From 27fb208c81f830d371396750b57133b3f25c0541 Mon Sep 17 00:00:00 2001
From: supreme0597 <supreme0597@gmail.com>
Date: Fri, 22 May 2026 13:28:53 +0800
Subject: [PATCH] =?UTF-8?q?fix(mention):=20=E8=A7=A3=E5=86=B3=E6=96=B0?=
 =?UTF-8?q?=E5=BB=BA=E4=BC=9A=E8=AF=9D=E6=9C=AA=E5=AF=B9=E8=AF=9D=E6=97=B6?=
 =?UTF-8?q?=E8=BE=93=E5=85=A5@=E6=97=A0=E6=B3=95=E6=A3=80=E7=B4=A2?=
 =?UTF-8?q?=E5=B7=A5=E4=BD=9C=E5=8C=BA=E6=96=87=E4=BB=B6=E7=9A=84=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/server/routers/mention_router.py     | 15 +++++++++++++--
 web/src/components/MessageInputComponent.vue |  7 ++++---
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/backend/server/routers/mention_router.py b/backend/server/routers/mention_router.py
index a8e8b068..b25ed42b 100644
--- a/backend/server/routers/mention_router.py
+++ b/backend/server/routers/mention_router.py
@@ -35,8 +35,19 @@ async def search_mention_files(
     # NOTE: 校验 thread 归属权，防止恶意用户传入他人 thread_id 遍历文件
     conv_repo = ConversationRepository(db)
     conversation = await conv_repo.get_conversation_by_thread_id(thread_id)
-    if not conversation or conversation.user_id != user_id or conversation.status == "deleted":
-        raise HTTPException(status_code=404, detail="对话线程不存在")
+    if conversation:
+        if conversation.user_id != user_id or conversation.status == "deleted":
+            raise HTTPException(status_code=404, detail="对话线程不存在")
+    else:
+        # NOTE: 如果是尚未在数据库记录的全新对话（还未发送首条消息），在格式校验安全的前提下放行。
+        # 此时该 thread 专属的 uploads/outputs 目录还没创建或为空，
+        # 用户仅能安全地搜索到自己全局的工作区 (workspace) 文件。
+        try:
+            from yuxi.agents.backends.sandbox.paths import _validate_thread_id
+
+            _validate_thread_id(thread_id)
+        except ValueError:
+            raise HTTPException(status_code=400, detail="非法的 thread_id 格式")
 
     return await search_mention_files_in_index(
         thread_id=thread_id,
diff --git a/web/src/components/MessageInputComponent.vue b/web/src/components/MessageInputComponent.vue
index 07c2a4e6..06e683ca 100644
--- a/web/src/components/MessageInputComponent.vue
+++ b/web/src/components/MessageInputComponent.vue
@@ -425,8 +425,9 @@ const updateMentionItems = (query = '') => {
     subagents: filterItems(subagentItems)
   }
 
-  // 如果有关键字，且已绑定会话，则触发后端高性能搜索进行补充
-  if (query && props.threadId) {
+  // NOTE: 如果是尚未开始对话的全新会话，此时 threadId 为空，允许使用临时占位 ID 检索用户全局的工作区文件
+  if (query) {
+    const activeThreadId = props.threadId || 'new_thread_placeholder'
     clearTimeout(mentionSearchTimer)
     mentionSearchTimer = setTimeout(async () => {
       // 物理中断之前的未完成 HTTP 请求
@@ -440,7 +441,7 @@ const updateMentionItems = (query = '') => {
 
       try {
         const responseData = await searchMentionFiles(
-          props.threadId,
+          activeThreadId,
           query,
           activeAbortController.signal
         )