chore: retire openhub and pi ts runtime

rust/crates/control-plane/src/sqlite.rs

@@ -2160,18 +2160,31 @@ impl ControlPlaneStore for SqliteControlPlaneStore {
 
         let conn = self.lock_conn()?;
         let now = now_text();
-        let existing = conn
-            .query_row(
+        let existing = if let Some(workspace_id) = input.workspace_id.as_deref() {
+            conn.query_row(
                 "SELECT id, user_id, workspace_id, allowed_roots_json, model_policy_json, quota_json, created_at, updated_at, revision
                  FROM ai_policies
-                 WHERE (?1 IS NULL OR user_id = ?1)
-                   AND (?2 IS NULL OR workspace_id = ?2)
+                 WHERE workspace_id = ?1
                  ORDER BY created_at DESC
                  LIMIT 1",
-                params![input.user_id, input.workspace_id],
+                params![workspace_id],
                 row_to_ai_policy,
             )
-            .optional()?;
+            .optional()?
+        } else if let Some(user_id) = input.user_id.as_deref() {
+            conn.query_row(
+                "SELECT id, user_id, workspace_id, allowed_roots_json, model_policy_json, quota_json, created_at, updated_at, revision
+                 FROM ai_policies
+                 WHERE user_id = ?1 AND workspace_id IS NULL
+                 ORDER BY created_at DESC
+                 LIMIT 1",
+                params![user_id],
+                row_to_ai_policy,
+            )
+            .optional()?
+        } else {
+            None
+        };
 
         if let Some(existing) = existing {
             let revision = existing.revision + 1;
@@ -4067,6 +4080,52 @@ mod tests {
         assert_eq!(user_only.id, user_policy.id);
     }
 
+    #[test]
+    fn ai_policy_user_upsert_does_not_overwrite_workspace_policy() {
+        let store = store();
+        create_user(&store, "ai_user");
+        let workspace = store
+            .ensure_default_workspace("ai_user")
+            .expect("default workspace");
+
+        let workspace_policy = store
+            .upsert_ai_policy(UpsertAiPolicyInput {
+                id: None,
+                user_id: Some("ai_user".to_string()),
+                workspace_id: Some(workspace.id.clone()),
+                allowed_roots_json: "[\"file:///workspace-root\"]".to_string(),
+                model_policy_json: "{\"default\":\"workspace\"}".to_string(),
+                quota_json: "{}".to_string(),
+            })
+            .expect("workspace policy");
+
+        let user_policy = store
+            .upsert_ai_policy(UpsertAiPolicyInput {
+                id: None,
+                user_id: Some("ai_user".to_string()),
+                workspace_id: None,
+                allowed_roots_json: "[\"file:///user-root\"]".to_string(),
+                model_policy_json: "{\"default\":\"user\"}".to_string(),
+                quota_json: "{}".to_string(),
+            })
+            .expect("user policy");
+        assert_ne!(user_policy.id, workspace_policy.id);
+
+        let user_only = store
+            .get_ai_policy("ai_user", None)
+            .expect("get user policy")
+            .expect("user policy exists");
+        assert_eq!(user_only.id, user_policy.id);
+        assert!(user_only.allowed_roots_json.contains("user-root"));
+
+        let workspace_only = store
+            .get_ai_policy("ai_user", Some(&workspace.id))
+            .expect("get workspace policy")
+            .expect("workspace policy exists");
+        assert_eq!(workspace_only.id, workspace_policy.id);
+        assert!(workspace_only.allowed_roots_json.contains("workspace-root"));
+    }
+
     #[test]
     fn sync_state_upsert_tracks_cursor_status_and_revision() {
         let store = store();

rust/crates/control-plane/src/turso.rs

@@ -2684,18 +2684,31 @@ impl ControlPlaneStore for TursoControlPlaneStore {
 
         let conn = self.lock_conn()?;
         let now = now_text();
-        let existing = conn
-            .query_row(
+        let existing = if let Some(workspace_id) = input.workspace_id.as_deref() {
+            conn.query_row(
                 "SELECT id, user_id, workspace_id, allowed_roots_json, model_policy_json, quota_json, created_at, updated_at, revision
                  FROM ai_policies
-                 WHERE (?1 IS NULL OR user_id = ?1)
-                   AND (?2 IS NULL OR workspace_id = ?2)
+                 WHERE workspace_id = ?1
                  ORDER BY created_at DESC
                  LIMIT 1",
-                params![input.user_id, input.workspace_id],
+                params![workspace_id],
                 row_to_ai_policy,
             )
-            .optional()?;
+            .optional()?
+        } else if let Some(user_id) = input.user_id.as_deref() {
+            conn.query_row(
+                "SELECT id, user_id, workspace_id, allowed_roots_json, model_policy_json, quota_json, created_at, updated_at, revision
+                 FROM ai_policies
+                 WHERE user_id = ?1 AND workspace_id IS NULL
+                 ORDER BY created_at DESC
+                 LIMIT 1",
+                params![user_id],
+                row_to_ai_policy,
+            )
+            .optional()?
+        } else {
+            None
+        };
 
         if let Some(existing) = existing {
             let revision = existing.revision + 1;
@@ -4593,6 +4606,52 @@ mod tests {
         assert_eq!(user_only.id, user_policy.id);
     }
 
+    #[test]
+    fn ai_policy_user_upsert_does_not_overwrite_workspace_policy() {
+        let store = store();
+        create_user(&store, "ai_user");
+        let workspace = store
+            .ensure_default_workspace("ai_user")
+            .expect("default workspace");
+
+        let workspace_policy = store
+            .upsert_ai_policy(UpsertAiPolicyInput {
+                id: None,
+                user_id: Some("ai_user".to_string()),
+                workspace_id: Some(workspace.id.clone()),
+                allowed_roots_json: "[\"file:///workspace-root\"]".to_string(),
+                model_policy_json: "{\"default\":\"workspace\"}".to_string(),
+                quota_json: "{}".to_string(),
+            })
+            .expect("workspace policy");
+
+        let user_policy = store
+            .upsert_ai_policy(UpsertAiPolicyInput {
+                id: None,
+                user_id: Some("ai_user".to_string()),
+                workspace_id: None,
+                allowed_roots_json: "[\"file:///user-root\"]".to_string(),
+                model_policy_json: "{\"default\":\"user\"}".to_string(),
+                quota_json: "{}".to_string(),
+            })
+            .expect("user policy");
+        assert_ne!(user_policy.id, workspace_policy.id);
+
+        let user_only = store
+            .get_ai_policy("ai_user", None)
+            .expect("get user policy")
+            .expect("user policy exists");
+        assert_eq!(user_only.id, user_policy.id);
+        assert!(user_only.allowed_roots_json.contains("user-root"));
+
+        let workspace_only = store
+            .get_ai_policy("ai_user", Some(&workspace.id))
+            .expect("get workspace policy")
+            .expect("workspace policy exists");
+        assert_eq!(workspace_only.id, workspace_policy.id);
+        assert!(workspace_only.allowed_roots_json.contains("workspace-root"));
+    }
+
     #[test]
     fn sync_state_upsert_tracks_cursor_status_and_revision() {
         let store = store();

rust/crates/mnote-web/browser/sidebar-page-ai-pi-lab-runtime.js

@@ -1,7 +1,7 @@
 // == Pi Lab Page AI Runtime ==
 // MNote-native adapter for Pi-first Page AI Lab.
-// Renders the MNote-owned Pi Rust Page AI surface. OpenHub is kept as a
-// compatibility/admin boundary during migration, not as the default chat owner.
+// Renders the MNote-owned Pi Rust Page AI surface. Retired hosts stay in
+// recycle; this runtime must stay independent.
 // NO setInterval polling.
 //
 // UI note: @earendil-works/pi-web-ui@0.75.3 was checked as the mature upstream UI.

rust/crates/mnote-web/browser/sidebar-page-ai-runtime.js

@@ -199,12 +199,6 @@ export function createSidebarPageAiRuntime(context) {
       pageAiOpencodeEventSource: null,
       pageAiOpencodeEventSessionId: '',
       pageAiOpencodeEventTimer: 0,
-      pageAiOpenHubStatus: null,
-      pageAiOpenHubStatusError: '',
-      pageAiOpenHubBootstrap: null,
-      pageAiOpenHubIframeUrl: '',
-      pageAiOpenHubScopeSummary: '',
-      pageAiOpenHubFallbackReason: '',
       pageAiSessionSearchQuery: '',
       pageAiSessionSearchResults: [],
       pageAiSessionSearchTimer: 0,
@@ -892,10 +886,6 @@ export function createSidebarPageAiRuntime(context) {
     }
   }
 
-  function pageAiOpenHubHostEnabled() {
-    return true;
-  }
-
   function pageAiOpencodeStatusLabel(status) {
     var node = status && typeof status === 'object' ? status : {};
     var state = String(node.status || node.state || node.runtimeStatus || '').trim();
@@ -1151,116 +1141,6 @@ export function createSidebarPageAiRuntime(context) {
     return lines.join('\n');
   }
 
-  function pageAiOpenHubScopeSummary(scope) {
-    var node = scope && typeof scope === 'object' ? scope : {};
-    var workspace = node.workspaceScope && typeof node.workspaceScope === 'object' ? node.workspaceScope : {};
-    var items = [];
-    if (node.openhubUserKey || node.openhub_user_key) items.push('openhub_user_key=' + String(node.openhubUserKey || node.openhub_user_key));
-    if (node.openhubWorkspaceKey || node.workspace_key) items.push('workspace_key=' + String(node.openhubWorkspaceKey || node.workspace_key));
-    if (workspace.workspaceId) items.push('workspace=' + String(workspace.workspaceId));
-    if (workspace.rootUri) items.push('rootUri=' + String(workspace.rootUri));
-    if (node.openhubSessionScope || node.session_scope) items.push('session_scope=' + String(node.openhubSessionScope || node.session_scope));
-    if (node.skillScope || node.skill_scope) items.push('skill_scope=' + String(node.skillScope || node.skill_scope));
-    if (node.mcpScope) items.push('mcp_scope=' + String(node.mcpScope));
-    if (node.toolPermissionScope || node.tool_permission_scope) items.push('tool_permission_scope=' + String(node.toolPermissionScope || node.tool_permission_scope));
-    if (node.weknoraToolScope || node.weknora_tool_scope) items.push('weknora_tool_scope=' + String(node.weknoraToolScope || node.weknora_tool_scope));
-    return items.join('\n');
-  }
-
-  function pageAiOpenHubStatusText(status) {
-    var node = status && typeof status === 'object' ? status : {};
-    if (node.ok === true || String(node.status || '').trim() === 'ready') return '已连接 OpenHub';
-    if (String(node.status || '').trim() === 'degraded') return 'OpenHub 连接受限';
-    return '正在连接 OpenHub';
-  }
-
-  function pageAiRenderOpenHubHostChrome() {
-    var drawer = document.querySelector('[data-testid="wolai-page-ai-drawer"]');
-    if (!(drawer instanceof HTMLElement) || drawer.getAttribute('data-page-ai-openhub-host') !== 'true') return;
-    var bootstrap = pageUiState.pageAiOpenHubBootstrap && typeof pageUiState.pageAiOpenHubBootstrap === 'object' ? pageUiState.pageAiOpenHubBootstrap : {};
-    var scope = bootstrap.scope && typeof bootstrap.scope === 'object' ? bootstrap.scope : {};
-    var status = pageUiState.pageAiOpenHubStatus && typeof pageUiState.pageAiOpenHubStatus === 'object' ? pageUiState.pageAiOpenHubStatus : {};
-    var statusNode = drawer.querySelector('[data-page-ai-openhub-runtime-status]');
-    if (statusNode instanceof HTMLElement) {
-      statusNode.textContent = pageUiState.pageAiOpenHubStatusError || pageAiOpenHubStatusText(status);
-      statusNode.setAttribute('data-state', pageUiState.pageAiOpenHubStatusError ? 'error' : (status.ok ? 'ok' : 'degraded'));
-    }
-    var userNode = drawer.querySelector('[data-page-ai-openhub-user-key]');
-    if (userNode instanceof HTMLElement) userNode.textContent = String(scope.openhubUserKey || scope.openhub_user_key || '等待 bootstrap');
-    var authNode = drawer.querySelector('[data-page-ai-openhub-auth-truth]');
-    if (authNode instanceof HTMLElement) authNode.textContent = '登录真相：MNote mnote_session；拒绝 OpenHub JWT/localStorage';
-    var workspaceNode = drawer.querySelector('[data-page-ai-openhub-workspace-scope]');
-    if (workspaceNode instanceof HTMLElement) workspaceNode.textContent = pageAiOpenHubScopeSummary(scope) || '等待 workspace/rootUri/session/tool scope';
-    var guardNode = drawer.querySelector('[data-page-ai-openhub-route-guard]');
-    if (guardNode instanceof HTMLElement) guardNode.textContent = '非 AI 路由 guard：login/admin/file/knowledge 由 MNote 接管';
-    var fallbackNode = drawer.querySelector('[data-page-ai-openhub-fallback]');
-    if (fallbackNode instanceof HTMLElement) {
-      fallbackNode.textContent = pageUiState.pageAiOpenHubFallbackReason || 'OpenHub 不可用时提示用户刷新或检查服务，不再提供 opencode 页面回退';
-    }
-    var iframe = drawer.querySelector('[data-page-ai-openhub-iframe]');
-    if (iframe instanceof HTMLIFrameElement) {
-      var nextUrl = String(pageUiState.pageAiOpenHubIframeUrl || bootstrap.openhubIframeUrl || '/page-ai/openhub/ai').trim();
-      if (nextUrl && iframe.getAttribute('src') !== nextUrl) iframe.setAttribute('src', nextUrl);
-      iframe.hidden = !nextUrl;
-    }
-  }
-
-  function pageAiEnsureOpenHubHostDrawer() {
-    var drawer = ensurePageAiDrawer();
-    pageAiInstallMNoteOpenFileBridge();
-    if (drawer.getAttribute('data-page-ai-openhub-host') !== 'true') {
-      drawer.setAttribute('data-page-ai-openhub-host', 'true');
-      drawer.removeAttribute('data-page-ai-opencode-host');
-      drawer.setAttribute('data-mnote-acp-runtime', 'openhub-opencode');
-      drawer.innerHTML = '' +
-        '<div class="wolai-page-ai-resize-handle" data-page-ai-resize-handle title="拖动调整页面 AI 宽度" aria-hidden="true"></div>' +
-        '<div class="wolai-page-ai-panel wolai-page-ai-opencode-panel" role="dialog" aria-modal="false" aria-label="OpenHub AI">' +
-          '<details class="wolai-page-ai-openhub-diagnostics" data-page-ai-openhub-bootstrap-copy hidden aria-hidden="true">' +
-            '<summary>诊断</summary>' +
-            '<div class="wolai-page-ai-opencode-row"><span>用户隔离</span><code data-page-ai-openhub-user-key>等待 bootstrap</code></div>' +
-            '<div class="wolai-page-ai-opencode-row"><span>认证边界</span><strong data-page-ai-openhub-auth-truth>登录真相：MNote mnote_session</strong></div>' +
-            '<pre class="wolai-page-ai-opencode-empty" data-page-ai-openhub-workspace-scope>等待 workspace/rootUri/session/tool scope</pre>' +
-            '<div class="wolai-page-ai-opencode-badges"><span data-page-ai-openhub-route-guard>非 AI 路由 guard：login/admin/file/knowledge</span><span data-page-ai-openhub-fallback>OpenHub 不可用时提示刷新或检查服务</span></div>' +
-          '</details>' +
-          '<div class="wolai-page-ai-opencode-frame-wrap" data-page-ai-openhub-frame-wrap>' +
-            '<iframe class="wolai-page-ai-opencode-iframe" data-page-ai-openhub-iframe title="OpenHub AI 面板" allow="clipboard-read; clipboard-write" referrerpolicy="same-origin" src="about:blank"></iframe>' +
-          '</div>' +
-        '</div>';
-    }
-    pageAiRenderOpenHubHostChrome();
-    void pageAiBootstrapOpenHubHost();
-    return drawer;
-  }
-
-  async function pageAiBootstrapOpenHubHost() {
-    var context = pageAiBuildOpencodeContextPayload();
-    try {
-      var statusResponse = await fetch('/api/page-ai/openhub/status', { headers: { accept: 'application/json' }, cache: 'no-store' });
-      pageUiState.pageAiOpenHubStatus = await statusResponse.json().catch(function() { return null; }) || {};
-      var response = await fetch('/api/page-ai/openhub/bootstrap', {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', accept: 'application/json' },
-        cache: 'no-store',
-        body: JSON.stringify(context)
-      });
-      var payload = await response.json().catch(function() { return null; });
-      if (!response.ok) throw new Error(payload && (payload.error || payload.message) ? String(payload.error || payload.message) : 'HTTP ' + response.status);
-      pageUiState.pageAiOpenHubBootstrap = payload || {};
-      pageUiState.pageAiOpenHubStatusError = '';
-      pageUiState.pageAiOpenHubIframeUrl = String(payload && payload.openhubIframeUrl || '/page-ai/openhub/ai').trim();
-      var statusFallback = pageUiState.pageAiOpenHubStatus && pageUiState.pageAiOpenHubStatus.fallback ? pageUiState.pageAiOpenHubStatus.fallback : null;
-      pageUiState.pageAiOpenHubFallbackReason = payload && payload.fallback
-        ? String(payload.fallback.reason || '')
-        : (statusFallback ? String(statusFallback.reason || '') : '');
-      pageUiState.pageAiOpenHubScopeSummary = pageAiOpenHubScopeSummary(payload && payload.scope);
-      pageAiRenderOpenHubHostChrome();
-    } catch (error) {
-      pageUiState.pageAiOpenHubStatusError = error instanceof Error ? error.message : String(error);
-      pageUiState.pageAiOpenHubFallbackReason = 'OpenHub bootstrap 不可用，请刷新或检查 OpenHub 服务';
-      pageAiRenderOpenHubHostChrome();
-    }
-  }
-
   function pageAiPostOpencodeBridgeMessage(type, payload) {
     var iframe = document.querySelector('[data-page-ai-opencode-iframe]');
     if (!(iframe instanceof HTMLIFrameElement) || !iframe.contentWindow) return false;
@@ -1268,45 +1148,6 @@ export function createSidebarPageAiRuntime(context) {
     return true;
   }
 
-  function pageAiInstallMNoteOpenFileBridge() {
-    if (pageUiState.pageAiMNoteOpenFileBridgeInstalled) return;
-    pageUiState.pageAiMNoteOpenFileBridgeInstalled = true;
-    window.addEventListener('message', function(event) {
-      if (event.origin !== window.location.origin) return;
-      var message = event.data && typeof event.data === 'object' ? event.data : null;
-      if (message && message.source === 'openhub-ai' && message.type === 'mnote:minimize-openhub') {
-        closePageAiDrawer();
-        return;
-      }
-      if (message && message.source === 'openhub-ai' && message.type === 'mnote:get-active-tab-address') {
-        var addressPayload = pageAiCurrentActiveTabAddressPayload();
-        var requestPayload = message.payload && typeof message.payload === 'object' ? message.payload : {};
-        var kind = String(requestPayload.kind || message.kind || 'tab').trim();
-        var value = kind === 'folder' ? addressPayload.folderUrl : addressPayload.tabUrl;
-        if (event.source && typeof event.source.postMessage === 'function') {
-          event.source.postMessage({
-            source: 'mnote-page-ai',
-            type: 'mnote:active-tab-address',
-            requestId: message.requestId || '',
-            payload: Object.assign({}, addressPayload, {
-              kind: kind === 'folder' ? 'folder' : 'tab',
-              value: value
-            })
-          }, event.origin);
-        }
-        return;
-      }
-      if (!message || (message.type !== 'mnote:open-file' && message.type !== 'mnote:open-reference')) return;
-      if (message.source !== 'openhub-diff' && message.source !== 'openhub-changed-files' && message.source !== 'openhub-citation') return;
-      var payload = message.payload && typeof message.payload === 'object' ? message.payload : {};
-      pageAiOpenOpencodeChangedFile(message.path || payload.path || payload.href || '', {
-        rootUri: String(message.rootUri || payload.rootUri || payload.root_uri || currentRootUri() || '').trim(),
-        workspaceId: String(message.workspaceId || payload.workspaceId || payload.workspace_id || resolveWorkspaceId(document.body) || '').trim(),
-        documentId: String(message.documentId || payload.documentId || payload.document_id || '').trim()
-      });
-    });
-  }
-
   function pageAiInstallOpencodeBridge() {
     if (pageUiState.pageAiOpencodeBridgeInstalled) return;
     pageUiState.pageAiOpencodeBridgeInstalled = true;
@@ -1540,10 +1381,8 @@ export function createSidebarPageAiRuntime(context) {
 
   function pageAiEnsureOpencodeHostDrawer() {
     var drawer = ensurePageAiDrawer();
-    pageAiInstallMNoteOpenFileBridge();
     if (drawer.getAttribute('data-page-ai-opencode-host') !== 'true') {
       drawer.setAttribute('data-page-ai-opencode-host', 'true');
-      drawer.removeAttribute('data-page-ai-openhub-host');
       drawer.setAttribute('data-mnote-acp-runtime', 'opencode');
       drawer.innerHTML = '' +
         '<div class="wolai-page-ai-resize-handle" data-page-ai-resize-handle title="拖动调整页面 AI 宽度" aria-hidden="true"></div>' +
@@ -1828,17 +1667,17 @@ export function createSidebarPageAiRuntime(context) {
     if (isMarkdown) {
       if (window.__mnoteLocalFolderEventBus && typeof window.__mnoteLocalFolderEventBus.emitChangedFiles === 'function') {
         window.__mnoteLocalFolderEventBus.emitChangedFiles({
-          source: 'openhub_changed_file_bridge',
-          reason: 'openhub_changed_file',
+          source: 'opencode_changed_file_bridge',
+          reason: 'opencode_changed_file',
           rootUri: rootUri,
           workspaceId: workspaceId,
           changedFiles: [{ relativePath: targetPath, documentId: documentId, changeType: 'modified' }],
-          affectedParents: [{ relativePath: pageAiParentRelativePath(targetPath), reason: 'openhub_changed_file' }]
+          affectedParents: [{ relativePath: pageAiParentRelativePath(targetPath), reason: 'opencode_changed_file' }]
         });
       }
       if (typeof window.__mnoteDocumentPaneRuntime.openPrimaryDocument === 'function') {
         if (documentId === String(currentDocumentId() || '').trim()) {
-          document.documentElement.setAttribute('data-mnote-page-ai-openhub-document-pane-refresh', targetPath);
+          document.documentElement.setAttribute('data-mnote-page-ai-opencode-document-pane-refresh', targetPath);
           return true;
         }
         void window.__mnoteDocumentPaneRuntime.openPrimaryDocument({
@@ -1847,7 +1686,7 @@ export function createSidebarPageAiRuntime(context) {
           sourceKind: currentSourceKind() || 'local_folder',
           rootUri: rootUri
         });
-        document.documentElement.setAttribute('data-mnote-page-ai-openhub-document-pane-refresh', targetPath);
+        document.documentElement.setAttribute('data-mnote-page-ai-opencode-document-pane-refresh', targetPath);
         return true;
       }
     }
@@ -3872,20 +3711,6 @@ export function createSidebarPageAiRuntime(context) {
 
 
   function openPageAiDrawer() {
-    if (pageAiOpenHubHostEnabled()) {
-      pageAiEnsureContextRefState();
-      void pageAiLoadAllowedRoots().then(function() {
-        pageAiRenderOpenHubHostChrome();
-      }).catch(function() {
-        pageAiRenderOpenHubHostChrome();
-      });
-      var openhubDrawer = pageAiEnsureOpenHubHostDrawer();
-      pageAiApplyDrawerWidth(openhubDrawer);
-      openhubDrawer.hidden = false;
-      pageUiState.pageAiOpen = true;
-      updatePageAiTriggerState();
-      return;
-    }
     if (pageAiOpencodeHostEnabled()) {
       pageAiEnsureContextRefState();
       void pageAiLoadAllowedRoots().then(function() {
@@ -5095,9 +4920,6 @@ export function createSidebarPageAiRuntime(context) {
           });
         }
       }
-      if (action === 'openhub-refresh-bootstrap') {
-        void pageAiBootstrapOpenHubHost();
-      }
       if (action === 'cancel-queued-run') {
         void pageAiCancelQueuedRun(pageAiAction.getAttribute('data-page-ai-queue-id'));
       }

rust/crates/mnote-web/src/provider_identity_sync.rs

@@ -1,13 +1,10 @@
 use crate::error::WebError;
-use control_plane::{ControlPlaneStore, DirectoryGrantRecord, UserRecord};
+use control_plane::UserRecord;
 use reqwest::header::{HeaderMap, HeaderValue};
 use serde_json::{json, Value};
-use std::collections::hash_map::DefaultHasher;
 use std::env;
-use std::hash::{Hash, Hasher};
 use std::time::Duration;
 
-const DEFAULT_OPENHUB_BASE_URL: &str = "http://127.0.0.1:18080";
 const DEFAULT_WEKNORA_ENDPOINT: &str = "http://127.0.0.1:8080/api/v1";
 const PROVIDER_IDENTITY_SYNC_TIMEOUT_MS: u64 = 1_500;
 
@@ -31,13 +28,6 @@ fn clean_url(value: String) -> Option<String> {
     (!trimmed.is_empty()).then_some(trimmed)
 }
 
-fn openhub_base_url() -> String {
-    env::var("MNOTE_OPENHUB_BASE_URL")
-        .ok()
-        .and_then(clean_url)
-        .unwrap_or_else(|| DEFAULT_OPENHUB_BASE_URL.to_string())
-}
-
 fn weknora_endpoint() -> String {
     env::var("MNOTE_WEKNORA_ENDPOINT")
         .or_else(|_| env::var("WEKNORA_ENDPOINT"))
@@ -67,12 +57,6 @@ fn internal_headers() -> HeaderMap {
     headers
 }
 
-fn stable_openhub_user_id(user_id: &str) -> i64 {
-    let mut hasher = DefaultHasher::new();
-    format!("mnote-openhub-user:{user_id}").hash(&mut hasher);
-    (hasher.finish() % 1_900_000_000) as i64 + 100_000_000
-}
-
 fn fallback_email(user: &UserRecord) -> String {
     user.email
         .as_deref()
@@ -82,13 +66,6 @@ fn fallback_email(user: &UserRecord) -> String {
         .unwrap_or_else(|| format!("{}@mnote.local", user.username))
 }
 
-fn default_workspace_path(user: &UserRecord) -> String {
-    format!(
-        "/mnt/Data1T/Mnote_data/users/{}/workspaces/my-space",
-        user.id
-    )
-}
-
 fn sync_disabled() -> bool {
     !env_flag("MNOTE_PROVIDER_IDENTITY_SYNC", true)
 }
@@ -96,7 +73,6 @@ fn sync_disabled() -> bool {
 pub async fn sync_provider_identities(
     user: &UserRecord,
     password: &str,
-    directory_grants: &[DirectoryGrantRecord],
 ) -> Vec<ProviderIdentitySyncResult> {
     if sync_disabled() {
         return vec![ProviderIdentitySyncResult {
@@ -107,78 +83,16 @@ pub async fn sync_provider_identities(
         }];
     }
 
-    let sync_openhub = env_flag("MNOTE_PROVIDER_IDENTITY_SYNC_OPENHUB", true);
     let sync_weknora = env_flag("MNOTE_PROVIDER_IDENTITY_SYNC_WEKNORA", true);
-
-    match (sync_openhub, sync_weknora) {
-        (true, true) => {
-            let (openhub, weknora) = tokio::join!(
-                sync_openhub_identity(user, password, directory_grants),
-                sync_weknora_identity(user, password)
-            );
-            vec![openhub, weknora]
-        }
-        (true, false) => vec![sync_openhub_identity(user, password, directory_grants).await],
-        (false, true) => vec![sync_weknora_identity(user, password).await],
-        (false, false) => vec![ProviderIdentitySyncResult {
+    if sync_weknora {
+        vec![sync_weknora_identity(user, password).await]
+    } else {
+        vec![ProviderIdentitySyncResult {
             provider: "all",
             ok: true,
             message: "provider identity sync disabled".to_string(),
             provider_user_id: None,
-        }],
-    }
-}
-
-pub async fn sync_openhub_directory_permissions_for_user_id(
-    control_plane: &dyn ControlPlaneStore,
-    user_id: &str,
-) -> ProviderIdentitySyncResult {
-    if sync_disabled() || !env_flag("MNOTE_PROVIDER_IDENTITY_SYNC_OPENHUB", true) {
-        return ProviderIdentitySyncResult {
-            provider: "openhub",
-            ok: true,
-            message: "provider identity sync disabled".to_string(),
-            provider_user_id: None,
-        };
-    }
-    let user_id = user_id.trim();
-    let provider_user_id = stable_openhub_user_id(user_id);
-    let directory_grants = match control_plane.list_directory_grants_for_actor(user_id) {
-        Ok(grants) => grants,
-        Err(error) => {
-            return ProviderIdentitySyncResult {
-                provider: "openhub",
-                ok: false,
-                message: format!("mnote directory grants read failed: {error}"),
-                provider_user_id: Some(provider_user_id.to_string()),
-            };
-        }
-    };
-    let payload = json!({
-        "mnote_user_id": user_id,
-        "allowedRoots": openhub_allowed_roots_payload(&directory_grants),
-    });
-    match post_json(
-        join_url(
-            &openhub_base_url(),
-            &format!("/api/internal/mnote/users/{provider_user_id}/directory-permissions/sync"),
-        ),
-        payload,
-    )
-    .await
-    {
-        Ok(_) => ProviderIdentitySyncResult {
-            provider: "openhub",
-            ok: true,
-            message: "directory permissions synced".to_string(),
-            provider_user_id: Some(provider_user_id.to_string()),
-        },
-        Err(error) => ProviderIdentitySyncResult {
-            provider: "openhub",
-            ok: false,
-            message: error.message().to_string(),
-            provider_user_id: Some(provider_user_id.to_string()),
-        },
+        }]
     }
 }
 
@@ -210,74 +124,6 @@ async fn post_json(url: String, body: Value) -> Result<Value, WebError> {
     Ok(payload)
 }
 
-async fn sync_openhub_identity(
-    user: &UserRecord,
-    password: &str,
-    directory_grants: &[DirectoryGrantRecord],
-) -> ProviderIdentitySyncResult {
-    let provider_user_id = stable_openhub_user_id(&user.id);
-    let payload = json!({
-        "provider_user_id": provider_user_id,
-        "mnote_user_id": user.id,
-        "username": user.username,
-        "email": fallback_email(user),
-        "password": password,
-        "workspace_path": default_workspace_path(user),
-        "allowedRoots": openhub_allowed_roots_payload(directory_grants),
-        "disabled": user.status != "active",
-        "is_admin": false,
-    });
-    match post_json(
-        join_url(&openhub_base_url(), "/api/internal/mnote/users/provision"),
-        payload,
-    )
-    .await
-    {
-        Ok(_) => ProviderIdentitySyncResult {
-            provider: "openhub",
-            ok: true,
-            message: "synced".to_string(),
-            provider_user_id: Some(provider_user_id.to_string()),
-        },
-        Err(error) => ProviderIdentitySyncResult {
-            provider: "openhub",
-            ok: false,
-            message: error.message().to_string(),
-            provider_user_id: Some(provider_user_id.to_string()),
-        },
-    }
-}
-
-fn openhub_allowed_roots_payload(directory_grants: &[DirectoryGrantRecord]) -> Vec<Value> {
-    directory_grants
-        .iter()
-        .filter(|grant| !is_default_workspace_auto_grant(grant))
-        .filter(|grant| grant.status.trim() == "active")
-        .filter(|grant| !grant.root_path.trim().is_empty())
-        .map(|grant| {
-            json!({
-                "grantId": grant.id,
-                "rootUri": grant.root_uri,
-                "rootPath": grant.root_path,
-                "permission": grant.permission,
-                "recursive": grant.recursive,
-                "capabilities": serde_json::from_str::<Vec<String>>(&grant.capabilities_json).unwrap_or_default(),
-                "source": grant.source,
-            })
-        })
-        .collect()
-}
-
-fn is_default_workspace_auto_grant(grant: &DirectoryGrantRecord) -> bool {
-    grant.source.trim() == "auto"
-        && grant.permission.trim() == "write"
-        && grant.recursive
-        && grant.created_by.as_deref().map(str::trim) == Some(grant.user_id.as_str())
-        && grant.workspace_id.is_some()
-        && grant.root_uri.starts_with("local://users/")
-        && grant.root_uri.ends_with("/workspaces/my-space")
-}
-
 async fn sync_weknora_identity(user: &UserRecord, password: &str) -> ProviderIdentitySyncResult {
     let payload = json!({
         "mnote_user_id": user.id,

rust/crates/mnote-web/src/routes/gateway.rs

@@ -2301,16 +2301,7 @@ async fn handle_control_plane_auth_action(
     });
 
     let provider_sync_results = if matches!(flow, "signUp" | "signIn") {
-        let directory_grants = state
-            .control_plane()
-            .list_directory_grants_for_actor(&resolved.user.id)
-            .unwrap_or_default();
-        let results = sync_provider_identities(
-            &resolved.user,
-            &password_for_provider_sync,
-            &directory_grants,
-        )
-        .await;
+        let results = sync_provider_identities(&resolved.user, &password_for_provider_sync).await;
         let _ = state.control_plane().append_audit(AppendAuditInput {
             actor_user_id: Some(resolved.user.id.clone()),
             action: "control.auth.provider_identities_synced".to_string(),

rust/crates/mnote-web/src/routes/local_folder_source.rs

@@ -5,7 +5,6 @@ use crate::page_aggregate::{
     PageAggregate, PageAggregateSource, PageBody, PageHead, PageIdentity, PageLayout, PageOptions,
     PagePermissions, PageStats, PageTree,
 };
-use crate::provider_identity_sync::sync_openhub_directory_permissions_for_user_id;
 use crate::routes::local_markdown_parser::{
     file_stem_title, parse_markdown_attachment_refs, parse_markdown_page, split_frontmatter,
 };
@@ -2442,14 +2441,6 @@ pub async fn create_local_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = add_control_plane_local_access_grant_for_context(&state, &context, request)
         .map_err(|error| error.with_context(&context))?;
-    if let Some(user_id) = payload
-        .pointer("/grant/userId")
-        .and_then(Value::as_str)
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
-    }
     Ok((StatusCode::OK, Json(payload)))
 }
 
@@ -2460,14 +2451,6 @@ pub async fn create_user_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = add_control_plane_user_access_grant_for_context(&state, &context, request)
         .map_err(|error| error.with_context(&context))?;
-    if let Some(user_id) = payload
-        .pointer("/grant/userId")
-        .and_then(Value::as_str)
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
-    }
     Ok((StatusCode::OK, Json(payload)))
 }
 
@@ -2478,14 +2461,6 @@ pub async fn delete_local_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = delete_control_plane_local_access_grant_for_context(&state, &context, &grant_id)
         .map_err(|error| error.with_context(&context))?;
-    if let Some(user_id) = payload
-        .get("revokedUserId")
-        .and_then(Value::as_str)
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
-    }
     Ok((StatusCode::OK, Json(payload)))
 }
 
@@ -2496,14 +2471,6 @@ pub async fn delete_user_access_grant(
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let payload = delete_control_plane_user_access_grant_for_context(&state, &context, &grant_id)
         .map_err(|error| error.with_context(&context))?;
-    if let Some(user_id) = payload
-        .get("revokedUserId")
-        .and_then(Value::as_str)
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
-    }
     Ok((StatusCode::OK, Json(payload)))
 }
 

rust/crates/mnote-web/src/routes/mod.rs

@@ -28,7 +28,6 @@ mod onlyoffice;
 pub(crate) mod onlyoffice_bridge;
 mod page_ai_board;
 mod page_ai_opencode;
-mod page_ai_openhub;
 mod page_ai_pi;
 mod page_ai_workflow;
 mod query_support;
@@ -408,68 +407,6 @@ pub fn build_router(state: AppState) -> Router {
             "/api/page-ai/opencode/status",
             get(page_ai_opencode::status),
         )
-        .route("/api/page-ai/openhub/status", get(page_ai_openhub::status))
-        .route(
-            "/api/page-ai/openhub/bootstrap",
-            post(page_ai_openhub::bootstrap),
-        )
-        .route(
-            "/api/page-ai/openhub/artifact-index",
-            get(page_ai_openhub::artifact_index_get).post(page_ai_openhub::artifact_index_upsert),
-        )
-        .route("/page-ai/openhub/ai", get(page_ai_openhub::ai_shell))
-        .route(
-            "/page-ai/openhub/ai/{*path}",
-            any(page_ai_openhub::ai_proxy),
-        )
-        .route(
-            "/page-ai/openhub/login",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/login/{*path}",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/admin",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/admin/{*path}",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/file",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/file/{*path}",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/files",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/files/{*path}",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/knowledge",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/knowledge/{*path}",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/git",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
-        .route(
-            "/page-ai/openhub/git/{*path}",
-            any(page_ai_openhub::non_ai_route_guard),
-        )
         .route(
             "/api/page-ai/opencode/session",
             post(page_ai_opencode::bind_session),

rust/crates/mnote-web/src/routes/page_ai_pi.rs

@@ -1,6 +1,6 @@
 //! Pi-first Page AI Lab — MNote 托管的后端垂直切片。
 //!
-//! 该模块默认启用 MNote 托管的 Pi Rust Page AI 后端；OpenHub 仅保留为迁移期兼容 / admin 边界。
+//! 该模块默认启用 MNote 托管的 Pi Rust Page AI 后端；OpenHub 与 Pi TS 已退役到 recycle 边界。
 //! Pi 进程通过 RPC subprocess 托管，MNote bridge tools 在 Rust 后端按 allowed roots 执行权限校验。
 
 use crate::app::AppState;
@@ -60,7 +60,6 @@ const PI_LAB_MAX_STARTS_PER_WINDOW: usize = 4;
 const PI_LAB_MAX_SENDS_PER_WINDOW: usize = 12;
 const PI_LAB_MAX_TOOLS_PER_WINDOW: usize = 40;
 const PI_LAB_RUNTIME_IMPL_RUST: &str = "pi-rust";
-const PI_LAB_RUNTIME_IMPL_TS: &str = "pi-ts";
 const PI_LAB_MANAGED_BUILTIN_TOOLS: [&str; 8] = [
     "read",
     "write",
@@ -970,9 +969,6 @@ fn pi_binary() -> String {
     if let Some(explicit) = env_trimmed("MNOTE_PAGE_AI_PI_BIN") {
         return explicit;
     }
-    if pi_runtime_impl() == PI_LAB_RUNTIME_IMPL_TS {
-        return env_trimmed("MNOTE_PAGE_AI_PI_TS_BIN").unwrap_or_else(|| "pi".into());
-    }
     env_trimmed("MNOTE_PAGE_AI_PI_RUST_BIN")
         .or_else(first_existing_pi_rust_binary)
         .unwrap_or_else(|| "pi-rust".into())
@@ -983,7 +979,6 @@ fn pi_runtime_impl() -> String {
         .or_else(|| env_trimmed("MNOTE_PAGE_AI_PI_RUNTIME_IMPL"))
         .unwrap_or_else(|| PI_LAB_RUNTIME_IMPL_RUST.into());
     match raw.trim().to_ascii_lowercase().as_str() {
-        "ts" | "typescript" | "pi-ts" | "legacy-ts" => PI_LAB_RUNTIME_IMPL_TS.into(),
         "rust" | "rs" | "pi-rust" | "pi_agent_rust" | "pi-agent-rust" => {
             PI_LAB_RUNTIME_IMPL_RUST.into()
         }
@@ -1026,15 +1021,10 @@ fn pi_runtime_binary_available(binary: &str) -> bool {
         .any(|candidate| candidate.is_file())
 }
 
-fn pi_runtime_install_hint(runtime_impl: &str, binary: &str) -> Option<String> {
+fn pi_runtime_install_hint(_runtime_impl: &str, binary: &str) -> Option<String> {
     if runtime_mode() == "mock" || pi_runtime_binary_available(binary) {
         return None;
     }
-    if runtime_impl == PI_LAB_RUNTIME_IMPL_TS {
-        return Some(format!(
-            "未找到 Pi TS runtime: {binary}。请设置 MNOTE_PAGE_AI_PI_TS_BIN 或 MNOTE_PAGE_AI_PI_BIN。"
-        ));
-    }
     Some(format!(
         "未找到 Pi Rust runtime: {binary}。请安装到 ~/.local/share/mnote/pi-rust/bin/pi，或设置 MNOTE_PAGE_AI_PI_RUST_BIN / MNOTE_PAGE_AI_PI_BIN。"
     ))

rust/crates/mnote-web/src/ssr/pages/ai_admin.rs

@@ -1272,7 +1272,6 @@ const AI_ADMIN_SCRIPT: &str = r#"
 
     function renderServicePanels(piStatus, effectivePayload) {
       var providers = effectivePayload && Array.isArray(effectivePayload.providers) ? effectivePayload.providers : [];
-      var openhubStatus = '兼容保留';
       var defaultModel = effectivePayload && (effectivePayload.defaultModel || effectivePayload.default_model || '');
       var piDefaultModel = piStatus
         ? normalizeModelRef(piStatus.defaultModelProvider || piStatus.default_model_provider, piStatus.defaultModelId || piStatus.default_model_id)
@@ -1329,20 +1328,6 @@ const AI_ADMIN_SCRIPT: &str = r#"
                 '</details>' +
               '</div>' +
             '</div>' +
-            '<div class="mnote-ai-admin-admin-card">' +
-              '<div class="mnote-ai-admin-admin-card-head"><h3>OpenHub</h3><span class="mnote-ai-admin-actions-bar">' +
-                renderTag(openhubStatus, 'orange') +
-                '<a href="/page-ai/openhub/admin" class="mnote-ai-admin-policy-link">打开 OpenHub Admin</a>' +
-              '</span></div>' +
-              '<div class="mnote-ai-admin-admin-card-body">' +
-                '<div class="mnote-ai-admin-kv-grid">' +
-                  renderKv('定位', '迁移期兼容 / admin 边界，不再作为默认 Page AI chat') +
-                  renderKv('MNote 侧入口', '/page-ai/openhub/ai') +
-                  renderKv('管理入口', '/page-ai/openhub/admin') +
-                  renderKv('后续策略', '只保留一个用户 Page AI 入口，OpenHub 不再扩展重复面板能力') +
-                '</div>' +
-              '</div>' +
-            '</div>' +
           '</div>';
       }
       if (channelsPanel) {
@@ -1408,7 +1393,6 @@ const AI_ADMIN_SCRIPT: &str = r#"
       if (healthGrid) {
         healthGrid.innerHTML = [
           ['Pi Rust Page AI', piRunning ? '运行中' : (piRuntimeAvailable ? '可启动' : '不可用'), 'impl=' + piRuntimeImpl + ' · runtime=' + piRuntime + ' · model=' + piDefaultModel],
-          ['OpenHub', '兼容保留', '迁移期 admin / fallback 边界，不再作为默认 Page AI chat'],
           ['LightRAG', '默认', '唯一默认 knowledge provider，Pi 通过 MNote facade 查询'],
           ['Control-plane', effectivePayload && (effectivePayload.sourceOfTruth || effectivePayload.source_of_truth) || 'directory_grants', '授权、策略、receipt 真相层']
         ].map(function(item) {
@@ -1605,7 +1589,7 @@ const AI_ADMIN_SCRIPT: &str = r#"
         '</div>';
       var body = '';
       if (activePanel === 'tools') {
-        body = '<div class="mnote-ai-admin-user-section"><div class="mnote-ai-admin-user-section-title"><h3>工具权限</h3><small>按 OpenHub risk_level 分组</small></div>' + (tools || '<div class="mnote-ai-admin-empty">暂无工具</div>') + '</div>';
+        body = '<div class="mnote-ai-admin-user-section"><div class="mnote-ai-admin-user-section-title"><h3>工具权限</h3><small>按 MNote policy 分组</small></div>' + (tools || '<div class="mnote-ai-admin-empty">暂无工具</div>') + '</div>';
       } else if (activePanel === 'skills') {
         body = '<div class="mnote-ai-admin-user-section"><div class="mnote-ai-admin-user-section-title"><h3>Skills</h3><small>全局启用后用户可单独降权</small></div>' + (skills || '<div class="mnote-ai-admin-empty">暂无 Skill</div>') + '</div>';
       } else if (activePanel === 'mcp') {
@@ -1621,7 +1605,7 @@ const AI_ADMIN_SCRIPT: &str = r#"
           '</div>' +
           (roots || '<div class="mnote-ai-admin-empty">暂无可单独管理的目录权限</div>') + '</div>';
       } else {
-        body = '<div class="mnote-ai-admin-user-section"><div class="mnote-ai-admin-user-section-title"><h3>模型权限</h3><small>按 provider 分组，参考 OpenHub 用户模型权限</small></div>' + (modelRows || '<div class="mnote-ai-admin-empty">暂无可用模型</div>') +
+        body = '<div class="mnote-ai-admin-user-section"><div class="mnote-ai-admin-user-section-title"><h3>模型权限</h3><small>按 provider/model policy 分组</small></div>' + (modelRows || '<div class="mnote-ai-admin-empty">暂无可用模型</div>') +
           '<label class="mnote-ai-admin-label">默认模型</label><select class="mnote-ai-admin-select" data-user-default-model>' +
           catalogModels.filter(function(model) { return allowedIds.has(model.id); }).map(function(model) {
             return '<option value="' + escapeHtml(model.id) + '"' + (payload.defaultModel === model.id ? ' selected' : '') + '>' + escapeHtml(model.name || model.id) + '</option>';
@@ -1719,10 +1703,21 @@ const AI_ADMIN_SCRIPT: &str = r#"
       var allowedModels = selectedUserSettings && selectedUserSettings.allowedModels
         ? selectedUserSettings.allowedModels.map(function(model) { return model.id; })
         : [];
+      var catalogModelIds = new Set((selectedUserSettings && selectedUserSettings.catalogModels || []).map(function(model) { return model.id; }).filter(Boolean));
+      if (catalogModelIds.size) {
+        allowedModels = allowedModels.filter(function(modelId) { return catalogModelIds.has(modelId); });
+      }
       if (modelInputs.length) {
         allowedModels = Array.from(userSettingsEditor.querySelectorAll('[data-user-model]:checked')).map(function(input) { return input.getAttribute('data-user-model'); });
       }
       var defaultSelect = userSettingsEditor.querySelector('[data-user-default-model]');
+      var defaultModel = defaultSelect ? defaultSelect.value : ((selectedUserSettings && selectedUserSettings.defaultModel) || '');
+      if (catalogModelIds.size && defaultModel && !catalogModelIds.has(defaultModel)) {
+        defaultModel = allowedModels[0] || '';
+      }
+      if (defaultModel && allowedModels.indexOf(defaultModel) === -1) {
+        defaultModel = allowedModels[0] || '';
+      }
       var tools = {};
       (selectedUserSettings && selectedUserSettings.tools || []).forEach(function(tool) {
         tools[tool.name] = tool.action;
@@ -1752,16 +1747,19 @@ const AI_ADMIN_SCRIPT: &str = r#"
         piExtensions[input.getAttribute('data-user-pi-extension')] = input.checked;
       });
       try {
+        var payload = {
+          tools: tools,
+          skills: skills,
+          mcpServers: mcpServers,
+          piExtensions: piExtensions
+        };
+        if (modelInputs.length || defaultSelect) {
+          payload.allowedModels = allowedModels;
+          payload.defaultModel = defaultModel;
+        }
         await requestJson('/api/ai-admin/users/' + encodeURIComponent(selectedUserId) + '/settings', {
           method: 'PUT',
-          body: JSON.stringify({
-            allowedModels: allowedModels,
-            defaultModel: defaultSelect ? defaultSelect.value : ((selectedUserSettings && selectedUserSettings.defaultModel) || ''),
-            tools: tools,
-            skills: skills,
-            mcpServers: mcpServers,
-            piExtensions: piExtensions
-          })
+          body: JSON.stringify(payload)
         });
         showSaveStatus(userSettingsStatus, 'success', '用户 AI 配置已保存');
         await loadUserSettings(selectedUserId);
@@ -1835,7 +1833,7 @@ const AI_ADMIN_SCRIPT: &str = r#"
       try {
         piStatus = await requestJson('/api/page-ai/pi/status', { method: 'GET' });
       } catch (_err) {
-        // Pi Lab 状态失败不阻塞 OpenHub / 管理页主面板。
+        // Pi Lab 状态失败不阻塞管理页主面板。
       }
       renderServicePanels(piStatus, payload);
     }
@@ -2518,13 +2516,18 @@ const AI_ADMIN_SCRIPT: &str = r#"
         }
         var allowedRaw = val('allowedModels');
         var failoverRaw = val('failoverChains');
+        var allowedModels = allowedRaw ? allowedRaw.split(',').map(function(s) { return s.trim(); }).filter(Boolean) : [];
+        var defaultModel = val('defaultModel');
+        if (defaultModel && allowedModels.length && allowedModels.indexOf(defaultModel) === -1) {
+          defaultModel = allowedModels[0];
+        }
         return {
           id: val('id'),
           name: val('name'),
           baseUrl: val('baseUrl'),
           secretRef: val('secretRef'),
-          allowedModels: allowedRaw ? allowedRaw.split(',').map(function(s) { return s.trim(); }).filter(Boolean) : [],
-          defaultModel: val('defaultModel'),
+          allowedModels: allowedModels,
+          defaultModel: defaultModel,
           defaultBuildModel: val('defaultBuildModel'),
           defaultPlanModel: val('defaultPlanModel'),
           defaultTaskModel: val('defaultTaskModel'),
@@ -3029,7 +3032,7 @@ pub fn AiManagementPage(
                 <div class="mnote-ai-admin-section-header">
                     <div>
                         <h2>"用户管理"</h2>
-                        <p class="mnote-ai-admin-section-desc">"参考 OpenHub：用户、逐用户模型/工具/目录授权"</p>
+                        <p class="mnote-ai-admin-section-desc">"用户、逐用户模型/工具/目录授权"</p>
                     </div>
                 </div>
                 <div class="mnote-ai-admin-section-body">
@@ -3083,9 +3086,8 @@ pub fn AiManagementPage(
                 <div class="mnote-ai-admin-section-header">
                     <div>
                         <h2>"Pi Rust 服务"</h2>
-                        <p class="mnote-ai-admin-section-desc">"Pi Rust 是默认 Page AI runtime；OpenHub 仅保留为迁移期兼容 / admin 边界"</p>
+                        <p class="mnote-ai-admin-section-desc">"Pi Rust 是默认 Page AI runtime；历史 host 已软归档到 recycle 边界"</p>
                     </div>
-                    <a href="/page-ai/openhub/admin" class="mnote-ai-admin-policy-link">"打开 OpenHub Admin"</a>
                 </div>
                 <div class="mnote-ai-admin-section-body">
                     <div data-ai-admin-service-panel>
@@ -3263,7 +3265,7 @@ pub fn AiManagementPage(
                 <div class="mnote-ai-admin-section-header">
                     <div>
                         <h2>"渠道管理"</h2>
-                        <p class="mnote-ai-admin-section-desc">"OpenHub 的渠道管理在 MNote 中收敛为 provider/model policy"</p>
+                        <p class="mnote-ai-admin-section-desc">"渠道管理在 MNote 中收敛为 provider/model policy"</p>
                     </div>
                 </div>
                 <div class="mnote-ai-admin-section-body">
@@ -3308,7 +3310,7 @@ pub fn AiManagementPage(
                 <div class="mnote-ai-admin-section-header">
                     <div>
                         <h2>"系统监控"</h2>
-                        <p class="mnote-ai-admin-section-desc">"以 AI 相关服务健康为主，不复制 OpenHub 进程管理"</p>
+                        <p class="mnote-ai-admin-section-desc">"以 AI 相关服务健康为主，不复制已退役 host 进程管理"</p>
                     </div>
                 </div>
                 <div class="mnote-ai-admin-section-body">

rust/crates/mnote-web/src/ssr/styles/components/page-ai.css

@@ -2221,71 +2221,10 @@ button.wolai-page-ai-history-main span {
   overflow: hidden;
 }
 
-.wolai-page-ai-drawer[data-page-ai-openhub-host="true"] .wolai-page-ai-panel {
-  display: flex;
-  flex-direction: column;
-  gap: 0;
-  padding: 0;
-  border: 0;
-  overflow: hidden;
-}
-
-.wolai-page-ai-drawer[data-page-ai-openhub-host="true"] .wolai-page-ai-resize-handle {
-  left: -12px;
-}
-
 .wolai-page-ai-opencode-header {
   flex: 0 0 auto;
 }
 
-.wolai-page-ai-openhub-diagnostics {
-  flex: 0 0 auto;
-  max-height: 32px;
-  overflow: hidden;
-  border-bottom: 1px solid rgba(27, 28, 28, 0.08);
-  background: rgba(247, 247, 245, 0.78);
-  color: rgba(27, 28, 28, 0.58);
-  font-size: 12px;
-}
-
-.wolai-page-ai-openhub-diagnostics[hidden] {
-  display: none !important;
-}
-
-.wolai-page-ai-openhub-diagnostics summary {
-  min-height: 32px;
-  display: flex;
-  align-items: center;
-  padding: 0 12px;
-  cursor: pointer;
-  list-style: none;
-}
-
-.wolai-page-ai-openhub-diagnostics summary::-webkit-details-marker {
-  display: none;
-}
-
-.wolai-page-ai-openhub-diagnostics:not([open]) > :not(summary) {
-  display: none !important;
-}
-
-.wolai-page-ai-openhub-diagnostics[open] {
-  max-height: min(36vh, 220px);
-  overflow: auto;
-  padding-bottom: 10px;
-}
-
-.wolai-page-ai-openhub-diagnostics[open] summary {
-  margin-bottom: 6px;
-}
-
-.wolai-page-ai-openhub-diagnostics .wolai-page-ai-opencode-row,
-.wolai-page-ai-openhub-diagnostics .wolai-page-ai-opencode-empty,
-.wolai-page-ai-openhub-diagnostics .wolai-page-ai-opencode-badges {
-  margin-right: 12px;
-  margin-left: 12px;
-}
-
 .wolai-page-ai-opencode-chrome {
   display: flex;
   flex: 0 0 auto;