@modesto_ma/dsh-channels 0.4.0 → 0.5.0-beta.1

package/src/cards/approval.ts

@@ -8,8 +8,21 @@ import { columnSet, divider, markdown, note, standaloneCard, textButton } from '
 
 // ---- HITL approval decision cards ----------------------------------------
 
-/** Terminal states an approval decision card can settle into. */
-export type ApprovalCardState = 'allowed' | 'denied' | 'expired' | 'cancelled'
+/**
+ * Terminal states an approval decision card can settle into. `allowed-text`
+ * and `denied-text` are decisions typed as a topic reply; `remembered` is the
+ * "stop asking in this topic" decision; `superseded` is a non-keyword reply
+ * that rejected the request and was queued as the next instruction.
+ */
+export type ApprovalCardState =
+  | 'allowed'
+  | 'allowed-text'
+  | 'remembered'
+  | 'denied'
+  | 'denied-text'
+  | 'superseded'
+  | 'expired'
+  | 'cancelled'
 
 /** The question one approval decision card presents. */
 export interface ApprovalQuestion {
@@ -19,6 +32,10 @@ export interface ApprovalQuestion {
   toolName: string
   /** The asker's human-readable justification; clipped to a safe length. */
   reason?: string
+  /** What the call will run: the bash command or the raw arguments JSON. */
+  command?: string
+  /** The sandbox mode the call asks to be raised to, when it asks. */
+  escalateTo?: string
   /** Timeout window shown on the card (milliseconds). */
   timeoutMs: number
   /** Session id trace line (omitted when absent). */
@@ -31,56 +48,105 @@ export interface ApprovalCardOptions {
   unauthorizedNote?: boolean
 }
 
+/** Cap on the rendered command so the card stays readable on a phone. */
+const APPROVAL_COMMAND_MAX_CHARS = 600
+
 /** Cap on the rendered reason so the card can never approach the size budget. */
 const APPROVAL_REASON_MAX_CHARS = 1_000
 
+/** The sandbox mode whose standing grant removes all confinement. */
+const UNCONFINED_MODE = 'danger-full-access'
+
 /** `⏱ 5 分钟内有效…` — human timeout label (whole minutes, min 1). */
 function approvalTimeoutLabel(timeoutMs: number): string {
   return `${Math.max(1, Math.round(timeoutMs / 60_000))} 分钟`
 }
 
+/** Clip to `max` chars and report how many were dropped. */
+function clip(value: string, max: number): { shown: string; hidden: number } {
+  return value.length <= max
+    ? { shown: value, hidden: 0 }
+    : { shown: value.slice(0, max), hidden: value.length - max }
+}
+
+/**
+ * What a "stop asking in this topic" grant covers, as the card states it:
+ * `bash 提升到 workspace-write` or the bare tool name.
+ * @param question - the question whose grant scope is described.
+ * @returns The scope phrase.
+ */
+export function approvalGrantScope(question: Pick<ApprovalQuestion, 'toolName' | 'escalateTo'>): string {
+  return question.escalateTo === undefined
+    ? `\`${question.toolName}\``
+    : `\`${question.toolName}\` 提升到 \`${question.escalateTo}\``
+}
+
+type ApprovalDecision = 'allow' | 'always' | 'deny'
+
 /** One approval decision button with its callback payload. */
-function approvalButton(question: ApprovalQuestion, decision: 'allow' | 'deny'): object {
-  const allow = decision === 'allow'
+function approvalButton(question: ApprovalQuestion, decision: ApprovalDecision): object {
+  const label = decision === 'allow' ? '✅ 允许' : decision === 'always' ? '♾️ 本话题不再询问' : '❌ 拒绝'
+  const type = decision === 'allow'
+    ? 'primary'
+    : decision === 'always'
+      ? (question.escalateTo === UNCONFINED_MODE ? 'danger' : 'default')
+      : 'danger'
   return textButton({
-    label: allow ? '✅ 允许' : '❌ 拒绝',
-    type: allow ? 'primary' : 'danger',
+    label,
+    type,
     width: 'fill',
-    margin: '0px',
+    margin: decision === 'always' ? '8px 0 0 0' : '0px',
     value: { decision, token: question.token },
   })
 }
 
-/** Two-column row that keeps both decisions side by side. */
-function approvalActions(question: ApprovalQuestion): object {
-  return columnSet((['allow', 'deny'] as const).map(decision => approvalButton(question, decision)))
+/**
+ * The decision controls: allow and deny side by side, then the full-width
+ * "stop asking in this topic" button with the grant's scope under it.
+ */
+function approvalActions(question: ApprovalQuestion): object[] {
+  const scope = question.escalateTo === UNCONFINED_MODE
+    ? `之后本话题内 ${approvalGrantScope(question)} 都自动允许，等于完全不受沙箱限制`
+    : `之后本话题内 ${approvalGrantScope(question)} 都自动允许`
+  return [
+    columnSet((['allow', 'deny'] as const).map(decision => approvalButton(question, decision))),
+    approvalButton(question, 'always'),
+    note(`♾️ ${scope}；/renew 或重启后恢复询问`),
+  ]
 }
 
 /** The question summary shared by the pending and settled variants. */
 function approvalQuestionElements(question: ApprovalQuestion): object[] {
   const elements: object[] = [
-    markdown(`工具 \`${question.toolName}\` 请求执行一个需要授权的操作。`),
+    markdown(question.escalateTo === undefined
+      ? `工具 \`${question.toolName}\` 请求执行一个需要授权的操作。`
+      : `工具 \`${question.toolName}\` 请求把本次调用提升到 \`${question.escalateTo}\` 权限。`),
   ]
+  if (question.command !== undefined && question.command !== '') {
+    const command = clip(question.command, APPROVAL_COMMAND_MAX_CHARS)
+    elements.push(markdown(`**将执行**\n\`\`\`\n${command.shown.replace(/```/gu, '`​``')}\n\`\`\``))
+    if (command.hidden > 0) elements.push(note(`已截断 ${command.hidden} 个字符`))
+  }
   if (question.reason !== undefined && question.reason !== '') {
-    const clipped = question.reason.length > APPROVAL_REASON_MAX_CHARS
-      ? `${question.reason.slice(0, APPROVAL_REASON_MAX_CHARS)}…`
-      : question.reason
-    elements.push(markdown(`> ${clipped.replace(/\s+/gu, ' ')}`))
+    const reason = clip(question.reason, APPROVAL_REASON_MAX_CHARS)
+    elements.push(markdown(`> ${reason.shown.replace(/\s+/gu, ' ')}${reason.hidden > 0 ? '…' : ''}`))
   }
   return elements
 }
 
 /**
- * The pending approval decision card: question summary, timeout note, and the
- * enabled allow/deny buttons. Sent as a NEW standalone message anchored to
- * the session's latest streaming card (never embedded into the streamed
- * card, whose full-replacement patches would clobber the buttons).
+ * The pending approval decision card: question summary (with the command
+ * when known), how to answer, and the enabled decision buttons. Sent as a NEW
+ * standalone message anchored to the session's latest streaming card (never
+ * embedded into the streamed card, whose full-replacement patches would
+ * clobber the buttons).
  */
 export function buildApprovalCard(question: ApprovalQuestion, options: ApprovalCardOptions = {}): object {
   const elements: object[] = [
     ...approvalQuestionElements(question),
     divider(),
-    note(`⏱ ${approvalTimeoutLabel(question.timeoutMs)}内有效，超时自动拒绝 · 允许仅对本次动作生效`),
+    note(`⏱ ${approvalTimeoutLabel(question.timeoutMs)}内有效，超时自动拒绝 · 「允许」仅对本次生效`),
+    note('💬 也可直接回复「允许」「拒绝」「全部允许」；回复其他内容视为拒绝，并作为下一条指令'),
   ]
   if (options.unauthorizedNote === true) {
     elements.push(note('ℹ️ 仅发起该会话的用户可操作此卡片'))
@@ -88,14 +154,18 @@ export function buildApprovalCard(question: ApprovalQuestion, options: ApprovalC
   if (question.sessionId !== undefined) {
     elements.push(note(`🔑 ${question.sessionId}`))
   }
-  elements.push(approvalActions(question))
+  elements.push(...approvalActions(question))
   return standaloneCard('**⚠️ 需要你的审批**', elements)
 }
 
 /** Settled-card status lines, one per terminal state. */
 const APPROVAL_SETTLED_LINES: Record<ApprovalCardState, string> = {
   allowed: '✅ 已允许执行',
+  'allowed-text': '✅ 已允许执行（文字回复）',
+  remembered: '♾️ 已允许，本话题不再询问',
   denied: '❌ 已拒绝',
+  'denied-text': '❌ 已拒绝（文字回复）',
+  superseded: '❌ 已拒绝，你的新消息将作为下一条指令',
   expired: '⏱ 已超时未处理，自动拒绝',
   cancelled: '↩️ 请求已取消',
 }
@@ -106,9 +176,9 @@ const APPROVAL_SETTLED_LINES: Record<ApprovalCardState, string> = {
  * and removes the decision controls entirely.
  */
 export function buildApprovalSettledCard(question: ApprovalQuestion, state: ApprovalCardState): object {
-  return standaloneCard(`**${APPROVAL_SETTLED_LINES[state]}**`, [
-    ...approvalQuestionElements(question),
-    divider(),
-  ])
+  const elements = [...approvalQuestionElements(question), divider()]
+  if (state === 'remembered') {
+    elements.push(note(`本话题内 ${approvalGrantScope(question)} 将自动允许；/renew 或重启后恢复询问`))
+  }
+  return standaloneCard(`**${APPROVAL_SETTLED_LINES[state]}**`, elements)
 }
-

package/src/cards/index.ts

@@ -10,3 +10,4 @@ export * from './streaming.ts'
 export * from './onboarding.ts'
 export * from './approval.ts'
 export * from './question.ts'
+export * from './picker.ts'

package/src/cards/onboarding.ts

@@ -15,6 +15,7 @@ export function buildOnboardingCard(): object {
     markdown('**👋 欢迎使用飞书 DSH**'),
     markdown('直接发消息即可开始一个会话，我会在话题里流式回复；话题内继续发消息无需再 @ 我。'),
     markdown('**工作区**：私聊一人一个；群里每位成员各自一个，互不影响。'),
+    markdown('**发文件**：只发文件我不会回复；请引用那条文件消息再提问，多个文件可合并转发后引用。'),
     markdown('**常用命令**：`/help` 命令列表 · `/status` 会话状态 · `/workspace` 工作目录\n'
       + '`/effort` 推理强度 · `/model` 模型 · `/permissions` 权限预设\n'
       + '`/new` 新建会话 · `/stop` 中断当前回合 · `/history` 历史 · `/export` 导出日志'),

package/src/cards/picker.ts

@@ -0,0 +1,115 @@
+/**
+ * Command picker cards: `/model`, `/effort` and `/permissions` without
+ * arguments answer with clickable choices instead of ids to retype.
+ *
+ * A click carries the command and its argument back to the service, which
+ * runs it exactly like the typed `/<command> <arg>` line, so admission,
+ * ownership and validation stay in one place.
+ *
+ * @module dsh-channels/cards/picker
+ */
+
+import { columnSet, divider, markdown, note, standaloneCard, textButton } from './primitives.ts'
+
+/** `decision` carried by every picker button. */
+export const PICK_ACTION = 'command-pick'
+
+/** Commands that answer their bare form with a picker card. */
+export const PICKER_COMMANDS = ['model', 'effort', 'permissions'] as const
+export type PickerCommand = typeof PICKER_COMMANDS[number]
+
+/** Cap on rendered choices so one picker cannot approach the card budget. */
+export const MAX_PICKER_OPTIONS = 12
+
+/** Callback value of one picker button. */
+export interface PickAction {
+  decision: typeof PICK_ACTION
+  command: PickerCommand
+  /** Argument appended to the command line (`/model <arg>`). */
+  arg: string
+  /** Session the picker was rendered for; a rebound topic makes it stale. */
+  sessionId: string
+}
+
+/** One selectable choice. */
+export interface PickerOption {
+  label: string
+  /** Command argument; never contains whitespace. */
+  arg: string
+}
+
+/** One picker card's render input. */
+export interface PickerCardInput {
+  title: string
+  command: PickerCommand
+  /** Markdown shown above the choices (the command's own text answer). */
+  text: string
+  sessionId: string
+  options: readonly PickerOption[]
+  /** `arg` of the active choice, rendered highlighted. */
+  current?: string
+  /** Add a 恢复默认 button that runs `/<command> reset`. */
+  reset?: boolean
+}
+
+function pickButton(input: PickerCardInput, label: string, arg: string): object {
+  const active = arg === input.current
+  const value: PickAction = { decision: PICK_ACTION, command: input.command, arg, sessionId: input.sessionId }
+  return textButton({
+    label: active ? `✅ ${label}` : label,
+    type: active ? 'primary' : 'default',
+    width: 'fill',
+    margin: '0px',
+    value,
+  })
+}
+
+/** Choices in two-column rows. */
+function optionRows(input: PickerCardInput, options: readonly PickerOption[]): object[] {
+  const rows: object[] = []
+  for (let index = 0; index < options.length; index += 2) {
+    const pair = options.slice(index, index + 2).map(option => pickButton(input, option.label, option.arg))
+    rows.push(columnSet(pair))
+  }
+  return rows
+}
+
+/** Whether a value can be appended to a command line as one argument. */
+export function isPickerArg(value: string): boolean {
+  return value !== '' && !/\s/u.test(value)
+}
+
+/**
+ * The picker card. Options whose argument cannot form one command-line token
+ * are skipped; when more than `MAX_PICKER_OPTIONS` remain the rest are
+ * reported as typed-only.
+ */
+export function buildPickerCard(input: PickerCardInput): object {
+  const usable = input.options.filter(option => isPickerArg(option.arg))
+  const shown = usable.slice(0, MAX_PICKER_OPTIONS)
+  const elements: object[] = [markdown(input.text), ...optionRows(input, shown)]
+  if (usable.length > shown.length) {
+    elements.push(note(`另有 ${usable.length - shown.length} 项未展示，可直接输入 /${input.command} <id>。`))
+  }
+  if (input.reset === true) {
+    elements.push(textButton({
+      label: '恢复默认',
+      value: { decision: PICK_ACTION, command: input.command, arg: 'reset', sessionId: input.sessionId } satisfies PickAction,
+    }))
+  }
+  elements.push(divider())
+  elements.push(note(`点击即切换 · 仅发起该会话的用户可操作 · 🔑 ${input.sessionId}`))
+  return standaloneCard(`**${input.title}**`, elements)
+}
+
+/** Parse a card action value into a picker action; undefined for anything else. */
+export function parsePickAction(value: unknown): PickAction | undefined {
+  if (typeof value !== 'object' || value === null) return undefined
+  const record = value as Record<string, unknown>
+  if (record.decision !== PICK_ACTION) return undefined
+  const { command, arg, sessionId } = record
+  if (typeof command !== 'string' || !(PICKER_COMMANDS as readonly string[]).includes(command)) return undefined
+  if (typeof arg !== 'string' || !isPickerArg(arg)) return undefined
+  if (typeof sessionId !== 'string' || sessionId === '') return undefined
+  return { decision: PICK_ACTION, command: command as PickerCommand, arg, sessionId }
+}

package/src/cards/streaming.ts

@@ -26,6 +26,10 @@
  * Continuation cards (`options.segment`) carry a segment header and the body;
  * they have no panel and no footer, so a long answer is not repeated chrome.
  *
+ * The stop button follows the activity lines: the streamer only passes it for
+ * the card that is currently streaming and drops it once the turn settles, so
+ * a settled card never offers a control that can no longer act.
+ *
  * Budgets, two independent ones:
  * - Each card is measured as a whole: segmentation targets `CARD_TARGET_BYTES`
  *   (main cards probe the panel at its maximum window, so reasoning that keeps
@@ -39,17 +43,27 @@
  * @module dsh-channels/cards/streaming
  */
 
-import { card, divider, foldPanel, markdown, note } from './primitives.ts'
+import { card, divider, foldPanel, markdown, note, textButton } from './primitives.ts'
 
-export type PanelPhase = 'thinking' | 'replying' | 'done' | 'error'
+export type PanelPhase = 'thinking' | 'replying' | 'done' | 'stopped' | 'error'
 
 export const PANEL_TITLES: Record<PanelPhase, string> = {
   thinking: '推理中',
   replying: '回复中',
   done: '回复结束',
+  stopped: '已停止',
   error: '回复失败',
 }
 
+/** `decision` carried by the streaming card's stop button. */
+export const STOP_ACTION = 'turn-stop'
+
+/**
+ * Stop control state on the streaming card: `ready` offers the button,
+ * `stopping` shows it disabled after the owner clicked it.
+ */
+export type StopControl = 'ready' | 'stopping'
+
 /** Built-in icon token for the fold-panel chevron (from the official component docs). */
 export const PANEL_CHEVRON_TOKEN = 'down-small-ccm_outlined'
 
@@ -124,6 +138,14 @@ export interface CardState {
    * Empty/undefined → omitted.
    */
   tool?: string
+  /**
+   * Stop control for the actively streaming card. Same rule as `status`: the
+   * streamer passes it only for the current card of an unsettled turn.
+   * Undefined → no button.
+   */
+  stop?: StopControl
+  /** Add the owner-only notice under the stop button (a non-owner clicked it). */
+  stopDenied?: boolean
   stats: CardStats
 }
 
@@ -311,7 +333,7 @@ function reasoningPlaceholder(phase: PanelPhase): string {
 }
 
 function bodyPlaceholder(phase: PanelPhase): string {
-  return phase === 'done' || phase === 'error' ? '*（本次无正文输出）*' : '*正在生成…*'
+  return isSettled(phase) ? '*（本次无正文输出）*' : '*正在生成…*'
 }
 
 /** The panel's markdown: stripped of tables, with a placeholder when empty. */
@@ -341,7 +363,7 @@ function interruptionHeader(segment: number): string {
 }
 
 function isSettled(phase: PanelPhase): boolean {
-  return phase === 'done' || phase === 'error'
+  return phase === 'done' || phase === 'stopped' || phase === 'error'
 }
 
 /**
@@ -360,6 +382,23 @@ function activityNote(text: string | undefined): object | undefined {
   return note(clipped)
 }
 
+/** Main-card line of a turn that ended through a stop request. */
+export const STOPPED_NOTICE = '⏹ 已按请求停止本轮回复'
+
+/** The stop button plus its optional owner-only notice. */
+function stopElements(stop: StopControl, denied: boolean): object[] {
+  const elements: object[] = [textButton({
+    label: stop === 'stopping' ? '正在停止…' : '⏹ 停止',
+    type: 'default',
+    width: 'default',
+    margin: '8px 0 0 0',
+    disabled: stop === 'stopping',
+    value: { decision: STOP_ACTION },
+  })]
+  if (denied) elements.push(note('ℹ️ 仅发起该会话的用户可停止'))
+  return elements
+}
+
 // ---- rendering ------------------------------------------------------------
 
 /** Render one card. `reasoning`/`body` are the already-budgeted texts. */
@@ -392,6 +431,10 @@ function renderCard(
 
   elements.push(markdown(body.trim() === '' ? bodyPlaceholder(state.phase) : body))
 
+  if (state.stop !== undefined) elements.push(...stopElements(state.stop, state.stopDenied === true))
+
+  if (main && state.phase === 'stopped') elements.push(note(STOPPED_NOTICE))
+
   if (main && isSettled(state.phase)) {
     // The divider separates the answer from the turn's metadata; the two
     // notation lines below it are the only place the settled figures appear.
@@ -474,8 +517,10 @@ const PANEL_PROBE_MARKDOWN = 'r'.repeat(REASONING_MAX_BYTES - 2)
  *
  * The probe renders the worst card this segment can ever become: the main card
  * always budgets the panel's full window (reasoning may keep growing after the
- * split) and its settled footer, while continuation cards have neither. The
- * `error` phase is probed because it has the longest panel title.
+ * split) and its settled footer, while continuation cards have neither. Every
+ * card also budgets the stop button with its notice, since the newest card
+ * carries it while streaming. The `error` phase is probed because it has the
+ * longest panel title.
  */
 export function segmentCardContent(state: CardState, options: CardOptions = {}): BodySplit {
   const main = options.segment === undefined
@@ -483,6 +528,8 @@ export function segmentCardContent(state: CardState, options: CardOptions = {}):
     ...state,
     phase: 'error',
     reasoning: main ? PANEL_PROBE_MARKDOWN : '',
+    stop: 'stopping',
+    stopDenied: true,
   }
   const limit = fitPrefix(
     state.body,
@@ -568,7 +615,9 @@ export function splitBodyForCard(body: string, maxChars: number, maxTables: numb
 
 /**
  * The initial (empty) streaming card for one session: thinking phase, empty
- * body and reasoning, zeroed stats. The service sends it as the topic-creating
+ * body and reasoning, zeroed stats. It has no stop button: the turn may still
+ * be preparing or queued behind another one, and the streamer adds the button
+ * once the turn is the active one. The service sends it as the topic-creating
  * first reply and then streams into the same message.
  */
 export function initialStreamingCard(sessionId: string): object {

package/src/client/api.ts

@@ -11,7 +11,6 @@ import {
   ACCESS_ROUTE,
   ACCESS_USERS_ROUTE,
   CATALOG_ROUTE,
-  CLEANUP_ROUTE,
   CONFIG_ROUTE,
   CREDENTIALS_ROUTE,
   PANEL_ROUTE,
@@ -24,7 +23,6 @@ import type {
   AccessWire,
   CatalogWire,
   ChannelStatusWire,
-  CleanupResponse,
   ClearConfigResponse,
   ClearCredentialResponse,
   CredentialField,
@@ -143,24 +141,6 @@ export async function reconnect(): Promise<ReconnectResponse> {
   return JSON.parse(text) as ReconnectResponse
 }
 
-/**
- * Run one workspace cleanup. No request body: the Host derives the candidate
- * set from the effective retention config. Irreversible, so the caller asks
- * for confirmation first; partial failures come back inside `result.failures`.
- */
-export async function runCleanup(): Promise<CleanupResponse> {
-  const response = await request(CLEANUP_ROUTE, { method: 'POST' })
-  const text = await response.text()
-  if (!response.ok) {
-    try {
-      return JSON.parse(text) as CleanupResponse
-    } catch {
-      return { ok: false, error: errorFromBody(response.status, text) }
-    }
-  }
-  return JSON.parse(text) as CleanupResponse
-}
-
 /**
  * Ask the Host to open its native directory chooser (the panel's「选择目录…」
  * button). The request stays open while the OS dialog does; a cancel comes back
@@ -259,18 +239,18 @@ export async function removeAccessGroup(chatId: string): Promise<AccessMutationR
   return mutateAccess(ACCESS_GROUPS_ROUTE, 'DELETE', { chatId })
 }
 
-/** Authorize one user open_id (global across authorized groups). */
-export async function addAccessUser(openId: string, name?: string): Promise<AccessMutationResponse> {
+/** Authorize one user `user_id` (global across authorized groups). */
+export async function addAccessUser(userId: string, name?: string): Promise<AccessMutationResponse> {
   return mutateAccess(
     ACCESS_USERS_ROUTE,
     'POST',
-    name === undefined || name === '' ? { openId } : { openId, name },
+    name === undefined || name === '' ? { userId } : { userId, name },
   )
 }
 
 /** Revoke one user authorization (takes effect on the next message). */
-export async function removeAccessUser(openId: string): Promise<AccessMutationResponse> {
-  return mutateAccess(ACCESS_USERS_ROUTE, 'DELETE', { openId })
+export async function removeAccessUser(userId: string): Promise<AccessMutationResponse> {
+  return mutateAccess(ACCESS_USERS_ROUTE, 'DELETE', { userId })
 }
 
 /** Settle one pending authorization request (same resolver as the Feishu card). */

package/src/client/panel/access-card.tsx

@@ -44,8 +44,8 @@ export interface AccessCardProps {
   error: string | null
   onAddGroup: (chatId: string, name: string) => Promise<boolean>
   onRemoveGroup: (chatId: string) => void
-  onAddUser: (openId: string, name: string) => Promise<boolean>
-  onRemoveUser: (openId: string) => void
+  onAddUser: (userId: string, name: string) => Promise<boolean>
+  onRemoveUser: (userId: string) => void
   onResolveRequest: (token: string, decision: 'allow' | 'deny') => void
 }
 
@@ -54,7 +54,7 @@ export function AccessCard(props: AccessCardProps): JSX.Element {
   const { access } = panel
   const [groupChatId, setGroupChatId] = useState('')
   const [groupName, setGroupName] = useState('')
-  const [userOpenId, setUserOpenId] = useState('')
+  const [userUserId, setUserUserId] = useState('')
   const [userName, setUserName] = useState('')
   const groups: readonly AccessGroupWire[] = access.groups
   const users: readonly AccessUserWire[] = access.users
@@ -71,9 +71,9 @@ export function AccessCard(props: AccessCardProps): JSX.Element {
   }
 
   const submitUser = async (): Promise<void> => {
-    if (userOpenId.trim() === '') return
-    if (await onAddUser(userOpenId, userName)) {
-      setUserOpenId('')
+    if (userUserId.trim() === '') return
+    if (await onAddUser(userUserId, userName)) {
+      setUserUserId('')
       setUserName('')
     }
   }
@@ -93,6 +93,15 @@ export function AccessCard(props: AccessCardProps): JSX.Element {
         ? (
             <div className="dsh-channels-cfg__notice dsh-channels-cfg__notice--error">
               <strong>{PANEL_COPY.accessAdminMissingWarning}</strong>
+              {access.admin.ownerLookupError === undefined ? null : <div>{access.admin.ownerLookupError}</div>}
+            </div>
+          )
+        : null}
+      {access.mode === 'guarded' && access.admin.source === 'owner' && access.admin.userId !== undefined
+        ? (
+            <div className="dsh-channels-cfg__notice dsh-channels-cfg__notice--ok">
+              {PANEL_COPY.accessAdminOwnerNotice}
+              <span className="dsh-channels-cfg__mono">{access.admin.userId}</span>
             </div>
           )
         : null}
@@ -171,11 +180,11 @@ export function AccessCard(props: AccessCardProps): JSX.Element {
                   : (
                       <ul className="dsh-channels-cfg__accessList">
                         {users.map(user => (
-                          <li className="dsh-channels-cfg__accessRow" key={user.openId}>
+                          <li className="dsh-channels-cfg__accessRow" key={user.userId}>
                             <span className="dsh-channels-cfg__accessMain">
-                              <span>{user.name ?? user.openId}</span>
+                              <span>{user.name ?? user.userId}</span>
                               <span className="dsh-channels-cfg__accessMeta">
-                                <span className="dsh-channels-cfg__mono">{user.openId}</span>
+                                <span className="dsh-channels-cfg__mono">{user.userId}</span>
                                 {` · ${accessSourceLabel(user.source)} · ${formatAccessDate(user.addedAt)}`}
                               </span>
                             </span>
@@ -183,7 +192,7 @@ export function AccessCard(props: AccessCardProps): JSX.Element {
                               type="button"
                               className="dsh-channels-cfg__btn"
                               disabled={disabled}
-                              onClick={() => onRemoveUser(user.openId)}
+                              onClick={() => onRemoveUser(user.userId)}
                             >
                               {working ? PANEL_COPY.accessWorking : PANEL_COPY.accessRemove}
                             </button>
@@ -195,11 +204,11 @@ export function AccessCard(props: AccessCardProps): JSX.Element {
                   <input
                     type="text"
                     className="dsh-channels-cfg__input dsh-channels-cfg__accessInput"
-                    value={userOpenId}
-                    placeholder={PANEL_COPY.accessUserOpenIdPlaceholder}
-                    aria-label={PANEL_COPY.accessUserOpenIdPlaceholder}
+                    value={userUserId}
+                    placeholder={PANEL_COPY.accessUserIdPlaceholder}
+                    aria-label={PANEL_COPY.accessUserIdPlaceholder}
                     disabled={disabled}
-                    onChange={event => setUserOpenId(event.target.value)}
+                    onChange={event => setUserUserId(event.target.value)}
                   />
                   <input
                     type="text"
@@ -213,7 +222,7 @@ export function AccessCard(props: AccessCardProps): JSX.Element {
                   <button
                     type="button"
                     className="dsh-channels-cfg__btn dsh-channels-cfg__btn--primary"
-                    disabled={disabled || userOpenId.trim() === ''}
+                    disabled={disabled || userUserId.trim() === ''}
                     onClick={() => { void submitUser() }}
                   >
                     {working ? PANEL_COPY.accessWorking : PANEL_COPY.accessAddUser}

package/src/client/panel/access-tab.tsx

@@ -1,5 +1,5 @@
 /**
- * 「访问授权」tab：准入与授权字段表单（管理员 open_id / 准入模式 /
+ * 「访问授权」tab：准入与授权字段表单（管理员 user_id / 准入模式 /
  * 申请有效期）+ 白名单与待处理申请卡。表单保存走全局 draft，白名单
  * 增删是独立即时 mutation。
  *
@@ -17,8 +17,8 @@ export interface AccessTabProps {
   accessError: string | null
   onAddGroup: (chatId: string, name: string) => Promise<boolean>
   onRemoveGroup: (chatId: string) => void
-  onAddUser: (openId: string, name: string) => Promise<boolean>
-  onRemoveUser: (openId: string) => void
+  onAddUser: (userId: string, name: string) => Promise<boolean>
+  onRemoveUser: (userId: string) => void
   onResolveRequest: (token: string, decision: 'allow' | 'deny') => void
 }