diff --git a/init/data.json b/init/data.json
new file mode 100644
index 0000000..37ea364
--- /dev/null
+++ b/init/data.json
@@ -0,0 +1,23 @@
+{
+    "appcodes": [
+        {
+            "id": "user_status",
+            "name": "用户状态",
+            "hierarchy_flg": "0"
+        }
+    ],
+    "appcodes_kv": [
+        {
+            "id": "user_status_0",
+            "parentid": "user_status",
+            "k": "0",
+            "v": "可用"
+        },
+        {
+            "id": "user_status_1",
+            "parentid": "user_status",
+            "k": "1",
+            "v": "禁用"
+        }
+    ]
+}
diff --git a/wwwroot/find_unauth_files.dspy b/wwwroot/find_unauth_files.dspy
index 4069989..0c20e01 100644
--- a/wwwroot/find_unauth_files.dspy
+++ b/wwwroot/find_unauth_files.dspy
@@ -1,7 +1,8 @@
 wwwroot = params_kw.get('wwwroot', '').strip()
 
 async with get_sor_context(request._run_ns, 'rbac') as sor:
-	title, message, is_error = await request._run_ns.scan_unauth_files(sor, wwwroot, __file__)
+	# dspy 运行时无 __file__，用 ahserver 注入的 ref_real_path（本 dspy 文件真实绝对路径）
+	title, message, is_error = await request._run_ns.scan_unauth_files(sor, wwwroot, request._run_ns.ref_real_path)
 
 if is_error:
 	return UiError(title=title, message=message)