chore: release v0.0.26

Org admin SPA, capacity policy admin, fleet deploy CI for educraft/educraft-dev.

.gitea/workflows/deploy-admin.yml

@@ -0,0 +1,126 @@
+name: deploy admin (hub fleet)
+
+# Rolls Hub releases that include the org-admin SPA (`admin-web` → registerStaticSpa)
+# onto the managed Alpha host. Two fleets share one machine and are separated by
+# the middle DNS label of each Silo's public URL:
+#
+#   dev  → https://<slug>.educraft-dev.paradigm-edu.net   (every push + PR)
+#   prod → https://<slug>.educraft.paradigm-edu.net       (main + tags)
+#
+# Example prod tenant:
+#   https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
+#
+# Required Gitea secret:
+#   DEPLOY_SSH_KEY  — private key for root@39.107.254.4
+#
+# Optional secrets / vars (defaults match NEW_SILO_RUNBOOK):
+#   DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_PORT, DEPLOY_BASE
+#   vars.ALLOW_EMPTY_FLEET=1  — green when the fleet has no silos yet
+
+on:
+  push:
+    paths:
+      - "hub/**"
+      - ".gitea/workflows/deploy-admin.yml"
+  pull_request:
+    paths:
+      - "hub/**"
+      - ".gitea/workflows/deploy-admin.yml"
+  workflow_dispatch:
+    inputs:
+      fleet:
+        description: "Which fleet to deploy (dev | prod | both)"
+        required: true
+        default: both
+      allow_empty_fleet:
+        description: "Succeed if no silo matches (1/0)"
+        required: false
+        default: "0"
+
+concurrency:
+  group: deploy-admin-host
+  cancel-in-progress: false
+
+jobs:
+  deploy-dev:
+    name: deploy fleet dev (educraft-dev)
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' &&
+        (github.event.inputs.fleet == 'dev' || github.event.inputs.fleet == 'both'))
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install rsync + ssh
+        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
+
+      - name: Deploy Hub + admin SPA to educraft-dev fleet
+        env:
+          CPH_FLEET: dev
+          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
+          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
+          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
+          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
+          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
+            echo "missing secret DEPLOY_SSH_KEY" >&2
+            exit 1
+          fi
+          key="$(mktemp)"
+          trap 'rm -f "$key"' EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
+          chmod 600 "$key"
+          export PLATFORM_DEPLOY_SSH_KEY="$key"
+          # Apply managed-host defaults when secrets are unset.
+          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
+          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+          bash hub/deploy/deploy_fleet_release.sh
+
+  deploy-prod:
+    name: deploy fleet prod (educraft)
+    runs-on: ubuntu-latest
+    if: >
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' &&
+        (github.event.inputs.fleet == 'prod' || github.event.inputs.fleet == 'both'))
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install rsync + ssh
+        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
+
+      - name: Deploy Hub + admin SPA to educraft fleet
+        env:
+          CPH_FLEET: prod
+          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
+          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
+          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
+          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
+          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
+            echo "missing secret DEPLOY_SSH_KEY" >&2
+            exit 1
+          fi
+          key="$(mktemp)"
+          trap 'rm -f "$key"' EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
+          chmod 600 "$key"
+          export PLATFORM_DEPLOY_SSH_KEY="$key"
+          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
+          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+          bash hub/deploy/deploy_fleet_release.sh

.gitignore

@@ -11,6 +11,9 @@
 # regenerable, not for VCS. The embedded engine mounts cph-render directly.
 render/vendor/local-packages/
 
+# Environment
+.env
+
 # Node (hub/ TS workspace and any future JS package)
 node_modules/
 

AGENTS.md

@@ -30,8 +30,17 @@
   控制面与 Docker adapter 后置(见 ADR-0025)。
 - Agent role 与 skill 是 Organization-scoped 动态运行配置：role 组合 model、system prompt、
   tools 与已安装 skill；skill 版本进入 content-addressed 持久存储，run 只读加载所选快照。
+  每个 Organization 必须且只能有一个启用中的默认 role；新建群绑定从该默认值初始化，之后
+  `ProjectGroupBinding` 持久化群内当前 role，run 在接纳时冻结该 role。飞书公开 slash 协议只含
+  `/project`、`/usage`、`/help`；role、会话、目录操作走 `/project` 卡片，Claude 原生
+  `/compact` 只能由卡片动作以未经包装的精确 prompt 转发。
   `settingSources: []` 继续禁用项目/用户配置加载，不得把任意 workspace `.claude` 配置变成
   运行时能力(见 ADR-0018)。
+- 项目发现由 `ProjectDiscovery` 模块统一承载：PostgreSQL `pg_trgm` 搜索派生文档、项目编号
+  归一化、完整 Folder breadcrumb、MANAGE 授权过滤与分页都在该模块内；飞书卡片只是 adapter。
+  `Project`/`Folder` 仍是事实来源，搜索文档必须可重建且由数据库触发器同步，禁止调用方双写。
+  系统 `Inbox` 只作为未分类项目的内部落点，不作为业务 folder 暴露；已绑定群通过
+  `@bot /project` 随时打开项目管理卡片，重命名仍走 org-scoped MANAGE 授权与审计。
 
 ## 纪律
 

docs/adr/0017-agent-session-is-provider-bound.md

@@ -34,8 +34,12 @@ provider runtime cursor needed to continue a conversation. For Claude Code SDK,
 that cursor is the `result.session_id`; store it in `AgentSession.metadata` as
 `claudeSessionId` and pass it back to the next `query()` call as
 `options.resume`. Role is part of the session binding because role prompts and
-tool surfaces can differ even when the underlying model is the same; `/draft`
+tool surfaces can differ even when the underlying model is the same. A Feishu
-and `/review` must not resume the same Claude runtime cursor by accident.
+project group's active binding selects one Organization role for ordinary
+messages. Switching that selection routes future messages to the selected
+role's own session; it never mutates or merges provider cursors across roles.
+Work freezes the selected role when accepted so queued requests cannot drift
+after a later switch.
 
 Role definitions are Organization-scoped runtime data. A role bundle selects
 its default model, system prompt, tool allowlist and installed Agent skill
@@ -47,6 +51,20 @@ a Hub release or process restart. A change to the role's execution surface
 the next run cannot resume a provider context created under stale instructions;
 label and ordering-only changes preserve conversational continuity.
 
+Exactly one active role per Organization is the default used when a project
+group is first bound. The default is configuration data, not a hard-coded role
+name. Roles are selected through the Hub project console; role ids are not
+public slash commands. A project participant may change the group's shared
+selection only when both `agent.trigger` for the project and `role.trigger` for
+the target role authorize that actor. The selection affects every participant's
+future messages, while already accepted work keeps its frozen role.
+
+Hub slash commands are a closed control-plane protocol. Unknown commands fail
+explicitly and are never downgraded to Agent text. Claude SDK session commands
+are invoked only through typed Hub actions. In particular, compaction resumes
+the selected role session and sends the exact `/compact` prompt without
+prepending Feishu context.
+
 Environment variables:
 ```
 ANTHROPIC_BASE_URL=https://openrouter.ai/api

docs/para-26071100-feishu-setup.md

@@ -72,8 +72,10 @@ Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放
 
 1. 在“事件配置”中将订阅方式设为“使用长连接接收事件”。
 2. 添加事件“接收消息” `im.message.receive_v1`。
-3. 在“回调配置”中同样选择长连接。
+3. 添加事件“解散群” `im.chat.disbanded_v1`，用于立即归档该群的项目绑定。
-4. 添加回调“卡片回传交互” `card.action.trigger`，用于审批、运行中断和项目创建/绑定按钮。
+4. 添加事件“机器人被移出群” `im.chat.member.bot.deleted_v1`，用于立即归档该群的项目绑定。
+5. 在“回调配置”中同样选择长连接。
+6. 添加回调“卡片回传交互” `card.action.trigger`，用于审批、运行中断和项目创建/绑定按钮。
 
 ![长连接与消息事件配置](assets/feishu-setup/03-events.png)
 
@@ -174,7 +176,7 @@ App ID：cli_...
 App Secret：（通过安全渠道单独发送）
 应用已发布：是 / 否
 机器人能力已启用：是 / 否
-消息事件和卡片回调已配置：是 / 否
+消息事件（含解散群、机器人被移出群）和卡片回调已配置：是 / 否
 OAuth 重定向 URL 已配置：是 / 否
 
 【首位 OWNER】

hub/.gitignore

@@ -4,3 +4,7 @@ dist/
 .env
 .env.*
 !.env.example
+.secrets/
+admin-web/node_modules/
+admin-web/build/
+admin-web/.svelte-kit/

hub/admin-web/.gitignore

@@ -0,0 +1,23 @@
+node_modules
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*

hub/admin-web/.npmrc

@@ -0,0 +1 @@
+engine-strict=true

hub/admin-web/.prettierignore

@@ -0,0 +1,4 @@
+build
+.svelte-kit
+node_modules
+package-lock.json

hub/admin-web/.prettierrc.json

@@ -0,0 +1,9 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"semi": true,
+	"trailingComma": "all",
+	"printWidth": 120,
+	"plugins": ["prettier-plugin-svelte"],
+	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
+}

hub/admin-web/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+	"recommendations": ["svelte.svelte-vscode"]
+}

hub/admin-web/README.md

@@ -0,0 +1,42 @@
+# sv
+
+Everything you need to build a Svelte project, powered by [`sv`](https://github.com/sveltejs/cli).
+
+## Creating a project
+
+If you're seeing this, you've probably already done this step. Congrats!
+
+```sh
+# create a new project
+npx sv create my-app
+```
+
+To recreate this project with the same configuration:
+
+```sh
+# recreate this project
+npx sv@0.16.2 create --template minimal --types ts --install npm D:/Projects/curriculum-project-hub/hub/admin-web
+```
+
+## Developing
+
+Once you've created a project and installed dependencies with `npm install` (or `pnpm install` or `yarn`), start a development server:
+
+```sh
+npm run dev
+
+# or start the server and open the app in a new browser tab
+npm run dev -- --open
+```
+
+## Building
+
+To create a production version of your app:
+
+```sh
+npm run build
+```
+
+You can preview the production build with `npm run preview`.
+
+> To deploy your app, you may need to install an [adapter](https://svelte.dev/docs/kit/adapters) for your target environment.

hub/admin-web/package.json

@@ -0,0 +1,33 @@
+{
+	"name": "admin-web",
+	"private": true,
+	"version": "0.0.1",
+	"type": "module",
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"preview": "vite preview",
+		"prepare": "svelte-kit sync || echo ''",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"format": "prettier --write .",
+		"format:check": "prettier --check ."
+	},
+	"devDependencies": {
+		"@skeletonlabs/skeleton": "^4.15.2",
+		"@skeletonlabs/skeleton-svelte": "^4.15.2",
+		"@sveltejs/adapter-auto": "^7.0.1",
+		"@sveltejs/adapter-static": "^3.0.10",
+		"@sveltejs/kit": "^2.63.0",
+		"@sveltejs/vite-plugin-svelte": "^7.1.2",
+		"@tailwindcss/vite": "^4.3.2",
+		"bits-ui": "^2.18.1",
+		"prettier": "^3.9.5",
+		"prettier-plugin-svelte": "^4.1.1",
+		"svelte": "^5.56.1",
+		"svelte-check": "^4.6.0",
+		"tailwindcss": "^4.3.2",
+		"typescript": "^6.0.3",
+		"vite": "^8.0.16"
+	}
+}

hub/admin-web/src/app.d.ts

@@ -0,0 +1,13 @@
+// See https://svelte.dev/docs/kit/types#app.d.ts
+// for information about these interfaces
+declare global {
+	namespace App {
+		// interface Error {}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};

hub/admin-web/src/app.html

@@ -0,0 +1,27 @@
+<!doctype html>
+<html lang="zh-CN" data-theme="hamlindigo">
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="text-scale" content="scale" />
+		<meta name="description" content="Curriculum Project Hub — 组织管理后台" />
+		<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
+		<link rel="preconnect" href="https://fonts.googleapis.com" />
+		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+		<link
+			href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Noto+Sans+SC:wght@400;500;600;700&display=swap"
+			rel="stylesheet"
+		/>
+		<style>
+			/* Fallback before CSS bundle: CJK-first industrial base */
+			html {
+				font-family: 'Noto Sans SC', 'PingFang SC', 'Microsoft YaHei', 'Inter', sans-serif;
+			}
+		</style>
+		<title>CPH Admin</title>
+		%sveltekit.head%
+	</head>
+	<body data-sveltekit-preload-data="hover">
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>

hub/admin-web/src/lib/api.ts

@@ -0,0 +1,345 @@
+/**
+ * Thin API client for the org admin backend. Same-origin cookie auth.
+ */
+
+export class ApiError extends Error {
+	code: string;
+	status: number;
+	constructor(code: string, message: string, status: number) {
+		super(message);
+		this.name = 'ApiError';
+		this.code = code;
+		this.status = status;
+	}
+}
+
+async function request(method: string, url: string, body?: unknown): Promise<unknown> {
+	const init: RequestInit = {
+		method,
+		credentials: 'same-origin',
+		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
+		body: body !== undefined ? JSON.stringify(body) : undefined,
+	};
+	const res = await fetch(url, init);
+	const text = await res.text();
+	let data: unknown = null;
+	if (text !== '') {
+		try {
+			data = JSON.parse(text);
+		} catch {
+			data = text;
+		}
+	}
+	if (!res.ok) {
+		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
+		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
+	}
+	return data;
+}
+
+const get = (u: string) => request('GET', u);
+const post = (u: string, b?: unknown) => request('POST', u, b);
+const put = (u: string, b?: unknown) => request('PUT', u, b);
+const patch = (u: string, b?: unknown) => request('PATCH', u, b);
+const del = (u: string) => request('DELETE', u);
+
+const orgBase = (slug: string) => `/api/org/${encodeURIComponent(slug)}`;
+
+// --- Types ---
+
+export interface OrgMembership {
+	id: string;
+	slug: string;
+	name: string;
+	status: string;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+}
+
+export interface MeResponse {
+	user: {
+		id: string;
+		feishuOpenId: string;
+		displayName: string;
+		avatarUrl: string | null;
+	};
+	organizations: OrgMembership[];
+}
+
+export interface OrgMember {
+	userId: string;
+	feishuOpenId: string;
+	displayName: string;
+	avatarUrl: string | null;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+	createdAt: string;
+}
+
+export interface TeamRow {
+	id: string;
+	slug: string;
+	name: string;
+	description: string | null;
+	memberCount: number;
+	createdAt: string;
+}
+
+export interface TeamMemberRow {
+	userId: string;
+	feishuOpenId: string;
+	displayName: string;
+	createdAt: string;
+}
+
+export interface ExplorerFolder {
+	id: string;
+	name: string;
+	parentId: string | null;
+	sortKey: string;
+	projectCount: number;
+	childFolderCount: number;
+}
+
+export interface ExplorerProject {
+	id: string;
+	name: string;
+	folderId: string | null;
+	createdAt: string;
+	binding: { chatId: string; createdAt: string } | null;
+}
+
+export interface ExplorerData {
+	folders: ExplorerFolder[];
+	projects: ExplorerProject[];
+}
+
+export interface ProjectDetail {
+	id: string;
+	name: string;
+	folderId: string | null;
+	folder: { id: string; name: string } | null;
+	workspaceDir: string;
+	createdAt: string;
+	archivedAt: string | null;
+	createdBy: { id: string; displayName: string; feishuOpenId: string } | null;
+	binding: { chatId: string; createdAt: string } | null;
+	actorIsOrgAdmin?: boolean;
+	actorCanManageProject?: boolean;
+}
+
+export interface TeamAccessEntry {
+	grantId: string;
+	projectId: string;
+	organizationId: string;
+	teamId: string;
+	teamSlug: string;
+	teamName: string;
+	role: 'READ' | 'EDIT' | 'MANAGE';
+}
+
+export interface SessionSummary {
+	id: string;
+	provider: string;
+	roleId: string;
+	model: string;
+	title: string | null;
+	runCount: number;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface ProviderConnectionRow {
+	id: string;
+	providerId: string;
+	mode: 'BYOK' | 'PLATFORM_MANAGED';
+	status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
+	activeVersion: number | null;
+	keyId: string | null;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface FeishuApplicationConnection {
+	id: string;
+	appFingerprint: string;
+	status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
+	activeVersion: number | null;
+	keyId: string | null;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface UsageTotals {
+	runCount: number;
+	runsWithCost: number;
+	runsWithoutCost: number;
+	inputTokens: number;
+	outputTokens: number;
+	costUsd: number | null;
+}
+
+export interface ProjectUsageRow extends UsageTotals {
+	projectId: string;
+	projectName: string;
+	folderId: string | null;
+}
+
+export interface UsageReport {
+	from: string | null;
+	to: string | null;
+	projects: ProjectUsageRow[];
+	totals: UsageTotals;
+}
+
+export type CapacityDimension =
+	| 'requestRate'
+	| 'requestBodySize'
+	| 'agentConcurrency'
+	| 'admissionQueueLength'
+	| 'admissionQueueWait'
+	| 'fileSize'
+	| 'attachmentCount'
+	| 'archiveExpansion'
+	| 'projectStorage'
+	| 'organizationStorage'
+	| 'memberCount'
+	| 'projectCount'
+	| 'teamCount'
+	| 'folderCount'
+	| 'sessionCount'
+	| 'runWallTime'
+	| 'runTurns'
+	| 'runToolCalls'
+	| 'toolWallTime'
+	| 'runOutputSize'
+	| 'processMemory'
+	| 'processCpu'
+	| 'processCount';
+
+export interface CapacityDimensionRow {
+	dimension: CapacityDimension;
+	platformCeiling: number | null;
+	organizationLimit: number | null;
+	effective: number | null;
+}
+
+export interface CapacityPolicyView {
+	dimensions: CapacityDimensionRow[];
+}
+
+// --- API ---
+
+export const api = {
+	me: () => get('/api/me') as Promise<MeResponse>,
+	logout: () => post('/auth/logout'),
+
+	org: (slug: string) =>
+		get(orgBase(slug)) as Promise<{
+			organization: { id: string; slug: string; name: string; status: string };
+			actorRole: string;
+		}>,
+	settings: (slug: string) => get(`${orgBase(slug)}/settings`) as Promise<{ membersCanCreateProjects: boolean }>,
+	setSettings: (slug: string, body: { membersCanCreateProjects: boolean }) =>
+		patch(`${orgBase(slug)}/settings`, body) as Promise<{ membersCanCreateProjects: boolean }>,
+
+	members: (slug: string) => get(`${orgBase(slug)}/members`) as Promise<{ members: OrgMember[] }>,
+	addMember: (slug: string, body: { feishuOpenId: string; displayName?: string; role: string }) =>
+		post(`${orgBase(slug)}/members`, body) as Promise<OrgMember>,
+	setMemberRole: (slug: string, userId: string, role: string) => patch(`${orgBase(slug)}/members/${userId}`, { role }),
+	revokeMember: (slug: string, userId: string) => post(`${orgBase(slug)}/members/${userId}/revoke`),
+
+	teams: (slug: string) => get(`${orgBase(slug)}/teams`) as Promise<{ teams: TeamRow[] }>,
+	createTeam: (slug: string, body: { slug: string; name: string; description?: string }) =>
+		post(`${orgBase(slug)}/teams`, body) as Promise<TeamRow>,
+	updateTeam: (slug: string, teamId: string, body: { name?: string; description?: string | null }) =>
+		patch(`${orgBase(slug)}/teams/${teamId}`, body) as Promise<TeamRow>,
+	archiveTeam: (slug: string, teamId: string) => post(`${orgBase(slug)}/teams/${teamId}/archive`),
+	teamMembers: (slug: string, teamId: string) =>
+		get(`${orgBase(slug)}/teams/${teamId}/members`) as Promise<{ members: TeamMemberRow[] }>,
+	addTeamMember: (slug: string, teamId: string, body: { userId?: string; feishuOpenId?: string }) =>
+		post(`${orgBase(slug)}/teams/${teamId}/members`, body) as Promise<TeamMemberRow>,
+	revokeTeamMember: (slug: string, teamId: string, userId: string) =>
+		post(`${orgBase(slug)}/teams/${teamId}/members/${userId}/revoke`),
+
+	explorer: (slug: string) => get(`${orgBase(slug)}/explorer`) as Promise<ExplorerData>,
+	myProjects: (slug: string) =>
+		get(`${orgBase(slug)}/my-projects`) as Promise<{ projects: ExplorerProject[] }>,
+	createFolder: (slug: string, body: { name: string; parentId?: string; sortKey?: string }) =>
+		post(`${orgBase(slug)}/folders`, body) as Promise<{
+			id: string;
+			name: string;
+			parentId: string | null;
+			sortKey: string;
+		}>,
+	renameFolder: (slug: string, folderId: string, body: { name?: string; sortKey?: string; parentId?: string | null }) =>
+		patch(`${orgBase(slug)}/folders/${folderId}`, body) as Promise<{
+			id: string;
+			name: string;
+			parentId: string | null;
+			sortKey: string;
+		}>,
+	archiveFolder: (slug: string, folderId: string) =>
+		post(`${orgBase(slug)}/folders/${folderId}/archive`) as Promise<{ archived: true; folderId: string }>,
+	createProject: (slug: string, body: { name: string; folderId?: string }) =>
+		post(`${orgBase(slug)}/projects`, body) as Promise<{ id: string; name: string }>,
+	project: (slug: string, projectId: string) => get(`${orgBase(slug)}/projects/${projectId}`) as Promise<ProjectDetail>,
+	renameProject: (slug: string, projectId: string, name: string) =>
+		patch(`${orgBase(slug)}/projects/${projectId}`, { name }),
+	moveProject: (slug: string, projectId: string, folderId: string | null) =>
+		patch(`${orgBase(slug)}/projects/${projectId}/folder`, { folderId }),
+	archiveProject: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/archive`),
+	archiveBinding: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/binding/archive`),
+
+	teamAccess: (slug: string, projectId: string) =>
+		get(`${orgBase(slug)}/projects/${projectId}/team-access`) as Promise<{ access: TeamAccessEntry[] }>,
+	grantTeamAccess: (slug: string, projectId: string, body: { teamId?: string; teamSlug?: string; role: string }) =>
+		put(`${orgBase(slug)}/projects/${projectId}/team-access`, body) as Promise<TeamAccessEntry>,
+	revokeTeamAccess: (slug: string, projectId: string, teamId: string) =>
+		del(`${orgBase(slug)}/projects/${projectId}/team-access/${teamId}`),
+
+	sessions: (slug: string, projectId: string, limit?: number) =>
+		get(`${orgBase(slug)}/projects/${projectId}/sessions${limit !== undefined ? `?limit=${limit}` : ''}`) as Promise<{
+			sessions: SessionSummary[];
+		}>,
+	usage: (slug: string, params?: { from?: string; to?: string; folderId?: string }) => {
+		const q = new URLSearchParams();
+		if (params?.from) q.set('from', params.from);
+		if (params?.to) q.set('to', params.to);
+		if (params?.folderId) q.set('folderId', params.folderId);
+		const qs = q.toString();
+		return get(`${orgBase(slug)}/usage${qs ? `?${qs}` : ''}`) as Promise<UsageReport>;
+	},
+
+	providerConnections: (slug: string) =>
+		get(`${orgBase(slug)}/provider-connections`) as Promise<{ connections: ProviderConnectionRow[] }>,
+	rotateProviderConnection: (
+		slug: string,
+		providerId: string,
+		body: { baseUrl: string; authToken: string; anthropicApiKey?: string },
+	) =>
+		put(
+			`${orgBase(slug)}/provider-connections/${encodeURIComponent(providerId)}`,
+			body,
+		) as Promise<ProviderConnectionRow>,
+
+	feishuApplication: (slug: string) =>
+		get(`${orgBase(slug)}/feishu-application-connection`) as Promise<{
+			connection: FeishuApplicationConnection | null;
+		}>,
+	rotateFeishuApplication: (
+		slug: string,
+		body: {
+			appId: string;
+			appSecret: string;
+			botOpenId: string;
+			verificationToken?: string;
+			encryptKey?: string;
+		},
+	) => put(`${orgBase(slug)}/feishu-application-connection`, body) as Promise<FeishuApplicationConnection>,
+	disableFeishuApplication: (slug: string) =>
+		del(`${orgBase(slug)}/feishu-application-connection`) as Promise<FeishuApplicationConnection>,
+
+	capacityPolicy: (slug: string) =>
+		get(`${orgBase(slug)}/capacity-policy`) as Promise<CapacityPolicyView>,
+	setCapacityPolicy: (slug: string, body: { limits: Partial<Record<CapacityDimension, number | null>> }) =>
+		put(`${orgBase(slug)}/capacity-policy`, body) as Promise<CapacityPolicyView>,
+};

hub/admin-web/src/lib/assets/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="107" height="128" viewBox="0 0 107 128"><title>svelte-logo</title><path d="M94.157 22.819c-10.4-14.885-30.94-19.297-45.792-9.835L22.282 29.608A29.92 29.92 0 0 0 8.764 49.65a31.5 31.5 0 0 0 3.108 20.231 30 30 0 0 0-4.477 11.183 31.9 31.9 0 0 0 5.448 24.116c10.402 14.887 30.942 19.297 45.791 9.835l26.083-16.624A29.92 29.92 0 0 0 98.235 78.35a31.53 31.53 0 0 0-3.105-20.232 30 30 0 0 0 4.474-11.182 31.88 31.88 0 0 0-5.447-24.116" style="fill:#ff3e00"/><path d="M45.817 106.582a20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.503 18 18 0 0 1 .624-2.435l.49-1.498 1.337.981a33.6 33.6 0 0 0 10.203 5.098l.97.294-.09.968a5.85 5.85 0 0 0 1.052 3.878 6.24 6.24 0 0 0 6.695 2.485 5.8 5.8 0 0 0 1.603-.704L69.27 76.28a5.43 5.43 0 0 0 2.45-3.631 5.8 5.8 0 0 0-.987-4.371 6.24 6.24 0 0 0-6.698-2.487 5.7 5.7 0 0 0-1.6.704l-9.953 6.345a19 19 0 0 1-5.296 2.326 20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.502 17.99 17.99 0 0 1 8.13-12.052l26.081-16.623a19 19 0 0 1 5.3-2.329 20.72 20.72 0 0 1 22.237 8.243 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-.624 2.435l-.49 1.498-1.337-.98a33.6 33.6 0 0 0-10.203-5.1l-.97-.294.09-.968a5.86 5.86 0 0 0-1.052-3.878 6.24 6.24 0 0 0-6.696-2.485 5.8 5.8 0 0 0-1.602.704L37.73 51.72a5.42 5.42 0 0 0-2.449 3.63 5.79 5.79 0 0 0 .986 4.372 6.24 6.24 0 0 0 6.698 2.486 5.8 5.8 0 0 0 1.602-.704l9.952-6.342a19 19 0 0 1 5.295-2.328 20.72 20.72 0 0 1 22.237 8.242 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-8.13 12.053l-26.081 16.622a19 19 0 0 1-5.3 2.328" style="fill:#fff"/></svg>

hub/admin-web/src/lib/components/CheckboxControl.svelte

@@ -0,0 +1,32 @@
+<script lang="ts">
+	import { Checkbox } from 'bits-ui';
+	import Icon from './Icon.svelte';
+
+	let {
+		checked = $bindable(false),
+		disabled = false,
+		class: className = '',
+		onchange,
+	}: {
+		checked?: boolean;
+		disabled?: boolean;
+		class?: string;
+		onchange?: (checked: boolean) => void;
+	} = $props();
+</script>
+
+<Checkbox.Root
+	class="saas-checkbox {className}"
+	{disabled}
+	{checked}
+	onCheckedChange={(next) => {
+		checked = next;
+		onchange?.(next);
+	}}
+>
+	{#snippet children({ checked: isChecked })}
+		{#if isChecked}
+			<Icon name="check" class="h-3.5 w-3.5" />
+		{/if}
+	{/snippet}
+</Checkbox.Root>

hub/admin-web/src/lib/components/EmptyState.svelte

@@ -0,0 +1,32 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+
+	let {
+		title = '暂无数据',
+		description,
+		action,
+	}: {
+		title?: string;
+		description?: string;
+		action?: Snippet;
+	} = $props();
+</script>
+
+<div class="saas-empty">
+	<div
+		class="mb-1 flex h-12 w-12 items-center justify-center border border-surface-300 bg-surface-100 text-surface-600"
+	>
+		<svg class="h-6 w-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+			<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25H12" />
+		</svg>
+	</div>
+	<p class="text-sm font-medium text-surface-900">{title}</p>
+	{#if description}
+		<p class="max-w-sm text-sm text-surface-600">{description}</p>
+	{/if}
+	{#if action}
+		<div class="mt-2">
+			{@render action()}
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/ErrorBanner.svelte

@@ -0,0 +1,26 @@
+<script lang="ts">
+	let {
+		message,
+		onretry,
+	}: {
+		message: string;
+		onretry?: () => void;
+	} = $props();
+</script>
+
+<div class="saas-card flex flex-wrap items-start gap-3 border-error-200 bg-error-50 p-4 text-error-700">
+	<svg class="mt-0.5 h-5 w-5 shrink-0" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M12 9v3.75m9-.75a9 9 0 11-18 0 9 9 0 0118 0zm-9 3.75h.008v.008H12v-.008z"
+		/>
+	</svg>
+	<div class="min-w-0 flex-1">
+		<p class="text-sm font-medium">请求失败</p>
+		<p class="mt-0.5 text-sm opacity-90">{message}</p>
+	</div>
+	{#if onretry}
+		<button type="button" class="saas-btn-ghost text-sm" onclick={onretry}>重试</button>
+	{/if}
+</div>

hub/admin-web/src/lib/components/FolderNode.svelte

@@ -0,0 +1,48 @@
+<script lang="ts">
+	import type { ExplorerFolder } from '$lib/api';
+	import Icon from './Icon.svelte';
+	import FolderTree from './FolderTree.svelte';
+
+	let {
+		folder,
+		folders,
+		projects,
+		slug,
+	}: {
+		folder: ExplorerFolder;
+		folders: ExplorerFolder[];
+		projects: {
+			id: string;
+			name: string;
+			folderId: string | null;
+			createdAt: string;
+			binding: { chatId: string } | null;
+		}[];
+		slug: string;
+	} = $props();
+
+	let open = $state(true);
+</script>
+
+<div>
+	<button
+		type="button"
+		class="flex w-full items-center gap-2.5 px-3 py-2.5 text-left text-sm transition hover:bg-surface-100"
+		onclick={() => (open = !open)}
+	>
+		<span class="w-3.5 text-center text-xs text-surface-600">{open ? '▾' : '▸'}</span>
+		<span class="flex h-7 w-7 items-center justify-center border border-warning-300 bg-warning-50 text-warning-800">
+			<Icon name="folder" class="h-4 w-4" />
+		</span>
+		<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{folder.name}</span>
+		<span class="saas-badge-neutral">{folder.projectCount} 项目</span>
+		{#if folder.childFolderCount > 0}
+			<span class="saas-badge-neutral">{folder.childFolderCount} 子夹</span>
+		{/if}
+	</button>
+	{#if open}
+		<div class="ml-4 border-l border-surface-300 pl-2">
+			<FolderTree {folders} {projects} parentId={folder.id} {slug} />
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/FolderTree.svelte

@@ -0,0 +1,49 @@
+<script lang="ts">
+	import type { ExplorerFolder } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import Icon from './Icon.svelte';
+	import FolderNode from './FolderNode.svelte';
+
+	let {
+		folders,
+		projects,
+		parentId,
+		slug,
+	}: {
+		folders: ExplorerFolder[];
+		projects: {
+			id: string;
+			name: string;
+			folderId: string | null;
+			createdAt: string;
+			binding: { chatId: string } | null;
+		}[];
+		parentId: string | null;
+		slug: string;
+	} = $props();
+
+	let childFolders = $derived(folders.filter((f) => f.parentId === parentId));
+	let childProjects = $derived(projects.filter((p) => p.folderId === parentId));
+</script>
+
+<div class="space-y-0.5">
+	{#each childProjects as p (p.id)}
+		<a
+			href={`/admin/org/${slug}/projects/${p.id}`}
+			class="flex items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100"
+		>
+			<span class="flex h-7 w-7 items-center justify-center border border-primary-200 bg-primary-50 text-primary-700">
+				<Icon name="file" class="h-4 w-4" />
+			</span>
+			<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{p.name}</span>
+			{#if p.binding}
+				<span class="saas-badge-success">已绑定</span>
+			{/if}
+			<span class="hidden text-xs text-surface-600 sm:inline">{fmtDate(p.createdAt)}</span>
+		</a>
+	{/each}
+
+	{#each childFolders as f (f.id)}
+		<FolderNode folder={f} {folders} {projects} {slug} />
+	{/each}
+</div>

hub/admin-web/src/lib/components/Icon.svelte

@@ -0,0 +1,123 @@
+<script lang="ts">
+	/** Inline nav icons for the admin shell. */
+	let {
+		name,
+		class: className = 'h-4 w-4',
+	}: {
+		name:
+			| 'overview'
+			| 'members'
+			| 'teams'
+			| 'projects'
+			| 'provider'
+			| 'feishu'
+			| 'menu'
+			| 'logout'
+			| 'org'
+			| 'chevron'
+			| 'folder'
+			| 'file'
+			| 'check';
+		class?: string;
+	} = $props();
+</script>
+
+{#if name === 'overview'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3 12l9-9 9 9M5 10v9a1 1 0 001 1h3v-5h6v5h3a1 1 0 001-1v-9"
+		/>
+	</svg>
+{:else if name === 'members'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M15.75 7.5a3.75 3.75 0 11-7.5 0 3.75 3.75 0 017.5 0zM4.5 19.5a7.5 7.5 0 0115 0"
+		/>
+	</svg>
+{:else if name === 'teams'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M18 18.72a9.09 9.09 0 003.74-.72 9 9 0 00-5.07-5.95M15 11a4 4 0 10-8 0 4 4 0 008 0zM4.26 18a9 9 0 0115.48 0"
+		/>
+	</svg>
+{:else if name === 'projects'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
+		/>
+	</svg>
+{:else if name === 'provider'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M13.19 8.688a4.5 4.5 0 016.364 6.364l-3.182 3.182a4.5 4.5 0 01-6.364-6.364"
+		/>
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M10.81 15.312a4.5 4.5 0 01-6.364-6.364l3.182-3.182a4.5 4.5 0 016.364 6.364"
+		/>
+	</svg>
+{:else if name === 'feishu'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M4.5 8.25h15a8.25 8.25 0 01-8.25 8.25A8.25 8.25 0 014.5 8.25z"
+		/>
+		<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 11.25h.01M12 11.25h.01M15.75 11.25h.01" />
+	</svg>
+{:else if name === 'menu'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5" />
+	</svg>
+{:else if name === 'logout'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M15.75 9V5.25A2.25 2.25 0 0013.5 3h-6A2.25 2.25 0 005.25 5.25v13.5A2.25 2.25 0 007.5 21h6a2.25 2.25 0 002.25-2.25V15M12 9l3 3m0 0l-3 3m3-3H6"
+		/>
+	</svg>
+{:else if name === 'org'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 21h16.5M4.5 3h15M5.25 3v18m13.5-18v18M9 6.75h1.5m-1.5 3h1.5m-1.5 3h1.5m3-6H15m-1.5 3H15m-1.5 3H15M9 21v-3.375c0-.621.504-1.125 1.125-1.125h3.75c.621 0 1.125.504 1.125 1.125V21"
+		/>
+	</svg>
+{:else if name === 'chevron'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 4.5l7.5 7.5-7.5 7.5" />
+	</svg>
+{:else if name === 'folder'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
+		/>
+	</svg>
+{:else if name === 'file'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
+		/>
+	</svg>
+{:else if name === 'check'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path stroke-linecap="round" stroke-linejoin="round" d="M4.5 12.75l6 6 9-13.5" />
+	</svg>
+{/if}

hub/admin-web/src/lib/components/LoadingState.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+	let { label = '加载中…' }: { label?: string } = $props();
+</script>
+
+<div class="flex flex-col items-center justify-center gap-3 py-16 text-surface-600">
+	<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+		<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+		<path
+			class="opacity-90"
+			fill="currentColor"
+			d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+		></path>
+	</svg>
+	<p class="text-sm">{label}</p>
+</div>

hub/admin-web/src/lib/components/Modal.svelte

@@ -0,0 +1,38 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+	import { Dialog } from 'bits-ui';
+
+	let {
+		open = $bindable(false),
+		title,
+		children,
+		onclose,
+	}: {
+		open?: boolean;
+		title: string;
+		children: Snippet;
+		onclose?: () => void;
+	} = $props();
+</script>
+
+<Dialog.Root
+	bind:open
+	onOpenChange={(next) => {
+		if (!next) onclose?.();
+	}}
+>
+	<Dialog.Portal>
+		<Dialog.Overlay class="saas-modal-backdrop" />
+		<Dialog.Content class="saas-modal">
+			<div class="mb-4 flex items-start justify-between gap-3">
+				<Dialog.Title class="text-lg font-semibold text-surface-900">{title}</Dialog.Title>
+				<Dialog.Close class="saas-btn-ghost px-2! py-1! text-surface-600" aria-label="关闭">
+					<svg class="h-5 w-5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+						<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+					</svg>
+				</Dialog.Close>
+			</div>
+			{@render children()}
+		</Dialog.Content>
+	</Dialog.Portal>
+</Dialog.Root>

hub/admin-web/src/lib/components/PageHeader.svelte

@@ -0,0 +1,27 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+
+	let {
+		title,
+		description,
+		actions,
+	}: {
+		title: string;
+		description?: string;
+		actions?: Snippet;
+	} = $props();
+</script>
+
+<div class="saas-toolbar">
+	<div class="min-w-0">
+		<h1 class="saas-page-title">{title}</h1>
+		{#if description}
+			<p class="saas-muted mt-1">{description}</p>
+		{/if}
+	</div>
+	{#if actions}
+		<div class="ml-auto flex flex-wrap items-center gap-2">
+			{@render actions()}
+		</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/SelectField.svelte

@@ -0,0 +1,66 @@
+<script lang="ts">
+	import { Select } from 'bits-ui';
+	import Icon from './Icon.svelte';
+
+	export type SelectItem = { label: string; value: string; disabled?: boolean };
+
+	let {
+		items,
+		value = $bindable(''),
+		class: className = '',
+		disabled = false,
+		placeholder = '请选择…',
+		onchange,
+	}: {
+		items: SelectItem[];
+		value?: string;
+		class?: string;
+		disabled?: boolean;
+		placeholder?: string;
+		onchange?: (value: string) => void;
+	} = $props();
+</script>
+
+<Select.Root
+	type="single"
+	{items}
+	{disabled}
+	{value}
+	onValueChange={(next) => {
+		value = next;
+		onchange?.(next);
+	}}
+>
+	<Select.Trigger class="saas-select-trigger {className}" {disabled}>
+		<span class="min-w-0 flex-1 truncate text-left">
+			<Select.Value {placeholder} />
+		</span>
+		<svg
+			class="ml-2 h-4 w-4 shrink-0 text-surface-600"
+			viewBox="0 0 24 24"
+			fill="none"
+			stroke="currentColor"
+			stroke-width="1.75"
+			aria-hidden="true"
+		>
+			<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 15l3.75 3.75L15.75 15" />
+			<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 9l3.75-3.75L15.75 9" />
+		</svg>
+	</Select.Trigger>
+	<Select.Portal>
+		<Select.Content class="saas-select-content" sideOffset={6} collisionPadding={8}>
+			<Select.Viewport class="p-1">
+				{#each items as item (item.value)}
+					<Select.Item class="saas-select-item" value={item.value} label={item.label} disabled={item.disabled}>
+						{#snippet children({ selected })}
+							<span class="min-w-0 flex-1 truncate">{item.label}</span>
+							{#if selected}
+								<Icon name="check" class="ml-2 h-4 w-4 shrink-0 text-primary-600" />
+							{/if}
+						{/snippet}
+					</Select.Item>
+				{/each}
+			</Select.Viewport>
+		</Select.Content>
+	</Select.Portal>
+</Select.Root>

hub/admin-web/src/lib/components/StatCard.svelte

@@ -0,0 +1,19 @@
+<script lang="ts">
+	let {
+		label,
+		value,
+		hint,
+	}: {
+		label: string;
+		value: string;
+		hint?: string;
+	} = $props();
+</script>
+
+<div class="saas-stat">
+	<div class="saas-stat-label">{label}</div>
+	<div class="saas-stat-value">{value}</div>
+	{#if hint}
+		<div class="saas-help">{hint}</div>
+	{/if}
+</div>

hub/admin-web/src/lib/components/SwitchControl.svelte

@@ -0,0 +1,27 @@
+<script lang="ts">
+	import { Switch } from 'bits-ui';
+
+	let {
+		checked = $bindable(false),
+		disabled = false,
+		class: className = '',
+		onchange,
+	}: {
+		checked?: boolean;
+		disabled?: boolean;
+		class?: string;
+		onchange?: (checked: boolean) => void;
+	} = $props();
+</script>
+
+<Switch.Root
+	class="saas-switch {className}"
+	{disabled}
+	{checked}
+	onCheckedChange={(next) => {
+		checked = next;
+		onchange?.(next);
+	}}
+>
+	<Switch.Thumb class="saas-switch-thumb" />
+</Switch.Root>

hub/admin-web/src/lib/components/ToastHost.svelte

@@ -0,0 +1,25 @@
+<script lang="ts">
+	import { dismissToast, toasts } from '$lib/toast';
+
+	const kindClass: Record<string, string> = {
+		info: 'border-surface-200 bg-surface-50 text-surface-800',
+		success: 'border-success-200 bg-success-50 text-success-800',
+		error: 'border-error-200 bg-error-50 text-error-800',
+	};
+</script>
+
+<div class="pointer-events-none fixed inset-x-0 top-0 z-100 flex flex-col items-end gap-2 p-4">
+	{#each $toasts as t (t.id)}
+		<div
+			class="pointer-events-auto flex max-w-sm items-start gap-3 border px-4 py-3 text-sm shadow-[4px_4px_0_rgb(15_23_42/0.12)] {kindClass[
+				t.kind
+			] ?? kindClass.info}"
+			role="status"
+		>
+			<p class="min-w-0 flex-1">{t.message}</p>
+			<button type="button" class="opacity-60 hover:opacity-100" onclick={() => dismissToast(t.id)} aria-label="关闭">
+				×
+			</button>
+		</div>
+	{/each}
+</div>

hub/admin-web/src/lib/constants.ts

@@ -0,0 +1,39 @@
+export interface ToolOption {
+	id: string;
+	label: string;
+	group: string;
+}
+
+export const TOOL_OPTIONS: ToolOption[] = [
+	{ id: 'read_file', label: '读取文件', group: '文件' },
+	{ id: 'write_file', label: '写入文件', group: '文件' },
+	{ id: 'list_files', label: '列目录', group: '文件' },
+	{ id: 'search_files', label: '搜索', group: '文件' },
+	{ id: 'bash', label: 'Bash 命令', group: 'Shell' },
+	{ id: 'cph_check', label: 'cph check', group: 'CPH' },
+	{ id: 'cph_build', label: 'cph build', group: 'CPH' },
+	{ id: 'send_file', label: '发送文件（飞书）', group: '飞书' },
+	{ id: 'feishu_read_context', label: '读飞书上下文', group: '飞书' },
+	{ id: 'feishu_download_resource', label: '下载飞书资源', group: '飞书' },
+	{ id: 'request_approval', label: '请求审批', group: '飞书' },
+];
+
+/** 组织成员角色（接口枚举保持英文，界面用 orgRoleLabel） */
+export const ORG_ROLES = ['OWNER', 'ADMIN', 'MEMBER'] as const;
+export type OrgRole = (typeof ORG_ROLES)[number];
+
+export const ORG_ROLE_LABELS: Record<OrgRole, string> = {
+	OWNER: '所有者',
+	ADMIN: '管理员',
+	MEMBER: '成员',
+};
+
+/** 项目团队授权角色（接口枚举保持英文，界面用 permissionRoleLabel） */
+export const PERMISSION_ROLES = ['READ', 'EDIT', 'MANAGE'] as const;
+export type PermissionRole = (typeof PERMISSION_ROLES)[number];
+
+export const PERMISSION_ROLE_LABELS: Record<PermissionRole, string> = {
+	READ: '只读',
+	EDIT: '编辑',
+	MANAGE: '管理',
+};

hub/admin-web/src/lib/format.ts

@@ -0,0 +1,46 @@
+import { ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS, type OrgRole, type PermissionRole } from './constants';
+
+export function fmtDate(iso: string): string {
+	if (!iso) return '—';
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return iso;
+	return d.toLocaleString(undefined, {
+		year: 'numeric',
+		month: 'short',
+		day: '2-digit',
+		hour: '2-digit',
+		minute: '2-digit',
+	});
+}
+
+export function fmtDateOnly(iso: string): string {
+	if (!iso) return '—';
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return iso;
+	return d.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: '2-digit' });
+}
+
+export function fmtCost(usd: number | null): string {
+	if (usd === null) return '—';
+	return `$${Number(usd).toFixed(4)}`;
+}
+
+export function fmtNum(n: number): string {
+	return n.toLocaleString();
+}
+
+export function orgRoleLabel(role: string): string {
+	const key = role.toUpperCase() as OrgRole;
+	return ORG_ROLE_LABELS[key] ?? role;
+}
+
+export function permissionRoleLabel(role: string): string {
+	const key = role.toUpperCase() as PermissionRole;
+	return PERMISSION_ROLE_LABELS[key] ?? role;
+}
+
+export function providerModeLabel(mode: string): string {
+	if (mode === 'BYOK') return '自带密钥';
+	if (mode === 'PLATFORM_MANAGED') return '平台托管';
+	return mode;
+}

hub/admin-web/src/lib/index.ts

@@ -0,0 +1 @@
+// place files you want to import through the `$lib` alias in this folder.

hub/admin-web/src/lib/session.ts

@@ -0,0 +1,43 @@
+import { writable } from 'svelte/store';
+import { api, type MeResponse } from './api';
+
+interface SessionState {
+	loading: boolean;
+	me: MeResponse | null;
+	error: string | null;
+}
+
+export const session = writable<SessionState>({
+	loading: true,
+	me: null,
+	error: null,
+});
+
+export async function loadSession(): Promise<void> {
+	session.update((s) => ({ ...s, loading: true, error: null }));
+	try {
+		const me = await api.me();
+		session.set({ loading: false, me, error: null });
+	} catch (err) {
+		const status = (err as { status?: number }).status;
+		if (status === 401) {
+			redirectToLogin();
+			return;
+		}
+		session.set({
+			loading: false,
+			me: null,
+			error: err instanceof Error ? err.message : String(err),
+		});
+	}
+}
+
+export function redirectToLogin(): void {
+	const ret = encodeURIComponent(window.location.pathname + window.location.hash);
+	window.location.href = `/auth/feishu?returnTo=${ret}`;
+}
+
+export async function logout(): Promise<void> {
+	await api.logout();
+	redirectToLogin();
+}

hub/admin-web/src/lib/toast.ts

@@ -0,0 +1,34 @@
+import { writable } from 'svelte/store';
+
+export type ToastKind = 'info' | 'success' | 'error';
+
+export interface ToastItem {
+	id: number;
+	message: string;
+	kind: ToastKind;
+}
+
+let seq = 0;
+export const toasts = writable<ToastItem[]>([]);
+
+export function pushToast(message: string, kind: ToastKind = 'info', ms = 3200): void {
+	const id = ++seq;
+	toasts.update((list) => [...list, { id, message, kind }]);
+	if (ms > 0) {
+		setTimeout(() => {
+			toasts.update((list) => list.filter((t) => t.id !== id));
+		}, ms);
+	}
+}
+
+export function dismissToast(id: number): void {
+	toasts.update((list) => list.filter((t) => t.id !== id));
+}
+
+export function toastSuccess(message: string): void {
+	pushToast(message, 'success');
+}
+
+export function toastError(message: string): void {
+	pushToast(message, 'error', 5000);
+}

hub/admin-web/src/routes/+layout.svelte

@@ -0,0 +1,389 @@
+<script lang="ts">
+	import '../routes/app.css';
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { page } from '$app/state';
+	import { session, loadSession, logout, redirectToLogin } from '$lib/session';
+	import type { OrgMembership } from '$lib/api';
+	import { orgRoleLabel } from '$lib/format';
+	import Icon from '$lib/components/Icon.svelte';
+	import ToastHost from '$lib/components/ToastHost.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+
+	let { children } = $props();
+	let mobileNavOpen = $state(false);
+	let redirecting = $state(false);
+
+	onMount(() => {
+		loadSession();
+	});
+
+	const navItems = [
+		{ key: 'overview', label: '概览', icon: 'overview' as const },
+		{ key: 'members', label: '成员', icon: 'members' as const },
+		{ key: 'teams', label: '团队', icon: 'teams' as const },
+		{ key: 'projects', label: '项目', icon: 'projects' as const },
+		{ key: 'capacity', label: '容量', icon: 'overview' as const },
+		{ key: 'provider', label: '供应方', icon: 'provider' as const },
+		{ key: 'feishu', label: '飞书', icon: 'feishu' as const },
+	];
+
+	function isAdmin(org: OrgMembership): boolean {
+		const role = String(org.role ?? '').toUpperCase();
+		return role === 'OWNER' || role === 'ADMIN';
+	}
+
+	function orgSlugFromPath(): string | null {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] === 'admin' && parts[1] === 'org' && parts[2]) {
+			return decodeURIComponent(parts[2]);
+		}
+		return null;
+	}
+
+	function isOnProjectRoute(): boolean {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
+	}
+
+	function memberships(): OrgMembership[] {
+		return $session.me?.organizations ?? [];
+	}
+
+	function adminOrgs(): OrgMembership[] {
+		return memberships().filter(isAdmin);
+	}
+
+	function currentOrg(): OrgMembership | null {
+		const slug = orgSlugFromPath();
+		if (!slug) return null;
+		return memberships().find((o) => o.slug === slug) ?? null;
+	}
+
+	function pickHomeOrg(): OrgMembership | null {
+		const admin = adminOrgs()[0];
+		if (admin) return admin;
+		return memberships()[0] ?? null;
+	}
+
+	function activeKey(): string {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] !== 'admin' || parts[1] !== 'org' || !parts[2]) return '';
+		return parts[3] ?? 'overview';
+	}
+
+	function navHref(key: string): string {
+		const slug = currentOrg()?.slug ?? pickHomeOrg()?.slug;
+		if (!slug) return '/';
+		if (key === 'overview') return `/admin/org/${slug}`;
+		return `/admin/org/${slug}/${key}`;
+	}
+
+	function pageTitle(): string {
+		const key = activeKey();
+		if (key === 'overview' || key === '') return '概览';
+		return navItems.find((i) => i.key === key)?.label ?? '管理后台';
+	}
+
+	function switchOrg(nextSlug: string) {
+		if (!nextSlug || nextSlug === currentOrg()?.slug) return;
+		void goto(`/admin/org/${nextSlug}`);
+	}
+
+	function handleLogout(e: Event) {
+		e.preventDefault();
+		logout();
+	}
+
+	function orgSelectItems(list: OrgMembership[]) {
+		return list.map((o) => ({
+			value: o.slug,
+			label: `${o.name} · ${orgRoleLabel(o.role)}`,
+		}));
+	}
+
+	$effect(() => {
+		page.url.pathname;
+		mobileNavOpen = false;
+	});
+
+	$effect(() => {
+		if ($session.loading || !$session.me) return;
+
+		const slug = orgSlugFromPath();
+		const matched = slug ? memberships().find((o) => o.slug === slug) : null;
+
+		// Org admins: route to their first admin org if none matched as admin.
+		const admins = adminOrgs();
+		if (matched && isAdmin(matched)) {
+			redirecting = false;
+			return;
+		}
+		if (!matched && admins.length > 0) {
+			const target = `/admin/org/${admins[0].slug}`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+			return;
+		}
+
+		// Members (non-admin): project pages are open to project MANAGE holders;
+		// the org overview and other admin-only surfaces are not for them.
+		if (matched && !isAdmin(matched)) {
+			redirecting = false;
+			const parts = page.url.pathname.split('/').filter(Boolean);
+			const onOverview = parts.length === 3; // /admin/org/:slug
+			if (onOverview) {
+				const target = `/admin/org/${matched.slug}/projects`;
+				if (page.url.pathname !== target) {
+					redirecting = true;
+					void goto(target, { replaceState: true });
+				}
+			}
+			return;
+		}
+
+		// No matched org and no admin orgs: route a member to their first org's
+		// projects page so they can reach project MANAGE surfaces.
+		if (!matched && memberships().length > 0) {
+			const home = memberships()[0];
+			const target = `/admin/org/${home.slug}/projects`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+		}
+	});
+</script>
+
+<ToastHost />
+
+{#if $session.loading || redirecting}
+	<div class="saas-status-panel">
+		<div class="flex flex-col items-center gap-3 text-surface-600">
+			<svg class="h-8 w-8 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+				<path
+					class="opacity-90"
+					fill="currentColor"
+					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+				></path>
+			</svg>
+			<p class="text-sm">{redirecting ? '正在进入组织…' : '正在加载会话…'}</p>
+		</div>
+	</div>
+{:else if $session.error}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<div
+				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-error-300 bg-error-100 text-error-700 font-bold"
+			>
+				!
+			</div>
+			<h2 class="mb-1 text-lg font-semibold">无法连接到后端</h2>
+			<p class="mb-5 text-sm text-surface-700">{$session.error}</p>
+			<button class="saas-btn-primary" onclick={() => loadSession()}>重试</button>
+		</div>
+	</div>
+{:else if !$session.me}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<div
+				class="mx-auto mb-5 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-white font-bold"
+			>
+				CPH
+			</div>
+			<h1 class="text-xl font-semibold">Curriculum Project Hub</h1>
+			<p class="mt-2 mb-6 text-sm text-surface-700">登录以管理组织、项目、团队与模型供应。</p>
+			<button class="saas-btn-primary w-full" onclick={() => redirectToLogin()}>使用飞书登录</button>
+		</div>
+	</div>
+{:else if currentOrg() && isAdmin(currentOrg()!)}
+	{@const org = currentOrg()!}
+	{@const me = $session.me!}
+	<div class="saas-shell">
+		{#if mobileNavOpen}
+			<button
+				type="button"
+				class="fixed inset-0 z-40 bg-surface-950/40 md:hidden"
+				aria-label="关闭导航"
+				onclick={() => (mobileNavOpen = false)}
+			></button>
+		{/if}
+
+		<aside
+			class="saas-sidebar fixed inset-y-0 left-0 z-50 transition-transform md:static md:translate-x-0
+				{mobileNavOpen ? 'translate-x-0' : '-translate-x-full md:translate-x-0'}"
+		>
+			<div class="flex items-center gap-2.5 px-4 py-4">
+				<div
+					class="flex h-9 w-9 items-center justify-center border border-primary-700 bg-primary-600 text-xs font-bold tracking-wide text-white"
+				>
+					CPH
+				</div>
+				<div class="min-w-0">
+					<div class="truncate text-sm font-semibold text-surface-900">组织后台</div>
+					<div class="truncate text-xs text-surface-600">Curriculum Hub</div>
+				</div>
+			</div>
+
+			<div class="px-3 pb-3">
+				<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
+					<Icon name="org" class="h-3.5 w-3.5" />
+					组织
+				</div>
+				<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
+			</div>
+
+			<nav class="flex-1 space-y-0.5 overflow-y-auto px-2 pb-3">
+				<p class="px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wider text-surface-600">工作台</p>
+				{#each navItems as item}
+					{@const active =
+						activeKey() === item.key || (item.key === 'overview' && (activeKey() === '' || activeKey() === 'overview'))}
+					<a href={navHref(item.key)} class="saas-nav-item" data-active={active ? 'true' : 'false'}>
+						<Icon name={item.icon} class="h-4 w-4 shrink-0 opacity-80" />
+						<span>{item.label}</span>
+					</a>
+				{/each}
+			</nav>
+
+			<div class="border-t border-surface-300 p-3">
+				<div class="flex items-center gap-2.5 border border-surface-300 bg-surface-100 px-2.5 py-2">
+					{#if me.user.avatarUrl}
+						<img src={me.user.avatarUrl} alt="" class="h-8 w-8 object-cover" />
+					{:else}
+						<div
+							class="flex h-8 w-8 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
+						>
+							{me.user.displayName.slice(0, 1)}
+						</div>
+					{/if}
+					<div class="min-w-0 flex-1">
+						<div class="truncate text-sm font-medium text-surface-900">{me.user.displayName}</div>
+						<div class="truncate text-[11px] text-surface-600">{orgRoleLabel(org.role)}</div>
+					</div>
+					<button
+						type="button"
+						class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
+						title="退出登录"
+						onclick={handleLogout}
+					>
+						<Icon name="logout" class="h-4 w-4" />
+					</button>
+				</div>
+			</div>
+		</aside>
+
+		<div class="saas-main">
+			<header class="saas-topbar">
+				<button
+					type="button"
+					class="saas-btn-ghost px-2! md:hidden"
+					onclick={() => (mobileNavOpen = !mobileNavOpen)}
+					aria-label="打开导航"
+				>
+					<Icon name="menu" class="h-5 w-5" />
+				</button>
+				<div class="min-w-0">
+					<div class="flex items-center gap-1.5 text-xs text-surface-600">
+						<span class="truncate">{org.name}</span>
+						<span>/</span>
+						<span class="truncate font-medium text-surface-900">{pageTitle()}</span>
+					</div>
+				</div>
+				<div class="ml-auto hidden items-center gap-2 sm:flex">
+					<span class="saas-badge-primary">{org.status}</span>
+					<span class="saas-badge-neutral font-mono">/{org.slug}</span>
+				</div>
+			</header>
+			<main class="saas-content">
+				<div class="saas-content-inner">
+					{@render children()}
+				</div>
+			</main>
+		</div>
+	</div>
+{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
+	{@const org = currentOrg()!}
+	{@const me = $session.me!}
+	<div class="saas-shell">
+		<div class="saas-main">
+			<header class="saas-topbar">
+				<a
+					href={`/admin/org/${org.slug}/projects`}
+					class="saas-btn-ghost px-2!"
+					aria-label="返回项目列表"
+				>
+					<Icon name="menu" class="h-5 w-5" />
+				</a>
+				<div class="min-w-0">
+					<div class="flex items-center gap-1.5 text-xs text-surface-600">
+						<span class="truncate">{org.name}</span>
+						<span>/</span>
+						<span class="truncate font-medium text-surface-900">项目</span>
+					</div>
+				</div>
+				<div class="ml-auto flex items-center gap-2">
+					<span class="saas-badge-neutral font-mono">/{org.slug}</span>
+					<button
+						type="button"
+						class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
+						title="退出登录"
+						onclick={handleLogout}
+					>
+						<Icon name="logout" class="h-4 w-4" />
+					</button>
+				</div>
+			</header>
+			<main class="saas-content">
+				<div class="saas-content-inner">
+					{@render children()}
+				</div>
+			</main>
+		</div>
+	</div>
+{:else if currentOrg() && !isAdmin(currentOrg()!)}
+	{@const denied = currentOrg()!}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">无权访问管理后台</h2>
+			<p class="mb-3 text-sm text-surface-700">
+				组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
+				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
+			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
+			{#if memberships().length > 1}
+				<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
+				<div class="mb-4">
+					<SelectField items={orgSelectItems(memberships())} value={denied.slug} onchange={switchOrg} />
+				</div>
+			{/if}
+			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{:else if memberships().length > 0}
+	{@const denied = pickHomeOrg()!}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
+			<p class="mb-5 text-sm text-surface-700">
+				即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
+			</p>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
+			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{:else}
+	<div class="saas-status-panel">
+		<div class="saas-status-card">
+			<h2 class="mb-2 text-lg font-semibold">未加入组织</h2>
+			<p class="mb-3 text-sm text-surface-700">飞书账号已登录，但当前账号尚未加入任何组织。</p>
+			<p class="mb-5 text-left text-xs text-surface-600">
+				open_id：
+				<code class="break-all font-mono text-surface-600">{$session.me!.user.feishuOpenId}</code>
+			</p>
+			<button class="saas-btn-primary" onclick={handleLogout}>退出登录</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/+page.svelte

@@ -0,0 +1,43 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { session, redirectToLogin } from '$lib/session';
+
+	function homeForSession(): string | null {
+		const me = $session.me;
+		if (!me) return null;
+		const admin = me.organizations.find((o) => {
+			const r = String(o.role ?? '').toUpperCase();
+			return r === 'OWNER' || r === 'ADMIN';
+		});
+		const target = admin ?? me.organizations[0];
+		return target ? `/admin/org/${target.slug}` : null;
+	}
+
+	onMount(() => {
+		const unsub = session.subscribe((s) => {
+			if (s.loading) return;
+			if (!s.me) {
+				redirectToLogin();
+				return;
+			}
+			const dest = homeForSession();
+			if (dest) void goto(dest, { replaceState: true });
+		});
+		return unsub;
+	});
+</script>
+
+<div class="saas-status-panel">
+	<div class="flex flex-col items-center gap-3 text-surface-600">
+		<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
+			<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+			<path
+				class="opacity-90"
+				fill="currentColor"
+				d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+			></path>
+		</svg>
+		<p class="text-sm">正在进入工作台…</p>
+	</div>
+</div>

hub/admin-web/src/routes/admin/org/[slug]/+page.svelte

@@ -0,0 +1,147 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type OrgMembership } from '$lib/api';
+	import { session } from '$lib/session';
+	import { fmtCost, fmtNum, orgRoleLabel } from '$lib/format';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import StatCard from '$lib/components/StatCard.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import SwitchControl from '$lib/components/SwitchControl.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	let orgSlug = $derived(page.params.slug ?? '');
+	let org = $derived($session.me?.organizations.find((o) => o.slug === orgSlug) as OrgMembership | undefined);
+
+	let settings = $state<{ membersCanCreateProjects: boolean } | null>(null);
+	let usage = $state<Awaited<ReturnType<typeof api.usage>> | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+	let saving = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			[settings, usage] = await Promise.all([api.settings(orgSlug), api.usage(orgSlug)]);
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function setMembersCanCreate(next: boolean) {
+		if (!settings || settings.membersCanCreateProjects === next) return;
+		saving = true;
+		const prev = settings.membersCanCreateProjects;
+		settings.membersCanCreateProjects = next;
+		try {
+			await api.setSettings(orgSlug, { membersCanCreateProjects: next });
+			toastSuccess(next ? '已允许成员自助建项' : '已关闭成员自助建项');
+		} catch (err) {
+			settings.membersCanCreateProjects = prev;
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (orgSlug) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if org && settings && usage}
+	<PageHeader title={org.name} description="组织健康度、用量与生产策略一览。" />
+
+	<div class="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+		<div class="saas-card-pad sm:col-span-2 lg:col-span-1">
+			<p class="saas-section-title mb-3">组织信息</p>
+			<dl class="space-y-2.5 text-sm">
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">Slug</dt>
+					<dd class="font-mono text-xs text-surface-800">/{org.slug}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">状态</dt>
+					<dd><span class="saas-badge-success">{org.status}</span></dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">你的角色</dt>
+					<dd><span class="saas-badge-primary">{orgRoleLabel(org.role)}</span></dd>
+				</div>
+			</dl>
+		</div>
+
+		<div class="saas-card-pad sm:col-span-2">
+			<p class="saas-section-title mb-1">项目自助创建策略</p>
+			<p class="saas-muted mb-4">开启后，普通老师可在飞书群自助创建项目；关闭后仅所有者与管理员可建。</p>
+			<div class="flex items-center gap-3 border border-surface-300 bg-surface-100 px-4 py-3">
+				<SwitchControl checked={settings.membersCanCreateProjects} disabled={saving} onchange={setMembersCanCreate} />
+				<div>
+					<div class="text-sm font-medium text-surface-900">允许成员自助创建项目</div>
+					<div class="text-xs text-surface-600">普通成员在飞书群中自助建项</div>
+				</div>
+			</div>
+		</div>
+	</div>
+
+	<div class="mb-4 flex items-end justify-between gap-3">
+		<div>
+			<h2 class="saas-section-title">用量概览</h2>
+			<p class="saas-muted">全组织智能体运行汇总</p>
+		</div>
+	</div>
+
+	<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
+		<StatCard label="运行总数" value={fmtNum(usage.totals.runCount)} />
+		<StatCard label="有成本运行" value={fmtNum(usage.totals.runsWithCost)} />
+		<StatCard label="无成本运行" value={fmtNum(usage.totals.runsWithoutCost)} />
+		<StatCard label="输入 tokens" value={fmtNum(usage.totals.inputTokens)} />
+		<StatCard label="输出 tokens" value={fmtNum(usage.totals.outputTokens)} />
+		<StatCard label="成本 (USD)" value={fmtCost(usage.totals.costUsd)} />
+	</div>
+
+	<div class="saas-card overflow-hidden">
+		<div class="border-b border-surface-200 px-5 py-3">
+			<h3 class="text-sm font-semibold text-surface-800">按项目用量</h3>
+		</div>
+		{#if usage.projects.length === 0}
+			<div class="saas-empty">
+				<p class="text-sm text-surface-600">暂无项目用量数据</p>
+			</div>
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>项目</th>
+							<th>运行</th>
+							<th>in / out tokens</th>
+							<th>成本</th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each usage.projects as p}
+							<tr>
+								<td class="font-medium">{p.projectName}</td>
+								<td class="tabular-nums">{fmtNum(p.runCount)}</td>
+								<td class="tabular-nums text-surface-600">{fmtNum(p.inputTokens)} / {fmtNum(p.outputTokens)}</td>
+								<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+	</div>
+{:else}
+	<div class="saas-empty">
+		<p class="text-sm text-surface-600">组织数据不可用</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/capacity/+page.svelte

@@ -0,0 +1,310 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type CapacityDimension, type CapacityDimensionRow, type CapacityPolicyView } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	// Friendlier, user-facing labels. No spec jargon (墙钟 → 运行时长, etc.).
+	const DIMENSION_LABELS: Record<CapacityDimension, string> = {
+		requestRate: '请求速率',
+		requestBodySize: '请求体大小',
+		agentConcurrency: '并发数',
+		admissionQueueLength: '队列长度',
+		admissionQueueWait: '队列等待',
+		fileSize: '单文件大小',
+		attachmentCount: '附件数',
+		archiveExpansion: '归档展开',
+		projectStorage: '项目存储',
+		organizationStorage: '组织存储',
+		memberCount: '成员数',
+		projectCount: '项目数',
+		teamCount: '团队数',
+		folderCount: '文件夹数',
+		sessionCount: '会话数',
+		runWallTime: '运行时长',
+		runTurns: '对话轮次',
+		runToolCalls: '工具调用数',
+		toolWallTime: '工具执行时长',
+		runOutputSize: '输出大小',
+		processMemory: '内存',
+		processCpu: 'CPU',
+		processCount: '进程数',
+	};
+
+	// Logical groupings for higher information density.
+	const GROUPS: { title: string; dims: CapacityDimension[] }[] = [
+		{ title: 'HTTP 接入', dims: ['requestRate', 'requestBodySize'] },
+		{ title: '智能体运行', dims: ['agentConcurrency', 'runWallTime', 'runTurns', 'runToolCalls', 'toolWallTime', 'runOutputSize'] },
+		{ title: '接纳队列', dims: ['admissionQueueLength', 'admissionQueueWait'] },
+		{ title: '附件与存储', dims: ['fileSize', 'attachmentCount', 'archiveExpansion', 'projectStorage', 'organizationStorage'] },
+		{ title: '组织配额', dims: ['memberCount', 'projectCount', 'teamCount', 'folderCount', 'sessionCount'] },
+		{ title: '进程资源', dims: ['processMemory', 'processCpu', 'processCount'] },
+	];
+
+	let view = $state<CapacityPolicyView | null>(null);
+	let drafts = $state<Partial<Record<CapacityDimension, string | number>>>({});
+	let loading = $state(true);
+	let saving = $state(false);
+	let error = $state<string | null>(null);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			view = await api.capacityPolicy(slug);
+			drafts = {};
+			for (const row of view.dimensions) {
+				drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function draftText(dim: CapacityDimension): string {
+		const raw = drafts[dim];
+		if (raw === undefined || raw === null) return '';
+		return String(raw).trim();
+	}
+
+	// Inline validation: surfaced as the user edits, not on submit. Returns null
+	// when the draft is empty (means "use platform ceiling") or valid.
+	function draftError(row: CapacityDimensionRow): string | null {
+		const text = draftText(row.dimension);
+		if (text === '') return null;
+		const n = Number.parseInt(text, 10);
+		if (!Number.isFinite(n) || n < 1) return '需为正整数';
+		if (row.platformCeiling !== null && n > row.platformCeiling) return `不得超过 ${row.platformCeiling}`;
+		return null;
+	}
+
+	// Live effective value: min(platform ceiling, draft). Reflects the draft
+	// before save so the user sees the outcome as they type.
+	function liveEffective(row: CapacityDimensionRow): number | null {
+		if (row.platformCeiling === null) return null;
+		const text = draftText(row.dimension);
+		if (text === '') return row.platformCeiling;
+		const n = Number.parseInt(text, 10);
+		if (!Number.isFinite(n) || n < 1) return row.platformCeiling;
+		return Math.min(row.platformCeiling, n);
+	}
+
+	function isLowered(row: CapacityDimensionRow): boolean {
+		const eff = liveEffective(row);
+		return eff !== null && eff < row.platformCeiling!;
+	}
+
+	const hasErrors = $derived(
+		view?.dimensions.some((row) => draftError(row) !== null) ?? false,
+	);
+
+	async function save() {
+		if (!view || hasErrors) return;
+		saving = true;
+		const limits: Partial<Record<CapacityDimension, number | null>> = {};
+		for (const row of view.dimensions) {
+			const text = draftText(row.dimension);
+			limits[row.dimension] = text === '' ? null : Number.parseInt(text, 10);
+		}
+		try {
+			view = await api.setCapacityPolicy(slug, { limits });
+			drafts = {};
+			for (const row of view.dimensions) {
+				drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
+			}
+			toastSuccess('容量策略已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="容量策略"
+	description="平台上限不可突破。组织可在此设更低限制，未设置时按平台上限执行。"
+>
+	{#snippet actions()}
+		<button class="saas-btn-primary" disabled={saving || !view || hasErrors} onclick={save}>
+			{saving ? '保存中…' : '保存'}
+		</button>
+	{/snippet}
+</PageHeader>
+
+<p class="saas-muted mb-6">
+	未配置平台上限的维度暂不可设置组织限制。输入框留空即沿用平台上限。
+</p>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if view}
+	{#if view.dimensions.length === 0}
+		<EmptyState title="暂无容量维度" description="容量维度由平台定义。" />
+	{:else}
+		{@const policy = view}
+		<div class="grid gap-4 md:grid-cols-2">
+			{#each GROUPS as group}
+				{@const rows = group.dims
+					.map((d) => policy.dimensions.find((r) => r.dimension === d))
+					.filter((r): r is CapacityDimensionRow => r !== undefined)}
+				{#if rows.length > 0}
+					<section class="saas-card">
+						<header class="group-header">
+							<h3 class="group-title">{group.title}</h3>
+							<span class="group-count">{rows.length} 项</span>
+						</header>
+						<div class="dim-list">
+							{#each rows as row (row.dimension)}
+								{@const err = draftError(row)}
+								{@const eff = liveEffective(row)}
+								{@const lowered = isLowered(row)}
+								{@const disabled = row.platformCeiling === null}
+								<div class="dim-row" class:dim-row-error={err !== null}>
+									<div class="dim-label">{DIMENSION_LABELS[row.dimension] ?? row.dimension}</div>
+									<div class="dim-ceiling">
+										{#if disabled}
+											<span class="text-surface-400">未配置</span>
+										{:else}
+											<span class="tabular-nums">平台 ≤ {row.platformCeiling}</span>
+										{/if}
+									</div>
+									<input
+										class="saas-input dim-input"
+										type="number"
+										placeholder="用平台值"
+										disabled={disabled}
+										bind:value={drafts[row.dimension]}
+									/>
+									<div class="dim-effective">
+										{#if eff === null}
+											<span class="text-surface-400">—</span>
+										{:else if lowered}
+											<span class="saas-badge saas-badge-primary tabular-nums">有效 {eff}</span>
+										{:else}
+											<span class="saas-badge saas-badge-neutral tabular-nums">有效 {eff}</span>
+										{/if}
+									</div>
+									{#if err !== null}
+										<div class="dim-error">{err}</div>
+									{/if}
+								</div>
+							{/each}
+						</div>
+					</section>
+				{/if}
+			{/each}
+		</div>
+	{/if}
+{:else}
+	<EmptyState title="容量数据不可用" description="无法加载容量策略。" />
+{/if}
+
+<style>
+	.group-header {
+		display: flex;
+		align-items: baseline;
+		justify-content: space-between;
+		padding: 0.5rem 0.75rem;
+		border-bottom: 1px solid var(--color-surface-200);
+		background: var(--color-surface-100);
+	}
+	.group-title {
+		font-size: 0.8125rem;
+		font-weight: 600;
+		color: var(--color-surface-800);
+		letter-spacing: 0.02em;
+	}
+	.group-count {
+		font-size: 0.6875rem;
+		color: var(--color-surface-500);
+	}
+	.dim-list {
+		display: flex;
+		flex-direction: column;
+	}
+	.dim-row {
+		display: grid;
+		grid-template-columns: minmax(5rem, 1fr) auto minmax(7rem, 8.5rem) 6.5rem;
+		align-items: center;
+		gap: 0.5rem;
+		padding: 0.4rem 0.75rem;
+		border-bottom: 1px solid var(--color-surface-100);
+	}
+	.dim-row:last-child {
+		border-bottom: none;
+	}
+	.dim-row-error {
+		background: color-mix(in oklab, var(--color-error-100) 40%, transparent);
+	}
+	.dim-label {
+		font-size: 0.8125rem;
+		font-weight: 500;
+		color: var(--color-surface-900);
+		white-space: nowrap;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+	.dim-ceiling {
+		font-size: 0.6875rem;
+		color: var(--color-surface-500);
+		white-space: nowrap;
+	}
+	.dim-input {
+		padding: 0.25rem 0.5rem;
+		font-size: 0.8125rem;
+		text-align: right;
+	}
+	.dim-effective {
+		display: flex;
+		justify-content: flex-end;
+	}
+	.dim-effective > .saas-badge {
+		width: 100%;
+		justify-content: center;
+	}
+	.dim-error {
+		grid-column: 1 / -1;
+		font-size: 0.6875rem;
+		color: var(--color-error-700);
+		padding-bottom: 0.2rem;
+	}
+	@media (max-width: 480px) {
+		.dim-row {
+			grid-template-columns: 1fr 5rem;
+			grid-template-rows: auto auto auto;
+			row-gap: 0.25rem;
+		}
+		.dim-label {
+			grid-column: 1;
+		}
+		.dim-ceiling {
+			grid-column: 2;
+			text-align: right;
+		}
+		.dim-input {
+			grid-column: 1 / -1;
+		}
+		.dim-effective {
+			grid-column: 1 / -1;
+			justify-content: flex-start;
+		}
+		.dim-effective > .saas-badge {
+			width: auto;
+			justify-content: flex-start;
+		}
+	}
+</style>

hub/admin-web/src/routes/admin/org/[slug]/feishu/+page.svelte

@@ -0,0 +1,176 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type FeishuApplicationConnection } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { Label } from 'bits-ui';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let connection = $state<FeishuApplicationConnection | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let appId = $state('');
+	let appSecret = $state('');
+	let botOpenId = $state('');
+	let verificationToken = $state('');
+	let encryptKey = $state('');
+	let saving = $state(false);
+	let disabling = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.feishuApplication(slug);
+			connection = res.connection;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function resetForm() {
+		appId = '';
+		appSecret = '';
+		botOpenId = '';
+		verificationToken = '';
+		encryptKey = '';
+	}
+
+	async function save() {
+		const id = appId.trim();
+		const secret = appSecret.trim();
+		const bot = botOpenId.trim();
+		if (id === '' || secret === '' || bot === '') {
+			toastError('App ID、App Secret、Bot Open ID 均为必填');
+			return;
+		}
+		saving = true;
+		const body: {
+			appId: string;
+			appSecret: string;
+			botOpenId: string;
+			verificationToken?: string;
+			encryptKey?: string;
+		} = { appId: id, appSecret: secret, botOpenId: bot };
+		const vt = verificationToken.trim();
+		if (vt !== '') body.verificationToken = vt;
+		const ek = encryptKey.trim();
+		if (ek !== '') body.encryptKey = ek;
+		try {
+			connection = await api.rotateFeishuApplication(slug, body);
+			resetForm();
+			toastSuccess('飞书应用凭据已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	async function disable() {
+		if (!connection) return;
+		if (!confirm('停用后该组织将无法收发飞书消息，确定停用？')) return;
+		disabling = true;
+		try {
+			connection = await api.disableFeishuApplication(slug);
+			toastSuccess('已停用飞书应用连接');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			disabling = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="飞书应用"
+	description="本组织绑定的飞书应用凭据（ADR-0021：组织与应用 1:1）。凭据按组织隔离、版本化信封存储，缺失或校验失败即 fail-closed。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	{#if connection}
+		<div class="saas-card-pad mb-6">
+			<p class="saas-section-title mb-3">当前连接</p>
+			<dl class="space-y-2.5 text-sm">
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">状态</dt>
+					<dd><span class="saas-badge-success">{connection.status}</span></dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">App 指纹</dt>
+					<dd class="font-mono text-xs text-surface-800">{connection.appFingerprint}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">版本</dt>
+					<dd class="tabular-nums">{connection.activeVersion ?? '—'}</dd>
+				</div>
+				<div class="flex items-center justify-between gap-3">
+					<dt class="text-surface-700">更新于</dt>
+					<dd class="text-surface-600">{fmtDate(connection.updatedAt)}</dd>
+				</div>
+			</dl>
+			{#if connection.status !== 'DISABLED'}
+				<div class="mt-5 flex items-center justify-end gap-3 border-t border-surface-100 pt-4">
+					<button class="saas-btn-ghost" onclick={disable} disabled={disabling}>
+						{disabling ? '停用中…' : '停用连接'}
+					</button>
+				</div>
+			{/if}
+		</div>
+	{:else}
+		<div class="saas-card-pad mb-6">
+			<p class="text-sm text-surface-700">本组织尚未绑定飞书应用。填写下方凭据以创建连接。</p>
+		</div>
+	{/if}
+
+	<div class="saas-card-pad">
+		<h3 class="saas-section-title mb-1">{connection ? '轮换凭据' : '创建连接'}</h3>
+		<p class="saas-muted mb-4">
+			密钥仅写入新版本，旧版本归档。{#if connection}App ID 不可变更，须与现有应用一致。{/if}
+		</p>
+		<div class="grid gap-5">
+			<div>
+				<Label.Root class="saas-label" for="app-id">App ID</Label.Root>
+				<input id="app-id" class="saas-input font-mono text-sm" bind:value={appId} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="app-secret">App Secret</Label.Root>
+				<input id="app-secret" class="saas-input" type="password" bind:value={appSecret} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="bot-open-id">Bot Open ID</Label.Root>
+				<input id="bot-open-id" class="saas-input font-mono text-sm" bind:value={botOpenId} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="verification-token">Verification Token（可选）</Label.Root>
+				<input id="verification-token" class="saas-input" type="password" bind:value={verificationToken} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="encrypt-key">Encrypt Key（可选）</Label.Root>
+				<input id="encrypt-key" class="saas-input" type="password" bind:value={encryptKey} />
+			</div>
+		</div>
+		<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
+			<div class="flex-1"></div>
+			<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
+			<button class="saas-btn-primary" onclick={save} disabled={saving}>
+				{saving ? '保存中…' : '保存'}
+			</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/members/+page.svelte

@@ -0,0 +1,164 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type OrgMember } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { ORG_ROLES, ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS } from '$lib/constants';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const roleItems = ORG_ROLES.map((r) => ({ value: r, label: ORG_ROLE_LABELS[r] }));
+	const permHint = Object.values(PERMISSION_ROLE_LABELS).join(' / ');
+
+	let members = $state<OrgMember[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newOpenId = $state('');
+	let newName = $state('');
+	let newRole = $state<string>('MEMBER');
+	let adding = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.members(slug);
+			members = res.members;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function addMember() {
+		if (!newOpenId.trim()) return;
+		adding = true;
+		try {
+			const m = await api.addMember(slug, {
+				feishuOpenId: newOpenId.trim(),
+				role: newRole,
+				...(newName.trim() ? { displayName: newName.trim() } : {}),
+			});
+			members = [...members, m].sort((a, b) => a.role.localeCompare(b.role) || a.createdAt.localeCompare(b.createdAt));
+			newOpenId = '';
+			newName = '';
+			toastSuccess('成员已添加');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	async function changeRole(m: OrgMember, role: string) {
+		try {
+			await api.setMemberRole(slug, m.userId, role);
+			await load();
+			toastSuccess('角色已更新');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revoke(m: OrgMember) {
+		if (!confirm(`移除成员 ${m.displayName} 出本组织?`)) return;
+		try {
+			await api.revokeMember(slug, m.userId);
+			await load();
+			toastSuccess('成员已移除');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader title="成员与权限" description="管理组织角色：所有者与管理员可访问本后台，成员不可。" />
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">添加成员</h2>
+		<div class="grid gap-3 md:grid-cols-[1.2fr_1fr_12rem_auto]">
+			<input class="saas-input" placeholder="飞书 open_id" bind:value={newOpenId} />
+			<input class="saas-input" placeholder="显示名（可选）" bind:value={newName} />
+			<SelectField items={roleItems} bind:value={newRole} />
+			<button class="saas-btn-primary" onclick={addMember} disabled={adding}>
+				{adding ? '添加中…' : '添加成员'}
+			</button>
+		</div>
+	</div>
+
+	<div class="saas-card overflow-hidden">
+		<div class="flex items-center justify-between border-b border-surface-200 px-5 py-3">
+			<h2 class="text-sm font-semibold">成员列表</h2>
+			<span class="saas-badge-neutral">{members.length}</span>
+		</div>
+		{#if members.length === 0}
+			<EmptyState title="暂无成员" description="使用上方表单按飞书 open_id 添加成员。" />
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>用户</th>
+							<th>open_id</th>
+							<th>组织角色</th>
+							<th>加入时间</th>
+							<th></th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each members as m}
+							<tr>
+								<td>
+									<div class="flex items-center gap-2.5">
+										{#if m.avatarUrl}
+											<img src={m.avatarUrl} alt="" class="h-7 w-7 border border-surface-300 object-cover" />
+										{:else}
+											<div
+												class="flex h-7 w-7 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
+											>
+												{m.displayName.slice(0, 1)}
+											</div>
+										{/if}
+										<span class="font-medium">{m.displayName}</span>
+									</div>
+								</td>
+								<td class="font-mono text-xs text-surface-700">{m.feishuOpenId}</td>
+								<td class="min-w-36">
+									<SelectField
+										items={roleItems}
+										value={m.role}
+										onchange={(role) => {
+											if (role !== m.role) changeRole(m, role);
+										}}
+									/>
+								</td>
+								<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
+								<td class="text-right">
+									<button class="saas-btn-danger py-1! text-sm" onclick={() => revoke(m)}>移除</button>
+								</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+		<p class="border-t border-surface-300 px-5 py-3 text-xs text-surface-600">
+			组织角色控制后台访问；项目级权限由「项目」页团队授权（{permHint}）决定。
+		</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/projects/+page.svelte

@@ -0,0 +1,205 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type ExplorerData, type ExplorerFolder, type ExplorerProject, type OrgMembership } from '$lib/api';
+	import { session } from '$lib/session';
+	import FolderTree from '$lib/components/FolderTree.svelte';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { Label } from 'bits-ui';
+	import Modal from '$lib/components/Modal.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { fmtDate } from '$lib/format';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(
+		($session.me?.organizations.find((o) => o.slug === slug) as OrgMembership | undefined) ?? null,
+	);
+	const isAdmin = $derived(!!org && (org.role === 'OWNER' || org.role === 'ADMIN'));
+
+	let data = $state<ExplorerData | null>(null);
+	let myProjects = $state<ExplorerProject[] | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let showFolderModal = $state(false);
+	let folderName = $state('');
+	let folderParent = $state('');
+
+	let showProjectModal = $state(false);
+	let projectName = $state('');
+	let projectFolder = $state('');
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			if (isAdmin) {
+				data = await api.explorer(slug);
+				myProjects = null;
+			} else {
+				myProjects = (await api.myProjects(slug)).projects;
+				data = null;
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function createFolder() {
+		if (!folderName.trim()) return;
+		try {
+			await api.createFolder(slug, {
+				name: folderName.trim(),
+				...(folderParent ? { parentId: folderParent } : {}),
+			});
+			folderName = '';
+			folderParent = '';
+			showFolderModal = false;
+			await load();
+			toastSuccess('文件夹已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function createProject() {
+		if (!projectName.trim()) return;
+		try {
+			const res = await api.createProject(slug, {
+				name: projectName.trim(),
+				...(projectFolder ? { folderId: projectFolder } : {}),
+			});
+			projectName = '';
+			projectFolder = '';
+			showProjectModal = false;
+			window.location.href = `/admin/org/${slug}/projects/${res.id}`;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	function folderPath(f: ExplorerFolder): string {
+		if (!data) return f.name;
+		const parts: string[] = [f.name];
+		let cur: ExplorerFolder | undefined = f;
+		while (cur?.parentId) {
+			const parent = data.folders.find((x) => x.id === cur!.parentId);
+			if (!parent) break;
+			parts.unshift(parent.name);
+			cur = parent;
+		}
+		return parts.join(' / ');
+	}
+
+	function folderItems() {
+		if (!data) return [{ value: '', label: '（根）' }];
+		return [{ value: '', label: '（根）' }, ...data.folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
+	}
+
+	$effect(() => {
+		if (slug && org) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if isAdmin && data}
+	<PageHeader title="项目" description="文件夹是透明组织节点；项目是权限边界。">
+		{#snippet actions()}
+			<button class="saas-btn-secondary" onclick={() => (showFolderModal = true)}>新建文件夹</button>
+			<button class="saas-btn-primary" onclick={() => (showProjectModal = true)}>新建项目</button>
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card p-2 sm:p-3">
+		{#if data.projects.filter((p) => !p.folderId).length === 0 && data.folders.filter((f) => !f.parentId).length === 0}
+			<EmptyState title="暂无项目" description="新建文件夹或项目，开始组织你的教研资产。" />
+		{:else}
+			<FolderTree folders={data.folders} projects={data.projects} parentId={null} {slug} />
+		{/if}
+	</div>
+
+	<Modal bind:open={showFolderModal} title="新建文件夹">
+		<Label.Root class="saas-label" for="folder-name">名称</Label.Root>
+		<input
+			id="folder-name"
+			class="saas-input mb-4"
+			bind:value={folderName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') createFolder();
+			}}
+		/>
+		{#if data && data.folders.length > 0}
+			<p class="saas-label">父文件夹（可选）</p>
+			<div class="mb-4">
+				<SelectField items={folderItems()} bind:value={folderParent} />
+			</div>
+		{/if}
+		<div class="flex justify-end gap-2">
+			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
+			<button class="saas-btn-primary" onclick={createFolder}>创建</button>
+		</div>
+	</Modal>
+
+	<Modal bind:open={showProjectModal} title="新建项目">
+		<Label.Root class="saas-label" for="project-name">项目名</Label.Root>
+		<input
+			id="project-name"
+			class="saas-input mb-4"
+			bind:value={projectName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') createProject();
+			}}
+		/>
+		{#if data && data.folders.length > 0}
+			<p class="saas-label">文件夹（可选）</p>
+			<div class="mb-4">
+				<SelectField items={folderItems()} bind:value={projectFolder} />
+			</div>
+		{/if}
+		<div class="flex justify-end gap-2">
+			<button class="saas-btn-ghost" onclick={() => (showProjectModal = false)}>取消</button>
+			<button class="saas-btn-primary" onclick={createProject}>创建</button>
+		</div>
+	</Modal>
+{:else if myProjects !== null}
+	<PageHeader title="我的项目" description="你拥有访问授权的项目。">
+		{#snippet actions()}
+			<span class="saas-badge-neutral">仅显示已授权项目</span>
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card overflow-hidden">
+		{#if myProjects.length === 0}
+			<EmptyState title="暂无可访问项目" description="当团队被授予项目访问权限时，项目会出现在这里。" />
+		{:else}
+			<table class="data-table">
+				<thead>
+					<tr>
+						<th>项目</th>
+						<th>飞书群</th>
+						<th>创建时间</th>
+					</tr>
+				</thead>
+				<tbody>
+					{#each myProjects as p}
+						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/org/${slug}/projects/${p.id}`)}>
+							<td class="font-medium">{p.name}</td>
+							<td class="font-mono text-xs">{p.binding ? `群 ${p.binding.chatId}` : '—'}</td>
+							<td class="text-surface-700">{fmtDate(p.createdAt)}</td>
+						</tr>
+					{/each}
+				</tbody>
+			</table>
+		{/if}
+	</div>
+{:else}
+	<EmptyState title="项目数据不可用" description="无法加载项目列表。" />
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/projects/[projectId]/+page.svelte

@@ -0,0 +1,304 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import {
+		api,
+		type ProjectDetail,
+		type TeamAccessEntry,
+		type TeamRow,
+		type SessionSummary,
+		type ExplorerData,
+	} from '$lib/api';
+	import { fmtDate, permissionRoleLabel } from '$lib/format';
+	import { PERMISSION_ROLES, PERMISSION_ROLE_LABELS } from '$lib/constants';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+	const projectId = $derived(page.params.projectId ?? '');
+	const roleItems = PERMISSION_ROLES.map((r) => ({ value: r, label: PERMISSION_ROLE_LABELS[r] }));
+	const roleChain = `${PERMISSION_ROLE_LABELS.READ} ⊂ ${PERMISSION_ROLE_LABELS.EDIT} ⊂ ${PERMISSION_ROLE_LABELS.MANAGE}`;
+
+	let proj = $state<ProjectDetail | null>(null);
+	let access = $state<TeamAccessEntry[]>([]);
+	let sessions = $state<SessionSummary[]>([]);
+	let teams = $state<TeamRow[]>([]);
+	let explorer = $state<ExplorerData | null>(null);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let grantTeam = $state('');
+	let grantRole = $state<string>('EDIT');
+	let moveFolder = $state('');
+
+	const actorIsOrgAdmin = $derived(proj?.actorIsOrgAdmin ?? false);
+	const actorCanManage = $derived(proj?.actorCanManageProject ?? false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			// Project detail + team-access list are gated to project read/oversight.
+			const [p, a] = await Promise.all([api.project(slug, projectId), api.teamAccess(slug, projectId)]);
+			proj = p;
+			access = a.access;
+			// Team list is needed for grant UI whenever the actor has project MANAGE
+			// (org admin or member). Sessions/explorer stay org-admin oversight only.
+			const needTeams = p.actorIsOrgAdmin === true || p.actorCanManageProject === true;
+			const [s, t, e] = await Promise.all([
+				p.actorIsOrgAdmin ? api.sessions(slug, projectId) : Promise.resolve({ sessions: [] as SessionSummary[] }),
+				needTeams ? api.teams(slug) : Promise.resolve({ teams: [] as TeamRow[] }),
+				p.actorIsOrgAdmin ? api.explorer(slug) : Promise.resolve(null as ExplorerData | null),
+			]);
+			sessions = s.sessions;
+			teams = t.teams;
+			explorer = e;
+			if (p.actorIsOrgAdmin) {
+				moveFolder = p.folderId ?? '';
+			}
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function rename() {
+		if (!proj) return;
+		const name = prompt('新名称', proj.name);
+		if (!name) return;
+		try {
+			await api.renameProject(slug, projectId, name);
+			await load();
+			toastSuccess('已重命名');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function archiveBinding() {
+		if (!confirm('解绑当前飞书群? 用户将无法通过该群触发智能体。')) return;
+		try {
+			await api.archiveBinding(slug, projectId);
+			await load();
+			toastSuccess('已解绑飞书群');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function archiveProject() {
+		if (!confirm(`归档项目 ${proj?.name}?`)) return;
+		try {
+			await api.archiveProject(slug, projectId);
+			window.location.href = `/admin/org/${slug}/projects`;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function move() {
+		try {
+			await api.moveProject(slug, projectId, moveFolder || null);
+			await load();
+			toastSuccess('已移动');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function grant() {
+		if (!grantTeam) return;
+		try {
+			await api.grantTeamAccess(slug, projectId, { teamId: grantTeam, role: grantRole });
+			grantTeam = '';
+			await load();
+			toastSuccess('已授权');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revoke(t: TeamAccessEntry) {
+		if (!confirm(`撤销 ${t.teamName} 对此项目的授权?`)) return;
+		try {
+			await api.revokeTeamAccess(slug, projectId, t.teamId);
+			await load();
+			toastSuccess('已撤销授权');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	function folderItems() {
+		const items = [{ value: '', label: '（根）' }];
+		if (!explorer) return items;
+		return [...items, ...explorer.folders.map((f) => ({ value: f.id, label: f.name }))];
+	}
+
+	function teamItems() {
+		return [{ value: '', label: '选择团队…' }, ...teams.map((t) => ({ value: t.id, label: `${t.name}（${t.slug}）` }))];
+	}
+
+	$effect(() => {
+		if (slug && projectId) load();
+	});
+</script>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else if proj}
+	<div class="mb-2">
+		<a
+			href={`/admin/org/${slug}/projects`}
+			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-600"
+		>
+			← 返回项目列表
+		</a>
+	</div>
+
+	{@const detail = proj}
+	<PageHeader title={detail.name} description={`项目是权限边界；通过团队授予 ${roleChain}。`}>
+		{#snippet actions()}
+			{#if actorIsOrgAdmin}
+				<button class="saas-btn-secondary py-1.5! text-sm" onclick={rename}>重命名</button>
+				{#if detail.binding}
+					<button class="saas-btn-secondary py-1.5! text-sm" onclick={archiveBinding}>解绑飞书群</button>
+				{/if}
+				<button class="saas-btn-danger py-1.5! text-sm" onclick={archiveProject}>归档</button>
+			{/if}
+		{/snippet}
+	</PageHeader>
+
+	<div class="saas-card-pad mb-6">
+		<dl class="grid gap-x-8 gap-y-3 text-sm sm:grid-cols-2">
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">工作区路径</dt>
+				<dd class="mt-0.5 break-all font-mono text-xs text-surface-700">{proj.workspaceDir}</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建者</dt>
+				<dd class="mt-0.5 text-surface-800">
+					{proj.createdBy ? `${proj.createdBy.displayName} (${proj.createdBy.feishuOpenId})` : '—'}
+				</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">文件夹</dt>
+				<dd class="mt-0.5 text-surface-800">{proj.folder ? proj.folder.name : '（根）'}</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">飞书群</dt>
+				<dd class="mt-0.5 text-surface-800">
+					{#if proj.binding}
+						<span class="saas-badge-success mr-1">已绑定</span>
+						<span class="font-mono text-xs">群 {proj.binding.chatId}</span>
+						<span class="text-surface-600"> · {fmtDate(proj.binding.createdAt)}</span>
+					{:else}
+						<span class="saas-badge-neutral">未绑定</span>
+					{/if}
+				</dd>
+			</div>
+			<div>
+				<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建时间</dt>
+				<dd class="mt-0.5 text-surface-800">{fmtDate(proj.createdAt)}</dd>
+			</div>
+		</dl>
+
+		{#if explorer}
+			<div class="mt-5 flex flex-wrap items-end gap-2 border-t border-surface-100 pt-4">
+				<div class="min-w-48 flex-1">
+					<p class="saas-label">移动到文件夹</p>
+					<SelectField items={folderItems()} bind:value={moveFolder} />
+				</div>
+				<button class="saas-btn-secondary" onclick={move}>移动</button>
+			</div>
+		{/if}
+	</div>
+
+	<div class="saas-card-pad mb-6">
+		<h3 class="saas-section-title mb-1">团队授权</h3>
+		<p class="saas-muted mb-4">通过团队授权项目访问。一项目可授多团队，一团队可访问多项目。</p>
+
+		{#if actorCanManage}
+			<div class="mb-4 grid gap-2 sm:grid-cols-[1fr_10rem_auto]">
+				<SelectField items={teamItems()} bind:value={grantTeam} />
+				<SelectField items={roleItems} bind:value={grantRole} />
+				<button class="saas-btn-primary" onclick={grant}>授权</button>
+			</div>
+		{:else}
+			<p class="mb-4 text-xs text-surface-600">需要项目 MANAGE 授权才能增删团队访问。</p>
+		{/if}
+
+		{#if access.length === 0}
+			<EmptyState title="暂无团队授权" description="选择团队并授予角色以开放项目访问。" />
+		{:else}
+			<table class="data-table">
+				<thead>
+					<tr>
+						<th>团队</th>
+						<th>标识</th>
+						<th>角色</th>
+						<th></th>
+					</tr>
+				</thead>
+				<tbody>
+					{#each access as g}
+						<tr>
+							<td class="font-medium">{g.teamName}</td>
+							<td class="font-mono text-xs">/{g.teamSlug}</td>
+							<td><span class="saas-badge-primary">{permissionRoleLabel(g.role)}</span></td>
+							<td class="text-right">
+								{#if actorCanManage}
+									<button class="saas-btn-danger py-1! text-xs" onclick={() => revoke(g)}>撤销</button>
+								{:else}
+									<span class="text-xs text-surface-500">—</span>
+								{/if}
+							</td>
+						</tr>
+					{/each}
+				</tbody>
+			</table>
+		{/if}
+	</div>
+
+	{#if actorIsOrgAdmin}
+		<div class="saas-card overflow-hidden">
+			<div class="border-b border-surface-200 px-5 py-3">
+				<h3 class="text-sm font-semibold">智能体会话</h3>
+			</div>
+			{#if sessions.length === 0}
+				<EmptyState title="暂无会话" description="飞书侧触发智能体后会显示在此。" />
+			{:else}
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>供应方 / 角色</th>
+							<th>模型</th>
+							<th>运行次数</th>
+							<th>更新</th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each sessions as s}
+							<tr>
+								<td class="font-mono text-xs">{s.provider} / {s.roleId}</td>
+								<td class="font-mono text-xs">{s.model}</td>
+								<td class="tabular-nums">{s.runCount}</td>
+								<td class="text-surface-700">{fmtDate(s.updatedAt)}</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			{/if}
+		</div>
+	{/if}
+{:else}
+	<div class="saas-empty">
+		<p class="text-sm text-surface-600">项目数据不可用</p>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/provider/+page.svelte

@@ -0,0 +1,169 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type ProviderConnectionRow } from '$lib/api';
+	import { fmtDate, providerModeLabel } from '$lib/format';
+	import { Label } from 'bits-ui';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let connections = $state<ProviderConnectionRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let providerId = $state('');
+	let baseUrl = $state('');
+	let authToken = $state('');
+	let anthropicApiKey = $state('');
+	let saving = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.providerConnections(slug);
+			connections = res.connections;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	function startRotate(row: ProviderConnectionRow) {
+		providerId = row.providerId;
+		baseUrl = '';
+		authToken = '';
+		anthropicApiKey = '';
+	}
+
+	function resetForm() {
+		providerId = '';
+		baseUrl = '';
+		authToken = '';
+		anthropicApiKey = '';
+	}
+
+	async function save() {
+		const id = providerId.trim();
+		if (id === '') {
+			toastError('请填写供应方 ID');
+			return;
+		}
+		const url = baseUrl.trim();
+		const token = authToken.trim();
+		if (url === '' || token === '') {
+			toastError('接口地址与访问令牌均为必填');
+			return;
+		}
+		saving = true;
+		const body: { baseUrl: string; authToken: string; anthropicApiKey?: string } = {
+			baseUrl: url,
+			authToken: token,
+		};
+		const key = anthropicApiKey.trim();
+		if (key !== '') body.anthropicApiKey = key;
+		try {
+			await api.rotateProviderConnection(slug, id, body);
+			toastSuccess('凭据已轮换');
+			resetForm();
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="模型供应方"
+	description="本组织的模型供应方连接。BYOK 由组织所有者/管理员轮换；平台托管连接由平台管理员配置。凭据按组织隔离，缺失或校验失败即拒绝运行（fail-closed）。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card overflow-hidden mb-6">
+		<div class="border-b border-surface-200 px-5 py-3">
+			<h3 class="text-sm font-semibold text-surface-800">连接</h3>
+		</div>
+		{#if connections.length === 0}
+			<div class="saas-empty"><p class="text-sm text-surface-600">尚无供应方连接</p></div>
+		{:else}
+			<div class="overflow-x-auto">
+				<table class="data-table">
+					<thead>
+						<tr>
+							<th>供应方</th>
+							<th>凭据模式</th>
+							<th>状态</th>
+							<th>版本</th>
+							<th>更新于</th>
+							<th></th>
+						</tr>
+					</thead>
+					<tbody>
+						{#each connections as row}
+							<tr>
+								<td class="font-mono text-sm">{row.providerId}</td>
+								<td>{providerModeLabel(row.mode)}</td>
+								<td>{row.status}</td>
+								<td class="tabular-nums">{row.activeVersion ?? '—'}</td>
+								<td class="text-surface-600">{fmtDate(row.updatedAt)}</td>
+								<td>
+									{#if row.mode === 'BYOK'}
+										<button class="saas-btn-ghost px-2! py-1! text-xs" onclick={() => startRotate(row)}>轮换</button>
+									{:else}
+										<span class="text-xs text-surface-500">平台管理</span>
+									{/if}
+								</td>
+							</tr>
+						{/each}
+					</tbody>
+				</table>
+			</div>
+		{/if}
+	</div>
+
+	<div class="saas-card-pad">
+		<h3 class="saas-section-title mb-1">轮换 BYOK 凭据</h3>
+		<p class="saas-muted mb-4">
+			密钥仅写入新版本，旧版本归档；保存时需重新填写接口地址与访问令牌。平台托管连接不在此处管理。
+		</p>
+		<div class="grid gap-5">
+			<div>
+				<Label.Root class="saas-label" for="provider-id">供应方 ID</Label.Root>
+				<input id="provider-id" class="saas-input font-mono text-sm" bind:value={providerId} placeholder="openrouter" />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="base-url">接口地址</Label.Root>
+				<input id="base-url" class="saas-input" placeholder="https://openrouter.ai/api" bind:value={baseUrl} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="auth-token">访问令牌</Label.Root>
+				<input id="auth-token" class="saas-input" type="password" bind:value={authToken} />
+			</div>
+			<div>
+				<Label.Root class="saas-label" for="anthropic-key">Anthropic API Key（可选）</Label.Root>
+				<input id="anthropic-key" class="saas-input" type="password" bind:value={anthropicApiKey} />
+			</div>
+		</div>
+		<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
+			<div class="flex-1"></div>
+			<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
+			<button class="saas-btn-primary" onclick={save} disabled={saving}>
+				{saving ? '保存中…' : '保存'}
+			</button>
+		</div>
+	</div>
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/teams/+page.svelte

@@ -0,0 +1,233 @@
+<script lang="ts">
+	import { Collapsible } from 'bits-ui';
+	import { page } from '$app/state';
+	import { api, type TeamRow, type TeamMemberRow } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let teams = $state<TeamRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newSlug = $state('');
+	let newName = $state('');
+	let newDesc = $state('');
+	let adding = $state(false);
+
+	let expandedId = $state<string | null>(null);
+	let teamMembers = $state<TeamMemberRow[]>([]);
+	let memberInput = $state('');
+	let loadingMembers = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.teams(slug);
+			teams = res.teams;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	const SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+
+	async function createTeam() {
+		if (!newSlug.trim() || !newName.trim()) return;
+		const teamSlug = newSlug.trim().toLowerCase();
+		if (!SLUG_RE.test(teamSlug)) {
+			toastError('标识须为小写字母数字，可用连字符连接');
+			return;
+		}
+		adding = true;
+		try {
+			await api.createTeam(slug, {
+				slug: teamSlug,
+				name: newName.trim(),
+				...(newDesc.trim() ? { description: newDesc.trim() } : {}),
+			});
+			newSlug = '';
+			newName = '';
+			newDesc = '';
+			await load();
+			toastSuccess('团队已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	async function archiveTeam(t: TeamRow) {
+		if (!confirm(`归档团队 ${t.name}? 归档后该团队不再解析为项目授权主体。`)) return;
+		try {
+			await api.archiveTeam(slug, t.id);
+			if (expandedId === t.id) expandedId = null;
+			await load();
+			toastSuccess('团队已归档');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function openMembers(t: TeamRow) {
+		if (expandedId === t.id) return;
+		expandedId = t.id;
+		loadingMembers = true;
+		memberInput = '';
+		try {
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			loadingMembers = false;
+		}
+	}
+
+	function onExpandChange(t: TeamRow, open: boolean) {
+		if (open) void openMembers(t);
+		else if (expandedId === t.id) expandedId = null;
+	}
+
+	async function addMember(t: TeamRow) {
+		if (!memberInput.trim()) return;
+		const v = memberInput.trim();
+		try {
+			await api.addTeamMember(slug, t.id, v.startsWith('ou') ? { feishuOpenId: v } : { userId: v });
+			memberInput = '';
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+			await load();
+			toastSuccess('已加入团队');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	async function revokeMember(t: TeamRow, m: TeamMemberRow) {
+		if (!confirm(`将 ${m.displayName} 移出团队 ${t.name}?`)) return;
+		try {
+			await api.revokeTeamMember(slug, t.id, m.userId);
+			const res = await api.teamMembers(slug, t.id);
+			teamMembers = res.members;
+			await load();
+			toastSuccess('已移出团队');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader title="团队" description="团队是项目授权主体，可被授予只读、编辑或管理权限。" />
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">新建团队</h2>
+		<div class="grid gap-3 md:grid-cols-[1fr_1fr_1.2fr_auto]">
+			<input class="saas-input" placeholder="标识（如 math-g7）" bind:value={newSlug} />
+			<input class="saas-input" placeholder="名称" bind:value={newName} />
+			<input class="saas-input" placeholder="描述（可选）" bind:value={newDesc} />
+			<button class="saas-btn-primary" onclick={createTeam} disabled={adding}>新建</button>
+		</div>
+	</div>
+
+	{#if teams.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无团队" description="创建团队后，可在项目页授权项目访问。" />
+		</div>
+	{:else}
+		<div class="space-y-3">
+			{#each teams as t (t.id)}
+				<Collapsible.Root
+					class="saas-card p-5"
+					open={expandedId === t.id}
+					onOpenChange={(open) => onExpandChange(t, open)}
+				>
+					<div class="flex flex-wrap items-center gap-2.5">
+						<span class="text-base font-semibold text-surface-900">{t.name}</span>
+						<span class="font-mono text-xs text-surface-600">/{t.slug}</span>
+						<span class="saas-badge-neutral">{t.memberCount} 成员</span>
+						<div class="ml-auto flex flex-wrap gap-2">
+							<Collapsible.Trigger class="saas-btn-secondary py-1.5! text-sm">
+								{expandedId === t.id ? '收起' : '管理成员'}
+							</Collapsible.Trigger>
+							<button type="button" class="saas-btn-danger py-1.5! text-sm" onclick={() => archiveTeam(t)}>
+								归档
+							</button>
+						</div>
+					</div>
+					{#if t.description}
+						<p class="mt-1.5 text-sm text-surface-700">{t.description}</p>
+					{/if}
+					<p class="mt-1 text-xs text-surface-600">创建于 {fmtDate(t.createdAt)}</p>
+
+					<Collapsible.Content>
+						<div class="mt-4 border-t border-surface-200 pt-4">
+							{#if loadingMembers && expandedId === t.id}
+								<p class="text-sm text-surface-600">加载中…</p>
+							{:else if expandedId === t.id}
+								<div class="mb-4 flex gap-2">
+									<input
+										class="saas-input"
+										placeholder="飞书 open_id 或用户 id"
+										bind:value={memberInput}
+										onkeydown={(e) => {
+											if (e.key === 'Enter') addMember(t);
+										}}
+									/>
+									<button class="saas-btn-secondary shrink-0" onclick={() => addMember(t)}>加入</button>
+								</div>
+								{#if teamMembers.length === 0}
+									<p class="py-3 text-center text-sm text-surface-600">团队暂无成员</p>
+								{:else}
+									<table class="data-table">
+										<thead>
+											<tr>
+												<th>成员</th>
+												<th>open_id</th>
+												<th>加入时间</th>
+												<th></th>
+											</tr>
+										</thead>
+										<tbody>
+											{#each teamMembers as m}
+												<tr>
+													<td class="font-medium">{m.displayName}</td>
+													<td class="font-mono text-xs">{m.feishuOpenId}</td>
+													<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
+													<td class="text-right">
+														<button class="saas-btn-danger py-1! text-xs" onclick={() => revokeMember(t, m)}>
+															移除
+														</button>
+													</td>
+												</tr>
+											{/each}
+										</tbody>
+									</table>
+								{/if}
+							{/if}
+						</div>
+					</Collapsible.Content>
+				</Collapsible.Root>
+			{/each}
+		</div>
+	{/if}
+	<p class="mt-4 text-xs text-surface-600">归档团队会同步撤销其活跃的项目授权。</p>
+{/if}

hub/admin-web/src/routes/app.css

@@ -0,0 +1,692 @@
+@import 'tailwindcss';
+
+@import '@skeletonlabs/skeleton';
+@import '@skeletonlabs/skeleton/themes/hamlindigo';
+
+@source './**/*.{html,js,svelte,ts}';
+@source '../lib/**/*.{html,js,svelte,ts}';
+
+/* Flat industrial: zero radius, higher-contrast surfaces, CJK-first type */
+@theme {
+	--font-sans:
+		'Noto Sans SC', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei', 'Inter', ui-sans-serif, system-ui,
+		-apple-system, 'Segoe UI', sans-serif;
+	--font-mono: 'JetBrains Mono', ui-monospace, 'SF Mono', Menlo, Consolas, monospace;
+
+	--radius-none: 0;
+	--radius-sm: 0;
+	--radius-md: 0;
+	--radius-lg: 0;
+	--radius-xl: 0;
+	--radius-2xl: 0;
+	--radius-3xl: 0;
+	--radius-full: 0;
+	--radius: 0;
+}
+
+@layer base {
+	html {
+		height: 100%;
+		-webkit-font-smoothing: antialiased;
+		-moz-osx-font-smoothing: grayscale;
+		text-rendering: optimizeLegibility;
+		font-feature-settings:
+			'kern' 1,
+			'liga' 1;
+		/* Prefer readable CJK metrics over Latin optical sizing */
+		text-size-adjust: 100%;
+	}
+
+	body {
+		min-height: 100%;
+		font-family: var(--font-sans);
+		font-size: 15px;
+		line-height: 1.7;
+		letter-spacing: 0.01em;
+		/* Slightly cooler industrial surface */
+		background: var(--color-surface-100);
+		color: var(--color-surface-950, var(--color-surface-900));
+		font-variant-east-asian: proportional-width;
+	}
+
+	/* CJK headings: no negative tracking, breathing line-height */
+	h1,
+	h2,
+	h3,
+	h4,
+	h5,
+	h6 {
+		font-weight: 600;
+		line-height: 1.45;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	p {
+		line-height: 1.75;
+	}
+
+	/* Harder focus ring for industrial UI */
+	:focus-visible {
+		outline: 2px solid var(--color-primary-600);
+		outline-offset: 2px;
+	}
+
+	::selection {
+		background: color-mix(in oklab, var(--color-primary-600) 35%, transparent);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	/* Tables: high-contrast grid, flat */
+	table.data-table {
+		width: 100%;
+		border-collapse: collapse;
+		font-size: 0.875rem;
+		line-height: 1.6;
+	}
+
+	table.data-table thead th {
+		padding: 0.625rem 0.75rem;
+		text-align: left;
+		font-weight: 600;
+		color: var(--color-surface-700);
+		background: var(--color-surface-100);
+		border-bottom: 1px solid var(--color-surface-300);
+		white-space: nowrap;
+		letter-spacing: 0.02em;
+	}
+
+	table.data-table tbody td {
+		padding: 0.75rem;
+		border-bottom: 1px solid var(--color-surface-200);
+		vertical-align: middle;
+		color: var(--color-surface-900);
+	}
+
+	table.data-table tbody tr:hover td {
+		background: var(--color-surface-100);
+	}
+
+	table.data-table tbody tr:last-child td {
+		border-bottom: none;
+	}
+}
+
+@layer components {
+	.saas-card {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		box-shadow: none;
+	}
+
+	.saas-card-pad {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		box-shadow: none;
+		padding: 1.25rem;
+	}
+
+	.saas-page-title {
+		font-size: 1.375rem;
+		line-height: 1.4;
+		font-weight: 700;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-section-title {
+		font-size: 1rem;
+		line-height: 1.5;
+		font-weight: 600;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-muted {
+		font-size: 0.875rem;
+		line-height: 1.65;
+		color: var(--color-surface-700);
+	}
+
+	.saas-label {
+		display: block;
+		margin-bottom: 0.375rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		font-weight: 600;
+		color: var(--color-surface-800);
+	}
+
+	.saas-help {
+		margin-top: 0.375rem;
+		font-size: 0.8125rem;
+		line-height: 1.6;
+		color: var(--color-surface-600);
+	}
+
+	.saas-toolbar {
+		display: flex;
+		flex-wrap: wrap;
+		align-items: center;
+		gap: 0.75rem;
+		margin-bottom: 1.5rem;
+	}
+
+	.saas-stat {
+		border-radius: 0;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		padding: 1rem;
+		box-shadow: none;
+	}
+
+	.saas-stat-label {
+		font-size: 0.75rem;
+		font-weight: 600;
+		letter-spacing: 0.04em;
+		text-transform: uppercase;
+		color: var(--color-surface-600);
+	}
+
+	.saas-stat-value {
+		margin-top: 0.25rem;
+		font-size: 1.5rem;
+		line-height: 1.3;
+		font-weight: 700;
+		font-variant-numeric: tabular-nums;
+		letter-spacing: 0;
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-empty {
+		display: flex;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		gap: 0.5rem;
+		padding: 3rem 1rem;
+		text-align: center;
+		line-height: 1.7;
+	}
+
+	.saas-shell {
+		display: flex;
+		height: 100vh;
+		overflow: hidden;
+		background: var(--color-surface-100);
+	}
+
+	.saas-sidebar {
+		display: flex;
+		width: 16rem;
+		flex-shrink: 0;
+		flex-direction: column;
+		border-right: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+	}
+
+	.saas-main {
+		display: flex;
+		min-width: 0;
+		flex: 1;
+		flex-direction: column;
+		overflow: hidden;
+	}
+
+	.saas-topbar {
+		display: flex;
+		height: 3.5rem;
+		flex-shrink: 0;
+		align-items: center;
+		gap: 0.75rem;
+		border-bottom: 1px solid var(--color-surface-300);
+		background: var(--color-surface-50);
+		padding: 0 1.5rem;
+		/* flat: no glass */
+		backdrop-filter: none;
+	}
+
+	.saas-content {
+		flex: 1;
+		overflow-y: auto;
+	}
+
+	.saas-content-inner {
+		margin-inline: auto;
+		width: 100%;
+		max-width: 72rem;
+		padding: 1.5rem;
+	}
+
+	@media (min-width: 768px) {
+		.saas-content-inner {
+			padding: 2rem;
+		}
+	}
+
+	.saas-nav-item {
+		display: flex;
+		align-items: center;
+		gap: 0.75rem;
+		border-radius: 0;
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		font-weight: 500;
+		color: var(--color-surface-700);
+		border-left: 2px solid transparent;
+		transition:
+			color 0.1s,
+			background-color 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-nav-item:hover {
+		background: var(--color-surface-100);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-nav-item[data-active='true'] {
+		background: var(--color-primary-50, var(--color-primary-100));
+		color: var(--color-primary-800);
+		border-left-color: var(--color-primary-600);
+		font-weight: 600;
+	}
+
+	.saas-badge {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		letter-spacing: 0.02em;
+	}
+
+	.saas-badge-neutral {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-surface-300);
+		background: var(--color-surface-100);
+		color: var(--color-surface-800);
+	}
+
+	.saas-badge-primary {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-primary-300);
+		background: var(--color-primary-100);
+		color: var(--color-primary-800);
+	}
+
+	.saas-badge-success {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-success-300);
+		background: var(--color-success-100);
+		color: var(--color-success-800);
+	}
+
+	.saas-badge-warning {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-warning-300);
+		background: var(--color-warning-100);
+		color: var(--color-warning-900);
+	}
+
+	.saas-badge-error {
+		display: inline-flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.125rem 0.5rem;
+		font-size: 0.75rem;
+		line-height: 1.4;
+		font-weight: 600;
+		border: 1px solid var(--color-error-300);
+		background: var(--color-error-100);
+		color: var(--color-error-800);
+	}
+
+	.saas-input,
+	.saas-select,
+	.saas-textarea {
+		width: 100%;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		color: var(--color-surface-950, var(--color-surface-900));
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		outline: none;
+		transition:
+			border-color 0.1s,
+			box-shadow 0.1s;
+	}
+
+	.saas-input::placeholder,
+	.saas-textarea::placeholder {
+		color: var(--color-surface-500);
+	}
+
+	.saas-input:focus,
+	.saas-select:focus,
+	.saas-textarea:focus {
+		border-color: var(--color-primary-600);
+		box-shadow: inset 0 0 0 1px var(--color-primary-600);
+	}
+
+	.saas-textarea {
+		font-family: var(--font-mono);
+		line-height: 1.55;
+		resize: vertical;
+	}
+
+	.saas-select-trigger {
+		display: inline-flex;
+		width: 100%;
+		align-items: center;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		color: var(--color-surface-950, var(--color-surface-900));
+		padding: 0.5rem 0.75rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		outline: none;
+		transition:
+			border-color 0.1s,
+			box-shadow 0.1s;
+		cursor: pointer;
+		text-align: left;
+	}
+
+	.saas-select-trigger:focus-visible,
+	.saas-select-trigger[data-state='open'] {
+		border-color: var(--color-primary-600);
+		box-shadow: inset 0 0 0 1px var(--color-primary-600);
+	}
+
+	.saas-select-trigger:disabled,
+	.saas-select-trigger[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.55;
+	}
+
+	.saas-select-trigger [data-placeholder] {
+		color: var(--color-surface-500);
+	}
+
+	.saas-select-content {
+		z-index: 70;
+		max-height: min(18rem, var(--bits-select-content-available-height, 18rem));
+		width: var(--bits-select-anchor-width);
+		min-width: var(--bits-select-anchor-width);
+		overflow: hidden;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		box-shadow: 4px 4px 0 rgb(15 23 42 / 0.12);
+		outline: none;
+	}
+
+	.saas-select-item {
+		display: flex;
+		align-items: center;
+		border-radius: 0;
+		padding: 0.45rem 0.65rem;
+		font-size: 0.875rem;
+		line-height: 1.5;
+		color: var(--color-surface-900);
+		cursor: pointer;
+		outline: none;
+		user-select: none;
+	}
+
+	.saas-select-item[data-highlighted] {
+		background: var(--color-primary-100);
+		color: var(--color-primary-900);
+	}
+
+	.saas-select-item[data-selected] {
+		color: var(--color-primary-900);
+		font-weight: 600;
+	}
+
+	.saas-select-item[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.45;
+	}
+
+	.saas-btn-primary,
+	.saas-btn-secondary,
+	.saas-btn-ghost,
+	.saas-btn-danger {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		gap: 0.375rem;
+		border-radius: 0;
+		padding: 0.5rem 0.875rem;
+		font-size: 0.875rem;
+		font-weight: 600;
+		line-height: 1.4;
+		letter-spacing: 0.01em;
+		border: 1px solid transparent;
+		cursor: pointer;
+		transition:
+			background-color 0.1s,
+			color 0.1s,
+			border-color 0.1s,
+			opacity 0.1s;
+	}
+
+	.saas-btn-primary:disabled,
+	.saas-btn-secondary:disabled,
+	.saas-btn-ghost:disabled,
+	.saas-btn-danger:disabled {
+		opacity: 0.55;
+		cursor: not-allowed;
+	}
+
+	.saas-btn-primary {
+		background: var(--color-primary-600);
+		border-color: var(--color-primary-700);
+		color: var(--color-primary-contrast-500, white);
+	}
+
+	.saas-btn-primary:hover:not(:disabled) {
+		background: var(--color-primary-700);
+		border-color: var(--color-primary-800);
+	}
+
+	.saas-btn-secondary {
+		background: var(--color-surface-100);
+		border-color: var(--color-surface-400);
+		color: var(--color-surface-900);
+	}
+
+	.saas-btn-secondary:hover:not(:disabled) {
+		background: var(--color-surface-200);
+		border-color: var(--color-surface-500);
+	}
+
+	.saas-btn-ghost {
+		background: transparent;
+		border-color: transparent;
+		color: var(--color-surface-800);
+	}
+
+	.saas-btn-ghost:hover:not(:disabled) {
+		background: var(--color-surface-200);
+		color: var(--color-surface-950, var(--color-surface-900));
+	}
+
+	.saas-btn-danger {
+		background: var(--color-error-100);
+		border-color: var(--color-error-400);
+		color: var(--color-error-800);
+	}
+
+	.saas-btn-danger:hover:not(:disabled) {
+		background: var(--color-error-200);
+		border-color: var(--color-error-500);
+	}
+
+	.saas-checkbox {
+		display: inline-flex;
+		align-items: center;
+		justify-content: center;
+		width: 1.1rem;
+		height: 1.1rem;
+		flex-shrink: 0;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-500);
+		background: var(--color-surface-50);
+		color: white;
+		cursor: pointer;
+		transition:
+			background 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-checkbox[data-state='checked'] {
+		background: var(--color-primary-700);
+		border-color: var(--color-primary-700);
+	}
+
+	.saas-checkbox:focus-visible {
+		outline: none;
+		box-shadow:
+			0 0 0 2px var(--color-surface-50),
+			0 0 0 4px var(--color-primary-600);
+	}
+
+	.saas-checkbox[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.5;
+	}
+
+	/* Square industrial switch (no pill) */
+	.saas-switch {
+		position: relative;
+		display: inline-flex;
+		width: 2.5rem;
+		height: 1.35rem;
+		flex-shrink: 0;
+		align-items: center;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-500);
+		background: var(--color-surface-300);
+		padding: 0.125rem;
+		cursor: pointer;
+		transition:
+			background 0.1s,
+			border-color 0.1s;
+	}
+
+	.saas-switch[data-state='checked'] {
+		background: var(--color-primary-600);
+		border-color: var(--color-primary-700);
+	}
+
+	.saas-switch:focus-visible {
+		outline: none;
+		box-shadow:
+			0 0 0 2px var(--color-surface-50),
+			0 0 0 4px var(--color-primary-600);
+	}
+
+	.saas-switch[data-disabled] {
+		cursor: not-allowed;
+		opacity: 0.5;
+	}
+
+	.saas-switch-thumb {
+		display: block;
+		width: 1rem;
+		height: 1rem;
+		border-radius: 0;
+		background: white;
+		border: 1px solid var(--color-surface-400);
+		box-shadow: none;
+		transition: transform 0.1s;
+		transform: translateX(0);
+	}
+
+	.saas-switch[data-state='checked'] .saas-switch-thumb,
+	.saas-switch-thumb[data-state='checked'] {
+		transform: translateX(1.1rem);
+		border-color: var(--color-primary-800);
+	}
+
+	.saas-modal-backdrop {
+		position: fixed;
+		inset: 0;
+		z-index: 50;
+		background: rgb(2 6 23 / 0.55);
+		backdrop-filter: none;
+	}
+
+	.saas-modal {
+		position: fixed;
+		left: 50%;
+		top: 50%;
+		z-index: 51;
+		width: calc(100% - 2rem);
+		max-width: 28rem;
+		transform: translate(-50%, -50%);
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		padding: 1.5rem;
+		box-shadow: 6px 6px 0 rgb(15 23 42 / 0.15);
+		outline: none;
+	}
+
+	.saas-status-panel {
+		display: flex;
+		min-height: 100vh;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		background: var(--color-surface-100);
+		padding: 1rem;
+	}
+
+	.saas-status-card {
+		width: 100%;
+		max-width: 28rem;
+		border-radius: 0;
+		border: 1px solid var(--color-surface-400);
+		background: var(--color-surface-50);
+		padding: 2rem;
+		text-align: center;
+		box-shadow: 4px 4px 0 rgb(15 23 42 / 0.1);
+		line-height: 1.7;
+	}
+}

hub/admin-web/static/favicon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
+	<rect width="32" height="32" rx="8" fill="#4F46E5"/>
+	<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
+	<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
+</svg>

hub/admin-web/static/robots.txt

@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:

hub/admin-web/svelte.config.js

@@ -0,0 +1,18 @@
+import adapter from '@sveltejs/adapter-static';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	preprocess: vitePreprocess(),
+	kit: {
+		adapter: adapter({
+			pages: 'build',
+			assets: 'build',
+			fallback: 'index.html',
+			precompress: false,
+			strict: false,
+		}),
+	},
+};
+
+export default config;

hub/admin-web/tsconfig.json

@@ -0,0 +1,20 @@
+{
+	"extends": "./.svelte-kit/tsconfig.json",
+	"compilerOptions": {
+		"rewriteRelativeImportExtensions": true,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"moduleResolution": "bundler"
+	}
+	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+	//
+	// To make changes to top-level options such as include and exclude, we recommend extending
+	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+}

hub/admin-web/vite.config.ts

@@ -0,0 +1,13 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import tailwindcss from '@tailwindcss/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+	plugins: [tailwindcss(), sveltekit()],
+	server: {
+		proxy: {
+			'/api': 'http://127.0.0.1:8788',
+			'/auth': 'http://127.0.0.1:8788',
+		},
+	},
+});

hub/deploy/README.md

@@ -11,6 +11,32 @@ See [NEW_SILO_RUNBOOK.md](NEW_SILO_RUNBOOK.md). The remainder of this document
 describes the individual installer and maintenance primitives used by the
 generated bundle.
 
+## CI: roll Hub + admin SPA by fleet (`educraft` / `educraft-dev`)
+
+`.gitea/workflows/deploy-admin.yml` deploys Hub releases (including the org-admin
+SPA) to the managed Alpha host via `deploy_fleet_release.sh`. Fleets share the
+host and are selected by the middle DNS label of `HUB_PUBLIC_BASE_URL`:
+
+| Fleet | Domain | CI trigger |
+|-------|--------|------------|
+| **dev** | `https://<slug>.educraft-dev.paradigm-edu.net` | every push + PR (paths under `hub/`) |
+| **prod** | `https://<slug>.educraft.paradigm-edu.net` | push to `main` + tags |
+
+Example prod tenant:
+`https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100`.
+
+Required Gitea secret: `DEPLOY_SSH_KEY` (private key for `root@39.107.254.4`).
+Optional: `DEPLOY_HOST` / `DEPLOY_USER` / `DEPLOY_SSH_PORT` / `DEPLOY_BASE`.
+Set repository var `ALLOW_EMPTY_FLEET=1` until the first silo exists for a fleet.
+
+Local dry-run against the host:
+
+```sh
+CPH_FLEET=dev \
+  PLATFORM_DEPLOY_SSH_KEY=$HOME/.ssh/id_ed25519 \
+  bash hub/deploy/deploy_fleet_release.sh
+```
+
 The supervised alpha runs one Organization per named Silo. The supported host
 has systemd, PostgreSQL, Node.js 24+, `pg_isready`, `runuser`, `setpriv`,
 bubblewrap, `socat`, `pg_dump`, `tar`, `sha256sum`, and a compatible `cph`.

hub/deploy/build_legacy_project_manifest.mjs

@@ -49,7 +49,10 @@ async function findProjectFiles(directory) {
   for (const entry of entries) {
     if (entry.name === ".trash") continue;
     const path = resolve(directory, entry.name);
-    if (entry.isSymbolicLink()) throw new Error(`legacy manifest rejects symbolic link: ${path}`);
+    if (entry.isSymbolicLink()) {
+      process.stderr.write(`[legacy-manifest] skip untracked symbolic link: ${path}\n`);
+      continue;
+    }
     if (entry.isDirectory()) found.push(...await findProjectFiles(path));
   }
   return found;

hub/deploy/deploy_fleet_release.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# Publish one immutable Hub release (tsc + admin-web SPA) to the managed host,
+# then repoint every Silo in the chosen fleet to that release and restart it.
+#
+# Fleet is selected by the middle DNS label of each Silo's HUB_PUBLIC_BASE_URL:
+#
+#   prod → https://<slug>.educraft.paradigm-edu.net
+#   dev  → https://<slug>.educraft-dev.paradigm-edu.net
+#
+# Example tenant (prod):
+#   https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
+#
+# Configure (CI secrets / env):
+#   CPH_FLEET                 required: dev | prod
+#   PLATFORM_DEPLOY_HOST      default 39.107.254.4
+#   PLATFORM_DEPLOY_USER      default root
+#   PLATFORM_DEPLOY_SSH_KEY   required (path to private key)
+#   PLATFORM_DEPLOY_PORT      default 22
+#   PLATFORM_DEPLOY_BASE      default /srv/curriculum-project-hub
+#   PLATFORM_DEPLOY_RELEASE   default git HEAD (must be safe for paths)
+#   ALLOW_EMPTY_FLEET         optional: if 1, succeed when no silo matches
+#
+# This is a code-roll for existing silos. It does not create databases, domains,
+# or Feishu apps — use new_silo.sh / apply_new_silo.sh for that.
+set -euo pipefail
+
+FLEET="${CPH_FLEET:?CPH_FLEET required (dev|prod)}"
+case "$FLEET" in
+  dev) FLEET_DOMAIN_SUFFIX="educraft-dev.paradigm-edu.net" ;;
+  prod) FLEET_DOMAIN_SUFFIX="educraft.paradigm-edu.net" ;;
+  *)
+    echo "CPH_FLEET must be dev or prod, got: $FLEET" >&2
+    exit 1
+    ;;
+esac
+
+HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
+DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
+PORT="${PLATFORM_DEPLOY_PORT:-22}"
+SSH_KEY="${PLATFORM_DEPLOY_SSH_KEY:?PLATFORM_DEPLOY_SSH_KEY required}"
+BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+RELEASE_ID="${PLATFORM_DEPLOY_RELEASE:-$(git -C "$REPO_ROOT" rev-parse --verify HEAD)}"
+[[ "$RELEASE_ID" =~ ^[A-Za-z0-9._-]+$ ]] || {
+  echo "invalid PLATFORM_DEPLOY_RELEASE: $RELEASE_ID" >&2
+  exit 1
+}
+ALLOW_EMPTY_FLEET="${ALLOW_EMPTY_FLEET:-0}"
+
+HUB_DIR="$BASE/releases/$RELEASE_ID/hub"
+RELEASE_DIR="$BASE/releases/$RELEASE_ID"
+SSH_OPTS=(-i "$SSH_KEY" -p "$PORT" -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+
+echo "[fleet] fleet=$FLEET domain=*.$FLEET_DOMAIN_SUFFIX host=$DEPLOY_USER@$HOST release=$RELEASE_ID"
+
+# --- 1. Publish immutable release (shared; flock so parallel fleet jobs do not race) ---
+release_ready=false
+if ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "test -f '$RELEASE_DIR/.complete'"; then
+  release_ready=true
+  echo "[fleet] release already complete: $RELEASE_DIR"
+fi
+
+if [ "$release_ready" = false ]; then
+  # Drop a prior incomplete tree for this release id (failed CI leave leftovers).
+  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
+set -euo pipefail
+flock /var/lock/cph-hub-release-publish bash -c '
+  set -euo pipefail
+  if [ -f "$RELEASE_DIR/.complete" ]; then
+    exit 0
+  fi
+  if [ -e "$RELEASE_DIR" ]; then
+    echo "[fleet] removing incomplete release: $RELEASE_DIR"
+    rm -rf "$RELEASE_DIR"
+  fi
+  mkdir -p "$HUB_DIR"
+'
+REMOTE
+
+  echo "[fleet] rsync hub → $HUB_DIR"
+  rsync -az --delete \
+    --exclude node_modules --exclude dist --exclude .env \
+    --exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
+    -e "ssh ${SSH_OPTS[*]}" \
+    "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
+
+  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
+  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
+set -euo pipefail
+flock /var/lock/cph-hub-release-publish bash -c '
+  set -euo pipefail
+  if [ -f "$RELEASE_DIR/.complete" ]; then
+    echo "[fleet] release completed by another job"
+    exit 0
+  fi
+  cd "$HUB_DIR"
+  npm ci
+  npm ci --prefix admin-web
+  npm run audit:production
+  npm run build
+  test -f admin-web/build/index.html
+  touch "$RELEASE_DIR/.complete"
+'
+REMOTE
+fi
+
+# --- 2. Discover silos in this fleet and roll them onto the release ---
+ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
+  env BASE="$BASE" HUB_DIR="$HUB_DIR" FLEET="$FLEET" \
+  FLEET_DOMAIN_SUFFIX="$FLEET_DOMAIN_SUFFIX" ALLOW_EMPTY_FLEET="$ALLOW_EMPTY_FLEET" \
+  bash -s <<'REMOTE'
+set -euo pipefail
+
+fleet_match() {
+  local public_url="$1"
+  local host="${public_url#https://}"
+  host="${host#http://}"
+  host="${host%%/*}"
+  host="${host%%:*}"
+  case "$FLEET" in
+    prod)
+      [[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]] || return 1
+      # Avoid matching educraft-dev when suffix is educraft.…
+      [[ "$host" != *.educraft-dev.paradigm-edu.net && "$host" != educraft-dev.paradigm-edu.net ]] || return 1
+      return 0
+      ;;
+    dev)
+      [[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]]
+      return
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+env_value() {
+  local file="$1"
+  local key="$2"
+  # Do not source secrets — only read the KEY=value line.
+  local line
+  line="$(grep -E "^${key}=" "$file" | tail -n1 || true)"
+  printf '%s' "${line#"${key}="}"
+}
+
+matched=0
+shopt -s nullglob
+for env_file in "$BASE"/.secrets/*/platform.env; do
+  instance_id="$(basename "$(dirname "$env_file")")"
+  public_url="$(env_value "$env_file" HUB_PUBLIC_BASE_URL)"
+  if [ -z "$public_url" ]; then
+    echo "[fleet] skip $instance_id: HUB_PUBLIC_BASE_URL empty"
+    continue
+  fi
+  if ! fleet_match "$public_url"; then
+    echo "[fleet] skip $instance_id: $public_url (not $FLEET)"
+    continue
+  fi
+
+  port="$(env_value "$env_file" PORT)"
+  workspace="$(env_value "$env_file" HUB_PROJECT_WORKSPACE_ROOT)"
+  unit="cph-hub-${instance_id}.service"
+  if [ ! -f "/etc/systemd/system/$unit" ]; then
+    echo "[fleet] skip $instance_id: unit missing ($unit)" >&2
+    continue
+  fi
+
+  # Prefer unit file ceilings (MemoryMax=16G) over systemctl's byte form.
+  memory_max="$(sed -n 's/^MemoryMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
+  cpu_quota="$(sed -n 's/^CPUQuota=//p' "/etc/systemd/system/$unit" | tail -n1)"
+  tasks_max="$(sed -n 's/^TasksMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
+
+  if [ -z "$port" ] || [ -z "$workspace" ] || [ -z "$memory_max" ] || [ -z "$cpu_quota" ] || [ -z "$tasks_max" ]; then
+    echo "[fleet] error: $instance_id missing PORT/workspace/ceilings (port=$port workspace=$workspace memory=$memory_max cpu=$cpu_quota tasks=$tasks_max)" >&2
+    exit 1
+  fi
+
+  echo "[fleet] roll $instance_id → $HUB_DIR ($public_url port=$port)"
+  BASE="$BASE" \
+    HUB_DIR="$HUB_DIR" \
+    INSTANCE_ID="$instance_id" \
+    WORKSPACE_ROOT="$workspace" \
+    PORT="$port" \
+    MEMORY_MAX="$memory_max" \
+    CPU_QUOTA="$cpu_quota" \
+    TASKS_MAX="$tasks_max" \
+    bash "$HUB_DIR/deploy/install_service.sh"
+
+  systemctl restart "$unit"
+  systemctl is-active --quiet "$unit"
+
+  health="http://127.0.0.1:${port}/api/healthz"
+  ok=false
+  for _ in $(seq 1 45); do
+    if curl --fail --silent "$health" >/dev/null 2>&1; then
+      ok=true
+      break
+    fi
+    sleep 1
+  done
+  if [ "$ok" != true ]; then
+    curl --fail --silent --show-error "$health" >/dev/null
+  fi
+  echo "[fleet] healthy $instance_id ($health)"
+  matched=$((matched + 1))
+done
+
+if [ "$matched" -eq 0 ]; then
+  msg="[fleet] no silos matched *.$FLEET_DOMAIN_SUFFIX under $BASE/.secrets"
+  if [ "$ALLOW_EMPTY_FLEET" = "1" ]; then
+    echo "$msg (ALLOW_EMPTY_FLEET=1)"
+    exit 0
+  fi
+  echo "$msg" >&2
+  exit 1
+fi
+
+echo "[fleet] rolled $matched silo(s) on $FLEET"
+REMOTE
+
+echo "[fleet] done fleet=$FLEET release=$RELEASE_ID hub=$HUB_DIR"

hub/deploy/deploy_platform.sh

@@ -60,9 +60,10 @@ if [ "$release_ready" = false ]; then
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  # 2. Install deps, audit and build, then atomically mark the release complete.
+  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
+  # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && npm ci && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi
 
 # 3. Ensure the service is installed (idempotent), then restart.

hub/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.21",
+  "version": "0.0.26",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.21",
+      "version": "0.0.26",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
@@ -131,9 +131,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -147,9 +144,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -163,9 +157,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -179,9 +170,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "SEE LICENSE IN LICENSE.md",
       "optional": true,
       "os": [
@@ -247,24 +235,26 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.11.1",
+      "version": "1.11.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
-      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.11.1",
+      "version": "1.11.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
-      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "tslib": "^2.4.0"
       }
@@ -1199,9 +1189,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1219,9 +1206,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1239,9 +1223,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1259,9 +1240,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1279,9 +1257,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1299,9 +1274,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1347,6 +1319,29 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmmirror.com/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmmirror.com/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
@@ -3157,9 +3152,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3181,9 +3173,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3205,9 +3194,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3229,9 +3215,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.21",
+  "version": "0.0.26",
   "private": true,
   "type": "module",
   "engines": {
@@ -30,19 +30,21 @@
   "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
   "scripts": {
     "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json && npm run admin:build",
     "start": "npm run prisma:migrate && node dist/server.js",
     "check": "tsc -p tsconfig.json --noEmit",
     "audit:production": "npm audit --omit=dev --audit-level=high",
     "prisma:generate": "prisma generate --schema prisma/schema.prisma",
-    "prisma:validate": "DATABASE_URL=${DATABASE_URL:-postgresql://stub:stub@127.0.0.1:5432/stub} prisma validate --schema prisma/schema.prisma",
+    "prisma:validate": "prisma validate --schema prisma/schema.prisma",
-    "prisma:migrate": "DATABASE_URL=${DATABASE_URL:-postgresql://paradigm:paradigm@127.0.0.1:5432/paradigm} prisma migrate deploy --schema prisma/schema.prisma",
+    "prisma:migrate": "prisma migrate deploy --schema prisma/schema.prisma",
     "secrets:rotate-kek": "node dist/deployment/rotate-secret-kek.js",
     "agent-config": "node dist/deployment/agent-config-cli.js",
     "silo:bootstrap": "node dist/deployment/bootstrap-silo-cli.js",
     "silo:restore-preflight": "node dist/deployment/restore-preflight.js",
     "deploy": "bash deploy/deploy_platform.sh",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "admin:dev": "npm run dev --prefix admin-web",
+    "admin:build": "npm run build --prefix admin-web"
   }
 }

hub/prisma/migrations/20260712010000_project_discovery_search/migration.sql

@@ -0,0 +1,191 @@
+-- Derived project discovery projection. Project/Folder remain authoritative;
+-- triggers prevent index drift through ordinary database mutations.
+CREATE EXTENSION IF NOT EXISTS pg_trgm;
+
+CREATE TYPE "FolderKind" AS ENUM ('REGULAR', 'SYSTEM_INBOX');
+ALTER TABLE "Folder" ADD COLUMN "kind" "FolderKind" NOT NULL DEFAULT 'REGULAR';
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM "Folder"
+    WHERE "parentId" IS NULL AND "name" = 'Inbox' AND "archivedAt" IS NULL
+    GROUP BY "organizationId" HAVING count(*) > 1
+  ) THEN
+    RAISE EXCEPTION 'cannot identify system Inbox: organization has multiple active root Inbox folders';
+  END IF;
+END $$;
+
+UPDATE "Folder" f SET "kind" = 'SYSTEM_INBOX'
+WHERE f."parentId" IS NULL AND f."name" = 'Inbox' AND f."archivedAt" IS NULL;
+
+INSERT INTO "Folder" ("id", "organizationId", "parentId", "name", "kind", "sortKey", "createdAt", "updatedAt")
+SELECT o."id" || ':system-inbox', o."id", NULL, 'Inbox', 'SYSTEM_INBOX', '000000', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+FROM "Organization" o
+WHERE NOT EXISTS (
+  SELECT 1 FROM "Folder" f
+  WHERE f."organizationId" = o."id" AND f."kind" = 'SYSTEM_INBOX' AND f."archivedAt" IS NULL
+);
+
+CREATE UNIQUE INDEX "Folder_one_active_system_inbox_per_org"
+  ON "Folder"("organizationId") WHERE "kind" = 'SYSTEM_INBOX' AND "archivedAt" IS NULL;
+
+CREATE OR REPLACE FUNCTION cph_protect_system_inbox() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'UPDATE' AND OLD."kind" = 'SYSTEM_INBOX' AND (
+    NEW."id" IS DISTINCT FROM OLD."id" OR
+    NEW."organizationId" IS DISTINCT FROM OLD."organizationId" OR
+    NEW."kind" IS DISTINCT FROM OLD."kind" OR
+    NEW."name" IS DISTINCT FROM OLD."name" OR
+    NEW."parentId" IS DISTINCT FROM OLD."parentId" OR
+    NEW."archivedAt" IS DISTINCT FROM OLD."archivedAt"
+  ) THEN
+    RAISE EXCEPTION 'system Inbox identity cannot be changed';
+  END IF;
+  IF TG_OP IN ('INSERT', 'UPDATE') AND NEW."kind" = 'SYSTEM_INBOX' AND (
+    NEW."name" <> 'Inbox' OR NEW."parentId" IS NOT NULL OR NEW."archivedAt" IS NOT NULL
+  ) THEN
+    RAISE EXCEPTION 'system Inbox must be an active root folder named Inbox';
+  END IF;
+  IF TG_OP = 'DELETE' AND OLD."kind" = 'SYSTEM_INBOX' AND EXISTS (
+    SELECT 1 FROM "Organization" WHERE "id" = OLD."organizationId"
+  ) THEN
+    RAISE EXCEPTION 'system Inbox cannot be deleted while its organization exists';
+  END IF;
+  RETURN CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+END;
+$$;
+
+CREATE TRIGGER cph_protect_system_inbox
+BEFORE INSERT OR UPDATE OR DELETE ON "Folder"
+FOR EACH ROW EXECUTE FUNCTION cph_protect_system_inbox();
+
+ALTER TABLE "Project" ADD COLUMN "code" TEXT;
+
+CREATE TABLE "ProjectSearchDocument" (
+    "projectId" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "code" TEXT,
+    "normalizedCode" TEXT NOT NULL,
+    "normalizedName" TEXT NOT NULL,
+    "breadcrumb" TEXT NOT NULL,
+    "normalizedBreadcrumb" TEXT NOT NULL,
+    "normalizedSearchText" TEXT NOT NULL,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "ProjectSearchDocument_pkey" PRIMARY KEY ("projectId")
+);
+
+CREATE INDEX "ProjectSearchDocument_organizationId_idx" ON "ProjectSearchDocument"("organizationId");
+CREATE INDEX "ProjectSearchDocument_normalizedName_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedName" gin_trgm_ops);
+CREATE INDEX "ProjectSearchDocument_normalizedCode_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedCode" gin_trgm_ops);
+CREATE INDEX "ProjectSearchDocument_normalizedBreadcrumb_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedBreadcrumb" gin_trgm_ops);
+CREATE INDEX "ProjectSearchDocument_normalizedSearchText_trgm_idx"
+  ON "ProjectSearchDocument" USING GIN ("normalizedSearchText" gin_trgm_ops);
+
+ALTER TABLE "ProjectSearchDocument" ADD CONSTRAINT "ProjectSearchDocument_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "ProjectSearchDocument" ADD CONSTRAINT "ProjectSearchDocument_organizationId_fkey"
+  FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+CREATE OR REPLACE FUNCTION cph_project_search_normalize(value TEXT) RETURNS TEXT
+LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS $$
+  SELECT lower(regexp_replace(normalize(value, NFKC), '[[:space:]_.:/\\-]+', '', 'g'))
+$$;
+
+CREATE OR REPLACE FUNCTION cph_folder_breadcrumb(folder_id TEXT) RETURNS TEXT
+LANGUAGE sql STABLE PARALLEL SAFE AS $$
+  WITH RECURSIVE ancestors AS (
+    SELECT f."id", f."parentId", f."name", f."kind", 0 AS depth
+    FROM "Folder" f
+    WHERE f."id" = folder_id
+    UNION ALL
+    SELECT parent."id", parent."parentId", parent."name", parent."kind", child.depth + 1
+    FROM "Folder" parent
+    JOIN ancestors child ON parent."id" = child."parentId"
+  )
+  SELECT CASE
+    WHEN count(*) = 1 AND bool_and("kind" = 'SYSTEM_INBOX') THEN '未分类'
+    ELSE coalesce(string_agg("name", ' / ' ORDER BY depth DESC), '')
+  END
+  FROM ancestors
+$$;
+
+CREATE OR REPLACE FUNCTION cph_project_search_code(explicit_code TEXT, project_name TEXT) RETURNS TEXT
+LANGUAGE sql IMMUTABLE PARALLEL SAFE AS $$
+  SELECT CASE
+    WHEN explicit_code IS NOT NULL AND btrim(explicit_code) <> ''
+      THEN cph_project_search_normalize(explicit_code)
+    ELSE coalesce(substring(cph_project_search_normalize(project_name) FROM '^[a-z]+[0-9]+'), '')
+  END
+$$;
+
+CREATE OR REPLACE FUNCTION cph_refresh_project_search_document(target_project_id TEXT) RETURNS void
+LANGUAGE plpgsql AS $$
+BEGIN
+  INSERT INTO "ProjectSearchDocument" (
+    "projectId", "organizationId", "name", "code", "normalizedCode", "normalizedName",
+    "breadcrumb", "normalizedBreadcrumb", "normalizedSearchText", "updatedAt"
+  )
+  SELECT p."id", p."organizationId", p."name", p."code",
+    cph_project_search_code(p."code", p."name"),
+    cph_project_search_normalize(p."name"),
+    cph_folder_breadcrumb(p."folderId"),
+    cph_project_search_normalize(cph_folder_breadcrumb(p."folderId")),
+    cph_project_search_normalize(cph_folder_breadcrumb(p."folderId") || ' ' || p."name"),
+    CURRENT_TIMESTAMP
+  FROM "Project" p WHERE p."id" = target_project_id
+  ON CONFLICT ("projectId") DO UPDATE SET
+    "organizationId" = EXCLUDED."organizationId",
+    "name" = EXCLUDED."name",
+    "code" = EXCLUDED."code",
+    "normalizedCode" = EXCLUDED."normalizedCode",
+    "normalizedName" = EXCLUDED."normalizedName",
+    "breadcrumb" = EXCLUDED."breadcrumb",
+    "normalizedBreadcrumb" = EXCLUDED."normalizedBreadcrumb",
+    "normalizedSearchText" = EXCLUDED."normalizedSearchText",
+    "updatedAt" = CURRENT_TIMESTAMP;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION cph_project_search_project_trigger() RETURNS trigger
+LANGUAGE plpgsql AS $$
+BEGIN
+  PERFORM cph_refresh_project_search_document(NEW."id");
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER cph_project_search_project_changed
+AFTER INSERT OR UPDATE OF "name", "code", "folderId", "organizationId", "archivedAt" ON "Project"
+FOR EACH ROW EXECUTE FUNCTION cph_project_search_project_trigger();
+
+CREATE OR REPLACE FUNCTION cph_project_search_folder_trigger() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE project_id TEXT;
+BEGIN
+  FOR project_id IN
+    WITH RECURSIVE descendants AS (
+      SELECT NEW."id"
+      UNION ALL
+      SELECT child."id" FROM "Folder" child
+      JOIN descendants parent ON child."parentId" = parent."id"
+    )
+    SELECT p."id" FROM "Project" p
+    WHERE p."folderId" IN (SELECT "id" FROM descendants)
+  LOOP
+    PERFORM cph_refresh_project_search_document(project_id);
+  END LOOP;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER cph_project_search_folder_changed
+AFTER UPDATE OF "name", "kind", "parentId", "archivedAt" ON "Folder"
+FOR EACH ROW EXECUTE FUNCTION cph_project_search_folder_trigger();
+
+SELECT cph_refresh_project_search_document("id") FROM "Project";

hub/prisma/migrations/20260713170000_project_group_selected_role/migration.sql

@@ -0,0 +1,65 @@
+-- ADR-0017: roles are selected through the project-group control plane, not
+-- through slash-command names. Existing alpha Organizations keep draft as
+-- their configured default during migration; runtime code no longer hard-codes it.
+ALTER TABLE "OrganizationAgentRole"
+  ADD COLUMN "isDefault" BOOLEAN NOT NULL DEFAULT false;
+
+-- An Organization without any role was valid in the previous schema (the
+-- runtime failed closed later). Preserve the old alpha baseline so every
+-- existing binding can acquire a selected role during this migration.
+INSERT INTO "OrganizationAgentRole" (
+  "id", "organizationId", "roleId", "label", "sortOrder", "isDefault", "updatedAt"
+)
+SELECT organization."id" || ':agent-role:draft', organization."id", 'draft', '草稿', 10, true, CURRENT_TIMESTAMP
+FROM "Organization" organization
+WHERE NOT EXISTS (
+  SELECT 1 FROM "OrganizationAgentRole" role
+  WHERE role."organizationId" = organization."id" AND role."disabledAt" IS NULL
+);
+
+WITH ranked AS (
+  SELECT "id", row_number() OVER (
+    PARTITION BY "organizationId"
+    ORDER BY CASE WHEN "roleId" = 'draft' THEN 0 ELSE 1 END, "sortOrder", "roleId", "id"
+  ) AS position
+  FROM "OrganizationAgentRole"
+  WHERE "disabledAt" IS NULL
+)
+UPDATE "OrganizationAgentRole" role
+SET "isDefault" = (ranked.position = 1)
+FROM ranked
+WHERE role."id" = ranked."id";
+
+CREATE UNIQUE INDEX "OrganizationAgentRole_one_active_default_per_org"
+  ON "OrganizationAgentRole"("organizationId")
+  WHERE "isDefault" = true AND "disabledAt" IS NULL;
+
+ALTER TABLE "ProjectGroupBinding"
+  ADD COLUMN "selectedAgentRoleId" TEXT;
+
+UPDATE "ProjectGroupBinding" binding
+SET "selectedAgentRoleId" = role."id"
+FROM "Project" project
+JOIN "OrganizationAgentRole" role
+  ON role."organizationId" = project."organizationId"
+ AND role."isDefault" = true
+ AND role."disabledAt" IS NULL
+WHERE binding."projectId" = project."id";
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM "ProjectGroupBinding" WHERE "selectedAgentRoleId" IS NULL) THEN
+    RAISE EXCEPTION 'cannot migrate project-group bindings without an active default Agent role';
+  END IF;
+END $$;
+
+ALTER TABLE "ProjectGroupBinding"
+  ALTER COLUMN "selectedAgentRoleId" SET NOT NULL;
+
+CREATE INDEX "ProjectGroupBinding_selectedAgentRoleId_idx"
+  ON "ProjectGroupBinding"("selectedAgentRoleId");
+
+ALTER TABLE "ProjectGroupBinding"
+  ADD CONSTRAINT "ProjectGroupBinding_selectedAgentRoleId_fkey"
+  FOREIGN KEY ("selectedAgentRoleId") REFERENCES "OrganizationAgentRole"("id")
+  ON DELETE RESTRICT ON UPDATE CASCADE;

hub/prisma/migrations/20260713173000_project_group_role_tenant_scope/migration.sql

@@ -0,0 +1,41 @@
+-- ADR-0017 / ADR-0020: enforce the selected role's Organization at the
+-- database boundary. A role primary key alone cannot prove tenant scope.
+ALTER TABLE "ProjectGroupBinding"
+  ADD COLUMN "organizationId" TEXT;
+
+UPDATE "ProjectGroupBinding" binding
+SET "organizationId" = project."organizationId"
+FROM "Project" project
+WHERE project."id" = binding."projectId";
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM "ProjectGroupBinding" WHERE "organizationId" IS NULL) THEN
+    RAISE EXCEPTION 'cannot tenant-scope project-group binding without a project Organization';
+  END IF;
+END $$;
+
+ALTER TABLE "ProjectGroupBinding"
+  ALTER COLUMN "organizationId" SET NOT NULL;
+
+CREATE UNIQUE INDEX "Project_organizationId_id_key"
+  ON "Project"("organizationId", "id");
+
+ALTER TABLE "ProjectGroupBinding"
+  DROP CONSTRAINT "ProjectGroupBinding_projectId_fkey",
+  DROP CONSTRAINT "ProjectGroupBinding_selectedAgentRoleId_fkey";
+
+ALTER TABLE "ProjectGroupBinding"
+  ADD CONSTRAINT "ProjectGroupBinding_organizationId_fkey"
+    FOREIGN KEY ("organizationId") REFERENCES "Organization"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE,
+  ADD CONSTRAINT "ProjectGroupBinding_organizationId_projectId_fkey"
+    FOREIGN KEY ("organizationId", "projectId") REFERENCES "Project"("organizationId", "id")
+    ON DELETE CASCADE ON UPDATE CASCADE,
+  ADD CONSTRAINT "ProjectGroupBinding_organizationId_selectedAgentRoleId_fkey"
+    FOREIGN KEY ("organizationId", "selectedAgentRoleId")
+    REFERENCES "OrganizationAgentRole"("organizationId", "id")
+    ON DELETE RESTRICT ON UPDATE CASCADE;
+
+CREATE INDEX "ProjectGroupBinding_organizationId_idx"
+  ON "ProjectGroupBinding"("organizationId");

hub/prisma/migrations/20260713174500_agent_role_default_invariant/migration.sql

@@ -0,0 +1,31 @@
+-- ADR-0017: once an Organization starts configuring roles, every committed
+-- state must contain exactly one active default. The deferred trigger permits
+-- an atomic default switch while rejecting zero-default transitions.
+CREATE FUNCTION cph_enforce_agent_role_default() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  target_organization_id TEXT := COALESCE(NEW."organizationId", OLD."organizationId");
+  active_default_count INTEGER;
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM "Organization" WHERE "id" = target_organization_id) THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT count(*) INTO active_default_count
+  FROM "OrganizationAgentRole"
+  WHERE "organizationId" = target_organization_id
+    AND "isDefault" = true
+    AND "disabledAt" IS NULL;
+
+  IF active_default_count <> 1 THEN
+    RAISE EXCEPTION 'Organization % must have exactly one active default Agent role; found %',
+      target_organization_id, active_default_count;
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+CREATE CONSTRAINT TRIGGER "OrganizationAgentRole_exactly_one_active_default"
+AFTER INSERT OR UPDATE OR DELETE ON "OrganizationAgentRole"
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW EXECUTE FUNCTION cph_enforce_agent_role_default();

hub/prisma/migrations/20260713175000_agent_role_tenant_immutable/migration.sql

@@ -0,0 +1,30 @@
+-- Organization-owned role configuration cannot be re-parented. Besides being
+-- a tenant boundary, immutability ensures the deferred default-role invariant
+-- checks the same Organization before and after an update.
+CREATE OR REPLACE FUNCTION cph_enforce_agent_role_default() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  target_organization_id TEXT := COALESCE(NEW."organizationId", OLD."organizationId");
+  active_default_count INTEGER;
+BEGIN
+  IF TG_OP = 'UPDATE' AND NEW."organizationId" <> OLD."organizationId" THEN
+    RAISE EXCEPTION 'OrganizationAgentRole.organizationId is immutable';
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM "Organization" WHERE "id" = target_organization_id) THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT count(*) INTO active_default_count
+  FROM "OrganizationAgentRole"
+  WHERE "organizationId" = target_organization_id
+    AND "isDefault" = true
+    AND "disabledAt" IS NULL;
+
+  IF active_default_count <> 1 THEN
+    RAISE EXCEPTION 'Organization % must have exactly one active default Agent role; found %',
+      target_organization_id, active_default_count;
+  END IF;
+  RETURN NULL;
+END;
+$$;

hub/prisma/migrations/20260713175500_organization_requires_default_role/migration.sql

@@ -0,0 +1,25 @@
+-- ADR-0017's default-role function is total over Organizations. Enforce the
+-- other side of the invariant when an Organization itself is created.
+CREATE FUNCTION cph_enforce_organization_default_role() RETURNS trigger
+LANGUAGE plpgsql AS $$
+DECLARE
+  active_default_count INTEGER;
+BEGIN
+  SELECT count(*) INTO active_default_count
+  FROM "OrganizationAgentRole"
+  WHERE "organizationId" = NEW."id"
+    AND "isDefault" = true
+    AND "disabledAt" IS NULL;
+
+  IF active_default_count <> 1 THEN
+    RAISE EXCEPTION 'Organization % must have exactly one active default Agent role; found %',
+      NEW."id", active_default_count;
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+CREATE CONSTRAINT TRIGGER "Organization_requires_active_default_role"
+AFTER INSERT ON "Organization"
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW EXECUTE FUNCTION cph_enforce_organization_default_role();

hub/prisma/migrations/20260714120000_drop_legacy_platform_role_assignment/migration.sql

@@ -0,0 +1,20 @@
+-- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
+-- model: the platform administration control plane is a separate identity/session/
+-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
+-- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
+-- reader — no guard, route, or service queries it for an authorization decision —
+-- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.
+-- Drop the table, the `User.platformRoles` relation, and the enum.
+
+-- DropForeignKey
+ALTER TABLE "PlatformRoleAssignment" DROP CONSTRAINT "PlatformRoleAssignment_userId_fkey";
+
+-- DropIndex
+DROP INDEX IF EXISTS "PlatformRoleAssignment_userId_revokedAt_idx";
+DROP INDEX IF EXISTS "PlatformRoleAssignment_role_revokedAt_idx";
+
+-- DropTable
+DROP TABLE IF EXISTS "PlatformRoleAssignment";
+
+-- DropEnum
+DROP TYPE IF EXISTS "PlatformRole";

hub/prisma/migrations/20260714130000_organization_capacity_policy/migration.sql

@@ -0,0 +1,18 @@
+-- ADR-0022 layered capacity policy. Org admins may set per-dimension lower
+-- `organizationLimit` overrides; platform ceilings come from deployment config
+-- (see `src/capacity/ceilings.ts`). `limits` is a JSON map of
+-- CapacityDimension → number (only the set dimensions); service enforces
+-- `LayeredLimit.Valid` (org limit ≤ platform ceiling).
+
+-- CreateTable
+CREATE TABLE "OrganizationCapacityPolicy" (
+    "organizationId" TEXT NOT NULL,
+    "limits" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "OrganizationCapacityPolicy_pkey" PRIMARY KEY ("organizationId")
+);
+
+-- AddForeignKey
+ALTER TABLE "OrganizationCapacityPolicy" ADD CONSTRAINT "OrganizationCapacityPolicy_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/schema.prisma

@@ -37,6 +37,7 @@ model Organization {
 
   memberships                  OrganizationMembership[]
   projectSettings              OrganizationProjectSettings?
+  capacityPolicy               OrganizationCapacityPolicy?
   folders                      Folder[]
   projects                     Project[]
   teams                        Team[]
@@ -45,7 +46,9 @@ model Organization {
   feishuApplicationConnection  OrganizationFeishuApplicationConnection?
   agentSkills                  OrganizationAgentSkill[]
   agentRoles                   OrganizationAgentRole[]
-  auditEntries                 AuditEntry[]                    @relation("organizationAudit")
+  projectGroupBindings         ProjectGroupBinding[]
+  auditEntries                 AuditEntry[]                             @relation("organizationAudit")
+  projectSearchDocuments       ProjectSearchDocument[]
 
   @@index([status])
 }
@@ -56,8 +59,9 @@ enum OrganizationStatus {
   ARCHIVED
 }
 
-/// Org-scoped platform role. Distinct from project PermissionRole and from
+/// Org-scoped membership role. Distinct from project PermissionRole and from
-/// global PlatformRoleAssignment, which is reserved for SaaS/platform control.
+/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
+/// which is a separate control plane not modeled in alpha (ADR-0025).
 model OrganizationMembership {
   id             String                 @id @default(cuid())
   organizationId String
@@ -115,12 +119,14 @@ model OrganizationAgentRole {
   systemPrompt   String?
   tools          Json?
   sortOrder      Int       @default(0)
+  isDefault      Boolean   @default(false)
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  organization       Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  skillBindings OrganizationAgentRoleSkill[]
+  skillBindings      OrganizationAgentRoleSkill[]
+  selectedByBindings ProjectGroupBinding[]        @relation("selectedAgentRole")
 
   @@unique([organizationId, roleId])
   @@unique([organizationId, id])
@@ -131,10 +137,10 @@ model OrganizationAgentRole {
 /// gives stable skill listing and prompt discovery order for a role bundle.
 model OrganizationAgentRoleSkill {
   organizationId String
-  agentRoleId     String
+  agentRoleId    String
-  agentSkillId    String
+  agentSkillId   String
-  sortOrder       Int      @default(0)
+  sortOrder      Int      @default(0)
-  createdAt       DateTime @default(now())
+  createdAt      DateTime @default(now())
 
   role  OrganizationAgentRole  @relation(fields: [organizationId, agentRoleId], references: [organizationId, id], onDelete: Cascade)
   skill OrganizationAgentSkill @relation(fields: [organizationId, agentSkillId], references: [organizationId, id], onDelete: Cascade)
@@ -155,6 +161,20 @@ model OrganizationProjectSettings {
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 }
 
+/// ADR-0022 layered capacity policy. Org admins may set per-dimension lower
+/// limits; `limits` is a JSON map of CapacityDimension → number (only the set
+/// ones). Each set value must be ≤ the platform ceiling for that dimension
+/// (validated in service; spec `LayeredLimit.Valid`). Dimensions with no entry
+/// fall back to the platform ceiling (`LayeredLimit.effective`).
+model OrganizationCapacityPolicy {
+  organizationId String   @id
+  limits         Json
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+}
+
 /// A person known to the Hub. `feishuOpenId` remains a legacy compatibility
 /// key; new customer-app identities live in FeishuUserIdentity and store a
 /// connection-scoped opaque USER principal here instead of a raw open_id.
@@ -166,18 +186,17 @@ model User {
   createdAt    DateTime @default(now())
   updatedAt    DateTime @updatedAt
 
-  platformRoles                PlatformRoleAssignment[]
   organizationMemberships      OrganizationMembership[]
-  createdProjects              Project[]                     @relation("projectCreator")
+  createdProjects              Project[]                            @relation("projectCreator")
-  requestedRuns                AgentRun[]                    @relation("runRequester")
+  requestedRuns                AgentRun[]                           @relation("runRequester")
-  heldLocks                    ProjectAgentLock[]            @relation("lockHolder")
+  heldLocks                    ProjectAgentLock[]                   @relation("lockHolder")
-  feishuBindings               ProjectGroupBinding[]         @relation("bindingCreator")
+  feishuBindings               ProjectGroupBinding[]                @relation("bindingCreator")
   teamMemberships              TeamMembership[]
   externalPrincipalMemberships ExternalPrincipalMembership[]
-  permissionGrants             PermissionGrant[]             @relation("grantCreator")
+  permissionGrants             PermissionGrant[]                    @relation("grantCreator")
-  roleTriggerGrants            RoleTriggerGrant[]            @relation("roleGrantCreator")
+  roleTriggerGrants            RoleTriggerGrant[]                   @relation("roleGrantCreator")
-  auditEntries                 AuditEntry[]                  @relation("auditActor")
+  auditEntries                 AuditEntry[]                         @relation("auditActor")
-  providerCredentialVersions   ProviderCredentialVersion[]   @relation("providerCredentialVersionCreator")
+  providerCredentialVersions   ProviderCredentialVersion[]          @relation("providerCredentialVersionCreator")
   feishuCredentialVersions     FeishuApplicationCredentialVersion[] @relation("feishuCredentialVersionCreator")
   feishuIdentities             FeishuUserIdentity[]
 }
@@ -196,7 +215,7 @@ model OrganizationFeishuApplicationConnection {
   createdAt              DateTime                     @default(now())
   updatedAt              DateTime                     @updatedAt
 
-  organization        Organization                       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  organization        Organization                         @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   secretVersions      FeishuApplicationCredentialVersion[] @relation("feishuCredentialVersions")
   activeSecretVersion FeishuApplicationCredentialVersion?  @relation("activeFeishuCredentialVersion", fields: [activeSecretVersionId], references: [id], onDelete: Restrict)
   userIdentities      FeishuUserIdentity[]
@@ -228,19 +247,19 @@ model FeishuUserIdentity {
 /// ADR-0024: all Feishu app material, including provider-local app/bot ids, is
 /// inside one immutable authenticated envelope version.
 model FeishuApplicationCredentialVersion {
-  id              String   @id @default(cuid())
+  id              String    @id @default(cuid())
   connectionId    String
   version         Int
-  envelopeVersion Int      @default(1)
+  envelopeVersion Int       @default(1)
   keyId           String
   envelope        Json
   createdByUserId String?
-  createdAt       DateTime @default(now())
+  createdAt       DateTime  @default(now())
   retiredAt       DateTime?
 
   connection OrganizationFeishuApplicationConnection  @relation("feishuCredentialVersions", fields: [connectionId], references: [id], onDelete: Cascade)
   activeFor  OrganizationFeishuApplicationConnection? @relation("activeFeishuCredentialVersion")
-  createdBy  User?                                   @relation("feishuCredentialVersionCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  createdBy  User?                                    @relation("feishuCredentialVersionCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
 
   @@unique([connectionId, version])
   @@index([connectionId, retiredAt])
@@ -287,14 +306,14 @@ enum OrganizationConnectionStatus {
 /// per immutable version. keyId/envelopeVersion are redacted rotation metadata;
 /// all provider URL/token/API-key fields remain inside envelope ciphertext.
 model ProviderCredentialVersion {
-  id              String   @id @default(cuid())
+  id              String    @id @default(cuid())
   connectionId    String
   version         Int
-  envelopeVersion Int      @default(1)
+  envelopeVersion Int       @default(1)
   keyId           String
   envelope        Json
   createdByUserId String?
-  createdAt       DateTime @default(now())
+  createdAt       DateTime  @default(now())
   retiredAt       DateTime?
 
   connection OrganizationProviderConnection  @relation("providerCredentialVersions", fields: [connectionId], references: [id], onDelete: Cascade)
@@ -307,26 +326,6 @@ model ProviderCredentialVersion {
   @@index([createdByUserId])
 }
 
-/// Platform-level role (admin/teacher). Distinct from ADR-0004 PermissionRole.
-/// `admin` is the only override path for force-release (spec RequiresAdmin).
-model PlatformRoleAssignment {
-  id        String       @id @default(cuid())
-  userId    String
-  role      PlatformRole
-  createdAt DateTime     @default(now())
-  revokedAt DateTime?
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId, revokedAt])
-  @@index([role, revokedAt])
-}
-
-enum PlatformRole {
-  ADMIN
-  TEACHER
-}
-
 /// ADR-0019: typed principals for permission grants and actor resolution.
 /// USER and Feishu external principals use connection-scoped opaque ids, never
 /// raw provider-local ids; TEAM uses Hub Team.id.
@@ -437,14 +436,20 @@ model ExternalPrincipalMembership {
 /// ADR-0021: transparent project explorer folder. Folders are org-scoped
 /// navigation/aggregation nodes, not permission resources; project grants stay
 /// attached to PROJECT resources.
+enum FolderKind {
+  REGULAR
+  SYSTEM_INBOX
+}
+
 model Folder {
-  id             String    @id @default(cuid())
+  id             String     @id @default(cuid())
   organizationId String
   parentId       String?
   name           String
-  sortKey        String    @default("")
+  kind           FolderKind @default(REGULAR)
-  createdAt      DateTime  @default(now())
+  sortKey        String     @default("")
-  updatedAt      DateTime  @updatedAt
+  createdAt      DateTime   @default(now())
+  updatedAt      DateTime   @updatedAt
   archivedAt     DateTime?
 
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
@@ -460,6 +465,7 @@ model Project {
   id              String    @id @default(cuid())
   organizationId  String
   folderId        String?
+  code            String?
   name            String
   workspaceDir    String
   createdByUserId String?
@@ -467,39 +473,68 @@ model Project {
   updatedAt       DateTime  @updatedAt
   archivedAt      DateTime?
 
-  organization      Organization          @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  organization      Organization           @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  folder            Folder?               @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  folder            Folder?                @relation(fields: [folderId], references: [id], onDelete: SetNull)
-  createdBy         User?                 @relation("projectCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  createdBy         User?                  @relation("projectCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
   groupBindings     ProjectGroupBinding[]
   agentSessions     AgentSession[]
   agentRuns         AgentRun[]
   agentLock         ProjectAgentLock?
-  roleTriggerGrants RoleTriggerGrant[]    @relation("projectRoleGrants")
+  roleTriggerGrants RoleTriggerGrant[]     @relation("projectRoleGrants")
-  auditEntries      AuditEntry[]          @relation("projectAudit")
+  auditEntries      AuditEntry[]           @relation("projectAudit")
-  fileChanges       AgentFileChange[]     @relation("projectFileChanges")
+  fileChanges       AgentFileChange[]      @relation("projectFileChanges")
+  searchDocument    ProjectSearchDocument?
 
+  @@unique([organizationId, id])
   @@index([organizationId, archivedAt])
   @@index([folderId, archivedAt])
   @@index([archivedAt])
 }
 
+/// Derived, rebuildable search projection for project discovery. PostgreSQL
+/// triggers keep it synchronized with Project and Folder mutations; Project
+/// remains the source of truth and authorization remains outside this table.
+model ProjectSearchDocument {
+  projectId            String   @id
+  organizationId       String
+  name                 String
+  code                 String?
+  normalizedCode       String
+  normalizedName       String
+  breadcrumb           String
+  normalizedBreadcrumb String
+  normalizedSearchText String
+  updatedAt            DateTime @updatedAt
+
+  project      Project      @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId])
+}
+
 /// ADR-0001 + ADR-0021: active bindings are one project ↔ one Feishu chat
 /// (1:1). Historical archived bindings are retained for audit; partial unique
 /// indexes in migrations enforce one active binding per project and per chat.
 model ProjectGroupBinding {
-  id              String    @id @default(cuid())
+  id                  String    @id @default(cuid())
-  projectId       String
+  organizationId      String
-  chatId          String
+  projectId           String
-  createdByUserId String?
+  chatId              String
-  createdAt       DateTime  @default(now())
+  createdByUserId     String?
-  updatedAt       DateTime  @updatedAt
+  createdAt           DateTime  @default(now())
-  archivedAt      DateTime?
+  updatedAt           DateTime  @updatedAt
+  archivedAt          DateTime?
+  selectedAgentRoleId String
 
-  project   Project @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  organization Organization          @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  createdBy User?   @relation("bindingCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  project      Project               @relation(fields: [organizationId, projectId], references: [organizationId, id], onDelete: Cascade)
+  createdBy    User?                 @relation("bindingCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+  selectedRole OrganizationAgentRole @relation("selectedAgentRole", fields: [organizationId, selectedAgentRoleId], references: [organizationId, id], onDelete: Restrict)
 
+  @@index([organizationId])
   @@index([projectId, archivedAt])
   @@index([chatId, archivedAt])
+  @@index([selectedAgentRoleId])
 }
 
 // --- AgentRun, session, lock (ADR-0002, 0017) -----------------------------
@@ -607,8 +642,9 @@ model ProjectAgentLock {
 // --- Permission grants & settings (ADR-0004) ----------------------------
 
 /// ADR-0004 PermissionRole: read ⊂ edit ⊂ manage (capability lattice).
-/// Distinct from PlatformRole. Force-release is admin-only, outside this
+/// Force-release is platform-admin-only, outside this lattice (spec
-/// lattice (spec RequiresAdmin).
+/// RequiresAdmin); platform admin is a separate control plane (ADR-0023),
+/// not modeled in alpha (ADR-0025).
 enum PermissionRole {
   READ
   EDIT
@@ -697,17 +733,17 @@ model RoleTriggerGrant {
 /// spec AuditEntry: minimal skeleton — one entry relates to a run. Event type,
 /// actor, timestamp, details are OPEN. This table mirrors that: `runId` is the
 model AuditEntry {
-  id          String   @id @default(cuid())
+  id             String   @id @default(cuid())
-  runId       String?
+  runId          String?
-  projectId   String?
+  projectId      String?
   organizationId String?
-  actorUserId String?
+  actorUserId    String?
-  action      String
+  action         String
-  metadata    Json
+  metadata       Json
-  createdAt   DateTime @default(now())
+  createdAt      DateTime @default(now())
 
-  actor   User?    @relation("auditActor", fields: [actorUserId], references: [id], onDelete: SetNull)
+  actor        User?         @relation("auditActor", fields: [actorUserId], references: [id], onDelete: SetNull)
-  project Project? @relation("projectAudit", fields: [projectId], references: [id], onDelete: SetNull)
+  project      Project?      @relation("projectAudit", fields: [projectId], references: [id], onDelete: SetNull)
   organization Organization? @relation("organizationAudit", fields: [organizationId], references: [id], onDelete: SetNull)
 
   @@index([runId])

hub/scripts/dev-bootstrap-silo.ts

@@ -0,0 +1,76 @@
+/**
+ * Local dev bootstrap for an Alpha Silo on Windows / non-systemd hosts.
+ *
+ * The production bootstrap-silo CLI is Linux-only (requires root uid 0,
+ * systemctl, root-owned files). This script calls the same
+ * `bootstrapAlphaSilo` invariants directly, sourcing credentials from the
+ * local `.env` and the dev keyring. Idempotent: re-running is a no-op once
+ * the Silo Organization exists.
+ *
+ * Usage: npx tsx scripts/dev-bootstrap-silo.ts
+ */
+import "dotenv/config";
+import { PrismaClient } from "@prisma/client";
+import { bootstrapAlphaSilo } from "../src/deployment/bootstrap-silo.js";
+import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
+
+function requiredEnv(name: string): string {
+  const v = process.env[name]?.trim();
+  if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
+  return v;
+}
+
+async function main(): Promise<void> {
+  const databaseUrl = requiredEnv("DATABASE_URL");
+  const keyring = await loadLocalSecretKeyring();
+  const secrets = new LocalSecretEnvelope(keyring);
+  const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
+
+  const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
+  const feishuAppId = requiredEnv("FEISHU_APP_ID");
+  const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
+  const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
+  const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
+  const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
+  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
+
+  try {
+    const result = await bootstrapAlphaSilo(
+      prisma,
+      secrets,
+      {
+        organization: {
+          id: organizationId,
+          slug: "local-dev",
+          name: "Local Dev Silo",
+        },
+        owner: {
+          openId: feishuBotOpenId,
+          displayName: "Local Dev Owner",
+        },
+        feishu: {
+          appId: feishuAppId,
+          appSecret: feishuAppSecret,
+          botOpenId: feishuBotOpenId,
+        },
+        provider: {
+          providerId: "openrouter",
+          baseUrl: providerBaseUrl,
+          authToken: providerAuthToken,
+          ...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
+        },
+      },
+      // Skip live network probes in local dev — Feishu/OpenRouter reachability
+      // is not required to seed the encrypted envelope rows.
+      { feishu: async () => {}, provider: async () => {} },
+    );
+    console.log("bootstrap result:", JSON.stringify(result, null, 2));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error("[dev-bootstrap-silo] failed:", error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

hub/scripts/dev-seed-connections.ts

@@ -0,0 +1,84 @@
+/**
+ * Local dev seed for an existing Organization that predates the ADR-0024
+ * secret-envelope plane (e.g. the legacy `org_default` from the tenant-root
+ * migration). Creates ACTIVE Feishu Application + Provider (BYOK openrouter)
+ * connections with encrypted envelopes, using the local dev keyring.
+ *
+ * Idempotent: re-running rotates a new secret version if the connection
+ * already exists.
+ *
+ * Usage: npx tsx scripts/dev-seed-connections.ts
+ */
+import "dotenv/config";
+import { PrismaClient } from "@prisma/client";
+import { FeishuApplicationConnectionService } from "../src/connections/feishuApplicationConnections.js";
+import { ProviderConnectionService } from "../src/connections/providerConnections.js";
+import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
+
+function requiredEnv(name: string): string {
+  const v = process.env[name]?.trim();
+  if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
+  return v;
+}
+
+async function main(): Promise<void> {
+  const databaseUrl = requiredEnv("DATABASE_URL");
+  const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
+  const keyring = await loadLocalSecretKeyring();
+  const secrets = new LocalSecretEnvelope(keyring);
+  const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
+
+  const feishuAppId = requiredEnv("FEISHU_APP_ID");
+  const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
+  const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
+  const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
+  const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
+  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
+
+  // Pick an existing active OWNER/ADMIN as the actor for the audit rows.
+  const actor = await prisma.organizationMembership.findFirst({
+    where: { organizationId, role: { in: ["OWNER", "ADMIN"] }, revokedAt: null },
+    select: { userId: true },
+  });
+  if (actor === null) throw new Error(`no active OWNER/ADMIN membership on ${organizationId}; seed a member first`);
+  const actorUserId = actor.userId;
+  console.log("actor:", actorUserId);
+
+  try {
+    const feishuService = new FeishuApplicationConnectionService(
+      prisma,
+      secrets,
+      async () => {}, // skip live Feishu probe in local dev
+    );
+    const feishuResult = await feishuService.rotateCustomerApplication({
+      organizationId,
+      actorUserId,
+      appId: feishuAppId,
+      appSecret: feishuAppSecret,
+      botOpenId: feishuBotOpenId,
+    });
+    console.log("feishu connection:", JSON.stringify(feishuResult, null, 2));
+
+    const providerService = new ProviderConnectionService(
+      prisma,
+      secrets,
+      async () => {}, // skip live OpenRouter probe in local dev
+    );
+    const providerResult = await providerService.rotateByok({
+      organizationId,
+      actorUserId,
+      providerId: "openrouter",
+      baseUrl: providerBaseUrl,
+      authToken: providerAuthToken,
+      ...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
+    });
+    console.log("provider connection:", JSON.stringify(providerResult, null, 2));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error: unknown) => {
+  console.error("[dev-seed-connections] failed:", error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

hub/src/admin/auth/guards.ts

@@ -10,8 +10,10 @@ import {
   verifySession,
   type SessionPayload,
 } from "./session.js";
+import { createPermissionAuthorizer, type AuthorizationAction } from "../../permissions/authorizer.js";
 
 export const ORG_ADMIN_ROLES: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN"];
+const ANY_ORG_ROLE: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN", "MEMBER"];
 
 export interface AuthContext {
   readonly session: SessionPayload;
@@ -175,3 +177,55 @@ export async function sendError(
 ): Promise<void> {
   await reply.status(statusCode).send({ error: { code, message } });
 }
+
+export interface ProjectAuthContext extends OrgAuthContext {
+  readonly projectId: string;
+}
+
+/**
+ * Resolve an org member (any role) viewing/mutating a project in their org, then
+ * enforce project-level permission via the PermissionGrant authorizer.
+ *
+ * `allowOrgAdminOversight=true` lets org OWNER/ADMIN through without a project
+ * grant — reserved for *read* oversight (listing/viewing). Mutations that the
+ * spec pins to project `manage` (e.g. `collaborator.manage`) must pass
+ * `allowOrgAdminOversight=false`: org role alone is not a project authorization
+ * root (spec `Permission.lean` / ADR-0004; the only out-of-role override is
+ * platform-admin force-release `RequiresAdmin`, not org admin).
+ */
+export async function requireProjectPermission(
+  request: FastifyRequest,
+  reply: FastifyReply,
+  deps: GuardDeps,
+  options: {
+    readonly orgSlug: string;
+    readonly projectId: string;
+    readonly action: AuthorizationAction;
+    readonly allowOrgAdminOversight: boolean;
+  },
+): Promise<ProjectAuthContext | null> {
+  const auth = await requireOrgRole(request, reply, deps, {
+    orgSlug: options.orgSlug,
+    roles: ANY_ORG_ROLE,
+  });
+  if (auth === null) return null;
+  await requireOrgProject(deps, auth.organization.id, options.projectId);
+  if (options.allowOrgAdminOversight && ORG_ADMIN_ROLES.includes(auth.membershipRole)) {
+    return { ...auth, projectId: options.projectId };
+  }
+  const decision = await createPermissionAuthorizer(deps.prisma).can({
+    actor: { feishuOpenId: auth.feishuOpenId },
+    action: options.action,
+    resource: { type: "PROJECT", id: options.projectId },
+  });
+  if (!decision.allowed) {
+    await sendError(
+      reply,
+      403,
+      "forbidden",
+      `project ${options.projectId} requires ${decision.requiredRole} (${options.action}): ${decision.reason}`,
+    );
+    return null;
+  }
+  return { ...auth, projectId: options.projectId };
+}

hub/src/admin/errors.ts

@@ -35,9 +35,11 @@ export async function handleRouteError(reply: FastifyReply, err: unknown): Promi
       await sendError(reply, mapped.statusCode, mapped.code, mapped.message);
       return;
     }
+    reply.log.error({ err }, "unmapped route error");
     await sendError(reply, 500, "internal_error", "internal error");
     return;
   }
+  reply.log.error({ err }, "unmapped route error");
   await sendError(reply, 500, "internal_error", "internal error");
 }
 
@@ -71,7 +73,8 @@ function mapDomainError(message: string): { statusCode: number; code: string; me
     lower.includes("is required") ||
     lower.includes("already") ||
     lower.includes("invalid") ||
-    lower.includes("accepts only")
+    lower.includes("accepts only") ||
+    lower.includes("must be")
   ) {
     return { statusCode: 400, code: "bad_request", message };
   }

hub/src/admin/plugin.ts

@@ -1,11 +1,12 @@
 /**
- * Registers org-admin HTTP surface: auth, org APIs, (later) static SPA.
+ * Registers org-admin HTTP surface: auth, org APIs, and the static SPA shell.
  */
 import cookie from "@fastify/cookie";
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
 import { registerAuthRoutes } from "./routes/authRoutes.js";
 import { registerOrgRoutes } from "./routes/orgRoutes.js";
+import { registerStaticSpa } from "./static.js";
 import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../connections/feishuReadiness.js";
@@ -62,4 +63,7 @@ export async function registerAdminPlugin(
       ? { feishuConnectionReadinessProbe: config.feishuConnectionReadinessProbe }
       : {}),
   });
+
+  // After API + /admin/login so SPA fallback does not shadow auth routes.
+  await registerStaticSpa(app);
 }

hub/src/admin/routes/accessRoutes.ts

@@ -5,7 +5,7 @@ import {
   listProjectTeamAccess,
   revokeTeamProjectAccess,
 } from "../../permissions/projectTeamAccess.js";
-import { requireOrgProject, requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { requireProjectPermission, type GuardDeps } from "../auth/guards.js";
 import { handleRouteError } from "../errors.js";
 
 const ROLES: readonly PermissionRole[] = ["READ", "EDIT", "MANAGE"];
@@ -19,9 +19,13 @@ export async function registerAccessRoutes(
   app.get("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "project.read",
+        allowOrgAdminOversight: true,
+      });
       if (auth === null) return;
-      await requireOrgProject(guardDeps, auth.organization.id, projectId);
       return { access: await listProjectTeamAccess(config.prisma, projectId) };
     } catch (err) {
       return handleRouteError(reply, err);
@@ -31,9 +35,13 @@ export async function registerAccessRoutes(
   app.put("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "collaborator.manage",
+        allowOrgAdminOversight: false,
+      });
       if (auth === null) return;
-      await requireOrgProject(guardDeps, auth.organization.id, projectId);
       const body = request.body as {
         teamId?: unknown;
         teamSlug?: unknown;
@@ -67,9 +75,13 @@ export async function registerAccessRoutes(
           projectId: string;
           teamId: string;
         };
-        const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+        const auth = await requireProjectPermission(request, reply, guardDeps, {
+          orgSlug,
+          projectId,
+          action: "collaborator.manage",
+          allowOrgAdminOversight: false,
+        });
         if (auth === null) return;
-        await requireOrgProject(guardDeps, auth.organization.id, projectId);
         const count = await revokeTeamProjectAccess(config.prisma, { projectId, teamId });
         return { revoked: count };
       } catch (err) {

hub/src/admin/routes/capacityRoutes.ts

@@ -0,0 +1,64 @@
+/**
+ * Org-admin capacity policy routes (ADR-0022).
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { FastifyInstance } from "fastify";
+import { getCapacityPolicy, setCapacityPolicy } from "../../org/capacityPolicy.js";
+import { isCapacityDimension } from "../../capacity/dimensions.js";
+import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { handleRouteError } from "../errors.js";
+
+export async function registerCapacityRoutes(
+  app: FastifyInstance,
+  config: { readonly prisma: PrismaClient; readonly sessionSecret: string },
+): Promise<void> {
+  const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
+
+  app.get("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      return await getCapacityPolicy(config.prisma, auth.organization.id);
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { limits?: unknown };
+      if (body?.limits === null || typeof body.limits !== "object") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "limits object is required" },
+        });
+      }
+      const limits: Record<string, number | null> = {};
+      for (const [key, value] of Object.entries(body.limits as Record<string, unknown>)) {
+        if (!isCapacityDimension(key)) {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: `unknown capacity dimension: ${key}` },
+          });
+        }
+        if (value === null) {
+          limits[key] = null;
+        } else if (typeof value === "number" && Number.isFinite(value)) {
+          limits[key] = value;
+        } else {
+          return reply.status(400).send({
+            error: { code: "bad_request", message: `limit for ${key} must be a number or null` },
+          });
+        }
+      }
+      return await setCapacityPolicy(config.prisma, {
+        organizationId: auth.organization.id,
+        limits,
+      });
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+}

hub/src/admin/routes/explorerRoutes.ts

@@ -10,13 +10,15 @@ import {
   createOrgFolder,
   createOrgProject,
   getOrgProjectDetail,
+  listMyProjects,
   listOrgExplorer,
   moveOrgProjectToFolder,
   renameFolder,
   renameProject,
 } from "../../org/explorer.js";
-import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { requireOrgRole, requireProjectPermission, ORG_ADMIN_ROLES, type GuardDeps } from "../auth/guards.js";
 import { handleRouteError } from "../errors.js";
+import { createPermissionAuthorizer } from "../../permissions/authorizer.js";
 
 export interface ExplorerRouteConfig {
   readonly prisma: PrismaClient;
@@ -41,6 +43,24 @@ export async function registerExplorerRoutes(
     }
   });
 
+  app.get("/api/org/:orgSlug/my-projects", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, {
+        orgSlug,
+        roles: ["OWNER", "ADMIN", "MEMBER"],
+      });
+      if (auth === null) return;
+      const projects = await listMyProjects(config.prisma, {
+        organizationId: auth.organization.id,
+        actorFeishuOpenId: auth.feishuOpenId,
+      });
+      return { projects };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
   app.post("/api/org/:orgSlug/folders", async (request, reply) => {
     try {
       const { orgSlug } = request.params as { orgSlug: string };
@@ -144,12 +164,27 @@ export async function registerExplorerRoutes(
   app.get("/api/org/:orgSlug/projects/:projectId", async (request, reply) => {
     try {
       const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireProjectPermission(request, reply, guardDeps, {
+        orgSlug,
+        projectId,
+        action: "project.read",
+        allowOrgAdminOversight: true,
+      });
       if (auth === null) return;
-      return await getOrgProjectDetail(config.prisma, {
+      const detail = await getOrgProjectDetail(config.prisma, {
         organizationId: auth.organization.id,
         projectId,
       });
+      const manageDecision = await createPermissionAuthorizer(config.prisma).can({
+        actor: { feishuOpenId: auth.feishuOpenId },
+        action: "collaborator.manage",
+        resource: { type: "PROJECT", id: projectId },
+      });
+      return {
+        ...detail,
+        actorIsOrgAdmin: ORG_ADMIN_ROLES.includes(auth.membershipRole),
+        actorCanManageProject: manageDecision.allowed,
+      };
     } catch (err) {
       return handleRouteError(reply, err);
     }

hub/src/admin/routes/orgRoutes.ts

@@ -15,6 +15,7 @@ import { registerMembersRoutes } from "./membersRoutes.js";
 import { registerSessionsAndUsageRoutes } from "./sessionsRoutes.js";
 import { registerTeamsRoutes } from "./teamsRoutes.js";
 import { registerProviderConnectionRoutes } from "./providerConnectionRoutes.js";
+import { registerCapacityRoutes } from "./capacityRoutes.js";
 import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../../connections/feishuReadiness.js";
@@ -105,6 +106,10 @@ export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteCo
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,
   });
+  await registerCapacityRoutes(app, {
+    prisma: config.prisma,
+    sessionSecret: config.sessionSecret,
+  });
   await registerSessionsAndUsageRoutes(app, {
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,

hub/src/admin/routes/teamsRoutes.ts

@@ -18,10 +18,16 @@ export async function registerTeamsRoutes(
 ): Promise<void> {
   const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
 
+  // Read-only listing is open to any active org member so project MANAGE
+  // holders can pick a team when granting TEAM→PROJECT access (ADR-0004).
+  // Mutations below stay org-admin only.
   app.get("/api/org/:orgSlug/teams", async (request, reply) => {
     try {
       const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireOrgRole(request, reply, guardDeps, {
+        orgSlug,
+        roles: ["OWNER", "ADMIN", "MEMBER"],
+      });
       if (auth === null) return;
       return { teams: await listOrgTeams(config.prisma, auth.organization.id) };
     } catch (err) {
@@ -34,7 +40,7 @@ export async function registerTeamsRoutes(
       const { orgSlug } = request.params as { orgSlug: string };
       const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
       if (auth === null) return;
-      const body = request.body as { slug?: unknown; name?: unknown; description?: unknown };
+      const body = (request.body ?? {}) as { slug?: unknown; name?: unknown; description?: unknown };
       if (typeof body.slug !== "string" || typeof body.name !== "string") {
         return reply.status(400).send({
           error: { code: "bad_request", message: "slug and name are required" },

hub/src/admin/static.ts

@@ -0,0 +1,82 @@
+/**
+ * Serves the org-admin SPA (built by SvelteKit via `admin-web/build/`) and
+ * the SPA index fallback for client-side routes under `/admin/*`.
+ *
+ * The SvelteKit project lives in `hub/admin-web/`. Run `npm run build` there
+ * to produce the static output in `admin-web/build/`. In development, use
+ * `npm run dev` in `admin-web/` which proxies `/api` and `/auth` to the Hub.
+ *
+ * Override the UI directory with `CPH_ADMIN_UI_DIR` env if needed.
+ */
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, extname, join, resolve as resolvePath } from "node:path";
+import type { FastifyInstance } from "fastify";
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".json": "application/json; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+};
+
+function resolveUiDir(): string {
+  const override = process.env["CPH_ADMIN_UI_DIR"];
+  if (override && override.trim() !== "") return resolvePath(override);
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolvePath(join(here, "..", "..", "admin-web", "build"));
+}
+
+export async function registerStaticSpa(app: FastifyInstance): Promise<void> {
+  const uiDir = resolveUiDir();
+  if (!existsSync(join(uiDir, "index.html"))) {
+    app.log.warn(
+      { uiDir },
+      "admin-web/build not found; SPA shell disabled. Run `npm run build` in admin-web/ to enable. Org admin APIs remain fully functional.",
+    );
+    return;
+  }
+  const indexHtml = await readFile(join(uiDir, "index.html"), "utf8");
+
+  // SvelteKit static assets (_app/*, favicon, etc.)
+  app.get("/_app/*", async (request, reply) => {
+    const rel = (request.params as { "*": string })["*"];
+    const safe = rel.split("/").filter((p) => p !== ".." && p !== "").join("/");
+    try {
+      const buf = await readFile(join(uiDir, "_app", safe));
+      const mime = MIME[extname(safe)] ?? "application/octet-stream";
+      return reply.type(mime).send(buf);
+    } catch {
+      return reply.status(404).send({ error: { code: "not_found", message: "asset not found" } });
+    }
+  });
+
+  // Other top-level static assets (favicon.svg, robots.txt, etc.)
+  app.get("/favicon.svg", async (_request, reply) => {
+    try {
+      const buf = await readFile(join(uiDir, "favicon.svg"));
+      return reply.type("image/svg+xml").send(buf);
+    } catch {
+      return reply.status(404).send();
+    }
+  });
+
+  // SPA client-side route fallback. Auth registers `/admin/login` first so it
+  // takes precedence; everything else under /admin/* serves the index so
+  // SvelteKit's client-side router can resolve the view.
+  app.get("/admin", async (_request, reply) => {
+    return reply.type("text/html; charset=utf-8").send(indexHtml);
+  });
+  app.get("/admin/*", async (_request, reply) => {
+    return reply.type("text/html; charset=utf-8").send(indexHtml);
+  });
+}

hub/src/agent/configuration.ts

@@ -89,6 +89,7 @@ export class OrganizationAgentConfiguration {
     readonly systemPrompt?: string | null | undefined;
     readonly tools?: readonly string[] | null | undefined;
     readonly sortOrder?: number | undefined;
+    readonly isDefault?: boolean | undefined;
   }): Promise<{ readonly id: string; readonly roleId: string }> {
     await this.requireActiveOrganization(input.organizationId);
     if (!ROLE_ID_PATTERN.test(input.roleId)) throw new Error(`invalid role id: ${input.roleId}`);
@@ -107,8 +108,22 @@ export class OrganizationAgentConfiguration {
     return this.prisma.$transaction(async (tx) => {
       const previous = await tx.organizationAgentRole.findUnique({
         where: { organizationId_roleId: { organizationId: input.organizationId, roleId: input.roleId } },
-        select: { defaultModel: true, systemPrompt: true, tools: true },
+        select: { defaultModel: true, systemPrompt: true, tools: true, isDefault: true },
       });
+      const currentDefault = await tx.organizationAgentRole.findFirst({
+        where: { organizationId: input.organizationId, isDefault: true, disabledAt: null },
+        select: { id: true },
+      });
+      const effectiveIsDefault = input.isDefault ?? previous?.isDefault ?? (currentDefault === null);
+      if (input.isDefault === false && previous?.isDefault === true) {
+        throw new Error("cannot unset the active default role without selecting a replacement");
+      }
+      if (effectiveIsDefault) {
+        await tx.organizationAgentRole.updateMany({
+          where: { organizationId: input.organizationId, isDefault: true },
+          data: { isDefault: false },
+        });
+      }
       const role = await tx.organizationAgentRole.upsert({
         where: {
           organizationId_roleId: {
@@ -124,6 +139,7 @@ export class OrganizationAgentConfiguration {
           systemPrompt: normalizeOptionalText(input.systemPrompt),
           tools: createTools,
           sortOrder,
+          isDefault: effectiveIsDefault,
         },
         update: {
           label,
@@ -131,6 +147,7 @@ export class OrganizationAgentConfiguration {
           ...(input.systemPrompt !== undefined ? { systemPrompt: normalizeOptionalText(input.systemPrompt) } : {}),
           ...(updateTools !== undefined ? { tools: updateTools } : {}),
           sortOrder,
+          isDefault: effectiveIsDefault,
           disabledAt: null,
         },
         select: { id: true, roleId: true },
@@ -140,6 +157,12 @@ export class OrganizationAgentConfiguration {
         (input.systemPrompt !== undefined && normalizeOptionalText(input.systemPrompt) !== previous.systemPrompt) ||
         (input.tools !== undefined && JSON.stringify(input.tools) !== JSON.stringify(previous.tools))
       );
+      const activeDefaultCount = await tx.organizationAgentRole.count({
+        where: { organizationId: input.organizationId, isDefault: true, disabledAt: null },
+      });
+      if (activeDefaultCount !== 1) {
+        throw new Error(`organization ${input.organizationId} must have exactly one active default role`);
+      }
       if (executionSurfaceChanged) await archiveRoleSessions(tx, input.organizationId, [input.roleId]);
       await tx.auditEntry.create({
         data: {
@@ -154,6 +177,8 @@ export class OrganizationAgentConfiguration {
               : normalizeOptionalText(input.systemPrompt) !== null,
             tools: input.tools === undefined ? "unchanged" : input.tools === null ? "all" : [...input.tools],
             sortOrder,
+            isDefault: effectiveIsDefault,
+            defaultExplicit: input.isDefault !== undefined,
           },
         },
       });
@@ -237,14 +262,26 @@ async function archiveRoleSessions(
   roleIds: readonly string[],
 ): Promise<void> {
   if (roleIds.length === 0) return;
-  await tx.agentSession.updateMany({
+  const sessions = await tx.agentSession.findMany({
     where: {
       roleId: { in: [...new Set(roleIds)] },
-      archivedAt: null,
       project: { organizationId },
     },
-    data: { archivedAt: new Date() },
+    select: { id: true, archivedAt: true, metadata: true },
   });
+  const archivedAt = new Date();
+  for (const session of sessions) {
+    const metadata = typeof session.metadata === "object" && session.metadata !== null && !Array.isArray(session.metadata)
+      ? session.metadata as Prisma.JsonObject
+      : {};
+    await tx.agentSession.update({
+      where: { id: session.id },
+      data: {
+        ...(session.archivedAt === null ? { archivedAt } : {}),
+        metadata: { ...metadata, userResumable: false },
+      },
+    });
+  }
 }
 
 function nonEmpty(value: string, label: string): string {

hub/src/agent/models.ts

@@ -12,8 +12,8 @@
  * A named role preset — the full per-run agent bundle. Roles are **data**, not
  * a code enum: admin/teachers define them (ADR-0017: role-based routing is
  * product config, not a spec invariant). `roleId` is an opaque string and
- * doubles as the slash-command name (`/draft ...`) — the registry holds the
+ * is selected through the project console — the registry holds the role set,
- * role set, so new roles are added by configuration, not by editing code.
+ * so new roles are added by configuration, not by editing code.
  *
  * A role bundles everything that distinguishes one agent persona from another:
  * model, system prompt, and the tool surface (files / cph / feishu / skills /

hub/src/agent/runner.ts

@@ -293,6 +293,9 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
         case "result": {
           const result = message as SDKResultMessage;
           sdkSessionId = result.session_id;
+          if (result.subtype === "success" && fullText === "" && typeof result.result === "string") {
+            fullText = result.result;
+          }
           costUsd = Number.isFinite(result.total_cost_usd) ? result.total_cost_usd : undefined;
           if (result.subtype !== "success") {
             error = `result_${result.subtype}`;

hub/src/capacity/ceilings.ts

@@ -0,0 +1,78 @@
+/**
+ * ADR-0022 platform ceilings (spec `LayeredLimit.platformCeiling`).
+ *
+ * Platform ceilings are the unbreakable upper bounds; org policy may only
+ * configure lower limits (see `LayeredLimit.Valid`). Exact numeric values are
+ * `OPEN` per spec and calibrated by capacity testing — this module is the
+ * single place to wire them.
+ *
+ * Seven dimensions are sourced from existing runtime env vars
+ * (`HUB_HTTP_BODY_LIMIT_BYTES`, `HUB_MAX_FILES_PER_MESSAGE`, `HUB_MAX_FILE_BYTES`,
+ * `HUB_HTTP_REQUESTS_PER_MINUTE`, `HUB_AGENT_MAX_CONCURRENT_RUNS`,
+ * `HUB_AGENT_MAX_RUN_SECONDS`, `HUB_AGENT_MAX_TURNS`). The remaining dimensions
+ * are sourced from `HUB_CEILING_<DIMENSION>` env vars; until those are set the
+ * dimension has no configured ceiling and the policy UI surfaces it as
+ * "未配置" (cannot enforce a limit without a ceiling).
+ */
+import type { CapacityDimension } from "./dimensions.js";
+
+function positiveIntEnv(name: string): number | undefined {
+  const raw = process.env[name];
+  if (raw === undefined || raw === "") return undefined;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+
+const ENV_BACKED_CEILINGS: Partial<Record<CapacityDimension, string>> = {
+  requestBodySize: "HUB_HTTP_BODY_LIMIT_BYTES",
+  attachmentCount: "HUB_MAX_FILES_PER_MESSAGE",
+  fileSize: "HUB_MAX_FILE_BYTES",
+  requestRate: "HUB_HTTP_REQUESTS_PER_MINUTE",
+  agentConcurrency: "HUB_AGENT_MAX_CONCURRENT_RUNS",
+  runWallTime: "HUB_AGENT_MAX_RUN_SECONDS",
+  runTurns: "HUB_AGENT_MAX_TURNS",
+};
+
+const CEILING_DIMENSIONS: readonly CapacityDimension[] = [
+  "requestRate",
+  "requestBodySize",
+  "agentConcurrency",
+  "admissionQueueLength",
+  "admissionQueueWait",
+  "fileSize",
+  "attachmentCount",
+  "archiveExpansion",
+  "projectStorage",
+  "organizationStorage",
+  "memberCount",
+  "projectCount",
+  "teamCount",
+  "folderCount",
+  "sessionCount",
+  "runWallTime",
+  "runTurns",
+  "runToolCalls",
+  "toolWallTime",
+  "runOutputSize",
+  "processMemory",
+  "processCpu",
+  "processCount",
+];
+
+function envNameFor(dimension: CapacityDimension): string {
+  return ENV_BACKED_CEILINGS[dimension] ?? `HUB_CEILING_${dimension.toUpperCase()}`;
+}
+
+/**
+ * Returns the configured platform ceilings (only the dimensions currently
+ * wired via env). Unconfigured dimensions are absent — callers must surface
+ * them, not assume unlimited (spec `LayeredLimit` forbids unlimited ceilings).
+ */
+export function readPlatformCeilings(): Partial<Record<CapacityDimension, number>> {
+  const ceilings: Partial<Record<CapacityDimension, number>> = {};
+  for (const dimension of CEILING_DIMENSIONS) {
+    const value = positiveIntEnv(envNameFor(dimension));
+    if (value !== undefined) ceilings[dimension] = value;
+  }
+  return ceilings;
+}

hub/src/capacity/dimensions.ts

@@ -0,0 +1,63 @@
+/**
+ * ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
+ * The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
+ * capacity testing. This module is the single source of the dimension set shared
+ * by the platform-ceiling config and the org capacity-policy service.
+ */
+export const CAPACITY_DIMENSIONS = [
+  "requestRate",
+  "requestBodySize",
+  "agentConcurrency",
+  "admissionQueueLength",
+  "admissionQueueWait",
+  "fileSize",
+  "attachmentCount",
+  "archiveExpansion",
+  "projectStorage",
+  "organizationStorage",
+  "memberCount",
+  "projectCount",
+  "teamCount",
+  "folderCount",
+  "sessionCount",
+  "runWallTime",
+  "runTurns",
+  "runToolCalls",
+  "toolWallTime",
+  "runOutputSize",
+  "processMemory",
+  "processCpu",
+  "processCount",
+] as const;
+
+export type CapacityDimension = (typeof CAPACITY_DIMENSIONS)[number];
+
+export const CAPACITY_DIMENSION_LABELS: Record<CapacityDimension, string> = {
+  requestRate: "HTTP 请求速率",
+  requestBodySize: "请求体大小",
+  agentConcurrency: "智能体并发",
+  admissionQueueLength: "接纳队列长度",
+  admissionQueueWait: "接纳队列等待",
+  fileSize: "单文件大小",
+  attachmentCount: "每消息附件数",
+  archiveExpansion: "归档展开",
+  projectStorage: "项目存储",
+  organizationStorage: "组织存储",
+  memberCount: "成员数",
+  projectCount: "项目数",
+  teamCount: "团队数",
+  folderCount: "文件夹数",
+  sessionCount: "会话数",
+  runWallTime: "单次运行墙钟",
+  runTurns: "单次运行轮次",
+  runToolCalls: "单次运行工具调用",
+  toolWallTime: "工具墙钟",
+  runOutputSize: "运行输出大小",
+  processMemory: "进程内存",
+  processCpu: "进程 CPU",
+  processCount: "进程数",
+};
+
+export function isCapacityDimension(value: string): value is CapacityDimension {
+  return (CAPACITY_DIMENSIONS as readonly string[]).includes(value);
+}

hub/src/deployment/agent-config-cli.ts

@@ -47,6 +47,7 @@ async function main(argv: readonly string[]): Promise<void> {
           : {}),
         ...(tools !== undefined ? { tools } : {}),
         ...(sortOrderRaw !== undefined ? { sortOrder: integer(sortOrderRaw, "sort-order") } : {}),
+        ...(options.has("default") ? { isDefault: boolean(options.get("default")!, "default") } : {}),
       });
       console.log(JSON.stringify(role));
       return;
@@ -79,6 +80,7 @@ async function main(argv: readonly string[]): Promise<void> {
         systemPromptConfigured: role.systemPrompt !== null,
         tools: role.tools,
         disabled: role.disabledAt !== null,
+        default: role.isDefault,
         skills: role.skillBindings.map((binding) => ({
           name: binding.skill.name,
           version: binding.skill.version,
@@ -138,10 +140,16 @@ function integer(raw: string, name: string): number {
   return value;
 }
 
+function boolean(raw: string, name: string): boolean {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error(`--${name} must be true or false`);
+}
+
 function printHelp(): void {
   console.log(`Usage:
   agent-config install-skill --organization ORG --source DIR --version VERSION
-  agent-config upsert-role --organization ORG --role ID --label LABEL [--model MODEL] [--system-prompt-file FILE] [--tools-json JSON] [--sort-order N]
+  agent-config upsert-role --organization ORG --role ID --label LABEL [--model MODEL] [--system-prompt-file FILE] [--tools-json JSON] [--sort-order N] [--default true|false]
   agent-config set-role-skills --organization ORG --role ID --skills name,name
   agent-config list --organization ORG
   agent-config verify-store --organization ORG`);

hub/src/deployment/bootstrap-silo.ts

@@ -233,6 +233,7 @@ async function initializeSilo(
           roleId: "draft",
           label: "草稿",
           sortOrder: 10,
+          isDefault: true,
         },
         {
           organizationId: input.organization.id,

hub/src/feishu/bindingLifecycle.ts

@@ -0,0 +1,101 @@
+import type { PrismaClient } from "@prisma/client";
+import {
+  requireActiveFeishuApplicationConnectionInTransaction,
+  scopedFeishuPrincipalId,
+} from "./identityNamespace.js";
+import { lockActiveOrganization } from "../org/status.js";
+
+export type FeishuBindingLifecycleReason = "chat_dissolved" | "bot_removed";
+
+/**
+ * Archive a project's active Feishu chat binding after Feishu has notified this
+ * bot that the chat dissolved or that the bot was removed. The event can be
+ * redelivered; only the first delivery changes state and writes an audit row.
+ */
+export async function archiveFeishuBindingForLifecycleEvent(
+  prisma: PrismaClient,
+  input: {
+    readonly chatId: string;
+    readonly eventId: string;
+    readonly reason: FeishuBindingLifecycleReason;
+  },
+): Promise<{ readonly archived: boolean; readonly projectId?: string | undefined }> {
+  const chatId = requireNonEmpty(input.chatId, "Feishu chat id");
+  const eventId = requireNonEmpty(input.eventId, "Feishu event id");
+  return prisma.$transaction(async (tx) => {
+    // Feishu WS delivery is at-least-once. Persist the receipt in the same
+    // transaction as the archive so a failed archive remains eligible for a
+    // retry, while an old redelivery cannot archive a later re-binding.
+    const receipt = await tx.feishuEventReceipt.createMany({
+      data: {
+        eventId,
+        eventType: lifecycleEventType(input.reason),
+      },
+      skipDuplicates: true,
+    });
+    if (receipt.count === 0) return { archived: false };
+
+    const binding = await tx.projectGroupBinding.findFirst({
+      where: { chatId, archivedAt: null },
+      select: { id: true, projectId: true, project: { select: { organizationId: true } } },
+    });
+    if (binding === null) return { archived: false };
+
+    await lockActiveOrganization(tx, binding.project.organizationId);
+    const connection = await tx.organizationFeishuApplicationConnection.findUnique({
+      where: { organizationId: binding.project.organizationId },
+      select: { id: true },
+    });
+    if (connection === null) {
+      throw new Error(`Feishu application connection not found for organization ${binding.project.organizationId}`);
+    }
+    const activeConnection = await requireActiveFeishuApplicationConnectionInTransaction(tx, connection.id);
+    if (activeConnection.organizationId !== binding.project.organizationId) {
+      throw new Error("Feishu application connection Organization scope mismatch");
+    }
+    const now = new Date();
+    const archived = await tx.projectGroupBinding.updateMany({
+      where: { id: binding.id, archivedAt: null },
+      data: { archivedAt: now },
+    });
+    if (archived.count === 0) return { archived: false };
+
+    await tx.permissionGrant.updateMany({
+      where: {
+        resourceType: "PROJECT",
+        resourceId: binding.projectId,
+        principalType: "FEISHU_CHAT",
+        // Bindings created before ADR-0024 used the raw chat id. Retire only
+        // that exact legacy principal alongside the current scoped principal.
+        principalId: {
+          in: [scopedFeishuPrincipalId("CHAT", connection.id, chatId), chatId],
+        },
+        revokedAt: null,
+      },
+      data: { revokedAt: now },
+    });
+    await tx.auditEntry.create({
+      data: {
+        organizationId: binding.project.organizationId,
+        projectId: binding.projectId,
+        action: "project.chat_binding_archived",
+        metadata: {
+          chatId,
+          reason: input.reason,
+          eventId,
+        },
+      },
+    });
+    return { archived: true, projectId: binding.projectId };
+  });
+}
+
+function lifecycleEventType(reason: FeishuBindingLifecycleReason): string {
+  return reason === "chat_dissolved" ? "im.chat.disbanded_v1" : "im.chat.member.bot.deleted_v1";
+}
+
+function requireNonEmpty(value: string, label: string): string {
+  const trimmed = value.trim();
+  if (trimmed === "") throw new Error(`${label} is required`);
+  return trimmed;
+}

hub/src/feishu/client.ts

@@ -100,11 +100,19 @@ export interface CardActionEvent {
     readonly value?: unknown;
     readonly tag?: string;
     readonly option?: string;
+    readonly form_value?: Readonly<Record<string, unknown>>;
   };
   readonly context?: { readonly open_message_id?: string; readonly open_chat_id?: string };
   readonly token?: string;
 }
 
+/** A binding-ending Feishu event delivered to this application's bot. */
+export interface FeishuBindingLifecycleEvent {
+  readonly eventId: string;
+  readonly chatId: string;
+  readonly reason: "chat_dissolved" | "bot_removed";
+}
+
 interface ContactBasicUser {
   readonly name?: string | undefined;
   readonly i18n_name?: {
@@ -921,6 +929,7 @@ export async function startFeishuListenerWithClient(
   onMessage: (event: MessageReceiveEvent, rt: FeishuRuntime) => Promise<void>,
   onCardAction?: (event: CardActionEvent, rt: FeishuRuntime) => Promise<void>,
   onTerminalError?: (error: Error) => void,
+  onBindingLifecycle?: (event: FeishuBindingLifecycleEvent) => Promise<void>,
 ): Promise<FeishuRuntime> {
   let state: "STARTING" | "READY" | "FAILED" = "STARTING";
   let resolveReady!: () => void;
@@ -962,6 +971,14 @@ export async function startFeishuListenerWithClient(
         .catch((e) => { logger.error({ err: e }, "feishu card action handler threw"); });
     };
   }
+  if (onBindingLifecycle !== undefined) {
+    handlers["im.chat.disbanded_v1"] = async (data) => {
+      await dispatchBindingLifecycleEvent(data, "chat_dissolved", onBindingLifecycle, logger);
+    };
+    handlers["im.chat.member.bot.deleted_v1"] = async (data) => {
+      await dispatchBindingLifecycleEvent(data, "bot_removed", onBindingLifecycle, logger);
+    };
+  }
   await wsClient.start({ eventDispatcher: new lark.EventDispatcher({}).register(handlers) });
   let timeout: ReturnType<typeof setTimeout> | undefined;
   const startupTimeout = new Promise<never>((_resolve, reject) => {
@@ -976,6 +993,36 @@ export async function startFeishuListenerWithClient(
   return rt;
 }
 
+async function dispatchBindingLifecycleEvent(
+  data: unknown,
+  reason: FeishuBindingLifecycleEvent["reason"],
+  onBindingLifecycle: (event: FeishuBindingLifecycleEvent) => Promise<void>,
+  logger: FastifyBaseLogger,
+): Promise<void> {
+  const event = bindingLifecycleEventFrom(data, reason);
+  if (event === null) {
+    logger.warn({ reason }, "feishu binding lifecycle event missing chat id");
+    return;
+  }
+  await onBindingLifecycle(event);
+}
+
+function bindingLifecycleEventFrom(
+  data: unknown,
+  reason: FeishuBindingLifecycleEvent["reason"],
+): FeishuBindingLifecycleEvent | null {
+  if (typeof data !== "object" || data === null) return null;
+  const event = data as { readonly chat_id?: unknown; readonly event_id?: unknown; readonly header?: { readonly event_id?: unknown } };
+  if (typeof event.chat_id !== "string" || event.chat_id.trim() === "") return null;
+  const eventId = typeof event.event_id === "string" && event.event_id !== ""
+    ? event.event_id
+    : typeof event.header?.event_id === "string" && event.header.event_id !== ""
+      ? event.header.event_id
+      : undefined;
+  if (eventId === undefined) return null;
+  return { chatId: event.chat_id, reason, eventId };
+}
+
 export async function startFeishuListener(
   config: FeishuConfig,
   logger: FastifyBaseLogger,

hub/src/feishu/identityNamespace.ts

@@ -66,7 +66,7 @@ export async function upsertScopedFeishuIdentityInTransaction(
   const principalId = scopedFeishuPrincipalId("USER", connectionId, openId);
   const userId = deterministicFeishuUserId(connectionId, openId);
 
-  const connection = await lockActiveConnection(prisma, connectionId);
+  const connection = await requireActiveFeishuApplicationConnectionInTransaction(prisma, connectionId);
   if (input.expectedOrganizationId !== undefined &&
       input.expectedOrganizationId !== connection.organizationId) {
     throw new Error("Feishu identity Organization scope mismatch");
@@ -114,7 +114,7 @@ export async function resolveScopedFeishuIdentity(
   const connectionId = nonEmpty(input.connectionId, "Feishu connectionId");
   const openId = nonEmpty(input.openId, "Feishu openId");
   return prisma.$transaction(async (tx) => {
-    const connection = await lockActiveConnection(tx, connectionId);
+    const connection = await requireActiveFeishuApplicationConnectionInTransaction(tx, connectionId);
     if (input.expectedOrganizationId !== undefined &&
         input.expectedOrganizationId !== connection.organizationId) {
       throw new Error("Feishu identity Organization scope mismatch");
@@ -127,7 +127,12 @@ export async function resolveScopedFeishuIdentity(
   });
 }
 
-async function lockActiveConnection(
+/**
+ * Lock and prove that a Feishu application connection is currently usable.
+ * Callers handling provider-originated data use this before trusting a
+ * connection-scoped identifier.
+ */
+export async function requireActiveFeishuApplicationConnectionInTransaction(
   prisma: Prisma.TransactionClient,
   connectionId: string,
 ): Promise<{ readonly organizationId: string }> {

hub/src/feishu/messageBatcher.ts

@@ -47,8 +47,8 @@ export class MessageBatcher {
     this.extendedDebounceMs = options.extendedDebounceMs ?? DEFAULT_OPTIONS.extendedDebounceMs;
   }
 
-  async enqueue(chatId: string, senderOpenId: string, text: string): Promise<void> {
+  async enqueue(chatId: string, senderOpenId: string, text: string, discriminator?: string): Promise<void> {
-    const key = messageBatchKey(chatId, senderOpenId);
+    const key = messageBatchKey(chatId, senderOpenId, discriminator);
     await this.runSerial(key, async () => {
       const existing = this.pending.get(key);
       const batch =
@@ -120,6 +120,8 @@ export class MessageBatcher {
   }
 }
 
-export function messageBatchKey(chatId: string, senderOpenId: string): string {
+export function messageBatchKey(chatId: string, senderOpenId: string, discriminator?: string): string {
-  return `${chatId}:${senderOpenId}`;
+  return discriminator === undefined
+    ? `${chatId}:${senderOpenId}`
+    : `${chatId}:${senderOpenId}:${discriminator}`;
 }

hub/src/feishu/projectConsole.ts

@@ -0,0 +1,381 @@
+import { Prisma, type PrismaClient } from "@prisma/client";
+import { lockActiveProjectOrganization } from "../org/status.js";
+
+export interface ProjectConsoleState {
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly projectName: string;
+  readonly folderId: string | null;
+  readonly breadcrumb: string;
+  readonly selectedRole: { readonly id: string; readonly roleId: string; readonly label: string };
+  readonly roles: readonly { readonly id: string; readonly roleId: string; readonly label: string }[];
+  readonly currentSession: {
+    readonly id: string;
+    readonly title: string | null;
+    readonly updatedAt: Date;
+    readonly runCount: number;
+    readonly sdkSessionReady: boolean;
+  } | null;
+}
+
+export interface FolderDestinationPage {
+  readonly folderId: string | null;
+  readonly parentFolderId: string | null;
+  readonly breadcrumb: string;
+  readonly childFolders: readonly { readonly id: string; readonly name: string }[];
+}
+
+export async function browseFolderDestinations(
+  prisma: PrismaClient,
+  input: { readonly organizationId: string; readonly folderId: string | null },
+): Promise<FolderDestinationPage> {
+  const folder = input.folderId === null ? null : await prisma.folder.findFirst({
+    where: { id: input.folderId, organizationId: input.organizationId, archivedAt: null },
+    select: { id: true, parentId: true },
+  });
+  if (input.folderId !== null && folder === null) throw new Error(`active folder not found: ${input.folderId}`);
+  const childFolders = await prisma.folder.findMany({
+    where: {
+      organizationId: input.organizationId,
+      parentId: input.folderId,
+      archivedAt: null,
+      kind: { not: "SYSTEM_INBOX" },
+    },
+    orderBy: [{ sortKey: "asc" }, { name: "asc" }, { id: "asc" }],
+    select: { id: true, name: true },
+  });
+  return {
+    folderId: input.folderId,
+    parentFolderId: folder?.parentId ?? null,
+    breadcrumb: input.folderId === null ? "根目录" : await folderBreadcrumb(prisma, input.folderId),
+    childFolders,
+  };
+}
+
+export async function createFolderAndMoveProject(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    readonly projectId: string;
+    readonly parentFolderId: string | null;
+    readonly name: string;
+    readonly actorUserId?: string | undefined;
+  },
+): Promise<{ readonly folderId: string; readonly folderName: string }> {
+  const name = input.name.trim();
+  if (name === "") throw new Error("folder name is required");
+  if (name.length > 100) throw new Error("folder name must not exceed 100 characters");
+  return prisma.$transaction(async (tx) => {
+    await lockActiveProjectOrganization(tx, input.projectId);
+    const project = await tx.project.findFirst({
+      where: { id: input.projectId, organizationId: input.organizationId, archivedAt: null },
+      select: { id: true, folderId: true },
+    });
+    if (project === null) throw new Error("active project not found in Organization");
+    if (input.parentFolderId !== null) {
+      const parent = await tx.folder.findFirst({
+        where: {
+          id: input.parentFolderId,
+          organizationId: input.organizationId,
+          archivedAt: null,
+          kind: { not: "SYSTEM_INBOX" },
+        },
+        select: { id: true },
+      });
+      if (parent === null) throw new Error("active destination folder not found in Organization");
+    }
+    const folder = await tx.folder.create({
+      data: {
+        organizationId: input.organizationId,
+        parentId: input.parentFolderId,
+        name,
+      },
+      select: { id: true, name: true },
+    });
+    await tx.project.update({ where: { id: project.id }, data: { folderId: folder.id } });
+    await tx.auditEntry.create({
+      data: {
+        organizationId: input.organizationId,
+        projectId: project.id,
+        ...(input.actorUserId !== undefined ? { actorUserId: input.actorUserId } : {}),
+        action: "folder.created_and_project_moved_from_feishu",
+        metadata: {
+          folderId: folder.id,
+          parentFolderId: input.parentFolderId,
+          previousFolderId: project.folderId,
+          name: folder.name,
+        },
+      },
+    });
+    return { folderId: folder.id, folderName: folder.name };
+  });
+}
+
+export async function loadProjectConsole(
+  prisma: PrismaClient,
+  input: { readonly projectId: string; readonly chatId: string },
+): Promise<ProjectConsoleState> {
+  const binding = await prisma.projectGroupBinding.findFirst({
+    where: { projectId: input.projectId, chatId: input.chatId, archivedAt: null },
+    select: {
+      selectedRole: { select: { id: true, roleId: true, label: true, disabledAt: true, organizationId: true } },
+      project: {
+        select: {
+          id: true,
+          name: true,
+          folderId: true,
+          organizationId: true,
+          archivedAt: true,
+          organization: {
+            select: {
+              status: true,
+              agentRoles: {
+                where: { disabledAt: null },
+                orderBy: [{ sortOrder: "asc" }, { roleId: "asc" }],
+                select: { id: true, roleId: true, label: true },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+  if (binding === null) throw new Error("project console requires an active binding to this chat");
+  const { project, selectedRole } = binding;
+  if (project.archivedAt !== null) throw new Error(`project ${project.id} is archived`);
+  if (project.organization.status !== "ACTIVE") {
+    throw new Error(`organization ${project.organizationId} is ${project.organization.status}`);
+  }
+  if (selectedRole.disabledAt !== null || selectedRole.organizationId !== project.organizationId) {
+    throw new Error("project group selected role is unavailable or cross-Organization");
+  }
+  const model = await selectedRoleModel(prisma, project.organizationId, selectedRole.id);
+  const currentSession = await prisma.agentSession.findFirst({
+    where: {
+      projectId: project.id,
+      roleId: selectedRole.roleId,
+      ...(model === null ? {} : { model }),
+      archivedAt: null,
+    },
+    orderBy: { updatedAt: "desc" },
+    select: { id: true, title: true, updatedAt: true, metadata: true, _count: { select: { runs: true } } },
+  });
+  return {
+    organizationId: project.organizationId,
+    projectId: project.id,
+    projectName: project.name,
+    folderId: project.folderId,
+    breadcrumb: project.folderId === null ? "根目录" : await folderBreadcrumb(prisma, project.folderId),
+    selectedRole: { id: selectedRole.id, roleId: selectedRole.roleId, label: selectedRole.label },
+    roles: project.organization.agentRoles,
+    currentSession: currentSession === null ? null : {
+      id: currentSession.id,
+      title: currentSession.title,
+      updatedAt: currentSession.updatedAt,
+      runCount: currentSession._count.runs,
+      sdkSessionReady: hasClaudeSessionId(currentSession.metadata),
+    },
+  };
+}
+
+function hasClaudeSessionId(metadata: unknown): boolean {
+  if (typeof metadata !== "object" || metadata === null || Array.isArray(metadata)) return false;
+  const value = (metadata as Record<string, unknown>)["claudeSessionId"];
+  return typeof value === "string" && value !== "";
+}
+
+function isUserResumable(metadata: unknown): boolean {
+  return typeof metadata === "object" && metadata !== null && !Array.isArray(metadata) &&
+    (metadata as Record<string, unknown>)["userResumable"] === true;
+}
+
+function userResumableMetadata(metadata: unknown, value: boolean): Prisma.InputJsonObject {
+  const base = typeof metadata === "object" && metadata !== null && !Array.isArray(metadata)
+    ? metadata as Prisma.JsonObject
+    : {};
+  return { ...base, userResumable: value };
+}
+
+export async function selectProjectGroupRole(
+  prisma: PrismaClient,
+  input: {
+    readonly projectId: string;
+    readonly chatId: string;
+    readonly agentRoleId: string;
+    readonly actorUserId: string;
+  },
+): Promise<void> {
+  await prisma.$transaction(async (tx) => {
+    await lockActiveProjectOrganization(tx, input.projectId);
+    const binding = await tx.projectGroupBinding.findFirst({
+      where: { projectId: input.projectId, chatId: input.chatId, archivedAt: null },
+      select: { id: true, project: { select: { organizationId: true } } },
+    });
+    if (binding === null) throw new Error("role selection requires an active binding to this chat");
+    const role = await tx.organizationAgentRole.findFirst({
+      where: {
+        id: input.agentRoleId,
+        organizationId: binding.project.organizationId,
+        disabledAt: null,
+      },
+      select: { id: true, roleId: true },
+    });
+    if (role === null) throw new Error(`active role not found: ${input.agentRoleId}`);
+    await tx.projectGroupBinding.update({
+      where: { id: binding.id },
+      data: { selectedAgentRoleId: role.id },
+    });
+    await tx.auditEntry.create({
+      data: {
+        projectId: input.projectId,
+        actorUserId: input.actorUserId,
+        action: "project_group.role_selected",
+        metadata: { chatId: input.chatId, roleId: role.roleId },
+      },
+    });
+  });
+}
+
+export async function archiveCurrentRoleSession(
+  prisma: PrismaClient,
+  input: { readonly projectId: string; readonly chatId: string; readonly actorUserId: string },
+): Promise<boolean> {
+  return prisma.$transaction(async (tx) => {
+    await lockActiveProjectOrganization(tx, input.projectId);
+    const activeRun = await tx.agentRun.findFirst({
+      where: { projectId: input.projectId, status: { in: ["ACTIVE", "WAITING_FOR_USER"] } },
+      select: { id: true },
+    });
+    if (activeRun !== null) throw new Error(`cannot archive a session while run ${activeRun.id} is active`);
+    const binding = await tx.projectGroupBinding.findFirst({
+      where: { projectId: input.projectId, chatId: input.chatId, archivedAt: null },
+      select: { selectedRole: { select: { roleId: true } } },
+    });
+    if (binding === null) throw new Error("session operation requires an active binding to this chat");
+    const session = await tx.agentSession.findFirst({
+      where: { projectId: input.projectId, roleId: binding.selectedRole.roleId, archivedAt: null },
+      orderBy: { updatedAt: "desc" },
+      select: { id: true, metadata: true },
+    });
+    if (session !== null) {
+      await tx.agentSession.update({
+        where: { id: session.id },
+        data: { archivedAt: new Date(), metadata: userResumableMetadata(session.metadata, true) },
+      });
+    }
+    await tx.auditEntry.create({
+      data: {
+        projectId: input.projectId,
+        actorUserId: input.actorUserId,
+        action: "agent_session.new_requested",
+        metadata: { chatId: input.chatId, roleId: binding.selectedRole.roleId, archivedSessionId: session?.id ?? null },
+      },
+    });
+    return session !== null;
+  });
+}
+
+export async function listRoleSessionHistory(
+  prisma: PrismaClient,
+  input: { readonly projectId: string; readonly chatId: string },
+): Promise<readonly { readonly id: string; readonly title: string | null; readonly updatedAt: Date; readonly runCount: number }[]> {
+  const binding = await prisma.projectGroupBinding.findFirst({
+    where: { projectId: input.projectId, chatId: input.chatId, archivedAt: null },
+    select: { selectedRole: { select: { roleId: true } } },
+  });
+  if (binding === null) throw new Error("session history requires an active binding to this chat");
+  const sessions = await prisma.agentSession.findMany({
+    where: { projectId: input.projectId, roleId: binding.selectedRole.roleId, archivedAt: { not: null } },
+    orderBy: { updatedAt: "desc" },
+    take: 10,
+    select: { id: true, title: true, updatedAt: true, metadata: true, _count: { select: { runs: true } } },
+  });
+  return sessions.filter((session) => isUserResumable(session.metadata)).map((session) => ({
+    id: session.id,
+    title: session.title,
+    updatedAt: session.updatedAt,
+    runCount: session._count.runs,
+  }));
+}
+
+export async function resumeRoleSession(
+  prisma: PrismaClient,
+  input: {
+    readonly projectId: string;
+    readonly chatId: string;
+    readonly sessionId: string;
+    readonly actorUserId: string;
+  },
+): Promise<void> {
+  await prisma.$transaction(async (tx) => {
+    await lockActiveProjectOrganization(tx, input.projectId);
+    const activeRun = await tx.agentRun.findFirst({
+      where: { projectId: input.projectId, status: { in: ["ACTIVE", "WAITING_FOR_USER"] } },
+      select: { id: true },
+    });
+    if (activeRun !== null) throw new Error(`cannot resume a session while run ${activeRun.id} is active`);
+    const binding = await tx.projectGroupBinding.findFirst({
+      where: { projectId: input.projectId, chatId: input.chatId, archivedAt: null },
+      select: { selectedRole: { select: { roleId: true } } },
+    });
+    if (binding === null) throw new Error("session resume requires an active binding to this chat");
+    const target = await tx.agentSession.findFirst({
+      where: { id: input.sessionId, projectId: input.projectId, roleId: binding.selectedRole.roleId, archivedAt: { not: null } },
+      select: { id: true, provider: true, model: true, metadata: true },
+    });
+    if (target === null || !isUserResumable(target.metadata)) {
+      throw new Error("user-resumable archived session not found for the selected role");
+    }
+    const activeSessions = await tx.agentSession.findMany({
+      where: {
+        projectId: input.projectId,
+        roleId: binding.selectedRole.roleId,
+        provider: target.provider,
+        model: target.model,
+        archivedAt: null,
+      },
+      select: { id: true, metadata: true },
+    });
+    const archivedAt = new Date();
+    for (const session of activeSessions) {
+      await tx.agentSession.update({
+        where: { id: session.id },
+        data: { archivedAt, metadata: userResumableMetadata(session.metadata, true) },
+      });
+    }
+    await tx.agentSession.update({
+      where: { id: target.id },
+      data: { archivedAt: null, metadata: userResumableMetadata(target.metadata, false) },
+    });
+    await tx.auditEntry.create({
+      data: {
+        projectId: input.projectId,
+        actorUserId: input.actorUserId,
+        action: "agent_session.resumed",
+        metadata: { chatId: input.chatId, roleId: binding.selectedRole.roleId, sessionId: target.id },
+      },
+    });
+  });
+}
+
+async function selectedRoleModel(
+  prisma: PrismaClient,
+  organizationId: string,
+  roleId: string,
+): Promise<string | null> {
+  const role = await prisma.organizationAgentRole.findFirst({
+    where: { id: roleId, organizationId, disabledAt: null },
+    select: { defaultModel: true },
+  });
+  if (role === null) throw new Error(`selected role not found: ${roleId}`);
+  return role.defaultModel;
+}
+
+async function folderBreadcrumb(prisma: PrismaClient, folderId: string): Promise<string> {
+  const rows = await prisma.$queryRaw<Array<{ breadcrumb: string }>>(Prisma.sql`
+    SELECT cph_folder_breadcrumb(${folderId}) AS breadcrumb
+  `);
+  const breadcrumb = rows[0]?.breadcrumb;
+  if (breadcrumb === undefined) throw new Error(`failed to resolve folder breadcrumb: ${folderId}`);
+  return breadcrumb;
+}

hub/src/feishu/projectOnboardingCard.ts

@@ -1,97 +1,61 @@
-export interface OnboardingProjectOption {
+import type { ProjectDiscoveryPage, ProjectFolderPage } from "../projectDiscovery.js";
-  readonly projectId: string;
-  readonly name: string;
-  readonly folderName?: string | undefined;
-}
 
-export interface OnboardingFolderOption {
+export type ProjectOnboardingView =
-  readonly folderId: string;
+  | { readonly mode: "search"; readonly result: ProjectDiscoveryPage }
-  readonly name: string;
+  | { readonly mode: "browse"; readonly result: ProjectFolderPage };
-}
 
 export interface ProjectOnboardingActionValue {
-  readonly action: "create_project_from_chat" | "bind_project";
+  readonly action:
+    | "create_project_from_chat"
+    | "bind_project"
+    | "browse_folder"
+    | "search_page"
+    | "rename_project"
+    | "select_agent_role"
+    | "new_agent_session"
+    | "show_session_history"
+    | "resume_agent_session"
+    | "compact_agent_session"
+    | "browse_move_destination"
+    | "move_project"
+    | "create_folder";
   readonly organization_id: string;
   readonly project_id?: string | undefined;
   readonly folder_id?: string | undefined;
+  readonly search_query?: string | undefined;
+  readonly page?: number | undefined;
+  readonly agent_role_id?: string | undefined;
+  readonly session_id?: string | undefined;
 }
 
 export function buildUnboundChatOnboardingCard(params: {
   readonly organizationId: string;
   readonly organizationName: string;
-  readonly folders: readonly OnboardingFolderOption[];
-  readonly projects: readonly OnboardingProjectOption[];
   readonly canCreateProject: boolean;
-  readonly searchQuery?: string | undefined;
+  readonly view: ProjectOnboardingView;
 }): Record<string, unknown> {
-  const actions: unknown[] = [];
+  const elements: unknown[] = [{
-  if (params.canCreateProject) {
+    tag: "markdown",
-    const folders = params.folders.length === 0 ? [{ folderId: undefined, name: "默认位置" }] : params.folders.slice(0, 3);
+    content: onboardingSummary(params.organizationName, params.view),
-    for (const folder of folders) {
+  }];
-      actions.push({
+
-        tag: "button",
+  if (params.view.mode === "browse") {
-        text: { tag: "plain_text", content: `新建到 ${buttonLabel(folder.name, 14)}` },
+    appendFolderNavigation(elements, params.organizationId, params.view.result);
-        type: "primary",
-        value: {
-          project_onboarding: {
-            action: "create_project_from_chat",
-            organization_id: params.organizationId,
-            ...(folder.folderId !== undefined ? { folder_id: folder.folderId } : {}),
-          },
-        },
-      });
-    }
   }
+  appendProjectResults(
+    elements,
+    params.organizationId,
+    params.view.mode === "search" ? params.view.result.items : params.view.result.projects,
+  );
+  appendPagination(elements, params.organizationId, params.view);
+  appendCreation(elements, params.organizationId, params.canCreateProject, params.view);
 
-  for (const project of params.projects.slice(0, 5)) {
+  if (elements.length === 1) {
-    actions.push({
+    elements.push({ tag: "markdown", content: "当前目录没有可浏览内容。" });
-      tag: "button",
-      text: { tag: "plain_text", content: buttonProjectLabel(project) },
-      type: "default",
-      value: {
-        project_onboarding: {
-          action: "bind_project",
-          organization_id: params.organizationId,
-          project_id: project.projectId,
-        },
-      },
-    });
   }
-
-  const elements: unknown[] = [
-    {
-      tag: "markdown",
-      content: [
-        `这个飞书群还没有绑定项目。`,
-        ``,
-        `组织: **${escapeMarkdown(params.organizationName)}**`,
-        ...(params.searchQuery === undefined || params.searchQuery === ""
-          ? [`可以选择 folder 新建项目并绑定到本群，或绑定你已经有管理权限的未绑定项目。`]
-          : [
-              `项目搜索: **${escapeMarkdown(params.searchQuery)}**`,
-              params.projects.length === 0
-                ? `没有匹配的未绑定项目。请 @bot 后换一个项目关键词。`
-                : `请选择匹配项目绑定到本群；如未找到，请 @bot 后换一个更具体的关键词。`,
-            ]),
-      ].join("\n"),
-    },
-  ];
-
-  if (actions.length > 0) {
-    elements.push({ tag: "action", actions });
-  } else {
-    elements.push({
-      tag: "markdown",
-      content: "你当前没有可绑定项目，也没有新建项目权限。请联系组织管理员。",
-    });
-  }
-
   return {
     config: { wide_screen_mode: true },
-    header: {
+    header: { title: { tag: "plain_text", content: "绑定项目" }, template: "blue" },
-      title: { tag: "plain_text", content: "绑定项目" },
-      template: "blue",
-    },
     elements,
   };
 }
@@ -103,54 +67,461 @@ export function buildProjectOnboardingResolvedCard(params: {
 }): Record<string, unknown> {
   return {
     config: { wide_screen_mode: true },
-    header: {
+    header: { title: { tag: "plain_text", content: params.title }, template: params.template },
-      title: { tag: "plain_text", content: params.title },
-      template: params.template,
-    },
     elements: [{ tag: "markdown", content: params.body }],
   };
 }
 
+export function buildProjectManagementCard(params: {
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly projectName: string;
+  readonly title?: string | undefined;
+  readonly breadcrumb?: string | undefined;
+  readonly selectedRole?: { readonly id: string; readonly roleId: string; readonly label: string } | undefined;
+  readonly roles?: readonly { readonly id: string; readonly roleId: string; readonly label: string }[] | undefined;
+  readonly currentSession?: {
+    readonly id: string;
+    readonly title: string | null;
+    readonly updatedAt: Date;
+    readonly runCount: number;
+    readonly sdkSessionReady: boolean;
+  } | null | undefined;
+  readonly canManageProject?: boolean | undefined;
+}): Record<string, unknown> {
+  const elements: unknown[] = [{
+    tag: "markdown",
+    content: [
+      `当前项目: **${escapeMarkdown(params.projectName)}**`,
+      `所在目录: **${escapeMarkdown(params.breadcrumb ?? "根目录")}**`,
+      params.selectedRole === undefined
+        ? "当前角色: **未配置**"
+        : `当前角色: **${escapeMarkdown(params.selectedRole.label)}**`,
+      sessionSummary(params.currentSession),
+    ].join("\n"),
+  }];
+  const roles = params.roles ?? [];
+  if (roles.length > 0) {
+    elements.push({ tag: "markdown", content: "**切换角色**" });
+    for (let index = 0; index < roles.length; index += 5) {
+      elements.push({
+        tag: "action",
+        actions: roles.slice(index, index + 5).map((role) => actionButton(
+          role.id === params.selectedRole?.id ? `✓ ${role.label}` : role.label,
+          {
+            action: "select_agent_role",
+            organization_id: params.organizationId,
+            project_id: params.projectId,
+            agent_role_id: role.id,
+          },
+          role.id === params.selectedRole?.id ? "primary" : "default",
+        )),
+      });
+    }
+  }
+  const sessionActions = [
+    actionButton("新开会话", {
+      action: "new_agent_session", organization_id: params.organizationId, project_id: params.projectId,
+    }),
+    actionButton("历史会话", {
+      action: "show_session_history", organization_id: params.organizationId, project_id: params.projectId,
+    }),
+  ];
+  if (params.currentSession?.sdkSessionReady === true) {
+    sessionActions.push(actionButton("压缩上下文", {
+      action: "compact_agent_session", organization_id: params.organizationId, project_id: params.projectId,
+    }));
+  }
+  elements.push(
+    { tag: "markdown", content: "**当前角色会话**" },
+    { tag: "action", actions: sessionActions },
+  );
+  if (params.canManageProject === true) {
+    elements.push(
+      { tag: "markdown", content: "**项目管理**" },
+      { tag: "action", actions: [actionButton("移动项目", {
+        action: "browse_move_destination",
+        organization_id: params.organizationId,
+        project_id: params.projectId,
+        page: 1,
+      })] },
+      renameProjectForm(params),
+    );
+  }
+  return {
+    config: { wide_screen_mode: true },
+    header: {
+      title: { tag: "plain_text", content: params.title ?? "项目管理" },
+      template: "green",
+    },
+    elements,
+  };
+}
+
+export function buildSessionHistoryCard(params: {
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly roleLabel: string;
+  readonly sessions: readonly {
+    readonly id: string;
+    readonly title: string | null;
+    readonly updatedAt: Date;
+    readonly runCount: number;
+  }[];
+}): Record<string, unknown> {
+  const elements: unknown[] = [{ tag: "markdown", content: `角色: **${escapeMarkdown(params.roleLabel)}**` }];
+  if (params.sessions.length === 0) elements.push({ tag: "markdown", content: "没有可恢复的历史会话。" });
+  for (const session of params.sessions) {
+    elements.push(
+      {
+        tag: "markdown",
+        content: `**${escapeMarkdown(session.title ?? "未命名会话")}**\n${session.runCount} runs · ${formatDate(session.updatedAt)}`,
+      },
+      { tag: "action", actions: [actionButton("恢复此会话", {
+        action: "resume_agent_session",
+        organization_id: params.organizationId,
+        project_id: params.projectId,
+        session_id: session.id,
+      }, "primary")] },
+    );
+  }
+  return {
+    config: { wide_screen_mode: true },
+    header: { title: { tag: "plain_text", content: "历史会话" }, template: "blue" },
+    elements,
+  };
+}
+
+export function buildMoveProjectCard(params: {
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly projectName: string;
+  readonly folderId: string | null;
+  readonly parentFolderId: string | null;
+  readonly breadcrumb: string;
+  readonly childFolders: readonly { readonly id: string; readonly name: string }[];
+  readonly canCreateFolder: boolean;
+}): Record<string, unknown> {
+  const navigation: unknown[] = [];
+  if (params.folderId !== null) {
+    navigation.push(actionButton("⬆ 上一级", {
+      action: "browse_move_destination",
+      organization_id: params.organizationId,
+      project_id: params.projectId,
+      ...(params.parentFolderId !== null ? { folder_id: params.parentFolderId } : {}),
+    }));
+  }
+  for (const folder of params.childFolders) {
+    navigation.push(actionButton(`📁 ${buttonLabel(folder.name, 22)}`, {
+      action: "browse_move_destination",
+      organization_id: params.organizationId,
+      project_id: params.projectId,
+      folder_id: folder.id,
+    }));
+  }
+  const elements: unknown[] = [
+    { tag: "markdown", content: `移动 **${escapeMarkdown(params.projectName)}**\n当前位置: **${escapeMarkdown(params.breadcrumb)}**` },
+  ];
+  for (let index = 0; index < navigation.length; index += 5) {
+    elements.push({ tag: "action", actions: navigation.slice(index, index + 5) });
+  }
+  elements.push({ tag: "action", actions: [actionButton("移动到这里", {
+    action: "move_project",
+    organization_id: params.organizationId,
+    project_id: params.projectId,
+    ...(params.folderId !== null ? { folder_id: params.folderId } : {}),
+  }, "primary")] });
+  if (params.canCreateFolder) {
+    elements.push(createFolderAndMoveForm({
+      organizationId: params.organizationId,
+      projectId: params.projectId,
+      parentFolderId: params.folderId,
+    }));
+  }
+  return {
+    config: { wide_screen_mode: true },
+    header: { title: { tag: "plain_text", content: "移动项目" }, template: "blue" },
+    elements,
+  };
+}
+
 export function projectOnboardingActionFromValue(value: unknown): ProjectOnboardingActionValue | null {
   const raw = unwrapValue(value);
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw) || !("project_onboarding" in raw)) return null;
-  if (!("project_onboarding" in raw)) return null;
   const action = raw.project_onboarding;
   if (typeof action !== "object" || action === null || Array.isArray(action)) return null;
-  const rawAction = (action as { action?: unknown }).action;
+  const fields = action as Record<string, unknown>;
-  const organizationId = (action as { organization_id?: unknown }).organization_id;
+  const rawAction = fields.action;
-  const projectId = (action as { project_id?: unknown }).project_id;
+  const organizationId = fields.organization_id;
-  const folderId = (action as { folder_id?: unknown }).folder_id;
+  const projectId = fields.project_id;
-  if ((rawAction !== "create_project_from_chat" && rawAction !== "bind_project") || typeof organizationId !== "string" || organizationId === "") {
+  const folderId = fields.folder_id;
-    return null;
+  const searchQuery = fields.search_query;
-  }
+  const page = fields.page;
-  if (rawAction === "bind_project" && (typeof projectId !== "string" || projectId === "")) {
+  const agentRoleId = fields.agent_role_id;
-    return null;
+  const sessionId = fields.session_id;
-  }
+  if (!isAction(rawAction) || typeof organizationId !== "string" || organizationId === "") return null;
-  if (folderId !== undefined && (typeof folderId !== "string" || folderId === "")) {
+  if ((rawAction === "bind_project" || rawAction === "rename_project") && (typeof projectId !== "string" || projectId === "")) return null;
-    return null;
+  if (rawAction === "search_page" && (typeof searchQuery !== "string" || !validPage(page))) return null;
-  }
+  if (folderId !== undefined && (typeof folderId !== "string" || folderId === "")) return null;
+  if (page !== undefined && !validPage(page)) return null;
+  if (rawAction === "select_agent_role" && (typeof agentRoleId !== "string" || agentRoleId === "")) return null;
+  if (rawAction === "resume_agent_session" && (typeof sessionId !== "string" || sessionId === "")) return null;
   return {
     action: rawAction,
     organization_id: organizationId,
     ...(typeof projectId === "string" && projectId !== "" ? { project_id: projectId } : {}),
     ...(typeof folderId === "string" && folderId !== "" ? { folder_id: folderId } : {}),
+    ...(typeof searchQuery === "string" ? { search_query: searchQuery.slice(0, 100) } : {}),
+    ...(typeof page === "number" ? { page } : {}),
+    ...(typeof agentRoleId === "string" && agentRoleId !== "" ? { agent_role_id: agentRoleId } : {}),
+    ...(typeof sessionId === "string" && sessionId !== "" ? { session_id: sessionId } : {}),
   };
 }
 
+function onboardingSummary(organizationName: string, view: ProjectOnboardingView): string {
+  if (view.mode === "search") {
+    const result = view.result;
+    return [
+      "这个飞书群还没有绑定项目。",
+      "",
+      `组织: **${escapeMarkdown(organizationName)}**`,
+      `搜索: **${escapeMarkdown(result.query)}**`,
+      result.totalItems === 0
+        ? "没有匹配的可绑定项目，请换一个关键词。"
+        : `共 **${result.totalItems}** 个匹配结果 · 第 **${result.page}/${result.totalPages}** 页`,
+    ].join("\n");
+  }
+  const location = view.result.breadcrumb === "" ? "根目录" : view.result.breadcrumb;
+  return [
+    "这个飞书群还没有绑定项目。",
+    "",
+    `组织: **${escapeMarkdown(organizationName)}**`,
+    `当前位置: **${escapeMarkdown(location)}**`,
+    "可以进入 folder 浏览，或选择有管理权限的未绑定项目。",
+  ].join("\n");
+}
+
+function appendFolderNavigation(elements: unknown[], organizationId: string, result: ProjectFolderPage): void {
+  const navigation: unknown[] = [];
+  if (result.folderId !== null) {
+    navigation.push(actionButton("⬆ 上一级", {
+      action: "browse_folder",
+      organization_id: organizationId,
+      ...(result.parentFolderId !== null ? { folder_id: result.parentFolderId } : {}),
+      page: 1,
+    }));
+  }
+  for (const folder of result.childFolders) {
+    navigation.push(actionButton(`📁 ${buttonLabel(folder.name, 22)}`, {
+      action: "browse_folder",
+      organization_id: organizationId,
+      folder_id: folder.folderId,
+      page: 1,
+    }));
+  }
+  for (let index = 0; index < navigation.length; index += 5) {
+    elements.push({ tag: "action", actions: navigation.slice(index, index + 5) });
+  }
+}
+
+function appendProjectResults(
+  elements: unknown[],
+  organizationId: string,
+  projects: readonly ProjectDiscoveryPage["items"][number][],
+): void {
+  for (const project of projects) {
+    const path = project.breadcrumb === "" ? "根目录" : project.breadcrumb;
+    elements.push({
+      tag: "markdown",
+      content: `**${escapeMarkdown(project.name)}**\n${escapeMarkdown(path)}`,
+    });
+    elements.push({
+      tag: "action",
+      actions: [actionButton("绑定这个项目", {
+        action: "bind_project",
+        organization_id: organizationId,
+        project_id: project.projectId,
+      })],
+    });
+  }
+}
+
+function appendPagination(elements: unknown[], organizationId: string, view: ProjectOnboardingView): void {
+  const result = projectPage(view);
+  if (result.totalPages <= 1) return;
+  const actions: unknown[] = [];
+  if (result.page > 1) actions.push(pageButton("上一页", organizationId, view, result.page - 1));
+  if (result.page < result.totalPages) actions.push(pageButton("下一页", organizationId, view, result.page + 1));
+  elements.push({ tag: "action", actions });
+}
+
+function appendCreation(
+  elements: unknown[],
+  organizationId: string,
+  canCreateProject: boolean,
+  view: ProjectOnboardingView,
+): void {
+  if (!canCreateProject || view.mode !== "browse") return;
+  elements.push({
+    tag: "action",
+    actions: [actionButton(view.result.folderId === null ? "新建项目" : "在此 folder 新建项目", {
+      action: "create_project_from_chat",
+      organization_id: organizationId,
+      ...(view.result.folderId !== null ? { folder_id: view.result.folderId } : {}),
+    }, "primary")],
+  });
+}
+
+function pageButton(label: string, organizationId: string, view: ProjectOnboardingView, page: number): unknown {
+  if (view.mode === "search") {
+    return actionButton(label, {
+      action: "search_page",
+      organization_id: organizationId,
+      search_query: view.result.query,
+      page,
+    });
+  }
+  return actionButton(label, {
+    action: "browse_folder",
+    organization_id: organizationId,
+    ...(view.result.folderId !== null ? { folder_id: view.result.folderId } : {}),
+    page,
+  });
+}
+
+function projectPage(view: ProjectOnboardingView): ProjectDiscoveryPage {
+  if (view.mode === "search") return view.result;
+  return {
+    query: "",
+    page: view.result.page,
+    pageSize: view.result.pageSize,
+    totalItems: view.result.totalFolders + view.result.totalProjects,
+    totalPages: view.result.totalPages,
+    items: view.result.projects,
+  };
+}
+
+function renameProjectForm(params: {
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly projectName: string;
+}): unknown {
+  return {
+    tag: "form",
+    name: "project_rename_form",
+    fallback: {
+      tag: "fallback_text",
+      text: { tag: "plain_text", content: "请升级飞书客户端后修改项目名称。" },
+    },
+    elements: [
+      {
+        tag: "input",
+        name: "project_name",
+        required: true,
+        max_length: 100,
+        default_value: params.projectName,
+        placeholder: { tag: "plain_text", content: "请输入项目名称" },
+      },
+      {
+        tag: "button",
+        name: "project_rename_submit",
+        text: { tag: "plain_text", content: "保存项目名称" },
+        type: "primary",
+        complex_interaction: true,
+        action_type: "form_submit",
+        value: { project_onboarding: {
+          action: "rename_project",
+          organization_id: params.organizationId,
+          project_id: params.projectId,
+        } },
+      },
+    ],
+  };
+}
+
+function createFolderAndMoveForm(params: {
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly parentFolderId: string | null;
+}): unknown {
+  return {
+    tag: "form",
+    name: "folder_create_form",
+    elements: [
+      {
+        tag: "input",
+        name: "folder_name",
+        required: true,
+        max_length: 100,
+        placeholder: { tag: "plain_text", content: "在当前目标目录下新建 Folder" },
+      },
+      {
+        tag: "button",
+        name: "folder_create_submit",
+        text: { tag: "plain_text", content: "新建并移动" },
+        type: "default",
+        complex_interaction: true,
+        action_type: "form_submit",
+        value: { project_onboarding: {
+          action: "create_folder",
+          organization_id: params.organizationId,
+          project_id: params.projectId,
+          ...(params.parentFolderId !== null ? { folder_id: params.parentFolderId } : {}),
+        } },
+      },
+    ],
+  };
+}
+
+function sessionSummary(session: {
+  readonly title: string | null;
+  readonly updatedAt: Date;
+  readonly runCount: number;
+} | null | undefined): string {
+  if (session === null || session === undefined) return "当前会话: **尚未开始**";
+  return `当前会话: **${escapeMarkdown(session.title ?? "未命名会话")}** · ${session.runCount} runs · ${formatDate(session.updatedAt)}`;
+}
+
+function formatDate(value: Date): string {
+  return new Intl.DateTimeFormat("zh-CN", {
+    timeZone: "Asia/Shanghai",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    hour12: false,
+  }).format(value);
+}
+
+function actionButton(
+  label: string,
+  value: ProjectOnboardingActionValue,
+  type: "default" | "primary" = "default",
+): unknown {
+  return {
+    tag: "button",
+    text: { tag: "plain_text", content: label },
+    type,
+    value: { project_onboarding: value },
+  };
+}
+
+function isAction(value: unknown): value is ProjectOnboardingActionValue["action"] {
+  return value === "create_project_from_chat" || value === "bind_project"
+    || value === "browse_folder" || value === "search_page" || value === "rename_project"
+    || value === "select_agent_role" || value === "new_agent_session"
+    || value === "show_session_history" || value === "resume_agent_session"
+    || value === "compact_agent_session" || value === "browse_move_destination"
+    || value === "move_project" || value === "create_folder";
+}
+
+function validPage(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1 && value <= 10_000;
+}
+
 function unwrapValue(value: unknown): unknown {
   if (typeof value !== "string") return value;
-  try {
+  try { return JSON.parse(value); } catch { return value; }
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-}
-
-function buttonProjectLabel(project: OnboardingProjectOption): string {
-  const folderPrefix = project.folderName === undefined ? "" : `${project.folderName} / `;
-  const label = `${folderPrefix}${project.name}`;
-  return buttonLabel(label, 24);
 }
 
 function buttonLabel(label: string, maxLength: number): string {

hub/src/feishu/slashCommands.ts

@@ -1,11 +1,6 @@
 import type { PrismaClient } from "@prisma/client";
-import type { FastifyBaseLogger } from "fastify";
 import { decimalToNumberOrNull, formatInteger, formatUsd } from "../agent/cost.js";
-import type { ModelRegistry, RoleEntry } from "../agent/models.js";
-import type { RuntimeSettings } from "../settings/runtime.js";
-import { lockActiveProjectOrganization } from "../org/status.js";
 import { sendText, type FeishuRuntime, type SendMessageOptions } from "./client.js";
-import type { TriggerQueue } from "./triggerQueue.js";
 
 export interface SlashInvocation {
   readonly name: string;
@@ -21,20 +16,13 @@ export interface SlashCommandRunContext {
 }
 
 export interface SlashCommandDefinition {
-  readonly name: string;
+  readonly name: "help" | "project" | "usage";
   readonly usage: string;
   readonly summary: string;
   readonly details: readonly string[];
   run(context: SlashCommandRunContext): Promise<void>;
 }
 
-export interface SlashCommandRegistryDeps {
-  readonly prisma: PrismaClient;
-  readonly settings: RuntimeSettings;
-  readonly logger: FastifyBaseLogger;
-  readonly triggerQueue: TriggerQueue;
-}
-
 const TERMINAL_RUN_STATUSES = ["COMPLETED", "FAILED", "TIMED_OUT", "CANCELED"] as const;
 
 export function parseSlashInvocation(prompt: string): SlashInvocation | null {
@@ -43,166 +31,94 @@ export function parseSlashInvocation(prompt: string): SlashInvocation | null {
   const tokens = trimmed.split(/\s+/);
   const rawCommand = tokens[0];
   if (rawCommand === undefined || rawCommand.length <= 1) return null;
-  return {
+  return { name: rawCommand.slice(1), args: tokens.slice(1) };
-    name: rawCommand.slice(1),
-    args: tokens.slice(1),
-  };
 }
 
-export function parseSlashHelpSubcommand(invocation: SlashInvocation): string | null {
+export function createSlashCommandRegistry(
-  if (invocation.name === "help") return null;
+  deps: { readonly prisma: PrismaClient },
-  return invocation.args.length === 1 && invocation.args[0] === "help"
+): ReadonlyMap<string, SlashCommandDefinition> {
-    ? invocation.name
-    : null;
-}
-
-export function createSlashCommandRegistry(deps: SlashCommandRegistryDeps): ReadonlyMap<string, SlashCommandDefinition> {
   const commands = new Map<string, SlashCommandDefinition>();
   const add = (command: SlashCommandDefinition): void => {
-    if (commands.has(command.name)) {
+    if (commands.has(command.name)) throw new Error(`duplicate slash command definition: /${command.name}`);
-      throw new Error(`duplicate slash command definition: /${command.name}`);
-    }
     commands.set(command.name, command);
   };
 
   add({
     name: "help",
-    usage: "/help [command]",
+    usage: "/help [project|usage]",
-    summary: "查看可用 slash 命令或单个命令说明。",
+    summary: "查看 Hub 命令。",
-    details: [
+    details: ["未知 slash 命令会明确报错，不会发送给 Agent。"],
-      "不创建 agent run,也不改变当前会话。",
+    run: async ({ invocation, chatId, rt, sendOptions }) => {
-      "支持 /help new 和 /new help 两种写法。",
+      if (invocation.args.length > 1) {
-    ],
+        await sendText(rt, chatId, "用法: /help [project|usage]", sendOptions);
+        return;
+      }
+      const target = invocation.args[0];
+      await sendText(rt, chatId, target === undefined
+        ? formatSlashOverview(commands)
+        : formatSlashHelpTarget(target, commands), sendOptions);
+    },
+  });
+
+  add({
+    name: "project",
+    usage: "/project",
+    summary: "打开当前项目控制台，切换角色、管理会话和项目。",
+    details: ["不同区域按当前操作者的项目与组织权限显示。"],
+    run: async ({ chatId, rt, sendOptions }) => {
+      await sendText(rt, chatId, "请在绑定的项目群中使用 /project。", sendOptions);
+    },
+  });
+
+  add({
+    name: "usage",
+    usage: "/usage [current|project]",
+    summary: "查看 Hub 记录的真实 Agent 用量与成本。",
+    details: ["current 只统计当前角色的活跃会话；project 统计整个项目。"],
     run: async ({ invocation, projectId, chatId, rt, sendOptions }) => {
-      const registry = await deps.settings.modelRegistry({ projectId });
+      const scope = invocation.args[0] ?? "current";
-      await sendText(rt, chatId, formatHelpCommandInvocation(invocation, registry, commands), sendOptions);
+      if (invocation.args.length > 1 || (scope !== "current" && scope !== "project")) {
-    },
+        await sendText(rt, chatId, "用法: /usage [current|project]", sendOptions);
-  });
-
-  add({
-    name: "new",
-    usage: "/new",
-    summary: "开新会话,下次 @bot 将从头开始。",
-    details: [
-      "归档当前未归档的 agent session。",
-      "不会清空当前项目的等待队列。",
-    ],
-    run: async ({ projectId, chatId, rt, sendOptions }) => {
-      await deps.prisma.$transaction(async (tx) => {
-        await lockActiveProjectOrganization(tx, projectId);
-        await tx.agentSession.updateMany({
-          where: { projectId, archivedAt: null },
-          data: { archivedAt: new Date() },
-        });
-      });
-      await sendText(rt, chatId, "已开新会话,下次 @bot 将从头开始。", sendOptions);
-    },
-  });
-
-  add({
-    name: "resume",
-    usage: "/resume",
-    summary: "恢复最近一次已归档的会话。",
-    details: [
-      "只恢复当前项目最近归档的 agent session。",
-      "没有可恢复会话时只回复提示,不会创建 agent run。",
-    ],
-    run: async ({ projectId, chatId, rt, sendOptions }) => {
-      const resumed = await deps.prisma.$transaction(async (tx) => {
-        await lockActiveProjectOrganization(tx, projectId);
-        const latest = await tx.agentSession.findFirst({
-          where: { projectId, archivedAt: { not: null } },
-          orderBy: { archivedAt: "desc" },
-          select: { id: true },
-        });
-        if (latest === null) return false;
-        await tx.agentSession.update({
-          where: { id: latest.id },
-          data: { archivedAt: null },
-        });
-        return true;
-      });
-      if (!resumed) {
-        await sendText(rt, chatId, "没有可恢复的会话。", sendOptions);
         return;
       }
-      await sendText(rt, chatId, "已恢复上一个会话。", sendOptions);
+      const sessionIds = scope === "project"
-    },
+        ? undefined
-  });
+        : await currentRoleSessionIds(deps.prisma, projectId, chatId);
-
-  add({
-    name: "cost",
-    usage: "/cost",
-    summary: "查看当前会话已记录的 agent 成本。",
-    details: [
-      "只读取当前项目未归档 agent session 下已经结束的 run,不创建 agent run。",
-      "只统计运行时真实记录到 AgentRun.costUsd 的成本;未记录成本的 run 会单独列出。",
-    ],
-    run: async ({ invocation, projectId, chatId, rt, sendOptions }) => {
-      if (invocation.args.length > 0) {
-        await sendText(rt, chatId, ["用法错误: /cost 暂不接受参数。", "", formatBuiltinSlashCommandHelp(commands.get("cost")!)].join("\n"), sendOptions);
-        return;
-      }
-
-      const sessions = await deps.prisma.agentSession.findMany({
-        where: { projectId, archivedAt: null },
-        orderBy: { updatedAt: "asc" },
-        select: { id: true },
-      });
-      if (sessions.length === 0) {
-        await sendText(rt, chatId, "当前会话还没有 agent session。", sendOptions);
-        return;
-      }
-
       const runs = await deps.prisma.agentRun.findMany({
         where: {
           projectId,
-          sessionId: { in: sessions.map((session) => session.id) },
+          ...(sessionIds === undefined ? {} : { sessionId: { in: sessionIds } }),
           status: { in: [...TERMINAL_RUN_STATUSES] },
           finishedAt: { not: null },
         },
         orderBy: { finishedAt: "asc" },
-        select: {
+        select: { model: true, provider: true, inputTokens: true, outputTokens: true, costUsd: true },
-          model: true,
-          provider: true,
-          inputTokens: true,
-          outputTokens: true,
-          costUsd: true,
-        },
       });
-
+      await sendText(rt, chatId, formatUsageReport(runs, scope), sendOptions);
-      await sendText(rt, chatId, formatCostReport(runs), sendOptions);
-    },
-  });
-
-  add({
-    name: "reset",
-    usage: "/reset",
-    summary: "重置当前会话并清空等待队列。",
-    details: [
-      "归档当前未归档的 agent session。",
-      "清空当前项目已经排队、尚未开始的触发请求。",
-    ],
-    run: async ({ projectId, chatId, rt, sendOptions }) => {
-      await deps.prisma.$transaction(async (tx) => {
-        await lockActiveProjectOrganization(tx, projectId);
-        await tx.agentSession.updateMany({
-          where: { projectId, archivedAt: null },
-          data: { archivedAt: new Date() },
-        });
-      });
-      const cleared = deps.triggerQueue.clear(projectId);
-      if (cleared > 0) {
-        deps.logger.info({ projectId, cleared }, "feishu trigger: cleared queued triggers on reset");
-      }
-      await sendText(rt, chatId, "已重置,下次 @bot 将从头开始。", sendOptions);
     },
   });
 
   return commands;
 }
 
-interface CostReportRun {
+async function currentRoleSessionIds(
+  prisma: PrismaClient,
+  projectId: string,
+  chatId: string,
+): Promise<string[]> {
+  const binding = await prisma.projectGroupBinding.findFirst({
+    where: { projectId, chatId, archivedAt: null },
+    select: { selectedRole: { select: { roleId: true } } },
+  });
+  if (binding === null) throw new Error("active project-group binding not found");
+  const sessions = await prisma.agentSession.findMany({
+    where: { projectId, roleId: binding.selectedRole.roleId, archivedAt: null },
+    select: { id: true },
+  });
+  return sessions.map((session) => session.id);
+}
+
+interface UsageRun {
   readonly model: string;
   readonly provider: string;
   readonly inputTokens: number | null;
@@ -210,225 +126,66 @@ interface CostReportRun {
   readonly costUsd: unknown;
 }
 
-interface CostReportBucket {
+function formatUsageReport(runs: readonly UsageRun[], scope: "current" | "project"): string {
-  readonly provider: string;
+  if (runs.length === 0) return `${scope === "current" ? "当前角色会话" : "当前项目"}还没有已结束的 Agent run。`;
-  readonly model: string;
+  const buckets = new Map<string, {
-  runs: number;
+    provider: string; model: string; runs: number; inputTokens: number; outputTokens: number; costUsd: number;
-  inputTokens: number;
+  }>();
-  outputTokens: number;
-  costUsd: number;
-}
-
-function formatCostReport(runs: readonly CostReportRun[]): string {
-  if (runs.length === 0) {
-    return "当前会话还没有已结束的 agent run。";
-  }
-
-  const buckets = new Map<string, CostReportBucket>();
   let recordedRuns = 0;
   let unrecordedRuns = 0;
   let totalInputTokens = 0;
   let totalOutputTokens = 0;
   let totalCostUsd = 0;
-
   for (const run of runs) {
     const costUsd = decimalToNumberOrNull(run.costUsd);
-    if (costUsd === null) {
+    if (costUsd === null) { unrecordedRuns++; continue; }
-      unrecordedRuns++;
-      continue;
-    }
-
     recordedRuns++;
-    const inputTokens = run.inputTokens ?? 0;
-    const outputTokens = run.outputTokens ?? 0;
-    totalInputTokens += inputTokens;
-    totalOutputTokens += outputTokens;
-    totalCostUsd += costUsd;
-
     const key = `${run.provider}\u0000${run.model}`;
-    let bucket = buckets.get(key);
+    const bucket = buckets.get(key) ?? {
-    if (bucket === undefined) {
+      provider: run.provider, model: run.model, runs: 0, inputTokens: 0, outputTokens: 0, costUsd: 0,
-      bucket = {
+    };
-        provider: run.provider,
-        model: run.model,
-        runs: 0,
-        inputTokens: 0,
-        outputTokens: 0,
-        costUsd: 0,
-      };
-      buckets.set(key, bucket);
-    }
     bucket.runs++;
-    bucket.inputTokens += inputTokens;
+    bucket.inputTokens += run.inputTokens ?? 0;
-    bucket.outputTokens += outputTokens;
+    bucket.outputTokens += run.outputTokens ?? 0;
     bucket.costUsd += costUsd;
+    buckets.set(key, bucket);
+    totalInputTokens += run.inputTokens ?? 0;
+    totalOutputTokens += run.outputTokens ?? 0;
+    totalCostUsd += costUsd;
   }
-
-  if (recordedRuns === 0) {
-    return [
-      "当前会话已有已结束 agent run,但还没有任何 run 记录到真实成本。",
-      `未记录成本: ${formatInteger(unrecordedRuns)} runs。`,
-      "后续 run 需要 SDK 返回 total_cost_usd 才会进入 /cost 合计。",
-    ].join("\n");
-  }
-
   const lines = [
-    "当前会话已记录 agent 成本:",
+    `${scope === "current" ? "当前角色会话" : "当前项目"}用量`,
-    `总计: ${formatUsd(totalCostUsd)}`,
+    `已记录成本: ${formatInteger(recordedRuns)} runs · ${formatUsd(totalCostUsd)}`,
-    `Runs: ${formatInteger(recordedRuns)} 已记录${unrecordedRuns > 0 ? ` / ${formatInteger(unrecordedRuns)} 未记录` : ""}`,
     `Tokens: input ${formatInteger(totalInputTokens)} / output ${formatInteger(totalOutputTokens)}`,
-    "",
-    "按模型:",
   ];
-
+  if (unrecordedRuns > 0) lines.push(`另有 ${formatInteger(unrecordedRuns)} 个 run 未记录成本。`);
-  const sortedBuckets = [...buckets.values()].sort((a, b) => b.costUsd - a.costUsd);
+  for (const bucket of buckets.values()) {
-  for (const bucket of sortedBuckets) {
+    lines.push(`- ${bucket.provider} / ${bucket.model}: ${formatInteger(bucket.runs)} runs, ${formatUsd(bucket.costUsd)}`);
-    lines.push(
-      `- ${bucket.provider} / ${bucket.model}: ${formatInteger(bucket.runs)} runs, ${formatUsd(bucket.costUsd)}, input ${formatInteger(bucket.inputTokens)} / output ${formatInteger(bucket.outputTokens)}`,
-    );
   }
-
   return lines.join("\n");
 }
 
-function formatHelpCommandInvocation(
-  invocation: SlashInvocation,
-  registry: ModelRegistry,
-  slashCommands: ReadonlyMap<string, SlashCommandDefinition>,
-): string {
-  if (invocation.args.length > 1) {
-    const helpCommand = slashCommands.get("help");
-    if (helpCommand === undefined) {
-      throw new Error("slash command registry is missing /help");
-    }
-    return [
-      "用法错误: /help 只接受一个命令名。",
-      "",
-      formatBuiltinSlashCommandHelp(helpCommand),
-    ].join("\n");
-  }
-
-  const target = invocation.args[0];
-  if (target === undefined) return formatSlashOverview(registry, slashCommands);
-  const normalizedTarget = normalizeHelpTarget(target);
-  if (normalizedTarget === "") return formatSlashOverview(registry, slashCommands);
-  return formatSlashHelpTarget(normalizedTarget, registry, slashCommands);
-}
-
 export function formatSlashHelpTarget(
   target: string,
-  registry: ModelRegistry,
+  commands: ReadonlyMap<string, SlashCommandDefinition>,
-  slashCommands: ReadonlyMap<string, SlashCommandDefinition>,
 ): string {
-  const normalizedTarget = normalizeHelpTarget(target);
+  const normalized = target.trim().replace(/^\/+/, "");
-  if (normalizedTarget === "") return formatSlashOverview(registry, slashCommands);
+  const command = commands.get(normalized);
-  return formatSlashCommandHelp(normalizedTarget, registry, slashCommands) ?? formatUnknownSlashHelp(normalizedTarget, registry, slashCommands);
+  if (command === undefined) return [`未知 slash 命令 /${normalized}。`, "", formatSlashOverview(commands)].join("\n");
-}
-
-function normalizeHelpTarget(target: string): string {
-  return target.trim().replace(/^\/+/, "");
-}
-
-function formatSlashOverview(
-  registry: ModelRegistry,
-  slashCommands: ReadonlyMap<string, SlashCommandDefinition>,
-): string {
-  const lines = [
-    "可用 slash 命令:",
-    ...[...slashCommands.values()].map((command) => `/${command.name} - ${command.summary}`),
-  ];
-  const roles = visibleRoleCommands(registry, slashCommands);
-  if (roles.length > 0) {
-    lines.push("", "角色命令:");
-    for (const role of roles) {
-      lines.push(`/${role.id} <需求> - 使用“${role.label}”角色发起请求。`);
-    }
-  } else {
-    lines.push("", "当前没有配置角色命令。");
-  }
-  lines.push("", "查看单个命令: /help new 或 /new help。");
-  return lines.join("\n");
-}
-
-function formatSlashCommandHelp(
-  commandName: string,
-  registry: ModelRegistry,
-  slashCommands: ReadonlyMap<string, SlashCommandDefinition>,
-): string | null {
-  const normalizedName = normalizeHelpTarget(commandName);
-  const slashCommand = slashCommands.get(normalizedName);
-  if (slashCommand !== undefined) return formatBuiltinSlashCommandHelp(slashCommand);
-
-  const role = registry.role(normalizedName);
-  if (role === undefined) return null;
-  if (slashCommands.has(role.id)) return null;
-  return formatRoleSlashCommandHelp(role);
-}
-
-function formatBuiltinSlashCommandHelp(command: SlashCommandDefinition): string {
-  const helpUsage = command.name === "help"
-    ? "帮助: /help help"
-    : `帮助: /help ${command.name} 或 /${command.name} help`;
   return [
     `/${command.name}`,
     command.summary,
     "",
     `用法: ${command.usage}`,
     ...command.details.map((detail) => `- ${detail}`),
-    "",
-    helpUsage,
   ].join("\n");
 }
 
-function formatRoleSlashCommandHelp(role: RoleEntry): string {
+function formatSlashOverview(commands: ReadonlyMap<string, SlashCommandDefinition>): string {
-  const lines = [
-    `/${role.id}`,
-    `使用“${role.label}”角色发起一次 agent run。`,
-    "",
-    `用法: /${role.id} <需求>`,
-    "- 真正运行时仍会按当前项目的 role.trigger 授权检查。",
-  ];
-  if (role.defaultModel !== undefined) {
-    lines.push(`- 默认模型: ${role.defaultModel}`);
-  }
-  lines.push(
-    `- 工具范围: ${roleToolsDescription(role)}`,
-    `- Skills: ${roleSkillsDescription(role)}`,
-    "",
-    `帮助: /help ${role.id} 或 /${role.id} help`,
-  );
-  return lines.join("\n");
-}
-
-function roleSkillsDescription(role: RoleEntry): string {
-  if (role.skills === undefined || role.skills.length === 0) return "无";
-  return role.skills.map((skill) => `${skill.name}@${skill.version}`).join(", ");
-}
-
-function roleToolsDescription(role: RoleEntry): string {
-  if (role.tools === undefined) return "全部已注册工具";
-  if (role.tools.length === 0) return "无";
-  return role.tools.join(", ");
-}
-
-function formatUnknownSlashHelp(
-  commandName: string,
-  registry: ModelRegistry,
-  slashCommands: ReadonlyMap<string, SlashCommandDefinition>,
-): string {
-  const normalizedName = normalizeHelpTarget(commandName);
   return [
-    `未知 slash 命令 /${normalizedName}。`,
+    "可用 slash 命令:",
+    ...[...commands.values()].map((command) => `/${command.name} - ${command.summary}`),
     "",
-    formatSlashOverview(registry, slashCommands),
+    "普通消息会使用 /project 中选定的当前角色。",
   ].join("\n");
 }
-
-function visibleRoleCommands(
-  registry: ModelRegistry,
-  slashCommands: ReadonlyMap<string, SlashCommandDefinition>,
-): readonly RoleEntry[] {
-  return registry
-    .listRoles()
-    .filter((role) => !slashCommands.has(role.id));
-}

hub/src/feishu/trigger.ts

@@ -52,22 +52,36 @@ import {
   type StagedMessageResourceBatch,
 } from "./resourceStaging.js";
 import { TriggerQueue, triggerQueue as defaultTriggerQueue, type QueuedTrigger } from "./triggerQueue.js";
-import { createSlashCommandRegistry, formatSlashHelpTarget, parseSlashHelpSubcommand, parseSlashInvocation } from "./slashCommands.js";
+import { createSlashCommandRegistry, parseSlashInvocation } from "./slashCommands.js";
 import { cphHubMcpToolsForRole, roleToolsAllow } from "../agent/roleTools.js";
 import {
   bindFeishuChatToProject,
   createProjectFromFeishuChat,
   ensureOrganizationProjectSettings,
+  moveProjectToFolder,
+  renameProjectForActor,
 } from "../projectOnboarding.js";
 import {
+  buildProjectManagementCard,
+  buildMoveProjectCard,
+  buildSessionHistoryCard,
   buildProjectOnboardingResolvedCard,
   buildUnboundChatOnboardingCard,
   projectOnboardingActionFromValue,
-  type OnboardingFolderOption,
-  type OnboardingProjectOption,
   type ProjectOnboardingActionValue,
+  type ProjectOnboardingView,
 } from "./projectOnboardingCard.js";
+import {
+  archiveCurrentRoleSession,
+  browseFolderDestinations,
+  createFolderAndMoveProject,
+  listRoleSessionHistory,
+  loadProjectConsole,
+  resumeRoleSession,
+  selectProjectGroupRole,
+} from "./projectConsole.js";
 import { SiloFixedWindowRateLimiter } from "../deployment/siloRateLimit.js";
+import { browseBindableFolder, discoverBindableProjects } from "../projectDiscovery.js";
 
 export { ApprovalManager } from "./approval.js";
 export type { ApprovalResult, PendingApproval } from "./approval.js";
@@ -111,6 +125,7 @@ interface TriggerRunContext {
   readonly projectId: string;
   readonly senderOpenId: string;
   readonly actor: TriggerActor;
+  readonly roleId: string;
 }
 
 type StartAgentRunOutcome = "started" | "queued" | "rejected" | "locked" | "skipped";
@@ -148,9 +163,6 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     : new SiloFixedWindowRateLimiter(deps.maxFeishuEventsPerMinute, 60_000);
   const slashCommands = createSlashCommandRegistry({
     prisma: deps.prisma,
-    settings: deps.settings,
-    logger: deps.logger,
-    triggerQueue,
   });
   const batchContexts = new Map<string, TriggerRunContext>();
   // runId → AbortController for live runs. Registered when a run starts,
@@ -176,10 +188,47 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     }
   }, deps.messageBatcherOptions);
 
+  async function projectConsoleCard(
+    projectId: string,
+    chatId: string,
+    actorOpenId: string,
+    title?: string,
+  ): Promise<Record<string, unknown>> {
+    const state = await loadProjectConsole(deps.prisma, { projectId, chatId });
+    const actor = { feishuOpenId: actorOpenId, chatId };
+    const [manageDecision, organization, roleDecisions] = await Promise.all([
+      authorizer.can({ actor, action: "collaborator.manage", resource: { type: "PROJECT", id: projectId } }),
+      resolveSingleActiveOrganizationForFeishuUser(actorOpenId),
+      Promise.all(state.roles.map(async (role) => ({
+        role,
+        decision: await authorizer.can({
+          actor,
+          action: "role.trigger",
+          resource: { type: "PROJECT", id: projectId },
+          roleId: role.roleId,
+        }),
+      }))),
+    ]);
+    const visibleRoles = roleDecisions.filter(({ decision }) => decision.allowed).map(({ role }) => role);
+    const isOrgAdmin = organization.status === "ok" &&
+      organization.organizationId === state.organizationId && isOrgAdminRole(organization.role);
+    return buildProjectManagementCard({
+      organizationId: state.organizationId,
+      projectId: state.projectId,
+      projectName: state.projectName,
+      breadcrumb: state.breadcrumb,
+      selectedRole: state.selectedRole,
+      roles: visibleRoles,
+      currentSession: state.currentSession,
+      canManageProject: manageDecision.allowed || isOrgAdmin,
+      ...(title !== undefined ? { title } : {}),
+    });
+  }
+
   async function startAgentRun(
     context: TriggerRunContext,
     cleanPrompt: string,
-    options: { readonly queueIfLocked?: boolean } = {},
+    options: { readonly queueIfLocked?: boolean; readonly nativeSlash?: boolean } = {},
   ): Promise<StartAgentRunOutcome> {
     const { msg, rt, chatId, projectId, senderOpenId, actor } = context;
     const sendOptions = sendOptionsForTriggerMessage(msg);
@@ -193,7 +242,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
         return "rejected";
       }
       if (!queueIfLocked) return "locked";
-      return enqueueLockedTrigger(context, cleanPrompt);
+      return enqueueLockedTrigger(context, cleanPrompt, options.nativeSlash === true ? "native_compact" : "conversation");
     }
 
     const project = await deps.prisma.project.findUnique({
@@ -205,15 +254,11 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       return "skipped";
     }
 
-    // ADR-0017: role-as-data. Parse a leading `/<role>` command; unknown
-    // slashes are left as literal text (extractRole returns null). Falls back
-    // to "draft" when no role is named — the registry degrades gracefully.
     const models = await deps.settings.modelRegistry({ projectId });
-    const { roleId: parsedRole, prompt: parsedAgentPrompt } = extractRole(cleanPrompt, models);
+    const roleId = context.roleId;
-    const roleId = parsedRole ?? "draft";
     // ADR-0019: role trigger is the second gate after project agent.trigger.
-    // Unconfigured roles remain open for back-compat; configured roles require
+    // Configured roles require a matching active RoleTriggerGrant for any
-    // a matching active RoleTriggerGrant for any resolved principal.
+    // resolved principal; otherwise the role remains open within the project.
     const roleDecision = await authorizer.can({
       actor,
       action: "role.trigger",
@@ -260,8 +305,10 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       projectWorkspaceRoot,
       deps.resourceLimits,
     );
-    const agentPrompt = appendStagedResourcePaths(parsedAgentPrompt, stagedResources, project.workspaceDir);
+    const agentPrompt = appendStagedResourcePaths(cleanPrompt, stagedResources, project.workspaceDir);
-    const promptForAgent = withFeishuTriggerContext(agentPrompt, feishuTriggerContext);
+    const promptForAgent = options.nativeSlash === true
+      ? cleanPrompt
+      : withFeishuTriggerContext(agentPrompt, feishuTriggerContext);
 
     // Linearization point for org lifecycle + session/run/lock admission.
     // FOR SHARE on the Organization row conflicts with a concurrent status
@@ -621,10 +668,16 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     return "started";
   }
 
-  async function enqueueLockedTrigger(context: TriggerRunContext, cleanPrompt: string): Promise<StartAgentRunOutcome> {
+  async function enqueueLockedTrigger(
+    context: TriggerRunContext,
+    cleanPrompt: string,
+    executionKind: QueuedTrigger["executionKind"] = "conversation",
+  ): Promise<StartAgentRunOutcome> {
     const position = triggerQueue.enqueue(context.projectId, {
       chatId: context.chatId,
       prompt: cleanPrompt,
+      roleId: context.roleId,
+      executionKind,
       msg: context.msg,
       senderOpenId: context.senderOpenId,
       actor: context.actor,
@@ -662,7 +715,10 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
 
       const next = triggerQueue.dequeue(projectId);
       if (next === null) return;
-      const outcome = await startAgentRun(contextFromQueuedTrigger(next, rt), next.prompt, { queueIfLocked: false });
+      const outcome = await startAgentRun(contextFromQueuedTrigger(next, rt), next.prompt, {
+        queueIfLocked: false,
+        nativeSlash: next.executionKind === "native_compact",
+      });
       if (outcome === "started") return;
       if (outcome === "locked") {
         requeueTrigger(next);
@@ -679,6 +735,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       projectId: trigger.projectId,
       senderOpenId: trigger.senderOpenId,
       actor: trigger.actor,
+      roleId: trigger.roleId,
     };
   }
 
@@ -686,6 +743,8 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     const position = triggerQueue.enqueue(trigger.projectId, {
       chatId: trigger.chatId,
       prompt: trigger.prompt,
+      roleId: trigger.roleId,
+      executionKind: trigger.executionKind,
       msg: trigger.msg,
       senderOpenId: trigger.senderOpenId,
       actor: trigger.actor,
@@ -754,21 +813,257 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     }
 
     try {
+      const organization = await resolveSingleActiveOrganizationForFeishuUser(operatorOpenId);
+      if (organization.status !== "ok") throw new Error(organization.message);
+      if (organization.organizationId !== action.organization_id) {
+        throw new Error("project onboarding organization mismatch");
+      }
+      if (
+        action.action === "select_agent_role" ||
+        action.action === "new_agent_session" ||
+        action.action === "show_session_history" ||
+        action.action === "resume_agent_session" ||
+        action.action === "compact_agent_session"
+      ) {
+        const projectId = action.project_id;
+        if (projectId === undefined) throw new Error(`${action.action} requires project_id`);
+        const binding = await deps.prisma.projectGroupBinding.findFirst({
+          where: { projectId, chatId, archivedAt: null },
+          select: { id: true },
+        });
+        if (binding === null) throw new Error("project console action requires the project to be bound to this chat");
+        const state = await loadProjectConsole(deps.prisma, { projectId, chatId });
+        const targetRole = action.action === "select_agent_role"
+          ? state.roles.find((role) => role.id === action.agent_role_id)
+          : state.selectedRole;
+        if (targetRole === undefined) throw new Error("selected Agent role is unavailable");
+        const actor = { feishuOpenId: operatorOpenId, chatId };
+        const [triggerDecision, roleDecision] = await Promise.all([
+          authorizer.can({ actor, action: "agent.trigger", resource: { type: "PROJECT", id: projectId } }),
+          authorizer.can({
+            actor,
+            action: "role.trigger",
+            resource: { type: "PROJECT", id: projectId },
+            roleId: targetRole.roleId,
+          }),
+        ]);
+        if (!triggerDecision.allowed || !roleDecision.allowed || roleDecision.actorUserId === undefined) {
+          throw new Error(`not authorized for Agent role ${targetRole.roleId}`);
+        }
+
+        if (action.action === "select_agent_role") {
+          await selectProjectGroupRole(deps.prisma, {
+            projectId,
+            chatId,
+            agentRoleId: targetRole.id,
+            actorUserId: roleDecision.actorUserId,
+          });
+          if (messageId === undefined) throw new Error("role selection requires message id");
+          await patchCard(rt, messageId, await projectConsoleCard(
+            projectId,
+            chatId,
+            operatorOpenId,
+            `已切换至 ${targetRole.label}`,
+          ));
+          return;
+        }
+        if (action.action === "new_agent_session") {
+          await archiveCurrentRoleSession(deps.prisma, {
+            projectId,
+            chatId,
+            actorUserId: roleDecision.actorUserId,
+          });
+          if (messageId === undefined) throw new Error("new session requires message id");
+          await patchCard(rt, messageId, await projectConsoleCard(projectId, chatId, operatorOpenId, "已新开会话"));
+          return;
+        }
+        if (action.action === "show_session_history") {
+          const sessions = await listRoleSessionHistory(deps.prisma, { projectId, chatId });
+          if (messageId === undefined) throw new Error("session history requires message id");
+          await patchCard(rt, messageId, buildSessionHistoryCard({
+            organizationId: state.organizationId,
+            projectId,
+            roleLabel: state.selectedRole.label,
+            sessions,
+          }));
+          return;
+        }
+        if (action.action === "resume_agent_session") {
+          if (action.session_id === undefined) throw new Error("resume_agent_session requires session_id");
+          await resumeRoleSession(deps.prisma, {
+            projectId,
+            chatId,
+            sessionId: action.session_id,
+            actorUserId: roleDecision.actorUserId,
+          });
+          if (messageId === undefined) throw new Error("session resume requires message id");
+          await patchCard(rt, messageId, await projectConsoleCard(projectId, chatId, operatorOpenId, "已恢复历史会话"));
+          return;
+        }
+        if (state.currentSession === null || !state.currentSession.sdkSessionReady) {
+          throw new Error("当前角色还没有可压缩的 Claude 会话");
+        }
+        const commandMessage: MessageReceiveEvent["message"] = {
+          message_id: messageId ?? randomUUID(),
+          chat_id: chatId,
+          chat_type: "group",
+          message_type: "text",
+          content: JSON.stringify({ text: "/compact" }),
+          mentions: [],
+        };
+        await startAgentRun({
+          msg: commandMessage,
+          rt,
+          chatId,
+          projectId,
+          senderOpenId: operatorOpenId,
+          actor,
+          roleId: state.selectedRole.roleId,
+        }, "/compact", { nativeSlash: true });
+        return;
+      }
+      if (
+        action.action === "browse_move_destination" ||
+        action.action === "move_project" ||
+        action.action === "create_folder"
+      ) {
+        const projectId = action.project_id;
+        if (projectId === undefined) throw new Error(`${action.action} requires project_id`);
+        const state = await loadProjectConsole(deps.prisma, { projectId, chatId });
+        const isOrgAdmin = isOrgAdminRole(organization.role);
+        const manageDecision = await authorizer.can({
+          actor: { feishuOpenId: operatorOpenId, chatId },
+          action: "collaborator.manage",
+          resource: { type: "PROJECT", id: projectId },
+        });
+        if (!isOrgAdmin && !manageDecision.allowed) throw new Error("project MANAGE permission is required");
+
+        if (action.action === "browse_move_destination") {
+          const page = await browseFolderDestinations(deps.prisma, {
+            organizationId: state.organizationId,
+            folderId: action.folder_id ?? null,
+          });
+          if (messageId === undefined) throw new Error("folder navigation requires message id");
+          await patchCard(rt, messageId, buildMoveProjectCard({
+            organizationId: state.organizationId,
+            projectId,
+            projectName: state.projectName,
+            canCreateFolder: isOrgAdmin,
+            ...page,
+          }));
+          return;
+        }
+        if (action.action === "move_project") {
+          await moveProjectToFolder(deps.prisma, { projectId, folderId: action.folder_id ?? null });
+          await writeAudit(deps.prisma, {
+            projectId,
+            ...(manageDecision.actorUserId !== undefined ? { actorUserId: manageDecision.actorUserId } : {}),
+            action: "project.moved_from_feishu",
+            metadata: { folderId: action.folder_id ?? null },
+          });
+          if (messageId === undefined) throw new Error("project move requires message id");
+          await patchCard(rt, messageId, await projectConsoleCard(projectId, chatId, operatorOpenId, "项目已移动"));
+          return;
+        }
+        if (!isOrgAdmin) throw new Error("creating an Organization folder requires OWNER or ADMIN");
+        const folderName = event.action.form_value?.["folder_name"];
+        if (typeof folderName !== "string") throw new Error("create folder form is missing folder_name");
+        const folder = await createFolderAndMoveProject(deps.prisma, {
+          organizationId: state.organizationId,
+          projectId,
+          parentFolderId: action.folder_id ?? null,
+          name: folderName.slice(0, 100),
+          ...(manageDecision.actorUserId !== undefined ? { actorUserId: manageDecision.actorUserId } : {}),
+        });
+        if (messageId === undefined) throw new Error("folder creation requires message id");
+        await patchCard(rt, messageId, await projectConsoleCard(
+          projectId,
+          chatId,
+          operatorOpenId,
+          `已新建目录“${folder.folderName}”并移动项目`,
+        ));
+        return;
+      }
+      if (action.action === "rename_project") {
+        const projectId = action.project_id;
+        if (projectId === undefined) throw new Error("rename_project action requires project_id");
+        const binding = await deps.prisma.projectGroupBinding.findFirst({
+          where: { chatId, projectId, archivedAt: null },
+          select: { id: true },
+        });
+        if (binding === null) throw new Error("project rename requires the project to be bound to this chat");
+        const submittedName = event.action.form_value?.["project_name"];
+        if (typeof submittedName !== "string") throw new Error("project rename form is missing project_name");
+        const renamed = await renameProjectForActor(deps.prisma, {
+          organizationId: organization.organizationId,
+          projectId,
+          actorFeishuOpenId: operatorOpenId,
+          name: submittedName.slice(0, 100),
+        });
+        if (messageId === undefined) throw new Error("project rename requires message id");
+        await patchCard(rt, messageId, await projectConsoleCard(
+          renamed.projectId,
+          chatId,
+          operatorOpenId,
+          "项目名称已更新",
+        ));
+        deps.logger.info({ chatId, projectId, operatorOpenId }, "project onboarding: project renamed");
+        return;
+      }
+      if (action.action === "browse_folder" || action.action === "search_page") {
+        const activeBinding = await deps.prisma.projectGroupBinding.findFirst({
+          where: { chatId, archivedAt: null },
+          select: { projectId: true },
+        });
+        if (activeBinding !== null) throw new Error(`chat is already bound to project ${activeBinding.projectId}`);
+        const settings = await ensureOrganizationProjectSettings(deps.prisma, organization.organizationId);
+        const view = action.action === "search_page"
+          ? await searchOnboardingView({
+              organizationId: organization.organizationId,
+              actorFeishuOpenId: operatorOpenId,
+              isOrgAdmin: isOrgAdminRole(organization.role),
+              query: action.search_query ?? "",
+              page: action.page ?? 1,
+            })
+          : await browseOnboardingView({
+              organizationId: organization.organizationId,
+              actorFeishuOpenId: operatorOpenId,
+              isOrgAdmin: isOrgAdminRole(organization.role),
+              folderId: action.folder_id ?? null,
+              page: action.page ?? 1,
+            });
+        if (messageId === undefined) throw new Error("project onboarding navigation requires message id");
+        await patchCard(rt, messageId, buildUnboundChatOnboardingCard({
+          organizationId: organization.organizationId,
+          organizationName: organization.organizationName,
+          canCreateProject: settings.membersCanCreateProjects || isOrgAdminRole(organization.role),
+          view,
+        }));
+        deps.logger.info(
+          { chatId, operatorOpenId, action: action.action, folderId: action.folder_id, page: action.page },
+          "project onboarding: navigated discovery card",
+        );
+        return;
+      }
+
       if (action.action === "create_project_from_chat") {
         const name = defaultProjectNameForChat(chatId);
         const project = await createProjectFromFeishuChat(deps.prisma, {
-          organizationId: action.organization_id,
+          organizationId: organization.organizationId,
           actorFeishuOpenId: operatorOpenId,
           chatId,
           name,
           workspaceRoot: projectWorkspaceRoot,
           folderId: action.folder_id,
         });
-        await resolveProjectOnboardingCard(rt, messageId, {
+        if (messageId !== undefined) {
-          title: "已创建并绑定项目",
+          await patchCard(rt, messageId, await projectConsoleCard(
-          body: `项目 **${escapeCardMarkdown(name)}** 已绑定到本群。后续 @bot 会进入这个项目的 session。`,
+            project.projectId,
-          template: "green",
+            chatId,
-        });
+            operatorOpenId,
+            "已创建并绑定项目",
+          ));
+        }
         deps.logger.info({ chatId, projectId: project.projectId, operatorOpenId }, "project onboarding: created project from chat");
         return;
       }
@@ -777,16 +1072,27 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       if (projectId === undefined) {
         throw new Error("bind_project action requires project_id");
       }
+      const target = await deps.prisma.project.findUnique({
+        where: { id: projectId },
+        select: { organizationId: true },
+      });
+      if (target === null) throw new Error(`project not found: ${projectId}`);
+      if (target.organizationId !== organization.organizationId) {
+        throw new Error("project onboarding project organization mismatch");
+      }
       const project = await bindFeishuChatToProject(deps.prisma, {
         projectId,
         actorFeishuOpenId: operatorOpenId,
         chatId,
       });
-      await resolveProjectOnboardingCard(rt, messageId, {
+      if (messageId !== undefined) {
-        title: "已绑定项目",
+        await patchCard(rt, messageId, await projectConsoleCard(
-        body: `本群已绑定到项目 \`${project.projectId}\`。后续 @bot 会进入这个项目的 session。`,
+          project.projectId,
-        template: "green",
+          chatId,
-      });
+          operatorOpenId,
+          "已绑定项目",
+        ));
+      }
       deps.logger.info({ chatId, projectId: project.projectId, operatorOpenId }, "project onboarding: bound existing project");
     } catch (e) {
       const reason = e instanceof Error ? e.message : String(e);
@@ -818,7 +1124,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     }
     const binding = await deps.prisma.projectGroupBinding.findFirst({
       where: { chatId, archivedAt: null },
-      select: { projectId: true },
+      select: { projectId: true, selectedRole: { select: { roleId: true } } },
     });
     if (binding === null) {
       deps.logger.debug({ chatId }, "feishu interrupt: chat not bound to any project");
@@ -923,7 +1229,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     // ADR-0001: resolve chat → project. Unknown chat ⇒ not a project group.
     const binding = await deps.prisma.projectGroupBinding.findFirst({
       where: { chatId, archivedAt: null },
-      select: { projectId: true },
+      select: { projectId: true, selectedRole: { select: { roleId: true } } },
     });
     if (binding === null) {
       deps.logger.debug({ chatId }, "feishu trigger: chat not bound to any project");
@@ -995,22 +1301,35 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       }
     }
     if (cleanPrompt === null) return;
-    const runContext: TriggerRunContext = { msg, rt, chatId, projectId, senderOpenId, actor };
+    const runContext: TriggerRunContext = {
+      msg,
+      rt,
+      chatId,
+      projectId,
+      senderOpenId,
+      actor,
+      roleId: binding.selectedRole.roleId,
+    };
 
-    // Slash commands: session management, not agent runs. These bypass the
+    // Hub owns a closed slash-command protocol. Unknown commands fail visibly;
-    // batcher. Session commands bypass the lock because they don't create runs;
+    // they are never downgraded to Agent text or forwarded to the SDK.
-    // role/unknown slash prompts still use the normal run path and queue if locked.
     if (cleanPrompt.startsWith("/")) {
       const invocation = parseSlashInvocation(cleanPrompt);
-      const helpSubcommandTarget = invocation === null ? null : parseSlashHelpSubcommand(invocation);
-      if (helpSubcommandTarget !== null) {
-        // Help is generated on demand because role/tool configuration is runtime data.
-        const models = await deps.settings.modelRegistry({ projectId });
-        await sendText(rt, chatId, formatSlashHelpTarget(helpSubcommandTarget, models, slashCommands), sendOptionsForTriggerMessage(msg));
-        return;
-      }
-
       if (invocation !== null) {
+        if (invocation.name === "project") {
+          if (invocation.args.length > 0) {
+            await sendText(rt, chatId, "用法: /project", sendOptionsForTriggerMessage(msg));
+            return;
+          }
+          await sendCard(
+            rt,
+            chatId,
+            await projectConsoleCard(projectId, chatId, senderOpenId),
+            sendOptionsForTriggerMessage(msg),
+          );
+          deps.logger.info({ chatId, projectId, senderOpenId }, "feishu project console opened");
+          return;
+        }
         const slashCommand = slashCommands.get(invocation.name);
         if (slashCommand !== undefined) {
           try {
@@ -1026,8 +1345,8 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
           return;
         }
       }
-
+      const name = invocation?.name ?? cleanPrompt.slice(1).trim();
-      await startAgentRun(runContext, cleanPrompt);
+      await sendText(rt, chatId, `未知 slash 命令 /${name}。使用 /help 查看可用命令。`, sendOptionsForTriggerMessage(msg));
       return;
     }
 
@@ -1041,11 +1360,20 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
         await enqueueLockedTrigger(runContext, cleanPrompt);
         return;
       }
-      const key = messageBatchKey(chatId, senderOpenId);
+      const key = messageBatchKey(chatId, senderOpenId, runContext.roleId);
+      for (const [pendingKey, pendingContext] of batchContexts) {
+        if (
+          pendingKey !== key &&
+          pendingContext.chatId === chatId &&
+          pendingContext.senderOpenId === senderOpenId
+        ) {
+          await messageBatcher.flushNow(pendingKey);
+        }
+      }
       if (!batchContexts.has(key)) {
         batchContexts.set(key, runContext);
       }
-      await messageBatcher.enqueue(chatId, senderOpenId, cleanPrompt);
+      await messageBatcher.enqueue(chatId, senderOpenId, cleanPrompt, runContext.roleId);
       return;
     }
 
@@ -1071,13 +1399,21 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     const settings = await ensureOrganizationProjectSettings(deps.prisma, organization.organizationId);
     const canCreateProject = settings.membersCanCreateProjects || isOrgAdminRole(organization.role);
     const searchQuery = (extractPrompt(msg) ?? "").trim().slice(0, 100);
-    const projects = await listBindableProjectsForActor({
+    const view = searchQuery === ""
-      organizationId: organization.organizationId,
+      ? await browseOnboardingView({
-      actorFeishuOpenId: senderOpenId,
+          organizationId: organization.organizationId,
-      isOrgAdmin: isOrgAdminRole(organization.role),
+          actorFeishuOpenId: senderOpenId,
-      searchQuery,
+          isOrgAdmin: isOrgAdminRole(organization.role),
-    });
+          folderId: null,
-    const folders = await listCreatableRootFolders(organization.organizationId);
+          page: 1,
+        })
+      : await searchOnboardingView({
+          organizationId: organization.organizationId,
+          actorFeishuOpenId: senderOpenId,
+          isOrgAdmin: isOrgAdminRole(organization.role),
+          query: searchQuery,
+          page: 1,
+        });
 
     await sendCard(
       rt,
@@ -1085,10 +1421,8 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       buildUnboundChatOnboardingCard({
         organizationId: organization.organizationId,
         organizationName: organization.organizationName,
-        folders,
-        projects,
         canCreateProject,
-        searchQuery,
+        view,
       }),
       sendOptionsForTriggerMessage(msg),
     );
@@ -1181,67 +1515,44 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     };
   }
 
-  async function listBindableProjectsForActor(input: {
+  async function searchOnboardingView(input: {
     readonly organizationId: string;
     readonly actorFeishuOpenId: string;
     readonly isOrgAdmin: boolean;
-    readonly searchQuery: string;
+    readonly query: string;
-  }): Promise<readonly OnboardingProjectOption[]> {
+    readonly page: number;
-    const allowed: OnboardingProjectOption[] = [];
+  }): Promise<ProjectOnboardingView> {
-    let cursor: string | undefined;
+    return {
-    while (allowed.length < 5) {
+      mode: "search",
-      const candidates = await deps.prisma.project.findMany({
+      result: await discoverBindableProjects({
-        where: {
+        prisma: deps.prisma,
         organizationId: input.organizationId,
-        archivedAt: null,
+        actorFeishuOpenId: input.actorFeishuOpenId,
-        groupBindings: { none: { archivedAt: null } },
+        isOrgAdmin: input.isOrgAdmin,
-        ...(input.searchQuery === "" ? {} : {
+        query: input.query,
-          OR: [
+        page: input.page,
-            { name: { contains: input.searchQuery, mode: "insensitive" } },
+      }),
-            { folder: { name: { contains: input.searchQuery, mode: "insensitive" } } },
+    };
-          ],
-        }),
-        },
-        select: {
-          id: true,
-          name: true,
-          folder: { select: { name: true } },
-        },
-        orderBy: [{ updatedAt: "desc" }, { id: "desc" }],
-        take: 20,
-        ...(cursor === undefined ? {} : { cursor: { id: cursor }, skip: 1 }),
-      });
-      for (const project of candidates) {
-        if (!input.isOrgAdmin) {
-          const decision = await authorizer.can({
-            actor: { feishuOpenId: input.actorFeishuOpenId },
-            action: "collaborator.manage",
-            resource: { type: "PROJECT", id: project.id },
-          });
-          if (!decision.allowed) continue;
-        }
-        allowed.push({
-          projectId: project.id,
-          name: project.name,
-          ...(project.folder?.name !== undefined ? { folderName: project.folder.name } : {}),
-        });
-        if (allowed.length >= 5) break;
-      }
-      if (candidates.length < 20) break;
-      cursor = candidates.at(-1)?.id;
-      if (cursor === undefined) break;
-    }
-    return allowed;
   }
 
-  async function listCreatableRootFolders(organizationId: string): Promise<readonly OnboardingFolderOption[]> {
+  async function browseOnboardingView(input: {
-    const folders = await deps.prisma.folder.findMany({
+    readonly organizationId: string;
-      where: { organizationId, parentId: null, archivedAt: null },
+    readonly actorFeishuOpenId: string;
-      select: { id: true, name: true },
+    readonly isOrgAdmin: boolean;
-      orderBy: [{ sortKey: "asc" }, { name: "asc" }],
+    readonly folderId: string | null;
-      take: 3,
+    readonly page: number;
-    });
+  }): Promise<ProjectOnboardingView> {
-    return folders.map((folder) => ({ folderId: folder.id, name: folder.name }));
+    return {
+      mode: "browse",
+      result: await browseBindableFolder({
+        prisma: deps.prisma,
+        organizationId: input.organizationId,
+        actorFeishuOpenId: input.actorFeishuOpenId,
+        isOrgAdmin: input.isOrgAdmin,
+        folderId: input.folderId,
+        page: input.page,
+      }),
+    };
   }
 
   return Object.assign(onMessage, { onCardAction, approvalManager });
@@ -1505,10 +1816,6 @@ function shortId(value: string): string {
   return value.length <= 8 ? value : value.slice(-8);
 }
 
-function escapeCardMarkdown(value: string): string {
-  return value.replace(/([`*_{}[\]<>])/g, "\\$1");
-}
-
 /** Lark text-message content: `{"text":"@_user_1 do something"}`. */
 const TextMessageContentSchema = z.object({ text: z.string() });
 
@@ -1651,27 +1958,3 @@ async function compensateFailedResourceAdmission(
     );
   }
 }
-
-/**
- * Parse a leading `/<role>` command from a prompt (e.g. `/draft 帮我写教案`).
- * Returns the role id and the remaining prompt with the command stripped.
- * Control/help commands already handled upstream are ignored here — they never
- * reach this function.
- *
- * Unknown `/foo` that isn't a registered role: returns `null` role and the
- * original prompt unchanged (the slash is treated as literal text). Role
- * resolution still happens via the registry's fallback.
- */
-export function extractRole(
-  prompt: string,
-  registry: { role(id: string): unknown },
-): { roleId: string | null; prompt: string } {
-  const m = /^\/(\S+)\s*/.exec(prompt);
-  if (m === null || m[1] === undefined) return { roleId: null, prompt };
-  const roleId = m[1];
-  if (registry.role(roleId) === undefined) {
-    // Unknown slash command — leave the prompt as-is (no silent role switch).
-    return { roleId: null, prompt };
-  }
-  return { roleId, prompt: prompt.slice(m[0].length) };
-}

hub/src/feishu/triggerQueue.ts

@@ -4,6 +4,9 @@ export interface QueuedTrigger {
   readonly projectId: string;
   readonly chatId: string;
   readonly prompt: string;
+  /** Role frozen when the message was accepted; later group switches cannot change it. */
+  readonly roleId: string;
+  readonly executionKind: "conversation" | "native_compact";
   readonly msg: MessageReceiveEvent["message"];
   readonly senderOpenId: string;
   readonly actor: { readonly feishuOpenId: string; readonly chatId: string };

hub/src/hub.ts

@@ -2,6 +2,7 @@ import Fastify from "fastify";
 import { registerAdminPlugin } from "./admin/plugin.js";
 import { prisma } from "./db.js";
 import { createLarkClient, startFeishuListenerWithClient } from "./feishu/client.js";
+import { archiveFeishuBindingForLifecycleEvent } from "./feishu/bindingLifecycle.js";
 import { makeTriggerHandler } from "./feishu/trigger.js";
 import { removeAbandonedMessageResourceStages } from "./feishu/resourceStaging.js";
 import { triggerQueue } from "./feishu/triggerQueue.js";
@@ -177,6 +178,10 @@ export async function startHub(): Promise<void> {
         process.exitCode = 1;
         void app.close().catch((error) => app.log.error({ err: error }, "Hub close after Feishu failure failed"));
       },
+      async (event) => {
+        const result = await archiveFeishuBindingForLifecycleEvent(prisma, event);
+        app.log.info({ ...event, archived: result.archived, projectId: result.projectId }, "feishu binding lifecycle event handled");
+      },
     );
   } else {
     app.log.info("feishu listener disabled by HUB_FEISHU_LISTENER_ENABLED");

hub/src/org/capacityPolicy.ts

@@ -0,0 +1,102 @@
+/**
+ * Org capacity policy service (ADR-0022 / spec `Spec.System.Capacity`).
+ *
+ * Stores per-Organization lower `organizationLimit` overrides per
+ * `CapacityDimension`. Enforces `LayeredLimit.Valid`: a set limit must be ≤ the
+ * platform ceiling for that dimension. `LayeredLimit.effective` (min of the two)
+ * is the value capacity admission should use; dimensions with no org override
+ * fall back to the platform ceiling.
+ */
+import type { PrismaClient } from "@prisma/client";
+import { CAPACITY_DIMENSIONS, isCapacityDimension, type CapacityDimension } from "../capacity/dimensions.js";
+import { readPlatformCeilings } from "../capacity/ceilings.js";
+import { lockActiveOrganization } from "./status.js";
+
+export interface CapacityPolicyView {
+  /** Per-dimension: platform ceiling (absent if not configured) + org limit. */
+  readonly dimensions: ReadonlyArray<{
+    readonly dimension: CapacityDimension;
+    readonly platformCeiling: number | null;
+    readonly organizationLimit: number | null;
+    readonly effective: number | null;
+  }>;
+}
+
+export async function getCapacityPolicy(
+  prisma: PrismaClient,
+  organizationId: string,
+): Promise<CapacityPolicyView> {
+  const row = await prisma.organizationCapacityPolicy.findUnique({
+    where: { organizationId },
+    select: { limits: true },
+  });
+  const orgLimits = parseLimits(row?.limits);
+  const ceilings = readPlatformCeilings();
+  const dimensions = CAPACITY_DIMENSIONS.map((dimension) => {
+    const platformCeiling = ceilings[dimension] ?? null;
+    const organizationLimit = orgLimits[dimension] ?? null;
+    const effective = effectiveLimit(platformCeiling, organizationLimit);
+    return { dimension, platformCeiling, organizationLimit, effective };
+  });
+  return { dimensions };
+}
+
+export async function setCapacityPolicy(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    /** Partial map of dimension → limit. null/absent clears a dimension. */
+    readonly limits: Partial<Record<CapacityDimension, number | null>>;
+  },
+): Promise<CapacityPolicyView> {
+  const ceilings = readPlatformCeilings();
+  const cleaned: Record<string, number> = {};
+  for (const [dimension, value] of Object.entries(input.limits)) {
+    if (!isCapacityDimension(dimension)) {
+      throw new Error(`unknown capacity dimension: ${dimension}`);
+    }
+    if (value === null || value === undefined) continue;
+    if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {
+      throw new Error(`limit for ${dimension} must be a positive integer`);
+    }
+    const ceiling = ceilings[dimension];
+    if (ceiling === undefined) {
+      throw new Error(
+        `platform ceiling for ${dimension} is not configured; cannot set an organization limit (spec LayeredLimit.Valid)`,
+      );
+    }
+    if (value > ceiling) {
+      throw new Error(
+        `organization limit ${value} for ${dimension} exceeds platform ceiling ${ceiling} (spec LayeredLimit.Valid)`,
+      );
+    }
+    cleaned[dimension] = value;
+  }
+
+  await prisma.$transaction(async (tx) => {
+    await lockActiveOrganization(tx, input.organizationId);
+    await tx.organizationCapacityPolicy.upsert({
+      where: { organizationId: input.organizationId },
+      create: { organizationId: input.organizationId, limits: cleaned },
+      update: { limits: cleaned },
+    });
+  });
+  return getCapacityPolicy(prisma, input.organizationId);
+}
+
+function effectiveLimit(platformCeiling: number | null, organizationLimit: number | null): number | null {
+  if (platformCeiling === null) return null;
+  if (organizationLimit === null) return platformCeiling;
+  return Math.min(platformCeiling, organizationLimit);
+}
+
+function parseLimits(raw: unknown): Partial<Record<CapacityDimension, number>> {
+  if (raw === null || typeof raw !== "object") return {};
+  const result: Partial<Record<CapacityDimension, number>> = {};
+  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
+    if (isCapacityDimension(key) && typeof value === "number" && Number.isFinite(value)) {
+      result[key] = value;
+    }
+  }
+  return result;
+}

hub/src/org/explorer.ts

@@ -4,7 +4,7 @@
  * Folders are transparent navigation nodes (not ACL resources). Project grants
  * stay on PROJECT. Archive folder refuses when active children/projects remain.
  */
-import type { Prisma, PrismaClient } from "@prisma/client";
+import { Prisma, type PrismaClient } from "@prisma/client";
 import {
   archiveFeishuChatBinding,
   createFolder,
@@ -12,6 +12,7 @@ import {
   moveProjectToFolder,
 } from "../projectOnboarding.js";
 import { lockActiveOrganization } from "./status.js";
+import { PrismaPrincipalResolver } from "../permissions/principals.js";
 
 export interface ExplorerFolderNode {
   readonly id: string;
@@ -123,11 +124,25 @@ export async function renameFolder(
   return prisma.$transaction(async (tx) => {
     await lockActiveOrganization(tx, input.organizationId);
     const folder = await requireActiveFolder(tx, input.folderId, input.organizationId);
+    if (folder.kind === "SYSTEM_INBOX" && (input.name !== undefined || input.parentId !== undefined)) {
+      throw new Error("system Inbox cannot be renamed or moved");
+    }
     if (input.parentId !== undefined && input.parentId !== null) {
       if (input.parentId === folder.id) {
         throw new Error("folder cannot be its own parent");
       }
       await requireActiveFolder(tx, input.parentId, input.organizationId);
+      const descendant = await tx.$queryRaw<Array<{ found: boolean }>>(Prisma.sql`
+        WITH RECURSIVE descendants AS (
+          SELECT "id" FROM "Folder" WHERE "parentId" = ${folder.id} AND "archivedAt" IS NULL
+          UNION ALL
+          SELECT child."id" FROM "Folder" child
+          JOIN descendants parent ON child."parentId" = parent."id"
+          WHERE child."archivedAt" IS NULL
+        )
+        SELECT EXISTS(SELECT 1 FROM descendants WHERE "id" = ${input.parentId}) AS found
+      `);
+      if (descendant[0]?.found === true) throw new Error("folder cannot be moved below its descendant");
     }
     const name =
       input.name !== undefined ? requireNonEmpty(input.name, "folder name") : undefined;
@@ -152,6 +167,7 @@ export async function archiveFolder(
   return prisma.$transaction(async (tx) => {
     await lockActiveOrganization(tx, input.organizationId);
     const folder = await requireActiveFolder(tx, input.folderId, input.organizationId);
+    if (folder.kind === "SYSTEM_INBOX") throw new Error("system Inbox cannot be archived");
     const childFolders = await tx.folder.count({
       where: { parentId: folder.id, archivedAt: null },
     });
@@ -320,14 +336,72 @@ export async function archiveOrgProjectChatBinding(
   });
 }
 
+/**
+ * Projects an org member can see via their resolved principals' READ+ grants
+ * (spec `PermissionGrant` / ADR-0004). Used by the member-facing project list
+ * — org-admin oversight uses `listOrgExplorer` instead.
+ */
+export async function listMyProjects(
+  prisma: PrismaClient,
+  input: { readonly organizationId: string; readonly actorFeishuOpenId: string },
+): Promise<readonly ExplorerProjectNode[]> {
+  const resolver = new PrismaPrincipalResolver(prisma);
+  const resolution = await resolver.resolveActor(
+    { feishuOpenId: input.actorFeishuOpenId },
+    { organizationId: input.organizationId },
+  );
+  // Match exact (type, id) pairs — independent IN filters form a cartesian
+  // product and can attribute another principal's grants to this actor.
+  if (resolution.principals.length === 0) return [];
+  const grants = await prisma.permissionGrant.findMany({
+    where: {
+      resourceType: "PROJECT",
+      revokedAt: null,
+      OR: resolution.principals.map((p) => ({
+        principalType: p.type,
+        principalId: p.id,
+      })),
+    },
+    select: { resourceId: true },
+    distinct: ["resourceId"],
+  });
+  const projectIds = grants.map((g) => g.resourceId);
+  if (projectIds.length === 0) return [];
+  const projects = await prisma.project.findMany({
+    where: { id: { in: projectIds }, organizationId: input.organizationId, archivedAt: null },
+    select: {
+      id: true,
+      name: true,
+      folderId: true,
+      createdAt: true,
+      groupBindings: {
+        where: { archivedAt: null },
+        select: { chatId: true, createdAt: true },
+        take: 1,
+      },
+    },
+    orderBy: { name: "asc" },
+  });
+  return projects.map((p) => {
+    const binding = p.groupBindings[0];
+    return {
+      id: p.id,
+      name: p.name,
+      folderId: p.folderId,
+      createdAt: p.createdAt.toISOString(),
+      binding: binding === undefined ? null : { chatId: binding.chatId, createdAt: binding.createdAt.toISOString() },
+    };
+  });
+}
+
 async function requireActiveFolder(
   prisma: PrismaClient | Prisma.TransactionClient,
   folderId: string,
   organizationId: string,
-): Promise<{ readonly id: string; readonly organizationId: string }> {
+): Promise<{ readonly id: string; readonly organizationId: string; readonly kind: "REGULAR" | "SYSTEM_INBOX" }> {
   const folder = await prisma.folder.findUnique({
     where: { id: folderId },
-    select: { id: true, organizationId: true, archivedAt: true },
+    select: { id: true, organizationId: true, kind: true, archivedAt: true },
   });
   if (folder === null || folder.archivedAt !== null || folder.organizationId !== organizationId) {
     throw new Error(`active folder not found: ${folderId}`);

hub/src/org/teams.ts

@@ -1,8 +1,9 @@
 /**
  * Hub team lifecycle for org admin (ADR-0019 / ADR-0021).
  *
- * Archiving a team soft-archives the team row and revokes active TEAM→PROJECT
+ * Archiving a team soft-archives the team row. Active TEAM→PROJECT grants and
- * grants that use this team as principal (product pin).
+ * memberships are left in place as dead rows: principal resolution refuses
+ * archived teams (see `permissions/principals.ts`), so they confer no access.
  */
 import type { Prisma, PrismaClient } from "@prisma/client";
 import { lockActiveOrganization } from "./status.js";
@@ -125,37 +126,21 @@ export async function updateTeam(
 }
 
 /**
- * Soft-archive team and revoke its active project grants (TEAM principal).
+ * Soft-archive team. Active grants/memberships are not cascade-revoked; the
+ * archived flag alone makes the team's principal unresolvable (no access).
  */
 export async function archiveTeam(
   prisma: PrismaClient,
   input: { readonly organizationId: string; readonly teamId: string },
-): Promise<{ readonly archived: true; readonly teamId: string; readonly revokedGrants: number }> {
+): Promise<{ readonly archived: true; readonly teamId: string }> {
   return prisma.$transaction(async (tx) => {
     await lockActiveOrganization(tx, input.organizationId);
     const team = await requireActiveTeam(tx, input.teamId, input.organizationId);
-    const now = new Date();
     await tx.team.update({
       where: { id: team.id },
-      data: { archivedAt: now },
+      data: { archivedAt: new Date() },
     });
-    await tx.teamMembership.updateMany({
+    return { archived: true as const, teamId: team.id };
-      where: { teamId: team.id, revokedAt: null },
-      data: { revokedAt: now },
-    });
-    const grants = await tx.permissionGrant.updateMany({
-      where: {
-        principalType: "TEAM",
-        principalId: team.id,
-        revokedAt: null,
-      },
-      data: { revokedAt: now },
-    });
-    return {
-      archived: true as const,
-      teamId: team.id,
-      revokedGrants: grants.count,
-    };
   });
 }
 

hub/src/permissions/externalSync.ts

@@ -71,7 +71,6 @@ export async function syncExternalPrincipalMemberships(
         create: {
           feishuOpenId: item.feishuOpenId,
           displayName: item.displayName,
-          platformRoles: { create: { role: "TEACHER" } },
           organizationMemberships: { create: { organizationId: input.organizationId, role: "MEMBER" } },
         },
       });

hub/src/permissions/projectTeamAccess.ts

@@ -131,9 +131,8 @@ export async function listProjectTeamAccess(
     where: {
       organizationId: project.organizationId,
       id: { in: grants.map((grant) => grant.principalId) },
-      archivedAt: null,
     },
-    select: { id: true, slug: true, name: true },
+    select: { id: true, slug: true, name: true, archivedAt: true },
   });
   const teamsById = new Map(teams.map((team) => [team.id, team]));
   const missing = grants.filter((grant) => !teamsById.has(grant.principalId));
@@ -143,13 +142,15 @@ export async function listProjectTeamAccess(
     );
   }
 
-  return grants.map((grant) => entryFromGrant({
+  return grants
-    grantId: grant.id,
+    .filter((grant) => teamsById.get(grant.principalId)?.archivedAt === null)
-    projectId: project.id,
+    .map((grant) => entryFromGrant({
-    organizationId: project.organizationId,
+      grantId: grant.id,
-    team: teamsById.get(grant.principalId)!,
+      projectId: project.id,
-    role: grant.role,
+      organizationId: project.organizationId,
-  }));
+      team: teamsById.get(grant.principalId)!,
+      role: grant.role,
+    }));
 }
 
 type ProjectForAccess = {