diff --git a/inventory-backend/app/api/v1/inbound/buy.py b/inventory-backend/app/api/v1/inbound/buy.py
index 3d5d696..4dae9d5 100644
--- a/inventory-backend/app/api/v1/inbound/buy.py
+++ b/inventory-backend/app/api/v1/inbound/buy.py
@@ -103,7 +103,16 @@ def get_list():
         # 字段级脱敏
         user_permissions = get_current_user_permissions()
         if result.get('items'):
-            result['items'] = [filter_item_by_permissions(item, user_permissions) for item in result['items']]
+            # ★ 字段权限过滤会剥离 base_id，但前端扫码/选物料联动需要它匹配历史批号（自动叠加）
+            #   在过滤前保留 base_id，过滤后补回（非敏感字段，仅物料关联 ID，与 semi 列表一致）
+            restored = []
+            for item in result['items']:
+                base_id = item.get('base_id')
+                filtered = filter_item_by_permissions(item, user_permissions)
+                if base_id is not None:
+                    filtered['base_id'] = base_id
+                restored.append(filtered)
+            result['items'] = restored
         return jsonify({"code": 200, "msg": "success", "data": result})
     except Exception as e:
         traceback.print_exc()