feat: 更新环境变量配置，使用后端代理替代直接 API 调用；优化文档和代码注释

.env

@@ -13,10 +13,8 @@ VITE_APP_TITLE=AX Document Editor
 VITE_DEBUG=false
 
 # External AI services are called directly by the browser.
-VITE_AI_API_URL=http://114.242.25.27:3000/api/v1/chat/completions
-VITE_AI_API_KEY=XAgent-eVVoqEO7WJYwzCc5wQ8meEtIuyIQgHhxYvpd6fSwa7BwJW8CaBom4
-VITE_WORKFLOW_API_URL=http://114.242.25.27:3000/api/v2/chat/completions
-VITE_WORKFLOW_API_KEY=XAgent-mWHBqQw06psUYRqx6PrHWiKdfY05ebt7I9drDBHzaG9QQesIkVEICj
+VITE_AI_PROXY_URL=/api/v1/ai/chat
+VITE_WORKFLOW_PROXY_URL=/api/v1/ai/workflow
 
 # WebMCP Bridge 连接配置
 VITE_WEBMCP_BRIDGE_TOKEN=AXWebMCP-04fb7ebd989246b28ca63a49e0efd2c0a27cc8c89e2241fda22b8b0c42c744a1

.env.example

@@ -14,12 +14,6 @@ VITE_APP_TITLE=AX Document Editor
 # Default: false
 VITE_DEBUG=false
 
-# Development-only direct AI endpoints. Never ship these keys in a production build.
-VITE_AI_API_URL=
-VITE_AI_API_KEY=
-VITE_WORKFLOW_API_URL=
-VITE_WORKFLOW_API_KEY=
-
-# Production same-origin proxy endpoints. The proxy stores the upstream API keys server-side.
+# Frontend only calls these backend proxy endpoints. Upstream keys belong in ax-backend-v1/.env.
 VITE_AI_PROXY_URL=/api/v1/ai/chat
 VITE_WORKFLOW_PROXY_URL=/api/v1/ai/workflow

README.md

@@ -126,8 +126,9 @@ ax-frontend-app/
 - 支持断网检测和重连机制
 
 **API 集成**:
-- AI 对话 API: `VITE_AI_API_URL`
-- 工作流 API: `VITE_WORKFLOW_API_URL`
+- AI 对话通过后端代理 `/api/v1/ai/chat`
+- 文档工作流通过后端代理 `/api/v1/ai/workflow`，对应平台接口 `/api/v2/chat/completions`
+- 平台 `appId/projectId` 和 API 密钥只配置在 `ax-backend-v1/.env`，不会进入前端构建
 
 ---
 
@@ -407,10 +408,8 @@ Content-Type: 'application/json'
 | `VITE_API_BASE_URL` | 后端 API 地址 | `http://192.168.0.195:8000` |
 | `VITE_APP_TITLE` | 应用标题 | `AX Document Editor` |
 | `VITE_DEBUG` | 调试模式 | `false` |
-| `VITE_AI_API_URL` | AI 对话 API | `http://114.242.25.27:3000/api/v1/chat/completions` |
-| `VITE_AI_API_KEY` | AI API 密钥 | - |
-| `VITE_WORKFLOW_API_URL` | 工作流 API | `http://114.242.25.27:3000/api/v2/chat/completions` |
-| `VITE_WORKFLOW_API_KEY` | 工作流 API 密钥 | - |
+| `VITE_AI_PROXY_URL` | 后端 AI 代理 | `/api/v1/ai/chat` |
+| `VITE_WORKFLOW_PROXY_URL` | 后端工作流代理 | `/api/v1/ai/workflow` |
 
 ### 配置步骤
 

docs/README.md

@@ -217,7 +217,7 @@ PDF、截图和 Word 解析库不应改为入口静态 import，否则会增加
 
 必须注意：
 
-`VITE_*` 环境变量会进入浏览器构建产物，因此 `VITE_AI_API_KEY` 和 `VITE_WORKFLOW_API_KEY` 不能作为生产秘密。生产环境应使用后端代理：
+`VITE_*` 环境变量会进入浏览器构建产物，因此 `VITE_AI_API_KEY` 和 `VITE_WORKFLOW_API_KEY` 不能作为生产秘密。生产环境应使用后端代理；平台密钥和固定的 `appId/projectId` 只放在后端环境：
 
 ```text
 浏览器 -> 自有后端 -> AI / Workflow 服务
@@ -239,10 +239,8 @@ npm audit --omit=dev
 | 变量                    | 用途                            |
 | ----------------------- | ------------------------------- |
 | `VITE_API_BASE_URL`     | 后端 API 地址                   |
-| `VITE_AI_API_URL`       | AI 聊天服务地址                 |
-| `VITE_AI_API_KEY`       | AI 服务访问令牌，不应放生产秘密 |
-| `VITE_WORKFLOW_API_URL` | 文档工作流地址                  |
-| `VITE_WORKFLOW_API_KEY` | 工作流访问令牌，不应放生产秘密  |
+| `VITE_AI_PROXY_URL`       | 后端 AI 代理地址                 |
+| `VITE_WORKFLOW_PROXY_URL` | 后端工作流代理地址               |
 | `VITE_DEBUG`            | 是否输出 API 调试日志           |
 
 默认后端地址由服务层提供，仅适合本地开发。部署时应显式配置 `VITE_API_BASE_URL`。

docs/新编辑器架构设计.md

@@ -90,7 +90,7 @@ MessageItem / ExportRecordList
 
 `richTextConverter` 在生成 HTML 前会转义文本，并限制颜色和字体值格式。富文本解析使用临时 DOM，不应直接将未过滤的用户 HTML 传给 `dangerouslySetInnerHTML`。
 
-当前前端仍会读取 `VITE_AI_API_KEY` 和 `VITE_WORKFLOW_API_KEY`。Vite 的 `VITE_*` 变量会被打包到浏览器，不能视为秘密。生产部署应由后端代理 AI 和工作流请求。
+前端不得读取 `VITE_AI_API_KEY` 或 `VITE_WORKFLOW_API_KEY`。Vite 的 `VITE_*` 变量会被打包到浏览器，不能视为秘密。AI 和工作流请求统一通过后端代理，目标工作流固定为 `/api/v2/chat/completions`，并由后端附带固定的 `appId/projectId`。
 
 ## 8. 性能决策
 

src/services/aiChatService.ts

@@ -71,23 +71,17 @@ export interface ChatCompletionResponse {
  */
 interface AIChatConfig {
   apiUrl: string;
-  apiKey: string;
 }
 
 /**
  * Get AI Chat configuration from environment variables
  */
 const getAIChatConfig = (): AIChatConfig => {
-  const isDevelopment = import.meta.env.DEV;
   return {
-    apiUrl: isDevelopment ? import.meta.env.VITE_AI_API_URL : import.meta.env.VITE_AI_PROXY_URL,
-    apiKey: isDevelopment ? import.meta.env.VITE_AI_API_KEY : '',
+    apiUrl: import.meta.env.VITE_AI_PROXY_URL || '/api/v1/ai/chat',
   };
 };
 
-const getAuthorizationHeaders = (apiKey: string): Record<string, string> =>
-  apiKey ? { Authorization: `Bearer ${apiKey}` } : {};
-
 /**
  * Send a chat completion request to AI platform
  *
@@ -101,18 +95,10 @@ export const sendChatCompletion = async (
   try {
     const config = getAIChatConfig();
 
-    if (!config.apiUrl) {
-      if (import.meta.env.PROD) {
-        throw new Error('AI 服务未配置，请先配置服务端代理');
-      }
-      return mockChatCompletion(request);
-    }
-
     const response = await fetchWithTimeout(config.apiUrl, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        ...getAuthorizationHeaders(config.apiKey),
       },
       body: JSON.stringify({
         chatId: request.chatId,
@@ -176,7 +162,6 @@ export const sendStreamingChatCompletion = async (
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        ...getAuthorizationHeaders(config.apiKey),
       },
       body: JSON.stringify({
         ...request,

src/services/exportService.ts

@@ -36,7 +36,11 @@ export const exportToWord = async (request: ExportDocRequest): Promise<ExportDoc
   try {
     const response = await apiClient.post<ApiResponse<ExportDocResponse>>(
       '/api/v1/export/doc',
-      request
+      request,
+      {
+        // 大文档的排版和文件生成可能超过普通 API 的 30 秒保护窗口。
+        timeout: 120000,
+      }
     );
 
     const data = response.data.data;

src/services/webMcpAgentService.ts

@@ -8,6 +8,7 @@ import { getWebMcpTools } from './webMcpService';
 import { translateWebMcpInput } from '../share/webmcp';
 import { listDocuments } from './documentService';
 import { blockService } from './blockService';
+import { useEditorStore } from '../stores/editorStore';
 
 export interface WebMcpChatResult {
 	handled: boolean;
@@ -52,7 +53,11 @@ const stringifyResult = (result: WebMcpToolResult): string => {
 };
 
 const getDocumentCandidates = async (): Promise<ExportCandidate[]> => {
-	if (documentCandidatesCache && documentCandidatesCache.expiresAt > Date.now()) {
+	const currentDocumentId = useEditorStore.getState().documentId;
+	const cacheContainsCurrentDocument = !currentDocumentId || documentCandidatesCache?.value.some(
+		(candidate) => candidate.documentId === currentDocumentId
+	);
+	if (documentCandidatesCache && documentCandidatesCache.expiresAt > Date.now() && cacheContainsCurrentDocument) {
 		return documentCandidatesCache.value;
 	}
 	if (documentCandidatesRequest) return documentCandidatesRequest;
@@ -68,6 +73,34 @@ const getDocumentCandidates = async (): Promise<ExportCandidate[]> => {
 
 const loadDocumentCandidates = async (): Promise<ExportCandidate[]> => {
 	const unique = new Map<string, ExportCandidate>();
+	const getBlockText = (block: unknown): string => {
+		if (!block || typeof block !== 'object') return '';
+		const content = (block as { content?: unknown }).content;
+		if (typeof content === 'string') return content.trim();
+		if (Array.isArray(content)) {
+			return content
+				.map((part) => part && typeof part === 'object' && typeof (part as { text?: unknown }).text === 'string'
+					? (part as { text: string }).text
+					: '')
+				.join('')
+				.trim();
+		}
+		return '';
+	};
+	const getFirstBlockText = (blocks: unknown): string =>
+		Array.isArray(blocks) ? blocks.map(getBlockText).find(Boolean) || '' : '';
+	const currentEditor = useEditorStore.getState();
+	if (currentEditor.documentId) {
+		const currentBlockAliases = currentEditor.blocks
+			.map(getBlockText)
+			.filter(Boolean)
+			.slice(0, 20);
+		unique.set(currentEditor.documentId, {
+			documentId: currentEditor.documentId,
+			title: getFirstBlockText(currentEditor.blocks) || currentEditor.documentId,
+			aliases: currentBlockAliases,
+		});
+	}
 	try {
 		const documentResult = await listDocuments({
 			userId: 'default-user',
@@ -82,23 +115,13 @@ const loadDocumentCandidates = async (): Promise<ExportCandidate[]> => {
 				? (detail.data as { blocks?: unknown }).blocks
 				: undefined;
 			if (!Array.isArray(blocks)) return;
-			const firstText = blocks
-				.map((block) => {
-					if (!block || typeof block !== 'object') return '';
-					const content = (block as { content?: unknown }).content;
-					if (typeof content === 'string') return content.trim();
-					if (Array.isArray(content)) {
-						return content
-							.map((part) => part && typeof part === 'object' && typeof (part as { text?: unknown }).text === 'string'
-								? (part as { text: string }).text
-								: '')
-							.join('')
-							.trim();
-					}
-					return '';
-				})
-				.find(Boolean);
-			unique.set(document.id, { documentId: document.id, title: firstText || document.id });
+			const firstText = getFirstBlockText(blocks);
+			const existing = unique.get(document.id);
+		unique.set(document.id, {
+			...existing,
+			documentId: document.id,
+			title: firstText || existing?.title || document.id,
+		});
 		}));
 	} catch (error) {
 		console.warn('[WebMCP] 获取文档名称失败，将继续使用导出记录:', error);
@@ -142,10 +165,24 @@ const findDocumentCandidate = (
 	candidates: ExportCandidate[]
 ): { candidate?: ExportCandidate; ambiguous: boolean } => {
 	const normalizedTitle = normalizeDocumentText(title);
+	const isChineseShortName = (value: string): boolean =>
+		value.length >= 3 && /^[\u3400-\u9fff]+$/.test(value);
+	const isOrderedChineseMatch = (shortName: string, fullName: string): boolean => {
+		if (!isChineseShortName(shortName)) return false;
+		let shortIndex = 0;
+		for (const character of fullName) {
+			if (character === shortName[shortIndex]) shortIndex += 1;
+			if (shortIndex === shortName.length) return true;
+		}
+		return false;
+	};
 	const matches = candidates.filter((candidate) => {
 		const candidateTitles = [candidate.title, ...(candidate.aliases || [])].map(normalizeDocumentText);
 		return candidate.documentId === title || candidate.recordId === title || candidateTitles.some((candidateTitle) =>
-			candidateTitle === normalizedTitle || candidateTitle.includes(normalizedTitle) || normalizedTitle.includes(candidateTitle)
+			candidateTitle === normalizedTitle ||
+			candidateTitle.includes(normalizedTitle) ||
+			normalizedTitle.includes(candidateTitle) ||
+			isOrderedChineseMatch(normalizedTitle, candidateTitle)
 		);
 	});
 	return { candidate: matches.length === 1 ? matches[0] : undefined, ambiguous: matches.length > 1 };
@@ -231,8 +268,8 @@ const parseLocalDocumentCommand = async (content: string): Promise<
 	if (isBlockAction) {
 		const blockMatch = remainder.match(/\b(block-[\w-]+)\b/i);
 		blockId = blockMatch?.[1];
-		blockContent = remainder.match(/(?:为|改为|内容为|插入)[:：]?\s*(.+)$/)?.[1];
-		remainder = remainder.replace(blockId || '', '').replace(/(?:为|改为|内容为|插入)[:：]?\s*.+$/, '').trim();
+		blockContent = remainder.match(/(?:为|改为|内容为|插入|：|:)\s*(.+)$/)?.[1];
+		remainder = remainder.replace(blockId || '', '').replace(/(?:为|改为|内容为|插入|：|:)\s*.+$/, '').trim();
 		const parsedReference = parseBlockReference(remainder);
 		blockReference = parsedReference.reference;
 		remainder = parsedReference.remainder;
@@ -267,7 +304,10 @@ const parseLocalDocumentCommand = async (content: string): Promise<
 	const input: Record<string, unknown> = toolName === 'download_export_record'
 		? { recordId: candidate.recordId || candidate.documentId }
 		: { documentId: candidate.documentId };
-	if (blockId) input.blockId = blockId;
+	if (blockId) {
+		if (toolName === 'insert_block') input.afterBlockId = blockId;
+		else input.blockId = blockId;
+	}
 	if (toolName === 'update_block' && blockContent) input.content = blockContent;
 	if (toolName === 'insert_block' && blockContent) {
 		input.type = 'paragraph';

src/services/workflowService.ts

@@ -74,25 +74,17 @@ interface WorkflowResponse {
  */
 interface WorkflowConfig {
   apiUrl: string;
-  apiKey: string;
 }
 
 /**
  * Get Workflow configuration from environment variables
  */
 const getWorkflowConfig = (): WorkflowConfig => {
-  const isDevelopment = import.meta.env.DEV;
   return {
-    apiUrl: isDevelopment
-      ? import.meta.env.VITE_WORKFLOW_API_URL
-      : import.meta.env.VITE_WORKFLOW_PROXY_URL,
-    apiKey: isDevelopment ? import.meta.env.VITE_WORKFLOW_API_KEY : '',
+    apiUrl: import.meta.env.VITE_WORKFLOW_PROXY_URL || '/api/v1/ai/workflow',
   };
 };
 
-const getAuthorizationHeaders = (apiKey: string): Record<string, string> =>
-  apiKey ? { Authorization: `Bearer ${apiKey}` } : {};
-
 /**
  * Check if user input should trigger document generation workflow
  *
@@ -137,10 +129,6 @@ export const triggerDocumentWorkflow = async (
   try {
     const config = getWorkflowConfig();
 
-    if (!config.apiUrl || !config.apiKey) {
-      return { content: '工作流未配置，无法生成文档。请检查前端环境配置。' };
-    }
-
     // ⭐ 重要: 添加时间戳避免工作流缓存
     // 每次调用都会生成唯一的chatId,但sessionId保持不变
     // 这样工作流会为每个请求生成新的文档,但它们都关联到同一个sessionId
@@ -156,7 +144,6 @@ export const triggerDocumentWorkflow = async (
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        ...getAuthorizationHeaders(config.apiKey),
       },
       body: JSON.stringify({
         chatId: uniqueChatId, // 带时间戳的唯一ID，避免工作流缓存