {
+    expect(safeExternalHttpsUrl(`https://provider.example/before${String.fromCodePoint(codePoint)}after`))
+      .toBeNull()
+  })
+
   it.each([
     'javascript:alert(1)',
     'data:text/html,attack',
@@ -53,6 +81,17 @@ describe('safeExternalWebUrl', () => {
     expect(safeExternalWebUrl(value)).toBe(expected)
   })
 
+  it.each(unicodeSegments)('allows valid Unicode provider websites: %s', (segment) => {
+    expect(safeExternalWebUrl(`https://provider.example/docs/${segment}`)).toBe(
+      `https://provider.example/docs/${encodeURIComponent(segment)}`,
+    )
+  })
+
+  it.each(controlCodePoints)('rejects control character code point %i', (codePoint) => {
+    expect(safeExternalWebUrl(`https://provider.example/before${String.fromCodePoint(codePoint)}after`))
+      .toBeNull()
+  })
+
   it.each([
     'javascript:alert(1)',
     'data:text/html,attack',
diff --git a/frontend/src/utils/navigationSecurity.ts b/frontend/src/utils/navigationSecurity.ts
index eb3d45706..abe8bc066 100644
--- a/frontend/src/utils/navigationSecurity.ts
+++ b/frontend/src/utils/navigationSecurity.ts
@@ -1,5 +1,5 @@
 const INTERNAL_NAVIGATION_BASE = 'https://aether.invalid'
-const UNSAFE_EXTERNAL_URL_CHARACTERS = /[\\\p{C}]/u
+const UNSAFE_EXTERNAL_URL_CHARACTERS = /[\\\p{Cc}]/u
 
 function safeAbsoluteExternalUrl(
   value: string | null | undefined,
@@ -38,7 +38,7 @@ export function safeInternalNavigationPath(value: string | null | undefined): st
     !candidate.startsWith('/')
     || candidate.startsWith('//')
     || candidate.includes('\\')
-    || /\p{C}/u.test(candidate)
+    || /\p{Cc}/u.test(candidate)
   ) {
     return null
   }