@nelsonlongxiang/dsh-open-a2a-net 0.6.32 → 0.6.34

package/lib/types/task-auth.d.ts

@@ -1,7 +1,7 @@
 /** The admission basis (closed set, design §2.2). */
 export type Via = 'host-face' | 'joined-session' | 'canvas-member' | 'peer-org' | 'cli-deposit' | 'open';
 /** The exact rule that admitted a caller (closed set, design §2.2). */
-export type AdmissionRule = 'scope-off' | 'host-face' | 'local-exempt' | 'roster-shared' | 'canvas-shared' | 'remote-ref-samezone' | 'remote-ref-foreign' | 'peer-org' | 'node-fact' | 'cli-deposit';
+export type AdmissionRule = 'scope-off' | 'host-face' | 'local-exempt' | 'roster-shared' | 'canvas-shared' | 'remote-ref-samezone' | 'remote-ref-foreign' | 'remote-ref-cli' | 'peer-org' | 'node-fact' | 'cli-deposit';
 /** Every rule's basis — the mapping the authorization record stores beside the rule. */
 export declare const VIA_OF: Readonly<Record<AdmissionRule, Via>>;
 /**
@@ -49,6 +49,15 @@ export interface AdmissionRecords {
     peerOrgs(): Iterable<readonly PeerOrgEntry[]>;
     liveNodeIds(): readonly string[];
     cliDeposited(handle: string): boolean;
+    /** An operator-pinned CLI home, absent for ambiguous/unlinked CLI refs. */
+    cliHomeOf?(handle: string): string | undefined;
+}
+/** Bound signer evidence and a fresh full-card online check, never caller self-description. */
+export interface RemoteCliProof {
+    readonly origin: string;
+    readonly viaUrl: string;
+    readonly bound: boolean;
+    readonly online: boolean;
 }
 /**
  * W1/W2 shared-team admission core: a same-zone zone/id8 caller passes when
@@ -73,7 +82,9 @@ export declare function joinedFaceAdmission(r: AdmissionRecords, callerSession:
  */
 export declare function localCandidateAdmission(r: AdmissionRecords, callerSession: string | undefined, targetTeam?: string): Admission;
 /** Inbound admission for the peer faces (/a2a/direct, /a2a/log): caller_session is the contract. */
-export declare function callerAdmission(r: AdmissionRecords, caller: string, targetTeam?: string): Admission;
+export declare function callerAdmission(r: AdmissionRecords, caller: string, targetTeam?: string, cliProof?: RemoteCliProof): Admission;
+/** Revalidate only mutable operator authority, not already-verified birth-time identity or liveness. */
+export declare function recheckRemoteCliAuthorization(r: AdmissionRecords, auth: TaskAuthorization): Admission;
 /**
  * The inputs of the allowlist version (design §2.3): only operator-controlled
  * records the admission rules really read. The peer-card canvasOrg is left
@@ -87,6 +98,7 @@ export interface AllowlistInputs {
     readonly roster: readonly (readonly [handle: string, team: string])[];
     readonly canvas: readonly (readonly [team: string, members: readonly string[]])[];
     readonly cli: readonly string[];
+    readonly cliHome?: readonly (readonly [handle: string, origin: string])[];
     readonly links: readonly string[];
 }
 /**
@@ -125,6 +137,8 @@ export interface TaskAuthorization {
     };
     readonly ingress: 'wire' | 'local';
     readonly via: Via;
+    /** Signed courier host's card URL for a remote CLI, distinct from the closed-set admission via. */
+    readonly carrier_url?: string;
     readonly admission_rule: AdmissionRule;
     /** Every shared team that held (cache-owed ones as `peer-org:<team>`). */
     readonly basis: readonly string[];
@@ -152,6 +166,7 @@ export interface AuthorizationFacts {
         readonly caller: string;
         readonly origin: string;
     };
+    readonly carrierUrl?: string;
     readonly ingress: 'wire' | 'local';
     readonly allowlistVersion: string;
     readonly target: string;

package/lib/types/task-ledger.d.ts

@@ -63,7 +63,7 @@ export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled' | 'evict
  * same-host seats could not be told apart.
  */
 export interface Sender {
-    readonly kind: 'session' | 'host' | 'bridge';
+    readonly kind: 'session' | 'host' | 'bridge' | 'cli';
     /**
      * A session's `<zone>/<id8>` node team, the host process label, or the
      * bridge submitter. Group senders by `kind:id`, never by `id` alone: a host
@@ -89,6 +89,7 @@ export declare const SENDER_ID_CAP = 256;
 export declare function parseSender(raw: unknown): Sender | undefined;
 /** #139: what an outbound row is born with besides its sender. */
 export interface OutboundBirth {
+    readonly forwarded?: true;
     /** The local-candidate admission (ingress local); kept only on a row whose peer is 'local'. */
     readonly auth?: TaskAuthorization;
     readonly peerKey?: string;
@@ -124,6 +125,8 @@ export interface TaskRecord {
     readonly brief?: string;
     /** #114 S3: the real sender of an outbound row (absent on inbound rows and rows persisted before the field). */
     readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
     /**
      * #114 S2: the immutable authorization the row was born with — an inbound
      * row's wire admission, or (#139) an outbound row's local-candidate
@@ -183,6 +186,8 @@ export interface ArchivedRecord {
     readonly receiptExpected?: false;
     /** #114 S3: copied from the owed row (absent on inbound rows and rows archived before the field). */
     readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
     /** #114 S2: carried over from the live row unchanged. */
     readonly auth?: TaskAuthorization;
     /** #139: carried over from the live row unchanged (a late receipt is judged against them). */

package/lib/types/team-store.d.ts

@@ -51,6 +51,13 @@ export declare class TeamMembershipStore {
     add(session: string, team: string): void;
     /** Retract one membership; a no-op when absent. */
     remove(session: string, team: string): void;
+    /** One atomic roster replacement for the owner's workbench gesture. A failed disk write changes no in-memory membership. */
+    replaceTeam(team: string, members: readonly string[]): {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    };
     /** Drop every declaration of one session (a left or archived node). */
     dropSession(session: string): void;
     /**

package/lib/types/types.d.ts

@@ -76,6 +76,8 @@ export interface A2aSessionTeamInfo {
     readonly name: string;
     /** One-line excerpt of the session's newest user or assistant text. */
     readonly description: string;
+    /** CLI deposit status, explicitly online/offline on full host cards; absent on ordinary sessions. */
+    readonly offline?: boolean;
     /** The session's working directory, when the publishing node shares it. */
     readonly workspace?: string;
 }
@@ -105,6 +107,8 @@ export interface ZoneRecord {
 }
 /** Canonical `a2a_route` success value. */
 export interface A2aRouteOk {
+    /** Actual member face returned by a forwarded peer delivery. */
+    readonly deliveredTo?: string;
     readonly ok: true;
     readonly team: string;
     /** Reply text the remote team produced. */
@@ -129,6 +133,8 @@ export interface A2aRouteOk {
      * receipt-owed (`trackOwedTask` skips it).
      */
     readonly bridge?: 'native-teams';
+    /** The peer's explicit receipt contract, when provided. */
+    readonly receipt?: 'none' | 'routed' | 'mailbox';
     /**
      * gh#141: the peer refused the settlement the delivered message carried
      * (its enforce verdict, `settlement: {status: 'refused'}` on the wire,
@@ -138,6 +144,8 @@ export interface A2aRouteOk {
 }
 /** Canonical `a2a_route` failure value. */
 export interface A2aRouteError {
+    /** A forwarded receipt never promises another receipt, including uncertain waits. */
+    readonly receipt?: 'none';
     readonly ok: false;
     /** Peer or transport failure text. */
     readonly error: string;

package/nexus-stage/src/canvas-ops.ts

@@ -19,7 +19,7 @@ import type { LayoutDoc } from './layout-doc'
 export type RosterOp = { op: 'remove' | 'add'; id: string }
 
 /** The five user-facing write actions (one per design.md §3.3 row), plus the two network join/leave actions the panel-slim migration moved into the planning view. */
-export type CanvasAction =
+export type CanvasAction = (
   | { type: 'create-team'; name: string; ids: readonly string[]; /** true when the model had no such team before this action; NOT server creation provenance and never authority to delete on failure. */ created?: boolean }
   | { type: 'add-member'; team: string; ids: readonly string[]; /** gh#41: set when the target frame is a REMOTE peer's team — the wire routes the op through the host fleet relay. */ fleetPeer?: string }
   | { type: 'remove-member'; team: string; ids: readonly string[]; /** gh#41: see add-member. */ fleetPeer?: string }
@@ -29,6 +29,7 @@ export type CanvasAction =
   /** Network-level join/leave (the session joins the A2A mesh) — distinct from canvas-team membership. */
   | { type: 'join-network'; id: string }
   | { type: 'leave-network'; id: string }
+) & { roster?: boolean }
 
 /** Reverts exactly what one applyAction did (team-scoped). */
 export type Undo = () => void

package/nexus-stage/src/cli-home-picker.ts

@@ -0,0 +1,42 @@
+/** Explicit operator choice only; this form never auto-selects or relaxes home admission. */
+export interface CliHomeOptions { ok: boolean; homes?: string[]; unreadable?: number; held?: boolean; error?: string }
+export function createCliHomePicker(read: () => Promise<CliHomeOptions>, save: (home: string) => Promise<boolean>): HTMLFormElement {
+  const form = document.createElement('form')
+  form.className = 'wb-cli-home'
+  const readButton = document.createElement('button')
+  readButton.type = 'button'; readButton.textContent = '指定 home'; readButton.className = 'wb-member-submit'
+  const select = document.createElement('select')
+  select.className = 'wb-member-pick'; select.setAttribute('aria-label', '选择 CLI home 主机'); select.hidden = true
+  const submit = document.createElement('button')
+  submit.type = 'submit'; submit.textContent = '确认 home'; submit.className = 'wb-member-submit'; submit.hidden = true; submit.disabled = true
+  const note = document.createElement('div')
+  note.className = 'wb-hint'; note.setAttribute('role', 'status'); note.setAttribute('aria-live', 'polite')
+  note.textContent = 'home 未确定；点击指定 home 现读已链接主机名片。'
+  let busy = false
+  readButton.addEventListener('click', async () => {
+    if (busy) return
+    busy = true; readButton.disabled = true; submit.disabled = true; note.textContent = '正在现读主机名片…'
+    try {
+      const result = await read()
+      if (!result.ok) throw Error(result.error ?? '候选读取失败')
+      if (result.held) { readButton.hidden = true; select.hidden = true; submit.hidden = true; select.replaceChildren(); note.textContent = '本机持有，无需指定'; return }
+      select.replaceChildren(new Option('请选择 home 主机…', '', true, true))
+      for (const home of result.homes ?? []) select.appendChild(new Option(home, home))
+      select.hidden = false; submit.hidden = false; readButton.textContent = '刷新候选'
+      const count = result.homes?.length ?? 0
+      note.textContent = (result.unreadable ? '有 ' + result.unreadable + ' 台对端名片读不到；' : '') + (count > 1 ? '多台已链接主机列出该句柄，请显式选择。' : count === 1 ? '找到 1 台已链接主机；仍需你显式确认。' : '当前没有已链接且列出该句柄的可选主机。')
+    } catch (error) { note.textContent = '读取失败：' + String(error); select.hidden = true; submit.hidden = true }
+    finally { busy = false; readButton.disabled = false }
+  })
+  select.addEventListener('change', () => { submit.disabled = busy || select.value === '' })
+  form.addEventListener('submit', async event => {
+    event.preventDefault()
+    if (busy || select.value === '') return
+    busy = true; readButton.disabled = true; select.disabled = true; submit.disabled = true
+    try { note.textContent = await save(select.value) ? 'home 已指定：' + select.value : '指定失败：主机可能已离线或不再列出该句柄，请刷新后重选。' }
+    catch (error) { note.textContent = '指定失败：' + String(error) }
+    finally { busy = false; readButton.disabled = false; select.disabled = false; submit.disabled = select.value === '' }
+  })
+  form.append(readButton, select, submit, note)
+  return form
+}

package/nexus-stage/src/layout-doc.ts

@@ -66,11 +66,13 @@ function clampRect(raw: unknown): LayoutRect | undefined {
  * Normalize an untrusted layout document exactly as the host does:
  * version!==1 rejects the whole doc; non-finite coordinates drop the
  * point; coordinates round and clamp to ±COORD_LIMIT; scale clamps to
- * [SCALE_MIN, SCALE_MAX]; node keys cap at 128 chars; frame keys mirror
- * canvas team names (no '/', cap 40); rects need w>0 and h>0; caps are
+ * [SCALE_MIN, SCALE_MAX]; node keys cap at 128 chars; canvas frame names cap at 40,
+ * roster:<name> reserves seven extra characters; rects need w>0 and h>0; caps are
  * first-wins in insertion order - entries beyond are silently dropped,
  * never refused (an overflow renders, it just does not persist).
  */
+const validFrame = (name: string): boolean => name !== '' && !name.includes('/') && (name.startsWith('roster:') ? name.length > 7 && name.length <= 47 : name.length <= 40)
+
 export function clampDoc(raw: unknown): LayoutDoc | undefined {
   if (raw === null || typeof raw !== 'object') return undefined
   const rec = raw as Record<string, unknown>
@@ -96,7 +98,7 @@ export function clampDoc(raw: unknown): LayoutDoc | undefined {
   const frames: Record<string, LayoutRect> = {}
   if (rec.frames !== null && typeof rec.frames === 'object') {
     for (const [name, rect] of Object.entries(rec.frames as Record<string, unknown>)) {
-      if (typeof name !== 'string' || name === '' || name.includes('/') || name.length > 40) continue
+      if (!validFrame(name)) continue
       const r = clampRect(rect)
       if (r !== undefined) frames[name] = r
       if (Object.keys(frames).length >= LAYOUT_FRAME_CAP) break
@@ -127,7 +129,7 @@ export function buildLayoutDoc(
   }
   const docFrames: Record<string, LayoutRect> = {}
   for (const [name, r] of frames) {
-    if (typeof name !== 'string' || name === '' || name.includes('/') || name.length > 40) continue
+    if (!validFrame(name)) continue
     const w = clamp(r.w)
     const h = clamp(r.h)
     if (w <= 0 || h <= 0) continue

package/nexus-stage/src/main.ts

@@ -9,9 +9,10 @@
 import { createFaultReporter } from './fault'
 import { createWorkbench, type StateBody } from './workbench'
 import { createPlanningView } from './planning-view'
+import { rosterFrames, rosterNameOf } from './planning-roster'
 import { createSaveLoop, type LampState } from './layout-wire'
 import { createCanvasWire } from './canvas-wire'
-import type { CanvasAction } from './canvas-ops'
+import { actionTeam, type CanvasAction } from './canvas-ops'
 import './workbench.css'
 
 const app = document.getElementById('app')!
@@ -171,6 +172,24 @@ async function fleetOp(peer: string, op: 'add-member' | 'remove-member' | 'remov
   return false
 }
 
+async function rosterAction(a: CanvasAction, name: string): Promise<boolean> {
+  const post = async (body: Record<string, unknown>): Promise<boolean> => {
+    const reply = await controlFetch('/__dsh_a2a/roster-op', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name, ...body }) }).catch(() => undefined)
+    const result = reply !== undefined ? await reply.json().catch(() => undefined) as { ok?: boolean; error?: string } | undefined : undefined
+    if (reply?.ok && result?.ok === true) return true
+    planning.notice('error', `roster 操作失败：${String(result?.error ?? (reply ? `HTTP ${reply.status}` : '无响应'))}`)
+    return false
+  }
+  if (a.type === 'create-team') return post({ op: 'create', ids: a.ids })
+  if (a.type === 'remove-team') return post({ op: 'dissolve' })
+  if (a.type === 'add-member' || a.type === 'remove-member') {
+    for (const id of a.ids) if (!(await post({ op: a.type, id }))) return false
+    return true
+  }
+  planning.notice('error', 'roster 不支持该操作')
+  return false
+}
+
 function runCanvasAction(a: CanvasAction): Promise<boolean> {
   // gh#41: a remote-frame drop forks to the fleet relay; so does dissolving
   // a mirror frame (single owner + mirror: the owner's store is the truth).
@@ -182,6 +201,12 @@ function runCanvasAction(a: CanvasAction): Promise<boolean> {
     })()
   }
   if (a.type === 'remove-team' && a.fleetPeer !== undefined) return fleetOp(a.fleetPeer, 'remove', a.name)
+  // Only a trusted registry roster frame or an explicit create choice may trigger a local roster write.
+  if (a.roster === true) {
+    const roster = rosterNameOf(actionTeam(a))
+    if (roster !== undefined) return rosterAction(a, roster)
+    planning.notice('error', '无效的 roster 框名'); return Promise.resolve(false)
+  }
   switch (a.type) {
     case 'create-team': return canvasWire.createTeam(a.name, a.ids, a.created)
     case 'add-member': return canvasWire.addMembers(a.team, a.ids)
@@ -267,14 +292,21 @@ const bench = createWorkbench({
   // The only reach primitive is the inline 快派 form: it works for local
   // session teams, canvas teams and remote rows alike, and never leaves
   // this page.
-  async canvasOp(action, name, id) {
+  async cliHomeOptions(name, id) {
+    try {
+      const res = await controlFetch('/__dsh_a2a/canvas', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ action: 'cli-home-options', name, id }) })
+      const body = await res.json() as { ok: boolean; homes?: string[]; unreadable?: number; held?: boolean; error?: string }
+      return { ...body, ok: res.ok && body.ok === true }
+    } catch (error) { return { ok: false, error: String(error) } }
+  },
+  async canvasOp(action, name, id, home) {
     // Same control route the planning board's wire uses; the inspector's
     // member writes are one id at a time, so no serial fan-out needed.
     try {
       const res = await controlFetch('/__dsh_a2a/canvas', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ action, name, id }),
+        body: JSON.stringify({ action, name, id, ...(home === undefined ? {} : { home }) }),
       })
       const body = (await res.json().catch(() => ({}))) as { ok?: boolean; error?: string }
       if (res.ok && body.ok !== false) return true
@@ -440,7 +472,7 @@ async function poll(): Promise<void> {
     // SessionLite needs `joined: boolean` (workbench rows carry `joined?`):
     // tri-state → boolean without losing the unjoined node-list population.
     const allSessions = (body.sessions ?? []).map(s => ({ ...s, joined: s.joined === true }))
-    const teams = body.canvas?.teams ?? []
+    const teams = [...(body.canvas?.teams ?? []), ...rosterFrames(body.registry?.teams ?? [], body.zone ?? '')]
     const peers = (body.peers ?? []).filter(p => p !== null && typeof p === 'object' && typeof (p as { url?: unknown }).url === 'string')
     const inFlight = (body.inFlight ?? []).filter(r => r !== null && typeof r === 'object' && typeof (r as { team?: unknown }).team === 'string' && typeof (r as { peer?: unknown }).peer === 'string' && Number.isFinite((r as { startedAt?: unknown }).startedAt))
     const remoteTeams = (body.remote ?? [])

package/nexus-stage/src/planning-card.ts

@@ -0,0 +1,61 @@
+/**
+ * Board node card: the DOM skeleton and the right-hand chip. Extracted from planning-view so the card's static
+ * structure reads in one place and the view stays under its M1 module-size cap (1507 lines; it reached 1529 with
+ * the 工作中/空闲 chip). Pure DOM helpers — no view state; renderNodes still decides what each card shows.
+ * @module nexus-stage/planning-card
+ */
+import type { PlanningSession } from './planning-types'
+import type { WorldNode } from './world'
+
+/** The card's 工作中/空闲 chip text; empty when the host reported no status (older host, cold or remote node). */
+export function workLabel(work: Pick<PlanningSession, 'status' | 'queued'> | undefined): string {
+  if (work?.status === undefined) return ''
+  const base = work.status === 'running' ? '工作中' : '空闲'
+  return typeof work.queued === 'number' && work.queued > 0 ? `${base} · 排队 ${String(work.queued)}` : base
+}
+
+/** A fresh `.p-node` card: title row (dot + text), second row (description + 工作中/空闲 chip), and the right-hand chip. */
+export function createCardElement(id: string): HTMLDivElement {
+  const el = document.createElement('div')
+  el.className = 'p-node'
+  el.dataset.id = id
+  el.tabIndex = 0
+  const nm = document.createElement('div')
+  nm.className = 'nm'
+  const dot = document.createElement('span')
+  dot.className = 'dot'
+  const name = document.createElement('span')
+  name.className = 'nm-text'
+  nm.append(dot, name)
+  const sub = document.createElement('div')
+  sub.className = 'sub mono'
+  const prio = document.createElement('span')
+  prio.className = 'prio mono'
+  // Second line: the description, with the 工作中/空闲 chip at its right end — the title keeps its full width.
+  const work = document.createElement('span')
+  work.className = 'work'
+  const subRow = document.createElement('div')
+  subRow.className = 'sub-row'
+  subRow.append(sub, work)
+  el.append(nm, subRow, prio)
+  return el
+}
+
+/**
+ * The right-hand chip. Peer cards show the link badge (gh#20 W-A: linked green / stranger gray, then the
+ * verified tick/cross; an absent link field from an older host renders the neutral 'peer'); session cards show
+ * their first membership priority `P<n>`. Writes only on change.
+ */
+export function paintPrio(prioEl: HTMLElement, n: WorldNode, info: { link?: 'linked' | 'stranger'; verified?: boolean } | undefined): void {
+  if (n.remote === true) {
+    const cls = info?.link === 'linked' ? 'lnk-linked' : info?.link === 'stranger' ? 'lnk-stranger' : ''
+    if (prioEl.className !== `prio mono ${cls}`.trim()) prioEl.className = `prio mono ${cls}`.trim()
+    const mark = info === undefined ? '' : info.verified === true ? '✓' : '✗'
+    const badge = (info?.link ?? 'peer') + mark
+    if (prioEl.textContent !== badge) prioEl.textContent = badge
+  } else {
+    if (prioEl.className !== 'prio mono') prioEl.className = 'prio mono'
+    const prioText = n.memberships[0] !== undefined ? `P${n.memberships[0]!.index}` : ''
+    if (prioEl.textContent !== prioText) prioEl.textContent = prioText
+  }
+}

package/nexus-stage/src/planning-frame-hue.ts

@@ -0,0 +1,13 @@
+/** Stable team hue shared by canvas and roster frames. */
+import { FRAME_HUES } from './tokens'
+
+export function frameHue(name: string): { line: string; bg: string } {
+  let h = 0
+  for (let i = 0; i < name.length; i++) h = ((h * 31 + name.charCodeAt(i)) & 0xfffffff) >>> 0
+  const rgb = FRAME_HUES[h % FRAME_HUES.length]!
+  const line = "#" + rgb.toString(16).padStart(6, "0")
+  const r = (rgb >> 16) & 0xff
+  const g = (rgb >> 8) & 0xff
+  const b = rgb & 0xff
+  return { line, bg: `rgba(${r},${g},${b},0.05)` }
+}

package/nexus-stage/src/planning-legend.ts

@@ -27,6 +27,7 @@ export function createLegend(): HTMLDetailsElement {
   }
   row(false, '成员边（星形，框→成员）')
   row(true, '跨队多属（虚线）')
+  row(true, 'roster 网络队框（双线边框）')
   row(false, '活动边（inFlight 路由，瞬时）', 'var(--accent)')
   row(true, '联邦线（→peer）', 'var(--federal)')
   legend.append(summary, rows)

package/nexus-stage/src/planning-menus.ts

@@ -8,6 +8,7 @@
  * @module nexus-stage/planning-menus
  */
 import { reorderOps, type CanvasAction } from './canvas-ops'
+import { rosterFrameName, rosterFrameTitle } from './planning-roster'
 import type { PlanningSession, PlanningTeam } from './planning-types'
 import type { WorldModel } from './world'
 
@@ -22,6 +23,8 @@ export interface MenusDeps {
   readonly model: WorldModel
   /** Canvas teams from the latest poll. */
   teams(): ReadonlyArray<PlanningTeam>
+  joined(id: string): boolean
+  isRoster(frame: string): boolean
   /** The card or frame-head element a menu re-focuses on close. */
   anchorFor(target: MenuTarget): HTMLElement | null
   emit(a: CanvasAction): void
@@ -45,6 +48,7 @@ export interface PlanningMenus {
 
 export function createPlanningMenus(d: MenusDeps): PlanningMenus {
   const { root, netBtn, signal, model } = d
+  const titleOf = (frame: string): string => d.isRoster(frame) ? rosterFrameTitle(frame) : frame
 
   // ── 建队：selection → 命名对话框 → create-team ──
   function selectedByY(): string[] {
@@ -87,6 +91,46 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
     title.id = 'p-dialog-title'
     title.className = 'p-dialog-title'
     title.textContent = `组建团队（${ids.length} 个节点，自上而下即优先级）`
+    // Team type: a visible two-way toggle (a bare <select> read as a label and roster went unnoticed).
+    const kind = { value: 'canvas' as 'canvas' | 'roster' }
+    const kindGroup = document.createElement('div')
+    kindGroup.className = 'p-dialog-kind'
+    kindGroup.setAttribute('role', 'radiogroup')
+    kindGroup.setAttribute('aria-label', '团队类型')
+    const kindHint = document.createElement('div')
+    kindHint.className = 'p-dialog-hint'
+    const KIND_HINT = {
+      canvas: 'canvas 队：画布上的协作组，可以加入远端成员。',
+      roster: 'roster 网络队：只收本机已入网的会话；队名会写进属主的精确允许名单。',
+    } as const
+    const kindButtons = (['canvas', 'roster'] as const).map(value => {
+      const b = document.createElement('button')
+      b.type = 'button'
+      b.dataset.kind = value
+      b.setAttribute('role', 'radio')
+      b.textContent = value === 'canvas' ? 'canvas 队' : 'roster 网络队'
+      b.addEventListener('click', () => setKind(value))
+      kindGroup.appendChild(b)
+      return b
+    })
+    function setKind(value: 'canvas' | 'roster'): void {
+      kind.value = value
+      for (const b of kindButtons) {
+        const on = b.dataset.kind === value
+        b.setAttribute('aria-checked', String(on))
+        b.tabIndex = on ? 0 : -1
+      }
+      kindHint.textContent = KIND_HINT[value]
+      err.textContent = ''
+    }
+    // Arrow keys move between the two options (radiogroup pattern).
+    kindGroup.addEventListener('keydown', (ev) => {
+      const e = ev as KeyboardEvent
+      if (!['ArrowLeft', 'ArrowRight', 'ArrowUp', 'ArrowDown'].includes(e.key)) return
+      e.preventDefault()
+      setKind(kind.value === 'canvas' ? 'roster' : 'canvas')
+      kindButtons.find(b => b.dataset.kind === kind.value)?.focus()
+    })
     const input = document.createElement('input')
     input.className = 'p-dialog-input'
     input.maxLength = 40
@@ -103,7 +147,8 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
     cancelBtn.type = 'button'
     cancelBtn.textContent = '取消'
     row.append(okBtn, cancelBtn)
-    panel.append(title, input, err, row)
+    setKind('canvas')
+    panel.append(title, kindGroup, kindHint, input, err, row)
     wrap.appendChild(panel)
     root.appendChild(wrap)
 
@@ -115,25 +160,27 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
     }
     const nameError = (): string | null => {
       const name = input.value.trim()
-      if (name === '' || name.length > 40 || name.includes('/') || /^\d+$/.test(name)) {
-        return '队名需 1..40 字，不含“/”，不为纯数字'
-      }
+      if (name === '' || name.length > 40 || name.includes('/') || name.startsWith('roster:') || (kind.value === 'roster' && name.includes('*')) || /^\d+$/.test(name)) return '队名需 1..40 字，不含“/”、通配符或保留前缀，不为纯数字'
+      if (kind.value === 'roster' && model.getFrame(name) !== undefined) return '同名 canvas 队已存在，不能创建 roster 队'
+      if (kind.value === 'roster' && model.getFrame(rosterFrameName(name)) !== undefined && !d.isRoster(rosterFrameName(name))) return 'roster 框名已被 canvas 或镜像队占用'
+      if (kind.value === 'canvas' && model.getFrame(rosterFrameName(name)) !== undefined) return '同名 roster 队已存在，不能创建 canvas 队'
+      if (kind.value === 'roster' && ids.some(id => model.getNode(id)?.remote === true || !d.joined(id))) return 'roster 仅接受本机已入网的会话'
       return null
     }
     const confirm = (): void => {
       const problem = nameError()
       if (problem !== null) { err.textContent = problem; input.focus(); return }
-      const name = input.value.trim()
+      const name = kind.value === 'roster' ? rosterFrameName(input.value.trim()) : input.value.trim()
       close()
       if (model.getFrame(name) !== undefined) {
         // Duplicate name: host create is idempotent-ok, but the optimistic
         // create-team would WIPE the existing roster and overwrite its saved
         // frame rect. Join instead — same wire result, nothing destroyed.
-        d.notice('info', `已加入现有团队「${name}」`)
+        d.notice('info', `已加入现有团队「${kind.value === 'roster' ? rosterFrameTitle(name) : name}」`)
         d.emit({ type: 'add-member', team: name, ids })
         return
       }
-      d.emit({ type: 'create-team', name, ids, created: true })
+      d.emit({ type: 'create-team', name, ids, created: true, ...(kind.value === 'roster' ? { roster: true } : {}) })
     }
     okBtn.addEventListener('click', confirm)
     cancelBtn.addEventListener('click', close)
@@ -149,7 +196,7 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
       if (e.key === 'Escape') { e.preventDefault(); e.stopPropagation(); close(); return }
       if (e.key !== 'Tab') return
       e.preventDefault()
-      const focusables = Array.from(panel.querySelectorAll<HTMLElement>('input, button'))
+      const focusables = Array.from(panel.querySelectorAll<HTMLElement>('input, select, button:not([tabindex="-1"])'))
       const idx = focusables.indexOf(document.activeElement as HTMLElement)
       const next = e.shiftKey
         ? focusables[(idx - 1 + focusables.length) % focusables.length]
@@ -252,7 +299,7 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
     el.setAttribute('aria-label', '团队操作')
     let items: HTMLButtonElement[] = []
     if (target.kind === 'frame') {
-      items = [menuItem(`解散团队「${target.name}」`, true, () => d.emit({ type: 'remove-team', name: target.name }))]
+      items = [menuItem(`解散团队「${titleOf(target.name)}」`, true, () => d.emit({ type: 'remove-team', name: target.name }))]
     } else {
       const id = target.id
       if (level === 'root') {
@@ -278,13 +325,17 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
         for (const t of d.teams()) {
           if (level === 'join') {
             const already = (model.getNode(id)?.memberships.some(m => m.team === t.name)) ?? true
-            items.push(menuItem(already ? `${t.name}（已加入）` : t.name, !already, () => d.emit({ type: 'add-member', team: t.name, ids: [id] })))
+            const allowed = !d.isRoster(t.name) || (d.joined(id) && model.getNode(id)?.remote !== true)
+            const item = menuItem(already ? `${titleOf(t.name)}（已加入）` : titleOf(t.name), !already && allowed, () => d.emit({ type: 'add-member', team: t.name, ids: [id] }))
+            if (!allowed) item.title = 'roster 只接受本机已入网会话'
+            items.push(item)
           } else if (level === 'leave') {
             const member = (model.getNode(id)?.memberships.some(m => m.team === t.name)) ?? false
-            items.push(menuItem(t.name, member, () => d.emit({ type: 'remove-member', team: t.name, ids: [id] })))
+            items.push(menuItem(titleOf(t.name), member, () => d.emit({ type: 'remove-member', team: t.name, ids: [id] })))
           } else {
             const member = (model.getNode(id)?.memberships.some(m => m.team === t.name)) ?? false
-            items.push(menuItem(t.name, member, () => {
+            if (d.isRoster(t.name)) continue
+            items.push(menuItem(titleOf(t.name), member, () => {
               const current = model.teamMemberIds(t.name)
               const desired = [id, ...current.filter(x => x !== id)]
               d.emit({ type: 'reorder', team: t.name, ops: reorderOps(current, desired) })

package/nexus-stage/src/planning-roster.ts

@@ -0,0 +1,15 @@
+/** Roster frames use an independent layout namespace beside canvas frames. */
+import type { PlanningTeam } from './planning-types'
+
+export const ROSTER_PREFIX = 'roster:'
+export const rosterNameOf = (frame: string): string | undefined => frame.startsWith(ROSTER_PREFIX) ? frame.slice(ROSTER_PREFIX.length) : undefined
+export const rosterFrameName = (name: string): string => ROSTER_PREFIX + name
+export const rosterFrameTitle = (frame: string): string => { const name = rosterNameOf(frame); return name === undefined ? frame : `网络队 · roster · ${name}` }
+export function rosterFrames(rows: readonly { team: string; members: readonly string[] }[], zone: string): PlanningTeam[] {
+  return rows.flatMap(row => {
+    if (zone === '' || !row.team.startsWith(zone + '/') || !Array.isArray(row.members)) return []
+    const name = row.team.slice(zone.length + 1)
+    if (name === '' || name.length > 40 || name.includes('/') || name.startsWith(ROSTER_PREFIX) || name.includes('*')) return []
+    return [{ name: rosterFrameName(name), team: row.team, kind: 'roster' as const, members: row.members.filter(id => typeof id === 'string' && id !== '').map(id => ({ id })) }]
+  })
+}

package/nexus-stage/src/planning-types.ts

@@ -12,7 +12,7 @@ import type { SessionLite, TeamLite } from './world'
 
 /** Minimal session/team shapes consumed here (topology rows satisfy them). */
 export interface PlanningSession extends SessionLite {}
-export interface PlanningTeam extends TeamLite {}
+export interface PlanningTeam extends TeamLite { kind?: 'roster' }
 
 export interface PlanningInput {
   sessions: ReadonlyArray<PlanningSession>