kczx-user-management 1.0.2 → 1.0.4

package/CUTOVER-RUNBOOK.md

@@ -39,7 +39,7 @@ takes a few minutes and the rollback takes one command.
 #    user-management:
 #      listenHost: '0.0.0.0'    # was 127.0.0.1 (observer mode)
 #      plaintext: false         # was true: the door terminates TLS again
-#      port: 19843
+#      port: 8088
 #      trustedSecret: ''        # no signing gateway in front of it any more
 
 # 2. remove dsh-passwords from the profile
@@ -50,7 +50,7 @@ dsh plugin --profile web remove dsh-passwords
 
 ## Verification after the switch
 
-1. `https://<host>:19843/login` renders, a wrong password is refused, a correct
+1. `https://<host>:8088/login` renders, a wrong password is refused, a correct
    one lands on the SPA.
 2. The settings page shows 用户管理 with the accounts that were migrated
    (`mxz`, `mxz1`) and their permissions intact.

package/MERGED-DEPLOYMENT.md

@@ -43,7 +43,7 @@ dsh 宿主 127.0.0.1:3080
 user-management:
   enabled: true
   listenHost: '127.0.0.1'   # 明文模式会强制为回环，配别的会被拒绝并告警
-  port: 19843
+  port: 8088
   plaintext: true           # 明文监听：登录门的 WS 升级走裸 TCP 隧道，无法对这一跳做 TLS
   trustedSecret: '<64 hex>' # 与 dsh-passwords 的 MCP_IDENTITY_SECRET 必须逐字一致
   # trustedPeers: []        # 默认即回环；仅在确有需要时覆盖
@@ -53,7 +53,7 @@ user-management:
 
 ```
 MCP_IDENTITY_SECRET=<同一个 64 hex>     # 专用密钥，不复用 MCP_INTERNAL_SECRET
-MCP_GATEWAY_UPSTREAM=http://127.0.0.1:19843
+MCP_GATEWAY_UPSTREAM=http://127.0.0.1:8088
 ```
 
 两端密钥不一致是**静默失败**——观察层会拒绝全部请求，台账停止增长而没有任何报错。

package/README.md

@@ -54,11 +54,30 @@ pnpm add ./kczx-user-management-1.0.0.tgz        # 正常路径：依赖从 regi
 node scripts/ensure-deps.mjs                     # 仅当上述解析不到 schemastery 时才需要
 ```
 
+## 首次使用（初始化）
+
+**自助注册是关闭的**：账号只能由管理员在设置页创建，第一个管理员走"初始化"流程。
+
+1. 启动 dsh。库里还没有任何账号时，启动日志会打印一行初始化密钥：
+
+   ```
+   [user-management] first-run setup key 3f0c… (also in ~/.dsh/user-management/setup-key.txt)
+   ```
+
+   密钥同时写在 `$DSH_HOME/user-management/setup-key.txt`；也可以用 `settings.yaml` 的
+   `user-management.setupKey` 自行指定（那样不会往磁盘写密钥文件）。
+
+2. 浏览器打开 `https://<主机>:8088/login` —— 此时显示**初始化页**：填初始化密钥 + 用户名 + 密码。
+3. 提交后该账号**直接成为管理员并登录**，初始化密钥当场销毁（删文件、清内存）；此后 `/login` 只显示登录表单，
+   `/user-management/api/setup` 拒绝一切后续调用。
+
+> 登录页样式与 dsh-passwords 一致（光晕背景 + 网格 + 玻璃卡片 + 渐变按钮），跟随宿主主题深浅色，右上角可切换中文 / English。
+
 ## 它做什么
 
 ### 一扇门
 
-独立的 `node:https` 监听器（默认 `0.0.0.0:19843`），自签证书（SAN 覆盖本机全部 IP + sslip.io / nip.io 别名），
+独立的 `node:https` 监听器（默认 `0.0.0.0:8088`），自签证书（SAN 覆盖本机全部 IP + sslip.io / nip.io 别名），
 未登录的页面访问跳转 `/login`、API 请求 401；登录页自带深浅色。设置页提供证书下载（PEM/DER）、指纹核对与
 各系统导入向导。
 
@@ -68,7 +87,7 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 |---|---|
 | 用户增删改查 | 用户表每行一个「编辑」**全屏页**：基本资料（部门 / 角色）+ 账号操作（重置密码 / 重置两步验证 / 禁用启用 / 删除）+ 权限与配额，集中一屏；改动类走「保存」，破坏性操作仍是各自带确认的按钮 |
 | 所属部门 | 账号资料字段（trim 后 ≤ 64 字，控制字符剔除）：新增用户时可填，编辑页可随时改或清空；变更写进操作日志 |
-| 工作区白名单 | 留空 = 允许全部；填写后只允许这些目录（Windows 路径折叠大小写，末尾斜杠自动忽略） |
+| 工作区白名单 | **留空 = 不允许任何工作区**（白名单默认拒绝）；填写后只允许这些目录下的工作区；条目 `*` = 允许全部。Windows 路径折叠大小写，末尾斜杠自动忽略 |
 | 工作区归属跟踪 | 谁创建的工作区归谁：别人看不到、也不能删改；删除后释放，账号删除后清理 |
 | 每小时 token 配额 | 由浏览器上报 dsh 自身的用量投影增量，服务端按小时窗口累计并拦截 |
 | 每日时长配额 | 按真实活跃时间累计（不是请求数），限流不因轮询膨胀 |
@@ -80,7 +99,7 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 
 | 台账 | 内容 |
 |---|---|
-| 登录记录 | 登录 / 失败 / 登出 / 改密 / 注册 / 角色变更 / 删号 / 权限变更（含紧凑差异串） |
+| 登录记录 | 登录 / 失败 / 登出 / 改密 / 初始化（首次建号）/ 建号 / 删号 / 角色变更 / 资料变更 / 权限变更（含紧凑差异串） |
 | 访问记录 | 页面级访问（保留真实客户端 IP） |
 | 操作日志 | 经过网关的每次 API 调用与 WebSocket 连接（方法 / 路径 / 状态 / 来源 IP） |
 
@@ -94,11 +113,11 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 user-management:
   enabled: true
   listenHost: '0.0.0.0'   # 只本机可达就填 127.0.0.1
-  port: 19843
+  port: 8088
   plaintext: false        # true 时只允许回环（明文服务观察层用，见 MERGED-DEPLOYMENT.md）
   sites: []               # 空 = 自动枚举本机 IP；配域名 + 证书则按 SNI 选择
   title: 'DSH 控制台'
-  autoActivate: false     # false = 自助注册需管理员启用
+  setupKey: ''            # 首次初始化密钥；留空 = 启动时随机生成并写到 setup-key.txt
   historyMaxBytes: 67108864   # 历史改写缓冲上限（字节，默认 64 MiB，最小 1 MiB）
 ```
 
@@ -152,6 +171,9 @@ dsh plugin --profile web remove kczx-user-management
 - **执行只对本地存在的账号生效**：签名身份 / 未知用户名按「不限制」处理，避免迁移期误锁人。
 - **门只管走门的人**：若另有插件把 dsh 宿主绑到 `0.0.0.0`（例如 dsh-lan-access），直连宿主端口即可绕过登录，
   且**绕过流量不会出现在任何一本台账里**。要真正的强制约束，宿主端口必须保持回环。
+- **工作区白名单的语义**：空名单 = 全部禁止（1.0.4 起；此前是"允许全部"）。升级时会对老记录做**一次性迁移**——把"空名单"写成显式
+  的 `*`（允许全部），保持账号原有的可达范围；迁移只跑一次（留下 `workspace-scope-migration.json` 标记），之后你手工清空白名单
+  才等于全部禁止。新建账号默认空 = 无工作区权限。
 - **token 配额依赖客户端上报**：浏览器侧被禁用或页面未加载时不计费（时长配额不受影响，它在服务端计时）。
 - **会话历史要缓冲后才能改写**：历史响应是**一个 JSON 文档**（长会话实测 9–16 MB），网关必须先缓冲才能做沙盒降级与隐藏字符
   清洗，因此有 `historyMaxBytes` 上限（默认 64 MiB）。超过上限的会话会 **fail-closed 返回 502**，UI 显示「历史加载失败」——

package/client/bundle.js

@@ -199,8 +199,11 @@ window.__ModuleLoader__.load({
       usageTokensFree: '{used} tok/h',
       permissionsTitle: '权限与配额',
       permFolders: '工作区白名单',
-      permFoldersHint: '留空 = 允许访问所有工作区；填写后只允许这些目录下的工作区。',
-      permFoldersAll: '未限制（允许全部工作区）',
+      permFoldersHint: '留空 = 不允许任何工作区；填写后只允许这些目录下的工作区；条目 * 表示允许全部。',
+      permFoldersNone: '未授权（不允许任何工作区）',
+      permFoldersAll: '允许全部（*）',
+      permFoldersAllShort: '允许全部工作区',
+      permFoldersNoneShort: '禁止所有工作区',
       permFolderPlaceholder: '例如 /srv/work 或 D:\\work',
       add: '添加',
       remove: '移除',
@@ -382,8 +385,11 @@ window.__ModuleLoader__.load({
       usageTokensFree: '{used} tok/h',
       permissionsTitle: 'Permissions & Quota',
       permFolders: 'Workspace allow-list',
-      permFoldersHint: 'Empty = every workspace is allowed; once filled, only workspaces under these folders are.',
-      permFoldersAll: 'Unrestricted (all workspaces allowed)',
+      permFoldersHint: 'Empty = no workspace at all; once filled, only workspaces under these folders are. Add * to allow every workspace.',
+      permFoldersNone: 'Not granted (no workspace allowed)',
+      permFoldersAll: 'Allow all (*)',
+      permFoldersAllShort: 'All workspaces',
+      permFoldersNoneShort: 'No workspace',
       permFolderPlaceholder: 'e.g. /srv/work or D:\\work',
       add: 'Add',
       remove: 'Remove',
@@ -518,6 +524,10 @@ window.__ModuleLoader__.load({
     .um-wrap { font-size: 13px; color: var(--dsw-alias-label-primary); display: flex; flex-direction: column; gap: 14px; }
     .um-avatar { border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; color: rgba(255,255,255,.95); font-weight: 600; flex: none; user-select: none; letter-spacing: 0; }
     .um-brand-name { font-size: 13px; font-weight: 600; color: var(--dsw-alias-label-primary); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block; max-width: 150px; }
+    .um-header-user { display: inline-flex; align-items: center; }
+    .um-header-user-btn { display: inline-flex; align-items: center; gap: 7px; padding: 3px 10px 3px 3px; border: 1px solid transparent; border-radius: 999px; background: transparent; color: var(--dsw-alias-label-primary); font: inherit; font-size: 12.5px; line-height: 1; cursor: pointer; }
+    .um-header-user-btn:hover { background: var(--dsw-alias-interactive-bg-hover); border-color: var(--dsw-alias-border-l2); }
+    .um-header-user-name { max-width: 130px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
     .um-logout { display: inline-flex; align-items: center; gap: 6px; border: 0; background: transparent; color: var(--dsw-alias-label-secondary); font-size: 12px; padding: 6px 10px; border-radius: 7px; cursor: pointer; flex: none; }
     .um-logout:hover { background: var(--dsw-alias-interactive-bg-hover); color: var(--dsw-alias-state-error-primary); }
     .um-user-menu { min-width: 216px; background: var(--dsw-alias-bg-layer-1); border: 1px solid var(--dsw-alias-border-l2); border-radius: 10px; box-shadow: 0 8px 28px rgba(0,0,0,.18); padding: 6px; }
@@ -650,45 +660,36 @@ window.__ModuleLoader__.load({
       }, label.charAt(0).toUpperCase())
     }
 
-    /** Sidebar brand mark — host renders it in the expanded brand row AND the
-     *  collapsed rail (owner supplies the square `size`), so fold states adapt
-     *  without us tracking the shell. Clicking it (or the name) opens the
-     *  user menu; sign-out sits at the bottom in red. */
-    function BrandMark({ size, className }) {
+    /** Account menu for the right end of the conversation header.
+     *
+     *  It lives in the session header's utilities group rather than the sidebar's
+     *  brand seat: the brand belongs to the host (its fish logo returns there
+     *  untouched), while the signed-in account belongs to the surface that acts on
+     *  its behalf. Clicking opens the same menu used everywhere else — change
+     *  password, sign out — with sign-out last, in red.
+     *
+     *  Session-scoped by construction: the header only exists once a conversation
+     *  is open, so on the welcome screen there is no account chip to click. */
+    function HeaderUserMenu() {
       useEffect(ensureStyles, [])
       const [me, setMe] = useState(sessionCache.me)
       useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
       const { toggle, menu, dialog } = useUserMenu(me)
-      if (!me) {
-        return h('div', { className, style: { width: size, height: size, borderRadius: '50%', background: 'var(--dsw-alias-bg-layer-3)' } })
-      }
-      return h('div', {
-        className,
-        style: { cursor: 'pointer', display: 'inline-flex', borderRadius: '50%' },
-        title: me.username,
-        'aria-haspopup': 'menu',
-        onClick: toggle,
-      },
-        h(UserAvatar, { username: me.username, size: size || 24 }),
+      if (!me) return null
+      return h('div', { className: 'um-header-user' },
+        h('button', {
+          type: 'button',
+          className: 'um-header-user-btn',
+          title: me.username,
+          'aria-haspopup': 'menu',
+          onClick: toggle,
+        },
+          h(UserAvatar, { username: me.username, size: 22 }),
+          h('span', { className: 'um-header-user-name' }, me.username)),
         menu,
         dialog)
     }
 
-    /** Sidebar brand name — host renders it beside the expanded mark only. */
-    function BrandName() {
-      useEffect(ensureStyles, [])
-      const [me, setMe] = useState(sessionCache.me)
-      useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
-      const { toggle, menu, dialog } = useUserMenu(me)
-      return h('span', {
-        className: 'um-brand-name',
-        style: { cursor: 'pointer' },
-        title: me ? me.username : '',
-        'aria-haspopup': 'menu',
-        onClick: toggle,
-      }, me ? me.username : '', menu, dialog)
-    }
-
     // ── logout ────────────────────────────────────────────────────────────────
 
     /** Locale accessor for slot components living outside apply()'s closure —
@@ -879,14 +880,22 @@ window.__ModuleLoader__.load({
       return byTime || byTokens
     }
 
+    /** Whether one allow-list entry grants every workspace ('*', '/', '.' or ''). */
+    function folderAllowsEverything(entry) {
+      return entry === '*' || entry === '' || entry === '/' || entry === '.'
+    }
+
     /** One-line limits summary for the users table. */
     function permissionSummary(user, t) {
       const p = user.permissions || {}
       const bits = []
       if (p.banned) bits.push(t('permBannedShort'))
-      if (Array.isArray(p.allowedFolders) && p.allowedFolders.length > 0) {
-        bits.push(interpolate(t('permFoldersShort'), { n: p.allowedFolders.length }))
-      }
+      // The workspace field always says something: an untouched account is denied,
+      // which the table must show rather than leave blank.
+      const folders = Array.isArray(p.allowedFolders) ? p.allowedFolders : []
+      if (folders.length === 0) bits.push(t('permFoldersNoneShort'))
+      else if (folders.some(folderAllowsEverything)) bits.push(t('permFoldersAllShort'))
+      else bits.push(interpolate(t('permFoldersShort'), { n: folders.length }))
       if (p.hourlyTokenLimit != null) bits.push(interpolate(t('permTokensShort'), { n: p.hourlyTokenLimit }))
       if (p.dailyMinuteLimit != null) bits.push(interpolate(t('permMinutesShort'), { n: p.dailyMinuteLimit }))
       if (p.sandboxMode) bits.push(p.sandboxMode)
@@ -906,9 +915,10 @@ window.__ModuleLoader__.load({
      *  confirm: folding those into a save button would hide them from the operator
      *  reviewing the form before pressing it.
      *
-     *  The store's reading is surfaced verbatim: an empty folder list means every
-     *  workspace, an empty limit means no cap — clearing a field is a visible,
-     *  deliberate act rather than a silent default. */
+     *  The store's reading is surfaced verbatim: an empty folder list means NO
+     *  workspace (the whitelist denies by default, and '*' is the wide grant), an
+     *  empty limit means no cap — clearing a field is a visible, deliberate act
+     *  rather than a silent default. */
     function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
       const p = user.permissions || {}
       const isSelf = user.id === me.id
@@ -1063,7 +1073,7 @@ window.__ModuleLoader__.load({
                 h('label', null, t('permFolders')),
                 h('div', { className: 'um-muted', style: { fontSize: 11, marginTop: -4 } }, t('permFoldersHint')),
                 folders.length === 0
-                  ? h('div', { className: 'um-empty' }, t('permFoldersAll'))
+                  ? h('div', { className: 'um-empty' }, t('permFoldersNone'))
                   : folders.map((folder, index) => h('div', { key: folder, className: 'um-row' },
                     h('code', { style: { flex: 1, wordBreak: 'break-all', fontSize: 12 } }, folder),
                     h('button', {
@@ -1076,7 +1086,12 @@ window.__ModuleLoader__.load({
                     value: draft, onChange: (e) => setDraft(e.target.value),
                     onKeyDown: (e) => { if (e.key === 'Enter') { e.preventDefault(); addFolder() } },
                   }),
-                  h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add'))),
+                  h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add')),
+            // Blank now means "no workspace", so the wide grant needs its own door.
+            h('button', {
+              className: 'um-btn', style: { flex: 'none' },
+              onClick: () => { if (!folders.includes('*')) setFolders([...folders, '*']) },
+            }, t('permFoldersAll'))),
 
                 h('label', { htmlFor: 'um-perm-tokens' }, t('permTokenLimit')),
                 h('input', {
@@ -1810,24 +1825,24 @@ window.__ModuleLoader__.load({
       name: CLIENT_NAME,
       inject: ['slots', 'locale'],
       __boot,
-      __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, BrandMark, BrandName, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
+      __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, HeaderUserMenu, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
       apply(ctx) {
         ctx.locale.register(NS, 'zh', ZH)
         ctx.locale.register(NS, 'en', EN)
         const t = ctx.locale.bind(NS)
         localeT = t
         ctx.effect(() => {
-          // Official-brand pattern: nested injects claim both brand seats, one
-          // generator registers them. The mark shows in expanded row + collapsed
-          // rail (fold-adaptive), the name only beside the expanded mark.
-          // priority: -1 shadows the host's default brand registration at 0
-          // ("lowest renders"); uninstalling this plugin restores the official
-          // brand with no residue.
-          ctx.slots.inject('sidebar.brand.mark', () => ctx.slots.inject('sidebar.brand.name', function* () {
-            yield ctx.slots.register({ name: 'sidebar.brand.mark', priority: -1 }, BrandMark)
-            yield ctx.slots.register({ name: 'sidebar.brand.name', priority: -1 }, BrandName)
-          }))
-        }, 'user-management: sidebar brand')
+          // The account chip sits at the right end of the conversation header (the
+          // utilities group). The sidebar's brand seats are deliberately left to the
+          // host: its fish logo stays where it was, and uninstalling this plugin
+          // leaves nothing behind.
+          ctx.slots.inject('conversation.session.header.utilities', () => ctx.slots.register({
+            name: 'conversation.session.header.utilities',
+            id: `${CLIENT_NAME}:user-menu`,
+            order: 50,
+            locale: NS,
+          }, HeaderUserMenu))
+        }, 'user-management: session header account menu')
         // Token accounting: the session-scoped dock slot is the one seat whose
         // standard props carry `useProjection` — the only place the browser can
         // read the host's own token totals.

package/client/index.js

@@ -189,8 +189,11 @@ const ZH = {
   usageTokensFree: '{used} tok/h',
   permissionsTitle: '权限与配额',
   permFolders: '工作区白名单',
-  permFoldersHint: '留空 = 允许访问所有工作区；填写后只允许这些目录下的工作区。',
-  permFoldersAll: '未限制（允许全部工作区）',
+  permFoldersHint: '留空 = 不允许任何工作区；填写后只允许这些目录下的工作区；条目 * 表示允许全部。',
+  permFoldersNone: '未授权（不允许任何工作区）',
+  permFoldersAll: '允许全部（*）',
+  permFoldersAllShort: '允许全部工作区',
+  permFoldersNoneShort: '禁止所有工作区',
   permFolderPlaceholder: '例如 /srv/work 或 D:\\work',
   add: '添加',
   remove: '移除',
@@ -372,8 +375,11 @@ const EN = {
   usageTokensFree: '{used} tok/h',
   permissionsTitle: 'Permissions & Quota',
   permFolders: 'Workspace allow-list',
-  permFoldersHint: 'Empty = every workspace is allowed; once filled, only workspaces under these folders are.',
-  permFoldersAll: 'Unrestricted (all workspaces allowed)',
+  permFoldersHint: 'Empty = no workspace at all; once filled, only workspaces under these folders are. Add * to allow every workspace.',
+  permFoldersNone: 'Not granted (no workspace allowed)',
+  permFoldersAll: 'Allow all (*)',
+  permFoldersAllShort: 'All workspaces',
+  permFoldersNoneShort: 'No workspace',
   permFolderPlaceholder: 'e.g. /srv/work or D:\\work',
   add: 'Add',
   remove: 'Remove',
@@ -508,6 +514,10 @@ const STYLE = `
 .um-wrap { font-size: 13px; color: var(--dsw-alias-label-primary); display: flex; flex-direction: column; gap: 14px; }
 .um-avatar { border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; color: rgba(255,255,255,.95); font-weight: 600; flex: none; user-select: none; letter-spacing: 0; }
 .um-brand-name { font-size: 13px; font-weight: 600; color: var(--dsw-alias-label-primary); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block; max-width: 150px; }
+.um-header-user { display: inline-flex; align-items: center; }
+.um-header-user-btn { display: inline-flex; align-items: center; gap: 7px; padding: 3px 10px 3px 3px; border: 1px solid transparent; border-radius: 999px; background: transparent; color: var(--dsw-alias-label-primary); font: inherit; font-size: 12.5px; line-height: 1; cursor: pointer; }
+.um-header-user-btn:hover { background: var(--dsw-alias-interactive-bg-hover); border-color: var(--dsw-alias-border-l2); }
+.um-header-user-name { max-width: 130px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .um-logout { display: inline-flex; align-items: center; gap: 6px; border: 0; background: transparent; color: var(--dsw-alias-label-secondary); font-size: 12px; padding: 6px 10px; border-radius: 7px; cursor: pointer; flex: none; }
 .um-logout:hover { background: var(--dsw-alias-interactive-bg-hover); color: var(--dsw-alias-state-error-primary); }
 .um-user-menu { min-width: 216px; background: var(--dsw-alias-bg-layer-1); border: 1px solid var(--dsw-alias-border-l2); border-radius: 10px; box-shadow: 0 8px 28px rgba(0,0,0,.18); padding: 6px; }
@@ -640,45 +650,36 @@ function UserAvatar({ username, size = 22 }) {
   }, label.charAt(0).toUpperCase())
 }
 
-/** Sidebar brand mark — host renders it in the expanded brand row AND the
- *  collapsed rail (owner supplies the square `size`), so fold states adapt
- *  without us tracking the shell. Clicking it (or the name) opens the
- *  user menu; sign-out sits at the bottom in red. */
-function BrandMark({ size, className }) {
+/** Account menu for the right end of the conversation header.
+ *
+ *  It lives in the session header's utilities group rather than the sidebar's
+ *  brand seat: the brand belongs to the host (its fish logo returns there
+ *  untouched), while the signed-in account belongs to the surface that acts on
+ *  its behalf. Clicking opens the same menu used everywhere else — change
+ *  password, sign out — with sign-out last, in red.
+ *
+ *  Session-scoped by construction: the header only exists once a conversation
+ *  is open, so on the welcome screen there is no account chip to click. */
+function HeaderUserMenu() {
   useEffect(ensureStyles, [])
   const [me, setMe] = useState(sessionCache.me)
   useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
   const { toggle, menu, dialog } = useUserMenu(me)
-  if (!me) {
-    return h('div', { className, style: { width: size, height: size, borderRadius: '50%', background: 'var(--dsw-alias-bg-layer-3)' } })
-  }
-  return h('div', {
-    className,
-    style: { cursor: 'pointer', display: 'inline-flex', borderRadius: '50%' },
-    title: me.username,
-    'aria-haspopup': 'menu',
-    onClick: toggle,
-  },
-    h(UserAvatar, { username: me.username, size: size || 24 }),
+  if (!me) return null
+  return h('div', { className: 'um-header-user' },
+    h('button', {
+      type: 'button',
+      className: 'um-header-user-btn',
+      title: me.username,
+      'aria-haspopup': 'menu',
+      onClick: toggle,
+    },
+      h(UserAvatar, { username: me.username, size: 22 }),
+      h('span', { className: 'um-header-user-name' }, me.username)),
     menu,
     dialog)
 }
 
-/** Sidebar brand name — host renders it beside the expanded mark only. */
-function BrandName() {
-  useEffect(ensureStyles, [])
-  const [me, setMe] = useState(sessionCache.me)
-  useEffect(() => { loadMeCached().then((user) => setMe(user)) }, [])
-  const { toggle, menu, dialog } = useUserMenu(me)
-  return h('span', {
-    className: 'um-brand-name',
-    style: { cursor: 'pointer' },
-    title: me ? me.username : '',
-    'aria-haspopup': 'menu',
-    onClick: toggle,
-  }, me ? me.username : '', menu, dialog)
-}
-
 // ── logout ────────────────────────────────────────────────────────────────
 
 /** Locale accessor for slot components living outside apply()'s closure —
@@ -869,14 +870,22 @@ function overQuota(user) {
   return byTime || byTokens
 }
 
+/** Whether one allow-list entry grants every workspace ('*', '/', '.' or ''). */
+function folderAllowsEverything(entry) {
+  return entry === '*' || entry === '' || entry === '/' || entry === '.'
+}
+
 /** One-line limits summary for the users table. */
 function permissionSummary(user, t) {
   const p = user.permissions || {}
   const bits = []
   if (p.banned) bits.push(t('permBannedShort'))
-  if (Array.isArray(p.allowedFolders) && p.allowedFolders.length > 0) {
-    bits.push(interpolate(t('permFoldersShort'), { n: p.allowedFolders.length }))
-  }
+  // The workspace field always says something: an untouched account is denied,
+  // which the table must show rather than leave blank.
+  const folders = Array.isArray(p.allowedFolders) ? p.allowedFolders : []
+  if (folders.length === 0) bits.push(t('permFoldersNoneShort'))
+  else if (folders.some(folderAllowsEverything)) bits.push(t('permFoldersAllShort'))
+  else bits.push(interpolate(t('permFoldersShort'), { n: folders.length }))
   if (p.hourlyTokenLimit != null) bits.push(interpolate(t('permTokensShort'), { n: p.hourlyTokenLimit }))
   if (p.dailyMinuteLimit != null) bits.push(interpolate(t('permMinutesShort'), { n: p.dailyMinuteLimit }))
   if (p.sandboxMode) bits.push(p.sandboxMode)
@@ -896,9 +905,10 @@ function permissionSummary(user, t) {
  *  confirm: folding those into a save button would hide them from the operator
  *  reviewing the form before pressing it.
  *
- *  The store's reading is surfaced verbatim: an empty folder list means every
- *  workspace, an empty limit means no cap — clearing a field is a visible,
- *  deliberate act rather than a silent default. */
+ *  The store's reading is surfaced verbatim: an empty folder list means NO
+ *  workspace (the whitelist denies by default, and '*' is the wide grant), an
+ *  empty limit means no cap — clearing a field is a visible, deliberate act
+ *  rather than a silent default. */
 function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
   const p = user.permissions || {}
   const isSelf = user.id === me.id
@@ -1053,7 +1063,7 @@ function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
             h('label', null, t('permFolders')),
             h('div', { className: 'um-muted', style: { fontSize: 11, marginTop: -4 } }, t('permFoldersHint')),
             folders.length === 0
-              ? h('div', { className: 'um-empty' }, t('permFoldersAll'))
+              ? h('div', { className: 'um-empty' }, t('permFoldersNone'))
               : folders.map((folder, index) => h('div', { key: folder, className: 'um-row' },
                 h('code', { style: { flex: 1, wordBreak: 'break-all', fontSize: 12 } }, folder),
                 h('button', {
@@ -1066,7 +1076,12 @@ function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
                 value: draft, onChange: (e) => setDraft(e.target.value),
                 onKeyDown: (e) => { if (e.key === 'Enter') { e.preventDefault(); addFolder() } },
               }),
-              h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add'))),
+              h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add')),
+        // Blank now means "no workspace", so the wide grant needs its own door.
+        h('button', {
+          className: 'um-btn', style: { flex: 'none' },
+          onClick: () => { if (!folders.includes('*')) setFolders([...folders, '*']) },
+        }, t('permFoldersAll'))),
 
             h('label', { htmlFor: 'um-perm-tokens' }, t('permTokenLimit')),
             h('input', {
@@ -1800,24 +1815,24 @@ module.exports = {
   name: CLIENT_NAME,
   inject: ['slots', 'locale'],
   __boot,
-  __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, BrandMark, BrandName, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
+  __internals: { NS, ZH, EN, TYPE_LABELS, api, formatTime, interpolate, filterActivity, filterAudit, avatarHue, UserAvatar, HeaderUserMenu, canBanIp, BanIpButton, ChangePasswordDialog, UserMenu, CertCard, CERT_INSTALL_COMMANDS, UserManagementSection, UserManagementEntry, AdminPanel, TotpCard, TotpSetupDialog, TotpDisableDialog },
   apply(ctx) {
     ctx.locale.register(NS, 'zh', ZH)
     ctx.locale.register(NS, 'en', EN)
     const t = ctx.locale.bind(NS)
     localeT = t
     ctx.effect(() => {
-      // Official-brand pattern: nested injects claim both brand seats, one
-      // generator registers them. The mark shows in expanded row + collapsed
-      // rail (fold-adaptive), the name only beside the expanded mark.
-      // priority: -1 shadows the host's default brand registration at 0
-      // ("lowest renders"); uninstalling this plugin restores the official
-      // brand with no residue.
-      ctx.slots.inject('sidebar.brand.mark', () => ctx.slots.inject('sidebar.brand.name', function* () {
-        yield ctx.slots.register({ name: 'sidebar.brand.mark', priority: -1 }, BrandMark)
-        yield ctx.slots.register({ name: 'sidebar.brand.name', priority: -1 }, BrandName)
-      }))
-    }, 'user-management: sidebar brand')
+      // The account chip sits at the right end of the conversation header (the
+      // utilities group). The sidebar's brand seats are deliberately left to the
+      // host: its fish logo stays where it was, and uninstalling this plugin
+      // leaves nothing behind.
+      ctx.slots.inject('conversation.session.header.utilities', () => ctx.slots.register({
+        name: 'conversation.session.header.utilities',
+        id: `${CLIENT_NAME}:user-menu`,
+        order: 50,
+        locale: NS,
+      }, HeaderUserMenu))
+    }, 'user-management: session header account menu')
     // Token accounting: the session-scoped dock slot is the one seat whose
     // standard props carry `useProjection` — the only place the browser can
     // read the host's own token totals.

package/docs/FAQ.md

@@ -57,7 +57,7 @@ rm ~/.dsh/user-management/users.json ~/.dsh/user-management/sessions.json
 
 ## 为什么直连 dsh web 端口（19080/3080）没有登录墙
 
-v0.4 起门禁由本插件**自带的 HTTPS 网关**（默认 `https://<IP>:19843`）承担，不是宿主的 19080。直连 19080 等于绕过网关——**请保证 dsh web 只监听 loopback**（127.0.0.1），对外只暴露 19843。本机 `dsh web` 若被改绑到 0.0.0.0:19080，等于没有认证裸奔。
+v0.4 起门禁由本插件**自带的 HTTPS 网关**（默认 `https://<IP>:8088`）承担，不是宿主的 19080。直连 19080 等于绕过网关——**请保证 dsh web 只监听 loopback**（127.0.0.1），对外只暴露 8088。本机 `dsh web` 若被改绑到 0.0.0.0:19080，等于没有认证裸奔。
 
 ## 登录后很快又被要求登录
 
@@ -80,13 +80,13 @@ v0.4 起门禁由本插件**自带的 HTTPS 网关**（默认 `https://<IP>:1984
 ## 网关没起来 / 端口被占用
 
 ```bash
-# 谁占着 19843：
-lsof -iTCP:19843
+# 谁占着 8088：
+lsof -iTCP:8088
 # 启动日志（用户管理所有 [user-management] 前缀的输出都在这里）：
 grep user-management ~/.dsh/logs/web.out.log ~/.dsh/logs/web.err.log
 ```
 
-- `EADDRINUSE`：19843 被别的进程（或另一个 dsh 实例）占了——杀掉占用者，或在 `~/.dsh/settings.yaml` 的 `user-management:` 段改 `port`
+- `EADDRINUSE`：8088 被别的进程（或另一个 dsh 实例）占了——杀掉占用者，或在 `~/.dsh/settings.yaml` 的 `user-management:` 段改 `port`
 - 配置了 `enabled: false` 网关不会启动
 - 改了 hosts/证书配置不生效：删除 `~/.dsh/user-management/certs/` 下的旧证书文件再重启（旧证书按指纹稳定复用，不会自动重签）
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kczx-user-management",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "type": "module",
   "description": "dsh 插件 · 登录门 + 账号 / 权限 / 配额 / 审计台账（dsh-passwords 的功能已并入）：HTTPS 登录网关与自签证书、用户增删改查、工作区白名单与归属跟踪、每小时 token 与每日时长配额、沙盒档位下限、上传/git 开关、三本审计台账（登录/访问/操作）、IP 封禁、TOTP 两步验证。",
   "license": "MIT",