agentworkshop 0.7.8 → 0.7.11

package/app/pages/dcw/index.vue

@@ -69,7 +69,7 @@ async function doCreateLine(): Promise<void> {
     createOpen.value = false
   }
   catch (err) {
-    createError.value = err instanceof Error ? err.message : String(err)
+    createError.value = apiErrorMessage(err)
   }
   finally {
     createSaving.value = false
@@ -90,7 +90,7 @@ async function quickStart(card: LineCard): Promise<void> {
     await dcw.startLine(card.line.id, rid)
   }
   catch (err) {
-    quickErr.value = err instanceof Error ? err.message : String(err)
+    quickErr.value = apiErrorMessage(err)
   }
   finally {
     quickBusy.value = ''
@@ -104,7 +104,7 @@ async function quickStop(card: LineCard): Promise<void> {
     await dcw.stopLine(card.line.id)
   }
   catch (err) {
-    quickErr.value = err instanceof Error ? err.message : String(err)
+    quickErr.value = apiErrorMessage(err)
   }
   finally {
     quickBusy.value = ''
@@ -140,7 +140,7 @@ async function doDeleteLine(): Promise<void> {
     delOpen.value = false
   }
   catch (err) {
-    delErr.value = err instanceof Error ? err.message : String(err)
+    delErr.value = apiErrorMessage(err)
   }
   finally {
     delBusy.value = false
@@ -174,7 +174,7 @@ async function doEditLine(): Promise<void> {
     editOpen.value = false
   }
   catch (err) {
-    editError.value = err instanceof Error ? err.message : String(err)
+    editError.value = apiErrorMessage(err)
   }
   finally {
     editSaving.value = false
@@ -218,7 +218,7 @@ async function doCreateTemplate(): Promise<void> {
     tplForm.max = ''
   }
   catch (err) {
-    tplError.value = err instanceof Error ? err.message : String(err)
+    tplError.value = apiErrorMessage(err)
   }
 }
 
@@ -236,7 +236,7 @@ async function doRemoveTemplate(key: string): Promise<void> {
     if (i >= 0) dcw.templates.splice(i, 1)
   }
   catch (err) {
-    tplError.value = err instanceof Error ? err.message : String(err)
+    tplError.value = apiErrorMessage(err)
   }
 }
 

package/app/pages/logs/index.vue

@@ -436,7 +436,7 @@ async function submitManual(): Promise<void> {
     doQuery()
   }
   catch (err) {
-    message.error(err instanceof Error ? err.message : String(err))
+    message.error(apiErrorMessage(err))
   }
 }
 

package/app/pages/permissions/index.vue

@@ -0,0 +1,327 @@
+<script setup lang="ts">
+/**
+ * 权限管理(admin 专属)—— 用户 × 产线授权矩阵。
+ * 三态:无权(none,后端不返回该产线数据)/ 仅查看(readonly,数采只读)/ 可操控(operate,数采+数控全量)。
+ * 用户详情抽屉含:基本信息、该用户创建的 Channel、产线授权矩阵(逐线三态选择,批量保存)。
+ */
+import { computed, onMounted, reactive, ref } from 'vue'
+import { message } from 'ant-design-vue'
+import { useUserStore } from '~/stores/workshop/user'
+
+const { t } = useI18n()
+const userStore = useUserStore()
+
+interface LineView { id: string, name: string }
+interface GrantRow { lineId: string, mode: string, grantedBy: string | null, grantedAt: string }
+interface UserRow {
+  id: string
+  name: string
+  email: string
+  role: string
+  status: string
+  createdAt: string
+  channels: Array<{ id: string, name: string, createdAt: string }>
+  grants: GrantRow[]
+}
+
+const lines = ref<LineView[]>([])
+const users = ref<UserRow[]>([])
+const loading = ref(false)
+const keyword = ref('')
+const drawerOpen = ref(false)
+const current = ref<UserRow | null>(null)
+// lineId → 'none' | 'readonly' | 'operate'
+const draft = reactive<Record<string, string>>({})
+const saving = ref(false)
+
+function authHeaders(): Record<string, string> {
+  const token = (userStore as { token?: string }).token
+  return token ? { authorization: `Bearer ${token}` } : {}
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const d = await $fetch<{ code: number, data?: { lines: LineView[], users: UserRow[] } }>('/api/workshop/permissions', { headers: authHeaders() })
+    if (d.code !== 0 || !d.data) throw new Error('load fail')
+    lines.value = d.data.lines ?? []
+    users.value = d.data.users ?? []
+  }
+  catch (err) {
+    message.error(apiErrorMessage(err, t('permissions.loadFail')))
+  }
+  finally {
+    loading.value = false
+  }
+}
+
+const filteredUsers = computed(() => {
+  const kw = keyword.value.trim().toLowerCase()
+  if (!kw) return users.value
+  return users.value.filter(u => `${u.name} ${u.email}`.toLowerCase().includes(kw))
+})
+
+function openDetail(u: UserRow) {
+  current.value = u
+  draftClear(u)
+  drawerOpen.value = true
+}
+
+function draftClear(u: UserRow) {
+  for (const k of Object.keys(draft)) Reflect.deleteProperty(draft, k)
+  for (const l of lines.value) {
+    const g = u.grants.find(x => x.lineId === l.id)
+    draft[l.id] = (g?.mode === 'readonly' || g?.mode === 'operate') ? g.mode : 'none'
+  }
+}
+
+const dirtyCount = computed(() => {
+  if (!current.value) return 0
+  let n = 0
+  for (const l of lines.value) {
+    const g = current.value.grants.find(x => x.lineId === l.id)
+    const cur = (g?.mode === 'readonly' || g?.mode === 'operate') ? g.mode : 'none'
+    if ((draft[l.id] ?? 'none') !== cur) n++
+  }
+  return n
+})
+
+async function save() {
+  if (!current.value) return
+  saving.value = true
+  try {
+    const grants = lines.value
+      .filter(l => (draft[l.id] ?? 'none') !== 'none')
+      .map(l => ({ lineId: l.id, mode: draft[l.id] }))
+    const revoked = lines.value
+      .filter(l => (draft[l.id] ?? 'none') === 'none' && current.value!.grants.some(g => g.lineId === l.id))
+      .map(l => ({ lineId: l.id, mode: null }))
+    const d = await $fetch<{ code: number, data?: { grants: GrantRow[] } }>('/api/workshop/permissions', {
+      method: 'PUT',
+      headers: authHeaders(),
+      body: { userId: current.value.id, grants: [...grants, ...revoked] },
+    })
+    if (d.code !== 0 || !d.data) throw new Error('save fail')
+    current.value.grants = d.data.grants
+    const u = users.value.find(x => x.id === current.value?.id)
+    if (u) u.grants = d.data.grants
+    message.success(t('permissions.saved', { n: grants.length + revoked.length }))
+  }
+  catch (err) {
+    message.error(apiErrorMessage(err, t('permissions.saveFail')))
+  }
+  finally {
+    saving.value = false
+  }
+}
+
+function modeTag(mode: string): string {
+  return mode === 'operate' ? t('permissions.operate') : mode === 'readonly' ? t('permissions.readonly') : t('permissions.none')
+}
+
+// admin 专属页:非 admin 直接回仪表盘(后端 API 亦有 admin 拦截)
+watch(() => userStore.isLoggedIn, (ok) => {
+  if (ok && !userStore.isAdmin) navigateTo('/')
+}, { immediate: true })
+
+onMounted(load)
+</script>
+
+<template>
+  <div class="perm-page">
+    <header class="pg-head">
+      <div>
+        <h1 class="pg-title">
+          {{ $t('permissions.title') }}
+        </h1>
+        <p class="pg-sub">
+          {{ $t('permissions.subtitle') }}
+        </p>
+      </div>
+      <a-input-search
+        v-model:value="keyword"
+        :placeholder="$t('permissions.search')"
+        style="max-width: 260px"
+        allow-clear
+      />
+    </header>
+
+    <a-table
+      :data-source="filteredUsers"
+      :loading="loading"
+      row-key="id"
+      size="middle"
+      :pagination="{ pageSize: 12, showSizeChanger: false }"
+    >
+      <a-table-column
+        :title="$t('permissions.colUser')"
+        data-index="name"
+      >
+        <template #default="{ record }">
+          <a @click.prevent="openDetail(record)">{{ record.name }}</a>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colEmail')"
+        data-index="email"
+      />
+      <a-table-column
+        :title="$t('permissions.colRole')"
+        data-index="role"
+      >
+        <template #default="{ record }">
+          <a-tag :color="record.role === 'admin' ? 'green' : record.role === 'editor' ? 'blue' : 'default'">
+            {{ record.role }}
+          </a-tag>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colStatus')"
+        data-index="status"
+      >
+        <template #default="{ record }">
+          <a-tag :color="record.status === 'active' ? 'cyan' : 'red'">
+            {{ record.status === 'active' ? $t('permissions.active') : record.status }}
+          </a-tag>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colChannels')"
+        data-index="channels"
+      >
+        <template #default="{ record }">
+          {{ record.channels.length }}
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colGrants')"
+        data-index="grants"
+      >
+        <template #default="{ record }">
+          <a-tag
+            v-for="g in record.grants"
+            :key="g.lineId"
+            style="margin-bottom: 2px"
+          >
+            {{ (lines.find(l => l.id === g.lineId)?.name ?? g.lineId).slice(0, 14) }} · {{ modeTag(g.mode) }}
+          </a-tag>
+          <span
+            v-if="!record.grants.length"
+            class="dim"
+          >—</span>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colOps')"
+        :width="90"
+      >
+        <template #default="{ record }">
+          <a-button
+            size="small"
+            @click="openDetail(record)"
+          >
+            {{ $t('permissions.manage') }}
+          </a-button>
+        </template>
+      </a-table-column>
+    </a-table>
+
+    <a-drawer
+      v-model:open="drawerOpen"
+      :title="current ? `${current.name} · ${$t('permissions.detail')}` : ''"
+      width="560"
+    >
+      <template v-if="current">
+        <h4 class="sec">
+          {{ $t('permissions.secProfile') }}
+        </h4>
+        <dl class="detail">
+          <dt>email</dt><dd>{{ current.email }}</dd>
+          <dt>role</dt><dd>{{ current.role }}</dd>
+          <dt>status</dt><dd>{{ current.status }}</dd>
+          <dt>created</dt><dd>{{ current.createdAt }}</dd>
+        </dl>
+
+        <h4 class="sec">
+          {{ $t('permissions.secChannels') }}({{ current.channels.length }})
+        </h4>
+        <div
+          v-if="current.channels.length"
+          class="ch-list"
+        >
+          <code
+            v-for="c in current.channels"
+            :key="c.id"
+          >{{ c.name || c.id.slice(0, 8) }}</code>
+        </div>
+        <p
+          v-else
+          class="dim"
+        >
+          {{ $t('permissions.noChannels') }}
+        </p>
+
+        <h4 class="sec">
+          {{ $t('permissions.secMatrix') }}
+          <a-button
+            type="primary"
+            size="small"
+            :loading="saving"
+            :disabled="dirtyCount === 0"
+            style="margin-left: 12px"
+            @click="save"
+          >
+            {{ $t('permissions.save', { n: dirtyCount }) }}
+          </a-button>
+        </h4>
+        <p class="hint">
+          {{ $t('permissions.matrixHint') }}
+        </p>
+        <div class="matrix">
+          <div
+            v-for="l in lines"
+            :key="l.id"
+            class="row"
+          >
+            <span
+              class="line-name"
+              :title="l.id"
+            >{{ l.name }}</span>
+            <a-radio-group
+              v-model:value="draft[l.id]"
+              size="small"
+            >
+              <a-radio-button value="none">
+                {{ $t('permissions.none') }}
+              </a-radio-button>
+              <a-radio-button value="readonly">
+                {{ $t('permissions.readonly') }}
+              </a-radio-button>
+              <a-radio-button value="operate">
+                {{ $t('permissions.operate') }}
+              </a-radio-button>
+            </a-radio-group>
+          </div>
+        </div>
+      </template>
+    </a-drawer>
+  </div>
+</template>
+
+<style scoped lang="css">
+.perm-page { max-width: 1180px; margin: 0 auto; padding: 24px 20px 48px; }
+.pg-head { display: flex; align-items: flex-end; justify-content: space-between; gap: 16px; margin-bottom: 18px; }
+.pg-title { margin: 0; font-size: 22px; font-weight: 700; letter-spacing: .5px; }
+.pg-sub { margin: 4px 0 0; opacity: .6; font-size: 12px; }
+.dim { opacity: .45; }
+.sec { margin: 20px 0 8px; font-size: 13px; font-weight: 700; }
+.detail dt { margin-top: 8px; font-size: 11px; opacity: .5; }
+.detail dd { margin: 2px 0 0; font-family: ui-monospace, monospace; font-size: 12px; }
+.ch-list { display: flex; flex-wrap: wrap; gap: 6px; }
+.ch-list code { padding: 2px 8px; border: 1px solid rgba(128, 152, 199, .3); border-radius: 6px; font-size: 11px; }
+.hint { font-size: 11px; opacity: .55; margin: 4px 0 10px; }
+.matrix { display: flex; flex-direction: column; gap: 8px; }
+.matrix .row { display: flex; align-items: center; justify-content: space-between; gap: 12px;
+  padding: 8px 12px; border: 1px solid var(--aw-border, rgba(128, 152, 199, .25)); border-radius: 10px; }
+.line-name { font-size: 13px; font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+</style>

package/app/pages/plugins/index.vue

@@ -17,6 +17,8 @@ interface PluginInfo {
   version: string
   description: string
   scope: 'project' | 'user'
+  /** 内置示例插件(随项目检出提供);false/undefined = 用户级扩展 */
+  builtin?: boolean
   enabled: boolean
   hasClient: boolean
   routes: PluginRoute[]
@@ -43,8 +45,8 @@ async function load() {
     plugins.value = d.plugins ?? []
     failures.value = d.failures ?? []
   }
-  catch {
-    message.error(t('plugins.enableFail'))
+  catch (err) {
+    message.error(apiErrorMessage(err, t('plugins.loadFail')))
   }
   finally {
     loading.value = false
@@ -54,13 +56,15 @@ async function load() {
 async function toggle(p: PluginInfo) {
   busyName.value = p.name
   try {
-    const d = await $fetch<{ enabled: boolean }>(`/api/workshop/plugins/${p.name}/${p.enabled ? 'disable' : 'enable'}`, { method: 'POST', headers: authHeaders() })
-    p.enabled = d.enabled
-    message.success(`${p.name} · ${d.enabled ? t('plugins.enabled') : t('plugins.disabled')}`)
+    const d = await $fetch<{ code: number, data?: { enabled: boolean } }>(`/api/workshop/plugins/${p.name}/${p.enabled ? 'disable' : 'enable'}`, { method: 'POST', headers: authHeaders() })
+    if (d.code !== 0 || !d.data) throw new Error(t('plugins.enableFail'))
+    p.enabled = d.data.enabled
+    message.success(`${p.name} · ${d.data.enabled ? t('plugins.enabled') : t('plugins.disabled')}`)
     setTimeout(load, 800) // 热重载完成后刷新路由/客户端状态
   }
   catch (err) {
-    message.error(`${t('plugins.enableFail')}: ${(err as Error)?.message ?? ''}`)
+    // 403 权限不足/404 插件不存在等:信封 message 直出人话,不再渲染码式文本
+    message.error(apiErrorMessage(err, t('plugins.enableFail')))
   }
   finally {
     busyName.value = ''
@@ -189,6 +193,9 @@ onMounted(load)
         <dl class="detail">
           <dt>version</dt><dd>{{ current.version }}</dd>
           <dt>scope</dt><dd>{{ scopeLabel(current.scope) }}</dd>
+          <dd class="scope-hint">
+            {{ current.scope === 'project' ? $t('plugins.scopeBuiltinHint') : $t('plugins.scopeUserHint') }}
+          </dd>
           <dt>enabled</dt><dd>{{ current.enabled }}</dd>
           <dt>client</dt><dd>{{ current.hasClient ? '✓' : '—' }}</dd>
           <dt v-if="current.error">
@@ -252,6 +259,7 @@ onMounted(load)
 .card-routes code { font-size: 10px; opacity: .65; }
 .detail dt { margin-top: 10px; font-size: 11px; opacity: .5; }
 .detail dd { margin: 2px 0 0; font-family: ui-monospace, monospace; font-size: 12px; }
+.detail .scope-hint { font-family: inherit; font-size: 11px; opacity: .6; margin-bottom: 6px; }
 .detail-route { display: block; font-size: 11px; opacity: .8; margin-bottom: 4px; }
 h4 { margin: 16px 0 6px; }
 .dim { opacity: .45; }

package/app/pages/settings.vue

@@ -60,7 +60,9 @@ async function saveRuntime() {
 async function resetRuntimeKey(key: string) {
   try {
     await rcStore.patch({ [key]: null })
-    syncRuntimeDraft()
+    // 只收敛被重置的键:整表 sync 会静默丢弃用户其他未保存编辑
+    dirtyKeys.value.delete(key)
+    draft.value[key] = rcStore.effective[key]
     runtimeNotice.value = { type: 'success', text: t('settings.runtime.keyReset', { key }) }
   }
   catch (e) {
@@ -80,7 +82,7 @@ async function resetAllRuntime() {
 }
 
 function groupLabel(group: string): string {
-  const known: Record<string, string> = { server: t('settings.runtime.groupServer'), app: t('settings.runtime.groupApp'), api: 'API', theme: t('settings.runtime.groupTheme'), i18n: t('settings.runtime.groupI18n'), security: t('settings.runtime.groupSecurity'), daq: t('settings.runtime.groupDaq'), memory: t('settings.runtime.groupMemory'), omp: t('settings.runtime.groupOmp'), dcw: t('settings.runtime.groupDcw'), workshop: t('settings.runtime.groupWorkshop'), backup: t('settings.runtime.groupBackup'), retention: t('settings.runtime.groupRetention'), log: t('settings.runtime.groupLog') }
+  const known: Record<string, string> = { server: t('settings.runtime.groupServer'), app: t('settings.runtime.groupApp'), api: t('settings.runtime.groupApi'), theme: t('settings.runtime.groupTheme'), i18n: t('settings.runtime.groupI18n'), security: t('settings.runtime.groupSecurity'), daq: t('settings.runtime.groupDaq'), memory: t('settings.runtime.groupMemory'), omp: t('settings.runtime.groupOmp'), harness: t('settings.runtime.groupHarness'), dcw: t('settings.runtime.groupDcw'), workshop: t('settings.runtime.groupWorkshop'), backup: t('settings.runtime.groupBackup'), retention: t('settings.runtime.groupRetention'), log: t('settings.runtime.groupLog') }
   return known[group] ?? group
 }
 function sourceClass(s: string): string {

package/app/pages/tokens.vue

@@ -62,7 +62,7 @@ const doCreate = async (): Promise<void> => {
     await load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     createLoading.value = false
@@ -84,7 +84,7 @@ const doRename = async (): Promise<void> => {
     message.success(tt('tokens.k3n9aij015'))
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     renameLoading.value = false
@@ -103,7 +103,7 @@ const doRevoke = (t: { id?: string }): void => {
       await load()
     }
     catch (e) {
-      message.error(e instanceof Error ? e.message : String(e))
+      message.error(apiErrorMessage(e))
     }
   })()
 }

package/app/pages/workshop/agents.vue

@@ -136,7 +136,7 @@ const save = async (): Promise<void> => {
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
 }
 const remove = async (t: AgentTemplateDto): Promise<void> => {
@@ -158,7 +158,7 @@ const toggleVisibility = async (t: AgentTemplateDto, pub: boolean): Promise<void
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
 }
 

package/app/pages/workshop/channel-templates.vue

@@ -104,7 +104,7 @@ const create = async (): Promise<void> => {
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
 }
 
@@ -116,7 +116,7 @@ const toggleVisibility = async (t: ChannelTemplateDto, pub: boolean): Promise<vo
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
 }
 
@@ -130,7 +130,7 @@ const instantiate = async (t: ChannelTemplateDto): Promise<void> => {
     message.success(tt('ctpl.kefkfnl030', { p0: t.name, p1: data?.agentCount ?? 0 }))
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     instantiating.value = null

package/app/pages/workshop/index.vue

@@ -63,7 +63,7 @@ const doRegister = async (): Promise<void> => {
     authPassword.value = ''
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     authLoading.value = false
@@ -82,7 +82,7 @@ const doLogin = async (): Promise<void> => {
     authPassword.value = ''
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     authLoading.value = false
@@ -97,7 +97,7 @@ const doLoginWithToken = async (): Promise<void> => {
     authTokenInput.value = ''
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     authLoading.value = false
@@ -157,7 +157,7 @@ const create = async (): Promise<void> => {
     navigateTo(`/workshop/w/${ws.id}`)
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     createLoading.value = false

package/app/pages/workshop/teams.vue

@@ -79,7 +79,7 @@ const toggleVisibility = async (team: TeamDto, pub: boolean): Promise<void> => {
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
 }
 
@@ -105,7 +105,7 @@ const addMember = async (): Promise<void> => {
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
 }
 const removeMember = async (team: TeamDto, templateId: string): Promise<void> => {
@@ -135,7 +135,7 @@ const deploy = async (): Promise<void> => {
     deployOpen.value = false
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     deploying.value = false

package/app/plugins/http.ts

@@ -5,6 +5,9 @@ import axios, {
   type InternalAxiosRequestConfig,
 } from 'axios'
 import { message } from 'ant-design-vue'
+import { useUserStore } from '~/stores/workshop/user'
+
+const g = globalThis as typeof globalThis & { __awShown401?: boolean }
 
 /**
  * HTTP 请求层（基于 axios 封装）
@@ -12,7 +15,7 @@ import { message } from 'ant-design-vue'
  * - 统一请求/响应拦截：注入 token、统一错误提示
  * - 通过 nuxt provide 暴露 $http，并提供 useHttp 组合式入口
  */
-export default defineNuxtPlugin(() => {
+export default defineNuxtPlugin((nuxtApp) => {
   const config = useRuntimeConfig().public
 
   const instance: AxiosInstance = axios.create({
@@ -40,7 +43,20 @@ export default defineNuxtPlugin(() => {
       const msg = error?.response?.data?.message || error.message || '请求失败'
 
       if (status === 401) {
-        message.error('登录已过期，请重新登录')
+        // 死 token 收尾:清登录态(cookie+pinia)防 401 toast 风暴;toast 3s 去重
+        try {
+          const cookie = useCookie<string | null>('token')
+          cookie.value = null
+          useUserStore(nuxtApp.$pinia).$reset()
+        }
+        catch { /* 无 pinia 上下文(极端时序) */ }
+        if (!g.__awShown401) {
+          g.__awShown401 = true
+          message.error('登录已过期,请重新登录')
+          setTimeout(() => {
+            g.__awShown401 = false
+          }, 3000)
+        }
       }
       else if (status >= 500) {
         message.error('服务器异常，请稍后重试')

package/app/plugins/session-restore.client.ts

@@ -16,9 +16,14 @@ export default defineNuxtPlugin(async () => {
   const token = cookie.value
   if (!token) return
   try {
-    await store.loginWithToken(token)
+    // 超时竞速:慢 auth API 不应阻塞整站首绘
+    await Promise.race([
+      store.loginWithToken(token),
+      new Promise(r => setTimeout(r, 5000)),
+    ])
   }
   catch {
-    /* token 已失效(吊销/用户删除):静默停留未登录态 */
+    // token 已失效(吊销/用户删除/过期):清死 cookie,避免每次刷新重复必然失败的校验
+    useCookie<string | null>('token').value = null
   }
 })