fix: enforce active organization boundary

hub/src/hub.ts

@@ -3,6 +3,7 @@ import { registerAdminPlugin } from "./admin/plugin.js";
 import { prisma } from "./db.js";
 import { createLarkClient, startFeishuListenerWithClient } from "./feishu/client.js";
 import { makeTriggerHandler } from "./feishu/trigger.js";
+import { removeAbandonedMessageResourceStages } from "./feishu/resourceStaging.js";
 import { triggerQueue } from "./feishu/triggerQueue.js";
 import { createEnvRuntimeSettings } from "./settings/runtime.js";
 import { readServerBinding } from "./settings/server.js";
@@ -24,6 +25,11 @@ function booleanEnv(name: string, fallback: boolean): boolean {
 /** Start the Hub after every import and runtime dependency has loaded. */
 export async function startHub(): Promise<void> {
   requireEnv("DATABASE_URL");
+  const projectWorkspaceRoot = requireEnv("HUB_PROJECT_WORKSPACE_ROOT");
+  const app = Fastify({ logger: true });
+
+  const abandonedStages = await removeAbandonedMessageResourceStages(projectWorkspaceRoot);
+  app.log.info({ removed: abandonedStages }, "startup: removed abandoned Feishu resource stages");
 
   const runtimeSettings = createEnvRuntimeSettings();
   await runtimeSettings.provider("openrouter");
@@ -31,13 +37,10 @@ export async function startHub(): Promise<void> {
   const feishuAppId = requireEnv("FEISHU_APP_ID");
   const feishuAppSecret = requireEnv("FEISHU_APP_SECRET");
   const feishuBotOpenId = requireEnv("FEISHU_BOT_OPEN_ID");
-  const projectWorkspaceRoot = requireEnv("HUB_PROJECT_WORKSPACE_ROOT");
   const sessionSecret = requireEnv("HUB_SESSION_SECRET");
   const publicBaseUrl = process.env["HUB_PUBLIC_BASE_URL"] ?? "http://127.0.0.1:8788";
   const bind = readServerBinding();
 
-  const app = Fastify({ logger: true });
-
   // Startup reset: clear stale locks + mark dead runs as FAILED.
   await prisma.projectAgentLock.deleteMany({});
   await prisma.agentRun.updateMany({