ework-web 0.10.16 → 0.10.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.16",
+  "version": "0.10.18",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -78,6 +78,7 @@ export const configSchema = z.object({
   daemonBotLogin: z.string().default(""),
   daemonWebhookUrl: z.string().default(""),
   daemonWebhookSecret: z.string().default(""),
+  routerAdminToken: z.string().default(""),
   // Default "provider/model" string passed to `opencode run --model <X>`.
   // Empty = let opencode pick per its own opencode.json + env. ework-daemon
   // pushes this (or the per-project override) on every spawn to defend
@@ -175,8 +176,9 @@ export async function loadConfig(): Promise<Config> {
     ttsDefaultBackend: db.ttsDefaultBackend ?? process.env.WORK_TTS_DEFAULT_BACKEND,
     ttsSpeed: db.ttsSpeed ?? process.env.WORK_TTS_SPEED,
     daemonBotLogin: process.env.WORK_DAEMON_BOT_LOGIN ?? "",
-    daemonWebhookUrl: process.env.WORK_DAEMON_WEBHOOK_URL ?? "",
-    daemonWebhookSecret: process.env.WORK_DAEMON_WEBHOOK_SECRET ?? "",
+  daemonWebhookUrl: process.env.WORK_DAEMON_WEBHOOK_URL ?? "",
+  daemonWebhookSecret: process.env.WORK_DAEMON_WEBHOOK_SECRET ?? "",
+  routerAdminToken: process.env.WORK_ROUTER_ADMIN_TOKEN ?? "",
     defaultModel: db.defaultModel ?? process.env.WORK_DEFAULT_MODEL,
     autowireActive: process.env.WORK_AUTOWIRE_ACTIVE !== "false",
     webhookMaxConcurrent: Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),

package/src/db-admin.ts

@@ -575,6 +575,75 @@ const DAEMON_DDL: Record<string, string> = {
     ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4",
 };
 
+export interface DdlResult {
+  ok: true;
+  sql: string;
+  database: string;
+  webPrefix: string;
+  daemonPrefix: string;
+}
+
+/** Generate a runnable MySQL script for accounts whose DB user lacks CREATE
+ *  (the wizard's auto-CREATE-DATABASE path is blocked). Reuses migrate()'s
+ *  exact DDL so manual + auto paths stay in sync. Idempotent. */
+export function generateMysqlDDL(
+  opts: MysqlTargetOpts,
+  daemonPrefixRaw: string,
+): DdlResult {
+  const webPrefix = validatePrefix(opts.prefix ?? "");
+  const daemonPrefix = validatePrefix(daemonPrefixRaw);
+  const lines: string[] = [];
+
+  lines.push(`-- ework-web + ework-daemon MySQL schema`);
+  lines.push(`-- Generated for restricted-privilege accounts (no CREATE).`);
+  lines.push(`-- Database: ${opts.database} | web prefix: "${webPrefix}" | daemon prefix: "${daemonPrefix}"`);
+  lines.push(`-- Idempotent — safe to re-run.`);
+  lines.push(``);
+  lines.push(`CREATE DATABASE IF NOT EXISTS ${ident(opts.database)} CHARACTER SET utf8mb4;`);
+  lines.push(`USE ${ident(opts.database)};`);
+  lines.push(``);
+  lines.push(`-- ─── ework-web tables (${webPrefix ? `prefix "${webPrefix}"` : "no prefix"}) ───`);
+
+  for (const stmt of readSchemaMysqlStatements(webPrefix)) {
+    lines.push(stmt + ";");
+  }
+
+  // config table — created in db.ts:SqliteDriver.create at boot, missing from
+  // schema-mysql.sql. Same shape as migrateSqliteToMysql L257-266. `key` is a
+  // MySQL reserved word → backticked.
+  lines.push(
+    applyTargetPrefix(
+      "CREATE TABLE IF NOT EXISTS {{config}} (" +
+        "`key` VARCHAR(255) PRIMARY KEY," +
+        "value TEXT NOT NULL," +
+        "updated_at VARCHAR(40) NOT NULL" +
+        ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;",
+      webPrefix
+    )
+  );
+
+  lines.push(``);
+  lines.push(`-- ─── ework-daemon tables (${daemonPrefix ? `prefix "${daemonPrefix}"` : "no prefix"}) ───`);
+  lines.push(`-- Daemon columns match its SQLite schema; coordination columns`);
+  lines.push(`-- (owner_daemon_id etc.) are added by the daemon's ALTER TABLE on boot.`);
+  for (const table of DAEMON_TABLES) {
+    const ddl = applyTargetPrefix(
+      DAEMON_DDL[table]!.replace(/{{t}}/g, `{{${table}}}`),
+      daemonPrefix
+    );
+    lines.push(ddl + ";");
+  }
+
+  lines.push(``);
+  return {
+    ok: true,
+    sql: lines.join("\n"),
+    database: opts.database,
+    webPrefix,
+    daemonPrefix,
+  };
+}
+
 export async function migrateDaemonSqliteToMysql(
   sqlitePath: string,
   opts: MysqlTargetOpts,

package/src/db.ts

@@ -127,6 +127,20 @@ function migrateIssuesTable(db: Database): void {
   }
 }
 
+function migrateLabelsTable(db: Database): void {
+  const have = tableColumns(db, "labels");
+  if (have.size === 0) return;
+  if (!have.has("description")) {
+    db.exec(applyPrefix("ALTER TABLE {{labels}} ADD COLUMN description TEXT NOT NULL DEFAULT ''"));
+  }
+  if (!have.has("exclusive")) {
+    db.exec(applyPrefix("ALTER TABLE {{labels}} ADD COLUMN exclusive INTEGER NOT NULL DEFAULT 0"));
+  }
+  if (!have.has("is_archived")) {
+    db.exec(applyPrefix("ALTER TABLE {{labels}} ADD COLUMN is_archived INTEGER NOT NULL DEFAULT 0"));
+  }
+}
+
 // ---- SqliteDriver: wraps bun:sqlite behind AsyncDatabase ----
 class SqliteDriver implements AsyncDatabase {
   readonly dialect = "sqlite" as const;
@@ -145,10 +159,11 @@ class SqliteDriver implements AsyncDatabase {
       )
     );
     // Migration must run BEFORE schema.sql (same ordering as the original file).
-    migrateUsersTable(db);
-    migratePatTable(db);
-    migrateProjectsTable(db);
-    migrateIssuesTable(db);
+  migrateUsersTable(db);
+  migratePatTable(db);
+  migrateProjectsTable(db);
+  migrateIssuesTable(db);
+  migrateLabelsTable(db);
     db.exec(applyPrefix(readFileSync(join(import.meta.dir, "schema.sql"), "utf8")));
     return new SqliteDriver(db);
   }

package/src/index.ts

@@ -7,7 +7,7 @@ import { loadConfig, DB_OVERRIDABLE, parseOverride, resolveTtsBackend } from "./
 import type { Config } from "./config";
 import { setConfig, initDB, getDB } from "./db";
 import { getActiveDaemons, listAllDaemons } from "./coordination";
-import { testMysqlConnection, migrateSqliteToMysql, writeMysqlEnv, migrateMysqlToSqlite, writeSqliteEnv, migrateDaemonSqliteToMysql } from "./db-admin";
+import { testMysqlConnection, migrateSqliteToMysql, writeMysqlEnv, migrateMysqlToSqlite, writeSqliteEnv, migrateDaemonSqliteToMysql, generateMysqlDDL } from "./db-admin";
 import type { MysqlTargetOpts } from "./db-admin";
 import { checkAuth, makeAuthCookieHeader, clearAuthCookieHeader, loginHTML, sanitizeNext, ensureBootstrapAdmin, ensureBootstrapSystem, isReservedSystemLogin } from "./auth";
 import { OpencodeError, createOpencodeClient, MultiDaemonOpencodeClient, RemoteOpencodeClient, isLocalhost, type OpencodeClientInterface } from "./opencode";
@@ -61,6 +61,13 @@ import {
   setProjectModel,
   listCachedModels,
   replaceCachedModels,
+  listLabels,
+  listLabelsForIssue,
+  createLabel,
+  updateLabel,
+  archiveLabel,
+  deleteLabel,
+  setIssueLabels,
   type ProjectRole,
   type UserRow,
 } from "./store";
@@ -91,6 +98,7 @@ import { buildWebhookDeliveriesPage } from "./views/webhookDeliveries";
 import { browseRemoteFile, proxyFileSince, RemoteFileError } from "./remote-file";
 import { buildProjectMembersPage } from "./views/projectMembers";
 import { buildProjectUpstreamsPage, trySetUpstreamUrls } from "./views/projectUpstreams";
+import { buildProjectLabelsPage } from "./views/projectLabels";
 import { buildProjectModelPage } from "./views/projectModel";
 import { handleGiteaApi } from "./giteaApi";
 import { deployRemoteDaemon, deployBatch, type DeployTarget } from "./daemon-deploy";
@@ -201,7 +209,9 @@ function html(body: string, status = 200): Response {
 // The prefix regex below must match db.ts:WORK_DB_PREFIX exactly — if the API
 // accepts a prefix that boot rejects, the wizard writes a .env that restarts
 // into a crash. Any change here must be mirrored in db.ts + db-admin.ts.
-function parseDbTargetOpts(payload: unknown): MysqlTargetOpts | { error: string } {
+type ParsedDbTarget = MysqlTargetOpts & { daemonPrefix?: string };
+
+function parseDbTargetOpts(payload: unknown): ParsedDbTarget | { error: string } {
   if (typeof payload !== "object" || payload === null) return { error: "invalid body" };
   const p = payload as Record<string, unknown>;
   const host = typeof p.host === "string" ? p.host.trim() : "";
@@ -210,17 +220,23 @@ function parseDbTargetOpts(payload: unknown): MysqlTargetOpts | { error: string
   const password = typeof p.password === "string" ? p.password : "";
   const database = typeof p.database === "string" ? p.database.trim() : "";
   const prefix = typeof p.prefix === "string" ? p.prefix.trim() : "";
+  const daemonPrefix = typeof p.daemonPrefix === "string" ? p.daemonPrefix.trim() : "";
   if (!host) return { error: "host required" };
   if (!user) return { error: "user required" };
   if (!database) return { error: "database required" };
   if (!Number.isInteger(portNum) || portNum < 1 || portNum > 65535) {
     return { error: "port must be an integer 1-65535" };
   }
-  if (prefix && !/^[A-Za-z_][A-Za-z0-9_]{0,31}$/.test(prefix)) {
+  const prefixRe = /^[A-Za-z_][A-Za-z0-9_]{0,31}$/;
+  if (prefix && !prefixRe.test(prefix)) {
     return { error: "prefix must match ^[A-Za-z_][A-Za-z0-9_]{0,31}$" };
   }
-  const opts: MysqlTargetOpts = { host, port: portNum, user, password, database };
+  if (daemonPrefix && !prefixRe.test(daemonPrefix)) {
+    return { error: "daemonPrefix must match ^[A-Za-z_][A-Za-z0-9_]{0,31}$" };
+  }
+  const opts: ParsedDbTarget = { host, port: portNum, user, password, database };
   if (prefix) opts.prefix = prefix;
+  if (daemonPrefix) opts.daemonPrefix = daemonPrefix;
   return opts;
 }
 
@@ -323,6 +339,10 @@ const REPO_MEMBER_ACTION_RE = /^\/([^/]+)\/([^/]+)\/settings\/members\/([^/]+)\/
 const REPO_MEMBER_ADD_RE = /^\/([^/]+)\/([^/]+)\/settings\/members\/add$/;
 const REPO_UPSTREAMS_RE = /^\/([^/]+)\/([^/]+)\/settings\/upstreams$/;
 const REPO_MODEL_RE = /^\/([^/]+)\/([^/]+)\/settings\/model$/;
+const REPO_LABELS_RE = /^\/([^/]+)\/([^/]+)\/settings\/labels$/;
+const REPO_LABEL_ADD_RE = /^\/([^/]+)\/([^/]+)\/settings\/labels\/add$/;
+const REPO_LABEL_ACTION_RE = /^\/([^/]+)\/([^/]+)\/settings\/labels\/(\d+)\/(update|archive|unarchive|delete)$/;
+const API_ISSUE_LABELS_RE = /^\/api\/([^/]+)\/([^/]+)\/issues\/(\d+)\/labels$/;
 const WH_ACTION_RE = /^\/__wh\/(\d+)\/(delete|toggle|test)$/;
 const SESSIONS_RE = /^\/sessions$/;
 const SESSION_VIEW_RE = /^\/sessions\/([A-Za-z0-9_-]+)$/;
@@ -805,7 +825,9 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     const rawPayload = await req.json().catch(() => ({}));
     const parsed = parseDbTargetOpts(rawPayload);
     if ("error" in parsed) return json(parsed, 400);
-    const daemonOpts: MysqlTargetOpts = { ...parsed, prefix: daemonPrefix(parsed.prefix ?? "") };
+    const { daemonPrefix: _dp, ...mysqlFields } = parsed;
+    const dPrefix = parsed.daemonPrefix ?? daemonPrefix(parsed.prefix ?? "");
+    const daemonOpts: MysqlTargetOpts = { ...mysqlFields, prefix: dPrefix };
     const envPath = daemonEnvPath();
     if (!envPath) {
       return json({ ok: false, configured: false, manual: daemonManualInstructions(daemonOpts) });
@@ -825,6 +847,21 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     }
   }
 
+  if (req.method === "POST" && url.pathname === "/api/db/ddl") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    if (!rateLimit(`db-ddl:${ip}`, 10, 10 / 60)) return json({ error: "rate limited" }, 429);
+    const payload = await req.json().catch(() => ({}));
+    const parsed = parseDbTargetOpts(payload);
+    if ("error" in parsed) return json(parsed, 400);
+    const dPrefix = parsed.daemonPrefix ?? daemonPrefix(parsed.prefix ?? "");
+    try {
+      const result = generateMysqlDDL(parsed, dPrefix);
+      return json(result);
+    } catch (e) {
+      return json({ ok: false, error: errMsg(e) }, 400);
+    }
+  }
+
   if (req.method === "POST" && url.pathname === "/api/db/revert") {
     if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
     if (!rateLimit(`db-revert:${ip}`, 2, 2 / 3600)) return json({ error: "rate limited" }, 429);
@@ -1023,16 +1060,18 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
   if (url.pathname === "/api/router/strategy") {
     if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
     const routerUrl = cfg.daemonWebhookUrl.replace(/\/$/, "");
+    const routerHeaders: Record<string, string> = { "Content-Type": "application/json" };
+    if (cfg.routerAdminToken) routerHeaders["Authorization"] = `Bearer ${cfg.routerAdminToken}`;
     try {
       if (req.method === "GET") {
-        const res = await fetch(`${routerUrl}/api/strategy`, { signal: AbortSignal.timeout(5000) });
+        const res = await fetch(`${routerUrl}/api/strategy`, { headers: routerHeaders, signal: AbortSignal.timeout(5000) });
         return json(await res.json());
       }
       if (req.method === "POST") {
         const body = await req.text();
         const res = await fetch(`${routerUrl}/api/strategy`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: routerHeaders,
           body,
           signal: AbortSignal.timeout(5000),
         });
@@ -1638,6 +1677,61 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       }
     }
 
+    const labelAdd = url.pathname.match(REPO_LABEL_ADD_RE);
+    if (labelAdd) {
+      const [, owner, repo] = labelAdd;
+      if (!(owner && repo)) return html(errorPage("bad path", ""), 400);
+      const project = await getProject(owner, repo);
+      if (!project) return html(errorPage("项目不存在", ""), 404);
+      const back = `${url.origin}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/settings/labels`;
+      if (!(await canAdminProject(project.id, ctx.user))) {
+        return Response.redirect(`${back}?err=${encodeURIComponent("无权限")}`, 303);
+      }
+      const form = await req.formData().catch(() => new FormData());
+      try {
+        await createLabel(project.id, {
+          name: String(form.get("name") ?? ""),
+          color: String(form.get("color") ?? "#888888"),
+          description: String(form.get("description") ?? ""),
+          exclusive: form.get("exclusive") === "1",
+        });
+        return Response.redirect(`${back}?ok=1&ok_msg=${encodeURIComponent("标签已创建")}`, 303);
+      } catch (e) {
+        return Response.redirect(`${back}?err=${encodeURIComponent(errMsg(e))}`, 303);
+      }
+    }
+
+    const labelAction = url.pathname.match(REPO_LABEL_ACTION_RE);
+    if (labelAction) {
+      const [, owner, repo, lidStr, action] = labelAction;
+      if (!(owner && repo && lidStr && action)) return html(errorPage("bad path", ""), 400);
+      const project = await getProject(owner, repo);
+      if (!project) return html(errorPage("项目不存在", ""), 404);
+      const back = `${url.origin}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/settings/labels`;
+      if (!(await canAdminProject(project.id, ctx.user))) {
+        return Response.redirect(`${back}?err=${encodeURIComponent("无权限")}`, 303);
+      }
+      const lid = Number(lidStr);
+      const form = await req.formData().catch(() => new FormData());
+      try {
+        if (action === "update") {
+          await updateLabel(project.id, lid, {
+            name: String(form.get("name") ?? ""),
+            color: String(form.get("color") ?? "#888888"),
+            description: String(form.get("description") ?? ""),
+            exclusive: form.get("exclusive") === "1",
+          });
+        } else if (action === "archive" || action === "unarchive") {
+          await archiveLabel(project.id, lid, action === "archive");
+        } else if (action === "delete") {
+          await deleteLabel(project.id, lid);
+        }
+        return Response.redirect(`${back}?ok=1`, 303);
+      } catch (e) {
+        return Response.redirect(`${back}?err=${encodeURIComponent(errMsg(e))}`, 303);
+      }
+    }
+
     return json({ error: "not found" }, 404);
   }
 
@@ -1671,6 +1765,38 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     }
   }
 
+  const issueLabelsApi = url.pathname.match(API_ISSUE_LABELS_RE);
+  if (issueLabelsApi) {
+    const [, owner, repo, numStr] = issueLabelsApi;
+    if (!(owner && repo && numStr)) return html(errorPage("404", "bad path"), 404);
+    const project = await getProject(owner, repo);
+    if (!project) return json({ error: "project not found" }, 404);
+    const issue = await getIssueWithMeta(project.id, Number(numStr));
+    if (!issue) return json({ error: "issue not found" }, 404);
+    if (req.method === "GET") {
+      const [current, available] = await Promise.all([
+        listLabelsForIssue(issue.id),
+        listLabels(project.id),
+      ]);
+      return json({ current, available });
+    }
+    if (req.method === "POST") {
+      if (!ctx.user || !(await canWriteProject(project.id, ctx.user))) {
+        return json({ error: "forbidden: needs writer role on project" }, 403);
+      }
+      const body = await req.json().catch(() => ({}));
+      const labelIds = Array.isArray(body.labelIds) ? body.labelIds.map((n: unknown) => Number(n)).filter((n: number) => Number.isInteger(n) && n > 0) : [];
+      try {
+        await setIssueLabels(issue.id, labelIds);
+        const current = await listLabelsForIssue(issue.id);
+        return json({ current });
+      } catch (e) {
+        return json({ error: errMsg(e) }, e instanceof StoreError ? e.status : 500);
+      }
+    }
+    return json({ error: "method not allowed" }, 405);
+  }
+
   const isNew = url.pathname.match(REPO_NEW_RE);
   if (isNew) {
     const [, owner, repo] = isNew;
@@ -1754,6 +1880,22 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     return html(buildProjectUpstreamsPage(ctx.user!, project, flash));
   }
 
+  const labelsPage = url.pathname.match(REPO_LABELS_RE);
+  if (labelsPage) {
+    const [, owner, repo] = labelsPage;
+    if (!(owner && repo)) return html(errorPage("404", "bad path"), 404);
+    const project = await getProject(owner, repo);
+    if (!project) return html(errorPage("项目不存在", "项目未创建"), 404);
+    if (ctx.user!.is_admin === 1) await ensureProjectBootstrapAdmin(project.id, ctx.user!.login);
+    if (!(await canAdminProject(project.id, ctx.user))) {
+      return html(errorPage("无权限", "需要该项目 admin 角色才能管理标签"), 403);
+    }
+    const flashKind = url.searchParams.get("ok") === "1" ? "ok" : url.searchParams.get("err") ? "err" : null;
+    const flashMsg = flashKind === "ok" ? (url.searchParams.get("ok_msg") ?? "") : (url.searchParams.get("err") ?? "");
+    const flash = flashKind ? { kind: flashKind as "ok" | "err", msg: flashMsg } : null;
+    return html(await buildProjectLabelsPage(ctx.user!, project, flash));
+  }
+
   const modelPage = url.pathname.match(REPO_MODEL_RE);
   if (modelPage) {
     const [, owner, repo] = modelPage;

package/src/render/layout.ts

@@ -14,6 +14,8 @@ export interface LayoutProps {
   upstreamWebUrl?: string | null;
   translateEnabled?: boolean;
   ttsEnabled?: boolean;
+  labels?: { id: number; name: string; color: string }[];
+  canEditLabels?: boolean;
 }
 
 export const THEME_CSS = `
@@ -107,6 +109,20 @@ header.topbar .num{opacity:.7}
 .desc-toggle{margin-top:.4rem;background:none;border:none;color:var(--accent);font-size:13px;cursor:pointer;padding:.2rem 0}
 .upstream-link{font-size:12px;color:var(--accent);opacity:.85}
 .upstream-link:hover{opacity:1;text-decoration:underline}
+.issue-label{display:inline-flex;align-items:center;font-size:12px;font-weight:500;padding:.05rem .5rem;border:1px solid;border-radius:99px;line-height:1.6;background:color-mix(in srgb,currentColor 8%,transparent)}
+.label-edit-btn{background:none;border:1px solid var(--border);border-radius:6px;padding:.05rem .35rem;cursor:pointer;font-size:13px;line-height:1.5;color:var(--text-muted)}
+.label-edit-btn:hover{border-color:var(--accent);color:var(--accent)}
+#labelDlg{border:1px solid var(--border);border-radius:10px;background:var(--bg-elev);color:var(--text);padding:1.1rem;max-width:380px;width:90vw}
+#labelDlg::backdrop{background:rgba(0,0,0,.5)}
+#labelDlg h3{margin:0 0 .6rem;font-size:14px}
+.lp-list{max-height:300px;overflow-y:auto;display:flex;flex-direction:column;gap:.15rem}
+.lp-item{display:flex;align-items:center;gap:.4rem;padding:.3rem .4rem;border-radius:6px;cursor:pointer;font-size:13px}
+.lp-item:hover{background:var(--bg-muted)}
+.lp-item input{margin:0}
+.lp-dot{width:10px;height:10px;border-radius:50%;border:1px solid var(--border);flex-shrink:0}
+.lp-name{flex:1;overflow-wrap:anywhere}
+.lp-scope{font-size:10px;color:var(--text-muted)}
+.lp-empty{color:var(--text-muted);font-size:12px;padding:.6rem 0;text-align:center}
 `;
 
 export function renderLayout(props: LayoutProps, inner: string, initialItems: string): string {
@@ -119,6 +135,12 @@ export function renderLayout(props: LayoutProps, inner: string, initialItems: st
   const [repoOwner, repoName] = props.repoPath.split("/");
   const repoIssuesHref = `/${encodeURIComponent(repoOwner ?? "")}/${encodeURIComponent(repoName ?? "")}/issues`;
   const op = props.operatorLogin ?? "operator";
+  const labelsHtml = (props.labels ?? []).length
+    ? props.labels!.map((l) => `<span class="issue-label" style="border-color:${escapeAttr(l.color)};color:${escapeAttr(l.color)}">${escapeHtml(l.name)}</span>`).join("")
+    : "";
+  const labelPickerBtn = props.canEditLabels
+    ? `<button type="button" class="label-edit-btn" id="labelEditBtn" title="管理标签">🏷️</button>`
+    : "";
   return `<!doctype html>
 <html lang="zh">
 <head>
@@ -140,6 +162,7 @@ export function renderLayout(props: LayoutProps, inner: string, initialItems: st
   <h1>${escapeHtml(props.issueTitle)}</h1>
   <div class="meta-status">
     <span class="state-badge ${stateClass}">${stateLabel}</span>
+    ${labelsHtml}${labelPickerBtn}
     <span class="count" id="count">…</span>
     ${props.upstreamWebUrl ? `<a class="upstream-link" href="${escapeAttr(props.upstreamWebUrl)}" target="_blank" rel="noopener noreferrer" title="跳转到上游仓库">🔗 查看上游</a>` : ""}
   </div>
@@ -168,6 +191,8 @@ ${props.writesEnabled !== false
 <script type="application/json" id="initial-data">${inner}</script>
 <script src="/static/tts.js?v=${BUILD_ID}" defer></script>
 <script src="/static/app.js?v=${BUILD_ID}" defer></script>
+${props.canEditLabels ? `<dialog id="labelDlg"><h3>标签</h3><div class="lp-list" id="lpList"></div><div class="lp-empty hidden" id="lpEmpty">该项目还没有标签。先到设置页创建。</div></dialog>
+<script src="/static/label-picker.js?v=${BUILD_ID}" defer></script>` : ""}
 </body>
 </html>`;
 }

package/src/schema-mysql.sql

@@ -74,10 +74,13 @@ CREATE INDEX comments_issue_created ON {{comments}} (issue_id, created_at);
 CREATE INDEX comments_author ON {{comments}} (author);
 
 CREATE TABLE IF NOT EXISTS {{labels}} (
-  id         BIGINT AUTO_INCREMENT PRIMARY KEY,
-  project_id BIGINT NOT NULL,
-  name       VARCHAR(255) NOT NULL,
-  color      VARCHAR(16) NOT NULL DEFAULT '#888888',
+  id          BIGINT AUTO_INCREMENT PRIMARY KEY,
+  project_id  BIGINT NOT NULL,
+  name        VARCHAR(255) NOT NULL,
+  color       VARCHAR(16) NOT NULL DEFAULT '#888888',
+  description VARCHAR(255) NOT NULL DEFAULT '',
+  exclusive   TINYINT NOT NULL DEFAULT 0,
+  is_archived TINYINT NOT NULL DEFAULT 0,
   UNIQUE (project_id, name),
   CONSTRAINT {{fk_labels_project}} FOREIGN KEY (project_id) REFERENCES {{projects}}(id) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

package/src/schema.sql

@@ -78,10 +78,13 @@ CREATE INDEX IF NOT EXISTS comments_issue_created
   ON {{comments}} (issue_id, created_at);
 
 CREATE TABLE IF NOT EXISTS {{labels}} (
-  id         INTEGER PRIMARY KEY AUTOINCREMENT,
-  project_id INTEGER NOT NULL REFERENCES {{projects}}(id) ON DELETE CASCADE,
-  name       TEXT NOT NULL,
-  color      TEXT NOT NULL DEFAULT '#888888',
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id  INTEGER NOT NULL REFERENCES {{projects}}(id) ON DELETE CASCADE,
+  name        TEXT NOT NULL,
+  color       TEXT NOT NULL DEFAULT '#888888',
+  description TEXT NOT NULL DEFAULT '',
+  exclusive   INTEGER NOT NULL DEFAULT 0,
+  is_archived INTEGER NOT NULL DEFAULT 0,
   UNIQUE (project_id, name)
 );
 

package/src/static/daemon-groups.js

@@ -6,7 +6,7 @@
   const saveBtn = document.getElementById("strategy-save");
   const addBindingBtn = document.getElementById("binding-add");
 
-  let currentStrategy = { strategy: "least-loaded", groupBindings: {}, daemonGroups: {} };
+  let currentStrategy = { strategy: "least-loaded", groupBindings: {}, daemonGroups: {}, groupConfigs: {} };
 
   function showResult(msg, ok) {
     result.textContent = msg;
@@ -14,6 +14,47 @@
     setTimeout(() => { result.textContent = ""; result.className = "db-result"; }, 3000);
   }
 
+  function esc(s) {
+    return String(s).replace(/[&<>"']/g, function (c) {
+      return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c];
+    });
+  }
+
+  function collectGroupNames() {
+    var names = new Set();
+    var dg = currentStrategy.daemonGroups || {};
+    Object.values(dg).forEach(function (arr) { (arr || []).forEach(function (g) { names.add(g); }); });
+    var gb = currentStrategy.groupBindings || {};
+    Object.values(gb).forEach(function (g) { names.add(g); });
+    Object.keys(currentStrategy.groupConfigs || {}).forEach(function (g) { names.add(g); });
+    return Array.from(names).sort();
+  }
+
+  function renderGroupConfigs() {
+    var container = document.getElementById("group-configs-list");
+    if (!container) return;
+    var names = collectGroupNames();
+    if (!names.length) {
+      container.innerHTML = '<p class="hint" style="margin:0">先添加分组（上方给 daemon 打组或绑定 repo→组）后这里会出现配置项。</p>';
+      return;
+    }
+    container.innerHTML = names.map(function (g) {
+      var cfg = (currentStrategy.groupConfigs || {})[g] || {};
+      return '<details class="gc-card" style="border:1px solid var(--border);border-radius:8px;padding:.6rem .8rem;margin:.4rem 0">' +
+        '<summary style="cursor:pointer;font-weight:600;font-size:13px">' + esc(g) + '</summary>' +
+        '<div style="margin-top:.5rem">' +
+        '<label style="font-size:12px;color:var(--text-muted)">工作目录模板（变量: {owner} {repo} {issue} {session}）</label>' +
+        '<input type="text" class="gc-workdir" data-group="' + esc(g) + '" value="' + esc(cfg.workdirTemplate || "") + '" placeholder="/data/work/{owner}/{repo}/{issue}" maxlength="512" style="width:100%;padding:.35rem .5rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font-size:13px;margin-bottom:.5rem;font-family:ui-monospace,monospace">' +
+        '<label style="font-size:12px;color:var(--text-muted)">Init 脚本（投递时跑，cwd=workdir，env 有 $EWORK_OWNER/$EWORK_REPO/$EWORK_ISSUE/$EWORK_WORKDIR）</label>' +
+        '<textarea class="gc-init" data-group="' + esc(g) + '" placeholder="git clone https://gitea.example.com/$EWORK_OWNER/$EWORK_REPO.git ." rows="2" maxlength="4096" style="width:100%;padding:.35rem .5rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font-size:12px;margin-bottom:.5rem;font-family:ui-monospace,monospace;resize:vertical">' + esc(cfg.initScript || "") + '</textarea>' +
+        '<label style="font-size:12px;color:var(--text-muted)">Destroy 脚本（关闭时跑，cwd=workdir）</label>' +
+        '<textarea class="gc-destroy" data-group="' + esc(g) + '" rows="2" maxlength="4096" style="width:100%;padding:.35rem .5rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font-size:12px;margin-bottom:.5rem;font-family:ui-monospace,monospace;resize:vertical">' + esc(cfg.destroyScript || "") + '</textarea>' +
+        '<label style="font-size:12px;color:var(--text-muted)">Env-Init 脚本（机器级，预留）</label>' +
+        '<textarea class="gc-envinit" data-group="' + esc(g) + '" rows="1" disabled maxlength="4096" placeholder="预留，暂不执行" style="width:100%;padding:.35rem .5rem;border:1px solid var(--border);border-radius:6px;background:var(--bg-muted);color:var(--text-muted);font-size:12px;resize:vertical">' + esc(cfg.envInitScript || "") + '</textarea>' +
+        '</div></details>';
+    }).join("");
+  }
+
   async function load() {
     try {
       const [daemonsRes, strategyRes] = await Promise.all([
@@ -35,6 +76,7 @@
       }).join("") || '<tr><td colspan="4" class="daemon-empty">没有已注册的 daemon（节点启动后自动出现）</td></tr>';
 
       renderBindings();
+      renderGroupConfigs();
     } catch (e) {
       tbody.innerHTML = '<tr><td colspan="4" class="daemon-empty">无法连接 router — 确认 router 已启动</td></tr>';
     }
@@ -67,6 +109,7 @@
     document.getElementById("binding-repo").value = "";
     document.getElementById("binding-group").value = "";
     renderBindings();
+    renderGroupConfigs();
   };
 
   saveBtn.onclick = async () => {
@@ -79,6 +122,24 @@
     });
     currentStrategy.daemonGroups = newGroups;
 
+    var newConfigs = {};
+    document.querySelectorAll("details.gc-card").forEach(function (card) {
+      var g = card.querySelector("summary").textContent.trim();
+      var workdir = (card.querySelector(".gc-workdir") || {}).value || "";
+      var init = (card.querySelector(".gc-init") || {}).value || "";
+      var destroy = (card.querySelector(".gc-destroy") || {}).value || "";
+      var envinit = (card.querySelector(".gc-envinit") || {}).value || "";
+      if (workdir.trim() || init.trim() || destroy.trim() || envinit.trim()) {
+        newConfigs[g] = {
+          workdirTemplate: workdir.trim() || undefined,
+          initScript: init.trim() || undefined,
+          destroyScript: destroy.trim() || undefined,
+          envInitScript: envinit.trim() || undefined,
+        };
+      }
+    });
+    currentStrategy.groupConfigs = newConfigs;
+
     try {
       const res = await fetch("/api/router/strategy", {
         method: "POST",

package/src/static/db-wizard.js

@@ -12,7 +12,8 @@
       user: get('db-user').trim(),
       password: get('db-password'),
       database: get('db-database').trim(),
-      prefix: get('db-prefix').trim()
+      prefix: get('db-prefix').trim(),
+      daemonPrefix: get('db-daemon-prefix').trim()
     });
   }
   function setBtns(d) {
@@ -74,6 +75,58 @@
   document.getElementById('db-daemon').onclick = function () { act('daemon-config'); };
   document.getElementById('db-enable').onclick = function () { act('enable'); };
 
+  var ddlBtn = document.getElementById('db-ddl');
+  if (ddlBtn) {
+    ddlBtn.onclick = async function () {
+      setBtns(true);
+      R.className = 'db-result db-loading';
+      R.textContent = '生成建表 SQL…';
+      try {
+        var res = await fetch('/api/db/ddl', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: gather()
+        });
+        var data = await res.json();
+        if (data.ok) {
+          R.className = 'db-result db-ok';
+          R.textContent = '✓ SQL 已生成（' + data.database + ' · web 前缀 "' + (data.webPrefix || '(无)') + '" · daemon 前缀 "' + (data.daemonPrefix || '(无)') + '"）。复制下方 SQL，用有 CREATE 权限的账号在 MySQL 里跑一遍，再回来点 ② 迁移。';
+          var out = document.getElementById('db-ddl-out');
+          var ta = document.getElementById('db-ddl-text');
+          var meta = document.getElementById('db-ddl-meta');
+          ta.value = data.sql;
+          meta.textContent = data.sql.length + ' 字符';
+          out.style.display = '';
+        } else {
+          R.className = 'db-result db-err';
+          R.textContent = '✗ ' + (data.error || '未知错误');
+        }
+      } catch (e) {
+        R.className = 'db-result db-err';
+        R.textContent = '✗ ' + (e.message || String(e));
+      } finally {
+        setBtns(false);
+      }
+    };
+  }
+
+  var ddlCopy = document.getElementById('db-ddl-copy');
+  if (ddlCopy) {
+    ddlCopy.onclick = async function () {
+      var ta = document.getElementById('db-ddl-text');
+      try {
+        await navigator.clipboard.writeText(ta.value);
+        ddlCopy.textContent = '✓ 已复制';
+        setTimeout(function () { ddlCopy.textContent = '📋 复制 SQL'; }, 1500);
+      } catch (e) {
+        ta.select();
+        document.execCommand('copy');
+        ddlCopy.textContent = '✓ 已复制';
+        setTimeout(function () { ddlCopy.textContent = '📋 复制 SQL'; }, 1500);
+      }
+    };
+  }
+
   var revertBtn = document.getElementById('db-revert');
   if (revertBtn) {
     revertBtn.onclick = async function () {

package/src/static/label-picker.js

@@ -0,0 +1,106 @@
+(function () {
+  var btn = document.getElementById("labelEditBtn");
+  if (!btn) return;
+  var dlg = document.getElementById("labelDlg");
+  var listEl = document.getElementById("lpList");
+  var emptyEl = document.getElementById("lpEmpty");
+  if (!dlg || !listEl) return;
+
+  var path = window.location.pathname.replace(/\/+$/, "");
+  var m = path.match(/^\/(.+)\/(.+)\/issues\/(\d+)$/);
+  if (!m) return;
+  var apiBase = "/api/" + encodeURIComponent(m[1]) + "/" + encodeURIComponent(m[2]) + "/issues/" + m[3] + "/labels";
+
+  function scopeOf(name) {
+    var i = name.indexOf("/");
+    return i > 0 ? name.slice(0, i) : "";
+  }
+
+  var state = { available: [], current: [] };
+
+  function render() {
+    if (!state.available.length) {
+      listEl.classList.add("hidden");
+      emptyEl.classList.remove("hidden");
+      return;
+    }
+    listEl.classList.remove("hidden");
+    emptyEl.classList.add("hidden");
+    var currentIds = new Set(state.current.map(function (l) { return l.id; }));
+    listEl.innerHTML = state.available.map(function (l) {
+      var checked = currentIds.has(l.id);
+      var sc = scopeOf(l.name);
+      var scopeHint = l.exclusive === 1 && sc ? '<span class="lp-scope">互斥 · ' + esc(sc) + "</span>" : "";
+      return '<label class="lp-item">' +
+        '<input type="checkbox" data-id="' + l.id + '"' + (l.exclusive === 1 ? ' data-exclusive="1"' : "") +
+        (sc ? ' data-scope="' + esc(sc) + '"' : "") +
+        (checked ? " checked" : "") + ">" +
+        '<span class="lp-dot" style="background:' + esc(l.color) + '"></span>' +
+        '<span class="lp-name">' + esc(l.name) + "</span>" + scopeHint +
+        "</label>";
+    }).join("");
+  }
+
+  function renderChips() {
+    var row = document.querySelector(".meta-status");
+    if (!row) return;
+    var existing = row.querySelectorAll(".issue-label");
+    existing.forEach(function (e) { e.remove(); });
+    var badge = row.querySelector(".state-badge");
+    var html = state.current.map(function (l) {
+      return '<span class="issue-label" style="border-color:' + esc(l.color) + ";color:" + esc(l.color) + '">' + esc(l.name) + "</span>";
+    }).join("");
+    badge.insertAdjacentHTML("afterend", html);
+  }
+
+  function esc(s) {
+    return String(s).replace(/[&<>"']/g, function (c) {
+      return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c];
+    });
+  }
+
+  async function load() {
+    try {
+      var res = await fetch(apiBase);
+      if (!res.ok) return;
+      var data = await res.json();
+      state.available = data.available || [];
+      state.current = data.current || [];
+      render();
+    } catch (e) {}
+  }
+
+  async function save(labelIds) {
+    try {
+      var res = await fetch(apiBase, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ labelIds: labelIds }),
+      });
+      if (!res.ok) return;
+      var data = await res.json();
+      state.current = data.current || [];
+      renderChips();
+    } catch (e) {}
+  }
+
+  btn.addEventListener("click", async function () {
+    await load();
+    dlg.showModal();
+  });
+
+  listEl.addEventListener("change", function (e) {
+    var cb = e.target;
+    if (cb.tagName !== "INPUT" || cb.type !== "checkbox") return;
+    if (cb.checked && cb.dataset.exclusive === "1" && cb.dataset.scope) {
+      var scope = cb.dataset.scope;
+      listEl.querySelectorAll('input[data-exclusive="1"]').forEach(function (other) {
+        if (other !== cb && other.dataset.scope === scope) other.checked = false;
+      });
+    }
+    var ids = Array.from(listEl.querySelectorAll("input:checked")).map(function (c) {
+      return Number(c.dataset.id);
+    });
+    save(ids);
+  });
+})();

package/src/store.ts

@@ -79,6 +79,17 @@ export interface LabelRow {
   project_id: number;
   name: string;
   color: string;
+  description: string;
+  exclusive: number;
+  is_archived: number;
+}
+
+/** For an exclusive label named "scope/name", the scope is "scope". A label
+ *  with no "/" has no scope and is never exclusive. Issues may carry at most
+ *  one label per scope (Gitea semantics). */
+export function labelScope(name: string): string {
+  const i = name.indexOf("/");
+  return i > 0 ? name.slice(0, i) : "";
 }
 
 export interface AttachmentRow {
@@ -595,8 +606,12 @@ export async function removeReaction(commentId: number, userLogin: string, conte
   );
 }
 
-export async function listLabels(projectId: number): Promise<LabelRow[]> {
-  return await getDB().all<LabelRow>("SELECT * FROM {{labels}} WHERE project_id = ? ORDER BY name", [projectId]);
+const LABEL_COLOR_RE = /^#[0-9a-fA-F]{6}$/;
+const LABEL_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9 _\-./]{0,62}$/;
+
+export async function listLabels(projectId: number, includeArchived = false): Promise<LabelRow[]> {
+  const where = includeArchived ? "project_id = ?" : "project_id = ? AND is_archived = 0";
+  return await getDB().all<LabelRow>(`SELECT * FROM {{labels}} WHERE ${where} ORDER BY name`, [projectId]);
 }
 
 export async function listLabelsForIssue(issueId: number): Promise<LabelRow[]> {
@@ -608,19 +623,98 @@ export async function listLabelsForIssue(issueId: number): Promise<LabelRow[]> {
   );
 }
 
-export async function createLabel(projectId: number, name: string, color: string): Promise<LabelRow> {
-  name = name.trim();
+export async function getLabel(projectId: number, id: number): Promise<LabelRow | null> {
+  return (await getDB().get<LabelRow>("SELECT * FROM {{labels}} WHERE project_id = ? AND id = ?", [projectId, id])) ?? null;
+}
+
+interface LabelInput {
+  name: string;
+  color: string;
+  description?: string;
+  exclusive?: boolean;
+}
+
+function validateLabel(t: LabelInput): { name: string; color: string; description: string; exclusive: number } {
+  const name = t.name.trim();
   if (!name) throw new StoreError(400, "标签名不能为空");
-  if (!/^#[0-9a-fA-F]{6}$/.test(color)) throw new StoreError(400, "颜色须为 #RRGGBB");
-  const info = await getDB().run("INSERT INTO {{labels}} (project_id, name, color) VALUES (?, ?, ?)", [projectId, name, color]);
+  if (!LABEL_NAME_RE.test(name)) throw new StoreError(400, "标签名仅允许字母数字、空格、_ - . /，且不能以 / 开头");
+  if (!LABEL_COLOR_RE.test(t.color)) throw new StoreError(400, "颜色须为 #RRGGBB");
+  return { name, color: t.color, description: (t.description ?? "").trim(), exclusive: t.exclusive ? 1 : 0 };
+}
+
+export async function createLabel(projectId: number, input: LabelInput): Promise<LabelRow> {
+  const v = validateLabel(input);
+  const info = await getDB().run(
+    "INSERT INTO {{labels}} (project_id, name, color, description, exclusive) VALUES (?, ?, ?, ?, ?)",
+    [projectId, v.name, v.color, v.description, v.exclusive]
+  );
   return (await getDB().get<LabelRow>("SELECT * FROM {{labels}} WHERE id = ?", [info.insertId]))!;
 }
 
+export async function updateLabel(projectId: number, id: number, input: Partial<LabelInput>): Promise<LabelRow> {
+  const existing = await getLabel(projectId, id);
+  if (!existing) throw new StoreError(404, "标签不存在");
+  const merged: LabelInput = {
+    name: input.name ?? existing.name,
+    color: input.color ?? existing.color,
+    description: input.description ?? existing.description,
+    exclusive: input.exclusive ?? (existing.exclusive === 1),
+  };
+  const v = validateLabel(merged);
+  await getDB().run(
+    "UPDATE {{labels}} SET name = ?, color = ?, description = ?, exclusive = ? WHERE project_id = ? AND id = ?",
+    [v.name, v.color, v.description, v.exclusive, projectId, id]
+  );
+  return (await getDB().get<LabelRow>("SELECT * FROM {{labels}} WHERE id = ?", [id]))!;
+}
+
+export async function archiveLabel(projectId: number, id: number, archived: boolean): Promise<LabelRow> {
+  const existing = await getLabel(projectId, id);
+  if (!existing) throw new StoreError(404, "标签不存在");
+  await getDB().run("UPDATE {{labels}} SET is_archived = ? WHERE project_id = ? AND id = ?", [archived ? 1 : 0, projectId, id]);
+  return (await getDB().get<LabelRow>("SELECT * FROM {{labels}} WHERE id = ?", [id]))!;
+}
+
+export async function deleteLabel(projectId: number, id: number): Promise<void> {
+  await getDB().run("DELETE FROM {{labels}} WHERE project_id = ? AND id = ?", [projectId, id]);
+}
+
+/** Attach (`on=true`) or detach a label. When attaching an exclusive label
+ *  (scope/name with exclusive=1), any other already-attached label sharing the
+ *  same scope is removed first, so an issue holds at most one label per scope. */
 export async function setIssueLabel(issueId: number, labelId: number, on: boolean): Promise<void> {
-  if (on) {
-    await getDB().run("INSERT OR IGNORE INTO {{issue_labels}} (issue_id, label_id) VALUES (?, ?)", [issueId, labelId]);
-  } else {
+  if (!on) {
     await getDB().run("DELETE FROM {{issue_labels}} WHERE issue_id = ? AND label_id = ?", [issueId, labelId]);
+    return;
+  }
+  const label = await getDB().get<LabelRow>("SELECT * FROM {{labels}} WHERE id = ?", [labelId]);
+  if (!label) throw new StoreError(404, "标签不存在");
+  if (label.exclusive === 1) {
+    const scope = labelScope(label.name);
+    if (scope) {
+      const current = await listLabelsForIssue(issueId);
+      const siblings = current.filter((l) => l.exclusive === 1 && labelScope(l.name) === scope && l.id !== labelId);
+      for (const s of siblings) {
+        await getDB().run("DELETE FROM {{issue_labels}} WHERE issue_id = ? AND label_id = ?", [issueId, s.id]);
+      }
+    }
+  }
+  const dialect = getDB().dialect;
+  const insert = dialect === "sqlite"
+    ? "INSERT OR IGNORE INTO {{issue_labels}} (issue_id, label_id) VALUES (?, ?)"
+    : "INSERT IGNORE INTO {{issue_labels}} (issue_id, label_id) VALUES (?, ?)";
+  await getDB().run(insert, [issueId, labelId]);
+}
+
+export async function setIssueLabels(issueId: number, labelIds: number[]): Promise<void> {
+  const dialect = getDB().dialect;
+  await getDB().run("DELETE FROM {{issue_labels}} WHERE issue_id = ?", [issueId]);
+  const ids = Array.from(new Set(labelIds));
+  const insert = dialect === "sqlite"
+    ? "INSERT OR IGNORE INTO {{issue_labels}} (issue_id, label_id) VALUES (?, ?)"
+    : "INSERT IGNORE INTO {{issue_labels}} (issue_id, label_id) VALUES (?, ?)";
+  for (const id of ids) {
+    await getDB().run(insert, [issueId, id]);
   }
 }
 

package/src/views/issueThread.ts

@@ -11,6 +11,7 @@ import {
   listCommentsPage,
   listCommentsSince,
   getDefaultUpstreamUrl,
+  listLabelsForIssue,
   type CommentRow,
   type IssueWithMeta,
 } from "../store";
@@ -110,6 +111,7 @@ export async function buildIssueThread(
     if (!clone) return null;
     return webUrlFromClone(clone);
   })();
+  const labels = await listLabelsForIssue(issue.id);
 
   const html = renderLayout(
     {
@@ -126,6 +128,8 @@ export async function buildIssueThread(
       upstreamWebUrl,
       translateEnabled: !!cfg.translateUrl && cfg.translateUrl.trim() !== "",
       ttsEnabled: cfg.ttsBackends.some((b) => b.url && b.url.trim() !== ""),
+      labels: labels.map((l) => ({ id: l.id, name: l.name, color: l.color })),
+      canEditLabels: cfg.writesEnabled !== false,
     },
     safeJsonEmbed(payload),
     displayViews.map((v) => renderCommentCard(v, cfg)).join("")

package/src/views/projectLabels.ts

@@ -0,0 +1,190 @@
+import { THEME_CSS, escapeHtml, escapeAttr } from "../render/layout";
+import { projectSettingsTabsHTML } from "./projectUpstreams";
+import { listLabels, type ProjectRow, type UserRow, type LabelRow } from "../store";
+
+interface Flash {
+  kind: "ok" | "err";
+  msg: string;
+}
+
+const PALETTE = [
+  "#888888", "#e11d48", "#db2777", "#9333ea", "#4f46e5",
+  "#2563eb", "#0891b2", "#0d9488", "#16a34a", "#ca8a04",
+  "#d97706", "#92400e",
+];
+
+function colorDot(c: string): string {
+  return `<span class="dot" style="background:${escapeAttr(c)}"></span>`;
+}
+
+function labelRowHtml(l: LabelRow, owner: string, repo: string): string {
+  const base = `/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/settings/labels/${l.id}`;
+  const exclusiveBadge = l.exclusive === 1 ? `<span class="tag" title="互斥标签（scope/name）">互斥</span>` : "";
+  const archivedBadge = l.is_archived === 1 ? `<span class="tag arch">已归档</span>` : "";
+  return `<tr>
+    <td class="nm">${colorDot(l.color)}${escapeHtml(l.name)} ${exclusiveBadge}${archivedBadge}</td>
+    <td class="desc">${escapeHtml(l.description || "—")}</td>
+    <td class="act">
+      <form method="POST" action="${escapeAttr(base)}/update" class="inline" data-edit="${l.id}">
+        <input type="hidden" name="name" value="${escapeAttr(l.name)}">
+        <input type="hidden" name="color" value="${escapeAttr(l.color)}">
+        <input type="hidden" name="description" value="${escapeAttr(l.description)}">
+        <input type="hidden" name="exclusive" value="${l.exclusive}">
+        <button type="button" class="lnk" data-edit-btn="${l.id}">编辑</button>
+      </form>
+      <form method="POST" action="${escapeAttr(base)}/${l.is_archived === 1 ? "unarchive" : "archive"}" class="inline">
+        <button type="submit" class="lnk">${l.is_archived === 1 ? "恢复" : "归档"}</button>
+      </form>
+      <form method="POST" action="${escapeAttr(base)}/delete" class="inline" onsubmit="return confirm('删除标签「${escapeAttr(l.name)}」？会从所有 issue 上移除。')">
+        <button type="submit" class="lnk danger">删除</button>
+      </form>
+    </td>
+  </tr>`;
+}
+
+export async function buildProjectLabelsPage(
+  _viewer: UserRow,
+  project: ProjectRow,
+  flash: Flash | null,
+): Promise<string> {
+  const labels = await listLabels(project.id, true);
+  const rowsHtml = labels.length
+    ? `<table>
+<thead><tr><th>标签</th><th>描述</th><th>操作</th></tr></thead>
+<tbody>${labels.map((l) => labelRowHtml(l, project.owner, project.name)).join("")}</tbody>
+</table>`
+    : `<div class="hint">该项目还没有标签。在下方创建。</div>`;
+
+  const flashHtml = flash ? `<div class="flash ${flash.kind}">${escapeHtml(flash.msg)}</div>` : "";
+  const createAction = `/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/labels/add`;
+  const paletteHtml = PALETTE.map((c) => `<button type="button" class="swatch" data-color="${c}" style="background:${c}" aria-label="${c}"></button>`).join("");
+  const labelsJson = JSON.stringify(labels.map((l) => ({ id: l.id, name: l.name, color: l.color, description: l.description, exclusive: l.exclusive, is_archived: l.is_archived })));
+
+  return `<!doctype html>
+<html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="icon" type="image/svg+xml" href="/favicon.svg">
+<title>标签 · ${escapeHtml(project.owner)}/${escapeHtml(project.name)}</title>
+<style>${THEME_CSS}
+.flash{padding:.5rem .7rem;border-radius:6px;font-size:13px;margin-bottom:.8rem}
+.flash.ok{background:color-mix(in srgb,var(--green) 18%,transparent);color:var(--green)}
+.flash.err{background:color-mix(in srgb,#f85149 18%,transparent);color:#f85149}
+.wrap{max-width:920px;margin:0 auto;padding:1rem}
+h1{font-size:18px;margin:0 0 .4rem}
+h1 a{color:var(--text)}
+.subtabs{display:flex;gap:.4rem;padding:.4rem 0 0;border-bottom:1px solid var(--border);margin-bottom:.9rem}
+.subtab{padding:.35rem .8rem;border-radius:6px 6px 0 0;font-size:13px;color:var(--text-muted)}
+.subtab.active{background:var(--bg-muted);color:var(--text);font-weight:600}
+.card{background:var(--bg-elev);border:1px solid var(--border);border-radius:10px;padding:.9rem 1rem;margin-bottom:.9rem}
+.card h2{font-size:14px;margin:0 0 .7rem;font-weight:600}
+table{width:100%;border-collapse:collapse;font-size:13px}
+th,td{text-align:left;padding:.55rem .45rem;border-bottom:1px solid var(--border);vertical-align:middle}
+th{color:var(--text-muted);font-weight:600;font-size:12px}
+td.nm{font-weight:500}
+td.desc{color:var(--text-muted);font-size:12px}
+td.act{white-space:nowrap;text-align:right}
+.dot{display:inline-block;width:12px;height:12px;border-radius:50%;vertical-align:middle;margin-right:.4rem;border:1px solid var(--border)}
+.chip{display:inline-block;padding:.1rem .5rem;border:1px solid;border-radius:99px;font-size:12px;font-weight:500}
+.tag{display:inline-block;margin-left:.3rem;padding:.05rem .35rem;border-radius:4px;font-size:10px;font-weight:600;background:color-mix(in srgb,var(--accent) 16%,transparent);color:var(--accent)}
+.tag.arch{background:color-mix(in srgb,var(--text-muted) 16%,transparent);color:var(--text-muted)}
+.hint{color:var(--text-muted);font-size:12px;line-height:1.5;margin:.4rem 0}
+label{display:block;font-size:12px;color:var(--text-muted);margin:0 0 .25rem}
+input[type=text],input[type=color]{width:100%;box-sizing:border-box;padding:.5rem .65rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font:inherit;font-size:13px;margin-bottom:.7rem}
+input[type=color]{height:38px;padding:3px;cursor:pointer}
+.row{display:flex;gap:.7rem;align-items:flex-start}
+.row>div{flex:1}
+.swatches{display:flex;flex-wrap:wrap;gap:.3rem;margin:.2rem 0 .7rem}
+.swatch{width:22px;height:22px;border-radius:50%;border:2px solid transparent;cursor:pointer;padding:0}
+.swatch.sel{border-color:var(--text);box-shadow:0 0 0 2px var(--bg)}
+.check{display:flex;align-items:center;gap:.4rem;font-size:13px;color:var(--text);margin-bottom:.7rem;cursor:pointer}
+.check input{margin:0}
+button.primary{padding:.5rem 1rem;border:0;border-radius:6px;background:var(--accent);color:#fff;font-size:13px;cursor:pointer}
+.lnk{background:none;border:0;color:var(--accent);font-size:12px;cursor:pointer;padding:.15rem .25rem;text-decoration:underline}
+.lnk.danger{color:#f85149}
+form.inline{display:inline}
+dialog{border:1px solid var(--border);border-radius:10px;background:var(--bg-elev);color:var(--text);padding:1.2rem;max-width:420px}
+dialog::backdrop{background:rgba(0,0,0,.5)}
+dialog h3{margin:0 0 .7rem;font-size:15px}
+dialog .swatches{margin:.4rem 0}
+dialog .row2{display:flex;gap:.6rem}
+dialog .row2>div{flex:1}
+</style></head><body>
+<header class="topbar"><span style="font-weight:600">🏷️ ${escapeHtml(project.owner)}/${escapeHtml(project.name)} · 标签</span></header>
+<main class="wrap">
+<h1><a href="/${escapeAttr(project.owner)}/${escapeAttr(project.name)}/issues">${escapeHtml(project.owner)}/${escapeHtml(project.name)}</a> · 标签</h1>
+${projectSettingsTabsHTML(project.owner, project.name, "labels")}
+${flashHtml}
+
+<div class="card">
+<h2>已有标签（${labels.length}）</h2>
+${rowsHtml}
+</div>
+
+<form class="card" method="POST" action="${escapeAttr(createAction)}">
+<h2>新建标签</h2>
+<div class="row">
+  <div>
+    <label for="f-name">名称（支持 <code>scope/name</code> 互斥语法）</label>
+    <input id="f-name" name="name" type="text" required maxlength="63" placeholder="如 bug / priority/high">
+  </div>
+  <div style="flex:0 0 80px">
+    <label for="f-color">颜色</label>
+    <input id="f-color" name="color" type="color" value="#888888">
+  </div>
+</div>
+<div class="swatches" id="palette">${paletteHtml}</div>
+<label for="f-desc">描述（可选）</label>
+<input id="f-desc" name="description" type="text" maxlength="255" placeholder="简短说明">
+<label class="check"><input type="checkbox" name="exclusive" value="1"> 互斥标签（同 scope 下只能选一个）</label>
+<div class="hint">名称含 <code>/</code> 时，<code>/</code> 前的部分为 scope。同一 scope 下的互斥标签，一个 issue 只能贴一个。</div>
+<button class="primary" type="submit">创建标签</button>
+</form>
+</main>
+
+<dialog id="dlg">
+  <h3>编辑标签</h3>
+  <form method="POST" id="edit-form">
+    <div class="row2">
+      <div><label>名称</label><input name="name" type="text" required maxlength="63"></div>
+      <div style="flex:0 0 80px"><label>颜色</label><input name="color" type="color"></div>
+    </div>
+    <div class="swatches" id="dlg-palette"></div>
+    <label>描述</label><input name="description" type="text" maxlength="255">
+    <label class="check"><input type="checkbox" name="exclusive" value="1"> 互斥</label>
+    <div style="display:flex;gap:.5rem;justify-content:flex-end;margin-top:.8rem">
+      <button type="button" id="dlg-cancel">取消</button>
+      <button type="submit" class="primary">保存</button>
+    </div>
+  </form>
+</dialog>
+<script>
+const LABELS = ${labelsJson};
+const palette = ${JSON.stringify(PALETTE)};
+function bindSwatches(container, colorInput){
+  container.innerHTML = palette.map(c => '<button type="button" class="swatch" data-color="'+c+'" style="background:'+c+'" aria-label="'+c+'"></button>').join('');
+  const sync = ()=>{ container.querySelectorAll('.swatch').forEach(b=>b.classList.toggle('sel', b.dataset.color.toLowerCase()===colorInput.value.toLowerCase())); };
+  sync();
+  container.addEventListener('click', e=>{ const b=e.target.closest('.swatch'); if(!b)return; colorInput.value=b.dataset.color; sync(); });
+  colorInput.addEventListener('input', sync);
+}
+bindSwatches(document.getElementById('palette'), document.getElementById('f-color'));
+const dlg=document.getElementById('dlg'), ef=document.getElementById('edit-form'), dp=document.getElementById('dlg-palette');
+let dlgColor;
+document.addEventListener('click', e=>{
+  const btn=e.target.closest('[data-edit-btn]');
+  if(!btn)return;
+  const id=Number(btn.dataset.editBtn);
+  const l=LABELS.find(x=>x.id===id); if(!l)return;
+  ef.action=btn.form.action;
+  ef.querySelector('[name=name]').value=l.name;
+  ef.querySelector('[name=color]').value=l.color;
+  dlgColor=ef.querySelector('[name=color]');
+  ef.querySelector('[name=description]').value=l.description;
+  ef.querySelector('[name=exclusive]').checked=l.exclusive===1;
+  bindSwatches(dp, dlgColor);
+  dlg.showModal();
+});
+document.getElementById('dlg-cancel').addEventListener('click', ()=>dlg.close());
+</script>
+</body></html>`;
+}

package/src/views/projectUpstreams.ts

@@ -16,7 +16,7 @@ interface Flash {
 export function projectSettingsTabsHTML(
   owner: string,
   name: string,
-  active: "webhooks" | "members" | "upstreams" | "model",
+  active: "webhooks" | "members" | "upstreams" | "model" | "labels",
 ): string {
   const base = `/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/settings`;
   const cls = (which: typeof active) => (active === which ? " active" : "");
@@ -24,6 +24,7 @@ export function projectSettingsTabsHTML(
     <a class="subtab${cls("webhooks")}" href="${escapeAttr(base)}/webhooks">Webhooks</a>
     <a class="subtab${cls("members")}" href="${escapeAttr(base)}/members">成员</a>
     <a class="subtab${cls("upstreams")}" href="${escapeAttr(base)}/upstreams">上游</a>
+    <a class="subtab${cls("labels")}" href="${escapeAttr(base)}/labels">🏷️ 标签</a>
     <a class="subtab${cls("model")}" href="${escapeAttr(base)}/model">🤖 模型</a>
   </nav>`;
 }

package/src/views/settings.ts

@@ -49,20 +49,23 @@ function buildDbSection(viewer: UserRow): string {
   return `<section class="sg db-section">
 <h2>数据库后端</h2>
 <p class="db-badge">当前后端: <strong>${escapeHtml(driver.toUpperCase())}</strong> · ${escapeHtml(currentTarget)}</p>
-<div class="db-warn">⚠ 切换到 MySQL 后 Web 进程会重启并以 MySQL 为存储。若 MySQL 不可达，进程无法启动——需手动编辑 <code>.env</code> 将 <code>WORK_DB_DRIVER</code> 改回 <code>sqlite</code> 才能恢复。流程：先 ① 测试连接、再 ② 迁移数据、最后 ③ 启用。</div>
+<div class="db-warn">⚠ 切换到 MySQL 后 Web 进程会重启并以 MySQL 为存储。若 MySQL 不可达，进程无法启动——需手动编辑 <code>.env</code> 将 <code>WORK_DB_DRIVER</code> 改回 <code>sqlite</code> 才能恢复。流程：先 ① 测试连接、再 ② 迁移数据、最后 ③ 启用。若你的 MySQL 账号无 CREATE 权限，先点 ⑤ 生成建表 SQL，用有权限的账号跑一遍，再回来 ② 迁移。</div>
 <label class="sf"><span>MySQL 主机</span><input type="text" id="db-host" placeholder="127.0.0.1" autocomplete="off"></label>
 <label class="sf"><span>端口</span><input type="number" id="db-port" value="3306" min="1" max="65535" autocomplete="off"></label>
 <label class="sf"><span>用户名</span><input type="text" id="db-user" placeholder="ework" autocomplete="off"></label>
 <label class="sf"><span>密码</span><input type="password" id="db-password" placeholder="••••••" autocomplete="new-password"></label>
 <label class="sf"><span>数据库名</span><input type="text" id="db-database" placeholder="ework" autocomplete="off"></label>
 <label class="sf"><span>表前缀（可选）</span><input type="text" id="db-prefix" placeholder="留空 = 无前缀" autocomplete="off"></label>
+<label class="sf"><span>daemon 前缀（可选）</span><input type="text" id="db-daemon-prefix" placeholder="留空 = 自动用「表前缀」+d_" autocomplete="off"></label>
 <div class="db-controls">
 <button type="button" id="db-test">① 测试连接</button>
 <button type="button" id="db-migrate" class="secondary">② 迁移数据</button>
 <button type="button" id="db-daemon" class="secondary">③ 配置 daemon</button>
 <button type="button" id="db-enable" class="secondary">④ 启用并重启</button>
+<button type="button" id="db-ddl" class="secondary">⑤ 生成建表 SQL（手动建库）</button>
 </div>
 <div id="db-result" class="db-result"></div>
+<div id="db-ddl-out" style="display:none;margin-top:.6rem"><div class="db-controls" style="align-items:center"><button type="button" id="db-ddl-copy" class="secondary">📋 复制 SQL</button><span id="db-ddl-meta" style="font-size:12px;color:var(--text-muted)"></span></div><textarea id="db-ddl-text" readonly style="width:100%;min-height:240px;padding:.5rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font-size:11px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" wrap="off"></textarea></div>
 ${isMysql ? `<hr style="border:0;border-top:1px solid var(--border);margin:1rem 0"><div class="db-controls"><button type="button" id="db-revert" class="secondary">⚠ 切回 SQLite（安全网）</button></div><div id="db-revert-result" class="db-result"></div>` : ""}
 <script src="/static/db-wizard.js"></script>
 </section>`;
@@ -205,6 +208,11 @@ function buildGroupsSection(): string {
       <button type="button" id="binding-add" class="secondary">添加绑定</button>
     </div>
   </div>
+  <div id="group-configs-editor" style="margin-top:.7rem">
+    <h2 style="margin-bottom:.5rem">分组工作目录与脚本</h2>
+    <p class="hint" style="margin:0 0 .5rem">为每个分组配置工作目录模板和生命周期脚本。模板变量：<code>{owner}</code> <code>{repo}</code> <code>{issue}</code> <code>{session}</code>。脚本在 daemon 上以工作目录为 cwd 执行。</p>
+    <div id="group-configs-list"></div>
+  </div>
   <div class="db-controls" style="margin-top:.7rem">
     <button type="button" id="strategy-save">保存策略</button>
   </div>

package/src/webhooks.ts

@@ -26,6 +26,7 @@ import {
   getDefaultUpstreamUrl,
   ensureUser,
   resolveModel,
+  listLabelsForIssue,
   type IssueRow,
   type ProjectRow,
   type CommentRow,
@@ -355,12 +356,18 @@ function buildRepository(project: ProjectRow, origin: string, model?: string): P
   return repo;
 }
 
+async function toPayloadLabels(issueId: number): Promise<PayloadLabel[]> {
+  const rows = await listLabelsForIssue(issueId);
+  return rows.map((l) => ({ id: l.id, name: l.name, color: l.color, description: l.description }));
+}
+
 function buildIssue(
   issue: IssueRow,
   project: ProjectRow,
   commentCount: number,
   origin: string,
   model?: string,
+  labels: PayloadLabel[] = [],
 ): PayloadIssue {
   const repoUrl = `${origin}/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}`;
   const issueUrl = `${repoUrl}/issues/${issue.number}`;
@@ -371,7 +378,7 @@ function buildIssue(
     number: issue.number,
     title: issue.title,
     body: issue.body ?? "",
-    labels: [],
+    labels,
     milestone: null,
     assignee: null,
     assignees: null,
@@ -415,10 +422,11 @@ function buildCommentPayload(
   commentCount: number,
   origin: string,
   model?: string,
+  labels: PayloadLabel[] = [],
 ): CommentEventPayload {
   return {
     action: "created",
-    issue: buildIssue(issue, project, commentCount, origin, model),
+    issue: buildIssue(issue, project, commentCount, origin, model, labels),
     comment: buildComment(issue, comment, project, origin),
     repository: buildRepository(project, origin, model),
     sender: buildUser(comment.author, origin),
@@ -432,10 +440,11 @@ function buildIssuePayload(
   action: IssueAction,
   origin: string,
   model?: string,
+  labels: PayloadLabel[] = [],
 ): IssueEventPayload {
   return {
     action,
-    issue: buildIssue(issue, project, commentCount, origin, model),
+    issue: buildIssue(issue, project, commentCount, origin, model, labels),
     repository: buildRepository(project, origin, model),
     sender: buildUser(issue.author, origin),
   };
@@ -604,7 +613,8 @@ export async function emitIssueEvent(
     // comes from the config table via loadConfig() — cheap DB read.
     const globalDefault = (await loadConfig()).defaultModel;
     const model = resolveModel(project.model, globalDefault);
-    const payload = buildIssuePayload(issue, project, commentCount, action, origin, model);
+    const labels = await toPayloadLabels(issueId);
+    const payload = buildIssuePayload(issue, project, commentCount, action, origin, model, labels);
     const rawBody = JSON.stringify(payload);
     await fanOut(projectId, "issues", rawBody);
   } catch (e) {
@@ -633,7 +643,8 @@ export async function emitCommentEvent(
     const commentCount = await countCommentsSafe(issueId);
     const globalDefault = (await loadConfig()).defaultModel;
     const model = resolveModel(project.model, globalDefault);
-    const payload = buildCommentPayload(issue, comment, project, commentCount, origin, model);
+    const labels = await toPayloadLabels(issueId);
+    const payload = buildCommentPayload(issue, comment, project, commentCount, origin, model, labels);
     const rawBody = JSON.stringify(payload);
     await fanOut(projectId, "issue_comment", rawBody);
   } catch (e) {