From 43cb20eeb48dafae2d4d4d3e5c6a6993faa5cf5c Mon Sep 17 00:00:00 2001
From: "z.zhang" <andy_azhen@163.com>
Date: Thu, 22 Oct 2026 23:35:13 +0800
Subject: [PATCH] =?UTF-8?q?fix(auth):=20=E9=80=80=E5=87=BA=E6=8E=88?=
 =?UTF-8?q?=E6=9D=83=E6=B8=85=E9=99=A4=E5=8C=BF=E5=90=8D=E8=AE=BF=E5=AE=A2?=
 =?UTF-8?q?=E8=BA=AB=E4=BB=BD=EF=BC=8C=E7=99=BB=E5=87=BA=E5=90=8E=E4=B8=8D?=
 =?UTF-8?q?=E5=86=8D=E8=A2=AB=E8=87=AA=E5=8A=A8=E9=87=8D=E7=99=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/web/src/api/client.ts         | 9 +++++++++
 apps/web/src/auth/AuthProvider.tsx | 3 ++-
 server/gateway/app.py              | 3 ++-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/api/client.ts b/apps/web/src/api/client.ts
index ebb9394..f800ad8 100644
--- a/apps/web/src/api/client.ts
+++ b/apps/web/src/api/client.ts
@@ -50,6 +50,15 @@ function ensureVisitorId(): string {
   }
 }
 
+export function resetVisitorId(): void {
+  memoryVisitorId = null;
+  try {
+    window.localStorage.removeItem(ANONYMOUS_VISITOR_KEY);
+  } catch {
+    // 隐私模式等场景下 localStorage 不可用，忽略即可
+  }
+}
+
 let desktopDeviceId: Promise<string> | null = null;
 
 async function getDesktopDeviceId(): Promise<string> {
diff --git a/apps/web/src/auth/AuthProvider.tsx b/apps/web/src/auth/AuthProvider.tsx
index 134c11d..2f50b6b 100644
--- a/apps/web/src/auth/AuthProvider.tsx
+++ b/apps/web/src/auth/AuthProvider.tsx
@@ -6,7 +6,7 @@ import {
   SafetyCertificateOutlined, UserOutlined, WarningOutlined,
 } from '@ant-design/icons';
 
-import { clientFetch, getClientMode, type ClientMode } from '../api/client';
+import { clientFetch, getClientMode, resetVisitorId, type ClientMode } from '../api/client';
 
 export type AuthUser = {
   user_id: string;
@@ -184,6 +184,7 @@ export function AuthProvider(props: { children: ReactNode }) {
       await clientFetch('/api/auth/logout', { method: 'POST' });
     } finally {
       clearSensitiveBrowserState();
+      resetVisitorId();
       await refresh();
     }
   }, [refresh]);
diff --git a/server/gateway/app.py b/server/gateway/app.py
index b26b47a..945dd57 100644
--- a/server/gateway/app.py
+++ b/server/gateway/app.py
@@ -73,7 +73,7 @@ from server.contracts import INTERFACE_VERSION, IntentResult  # 跨层握手与
 from server.state.checkpoints import get_checkpoints   # 成对快照仓（时间线）
 from server.state.store import get_store               # 世界状态单例
 from server.auth.context import get_identity
-from server.auth.middleware import AuthenticationMiddleware
+from server.auth.middleware import ANONYMOUS_COOKIE, AuthenticationMiddleware
 from server.auth.licenses import (
     DESKTOP_COOKIE,
     WEB_LICENSE_COOKIE,
@@ -1219,6 +1219,7 @@ def create_app() -> FastAPI:
         response.delete_cookie("aps_session", path="/")
         response.delete_cookie(DESKTOP_COOKIE, path="/")
         response.delete_cookie(WEB_LICENSE_COOKIE, path="/")
+        response.delete_cookie(ANONYMOUS_COOKIE, path="/")
         return {"ok": True}
 
     @app.get("/api/auth/users")