feat(auth): 添加异步密码哈希和验证函数

refactor(relay): 复用HTTP客户端和请求体序列化结果

feat(kernel): 添加获取单个审批记录的方法

fix(store): 改进SaaS连接错误分类和降级处理

docs: 更新审计文档和系统架构文档

refactor(prompt): 优化SQL查询参数化绑定

refactor(migration): 使用静态SQL和COALESCE更新配置项

feat(commands): 添加审批执行状态追踪和事件通知

chore: 更新启动脚本以支持Admin后台

fix(auth-guard): 优化授权状态管理和错误处理

refactor(db): 使用异步密码哈希函数

refactor(totp): 使用异步密码验证函数

style: 清理无用文件和注释

docs: 更新功能全景和审计文档

refactor(service): 优化HTTP客户端重用和请求处理

fix(connection): 改进SaaS不可用时的降级处理

refactor(handlers): 使用异步密码验证函数

chore: 更新依赖和工具链配置

desktop/src/store/connectionStore.ts

@@ -352,8 +352,11 @@ export const useConnectionStore = create<ConnectionStore>((set, get) => {
 
         // === SaaS Relay Mode ===
         // Check connection mode from localStorage (set by saasStore).
-        // This takes priority over Tauri/Gateway when the user has selected SaaS mode.
+        // When SaaS is unreachable, gracefully degrade to local kernel mode
+        // so the desktop app remains functional.
         const savedMode = localStorage.getItem('zclaw-connection-mode');
+        let saasDegraded = false;
+
         if (savedMode === 'saas') {
           const { loadSaaSSession, saasClient } = await import('../lib/saas-client');
           const session = loadSaaSSession();
@@ -379,13 +382,26 @@ export const useConnectionStore = create<ConnectionStore>((set, get) => {
               useSaaSStore.getState().logout();
               throw new Error('SaaS 会话已过期，请重新登录');
             }
+
+            // SaaS unreachable — degrade to local kernel mode
             const errMsg = err instanceof Error ? err.message : String(err);
-            throw new Error(`SaaS 平台连接失败: ${errMsg}`);
+            log.warn(`SaaS 平台连接失败: ${errMsg} — 降级到本地 Kernel 模式`);
+
+            // Mark SaaS as unreachable in store
+            try {
+              const { useSaaSStore } = await import('./saasStore');
+              useSaaSStore.setState({ saasReachable: false });
+            } catch { /* non-critical */ }
+
+            saasDegraded = true;
           }
 
-          set({ connectionState: 'connected', gatewayVersion: 'saas-relay' });
-          log.debug('Connected to SaaS relay');
-          return;
+          if (!saasDegraded) {
+            set({ connectionState: 'connected', gatewayVersion: 'saas-relay' });
+            log.debug('Connected to SaaS relay');
+            return;
+          }
+          // Fall through to Tauri Kernel / Gateway mode
         }
 
         // === Internal Kernel Mode (Tauri) ===