agent-exec transport b5b3f3ccf73878024650752934ac53e9/92156324805b

Why: Owner reported that role creation showed system admin permissions, the
admin page carried a retired recovery-proposal section, and one-time password
generation failed. They also require a permanent entry for no-project
conversations that does not depend on projects or project permissions.

Evidence: npx vite build passes; the agent-exec transport diff is identical to
the owner-accepted revision deployed on imc-tx-ecs (binary 941f8eef).

Impact: role editor renders only the project-management toggle, the recovery
proposal panel and its entry points are removed, admin password reset calls the
existing one-time-password endpoint, and the sidebar gains an always-available
no-project conversation action backed by a new client method and store action.

Refs: feature/role-project-toggle-and-recovery-cleanup

src/api.ts

@@ -155,8 +155,13 @@ export const api = {
   }),
   listAdminUsers: () => auth.fetch(`${BASE}/api/admin/users`).then(r => json<{ userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number; profileVersion: number; initializationState: string }[]>(r)),
   // 管理员建号：可提供初始密码；省略密码时由服务端生成并仅返回一次。
+  // 无项目对话（临时会话）：所有登录用户默认可用，与项目、项目权限无关。
+  createScratchSession: (title?: string) => auth.fetch(`${BASE}/api/scratch-sessions`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(title ? { title } : {}) })
+    .then(r => json<{ project: { id: string; name: string }; conversation: { id: string; projectId: string } }>(r)),
   createAdminUser: (owner: string, name: string, password?: string) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile: { name }, ...(password ? { password } : {}) }) }).then(r => json<{ userId: string; owner: string; passwordSet: boolean; mustChangePassword: boolean; initializationState: string; initialPassword?: string }>(r)),
-  adminResetUserPassword: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }).then(r => json<{ owner: string; temporaryPassword: string; mustChangePassword: boolean }>(r)),
+  // 管理员重置密码：服务端只提供一次性登录口令端点（旧的 /password 路由已不存在，
+  // 调用它恒为 404）。口令一次性返回，用户首次登录必须改密。
+  adminResetUserPassword: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/one-time-password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }).then(r => json<{ id: string; owner: string; oneTimePassword: string; mustChangePassword: boolean }>(r)).then(d => ({ owner: d.owner, temporaryPassword: d.oneTimePassword, mustChangePassword: d.mustChangePassword })),
   searchAdminUsers: (request: { query: string; mode: 'exact' | 'fuzzy'; status: 'all' | 'enabled' | 'disabled'; fields: string[]; cursor?: string; limit?: number }) => {
     const params = new URLSearchParams({ query: request.query, mode: request.mode, status: request.status,
       fields: request.fields.join(','), limit: String(request.limit ?? 20) })

src/components/AccountUsersPanel.tsx

@@ -176,7 +176,7 @@ export function AccountUsersPanel() {
     setBusy(true); setErr(''); setNotice('')
     try {
       const updated = await api.adminSetUserEnabled(selected.userId, selected.stateVersion, !selected.enabled)
-      setSelected(updated); setNotice(updated.enabled ? '账号已启用；旧会话和 Key 不会恢复' : '账号已停用，旧会话、Key 与进行中的恢复提案已撤销')
+      setSelected(updated); setNotice(updated.enabled ? '账号已启用；旧会话和 Key 不会恢复' : '账号已停用，旧会话与登录 Key 已撤销')
       await refreshFirst()
     } catch (error) { setErr(String(error).includes('409') ? '状态版本或最后管理员保护发生冲突，请重新打开用户' : String(error)) }
     finally { setBusy(false) }

src/components/AdminZone.tsx

@@ -30,15 +30,15 @@ function ProfilesPanelWrapper() {
   return <ProfilesSection profiles={profiles} />
 }
 
-/** 账号目录（按系统权限开放）+ 登录凭据与恢复提案（根管理员专属，旧 /api/admin/users 列表与密码端点）。 */
+/** 账号目录（按系统权限开放）+ 凭据发放（根管理员专属：建号、初始密码、一次性重置口令）。 */
 function UsersSection() {
   const isAdmin = useStore(s => !!s.me?.isAdmin)
   return <>
     <AccountUsersPanel />
     {isAdmin && <>
       <div className="az-section-head" style={{ marginTop: 18 }}>
-        <h3>登录凭据与恢复</h3>
-        <p>建号并发放初始密码、重置临时密码、发起恢复提案（仅根管理员）</p>
+        <h3>账号与凭据</h3>
+        <p>建号并发放初始密码、为已有账号重置一次性登录口令（仅根管理员）</p>
       </div>
       <UsersPanel />
     </>}
@@ -46,8 +46,8 @@ function UsersSection() {
 }
 
 const SECTIONS: AdminSectionDef[] = [
-  { key: 'users', label: '用户管理', icon: 'users', desc: '可选资料、账号状态、唯一生效角色与明确系统权限；根管理员另可发放与恢复登录凭据', requiredAction: 'system.users.view', render: () => <UsersSection /> },
-  { key: 'roles', label: '角色与权限', icon: 'shield', desc: '职位角色、默认权限与上限；支持单角色和角色矩阵配置', requiredAction: 'system.roles.view', render: () => <RolePermissionsPanel /> },
+  { key: 'users', label: '用户管理', icon: 'users', desc: '可选资料、账号状态、唯一生效角色与明确系统权限；根管理员另可建号与发放/重置登录口令', requiredAction: 'system.users.view', render: () => <UsersSection /> },
+  { key: 'roles', label: '角色与权限', icon: 'shield', desc: '职位角色；每个角色只有一个「项目管理」开关，决定能否建项目并管理自己参与的项目', requiredAction: 'system.roles.view', render: () => <RolePermissionsPanel /> },
   { key: 'profiles', label: '智能体画像', icon: 'bot', desc: '系统级画像：系统提示、工具允许/确认/拒绝清单', rootOnly: true, render: () => <ProfilesPanelWrapper /> },
   // P2 受管：模型/密钥/Tavily/遥测/运行基础设施的唯一写入面（Backend PR 188 系统设置 API）。
   { key: 'system-settings', label: '模型与服务配置', icon: 'settings', desc: '系统受管项：模型、密钥、Tavily、遥测与运行基础设施（仅管理员）', rootOnly: true, render: () => <SystemSettingsPanel /> },

src/components/RolePermissionsPanel.tsx

@@ -10,6 +10,10 @@ import { useStore } from '../store'
 /** DR9 离开管理区守卫：面板有未保存权限草稿时注册；AdminZone「返回工作台」消费。 */
 export const roleDraftLeaveGuard: { current: (() => boolean) | null } = { current: null }
 
+/** 角色唯一可配置的动作：项目管理（建项目 + 在自己参与的项目里协作）。 */
+export const PROJECT_MANAGEMENT_ACTION = 'project.create'
+const PROJECT_MANAGEMENT_HINT = '开启后可创建项目，并在自己参与的项目里读写文档、管理成员、查看追溯与推进阶段；发布/批准等三权仍按项目内职责分配。'
+
 export function filterRoles(
   roles: RoleRecord[], query: string, mode: 'exact' | 'fuzzy', status: 'all' | 'enabled' | 'disabled',
 ): RoleRecord[] {
@@ -105,7 +109,10 @@ export function RolePermissionsPanel() {
     ])
     if (!shouldAcceptRoleResponse(requestSequence.current, sequence)) return
     setRoleLoading(false)
-    const descriptors = catalogResult.status === 'fulfilled' ? catalogResult.value : catalog
+    // 角色只承载一个「项目管理」开关：权限目录在这里收敛为该动作，
+    // 系统授权与其余项目动作不再出现在角色编辑面。
+    const descriptors = (catalogResult.status === 'fulfilled' ? catalogResult.value : catalog)
+      .filter(item => item.actionId === PROJECT_MANAGEMENT_ACTION)
     if (catalogResult.status === 'fulfilled') setCatalog(descriptors)
     if (roleResult.status === 'rejected') {
       setErr(String(roleResult.reason))
@@ -363,15 +370,18 @@ export function RolePermissionsPanel() {
             <button className="ad-mini" disabled={busy || roleLoading} onClick={() => { setConfirmDisable(false); void setEnabled() }}>确认停用</button>
             <button className="ad-mini" disabled={busy} onClick={() => setConfirmDisable(false)}>取消</button>
           </div>}
-          {canViewPermissions ? <><table className="ad-table"><thead><tr><th>权限</th><th>默认允许</th><th>角色上限</th><th>说明</th></tr></thead>
+          {canViewPermissions ? <><table className="ad-table"><thead><tr><th>权限</th><th>启用</th><th>说明</th></tr></thead>
             <tbody>{pageItems.map(item => {
               const value = draft.values[item.actionId] ?? { allowed: false, capAllowed: false }
+              // 一个开关同时写默认允许与角色上限（项目管理在服务端就是这个布尔）
+              const toggle = (next: boolean) => {
+                editValue(item.actionId, 'allowed', next)
+                editValue(item.actionId, 'capAllowed', next)
+              }
               return <tr key={item.actionId}><td>{item.label}<div className="ad-dim ad-mono">{item.actionId}</div></td>
-                <td><input type="checkbox" aria-label={`${item.label} 默认允许`} checked={value.allowed} disabled={busy || roleLoading || !canManagePermissions || item.protected}
-                  onChange={event => editValue(item.actionId, 'allowed', event.target.checked)} /></td>
-                <td><input type="checkbox" aria-label={`${item.label} 角色上限`} checked={value.capAllowed} disabled={busy || roleLoading || !canManagePermissions || item.protected}
-                  onChange={event => editValue(item.actionId, 'capAllowed', event.target.checked)} /></td>
-                <td className="ad-dim">{item.protected ? '受保护系统授权，不能由普通角色授予' : item.description}</td></tr>
+                <td><input type="checkbox" aria-label={`${item.label} 开关`} checked={value.allowed} disabled={busy || roleLoading || !canManagePermissions || item.protected}
+                  onChange={event => toggle(event.target.checked)} /></td>
+                <td className="ad-dim">{PROJECT_MANAGEMENT_HINT}</td></tr>
             })}</tbody></table>
           <Collapsible id={`role-diff-${selected.roleId}`} trigger={`变更预览（${changes.length}）`}>
             {changes.length === 0 ? <p className="ad-hint">没有权限变化</p> : <ul className="rp-diff">{changes.map(change =>

src/components/TaskSidebar.tsx

@@ -142,6 +142,9 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
           <button className="tsb-newtask-main" title="在当前项目新建对话（⌘N）" onClick={() => createConversation()}>
             <Icon name="plus" size={15} />新建对话
           </button>
+          <button className="tsb-newtask-main" title="新建无项目对话（所有用户可用）" onClick={() => { void store.createScratchConversation() }}>
+            <Icon name="message" size={15} />新建无项目对话
+          </button>
           <button className="tsb-newtask-caret" title="更多创建选项"
             onClick={e => { const el = e.currentTarget; setMenu(m => m?.kind === 'new' ? null : { kind: 'new', anchor: el }) }}><Icon name="chevron-down" size={14} /></button>
         </div>
@@ -245,6 +248,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
 
       <Menu anchor={menu?.kind === 'new' ? menu.anchor : null} onClose={() => setMenu(null)}>
         <MenuItem icon="plus" onClick={() => { createConversation(); setMenu(null) }}>新建对话 · 当前项目<kbd>⌘N</kbd></MenuItem>
+        <MenuItem icon="message" onClick={() => { void store.createScratchConversation(); setMenu(null) }}>新建无项目对话</MenuItem>
         <div className="tsb-menu-div" />
         <MenuItem icon="folder" onClick={() => { setCreatingProject(true); setMenu(null) }}>新建项目…</MenuItem>
         {projects.filter(p => p.id !== currentProjectId).slice(0, 6).map(p => (

src/components/adminSections.tsx

@@ -1,21 +1,17 @@
 // 系统管理分区面板（重设计方案 阶段②）：普通用户界面不再暴露的系统能力
 // 全部收进这里，由 AdminZone 以分区注册表呈现。数据入口与原弹窗完全一致
 //（api.* 不变），只换呈现位置；插件面板/声明工作区经 UIRenderer 内联渲染。
-import { useEffect, useRef, useState } from 'react'
-import { api, type RecoveryProposal } from '../api'
+import { useEffect, useState } from 'react'
+import { api } from '../api'
 import { store, useStore } from '../store'
 import type { AgentProfile } from '../contracts'
 import { Btn, EmptyState, Icon, SettingRow, SettingsGroup, UIRenderer, type DocBridge } from '@ui'
 import { SettingInput, flatten, unflatten } from './SettingsModal'
 import type { SettingDesc } from '../contracts'
 import { docBridge } from './Workbench'
-import {
-  recoveryAttemptKey, recoveryProposalErrorMessage, recoveryProposalHint, recoveryProposalNotice, recoveryProposalRejected,
-  recoveryStatusLabel, type RecoveryAttempt,
-} from '../recovery'
 
-// ---- 用户管理：页面建号可设置/生成初始密码，管理员重置生成临时密码；
-// 保留恢复提案与 Key 管理作为既有非登录页恢复流程。 ----
+// ---- 用户管理：建号（可指定或由服务端生成初始密码）与重置一次性登录口令。
+// 恢复提案流程已下线，本面板不再保留入口。 ----
 interface AdminUserRow { userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number }
 
 export function UsersPanel() {
@@ -28,26 +24,9 @@ export function UsersPanel() {
   const [initialPassword, setInitialPassword] = useState('')
   const [generatedCredential, setGeneratedCredential] = useState<{ owner: string; password: string; kind: 'initial' | 'temporary' } | null>(null)
   const [busy, setBusy] = useState(false)
-  // 恢复提案面板：propFor 打开指定用户的提案视图（创建 / 状态 / 撤销）。
-  const [propFor, setPropFor] = useState<AdminUserRow | null>(null)
-  const [proposals, setProposals] = useState<RecoveryProposal[] | null>(null)
-
-  // 提案视图代次：切换/关闭目标推进代次，迟到响应不得覆盖新选中的账号。
-  const proposalSeq = useRef(0)
-  // 结果未确定的提案请求：显式重试沿用同一 idempotencyKey，不重复创建。
-  const recoveryAttempt = useRef<RecoveryAttempt | null>(null)
-
   const refresh = async () => {
     try { setUsers(await api.listAdminUsers()) } catch (e) { setErr(String(e)) }
   }
-  const refreshProposals = async (userId: string) => {
-    const seq = proposalSeq.current
-    try {
-      const statuses = await api.listAdminRecoveryProposals(userId)
-      if (seq === proposalSeq.current) setProposals(statuses)
-    } catch (e) { if (seq === proposalSeq.current) setErr(String(e)) }
-  }
-  useEffect(() => { refresh() }, [])
 
   const create = async () => {
     setErr(''); setNotice('')
@@ -71,67 +50,6 @@ export function UsersPanel() {
     } catch (e) { setErr(String(e)) } finally { setBusy(false) }
   }
 
-  const openProposals = async (u: AdminUserRow) => {
-    proposalSeq.current++
-    setErr(''); setNotice(''); setPropFor(u); setProposals(null)
-    await refreshProposals(u.userId)
-  }
-  const closeProposals = () => { proposalSeq.current++; setPropFor(null); setProposals(null) }
-
-  const propose = async () => {
-    if (!propFor) return
-    const target = propFor
-    const seq = proposalSeq.current
-    const stillSelected = () => seq === proposalSeq.current
-    setErr(''); setNotice(''); setBusy(true)
-    const idempotencyKey = recoveryAttemptKey(recoveryAttempt.current, target.userId, target.stateVersion, () => crypto.randomUUID())
-    recoveryAttempt.current = { userId: target.userId, stateVersion: target.stateVersion, key: idempotencyKey }
-    try {
-      const created = await api.createAdminRecoveryProposal(target.userId, target.stateVersion, idempotencyKey)
-      recoveryAttempt.current = null
-      const statuses = await api.listAdminRecoveryProposals(target.userId).catch(() => null)
-      if (!stillSelected()) return
-      if (statuses) setProposals(statuses)
-      setNotice(recoveryProposalNotice(target.owner, (statuses?.find(p => p.id === created.id) ?? created).status))
-    } catch (e) {
-      const message = String(e)
-      if (message.includes('409')) {
-        recoveryAttempt.current = null
-        await resetPassword(target)
-        return
-      }
-      if (!stillSelected()) return
-      if (recoveryProposalRejected(message)) {
-        recoveryAttempt.current = null
-        setErr(recoveryProposalErrorMessage(message))
-        return
-      }
-      // 响应丢失或服务端异常时提案可能已提交：先重读元数据，再允许沿用同一 key 显式重试。
-      try {
-        const statuses = await api.listAdminRecoveryProposals(target.userId)
-        if (!stillSelected()) return
-        setProposals(statuses)
-        if (statuses.length > 0) {
-          setNotice(`提案响应未收到；状态已刷新。最近记录：${recoveryStatusLabel[statuses[0].status]}。请核对下方记录；再次提交会沿用同一请求标识。`)
-        } else {
-          setErr('提案结果未确定；状态已刷新。再次提交会沿用同一请求标识。')
-        }
-      } catch {
-        if (stillSelected()) setErr('提案结果未知且状态暂时无法读取；请稍后核对，不会自动重复创建。')
-      }
-    } finally { setBusy(false) }
-  }
-
-  const revokeProposal = async (p: RecoveryProposal) => {
-    if (!propFor) return
-    setErr(''); setNotice(''); setBusy(true)
-    try {
-      await api.adminRevokeRecoveryProposal(propFor.userId, p.id, p.version)
-      await refreshProposals(propFor.userId)
-      setNotice('提案已撤销')
-    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
-  }
-
   return (
     <div>
       {me?.isAdmin && (
@@ -152,35 +70,6 @@ export function UsersPanel() {
         <button type="button" className="ad-mini" onClick={() => setGeneratedCredential(null)}>关闭</button>
       </div>}
       {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
-      {propFor ? (
-        <div className="ad-reset">
-          <div className="ad-row">
-            <span><b>{propFor.owner}</b> 的恢复提案（属主确认制：管理员提案，本人确认后获一次性 Key）</span>
-            <button className="lg-submit ad-create-btn" disabled={busy} onClick={propose}>发起恢复提案</button>
-            <button type="button" className="ad-mini" onClick={closeProposals}>关闭</button>
-          </div>
-          <p className="ad-hint">前提：该用户当前在任一设备保持完整密码登录（会话证明）。已锁死且无会话的账号无法在线恢复，请走服务器本地处置。</p>
-          {proposals !== null && proposals.length > 0 && (
-            <table className="ad-table">
-              <thead><tr><th>提案</th><th>状态</th><th>到期时间</th><th>发起人</th><th></th></tr></thead>
-              <tbody>
-                {proposals.map(p => (
-                  <tr key={p.id}>
-                    <td className="ad-mono">{p.id}</td>
-                    <td>{recoveryStatusLabel[p.status]}{recoveryProposalHint(p.status) && <span className="ad-dim"> · {recoveryProposalHint(p.status)}</span>}</td>
-                    <td className="ad-dim">{new Date(p.expiresAt).toLocaleString()}</td>
-                    <td className="ad-dim">{p.createdBy}</td>
-                    <td>{(p.status === 'pending' || p.status === 'confirmed') && (
-                      <button className="ad-mini" disabled={busy} onClick={() => revokeProposal(p)}>撤销</button>
-                    )}</td>
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          )}
-          {proposals !== null && proposals.length === 0 && <p className="ad-hint">该用户当前没有恢复提案。</p>}
-        </div>
-      ) : (
         <table className="ad-table">
           <thead><tr><th>用户名</th><th>显示名</th><th>角色</th><th>状态</th><th>密码设置于</th><th></th></tr></thead>
           <tbody>
@@ -192,15 +81,13 @@ export function UsersPanel() {
                 <td>{u.mustChangePassword ? <span className="ad-chip ad-chip-warn">待改密</span> : u.hasPassword ? '正常' : '未设密码'}</td>
                 <td className="ad-dim">{u.passwordSetAt ? new Date(u.passwordSetAt).toLocaleString() : '—'}</td>
                 <td>{me?.isAdmin && <span className="ad-row">
-                  <button className="ad-mini" disabled={busy} onClick={() => resetPassword(u)}>重置临时密码</button>
-                  <button className="ad-mini" onClick={() => openProposals(u)}>恢复提案</button>
+                  <button className="ad-mini" disabled={busy} onClick={() => resetPassword(u)}>重置密码（一次性口令）</button>
                 </span>}</td>
               </tr>
             ))}
             {users !== null && users.length === 0 && <tr><td colSpan={6} className="ad-dim">暂无账号</td></tr>}
           </tbody>
         </table>
-      )}
     </div>
   )
 }

src/store.ts

@@ -548,6 +548,27 @@ export const store = {
 
   /** 新建任务（=会话）：默认当前项目上下文；显式 projectId 用于"新建于指定项目"。
    * 空库时主按钮与空状态都写着「点击新建任务开始」，这里先落一个默认项目再开会话。 */
+  /**
+   * 无项目对话：所有用户默认可用，不依赖项目与项目权限。
+   * 与 createTask 分开：createTask 会在没有项目时自动建「默认项目」，
+   * 那是项目内对话入口，不该替代临时会话。
+   */
+  async createScratchConversation() {
+    const epoch = identityEpoch
+    try {
+      const out = await api.createScratchSession()
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重试')
+      await store.refreshProjects()
+      await store.refreshTasks()
+      store.toast('已创建无项目对话')
+      await store.openTask(out.conversation.id)
+      return out.conversation
+    } catch (e) {
+      store.toast(`创建无项目对话失败：${String(e).replace(/^[^:]*:\s*/, '')}`)
+      throw e
+    }
+  },
+
   async createTask(projectId?: string) {
     const epoch = identityEpoch
     try {