@yeaft/webchat-agent 1.0.298 → 1.0.300

package/local-runtime/server/auth/login.js

@@ -12,12 +12,14 @@ import { generateVerificationCode, maskEmail } from './utils.js';
  * Helper: complete login and return token + sessionKey + role
  */
 export function completeLogin(username, sessionKey, role) {
+  const user = getUserByUsername(username);
   const token = issueSessionToken(username);
   activeSessions.set(token, { username, sessionKey });
   return {
     success: true,
     token,
     sessionKey: encodeKey(sessionKey),
+    userId: user?.id || null,
     role: role === 'admin' ? 'admin' : 'pro',
     needTotpCode: false,
     needTotpSetup: false,

package/local-runtime/server/database.js

@@ -4,6 +4,7 @@ export { userDb } from './db/user-db.js';
 export { invitationDb } from './db/invitation-db.js';
 export { sessionDb } from './db/session-db.js';
 export { yeaftSessionDb } from './db/yeaft-session-db.js';
+export { yeaftProjectDb, YeaftProjectDbError } from './db/yeaft-project-db.js';
 export { sessionUiMetadataDb } from './db/session-ui-metadata-db.js';
 export { messageDb } from './db/message-db.js';
 export { userStatsDb } from './db/user-stats-db.js';

package/local-runtime/server/db/connection.js

@@ -241,6 +241,37 @@ db.exec(`
   );
   CREATE INDEX IF NOT EXISTS idx_session_ui_metadata_user_sort
     ON session_ui_metadata(user_id, pinned DESC, sort_rank ASC);
+
+  -- Projects are user-owned organization metadata. Membership keeps the full
+  -- Agent + Session identity because Session ids are only unique per Agent.
+  CREATE TABLE IF NOT EXISTS yeaft_projects (
+    id TEXT NOT NULL,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    sort_order INTEGER NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (user_id, id)
+  );
+  CREATE TABLE IF NOT EXISTS yeaft_project_sessions (
+    user_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    agent_id TEXT NOT NULL,
+    session_id TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (user_id, agent_id, session_id),
+    FOREIGN KEY (user_id, project_id) REFERENCES yeaft_projects(user_id, id) ON DELETE CASCADE
+  );
+  CREATE INDEX IF NOT EXISTS idx_yeaft_projects_user_sort
+    ON yeaft_projects(user_id, sort_order ASC, created_at ASC);
+  CREATE INDEX IF NOT EXISTS idx_yeaft_project_sessions_project
+    ON yeaft_project_sessions(user_id, project_id, agent_id);
+  CREATE TABLE IF NOT EXISTS yeaft_project_imports (
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    agent_id TEXT NOT NULL,
+    imported_at INTEGER NOT NULL,
+    PRIMARY KEY (user_id, agent_id)
+  );
 `);
 
 try {
@@ -645,6 +676,61 @@ export const stmts = {
     DELETE FROM session_ui_metadata WHERE user_id = ? AND catalog_key = ?
   `),
 
+  // Project organization metadata. Projects are server-owned and may contain
+  // Sessions from multiple Agents; sharing still filters by agent_id.
+  insertYeaftProject: db.prepare(`
+    INSERT INTO yeaft_projects (id, user_id, name, sort_order, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?)
+  `),
+  getYeaftProjectsByUser: db.prepare(`
+    SELECT * FROM yeaft_projects WHERE user_id = ? ORDER BY sort_order ASC, created_at ASC
+  `),
+  getYeaftProjectForUser: db.prepare(`
+    SELECT * FROM yeaft_projects WHERE user_id = ? AND id = ?
+  `),
+  updateYeaftProjectName: db.prepare(`
+    UPDATE yeaft_projects SET name = ?, updated_at = ? WHERE user_id = ? AND id = ?
+  `),
+  deleteYeaftProject: db.prepare(`
+    DELETE FROM yeaft_projects WHERE user_id = ? AND id = ?
+  `),
+  getYeaftProjectMembersByUser: db.prepare(`
+    SELECT * FROM yeaft_project_sessions
+    WHERE user_id = ?
+    ORDER BY created_at ASC, agent_id ASC, session_id ASC
+  `),
+  getYeaftProjectForSession: db.prepare(`
+    SELECT p.* FROM yeaft_projects p
+    JOIN yeaft_project_sessions m
+      ON m.user_id = p.user_id AND m.project_id = p.id
+    WHERE m.user_id = ? AND m.agent_id = ? AND m.session_id = ?
+  `),
+  getYeaftProjectMembersForAgent: db.prepare(`
+    SELECT agent_id, session_id FROM yeaft_project_sessions
+    WHERE user_id = ? AND project_id = ? AND agent_id = ?
+    ORDER BY created_at ASC, session_id ASC
+  `),
+  deleteYeaftProjectSessionMembership: db.prepare(`
+    DELETE FROM yeaft_project_sessions
+    WHERE user_id = ? AND agent_id = ? AND session_id = ?
+  `),
+  insertYeaftProjectSessionMembership: db.prepare(`
+    INSERT INTO yeaft_project_sessions
+      (user_id, project_id, agent_id, session_id, created_at)
+    VALUES (?, ?, ?, ?, ?)
+  `),
+  deleteYeaftProjectMembershipsForSession: db.prepare(`
+    DELETE FROM yeaft_project_sessions
+    WHERE user_id = ? AND agent_id = ? AND session_id = ?
+  `),
+  getYeaftProjectImport: db.prepare(`
+    SELECT imported_at FROM yeaft_project_imports WHERE user_id = ? AND agent_id = ?
+  `),
+  insertYeaftProjectImport: db.prepare(`
+    INSERT OR IGNORE INTO yeaft_project_imports (user_id, agent_id, imported_at)
+    VALUES (?, ?, ?)
+  `),
+
   // Message 操作
   insertMessage: db.prepare(`
     INSERT INTO messages (session_id, role, content, message_type, tool_name, tool_input, created_at, metadata)

package/local-runtime/server/db/yeaft-project-db.js

@@ -0,0 +1,225 @@
+import { randomUUID } from 'crypto';
+import { stmts, transaction } from './connection.js';
+
+export class YeaftProjectDbError extends Error {
+  constructor(code, message) {
+    super(message || code);
+    this.name = 'YeaftProjectDbError';
+    this.code = code;
+  }
+}
+
+function requireUserId(value) {
+  const userId = typeof value === 'string' ? value.trim() : '';
+  if (!userId) throw new YeaftProjectDbError('missing_user', 'User identity is required');
+  return userId;
+}
+
+function requireName(value) {
+  const name = typeof value === 'string' ? value.trim() : '';
+  if (!name) throw new YeaftProjectDbError('invalid_name', 'Project name is required');
+  return name.slice(0, 120);
+}
+
+function requireId(value, code, label) {
+  const id = typeof value === 'string' ? value.trim() : '';
+  if (!id) throw new YeaftProjectDbError(code, `${label} is required`);
+  return id;
+}
+
+function mapProject(row, members = []) {
+  if (!row) return null;
+  return {
+    id: row.id,
+    name: row.name,
+    sortOrder: row.sort_order,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    members: members.map(member => ({
+      agentId: member.agent_id,
+      sessionId: member.session_id,
+    })),
+  };
+}
+
+function requireProject(userId, projectId) {
+  const row = stmts.getYeaftProjectForUser.get(userId, projectId);
+  if (!row) throw new YeaftProjectDbError('not_found', 'Project not found');
+  return row;
+}
+
+export const yeaftProjectDb = {
+  list(userId) {
+    const ownerId = requireUserId(userId);
+    const membersByProject = new Map();
+    for (const member of stmts.getYeaftProjectMembersByUser.all(ownerId)) {
+      if (!membersByProject.has(member.project_id)) membersByProject.set(member.project_id, []);
+      membersByProject.get(member.project_id).push(member);
+    }
+    return stmts.getYeaftProjectsByUser.all(ownerId)
+      .map(row => mapProject(row, membersByProject.get(row.id) || []));
+  },
+
+  listForAgent(userId, agentId) {
+    const targetAgentId = typeof agentId === 'string' ? agentId.trim() : '';
+    return this.list(userId).map(project => ({
+      ...project,
+      sessionIds: targetAgentId
+        ? project.members
+            .filter(member => member.agentId === targetAgentId)
+            .map(member => member.sessionId)
+        : [],
+    }));
+  },
+
+  create(userId, name) {
+    const ownerId = requireUserId(userId);
+    const projects = this.list(ownerId);
+    const now = Date.now();
+    const project = {
+      id: `project-${randomUUID().slice(0, 8)}`,
+      name: requireName(name),
+      sortOrder: projects.reduce((max, row) => Math.max(max, Number(row.sortOrder) || 0), -1) + 1,
+      createdAt: now,
+      updatedAt: now,
+      members: [],
+    };
+    stmts.insertYeaftProject.run(
+      project.id,
+      ownerId,
+      project.name,
+      project.sortOrder,
+      now,
+      now,
+    );
+    return project;
+  },
+
+  rename(userId, projectId, name) {
+    const ownerId = requireUserId(userId);
+    const id = requireId(projectId, 'invalid_project_id', 'Project id');
+    requireProject(ownerId, id);
+    const nextName = requireName(name);
+    stmts.updateYeaftProjectName.run(nextName, Date.now(), ownerId, id);
+    return mapProject(stmts.getYeaftProjectForUser.get(ownerId, id),
+      stmts.getYeaftProjectMembersByUser.all(ownerId).filter(member => member.project_id === id));
+  },
+
+  delete(userId, projectId) {
+    const ownerId = requireUserId(userId);
+    const id = requireId(projectId, 'invalid_project_id', 'Project id');
+    requireProject(ownerId, id);
+    stmts.deleteYeaftProject.run(ownerId, id);
+    return { projectId: id };
+  },
+
+  moveSession(userId, { agentId, sessionId, projectId = null } = {}) {
+    const ownerId = requireUserId(userId);
+    const targetAgentId = requireId(agentId, 'invalid_agent_id', 'Agent id');
+    const targetSessionId = requireId(sessionId, 'invalid_session_id', 'Session id');
+    const targetProjectId = projectId == null || projectId === ''
+      ? null
+      : requireId(projectId, 'invalid_project_id', 'Project id');
+    if (targetProjectId) requireProject(ownerId, targetProjectId);
+
+    transaction(() => {
+      stmts.deleteYeaftProjectSessionMembership.run(ownerId, targetAgentId, targetSessionId);
+      if (targetProjectId) {
+        stmts.insertYeaftProjectSessionMembership.run(
+          ownerId,
+          targetProjectId,
+          targetAgentId,
+          targetSessionId,
+          Date.now(),
+        );
+      }
+    })();
+    return { agentId: targetAgentId, sessionId: targetSessionId, projectId: targetProjectId };
+  },
+
+  reconcileAgentSessions(userId, agentId, sessionIds) {
+    const ownerId = requireUserId(userId);
+    const targetAgentId = requireId(agentId, 'invalid_agent_id', 'Agent id');
+    const currentIds = new Set((Array.isArray(sessionIds) ? sessionIds : [])
+      .filter(id => typeof id === 'string' && id.trim())
+      .map(id => id.trim()));
+    let removed = 0;
+    for (const project of this.list(ownerId)) {
+      for (const member of project.members) {
+        if (member.agentId !== targetAgentId || currentIds.has(member.sessionId)) continue;
+        removed += stmts.deleteYeaftProjectMembershipsForSession.run(
+          ownerId,
+          targetAgentId,
+          member.sessionId,
+        ).changes;
+      }
+    }
+    return removed;
+  },
+
+  removeSession(userId, agentId, sessionId) {
+    const ownerId = requireUserId(userId);
+    const targetAgentId = requireId(agentId, 'invalid_agent_id', 'Agent id');
+    const targetSessionId = requireId(sessionId, 'invalid_session_id', 'Session id');
+    return stmts.deleteYeaftProjectMembershipsForSession.run(
+      ownerId,
+      targetAgentId,
+      targetSessionId,
+    ).changes > 0;
+  },
+
+  importLegacyProjects(userId, agentId, projects, sessionExists = () => true) {
+    const ownerId = requireUserId(userId);
+    const targetAgentId = requireId(agentId, 'invalid_agent_id', 'Agent id');
+    if (stmts.getYeaftProjectImport.get(ownerId, targetAgentId)) return false;
+    if (!Array.isArray(projects)) return false;
+    const rows = projects;
+    transaction(() => {
+      const existingProjects = this.list(ownerId);
+      const usedNames = new Set(existingProjects.map(project => project.name));
+      let sortOrder = existingProjects.length;
+      for (const row of rows) {
+        const baseName = typeof row?.name === 'string' ? row.name.trim() : '';
+        if (!baseName) continue;
+        let name = baseName;
+        for (let suffix = 2; usedNames.has(name); suffix += 1) name = `${baseName} ${suffix}`;
+        const projectId = `project-${randomUUID().slice(0, 8)}`;
+        const now = Date.now();
+        stmts.insertYeaftProject.run(projectId, ownerId, name.slice(0, 120), sortOrder, now, now);
+        sortOrder += 1;
+        usedNames.add(name);
+        for (const rawSessionId of Array.isArray(row.sessionIds) ? row.sessionIds : []) {
+          const sessionId = typeof rawSessionId === 'string' ? rawSessionId.trim() : '';
+          if (!sessionId || !sessionExists(sessionId)) continue;
+          stmts.deleteYeaftProjectSessionMembership.run(ownerId, targetAgentId, sessionId);
+          stmts.insertYeaftProjectSessionMembership.run(
+            ownerId,
+            projectId,
+            targetAgentId,
+            sessionId,
+            now,
+          );
+        }
+      }
+      stmts.insertYeaftProjectImport.run(ownerId, targetAgentId, Date.now());
+    })();
+    return true;
+  },
+
+  contextForSession(userId, agentId, sessionId) {
+    const ownerId = requireUserId(userId);
+    const targetAgentId = requireId(agentId, 'invalid_agent_id', 'Agent id');
+    const targetSessionId = requireId(sessionId, 'invalid_session_id', 'Session id');
+    const project = stmts.getYeaftProjectForSession.get(ownerId, targetAgentId, targetSessionId);
+    if (!project) return null;
+    const sameAgentMembers = stmts.getYeaftProjectMembersForAgent
+      .all(ownerId, project.id, targetAgentId)
+      .map(row => row.session_id)
+      .filter(id => id && id !== targetSessionId);
+    return {
+      projectId: project.id,
+      projectName: project.name,
+      sessionIds: sameAgentMembers,
+    };
+  },
+};

package/local-runtime/server/handlers/agent-output.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'crypto';
-import { messageDb, yeaftSessionDb } from '../database.js';
+import { messageDb, yeaftProjectDb, yeaftSessionDb } from '../database.js';
+import { transaction } from '../db/connection.js';
 import { broadcastAgentList, broadcastSessionCatalog, forwardToClients, sendToAgent, sendToWebClient } from '../ws-utils.js';
 import { webClients, previewFiles } from '../context.js';
 import { CONFIG } from '../config.js';
@@ -33,6 +34,19 @@ export function decorateYeaftSessionsWithPinned(agentId, sessions) {
   });
 }
 
+function reconcileAuthoritativeSessionSnapshot(ownerId, agentId, sessions) {
+  const rows = Array.isArray(sessions) ? sessions : [];
+  transaction(() => {
+    yeaftSessionDb.reconcileFromSnapshot(ownerId, agentId, rows);
+    yeaftProjectDb.reconcileAgentSessions(
+      ownerId,
+      agentId,
+      rows.map(row => row?.id).filter(Boolean),
+    );
+  })();
+  return rows;
+}
+
 function syncYeaftSessionMetadata(agentId, agent, event) {
   if (!event || typeof event !== 'object') return event;
   const ownerId = agent?.ownerId || null;
@@ -40,7 +54,15 @@ function syncYeaftSessionMetadata(agentId, agent, event) {
   if (event.type === 'session_list_updated') {
     const rows = Array.isArray(event.sessions) ? event.sessions : [];
     try {
-      if (ownerId) yeaftSessionDb.reconcileFromSnapshot(ownerId, agentId, rows);
+      if (ownerId) {
+        reconcileAuthoritativeSessionSnapshot(ownerId, agentId, rows);
+        yeaftProjectDb.importLegacyProjects(
+          ownerId,
+          agentId,
+          event.projects,
+          sessionId => rows.some(row => row?.id === sessionId),
+        );
+      }
     } catch (e) {
       console.warn(`[Server] yeaft session persist failed for agent ${agentId}:`, e?.message || e);
     }
@@ -52,7 +74,7 @@ function syncYeaftSessionMetadata(agentId, agent, event) {
   const sessionId = event.sessionId;
   if (event.ok && op === 'list' && Array.isArray(event.sessions)) {
     try {
-      if (ownerId) yeaftSessionDb.reconcileFromSnapshot(ownerId, agentId, event.sessions);
+      if (ownerId) reconcileAuthoritativeSessionSnapshot(ownerId, agentId, event.sessions);
     } catch (e) {
       console.warn(`[Server] yeaft session list persist failed for agent ${agentId}:`, e?.message || e);
     }
@@ -63,6 +85,7 @@ function syncYeaftSessionMetadata(agentId, agent, event) {
   if (op === 'archive') {
     try {
       yeaftSessionDb.setArchivedForAgent(ownerId, agentId, sessionId, true);
+      yeaftProjectDb.removeSession(ownerId, agentId, sessionId);
     } catch (e) {
       console.warn('[Server] Yeaft Session metadata archive failed:', e?.message || e);
     }
@@ -71,6 +94,7 @@ function syncYeaftSessionMetadata(agentId, agent, event) {
 
   try {
     yeaftSessionDb.deleteForAgent(ownerId, agentId, sessionId);
+    yeaftProjectDb.removeSession(ownerId, agentId, sessionId);
   } catch (e) {
     console.warn('[Server] Yeaft Session metadata cleanup failed:', e?.message || e);
   }
@@ -527,7 +551,14 @@ export async function handleAgentOutput(agentId, agent, msg) {
     case 'yeaft_session_output':
     case 'session_output': {
       const data = hydrateInlinePreviewData(msg.data);
-      const event = syncYeaftSessionMetadata(agentId, agent, msg.event);
+      let event = syncYeaftSessionMetadata(agentId, agent, msg.event);
+      if ((event?.type === 'session_list_updated' || event?.type === 'session_crud_result') && agent.ownerId) {
+        event = {
+          ...event,
+          projects: yeaftProjectDb.listForAgent(agent.ownerId, agentId),
+          projectsAuthoritative: true,
+        };
+      }
       let catalogChanged = false;
       if (event?.type === 'yeaft_status') {
         agent.yeaftStatus = event;
@@ -850,6 +881,8 @@ export async function handleAgentOutput(agentId, agent, msg) {
             type: msg.type,
             agentId: agentId,
             sessions: decoratedSessions,
+            projects: agent.ownerId ? yeaftProjectDb.listForAgent(agent.ownerId, agentId) : [],
+            projectsAuthoritative: true,
           });
         }
       }
@@ -907,7 +940,10 @@ export async function handleAgentOutput(agentId, agent, msg) {
       // probes too: entering Yeaft asks each connected agent for its opened
       // sessions, and that response must carry persisted server-side pin
       // state before it hits the web store.
-      const outboundMsg = syncYeaftSessionMetadata(agentId, agent, msg);
+      const syncedMsg = syncYeaftSessionMetadata(agentId, agent, msg);
+      const outboundMsg = agent.ownerId
+        ? { ...syncedMsg, projects: yeaftProjectDb.listForAgent(agent.ownerId, agentId), projectsAuthoritative: true }
+        : { ...syncedMsg, projects: [], projectsAuthoritative: true };
       // CRUD acknowledgements are not authoritative catalog snapshots. The
       // agent emits session_list_updated after mutations; broadcast only after
       // that reconciliation so create/rename cannot briefly project stale data.

package/local-runtime/server/handlers/client-conversation.js

@@ -4,6 +4,7 @@ import {
   sessionDb,
   messageDb,
   userDb,
+  yeaftProjectDb,
   yeaftSessionDb,
   sessionUiMetadataDb,
 } from '../database.js';
@@ -1277,6 +1278,65 @@ export async function handleClientConversation(clientId, client, msg, checkAgent
       break;
     }
 
+    case 'yeaft_project_mutation': {
+      const requestId = typeof msg.requestId === 'string' ? msg.requestId : null;
+      const op = msg.op;
+      const respond = async (payload) => {
+        await sendToWebClient(client, {
+          type: 'yeaft_output',
+          agentId: msg.targetAgentId || msg.agentId || client.currentAgent || null,
+          event: {
+            type: 'project_mutation_result',
+            requestId,
+            op,
+            projectsAuthoritative: true,
+            ...payload,
+          },
+        });
+      };
+      try {
+        if (!client.userId) throw new Error('User identity is required');
+        let result = null;
+        if (op === 'create') result = yeaftProjectDb.create(client.userId, msg.name);
+        else if (op === 'rename') result = yeaftProjectDb.rename(client.userId, msg.projectId, msg.name);
+        else if (op === 'delete') result = yeaftProjectDb.delete(client.userId, msg.projectId);
+        else if (op === 'move_session') {
+          const agentId = msg.targetAgentId || msg.agentId;
+          const sessionId = typeof msg.sessionId === 'string' ? msg.sessionId.trim() : '';
+          if (!agentId || !sessionId) throw new Error('Agent and Session identities are required');
+          const targetSession = yeaftSessionDb.getForAgent(client.userId, agentId, sessionId);
+          if (!targetSession) throw new Error('Session not found');
+          if (targetSession.isArchived) {
+            const error = new Error('Archived Sessions cannot be moved to Projects');
+            error.code = 'session_archived';
+            throw error;
+          }
+          result = yeaftProjectDb.moveSession(client.userId, {
+            agentId,
+            sessionId,
+            projectId: msg.projectId || null,
+          });
+        } else {
+          throw new Error('Unknown Project operation');
+        }
+        const responseAgentId = msg.targetAgentId || msg.agentId || client.currentAgent || null;
+        const projects = responseAgentId
+          ? yeaftProjectDb.listForAgent(client.userId, responseAgentId)
+          : yeaftProjectDb.list(client.userId);
+        await respond({ ok: true, result, projects });
+        await broadcastSessionCatalog(client.userId);
+      } catch (err) {
+        await respond({
+          ok: false,
+          error: {
+            code: err?.code || 'project_mutation_failed',
+            message: err?.message || String(err),
+          },
+        });
+      }
+      break;
+    }
+
     case 'yeaft_merge_thread':
     case 'unify_merge_thread': {
       const mergeAgentId = msg.agentId || client.currentAgent;
@@ -1404,6 +1464,19 @@ export async function handleClientConversation(clientId, client, msg, checkAgent
         rest.type = relayType;
         if (rest.type === 'yeaft_session_send' || rest.type === 'yeaft_session_chat') {
           trackUserTurn(client.userId, Buffer.byteLength(JSON.stringify(msg)));
+          const sessionId = typeof rest.sessionId === 'string' ? rest.sessionId.trim() : '';
+          if (sessionId && client.userId) {
+            const projectContext = yeaftProjectDb.contextForSession(
+              client.userId,
+              relayAgentId,
+              sessionId,
+            );
+            rest.projectContext = projectContext || {
+              projectId: null,
+              projectName: null,
+              sessionIds: [],
+            };
+          }
         }
 
         if (rest.type === 'yeaft_session_chat' && !rest.id) {

package/local-runtime/server/routes/auth-routes.js

@@ -239,7 +239,13 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
     if (!r) return res.json({ status: 'pending' });
     if (r.kind === 'login') {
       setSessionCookie(req, res, r.token);
-      return res.json({ status: 'login', token: r.token, sessionKey: r.sessionKey, role: r.role });
+      return res.json({
+        status: 'login',
+        token: r.token,
+        sessionKey: r.sessionKey,
+        userId: r.userId,
+        role: r.role,
+      });
     }
     if (r.kind === 'bind') {
       return res.json({ status: 'bind', provider: r.provider });
@@ -278,6 +284,7 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
         const params = new URLSearchParams({
           token: result.token,
           sessionKey: result.sessionKey,
+          userId: result.userId || '',
           role: result.role
         });
         return res.redirect(`/#/sso-complete?${params.toString()}`);

package/local-runtime/server/routes/user-routes.js

@@ -57,6 +57,7 @@ export function registerUserRoutes(app, { requireAuth, requireAdmin }) {
         return res.status(404).json({ error: 'User not found' });
       }
       res.json({
+        userId: user.id,
         username: user.username,
         displayName: user.display_name,
         email: user.email,

package/local-runtime/server/ws-utils.js

@@ -1,7 +1,7 @@
 import { WebSocket } from 'ws';
 import { CONFIG } from './config.js';
 import { encrypt, decrypt, isEncrypted, encodeKey } from './encryption.js';
-import { sessionDb, yeaftSessionDb, sessionUiMetadataDb } from './database.js';
+import { sessionDb, yeaftProjectDb, yeaftSessionDb, sessionUiMetadataDb } from './database.js';
 import { projectSessionCatalog } from './session-catalog.js';
 import { agents, webClients, directoryCache, DIR_CACHE_TTL, DIR_CACHE_MAX_SIZE, trackMessageBytesSent } from './context.js';
 
@@ -126,6 +126,8 @@ export async function broadcastSessionCatalog(userId) {
       await sendToWebClient(client, {
         type: 'session_catalog_snapshot',
         catalog: buildSessionCatalog(userId, client.role),
+        projects: yeaftProjectDb.list(userId),
+        projectsAuthoritative: true,
       });
     } catch (e) {
       console.warn('[Server] session catalog projection failed:', e?.message || e);
@@ -187,6 +189,8 @@ export async function broadcastAgentList() {
         await sendToWebClient(client, {
           type: 'session_catalog_snapshot',
           catalog: buildSessionCatalog(client.userId, client.role),
+          projects: yeaftProjectDb.list(client.userId),
+          projectsAuthoritative: true,
         });
       } catch (e) {
         console.warn('[Server] session catalog projection failed:', e?.message || e);

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.298"}
+{"version":"1.0.300"}