Merge remote-tracking branch 'origin/master' into ji

# Conflicts:
#	frontend-web/src/components/workspace/messages/message-list-item.tsx
#	offline-backend-20260512/backend/app/gateway/app.py
#	offline-backend-20260512/backend/packages/harness/deerflow/runtime/scheduler/html_page.py
#	offline-backend-20260512/backend/packages/harness/deerflow/runtime/scheduler/service.py

frontend-web/src/core/auth/external-login.ts

@@ -13,6 +13,10 @@ export const EXTERNAL_LOGIN_STORAGE_KEYS = {
   ticket: "login.ticket",
   userId: "login.userId",
   env: "login.env",
+  /** MaxKey getTokenByOnlineTicket 返回的 token */
+  maxkeyOnlineToken: "login.maxkeyOnlineToken",
+  /** consumer /cop/userDetailToken 返回的 data 整包（JSON） */
+  userDetailToken: "login.userDetailToken",
 } as const;
 
 export type ExternalLoginParams = {

frontend-web/src/core/auth/wujie-ticket-login.ts

@@ -0,0 +1,142 @@
+import { requestCrudService } from "@/service/request-axios-service";
+
+import {
+  EXTERNAL_LOGIN_STORAGE_KEYS,
+  persistExternalLoginParams,
+} from "./external-login";
+
+const AUTH_BASE_URL = (import.meta.env.VITE_AUTH_BASE_URL || "").replace(
+  /\/$/,
+  "",
+);
+const CONSUMER_URL = (import.meta.env.VITE_AIPI_CONSUMER_URL || "").replace(
+  /\/$/,
+  "",
+);
+
+/** MaxKey onlineTicket 换发的 token（后续请求可能用到） */
+export const MAXKEY_ONLINE_TOKEN_STORAGE_KEY =
+  EXTERNAL_LOGIN_STORAGE_KEYS.maxkeyOnlineToken;
+
+/** `/cop/userDetailToken` 返回的 data 整包（JWT 解析后的用户信息） */
+export const USER_DETAIL_TOKEN_STORAGE_KEY =
+  EXTERNAL_LOGIN_STORAGE_KEYS.userDetailToken;
+
+export type MaxkeyTokenByTicketResponse = {
+  code: number;
+  data: string;
+  message?: string;
+};
+
+export type UserDetailTokenPayload = {
+  sub?: string;
+  user_id?: string;
+  exp?: number;
+  expired?: boolean;
+  iat?: number;
+  institution?: string;
+  iss?: string;
+  locale?: string;
+  kid?: string;
+  jti?: string;
+  [key: string]: unknown;
+};
+
+type UserDetailTokenResponse = {
+  code?: number;
+  data?: UserDetailTokenPayload;
+  message?: string;
+};
+
+function persistMaxkeyOnlineToken(token: string): void {
+  try {
+    localStorage.setItem(MAXKEY_ONLINE_TOKEN_STORAGE_KEY, token);
+  } catch {
+    // 静默失败，不阻断登录
+  }
+}
+
+function persistUserDetailToken(data: UserDetailTokenPayload): void {
+  try {
+    localStorage.setItem(USER_DETAIL_TOKEN_STORAGE_KEY, JSON.stringify(data));
+    if (data.user_id) {
+      localStorage.setItem(EXTERNAL_LOGIN_STORAGE_KEYS.userId, String(data.user_id));
+    }
+  } catch {
+    // 静默失败
+  }
+}
+
+/**
+ * 无界 / 外部跳转：用 onlineTicket 换 MaxKey token，并拉取用户详情。
+ * - token 存入 localStorage（`login.maxkeyOnlineToken`）
+ * - userDetailToken 的 data 存入 localStorage（`login.userDetailToken`）
+ * @returns 用于 DeerFlow `loginByUsername` 的用户名（取自 data.sub）
+ */
+export async function resolveUsernameByOnlineTicket(
+  ticket: string,
+): Promise<string> {
+  const onlineTicket = ticket.trim();
+  if (!onlineTicket) {
+    throw new Error("缺少 onlineTicket，无法完成无界登录。");
+  }
+  if (!AUTH_BASE_URL) {
+    throw new Error("未配置 VITE_AUTH_BASE_URL，无法换取 MaxKey token。");
+  }
+  if (!CONSUMER_URL) {
+    throw new Error("未配置 VITE_AIPI_CONSUMER_URL，无法获取用户详情。");
+  }
+
+  persistExternalLoginParams({ ticket: onlineTicket });
+
+  const tokenRes = (await requestCrudService.get(
+    `${AUTH_BASE_URL}/maxkey-mgt-api/sys/getTokenByOnlineTicket`,
+    { onlineTicket },
+  )) as unknown as MaxkeyTokenByTicketResponse;
+
+  console.log("[wujie] getTokenByOnlineTicket:", tokenRes);
+
+  if (tokenRes.code !== 200 || !tokenRes.data) {
+    throw new Error(
+      tokenRes.message || "getTokenByOnlineTicket 未返回有效 token。",
+    );
+  }
+  persistMaxkeyOnlineToken(tokenRes.data);
+
+  const detailRes = (await requestCrudService.get(
+    `${CONSUMER_URL}/cop/userDetailToken`,
+    { ticket: onlineTicket },
+  )) as unknown as UserDetailTokenResponse;
+
+  console.log("[wujie] userDetailToken:", detailRes);
+
+  const userData = detailRes.data;
+  if (!userData) {
+    throw new Error("userDetailToken 未返回用户 data。");
+  }
+  persistUserDetailToken(userData);
+
+  const username = (userData.sub ?? "").trim();
+  if (!username) {
+    throw new Error("userDetailToken 中缺少 sub（用户名）。");
+  }
+  return username;
+}
+
+export function readMaxkeyOnlineToken(): string {
+  try {
+    return localStorage.getItem(MAXKEY_ONLINE_TOKEN_STORAGE_KEY) ?? "";
+  } catch {
+    return "";
+  }
+}
+
+export function readUserDetailToken(): UserDetailTokenPayload | null {
+  try {
+    const raw = localStorage.getItem(USER_DETAIL_TOKEN_STORAGE_KEY);
+    if (!raw) return null;
+    return JSON.parse(raw) as UserDetailTokenPayload;
+  } catch {
+    return null;
+  }
+}