From a42675d2a5e477f4319d279cbee0184edc0fd18b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 6 Mar 2026 05:33:24 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=A4=9A=E5=B1=82=E9=98=B2=E5=BE=A1?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=8C=81=E7=BB=AD=E6=8A=A5=E9=94=99=E6=97=A7?=
 =?UTF-8?q?=20Key=20=E2=80=94=20no-cache=E3=80=81URL=20reset=E3=80=81heade?=
 =?UTF-8?q?r=20=E9=87=8D=E7=BD=AE=E6=8C=89=E9=92=AE=E3=80=81=E6=89=A9?=
 =?UTF-8?q?=E5=B1=95=20sanitization?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 docs/index.html | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)
diff --git a/docs/index.html b/docs/index.html
index 9fbb3f37..c0df8ad6 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -3,6 +3,9 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate">
+<meta http-equiv="Pragma" content="no-cache">
+<meta http-equiv="Expires" content="0">
 <title>铸渊助手 · HoloLake AI</title>
 <style>
 *,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
@@ -337,7 +340,13 @@ footer{padding:12px 18px 16px;background:var(--s1);border-top:1px solid var(--bo
 
 <!-- ════════════════════ SETTINGS PANEL ════════════════════ -->
 <div id="sp2" class="sp">
-  <div class="ph"><h2>⚙️ API 设置</h2><button class="cb" onclick="closeP()">✕</button></div>
+  <div class="ph">
+    <h2>⚙️ API 设置</h2>
+    <div style="display:flex;gap:6px;align-items:center">
+      <button onclick="resetAllSettings()" title="清除所有本地设置，重新开始" style="padding:4px 10px;border-radius:6px;border:1px solid #ef4444;background:transparent;color:#ef4444;font-size:11px;cursor:pointer;white-space:nowrap">🔄 重置</button>
+      <button class="cb" onclick="closeP()">✕</button>
+    </div>
+  </div>
   <div class="pb">
     <div class="sfg">
       <label>AI 提供商</label>
@@ -600,12 +609,26 @@ const A = {
 function ls(k){return localStorage.getItem(k)}
 function lss(k,v){localStorage.setItem(k,v)}
 
+const RESET_KEYS = ['zy_key','zy_base','zy_mdl','zy_prov','zy_uname','zy_ghuser','zy_role'];
+
 // ═══════════════════════════════════════════════════════
 // INIT
 // ═══════════════════════════════════════════════════════
 async function boot(){
-  // Sanitize: if a previous version accidentally stored the KEY_MASK string as the key, clear it.
-  if(ls('zy_key') === KEY_MASK){
+  // URL-based reset: visiting the page with ?reset=1 clears all local settings.
+  // This is a reliable escape hatch when the UI cannot be navigated.
+  if(new URLSearchParams(location.search).get('reset')==='1'){
+    RESET_KEYS.forEach(k => localStorage.removeItem(k));
+    A.key=''; A.base=PROVS['yunwu'].base; A.mdl='gpt-4o'; A.prov='yunwu'; A.demo=false;
+    A.userName=''; A.ghUser=''; A.role='guest';
+    // Remove ?reset=1 from the URL so a subsequent refresh does not trigger another reset.
+    history.replaceState(null,'',location.pathname);
+  }
+  // Sanitize: clear any stored key that contains the old KEY_MASK placeholder string.
+  // Valid API keys are always alphanumeric (no Chinese characters), so this check
+  // cannot produce false positives on a legitimate key.
+  const storedKey = ls('zy_key');
+  if(storedKey && storedKey.includes(KEY_MASK)){
     localStorage.removeItem('zy_key');
     A.key = '';
   }
@@ -744,8 +767,7 @@ function saveSet(){
 // ═══════════════════════════════════════════════════════
 function resetAllSettings(){
   if(!confirm('确定要清除所有本地设置吗？\n\n· API 密钥会被删除\n· 身份设置会被删除\n· 将返回初始设置界面\n\n这不会影响任何聊天记录或云端数据。')) return;
-  const keys = ['zy_key','zy_base','zy_mdl','zy_prov','zy_uname','zy_ghuser','zy_role'];
-  keys.forEach(k => localStorage.removeItem(k));
+  RESET_KEYS.forEach(k => localStorage.removeItem(k));
   window.location.reload();
 }
 
