diff --git a/persona-studio/backend/routes/auth.js b/persona-studio/backend/routes/auth.js
index 76080001..b31810a4 100644
--- a/persona-studio/backend/routes/auth.js
+++ b/persona-studio/backend/routes/auth.js
@@ -19,6 +19,17 @@ const USERS_DB_PATH = path.join(__dirname, '..', '..', '..', 'data', 'users.json
 
 // In-memory session store (server restart clears sessions)
 const sessions = new Map();
+const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+
+// Periodic session cleanup (every hour)
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, session] of sessions) {
+    if (now - new Date(session.created_at).getTime() > SESSION_TTL_MS) {
+      sessions.delete(token);
+    }
+  }
+}, 60 * 60 * 1000);
 
 function loadHumanRegistry() {
   try {
diff --git a/persona-studio/backend/routes/proxy.js b/persona-studio/backend/routes/proxy.js
index 5e0a5eb6..258156d8 100644
--- a/persona-studio/backend/routes/proxy.js
+++ b/persona-studio/backend/routes/proxy.js
@@ -19,6 +19,10 @@ const MODEL_API_KEY = process.env.MODEL_API_KEY || process.env.YUNWU_API_KEY ||
 const MODEL_API_BASE = process.env.MODEL_API_BASE || 'https://api.yunwu.ai/v1';
 const DEFAULT_MODEL = process.env.DEFAULT_MODEL || 'gemini-2.0-flash';
 
+if (!MODEL_API_KEY) {
+  console.warn('[Proxy] ⚠️ MODEL_API_KEY / YUNWU_API_KEY 未配置，服务器代理模式不可用。用户需使用自有 API 密钥。');
+}
+
 /**
  * 检查服务器端代理是否可用
  * GET /api/ps/proxy/status