diff --git a/frontend/index.html b/frontend/index.html
index 158bc0c..3418ae1 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -197,8 +197,8 @@
         <p>saas-search © 2025 | API: <span id="apiUrl">Loading...</span></p>
     </footer>
 
-    <script src="/static/js/tenant_facets_config.js?v=1.3"></script>
-    <script src="/static/js/app.js?v=3.6"></script>
+    <script src="/static/js/tenant_facets_config.js?v=1.4"></script>
+    <script src="/static/js/app.js?v=1.0"></script>
     <script>
         // 自动补全功能（使用后端 /search/suggestions 接口）
         const SUGGEST_API = API_BASE_URL + '/search/suggestions';
diff --git a/scripts/frontend_server.py b/scripts/frontend_server.py
index 1c44e8b..0e0ab04 100755
--- a/scripts/frontend_server.py
+++ b/scripts/frontend_server.py
@@ -19,6 +19,10 @@ from dotenv import load_dotenv
 project_root = Path(__file__).parent.parent
 load_dotenv(project_root / '.env')
 
+# Get API_BASE_URL from environment（默认不注入，避免被旧 .env 覆盖同源策略）
+# 仅当显式设置 FRONTEND_INJECT_API_BASE_URL=1 时才注入 window.API_BASE_URL。
+API_BASE_URL = os.getenv('API_BASE_URL') or None
+INJECT_API_BASE_URL = os.getenv('FRONTEND_INJECT_API_BASE_URL', '0') == '1'
 # Backend proxy target for same-origin API forwarding
 BACKEND_PROXY_URL = os.getenv('BACKEND_PROXY_URL', 'http://127.0.0.1:6002').rstrip('/')
 
@@ -27,7 +31,7 @@ frontend_dir = os.path.join(os.path.dirname(__file__), '../frontend')
 os.chdir(frontend_dir)
 
 # Get port from environment variable or default
-PORT = int(os.getenv('FRONTEND_PORT', 6003))
+PORT = int(os.getenv('PORT', 6003))
 
 # Configure logging to suppress scanner noise
 logging.basicConfig(level=logging.ERROR, format='%(asctime)s - %(levelname)s - %(message)s')
@@ -116,17 +120,48 @@ class MyHTTPRequestHandler(http.server.SimpleHTTPRequestHandler, RateLimitingMix
             self.wfile.write(b'{"error":"Bad Gateway: backend proxy failed"}')
 
     def do_GET(self):
-        """Handle GET requests with lightweight API proxy."""
+        """Handle GET requests with API config injection."""
         path = self.path.split('?')[0]
 
         # Proxy API paths to backend first
         if self._is_proxy_path(path):
             self._proxy_to_backend()
             return
+        
         # Route / to index.html
         if path == '/' or path == '':
             self.path = '/index.html' + (self.path.split('?', 1)[1] if '?' in self.path else '')
-        super().do_GET()
+        
+        # Inject API config for HTML files
+        if self.path.endswith('.html'):
+            self._serve_html_with_config()
+        else:
+            super().do_GET()
+    
+    def _serve_html_with_config(self):
+        """Serve HTML with optional API_BASE_URL injected."""
+        try:
+            file_path = self.path.lstrip('/')
+            if not os.path.exists(file_path):
+                self.send_error(404)
+                return
+            
+            with open(file_path, 'r', encoding='utf-8') as f:
+                html = f.read()
+
+            # 默认不注入 API_BASE_URL，避免历史 .env（如 http://xx:6002）覆盖同源调用。
+            # 仅当 FRONTEND_INJECT_API_BASE_URL=1 且 API_BASE_URL 有值时才注入。
+            if INJECT_API_BASE_URL and API_BASE_URL:
+                config_script = f'<script>window.API_BASE_URL="{API_BASE_URL}";</script>\n    '
+                html = html.replace('<script src="/static/js/app.js', config_script + '<script src="/static/js/app.js', 1)
+            
+            self.send_response(200)
+            self.send_header('Content-Type', 'text/html; charset=utf-8')
+            self.end_headers()
+            self.wfile.write(html.encode('utf-8'))
+        except Exception as e:
+            logging.error(f"Error serving HTML: {e}")
+            self.send_error(500)
 
     def do_POST(self):
         """Handle POST requests. Proxy API requests to backend."""
--
libgit2 0.21.2