更新

backend/rpa_engine/credential.py

@@ -52,7 +52,19 @@ def build_im_session_from_storage(
                 session.keys_str = saved.keys_str
             if saved.web_protect_str and not session.web_protect_str:
                 session.web_protect_str = saved.web_protect_str
-            if saved.my_uid and not session.my_uid:
+            # A UID verified from the account profile must win over collector
+            # guesses such as web_runtime_security_uid.  Persisting this flag
+            # keeps API/manual-send builders on the same identity as hosting.
+            if saved.uid_verified and saved.my_uid:
+                session.my_uid = saved.my_uid
+                # device_id 必须与 my_uid 指向同一账号：protobuf/frontier 的
+                # device_id 优先取 session.device_id，凭证里残留的旧设备号
+                # （如 www 域 web_runtime_security_uid）会导致 device_id != my_uid
+                # -> 安全网关 decision=KICK。用已核验 UID 同步 device_id。
+                if str(session.device_id or "") != str(saved.my_uid):
+                    session.device_id = str(saved.my_uid)
+                session.uid_verified = True
+            elif saved.my_uid and not session.my_uid:
                 session.my_uid = saved.my_uid
             if saved.device_id and not session.device_id:
                 session.device_id = saved.device_id