@memtensor/memos-local-openclaw-plugin 1.0.4-beta.2 → 1.0.4-beta.20

package/src/viewer/server.ts

@@ -34,6 +34,7 @@ export interface ViewerServerOptions {
   log: Logger;
   dataDir: string;
   ctx?: PluginContext;
+  defaultHubPort?: number;
 }
 
 interface AuthState {
@@ -51,6 +52,8 @@ export class ViewerServer {
   private readonly authFile: string;
   private readonly auth: AuthState;
   private readonly ctx?: PluginContext;
+  private readonly cookieName: string;
+  private readonly defaultHubPort: number;
 
   private static readonly SESSION_TTL = 24 * 60 * 60 * 1000;
   private static readonly PLUGIN_VERSION: string = (() => {
@@ -84,6 +87,12 @@ export class ViewerServer {
     { running: false, done: false, stopped: false, processed: 0, total: 0, tasksCreated: 0, skillsCreated: 0, errors: 0, skippedSessions: 0, totalSessions: 0 };
   private ppSSEClients: http.ServerResponse[] = [];
 
+  private notifSSEClients: http.ServerResponse[] = [];
+  private notifPollTimer?: ReturnType<typeof setInterval>;
+  private lastKnownNotifCount = 0;
+  private hubHeartbeatTimer?: ReturnType<typeof setInterval>;
+  private static readonly HUB_HEARTBEAT_INTERVAL_MS = 45_000;
+
   constructor(opts: ViewerServerOptions) {
     this.store = opts.store;
     this.embedder = opts.embedder;
@@ -93,25 +102,40 @@ export class ViewerServer {
     this.ctx = opts.ctx;
     this.authFile = path.join(opts.dataDir, "viewer-auth.json");
     this.auth = { passwordHash: null, sessions: new Map() };
+    this.cookieName = `memos_token_${opts.port}`;
+    this.defaultHubPort = opts.defaultHubPort ?? 18800;
     this.resetToken = crypto.randomBytes(16).toString("hex");
     this.loadAuth();
   }
 
+  private getHubPort(): number {
+    const configured = this.ctx?.config?.sharing?.hub?.port;
+    if (configured && configured !== 18800) return configured;
+    return this.defaultHubPort;
+  }
+
   start(): Promise<string> {
+    const MAX_PORT_RETRIES = 5;
     return new Promise((resolve, reject) => {
+      let retries = 0;
       this.server = http.createServer((req, res) => this.handleRequest(req, res));
       this.server.on("error", (err: NodeJS.ErrnoException) => {
-        if (err.code === "EADDRINUSE") {
-          this.log.warn(`Viewer port ${this.port} in use, trying ${this.port + 1}`);
-          this.server!.listen(this.port + 1, "127.0.0.1");
+        if (err.code === "EADDRINUSE" && retries < MAX_PORT_RETRIES) {
+          retries++;
+          const nextPort = this.port + retries;
+          this.log.warn(`Viewer port ${this.port + retries - 1} in use, trying ${nextPort}`);
+          this.server!.listen(nextPort, "0.0.0.0");
+        } else if (err.code === "EADDRINUSE") {
+          reject(new Error(`Viewer failed to find open port after ${MAX_PORT_RETRIES} retries (tried ${this.port}–${this.port + MAX_PORT_RETRIES})`));
         } else {
           reject(err);
         }
       });
-      this.server.listen(this.port, "127.0.0.1", () => {
+      this.server.listen(this.port, "0.0.0.0", () => {
         const addr = this.server!.address();
         const actualPort = typeof addr === "object" && addr ? addr.port : this.port;
         this.autoCleanupPolluted();
+        this.startHubHeartbeat();
         resolve(`http://127.0.0.1:${actualPort}`);
       });
     });
@@ -134,6 +158,10 @@ export class ViewerServer {
   }
 
   stop(): void {
+    this.stopHubHeartbeat();
+    this.stopNotifPoll();
+    for (const c of this.notifSSEClients) { try { c.end(); } catch {} }
+    this.notifSSEClients = [];
     this.server?.close();
     this.server = null;
   }
@@ -176,7 +204,8 @@ export class ViewerServer {
 
   private isValidSession(req: http.IncomingMessage): boolean {
     const cookie = req.headers.cookie ?? "";
-    const match = cookie.match(/memos_token=([a-f0-9]+)/);
+    const re = new RegExp(`${this.cookieName}=([a-f0-9]+)`);
+    const match = cookie.match(re);
     if (!match) return false;
     const expiry = this.auth.sessions.get(match[1]);
     if (!expiry) return false;
@@ -224,6 +253,11 @@ export class ViewerServer {
       }
 
       if (p === "/api/memories" && req.method === "GET") this.serveMemories(res, url);
+      else if (p === "/api/memories/share-local" && req.method === "POST") this.handleMemoryLocalShare(req, res);
+      else if (p === "/api/memories/unshare-local" && req.method === "POST") this.handleMemoryLocalUnshare(req, res);
+      else if (p.match(/^\/api\/memory\/[^/]+\/scope$/) && req.method === "PUT") this.handleMemoryScope(req, res, p);
+      else if (p.match(/^\/api\/task\/[^/]+\/scope$/) && req.method === "PUT") this.handleTaskScope(req, res, p);
+      else if (p.match(/^\/api\/skill\/[^/]+\/scope$/) && req.method === "PUT") this.handleSkillScope(req, res, p);
       else if (p === "/api/stats") this.serveStats(res, url);
       else if (p === "/api/metrics") this.serveMetrics(res, url);
       else if (p === "/api/tool-metrics") this.serveToolMetrics(res, url);
@@ -251,7 +285,10 @@ export class ViewerServer {
       else if (p === "/api/sharing/pending-users" && req.method === "GET") this.serveSharingPendingUsers(res);
       else if (p === "/api/sharing/approve-user" && req.method === "POST") this.handleSharingApproveUser(req, res);
       else if (p === "/api/sharing/reject-user" && req.method === "POST") this.handleSharingRejectUser(req, res);
+      else if (p === "/api/sharing/remove-user" && req.method === "POST") this.handleSharingRemoveUser(req, res);
+      else if (p === "/api/sharing/change-role" && req.method === "POST") this.handleSharingChangeRole(req, res);
       else if (p === "/api/sharing/retry-join" && req.method === "POST") this.handleRetryJoin(req, res);
+      else if (p === "/api/sharing/leave" && req.method === "POST") this.handleLeaveTeam(req, res);
       else if (p === "/api/sharing/search/memories" && req.method === "POST") this.handleSharingMemorySearch(req, res);
       else if (p === "/api/sharing/memories/list" && req.method === "GET") this.serveSharingMemoryList(res, url);
       else if (p === "/api/sharing/tasks/list" && req.method === "GET") this.serveSharingTaskList(res, url);
@@ -261,23 +298,24 @@ export class ViewerServer {
       else if (p === "/api/sharing/tasks/share" && req.method === "POST") this.handleSharingTaskShare(req, res);
       else if (p === "/api/sharing/tasks/unshare" && req.method === "POST") this.handleSharingTaskUnshare(req, res);
       else if (p === "/api/sharing/update-username" && req.method === "POST") this.handleUpdateUsername(req, res);
+      else if (p === "/api/sharing/rename-user" && req.method === "POST") this.handleAdminRenameUser(req, res);
       else if (p === "/api/sharing/test-hub" && req.method === "POST") this.handleTestHubConnection(req, res);
       else if (p === "/api/sharing/memories/share" && req.method === "POST") this.handleSharingMemoryShare(req, res);
       else if (p === "/api/sharing/memories/unshare" && req.method === "POST") this.handleSharingMemoryUnshare(req, res);
       else if (p === "/api/sharing/skills/pull" && req.method === "POST") this.handleSharingSkillPull(req, res);
       else if (p === "/api/sharing/skills/share" && req.method === "POST") this.handleSharingSkillShare(req, res);
       else if (p === "/api/sharing/skills/unshare" && req.method === "POST") this.handleSharingSkillUnshare(req, res);
-      else if (p === "/api/sharing/groups" && req.method === "GET") this.serveSharingGroups(res);
-      else if (p === "/api/sharing/groups" && req.method === "POST") this.handleSharingGroupCreate(req, res);
-      else if (p.match(/^\/api\/sharing\/groups\/[^/]+$/) && req.method === "PUT") this.handleSharingGroupUpdate(req, res, p);
-      else if (p.match(/^\/api\/sharing\/groups\/[^/]+$/) && req.method === "DELETE") this.handleSharingGroupDelete(res, p);
-      else if (p.match(/^\/api\/sharing\/groups\/[^/]+\/members$/) && req.method === "GET") this.serveSharingGroupMembers(res, p);
-      else if (p.match(/^\/api\/sharing\/groups\/[^/]+\/members$/) && req.method === "POST") this.handleSharingGroupAddMember(req, res, p);
-      else if (p.match(/^\/api\/sharing\/groups\/[^/]+\/members$/) && req.method === "DELETE") this.handleSharingGroupRemoveMember(req, res, p);
       else if (p === "/api/sharing/users" && req.method === "GET") this.serveSharingUsers(res);
+      else if (p === "/api/sharing/notifications" && req.method === "GET") this.serveSharingNotifications(res, url);
+      else if (p === "/api/sharing/notifications/read" && req.method === "POST") this.handleSharingNotificationsRead(req, res);
+      else if (p === "/api/sharing/notifications/clear" && req.method === "POST") this.handleSharingNotificationsClear(req, res);
+      else if (p === "/api/sharing/sync-hub-removal" && req.method === "POST") this.handleSyncHubRemoval(req, res);
+      else if (p === "/api/notifications/stream" && req.method === "GET") this.handleNotifSSE(req, res);
       else if (p === "/api/admin/shared-tasks" && req.method === "GET") this.serveAdminSharedTasks(res);
+      else if (p.match(/^\/api\/admin\/shared-tasks\/[^/]+\/detail$/) && req.method === "GET") this.serveHubTaskDetail(res, p);
       else if (p.match(/^\/api\/admin\/shared-tasks\/[^/]+$/) && req.method === "DELETE") this.handleAdminDeleteTask(res, p);
       else if (p === "/api/admin/shared-skills" && req.method === "GET") this.serveAdminSharedSkills(res);
+      else if (p.match(/^\/api\/admin\/shared-skills\/[^/]+\/detail$/) && req.method === "GET") this.serveHubSkillDetail(res, p);
       else if (p.match(/^\/api\/admin\/shared-skills\/[^/]+$/) && req.method === "DELETE") this.handleAdminDeleteSkill(res, p);
       else if (p === "/api/admin/shared-memories" && req.method === "GET") this.serveAdminSharedMemories(res);
       else if (p.match(/^\/api\/admin\/shared-memories\/[^/]+$/) && req.method === "DELETE") this.handleAdminDeleteMemory(res, p);
@@ -332,7 +370,7 @@ export class ViewerServer {
         const token = this.createSession();
         res.writeHead(200, {
           "Content-Type": "application/json",
-          "Set-Cookie": `memos_token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+          "Set-Cookie": `${this.cookieName}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
         });
         res.end(JSON.stringify({ ok: true, message: "Password set successfully" }));
       } catch (err) {
@@ -354,7 +392,7 @@ export class ViewerServer {
         const token = this.createSession();
         res.writeHead(200, {
           "Content-Type": "application/json",
-          "Set-Cookie": `memos_token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+          "Set-Cookie": `${this.cookieName}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
         });
         res.end(JSON.stringify({ ok: true }));
       } catch (err) {
@@ -366,11 +404,12 @@ export class ViewerServer {
 
   private handleLogout(req: http.IncomingMessage, res: http.ServerResponse): void {
     const cookie = req.headers.cookie ?? "";
-    const match = cookie.match(/memos_token=([a-f0-9]+)/);
+    const re = new RegExp(`${this.cookieName}=([a-f0-9]+)`);
+    const match = cookie.match(re);
     if (match) this.auth.sessions.delete(match[1]);
     res.writeHead(200, {
       "Content-Type": "application/json",
-      "Set-Cookie": "memos_token=; Path=/; HttpOnly; Max-Age=0",
+      "Set-Cookie": `${this.cookieName}=; Path=/; HttpOnly; Max-Age=0`,
     });
     res.end(JSON.stringify({ ok: true }));
   }
@@ -397,7 +436,7 @@ export class ViewerServer {
         const sessionToken = this.createSession();
         res.writeHead(200, {
           "Content-Type": "application/json",
-          "Set-Cookie": `memos_token=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+          "Set-Cookie": `${this.cookieName}=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
         });
         res.end(JSON.stringify({ ok: true, message: "Password reset successfully" }));
       } catch (err) {
@@ -432,22 +471,36 @@ export class ViewerServer {
     const params: any[] = [];
     if (session) { conditions.push("session_key = ?"); params.push(session); }
     if (role) { conditions.push("role = ?"); params.push(role); }
-    if (owner) { conditions.push("owner = ?"); params.push(owner); }
+    if (owner && owner.startsWith("agent:")) {
+      conditions.push("(owner = ? OR owner = 'public')");
+      params.push(owner);
+    } else if (owner) {
+      conditions.push("owner = ?"); params.push(owner);
+    }
     if (dateFrom) { conditions.push("created_at >= ?"); params.push(new Date(dateFrom).getTime()); }
     if (dateTo) { conditions.push("created_at <= ?"); params.push(new Date(dateTo).getTime()); }
 
     const where = conditions.length > 0 ? " WHERE " + conditions.join(" AND ") : "";
     const totalRow = db.prepare("SELECT COUNT(*) as count FROM chunks" + where).get(...params) as any;
-    const rawMemories = db.prepare("SELECT * FROM chunks" + where + ` ORDER BY created_at ${sortBy} LIMIT ? OFFSET ?`).all(...params, limit, offset);
+    const rawMemories = db.prepare("SELECT * FROM chunks" + where + ` ORDER BY CASE WHEN dedup_status IN ('duplicate','merged') THEN 1 ELSE 0 END ASC, created_at ${sortBy} LIMIT ? OFFSET ?`).all(...params, limit, offset);
     const findMergeSources = db.prepare("SELECT id, summary, role FROM chunks WHERE dedup_target = ? AND (dedup_status = 'merged' OR dedup_status = 'duplicate')");
 
     const chunkIds = rawMemories.map((m: any) => m.id);
     const sharingMap = new Map<string, { visibility: string; group_id: string | null }>();
+    const localShareMap = new Map<string, { original_owner: string; shared_at: number }>();
     if (chunkIds.length > 0) {
       try {
         const placeholders = chunkIds.map(() => "?").join(",");
         const sharedRows = db.prepare(`SELECT source_chunk_id, visibility, group_id FROM hub_memories WHERE source_chunk_id IN (${placeholders})`).all(...chunkIds) as Array<{ source_chunk_id: string; visibility: string; group_id: string | null }>;
         for (const r of sharedRows) sharingMap.set(r.source_chunk_id, r);
+        const teamMetaRows = db.prepare(`SELECT chunk_id, visibility, group_id FROM team_shared_chunks WHERE chunk_id IN (${placeholders})`).all(...chunkIds) as Array<{ chunk_id: string; visibility: string; group_id: string | null }>;
+        for (const r of teamMetaRows) {
+          if (!sharingMap.has(r.chunk_id)) {
+            sharingMap.set(r.chunk_id, { visibility: r.visibility, group_id: r.group_id });
+          }
+        }
+        const localRows = db.prepare(`SELECT chunk_id, original_owner, shared_at FROM local_shared_memories WHERE chunk_id IN (${placeholders})`).all(...chunkIds) as Array<{ chunk_id: string; original_owner: string; shared_at: number }>;
+        for (const r of localRows) localShareMap.set(r.chunk_id, r);
       } catch {
       }
     }
@@ -458,8 +511,12 @@ export class ViewerServer {
         out.merge_sources = sources;
       }
       const shared = sharingMap.get(m.id);
+      const localShared = localShareMap.get(m.id);
       out.sharingVisibility = shared?.visibility ?? null;
       out.sharingGroupId = shared?.group_id ?? null;
+      out.localSharing = out.owner === "public";
+      out.localSharingManaged = !!localShared;
+      out.localOriginalOwner = localShared?.original_owner ?? null;
       return out;
     });
 
@@ -477,7 +534,21 @@ export class ViewerServer {
   }
 
   private serveToolMetrics(res: http.ServerResponse, url: URL): void {
-    const minutes = Math.min(1440, Math.max(10, Number(url.searchParams.get("minutes")) || 60));
+    const fromParam = url.searchParams.get("from");
+    const toParam = url.searchParams.get("to");
+    if (fromParam) {
+      const fromMs = new Date(fromParam).getTime();
+      const toMs = toParam ? new Date(toParam).getTime() : Date.now();
+      if (isNaN(fromMs) || isNaN(toMs)) {
+        this.jsonResponse(res, { error: "Invalid date" }, 400);
+        return;
+      }
+      const diffMin = Math.max(10, Math.min(43200, Math.round((toMs - fromMs) / 60000)));
+      const data = this.store.getToolMetrics(diffMin, fromMs, toMs);
+      this.jsonResponse(res, data);
+      return;
+    }
+    const minutes = Math.min(43200, Math.max(10, Number(url.searchParams.get("minutes")) || 60));
     const data = this.store.getToolMetrics(minutes);
     this.jsonResponse(res, data);
   }
@@ -485,13 +556,15 @@ export class ViewerServer {
   private serveTasks(res: http.ServerResponse, url: URL): void {
     this.store.recordViewerEvent("tasks_list");
     const status = url.searchParams.get("status") ?? undefined;
+    const owner = url.searchParams.get("owner") ?? undefined;
     const limit = Math.min(100, Math.max(1, Number(url.searchParams.get("limit")) || 50));
     const offset = Math.max(0, Number(url.searchParams.get("offset")) || 0);
-    const { tasks, total } = this.store.listTasks({ status, limit, offset });
+    const { tasks, total } = this.store.listTasks({ status, limit, offset, owner });
 
     const db = (this.store as any).db;
     const items = tasks.map((t) => {
-      const meta = db.prepare("SELECT skill_status FROM tasks WHERE id = ?").get(t.id) as { skill_status: string | null } | undefined;
+      const meta = db.prepare("SELECT skill_status, owner FROM tasks WHERE id = ?").get(t.id) as { skill_status: string | null; owner: string | null } | undefined;
+      const sharedTask = db.prepare("SELECT visibility FROM hub_tasks WHERE source_task_id = ? ORDER BY updated_at DESC LIMIT 1").get(t.id) as { visibility: string } | undefined;
       return {
         id: t.id,
         sessionKey: t.sessionKey,
@@ -502,6 +575,8 @@ export class ViewerServer {
         endedAt: t.endedAt,
         chunkCount: this.store.countChunksByTask(t.id),
         skillStatus: meta?.skill_status ?? null,
+        owner: meta?.owner ?? "agent:main",
+        sharingVisibility: sharedTask?.visibility ?? null,
       };
     });
 
@@ -544,6 +619,7 @@ export class ViewerServer {
       title: task.title,
       summary: task.summary,
       status: task.status,
+      owner: task.owner ?? "agent:main",
       startedAt: task.startedAt,
       endedAt: task.endedAt,
       chunks: chunkItems,
@@ -552,6 +628,7 @@ export class ViewerServer {
       skillLinks,
       sharingVisibility: sharedTask?.visibility ?? null,
       sharingGroupId: sharedTask?.group_id ?? null,
+      hubTaskId: sharedTask ? true : false,
     });
   }
 
@@ -586,12 +663,19 @@ export class ViewerServer {
       }
       let embCount = 0;
       try { embCount = (db.prepare("SELECT COUNT(*) as count FROM embeddings").get() as any).count; } catch { /* table may not exist */ }
-      const sessionQuery = ownerFilter
-        ? "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks WHERE owner = ? GROUP BY session_key ORDER BY latest DESC"
-        : "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks GROUP BY session_key ORDER BY latest DESC";
-      const sessionList = (ownerFilter
-        ? db.prepare(sessionQuery).all(ownerFilter)
-        : db.prepare(sessionQuery).all()) as any[];
+      let sessionQuery: string;
+      let sessionParams: any[];
+      if (ownerFilter && ownerFilter.startsWith("agent:")) {
+        sessionQuery = "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks WHERE (owner = ? OR owner = 'public') GROUP BY session_key ORDER BY latest DESC";
+        sessionParams = [ownerFilter];
+      } else if (ownerFilter) {
+        sessionQuery = "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks WHERE owner = ? GROUP BY session_key ORDER BY latest DESC";
+        sessionParams = [ownerFilter];
+      } else {
+        sessionQuery = "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks GROUP BY session_key ORDER BY latest DESC";
+        sessionParams = [];
+      }
+      const sessionList = db.prepare(sessionQuery).all(...sessionParams) as any[];
 
       let skillCount = 0;
       try { skillCount = (db.prepare("SELECT COUNT(*) as count FROM skills").get() as any).count; } catch { /* table may not exist yet */ }
@@ -604,10 +688,16 @@ export class ViewerServer {
 
       let owners: string[] = [];
       try {
-        const ownerRows = db.prepare("SELECT DISTINCT owner FROM chunks WHERE owner IS NOT NULL ORDER BY owner").all() as any[];
+        const ownerRows = db.prepare("SELECT DISTINCT owner FROM chunks WHERE owner IS NOT NULL AND owner LIKE 'agent:%' ORDER BY owner").all() as any[];
         owners = ownerRows.map((o: any) => o.owner);
       } catch { /* column may not exist yet */ }
 
+      let currentAgentOwner = "agent:main";
+      try {
+        const latest = db.prepare("SELECT owner FROM chunks WHERE owner IS NOT NULL AND owner LIKE 'agent:%' ORDER BY created_at DESC LIMIT 1").get() as any;
+        if (latest?.owner) currentAgentOwner = latest.owner;
+      } catch { /* best-effort */ }
+
       this.jsonResponse(res, {
         totalMemories: total.count, totalSessions: sessions.count, totalEmbeddings: embCount,
         totalSkills: skillCount,
@@ -616,6 +706,7 @@ export class ViewerServer {
         timeRange: { earliest: timeRange.earliest, latest: timeRange.latest },
         sessions: sessionList,
         owners,
+        currentAgentOwner,
       });
     } catch (e) {
       this.log.warn(`stats error: ${e}`);
@@ -727,7 +818,12 @@ export class ViewerServer {
     if (visibility) {
       skills = skills.filter(s => s.visibility === visibility);
     }
-    this.jsonResponse(res, { skills });
+    const db = (this.store as any).db;
+    const enriched = skills.map(s => {
+      const hub = db.prepare("SELECT visibility FROM hub_skills WHERE source_skill_id = ? ORDER BY updated_at DESC LIMIT 1").get(s.id) as { visibility: string } | undefined;
+      return { ...s, sharingVisibility: hub?.visibility ?? null };
+    });
+    this.jsonResponse(res, { skills: enriched });
   }
 
   private serveSkillDetail(res: http.ServerResponse, urlPath: string): void {
@@ -978,11 +1074,21 @@ export class ViewerServer {
     });
   }
 
-  private handleSkillDelete(res: http.ServerResponse, urlPath: string): void {
+  private async handleSkillDelete(res: http.ServerResponse, urlPath: string): Promise<void> {
     const skillId = urlPath.replace("/api/skill/", "");
     const skill = this.store.getSkill(skillId);
     if (!skill) { res.writeHead(404, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Skill not found" })); return; }
-    // Remove skill directory from disk
+    try {
+      const hub = this.resolveHubConnection();
+      if (hub) {
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/skills/unpublish", {
+          method: "POST",
+          body: JSON.stringify({ sourceSkillId: skillId }),
+        }).catch(() => {});
+      }
+      const db = (this.store as any).db;
+      db.prepare("DELETE FROM hub_skills WHERE source_skill_id = ?").run(skillId);
+    } catch (_) {}
     try {
       if (skill.dirPath && fs.existsSync(skill.dirPath)) {
         fs.rmSync(skill.dirPath, { recursive: true, force: true });
@@ -1029,7 +1135,15 @@ export class ViewerServer {
     const cleaned = chunk.role === "user" && chunk.content
       ? { ...chunk, content: stripInboundMetadata(chunk.content) }
       : chunk;
-    this.jsonResponse(res, { memory: cleaned });
+    const localShared = this.store.getLocalSharedMemory(chunkId);
+    this.jsonResponse(res, {
+      memory: {
+        ...cleaned,
+        localSharing: cleaned.owner === "public",
+        localSharingManaged: !!localShared,
+        localOriginalOwner: localShared?.originalOwner ?? null,
+      },
+    });
   }
 
   private handleUpdate(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
@@ -1058,6 +1172,365 @@ export class ViewerServer {
     else { res.writeHead(404, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Not found" })); }
   }
 
+  private handleMemoryLocalShare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const chunkId = String(parsed.chunkId || "");
+        if (!chunkId) return this.jsonResponse(res, { ok: false, error: "missing_chunk_id" }, 400);
+        const result = this.store.markMemorySharedLocally(chunkId);
+        if (!result.ok) {
+          return this.jsonResponse(res, { ok: false, error: result.reason ?? "share_failed" }, result.reason === "not_found" ? 404 : 400);
+        }
+        this.jsonResponse(res, {
+          ok: true,
+          chunkId,
+          owner: result.owner,
+          localSharing: true,
+          localSharingManaged: true,
+          localOriginalOwner: result.originalOwner ?? null,
+        });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 400);
+      }
+    });
+  }
+
+  private handleMemoryLocalUnshare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const chunkId = String(parsed.chunkId || "");
+        const privateOwner = typeof parsed.privateOwner === "string" ? parsed.privateOwner : undefined;
+        if (!chunkId) return this.jsonResponse(res, { ok: false, error: "missing_chunk_id" }, 400);
+        const result = this.store.unmarkMemorySharedLocally(chunkId, privateOwner);
+        if (!result.ok) {
+          return this.jsonResponse(res, { ok: false, error: result.reason ?? "unshare_failed" }, result.reason === "not_found" ? 404 : 400);
+        }
+        this.jsonResponse(res, {
+          ok: true,
+          chunkId,
+          owner: result.owner,
+          localSharing: false,
+          localOriginalOwner: result.originalOwner ?? null,
+        });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 400);
+      }
+    });
+  }
+
+  // ─── Unified scope API ───
+
+  private handleMemoryScope(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
+    const chunkId = urlPath.split("/")[3];
+    this.readBody(req, async (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const scope = parsed.scope as string;
+        if (!["private", "local", "team"].includes(scope)) {
+          return this.jsonResponse(res, { ok: false, error: "scope must be 'private', 'local', or 'team'" }, 400);
+        }
+        const db = (this.store as any).db;
+        const chunk = db.prepare("SELECT * FROM chunks WHERE id = ?").get(chunkId) as any;
+        if (!chunk) return this.jsonResponse(res, { ok: false, error: "not_found" }, 404);
+
+        if (chunk.dedup_status && chunk.dedup_status !== "active") {
+          return this.jsonResponse(res, { ok: false, error: "inactive_memory", message: "Merged/duplicate memories cannot be shared" }, 400);
+        }
+
+        const isLocalShared = chunk.owner === "public";
+        const hubMemory = this.getHubMemoryForChunk(chunkId);
+        const isTeamShared = !!hubMemory;
+        const currentScope = isTeamShared ? "team" : isLocalShared ? "local" : "private";
+
+        if (scope === currentScope) {
+          return this.jsonResponse(res, { ok: true, scope, changed: false });
+        }
+
+        let hubSynced = false;
+
+        if (scope === "team") {
+          if (!isTeamShared) {
+            const hubClient = await this.resolveHubClientAware();
+            const refreshedChunk = db.prepare("SELECT * FROM chunks WHERE id = ?").get(chunkId) as any;
+            const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/share", {
+              method: "POST",
+              body: JSON.stringify({ memory: { sourceChunkId: refreshedChunk.id, role: refreshedChunk.role, content: refreshedChunk.content, summary: refreshedChunk.summary, kind: refreshedChunk.kind, groupId: null, visibility: "public" } }),
+            });
+            if (!isLocalShared) this.store.markMemorySharedLocally(chunkId);
+            const memoryId = String((response as any)?.memoryId ?? "");
+            const isHubRole = this.ctx?.config?.sharing?.role === "hub";
+            if (hubClient.userId && isHubRole) {
+              const existing = this.store.getHubMemoryBySource(hubClient.userId, chunkId);
+              this.store.upsertHubMemory({
+                id: memoryId || existing?.id || crypto.randomUUID(),
+                sourceChunkId: chunkId, sourceUserId: hubClient.userId,
+                role: refreshedChunk.role, content: refreshedChunk.content, summary: refreshedChunk.summary ?? "",
+                kind: refreshedChunk.kind, groupId: null, visibility: "public",
+                createdAt: existing?.createdAt ?? Date.now(), updatedAt: Date.now(),
+              });
+            } else if (hubClient.userId) {
+              this.store.upsertTeamSharedChunk(chunkId, { hubMemoryId: memoryId, visibility: "public", groupId: null });
+            }
+            hubSynced = true;
+          } else {
+            if (!isLocalShared) this.store.markMemorySharedLocally(chunkId);
+          }
+        } else if (scope === "local") {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/unshare", {
+                method: "POST", body: JSON.stringify({ sourceChunkId: chunkId }),
+              });
+              if (hubClient.userId) this.store.deleteHubMemoryBySource(hubClient.userId, chunkId);
+              this.store.deleteTeamSharedChunk(chunkId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unshare memory from team: ${err}`); }
+          }
+          if (!isLocalShared) this.store.markMemorySharedLocally(chunkId);
+        } else {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/unshare", {
+                method: "POST", body: JSON.stringify({ sourceChunkId: chunkId }),
+              });
+              if (hubClient.userId) this.store.deleteHubMemoryBySource(hubClient.userId, chunkId);
+              this.store.deleteTeamSharedChunk(chunkId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unshare memory from team: ${err}`); }
+          }
+          if (isLocalShared) this.store.unmarkMemorySharedLocally(chunkId);
+        }
+
+        this.jsonResponse(res, { ok: true, scope, changed: true, hubSynced });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 500);
+      }
+    });
+  }
+
+  private handleTaskScope(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
+    const taskId = urlPath.split("/")[3];
+    this.readBody(req, async (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const scope = parsed.scope as string;
+        if (!["private", "local", "team"].includes(scope)) {
+          return this.jsonResponse(res, { ok: false, error: "scope must be 'private', 'local', or 'team'" }, 400);
+        }
+        const task = this.store.getTask(taskId);
+        if (!task) return this.jsonResponse(res, { ok: false, error: "task_not_found" }, 404);
+
+        if (scope !== "private" && task.status !== "completed") {
+          return this.jsonResponse(res, { ok: false, error: "only_completed_tasks_can_be_shared" }, 400);
+        }
+
+        const isLocalShared = task.owner === "public";
+        const hubTask = this.getHubTaskForLocal(taskId);
+        const isTeamShared = !!hubTask;
+        const currentScope = isTeamShared ? "team" : isLocalShared ? "local" : "private";
+
+        if (scope === currentScope) {
+          return this.jsonResponse(res, { ok: true, scope, changed: false });
+        }
+
+        let hubSynced = false;
+
+        if (scope === "team") {
+          if (!isTeamShared) {
+            const chunks = this.store.getChunksByTask(taskId);
+            const hubClient = await this.resolveHubClientAware();
+            const refreshedTask = this.store.getTask(taskId)!;
+            const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/share", {
+              method: "POST",
+              body: JSON.stringify({
+                task: { id: refreshedTask.id, sourceTaskId: refreshedTask.id, title: refreshedTask.title, summary: refreshedTask.summary, groupId: null, visibility: "public", createdAt: refreshedTask.startedAt ?? Date.now(), updatedAt: refreshedTask.updatedAt ?? Date.now() },
+                chunks: chunks.map((c) => ({ id: c.id, hubTaskId: refreshedTask.id, sourceTaskId: refreshedTask.id, sourceChunkId: c.id, role: c.role, content: c.content, summary: c.summary, kind: c.kind, groupId: null, visibility: "public", createdAt: c.createdAt ?? Date.now() })),
+              }),
+            });
+            if (hubClient.userId) {
+              const existing = this.store.getHubTaskBySource(hubClient.userId, taskId);
+              this.store.upsertHubTask({
+                id: (response as any)?.taskId ?? existing?.id ?? crypto.randomUUID(),
+                sourceTaskId: taskId, sourceUserId: hubClient.userId, title: refreshedTask.title ?? "",
+                summary: refreshedTask.summary ?? "", groupId: null, visibility: "public",
+                createdAt: existing?.createdAt ?? Date.now(), updatedAt: Date.now(),
+              });
+            }
+            hubSynced = true;
+          }
+          if (!isLocalShared) {
+            const originalOwner = task.owner;
+            const db = (this.store as any).db;
+            db.prepare("INSERT INTO local_shared_tasks (task_id, hub_task_id, original_owner, shared_at) VALUES (?, ?, ?, ?) ON CONFLICT(task_id) DO UPDATE SET original_owner = excluded.original_owner, shared_at = excluded.shared_at").run(taskId, "", originalOwner, Date.now());
+            db.prepare("UPDATE tasks SET owner = 'public' WHERE id = ?").run(taskId);
+          }
+        }
+
+        if (scope === "local") {
+          if (!isLocalShared) {
+            const originalOwner = task.owner;
+            const db = (this.store as any).db;
+            db.prepare("INSERT INTO local_shared_tasks (task_id, hub_task_id, original_owner, shared_at) VALUES (?, ?, ?, ?) ON CONFLICT(task_id) DO UPDATE SET original_owner = excluded.original_owner, shared_at = excluded.shared_at").run(taskId, "", originalOwner, Date.now());
+            db.prepare("UPDATE tasks SET owner = 'public' WHERE id = ?").run(taskId);
+          }
+        }
+
+        if (scope === "local" && isTeamShared) {
+          try {
+            const hubClient = await this.resolveHubClientAware();
+            await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/unshare", {
+              method: "POST", body: JSON.stringify({ sourceTaskId: taskId }),
+            });
+            if (hubClient.userId) this.store.deleteHubTaskBySource(hubClient.userId, taskId);
+            hubSynced = true;
+          } catch (err) { this.log.warn(`Failed to unshare task from team: ${err}`); }
+        }
+
+        if (scope === "private") {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/unshare", {
+                method: "POST", body: JSON.stringify({ sourceTaskId: taskId }),
+              });
+              if (hubClient.userId) this.store.deleteHubTaskBySource(hubClient.userId, taskId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unshare task from team: ${err}`); }
+          }
+          if (isLocalShared) {
+            const db = (this.store as any).db;
+            const shared = db.prepare("SELECT original_owner FROM local_shared_tasks WHERE task_id = ?").get(taskId) as any;
+            const restoreOwner = shared?.original_owner ?? task.owner;
+            if (restoreOwner && restoreOwner !== "public") {
+              db.prepare("UPDATE tasks SET owner = ? WHERE id = ?").run(restoreOwner, taskId);
+            }
+            db.prepare("DELETE FROM local_shared_tasks WHERE task_id = ?").run(taskId);
+          }
+        }
+
+        this.jsonResponse(res, { ok: true, scope, changed: true, hubSynced });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 500);
+      }
+    });
+  }
+
+  private handleSkillScope(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
+    const skillId = urlPath.split("/")[3];
+    this.readBody(req, async (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const scope = parsed.scope as string;
+        if (!["private", "local", "team"].includes(scope)) {
+          return this.jsonResponse(res, { ok: false, error: "scope must be 'private', 'local', or 'team'" }, 400);
+        }
+        const skill = this.store.getSkill(skillId);
+        if (!skill) return this.jsonResponse(res, { ok: false, error: "skill_not_found" }, 404);
+
+        if (scope !== "private" && skill.status !== "active") {
+          return this.jsonResponse(res, { ok: false, error: "only_active_skills_can_be_shared" }, 400);
+        }
+
+        const isLocalShared = skill.visibility === "public";
+        const hubSkill = this.getHubSkillForLocal(skillId);
+        const isTeamShared = !!hubSkill;
+        const currentScope = isTeamShared ? "team" : isLocalShared ? "local" : "private";
+
+        if (scope === currentScope) {
+          return this.jsonResponse(res, { ok: true, scope, changed: false });
+        }
+
+        let hubSynced = false;
+
+        if (scope === "team") {
+          if (!isTeamShared) {
+            const bundle = buildSkillBundleForHub(this.store, skillId);
+            const hubClient = await this.resolveHubClientAware();
+            const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/publish", {
+              method: "POST",
+              body: JSON.stringify({ visibility: "public", groupId: null, metadata: bundle.metadata, bundle: bundle.bundle }),
+            });
+            if (hubClient.userId) {
+              const existing = this.store.getHubSkillBySource(hubClient.userId, skillId);
+              this.store.upsertHubSkill({
+                id: (response as any)?.skillId ?? existing?.id ?? crypto.randomUUID(),
+                sourceSkillId: skillId, sourceUserId: hubClient.userId,
+                name: skill.name, description: skill.description, version: skill.version,
+                groupId: null, visibility: "public",
+                bundle: JSON.stringify(bundle.bundle), qualityScore: skill.qualityScore,
+                createdAt: existing?.createdAt ?? Date.now(), updatedAt: Date.now(),
+              });
+            }
+            hubSynced = true;
+          }
+          if (!isLocalShared) this.store.setSkillVisibility(skillId, "public");
+        }
+
+        if (scope === "local") {
+          if (!isLocalShared) this.store.setSkillVisibility(skillId, "public");
+        }
+
+        if (scope === "local" && isTeamShared) {
+          try {
+            const hubClient = await this.resolveHubClientAware();
+            await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/unpublish", {
+              method: "POST", body: JSON.stringify({ sourceSkillId: skillId }),
+            });
+            if (hubClient.userId) this.store.deleteHubSkillBySource(hubClient.userId, skillId);
+            hubSynced = true;
+          } catch (err) { this.log.warn(`Failed to unpublish skill from team: ${err}`); }
+        }
+
+        if (scope === "private") {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/unpublish", {
+                method: "POST", body: JSON.stringify({ sourceSkillId: skillId }),
+              });
+              if (hubClient.userId) this.store.deleteHubSkillBySource(hubClient.userId, skillId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unpublish skill from team: ${err}`); }
+          }
+          if (isLocalShared) this.store.setSkillVisibility(skillId, "private");
+        }
+
+        this.jsonResponse(res, { ok: true, scope, changed: true, hubSynced });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 500);
+      }
+    });
+  }
+
+  private getHubMemoryForChunk(chunkId: string): any {
+    const db = (this.store as any).db;
+    const hub = db.prepare("SELECT * FROM hub_memories WHERE source_chunk_id = ? LIMIT 1").get(chunkId);
+    if (hub) return hub;
+    const ts = this.store.getTeamSharedChunk(chunkId);
+    if (ts) {
+      return {
+        source_chunk_id: chunkId,
+        visibility: ts.visibility,
+        group_id: ts.groupId,
+      };
+    }
+    return undefined;
+  }
+
+  private getHubTaskForLocal(taskId: string): any {
+    const db = (this.store as any).db;
+    return db.prepare("SELECT * FROM hub_tasks WHERE source_task_id = ? LIMIT 1").get(taskId);
+  }
+
+  private getHubSkillForLocal(skillId: string): any {
+    const db = (this.store as any).db;
+    return db.prepare("SELECT * FROM hub_skills WHERE source_skill_id = ? LIMIT 1").get(skillId);
+  }
+
   private handleDeleteSession(res: http.ServerResponse, url: URL): void {
     const key = url.searchParams.get("key");
     if (!key) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Missing key" })); return; }
@@ -1092,8 +1565,10 @@ export class ViewerServer {
   // ─── Config API ───
 
   private getOpenClawConfigPath(): string {
+    if (process.env.OPENCLAW_CONFIG_PATH) return process.env.OPENCLAW_CONFIG_PATH;
     const home = process.env.HOME || process.env.USERPROFILE || "";
-    return path.join(home, ".openclaw", "openclaw.json");
+    const ocHome = process.env.OPENCLAW_STATE_DIR || path.join(home, ".openclaw");
+    return path.join(ocHome, "openclaw.json");
   }
 
   private getPluginEntryConfig(raw: any): Record<string, unknown> {
@@ -1157,8 +1632,7 @@ export class ViewerServer {
       base.connection.connected = true;
       base.connection.hubUrl = resolvedHubUrl ?? undefined;
 
-      // 通过 hub API 获取 admin 用户的真实信息（含分组）
-      let adminUser: any = { username: "hub-admin", role: "admin", groups: [] };
+      let adminUser: any = { username: "hub-admin", role: "admin" };
       try {
         const hub = this.resolveHubConnection();
         if (hub) {
@@ -1168,7 +1642,6 @@ export class ViewerServer {
               id: me.id,
               username: me.username ?? "hub-admin",
               role: me.role ?? "admin",
-              groups: Array.isArray(me.groups) ? me.groups : [],
             };
           }
         }
@@ -1182,7 +1655,20 @@ export class ViewerServer {
         base.connection.teamName = info?.teamName ?? sharing.hub?.teamName ?? null;
         base.connection.apiVersion = info?.apiVersion ?? null;
       } catch { /* ignore */ }
-      this.jsonResponse(res, base);
+
+      const hubStats: any = { totalMembers: 0, onlineMembers: 0, pendingMembers: 0 };
+      try {
+        const activeUsers = this.store.listHubUsers("active");
+        const pendingUsers = this.store.listHubUsers("pending");
+        const now = Date.now();
+        const OFFLINE_THRESHOLD = 120_000;
+        hubStats.totalMembers = activeUsers.length;
+        hubStats.onlineMembers = activeUsers.filter(u =>
+          u.lastActiveAt && (now - u.lastActiveAt < OFFLINE_THRESHOLD),
+        ).length;
+        hubStats.pendingMembers = pendingUsers.length;
+      } catch { /* best-effort */ }
+      this.jsonResponse(res, { ...base, hubStats });
       return;
     }
 
@@ -1201,6 +1687,9 @@ export class ViewerServer {
       if (status.user?.status === "rejected") {
         output.connection.rejected = true;
       }
+      if (status.user?.status === "removed") {
+        output.connection.removed = true;
+      }
       if (status.connected && status.hubUrl) {
         try {
           const info = await fetch(`${status.hubUrl}/api/v1/hub/info`).then((r) => (r.ok ? r.json() : null)).catch(() => null) as any;
@@ -1269,6 +1758,67 @@ export class ViewerServer {
     });
   }
 
+  private handleSharingChangeRole(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/change-role", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId, role: parsed.role }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingRemoveUser(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/remove-user", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId, cleanResources: parsed.cleanResources === true }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleAdminRenameUser(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/rename-user", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId, username: parsed.username }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        const errStr = String(err);
+        if (errStr.includes("username_taken")) {
+          this.jsonResponse(res, { ok: false, error: "username_taken" });
+        } else if (errStr.includes("invalid_params")) {
+          this.jsonResponse(res, { ok: false, error: "invalid_params" });
+        } else {
+          this.jsonResponse(res, { ok: false, error: errStr });
+        }
+      }
+    });
+  }
+
   private handleRetryJoin(req: http.IncomingMessage, res: http.ServerResponse): void {
     this.readBody(req, async (_body) => {
       if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
@@ -1284,12 +1834,16 @@ export class ViewerServer {
       try {
         const hubUrl = normalizeHubUrl(hubAddress);
         const os = await import("os");
-        const username = os.userInfo().username || "user";
+        const nickname = sharing.client?.nickname;
+        const username = nickname || os.userInfo().username || "user";
         const hostname = os.hostname() || "unknown";
+        const persisted = this.store.getClientHubConnection();
+        const existingIdentityKey = persisted?.identityKey || "";
         const result = await hubRequestJson(hubUrl, "", "/api/v1/hub/join", {
           method: "POST",
-          body: JSON.stringify({ teamToken, username, deviceName: hostname }),
+          body: JSON.stringify({ teamToken, username, deviceName: hostname, reapply: true, identityKey: existingIdentityKey }),
         }) as any;
+        const returnedIdentityKey = String(result.identityKey || existingIdentityKey || "");
         this.store.setClientHubConnection({
           hubUrl,
           userId: String(result.userId || ""),
@@ -1297,6 +1851,8 @@ export class ViewerServer {
           userToken: result.userToken || "",
           role: "member",
           connectedAt: Date.now(),
+          identityKey: returnedIdentityKey,
+          lastKnownStatus: result.status || "",
         });
         this.jsonResponse(res, { ok: true, status: result.status || "pending" });
       } catch (err) {
@@ -1309,7 +1865,13 @@ export class ViewerServer {
     if (!this.ctx) return this.jsonResponse(res, { memories: [], error: "sharing_unavailable" });
     try {
       const limit = Number(url.searchParams.get("limit") || 40);
-      const data = await hubListMemories(this.store, this.ctx, { limit });
+      const hub = this.resolveHubConnection();
+      let data: any;
+      if (hub) {
+        data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/memories?limit=${limit}`);
+      } else {
+        data = await hubListMemories(this.store, this.ctx, { limit });
+      }
       this.jsonResponse(res, { memories: Array.isArray(data?.memories) ? data.memories : [] });
     } catch (err) {
       this.jsonResponse(res, { memories: [], error: String(err) });
@@ -1320,7 +1882,13 @@ export class ViewerServer {
     if (!this.ctx) return this.jsonResponse(res, { tasks: [], error: "sharing_unavailable" });
     try {
       const limit = Number(url.searchParams.get("limit") || 40);
-      const data = await hubListTasks(this.store, this.ctx, { limit });
+      const hub = this.resolveHubConnection();
+      let data: any;
+      if (hub) {
+        data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/tasks?limit=${limit}`);
+      } else {
+        data = await hubListTasks(this.store, this.ctx, { limit });
+      }
       this.jsonResponse(res, { tasks: Array.isArray(data?.tasks) ? data.tasks : [] });
     } catch (err) {
       this.jsonResponse(res, { tasks: [], error: String(err) });
@@ -1331,7 +1899,13 @@ export class ViewerServer {
     if (!this.ctx) return this.jsonResponse(res, { skills: [], error: "sharing_unavailable" });
     try {
       const limit = Number(url.searchParams.get("limit") || 40);
-      const data = await hubListSkills(this.store, this.ctx, { limit });
+      const hub = this.resolveHubConnection();
+      let data: any;
+      if (hub) {
+        data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/skills/list?limit=${limit}`);
+      } else {
+        data = await hubListSkills(this.store, this.ctx, { limit });
+      }
       this.jsonResponse(res, { skills: Array.isArray(data?.skills) ? data.skills : [] });
     } catch (err) {
       this.jsonResponse(res, { skills: [], error: String(err) });
@@ -1347,13 +1921,21 @@ export class ViewerServer {
         const query = String(parsed.query || "");
         const role = typeof parsed.role === "string" ? parsed.role : undefined;
         const maxResults = typeof parsed.maxResults === "number" ? parsed.maxResults : 10;
-        const scope = parsed.scope === "group" || parsed.scope === "all" ? parsed.scope : "local";
+        const scope = parsed.scope === "group" || parsed.scope === "all" || parsed.scope === "hub" ? (parsed.scope === "hub" ? "all" : parsed.scope) : "local";
         const local = this.searchLocalViewerMemories(query, { role, maxResults });
         if (scope === "local") {
           return this.jsonResponse(res, { local: { hits: local.hits, meta: local.meta }, hub: emptyHub });
         }
         try {
-          const hub = await hubSearchMemories(this.store, this.ctx, { query, maxResults, scope });
+          const conn = this.resolveHubConnection();
+          let hub: any;
+          if (conn) {
+            hub = await hubRequestJson(conn.hubUrl, conn.userToken, "/api/v1/hub/search", {
+              method: "POST", body: JSON.stringify({ query, maxResults, scope }),
+            });
+          } else {
+            hub = await hubSearchMemories(this.store, this.ctx!, { query, maxResults, scope });
+          }
           this.jsonResponse(res, { local: { hits: local.hits, meta: local.meta }, hub });
         } catch (err) {
           this.jsonResponse(res, { local: { hits: local.hits, meta: local.meta }, hub: emptyHub, error: String(err) });
@@ -1546,14 +2128,14 @@ export class ViewerServer {
             },
           }),
         });
-        const hubUserId = hubClient.userId;
-        if (hubUserId) {
+        const mid = String((response as any)?.memoryId ?? "");
+        if (hubClient.userId && this.ctx?.config?.sharing?.role === "hub") {
           const now = Date.now();
-          const existing = this.store.getHubMemoryBySource(hubUserId, chunk.id);
+          const existing = this.store.getHubMemoryBySource(hubClient.userId, chunk.id);
           this.store.upsertHubMemory({
-            id: (response as any)?.memoryId ?? existing?.id ?? crypto.randomUUID(),
+            id: mid || existing?.id || crypto.randomUUID(),
             sourceChunkId: chunk.id,
-            sourceUserId: hubUserId,
+            sourceUserId: hubClient.userId,
             role: chunk.role,
             content: chunk.content,
             summary: chunk.summary ?? "",
@@ -1563,6 +2145,8 @@ export class ViewerServer {
             createdAt: existing?.createdAt ?? now,
             updatedAt: now,
           });
+        } else if (hubClient.userId) {
+          this.store.upsertTeamSharedChunk(chunk.id, { hubMemoryId: mid, visibility, groupId });
         }
         this.jsonResponse(res, { ok: true, chunkId, visibility, response });
       } catch (err) {
@@ -1584,6 +2168,7 @@ export class ViewerServer {
         });
         const hubUserId = hubClient.userId;
         if (hubUserId) this.store.deleteHubMemoryBySource(hubUserId, chunkId);
+        this.store.deleteTeamSharedChunk(chunkId);
         this.jsonResponse(res, { ok: true, chunkId });
       } catch (err) {
         this.jsonResponse(res, { ok: false, error: String(err) });
@@ -1680,7 +2265,7 @@ export class ViewerServer {
     // Hub 模式：连接自己，用 bootstrap admin token
     const sharing = this.ctx.config.sharing;
     if (sharing?.role === "hub") {
-      const hubPort = sharing.hub?.port ?? 18800;
+      const hubPort = this.getHubPort();
       const hubUrl = `http://127.0.0.1:${hubPort}`;
       try {
         const authPath = path.join(this.dataDir, "hub-auth.json");
@@ -1720,123 +2305,12 @@ export class ViewerServer {
     return resolveHubClient(this.store, this.ctx);
   }
 
-  private extractGroupId(path: string): string {
-    const m = path.match(/\/api\/sharing\/groups\/([^/]+)/);
-    return m ? decodeURIComponent(m[1]) : "";
-  }
-
-  private async serveSharingGroups(res: http.ServerResponse): Promise<void> {
+  private async serveSharingUsers(res: http.ServerResponse): Promise<void> {
     const hub = this.resolveHubConnection();
-    if (!hub) return this.jsonResponse(res, { groups: [], error: "not_configured" });
+    if (!hub) return this.jsonResponse(res, { users: [], error: "not_configured" });
     try {
-      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/groups", { method: "GET" }) as any;
-      this.jsonResponse(res, { groups: Array.isArray(data?.groups) ? data.groups : [] });
-    } catch (err) {
-      this.jsonResponse(res, { groups: [], error: String(err) });
-    }
-  }
-
-  private handleSharingGroupCreate(req: http.IncomingMessage, res: http.ServerResponse): void {
-    this.readBody(req, async (body) => {
-      const hub = this.resolveHubConnection();
-      if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
-      try {
-        const parsed = JSON.parse(body || "{}");
-        const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/groups", {
-          method: "POST",
-          body: JSON.stringify({ name: parsed.name, description: parsed.description }),
-        }) as any;
-        this.jsonResponse(res, { ok: true, ...data });
-      } catch (err) {
-        this.jsonResponse(res, { ok: false, error: String(err) });
-      }
-    });
-  }
-
-  private handleSharingGroupUpdate(req: http.IncomingMessage, res: http.ServerResponse, p: string): void {
-    this.readBody(req, async (body) => {
-      const hub = this.resolveHubConnection();
-      if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
-      const groupId = this.extractGroupId(p);
-      try {
-        const parsed = JSON.parse(body || "{}");
-        await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/groups/${encodeURIComponent(groupId)}`, {
-          method: "PUT",
-          body: JSON.stringify({ name: parsed.name, description: parsed.description }),
-        });
-        this.jsonResponse(res, { ok: true });
-      } catch (err) {
-        this.jsonResponse(res, { ok: false, error: String(err) });
-      }
-    });
-  }
-
-  private async handleSharingGroupDelete(res: http.ServerResponse, p: string): Promise<void> {
-    const hub = this.resolveHubConnection();
-    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
-    const groupId = this.extractGroupId(p);
-    try {
-      await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/groups/${encodeURIComponent(groupId)}`, { method: "DELETE" });
-      this.jsonResponse(res, { ok: true });
-    } catch (err) {
-      this.jsonResponse(res, { ok: false, error: String(err) });
-    }
-  }
-
-  private async serveSharingGroupMembers(res: http.ServerResponse, p: string): Promise<void> {
-    const hub = this.resolveHubConnection();
-    if (!hub) return this.jsonResponse(res, { members: [], error: "not_configured" });
-    const groupId = this.extractGroupId(p);
-    try {
-      const data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/groups/${encodeURIComponent(groupId)}`, { method: "GET" }) as any;
-      this.jsonResponse(res, { members: Array.isArray(data?.members) ? data.members : [] });
-    } catch (err) {
-      this.jsonResponse(res, { members: [], error: String(err) });
-    }
-  }
-
-  private handleSharingGroupAddMember(req: http.IncomingMessage, res: http.ServerResponse, p: string): void {
-    this.readBody(req, async (body) => {
-      const hub = this.resolveHubConnection();
-      if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
-      const groupId = this.extractGroupId(p);
-      try {
-        const parsed = JSON.parse(body || "{}");
-        await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/groups/${encodeURIComponent(groupId)}/members`, {
-          method: "POST",
-          body: JSON.stringify({ userId: parsed.userId }),
-        });
-        this.jsonResponse(res, { ok: true });
-      } catch (err) {
-        this.jsonResponse(res, { ok: false, error: String(err) });
-      }
-    });
-  }
-
-  private handleSharingGroupRemoveMember(req: http.IncomingMessage, res: http.ServerResponse, p: string): void {
-    this.readBody(req, async (body) => {
-      const hub = this.resolveHubConnection();
-      if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
-      const groupId = this.extractGroupId(p);
-      try {
-        const parsed = JSON.parse(body || "{}");
-        await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/groups/${encodeURIComponent(groupId)}/members`, {
-          method: "DELETE",
-          body: JSON.stringify({ userId: parsed.userId }),
-        });
-        this.jsonResponse(res, { ok: true });
-      } catch (err) {
-        this.jsonResponse(res, { ok: false, error: String(err) });
-      }
-    });
-  }
-
-  private async serveSharingUsers(res: http.ServerResponse): Promise<void> {
-    const hub = this.resolveHubConnection();
-    if (!hub) return this.jsonResponse(res, { users: [], error: "not_configured" });
-    try {
-      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/users", { method: "GET" }) as any;
-      this.jsonResponse(res, { users: Array.isArray(data?.users) ? data.users : [] });
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/users", { method: "GET" }) as any;
+      this.jsonResponse(res, { users: Array.isArray(data?.users) ? data.users : [] });
     } catch (err) {
       this.jsonResponse(res, { users: [], error: String(err) });
     }
@@ -1849,7 +2323,14 @@ export class ViewerServer {
     if (!hub) return this.jsonResponse(res, { tasks: [], error: "not_configured" });
     try {
       const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/shared-tasks", { method: "GET" }) as any;
-      this.jsonResponse(res, { tasks: Array.isArray(data?.tasks) ? data.tasks : [] });
+      const tasks = Array.isArray(data?.tasks) ? data.tasks : [];
+      for (const tk of tasks) {
+        if (!tk.summary && tk.sourceTaskId) {
+          const local = this.store.getTask(tk.sourceTaskId);
+          if (local) { tk.summary = local.summary; tk.title = tk.title || local.title; }
+        }
+      }
+      this.jsonResponse(res, { tasks });
     } catch (err) {
       this.jsonResponse(res, { tasks: [], error: String(err) });
     }
@@ -1867,12 +2348,47 @@ export class ViewerServer {
     }
   }
 
+  private async serveHubTaskDetail(res: http.ServerResponse, p: string): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { error: "not_configured" }, 500);
+    const m = p.match(/^\/api\/admin\/shared-tasks\/([^/]+)\/detail$/);
+    if (!m) return this.jsonResponse(res, { error: "bad_request" }, 400);
+    const taskId = decodeURIComponent(m[1]);
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/shared-tasks/${encodeURIComponent(taskId)}/detail`, { method: "GET" }) as any;
+      this.jsonResponse(res, data);
+    } catch (err) {
+      this.jsonResponse(res, { error: String(err) }, 500);
+    }
+  }
+
+  private async serveHubSkillDetail(res: http.ServerResponse, p: string): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { error: "not_configured" }, 500);
+    const m = p.match(/^\/api\/admin\/shared-skills\/([^/]+)\/detail$/);
+    if (!m) return this.jsonResponse(res, { error: "bad_request" }, 400);
+    const skillId = decodeURIComponent(m[1]);
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/shared-skills/${encodeURIComponent(skillId)}/detail`, { method: "GET" }) as any;
+      this.jsonResponse(res, data);
+    } catch (err) {
+      this.jsonResponse(res, { error: String(err) }, 500);
+    }
+  }
+
   private async serveAdminSharedSkills(res: http.ServerResponse): Promise<void> {
     const hub = this.resolveHubConnection();
     if (!hub) return this.jsonResponse(res, { skills: [], error: "not_configured" });
     try {
       const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/shared-skills", { method: "GET" }) as any;
-      this.jsonResponse(res, { skills: Array.isArray(data?.skills) ? data.skills : [] });
+      const skills = Array.isArray(data?.skills) ? data.skills : [];
+      for (const sk of skills) {
+        if (!sk.description && sk.sourceSkillId) {
+          const local = this.store.getSkill(sk.sourceSkillId);
+          if (local) { sk.description = sk.description || local.description; sk.name = sk.name || local.name; }
+        }
+      }
+      this.jsonResponse(res, { skills });
     } catch (err) {
       this.jsonResponse(res, { skills: [], error: String(err) });
     }
@@ -1895,7 +2411,14 @@ export class ViewerServer {
     if (!hub) return this.jsonResponse(res, { memories: [], error: "not_configured" });
     try {
       const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/shared-memories", { method: "GET" }) as any;
-      this.jsonResponse(res, { memories: Array.isArray(data?.memories) ? data.memories : [] });
+      const memories = Array.isArray(data?.memories) ? data.memories : [];
+      for (const m of memories) {
+        if (!m.content && m.sourceChunkId) {
+          const local = this.store.getChunk(m.sourceChunkId);
+          if (local) { m.content = local.content; if (!m.summary && local.summary) m.summary = local.summary; }
+        }
+      }
+      this.jsonResponse(res, { memories });
     } catch (err) {
       this.jsonResponse(res, { memories: [], error: String(err) });
     }
@@ -1913,6 +2436,150 @@ export class ViewerServer {
     }
   }
 
+  private async serveSharingNotifications(res: http.ServerResponse, url: URL): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { notifications: [], unreadCount: 0 });
+    try {
+      const unread = url.searchParams.get("unread") === "1" ? "?unread=1" : "";
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/notifications${unread}`) as any;
+      this.jsonResponse(res, data);
+    } catch {
+      this.jsonResponse(res, { notifications: [], unreadCount: 0 });
+    }
+  }
+
+  private handleSharingNotificationsRead(req: http.IncomingMessage, res: http.ServerResponse): void {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+    this.readBody(req, async (raw) => {
+      try {
+        const body = JSON.parse(raw || "{}");
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications/read", { method: "POST", body: JSON.stringify(body) });
+        this.jsonResponse(res, { ok: true });
+        try {
+          const data = (await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications?unread=1")) as any;
+          const count = data?.unreadCount ?? 0;
+          this.lastKnownNotifCount = count;
+          this.broadcastNotifSSE({ type: "update", unreadCount: count });
+        } catch { /* best effort */ }
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingNotificationsClear(req: http.IncomingMessage, res: http.ServerResponse): void {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+    this.readBody(req, async () => {
+      try {
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications/clear", { method: "POST", body: "{}" });
+        this.jsonResponse(res, { ok: true });
+        this.broadcastNotifSSE({ type: "cleared", unreadCount: 0 });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  /** Badge-only: clear Client team-share UI metadata when Hub admin removes that memory. Does NOT touch chunks, embeddings, or hub_memories (recall paths). */
+  private handleSyncHubRemoval(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const sourceChunkId = String(parsed.sourceChunkId || "");
+        if (!sourceChunkId) return this.jsonResponse(res, { ok: false, error: "missing_source_chunk_id" }, 400);
+        this.store.deleteTeamSharedChunk(sourceChunkId);
+        this.jsonResponse(res, { ok: true, sourceChunkId });
+      } catch (e) {
+        this.jsonResponse(res, { ok: false, error: String(e) }, 500);
+      }
+    });
+  }
+
+  private handleNotifSSE(req: http.IncomingMessage, res: http.ServerResponse): void {
+    res.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "Access-Control-Allow-Origin": "*",
+    });
+    res.write("data: {\"type\":\"connected\"}\n\n");
+    this.notifSSEClients.push(res);
+    if (!this.notifPollTimer) this.startNotifPoll();
+    else this.notifPollImmediate();
+    req.on("close", () => {
+      this.notifSSEClients = this.notifSSEClients.filter((c) => c !== res);
+      if (this.notifSSEClients.length === 0) this.stopNotifPoll();
+    });
+  }
+
+  private broadcastNotifSSE(data: Record<string, unknown>): void {
+    const msg = `data: ${JSON.stringify(data)}\n\n`;
+    this.notifSSEClients = this.notifSSEClients.filter((c) => {
+      try { c.write(msg); return true; } catch { return false; }
+    });
+  }
+
+  private startNotifPoll(): void {
+    this.stopNotifPoll();
+    const tick = async () => {
+      const hub = this.resolveHubConnection();
+      if (!hub) return;
+      try {
+        const data = (await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications?unread=1")) as any;
+        const count = data?.unreadCount ?? 0;
+        if (count !== this.lastKnownNotifCount) {
+          this.lastKnownNotifCount = count;
+          this.broadcastNotifSSE({ type: "update", unreadCount: count });
+        }
+      } catch { /* ignore */ }
+    };
+    tick();
+    this.notifPollTimer = setInterval(tick, 3000);
+  }
+
+  private stopNotifPoll(): void {
+    if (this.notifPollTimer) { clearInterval(this.notifPollTimer); this.notifPollTimer = undefined; }
+  }
+
+  private notifPollImmediate(): void {
+    const hub = this.resolveHubConnection();
+    if (!hub) return;
+    hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications?unread=1")
+      .then((data: any) => {
+        const count = data?.unreadCount ?? 0;
+        if (count !== this.lastKnownNotifCount) {
+          this.lastKnownNotifCount = count;
+          this.broadcastNotifSSE({ type: "update", unreadCount: count });
+        }
+      })
+      .catch(() => {});
+  }
+
+  private startHubHeartbeat(): void {
+    this.stopHubHeartbeat();
+    const sendHeartbeat = async () => {
+      try {
+        const hub = this.resolveHubConnection();
+        if (!hub) {
+          const persisted = this.store.getClientHubConnection();
+          if (persisted?.hubUrl && persisted?.userToken) {
+            await hubRequestJson(persisted.hubUrl, persisted.userToken, "/api/v1/hub/heartbeat", { method: "POST" });
+          }
+          return;
+        }
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/heartbeat", { method: "POST" });
+      } catch { /* best-effort */ }
+    };
+    sendHeartbeat();
+    this.hubHeartbeatTimer = setInterval(sendHeartbeat, ViewerServer.HUB_HEARTBEAT_INTERVAL_MS);
+  }
+
+  private stopHubHeartbeat(): void {
+    if (this.hubHeartbeatTimer) { clearInterval(this.hubHeartbeatTimer); this.hubHeartbeatTimer = undefined; }
+  }
+
   private getLocalIPs(): string[] {
     const nets = os.networkInterfaces();
     const ips: string[] = [];
@@ -1965,7 +2632,7 @@ export class ViewerServer {
   }
 
   private handleSaveConfig(req: http.IncomingMessage, res: http.ServerResponse): void {
-    this.readBody(req, (body) => {
+    this.readBody(req, async (body) => {
       try {
         const newCfg = JSON.parse(body);
         const cfgPath = this.getOpenClawConfigPath();
@@ -1988,6 +2655,11 @@ export class ViewerServer {
         if (!entry.config) entry.config = {};
         const config = entry.config as Record<string, unknown>;
 
+        const oldSharing = config.sharing as Record<string, unknown> | undefined;
+        const oldSharingRole = oldSharing?.role as string | undefined;
+        const oldSharingEnabled = Boolean(oldSharing?.enabled);
+        const oldClientHubAddress = String((oldSharing?.client as Record<string, unknown>)?.hubAddress || "");
+
         if (newCfg.embedding) config.embedding = newCfg.embedding;
         if (newCfg.summarizer) config.summarizer = newCfg.summarizer;
         if (newCfg.skillEvolution) config.skillEvolution = newCfg.skillEvolution;
@@ -2002,12 +2674,14 @@ export class ViewerServer {
           if (merged.role === "client" && merged.client) {
             const clientCfg = merged.client as Record<string, unknown>;
             const addr = String(clientCfg.hubAddress || "");
-            if (addr) {
+            if (addr && oldSharingRole === "hub" && oldSharingEnabled) {
+              const selfHubPort = (oldSharing?.hub as Record<string, unknown>)?.port ?? 18800;
               const localIPs = this.getLocalIPs();
               localIPs.push("127.0.0.1", "localhost", "0.0.0.0");
               try {
                 const u = new URL(addr.startsWith("http") ? addr : `http://${addr}`);
-                if (localIPs.includes(u.hostname)) {
+                const targetPort = u.port || (u.protocol === "https:" ? "443" : "80");
+                if (localIPs.includes(u.hostname) && targetPort === String(selfHubPort)) {
                   res.writeHead(400, { "Content-Type": "application/json" });
                   res.end(JSON.stringify({ error: "cannot_join_self" }));
                   return;
@@ -2015,10 +2689,44 @@ export class ViewerServer {
               } catch {}
             }
           }
+
+          const newRole = merged.role as string | undefined;
+          const newEnabled = Boolean(merged.enabled);
+
+          // Detect disabling sharing or switching away from hub mode
+          const wasHub = oldSharingEnabled && oldSharingRole === "hub";
+          const isHub = newEnabled && newRole === "hub";
+          if (wasHub && !isHub) {
+            await this.notifyHubShutdown();
+            this.stopHubHeartbeat();
+            this.log.info("Hub shutting down: notified connected clients");
+          }
+
+          // Detect disabling sharing or switching away from client mode
+          const wasClient = oldSharingEnabled && oldSharingRole === "client";
+          const isClient = newEnabled && newRole === "client";
+          if (wasClient && !isClient) {
+            await this.withdrawOrLeaveHub();
+            this.store.clearClientHubConnection();
+            this.log.info("Client hub connection cleared (sharing disabled or role changed)");
+          }
+
+          if (wasClient && isClient) {
+            const newClientAddr = String((merged.client as Record<string, unknown>)?.hubAddress || "");
+            if (newClientAddr && oldClientHubAddress && normalizeHubUrl(newClientAddr) !== normalizeHubUrl(oldClientHubAddress)) {
+              this.notifyHubLeave();
+              const oldConn = this.store.getClientHubConnection();
+              if (oldConn) {
+                this.store.setClientHubConnection({ ...oldConn, hubUrl: normalizeHubUrl(newClientAddr), userToken: "", lastKnownStatus: "hub_changed" });
+              }
+              this.log.info("Client hub connection token cleared (switched to different Hub), identity preserved");
+            }
+          }
+
           if (merged.role === "hub") {
             merged.client = { hubAddress: "", userToken: "", teamToken: "" };
           } else if (merged.role === "client") {
-            merged.hub = { port: 18800, teamName: "", teamToken: "" };
+            merged.hub = { teamName: "", teamToken: "" };
           }
           config.sharing = merged;
         }
@@ -2026,7 +2734,27 @@ export class ViewerServer {
         fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
         fs.writeFileSync(cfgPath, JSON.stringify(raw, null, 2), "utf-8");
         this.log.info("Plugin config updated via Viewer");
-        this.jsonResponse(res, { ok: true });
+        this.stopHubHeartbeat();
+
+        // When switching to client mode or re-enabling sharing as client, send join request
+        const finalSharing = config.sharing as Record<string, unknown> | undefined;
+        const nowClient = Boolean(finalSharing?.enabled) && finalSharing?.role === "client";
+        const previouslyClient = oldSharingEnabled && oldSharingRole === "client";
+        let joinStatus: string | undefined;
+        if (nowClient && !previouslyClient) {
+          try {
+            joinStatus = await this.autoJoinOnSave(finalSharing);
+          } catch (e) {
+            this.log.warn(`Auto-join on save failed: ${e}`);
+          }
+        }
+
+        this.jsonResponse(res, { ok: true, joinStatus, restart: true });
+
+        setTimeout(() => {
+          this.log.info("config-save: triggering gateway restart via SIGUSR1...");
+          try { process.kill(process.pid, "SIGUSR1"); } catch (sig) { this.log.warn(`SIGUSR1 failed: ${sig}`); }
+        }, 500);
       } catch (e) {
         this.log.warn(`handleSaveConfig error: ${e}`);
         res.writeHead(500, { "Content-Type": "application/json" });
@@ -2035,6 +2763,166 @@ export class ViewerServer {
     });
   }
 
+  private async autoJoinOnSave(sharing: Record<string, unknown>): Promise<string | undefined> {
+    const clientCfg = sharing.client as Record<string, unknown> | undefined;
+    const hubAddress = String(clientCfg?.hubAddress || "");
+    const teamToken = String(clientCfg?.teamToken || "");
+    if (!hubAddress || !teamToken) return undefined;
+    const hubUrl = normalizeHubUrl(hubAddress);
+    const os = await import("os");
+    const nickname = String(clientCfg?.nickname || "");
+    const username = nickname || os.userInfo().username || "user";
+    const hostname = os.hostname() || "unknown";
+    const persisted = this.store.getClientHubConnection();
+    const existingIdentityKey = persisted?.identityKey || "";
+    const result = await hubRequestJson(hubUrl, "", "/api/v1/hub/join", {
+      method: "POST",
+      body: JSON.stringify({ teamToken, username, deviceName: hostname, identityKey: existingIdentityKey }),
+    }) as any;
+    const returnedIdentityKey = String(result.identityKey || existingIdentityKey || "");
+    this.store.setClientHubConnection({
+      hubUrl,
+      userId: String(result.userId || ""),
+      username,
+      userToken: result.userToken || "",
+      role: "member",
+      connectedAt: Date.now(),
+      identityKey: returnedIdentityKey,
+      lastKnownStatus: result.status || "",
+    });
+    this.log.info(`Auto-join on save: status=${result.status}, userId=${result.userId}`);
+    if (result.userToken) {
+      this.startHubHeartbeat();
+    }
+    return result.status;
+  }
+
+  private handleLeaveTeam(_req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(_req, async () => {
+      try {
+        await this.withdrawOrLeaveHub();
+        this.store.clearClientHubConnection();
+
+        const configPath = this.getOpenClawConfigPath();
+        if (configPath && fs.existsSync(configPath)) {
+          const raw = JSON.parse(fs.readFileSync(configPath, "utf8"));
+          const pluginKey = Object.keys(raw.plugins?.entries ?? {}).find(k => k.includes("memos-local"));
+          if (pluginKey) {
+            const cfg = raw.plugins.entries[pluginKey].config ?? {};
+            if (cfg.sharing) {
+              cfg.sharing.enabled = false;
+              cfg.sharing.client = { hubAddress: "", userToken: "", teamToken: "" };
+            }
+            raw.plugins.entries[pluginKey].config = cfg;
+            fs.writeFileSync(configPath, JSON.stringify(raw, null, 2) + "\n");
+            this.log.info("handleLeaveTeam: config updated, sharing disabled");
+          }
+        }
+
+        this.jsonResponse(res, { ok: true, restart: true });
+
+        setTimeout(() => {
+          this.log.info("handleLeaveTeam: triggering gateway restart via SIGUSR1...");
+          try { process.kill(process.pid, "SIGUSR1"); } catch (sig) { this.log.warn(`SIGUSR1 failed: ${sig}`); }
+        }, 500);
+      } catch (e) {
+        this.log.warn(`handleLeaveTeam error: ${e}`);
+        this.jsonResponse(res, { ok: false, error: String(e) });
+      }
+    });
+  }
+
+  private async notifyHubLeave(): Promise<void> {
+    try {
+      const hub = this.resolveHubConnection();
+      if (hub) {
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/leave", { method: "POST" });
+        this.log.info("Notified Hub of voluntary leave");
+        return;
+      }
+      const persisted = this.store.getClientHubConnection();
+      if (persisted?.hubUrl && persisted?.userToken) {
+        await hubRequestJson(persisted.hubUrl, persisted.userToken, "/api/v1/hub/leave", { method: "POST" });
+        this.log.info("Notified Hub of voluntary leave (persisted connection)");
+      }
+    } catch (e) {
+      this.log.warn(`Failed to notify Hub of leave: ${e}`);
+    }
+  }
+
+  private async withdrawOrLeaveHub(): Promise<void> {
+    try {
+      const persisted = this.store.getClientHubConnection();
+      const sharing = this.ctx?.config?.sharing;
+
+      if (persisted?.userToken && persisted?.hubUrl) {
+        await hubRequestJson(persisted.hubUrl, persisted.userToken, "/api/v1/hub/leave", { method: "POST" });
+        this.log.info("Notified Hub of voluntary leave (had token)");
+        return;
+      }
+
+      const hub = this.resolveHubConnection();
+      if (hub?.userToken) {
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/leave", { method: "POST" });
+        this.log.info("Notified Hub of voluntary leave (resolved connection)");
+        return;
+      }
+
+      const hubUrl = persisted?.hubUrl || (sharing?.client?.hubAddress ? normalizeHubUrl(sharing.client.hubAddress) : null);
+      const userId = persisted?.userId;
+      const teamToken = sharing?.client?.teamToken;
+      if (hubUrl && userId && teamToken) {
+        const withdrawUrl = `${normalizeHubUrl(hubUrl)}/api/v1/hub/withdraw-pending`;
+        await fetch(withdrawUrl, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ teamToken, userId }),
+        });
+        this.log.info("Withdrew pending application from Hub");
+        return;
+      }
+
+      this.log.info("No hub connection to clean up (no token, no pending)");
+    } catch (e) {
+      this.log.warn(`Failed to withdraw/leave Hub: ${e}`);
+    }
+  }
+
+  private async notifyHubShutdown(): Promise<void> {
+    try {
+      const sharing = this.ctx?.config.sharing;
+      if (!sharing || sharing.role !== "hub") return;
+      const hubPort = this.getHubPort();
+      const authPath = path.join(this.dataDir, "hub-auth.json");
+      let adminToken: string | undefined;
+      try {
+        const authData = JSON.parse(fs.readFileSync(authPath, "utf8"));
+        adminToken = authData?.bootstrapAdminToken;
+      } catch { return; }
+      if (!adminToken) return;
+
+      const users = this.store.listHubUsers("active");
+      const { v4: uuidv4 } = require("uuid");
+      for (const u of users) {
+        try {
+          this.store.insertHubNotification({
+            id: uuidv4(),
+            userId: u.id,
+            type: "hub_shutdown",
+            resource: "hub",
+            title: "Hub is shutting down",
+            message: "The Hub server is shutting down. You may be disconnected.",
+          });
+        } catch (e) {
+          this.log.warn(`Failed to insert shutdown notification for user ${u.id}: ${e}`);
+        }
+      }
+      this.log.info(`Hub shutdown: notified ${users.length} approved user(s)`);
+    } catch (e) {
+      this.log.warn(`notifyHubShutdown error: ${e}`);
+    }
+  }
+
   private handleUpdateUsername(req: http.IncomingMessage, res: http.ServerResponse): void {
     this.readBody(req, async (body) => {
       if (!this.ctx) return this.jsonResponse(res, { error: "sharing_unavailable" });
@@ -2062,10 +2950,10 @@ export class ViewerServer {
               this.log.warn(`Failed to update hub-auth.json: ${e}`);
             }
           } else {
-            const persisted = this.store.getClientHubConnection();
-            if (persisted) {
+            const persistedConn = this.store.getClientHubConnection();
+            if (persistedConn) {
               this.store.setClientHubConnection({
-                ...persisted,
+                ...persistedConn,
                 username: result.username,
                 userToken: result.userToken,
               });
@@ -2089,12 +2977,17 @@ export class ViewerServer {
         const { hubUrl } = JSON.parse(body);
         if (!hubUrl) { this.jsonResponse(res, { ok: false, error: "hubUrl is required" }); return; }
         try {
-          const localIPs = this.getLocalIPs();
-          localIPs.push("127.0.0.1", "localhost", "0.0.0.0");
-          const parsed = new URL(hubUrl.startsWith("http") ? hubUrl : `http://${hubUrl}`);
-          if (localIPs.includes(parsed.hostname)) {
-            this.jsonResponse(res, { ok: false, error: "cannot_join_self" });
-            return;
+          const sharing = this.ctx?.config?.sharing;
+          if (sharing?.enabled && sharing.role === "hub") {
+            const selfHubPort = this.getHubPort();
+            const localIPs = this.getLocalIPs();
+            localIPs.push("127.0.0.1", "localhost", "0.0.0.0");
+            const parsed = new URL(hubUrl.startsWith("http") ? hubUrl : `http://${hubUrl}`);
+            const targetPort = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+            if (localIPs.includes(parsed.hostname) && targetPort === String(selfHubPort)) {
+              this.jsonResponse(res, { ok: false, error: "cannot_join_self" });
+              return;
+            }
           }
         } catch {}
         const url = hubUrl.replace(/\/+$/, "") + "/api/v1/hub/info";
@@ -2332,10 +3225,9 @@ export class ViewerServer {
                   this.log.info(`update-install: success! Updated to ${newVersion}`);
                   this.jsonResponse(res, { ok: true, version: newVersion });
 
-                  // Trigger Gateway restart after response is sent
                   setTimeout(() => {
-                    this.log.info(`update-install: triggering gateway restart...`);
-                    process.kill(process.pid, "SIGUSR1");
+                    this.log.info(`update-install: triggering gateway restart via SIGUSR1...`);
+                    try { process.kill(process.pid, "SIGUSR1"); } catch (sig) { this.log.warn(`SIGUSR1 failed: ${sig}`); }
                   }, 500);
                 });
               });
@@ -2488,7 +3380,7 @@ export class ViewerServer {
 
   private getOpenClawHome(): string {
     const home = process.env.HOME || process.env.USERPROFILE || "";
-    return path.join(home, ".openclaw");
+    return process.env.OPENCLAW_STATE_DIR || path.join(home, ".openclaw");
   }
 
   private handleCleanupPolluted(res: http.ServerResponse): void {
@@ -2517,7 +3409,7 @@ export class ViewerServer {
     try {
       const ocHome = this.getOpenClawHome();
       const memoryDir = path.join(ocHome, "memory");
-      const sessionsDir = path.join(ocHome, "agents", "main", "sessions");
+      const agentsDir = path.join(ocHome, "agents");
 
       const sqliteFiles: Array<{ file: string; chunks: number }> = [];
       if (fs.existsSync(memoryDir)) {
@@ -2536,31 +3428,36 @@ export class ViewerServer {
 
       let sessionCount = 0;
       let messageCount = 0;
-      if (fs.existsSync(sessionsDir)) {
-        const jsonlFiles = fs.readdirSync(sessionsDir).filter(f => f.includes(".jsonl"));
-        sessionCount = jsonlFiles.length;
-        for (const f of jsonlFiles) {
-          try {
-            const content = fs.readFileSync(path.join(sessionsDir, f), "utf-8");
-            const lines = content.split("\n").filter(l => l.trim());
-            for (const line of lines) {
-              try {
-                const obj = JSON.parse(line);
-                if (obj.type === "message") {
-                  const role = obj.message?.role ?? obj.role;
-                  if (role === "user" || role === "assistant") {
-                    const mc = obj.message?.content ?? obj.content;
-                    let txt = "";
-                    if (typeof mc === "string") txt = mc;
-                    else if (Array.isArray(mc)) txt = mc.filter((p: any) => p.type === "text" && p.text).map((p: any) => p.text).join("\n");
-                    else txt = JSON.stringify(mc);
-                    if (role === "user") txt = stripInboundMetadata(txt);
-                    if (txt && txt.length >= 10) messageCount++;
+      if (fs.existsSync(agentsDir)) {
+        for (const entry of fs.readdirSync(agentsDir, { withFileTypes: true })) {
+          if (!entry.isDirectory()) continue;
+          const sessDir = path.join(agentsDir, entry.name, "sessions");
+          if (!fs.existsSync(sessDir)) continue;
+          const jsonlFiles = fs.readdirSync(sessDir).filter(f => f.includes(".jsonl"));
+          sessionCount += jsonlFiles.length;
+          for (const f of jsonlFiles) {
+            try {
+              const content = fs.readFileSync(path.join(sessDir, f), "utf-8");
+              const lines = content.split("\n").filter(l => l.trim());
+              for (const line of lines) {
+                try {
+                  const obj = JSON.parse(line);
+                  if (obj.type === "message") {
+                    const role = obj.message?.role ?? obj.role;
+                    if (role === "user" || role === "assistant") {
+                      const mc = obj.message?.content ?? obj.content;
+                      let txt = "";
+                      if (typeof mc === "string") txt = mc;
+                      else if (Array.isArray(mc)) txt = mc.filter((p: any) => p.type === "text" && p.text).map((p: any) => p.text).join("\n");
+                      else txt = JSON.stringify(mc);
+                      if (role === "user") txt = stripInboundMetadata(txt);
+                      if (txt && txt.length >= 10) messageCount++;
+                    }
                   }
-                }
-              } catch { /* skip bad lines */ }
-            }
-          } catch { /* skip unreadable */ }
+                } catch { /* skip bad lines */ }
+              }
+            } catch { /* skip unreadable */ }
+          }
         }
       }