@memtensor/memos-local-openclaw-plugin 1.0.4-beta.6 → 1.0.4-beta.8

package/src/viewer/server.ts

@@ -14,7 +14,11 @@ import { vectorSearch } from "../storage/vector";
 import { TaskProcessor } from "../ingest/task-processor";
 import { RecallEngine } from "../recall/engine";
 import { SkillEvolver } from "../skill/evolver";
-import type { Logger, Chunk, PluginContext } from "../types";
+import { resolveConfig } from "../config";
+import { getHubStatus } from "../client/connector";
+import { type ResolvedHubClient, hubGetMemoryDetail, hubListMemories, hubListTasks, hubListSkills, hubRequestJson, hubSearchMemories, hubSearchSkills, hubUpdateUsername, normalizeHubUrl, resolveHubClient } from "../client/hub";
+import { buildSkillBundleForHub, fetchHubSkillBundle, restoreSkillBundleFromHub } from "../client/skill-sync";
+import type { Logger, Chunk, PluginContext, MemosLocalConfig } from "../types";
 import { viewerHTML } from "./html";
 import { v4 as uuid } from "uuid";
 
@@ -80,6 +84,12 @@ export class ViewerServer {
     { running: false, done: false, stopped: false, processed: 0, total: 0, tasksCreated: 0, skillsCreated: 0, errors: 0, skippedSessions: 0, totalSessions: 0 };
   private ppSSEClients: http.ServerResponse[] = [];
 
+  private notifSSEClients: http.ServerResponse[] = [];
+  private notifPollTimer?: ReturnType<typeof setInterval>;
+  private lastKnownNotifCount = 0;
+  private hubHeartbeatTimer?: ReturnType<typeof setInterval>;
+  private static readonly HUB_HEARTBEAT_INTERVAL_MS = 45_000;
+
   constructor(opts: ViewerServerOptions) {
     this.store = opts.store;
     this.embedder = opts.embedder;
@@ -99,15 +109,16 @@ export class ViewerServer {
       this.server.on("error", (err: NodeJS.ErrnoException) => {
         if (err.code === "EADDRINUSE") {
           this.log.warn(`Viewer port ${this.port} in use, trying ${this.port + 1}`);
-          this.server!.listen(this.port + 1, "127.0.0.1");
+          this.server!.listen(this.port + 1, "0.0.0.0");
         } else {
           reject(err);
         }
       });
-      this.server.listen(this.port, "127.0.0.1", () => {
+      this.server.listen(this.port, "0.0.0.0", () => {
         const addr = this.server!.address();
         const actualPort = typeof addr === "object" && addr ? addr.port : this.port;
         this.autoCleanupPolluted();
+        this.startHubHeartbeat();
         resolve(`http://127.0.0.1:${actualPort}`);
       });
     });
@@ -130,6 +141,10 @@ export class ViewerServer {
   }
 
   stop(): void {
+    this.stopHubHeartbeat();
+    this.stopNotifPoll();
+    for (const c of this.notifSSEClients) { try { c.end(); } catch {} }
+    this.notifSSEClients = [];
     this.server?.close();
     this.server = null;
   }
@@ -220,7 +235,12 @@ export class ViewerServer {
       }
 
       if (p === "/api/memories" && req.method === "GET") this.serveMemories(res, url);
-      else if (p === "/api/stats") this.serveStats(res);
+      else if (p === "/api/memories/share-local" && req.method === "POST") this.handleMemoryLocalShare(req, res);
+      else if (p === "/api/memories/unshare-local" && req.method === "POST") this.handleMemoryLocalUnshare(req, res);
+      else if (p.match(/^\/api\/memory\/[^/]+\/scope$/) && req.method === "PUT") this.handleMemoryScope(req, res, p);
+      else if (p.match(/^\/api\/task\/[^/]+\/scope$/) && req.method === "PUT") this.handleTaskScope(req, res, p);
+      else if (p.match(/^\/api\/skill\/[^/]+\/scope$/) && req.method === "PUT") this.handleSkillScope(req, res, p);
+      else if (p === "/api/stats") this.serveStats(res, url);
       else if (p === "/api/metrics") this.serveMetrics(res, url);
       else if (p === "/api/tool-metrics") this.serveToolMetrics(res, url);
       else if (p === "/api/search") this.serveSearch(req, res, url);
@@ -243,6 +263,43 @@ export class ViewerServer {
       else if (p === "/api/memories" && req.method === "DELETE") this.handleDeleteAll(res);
       else if (p === "/api/logs" && req.method === "GET") this.serveLogs(res, url);
       else if (p === "/api/log-tools" && req.method === "GET") this.serveLogTools(res);
+      else if (p === "/api/sharing/status" && req.method === "GET") this.serveSharingStatus(res);
+      else if (p === "/api/sharing/pending-users" && req.method === "GET") this.serveSharingPendingUsers(res);
+      else if (p === "/api/sharing/approve-user" && req.method === "POST") this.handleSharingApproveUser(req, res);
+      else if (p === "/api/sharing/reject-user" && req.method === "POST") this.handleSharingRejectUser(req, res);
+      else if (p === "/api/sharing/remove-user" && req.method === "POST") this.handleSharingRemoveUser(req, res);
+      else if (p === "/api/sharing/change-role" && req.method === "POST") this.handleSharingChangeRole(req, res);
+      else if (p === "/api/sharing/retry-join" && req.method === "POST") this.handleRetryJoin(req, res);
+      else if (p === "/api/sharing/search/memories" && req.method === "POST") this.handleSharingMemorySearch(req, res);
+      else if (p === "/api/sharing/memories/list" && req.method === "GET") this.serveSharingMemoryList(res, url);
+      else if (p === "/api/sharing/tasks/list" && req.method === "GET") this.serveSharingTaskList(res, url);
+      else if (p === "/api/sharing/skills/list" && req.method === "GET") this.serveSharingSkillList(res, url);
+      else if (p === "/api/sharing/memory-detail" && req.method === "POST") this.handleSharingMemoryDetail(req, res);
+      else if (p === "/api/sharing/search/skills" && req.method === "GET") this.serveSharingSkillSearch(res, url);
+      else if (p === "/api/sharing/tasks/share" && req.method === "POST") this.handleSharingTaskShare(req, res);
+      else if (p === "/api/sharing/tasks/unshare" && req.method === "POST") this.handleSharingTaskUnshare(req, res);
+      else if (p === "/api/sharing/update-username" && req.method === "POST") this.handleUpdateUsername(req, res);
+      else if (p === "/api/sharing/rename-user" && req.method === "POST") this.handleAdminRenameUser(req, res);
+      else if (p === "/api/sharing/test-hub" && req.method === "POST") this.handleTestHubConnection(req, res);
+      else if (p === "/api/sharing/memories/share" && req.method === "POST") this.handleSharingMemoryShare(req, res);
+      else if (p === "/api/sharing/memories/unshare" && req.method === "POST") this.handleSharingMemoryUnshare(req, res);
+      else if (p === "/api/sharing/skills/pull" && req.method === "POST") this.handleSharingSkillPull(req, res);
+      else if (p === "/api/sharing/skills/share" && req.method === "POST") this.handleSharingSkillShare(req, res);
+      else if (p === "/api/sharing/skills/unshare" && req.method === "POST") this.handleSharingSkillUnshare(req, res);
+      else if (p === "/api/sharing/users" && req.method === "GET") this.serveSharingUsers(res);
+      else if (p === "/api/sharing/notifications" && req.method === "GET") this.serveSharingNotifications(res, url);
+      else if (p === "/api/sharing/notifications/read" && req.method === "POST") this.handleSharingNotificationsRead(req, res);
+      else if (p === "/api/sharing/notifications/clear" && req.method === "POST") this.handleSharingNotificationsClear(req, res);
+      else if (p === "/api/notifications/stream" && req.method === "GET") this.handleNotifSSE(req, res);
+      else if (p === "/api/admin/shared-tasks" && req.method === "GET") this.serveAdminSharedTasks(res);
+      else if (p.match(/^\/api\/admin\/shared-tasks\/[^/]+\/detail$/) && req.method === "GET") this.serveHubTaskDetail(res, p);
+      else if (p.match(/^\/api\/admin\/shared-tasks\/[^/]+$/) && req.method === "DELETE") this.handleAdminDeleteTask(res, p);
+      else if (p === "/api/admin/shared-skills" && req.method === "GET") this.serveAdminSharedSkills(res);
+      else if (p.match(/^\/api\/admin\/shared-skills\/[^/]+\/detail$/) && req.method === "GET") this.serveHubSkillDetail(res, p);
+      else if (p.match(/^\/api\/admin\/shared-skills\/[^/]+$/) && req.method === "DELETE") this.handleAdminDeleteSkill(res, p);
+      else if (p === "/api/admin/shared-memories" && req.method === "GET") this.serveAdminSharedMemories(res);
+      else if (p.match(/^\/api\/admin\/shared-memories\/[^/]+$/) && req.method === "DELETE") this.handleAdminDeleteMemory(res, p);
+      else if (p === "/api/local-ips" && req.method === "GET") this.serveLocalIPs(res);
       else if (p === "/api/config" && req.method === "GET") this.serveConfig(res);
       else if (p === "/api/config" && req.method === "PUT") this.handleSaveConfig(req, res);
       else if (p === "/api/test-model" && req.method === "POST") this.handleTestModel(req, res);
@@ -393,7 +450,13 @@ export class ViewerServer {
     const params: any[] = [];
     if (session) { conditions.push("session_key = ?"); params.push(session); }
     if (role) { conditions.push("role = ?"); params.push(role); }
-    if (owner) { conditions.push("owner = ?"); params.push(owner); }
+    if (owner && owner.startsWith("agent:")) {
+      const agentPrefix = owner + ":";
+      conditions.push("(owner = ? OR (owner = 'public' AND session_key LIKE ?))");
+      params.push(owner, agentPrefix + "%");
+    } else if (owner) {
+      conditions.push("owner = ?"); params.push(owner);
+    }
     if (dateFrom) { conditions.push("created_at >= ?"); params.push(new Date(dateFrom).getTime()); }
     if (dateTo) { conditions.push("created_at <= ?"); params.push(new Date(dateTo).getTime()); }
 
@@ -401,15 +464,34 @@ export class ViewerServer {
     const totalRow = db.prepare("SELECT COUNT(*) as count FROM chunks" + where).get(...params) as any;
     const rawMemories = db.prepare("SELECT * FROM chunks" + where + ` ORDER BY created_at ${sortBy} LIMIT ? OFFSET ?`).all(...params, limit, offset);
     const findMergeSources = db.prepare("SELECT id, summary, role FROM chunks WHERE dedup_target = ? AND (dedup_status = 'merged' OR dedup_status = 'duplicate')");
-    const memories = rawMemories.map((m: any) => {
-      if (m.role === "user" && m.content) {
-        m = { ...m, content: stripInboundMetadata(m.content) };
+
+    const chunkIds = rawMemories.map((m: any) => m.id);
+    const sharingMap = new Map<string, { visibility: string; group_id: string | null }>();
+    const localShareMap = new Map<string, { original_owner: string; shared_at: number }>();
+    if (chunkIds.length > 0) {
+      try {
+        const placeholders = chunkIds.map(() => "?").join(",");
+        const sharedRows = db.prepare(`SELECT source_chunk_id, visibility, group_id FROM hub_memories WHERE source_chunk_id IN (${placeholders})`).all(...chunkIds) as Array<{ source_chunk_id: string; visibility: string; group_id: string | null }>;
+        for (const r of sharedRows) sharingMap.set(r.source_chunk_id, r);
+        const localRows = db.prepare(`SELECT chunk_id, original_owner, shared_at FROM local_shared_memories WHERE chunk_id IN (${placeholders})`).all(...chunkIds) as Array<{ chunk_id: string; original_owner: string; shared_at: number }>;
+        for (const r of localRows) localShareMap.set(r.chunk_id, r);
+      } catch {
       }
-      if (m.merge_count > 0) {
+    }
+    const memories = rawMemories.map((m: any) => {
+      const out: any = m.role === "user" && m.content ? { ...m, content: stripInboundMetadata(m.content) } : { ...m };
+      if (out.merge_count > 0) {
         const sources = findMergeSources.all(m.id) as Array<{ id: string; summary: string; role: string }>;
-        m.merge_sources = sources;
+        out.merge_sources = sources;
       }
-      return m;
+      const shared = sharingMap.get(m.id);
+      const localShared = localShareMap.get(m.id);
+      out.sharingVisibility = shared?.visibility ?? null;
+      out.sharingGroupId = shared?.group_id ?? null;
+      out.localSharing = out.owner === "public";
+      out.localSharingManaged = !!localShared;
+      out.localOriginalOwner = localShared?.original_owner ?? null;
+      return out;
     });
 
     this.store.recordViewerEvent("list");
@@ -426,7 +508,21 @@ export class ViewerServer {
   }
 
   private serveToolMetrics(res: http.ServerResponse, url: URL): void {
-    const minutes = Math.min(1440, Math.max(10, Number(url.searchParams.get("minutes")) || 60));
+    const fromParam = url.searchParams.get("from");
+    const toParam = url.searchParams.get("to");
+    if (fromParam) {
+      const fromMs = new Date(fromParam).getTime();
+      const toMs = toParam ? new Date(toParam).getTime() : Date.now();
+      if (isNaN(fromMs) || isNaN(toMs)) {
+        this.jsonResponse(res, { error: "Invalid date" }, 400);
+        return;
+      }
+      const diffMin = Math.max(10, Math.min(43200, Math.round((toMs - fromMs) / 60000)));
+      const data = this.store.getToolMetrics(diffMin, fromMs, toMs);
+      this.jsonResponse(res, data);
+      return;
+    }
+    const minutes = Math.min(43200, Math.max(10, Number(url.searchParams.get("minutes")) || 60));
     const data = this.store.getToolMetrics(minutes);
     this.jsonResponse(res, data);
   }
@@ -434,13 +530,15 @@ export class ViewerServer {
   private serveTasks(res: http.ServerResponse, url: URL): void {
     this.store.recordViewerEvent("tasks_list");
     const status = url.searchParams.get("status") ?? undefined;
+    const owner = url.searchParams.get("owner") ?? undefined;
     const limit = Math.min(100, Math.max(1, Number(url.searchParams.get("limit")) || 50));
     const offset = Math.max(0, Number(url.searchParams.get("offset")) || 0);
-    const { tasks, total } = this.store.listTasks({ status, limit, offset });
+    const { tasks, total } = this.store.listTasks({ status, limit, offset, owner });
 
     const db = (this.store as any).db;
     const items = tasks.map((t) => {
-      const meta = db.prepare("SELECT skill_status FROM tasks WHERE id = ?").get(t.id) as { skill_status: string | null } | undefined;
+      const meta = db.prepare("SELECT skill_status, owner FROM tasks WHERE id = ?").get(t.id) as { skill_status: string | null; owner: string | null } | undefined;
+      const sharedTask = db.prepare("SELECT visibility FROM hub_tasks WHERE source_task_id = ? ORDER BY updated_at DESC LIMIT 1").get(t.id) as { visibility: string } | undefined;
       return {
         id: t.id,
         sessionKey: t.sessionKey,
@@ -451,6 +549,8 @@ export class ViewerServer {
         endedAt: t.endedAt,
         chunkCount: this.store.countChunksByTask(t.id),
         skillStatus: meta?.skill_status ?? null,
+        owner: meta?.owner ?? "agent:main",
+        sharingVisibility: sharedTask?.visibility ?? null,
       };
     });
 
@@ -485,6 +585,7 @@ export class ViewerServer {
     const db = (this.store as any).db;
     const meta = db.prepare("SELECT skill_status, skill_reason FROM tasks WHERE id = ?").get(taskId) as
       { skill_status: string | null; skill_reason: string | null } | undefined;
+    const sharedTask = db.prepare("SELECT visibility, group_id FROM hub_tasks WHERE source_task_id = ? ORDER BY updated_at DESC LIMIT 1").get(taskId) as { visibility: string | null; group_id: string | null } | undefined;
 
     this.jsonResponse(res, {
       id: task.id,
@@ -492,16 +593,20 @@ export class ViewerServer {
       title: task.title,
       summary: task.summary,
       status: task.status,
+      owner: task.owner ?? "agent:main",
       startedAt: task.startedAt,
       endedAt: task.endedAt,
       chunks: chunkItems,
       skillStatus: meta?.skill_status ?? null,
       skillReason: meta?.skill_reason ?? null,
       skillLinks,
+      sharingVisibility: sharedTask?.visibility ?? null,
+      sharingGroupId: sharedTask?.group_id ?? null,
+      hubTaskId: sharedTask ? true : false,
     });
   }
 
-  private serveStats(res: http.ServerResponse): void {
+  private serveStats(res: http.ServerResponse, url?: URL): void {
     const emptyStats = {
       totalMemories: 0, totalSessions: 0, totalEmbeddings: 0, totalSkills: 0,
       embeddingProvider: this.embedder?.provider ?? "none",
@@ -515,6 +620,8 @@ export class ViewerServer {
       return;
     }
 
+    const ownerFilter = url?.searchParams.get("owner") ?? "";
+
     try {
       const db = (this.store as any).db;
       const total = db.prepare("SELECT COUNT(*) as count FROM chunks").get() as any;
@@ -530,9 +637,20 @@ export class ViewerServer {
       }
       let embCount = 0;
       try { embCount = (db.prepare("SELECT COUNT(*) as count FROM embeddings").get() as any).count; } catch { /* table may not exist */ }
-      const sessionList = db.prepare(
-        "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks GROUP BY session_key ORDER BY latest DESC",
-      ).all() as any[];
+      let sessionQuery: string;
+      let sessionParams: any[];
+      if (ownerFilter && ownerFilter.startsWith("agent:")) {
+        const agentPrefix = ownerFilter + ":";
+        sessionQuery = "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks WHERE (owner = ? OR (owner = 'public' AND session_key LIKE ?)) GROUP BY session_key ORDER BY latest DESC";
+        sessionParams = [ownerFilter, agentPrefix + "%"];
+      } else if (ownerFilter) {
+        sessionQuery = "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks WHERE owner = ? GROUP BY session_key ORDER BY latest DESC";
+        sessionParams = [ownerFilter];
+      } else {
+        sessionQuery = "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks GROUP BY session_key ORDER BY latest DESC";
+        sessionParams = [];
+      }
+      const sessionList = db.prepare(sessionQuery).all(...sessionParams) as any[];
 
       let skillCount = 0;
       try { skillCount = (db.prepare("SELECT COUNT(*) as count FROM skills").get() as any).count; } catch { /* table may not exist yet */ }
@@ -545,7 +663,7 @@ export class ViewerServer {
 
       let owners: string[] = [];
       try {
-        const ownerRows = db.prepare("SELECT DISTINCT owner FROM chunks WHERE owner IS NOT NULL ORDER BY owner").all() as any[];
+        const ownerRows = db.prepare("SELECT DISTINCT owner FROM chunks WHERE owner IS NOT NULL AND owner LIKE 'agent:%' ORDER BY owner").all() as any[];
         owners = ownerRows.map((o: any) => o.owner);
       } catch { /* column may not exist yet */ }
 
@@ -668,7 +786,12 @@ export class ViewerServer {
     if (visibility) {
       skills = skills.filter(s => s.visibility === visibility);
     }
-    this.jsonResponse(res, { skills });
+    const db = (this.store as any).db;
+    const enriched = skills.map(s => {
+      const hub = db.prepare("SELECT visibility FROM hub_skills WHERE source_skill_id = ? ORDER BY updated_at DESC LIMIT 1").get(s.id) as { visibility: string } | undefined;
+      return { ...s, sharingVisibility: hub?.visibility ?? null };
+    });
+    this.jsonResponse(res, { skills: enriched });
   }
 
   private serveSkillDetail(res: http.ServerResponse, urlPath: string): void {
@@ -684,8 +807,11 @@ export class ViewerServer {
     const relatedTasks = this.store.getTasksBySkill(skillId);
     const files = fs.existsSync(skill.dirPath) ? this.walkDir(skill.dirPath, skill.dirPath) : [];
 
+    const db = (this.store as any).db;
+    const sharedSkill = db.prepare("SELECT visibility, group_id FROM hub_skills WHERE source_skill_id = ? ORDER BY updated_at DESC LIMIT 1").get(skillId) as { visibility: string | null; group_id: string | null } | undefined;
+
     this.jsonResponse(res, {
-      skill,
+      skill: { ...skill, sharingVisibility: sharedSkill?.visibility ?? null, sharingGroupId: sharedSkill?.group_id ?? null },
       versions: versions.map(v => ({
         id: v.id,
         version: v.version,
@@ -796,7 +922,7 @@ export class ViewerServer {
   private handleSkillVisibility(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
     const segments = urlPath.split("/");
     const skillId = segments[segments.length - 2];
-    this.readBody(req, (body) => {
+    this.readBody(req, async (body) => {
       try {
         const parsed = JSON.parse(body);
         const visibility = parsed.visibility;
@@ -812,7 +938,46 @@ export class ViewerServer {
           return;
         }
         this.store.setSkillVisibility(skillId, visibility);
-        this.jsonResponse(res, { ok: true, skillId, visibility });
+
+        let hubSynced = false;
+        const sharing = this.ctx?.config?.sharing;
+        if (sharing?.enabled && this.ctx) {
+          try {
+            const hubClient = await this.resolveHubClientAware();
+            if (visibility === "public") {
+              const bundle = buildSkillBundleForHub(this.store, skillId);
+              const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/publish", {
+                method: "POST",
+                body: JSON.stringify({ visibility: "public", groupId: null, metadata: bundle.metadata, bundle: bundle.bundle }),
+              }) as any;
+              if (hubClient.userId) {
+                const existing = this.store.getHubSkillBySource(hubClient.userId, skillId);
+                this.store.upsertHubSkill({
+                  id: response?.skillId ?? existing?.id ?? crypto.randomUUID(),
+                  sourceSkillId: skillId, sourceUserId: hubClient.userId,
+                  name: skill.name, description: skill.description, version: skill.version,
+                  groupId: null, visibility: "public",
+                  bundle: JSON.stringify(bundle.bundle), qualityScore: skill.qualityScore,
+                  createdAt: existing?.createdAt ?? Date.now(), updatedAt: Date.now(),
+                });
+              }
+              hubSynced = true;
+              this.log.info(`Skill "${skill.name}" published to Hub`);
+            } else {
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/unpublish", {
+                method: "POST",
+                body: JSON.stringify({ sourceSkillId: skillId }),
+              });
+              if (hubClient.userId) this.store.deleteHubSkillBySource(hubClient.userId, skillId);
+              hubSynced = true;
+              this.log.info(`Skill "${skill.name}" unpublished from Hub`);
+            }
+          } catch (hubErr) {
+            this.log.warn(`Hub sync failed for skill visibility change: ${hubErr}`);
+          }
+        }
+
+        this.jsonResponse(res, { ok: true, skillId, visibility, hubSynced });
       } catch (err) {
         const errMsg = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
         this.log.error(`handleSkillVisibility error: skillId=${skillId}, body=${body}, err=${errMsg}`);
@@ -928,7 +1093,15 @@ export class ViewerServer {
     const cleaned = chunk.role === "user" && chunk.content
       ? { ...chunk, content: stripInboundMetadata(chunk.content) }
       : chunk;
-    this.jsonResponse(res, { memory: cleaned });
+    const localShared = this.store.getLocalSharedMemory(chunkId);
+    this.jsonResponse(res, {
+      memory: {
+        ...cleaned,
+        localSharing: cleaned.owner === "public",
+        localSharingManaged: !!localShared,
+        localOriginalOwner: localShared?.originalOwner ?? null,
+      },
+    });
   }
 
   private handleUpdate(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
@@ -957,6 +1130,340 @@ export class ViewerServer {
     else { res.writeHead(404, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Not found" })); }
   }
 
+  private handleMemoryLocalShare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const chunkId = String(parsed.chunkId || "");
+        if (!chunkId) return this.jsonResponse(res, { ok: false, error: "missing_chunk_id" }, 400);
+        const result = this.store.markMemorySharedLocally(chunkId);
+        if (!result.ok) {
+          return this.jsonResponse(res, { ok: false, error: result.reason ?? "share_failed" }, result.reason === "not_found" ? 404 : 400);
+        }
+        this.jsonResponse(res, {
+          ok: true,
+          chunkId,
+          owner: result.owner,
+          localSharing: true,
+          localSharingManaged: true,
+          localOriginalOwner: result.originalOwner ?? null,
+        });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 400);
+      }
+    });
+  }
+
+  private handleMemoryLocalUnshare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const chunkId = String(parsed.chunkId || "");
+        const privateOwner = typeof parsed.privateOwner === "string" ? parsed.privateOwner : undefined;
+        if (!chunkId) return this.jsonResponse(res, { ok: false, error: "missing_chunk_id" }, 400);
+        const result = this.store.unmarkMemorySharedLocally(chunkId, privateOwner);
+        if (!result.ok) {
+          return this.jsonResponse(res, { ok: false, error: result.reason ?? "unshare_failed" }, result.reason === "not_found" ? 404 : 400);
+        }
+        this.jsonResponse(res, {
+          ok: true,
+          chunkId,
+          owner: result.owner,
+          localSharing: false,
+          localOriginalOwner: result.originalOwner ?? null,
+        });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 400);
+      }
+    });
+  }
+
+  // ─── Unified scope API ───
+
+  private handleMemoryScope(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
+    const chunkId = urlPath.split("/")[3];
+    this.readBody(req, async (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const scope = parsed.scope as string;
+        if (!["private", "local", "team"].includes(scope)) {
+          return this.jsonResponse(res, { ok: false, error: "scope must be 'private', 'local', or 'team'" }, 400);
+        }
+        const db = (this.store as any).db;
+        const chunk = db.prepare("SELECT * FROM chunks WHERE id = ?").get(chunkId) as any;
+        if (!chunk) return this.jsonResponse(res, { ok: false, error: "not_found" }, 404);
+
+        if (chunk.dedup_status && chunk.dedup_status !== "active") {
+          return this.jsonResponse(res, { ok: false, error: "inactive_memory", message: "Merged/duplicate memories cannot be shared" }, 400);
+        }
+
+        const isLocalShared = chunk.owner === "public";
+        const hubMemory = this.getHubMemoryForChunk(chunkId);
+        const isTeamShared = !!hubMemory;
+        const currentScope = isTeamShared ? "team" : isLocalShared ? "local" : "private";
+
+        if (scope === currentScope) {
+          return this.jsonResponse(res, { ok: true, scope, changed: false });
+        }
+
+        let hubSynced = false;
+
+        if (scope === "team") {
+          if (!isLocalShared) this.store.markMemorySharedLocally(chunkId);
+          if (!isTeamShared) {
+            const hubClient = await this.resolveHubClientAware();
+            const refreshedChunk = db.prepare("SELECT * FROM chunks WHERE id = ?").get(chunkId) as any;
+            const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/share", {
+              method: "POST",
+              body: JSON.stringify({ memory: { sourceChunkId: refreshedChunk.id, role: refreshedChunk.role, content: refreshedChunk.content, summary: refreshedChunk.summary, kind: refreshedChunk.kind, groupId: null, visibility: "public" } }),
+            });
+            if (hubClient.userId) {
+              const existing = this.store.getHubMemoryBySource(hubClient.userId, chunkId);
+              this.store.upsertHubMemory({
+                id: (response as any)?.memoryId ?? existing?.id ?? crypto.randomUUID(),
+                sourceChunkId: chunkId, sourceUserId: hubClient.userId,
+                role: refreshedChunk.role, content: refreshedChunk.content, summary: refreshedChunk.summary ?? "",
+                kind: refreshedChunk.kind, groupId: null, visibility: "public",
+                createdAt: existing?.createdAt ?? Date.now(), updatedAt: Date.now(),
+              });
+            }
+            hubSynced = true;
+          }
+        } else if (scope === "local") {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/unshare", {
+                method: "POST", body: JSON.stringify({ sourceChunkId: chunkId }),
+              });
+              if (hubClient.userId) this.store.deleteHubMemoryBySource(hubClient.userId, chunkId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unshare memory from team: ${err}`); }
+          }
+          if (!isLocalShared) this.store.markMemorySharedLocally(chunkId);
+        } else {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/unshare", {
+                method: "POST", body: JSON.stringify({ sourceChunkId: chunkId }),
+              });
+              if (hubClient.userId) this.store.deleteHubMemoryBySource(hubClient.userId, chunkId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unshare memory from team: ${err}`); }
+          }
+          if (isLocalShared) this.store.unmarkMemorySharedLocally(chunkId);
+        }
+
+        this.jsonResponse(res, { ok: true, scope, changed: true, hubSynced });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 500);
+      }
+    });
+  }
+
+  private handleTaskScope(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
+    const taskId = urlPath.split("/")[3];
+    this.readBody(req, async (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const scope = parsed.scope as string;
+        if (!["private", "local", "team"].includes(scope)) {
+          return this.jsonResponse(res, { ok: false, error: "scope must be 'private', 'local', or 'team'" }, 400);
+        }
+        const task = this.store.getTask(taskId);
+        if (!task) return this.jsonResponse(res, { ok: false, error: "task_not_found" }, 404);
+
+        if (scope !== "private" && task.status !== "completed") {
+          return this.jsonResponse(res, { ok: false, error: "only_completed_tasks_can_be_shared" }, 400);
+        }
+
+        const isLocalShared = task.owner === "public";
+        const hubTask = this.getHubTaskForLocal(taskId);
+        const isTeamShared = !!hubTask;
+        const currentScope = isTeamShared ? "team" : isLocalShared ? "local" : "private";
+
+        if (scope === currentScope) {
+          return this.jsonResponse(res, { ok: true, scope, changed: false });
+        }
+
+        let hubSynced = false;
+
+        if (scope === "local" || scope === "team") {
+          if (!isLocalShared) {
+            const originalOwner = task.owner;
+            const db = (this.store as any).db;
+            db.prepare("INSERT INTO local_shared_tasks (task_id, hub_task_id, original_owner, shared_at) VALUES (?, ?, ?, ?) ON CONFLICT(task_id) DO UPDATE SET original_owner = excluded.original_owner, shared_at = excluded.shared_at").run(taskId, "", originalOwner, Date.now());
+            db.prepare("UPDATE tasks SET owner = 'public' WHERE id = ?").run(taskId);
+          }
+        }
+
+        if (scope === "team") {
+          if (!isTeamShared) {
+            const chunks = this.store.getChunksByTask(taskId);
+            const hubClient = await this.resolveHubClientAware();
+            const refreshedTask = this.store.getTask(taskId)!;
+            const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/share", {
+              method: "POST",
+              body: JSON.stringify({
+                task: { id: refreshedTask.id, sourceTaskId: refreshedTask.id, title: refreshedTask.title, summary: refreshedTask.summary, groupId: null, visibility: "public", createdAt: refreshedTask.startedAt ?? Date.now(), updatedAt: refreshedTask.updatedAt ?? Date.now() },
+                chunks: chunks.map((c) => ({ id: c.id, hubTaskId: refreshedTask.id, sourceTaskId: refreshedTask.id, sourceChunkId: c.id, role: c.role, content: c.content, summary: c.summary, kind: c.kind, groupId: null, visibility: "public", createdAt: c.createdAt ?? Date.now() })),
+              }),
+            });
+            if (hubClient.userId) {
+              const existing = this.store.getHubTaskBySource(hubClient.userId, taskId);
+              this.store.upsertHubTask({
+                id: (response as any)?.taskId ?? existing?.id ?? crypto.randomUUID(),
+                sourceTaskId: taskId, sourceUserId: hubClient.userId, title: refreshedTask.title ?? "",
+                summary: refreshedTask.summary ?? "", groupId: null, visibility: "public",
+                createdAt: existing?.createdAt ?? Date.now(), updatedAt: Date.now(),
+              });
+            }
+            hubSynced = true;
+          }
+        }
+
+        if (scope === "local" && isTeamShared) {
+          try {
+            const hubClient = await this.resolveHubClientAware();
+            await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/unshare", {
+              method: "POST", body: JSON.stringify({ sourceTaskId: taskId }),
+            });
+            if (hubClient.userId) this.store.deleteHubTaskBySource(hubClient.userId, taskId);
+            hubSynced = true;
+          } catch (err) { this.log.warn(`Failed to unshare task from team: ${err}`); }
+        }
+
+        if (scope === "private") {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/unshare", {
+                method: "POST", body: JSON.stringify({ sourceTaskId: taskId }),
+              });
+              if (hubClient.userId) this.store.deleteHubTaskBySource(hubClient.userId, taskId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unshare task from team: ${err}`); }
+          }
+          if (isLocalShared) {
+            const db = (this.store as any).db;
+            const shared = db.prepare("SELECT original_owner FROM local_shared_tasks WHERE task_id = ?").get(taskId) as any;
+            const restoreOwner = shared?.original_owner ?? task.owner;
+            if (restoreOwner && restoreOwner !== "public") {
+              db.prepare("UPDATE tasks SET owner = ? WHERE id = ?").run(restoreOwner, taskId);
+            }
+            db.prepare("DELETE FROM local_shared_tasks WHERE task_id = ?").run(taskId);
+          }
+        }
+
+        this.jsonResponse(res, { ok: true, scope, changed: true, hubSynced });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 500);
+      }
+    });
+  }
+
+  private handleSkillScope(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
+    const skillId = urlPath.split("/")[3];
+    this.readBody(req, async (body) => {
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const scope = parsed.scope as string;
+        if (!["private", "local", "team"].includes(scope)) {
+          return this.jsonResponse(res, { ok: false, error: "scope must be 'private', 'local', or 'team'" }, 400);
+        }
+        const skill = this.store.getSkill(skillId);
+        if (!skill) return this.jsonResponse(res, { ok: false, error: "skill_not_found" }, 404);
+
+        if (scope !== "private" && skill.status !== "active") {
+          return this.jsonResponse(res, { ok: false, error: "only_active_skills_can_be_shared" }, 400);
+        }
+
+        const isLocalShared = skill.visibility === "public";
+        const hubSkill = this.getHubSkillForLocal(skillId);
+        const isTeamShared = !!hubSkill;
+        const currentScope = isTeamShared ? "team" : isLocalShared ? "local" : "private";
+
+        if (scope === currentScope) {
+          return this.jsonResponse(res, { ok: true, scope, changed: false });
+        }
+
+        let hubSynced = false;
+
+        if (scope === "local" || scope === "team") {
+          if (!isLocalShared) this.store.setSkillVisibility(skillId, "public");
+        }
+
+        if (scope === "team") {
+          if (!isTeamShared) {
+            const bundle = buildSkillBundleForHub(this.store, skillId);
+            const hubClient = await this.resolveHubClientAware();
+            const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/publish", {
+              method: "POST",
+              body: JSON.stringify({ visibility: "public", groupId: null, metadata: bundle.metadata, bundle: bundle.bundle }),
+            });
+            if (hubClient.userId) {
+              const existing = this.store.getHubSkillBySource(hubClient.userId, skillId);
+              this.store.upsertHubSkill({
+                id: (response as any)?.skillId ?? existing?.id ?? crypto.randomUUID(),
+                sourceSkillId: skillId, sourceUserId: hubClient.userId,
+                name: skill.name, description: skill.description, version: skill.version,
+                groupId: null, visibility: "public",
+                bundle: JSON.stringify(bundle.bundle), qualityScore: skill.qualityScore,
+                createdAt: existing?.createdAt ?? Date.now(), updatedAt: Date.now(),
+              });
+            }
+            hubSynced = true;
+          }
+        }
+
+        if (scope === "local" && isTeamShared) {
+          try {
+            const hubClient = await this.resolveHubClientAware();
+            await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/unpublish", {
+              method: "POST", body: JSON.stringify({ sourceSkillId: skillId }),
+            });
+            if (hubClient.userId) this.store.deleteHubSkillBySource(hubClient.userId, skillId);
+            hubSynced = true;
+          } catch (err) { this.log.warn(`Failed to unpublish skill from team: ${err}`); }
+        }
+
+        if (scope === "private") {
+          if (isTeamShared) {
+            try {
+              const hubClient = await this.resolveHubClientAware();
+              await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/unpublish", {
+                method: "POST", body: JSON.stringify({ sourceSkillId: skillId }),
+              });
+              if (hubClient.userId) this.store.deleteHubSkillBySource(hubClient.userId, skillId);
+              hubSynced = true;
+            } catch (err) { this.log.warn(`Failed to unpublish skill from team: ${err}`); }
+          }
+          if (isLocalShared) this.store.setSkillVisibility(skillId, "private");
+        }
+
+        this.jsonResponse(res, { ok: true, scope, changed: true, hubSynced });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) }, 500);
+      }
+    });
+  }
+
+  private getHubMemoryForChunk(chunkId: string): any {
+    const db = (this.store as any).db;
+    return db.prepare("SELECT * FROM hub_memories WHERE source_chunk_id = ? LIMIT 1").get(chunkId);
+  }
+
+  private getHubTaskForLocal(taskId: string): any {
+    const db = (this.store as any).db;
+    return db.prepare("SELECT * FROM hub_tasks WHERE source_task_id = ? LIMIT 1").get(taskId);
+  }
+
+  private getHubSkillForLocal(skillId: string): any {
+    const db = (this.store as any).db;
+    return db.prepare("SELECT * FROM hub_skills WHERE source_skill_id = ? LIMIT 1").get(skillId);
+  }
+
   private handleDeleteSession(res: http.ServerResponse, url: URL): void {
     const key = url.searchParams.get("key");
     if (!key) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Missing key" })); return; }
@@ -996,69 +1503,1077 @@ export class ViewerServer {
     return path.join(ocHome, "openclaw.json");
   }
 
-  private serveConfig(res: http.ServerResponse): void {
+  private getPluginEntryConfig(raw: any): Record<string, unknown> {
+    const entries = raw?.plugins?.entries ?? {};
+    return entries["memos-local-openclaw-plugin"]?.config
+      ?? entries["memos-lite-openclaw-plugin"]?.config
+      ?? entries["memos-lite"]?.config
+      ?? {};
+  }
+
+  private getResolvedViewerConfig(raw?: any): MemosLocalConfig {
+    const pluginCfg = this.getPluginEntryConfig(raw);
+    const stateDir = this.ctx?.stateDir ?? this.getOpenClawHome();
+    return resolveConfig(pluginCfg as Partial<MemosLocalConfig>, stateDir);
+  }
+
+  private hasUsableEmbeddingProvider(cfg: MemosLocalConfig): boolean {
+    const embedding = cfg.embedding;
+    if (!embedding?.provider) return false;
+    if (embedding.provider === "openclaw") {
+      return !!(this.ctx?.openclawAPI) && embedding.capabilities?.hostEmbedding === true;
+    }
+    return true;
+  }
+
+  private hasUsableSummarizerProvider(cfg: MemosLocalConfig): boolean {
+    const summarizer = cfg.summarizer;
+    if (!summarizer?.provider) return false;
+    if (summarizer.provider === "openclaw") {
+      return !!(this.ctx?.openclawAPI) && summarizer.capabilities?.hostCompletion === true;
+    }
+    return true;
+  }
+
+  private async serveSharingStatus(res: http.ServerResponse): Promise<void> {
+    const sharing = this.ctx?.config?.sharing;
+    const persisted = this.store.getClientHubConnection();
+    const resolvedHubUrl = sharing?.client?.hubAddress ? normalizeHubUrl(sharing.client.hubAddress) : persisted?.hubUrl ?? null;
+    const hasClientConfig = Boolean(
+      (sharing?.client?.hubAddress && sharing?.client?.userToken) ||
+      (persisted?.hubUrl && persisted?.userToken),
+    );
+    const base = {
+      enabled: Boolean(sharing?.enabled),
+      role: sharing?.role ?? null,
+      clientConfigured: hasClientConfig,
+      hubUrl: resolvedHubUrl,
+      connection: { connected: false, user: null as any, hubUrl: undefined as string | undefined, teamName: null as string | null, apiVersion: null as string | null },
+      admin: { canManageUsers: false, rejectSupported: false },
+    };
+
+    if (!this.ctx || !sharing?.enabled) {
+      this.jsonResponse(res, base);
+      return;
+    }
+
+    // Hub 模式下，本机就是管理者，直接赋予 admin 权限
+    if (sharing.role === "hub") {
+      base.admin.canManageUsers = true;
+      base.admin.rejectSupported = true;
+      base.connection.connected = true;
+      base.connection.hubUrl = resolvedHubUrl ?? undefined;
+
+      let adminUser: any = { username: "hub-admin", role: "admin" };
+      try {
+        const hub = this.resolveHubConnection();
+        if (hub) {
+          const me = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/me", { method: "GET" }) as any;
+          if (me) {
+            adminUser = {
+              id: me.id,
+              username: me.username ?? "hub-admin",
+              role: me.role ?? "admin",
+            };
+          }
+        }
+      } catch { /* fallback to default */ }
+      base.connection.user = adminUser;
+
+      // Fetch team info from own hub
+      try {
+        const selfUrl = resolvedHubUrl || `http://localhost:${sharing.hub?.port ?? 21816}`;
+        const info = await fetch(`${selfUrl}/api/v1/hub/info`).then(r => r.ok ? r.json() : null).catch(() => null) as any;
+        base.connection.teamName = info?.teamName ?? sharing.hub?.teamName ?? null;
+        base.connection.apiVersion = info?.apiVersion ?? null;
+      } catch { /* ignore */ }
+      this.jsonResponse(res, base);
+      return;
+    }
+
+    const hasPendingConnection = Boolean(persisted?.hubUrl && persisted?.userId && !persisted?.userToken);
+    if (!hasClientConfig && !hasPendingConnection) {
+      this.jsonResponse(res, base);
+      return;
+    }
+
     try {
-      const cfgPath = this.getOpenClawConfigPath();
-      if (!fs.existsSync(cfgPath)) {
-        this.jsonResponse(res, {});
-        return;
+      const status = await getHubStatus(this.store, this.ctx.config);
+      const output = { ...base, connection: { ...base.connection, ...status } } as any;
+      if (status.user?.status === "pending") {
+        output.connection.pendingApproval = true;
       }
-      const raw = JSON.parse(fs.readFileSync(cfgPath, "utf-8"));
-      const entries = raw?.plugins?.entries ?? {};
-      const pluginEntry = entries["memos-local-openclaw-plugin"]?.config
-        ?? entries["memos-local"]?.config
-        ?? entries["memos-lite-openclaw-plugin"]?.config
-        ?? entries["memos-lite"]?.config
-        ?? {};
-      const result: Record<string, unknown> = { ...pluginEntry };
-      const topEntry = entries["memos-local-openclaw-plugin"]
-        ?? entries["memos-local"]
-        ?? entries["memos-lite-openclaw-plugin"]
-        ?? entries["memos-lite"]
-        ?? {};
-      if (pluginEntry.viewerPort == null && topEntry.viewerPort) {
-        result.viewerPort = topEntry.viewerPort;
+      if (status.user?.status === "rejected") {
+        output.connection.rejected = true;
       }
-      this.jsonResponse(res, result);
-    } catch (e) {
-      this.log.warn(`serveConfig error: ${e}`);
-      this.jsonResponse(res, {});
+      if (status.connected && status.hubUrl) {
+        try {
+          const info = await fetch(`${status.hubUrl}/api/v1/hub/info`).then((r) => (r.ok ? r.json() : null)).catch(() => null) as any;
+          output.connection.teamName = info?.teamName ?? null;
+          output.connection.apiVersion = info?.apiVersion ?? null;
+        } catch {}
+      } else if (status.hubUrl) {
+        try {
+          const info = await fetch(`${status.hubUrl}/api/v1/hub/info`).then((r) => (r.ok ? r.json() : null)).catch(() => null) as any;
+          output.connection.teamName = info?.teamName ?? null;
+        } catch {}
+      }
+      output.admin.canManageUsers = status.connected && status.user?.role === "admin";
+      output.admin.rejectSupported = output.admin.canManageUsers;
+      this.jsonResponse(res, output);
+    } catch (err) {
+      this.jsonResponse(res, { ...base, error: String(err) });
     }
   }
 
-  private handleSaveConfig(req: http.IncomingMessage, res: http.ServerResponse): void {
-    this.readBody(req, (body) => {
+  private async serveSharingPendingUsers(res: http.ServerResponse): Promise<void> {
+    if (!this.ctx) return this.jsonResponse(res, { users: [], error: "sharing_unavailable" });
+    try {
+      const hub = this.resolveHubConnection();
+      if (!hub) return this.jsonResponse(res, { users: [], error: "not_configured" });
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/pending-users", { method: "GET" }) as any;
+      this.jsonResponse(res, { users: Array.isArray(data?.users) ? data.users : [] });
+    } catch (err) {
+      this.jsonResponse(res, { users: [], error: String(err) });
+    }
+  }
+
+  private handleSharingApproveUser(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
       try {
-        const newCfg = JSON.parse(body);
-        const cfgPath = this.getOpenClawConfigPath();
-        let raw: Record<string, unknown> = {};
-        if (fs.existsSync(cfgPath)) {
-          raw = JSON.parse(fs.readFileSync(cfgPath, "utf-8"));
-        }
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/approve-user", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId, username: parsed.username }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
 
-        if (!raw.plugins) raw.plugins = {};
-        const plugins = raw.plugins as Record<string, unknown>;
-        if (!plugins.entries) plugins.entries = {};
-        const entries = plugins.entries as Record<string, unknown>;
-        const entryKey = entries["memos-local-openclaw-plugin"] ? "memos-local-openclaw-plugin"
-          : entries["memos-local"] ? "memos-local"
-          : entries["memos-lite-openclaw-plugin"] ? "memos-lite-openclaw-plugin"
-          : entries["memos-lite"] ? "memos-lite"
-          : "memos-local-openclaw-plugin";
-        if (!entries[entryKey]) entries[entryKey] = { enabled: true };
-        const entry = entries[entryKey] as Record<string, unknown>;
-        if (!entry.config) entry.config = {};
-        const config = entry.config as Record<string, unknown>;
+  private handleSharingRejectUser(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/reject-user", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
 
-        if (newCfg.embedding) config.embedding = newCfg.embedding;
-        if (newCfg.summarizer) config.summarizer = newCfg.summarizer;
+  private handleSharingChangeRole(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/change-role", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId, role: parsed.role }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingRemoveUser(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/remove-user", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId, cleanResources: parsed.cleanResources === true }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleAdminRenameUser(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const hub = this.resolveHubConnection();
+        if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+        const result = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/rename-user", {
+          method: "POST",
+          body: JSON.stringify({ userId: parsed.userId, username: parsed.username }),
+        });
+        this.jsonResponse(res, { ok: true, result });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleRetryJoin(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (_body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      const sharing = this.ctx.config.sharing;
+      if (!sharing?.enabled || sharing.role !== "client") {
+        return this.jsonResponse(res, { ok: false, error: "not_in_client_mode" });
+      }
+      const hubAddress = sharing.client?.hubAddress ?? "";
+      const teamToken = sharing.client?.teamToken ?? "";
+      if (!hubAddress || !teamToken) {
+        return this.jsonResponse(res, { ok: false, error: "missing_hub_address_or_team_token" });
+      }
+      try {
+        const hubUrl = normalizeHubUrl(hubAddress);
+        const os = await import("os");
+        const nickname = sharing.client?.nickname;
+        const username = nickname || os.userInfo().username || "user";
+        const hostname = os.hostname() || "unknown";
+        const result = await hubRequestJson(hubUrl, "", "/api/v1/hub/join", {
+          method: "POST",
+          body: JSON.stringify({ teamToken, username, deviceName: hostname }),
+        }) as any;
+        this.store.setClientHubConnection({
+          hubUrl,
+          userId: String(result.userId || ""),
+          username,
+          userToken: result.userToken || "",
+          role: "member",
+          connectedAt: Date.now(),
+        });
+        this.jsonResponse(res, { ok: true, status: result.status || "pending" });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private async serveSharingMemoryList(res: http.ServerResponse, url: URL): Promise<void> {
+    if (!this.ctx) return this.jsonResponse(res, { memories: [], error: "sharing_unavailable" });
+    try {
+      const limit = Number(url.searchParams.get("limit") || 40);
+      const hub = this.resolveHubConnection();
+      let data: any;
+      if (hub) {
+        data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/memories?limit=${limit}`);
+      } else {
+        data = await hubListMemories(this.store, this.ctx, { limit });
+      }
+      this.jsonResponse(res, { memories: Array.isArray(data?.memories) ? data.memories : [] });
+    } catch (err) {
+      this.jsonResponse(res, { memories: [], error: String(err) });
+    }
+  }
+
+  private async serveSharingTaskList(res: http.ServerResponse, url: URL): Promise<void> {
+    if (!this.ctx) return this.jsonResponse(res, { tasks: [], error: "sharing_unavailable" });
+    try {
+      const limit = Number(url.searchParams.get("limit") || 40);
+      const hub = this.resolveHubConnection();
+      let data: any;
+      if (hub) {
+        data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/tasks?limit=${limit}`);
+      } else {
+        data = await hubListTasks(this.store, this.ctx, { limit });
+      }
+      this.jsonResponse(res, { tasks: Array.isArray(data?.tasks) ? data.tasks : [] });
+    } catch (err) {
+      this.jsonResponse(res, { tasks: [], error: String(err) });
+    }
+  }
+
+  private async serveSharingSkillList(res: http.ServerResponse, url: URL): Promise<void> {
+    if (!this.ctx) return this.jsonResponse(res, { skills: [], error: "sharing_unavailable" });
+    try {
+      const limit = Number(url.searchParams.get("limit") || 40);
+      const hub = this.resolveHubConnection();
+      let data: any;
+      if (hub) {
+        data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/skills/list?limit=${limit}`);
+      } else {
+        data = await hubListSkills(this.store, this.ctx, { limit });
+      }
+      this.jsonResponse(res, { skills: Array.isArray(data?.skills) ? data.skills : [] });
+    } catch (err) {
+      this.jsonResponse(res, { skills: [], error: String(err) });
+    }
+  }
+
+  private handleSharingMemorySearch(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { local: { hits: [], meta: {} }, hub: { hits: [], meta: { totalCandidates: 0, searchedGroups: [], includedPublic: false } }, error: "sharing_unavailable" });
+      const emptyHub = { hits: [], meta: { totalCandidates: 0, searchedGroups: [], includedPublic: false } };
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const query = String(parsed.query || "");
+        const role = typeof parsed.role === "string" ? parsed.role : undefined;
+        const maxResults = typeof parsed.maxResults === "number" ? parsed.maxResults : 10;
+        const scope = parsed.scope === "group" || parsed.scope === "all" || parsed.scope === "hub" ? (parsed.scope === "hub" ? "all" : parsed.scope) : "local";
+        const local = this.searchLocalViewerMemories(query, { role, maxResults });
+        if (scope === "local") {
+          return this.jsonResponse(res, { local: { hits: local.hits, meta: local.meta }, hub: emptyHub });
+        }
+        try {
+          const conn = this.resolveHubConnection();
+          let hub: any;
+          if (conn) {
+            hub = await hubRequestJson(conn.hubUrl, conn.userToken, "/api/v1/hub/search", {
+              method: "POST", body: JSON.stringify({ query, maxResults, scope }),
+            });
+          } else {
+            hub = await hubSearchMemories(this.store, this.ctx!, { query, maxResults, scope });
+          }
+          this.jsonResponse(res, { local: { hits: local.hits, meta: local.meta }, hub });
+        } catch (err) {
+          this.jsonResponse(res, { local: { hits: local.hits, meta: local.meta }, hub: emptyHub, error: String(err) });
+        }
+      } catch (err) {
+        this.jsonResponse(res, { local: { hits: [], meta: {} }, hub: emptyHub, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingMemoryDetail(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const detail = await hubGetMemoryDetail(this.store, this.ctx, { remoteHitId: String(parsed.remoteHitId || "") });
+        this.jsonResponse(res, detail);
+      } catch (err) {
+        this.jsonResponse(res, { error: String(err) });
+      }
+    });
+  }
+
+  private async serveSharingSkillSearch(res: http.ServerResponse, url: URL): Promise<void> {
+    if (!this.ctx) return this.jsonResponse(res, { local: { hits: [] }, hub: { hits: [] }, error: "sharing_unavailable" });
+    try {
+      const query = String(url.searchParams.get("query") || "");
+      const scope = url.searchParams.get("scope") === "group" || url.searchParams.get("scope") === "all" ? url.searchParams.get("scope")! : "local";
+      const recall = new RecallEngine(this.store, this.embedder, this.ctx);
+      const localHits = await recall.searchSkills(query, "mix" as any, "agent:main");
+      if (scope === "local") {
+        return this.jsonResponse(res, { local: { hits: localHits }, hub: { hits: [] } });
+      }
+      try {
+        const hub = await hubSearchSkills(this.store, this.ctx, { query, maxResults: Number(url.searchParams.get("maxResults") || 20) });
+        this.jsonResponse(res, { local: { hits: localHits }, hub });
+      } catch (err) {
+        this.jsonResponse(res, { local: { hits: localHits }, hub: { hits: [] }, error: String(err) });
+      }
+    } catch (err) {
+      this.jsonResponse(res, { local: { hits: [] }, hub: { hits: [] }, error: String(err) });
+    }
+  }
+
+  private searchLocalViewerMemories(query: string, options?: { role?: string; maxResults?: number }): { hits: any[]; meta: Record<string, unknown> } {
+    const db = (this.store as any).db;
+    const role = options?.role;
+    const maxResults = options?.maxResults ?? 10;
+    const params: any[] = [];
+    let rows: any[] = [];
+    try {
+      let sql = "SELECT c.* FROM chunks_fts f JOIN chunks c ON f.rowid = c.rowid WHERE chunks_fts MATCH ?";
+      params.push(query);
+      if (role) {
+        sql += " AND c.role = ?";
+        params.push(role);
+      }
+      sql += " ORDER BY rank LIMIT ?";
+      params.push(maxResults);
+      rows = db.prepare(sql).all(...params);
+    } catch {
+      const likeParams: any[] = [`%${query}%`, `%${query}%`];
+      let sql = "SELECT * FROM chunks WHERE (content LIKE ? OR summary LIKE ?)";
+      if (role) {
+        sql += " AND role = ?";
+        likeParams.push(role);
+      }
+      sql += " ORDER BY created_at DESC LIMIT ?";
+      likeParams.push(maxResults);
+      rows = db.prepare(sql).all(...likeParams);
+    }
+    const hits = rows.map((row: any, idx: number) => ({
+      id: row.id,
+      summary: row.summary || row.content?.slice(0, 120) || "",
+      excerpt: row.content || "",
+      score: Math.max(0.3, 1 - idx * 0.1),
+      role: row.role,
+      ref: { sessionKey: row.session_key, chunkId: row.id, turnId: row.turn_id, seq: row.seq },
+      taskId: row.task_id ?? null,
+      skillId: row.skill_id ?? null,
+    }));
+    return { hits, meta: { total: hits.length, usedMaxResults: maxResults } };
+  }
+
+  private handleSharingTaskShare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const taskId = String(parsed.taskId || "");
+        const visibility = "public";
+        const groupId: string | undefined = undefined;
+        const task = this.store.getTask(taskId);
+        if (!task) return this.jsonResponse(res, { ok: false, error: "task_not_found" });
+        const chunks = this.store.getChunksByTask(taskId);
+        if (chunks.length === 0) return this.jsonResponse(res, { ok: false, error: "no_chunks" });
+        const hubClient = await this.resolveHubClientAware();
+        const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/share", {
+          method: "POST",
+          body: JSON.stringify({
+            task: {
+              id: task.id,
+              sourceTaskId: task.id,
+              title: task.title,
+              summary: task.summary,
+              groupId: null,
+              visibility,
+              createdAt: task.startedAt ?? Date.now(),
+              updatedAt: task.updatedAt ?? Date.now(),
+            },
+            chunks: chunks.map((chunk) => ({
+              id: chunk.id,
+              hubTaskId: task.id,
+              sourceTaskId: task.id,
+              sourceChunkId: chunk.id,
+              role: chunk.role,
+              content: chunk.content,
+              summary: chunk.summary,
+              kind: chunk.kind,
+              createdAt: chunk.createdAt,
+            })),
+          }),
+        });
+        const hubUserId = hubClient.userId;
+        if (hubUserId) {
+          this.store.upsertHubTask({
+            id: task.id,
+            sourceTaskId: task.id,
+            sourceUserId: hubUserId,
+            title: task.title,
+            summary: task.summary,
+            groupId: null,
+            visibility,
+            createdAt: task.startedAt ?? Date.now(),
+            updatedAt: task.updatedAt ?? Date.now(),
+          });
+        }
+        this.jsonResponse(res, { ok: true, taskId, visibility, response });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingTaskUnshare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const taskId = String(parsed.taskId || "");
+        const task = this.store.getTask(taskId);
+        if (!task) return this.jsonResponse(res, { ok: false, error: "task_not_found" });
+        const hubClient = await this.resolveHubClientAware();
+        await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/tasks/unshare", {
+          method: "POST",
+          body: JSON.stringify({ sourceTaskId: task.id }),
+        });
+        const hubUserId = hubClient.userId;
+        if (hubUserId) this.store.deleteHubTaskBySource(hubUserId, task.id);
+        this.jsonResponse(res, { ok: true, taskId });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingMemoryShare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const chunkId = String(parsed.chunkId || "");
+        const visibility = "public";
+        const groupId: string | undefined = undefined;
+        const db = (this.store as any).db;
+        const chunk = db.prepare("SELECT * FROM chunks WHERE id = ?").get(chunkId) as any;
+        if (!chunk) return this.jsonResponse(res, { ok: false, error: "memory_not_found" });
+        const hubClient = await this.resolveHubClientAware();
+        const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/share", {
+          method: "POST",
+          body: JSON.stringify({
+            memory: {
+              sourceChunkId: chunk.id,
+              role: chunk.role,
+              content: chunk.content,
+              summary: chunk.summary,
+              kind: chunk.kind,
+              groupId: null,
+              visibility,
+            },
+          }),
+        });
+        const hubUserId = hubClient.userId;
+        if (hubUserId) {
+          const now = Date.now();
+          const existing = this.store.getHubMemoryBySource(hubUserId, chunk.id);
+          this.store.upsertHubMemory({
+            id: (response as any)?.memoryId ?? existing?.id ?? crypto.randomUUID(),
+            sourceChunkId: chunk.id,
+            sourceUserId: hubUserId,
+            role: chunk.role,
+            content: chunk.content,
+            summary: chunk.summary ?? "",
+            kind: chunk.kind,
+            groupId: null,
+            visibility,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+          });
+        }
+        this.jsonResponse(res, { ok: true, chunkId, visibility, response });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingMemoryUnshare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const chunkId = String(parsed.chunkId || "");
+        const hubClient = await this.resolveHubClientAware();
+        await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/memories/unshare", {
+          method: "POST",
+          body: JSON.stringify({ sourceChunkId: chunkId }),
+        });
+        const hubUserId = hubClient.userId;
+        if (hubUserId) this.store.deleteHubMemoryBySource(hubUserId, chunkId);
+        this.jsonResponse(res, { ok: true, chunkId });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingSkillPull(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const skillId = String(parsed.skillId || "");
+        const payload = await fetchHubSkillBundle(this.store, this.ctx, { skillId });
+        const restored = restoreSkillBundleFromHub(this.store, this.ctx, payload);
+        this.jsonResponse(res, { ok: true, pulled: true, hubSkillId: skillId, ...restored });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingSkillShare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const skillId = String(parsed.skillId || "");
+        const visibility = "public";
+        const groupId: string | null = null;
+        const skill = this.store.getSkill(skillId);
+        if (!skill) return this.jsonResponse(res, { ok: false, error: "skill_not_found" });
+        const bundle = buildSkillBundleForHub(this.store, skillId);
+        const hubClient = await this.resolveHubClientAware();
+        const response = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/publish", {
+          method: "POST",
+          body: JSON.stringify({
+            visibility,
+            groupId: null,
+            metadata: bundle.metadata,
+            bundle: bundle.bundle,
+          }),
+        });
+        const hubUserId = hubClient.userId;
+        if (hubUserId) {
+          const existing = this.store.getHubSkillBySource(hubUserId, skillId);
+          this.store.upsertHubSkill({
+            id: (response as any)?.skillId ?? existing?.id ?? crypto.randomUUID(),
+            sourceSkillId: skillId,
+            sourceUserId: hubUserId,
+            name: skill.name,
+            description: skill.description,
+            version: skill.version,
+            groupId: null,
+            visibility,
+            bundle: JSON.stringify(bundle.bundle),
+            qualityScore: skill.qualityScore,
+            createdAt: existing?.createdAt ?? Date.now(),
+            updatedAt: Date.now(),
+          });
+        }
+        this.jsonResponse(res, { ok: true, skillId, visibility, response });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingSkillUnshare(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { ok: false, error: "sharing_unavailable" });
+      try {
+        const parsed = JSON.parse(body || "{}");
+        const skillId = String(parsed.skillId || "");
+        const skill = this.store.getSkill(skillId);
+        if (!skill) return this.jsonResponse(res, { ok: false, error: "skill_not_found" });
+        const hubClient = await this.resolveHubClientAware();
+        await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/skills/unpublish", {
+          method: "POST",
+          body: JSON.stringify({ sourceSkillId: skill.id }),
+        });
+        const hubUserId = hubClient.userId;
+        if (hubUserId) this.store.deleteHubSkillBySource(hubUserId, skill.id);
+        this.jsonResponse(res, { ok: true, skillId });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private resolveHubConnection(): { hubUrl: string; userToken: string } | null {
+    if (!this.ctx) return null;
+
+    // Hub 模式：连接自己，用 bootstrap admin token
+    const sharing = this.ctx.config.sharing;
+    if (sharing?.role === "hub") {
+      const hubPort = sharing.hub?.port ?? 18800;
+      const hubUrl = `http://127.0.0.1:${hubPort}`;
+      try {
+        const authPath = path.join(this.dataDir, "hub-auth.json");
+        const authData = JSON.parse(fs.readFileSync(authPath, "utf8"));
+        const adminToken = authData?.bootstrapAdminToken;
+        if (adminToken) return { hubUrl, userToken: adminToken };
+      } catch {
+        // hub-auth.json 不存在或读取失败，fall through
+      }
+    }
+
+    // Client 模式：用配置的 hubAddress + userToken
+    const conn = this.store.getClientHubConnection();
+    const hubUrl = conn?.hubUrl || this.ctx.config.sharing?.client?.hubAddress || "";
+    const userToken = conn?.userToken || this.ctx.config.sharing?.client?.userToken || "";
+    if (!hubUrl || !userToken) return null;
+    return { hubUrl: normalizeHubUrl(hubUrl), userToken };
+  }
+
+  /** resolveHubClient 的 viewer 版本：hub 模式下使用 bootstrap admin 身份 */
+  private async resolveHubClientAware(): Promise<ResolvedHubClient> {
+    if (!this.ctx) throw new Error("sharing_unavailable");
+    const sharing = this.ctx.config.sharing;
+    if (sharing?.role === "hub") {
+      const hub = this.resolveHubConnection();
+      if (hub) {
+        const me = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/me", { method: "GET" }) as any;
+        return {
+          hubUrl: hub.hubUrl,
+          userToken: hub.userToken,
+          userId: String(me.id),
+          username: String(me.username ?? "hub-admin"),
+          role: String(me.role ?? "admin"),
+        };
+      }
+    }
+    return resolveHubClient(this.store, this.ctx);
+  }
+
+  private async serveSharingUsers(res: http.ServerResponse): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { users: [], error: "not_configured" });
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/users", { method: "GET" }) as any;
+      this.jsonResponse(res, { users: Array.isArray(data?.users) ? data.users : [] });
+    } catch (err) {
+      this.jsonResponse(res, { users: [], error: String(err) });
+    }
+  }
+
+  // ─── Admin management endpoints (Hub-side data) ───
+
+  private async serveAdminSharedTasks(res: http.ServerResponse): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { tasks: [], error: "not_configured" });
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/shared-tasks", { method: "GET" }) as any;
+      const tasks = Array.isArray(data?.tasks) ? data.tasks : [];
+      for (const tk of tasks) {
+        if (!tk.summary && tk.sourceTaskId) {
+          const local = this.store.getTask(tk.sourceTaskId);
+          if (local) { tk.summary = local.summary; tk.title = tk.title || local.title; }
+        }
+      }
+      this.jsonResponse(res, { tasks });
+    } catch (err) {
+      this.jsonResponse(res, { tasks: [], error: String(err) });
+    }
+  }
+
+  private async handleAdminDeleteTask(res: http.ServerResponse, p: string): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+    const taskId = decodeURIComponent(p.replace("/api/admin/shared-tasks/", ""));
+    try {
+      await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/admin/shared-tasks/${encodeURIComponent(taskId)}`, { method: "DELETE" });
+      this.jsonResponse(res, { ok: true });
+    } catch (err) {
+      this.jsonResponse(res, { ok: false, error: String(err) });
+    }
+  }
+
+  private async serveHubTaskDetail(res: http.ServerResponse, p: string): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { error: "not_configured" }, 500);
+    const m = p.match(/^\/api\/admin\/shared-tasks\/([^/]+)\/detail$/);
+    if (!m) return this.jsonResponse(res, { error: "bad_request" }, 400);
+    const taskId = decodeURIComponent(m[1]);
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/shared-tasks/${encodeURIComponent(taskId)}/detail`, { method: "GET" }) as any;
+      this.jsonResponse(res, data);
+    } catch (err) {
+      this.jsonResponse(res, { error: String(err) }, 500);
+    }
+  }
+
+  private async serveHubSkillDetail(res: http.ServerResponse, p: string): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { error: "not_configured" }, 500);
+    const m = p.match(/^\/api\/admin\/shared-skills\/([^/]+)\/detail$/);
+    if (!m) return this.jsonResponse(res, { error: "bad_request" }, 400);
+    const skillId = decodeURIComponent(m[1]);
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/shared-skills/${encodeURIComponent(skillId)}/detail`, { method: "GET" }) as any;
+      this.jsonResponse(res, data);
+    } catch (err) {
+      this.jsonResponse(res, { error: String(err) }, 500);
+    }
+  }
+
+  private async serveAdminSharedSkills(res: http.ServerResponse): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { skills: [], error: "not_configured" });
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/shared-skills", { method: "GET" }) as any;
+      const skills = Array.isArray(data?.skills) ? data.skills : [];
+      for (const sk of skills) {
+        if (!sk.description && sk.sourceSkillId) {
+          const local = this.store.getSkill(sk.sourceSkillId);
+          if (local) { sk.description = sk.description || local.description; sk.name = sk.name || local.name; }
+        }
+      }
+      this.jsonResponse(res, { skills });
+    } catch (err) {
+      this.jsonResponse(res, { skills: [], error: String(err) });
+    }
+  }
+
+  private async handleAdminDeleteSkill(res: http.ServerResponse, p: string): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+    const skillId = decodeURIComponent(p.replace("/api/admin/shared-skills/", ""));
+    try {
+      await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/admin/shared-skills/${encodeURIComponent(skillId)}`, { method: "DELETE" });
+      this.jsonResponse(res, { ok: true });
+    } catch (err) {
+      this.jsonResponse(res, { ok: false, error: String(err) });
+    }
+  }
+
+  private async serveAdminSharedMemories(res: http.ServerResponse): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { memories: [], error: "not_configured" });
+    try {
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/admin/shared-memories", { method: "GET" }) as any;
+      const memories = Array.isArray(data?.memories) ? data.memories : [];
+      for (const m of memories) {
+        if (!m.content && m.sourceChunkId) {
+          const local = this.store.getChunk(m.sourceChunkId);
+          if (local) { m.content = local.content; if (!m.summary && local.summary) m.summary = local.summary; }
+        }
+      }
+      this.jsonResponse(res, { memories });
+    } catch (err) {
+      this.jsonResponse(res, { memories: [], error: String(err) });
+    }
+  }
+
+  private async handleAdminDeleteMemory(res: http.ServerResponse, p: string): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+    const memoryId = decodeURIComponent(p.replace("/api/admin/shared-memories/", ""));
+    try {
+      await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/admin/shared-memories/${encodeURIComponent(memoryId)}`, { method: "DELETE" });
+      this.jsonResponse(res, { ok: true });
+    } catch (err) {
+      this.jsonResponse(res, { ok: false, error: String(err) });
+    }
+  }
+
+  private async serveSharingNotifications(res: http.ServerResponse, url: URL): Promise<void> {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { notifications: [], unreadCount: 0 });
+    try {
+      const unread = url.searchParams.get("unread") === "1" ? "?unread=1" : "";
+      const data = await hubRequestJson(hub.hubUrl, hub.userToken, `/api/v1/hub/notifications${unread}`) as any;
+      this.jsonResponse(res, data);
+    } catch {
+      this.jsonResponse(res, { notifications: [], unreadCount: 0 });
+    }
+  }
+
+  private handleSharingNotificationsRead(req: http.IncomingMessage, res: http.ServerResponse): void {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+    this.readBody(req, async (raw) => {
+      try {
+        const body = JSON.parse(raw || "{}");
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications/read", { method: "POST", body: JSON.stringify(body) });
+        this.jsonResponse(res, { ok: true });
+        try {
+          const data = (await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications?unread=1")) as any;
+          const count = data?.unreadCount ?? 0;
+          this.lastKnownNotifCount = count;
+          this.broadcastNotifSSE({ type: "update", unreadCount: count });
+        } catch { /* best effort */ }
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleSharingNotificationsClear(req: http.IncomingMessage, res: http.ServerResponse): void {
+    const hub = this.resolveHubConnection();
+    if (!hub) return this.jsonResponse(res, { ok: false, error: "not_configured" });
+    this.readBody(req, async () => {
+      try {
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications/clear", { method: "POST", body: "{}" });
+        this.jsonResponse(res, { ok: true });
+        this.broadcastNotifSSE({ type: "cleared", unreadCount: 0 });
+      } catch (err) {
+        this.jsonResponse(res, { ok: false, error: String(err) });
+      }
+    });
+  }
+
+  private handleNotifSSE(req: http.IncomingMessage, res: http.ServerResponse): void {
+    res.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "Access-Control-Allow-Origin": "*",
+    });
+    res.write("data: {\"type\":\"connected\"}\n\n");
+    this.notifSSEClients.push(res);
+    if (!this.notifPollTimer) this.startNotifPoll();
+    req.on("close", () => {
+      this.notifSSEClients = this.notifSSEClients.filter((c) => c !== res);
+      if (this.notifSSEClients.length === 0) this.stopNotifPoll();
+    });
+  }
+
+  private broadcastNotifSSE(data: Record<string, unknown>): void {
+    const msg = `data: ${JSON.stringify(data)}\n\n`;
+    this.notifSSEClients = this.notifSSEClients.filter((c) => {
+      try { c.write(msg); return true; } catch { return false; }
+    });
+  }
+
+  private startNotifPoll(): void {
+    this.stopNotifPoll();
+    const tick = async () => {
+      const hub = this.resolveHubConnection();
+      if (!hub) return;
+      try {
+        const data = (await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/notifications?unread=1")) as any;
+        const count = data?.unreadCount ?? 0;
+        if (count !== this.lastKnownNotifCount) {
+          this.lastKnownNotifCount = count;
+          this.broadcastNotifSSE({ type: "update", unreadCount: count });
+        }
+      } catch { /* ignore */ }
+    };
+    tick();
+    this.notifPollTimer = setInterval(tick, 3000);
+  }
+
+  private stopNotifPoll(): void {
+    if (this.notifPollTimer) { clearInterval(this.notifPollTimer); this.notifPollTimer = undefined; }
+  }
+
+  private startHubHeartbeat(): void {
+    this.stopHubHeartbeat();
+    const sendHeartbeat = async () => {
+      try {
+        const hub = this.resolveHubConnection();
+        if (!hub) {
+          const persisted = this.store.getClientHubConnection();
+          if (persisted?.hubUrl && persisted?.userToken) {
+            await hubRequestJson(persisted.hubUrl, persisted.userToken, "/api/v1/hub/heartbeat", { method: "POST" });
+          }
+          return;
+        }
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/heartbeat", { method: "POST" });
+      } catch { /* best-effort */ }
+    };
+    sendHeartbeat();
+    this.hubHeartbeatTimer = setInterval(sendHeartbeat, ViewerServer.HUB_HEARTBEAT_INTERVAL_MS);
+  }
+
+  private stopHubHeartbeat(): void {
+    if (this.hubHeartbeatTimer) { clearInterval(this.hubHeartbeatTimer); this.hubHeartbeatTimer = undefined; }
+  }
+
+  private getLocalIPs(): string[] {
+    const nets = os.networkInterfaces();
+    const ips: string[] = [];
+    for (const name of Object.keys(nets)) {
+      for (const net of nets[name] ?? []) {
+        if (net.family === "IPv4" && !net.internal) {
+          ips.push(net.address);
+        }
+      }
+    }
+    return ips;
+  }
+
+  private serveLocalIPs(res: http.ServerResponse): void {
+    const ips = this.getLocalIPs();
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ips }));
+  }
+
+  private serveConfig(res: http.ServerResponse): void {
+    try {
+      const cfgPath = this.getOpenClawConfigPath();
+      if (!fs.existsSync(cfgPath)) {
+        this.jsonResponse(res, {});
+        return;
+      }
+      const raw = JSON.parse(fs.readFileSync(cfgPath, "utf-8"));
+      const entries = raw?.plugins?.entries ?? {};
+      const pluginEntry = entries["memos-local-openclaw-plugin"]?.config
+        ?? entries["memos-local"]?.config
+        ?? entries["memos-lite-openclaw-plugin"]?.config
+        ?? entries["memos-lite"]?.config
+        ?? {};
+      const result: Record<string, unknown> = { ...pluginEntry };
+      const topEntry = entries["memos-local-openclaw-plugin"]
+        ?? entries["memos-local"]
+        ?? entries["memos-lite-openclaw-plugin"]
+        ?? entries["memos-lite"]
+        ?? {};
+      if ((pluginEntry as any).viewerPort != null) {
+        result.viewerPort = (pluginEntry as any).viewerPort;
+      } else if (topEntry.viewerPort) {
+        result.viewerPort = topEntry.viewerPort;
+      }
+      this.jsonResponse(res, result);
+    } catch (e) {
+      this.log.warn(`serveConfig error: ${e}`);
+      this.jsonResponse(res, {});
+    }
+  }
+
+  private handleSaveConfig(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      try {
+        const newCfg = JSON.parse(body);
+        const cfgPath = this.getOpenClawConfigPath();
+        let raw: Record<string, unknown> = {};
+        if (fs.existsSync(cfgPath)) {
+          raw = JSON.parse(fs.readFileSync(cfgPath, "utf-8"));
+        }
+
+        if (!raw.plugins) raw.plugins = {};
+        const plugins = raw.plugins as Record<string, unknown>;
+        if (!plugins.entries) plugins.entries = {};
+        const entries = plugins.entries as Record<string, unknown>;
+        const entryKey = entries["memos-local-openclaw-plugin"] ? "memos-local-openclaw-plugin"
+          : entries["memos-local"] ? "memos-local"
+          : entries["memos-lite-openclaw-plugin"] ? "memos-lite-openclaw-plugin"
+          : entries["memos-lite"] ? "memos-lite"
+          : "memos-local-openclaw-plugin";
+        if (!entries[entryKey]) entries[entryKey] = { enabled: true };
+        const entry = entries[entryKey] as Record<string, unknown>;
+        if (!entry.config) entry.config = {};
+        const config = entry.config as Record<string, unknown>;
+
+        const oldSharingRole = (config.sharing as Record<string, unknown>)?.role as string | undefined;
+
+        if (newCfg.embedding) config.embedding = newCfg.embedding;
+        if (newCfg.summarizer) config.summarizer = newCfg.summarizer;
         if (newCfg.skillEvolution) config.skillEvolution = newCfg.skillEvolution;
         if (newCfg.viewerPort) config.viewerPort = newCfg.viewerPort;
         if (newCfg.telemetry !== undefined) config.telemetry = newCfg.telemetry;
+        if (newCfg.sharing !== undefined) {
+          const existing = (config.sharing as Record<string, unknown>) || {};
+          const merged = { ...existing, ...newCfg.sharing };
+          if (newCfg.sharing.capabilities && existing.capabilities) {
+            merged.capabilities = { ...(existing.capabilities as Record<string, unknown>), ...newCfg.sharing.capabilities };
+          }
+          if (merged.role === "client" && merged.client) {
+            const clientCfg = merged.client as Record<string, unknown>;
+            const addr = String(clientCfg.hubAddress || "");
+            if (addr) {
+              const localIPs = this.getLocalIPs();
+              localIPs.push("127.0.0.1", "localhost", "0.0.0.0");
+              try {
+                const u = new URL(addr.startsWith("http") ? addr : `http://${addr}`);
+                if (localIPs.includes(u.hostname)) {
+                  res.writeHead(400, { "Content-Type": "application/json" });
+                  res.end(JSON.stringify({ error: "cannot_join_self" }));
+                  return;
+                }
+              } catch {}
+            }
+          }
+
+          // When switching away from client mode, notify Hub that we're leaving
+          const newRole = merged.role as string | undefined;
+          if (oldSharingRole === "client" && newRole !== "client") {
+            this.notifyHubLeave();
+          }
+
+          if (merged.role === "hub") {
+            merged.client = { hubAddress: "", userToken: "", teamToken: "" };
+          } else if (merged.role === "client") {
+            merged.hub = { port: 18800, teamName: "", teamToken: "" };
+          }
+          config.sharing = merged;
+        }
 
         fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
         fs.writeFileSync(cfgPath, JSON.stringify(raw, null, 2), "utf-8");
         this.log.info("Plugin config updated via Viewer");
+        this.stopHubHeartbeat();
         this.jsonResponse(res, { ok: true });
       } catch (e) {
         this.log.warn(`handleSaveConfig error: ${e}`);
@@ -1068,6 +2583,106 @@ export class ViewerServer {
     });
   }
 
+  private async notifyHubLeave(): Promise<void> {
+    try {
+      const hub = this.resolveHubConnection();
+      if (hub) {
+        await hubRequestJson(hub.hubUrl, hub.userToken, "/api/v1/hub/leave", { method: "POST" });
+        this.log.info("Notified Hub of voluntary leave");
+        return;
+      }
+      const persisted = this.store.getClientHubConnection();
+      if (persisted?.hubUrl && persisted?.userToken) {
+        await hubRequestJson(persisted.hubUrl, persisted.userToken, "/api/v1/hub/leave", { method: "POST" });
+        this.log.info("Notified Hub of voluntary leave (persisted connection)");
+      }
+    } catch (e) {
+      this.log.warn(`Failed to notify Hub of leave: ${e}`);
+    }
+  }
+
+  private handleUpdateUsername(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      if (!this.ctx) return this.jsonResponse(res, { error: "sharing_unavailable" });
+      try {
+        const { username } = JSON.parse(body || "{}");
+        if (!username || typeof username !== "string" || username.trim().length < 2 || username.trim().length > 32) {
+          return this.jsonResponse(res, { error: "invalid_username" }, 400);
+        }
+        const trimmed = username.trim();
+        const hubClient = await this.resolveHubClientAware();
+        const result = await hubRequestJson(hubClient.hubUrl, hubClient.userToken, "/api/v1/hub/me/update-profile", {
+          method: "POST",
+          body: JSON.stringify({ username: trimmed }),
+        }) as any;
+        if (result.ok && result.userToken) {
+          const sharing = this.ctx.config.sharing;
+          if (sharing?.role === "hub") {
+            try {
+              const authPath = path.join(this.dataDir, "hub-auth.json");
+              const authData = JSON.parse(fs.readFileSync(authPath, "utf8"));
+              authData.bootstrapAdminToken = result.userToken;
+              fs.writeFileSync(authPath, JSON.stringify(authData, null, 2), "utf-8");
+              this.log.info("hub-auth.json updated with new admin token after username change");
+            } catch (e) {
+              this.log.warn(`Failed to update hub-auth.json: ${e}`);
+            }
+          } else {
+            const persisted = this.store.getClientHubConnection();
+            if (persisted) {
+              this.store.setClientHubConnection({
+                ...persisted,
+                username: result.username,
+                userToken: result.userToken,
+              });
+            }
+          }
+        }
+        this.jsonResponse(res, result);
+      } catch (err: any) {
+        const msg = String(err?.message || err);
+        if (msg.includes("409") || msg.includes("username_taken")) {
+          return this.jsonResponse(res, { error: "username_taken" }, 409);
+        }
+        this.jsonResponse(res, { error: msg }, 500);
+      }
+    });
+  }
+
+  private handleTestHubConnection(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, async (body) => {
+      try {
+        const { hubUrl } = JSON.parse(body);
+        if (!hubUrl) { this.jsonResponse(res, { ok: false, error: "hubUrl is required" }); return; }
+        try {
+          const localIPs = this.getLocalIPs();
+          localIPs.push("127.0.0.1", "localhost", "0.0.0.0");
+          const parsed = new URL(hubUrl.startsWith("http") ? hubUrl : `http://${hubUrl}`);
+          if (localIPs.includes(parsed.hostname)) {
+            this.jsonResponse(res, { ok: false, error: "cannot_join_self" });
+            return;
+          }
+        } catch {}
+        const url = hubUrl.replace(/\/+$/, "") + "/api/v1/hub/info";
+        const ctrl = new AbortController();
+        const timeout = setTimeout(() => ctrl.abort(), 8000);
+        try {
+          const r = await fetch(url, { signal: ctrl.signal });
+          clearTimeout(timeout);
+          if (!r.ok) { this.jsonResponse(res, { ok: false, error: `HTTP ${r.status}` }); return; }
+          const info = await r.json() as Record<string, unknown>;
+          this.jsonResponse(res, { ok: true, teamName: info.teamName || "", apiVersion: info.apiVersion || "" });
+        } catch (e: unknown) {
+          clearTimeout(timeout);
+          const msg = e instanceof Error ? e.message : String(e);
+          this.jsonResponse(res, { ok: false, error: msg.includes("abort") ? "Connection timeout (8s)" : msg });
+        }
+      } catch (e) {
+        this.jsonResponse(res, { ok: false, error: String(e) });
+      }
+    });
+  }
+
   private handleTestModel(req: http.IncomingMessage, res: http.ServerResponse): void {
     this.readBody(req, async (body) => {
       try {
@@ -2366,8 +3981,8 @@ export class ViewerServer {
     req.on("end", () => cb(body));
   }
 
-  private jsonResponse(res: http.ServerResponse, data: unknown): void {
-    res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
+  private jsonResponse(res: http.ServerResponse, data: unknown, statusCode = 200): void {
+    res.writeHead(statusCode, { "Content-Type": "application/json; charset=utf-8" });
     res.end(JSON.stringify(data));
   }
 }