diff --git a/src/app/api/monitor/scan-emails/route.ts b/src/app/api/monitor/scan-emails/route.ts
index 13a584d..9899735 100644
--- a/src/app/api/monitor/scan-emails/route.ts
+++ b/src/app/api/monitor/scan-emails/route.ts
@@ -8,9 +8,16 @@ import { getMonitorConfig } from '@/lib/monitor/settings-manager'
 import { ImapFlow } from 'imapflow'
 import { simpleParser } from 'mailparser'
 import { formatBeijingTime } from '@/lib/monitor/types'
-import { writeAuditLog, getClientIP } from '@/lib/audit'
+import { writeAuditLog } from '@/lib/audit'
 import { getScanState, setScanState, isCancelRequested, resetCancelFlag } from '@/lib/monitor/scan-state'
 
+// 直接定义，避免 Next.js tree-shaking 导致模块导出缺失
+function getClientIP(request: NextRequest): string | null {
+  const forwarded = request.headers.get('x-forwarded-for')
+  if (forwarded) return forwarded.split(',')[0].trim()
+  return request.headers.get('x-real-ip') ?? null
+}
+
 interface ScanResult {
   status: 'running' | 'completed' | 'error' | 'cancelling'
   startedAt: string
diff --git a/src/app/api/monitor/scan-status/route.ts b/src/app/api/monitor/scan-status/route.ts
index dd2f2c8..45ee8bb 100644
--- a/src/app/api/monitor/scan-status/route.ts
+++ b/src/app/api/monitor/scan-status/route.ts
@@ -3,9 +3,16 @@ import { NextRequest, NextResponse } from 'next/server'
 import { initDatabase } from '@/lib/db-schema'
 import { getCurrentUser } from '@/lib/auth'
 import { hasPermission } from '@/lib/permissions'
-import { getClientIP, writeAuditLog } from '@/lib/audit'
+import { writeAuditLog } from '@/lib/audit'
 import { getScanState, requestCancel } from '@/lib/monitor/scan-state'
 
+// 直接定义，避免 Next.js tree-shaking 导致模块导出缺失
+function getClientIP(request: NextRequest): string | null {
+  const forwarded = request.headers.get('x-forwarded-for')
+  if (forwarded) return forwarded.split(',')[0].trim()
+  return request.headers.get('x-real-ip') ?? null
+}
+
 export async function GET(request: NextRequest) {
   initDatabase()
   const user = await getCurrentUser()