chore: align sqlite control plane architecture

- replace default Convex control-plane wording with Rust SQLite control-plane across architecture, AGENTS, Reasonix, and design docs

- retire root Convex functions source and deploy script into recycle while keeping explicit cloud/compat/sync-replica boundaries

- add control-plane migration guard/docs and keep CodeGraph refreshed after the SQLite control-plane cutover

rust/crates/mnote-web/Cargo.toml

@@ -9,6 +9,7 @@ authors.workspace = true
 adapter-onlyoffice = { path = "../adapter-onlyoffice" }
 axum = { version = "0.8", features = ["multipart", "ws"] }
 bridge-runtime = { path = "../bridge-runtime" }
+control-plane = { path = "../control-plane" }
 core-protocol = { path = "../core-protocol" }
 futures-util = "0.3"
 hyper = "1"
@@ -30,3 +31,4 @@ base64 = "0.22"
 comrak = { version = "0.52", default-features = false }
 notify = "8.2.0"
 time = { version = "0.3", features = ["formatting", "local-offset"] }
+uuid = { version = "1", features = ["v4"] }

rust/crates/mnote-web/src/app.rs

@@ -5,6 +5,7 @@ use crate::local_folder_watcher_registry::LocalFolderWatcherRegistry;
 use crate::middleware::request_context::inject_request_context;
 use crate::routes::build_router;
 use axum::Router;
+use control_plane::{ControlPlaneStore, SqliteControlPlaneStore};
 use std::env;
 use std::fs;
 use std::sync::Arc;
@@ -137,7 +138,7 @@ fn read_env_or_dotenv(key: &str) -> Option<String> {
 
 use tokio::sync::broadcast;
 
-#[derive(Debug, Clone)]
+#[derive(Clone)]
 pub struct AppState {
     config: Arc<AppConfig>,
     local_folder_watcher_registry: LocalFolderWatcherRegistry,
@@ -146,6 +147,7 @@ pub struct AppState {
     pub stream_delta_tx: broadcast::Sender<serde_json::Value>,
     pub acp_runtime: Arc<AcpRuntimeManager>,
     pub buffer_store: BufferStore,
+    control_plane: Arc<SqliteControlPlaneStore>,
 }
 
 impl AppState {
@@ -155,6 +157,7 @@ impl AppState {
         let actor = EditorRuntimeActor::new();
         actor.set_block_delta_tx(block_delta_tx.clone());
         let buffer_store = BufferStore::new();
+        let control_plane = Arc::new(open_control_plane_store());
         Self {
             config: Arc::new(config),
             local_folder_watcher_registry: LocalFolderWatcherRegistry::new(buffer_store.clone()),
@@ -163,6 +166,7 @@ impl AppState {
             stream_delta_tx,
             acp_runtime: Arc::new(AcpRuntimeManager::from_env()),
             buffer_store,
+            control_plane,
         }
     }
 
@@ -173,6 +177,27 @@ impl AppState {
     pub fn local_folder_watcher_registry(&self) -> &LocalFolderWatcherRegistry {
         &self.local_folder_watcher_registry
     }
+
+    pub fn control_plane(&self) -> &dyn ControlPlaneStore {
+        self.control_plane.as_ref()
+    }
+}
+
+#[cfg(test)]
+fn open_control_plane_store() -> SqliteControlPlaneStore {
+    SqliteControlPlaneStore::in_memory().expect("初始化测试 SQLite 控制面")
+}
+
+#[cfg(not(test))]
+fn open_control_plane_store() -> SqliteControlPlaneStore {
+    let db_path = env::var("MNOTE_CONTROL_PLANE_DB_PATH")
+        .ok()
+        .filter(|value| !value.trim().is_empty())
+        .unwrap_or_else(|| "/mnt/Data1T/Mnote_data/control-plane/control-plane.db".to_string());
+    if let Some(parent) = std::path::Path::new(&db_path).parent() {
+        fs::create_dir_all(parent).expect("创建 SQLite 控制面目录");
+    }
+    SqliteControlPlaneStore::open(&db_path).expect("初始化 SQLite 控制面")
 }
 
 pub fn build_app(state: AppState) -> Router {
@@ -180,3 +205,61 @@ pub fn build_app(state: AppState) -> Router {
         .layer(TraceLayer::new_for_http())
         .layer(axum::middleware::from_fn(inject_request_context))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use control_plane::UpsertUserInput;
+
+    fn test_config() -> AppConfig {
+        AppConfig {
+            service_name: "mnote-web".into(),
+            service_version: "0.1.0".into(),
+            bind_addr: "127.0.0.1:0".into(),
+            public_bind_addr: "127.0.0.1:3000".into(),
+            legacy_next_base_url: None,
+            enable_legacy_next_compat: false,
+            enable_debug_shell_routes: false,
+            enable_editor_actor: true,
+            hermes_base_path: "/api/hermes".into(),
+            compat_next_base_path: "/api/compat/next".into(),
+            convex_url: None,
+            convex_admin_key: None,
+            allow_dev_fixtures: false,
+            query_fixtures_json: None,
+            mutation_fixtures_json: None,
+            dev_user_id: "dev-user".into(),
+            dev_user_name: "开发用户".into(),
+            dev_user_email: "dev@mnote.local".into(),
+        }
+    }
+
+    #[test]
+    fn app_state_initializes_sqlite_control_plane_store() {
+        let state = AppState::new(test_config());
+
+        state
+            .control_plane()
+            .upsert_user(UpsertUserInput {
+                id: Some("shujuan".into()),
+                email: Some("shujuan@163.com".into()),
+                username: "shujuan".into(),
+                display_name: "shujuan".into(),
+                role: None,
+                password_hash: None,
+            })
+            .expect("upsert user");
+
+        let workspace = state
+            .control_plane()
+            .ensure_default_workspace("shujuan")
+            .expect("default workspace");
+        assert_eq!(workspace.name, "shujuan 的空间");
+
+        let access = state
+            .control_plane()
+            .resolve_access("shujuan", &workspace.root_uri)
+            .expect("owner access");
+        assert_eq!(access.permission, "write");
+    }
+}

rust/crates/mnote-web/src/hermes_tools/mod.rs

@@ -195,7 +195,10 @@ pub struct CommandContextBridge {
 /// - 如果提供了 `bridge` 且 `workspace_readonly == true`，拒绝
 ///
 /// 拒绝响应可解释（包含具体原因），不静默成功，不 panic。
-pub fn ensure_write_authorized(context: &RequestContext, input: &ToolCallInput) -> Result<(), WebError> {
+pub fn ensure_write_authorized(
+    context: &RequestContext,
+    input: &ToolCallInput,
+) -> Result<(), WebError> {
     if !input.has_idempotency_key() {
         return Err(WebError::bad_request_code(
             "mnote_tool_idempotency_required",

rust/crates/mnote-web/src/routes/hermes_client.rs

@@ -9,6 +9,7 @@ use axum::extract::{Extension, Path, Query, State};
 use axum::http::{header, HeaderMap, HeaderName, HeaderValue, StatusCode};
 use axum::response::Response;
 use axum::Json;
+use control_plane::{AppendAiRuntimeEventInput, UpsertAiRuntimeRunInput};
 use futures_util::TryStreamExt;
 use serde::Deserialize;
 use serde_json::{json, Value};
@@ -27,8 +28,7 @@ use tracing::{info, warn};
 
 const HEADER_MNOTE_WEB_OWNER: &str = "x-mnote-web-owner";
 const HEADER_HERMES_CLIENT_OWNER: &str = "x-mnote-hermes-client-owner";
-const ACP_RUNTIME_RUN_MUTATION: &str = "aiSessions:upsertRuntimeRun";
-const ACP_RUNTIME_EVENT_MUTATION: &str = "aiSessions:appendRuntimeEvent";
+const ACP_RUNTIME_SQLITE_STORE: &str = "sqlite_acp_runtime_store";
 const ACP_ABORT_NOTIFICATION_TIMEOUT_MS: u64 = 2_500;
 const LOCAL_SHARE_GRANTS_JSON: &str = "/mnt/Data1T/Mnote_data/control-plane/share-grants.json";
 const ENV_LOCAL_SHARE_GRANTS_FILE: &str = "MNOTE_SHARE_GRANTS_FILE";
@@ -252,6 +252,50 @@ pub async fn search_sessions(
             .and_then(|value| value.parse::<u64>().ok())
             .unwrap_or(20)
             .clamp(1, 50);
+        if !use_legacy_convex_acp_store(&query) {
+            let runs = state
+                .control_plane()
+                .list_ai_runtime_runs(
+                    &user_id,
+                    workspace_id.as_deref(),
+                    None,
+                    None,
+                    limit as usize,
+                )
+                .map_err(|error| {
+                    WebError::internal(format!("SQLite ACP session 搜索失败: {error}"))
+                        .with_context(&context)
+                })?;
+            let needle = q.to_lowercase();
+            let results = runs
+                .iter()
+                .filter(|run| {
+                    run.title
+                        .as_deref()
+                        .unwrap_or_default()
+                        .to_lowercase()
+                        .contains(&needle)
+                        || run.payload_json.to_lowercase().contains(&needle)
+                })
+                .map(|run| {
+                    let mut value = ai_runtime_run_to_json(run);
+                    value["snippet"] =
+                        Value::String(run.title.clone().unwrap_or_else(|| run.session_id.clone()));
+                    value["score"] = Value::from(1);
+                    value
+                })
+                .collect::<Vec<_>>();
+            return Ok((
+                StatusCode::OK,
+                stamp_client_headers(),
+                Json(json!({
+                    "ok": true,
+                    "traceId": context.trace.trace_id,
+                    "persistence": ACP_RUNTIME_SQLITE_STORE,
+                    "results": results
+                })),
+            ));
+        }
         let mut args = serde_json::Map::new();
         args.insert("userId".into(), Value::String(user_id));
         args.insert("q".into(), Value::String(q.to_string()));
@@ -364,6 +408,31 @@ async fn list_acp_sessions(
         .and_then(|value| value.parse::<u64>().ok())
         .unwrap_or(50)
         .clamp(1, 100);
+    if !use_legacy_convex_acp_store(query) {
+        let runs = state
+            .control_plane()
+            .list_ai_runtime_runs(
+                &user_id,
+                workspace_id.as_deref(),
+                document_id.as_deref(),
+                session_id.as_deref(),
+                limit as usize,
+            )
+            .map_err(|error| {
+                WebError::internal(format!("SQLite ACP session 列表读取失败: {error}"))
+                    .with_context(context)
+            })?;
+        return Ok((
+            StatusCode::OK,
+            stamp_client_headers(),
+            Json(json!({
+                "ok": true,
+                "traceId": context.trace.trace_id,
+                "persistence": ACP_RUNTIME_SQLITE_STORE,
+                "sessions": runs.iter().map(ai_runtime_run_to_json).collect::<Vec<_>>()
+            })),
+        ));
+    }
     let mut args = serde_json::Map::new();
     args.insert("userId".into(), Value::String(user_id));
     if let Some(workspace_id) = workspace_id {
@@ -582,7 +651,7 @@ pub async fn create_session(
             &runtime_payload,
         )
         .await?;
-        persistence = "convex_acp_runtime_store";
+        persistence = ACP_RUNTIME_SQLITE_STORE;
     }
     Ok((
         StatusCode::OK,
@@ -978,7 +1047,10 @@ pub async fn resume_session(
         let result = get_acp_session(&state, &context, &session_id, &query).await?;
         let mut payload = result.2 .0;
         payload["resumed"] = Value::Bool(true);
-        payload["resumeSource"] = Value::String("convex_acp_runtime_store".into());
+        payload["resumeSource"] = payload
+            .get("persistence")
+            .cloned()
+            .unwrap_or_else(|| Value::String(ACP_RUNTIME_SQLITE_STORE.into()));
         return Ok((result.0, result.1, Json(payload)));
     }
     get_session(
@@ -997,6 +1069,36 @@ pub async fn delete_session(
     Query(query): Query<HashMap<String, String>>,
 ) -> Result<(StatusCode, HeaderMap, Json<Value>), WebError> {
     ensure_authenticated(&context)?;
+    if !use_legacy_convex_acp_store(&query) {
+        let user_id = effective_session_store_user_id(&state, &context).await?;
+        let workspace_id = query
+            .get("workspaceId")
+            .map(String::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(ToOwned::to_owned)
+            .or_else(|| context.workspace.workspace_id.clone());
+        let deleted = state
+            .control_plane()
+            .delete_ai_runtime_session(&user_id, &session_id, workspace_id.as_deref())
+            .map_err(|error| {
+                WebError::internal(format!("SQLite ACP session 删除失败: {error}"))
+                    .with_context(&context)
+            })?;
+        return Ok((
+            StatusCode::OK,
+            stamp_client_headers(),
+            Json(json!({
+                "ok": true,
+                "persistence": ACP_RUNTIME_SQLITE_STORE,
+                "result": {
+                    "ok": true,
+                    "sessionId": session_id,
+                    "deleted": deleted
+                }
+            })),
+        ));
+    }
     let result = execute_acp_session_mutation(
         &state,
         &context,
@@ -1035,6 +1137,37 @@ pub async fn rename_session(
                 .with_header(HEADER_HERMES_CLIENT_OWNER, "mnote-web-hermes-client"),
         );
     }
+    if !use_legacy_convex_acp_store(&query) {
+        let user_id = effective_session_store_user_id(&state, &context).await?;
+        let workspace_id = query
+            .get("workspaceId")
+            .map(String::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(ToOwned::to_owned)
+            .or_else(|| context.workspace.workspace_id.clone());
+        let runs = state
+            .control_plane()
+            .rename_ai_runtime_session(&user_id, &session_id, workspace_id.as_deref(), title)
+            .map_err(|error| {
+                WebError::internal(format!("SQLite ACP session 重命名失败: {error}"))
+                    .with_context(&context)
+            })?;
+        return Ok((
+            StatusCode::OK,
+            stamp_client_headers(),
+            Json(json!({
+                "ok": true,
+                "persistence": ACP_RUNTIME_SQLITE_STORE,
+                "result": {
+                    "ok": true,
+                    "sessionId": session_id,
+                    "title": title,
+                    "runs": runs.iter().map(ai_runtime_run_to_json).collect::<Vec<_>>()
+                }
+            })),
+        ));
+    }
     let result = execute_acp_session_mutation(
         &state,
         &context,
@@ -1063,6 +1196,38 @@ pub async fn auto_title_session(
     Query(query): Query<HashMap<String, String>>,
 ) -> Result<(StatusCode, HeaderMap, Json<Value>), WebError> {
     ensure_authenticated(&context)?;
+    if !use_legacy_convex_acp_store(&query) {
+        let user_id = effective_session_store_user_id(&state, &context).await?;
+        let workspace_id = query
+            .get("workspaceId")
+            .map(String::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(ToOwned::to_owned)
+            .or_else(|| context.workspace.workspace_id.clone());
+        let titled = state
+            .control_plane()
+            .auto_title_ai_runtime_session(&user_id, &session_id, workspace_id.as_deref())
+            .map_err(|error| {
+                WebError::internal(format!("SQLite ACP session 自动标题失败: {error}"))
+                    .with_context(&context)
+            })?;
+        let title = titled.as_ref().and_then(|run| run.title.clone());
+        return Ok((
+            StatusCode::OK,
+            stamp_client_headers(),
+            Json(json!({
+                "ok": true,
+                "persistence": ACP_RUNTIME_SQLITE_STORE,
+                "result": {
+                    "ok": true,
+                    "sessionId": session_id,
+                    "title": title,
+                    "run": titled.as_ref().map(ai_runtime_run_to_json)
+                }
+            })),
+        ));
+    }
     let result = execute_acp_session_mutation(
         &state,
         &context,
@@ -1177,6 +1342,54 @@ async fn get_acp_session(
         .filter(|value| !value.is_empty())
         .map(ToOwned::to_owned)
         .or_else(|| context.workspace.workspace_id.clone());
+    if !use_legacy_convex_acp_store(query) {
+        let runs = state
+            .control_plane()
+            .list_ai_runtime_runs(
+                &user_id,
+                workspace_id.as_deref(),
+                None,
+                Some(session_id),
+                20,
+            )
+            .map_err(|error| {
+                WebError::internal(format!("SQLite ACP session 详情读取失败: {error}"))
+                    .with_context(context)
+            })?;
+        let latest_run = runs.first().cloned();
+        let events = if let Some(run) = latest_run.as_ref() {
+            state
+                .control_plane()
+                .list_ai_runtime_events(&user_id, &run.run_id, 200)
+                .map_err(|error| {
+                    WebError::internal(format!("SQLite ACP runtime events 读取失败: {error}"))
+                        .with_context(context)
+                })?
+        } else {
+            Vec::new()
+        };
+        let runtime = latest_run
+            .as_ref()
+            .and_then(|run| serde_json::from_str::<Value>(&run.runtime_json).ok())
+            .unwrap_or_else(|| runtime_state_for_session(session_id));
+        return Ok((
+            StatusCode::OK,
+            stamp_client_headers(),
+            Json(json!({
+                "ok": true,
+                "traceId": context.trace.trace_id,
+                "persistence": ACP_RUNTIME_SQLITE_STORE,
+                "sessionId": session_id,
+                "session": {
+                    "sessionId": session_id,
+                    "messages": [],
+                    "runs": runs.iter().map(ai_runtime_run_to_json).collect::<Vec<_>>()
+                },
+                "runtime": runtime,
+                "events": events.iter().map(ai_runtime_event_to_json).collect::<Vec<_>>()
+            })),
+        ));
+    }
     let mut run_args = serde_json::Map::new();
     run_args.insert("userId".into(), Value::String(user_id.clone()));
     run_args.insert("sessionId".into(), Value::String(session_id.to_string()));
@@ -1327,7 +1540,7 @@ pub async fn create_run(
             "persistence": persistence_result
                 .get("persistence")
                 .and_then(Value::as_str)
-                .unwrap_or("convex_acp_runtime_store"),
+                .unwrap_or(ACP_RUNTIME_SQLITE_STORE),
             "sessionStorage": persistence_result
                 .get("sessionStorage")
                 .cloned()
@@ -4232,6 +4445,61 @@ fn acp_runtime_run_store_args(
     })
 }
 
+fn json_string(value: &Value) -> String {
+    serde_json::to_string(value).unwrap_or_else(|_| "{}".to_string())
+}
+
+fn ai_runtime_run_to_json(record: &control_plane::AiRuntimeRunRecord) -> Value {
+    let runtime = serde_json::from_str::<Value>(&record.runtime_json).unwrap_or(Value::Null);
+    let payload = serde_json::from_str::<Value>(&record.payload_json).unwrap_or(Value::Null);
+    json!({
+        "sessionId": record.session_id,
+        "runId": record.run_id,
+        "workspaceId": record.workspace_id,
+        "documentId": record.document_id,
+        "title": record.title,
+        "profile": record.profile,
+        "acpRuntime": record.acp_runtime,
+        "traceId": record.trace_id,
+        "status": record.status,
+        "runtime": runtime,
+        "payload": payload,
+        "createdAt": record.created_at,
+        "updatedAt": record.updated_at,
+        "persistence": ACP_RUNTIME_SQLITE_STORE,
+    })
+}
+
+fn ai_runtime_event_to_json(record: &control_plane::AiRuntimeEventRecord) -> Value {
+    let payload = serde_json::from_str::<Value>(&record.payload_json).unwrap_or(Value::Null);
+    json!({
+        "eventId": record.id,
+        "sessionId": record.session_id,
+        "runId": record.run_id,
+        "workspaceId": record.workspace_id,
+        "documentId": record.document_id,
+        "profile": record.profile,
+        "acpRuntime": record.acp_runtime,
+        "eventType": record.event_type,
+        "payload": payload,
+        "createdAt": record.created_at,
+        "persistence": ACP_RUNTIME_SQLITE_STORE,
+    })
+}
+
+fn query_bool(query: &HashMap<String, String>, key: &str) -> bool {
+    query
+        .get(key)
+        .map(String::as_str)
+        .map(str::trim)
+        .map(|value| matches!(value, "1" | "true" | "TRUE" | "yes" | "YES"))
+        .unwrap_or(false)
+}
+
+fn use_legacy_convex_acp_store(query: &HashMap<String, String>) -> bool {
+    query_bool(query, "legacyConvex") || query_bool(query, "convex")
+}
+
 fn local_session_share_id(payload: &Value) -> Option<String> {
     payload
         .get("shareId")
@@ -4868,19 +5136,57 @@ async fn persist_acp_runtime_run(
             "runId": run_id
         }));
     }
-    execute_convex_mutation_by_name(
-        state.config(),
-        context,
-        ACP_RUNTIME_RUN_MUTATION,
-        args,
-        payload
-            .get("workspaceId")
-            .and_then(Value::as_str)
-            .or(context.workspace.workspace_id.as_deref()),
-        Some(run_id),
-        "acp_runtime_run_store",
-    )
-    .await
+    let workspace_id = args
+        .get("workspaceId")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(ToOwned::to_owned);
+    let document_id = args
+        .get("documentId")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(ToOwned::to_owned);
+    let title = args
+        .get("title")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(ToOwned::to_owned);
+    let status = args
+        .get("status")
+        .and_then(Value::as_str)
+        .unwrap_or("acp_pending")
+        .to_string();
+    let record = state
+        .control_plane()
+        .upsert_ai_runtime_run(UpsertAiRuntimeRunInput {
+            id: None,
+            user_id: runtime_store_user_id(context, payload),
+            workspace_id,
+            document_id,
+            session_id: registration.session_id.clone(),
+            run_id: run_id.to_string(),
+            title,
+            profile: registration.profile.clone(),
+            acp_runtime: acp_runtime.to_string(),
+            trace_id: Some(registration.trace_id.clone()),
+            status,
+            runtime_json: json_string(runtime_state),
+            payload_json: json_string(payload),
+        })
+        .map_err(|error| {
+            WebError::internal(format!("SQLite ACP runtime run 写入失败: {error}"))
+                .with_context(context)
+        })?;
+    Ok(json!({
+        "ok": true,
+        "persistence": ACP_RUNTIME_SQLITE_STORE,
+        "sessionStorage": "sqlite_control_plane",
+        "sessionId": record.session_id,
+        "runId": record.run_id
+    }))
 }
 
 fn acp_runtime_event_store_args(
@@ -4990,19 +5296,41 @@ async fn persist_acp_runtime_event(
             "runId": run_id
         }));
     }
-    execute_convex_mutation_by_name(
-        state.config(),
-        context,
-        ACP_RUNTIME_EVENT_MUTATION,
-        args,
-        run_payload
-            .get("workspaceId")
-            .and_then(Value::as_str)
-            .or(context.workspace.workspace_id.as_deref()),
-        None,
-        "acp_runtime_event_store",
-    )
-    .await
+    state
+        .control_plane()
+        .append_ai_runtime_event(AppendAiRuntimeEventInput {
+            id: None,
+            user_id: runtime_store_user_id(context, run_payload),
+            workspace_id: args
+                .get("workspaceId")
+                .and_then(Value::as_str)
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .map(ToOwned::to_owned),
+            document_id: args
+                .get("documentId")
+                .and_then(Value::as_str)
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .map(ToOwned::to_owned),
+            session_id: registration.session_id.clone(),
+            run_id: run_id.to_string(),
+            profile: registration.profile.clone(),
+            acp_runtime: acp_runtime.to_string(),
+            event_type: event_type.to_string(),
+            payload_json: json_string(event_payload),
+        })
+        .map_err(|error| {
+            WebError::internal(format!("SQLite ACP runtime event 写入失败: {error}"))
+                .with_context(context)
+        })?;
+    Ok(json!({
+        "ok": true,
+        "persistence": ACP_RUNTIME_SQLITE_STORE,
+        "sessionStorage": "sqlite_control_plane",
+        "sessionId": registration.session_id,
+        "runId": run_id
+    }))
 }
 
 fn register_runtime_from_create_run_response(
@@ -5652,6 +5980,7 @@ mod tests {
     use axum::body::{to_bytes, Body};
     use axum::http::Request;
     use axum::routing::{get, post};
+    use control_plane::UpsertAiRuntimeRunInput;
     use std::sync::atomic::{AtomicUsize, Ordering};
     use std::sync::{Arc, Mutex, OnceLock};
     use tower::util::ServiceExt;
@@ -5776,6 +6105,48 @@ mod tests {
         build_app(AppState::new(config))
     }
 
+    fn seeded_acp_state() -> AppState {
+        let state = AppState::new(AppConfig {
+            service_name: "mnote-web".into(),
+            service_version: "0.1.0".into(),
+            bind_addr: "127.0.0.1:0".into(),
+            public_bind_addr: "127.0.0.1:3000".into(),
+            legacy_next_base_url: Some("http://127.0.0.1:3100".into()),
+            enable_legacy_next_compat: true,
+            enable_debug_shell_routes: false,
+            enable_editor_actor: true,
+            hermes_base_path: "/api/hermes".into(),
+            compat_next_base_path: "/api/compat/next".into(),
+            convex_url: None,
+            convex_admin_key: None,
+            allow_dev_fixtures: false,
+            query_fixtures_json: None,
+            mutation_fixtures_json: None,
+            dev_user_id: "dev-user".into(),
+            dev_user_name: "开发用户".into(),
+            dev_user_email: "dev@mnote.local".into(),
+        });
+        state
+            .control_plane()
+            .upsert_ai_runtime_run(UpsertAiRuntimeRunInput {
+                id: None,
+                user_id: "user_1".to_string(),
+                workspace_id: Some("ws_1".to_string()),
+                document_id: Some("doc_1".to_string()),
+                session_id: "sess_1".to_string(),
+                run_id: "run_1".to_string(),
+                title: None,
+                profile: "reasonix".to_string(),
+                acp_runtime: "reasonix".to_string(),
+                trace_id: Some("trace_1".to_string()),
+                status: "completed".to_string(),
+                runtime_json: "{\"status\":\"completed\",\"runId\":\"run_1\"}".to_string(),
+                payload_json: "{\"message\":\"自动标题\"}".to_string(),
+            })
+            .expect("seed acp runtime run");
+        state
+    }
+
     fn test_state() -> AppState {
         AppState::new(AppConfig {
             service_name: "mnote-web".into(),
@@ -6079,7 +6450,7 @@ mod tests {
         let payload: Value = serde_json::from_slice(&body).expect("json");
         assert_eq!(payload["ok"], true);
         assert_eq!(payload["sessionId"], "mnote_doc_1_trace_1");
-        assert_eq!(payload["persistence"], "convex_acp_runtime_store");
+        assert_eq!(payload["persistence"], ACP_RUNTIME_SQLITE_STORE);
         assert!(payload.get("messages").is_none());
     }
 
@@ -6519,109 +6890,82 @@ mod tests {
             .await
             .expect("body");
         let payload: Value = serde_json::from_slice(&body).expect("json");
-        assert_eq!(payload["persistence"], "convex_acp_runtime_store");
+        assert_eq!(payload["persistence"], ACP_RUNTIME_SQLITE_STORE);
 
-        let mutation = captured_body.lock().expect("captured convex body").clone();
-        assert_eq!(mutation["path"], "aiSessions:upsertRuntimeRun");
-        assert_eq!(mutation["args"][0]["userId"], "user_1");
-        assert_eq!(mutation["args"][0]["workspaceId"], "ws_1");
-        assert_eq!(mutation["args"][0]["documentId"], "doc_1");
-        assert_eq!(mutation["args"][0]["sessionId"], "mnote_doc_1_trace_1");
-        assert_eq!(mutation["args"][0]["runId"], "mnote_doc_1_trace_1_session");
-        assert_eq!(mutation["args"][0]["status"], "session.created");
+        assert_eq!(
+            captured_body.lock().expect("captured convex body").clone(),
+            Value::Null
+        );
     }
 
     #[tokio::test]
-    async fn hermes_client_acp_run_registers_scoped_runtime_record_in_convex() {
+    async fn hermes_client_acp_run_registers_scoped_runtime_record_in_sqlite() {
         let _guard = runtime_lock().lock().expect("runtime lock");
         clear_runtime_registry();
         clear_run_queue();
+        let router = app();
 
-        let captured_body = Arc::new(Mutex::new(Value::Null));
-        let captured_for_route = Arc::clone(&captured_body);
-        let mock = axum::Router::new().route(
-            "/api/mutation",
-            post(move |Json(body): Json<Value>| {
-                let captured = Arc::clone(&captured_for_route);
-                async move {
-                    *captured.lock().expect("captured convex body") = body;
-                    Json(json!({
-                        "status": "success",
-                        "value": {"ok": true, "stored": true}
-                    }))
-                }
-            }),
-        );
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/api/hermes/client/runs")
+                    .header("content-type", "application/json")
+                    .header("x-mnote-actor-id", "user_1")
+                    .header("x-mnote-workspace-id", "ws_header")
+                    .body(Body::from(
+                        json!({
+                            "workspaceId": "ws_1",
+                            "documentId": "doc_1",
+                            "sessionId": "sess_1",
+                            "message": "读取当前页面",
+                            "profile": "reasonix",
+                            "acpRuntime": "reasonix",
+                            "runId": "run_trace_1",
+                            "traceId": "trace_1",
+                            "pageContext": {"title": "页面标题"}
+                        })
+                        .to_string(),
+                    ))
+                    .expect("request"),
+            )
             .await
-            .expect("listener");
-        let convex_url = format!("http://{}", listener.local_addr().expect("addr"));
-        tokio::spawn(async move {
-            axum::serve(listener, mock).await.expect("mock convex");
-        });
-
-        let response = app_with_config(AppConfig {
-            service_name: "mnote-web".into(),
-            service_version: "0.1.0".into(),
-            bind_addr: "127.0.0.1:0".into(),
-            public_bind_addr: "127.0.0.1:3000".into(),
-            legacy_next_base_url: Some("http://127.0.0.1:3100".into()),
-            enable_legacy_next_compat: true,
-            enable_debug_shell_routes: false,
-            enable_editor_actor: true,
-            hermes_base_path: "/api/hermes".into(),
-            compat_next_base_path: "/api/compat/next".into(),
-            convex_url: Some(convex_url),
-            convex_admin_key: Some("admin-demo".into()),
-            allow_dev_fixtures: false,
-            query_fixtures_json: None,
-            mutation_fixtures_json: None,
-            dev_user_id: "dev-user".into(),
-            dev_user_name: "开发用户".into(),
-            dev_user_email: "dev@mnote.local".into(),
-        })
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri("/api/hermes/client/runs")
-                .header("content-type", "application/json")
-                .header("x-mnote-actor-id", "user_1")
-                .header("x-mnote-workspace-id", "ws_header")
-                .body(Body::from(
-                    json!({
-                        "workspaceId": "ws_1",
-                        "documentId": "doc_1",
-                        "sessionId": "sess_1",
-                        "message": "读取当前页面",
-                        "profile": "reasonix",
-                        "acpRuntime": "reasonix",
-                        "runId": "run_trace_1",
-                        "traceId": "trace_1",
-                        "pageContext": {"title": "页面标题"}
-                    })
-                    .to_string(),
-                ))
-                .expect("request"),
-        )
-        .await
-        .expect("response");
+            .expect("response");
         assert_eq!(response.status(), StatusCode::OK);
+        let body = to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("body");
+        let payload: Value = serde_json::from_slice(&body).expect("json");
+        assert_eq!(payload["persistence"], ACP_RUNTIME_SQLITE_STORE);
 
-        let body = captured_body.lock().expect("captured convex body").clone();
-        assert_eq!(body["path"], "aiSessions:upsertRuntimeRun");
-        let args = &body["args"][0];
-        assert_eq!(args["schema"], "mnote.acp_runtime_run.v1");
-        assert_eq!(args["source"], "acp");
-        assert_eq!(args["userId"], "user_1");
-        assert_eq!(args["workspaceId"], "ws_1");
-        assert_eq!(args["documentId"], "doc_1");
-        assert_eq!(args["sessionId"], "sess_1");
-        assert_eq!(args["runId"], "run_trace_1");
-        assert_eq!(args["profile"], "reasonix");
-        assert_eq!(args["acpRuntime"], "reasonix");
-        assert_eq!(args["runtime"]["status"], "acp_pending");
-        assert_eq!(args["payload"]["message"], "读取当前页面");
-        assert!(args.get("messages").is_none());
+        let response = router
+            .oneshot(
+                Request::builder()
+                    .method("GET")
+                    .uri("/api/hermes/client/sessions?profile=reasonix&workspaceId=ws_1&documentId=doc_1")
+                    .header("x-mnote-actor-id", "user_1")
+                    .body(Body::empty())
+                    .expect("request"),
+            )
+            .await
+            .expect("list response");
+        assert_eq!(response.status(), StatusCode::OK);
+        let body = to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("list body");
+        let payload: Value = serde_json::from_slice(&body).expect("json");
+        assert_eq!(payload["persistence"], ACP_RUNTIME_SQLITE_STORE);
+        let run = &payload["sessions"][0];
+        assert_eq!(run["sessionId"], "sess_1");
+        assert_eq!(run["runId"], "run_trace_1");
+        assert_eq!(run["workspaceId"], "ws_1");
+        assert_eq!(run["documentId"], "doc_1");
+        assert_eq!(run["profile"], "reasonix");
+        assert_eq!(run["acpRuntime"], "reasonix");
+        assert_eq!(run["runtime"]["status"], "acp_pending");
+        assert_eq!(run["payload"]["message"], "读取当前页面");
+        assert!(run.get("messages").is_none());
     }
 
     #[tokio::test]
@@ -6683,7 +7027,7 @@ mod tests {
         .oneshot(
             Request::builder()
                 .method("GET")
-                .uri("/api/hermes/client/sessions?profile=reasonix&workspaceId=ws_1&documentId=doc_1")
+                .uri("/api/hermes/client/sessions?profile=reasonix&workspaceId=ws_1&documentId=doc_1&legacyConvex=1")
                 .header("x-mnote-actor-id", "user_1")
                 .body(Body::empty())
                 .expect("request"),
@@ -6775,7 +7119,9 @@ mod tests {
         .oneshot(
             Request::builder()
                 .method("GET")
-                .uri("/api/hermes/client/sessions/sess_1?source=acp&workspaceId=ws_1")
+                .uri(
+                    "/api/hermes/client/sessions/sess_1?source=acp&workspaceId=ws_1&legacyConvex=1",
+                )
                 .header("x-mnote-actor-id", "user_1")
                 .body(Body::empty())
                 .expect("request"),
@@ -6861,7 +7207,7 @@ mod tests {
         .oneshot(
             Request::builder()
                 .method("POST")
-                .uri("/api/hermes/client/sessions/sess_1/resume?source=acp&workspaceId=ws_1")
+                .uri("/api/hermes/client/sessions/sess_1/resume?source=acp&workspaceId=ws_1&legacyConvex=1")
                 .header("x-mnote-actor-id", "user_1")
                 .body(Body::empty())
                 .expect("request"),
@@ -6880,131 +7226,33 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn hermes_client_acp_session_rename_calls_convex_store() {
-        let captured_body = Arc::new(Mutex::new(Value::Null));
-        let captured_for_route = Arc::clone(&captured_body);
-        let mock = axum::Router::new().route(
-            "/api/mutation",
-            post(move |Json(body): Json<Value>| {
-                let captured = Arc::clone(&captured_for_route);
-                async move {
-                    *captured.lock().expect("captured convex body") = body;
-                    Json(json!({
-                        "status": "success",
-                        "value": {"ok": true, "sessionId": "sess_1", "title": "新标题"}
-                    }))
-                }
-            }),
-        );
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+    async fn hermes_client_acp_session_rename_uses_sqlite_store() {
+        let response = build_app(seeded_acp_state())
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/api/hermes/client/sessions/sess_1/rename?source=acp&workspaceId=ws_1")
+                    .header("content-type", "application/json")
+                    .header("x-mnote-actor-id", "user_1")
+                    .body(Body::from(json!({"title": "新标题"}).to_string()))
+                    .expect("request"),
+            )
             .await
-            .expect("listener");
-        let convex_url = format!("http://{}", listener.local_addr().expect("addr"));
-        tokio::spawn(async move {
-            axum::serve(listener, mock).await.expect("mock convex");
-        });
-
-        let response = app_with_config(AppConfig {
-            service_name: "mnote-web".into(),
-            service_version: "0.1.0".into(),
-            bind_addr: "127.0.0.1:0".into(),
-            public_bind_addr: "127.0.0.1:3000".into(),
-            legacy_next_base_url: Some("http://127.0.0.1:3100".into()),
-            enable_legacy_next_compat: true,
-            enable_debug_shell_routes: false,
-            enable_editor_actor: true,
-            hermes_base_path: "/api/hermes".into(),
-            compat_next_base_path: "/api/compat/next".into(),
-            convex_url: Some(convex_url),
-            convex_admin_key: Some("admin-demo".into()),
-            allow_dev_fixtures: false,
-            query_fixtures_json: None,
-            mutation_fixtures_json: None,
-            dev_user_id: "dev-user".into(),
-            dev_user_name: "开发用户".into(),
-            dev_user_email: "dev@mnote.local".into(),
-        })
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri("/api/hermes/client/sessions/sess_1/rename?source=acp&workspaceId=ws_1")
-                .header("content-type", "application/json")
-                .header("x-mnote-actor-id", "user_1")
-                .body(Body::from(json!({"title": "新标题"}).to_string()))
-                .expect("request"),
-        )
-        .await
-        .expect("response");
+            .expect("response");
         assert_eq!(response.status(), StatusCode::OK);
         let body = to_bytes(response.into_body(), usize::MAX)
             .await
             .expect("body");
         let payload: Value = serde_json::from_slice(&body).expect("json");
         assert_eq!(payload["ok"], true);
+        assert_eq!(payload["persistence"], ACP_RUNTIME_SQLITE_STORE);
         assert_eq!(payload["result"]["title"], "新标题");
-
-        let mutation = captured_body.lock().expect("captured convex body").clone();
-        assert_eq!(mutation["path"], "aiSessions:renameRuntimeSession");
-        assert_eq!(mutation["args"][0]["userId"], "user_1");
-        assert_eq!(mutation["args"][0]["workspaceId"], "ws_1");
-        assert_eq!(mutation["args"][0]["sessionId"], "sess_1");
-        assert_eq!(mutation["args"][0]["title"], "新标题");
+        assert_eq!(payload["result"]["runs"][0]["sessionId"], "sess_1");
     }
 
     #[tokio::test]
-    async fn hermes_client_acp_session_delete_and_auto_title_call_convex_store() {
-        let captured_bodies = Arc::new(Mutex::new(Vec::<Value>::new()));
-        let captured_for_route = Arc::clone(&captured_bodies);
-        let mock = axum::Router::new().route(
-            "/api/mutation",
-            post(move |Json(body): Json<Value>| {
-                let captured = Arc::clone(&captured_for_route);
-                async move {
-                    captured
-                        .lock()
-                        .expect("captured convex bodies")
-                        .push(body.clone());
-                    let path = body["path"].as_str().unwrap_or_default();
-                    let value = match path {
-                        "aiSessions:autoTitleRuntimeSession" => {
-                            json!({"ok": true, "sessionId": "sess_1", "title": "自动标题"})
-                        }
-                        "aiSessions:deleteRuntimeSession" => {
-                            json!({"ok": true, "sessionId": "sess_1", "deleted": 1})
-                        }
-                        _ => Value::Null,
-                    };
-                    Json(json!({"status": "success", "value": value}))
-                }
-            }),
-        );
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
-            .await
-            .expect("listener");
-        let convex_url = format!("http://{}", listener.local_addr().expect("addr"));
-        tokio::spawn(async move {
-            axum::serve(listener, mock).await.expect("mock convex");
-        });
-        let router = app_with_config(AppConfig {
-            service_name: "mnote-web".into(),
-            service_version: "0.1.0".into(),
-            bind_addr: "127.0.0.1:0".into(),
-            public_bind_addr: "127.0.0.1:3000".into(),
-            legacy_next_base_url: Some("http://127.0.0.1:3100".into()),
-            enable_legacy_next_compat: true,
-            enable_debug_shell_routes: false,
-            enable_editor_actor: true,
-            hermes_base_path: "/api/hermes".into(),
-            compat_next_base_path: "/api/compat/next".into(),
-            convex_url: Some(convex_url),
-            convex_admin_key: Some("admin-demo".into()),
-            allow_dev_fixtures: false,
-            query_fixtures_json: None,
-            mutation_fixtures_json: None,
-            dev_user_id: "dev-user".into(),
-            dev_user_name: "开发用户".into(),
-            dev_user_email: "dev@mnote.local".into(),
-        });
+    async fn hermes_client_acp_session_delete_and_auto_title_use_sqlite_store() {
+        let router = build_app(seeded_acp_state());
 
         let response = router
             .clone()
@@ -7025,6 +7273,7 @@ mod tests {
             .await
             .expect("body");
         let payload: Value = serde_json::from_slice(&body).expect("json");
+        assert_eq!(payload["persistence"], ACP_RUNTIME_SQLITE_STORE);
         assert_eq!(payload["result"]["title"], "自动标题");
 
         let response = router
@@ -7039,13 +7288,12 @@ mod tests {
             .await
             .expect("response");
         assert_eq!(response.status(), StatusCode::OK);
-
-        let bodies = captured_bodies.lock().expect("captured convex bodies");
-        assert_eq!(bodies[0]["path"], "aiSessions:autoTitleRuntimeSession");
-        assert_eq!(bodies[0]["args"][0]["userId"], "user_1");
-        assert_eq!(bodies[0]["args"][0]["sessionId"], "sess_1");
-        assert_eq!(bodies[1]["path"], "aiSessions:deleteRuntimeSession");
-        assert_eq!(bodies[1]["args"][0]["workspaceId"], "ws_1");
+        let body = to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("delete body");
+        let payload: Value = serde_json::from_slice(&body).expect("json");
+        assert_eq!(payload["persistence"], ACP_RUNTIME_SQLITE_STORE);
+        assert_eq!(payload["result"]["deleted"], 1);
     }
 
     #[tokio::test]
@@ -7104,7 +7352,7 @@ mod tests {
         .oneshot(
             Request::builder()
                 .method("GET")
-                .uri("/api/hermes/client/sessions/search?source=acp&workspaceId=ws_1&q=%E5%8C%96%E5%AD%A6&limit=5")
+                .uri("/api/hermes/client/sessions/search?source=acp&workspaceId=ws_1&q=%E5%8C%96%E5%AD%A6&limit=5&legacyConvex=1")
                 .header("x-mnote-actor-id", "user_1")
                 .body(Body::empty())
                 .expect("request"),

rust/crates/mnote-web/src/routes/local_folder_events.rs

@@ -20,7 +20,8 @@ use std::pin::Pin;
 use std::time::{SystemTime, UNIX_EPOCH};
 use tokio::sync::broadcast::error::RecvError;
 
-type BoxedEventStream = Pin<Box<dyn futures_util::Stream<Item = Result<SseEvent, Infallible>> + Send>>;
+type BoxedEventStream =
+    Pin<Box<dyn futures_util::Stream<Item = Result<SseEvent, Infallible>> + Send>>;
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -138,8 +139,8 @@ async fn build_tree_live_stream(
         .map_err(|error| error.with_context(&context))?;
     let file_tree_snapshot = load_local_folder_file_tree_snapshot(&root_uri)
         .map_err(|error| error.with_context(&context))?;
-    let revision = local_folder_watch_revision(&root_uri)
-        .map_err(|error| error.with_context(&context))?;
+    let revision =
+        local_folder_watch_revision(&root_uri).map_err(|error| error.with_context(&context))?;
 
     let initial_payload = build_tree_snapshot_payload(
         &root_uri,
@@ -285,8 +286,7 @@ mod tests {
 
     fn app_with_local_workspace(root: &std::path::Path) -> axum::Router {
         let root_uri = format!("file://{}", root.display());
-        initialize_local_workspace_for_actor("dev-user", &root_uri)
-            .expect("init local workspace");
+        initialize_local_workspace_for_actor("dev-user", &root_uri).expect("init local workspace");
         build_app(AppState::new(AppConfig {
             service_name: "mnote-web".into(),
             service_version: "0.1.0".into(),

rust/crates/mnote-web/src/routes/mindmap_shell.rs

@@ -1,6 +1,7 @@
 use crate::app::AppState;
 use crate::context::RequestContext;
 use crate::error::WebError;
+use crate::routes::gateway::default_workspace_name_for_context;
 use crate::routes::web_shell::{
     build_page_aggregate_snapshot, load_file_tree_html, load_sidebar_tree_html,
     load_workspace_shell_projection, render_local_file_tree_html, render_local_sidebar_tree_html,
@@ -30,7 +31,7 @@ pub async fn mindmap_object_shell(
     Path((doc_id, mindmap_id)): Path<(String, String)>,
     Query(query): Query<MindmapShellQuery>,
 ) -> Result<Response, WebError> {
-    let default_workspace_name = format!("{} 的空间", state.config().dev_user_name);
+    let default_workspace_name = default_workspace_name_for_context(&state, &context);
     let source_kind = query.source_kind.as_deref();
     let root_uri = query.root_uri.as_deref();
     let aggregate = build_page_aggregate_snapshot(

rust/crates/mnote-web/src/routes/mod.rs

@@ -131,6 +131,26 @@ pub fn build_router(state: AppState) -> Router {
             "/api/admin/access-policy/grants/{grant_id}",
             delete(local_folder_source::delete_local_access_grant),
         )
+        .route(
+            "/api/user/access-policy",
+            get(local_folder_source::get_user_access_policy),
+        )
+        .route(
+            "/api/user/access-policy/grants",
+            post(local_folder_source::create_user_access_grant),
+        )
+        .route(
+            "/api/user/access-policy/grants/{grant_id}",
+            delete(local_folder_source::delete_user_access_grant),
+        )
+        .route(
+            "/api/admin/share-links",
+            get(local_folder_source::get_share_links).post(local_folder_source::create_share_link),
+        )
+        .route(
+            "/api/admin/share-links/{link_id}",
+            delete(local_folder_source::delete_share_link),
+        )
         .route(
             "/api/admin/share-grants",
             get(local_folder_source::get_share_grants)

rust/crates/mnote-web/src/routes/session.rs

@@ -5,10 +5,12 @@ use axum::http::{HeaderMap, HeaderName, HeaderValue, StatusCode};
 use axum::response::{IntoResponse, Response};
 use axum::Json;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use control_plane::session_token_hash;
 use serde::Serialize;
 
 const HEADER_MNOTE_WEB_OWNER: &str = "x-mnote-web-owner";
 const COOKIE_CONVEX_AUTH_JWT: &str = "__convexAuthJWT";
+const COOKIE_MNOTE_SESSION: &str = "mnote_session";
 const COOKIE_ACTOR_EMAIL: &str = "mnote_actor_email";
 const COOKIE_ACTOR_NAME: &str = "mnote_actor_name";
 
@@ -65,6 +67,28 @@ pub async fn refresh_session(
 }
 
 fn build_session_response(state: &AppState, context: RequestContext) -> SessionResponse {
+    if let Some(raw_token) = context
+        .auth
+        .cookie_header
+        .as_deref()
+        .and_then(|cookies| raw_cookie_value(cookies, COOKIE_MNOTE_SESSION))
+    {
+        let token_hash = session_token_hash(&raw_token);
+        if let Ok(Some(resolved)) = state.control_plane().get_session_by_token_hash(&token_hash) {
+            return SessionResponse {
+                ok: true,
+                owner: "mnote-web",
+                user_id: resolved.user.id,
+                email: resolved.user.email.unwrap_or_default(),
+                name: resolved.user.display_name,
+                actor_type: "user".to_string(),
+                auth_mode: "sqliteSession",
+                request_id: context.trace.request_id,
+                trace_id: context.trace.trace_id,
+            };
+        }
+    }
+
     let actor_id = context.auth.actor_id.trim();
     let has_forwarded_actor = !actor_id.is_empty() && actor_id != "anonymous";
     let actor_email = context
@@ -179,6 +203,7 @@ mod tests {
     use crate::app::{build_app, AppConfig, AppState};
     use axum::body::{to_bytes, Body};
     use axum::http::{Request, StatusCode};
+    use control_plane::{session_token_hash, CreateSessionInput, UpsertUserInput};
     use tower::util::ServiceExt;
 
     fn app() -> axum::Router {
@@ -282,6 +307,75 @@ mod tests {
         assert!(payload.get("convexAdminKey").is_none());
     }
 
+    #[tokio::test]
+    async fn session_prefers_sqlite_cookie_identity_over_dev_fallback() {
+        let state = AppState::new(AppConfig {
+            service_name: "mnote-web".into(),
+            service_version: "0.1.0".into(),
+            bind_addr: "127.0.0.1:0".into(),
+            public_bind_addr: "127.0.0.1:3000".into(),
+            legacy_next_base_url: Some("http://127.0.0.1:3100".into()),
+            enable_legacy_next_compat: true,
+            enable_debug_shell_routes: false,
+            enable_editor_actor: true,
+            hermes_base_path: "/api/hermes".into(),
+            compat_next_base_path: "/api/compat/next".into(),
+            convex_url: None,
+            convex_admin_key: None,
+            allow_dev_fixtures: true,
+            query_fixtures_json: None,
+            mutation_fixtures_json: None,
+            dev_user_id: "dev-user".into(),
+            dev_user_name: "开发用户".into(),
+            dev_user_email: "dev@mnote.local".into(),
+        });
+        state
+            .control_plane()
+            .upsert_user(UpsertUserInput {
+                id: Some("shujuan".into()),
+                email: Some("shujuan@163.com".into()),
+                username: "shujuan".into(),
+                display_name: "shujuan".into(),
+                role: None,
+                password_hash: None,
+            })
+            .expect("upsert user");
+        state
+            .control_plane()
+            .create_session(CreateSessionInput {
+                id: None,
+                user_id: "shujuan".into(),
+                token_hash: session_token_hash("raw-session-token"),
+                user_agent: None,
+                ip_hash: None,
+                expires_at: None,
+            })
+            .expect("create session");
+
+        let response = build_app(state)
+            .oneshot(
+                Request::builder()
+                    .uri("/api/auth/session")
+                    .header("cookie", "mnote_session=raw-session-token")
+                    .body(Body::empty())
+                    .expect("request"),
+            )
+            .await
+            .expect("response");
+
+        assert_eq!(response.status(), StatusCode::OK);
+        let body = to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("body");
+        let payload: serde_json::Value = serde_json::from_slice(&body).expect("json");
+        assert_eq!(payload["owner"], "mnote-web");
+        assert_eq!(payload["userId"], "shujuan");
+        assert_eq!(payload["email"], "shujuan@163.com");
+        assert_eq!(payload["name"], "shujuan");
+        assert_eq!(payload["actorType"], "user");
+        assert_eq!(payload["authMode"], "sqliteSession");
+    }
+
     #[tokio::test]
     async fn legacy_whoami_alias_prefers_forwarded_actor_identity() {
         let response = app()

rust/crates/mnote-web/src/routes/web_shell.rs

@@ -7,6 +7,7 @@ use crate::routes::documents::{
     load_document_content_result, load_document_meta_result, DocumentContentQuery,
     DocumentMetaQuery,
 };
+use crate::routes::gateway::default_workspace_name_for_context;
 use crate::routes::local_folder_source::{
     ensure_local_workspace_read_access, is_local_access_policy_admin_context,
     load_local_folder_file_tree_snapshot, load_local_folder_page_tree_snapshot,
@@ -125,7 +126,7 @@ pub async fn document_page_shell(
         } else {
             None
         };
-    let default_workspace_name = format!("{} 的空间", state.config().dev_user_name);
+    let default_workspace_name = default_workspace_name_for_context(&state, &context);
     let mut workspace_projection = load_workspace_shell_projection(
         state.config(),
         &context,

rust/crates/mnote-web/src/ssr/pages/admin.rs

@@ -1,267 +1,118 @@
-//! MNOTE 管理员目录授权页面组件
+//! MNOTE 文件夹授权管理组件
 
-use crate::ssr::pages::layout::PageLayout;
 use leptos::prelude::*;
 
 #[component]
-pub fn AdminAccessPolicyPage(
+pub fn AdminAccessPolicyPanel(
     #[prop(optional)] workspace_name: Option<String>,
-    #[prop(optional)] policy_path: Option<String>,
     #[prop(optional)] share_grants_path: Option<String>,
     #[prop(optional, default = true)] is_admin: bool,
+    #[prop(optional, default = true)] boot_script: bool,
 ) -> impl IntoView {
     let workspace_name = workspace_name
         .unwrap_or_else(|| "开发用户 的空间".to_string())
         .trim()
         .to_string();
-    let policy_path = policy_path
-        .unwrap_or_else(|| "/mnt/Data1T/Mnote_data/control-plane/access-policy.json".to_string());
     let share_grants_path = share_grants_path
-        .unwrap_or_else(|| "/mnt/Data1T/Mnote_data/control-plane/share-grants.json".to_string());
-    let page_title = "授权管理".to_string();
+        .unwrap_or_else(|| "/mnt/Data1T/Mnote_data/control-plane/control-plane.db".to_string());
+    let scope_text = if is_admin {
+        "管理员可以授权任意本地文件夹。"
+    } else {
+        "普通用户只能授权自己空间下的文件夹。"
+    };
     view! {
-        <PageLayout current_nav={if is_admin { "admin" } else { "home" }} workspace_name={workspace_name.clone()} topbar_title={page_title.clone()} show_admin_access_policy={is_admin}>
-            <main class="mnote-admin-policy-page" data-testid="mnote-admin-access-policy-page">
-                <header class="mnote-admin-policy-header">
-                    <h1>{page_title.clone()}</h1>
-                    <p>{if is_admin {
-                        "管理员可以管理目录授权和分享授权。"
-                    } else {
-                        "查看与你相关的分享授权。"
-                    }}</p>
-                </header>
+        <div
+            class="mnote-admin-policy-dialog__content"
+            data-testid="mnote-admin-access-policy-page"
+            data-access-policy-role={if is_admin { "admin" } else { "user" }}
+        >
+            <header class="mnote-admin-policy-header">
+                <div>
+                    <div class="mnote-admin-policy-eyebrow">"授权管理"</div>
+                    <h2 id="mnote-admin-policy-dialog-title">"文件夹授权"</h2>
+                    <p>{scope_text}</p>
+                </div>
+            </header>
 
-                <section class="mnote-admin-policy-summary">
-                    <div class="mnote-admin-policy-summary-item">
-                        <span class="mnote-admin-policy-summary-label">"工作区"</span>
-                        <strong data-testid="mnote-admin-workspace-name">{workspace_name.clone()}</strong>
-                    </div>
-                    <div class="mnote-admin-policy-summary-item">
-                        <span class="mnote-admin-policy-summary-label">"策略文件"</span>
-                        <code data-testid="mnote-admin-policy-path">{if is_admin { policy_path.clone() } else { "仅管理员可见".to_string() }}</code>
-                    </div>
-                    <div class="mnote-admin-policy-summary-item">
-                        <span class="mnote-admin-policy-summary-label">"分享授权文件"</span>
-                        <code data-testid="mnote-admin-share-grants-path">{share_grants_path.clone()}</code>
-                    </div>
-                </section>
+            <section class="mnote-admin-policy-summary">
+                <div class="mnote-admin-policy-summary-item">
+                    <span class="mnote-admin-policy-summary-label">"工作区"</span>
+                    <strong data-testid="mnote-admin-workspace-name">{workspace_name.clone()}</strong>
+                </div>
+                <div class="mnote-admin-policy-summary-item">
+                    <span class="mnote-admin-policy-summary-label">"授权记录"</span>
+                    <code data-testid="mnote-admin-share-grants-path">{share_grants_path.clone()}</code>
+                </div>
+            </section>
 
-                {if is_admin {
-                    view! {
-                        <section class="mnote-admin-policy-panel" data-admin-section="directory">
-                            <header class="mnote-admin-policy-panel-header">
-                                <div>
-                                    <h2>"目录授权"</h2>
-                                    <p class="mnote-admin-policy-note">"给指定用户授权可访问的本地目录。"</p>
-                                </div>
-                                <button type="button" data-testid="mnote-admin-policy-refresh" data-admin-action="refresh-policy">"刷新"</button>
-                            </header>
-                            <div class="mnote-admin-policy-table" data-testid="mnote-admin-policy-grants-list">
-                                <div class="mnote-admin-policy-empty">"正在读取目录授权..."</div>
-                            </div>
-                            <details class="mnote-admin-policy-debug">
-                                <summary>"查看策略 JSON"</summary>
-                                <pre class="mnote-admin-policy-json" data-testid="mnote-admin-policy-json">{""}</pre>
-                            </details>
-                            <div class="mnote-admin-policy-note" data-testid="mnote-admin-policy-message"></div>
-                        </section>
-                    }.into_any()
-                } else {
-                    view! {
-                        <section class="mnote-admin-policy-panel" data-admin-section="directory" hidden>
-                            <pre class="mnote-admin-policy-json" data-testid="mnote-admin-policy-json">{""}</pre>
-                            <div class="mnote-admin-policy-note" data-testid="mnote-admin-policy-message"></div>
-                        </section>
-                    }.into_any()
-                }}
-
-                {if is_admin {
-                    view! {
-                        <section class="mnote-admin-policy-grid" data-admin-only="true">
-                            <form class="mnote-admin-policy-form" data-admin-form="validate-root">
-                                <header><h2>"验证目录"</h2></header>
-                                <label>
-                                    <span>"rootUri"</span>
-                                    <input data-testid="mnote-admin-root-uri" name="rootUri" type="text" placeholder="file:///mnt/Data1T/Mnote_data/users/..." />
-                                </label>
-                                <label>
-                                    <span>"rootPath"</span>
-                                    <input data-testid="mnote-admin-root-path" name="rootPath" type="text" placeholder="/mnt/Data1T/Mnote_data/..." />
-                                </label>
-                                <button type="submit" data-testid="mnote-admin-validate-root-submit">"验证"</button>
-                                <pre class="mnote-admin-policy-json" data-testid="mnote-admin-validate-result"></pre>
-                            </form>
-
-                            <form class="mnote-admin-policy-form" data-admin-form="create-grant">
-                                <header><h2>"新增授权"</h2></header>
-                                <label>
-                                    <span>"grantId"</span>
-                                    <input data-testid="mnote-admin-grant-id" name="grantId" type="text" placeholder="可留空自动生成" />
-                                </label>
-                                <label>
-                                    <span>"userId"</span>
-                                    <input data-testid="mnote-admin-grant-user-id" name="userId" type="text" placeholder="user_123" required />
-                                </label>
-                                <label>
-                                    <span>"rootUri"</span>
-                                    <input data-testid="mnote-admin-grant-root-uri" name="rootUri" type="text" />
-                                </label>
-                                <label>
-                                    <span>"rootPath"</span>
-                                    <input data-testid="mnote-admin-grant-root-path" name="rootPath" type="text" />
-                                </label>
-                                <label>
-                                    <span>"permission"</span>
-                                    <select data-testid="mnote-admin-grant-permission" name="permission">
-                                        <option value="read">"read"</option>
-                                        <option value="write">"write"</option>
-                                    </select>
-                                </label>
-                                <label>
-                                    <span>"recursive"</span>
-                                    <input data-testid="mnote-admin-grant-recursive" name="recursive" type="checkbox" checked=true />
-                                </label>
-                                <label>
-                                    <span>"capabilities"</span>
-                                    <input data-testid="mnote-admin-grant-capabilities" name="capabilities" type="text" placeholder="ai,share" />
-                                </label>
-                                <button type="submit" data-testid="mnote-admin-create-grant-submit">"创建"</button>
-                                <pre class="mnote-admin-policy-json" data-testid="mnote-admin-create-result"></pre>
-                            </form>
-
-                            <form class="mnote-admin-policy-form" data-admin-form="delete-grant">
-                                <header><h2>"删除授权"</h2></header>
-                                <label>
-                                    <span>"grantId"</span>
-                                    <input data-testid="mnote-admin-delete-grant-id" name="grantId" type="text" placeholder="grant_xxx" required />
-                                </label>
-                                <button type="submit" data-testid="mnote-admin-delete-grant-submit">"删除"</button>
-                                <pre class="mnote-admin-policy-json" data-testid="mnote-admin-delete-result"></pre>
-                            </form>
-                        </section>
-                    }.into_any()
-                } else {
-                    view! {}.into_any()
-                }}
+            <section class="mnote-admin-policy-grid">
+                <form class="mnote-admin-policy-form" data-admin-form="create-share-grant">
+                    <header><h3>"新增文件夹授权"</h3></header>
+                    <label>
+                        <span>"文件夹地址"</span>
+                        <input data-testid="mnote-admin-share-root-path" name="rootPath" type="text" placeholder="/mnt/Data1T/Mnote_data/users/..." required=true />
+                    </label>
+                    <label>
+                        <span>"授权用户 ID"</span>
+                        <input data-testid="mnote-admin-share-target-user-id" name="targetUserId" type="text" placeholder="user_123" required=true />
+                    </label>
+                    <label>
+                        <span>"权限"</span>
+                        <select data-testid="mnote-admin-share-permission" name="sharePermission">
+                            <option value="read">"read"</option>
+                            <option value="write">"write"</option>
+                        </select>
+                    </label>
+                    <button type="submit" data-testid="mnote-admin-create-share-grant-submit">"创建授权"</button>
+                    <pre class="mnote-admin-policy-json" data-testid="mnote-admin-create-share-grant-result"></pre>
+                </form>
 
                 <section class="mnote-admin-policy-panel" data-testid="mnote-admin-share-grants-panel">
                     <header class="mnote-admin-policy-panel-header">
                         <div>
-                            <h2>"分享管理"</h2>
-                            <p class="mnote-admin-policy-note">{if is_admin {
-                                "查看、创建和撤销分享授权。"
-                            } else {
-                                "查看你创建或接收的分享授权。"
-                            }}</p>
+                            <h3>"授权列表"</h3>
+                            <p class="mnote-admin-policy-note">"查看当前可管理的文件夹授权，并撤销不再需要的授权。"</p>
                         </div>
                         <button type="button" data-testid="mnote-admin-share-grants-refresh" data-admin-action="refresh-share-grants">"刷新"</button>
                     </header>
                     <div class="mnote-admin-policy-table" data-testid="mnote-admin-share-grants-list">
-                        <div class="mnote-admin-policy-empty">"正在读取分享授权..."</div>
+                        <div class="mnote-admin-policy-empty">"正在读取授权..."</div>
                     </div>
                     <details class="mnote-admin-policy-debug">
-                        <summary>"查看分享授权 JSON"</summary>
+                        <summary>"查看授权 JSON"</summary>
                         <pre class="mnote-admin-policy-json" data-testid="mnote-admin-share-grants-json">{""}</pre>
                     </details>
                     <div class="mnote-admin-policy-note" data-testid="mnote-admin-share-grants-message"></div>
+                    <pre class="mnote-admin-policy-json" data-testid="mnote-admin-delete-share-grant-result" hidden></pre>
                 </section>
-
-                <section class="mnote-admin-policy-grid" data-admin-only={if is_admin { "true" } else { "false" }}>
-                    <form class="mnote-admin-policy-form" data-admin-form="create-share-grant">
-                        <header><h2>"新增分享授权"</h2></header>
-                        <label>
-                            <span>"grantId"</span>
-                            <input data-testid="mnote-admin-share-grant-id" name="shareGrantId" type="text" placeholder="可留空自动生成" />
-                        </label>
-                        {if is_admin {
-                            view! {
-                                <label>
-                                    <span>"ownerUserId"</span>
-                                    <input data-testid="mnote-admin-share-owner-user-id" name="ownerUserId" type="text" placeholder="owner_123" required />
-                                </label>
-                            }.into_any()
-                        } else {
-                            view! {
-                                <input type="hidden" data-testid="mnote-admin-share-owner-user-id" name="ownerUserId" value="" />
-                            }.into_any()
-                        }}
-                        <label>
-                            <span>"shareId"</span>
-                            <input data-testid="mnote-admin-share-id" name="shareId" type="text" placeholder="share_xxx" required />
-                        </label>
-                        <label>
-                            <span>"targetUserId"</span>
-                            <input data-testid="mnote-admin-share-target-user-id" name="targetUserId" type="text" placeholder="target_123" required />
-                        </label>
-                        <label>
-                            <span>"rootUri"</span>
-                            <input data-testid="mnote-admin-share-root-uri" name="shareRootUri" type="text" />
-                        </label>
-                        <label>
-                            <span>"rootPath"</span>
-                            <input data-testid="mnote-admin-share-root-path" name="shareRootPath" type="text" />
-                        </label>
-                        <label>
-                            <span>"documentId"</span>
-                            <input data-testid="mnote-admin-share-document-id" name="documentId" type="text" placeholder="doc_123" />
-                        </label>
-                        <label>
-                            <span>"allowedResourceIds"</span>
-                            <input data-testid="mnote-admin-share-resource-ids" name="allowedResourceIds" type="text" placeholder="doc_123,mindmap_456" />
-                        </label>
-                        <label>
-                            <span>"permission"</span>
-                            <select data-testid="mnote-admin-share-permission" name="sharePermission">
-                                <option value="read">"read"</option>
-                                <option value="write">"write"</option>
-                            </select>
-                        </label>
-                        <label>
-                            <span>"capabilities"</span>
-                            <input data-testid="mnote-admin-share-capabilities" name="shareCapabilities" type="text" placeholder="ai,share" />
-                        </label>
-                        <button type="submit" data-testid="mnote-admin-create-share-grant-submit">"创建分享授权"</button>
-                        <pre class="mnote-admin-policy-json" data-testid="mnote-admin-create-share-grant-result"></pre>
-                    </form>
-
-                    <form class="mnote-admin-policy-form" data-admin-form="delete-share-grant">
-                        <header><h2>"撤销分享授权"</h2></header>
-                        <label>
-                            <span>"shareId 或 grantId"</span>
-                            <input data-testid="mnote-admin-delete-share-id" name="deleteShareId" type="text" placeholder="share_xxx" required />
-                        </label>
-                        <button type="submit" data-testid="mnote-admin-delete-share-grant-submit">"撤销"</button>
-                        <pre class="mnote-admin-policy-json" data-testid="mnote-admin-delete-share-grant-result"></pre>
-                    </form>
-                </section>
-                <script id="__MNOTE_ACCESS_POLICY_PAGE__" type="application/json">
-                    {format!(r#"{{"isAdmin":{}}}"#, if is_admin { "true" } else { "false" })}
-                </script>
-                <script>{ADMIN_POLICY_SCRIPT}</script>
-            </main>
-        </PageLayout>
+            </section>
+            <script id="__MNOTE_ACCESS_POLICY_PAGE__" type="application/json">
+                {format!(r#"{{"isAdmin":{}}}"#, if is_admin { "true" } else { "false" })}
+            </script>
+            {if boot_script {
+                view! { <script>{ADMIN_POLICY_SCRIPT}</script> }.into_any()
+            } else {
+                view! {}.into_any()
+            }}
+        </div>
     }
 }
 
-const ADMIN_POLICY_SCRIPT: &str = r#"
+pub(crate) const ADMIN_POLICY_SCRIPT: &str = r#"
 (function () {
-  var root = document.querySelector('[data-testid="mnote-admin-access-policy-page"]');
+  function initAccessPolicyPanel(scope) {
+  var root = (scope || document).querySelector('[data-testid="mnote-admin-access-policy-page"]');
   if (!root) return;
-  var message = root.querySelector('[data-testid="mnote-admin-policy-message"]');
-  var policyJson = root.querySelector('[data-testid="mnote-admin-policy-json"]');
+  if (root.getAttribute('data-access-policy-ready') === 'true') return;
+  root.setAttribute('data-access-policy-ready', 'true');
   var shareGrantsJson = root.querySelector('[data-testid="mnote-admin-share-grants-json"]');
-  var validateResult = root.querySelector('[data-testid="mnote-admin-validate-result"]');
-  var createResult = root.querySelector('[data-testid="mnote-admin-create-result"]');
-  var deleteResult = root.querySelector('[data-testid="mnote-admin-delete-result"]');
   var shareGrantsMessage = root.querySelector('[data-testid="mnote-admin-share-grants-message"]');
   var createShareGrantResult = root.querySelector('[data-testid="mnote-admin-create-share-grant-result"]');
   var deleteShareGrantResult = root.querySelector('[data-testid="mnote-admin-delete-share-grant-result"]');
-  var refreshButton = root.querySelector('[data-admin-action="refresh-policy"]');
   var refreshShareGrantsButton = root.querySelector('[data-admin-action="refresh-share-grants"]');
-  var policyGrantsList = root.querySelector('[data-testid="mnote-admin-policy-grants-list"]');
   var shareGrantsList = root.querySelector('[data-testid="mnote-admin-share-grants-list"]');
   var pageConfig = (function () {
-    var node = document.getElementById('__MNOTE_ACCESS_POLICY_PAGE__');
+    var node = root.querySelector('#__MNOTE_ACCESS_POLICY_PAGE__');
     try { return JSON.parse(node ? node.textContent || '{}' : '{}'); } catch (_) { return {}; }
   })();
   var isAdmin = pageConfig.isAdmin === true;
@@ -285,76 +136,43 @@ const ADMIN_POLICY_SCRIPT: &str = r#"
     return '<span class="mnote-admin-policy-badge" data-value="' + escapeHtml(text) + '">' + escapeHtml(text) + '</span>';
   }
 
-  function renderPolicyGrants(payload) {
-    if (!policyGrantsList) return;
-    var grants = payload && payload.policy && Array.isArray(payload.policy.grants) ? payload.policy.grants : [];
-    if (!grants.length) {
-      policyGrantsList.innerHTML = '<div class="mnote-admin-policy-empty">暂无目录授权</div>';
-      return;
-    }
-    policyGrantsList.innerHTML = grants.map(function(grant) {
-      return '<article class="mnote-admin-policy-row">' +
-        '<div><strong>' + escapeHtml(grant.userId || grant.user_id || '未知用户') + '</strong><span>' + escapeHtml(grant.rootPath || grant.root_path || grant.rootUri || grant.root_uri || '') + '</span></div>' +
-        '<div>' + renderBadge(grant.permission || grant.access) + '</div>' +
-        '<div><span>' + escapeHtml((grant.capabilities || []).join(', ') || '无能力标记') + '</span></div>' +
-      '</article>';
-    }).join('');
+  function readDirectoryGrants(payload) {
+    if (payload && Array.isArray(payload.grants)) return payload.grants;
+    if (payload && payload.policy && Array.isArray(payload.policy.grants)) return payload.policy.grants;
+    return [];
+  }
+
+  function accessPolicyUrl(suffix) {
+    var base = isAdmin ? '/api/admin/access-policy' : '/api/user/access-policy';
+    return suffix ? base + suffix : base;
   }
 
   function renderShareGrants(payload) {
     if (!shareGrantsList) return;
-    var grants = payload && Array.isArray(payload.grants) ? payload.grants : [];
+    var grants = readDirectoryGrants(payload);
     if (!grants.length) {
-      shareGrantsList.innerHTML = '<div class="mnote-admin-policy-empty">暂无分享授权</div>';
+      shareGrantsList.innerHTML = '<div class="mnote-admin-policy-empty">暂无文件夹授权</div>';
       return;
     }
     shareGrantsList.innerHTML = grants.map(function(grant) {
-      var active = grant.active === false ? '已撤销' : '有效';
+      var active = grant.active === false || grant.status === 'revoked' ? '已撤销' : '有效';
+      var revokeButton = grant.active === false ? '' :
+        '<button type="button" data-admin-action="revoke-access-grant" data-grant-id="' + escapeHtml(grant.id || '') + '">撤销</button>';
       return '<article class="mnote-admin-policy-row">' +
-        '<div><strong>' + escapeHtml(grant.shareId || grant.id || '未命名分享') + '</strong><span>' + escapeHtml(grant.rootPath || grant.rootUri || '') + '</span></div>' +
+        '<div><strong>' + escapeHtml(grant.rootPath || grant.rootUri || '') + '</strong><span>授权用户 ' + escapeHtml(grant.targetUserId || grant.userId || '') + '</span></div>' +
         '<div>' + renderBadge(grant.permission) + renderBadge(active) + '</div>' +
-        '<div><span>所有者 ' + escapeHtml(grant.ownerUserId || '') + '</span><span>接收者 ' + escapeHtml(grant.targetUserId || '') + '</span></div>' +
+        '<div><span>创建者 ' + escapeHtml(grant.createdBy || grant.ownerUserId || '') + '</span><span>授权 ID ' + escapeHtml(grant.id || '') + '</span>' + revokeButton + '</div>' +
       '</article>';
     }).join('');
   }
 
-  function formValues(form) {
-    var data = new FormData(form);
-    var capabilities = String(data.get('capabilities') || '')
-      .split(/[,\s]+/)
-      .map(function (item) { return item.trim(); })
-      .filter(Boolean);
-    return {
-      id: String(data.get('grantId') || '').trim(),
-      userId: String(data.get('userId') || '').trim(),
-      rootUri: String(data.get('rootUri') || '').trim(),
-      rootPath: String(data.get('rootPath') || '').trim(),
-      permission: String(data.get('permission') || 'read').trim(),
-      recursive: data.get('recursive') === 'on' || data.get('recursive') === 'true',
-      capabilities: capabilities,
-    };
-  }
-
-  function splitList(value) {
-    return String(value || '')
-      .split(/[,\s]+/)
-      .map(function (item) { return item.trim(); })
-      .filter(Boolean);
-  }
-
   function shareGrantFormValues(form) {
     var data = new FormData(form);
     return {
-      id: String(data.get('shareGrantId') || '').trim(),
-      shareId: String(data.get('shareId') || '').trim(),
-      ownerUserId: String(data.get('ownerUserId') || '').trim(),
+      userId: String(data.get('targetUserId') || '').trim(),
       targetUserId: String(data.get('targetUserId') || '').trim(),
-      rootUri: String(data.get('shareRootUri') || '').trim(),
-      rootPath: String(data.get('shareRootPath') || '').trim(),
-      documentId: String(data.get('documentId') || '').trim(),
-      allowedResourceIds: splitList(data.get('allowedResourceIds')),
+      rootPath: String(data.get('rootPath') || '').trim(),
       permission: String(data.get('sharePermission') || 'read').trim(),
-      capabilities: splitList(data.get('shareCapabilities')),
     };
   }
 
@@ -371,101 +189,29 @@ const ADMIN_POLICY_SCRIPT: &str = r#"
     return payload;
   }
 
-  async function refreshPolicy() {
-    if (!isAdmin) return;
-    var payload = await requestJson('/api/admin/access-policy', { method: 'GET', headers: {} });
-    setText(policyJson, payload);
-    renderPolicyGrants(payload);
-    setText(message, '已刷新策略');
-  }
-
   async function refreshShareGrants() {
-    var payload = await requestJson(isAdmin ? '/api/admin/share-grants' : '/api/user/share-grants', { method: 'GET', headers: {} });
+    var payload = await requestJson(accessPolicyUrl(''), { method: 'GET', headers: {} });
     setText(shareGrantsJson, payload);
     renderShareGrants(payload);
-    setText(shareGrantsMessage, '已刷新分享授权');
+    setText(shareGrantsMessage, '已刷新授权列表');
   }
 
-  refreshButton && refreshButton.addEventListener('click', function () {
-    setText(message, '正在刷新策略...');
-    refreshPolicy().catch(function (error) { setText(message, error.message || '刷新失败'); });
-  });
-
   refreshShareGrantsButton && refreshShareGrantsButton.addEventListener('click', function () {
-    setText(shareGrantsMessage, '正在刷新分享授权...');
+    setText(shareGrantsMessage, '正在刷新授权列表...');
     refreshShareGrants().catch(function (error) { setText(shareGrantsMessage, error.message || '刷新失败'); });
   });
 
-  var validateRootForm = root.querySelector('[data-admin-form="validate-root"]');
-  if (validateRootForm) {
-    validateRootForm.addEventListener('submit', function (event) {
-      event.preventDefault();
-      var values = formValues(event.currentTarget);
-      setText(validateResult, '正在验证...');
-      requestJson('/api/admin/access-policy/validate-root', {
-        method: 'POST',
-        body: JSON.stringify({ rootUri: values.rootUri, rootPath: values.rootPath }),
-      }).then(function (payload) {
-        setText(validateResult, payload);
-        setText(message, '目录验证完成');
-      }).catch(function (error) {
-        setText(validateResult, { ok: false, error: error.message || '验证失败' });
-        setText(message, error.message || '验证失败');
-      });
-    });
-  }
-
-  var createGrantForm = root.querySelector('[data-admin-form="create-grant"]');
-  if (createGrantForm) {
-    createGrantForm.addEventListener('submit', function (event) {
-      event.preventDefault();
-      var values = formValues(event.currentTarget);
-      setText(createResult, '正在创建...');
-      requestJson('/api/admin/access-policy/grants', {
-        method: 'POST',
-        body: JSON.stringify(values),
-      }).then(function (payload) {
-        setText(createResult, payload);
-        setText(message, '授权已创建');
-        return refreshPolicy();
-      }).catch(function (error) {
-        setText(createResult, { ok: false, error: error.message || '创建失败' });
-        setText(message, error.message || '创建失败');
-      });
-    });
-  }
-
-  var deleteGrantForm = root.querySelector('[data-admin-form="delete-grant"]');
-  if (deleteGrantForm) {
-    deleteGrantForm.addEventListener('submit', function (event) {
-      event.preventDefault();
-      var values = formValues(event.currentTarget);
-      var grantId = values.id;
-      setText(deleteResult, '正在删除...');
-      requestJson('/api/admin/access-policy/grants/' + encodeURIComponent(grantId), {
-        method: 'DELETE',
-        headers: {},
-      }).then(function (payload) {
-        setText(deleteResult, payload);
-        setText(message, '授权已删除');
-        return refreshPolicy();
-      }).catch(function (error) {
-        setText(deleteResult, { ok: false, error: error.message || '删除失败' });
-        setText(message, error.message || '删除失败');
-      });
-    });
-  }
-
   root.querySelector('[data-admin-form="create-share-grant"]').addEventListener('submit', function (event) {
     event.preventDefault();
     var values = shareGrantFormValues(event.currentTarget);
     setText(createShareGrantResult, '正在创建...');
-    requestJson(isAdmin ? '/api/admin/share-grants' : '/api/user/share-grants', {
+    requestJson(accessPolicyUrl('/grants'), {
       method: 'POST',
       body: JSON.stringify(values),
     }).then(function (payload) {
       setText(createShareGrantResult, payload);
-      setText(shareGrantsMessage, '分享授权已创建');
+      setText(shareGrantsMessage, '文件夹授权已创建');
+      event.currentTarget.reset();
       return refreshShareGrants();
     }).catch(function (error) {
       setText(createShareGrantResult, { ok: false, error: error.message || '创建失败' });
@@ -473,17 +219,19 @@ const ADMIN_POLICY_SCRIPT: &str = r#"
     });
   });
 
-  root.querySelector('[data-admin-form="delete-share-grant"]').addEventListener('submit', function (event) {
+  shareGrantsList && shareGrantsList.addEventListener('click', function(event) {
+    var button = event.target && event.target.closest ? event.target.closest('[data-admin-action="revoke-access-grant"]') : null;
+    if (!button) return;
     event.preventDefault();
-    var data = new FormData(event.currentTarget);
-    var shareId = String(data.get('deleteShareId') || '').trim();
+    var grantId = String(button.getAttribute('data-grant-id') || '').trim();
+    if (!grantId) return;
     setText(deleteShareGrantResult, '正在撤销...');
-    requestJson((isAdmin ? '/api/admin/share-grants/' : '/api/user/share-grants/') + encodeURIComponent(shareId), {
+    requestJson(accessPolicyUrl('/grants/') + encodeURIComponent(grantId), {
       method: 'DELETE',
       headers: {},
     }).then(function (payload) {
       setText(deleteShareGrantResult, payload);
-      setText(shareGrantsMessage, '分享授权已撤销');
+      setText(shareGrantsMessage, '文件夹授权已撤销');
       return refreshShareGrants();
     }).catch(function (error) {
       setText(deleteShareGrantResult, { ok: false, error: error.message || '撤销失败' });
@@ -491,16 +239,16 @@ const ADMIN_POLICY_SCRIPT: &str = r#"
     });
   });
 
-  if (isAdmin) {
-    refreshPolicy().catch(function (error) {
-      setText(message, error.message || '加载策略失败');
-      renderPolicyGrants(null);
-    });
-  }
   refreshShareGrants().catch(function (error) {
-    setText(shareGrantsMessage, error.message || '加载分享授权失败');
+    setText(shareGrantsMessage, error.message || '加载授权失败');
     renderShareGrants(null);
   });
+  }
+  window.MNOTEInitAccessPolicyPanel = initAccessPolicyPanel;
+  var shell = document.body && document.body.getAttribute('data-mnote-shell');
+  if (shell === 'admin' || shell === 'user-access-policy') {
+    initAccessPolicyPanel(document);
+  }
 })();
 "#;
 
@@ -510,21 +258,38 @@ mod tests {
     use crate::ssr::render_view;
 
     #[test]
-    fn admin_access_policy_page_renders_admin_controls() {
+    fn admin_access_policy_panel_renders_minimal_folder_grant_controls() {
         let html = render_view(view! {
-            <AdminAccessPolicyPage
+            <AdminAccessPolicyPanel
                 workspace_name={"我的空间".to_string()}
-                policy_path={"/mnt/Data1T/Mnote_data/control-plane/access-policy.json".to_string()}
+                is_admin=true
             />
         });
         assert!(html.contains("mnote-admin-access-policy-page"));
-        assert!(html.contains("mnote-admin-policy-json"));
+        assert!(html.contains("文件夹授权"));
+        assert!(html.contains("文件夹地址"));
+        assert!(html.contains("授权用户 ID"));
+        assert!(html.contains("read"));
+        assert!(html.contains("write"));
         assert!(html.contains("mnote-admin-share-grants-panel"));
         assert!(html.contains("mnote-admin-share-grants-json"));
-        assert!(html.contains("mnote-admin-validate-root-submit"));
-        assert!(html.contains("mnote-admin-create-grant-submit"));
-        assert!(html.contains("mnote-admin-delete-grant-submit"));
         assert!(html.contains("mnote-admin-create-share-grant-submit"));
-        assert!(html.contains("mnote-admin-delete-share-grant-submit"));
+        assert!(html.contains("/api/admin/access-policy"));
+        assert!(html.contains("/api/user/access-policy"));
+        assert!(html.contains("data-mnote-shell"));
+        assert!(!html.contains("/api/admin/share-grants"));
+        assert!(!html.contains("/api/user/share-grants"));
+        assert!(
+            html.contains("data-admin-action=&quot;revoke-access-grant&quot;")
+                || html.contains("revoke-access-grant")
+        );
+        assert!(!html.contains("name=\"grantId\""));
+        assert!(!html.contains("name=\"shareId\""));
+        assert!(!html.contains("share_xxx"));
+        assert!(!html.contains("name=\"ownerUserId\""));
+        assert!(!html.contains("documentId"));
+        assert!(!html.contains("allowedResourceIds"));
+        assert!(!html.contains("capabilities"));
+        assert!(!html.contains("mnote-admin-validate-root-submit"));
     }
 }

rust/crates/mnote-web/src/ssr/pages/layout.rs

@@ -1,5 +1,6 @@
 //! MNOTE 通用页面布局组件（Wolai / Notion 风格）
 
+use crate::ssr::pages::admin::AdminAccessPolicyPanel;
 use leptos::prelude::*;
 
 const SIDEBAR_TREE_JS: &str = r##"
@@ -1227,6 +1228,12 @@ const SIDEBAR_TREE_JS: &str = r##"
     if (existing && existing.parentElement) existing.parentElement.removeChild(existing);
   }
 
+  function closeAdminAccessPolicyDialog() {
+    var existing = document.querySelector('[data-testid="mnote-admin-access-policy-modal"]');
+    if (existing && existing.parentElement) existing.parentElement.removeChild(existing);
+    document.documentElement.removeAttribute('data-mnote-admin-access-policy-modal-open');
+  }
+
   function accountMenuFallbackSession() {
     var body = document.body instanceof HTMLElement ? document.body : null;
     var actorId = body ? String(body.getAttribute('data-mnote-actor-id') || '').trim() : '';
@@ -1263,10 +1270,6 @@ const SIDEBAR_TREE_JS: &str = r##"
     return String(session && session.actorType || '').trim() === 'admin';
   }
 
-  function accessPolicyHrefForSession(session) {
-    return sessionIsAdmin(session) ? '/admin/access-policy' : '/user/access-policy';
-  }
-
   async function loadAccountInfo(menu) {
     try {
       var response = await fetch('/api/auth/session', {
@@ -1346,6 +1349,43 @@ const SIDEBAR_TREE_JS: &str = r##"
     if (closeButton instanceof HTMLElement) closeButton.focus();
   }
 
+  function openAdminAccessPolicyDialog(trigger) {
+    closeAdminAccessPolicyDialog();
+    closeAccountMenu();
+    if (!(trigger instanceof HTMLElement)) return;
+    var role = trigger.getAttribute('data-access-policy-role') === 'admin' ? 'admin' : 'user';
+    var template = document.querySelector('[data-testid="mnote-admin-access-policy-template-' + role + '"]');
+    var dialog = document.createElement('div');
+    dialog.className = 'mnote-admin-policy-modal';
+    dialog.setAttribute('data-testid', 'mnote-admin-access-policy-modal');
+    dialog.setAttribute('role', 'dialog');
+    dialog.setAttribute('aria-modal', 'true');
+    dialog.setAttribute('aria-labelledby', 'mnote-admin-policy-dialog-title');
+    dialog.innerHTML =
+      '<div class="mnote-admin-policy-modal__backdrop" data-admin-access-policy-close></div>' +
+      '<section class="mnote-admin-policy-modal__panel">' +
+        '<button type="button" class="mnote-admin-policy-modal__close" data-admin-access-policy-close aria-label="关闭授权管理"><span class="material-symbols-outlined" data-icon="close" aria-hidden="true"></span></button>' +
+        '<div class="mnote-admin-policy-modal__content" data-testid="mnote-admin-access-policy-modal-content"></div>' +
+      '</section>';
+    var content = dialog.querySelector('[data-testid="mnote-admin-access-policy-modal-content"]');
+    if (content) {
+      content.innerHTML = template ? template.innerHTML : '<div class="mnote-admin-policy-empty">授权管理面板加载失败</div>';
+    }
+    if (typeof window.MNOTEInitAccessPolicyPanel === 'function') {
+      window.MNOTEInitAccessPolicyPanel(dialog);
+    }
+    dialog.querySelectorAll('[data-admin-access-policy-close]').forEach(function(button) {
+      button.addEventListener('click', function(event) {
+        event.preventDefault();
+        closeAdminAccessPolicyDialog();
+      });
+    });
+    document.body.appendChild(dialog);
+    document.documentElement.setAttribute('data-mnote-admin-access-policy-modal-open', 'true');
+    var closeButton = dialog.querySelector('.mnote-admin-policy-modal__close');
+    if (closeButton instanceof HTMLElement) closeButton.focus();
+  }
+
   async function signOutAccount(trigger) {
     setCommandPending(trigger, true);
     try {
@@ -1382,7 +1422,7 @@ const SIDEBAR_TREE_JS: &str = r##"
     menu.setAttribute('role', 'menu');
     menu.innerHTML =
       '<button type="button" class="mnote-workspace-source-menu__item mnote-account-menu__item" data-testid="mnote-account-profile" role="menuitem"><span class="material-symbols-outlined" data-icon="account_circle" aria-hidden="true"></span><span>个人信息</span></button>' +
-      '<a class="mnote-workspace-source-menu__item mnote-account-menu__item" data-testid="mnote-account-access-policy" role="menuitem" href="/user/access-policy"><span class="material-symbols-outlined" data-icon="admin_panel_settings" aria-hidden="true"></span><span>授权管理</span></a>' +
+      '<button type="button" class="mnote-workspace-source-menu__item mnote-account-menu__item" data-testid="mnote-account-access-policy" role="menuitem" hidden><span class="material-symbols-outlined" data-icon="admin_panel_settings" aria-hidden="true"></span><span>授权管理</span></button>' +
       '<button type="button" class="mnote-workspace-source-menu__item mnote-account-menu__logout" data-testid="mnote-account-sign-out" role="menuitem">退出登录</button>' +
       '<div class="mnote-account-menu__error" data-account-error hidden></div>';
     var sessionPromise = fetchAccountSession();
@@ -1395,8 +1435,16 @@ const SIDEBAR_TREE_JS: &str = r##"
     }
     var accessPolicyLink = menu.querySelector('[data-testid="mnote-account-access-policy"]');
     sessionPromise.then(function(session) {
-      if (accessPolicyLink instanceof HTMLElement) accessPolicyLink.setAttribute('href', accessPolicyHrefForSession(session));
+      if (!(accessPolicyLink instanceof HTMLElement)) return;
+      accessPolicyLink.hidden = false;
+      accessPolicyLink.setAttribute('data-access-policy-role', sessionIsAdmin(session) ? 'admin' : 'user');
     });
+    if (accessPolicyLink) {
+      accessPolicyLink.addEventListener('click', function(event) {
+        event.preventDefault();
+        openAdminAccessPolicyDialog(accessPolicyLink);
+      });
+    }
     var signOutButton = menu.querySelector('[data-testid="mnote-account-sign-out"]');
     if (signOutButton) {
       signOutButton.addEventListener('click', function(event) {
@@ -9996,13 +10044,14 @@ pub fn PageLayout(
     /// 顶栏当前页面标题（可选）
     #[prop(optional)]
     topbar_title: Option<String>,
-    /// 是否显示管理员授权入口
+    /// 是否显示管理员授权能力
     #[prop(optional)]
     show_admin_access_policy: bool,
     /// 是否启用树实时流
     #[prop(optional, default = true)]
     enable_tree_live: bool,
 ) -> impl IntoView {
+    let _ = show_admin_access_policy;
     let sidebar_tree_html = sidebar_tree_html.unwrap_or_default();
 
     let ws_name = workspace_name
@@ -10042,6 +10091,12 @@ pub fn PageLayout(
         "views": ["page-tree", "file-tree"]
     })
     .to_string();
+    let admin_access_policy_template = crate::ssr::render_view(leptos::view! {
+        <AdminAccessPolicyPanel workspace_name={ws_name.clone()} is_admin=true boot_script=false />
+    });
+    let user_access_policy_template = crate::ssr::render_view(leptos::view! {
+        <AdminAccessPolicyPanel workspace_name={ws_name.clone()} is_admin=false boot_script=false />
+    });
 
     view! {
         <div class="mnote-shell wolai-workspace-shell" data-mnote-web-owner="mnote-web" data-mnote-shell="workspace">
@@ -10068,21 +10123,6 @@ pub fn PageLayout(
                     <a href="/help" title="帮助" aria-label="帮助"><span class="material-symbols-outlined nav-icon" data-icon="help" aria-hidden="true"></span></a>
                     <a href="/files" title="文件" aria-label="文件"><span class="material-symbols-outlined nav-icon" data-icon="inventory_2" aria-hidden="true"></span></a>
                     <button type="button" title="打开本地文件夹" aria-label="打开本地文件夹" data-mnote-action="open-local-folder"><span class="material-symbols-outlined nav-icon" data-icon="folder_open" aria-hidden="true"></span></button>
-                    {if show_admin_access_policy {
-                        view! {
-                            <a
-                                href="/admin/access-policy"
-                                class:active={current_nav == "admin"}
-                                title="目录授权"
-                                aria-label="目录授权"
-                                data-testid="mnote-admin-access-policy-entry"
-                            >
-                                <span class="material-symbols-outlined nav-icon" data-icon="admin_panel_settings" aria-hidden="true"></span>
-                            </a>
-                        }.into_any()
-                    } else {
-                        view! {}.into_any()
-                    }}
                     <button
                         type="button"
                         title="更多"
@@ -10097,6 +10137,9 @@ pub fn PageLayout(
                 </nav>
                 <div class="wolai-sidebar-body" inner_html={sidebar_sections_html}></div>
                 <script id="__MNOTE_TREE_LIVE_BOOTSTRAP__" type="application/json" inner_html={tree_live_bootstrap}></script>
+                <div hidden data-testid="mnote-admin-access-policy-template-admin" inner_html={admin_access_policy_template}></div>
+                <div hidden data-testid="mnote-admin-access-policy-template-user" inner_html={user_access_policy_template}></div>
+                <script inner_html={crate::ssr::pages::admin::ADMIN_POLICY_SCRIPT.to_string()}></script>
                 <script inner_html={SIDEBAR_TREE_JS.to_string()}></script>
                 <script id="mnote-tree-live-controller" inner_html={TREE_LIVE_CONTROLLER_JS.to_string()}></script>
             </aside>

rust/crates/mnote-web/src/ssr/styles.rs

@@ -1900,7 +1900,7 @@ body {
   background: var(--atelier-document);
 }
 
-.mnote-admin-policy-page{width:min(1080px,calc(100vw - 64px));margin:40px auto 64px}.mnote-admin-policy-header{margin-bottom:24px}.mnote-admin-policy-header h1{font-size:28px;font-weight:650}.mnote-admin-policy-header p,.mnote-admin-policy-note{color:var(--wolai-text-secondary);font-size:14px}.mnote-admin-policy-summary,.mnote-admin-policy-panel,.mnote-admin-policy-form{border:1px solid var(--wolai-border);border-radius:8px;background:#fff}.mnote-admin-policy-summary{display:grid;grid-template-columns:1fr 2fr;gap:16px;padding:16px;margin-bottom:16px}.mnote-admin-policy-summary-label{display:block;color:var(--wolai-text-secondary);font-size:12px}.mnote-admin-policy-summary code,.mnote-admin-policy-json{white-space:pre-wrap;overflow-wrap:anywhere;font-family:"JetBrains Mono","SFMono-Regular",Consolas,monospace;font-size:12px}.mnote-admin-policy-panel,.mnote-admin-policy-form{padding:16px;margin-bottom:16px}.mnote-admin-policy-panel-header{display:flex;justify-content:space-between;gap:12px;margin-bottom:12px}.mnote-admin-policy-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:16px}.mnote-admin-policy-form{display:flex;flex-direction:column;gap:12px}.mnote-admin-policy-form label{display:flex;flex-direction:column;gap:6px;color:var(--wolai-text-secondary);font-size:12px}.mnote-admin-policy-form input,.mnote-admin-policy-form select{min-height:34px;border:1px solid var(--wolai-border);border-radius:6px;padding:6px 8px;background:#fff}.mnote-admin-policy-form button,.mnote-admin-policy-panel button{min-height:34px;border:1px solid var(--wolai-border);border-radius:6px;padding:6px 12px;background:var(--wolai-bg-sidebar);cursor:pointer}.mnote-admin-policy-json{min-height:48px;max-height:320px;overflow:auto;border-radius:6px;background:var(--wolai-bg-sidebar);padding:10px}.mnote-admin-policy-debug{margin-top:12px}.mnote-admin-policy-table{display:grid;gap:8px}.mnote-admin-policy-row{display:grid;grid-template-columns:minmax(0,1.4fr) minmax(120px,.6fr) minmax(0,1fr);gap:12px;border:1px solid var(--wolai-border);border-radius:8px;padding:12px}.mnote-admin-policy-row strong,.mnote-admin-policy-row span{display:block;min-width:0}.mnote-admin-policy-row span{color:var(--wolai-text-secondary);font-size:12px;overflow-wrap:anywhere}.mnote-admin-policy-badge{display:inline-flex!important;margin:2px 4px 2px 0;border-radius:999px;padding:2px 8px;background:var(--wolai-bg-sidebar);font-size:12px}.mnote-admin-policy-badge[data-value="write"]{background:#DCFCE7}.mnote-admin-policy-badge[data-value="read"]{background:#DBEAFE}.mnote-admin-policy-badge[data-value="已撤销"]{background:#FEE2E2}.mnote-admin-policy-empty{border:1px dashed var(--wolai-border);border-radius:8px;padding:18px;color:var(--wolai-text-secondary);background:var(--wolai-bg-sidebar);font-size:13px}@media(max-width:960px){.mnote-admin-policy-summary,.mnote-admin-policy-grid,.mnote-admin-policy-row{grid-template-columns:1fr}}
+.mnote-admin-policy-page{width:min(1080px,calc(100vw - 64px));margin:40px auto 64px}.mnote-admin-policy-modal{position:fixed;inset:0;z-index:1200;display:grid;place-items:center}.mnote-admin-policy-modal__backdrop{position:absolute;inset:0;background:rgba(15,23,42,.22)}.mnote-admin-policy-modal__panel{position:relative;width:min(920px,calc(100vw - 32px));max-height:calc(100vh - 48px);overflow:auto;border:1px solid var(--wolai-border);border-radius:8px;background:#fff;box-shadow:0 18px 54px rgba(15,23,42,.18);padding:20px}.mnote-admin-policy-modal__close{position:absolute;right:14px;top:14px;width:32px;height:32px;border:0;border-radius:6px;background:transparent;color:var(--wolai-text-secondary);cursor:pointer}.mnote-admin-policy-dialog__content{padding-right:28px}.mnote-admin-policy-header{margin-bottom:20px}.mnote-admin-policy-eyebrow{color:var(--wolai-text-secondary);font-size:13px}.mnote-admin-policy-header h1,.mnote-admin-policy-header h2{font-size:22px;font-weight:650}.mnote-admin-policy-header p,.mnote-admin-policy-note{color:var(--wolai-text-secondary);font-size:14px}.mnote-admin-policy-summary,.mnote-admin-policy-panel,.mnote-admin-policy-form{border:1px solid var(--wolai-border);border-radius:8px;background:#fff}.mnote-admin-policy-summary{display:grid;grid-template-columns:1fr 2fr;gap:16px;padding:16px;margin-bottom:16px}.mnote-admin-policy-summary-label{display:block;color:var(--wolai-text-secondary);font-size:12px}.mnote-admin-policy-summary code,.mnote-admin-policy-json{white-space:pre-wrap;overflow-wrap:anywhere;font-family:"JetBrains Mono","SFMono-Regular",Consolas,monospace;font-size:12px}.mnote-admin-policy-panel,.mnote-admin-policy-form{padding:16px;margin-bottom:16px}.mnote-admin-policy-panel-header{display:flex;justify-content:space-between;gap:12px;margin-bottom:12px}.mnote-admin-policy-grid{display:grid;grid-template-columns:minmax(260px,.8fr) minmax(0,1.4fr);gap:16px}.mnote-admin-policy-form{display:flex;flex-direction:column;gap:12px}.mnote-admin-policy-form label{display:flex;flex-direction:column;gap:6px;color:var(--wolai-text-secondary);font-size:12px}.mnote-admin-policy-form input,.mnote-admin-policy-form select{min-height:34px;border:1px solid var(--wolai-border);border-radius:6px;padding:6px 8px;background:#fff}.mnote-admin-policy-form button,.mnote-admin-policy-panel button,.mnote-admin-policy-row button{min-height:34px;border:1px solid var(--wolai-border);border-radius:6px;padding:6px 12px;background:var(--wolai-bg-sidebar);cursor:pointer}.mnote-admin-policy-row button{margin-top:8px;color:#B91C1C}.mnote-admin-policy-json{min-height:48px;max-height:320px;overflow:auto;border-radius:6px;background:var(--wolai-bg-sidebar);padding:10px}.mnote-admin-policy-debug{margin-top:12px}.mnote-admin-policy-table{display:grid;gap:8px}.mnote-admin-policy-row{display:grid;grid-template-columns:minmax(0,1.4fr) minmax(120px,.5fr) minmax(0,.8fr);gap:12px;border:1px solid var(--wolai-border);border-radius:8px;padding:12px}.mnote-admin-policy-row strong,.mnote-admin-policy-row span{display:block;min-width:0}.mnote-admin-policy-row span{color:var(--wolai-text-secondary);font-size:12px;overflow-wrap:anywhere}.mnote-admin-policy-badge{display:inline-flex!important;margin:2px 4px 2px 0;border-radius:999px;padding:2px 8px;background:var(--wolai-bg-sidebar);font-size:12px}.mnote-admin-policy-badge[data-value="write"]{background:#DCFCE7}.mnote-admin-policy-badge[data-value="read"]{background:#DBEAFE}.mnote-admin-policy-badge[data-value="已撤销"]{background:#FEE2E2}.mnote-admin-policy-empty{border:1px dashed var(--wolai-border);border-radius:8px;padding:18px;color:var(--wolai-text-secondary);background:var(--wolai-bg-sidebar);font-size:13px}@media(max-width:960px){.mnote-admin-policy-summary,.mnote-admin-policy-grid,.mnote-admin-policy-row{grid-template-columns:1fr}.mnote-admin-policy-dialog__content{padding-right:0}}
 
 .mnote-trash-workbench {
   width: min(860px, calc(100vw - 64px));