chore(merge): sync master into dev/4.11.x

web/package.json

@@ -6,6 +6,7 @@
     "dev": "vite",
     "build": "tsc && vite build",
     "preview": "vite preview",
+    "test:unit": "node --test tests/unit/*.test.mjs",
     "test:e2e": "playwright test",
     "lint": "eslint .",
     "format": "prettier --write ."
@@ -31,6 +32,7 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
+    "@fingerprintjs/fingerprintjs": "^4.6.2",
     "@hookform/resolvers": "^5.0.1",
     "@radix-ui/react-alert-dialog": "^1.1.15",
     "@radix-ui/react-avatar": "^1.1.11",

web/pnpm-lock.yaml

@@ -24,6 +24,9 @@ dependencies:
   '@dnd-kit/utilities':
     specifier: ^3.2.2
     version: 3.2.2(react@19.2.1)
+  '@fingerprintjs/fingerprintjs':
+    specifier: ^4.6.2
+    version: 4.6.2
   '@hookform/resolvers':
     specifier: ^5.0.1
     version: 5.2.2(react-hook-form@7.71.1)
@@ -428,6 +431,12 @@ packages:
       levn: 0.4.1
     dev: true
 
+  /@fingerprintjs/fingerprintjs@4.6.2:
+    resolution: {integrity: sha512-g8mXuqcFKbgH2CZKwPfVtsUJDHyvcgIABQI7Y0tzWEFXpGxJaXuAuzlifT2oTakjDBLTK4Gaa9/5PERDhqUjtw==}
+    dependencies:
+      tslib: 2.8.1
+    dev: false
+
   /@floating-ui/core@1.7.4:
     resolution: {integrity: sha512-C3HlIdsBxszvm5McXlB8PeOEWfBhcGBTZGkGlWc2U0KFY5IwG5OQEuQ8rq52DZmcHDlPLd+YFBK+cZcytwIFWg==}
     dependencies:

web/src/app/auth/space/callback/page.tsx

@@ -1,6 +1,11 @@
 import { useEffect, useState, useCallback, Suspense, useRef } from 'react';
 import { useNavigate, useSearchParams } from 'react-router-dom';
 import { httpClient } from '@/app/infra/http/HttpClient';
+import {
+  beginAuthenticatedSession,
+  bootstrapWorkspaceSession,
+  getPendingInvitationToken,
+} from '@/app/infra/http';
 import { toast } from 'sonner';
 import { useTranslation } from 'react-i18next';
 import {
@@ -23,6 +28,7 @@ import langbotIcon from '@/app/assets/langbot-logo.webp';
 type SpaceOAuthLoginResult = {
   token: string;
   user: string;
+  workspace_uuid?: string;
 };
 
 const pendingSpaceOAuthLogins = new Map<
@@ -32,19 +38,23 @@ const pendingSpaceOAuthLogins = new Map<
 
 function getOrCreateSpaceOAuthLoginPromise(
   authCode: string,
+  state: string,
+  workspaceUuid?: string,
+  launchAssertion?: string,
 ): Promise<SpaceOAuthLoginResult> {
-  const pendingRequest = pendingSpaceOAuthLogins.get(authCode);
+  const requestKey = `${authCode}:${state}:${workspaceUuid ?? ''}:${launchAssertion ?? ''}`;
+  const pendingRequest = pendingSpaceOAuthLogins.get(requestKey);
   if (pendingRequest) {
     return pendingRequest;
   }
 
   const requestPromise = httpClient
-    .exchangeSpaceOAuthCode(authCode)
+    .exchangeSpaceOAuthCode(authCode, state, workspaceUuid, launchAssertion)
     .finally(() => {
-      pendingSpaceOAuthLogins.delete(authCode);
+      pendingSpaceOAuthLogins.delete(requestKey);
     });
 
-  pendingSpaceOAuthLogins.set(authCode, requestPromise);
+  pendingSpaceOAuthLogins.set(requestKey, requestPromise);
   return requestPromise;
 }
 
@@ -58,29 +68,57 @@ function SpaceOAuthCallbackContent() {
     'loading' | 'confirm' | 'success' | 'error'
   >('loading');
   const [errorMessage, setErrorMessage] = useState<string>('');
+  const [terminalErrorCode, setTerminalErrorCode] = useState<
+    'space_account_not_registered' | 'space_account_binding_required' | null
+  >(null);
   const [isBindMode, setIsBindMode] = useState(false);
   const [code, setCode] = useState<string | null>(null);
   const [isProcessing, setIsProcessing] = useState(false);
   const [localEmail, setLocalEmail] = useState<string>('');
 
   const handleOAuthCallback = useCallback(
-    async (authCode: string) => {
+    async (
+      authCode: string,
+      state: string,
+      workspaceUuid?: string,
+      launchAssertion?: string,
+    ) => {
       try {
-        const response = await getOrCreateSpaceOAuthLoginPromise(authCode);
+        const response = await getOrCreateSpaceOAuthLoginPromise(
+          authCode,
+          state,
+          workspaceUuid,
+          launchAssertion,
+        );
         if (!isMountedRef.current) {
           return;
         }
 
-        localStorage.setItem('token', response.token);
-        if (response.user) {
-          localStorage.setItem('userEmail', response.user);
+        beginAuthenticatedSession(response.token, response.user);
+        if (getPendingInvitationToken()) {
+          navigate('/invitations/accept', { replace: true });
+          return;
+        }
+        const workspaceResult = await bootstrapWorkspaceSession({
+          preferredWorkspaceUuid: response.workspace_uuid,
+        });
+        if (workspaceResult.status === 'unavailable') {
+          throw new Error('No Workspace is available for this Account');
+        }
+        if (response.workspace_uuid) {
+          navigate('/home', { replace: true });
+          return;
         }
         setStatus('success');
         toast.success(t('common.spaceLoginSuccess'));
 
         // If wizard state exists, redirect back to wizard instead of home
         const wizardState = localStorage.getItem('langbot_wizard_state');
-        const redirectTo = wizardState ? '/wizard' : '/home';
+        const destination = wizardState ? '/wizard' : '/home';
+        const redirectTo =
+          workspaceResult.status === 'selection-required'
+            ? `/workspaces/select?returnTo=${encodeURIComponent(destination)}`
+            : destination;
         setTimeout(() => {
           navigate(redirectTo);
         }, 1000);
@@ -90,7 +128,15 @@ function SpaceOAuthCallbackContent() {
         }
 
         setStatus('error');
-        const errorObj = err as { msg?: string };
+        const errorObj = err as { code?: string; msg?: string };
+        if (
+          errorObj.code === 'space_account_not_registered' ||
+          errorObj.code === 'space_account_binding_required'
+        ) {
+          setTerminalErrorCode(errorObj.code);
+          setErrorMessage(t(`account.${errorObj.code}`));
+          return;
+        }
         const errMsg = (errorObj?.msg || '').toLowerCase();
         if (errMsg.includes('account email mismatch')) {
           setErrorMessage(t('account.spaceEmailMismatch'));
@@ -113,14 +159,19 @@ function SpaceOAuthCallbackContent() {
           return;
         }
 
-        localStorage.setItem('token', response.token);
-        if (response.user) {
-          localStorage.setItem('userEmail', response.user);
+        beginAuthenticatedSession(response.token, response.user);
+        const workspaceResult = await bootstrapWorkspaceSession();
+        if (workspaceResult.status === 'unavailable') {
+          throw new Error('No Workspace is available for this Account');
         }
         setStatus('success');
         toast.success(t('account.bindSpaceSuccess'));
+        const redirectTo =
+          workspaceResult.status === 'selection-required'
+            ? '/workspaces/select?returnTo=%2Fhome'
+            : '/home';
         setTimeout(() => {
-          navigate('/home');
+          navigate(redirectTo);
         }, 1000);
       } catch (err) {
         if (!isMountedRef.current) {
@@ -128,7 +179,11 @@ function SpaceOAuthCallbackContent() {
         }
 
         setStatus('error');
-        const errorObj = err as { msg?: string };
+        const errorObj = err as { code?: string; msg?: string };
+        if (errorObj.code === 'space_account_email_mismatch') {
+          setErrorMessage(t('account.spaceEmailMismatch'));
+          return;
+        }
         const errMsg = (errorObj?.msg || '').toLowerCase();
         if (errMsg.includes('account email mismatch')) {
           setErrorMessage(t('account.spaceEmailMismatch'));
@@ -152,6 +207,8 @@ function SpaceOAuthCallbackContent() {
     const errorDescription = searchParams.get('error_description');
     const mode = searchParams.get('mode');
     const state = searchParams.get('state');
+    const workspaceUuid = searchParams.get('workspace_uuid');
+    const launchAssertion = searchParams.get('launch_assertion');
 
     if (error) {
       setStatus('error');
@@ -161,15 +218,13 @@ function SpaceOAuthCallbackContent() {
       return;
     }
 
-    if (!authCode) {
-      setStatus('error');
-      setErrorMessage(t('common.spaceLoginNoCode'));
-      return;
-    }
-
-    setCode(authCode);
-
     if (mode === 'bind') {
+      if (!authCode) {
+        setStatus('error');
+        setErrorMessage(t('common.spaceLoginNoCode'));
+        return;
+      }
+      setCode(authCode);
       // Bind mode - verify state (token) exists
       if (!state) {
         setStatus('error');
@@ -180,9 +235,31 @@ function SpaceOAuthCallbackContent() {
       setIsBindMode(true);
       setLocalEmail(localStorage.getItem('userEmail') || '');
       setStatus('confirm');
+    } else if (workspaceUuid || launchAssertion) {
+      if (!workspaceUuid || !launchAssertion) {
+        setStatus('error');
+        setErrorMessage(t('common.spaceLoginFailed'));
+        return;
+      }
+      handleOAuthCallback(
+        authCode ?? '',
+        state ?? '',
+        workspaceUuid,
+        launchAssertion,
+      );
     } else {
-      // Normal login/register mode
-      handleOAuthCallback(authCode);
+      if (!authCode) {
+        setStatus('error');
+        setErrorMessage(t('common.spaceLoginNoCode'));
+        return;
+      }
+      setCode(authCode);
+      if (!state) {
+        setStatus('error');
+        setErrorMessage(t('common.spaceLoginFailed'));
+        return;
+      }
+      handleOAuthCallback(authCode, state);
     }
     return () => {
       isMountedRef.current = false;
@@ -216,9 +293,11 @@ function SpaceOAuthCallbackContent() {
                 ? t('account.bindSpaceSuccess')
                 : t('common.spaceLoginSuccess'))}
             {status === 'error' &&
-              (isBindMode
-                ? t('account.bindSpaceFailed')
-                : t('common.spaceLoginError'))}
+              (terminalErrorCode
+                ? t(`account.${terminalErrorCode}Title`)
+                : isBindMode
+                  ? t('account.bindSpaceFailed')
+                  : t('common.spaceLoginError'))}
           </CardTitle>
           <CardDescription>
             {status === 'loading' &&

web/src/app/home/add-extension/page.tsx

@@ -636,7 +636,8 @@ function AddExtensionContent() {
     const pluginDisplayName = `${githubOwner}/${githubRepo}`;
     httpClient
       .installPluginFromGithub(
-        selectedAsset.download_url,
+        selectedAsset.id,
+        selectedRelease.id,
         githubOwner,
         githubRepo,
         selectedRelease.tag_name,

web/src/app/home/bots/BotDetailContent.tsx

@@ -29,11 +29,17 @@ import { useTranslation } from 'react-i18next';
 import { Settings, FileText, Users, RefreshCw, Trash2 } from 'lucide-react';
 import { cn } from '@/lib/utils';
 import { toast } from 'sonner';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 export default function BotDetailContent({ id }: { id: string }) {
   const isCreateMode = id === 'new';
   const navigate = useNavigate();
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManage =
+    currentWorkspace?.permissions.includes('resource.manage') ?? false;
+  const canViewMonitoring =
+    currentWorkspace?.permissions.includes('resource.view') ?? false;
   const { refreshBots, bots, setDetailEntityName } = useSidebarData();
 
   // Set breadcrumb entity name
@@ -131,19 +137,23 @@ export default function BotDetailContent({ id }: { id: string }) {
         {/* Header */}
         <div className="flex items-center justify-between pb-4 shrink-0">
           <h1 className="text-xl font-semibold">{t('bots.createBot')}</h1>
-          <Button type="submit" form="bot-form">
-            {t('common.submit')}
-          </Button>
+          {canManage && (
+            <Button type="submit" form="bot-form">
+              {t('common.submit')}
+            </Button>
+          )}
         </div>
 
         {/* Content */}
         <div className="flex-1 overflow-y-auto min-h-0">
           <div className="mx-auto max-w-3xl pb-8">
-            <BotForm
-              initBotId={undefined}
-              onFormSubmit={handleFormSubmit}
-              onNewBotCreated={handleNewBotCreated}
-            />
+            <fieldset className="contents" disabled={!canManage}>
+              <BotForm
+                initBotId={undefined}
+                onFormSubmit={handleFormSubmit}
+                onNewBotCreated={handleNewBotCreated}
+              />
+            </fieldset>
           </div>
         </div>
       </div>
@@ -164,6 +174,7 @@ export default function BotDetailContent({ id }: { id: string }) {
                   id="bot-enable-switch"
                   checked={botEnabled}
                   onCheckedChange={handleEnableToggle}
+                  disabled={!canManage}
                 />
                 <Label
                   htmlFor="bot-enable-switch"
@@ -174,14 +185,16 @@ export default function BotDetailContent({ id }: { id: string }) {
               </div>
             )}
           </div>
-          <Button
-            type="submit"
-            form="bot-form"
-            disabled={!formDirty}
-            className={activeTab !== 'config' ? 'invisible' : ''}
-          >
-            {t('common.save')}
-          </Button>
+          {canManage && (
+            <Button
+              type="submit"
+              form="bot-form"
+              disabled={!formDirty}
+              className={activeTab !== 'config' ? 'invisible' : ''}
+            >
+              {t('common.save')}
+            </Button>
+          )}
         </div>
 
         {/* Horizontal Tabs */}
@@ -197,14 +210,18 @@ export default function BotDetailContent({ id }: { id: string }) {
                 <Settings className="size-3.5" />
                 {t('bots.configuration')}
               </TabsTrigger>
-              <TabsTrigger value="logs" className="gap-1.5">
-                <FileText className="size-3.5" />
-                {t('bots.logs')}
-              </TabsTrigger>
-              <TabsTrigger value="sessions" className="gap-1.5">
-                <Users className="size-3.5" />
-                {t('bots.sessionMonitor.title')}
-              </TabsTrigger>
+              {canViewMonitoring && (
+                <TabsTrigger value="logs" className="gap-1.5">
+                  <FileText className="size-3.5" />
+                  {t('bots.logs')}
+                </TabsTrigger>
+              )}
+              {canViewMonitoring && (
+                <TabsTrigger value="sessions" className="gap-1.5">
+                  <Users className="size-3.5" />
+                  {t('bots.sessionMonitor.title')}
+                </TabsTrigger>
+              )}
             </TabsList>
             {activeTab === 'sessions' && (
               <button
@@ -239,60 +256,68 @@ export default function BotDetailContent({ id }: { id: string }) {
             className="flex-1 min-h-0 overflow-y-auto mt-4"
           >
             <div className="mx-auto max-w-3xl space-y-6 pb-8">
-              <BotForm
-                initBotId={id}
-                onFormSubmit={handleFormSubmit}
-                onNewBotCreated={handleNewBotCreated}
-                onDirtyChange={setFormDirty}
-              />
+              <fieldset className="contents" disabled={!canManage}>
+                <BotForm
+                  initBotId={id}
+                  onFormSubmit={handleFormSubmit}
+                  onNewBotCreated={handleNewBotCreated}
+                  onDirtyChange={setFormDirty}
+                />
+              </fieldset>
 
               {/* Card: Danger Zone */}
-              <Card className="border-destructive/50">
-                <CardHeader>
-                  <CardTitle className="text-destructive">
-                    {t('bots.dangerZone')}
-                  </CardTitle>
-                  <CardDescription>
-                    {t('bots.dangerZoneDescription')}
-                  </CardDescription>
-                </CardHeader>
-                <CardContent>
-                  <div className="flex items-center justify-between">
-                    <div className="space-y-1">
-                      <p className="text-sm font-medium">
-                        {t('bots.deleteBotAction')}
-                      </p>
-                      <p className="text-sm text-muted-foreground">
-                        {t('bots.deleteBotHint')}
-                      </p>
+              {canManage && (
+                <Card className="border-destructive/50">
+                  <CardHeader>
+                    <CardTitle className="text-destructive">
+                      {t('bots.dangerZone')}
+                    </CardTitle>
+                    <CardDescription>
+                      {t('bots.dangerZoneDescription')}
+                    </CardDescription>
+                  </CardHeader>
+                  <CardContent>
+                    <div className="flex items-center justify-between">
+                      <div className="space-y-1">
+                        <p className="text-sm font-medium">
+                          {t('bots.deleteBotAction')}
+                        </p>
+                        <p className="text-sm text-muted-foreground">
+                          {t('bots.deleteBotHint')}
+                        </p>
+                      </div>
+                      <Button
+                        type="button"
+                        variant="destructive"
+                        size="sm"
+                        onClick={() => setShowDeleteConfirm(true)}
+                      >
+                        <Trash2 className="size-4 mr-1.5" />
+                        {t('common.delete')}
+                      </Button>
                     </div>
-                    <Button
-                      type="button"
-                      variant="destructive"
-                      size="sm"
-                      onClick={() => setShowDeleteConfirm(true)}
-                    >
-                      <Trash2 className="size-4 mr-1.5" />
-                      {t('common.delete')}
-                    </Button>
-                  </div>
-                </CardContent>
-              </Card>
+                  </CardContent>
+                </Card>
+              )}
             </div>
           </TabsContent>
 
           {/* Tab: Logs */}
-          <TabsContent
-            value="logs"
-            className="flex-1 min-h-0 overflow-y-auto mt-4"
-          >
-            <BotLogListComponent botId={id} />
-          </TabsContent>
+          {canViewMonitoring && (
+            <TabsContent
+              value="logs"
+              className="flex-1 min-h-0 overflow-y-auto mt-4"
+            >
+              <BotLogListComponent botId={id} />
+            </TabsContent>
+          )}
 
           {/* Tab: Sessions */}
-          <TabsContent value="sessions" className="flex-1 min-h-0 mt-4">
-            <BotSessionMonitor ref={sessionMonitorRef} botId={id} />
-          </TabsContent>
+          {canViewMonitoring && (
+            <TabsContent value="sessions" className="flex-1 min-h-0 mt-4">
+              <BotSessionMonitor ref={sessionMonitorRef} botId={id} />
+            </TabsContent>
+          )}
         </Tabs>
       </div>
 

web/src/app/home/components/account-settings-dialog/AccountSettingsPanel.tsx

@@ -58,19 +58,9 @@ export default function AccountSettingsPanel({
   const handleBindSpace = async () => {
     setSpaceBindLoading(true);
     try {
-      const token = localStorage.getItem('token');
-      if (!token) {
-        toast.error(t('common.error'));
-        setSpaceBindLoading(false);
-        return;
-      }
       const currentOrigin = window.location.origin;
       const redirectUri = `${currentOrigin}/auth/space/callback?mode=bind`;
-      // Pass token as state for security verification
-      const response = await httpClient.getSpaceAuthorizeUrl(
-        redirectUri,
-        token,
-      );
+      const response = await httpClient.getSpaceBindAuthorizeUrl(redirectUri);
       window.location.href = response.authorize_url;
     } catch {
       toast.error(t('common.spaceLoginFailed'));

web/src/app/home/components/api-integration-dialog/ApiIntegrationPanel.tsx

@@ -40,12 +40,20 @@ import { PanelToolbar } from '../settings-dialog/panel-layout';
 
 interface ApiKey {
   id: number;
+  uuid: string;
   name: string;
-  key: string;
   description: string;
+  scopes: string[];
+  status: 'active' | 'revoked';
+  secret_available: false;
   created_at: string;
 }
 
+type CreatedApiKey = Omit<ApiKey, 'secret_available'> & {
+  key: string;
+  secret_available: true;
+};
+
 interface Webhook {
   id: number;
   name: string;
@@ -71,7 +79,7 @@ export default function ApiIntegrationPanel({
   const [showCreateDialog, setShowCreateDialog] = useState(false);
   const [newKeyName, setNewKeyName] = useState('');
   const [newKeyDescription, setNewKeyDescription] = useState('');
-  const [createdKey, setCreatedKey] = useState<ApiKey | null>(null);
+  const [createdKey, setCreatedKey] = useState<CreatedApiKey | null>(null);
   const [deleteKeyId, setDeleteKeyId] = useState<number | null>(null);
 
   // Webhook state
@@ -135,7 +143,7 @@ export default function ApiIntegrationPanel({
       const response = (await backendClient.post('/api/v1/apikeys', {
         name: newKeyName,
         description: newKeyDescription,
-      })) as { key: ApiKey };
+      })) as { key: CreatedApiKey };
 
       setCreatedKey(response.key);
       toast.success(t('common.apiKeyCreated'));
@@ -184,11 +192,6 @@ export default function ApiIntegrationPanel({
     copiedTimerRef.current = setTimeout(() => setCopiedKey(null), 2000);
   };
 
-  const maskApiKey = (key: string) => {
-    if (key.length <= 8) return key;
-    return `${key.substring(0, 8)}...${key.substring(key.length - 4)}`;
-  };
-
   // Webhook methods
   const loadWebhooks = async () => {
     setLoading(true);
@@ -337,25 +340,12 @@ export default function ApiIntegrationPanel({
                         </div>
                       </TableCell>
                       <TableCell>
-                        <code className="text-sm bg-muted px-2 py-1 rounded">
-                          {maskApiKey(item.key)}
-                        </code>
+                        <span className="text-sm text-muted-foreground">
+                          {t('common.apiKeyStoredSecurely')}
+                        </span>
                       </TableCell>
                       <TableCell>
                         <div className="flex gap-2">
-                          <Button
-                            variant="ghost"
-                            size="sm"
-                            type="button"
-                            onClick={() => handleCopyKey(item.key)}
-                            title={t('common.copyApiKey')}
-                          >
-                            {copiedKey === item.key ? (
-                              <Check className="h-4 w-4 text-green-600" />
-                            ) : (
-                              <Copy className="h-4 w-4" />
-                            )}
-                          </Button>
                           <Button
                             variant="ghost"
                             size="sm"

web/src/app/home/components/dynamic-form/DynamicFormComponent.tsx

@@ -15,6 +15,7 @@ import {
   FormMessage,
 } from '@/components/ui/form';
 import DynamicFormItemComponent from '@/app/home/components/dynamic-form/DynamicFormItemComponent';
+import { normalizeDynamicFormValuesForSave } from '@/app/home/components/dynamic-form/DynamicFormSaveValues';
 import QrCodeLoginDialog, {
   QrLoginPlatform,
 } from '@/app/home/components/qrcode-login/QrCodeLoginDialog';
@@ -640,12 +641,9 @@ export default function DynamicFormComponent({
     // even if the user saves without modifying any field.
     // form.watch(callback) only fires on subsequent changes, not on mount.
     const formValues = form.getValues();
-    const initialFinalValues = editableValueSpecs.reduce(
-      (acc, item) => {
-        acc[item.name] = formValues[item.name] ?? item.default;
-        return acc;
-      },
-      {} as Record<string, object>,
+    const initialFinalValues = normalizeDynamicFormValuesForSave(
+      editableValueSpecs,
+      formValues as Record<string, unknown>,
     );
     onSubmitRef.current?.(initialFinalValues);
 
@@ -660,12 +658,9 @@ export default function DynamicFormComponent({
 
     const subscription = form.watch(() => {
       const formValues = form.getValues();
-      const finalValues = editableValueSpecs.reduce(
-        (acc, item) => {
-          acc[item.name] = formValues[item.name] ?? item.default;
-          return acc;
-        },
-        {} as Record<string, object>,
+      const finalValues = normalizeDynamicFormValuesForSave(
+        editableValueSpecs,
+        formValues as Record<string, unknown>,
       );
       onSubmitRef.current?.(finalValues);
       previousInitialValues.current = finalValues as Record<string, object>;

web/src/app/home/components/dynamic-form/DynamicFormItemComponent.tsx

@@ -228,15 +228,10 @@ export default function DynamicFormItemComponent({
 
   const handleSpaceLogin = () => {
     try {
-      const token = localStorage.getItem('token');
-      if (!token) {
-        toast.error(t('common.error'));
-        return;
-      }
       const currentOrigin = window.location.origin;
       const redirectUri = `${currentOrigin}/auth/space/callback?mode=bind`;
       httpClient
-        .getSpaceAuthorizeUrl(redirectUri, token)
+        .getSpaceBindAuthorizeUrl(redirectUri)
         .then((response) => {
           window.location.href = response.authorize_url;
         })

web/src/app/home/components/dynamic-form/DynamicFormSaveValues.ts

@@ -0,0 +1,25 @@
+import type { IDynamicFormItemSchema } from '@/app/infra/entities/form/dynamic';
+
+export type DynamicFormSaveValueSpec = Pick<
+  IDynamicFormItemSchema,
+  'default' | 'name' | 'type'
+>;
+
+/**
+ * Build the value snapshot emitted to parent forms for persistence.
+ * Only single-line string fields trim surrounding whitespace; multiline text
+ * and every other dynamic form field type preserve their original values.
+ */
+export function normalizeDynamicFormValuesForSave(
+  specs: readonly DynamicFormSaveValueSpec[],
+  formValues: Record<string, unknown>,
+): Record<string, unknown> {
+  return specs.reduce<Record<string, unknown>>((values, spec) => {
+    const value = formValues[spec.name] ?? spec.default;
+    values[spec.name] =
+      spec.type === 'string' && typeof value === 'string'
+        ? value.trim()
+        : value;
+    return values;
+  }, {});
+}

web/src/app/home/components/dynamic-form/N8nAuthFormComponent.tsx

@@ -12,6 +12,7 @@ import {
 } from '@/components/ui/form';
 import { IDynamicFormItemSchema } from '@/app/infra/entities/form/dynamic';
 import DynamicFormItemComponent from '@/app/home/components/dynamic-form/DynamicFormItemComponent';
+import { normalizeDynamicFormValuesForSave } from '@/app/home/components/dynamic-form/DynamicFormSaveValues';
 import { extractI18nObject } from '@/i18n/I18nProvider';
 
 /**
@@ -150,12 +151,9 @@ export default function N8nAuthFormComponent({
     // Emit initial form values on mount so the parent form's
     // initializedStagesRef registers this stage (matches DynamicFormComponent).
     const formValues = form.getValues();
-    const initialFinalValues = itemConfigList.reduce(
-      (acc, item) => {
-        acc[item.name] = formValues[item.name] ?? item.default;
-        return acc;
-      },
-      {} as Record<string, string>,
+    const initialFinalValues = normalizeDynamicFormValuesForSave(
+      itemConfigList,
+      formValues as Record<string, unknown>,
     );
     onSubmitRef.current?.(initialFinalValues);
     previousInitialValues.current = initialFinalValues as Record<
@@ -171,12 +169,9 @@ export default function N8nAuthFormComponent({
 
       // 获取完整的表单值，确保包含所有默认值
       const formValues = form.getValues();
-      const finalValues = itemConfigList.reduce(
-        (acc, item) => {
-          acc[item.name] = formValues[item.name] ?? item.default;
-          return acc;
-        },
-        {} as Record<string, string>,
+      const finalValues = normalizeDynamicFormValuesForSave(
+        itemConfigList,
+        formValues as Record<string, unknown>,
       );
 
       onSubmitRef.current?.(finalValues);

web/src/app/home/components/home-sidebar/HomeSidebar.tsx

@@ -4,7 +4,11 @@ import { useNavigate, useLocation, useSearchParams } from 'react-router-dom';
 import { sidebarConfigList } from '@/app/home/components/home-sidebar/sidbarConfigList';
 import langbotIcon from '@/app/assets/langbot-logo.webp';
 import { systemInfo, httpClient } from '@/app/infra/http/HttpClient';
-import { getCloudServiceClientSync } from '@/app/infra/http';
+import {
+  clearUserInfo,
+  getCloudServiceClientSync,
+  useCurrentWorkspace,
+} from '@/app/infra/http';
 import { useTranslation } from 'react-i18next';
 import {
   Moon,
@@ -35,6 +39,7 @@ import {
   Bot,
   Workflow,
   ListTree,
+  UsersRound,
 } from 'lucide-react';
 import { useTheme } from '@/components/providers/theme-provider';
 
@@ -60,6 +65,9 @@ import { Avatar, AvatarFallback } from '@/components/ui/avatar';
 import { LanguageSelector } from '@/components/ui/language-selector';
 import { Badge } from '@/components/ui/badge';
 import { Button } from '@/components/ui/button';
+import WorkspaceSwitcher, {
+  OPEN_WORKSPACE_SETTINGS_EVENT,
+} from '@/app/home/components/workspace-settings/WorkspaceSwitcher';
 import NewVersionDialog from '@/app/home/components/new-version-dialog/NewVersionDialog';
 import SettingsDialog, {
   SettingsSection,
@@ -384,6 +392,11 @@ function NavItems({
   const sidebarData = useSidebarData();
   const { state: sidebarState, isMobile } = useSidebar();
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManageResources =
+    currentWorkspace?.permissions.includes('resource.manage') ?? false;
+  const canOperateRuntime =
+    currentWorkspace?.permissions.includes('runtime.operate') ?? false;
   // Track which entity categories have their full list expanded
   const [expandedLists, setExpandedLists] = useState<SidebarListExpansionState>(
     loadListExpansionState,
@@ -517,6 +530,9 @@ function NavItems({
     <>
       {sectionItems.map((config) => {
         if (!isEntityCategory(config.id)) {
+          if (config.id === 'add-extension' && !canManageResources) {
+            return null;
+          }
           // Non-entity entries (e.g. monitoring, market, mcp) render as plain links
           return (
             <SidebarMenuItem key={config.id}>
@@ -556,7 +572,8 @@ function NavItems({
           : sidebarData[entityKey];
         const routePrefix = ENTITY_ROUTE_MAP[categoryId];
         const hasDetailPages = DETAIL_PAGE_CATEGORIES.includes(categoryId);
-        const canCreate = CREATABLE_CATEGORIES.includes(categoryId);
+        const canCreate =
+          canManageResources && CREATABLE_CATEGORIES.includes(categoryId);
         const isCollapseOnly = COLLAPSIBLE_ONLY_CATEGORIES.includes(categoryId);
         const isPlugin = categoryId === 'plugins';
         const isSkill = categoryId === 'skills';
@@ -845,6 +862,7 @@ function NavItems({
                 {itemIsPluginType && !item.debug && (
                   <PluginItemMenu
                     item={item}
+                    canManage={canManageResources}
                     onUpdate={() => handlePluginUpdate(item)}
                     onDelete={() => handlePluginDelete(item)}
                   />
@@ -1149,7 +1167,7 @@ function NavItems({
                           <span>{t('agents.groupByKindShort')}</span>
                         </button>
                       )}
-                      {isExtensionsCategory && (
+                      {isExtensionsCategory && canOperateRuntime && (
                         <button
                           type="button"
                           title={t('plugins.groupByType')}
@@ -1440,10 +1458,12 @@ function NavItems({
 // Dropdown menu for plugin sidebar sub-items (shown on hover)
 function PluginItemMenu({
   item,
+  canManage,
   onUpdate,
   onDelete,
 }: {
   item: SidebarEntityItem;
+  canManage: boolean;
   onUpdate: () => void;
   onDelete: () => void;
 }) {
@@ -1454,6 +1474,8 @@ function PluginItemMenu({
   const isGithub = item.installSource === 'github';
   const hasSourceLink = isMarketplace || isGithub;
 
+  if (!canManage && !hasSourceLink) return null;
+
   function handleViewSource() {
     const slashIdx = item.id.indexOf('/');
     const author = slashIdx >= 0 ? item.id.substring(0, slashIdx) : '';
@@ -1494,7 +1516,7 @@ function PluginItemMenu({
         </button>
       </DropdownMenuTrigger>
       <DropdownMenuContent side="right" align="start">
-        {isMarketplace && (
+        {canManage && isMarketplace && (
           <DropdownMenuItem
             className="cursor-pointer"
             onClick={() => {
@@ -1523,16 +1545,18 @@ function PluginItemMenu({
             <span>{t('plugins.viewSource')}</span>
           </DropdownMenuItem>
         )}
-        <DropdownMenuItem
-          className="cursor-pointer text-red-600 focus:text-red-600"
-          onClick={() => {
-            onDelete();
-            setOpen(false);
-          }}
-        >
-          <Trash className="size-4" />
-          <span>{t('plugins.delete')}</span>
-        </DropdownMenuItem>
+        {canManage && (
+          <DropdownMenuItem
+            className="cursor-pointer text-red-600 focus:text-red-600"
+            onClick={() => {
+              onDelete();
+              setOpen(false);
+            }}
+          >
+            <Trash className="size-4" />
+            <span>{t('plugins.delete')}</span>
+          </DropdownMenuItem>
+        )}
       </DropdownMenuContent>
     </DropdownMenu>
   );
@@ -1722,6 +1746,7 @@ export default function HomeSidebar({
     useState<Record<string, boolean>>(loadSectionState);
   const { theme, setTheme } = useTheme();
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
   const [settingsOpen, setSettingsOpen] = useState(false);
   const [settingsSection, setSettingsSection] =
     useState<SettingsSection>('models');
@@ -1765,6 +1790,19 @@ export default function HomeSidebar({
     });
   }
 
+  useEffect(() => {
+    const openWorkspaceSettings = () => openSettings('workspace');
+    window.addEventListener(
+      OPEN_WORKSPACE_SETTINGS_EVENT,
+      openWorkspaceSettings,
+    );
+    return () =>
+      window.removeEventListener(
+        OPEN_WORKSPACE_SETTINGS_EVENT,
+        openWorkspaceSettings,
+      );
+  });
+
   function handleSettingsSectionChange(section: SettingsSection) {
     setSettingsSection(section);
     const params = new URLSearchParams(searchParams.toString());
@@ -1788,10 +1826,6 @@ export default function HomeSidebar({
 
   useEffect(() => {
     initSelect();
-    if (!localStorage.getItem('token')) {
-      localStorage.setItem('token', 'test-token');
-      localStorage.setItem('userEmail', 'test@example.com');
-    }
 
     const storedEmail = localStorage.getItem('userEmail');
     if (storedEmail) {
@@ -1930,6 +1964,7 @@ export default function HomeSidebar({
   }
 
   function handleLogout() {
+    clearUserInfo();
     localStorage.removeItem('token');
     localStorage.removeItem('userEmail');
     window.location.href = '/login';
@@ -1990,6 +2025,10 @@ export default function HomeSidebar({
           </SidebarMenu>
         </SidebarHeader>
 
+        <div className="px-2 group-data-[collapsible=icon]:px-0">
+          <WorkspaceSwitcher className="w-full group-data-[collapsible=icon]:min-w-0 group-data-[collapsible=icon]:px-2" />
+        </div>
+
         {/* Navigation items grouped by section */}
         <div className="relative flex min-h-0 flex-1 flex-col overflow-hidden">
           <SidebarContent ref={navigationContentRef} className="min-h-0 pb-8">
@@ -2058,18 +2097,20 @@ export default function HomeSidebar({
             </SidebarMenuItem>
           </SidebarMenu>
 
-          {/* API Integration entry */}
-          <SidebarMenu>
-            <SidebarMenuItem>
-              <SidebarMenuButton
-                onClick={() => openSettings('apiIntegration')}
-                tooltip={t('common.apiIntegration')}
-              >
-                <KeyRound className="size-4 text-blue-500" />
-                <span>{t('common.apiIntegration')}</span>
-              </SidebarMenuButton>
-            </SidebarMenuItem>
-          </SidebarMenu>
+          {/* API-key management is available only to authorized Workspace roles. */}
+          {currentWorkspace?.permissions.includes('api_key.manage') && (
+            <SidebarMenu>
+              <SidebarMenuItem>
+                <SidebarMenuButton
+                  onClick={() => openSettings('apiIntegration')}
+                  tooltip={t('common.apiIntegration')}
+                >
+                  <KeyRound className="size-4 text-blue-500" />
+                  <span>{t('common.apiIntegration')}</span>
+                </SidebarMenuButton>
+              </SidebarMenuItem>
+            </SidebarMenu>
+          )}
 
           {/* User menu using sidebar-07 nav-user DropdownMenu pattern */}
           <SidebarMenu>
@@ -2158,6 +2199,15 @@ export default function HomeSidebar({
                       <Settings />
                       {t('account.settings')}
                     </DropdownMenuItem>
+                    <DropdownMenuItem
+                      onClick={() => {
+                        setUserMenuOpen(false);
+                        openSettings('workspace');
+                      }}
+                    >
+                      <UsersRound />
+                      {t('workspace.settings')}
+                    </DropdownMenuItem>
                     <DropdownMenuItem
                       onClick={() => {
                         setUserMenuOpen(false);

web/src/app/home/components/models-dialog/ModelsPanel.tsx

@@ -24,6 +24,8 @@ import {
 } from './types';
 import { CustomApiError } from '@/app/infra/entities/common';
 import { PanelBody } from '../settings-dialog/panel-layout';
+import { useCurrentWorkspace } from '@/app/infra/http';
+import type { WorkspaceSpaceBilling } from '@/app/infra/entities/workspace';
 
 interface ModelsPanelProps {
   // True when this panel is the active section and the dialog is open.
@@ -83,10 +85,13 @@ export default function ModelsPanel({
   onBlockingChange,
 }: ModelsPanelProps) {
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManage =
+    currentWorkspace?.permissions.includes('provider_secret.manage') ?? false;
 
   const [providers, setProviders] = useState<ModelProvider[]>([]);
-  const [accountType, setAccountType] = useState<'local' | 'space'>('local');
-  const [spaceCredits, setSpaceCredits] = useState<number | null>(null);
+  const [spaceBilling, setSpaceBilling] =
+    useState<WorkspaceSpaceBilling | null>(null);
 
   // Expanded providers and their models
   const [expandedProviders, setExpandedProviders] = useState<Set<string>>(
@@ -140,7 +145,7 @@ export default function ModelsPanel({
 
   useEffect(() => {
     if (active) {
-      loadUserInfo();
+      loadWorkspaceBilling();
       loadProviders();
       loadRequesterSupportTypes();
     }
@@ -163,16 +168,11 @@ export default function ModelsPanel({
     }
   }, [providersLoaded, providers]);
 
-  async function loadUserInfo() {
+  async function loadWorkspaceBilling() {
     try {
-      const userInfo = await httpClient.getUserInfo();
-      setAccountType(userInfo.account_type);
-      if (userInfo.account_type === 'space') {
-        const creditsInfo = await httpClient.getSpaceCredits();
-        setSpaceCredits(creditsInfo.credits);
-      }
+      setSpaceBilling(await httpClient.getWorkspaceSpaceBilling());
     } catch {
-      setAccountType('local');
+      setSpaceBilling(null);
     }
   }
 
@@ -270,17 +270,9 @@ export default function ModelsPanel({
 
   async function handleSpaceLogin() {
     try {
-      const token = localStorage.getItem('token');
-      if (!token) {
-        toast.error(t('common.error'));
-        return;
-      }
       const currentOrigin = window.location.origin;
       const redirectUri = `${currentOrigin}/auth/space/callback?mode=bind`;
-      const response = await httpClient.getSpaceAuthorizeUrl(
-        redirectUri,
-        token,
-      );
+      const response = await httpClient.getSpaceBindAuthorizeUrl(redirectUri);
       window.location.href = response.authorize_url;
     } catch {
       toast.error(t('common.spaceLoginFailed'));
@@ -544,13 +536,15 @@ export default function ModelsPanel({
       <ProviderCard
         key={provider.uuid}
         provider={provider}
+        canManage={canManage}
         isLangBotModels={isLangBotModels}
         supportTypes={requesterSupportTypes[provider.requester]}
         isExpanded={expandedProviders.has(provider.uuid)}
         isLoading={loadingProviders.has(provider.uuid)}
         models={providerModels[provider.uuid]}
-        accountType={accountType}
-        spaceCredits={spaceCredits}
+        isWorkspaceOwner={currentWorkspace?.membership.role === 'owner'}
+        ownerSpaceBound={spaceBilling?.owner_space_bound ?? false}
+        spaceCredits={spaceBilling?.credits ?? null}
         addModelPopoverOpen={addModelPopoverOpen}
         editModelPopoverOpen={editModelPopoverOpen}
         deleteConfirmOpen={deleteConfirmOpen}
@@ -628,10 +622,12 @@ export default function ModelsPanel({
                 )
               : t('models.providerCount', { count: otherProviders.length })}
           </span>
-          <Button size="sm" variant="outline" onClick={handleCreateProvider}>
-            <Plus className="h-4 w-4 mr-1" />
-            {t('models.addProvider')}
-          </Button>
+          {canManage && (
+            <Button size="sm" variant="outline" onClick={handleCreateProvider}>
+              <Plus className="h-4 w-4 mr-1" />
+              {t('models.addProvider')}
+            </Button>
+          )}
         </div>
 
         {/* Provider List */}

web/src/app/home/components/models-dialog/components/ModelItem.tsx

@@ -18,6 +18,7 @@ import { userInfo } from '@/app/infra/http';
 
 interface ModelItemProps {
   model: LLMModel | EmbeddingModel;
+  canManage: boolean;
   modelType: ModelType;
   isLangBotModels: boolean;
   editModelPopoverOpen: string | null;
@@ -71,6 +72,7 @@ function convertExtraArgsToArray(extraArgs?: object): ExtraArg[] {
 
 export default function ModelItem({
   model,
+  canManage,
   modelType,
   isLangBotModels,
   editModelPopoverOpen,
@@ -149,7 +151,7 @@ export default function ModelItem({
 
   // Check if popover should be disabled (space models when not logged in)
   const isPopoverDisabled =
-    isLangBotModels && userInfo?.account_type !== 'space';
+    !canManage || (isLangBotModels && userInfo?.account_type !== 'space');
 
   return (
     <Popover
@@ -193,7 +195,7 @@ export default function ModelItem({
                 </Badge>
               )}
           </div>
-          {!isLangBotModels && (
+          {canManage && !isLangBotModels && (
             <Popover
               open={isDeleteOpen}
               onOpenChange={(open) =>

web/src/app/home/components/models-dialog/components/ProviderCard.tsx

@@ -38,12 +38,14 @@ import AddModelPopover from './AddModelPopover';
 
 interface ProviderCardProps {
   provider: ModelProvider;
+  canManage: boolean;
   isLangBotModels?: boolean;
   supportTypes?: string[];
   isExpanded: boolean;
   isLoading: boolean;
   models?: ProviderModels;
-  accountType: 'local' | 'space';
+  isWorkspaceOwner: boolean;
+  ownerSpaceBound: boolean;
   spaceCredits: number | null;
   // Popover states
   addModelPopoverOpen: string | null;
@@ -101,12 +103,14 @@ function maskApiKey(key: string): string {
 
 export default function ProviderCard({
   provider,
+  canManage,
   isLangBotModels = false,
   supportTypes,
   isExpanded,
   isLoading,
   models,
-  accountType,
+  isWorkspaceOwner,
+  ownerSpaceBound,
   spaceCredits,
   addModelPopoverOpen,
   editModelPopoverOpen,
@@ -196,7 +200,7 @@ export default function ProviderCard({
               </div>
             </div>
             <div className="flex items-center gap-1 ml-2 shrink-0">
-              {isLangBotModels && accountType !== 'space' && (
+              {isLangBotModels && isWorkspaceOwner && !ownerSpaceBound && (
                 <Button
                   variant="outline"
                   size="sm"
@@ -206,33 +210,41 @@ export default function ProviderCard({
                   }}
                 >
                   <LogIn className="h-4 w-4 mr-1" />
-                  {t('models.loginWithSpace')}
+                  {t('models.ownerMustBindSpace')}
                 </Button>
               )}
-              {isLangBotModels &&
-                accountType === 'space' &&
-                spaceCredits !== null && (
-                  <div className="flex items-center gap-1 border rounded-md px-2 h-8 text-sm mr-2">
-                    <span>
-                      {(spaceCredits / 5000).toFixed(2)} {t('models.credits')}
-                    </span>
-                    <Button
-                      variant="ghost"
-                      size="icon"
-                      className="h-5 w-5"
-                      onClick={(e) => {
-                        e.stopPropagation();
-                        window.open(
-                          `${systemInfo.cloud_service_url}/profile?tab=billing`,
-                          '_blank',
-                        );
-                      }}
-                    >
-                      <Plus className="h-3 w-3" />
-                    </Button>
-                  </div>
-                )}
-              {!isLangBotModels && (
+              {isLangBotModels && ownerSpaceBound && spaceCredits !== null && (
+                <div className="flex items-center gap-1 border rounded-md px-2 h-8 text-sm mr-2">
+                  <span>
+                    {(spaceCredits / 5000).toFixed(2)} {t('models.credits')}
+                  </span>
+                  <Button
+                    variant="ghost"
+                    size="icon"
+                    className="h-5 w-5"
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      window.open(
+                        `${systemInfo.cloud_service_url}/profile?tab=billing`,
+                        '_blank',
+                      );
+                    }}
+                  >
+                    <Plus className="h-3 w-3" />
+                  </Button>
+                </div>
+              )}
+              {isLangBotModels && !isWorkspaceOwner && ownerSpaceBound && (
+                <span className="text-xs text-muted-foreground">
+                  {t('models.usesOwnerSpaceBilling')}
+                </span>
+              )}
+              {isLangBotModels && !isWorkspaceOwner && !ownerSpaceBound && (
+                <span className="text-xs text-muted-foreground">
+                  {t('models.ownerMustBindSpace')}
+                </span>
+              )}
+              {canManage && !isLangBotModels && (
                 <>
                   <Button
                     variant="ghost"
@@ -317,7 +329,7 @@ export default function ProviderCard({
             ) : (
               <div />
             )}
-            {!isLangBotModels && (
+            {canManage && !isLangBotModels && (
               <div className="flex items-center gap-1">
                 <AddModelPopover
                   isOpen={
@@ -404,6 +416,7 @@ export default function ProviderCard({
                   <ModelItem
                     key={model.uuid}
                     model={model}
+                    canManage={canManage}
                     modelType="llm"
                     isLangBotModels={isLangBotModels}
                     editModelPopoverOpen={editModelPopoverOpen}
@@ -441,6 +454,7 @@ export default function ProviderCard({
                   <ModelItem
                     key={model.uuid}
                     model={model}
+                    canManage={canManage}
                     modelType="embedding"
                     isLangBotModels={isLangBotModels}
                     editModelPopoverOpen={editModelPopoverOpen}
@@ -472,6 +486,7 @@ export default function ProviderCard({
                   <ModelItem
                     key={model.uuid}
                     model={model}
+                    canManage={canManage}
                     modelType="rerank"
                     isLangBotModels={isLangBotModels}
                     editModelPopoverOpen={editModelPopoverOpen}

web/src/app/home/components/settings-dialog/SettingsDialog.tsx

@@ -1,6 +1,12 @@
 import { useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { KeyRound, Sparkles, Settings, HardDrive } from 'lucide-react';
+import {
+  HardDrive,
+  KeyRound,
+  Settings,
+  Sparkles,
+  UsersRound,
+} from 'lucide-react';
 import {
   Dialog,
   DialogContent,
@@ -22,10 +28,13 @@ import AccountSettingsPanel from '@/app/home/components/account-settings-dialog/
 import ApiIntegrationPanel from '@/app/home/components/api-integration-dialog/ApiIntegrationPanel';
 import ModelsPanel from '@/app/home/components/models-dialog/ModelsPanel';
 import StorageAnalysisPanel from '@/app/home/components/storage-analysis-dialog/StorageAnalysisPanel';
+import WorkspaceSettingsPanel from '@/app/home/components/workspace-settings/WorkspaceSettingsPanel';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 // The set of settings sections shown in the unified dialog. The string values
 // are also reused as the ?action= query param suffix so deep links keep working.
 export type SettingsSection =
+  | 'workspace'
   | 'account'
   | 'apiIntegration'
   | 'models'
@@ -35,6 +44,7 @@ export type SettingsSection =
 // (showAccountSettings, showApiIntegrationSettings, showModelSettings,
 // showStorageAnalysis) continue to resolve to the right section.
 export const SETTINGS_ACTION_BY_SECTION: Record<SettingsSection, string> = {
+  workspace: 'showWorkspaceSettings',
   account: 'showAccountSettings',
   apiIntegration: 'showApiIntegrationSettings',
   models: 'showModelSettings',
@@ -63,6 +73,7 @@ export default function SettingsDialog({
   onSectionChange,
 }: SettingsDialogProps) {
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
   // A nested modal (e.g. the provider form) can request that we ignore
   // outer-close until it is dismissed.
   const [blocking, setBlocking] = useState(false);
@@ -76,13 +87,20 @@ export default function SettingsDialog({
     }
   }, [section, open]);
 
-  const navItems: {
+  const allNavItems: {
     id: SettingsSection;
     label: string;
     title: string;
     description: string;
     icon: React.ReactNode;
   }[] = [
+    {
+      id: 'workspace',
+      label: t('settingsDialog.nav.workspace'),
+      title: t('workspace.title'),
+      description: t('workspace.description'),
+      icon: <UsersRound className="size-4" />,
+    },
     {
       id: 'models',
       label: t('settingsDialog.nav.models'),
@@ -112,6 +130,27 @@ export default function SettingsDialog({
       icon: <Settings className="size-4" />,
     },
   ];
+  const permissions = currentWorkspace?.permissions ?? [];
+  const canManageApiKeys = permissions.includes('api_key.manage');
+  const canViewAudit = permissions.includes('audit.view');
+  const navItems = allNavItems.filter((item) => {
+    if (item.id === 'apiIntegration') {
+      return canManageApiKeys;
+    }
+    if (item.id === 'storageAnalysis') {
+      return canViewAudit;
+    }
+    return true;
+  });
+
+  useEffect(() => {
+    const forbiddenSection =
+      (section === 'apiIntegration' && !canManageApiKeys) ||
+      (section === 'storageAnalysis' && !canViewAudit);
+    if (open && forbiddenSection) {
+      onSectionChange('workspace');
+    }
+  }, [canManageApiKeys, canViewAudit, open, section, onSectionChange]);
 
   const activeItem = navItems.find((item) => item.id === section);
   const activeLabel = activeItem?.title ?? t('settingsDialog.title');
@@ -201,6 +240,11 @@ export default function SettingsDialog({
             </div>
 
             <div className="flex min-h-0 flex-1 flex-col overflow-hidden">
+              {section === 'workspace' && (
+                <WorkspaceSettingsPanel
+                  active={open && section === 'workspace'}
+                />
+              )}
               {section === 'models' && (
                 <ModelsPanel
                   active={open && section === 'models'}

web/src/app/home/components/workspace-settings/WorkspaceSettingsPanel.tsx

@@ -0,0 +1,413 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import {
+  Copy,
+  ExternalLink,
+  Loader2,
+  Trash2,
+  UserPlus,
+  Users,
+} from 'lucide-react';
+import { useTranslation } from 'react-i18next';
+import { toast } from 'sonner';
+
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemMedia,
+  ItemTitle,
+} from '@/components/ui/item';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import type {
+  CurrentWorkspace,
+  WorkspaceInvitation,
+  WorkspaceMembership,
+  WorkspaceRole,
+} from '@/app/infra/entities/workspace';
+import { backendClient, systemInfo } from '@/app/infra/http';
+import {
+  PanelBody,
+  PanelToolbar,
+} from '@/app/home/components/settings-dialog/panel-layout';
+
+interface WorkspaceSettingsPanelProps {
+  active: boolean;
+}
+
+const ASSIGNABLE_ROLES: Exclude<WorkspaceRole, 'owner'>[] = [
+  'admin',
+  'developer',
+  'operator',
+  'viewer',
+];
+
+export default function WorkspaceSettingsPanel({
+  active,
+}: WorkspaceSettingsPanelProps) {
+  const { t } = useTranslation();
+  const [workspaceInfo, setWorkspaceInfo] = useState<CurrentWorkspace | null>(
+    null,
+  );
+  const [members, setMembers] = useState<WorkspaceMembership[]>([]);
+  const [invitations, setInvitations] = useState<WorkspaceInvitation[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [inviteEmail, setInviteEmail] = useState('');
+  const [inviteRole, setInviteRole] =
+    useState<Exclude<WorkspaceRole, 'owner'>>('viewer');
+  const [inviteLoading, setInviteLoading] = useState(false);
+  const [oneTimeInviteLink, setOneTimeInviteLink] = useState<string | null>(
+    null,
+  );
+
+  const permissions = useMemo(
+    () => new Set(workspaceInfo?.permissions ?? []),
+    [workspaceInfo],
+  );
+  const isCloudProjection =
+    workspaceInfo?.workspace.source === 'cloud_projection';
+  const canViewMembers = permissions.has('member.view');
+  const canInvite = permissions.has('member.invite');
+  const canUpdateMembers = permissions.has('member.update_role');
+  const canRemoveMembers = permissions.has('member.remove');
+  const canTransferOwner = permissions.has('owner.transfer');
+  const cloudPortalURL = workspaceInfo
+    ? `${systemInfo.cloud_service_url.replace(/\/$/, '')}/cloud?workspace=${encodeURIComponent(workspaceInfo.workspace.uuid)}&step=plan`
+    : '';
+
+  const loadWorkspace = useCallback(async () => {
+    setLoading(true);
+    try {
+      const current = await backendClient.getCurrentWorkspace();
+      setWorkspaceInfo(current);
+
+      const [memberResponse, invitationResponse] = await Promise.all([
+        current.permissions.includes('member.view')
+          ? backendClient.getWorkspaceMembers(current.workspace.uuid)
+          : Promise.resolve({ members: [] }),
+        current.permissions.includes('member.invite')
+          ? backendClient.getWorkspaceInvitations(current.workspace.uuid)
+          : Promise.resolve({ invitations: [] }),
+      ]);
+      setMembers(memberResponse.members);
+      setInvitations(invitationResponse.invitations);
+    } catch {
+      toast.error(t('workspace.loadFailed'));
+    } finally {
+      setLoading(false);
+    }
+  }, [t]);
+
+  useEffect(() => {
+    if (active) void loadWorkspace();
+  }, [active, loadWorkspace]);
+
+  async function createInvitation() {
+    if (!workspaceInfo || !inviteEmail.trim()) return;
+    setInviteLoading(true);
+    try {
+      const response = await backendClient.createWorkspaceInvitation(
+        workspaceInfo.workspace.uuid,
+        inviteEmail.trim(),
+        inviteRole,
+      );
+      setOneTimeInviteLink(response.link);
+      setInviteEmail('');
+      await loadWorkspace();
+      toast.success(t(`workspace.delivery.${response.delivery.status}`));
+    } catch {
+      toast.error(t('workspace.invitationCreateFailed'));
+    } finally {
+      setInviteLoading(false);
+    }
+  }
+
+  async function copyInvitationLink() {
+    if (!oneTimeInviteLink) return;
+    await navigator.clipboard.writeText(oneTimeInviteLink);
+    toast.success(t('workspace.invitationCopied'));
+  }
+
+  async function updateMemberRole(
+    member: WorkspaceMembership,
+    role: WorkspaceRole,
+  ) {
+    if (!workspaceInfo || member.role === role) return;
+    try {
+      await backendClient.updateWorkspaceMemberRole(
+        workspaceInfo.workspace.uuid,
+        member.account_uuid,
+        role,
+      );
+      await loadWorkspace();
+      toast.success(t('workspace.memberUpdated'));
+    } catch {
+      toast.error(t('workspace.memberUpdateFailed'));
+    }
+  }
+
+  async function removeMember(member: WorkspaceMembership) {
+    if (!workspaceInfo) return;
+    if (!window.confirm(t('workspace.removeMemberConfirm'))) return;
+    try {
+      await backendClient.removeWorkspaceMember(
+        workspaceInfo.workspace.uuid,
+        member.account_uuid,
+      );
+      await loadWorkspace();
+      toast.success(t('workspace.memberRemoved'));
+    } catch {
+      toast.error(t('workspace.memberRemoveFailed'));
+    }
+  }
+
+  async function revokeInvitation(invitation: WorkspaceInvitation) {
+    if (!workspaceInfo) return;
+    try {
+      await backendClient.revokeWorkspaceInvitation(
+        workspaceInfo.workspace.uuid,
+        invitation.uuid,
+      );
+      await loadWorkspace();
+      toast.success(t('workspace.invitationRevoked'));
+    } catch {
+      toast.error(t('workspace.invitationRevokeFailed'));
+    }
+  }
+
+  if (loading && !workspaceInfo) {
+    return (
+      <div className="flex flex-1 items-center justify-center">
+        <Loader2 className="size-6 animate-spin" />
+      </div>
+    );
+  }
+
+  return (
+    <>
+      <PanelToolbar>
+        <div className="min-w-0">
+          <p className="truncate text-sm font-medium">
+            {workspaceInfo?.workspace.name ?? t('workspace.title')}
+          </p>
+          <p className="text-xs text-muted-foreground">
+            {t(
+              isCloudProjection
+                ? 'workspace.cloudManagedDescription'
+                : 'workspace.ossSingletonDescription',
+            )}
+          </p>
+        </div>
+        {workspaceInfo && (
+          <Badge variant="secondary">
+            {t(`workspace.roles.${workspaceInfo.membership.role}`)}
+          </Badge>
+        )}
+        {isCloudProjection && workspaceInfo && (
+          <Button asChild size="sm">
+            <a href={cloudPortalURL} target="_blank" rel="noopener noreferrer">
+              {t('workspace.upgradePlan')}
+              <ExternalLink className="size-3.5" />
+            </a>
+          </Button>
+        )}
+      </PanelToolbar>
+
+      <PanelBody className="space-y-6">
+        {canInvite && (
+          <section className="space-y-3">
+            <div>
+              <h3 className="text-sm font-semibold">
+                {t('workspace.inviteMember')}
+              </h3>
+              <p className="text-xs text-muted-foreground">
+                {t('workspace.inviteDescription')}
+              </p>
+            </div>
+            <div className="flex flex-col gap-2 sm:flex-row">
+              <Input
+                type="email"
+                value={inviteEmail}
+                onChange={(event) => setInviteEmail(event.target.value)}
+                placeholder={t('workspace.emailPlaceholder')}
+                className="flex-1"
+              />
+              <Select
+                value={inviteRole}
+                onValueChange={(value) =>
+                  setInviteRole(value as Exclude<WorkspaceRole, 'owner'>)
+                }
+              >
+                <SelectTrigger className="w-full sm:w-36">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {ASSIGNABLE_ROLES.map((role) => (
+                    <SelectItem key={role} value={role}>
+                      {t(`workspace.roles.${role}`)}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+              <Button
+                onClick={createInvitation}
+                disabled={inviteLoading || !inviteEmail.trim()}
+              >
+                {inviteLoading ? (
+                  <Loader2 className="size-4 animate-spin" />
+                ) : (
+                  <UserPlus className="size-4" />
+                )}
+                {t('workspace.createInvitation')}
+              </Button>
+            </div>
+
+            {oneTimeInviteLink && (
+              <div className="rounded-lg border border-amber-500/30 bg-amber-500/5 p-3">
+                <p className="mb-2 text-xs text-muted-foreground">
+                  {t('workspace.oneTimeLinkWarning')}
+                </p>
+                <div className="flex gap-2">
+                  <Input value={oneTimeInviteLink} readOnly />
+                  <Button
+                    variant="outline"
+                    size="icon"
+                    onClick={copyInvitationLink}
+                    aria-label={t('workspace.copyInvitation')}
+                  >
+                    <Copy className="size-4" />
+                  </Button>
+                </div>
+              </div>
+            )}
+          </section>
+        )}
+
+        {canViewMembers && (
+          <section className="space-y-3">
+            <div className="flex items-center justify-between gap-3">
+              <h3 className="text-sm font-semibold">
+                {t('workspace.members')}
+              </h3>
+            </div>
+            <div className="space-y-2">
+              {members.map((member) => {
+                const isSelf =
+                  member.account_uuid ===
+                  workspaceInfo?.membership.account_uuid;
+                return (
+                  <Item
+                    key={member.uuid}
+                    size="sm"
+                    variant="muted"
+                    className="rounded-lg"
+                  >
+                    <ItemMedia variant="icon">
+                      <Users className="size-4" />
+                    </ItemMedia>
+                    <ItemContent>
+                      <ItemTitle>
+                        {member.email}
+                        {isSelf && (
+                          <Badge variant="outline">{t('workspace.you')}</Badge>
+                        )}
+                      </ItemTitle>
+                      <ItemDescription>
+                        {t(`workspace.roles.${member.role}`)}
+                      </ItemDescription>
+                    </ItemContent>
+                    <ItemActions>
+                      {canUpdateMembers && member.role !== 'owner' && (
+                        <Select
+                          value={member.role}
+                          onValueChange={(role) =>
+                            void updateMemberRole(member, role as WorkspaceRole)
+                          }
+                        >
+                          <SelectTrigger size="sm" className="w-32">
+                            <SelectValue />
+                          </SelectTrigger>
+                          <SelectContent>
+                            {ASSIGNABLE_ROLES.map((role) => (
+                              <SelectItem key={role} value={role}>
+                                {t(`workspace.roles.${role}`)}
+                              </SelectItem>
+                            ))}
+                            {canTransferOwner && (
+                              <SelectItem value="owner">
+                                {t('workspace.transferOwnership')}
+                              </SelectItem>
+                            )}
+                          </SelectContent>
+                        </Select>
+                      )}
+                      {canRemoveMembers &&
+                        !isSelf &&
+                        member.role !== 'owner' && (
+                          <Button
+                            variant="ghost"
+                            size="icon"
+                            onClick={() => void removeMember(member)}
+                            aria-label={t('workspace.removeMember')}
+                          >
+                            <Trash2 className="size-4" />
+                          </Button>
+                        )}
+                    </ItemActions>
+                  </Item>
+                );
+              })}
+            </div>
+          </section>
+        )}
+
+        {canInvite && invitations.length > 0 && (
+          <section className="space-y-3">
+            <h3 className="text-sm font-semibold">
+              {t('workspace.pendingInvitations')}
+            </h3>
+            <div className="space-y-2">
+              {invitations.map((invitation) => (
+                <Item
+                  key={invitation.uuid}
+                  size="sm"
+                  variant="outline"
+                  className="rounded-lg"
+                >
+                  <ItemContent>
+                    <ItemTitle>{invitation.normalized_email}</ItemTitle>
+                    <ItemDescription>
+                      {t(`workspace.roles.${invitation.role}`)} ·{' '}
+                      {t('workspace.expiresAt', {
+                        date: new Date(invitation.expires_at).toLocaleString(),
+                      })}
+                    </ItemDescription>
+                  </ItemContent>
+                  <ItemActions>
+                    <Button
+                      variant="ghost"
+                      size="icon"
+                      onClick={() => void revokeInvitation(invitation)}
+                      aria-label={t('workspace.revokeInvitation')}
+                    >
+                      <Trash2 className="size-4" />
+                    </Button>
+                  </ItemActions>
+                </Item>
+              ))}
+            </div>
+          </section>
+        )}
+      </PanelBody>
+    </>
+  );
+}

web/src/app/home/components/workspace-settings/WorkspaceSwitcher.tsx

@@ -0,0 +1,96 @@
+import { Building2, Check, Settings } from 'lucide-react';
+import { useTranslation } from 'react-i18next';
+
+import {
+  switchWorkspaceAndReload,
+  useCurrentWorkspace,
+  useWorkspaceBootstrap,
+} from '@/app/infra/http';
+import { Button } from '@/components/ui/button';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { cn } from '@/lib/utils';
+
+export const OPEN_WORKSPACE_SETTINGS_EVENT = 'langbot:open-workspace-settings';
+
+export function requestWorkspaceSettings(): void {
+  window.dispatchEvent(new Event(OPEN_WORKSPACE_SETTINGS_EVENT));
+}
+
+export default function WorkspaceSwitcher({
+  className,
+}: {
+  className?: string;
+}) {
+  const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const workspaces = useWorkspaceBootstrap();
+
+  if (!currentWorkspace) return null;
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button
+          variant="outline"
+          size="sm"
+          className={cn('h-9 min-w-0 justify-start px-2.5 text-sm', className)}
+          aria-label={t('workspace.switchWorkspace')}
+        >
+          <Building2 className="size-4 shrink-0" />
+          <span className="truncate">{currentWorkspace.workspace.name}</span>
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-64 p-1.5">
+        <DropdownMenuLabel className="px-3 py-2 text-sm">
+          {t('workspace.switchWorkspace')}
+        </DropdownMenuLabel>
+        {workspaces.map((entry) => {
+          const selected =
+            entry.workspace.uuid === currentWorkspace.workspace.uuid;
+          return (
+            <DropdownMenuItem
+              key={entry.workspace.uuid}
+              className="min-h-11 gap-2 px-2 py-1.5"
+              onClick={() => {
+                if (!selected)
+                  void switchWorkspaceAndReload(entry.workspace.uuid);
+              }}
+            >
+              <Building2 className="size-4 shrink-0" />
+              <span className="max-w-[7rem] min-w-0 flex-1 truncate font-medium">
+                {entry.workspace.name}
+              </span>
+              {entry.workspace.source === 'cloud_projection' && (
+                <span className="rounded-md border bg-muted px-2 py-0.5 text-[11px] font-medium uppercase text-muted-foreground">
+                  {entry.plan_name || t('workspace.planUnavailable')}
+                </span>
+              )}
+              {selected && <Check className="size-4" />}
+              {selected && (
+                <Button
+                  variant="ghost"
+                  size="icon"
+                  className="size-8"
+                  aria-label={t('workspace.settings')}
+                  onClick={(event) => {
+                    event.preventDefault();
+                    event.stopPropagation();
+                    requestWorkspaceSettings();
+                  }}
+                >
+                  <Settings className="size-4" />
+                </Button>
+              )}
+            </DropdownMenuItem>
+          );
+        })}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}

web/src/app/home/knowledge/KBDetailContent.tsx

@@ -27,11 +27,15 @@ import { KnowledgeBase } from '@/app/infra/entities/api';
 import { CustomApiError } from '@/app/infra/entities/common';
 import { toast } from 'sonner';
 import { FileText, FolderOpen, Search, Trash2 } from 'lucide-react';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 export default function KBDetailContent({ id }: { id: string }) {
   const isCreateMode = id === 'new';
   const navigate = useNavigate();
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManage =
+    currentWorkspace?.permissions.includes('resource.manage') ?? false;
   const { refreshKnowledgeBases, knowledgeBases, setDetailEntityName } =
     useSidebarData();
 
@@ -119,18 +123,22 @@ export default function KBDetailContent({ id }: { id: string }) {
           <h1 className="text-xl font-semibold">
             {t('knowledge.createKnowledgeBase')}
           </h1>
-          <Button type="submit" form="kb-form">
-            {t('common.submit')}
-          </Button>
+          {canManage && (
+            <Button type="submit" form="kb-form">
+              {t('common.submit')}
+            </Button>
+          )}
         </div>
 
         <div className="flex-1 overflow-y-auto min-h-0">
           <div className="mx-auto max-w-3xl pb-8">
-            <KBForm
-              initKbId={undefined}
-              onNewKbCreated={handleNewKbCreated}
-              onKbUpdated={handleKbUpdated}
-            />
+            <fieldset className="contents" disabled={!canManage}>
+              <KBForm
+                initKbId={undefined}
+                onNewKbCreated={handleNewKbCreated}
+                onKbUpdated={handleKbUpdated}
+              />
+            </fieldset>
           </div>
         </div>
       </div>
@@ -146,14 +154,16 @@ export default function KBDetailContent({ id }: { id: string }) {
           <h1 className="text-xl font-semibold">
             {t('knowledge.editKnowledgeBase')}
           </h1>
-          <Button
-            type="submit"
-            form="kb-form"
-            disabled={!formDirty}
-            className={activeTab !== 'metadata' ? 'invisible' : ''}
-          >
-            {t('common.save')}
-          </Button>
+          {canManage && (
+            <Button
+              type="submit"
+              form="kb-form"
+              disabled={!formDirty}
+              className={activeTab !== 'metadata' ? 'invisible' : ''}
+            >
+              {t('common.save')}
+            </Button>
+          )}
         </div>
 
         {/* Horizontal Tabs */}
@@ -186,45 +196,49 @@ export default function KBDetailContent({ id }: { id: string }) {
             className="flex-1 min-h-0 overflow-y-auto mt-4"
           >
             <div className="mx-auto max-w-3xl space-y-6 pb-8">
-              <KBForm
-                initKbId={id}
-                onNewKbCreated={handleNewKbCreated}
-                onKbUpdated={handleKbUpdated}
-                onDirtyChange={setFormDirty}
-              />
+              <fieldset className="contents" disabled={!canManage}>
+                <KBForm
+                  initKbId={id}
+                  onNewKbCreated={handleNewKbCreated}
+                  onKbUpdated={handleKbUpdated}
+                  onDirtyChange={setFormDirty}
+                />
+              </fieldset>
 
               {/* Danger Zone Card */}
-              <Card className="border-destructive/50">
-                <CardHeader>
-                  <CardTitle className="text-destructive">
-                    {t('knowledge.dangerZone')}
-                  </CardTitle>
-                  <CardDescription>
-                    {t('knowledge.dangerZoneDescription')}
-                  </CardDescription>
-                </CardHeader>
-                <CardContent>
-                  <div className="flex items-center justify-between">
-                    <div className="space-y-1">
-                      <p className="text-sm font-medium">
-                        {t('knowledge.deleteKbAction')}
-                      </p>
-                      <p className="text-sm text-muted-foreground">
-                        {t('knowledge.deleteKbHint')}
-                      </p>
+              {canManage && (
+                <Card className="border-destructive/50">
+                  <CardHeader>
+                    <CardTitle className="text-destructive">
+                      {t('knowledge.dangerZone')}
+                    </CardTitle>
+                    <CardDescription>
+                      {t('knowledge.dangerZoneDescription')}
+                    </CardDescription>
+                  </CardHeader>
+                  <CardContent>
+                    <div className="flex items-center justify-between">
+                      <div className="space-y-1">
+                        <p className="text-sm font-medium">
+                          {t('knowledge.deleteKbAction')}
+                        </p>
+                        <p className="text-sm text-muted-foreground">
+                          {t('knowledge.deleteKbHint')}
+                        </p>
+                      </div>
+                      <Button
+                        type="button"
+                        variant="destructive"
+                        size="sm"
+                        onClick={() => setShowDeleteConfirm(true)}
+                      >
+                        <Trash2 className="size-4 mr-1.5" />
+                        {t('common.delete')}
+                      </Button>
                     </div>
-                    <Button
-                      type="button"
-                      variant="destructive"
-                      size="sm"
-                      onClick={() => setShowDeleteConfirm(true)}
-                    >
-                      <Trash2 className="size-4 mr-1.5" />
-                      {t('common.delete')}
-                    </Button>
-                  </div>
-                </CardContent>
-              </Card>
+                  </CardContent>
+                </Card>
+              )}
             </div>
           </TabsContent>
 
@@ -234,11 +248,13 @@ export default function KBDetailContent({ id }: { id: string }) {
               value="documents"
               className="flex-1 min-h-0 overflow-y-auto mt-4"
             >
-              <KBDoc
-                kbId={id}
-                ragEngineName={kbInfo?.knowledge_engine?.name}
-                ragEngineCapabilities={kbInfo?.knowledge_engine?.capabilities}
-              />
+              <fieldset className="contents" disabled={!canManage}>
+                <KBDoc
+                  kbId={id}
+                  ragEngineName={kbInfo?.knowledge_engine?.name}
+                  ragEngineCapabilities={kbInfo?.knowledge_engine?.capabilities}
+                />
+              </fieldset>
             </TabsContent>
           )}
 

web/src/app/home/layout.tsx

@@ -14,10 +14,10 @@ import {
 } from '@/app/home/components/home-sidebar/SidebarDataContext';
 import { I18nObject } from '@/app/infra/entities/common';
 import {
-  userInfo,
+  bootstrapWorkspaceSession,
   systemInfo,
-  initializeUserInfo,
   initializeSystemInfo,
+  useCurrentWorkspace,
 } from '@/app/infra/http';
 import { useNavigate, useLocation } from 'react-router-dom';
 import { Link } from 'react-router-dom';
@@ -83,8 +83,6 @@ function isExtensionsRoute(pathname: string): boolean {
 }
 
 const HOME_CONTENT_MAX_WIDTH = 'max-w-[1360px]';
-const BACKEND_UNAVAILABLE_RETURN_TO_STORAGE_KEY =
-  'langbot_backend_unavailable_return_to';
 
 export default function HomeLayout({
   children,
@@ -93,45 +91,78 @@ export default function HomeLayout({
 }>) {
   const navigate = useNavigate();
   const location = useLocation();
+  const currentWorkspace = useCurrentWorkspace();
+  const [identityReady, setIdentityReady] = useState(false);
 
-  // Initialize user info if not already initialized
-  useEffect(() => {
-    if (!userInfo) {
-      initializeUserInfo();
-    }
-  }, []);
-
-  // Auto-redirect to wizard on first visit (wizard not yet completed on this instance)
+  // Resolve the instance, Account, and Workspace before mounting any
+  // Workspace-owned page. The second system-info read uses the now-stable
+  // selector and therefore returns the selected Workspace's wizard metadata.
   useEffect(() => {
     let cancelled = false;
-
-    const checkWizard = async () => {
-      try {
-        // Always re-fetch to ensure we have the latest wizard_status from backend
-        await initializeSystemInfo({ throwOnError: true });
-        if (!cancelled && systemInfo.wizard_status === 'none') {
-          navigate('/wizard', { replace: true });
-        }
-      } catch {
-        if (!cancelled) {
-          const returnTo = `${location.pathname}${location.search}${location.hash}`;
-          sessionStorage.setItem(
-            BACKEND_UNAVAILABLE_RETURN_TO_STORAGE_KEY,
-            returnTo,
+    bootstrapWorkspaceSession()
+      .then(async (result) => {
+        if (result.status === 'selection-required') {
+          const returnTo = `${location.pathname}${location.search}`;
+          navigate(
+            `/workspaces/select?returnTo=${encodeURIComponent(returnTo)}`,
+            { replace: true },
           );
-          navigate('/backend-unavailable', {
-            replace: true,
-            state: { from: returnTo },
-          });
+          return false;
         }
-      }
-    };
-    checkWizard();
-
+        if (result.status === 'unavailable') {
+          throw new Error('No Workspace is available for this Account');
+        }
+        await initializeSystemInfo({ throwOnError: true });
+        return true;
+      })
+      .then((ready) => {
+        if (!cancelled && ready) setIdentityReady(true);
+      })
+      .catch(() => {
+        if (!cancelled) navigate('/login', { replace: true });
+      });
     return () => {
       cancelled = true;
     };
-  }, [location.hash, location.pathname, location.search, navigate]);
+  }, [location.pathname, location.search, navigate]);
+
+  // A read-only member may view resources but must not enter mutation-only
+  // routes. The backend remains the authoritative authorization boundary.
+  useEffect(() => {
+    if (!identityReady || !currentWorkspace) return;
+    if (currentWorkspace.permissions.includes('resource.manage')) return;
+
+    const params = new URLSearchParams(location.search);
+    const createOnlyRoute =
+      location.pathname === '/home/add-extension' ||
+      params.get('id') === 'new' ||
+      (location.pathname === '/home/skills' &&
+        params.get('action') === 'create');
+    if (createOnlyRoute) {
+      const fallback =
+        location.pathname === '/home/add-extension'
+          ? '/home/extensions'
+          : location.pathname;
+      navigate(fallback, { replace: true });
+    }
+  }, [
+    currentWorkspace,
+    identityReady,
+    location.pathname,
+    location.search,
+    navigate,
+  ]);
+
+  // Auto-redirect only after the Workspace bootstrap above has loaded the
+  // selected Workspace's wizard state.
+  useEffect(() => {
+    if (!identityReady) return;
+    if (systemInfo.wizard_status === 'none') {
+      navigate('/wizard', { replace: true });
+    }
+  }, [identityReady, navigate]);
+
+  if (!identityReady) return <div />;
 
   return (
     <SidebarDataProvider>

web/src/app/home/mcp/MCPDetailContent.tsx

@@ -26,6 +26,7 @@ import { useSidebarData } from '@/app/home/components/home-sidebar/SidebarDataCo
 import { useTranslation } from 'react-i18next';
 import { Server, Trash2 } from 'lucide-react';
 import { toast } from 'sonner';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 type MCPRuntimeState = 'connected' | 'connecting' | 'error';
 type MCPConnectionState =
@@ -39,6 +40,11 @@ export default function MCPDetailContent({ id }: { id: string }) {
   const isCreateMode = id === 'new';
   const navigate = useNavigate();
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManage =
+    currentWorkspace?.permissions.includes('resource.manage') ?? false;
+  const canOperate =
+    currentWorkspace?.permissions.includes('runtime.operate') ?? false;
   const { refreshMCPServers, mcpServers, setDetailEntityName } =
     useSidebarData();
   const server = mcpServers.find((s) => s.id === id);
@@ -212,21 +218,25 @@ export default function MCPDetailContent({ id }: { id: string }) {
             </Badge>
           </div>
           <div className="flex flex-wrap gap-2">
-            <Button
-              type="button"
-              variant="outline"
-              onClick={() => navigate('/home/add-extension')}
-            >
-              {t('common.cancel')}
-            </Button>
-            <Button
-              type="button"
-              variant="outline"
-              onClick={() => formRef.current?.testMcp()}
-              disabled={mcpTesting}
-            >
-              {t('common.test')}
-            </Button>
+            {canOperate && (
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() => navigate('/home/add-extension')}
+              >
+                {t('common.cancel')}
+              </Button>
+            )}
+            {canManage && (
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() => formRef.current?.testMcp()}
+                disabled={mcpTesting}
+              >
+                {t('common.test')}
+              </Button>
+            )}
             <Button
               type="submit"
               form="mcp-form"
@@ -243,15 +253,17 @@ export default function MCPDetailContent({ id }: { id: string }) {
         </div>
 
         <div className="min-h-0 flex-1">
-          <MCPForm
-            ref={formRef}
-            initServerName={undefined}
-            layout="split"
-            onFormSubmit={handleFormSubmit}
-            onNewServerCreated={handleNewServerCreated}
-            onTestingChange={setMcpTesting}
-            onSaveBlockedChange={setSaveBlockedByBox}
-          />
+          <fieldset className="contents" disabled={!canManage}>
+            <MCPForm
+              ref={formRef}
+              initServerName={undefined}
+              layout="split"
+              onFormSubmit={handleFormSubmit}
+              onNewServerCreated={handleNewServerCreated}
+              onTestingChange={setMcpTesting}
+              onSaveBlockedChange={setSaveBlockedByBox}
+            />
+          </fieldset>
         </div>
       </div>
     );
@@ -274,6 +286,7 @@ export default function MCPDetailContent({ id }: { id: string }) {
             id="mcp-enable-switch"
             checked={serverEnabled}
             onCheckedChange={handleEnableToggle}
+            disabled={!canManage}
           />
         </div>
       </CardContent>
@@ -335,41 +348,47 @@ export default function MCPDetailContent({ id }: { id: string }) {
             </div>
           </div>
           <div className="flex flex-wrap gap-2">
-            <Button
-              type="button"
-              variant="outline"
-              onClick={() => formRef.current?.testMcp()}
-              disabled={mcpTesting}
-            >
-              {t('common.test')}
-            </Button>
-            <Button
-              type="submit"
-              form="mcp-form"
-              disabled={!formDirty || saveBlockedByBox}
-            >
-              {t('common.save')}
-            </Button>
+            {canOperate && (
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() => formRef.current?.testMcp()}
+                disabled={mcpTesting}
+              >
+                {t('common.test')}
+              </Button>
+            )}
+            {canManage && (
+              <Button
+                type="submit"
+                form="mcp-form"
+                disabled={!formDirty || saveBlockedByBox}
+              >
+                {t('common.save')}
+              </Button>
+            )}
           </div>
         </div>
 
         <div className="min-h-0 flex-1">
-          <MCPForm
-            ref={formRef}
-            initServerName={id}
-            layout="split"
-            sideHeader={enableControl}
-            sideFooter={editActions}
-            onFormSubmit={handleFormSubmit}
-            onNewServerCreated={handleNewServerCreated}
-            onDirtyChange={setFormDirty}
-            onTestingChange={setMcpTesting}
-            onSaveBlockedChange={setSaveBlockedByBox}
-            onRuntimeInfoChange={(runtimeInfo) =>
-              setDetailRuntimeStatus(runtimeInfo?.status ?? null)
-            }
-            onPersistedTestComplete={handlePersistedTestComplete}
-          />
+          <fieldset className="contents" disabled={!canManage}>
+            <MCPForm
+              ref={formRef}
+              initServerName={id}
+              layout="split"
+              sideHeader={enableControl}
+              sideFooter={canManage ? editActions : undefined}
+              onFormSubmit={handleFormSubmit}
+              onNewServerCreated={handleNewServerCreated}
+              onDirtyChange={setFormDirty}
+              onTestingChange={setMcpTesting}
+              onSaveBlockedChange={setSaveBlockedByBox}
+              onRuntimeInfoChange={(runtimeInfo) =>
+                setDetailRuntimeStatus(runtimeInfo?.status ?? null)
+              }
+              onPersistedTestComplete={handlePersistedTestComplete}
+            />
+          </fieldset>
         </div>
       </div>
 

web/src/app/home/mcp/components/mcp-form/MCPForm.tsx

@@ -56,6 +56,7 @@ import {
 import { CustomApiError } from '@/app/infra/entities/common';
 import { BoxUnavailableNotice } from '@/app/home/components/BoxUnavailableNotice';
 import { useBoxStatus } from '@/app/infra/hooks/useBoxStatus';
+import { useMCPStdioPolicy } from '@/app/infra/hooks/useMCPStdioPolicy';
 
 function StatusDisplay({
   testing,
@@ -435,6 +436,10 @@ const getFormSchema = (t: TFunction) =>
         .number({ invalid_type_error: t('mcp.timeoutMustBeNumber') })
         .positive({ message: t('mcp.timeoutMustBePositive') })
         .default(30),
+      tool_call_timeout_sec: z
+        .number({ invalid_type_error: t('mcp.timeoutMustBeNumber') })
+        .nonnegative({ message: t('mcp.timeoutNonNegative') })
+        .default(300),
       ssereadtimeout: z
         .number({ invalid_type_error: t('mcp.sseTimeoutMustBeNumber') })
         .positive({ message: t('mcp.timeoutMustBePositive') })
@@ -474,6 +479,7 @@ const getFormSchema = (t: TFunction) =>
 
 type FormValues = z.infer<ReturnType<typeof getFormSchema>> & {
   timeout: number;
+  tool_call_timeout_sec: number;
   ssereadtimeout: number;
 };
 
@@ -535,6 +541,7 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
       command: '',
       args: [],
       timeout: 30,
+      tool_call_timeout_sec: 300,
       ssereadtimeout: 300,
       extra_args: [],
       ...initialDraftRef.current,
@@ -560,11 +567,15 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
     hint: boxHint,
     reason: boxReason,
   } = useBoxStatus();
+  const { enabled: mcpStdioEnabled } = useMCPStdioPolicy();
   // stdio mode requires the Box sandbox at runtime. If the user picks
   // stdio while Box is disabled / unreachable, the server would refuse
   // to start anyway — block creation upfront so they aren't surprised
   // by an immediate "Connection failed" on the detail page.
-  const stdioBlockedByBox = watchMode === 'stdio' && !boxAvailable;
+  const stdioBlockedByPolicy = watchMode === 'stdio' && !mcpStdioEnabled;
+  const stdioBlockedByBox =
+    watchMode === 'stdio' && mcpStdioEnabled && !boxAvailable;
+  const stdioBlocked = stdioBlockedByPolicy || stdioBlockedByBox;
 
   const { isDirty } = form.formState;
   useEffect(() => {
@@ -572,8 +583,8 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
   }, [isDirty, onDirtyChange]);
 
   useEffect(() => {
-    onSaveBlockedChange?.(stdioBlockedByBox);
-  }, [stdioBlockedByBox, onSaveBlockedChange]);
+    onSaveBlockedChange?.(stdioBlocked);
+  }, [stdioBlocked, onSaveBlockedChange]);
 
   useEffect(() => {
     onTestingChange?.(mcpTesting);
@@ -589,10 +600,9 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
       testMcp: () => testMcp(),
       isTesting: mcpTesting,
     }),
-    // testMcp now reads everything via form.getValues(), so it does not need
-    // the latest stdioArgs/extraArgs closure — but keep mcpTesting so the
-    // exposed isTesting flag stays accurate.
-    [mcpTesting],
+    // Form values are read through form.getValues(); policy and runtime health
+    // remain closure values and must refresh the imperative handler.
+    [mcpTesting, mcpStdioEnabled, boxAvailable],
   );
 
   useEffect(() => {
@@ -609,6 +619,7 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
         command: '',
         args: [],
         timeout: 30,
+        tool_call_timeout_sec: 300,
         ssereadtimeout: 300,
         extra_args: [],
         ...initialDraftRef.current,
@@ -687,10 +698,16 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
         command: '',
         args: [],
         timeout: 30,
+        tool_call_timeout_sec: 300,
         ssereadtimeout: 300,
         extra_args: [],
       };
 
+      if (typeof server.extra_args.tool_call_timeout_sec === 'number') {
+        formValues.tool_call_timeout_sec =
+          server.extra_args.tool_call_timeout_sec;
+      }
+
       let newExtraArgs: {
         key: string;
         type: 'string' | 'number' | 'boolean';
@@ -747,6 +764,10 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
   async function handleFormSubmit(value: z.infer<typeof formSchema>) {
     // Belt-and-suspenders: even though the Save button is disabled when
     // stdio is unselectable, intercept programmatic submits too.
+    if (value.mode === 'stdio' && !mcpStdioEnabled) {
+      toast.error(t('mcp.stdioDisabledByPolicy'));
+      return;
+    }
     if (value.mode === 'stdio' && !boxAvailable) {
       toast.error(t('mcp.stdioBlockedByBoxToast'));
       return;
@@ -770,6 +791,7 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
             url: value.url!,
             headers,
             timeout: value.timeout,
+            tool_call_timeout_sec: value.tool_call_timeout_sec,
           },
         };
       } else {
@@ -786,6 +808,7 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
             command: value.command!,
             args: value.args?.map((arg) => arg.value) || [],
             env,
+            tool_call_timeout_sec: value.tool_call_timeout_sec,
           },
         };
       }
@@ -814,6 +837,16 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
 
     try {
       const mode = form.getValues('mode');
+      if (mode === 'stdio' && !mcpStdioEnabled) {
+        toast.error(t('mcp.stdioDisabledByPolicy'));
+        setMcpTesting(false);
+        return;
+      }
+      if (mode === 'stdio' && !boxAvailable) {
+        toast.error(t('mcp.stdioBlockedByBoxToast'));
+        setMcpTesting(false);
+        return;
+      }
       // Read every field via form.getValues() rather than the captured
       // `stdioArgs` / `extraArgs` state. testMcp() is invoked through an
       // imperative handle (formRef.current.testMcp()) whose closure is only
@@ -835,6 +868,7 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
         extraArgsData = {
           url: form.getValues('url')!,
           timeout: form.getValues('timeout'),
+          tool_call_timeout_sec: form.getValues('tool_call_timeout_sec'),
           headers: Object.fromEntries(
             formExtraArgs.map((arg) => [arg.key, arg.value]),
           ),
@@ -846,6 +880,7 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
           env: Object.fromEntries(
             formExtraArgs.map((arg) => [arg.key, arg.value]),
           ),
+          tool_call_timeout_sec: form.getValues('tool_call_timeout_sec'),
         };
       }
 
@@ -1020,13 +1055,20 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
                 </FormControl>
                 <SelectContent>
                   <SelectItem value="remote">{t('mcp.remote')}</SelectItem>
-                  <SelectItem value="stdio" disabled={!boxAvailable}>
+                  <SelectItem
+                    value="stdio"
+                    disabled={!mcpStdioEnabled || !boxAvailable}
+                  >
                     {t('mcp.local')}
-                    {!boxAvailable && (
+                    {!mcpStdioEnabled ? (
+                      <span className="ml-2 text-xs text-muted-foreground">
+                        ({t('mcp.disabledByPolicy')})
+                      </span>
+                    ) : !boxAvailable ? (
                       <span className="ml-2 text-xs text-muted-foreground">
                         ({t('mcp.boxRequired')})
                       </span>
-                    )}
+                    ) : null}
                   </SelectItem>
                 </SelectContent>
               </Select>
@@ -1035,6 +1077,14 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
                   ? t('mcp.localModeDescription')
                   : t('mcp.remoteModeDescription')}
               </FormDescription>
+              {stdioBlockedByPolicy && (
+                <div
+                  role="alert"
+                  className="mt-2 rounded-md border border-amber-500/40 bg-amber-500/10 p-3 text-sm text-amber-800 dark:text-amber-200"
+                >
+                  {t('mcp.stdioDisabledByPolicy')}
+                </div>
+              )}
               {stdioBlockedByBox && (
                 <BoxUnavailableNotice
                   hint={boxHint}
@@ -1047,6 +1097,30 @@ const MCPForm = forwardRef<MCPFormHandle, MCPFormProps>(function MCPForm(
           )}
         />
 
+        <FormField
+          control={form.control}
+          name="tool_call_timeout_sec"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t('mcp.toolCallTimeout')}</FormLabel>
+              <FormControl>
+                <Input
+                  type="number"
+                  min={0}
+                  step={1}
+                  placeholder="300"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+              <FormDescription>
+                {t('mcp.toolCallTimeoutDescription')}
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
         {watchMode === 'remote' && (
           <>
             <FormField

web/src/app/home/monitoring/components/overview-cards/SystemStatusCards.tsx

@@ -67,7 +67,7 @@ export default function SystemStatusCard({
     try {
       const [plugin, box] = await Promise.all([
         httpClient.getPluginSystemStatus().catch(() => null),
-        httpClient.getBoxStatus().catch(() => null),
+        httpClient.getBoxRuntimeStatus().catch(() => null),
       ]);
       const sessions = box?.hidden
         ? []

web/src/app/home/monitoring/page.tsx

@@ -23,9 +23,13 @@ import { FeedbackStatsCards } from './components/FeedbackCard';
 import { FeedbackList } from './components/FeedbackList';
 import { buildConversationTurns } from './utils/conversationTurns';
 import { LoadingSpinner, LoadingPage } from '@/components/ui/loading-spinner';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 function MonitoringPageContent() {
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canExport =
+    currentWorkspace?.permissions.includes('data.export') ?? false;
   const { filterState, setSelectedBots, setSelectedPipelines, setTimeRange } =
     useMonitoringFilters();
   const { data, loading, refetch } = useMonitoringData(filterState);
@@ -154,7 +158,7 @@ function MonitoringPageContent() {
               onTimeRangeChange={setTimeRange}
             />
             <div className="flex items-center gap-2">
-              <ExportDropdown filterState={filterState} />
+              {canExport && <ExportDropdown filterState={filterState} />}
               <Button
                 variant="outline"
                 size="sm"

web/src/app/home/pipelines/PipelineDetailContent.tsx

@@ -8,6 +8,7 @@ import PipelineMonitoringTab from '@/app/home/pipelines/components/monitoring-ta
 import { useSidebarData } from '@/app/home/components/home-sidebar/SidebarDataContext';
 import { useTranslation } from 'react-i18next';
 import { Settings, Bug, BarChart3 } from 'lucide-react';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 export default function PipelineDetailContent({
   id,
@@ -19,6 +20,13 @@ export default function PipelineDetailContent({
   const isCreateMode = id === 'new';
   const navigate = useNavigate();
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManage =
+    currentWorkspace?.permissions.includes('resource.manage') ?? false;
+  const canOperate =
+    currentWorkspace?.permissions.includes('runtime.operate') ?? false;
+  const canViewMonitoring =
+    currentWorkspace?.permissions.includes('resource.view') ?? false;
   const { refreshPipelines, pipelines, setDetailEntityName } = useSidebarData();
 
   // Set breadcrumb entity name
@@ -54,23 +62,27 @@ export default function PipelineDetailContent({
           <h1 className="text-xl font-semibold">
             {t('pipelines.createPipeline')}
           </h1>
-          <Button type="submit" form="pipeline-form" disabled={formSaving}>
-            {t('common.submit')}
-          </Button>
+          {canManage && (
+            <Button type="submit" form="pipeline-form" disabled={formSaving}>
+              {t('common.submit')}
+            </Button>
+          )}
         </div>
 
         <div className="flex-1 overflow-y-auto min-h-0">
           <div className="mx-auto max-w-2xl space-y-6">
-            <PipelineFormComponent
-              pipelineId={undefined}
-              isEditMode={false}
-              disableForm={false}
-              showButtons={false}
-              onFinish={handleFinish}
-              onNewPipelineCreated={handleNewPipelineCreated}
-              onDeletePipeline={() => {}}
-              onSavingChange={setFormSaving}
-            />
+            <fieldset className="contents" disabled={!canManage}>
+              <PipelineFormComponent
+                pipelineId={undefined}
+                isEditMode={false}
+                disableForm={!canManage}
+                showButtons={false}
+                onFinish={handleFinish}
+                onNewPipelineCreated={handleNewPipelineCreated}
+                onDeletePipeline={() => {}}
+                onSavingChange={setFormSaving}
+              />
+            </fieldset>
           </div>
         </div>
       </div>
@@ -88,14 +100,16 @@ export default function PipelineDetailContent({
       {/* Sticky Header: title + save button */}
       <div className="flex items-center justify-between pb-4 shrink-0">
         <h1 className="text-xl font-semibold">{t('pipelines.editPipeline')}</h1>
-        <Button
-          type="submit"
-          form="pipeline-form"
-          disabled={!formDirty || formSaving}
-          className={activeTab !== 'config' ? 'invisible' : ''}
-        >
-          {t('common.save')}
-        </Button>
+        {canManage && (
+          <Button
+            type="submit"
+            form="pipeline-form"
+            disabled={!formDirty || formSaving}
+            className={activeTab !== 'config' ? 'invisible' : ''}
+          >
+            {t('common.save')}
+          </Button>
+        )}
       </div>
 
       {/* Horizontal Tabs */}
@@ -110,21 +124,25 @@ export default function PipelineDetailContent({
             <Settings className="size-3.5" />
             {t('pipelines.configuration')}
           </TabsTrigger>
-          <TabsTrigger value="debug" className="gap-1.5">
-            <Bug className="size-3.5" />
-            {t('pipelines.debugChat')}
-            {activeTab === 'debug' && (
-              <span
-                className={`inline-block size-2 rounded-full ${
-                  isWebSocketConnected ? 'bg-green-500' : 'bg-red-500'
-                }`}
-              />
-            )}
-          </TabsTrigger>
-          <TabsTrigger value="monitoring" className="gap-1.5">
-            <BarChart3 className="size-3.5" />
-            {t('pipelines.monitoring.title')}
-          </TabsTrigger>
+          {canOperate && (
+            <TabsTrigger value="debug" className="gap-1.5">
+              <Bug className="size-3.5" />
+              {t('pipelines.debugChat')}
+              {activeTab === 'debug' && (
+                <span
+                  className={`inline-block size-2 rounded-full ${
+                    isWebSocketConnected ? 'bg-green-500' : 'bg-red-500'
+                  }`}
+                />
+              )}
+            </TabsTrigger>
+          )}
+          {canViewMonitoring && (
+            <TabsTrigger value="monitoring" className="gap-1.5">
+              <BarChart3 className="size-3.5" />
+              {t('pipelines.monitoring.title')}
+            </TabsTrigger>
+          )}
         </TabsList>
 
         {/* Tab: Configuration */}
@@ -132,42 +150,48 @@ export default function PipelineDetailContent({
           value="config"
           className="flex-1 min-h-0 overflow-y-auto mt-4"
         >
-          <PipelineFormComponent
-            pipelineId={id}
-            isEditMode={true}
-            disableForm={false}
-            showButtons={false}
-            onFinish={handleFinish}
-            onNewPipelineCreated={handleNewPipelineCreated}
-            onDeletePipeline={handleDeletePipeline}
-            onCancel={() => navigate(routeBase)}
-            onDirtyChange={setFormDirty}
-            onSavingChange={setFormSaving}
-          />
+          <fieldset className="contents" disabled={!canManage}>
+            <PipelineFormComponent
+              pipelineId={id}
+              isEditMode={true}
+              disableForm={!canManage}
+              showButtons={false}
+              onFinish={handleFinish}
+              onNewPipelineCreated={handleNewPipelineCreated}
+              onDeletePipeline={handleDeletePipeline}
+              onCancel={() => navigate(routeBase)}
+              onDirtyChange={setFormDirty}
+              onSavingChange={setFormSaving}
+            />
+          </fieldset>
         </TabsContent>
 
         {/* Tab: Debug */}
-        <TabsContent value="debug" className="flex-1 min-h-0 mt-4">
-          <DebugDialog
-            open={activeTab === 'debug'}
-            pipelineId={id}
-            isEmbedded={true}
-            onConnectionStatusChange={setIsWebSocketConnected}
-          />
-        </TabsContent>
+        {canOperate && (
+          <TabsContent value="debug" className="flex-1 min-h-0 mt-4">
+            <DebugDialog
+              open={activeTab === 'debug'}
+              pipelineId={id}
+              isEmbedded={true}
+              onConnectionStatusChange={setIsWebSocketConnected}
+            />
+          </TabsContent>
+        )}
 
         {/* Tab: Monitoring */}
-        <TabsContent
-          value="monitoring"
-          className="flex-1 min-h-0 overflow-y-auto mt-4"
-        >
-          <PipelineMonitoringTab
-            pipelineId={id}
-            onNavigateToMonitoring={() => {
-              navigate('/home/monitoring');
-            }}
-          />
-        </TabsContent>
+        {canViewMonitoring && (
+          <TabsContent
+            value="monitoring"
+            className="flex-1 min-h-0 overflow-y-auto mt-4"
+          >
+            <PipelineMonitoringTab
+              pipelineId={id}
+              onNavigateToMonitoring={() => {
+                navigate('/home/monitoring');
+              }}
+            />
+          </TabsContent>
+        )}
       </Tabs>
     </div>
   );

web/src/app/home/plugins/components/plugin-market/PluginMarketComponent.tsx

@@ -152,7 +152,7 @@ function MarketPageContent({
   // Per-format extension counts shown next to the type filter options.
   const [typeCounts, setTypeCounts] = useState<Record<string, number>>({});
   const [sortOption, setSortOption] = useState<string>(
-    () => loadMarketFilters().sortOption ?? 'install_count_desc',
+    () => loadMarketFilters().sortOption ?? 'hot_score_desc',
   );
 
   // Persist filter conditions so they survive navigation / reload.
@@ -179,6 +179,12 @@ function MarketPageContent({
 
   // 排序选项
   const sortOptions: SortOption[] = [
+    {
+      value: 'hot_score_desc',
+      label: t('market.sort.hottest'),
+      sortBy: 'hot_score',
+      sortOrder: 'DESC',
+    },
     {
       value: 'created_at_desc',
       label: t('market.sort.recentlyAdded'),
@@ -241,7 +247,7 @@ function MarketPageContent({
     const option = sortOptions.find((opt) => opt.value === sortOption);
     return option
       ? { sortBy: option.sortBy, sortOrder: option.sortOrder }
-      : { sortBy: 'install_count', sortOrder: 'DESC' };
+      : { sortBy: 'hot_score', sortOrder: 'DESC' };
   }, [sortOption]);
 
   // 将API响应转换为VO对象
@@ -263,6 +269,7 @@ function MarketPageContent({
         description:
           extractI18nObject(plugin.description) || t('market.noDescription'),
         installCount: plugin.install_count || 0,
+        likeCount: plugin.like_count || 0,
         iconURL,
         githubURL: plugin.repository,
         version: plugin.latest_version,

web/src/app/home/plugins/components/plugin-market/RecommendationLists.tsx

@@ -40,6 +40,7 @@ function pluginToVO(
     description:
       extractI18nObject(plugin.description) || t('market.noDescription'),
     installCount: plugin.install_count,
+    likeCount: plugin.like_count || 0,
     iconURL,
     githubURL: plugin.repository,
     version: plugin.latest_version,

web/src/app/home/plugins/components/plugin-market/marketplace-likes.ts

@@ -0,0 +1,118 @@
+import FingerprintJS, { type LoadOptions } from '@fingerprintjs/fingerprintjs';
+import { getCloudServiceClient } from '@/app/infra/http';
+
+const MARKETPLACE_LIKE_CHANGED_EVENT = 'langbot-marketplace-like-changed';
+
+export interface MarketplaceLikeChange {
+  key: string;
+  liked: boolean;
+  likeCount: number;
+}
+
+let fingerprintPromise: Promise<string> | undefined;
+let likedKeysPromise: Promise<Set<string>> | undefined;
+
+export function marketplaceExtensionKey(
+  type: string | undefined,
+  author: string,
+  name: string,
+): string {
+  return `${type || 'plugin'}:${author}/${name}`;
+}
+
+export function getMarketplaceFingerprint(): Promise<string> {
+  if (!fingerprintPromise) {
+    fingerprintPromise = FingerprintJS.load({
+      monitoring: false,
+    } as LoadOptions & { monitoring: boolean })
+      .then((agent) => agent.get())
+      .then((result) => result.visitorId)
+      .catch((error) => {
+        fingerprintPromise = undefined;
+        throw error;
+      });
+  }
+  return fingerprintPromise;
+}
+
+async function loadLikedKeys(): Promise<Set<string>> {
+  if (!likedKeysPromise) {
+    likedKeysPromise = Promise.all([
+      getMarketplaceFingerprint(),
+      getCloudServiceClient(),
+    ])
+      .then(([fingerprint, client]) =>
+        client.getMarketplaceLikedExtensions(fingerprint),
+      )
+      .then((data) => {
+        const keys = new Set<string>();
+        for (const ref of data.extensions || []) {
+          keys.add(`${ref.type}:${ref.extension_id}`);
+        }
+        return keys;
+      })
+      .catch((error) => {
+        likedKeysPromise = undefined;
+        throw error;
+      });
+  }
+  return likedKeysPromise;
+}
+
+export async function getMarketplaceExtensionLiked(
+  type: string | undefined,
+  author: string,
+  name: string,
+): Promise<boolean> {
+  const likedKeys = await loadLikedKeys();
+  return likedKeys.has(marketplaceExtensionKey(type, author, name));
+}
+
+export async function toggleMarketplaceExtensionLike(
+  type: string | undefined,
+  author: string,
+  name: string,
+  liked: boolean,
+): Promise<MarketplaceLikeChange> {
+  const extensionType = type || 'plugin';
+  const [fingerprint, likedKeys, client] = await Promise.all([
+    getMarketplaceFingerprint(),
+    loadLikedKeys(),
+    getCloudServiceClient(),
+  ]);
+  const result = await client.setMarketplaceExtensionLike(
+    extensionType,
+    author,
+    name,
+    fingerprint,
+    liked,
+  );
+  const key = marketplaceExtensionKey(extensionType, author, name);
+  if (result.liked) {
+    likedKeys.add(key);
+  } else {
+    likedKeys.delete(key);
+  }
+  const change: MarketplaceLikeChange = {
+    key,
+    liked: result.liked,
+    likeCount: result.like_count,
+  };
+  window.dispatchEvent(
+    new CustomEvent<MarketplaceLikeChange>(MARKETPLACE_LIKE_CHANGED_EVENT, {
+      detail: change,
+    }),
+  );
+  return change;
+}
+
+export function subscribeMarketplaceLikeChanges(
+  listener: (change: MarketplaceLikeChange) => void,
+): () => void {
+  const handler = (event: Event) => {
+    listener((event as CustomEvent<MarketplaceLikeChange>).detail);
+  };
+  window.addEventListener(MARKETPLACE_LIKE_CHANGED_EVENT, handler);
+  return () =>
+    window.removeEventListener(MARKETPLACE_LIKE_CHANGED_EVENT, handler);
+}

web/src/app/home/plugins/components/plugin-market/plugin-market-card/PluginMarketCardComponent.tsx

@@ -3,7 +3,7 @@ import { useRef, useState, useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 import PluginComponentList from '../PluginComponentList';
 import { Badge } from '@/components/ui/badge';
-import { Info, Package, ExternalLink } from 'lucide-react';
+import { Info, Package, ExternalLink, Heart, Loader2 } from 'lucide-react';
 import {
   Tooltip,
   TooltipContent,
@@ -11,6 +11,13 @@ import {
   TooltipTrigger,
 } from '@/components/ui/tooltip';
 import { Button } from '@/components/ui/button';
+import { toast } from 'sonner';
+import {
+  getMarketplaceExtensionLiked,
+  marketplaceExtensionKey,
+  subscribeMarketplaceLikeChanges,
+  toggleMarketplaceExtensionLike,
+} from '../marketplace-likes';
 
 export default function PluginMarketCardComponent({
   cardVO,
@@ -25,6 +32,9 @@ export default function PluginMarketCardComponent({
   const bottomRef = useRef<HTMLDivElement>(null);
   const [visibleTags, setVisibleTags] = useState(2);
   const [iconFailed, setIconFailed] = useState(!cardVO.iconURL);
+  const [liked, setLiked] = useState(false);
+  const [likeCount, setLikeCount] = useState(cardVO.likeCount);
+  const [isLiking, setIsLiking] = useState(false);
 
   const pluginDetailUrl = `https://space.langbot.app/market/${cardVO.author}/${cardVO.pluginName}`;
 
@@ -52,6 +62,37 @@ export default function PluginMarketCardComponent({
     setIconFailed(!cardVO.iconURL);
   }, [cardVO.iconURL]);
 
+  useEffect(() => {
+    setLikeCount(cardVO.likeCount);
+  }, [cardVO.likeCount]);
+
+  useEffect(() => {
+    let cancelled = false;
+    getMarketplaceExtensionLiked(cardVO.type, cardVO.author, cardVO.pluginName)
+      .then((value) => {
+        if (!cancelled) setLiked(value);
+      })
+      .catch(() => {
+        // The count still renders if the viewer-state request is unavailable.
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [cardVO.author, cardVO.pluginName, cardVO.type]);
+
+  useEffect(() => {
+    const key = marketplaceExtensionKey(
+      cardVO.type,
+      cardVO.author,
+      cardVO.pluginName,
+    );
+    return subscribeMarketplaceLikeChanges((change) => {
+      if (change.key !== key) return;
+      setLiked(change.liked);
+      setLikeCount(change.likeCount);
+    });
+  }, [cardVO.author, cardVO.pluginName, cardVO.type]);
+
   useEffect(() => {
     const tags = cardVO.tags;
     if (!bottomRef.current || !tags || tags.length === 0) return;
@@ -89,6 +130,29 @@ export default function PluginMarketCardComponent({
     onInstall?.(cardVO);
   };
 
+  const handleLikeClick = async (
+    event: React.MouseEvent<HTMLButtonElement>,
+  ) => {
+    event.preventDefault();
+    event.stopPropagation();
+    if (isLiking) return;
+    setIsLiking(true);
+    try {
+      const change = await toggleMarketplaceExtensionLike(
+        cardVO.type,
+        cardVO.author,
+        cardVO.pluginName,
+        !liked,
+      );
+      setLiked(change.liked);
+      setLikeCount(change.likeCount);
+    } catch {
+      toast.error(t('market.likeFailed'));
+    } finally {
+      setIsLiking(false);
+    }
+  };
+
   return (
     <div
       role="button"
@@ -97,7 +161,10 @@ export default function PluginMarketCardComponent({
       className="w-[100%] h-[10rem] cursor-pointer bg-white rounded-[10px] border border-border shadow-[0px_1px_2px_0_rgba(0,0,0,0.06)] p-3 sm:p-[1rem] hover:shadow-[0px_2px_5px_0_rgba(0,0,0,0.08)] transition-shadow duration-200 outline-none focus-visible:ring-[3px] focus-visible:ring-ring/50 dark:bg-[#1f1f22] dark:shadow-[0px_1px_2px_0_rgba(255,255,255,0.04)] dark:hover:shadow-[0px_2px_5px_0_rgba(255,255,255,0.07)] relative"
       onClick={handleInstallClick}
       onKeyDown={(event) => {
-        if (event.key === 'Enter' || event.key === ' ') {
+        if (
+          event.target === event.currentTarget &&
+          (event.key === 'Enter' || event.key === ' ')
+        ) {
           event.preventDefault();
           handleInstallClick();
         }
@@ -177,6 +244,26 @@ export default function PluginMarketCardComponent({
           </div>
 
           <div className="flex flex-row items-start justify-center gap-1 flex-shrink-0">
+            <Button
+              type="button"
+              variant="ghost"
+              size="sm"
+              title={t(liked ? 'market.unlike' : 'market.like')}
+              aria-label={t(liked ? 'market.unlike' : 'market.like')}
+              aria-pressed={liked}
+              disabled={isLiking}
+              className="h-7 min-w-7 gap-1 rounded-md px-1.5 text-muted-foreground hover:bg-red-50 hover:text-red-500 dark:hover:bg-red-950/30"
+              onClick={handleLikeClick}
+            >
+              {isLiking ? (
+                <Loader2 className="h-3.5 w-3.5 animate-spin" />
+              ) : (
+                <Heart
+                  className={`h-3.5 w-3.5 ${liked ? 'fill-red-500 text-red-500' : ''}`}
+                />
+              )}
+              <span className="text-xs tabular-nums">{likeCount}</span>
+            </Button>
             <Button
               type="button"
               variant="ghost"

web/src/app/home/plugins/components/plugin-market/plugin-market-card/PluginMarketCardVO.ts

@@ -5,6 +5,7 @@ export interface IPluginMarketCardVO {
   label: string;
   description: string;
   installCount: number;
+  likeCount?: number;
   iconURL: string;
   githubURL: string;
   version: string;
@@ -22,6 +23,7 @@ export class PluginMarketCardVO implements IPluginMarketCardVO {
   iconURL: string;
   githubURL: string;
   installCount: number;
+  likeCount: number;
   version: string;
   components?: Record<string, number>;
   tags?: string[];
@@ -35,6 +37,7 @@ export class PluginMarketCardVO implements IPluginMarketCardVO {
     this.iconURL = prop.iconURL;
     this.githubURL = prop.githubURL;
     this.installCount = prop.installCount;
+    this.likeCount = prop.likeCount ?? 0;
     this.pluginId = prop.pluginId;
     this.version = prop.version;
     this.components = prop.components;

web/src/app/home/skills/SkillDetailContent.tsx

@@ -24,11 +24,15 @@ import SkillForm from '@/app/home/skills/components/skill-form/SkillForm';
 import { BoxUnavailableNotice } from '@/app/home/components/BoxUnavailableNotice';
 import { useBoxStatus } from '@/app/infra/hooks/useBoxStatus';
 import { Sparkles, Trash2 } from 'lucide-react';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 export default function SkillDetailContent({ id }: { id: string }) {
   const isCreateMode = id === 'new';
   const navigate = useNavigate();
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManage =
+    currentWorkspace?.permissions.includes('resource.manage') ?? false;
   const { refreshSkills, skills, setDetailEntityName } = useSidebarData();
   const [showDeleteConfirm, setShowDeleteConfirm] = useState(false);
   const skill = skills.find((item) => item.id === id);
@@ -88,14 +92,16 @@ export default function SkillDetailContent({ id }: { id: string }) {
               </Badge>
             </div>
           </div>
-          <Button
-            type="submit"
-            form="skill-form"
-            className="shrink-0"
-            disabled={!boxAvailable}
-          >
-            {t('common.save')}
-          </Button>
+          {canManage && (
+            <Button
+              type="submit"
+              form="skill-form"
+              className="shrink-0"
+              disabled={!boxAvailable}
+            >
+              {t('common.save')}
+            </Button>
+          )}
         </div>
 
         {!boxAvailable && (
@@ -105,13 +111,17 @@ export default function SkillDetailContent({ id }: { id: string }) {
         )}
 
         <div className="min-h-0 flex-1">
-          <SkillForm
-            key="new-skill"
-            initSkillName={undefined}
-            layout="split"
-            onNewSkillCreated={(skillName) => handleImportedSkills([skillName])}
-            onSkillUpdated={() => {}}
-          />
+          <fieldset className="contents" disabled={!canManage}>
+            <SkillForm
+              key="new-skill"
+              initSkillName={undefined}
+              layout="split"
+              onNewSkillCreated={(skillName) =>
+                handleImportedSkills([skillName])
+              }
+              onSkillUpdated={() => {}}
+            />
+          </fieldset>
         </div>
       </div>
     );
@@ -133,16 +143,18 @@ export default function SkillDetailContent({ id }: { id: string }) {
               {t('skills.deleteConfirmation')}
             </p>
           </div>
-          <Button
-            variant="destructive"
-            type="button"
-            size="sm"
-            onClick={() => setShowDeleteConfirm(true)}
-            className="shrink-0"
-          >
-            <Trash2 className="mr-1.5 size-4" />
-            {t('common.delete')}
-          </Button>
+          {canManage && (
+            <Button
+              variant="destructive"
+              type="button"
+              size="sm"
+              onClick={() => setShowDeleteConfirm(true)}
+              className="shrink-0"
+            >
+              <Trash2 className="mr-1.5 size-4" />
+              {t('common.delete')}
+            </Button>
+          )}
         </div>
       </CardContent>
     </Card>
@@ -185,14 +197,18 @@ export default function SkillDetailContent({ id }: { id: string }) {
         )}
 
         <div className="min-h-0 flex-1">
-          <SkillForm
-            key={id}
-            initSkillName={id}
-            layout="split"
-            sideFooter={editActions}
-            onNewSkillCreated={(skillName) => handleImportedSkills([skillName])}
-            onSkillUpdated={handleSkillUpdated}
-          />
+          <fieldset className="contents" disabled={!canManage}>
+            <SkillForm
+              key={id}
+              initSkillName={id}
+              layout="split"
+              sideFooter={canManage ? editActions : undefined}
+              onNewSkillCreated={(skillName) =>
+                handleImportedSkills([skillName])
+              }
+              onSkillUpdated={handleSkillUpdated}
+            />
+          </fieldset>
         </div>
       </div>
 

web/src/app/home/skills/page.tsx

@@ -7,9 +7,13 @@ import SkillForm from '@/app/home/skills/components/skill-form/SkillForm';
 import { useSidebarData } from '@/app/home/components/home-sidebar/SidebarDataContext';
 import { BoxUnavailableNotice } from '@/app/home/components/BoxUnavailableNotice';
 import { useBoxStatus } from '@/app/infra/hooks/useBoxStatus';
+import { useCurrentWorkspace } from '@/app/infra/http';
 
 export default function SkillsPage() {
   const { t } = useTranslation();
+  const currentWorkspace = useCurrentWorkspace();
+  const canManage =
+    currentWorkspace?.permissions.includes('resource.manage') ?? false;
   const navigate = useNavigate();
   const [searchParams] = useSearchParams();
   const detailId = searchParams.get('id');
@@ -61,7 +65,11 @@ export default function SkillsPage() {
           <Button variant="outline" onClick={handleCancel}>
             {t('common.cancel')}
           </Button>
-          <Button type="submit" form="skill-form" disabled={!boxAvailable}>
+          <Button
+            type="submit"
+            form="skill-form"
+            disabled={!boxAvailable || !canManage}
+          >
             {t('common.save')}
           </Button>
         </div>
@@ -72,13 +80,15 @@ export default function SkillsPage() {
         </div>
       )}
       <div className="min-h-0 flex-1">
-        <SkillForm
-          key="new-skill"
-          initSkillName={undefined}
-          layout="split"
-          onNewSkillCreated={handleCreatedSkill}
-          onSkillUpdated={() => {}}
-        />
+        <fieldset className="contents" disabled={!canManage}>
+          <SkillForm
+            key="new-skill"
+            initSkillName={undefined}
+            layout="split"
+            onNewSkillCreated={handleCreatedSkill}
+            onSkillUpdated={() => {}}
+          />
+        </fieldset>
       </div>
     </div>
   );

web/src/app/infra/entities/api/index.ts

@@ -452,10 +452,16 @@ export interface ApiRespSystemInfo {
   debug: boolean;
   version: string;
   edition: string;
+  /** Independent instance-level gate for local stdio MCP transports. */
+  mcp_stdio_enabled: boolean;
   cloud_service_url: string;
   enable_marketplace: boolean;
   allow_modify_login_info: boolean;
   disable_models_service: boolean;
+  invitation_delivery?: {
+    enabled: boolean;
+    provider: 'resend' | 'smtp' | null;
+  };
   limitation: SystemLimitation;
   /** Public outbound IPs of the deployment (``system.outbound_ips`` in
    *  config.yaml). Shown on adapter config forms whose platform requires
@@ -625,18 +631,21 @@ export interface MCPServerExtraArgsSSE {
   headers: Record<string, string>;
   timeout: number;
   ssereadtimeout: number;
+  tool_call_timeout_sec?: number;
 }
 
 export interface MCPServerExtraArgsStdio {
   command: string;
   args: string[];
   env: Record<string, string>;
+  tool_call_timeout_sec?: number;
 }
 
 export interface MCPServerExtraArgsHttp {
   url: string;
   headers: Record<string, string>;
   timeout: number;
+  tool_call_timeout_sec?: number;
 }
 
 // "remote" mode: the user only supplies a URL; the backend auto-detects the
@@ -646,6 +655,7 @@ export interface MCPServerExtraArgsRemote {
   url: string;
   headers?: Record<string, string>;
   timeout?: number;
+  tool_call_timeout_sec?: number;
 }
 
 export enum MCPSessionStatus {

web/src/app/infra/entities/plugin/index.ts

@@ -48,6 +48,8 @@ export interface PluginV4 {
   repository: string;
   tags: string[];
   install_count: number;
+  like_count?: number;
+  hot_score?: number;
   latest_version: string;
   components: Record<string, number>;
   status: PluginV4Status;

web/src/app/infra/entities/workspace.ts

@@ -0,0 +1,66 @@
+export type WorkspaceRole =
+  | 'owner'
+  | 'admin'
+  | 'developer'
+  | 'operator'
+  | 'viewer';
+
+export interface Workspace {
+  uuid: string;
+  instance_uuid: string;
+  name: string;
+  slug: string;
+  type: 'personal' | 'team';
+  status: 'provisioning' | 'active' | 'suspended' | 'archived' | 'deleted';
+  source: 'local' | 'cloud_projection';
+}
+
+export interface WorkspaceMembership {
+  uuid: string;
+  workspace_uuid: string;
+  account_uuid: string;
+  email: string;
+  role: WorkspaceRole;
+  status: 'active' | 'disabled' | 'removed';
+  joined_at: string | null;
+  created_at: string;
+}
+
+export interface CurrentWorkspace {
+  workspace: Workspace;
+  membership: WorkspaceMembership;
+  permissions: string[];
+  placement_generation: number;
+  /** Signed Cloud display metadata; never used for client-side authorization. */
+  plan_name?: string | null;
+}
+
+export interface WorkspaceSpaceBilling {
+  credits: number | null;
+  owner_space_bound: boolean;
+  is_workspace_owner: boolean;
+}
+
+/** Account-scoped Workspace entry returned before a Workspace is selected. */
+export type WorkspaceBootstrapEntry = CurrentWorkspace;
+
+export interface WorkspaceBootstrapResponse {
+  workspaces: WorkspaceBootstrapEntry[];
+}
+
+export interface WorkspaceInvitation {
+  uuid: string;
+  workspace_uuid: string;
+  normalized_email: string;
+  role: Exclude<WorkspaceRole, 'owner'>;
+  status: 'pending' | 'accepted' | 'revoked' | 'expired';
+  expires_at: string;
+  created_at: string;
+}
+
+export type WorkspaceInvitationDeliveryStatus = 'sent' | 'link_only' | 'failed';
+
+export interface WorkspaceInvitationDelivery {
+  status: WorkspaceInvitationDeliveryStatus;
+  provider: 'resend' | 'smtp' | null;
+}

web/src/app/infra/hooks/useMCPStdioPolicy.ts

@@ -0,0 +1,32 @@
+import { useCallback, useEffect, useState } from 'react';
+
+import { httpClient } from '@/app/infra/http/HttpClient';
+
+/**
+ * Load the instance-level stdio MCP gate independently of Box health.
+ *
+ * The hook fails closed while loading or when System Info is unavailable.
+ * This is only a WebUI guard; the backend loader enforces the same gate at
+ * the final transport boundary.
+ */
+export function useMCPStdioPolicy() {
+  const [enabled, setEnabled] = useState(false);
+  const [loading, setLoading] = useState(true);
+
+  const refresh = useCallback(async () => {
+    try {
+      const info = await httpClient.getSystemInfo();
+      setEnabled(info.mcp_stdio_enabled === true);
+    } catch {
+      setEnabled(false);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  return { enabled, loading, refresh };
+}

web/src/app/infra/http/BackendClient.ts

@@ -1,4 +1,4 @@
-import { BaseHttpClient } from './BaseHttpClient';
+import { BaseHttpClient, type RequestConfig } from './BaseHttpClient';
 import {
   ApiRespProviderRequesters,
   ApiRespProviderRequester,
@@ -70,6 +70,16 @@ import type { PluginLogEntry } from '@/app/infra/entities/plugin';
 import type { I18nObject } from '@/app/infra/entities/common';
 import { GetBotLogsRequest } from '@/app/infra/http/requestParam/bots/GetBotLogsRequest';
 import { GetBotLogsResponse } from '@/app/infra/http/requestParam/bots/GetBotLogsResponse';
+import type {
+  CurrentWorkspace,
+  Workspace,
+  WorkspaceInvitation,
+  WorkspaceInvitationDelivery,
+  WorkspaceMembership,
+  WorkspaceBootstrapResponse,
+  WorkspaceRole,
+  WorkspaceSpaceBilling,
+} from '@/app/infra/entities/workspace';
 
 /**
  * 后端服务客户端
@@ -799,13 +809,15 @@ export class BackendClient extends BaseHttpClient {
   }
 
   public installPluginFromGithub(
-    assetUrl: string,
+    assetId: number,
+    releaseId: number,
     owner: string,
     repo: string,
     releaseTag: string,
   ): Promise<AsyncTaskCreatedResp> {
     return this.post('/api/v1/plugins/install/github', {
-      asset_url: assetUrl,
+      asset_id: assetId,
+      release_id: releaseId,
       owner,
       repo,
       release_tag: releaseTag,
@@ -1130,6 +1142,10 @@ export class BackendClient extends BaseHttpClient {
     return this.get('/api/v1/plugins/debug-info');
   }
 
+  public getBoxRuntimeStatus(): Promise<ApiRespBoxStatus> {
+    return this.get('/api/v1/box/runtime-status');
+  }
+
   public getBoxStatus(): Promise<ApiRespBoxStatus> {
     return this.get('/api/v1/box/status');
   }
@@ -1140,19 +1156,29 @@ export class BackendClient extends BaseHttpClient {
 
   // ============ User API ============
   public checkIfInited(): Promise<{ initialized: boolean }> {
-    return this.get('/api/v1/user/init');
+    return this.get('/api/v1/user/init', undefined, { skipWorkspace: true });
   }
 
   public initUser(user: string, password: string): Promise<object> {
-    return this.post('/api/v1/user/init', { user, password });
+    return this.post(
+      '/api/v1/user/init',
+      { user, password },
+      { skipWorkspace: true },
+    );
   }
 
   public authUser(user: string, password: string): Promise<ApiRespUserToken> {
-    return this.post('/api/v1/user/auth', { user, password });
+    return this.post(
+      '/api/v1/user/auth',
+      { user, password },
+      { skipWorkspace: true },
+    );
   }
 
   public checkUserToken(): Promise<ApiRespUserToken> {
-    return this.get('/api/v1/user/check-token');
+    return this.get('/api/v1/user/check-token', undefined, {
+      skipWorkspace: true,
+    });
   }
 
   public resetPassword(
@@ -1160,51 +1186,168 @@ export class BackendClient extends BaseHttpClient {
     recoveryKey: string,
     newPassword: string,
   ): Promise<{ user: string }> {
-    return this.post('/api/v1/user/reset-password', {
-      user,
-      recovery_key: recoveryKey,
-      new_password: newPassword,
-    });
+    return this.post(
+      '/api/v1/user/reset-password',
+      {
+        user,
+        recovery_key: recoveryKey,
+        new_password: newPassword,
+      },
+      { skipWorkspace: true },
+    );
   }
 
   public changePassword(
     currentPassword: string,
     newPassword: string,
   ): Promise<{ user: string }> {
-    return this.post('/api/v1/user/change-password', {
-      current_password: currentPassword,
-      new_password: newPassword,
-    });
+    return this.post(
+      '/api/v1/user/change-password',
+      {
+        current_password: currentPassword,
+        new_password: newPassword,
+      },
+      { skipWorkspace: true },
+    );
   }
 
   public getUserInfo(): Promise<{
+    account_uuid: string;
     user: string;
     account_type: 'local' | 'space';
     has_password: boolean;
   }> {
-    return this.get('/api/v1/user/info');
+    return this.get('/api/v1/user/info', undefined, { skipWorkspace: true });
   }
 
-  public getSpaceCredits(): Promise<{ credits: number | null }> {
+  public getWorkspaceSpaceBilling(): Promise<WorkspaceSpaceBilling> {
     return this.get('/api/v1/user/space-credits');
   }
 
   public getAccountInfo(): Promise<{
     initialized: boolean;
-    account_type?: 'local' | 'space';
-    has_password?: boolean;
+    password_login_enabled?: boolean;
+    space_login_enabled?: boolean;
   }> {
-    return this.get('/api/v1/user/account-info');
+    return this.get('/api/v1/user/account-info', undefined, {
+      skipWorkspace: true,
+    });
+  }
+
+  // ============ Workspace API ============
+  public getWorkspaceBootstrap(): Promise<WorkspaceBootstrapResponse> {
+    return this.get('/api/v1/workspaces/bootstrap', undefined, {
+      skipWorkspace: true,
+    });
+  }
+
+  public getWorkspaces(): Promise<{ workspaces: Workspace[] }> {
+    return this.get('/api/v1/workspaces', undefined, { skipWorkspace: true });
+  }
+
+  public getCurrentWorkspace(): Promise<CurrentWorkspace> {
+    return this.get('/api/v1/workspaces/current');
+  }
+
+  public getWorkspace(
+    workspaceUuid: string,
+  ): Promise<{ workspace: Workspace }> {
+    return this.get(`/api/v1/workspaces/${workspaceUuid}`);
+  }
+
+  public getWorkspaceMembers(
+    workspaceUuid: string,
+  ): Promise<{ members: WorkspaceMembership[] }> {
+    return this.get(`/api/v1/workspaces/${workspaceUuid}/members`);
+  }
+
+  public createWorkspaceInvitation(
+    workspaceUuid: string,
+    email: string,
+    role: Exclude<WorkspaceRole, 'owner'>,
+  ): Promise<{
+    invitation: WorkspaceInvitation;
+    token: string;
+    link: string;
+    delivery: WorkspaceInvitationDelivery;
+  }> {
+    return this.post(`/api/v1/workspaces/${workspaceUuid}/invitations`, {
+      email,
+      role,
+    });
+  }
+
+  public getWorkspaceInvitations(
+    workspaceUuid: string,
+  ): Promise<{ invitations: WorkspaceInvitation[] }> {
+    return this.get(`/api/v1/workspaces/${workspaceUuid}/invitations`);
+  }
+
+  public revokeWorkspaceInvitation(
+    workspaceUuid: string,
+    invitationUuid: string,
+  ): Promise<object> {
+    return this.delete(
+      `/api/v1/workspaces/${workspaceUuid}/invitations/${invitationUuid}`,
+    );
+  }
+
+  public inspectWorkspaceInvitation(
+    token: string,
+  ): Promise<{ invitation: WorkspaceInvitation; workspace: Workspace }> {
+    return this.post(
+      '/api/v1/invitations/inspect',
+      { token },
+      { skipWorkspace: true },
+    );
+  }
+
+  public acceptWorkspaceInvitation(
+    token: string,
+    registration?: { email: string; password: string },
+  ): Promise<{ token: string; workspace_uuid: string }> {
+    return this.post(
+      '/api/v1/invitations/accept',
+      {
+        token,
+        registration,
+      },
+      { skipWorkspace: true },
+    );
+  }
+
+  public updateWorkspaceMemberRole(
+    workspaceUuid: string,
+    accountUuid: string,
+    role: WorkspaceRole,
+  ): Promise<{ member: WorkspaceMembership }> {
+    return this.patch(
+      `/api/v1/workspaces/${workspaceUuid}/members/${accountUuid}`,
+      { role },
+    );
+  }
+
+  public removeWorkspaceMember(
+    workspaceUuid: string,
+    accountUuid: string,
+  ): Promise<object> {
+    return this.delete(
+      `/api/v1/workspaces/${workspaceUuid}/members/${accountUuid}`,
+    );
   }
 
   public setPassword(
     newPassword: string,
     currentPassword?: string,
   ): Promise<{ user: string }> {
-    return this.post('/api/v1/user/set-password', {
-      new_password: newPassword,
-      current_password: currentPassword,
-    });
+    return this.post(
+      '/api/v1/user/set-password',
+      {
+        new_password: newPassword,
+        current_password: currentPassword,
+      },
+      { skipWorkspace: true },
+    );
   }
 
   public async bindSpaceAccount(
@@ -1215,10 +1358,11 @@ export class BackendClient extends BaseHttpClient {
     user: string;
     account_type: 'local' | 'space';
   }> {
-    const response = await this.instance.post('/api/v1/user/bind-space', {
-      code,
-      state,
-    });
+    const response = await this.instance.post(
+      '/api/v1/user/bind-space',
+      { code, state },
+      { skipWorkspace: true } as RequestConfig,
+    );
     if (response.data.code !== 0) {
       throw {
         code: response.data.code,
@@ -1229,26 +1373,46 @@ export class BackendClient extends BaseHttpClient {
   }
 
   // ============ Space OAuth API (Redirect Flow) ============
-  public getSpaceAuthorizeUrl(
-    redirectUri: string,
-    state?: string,
-  ): Promise<{
+  public getSpaceAuthorizeUrl(redirectUri: string): Promise<{
     authorize_url: string;
   }> {
-    const params: Record<string, string> = { redirect_uri: redirectUri };
-    if (state) {
-      params.state = state;
-    }
-    return this.get('/api/v1/user/space/authorize-url', params);
+    return this.get(
+      '/api/v1/user/space/authorize-url',
+      { redirect_uri: redirectUri },
+      { skipWorkspace: true },
+    );
   }
 
-  public async exchangeSpaceOAuthCode(code: string): Promise<{
+  public getSpaceBindAuthorizeUrl(redirectUri: string): Promise<{
+    authorize_url: string;
+  }> {
+    return this.get(
+      '/api/v1/user/space/bind-authorize-url',
+      { redirect_uri: redirectUri },
+      { skipWorkspace: true },
+    );
+  }
+
+  public async exchangeSpaceOAuthCode(
+    code: string,
+    state: string,
+    workspaceUuid?: string,
+    launchAssertion?: string,
+  ): Promise<{
     token: string;
     user: string;
+    workspace_uuid?: string;
   }> {
-    const response = await this.instance.post('/api/v1/user/space/callback', {
-      code,
-    });
+    const response = await this.instance.post(
+      '/api/v1/user/space/callback',
+      {
+        code,
+        state,
+        workspace_uuid: workspaceUuid,
+        launch_assertion: launchAssertion,
+      },
+      { skipWorkspace: true } as RequestConfig,
+    );
     if (response.data.code !== 0) {
       throw {
         code: response.data.code,

web/src/app/infra/http/BaseHttpClient.ts

@@ -4,6 +4,12 @@ import axios, {
   AxiosResponse,
   AxiosError,
 } from 'axios';
+import {
+  clearActiveWorkspaceUuid,
+  getActiveWorkspaceUuid,
+} from './workspaceContext';
+import { setCurrentWorkspaceSnapshot } from './currentWorkspaceStore';
+import { clearWorkspaceBootstrapSnapshot } from './workspaceBootstrapStore';
 
 type JSONValue = string | number | boolean | JSONObject | JSONArray | null;
 interface JSONObject {
@@ -21,6 +27,8 @@ export interface ResponseData<T = unknown> {
 export interface RequestConfig extends AxiosRequestConfig {
   isSSR?: boolean; // 服务端渲染标识
   retry?: number; // 重试次数
+  /** Account-scoped endpoints must not receive a stale Workspace selector. */
+  skipWorkspace?: boolean;
 }
 
 /**
@@ -77,6 +85,17 @@ export abstract class BaseHttpClient {
           if (session) {
             config.headers.Authorization = `Bearer ${session}`;
           }
+
+          const requestConfig = config as RequestConfig;
+          const workspaceUuid = getActiveWorkspaceUuid();
+          if (requestConfig.skipWorkspace) {
+            delete config.headers['X-Workspace-Id'];
+            delete config.headers['x-workspace-id'];
+          } else if (workspaceUuid) {
+            config.headers['X-Workspace-Id'] = workspaceUuid;
+          }
+
+          delete requestConfig.skipWorkspace;
         }
 
         return config;
@@ -99,6 +118,10 @@ export abstract class BaseHttpClient {
             case 401:
               if (typeof window !== 'undefined') {
                 localStorage.removeItem('token');
+                localStorage.removeItem('userEmail');
+                clearActiveWorkspaceUuid();
+                setCurrentWorkspaceSnapshot(null);
+                clearWorkspaceBootstrapSnapshot();
                 if (!error.request.responseURL.includes('/check-token')) {
                   window.location.href = '/login';
                 }
@@ -187,6 +210,14 @@ export abstract class BaseHttpClient {
     return this.request<T>({ method: 'put', url, data, ...config });
   }
 
+  public patch<T = unknown>(
+    url: string,
+    data?: object,
+    config?: RequestConfig,
+  ): Promise<T> {
+    return this.request<T>({ method: 'patch', url, data, ...config });
+  }
+
   public delete<T = unknown>(url: string, config?: RequestConfig): Promise<T> {
     return this.request<T>({ method: 'delete', url, ...config });
   }

web/src/app/infra/http/CloudServiceClient.ts

@@ -128,6 +128,32 @@ export class CloudServiceClient extends BaseHttpClient {
       .catch(() => this.searchMarketplaceExtensionsLegacy(data));
   }
 
+  public getMarketplaceLikedExtensions(
+    fingerprint: string,
+  ): Promise<{ extensions: Array<{ type: string; extension_id: string }> }> {
+    return this.post('/api/v1/marketplace/extensions/likes/status', {
+      fingerprint,
+    });
+  }
+
+  public setMarketplaceExtensionLike(
+    type: string,
+    author: string,
+    name: string,
+    fingerprint: string,
+    liked: boolean,
+  ): Promise<{
+    type: string;
+    extension_id: string;
+    liked: boolean;
+    like_count: number;
+  }> {
+    return this.put(
+      `/api/v1/marketplace/extensions/${encodeURIComponent(type)}/${encodeURIComponent(author)}/${encodeURIComponent(name)}/like`,
+      { fingerprint, liked },
+    );
+  }
+
   private async searchMarketplaceExtensionsLegacy(data: {
     query?: string;
     page: number;
@@ -139,6 +165,8 @@ export class CloudServiceClient extends BaseHttpClient {
     tags_filter?: string[];
   }): Promise<ApiRespMarketplacePlugins> {
     const query = data.query || '';
+    const legacySortBy =
+      data.sort_by === 'hot_score' ? 'install_count' : data.sort_by;
 
     if (
       data.type_filter === 'plugin' ||
@@ -150,7 +178,7 @@ export class CloudServiceClient extends BaseHttpClient {
         query,
         data.page,
         data.page_size,
-        data.sort_by,
+        legacySortBy,
         data.sort_order,
         data.component_filter,
         data.tags_filter,
@@ -168,7 +196,7 @@ export class CloudServiceClient extends BaseHttpClient {
         query,
         data.page,
         data.page_size,
-        data.sort_by,
+        legacySortBy,
         data.sort_order,
         undefined,
         data.tags_filter,
@@ -178,7 +206,7 @@ export class CloudServiceClient extends BaseHttpClient {
         query,
         data.page,
         data.page_size,
-        data.sort_by,
+        legacySortBy,
         data.sort_order,
         undefined,
         data.tags_filter,
@@ -188,7 +216,7 @@ export class CloudServiceClient extends BaseHttpClient {
         query,
         data.page,
         data.page_size,
-        data.sort_by,
+        legacySortBy,
         data.sort_order,
         undefined,
         data.tags_filter,

web/src/app/infra/http/currentWorkspaceStore.ts

@@ -0,0 +1,30 @@
+import { useSyncExternalStore } from 'react';
+import type { CurrentWorkspace } from '@/app/infra/entities/workspace';
+
+let snapshot: CurrentWorkspace | null = null;
+const listeners = new Set<() => void>();
+
+export function getCurrentWorkspaceSnapshot(): CurrentWorkspace | null {
+  return snapshot;
+}
+
+export function setCurrentWorkspaceSnapshot(
+  workspace: CurrentWorkspace | null,
+): void {
+  snapshot = workspace;
+  listeners.forEach((listener) => listener());
+}
+
+function subscribe(listener: () => void): () => void {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+/** React-safe access to the currently selected Workspace and its permissions. */
+export function useCurrentWorkspace(): CurrentWorkspace | null {
+  return useSyncExternalStore(
+    subscribe,
+    getCurrentWorkspaceSnapshot,
+    getCurrentWorkspaceSnapshot,
+  );
+}

web/src/app/infra/http/index.ts

@@ -1,16 +1,39 @@
 import { BackendClient } from './BackendClient';
 import { CloudServiceClient } from './CloudServiceClient';
 import { ApiRespSystemInfo } from '@/app/infra/entities/api';
+import type {
+  CurrentWorkspace,
+  WorkspaceBootstrapEntry,
+} from '@/app/infra/entities/workspace';
+import {
+  clearActiveWorkspaceUuid,
+  getActiveWorkspaceUuid,
+  setActiveWorkspaceUuid,
+} from './workspaceContext';
+import {
+  getCurrentWorkspaceSnapshot,
+  setCurrentWorkspaceSnapshot,
+} from './currentWorkspaceStore';
+import {
+  clearWorkspaceBootstrapSnapshot,
+  getWorkspaceBootstrapSnapshot,
+  setWorkspaceBootstrapSnapshot,
+} from './workspaceBootstrapStore';
 
 // 系统信息
 export const systemInfo: ApiRespSystemInfo = {
   debug: false,
   version: '',
   edition: 'community',
+  mcp_stdio_enabled: false,
   enable_marketplace: true,
   cloud_service_url: '',
   allow_modify_login_info: true,
   disable_models_service: false,
+  invitation_delivery: {
+    enabled: false,
+    provider: null,
+  },
   limitation: {
     max_bots: -1,
     max_pipelines: -1,
@@ -23,6 +46,7 @@ export const systemInfo: ApiRespSystemInfo = {
 
 // 用户信息
 export let userInfo: {
+  account_uuid: string;
   user: string;
   account_type: 'local' | 'space';
   has_password: boolean;
@@ -109,25 +133,233 @@ export const initializeSystemInfo = async (options?: {
  * 初始化用户信息
  * 应该在用户登录后调用此方法
  */
-export const initializeUserInfo = async (): Promise<void> => {
+export const initializeUserInfo = async (options?: {
+  throwOnError?: boolean;
+}): Promise<void> => {
   try {
     userInfo = await backendClient.getUserInfo();
+    if (typeof window !== 'undefined') {
+      localStorage.setItem('userEmail', userInfo.user);
+    }
   } catch (error) {
     console.error('Failed to initialize user info:', error);
     userInfo = null;
+    if (options?.throwOnError) {
+      throw error;
+    }
   }
 };
 
+export const initializeWorkspaceInfo = async (): Promise<void> => {
+  const storedWorkspaceUuid = getActiveWorkspaceUuid();
+  try {
+    const workspace = await backendClient.getCurrentWorkspace();
+    setCurrentWorkspaceSnapshot(workspace);
+    setActiveWorkspaceUuid(workspace.workspace.uuid);
+  } catch (error) {
+    setCurrentWorkspaceSnapshot(null);
+    clearActiveWorkspaceUuid();
+    // A restored Community browser session can outlive a database reset or an
+    // instance replacement. Its stale selector is not an authorization
+    // credential, and the OSS policy still has exactly one legal Workspace,
+    // so retry once without it. Cloud must remain explicit and fail closed.
+    if (storedWorkspaceUuid && systemInfo.edition === 'community') {
+      const workspace = await backendClient.getCurrentWorkspace();
+      setCurrentWorkspaceSnapshot(workspace);
+      setActiveWorkspaceUuid(workspace.workspace.uuid);
+      return;
+    }
+    throw error;
+  }
+};
+
+export type WorkspaceBootstrapResult =
+  | {
+      status: 'ready';
+      workspace: CurrentWorkspace;
+      workspaces: WorkspaceBootstrapEntry[];
+    }
+  | {
+      status: 'selection-required';
+      workspaces: WorkspaceBootstrapEntry[];
+    }
+  | {
+      status: 'unavailable';
+      workspaces: [];
+    };
+
+export interface WorkspaceBootstrapOptions {
+  /** Discard any selector left by a previous Account session. */
+  resetSelection?: boolean;
+  /** Explicit intent, such as accepting an invitation. */
+  preferredWorkspaceUuid?: string;
+  /** Always show the chooser when the Account has multiple Workspaces. */
+  requireExplicitSelection?: boolean;
+}
+
+function clearWorkspaceSelection(): void {
+  setCurrentWorkspaceSnapshot(null);
+  clearActiveWorkspaceUuid();
+}
+
+/**
+ * Store a new Account token without carrying Workspace state across Accounts.
+ * Call bootstrapWorkspaceSession immediately afterwards.
+ */
+export function beginAuthenticatedSession(
+  token: string,
+  userEmail?: string,
+): void {
+  userInfo = null;
+  clearWorkspaceSelection();
+  clearWorkspaceBootstrapSnapshot();
+
+  if (typeof window === 'undefined') return;
+  localStorage.removeItem('token');
+  localStorage.removeItem('userEmail');
+  localStorage.setItem('token', token);
+  if (userEmail) localStorage.setItem('userEmail', userEmail);
+}
+
+async function initializeSelectedWorkspace(
+  workspaceUuid: string,
+  workspaces: WorkspaceBootstrapEntry[],
+): Promise<WorkspaceBootstrapResult> {
+  setActiveWorkspaceUuid(workspaceUuid);
+  try {
+    await Promise.all([
+      initializeUserInfo({ throwOnError: true }),
+      initializeWorkspaceInfo(),
+    ]);
+  } catch (error) {
+    clearWorkspaceSelection();
+    throw error;
+  }
+
+  const workspace = getCurrentWorkspaceSnapshot();
+  if (!workspace) {
+    clearWorkspaceSelection();
+    throw new Error('Selected Workspace could not be initialized');
+  }
+  return { status: 'ready', workspace, workspaces };
+}
+
+/**
+ * Resolve Account membership before any Workspace-scoped request is made.
+ * A singleton is selected automatically; multiple Workspaces require explicit
+ * user intent unless a still-valid selector already exists.
+ */
+export async function bootstrapWorkspaceSession(
+  options: WorkspaceBootstrapOptions = {},
+): Promise<WorkspaceBootstrapResult> {
+  if (options.resetSelection) {
+    clearWorkspaceSelection();
+    clearWorkspaceBootstrapSnapshot();
+  }
+
+  const response = await backendClient.getWorkspaceBootstrap();
+  const workspaces = response.workspaces;
+  setWorkspaceBootstrapSnapshot(workspaces);
+
+  if (workspaces.length === 0) {
+    clearWorkspaceSelection();
+    return { status: 'unavailable', workspaces: [] };
+  }
+
+  const preferredWorkspace = options.preferredWorkspaceUuid
+    ? workspaces.find(
+        (entry) => entry.workspace.uuid === options.preferredWorkspaceUuid,
+      )
+    : undefined;
+  if (options.preferredWorkspaceUuid && !preferredWorkspace) {
+    clearWorkspaceSelection();
+    return { status: 'selection-required', workspaces };
+  }
+
+  const activeWorkspace = !options.requireExplicitSelection
+    ? workspaces.find(
+        (entry) => entry.workspace.uuid === getActiveWorkspaceUuid(),
+      )
+    : undefined;
+  const selectedWorkspace =
+    preferredWorkspace ??
+    (workspaces.length === 1 ? workspaces[0] : activeWorkspace);
+
+  if (!selectedWorkspace) {
+    clearWorkspaceSelection();
+    return { status: 'selection-required', workspaces };
+  }
+
+  return initializeSelectedWorkspace(
+    selectedWorkspace.workspace.uuid,
+    workspaces,
+  );
+}
+
+/** Revalidate and activate an explicit choice made on the chooser page. */
+export async function selectWorkspace(
+  workspaceUuid: string,
+): Promise<WorkspaceBootstrapResult> {
+  const response = await backendClient.getWorkspaceBootstrap();
+  setWorkspaceBootstrapSnapshot(response.workspaces);
+  const selected = response.workspaces.find(
+    (entry) => entry.workspace.uuid === workspaceUuid,
+  );
+  if (!selected) {
+    clearWorkspaceSelection();
+    if (response.workspaces.length === 0) {
+      return { status: 'unavailable', workspaces: [] };
+    }
+    return { status: 'selection-required', workspaces: response.workspaces };
+  }
+  return initializeSelectedWorkspace(
+    selected.workspace.uuid,
+    response.workspaces,
+  );
+}
+
+/** Clear in-memory Workspace snapshots before reloading into a new scope. */
+export function switchWorkspaceAndReload(workspaceUuid: string): void {
+  const isAvailable = getWorkspaceBootstrapSnapshot().some(
+    (entry) => entry.workspace.uuid === workspaceUuid,
+  );
+  if (!isAvailable || workspaceUuid === getActiveWorkspaceUuid()) return;
+
+  clearWorkspaceSelection();
+  clearWorkspaceBootstrapSnapshot();
+  setActiveWorkspaceUuid(workspaceUuid);
+  window.location.replace('/home/monitoring');
+}
+
 /**
  * 清除用户信息
  * 应该在用户登出时调用此方法
  */
 export const clearUserInfo = (): void => {
   userInfo = null;
+  clearWorkspaceSelection();
+  clearWorkspaceBootstrapSnapshot();
 };
 
+export {
+  clearActiveWorkspaceUuid,
+  clearPendingInvitationToken,
+  getActiveWorkspaceUuid,
+  getPendingInvitationToken,
+  setActiveWorkspaceUuid,
+  setPendingInvitationToken,
+} from './workspaceContext';
+
 // 导出类型，以便其他地方使用
 export type { ResponseData, RequestConfig } from './BaseHttpClient';
 export { BaseHttpClient } from './BaseHttpClient';
 export { BackendClient } from './BackendClient';
 export { CloudServiceClient } from './CloudServiceClient';
+export {
+  getCurrentWorkspaceSnapshot,
+  useCurrentWorkspace,
+} from './currentWorkspaceStore';
+export {
+  getWorkspaceBootstrapSnapshot,
+  useWorkspaceBootstrap,
+} from './workspaceBootstrapStore';

web/src/app/infra/http/workspaceBootstrapStore.ts

@@ -0,0 +1,35 @@
+import { useSyncExternalStore } from 'react';
+
+import type { WorkspaceBootstrapEntry } from '@/app/infra/entities/workspace';
+
+let snapshot: WorkspaceBootstrapEntry[] = [];
+const listeners = new Set<() => void>();
+
+export function getWorkspaceBootstrapSnapshot(): WorkspaceBootstrapEntry[] {
+  return snapshot;
+}
+
+export function setWorkspaceBootstrapSnapshot(
+  workspaces: WorkspaceBootstrapEntry[],
+): void {
+  snapshot = workspaces;
+  listeners.forEach((listener) => listener());
+}
+
+export function clearWorkspaceBootstrapSnapshot(): void {
+  setWorkspaceBootstrapSnapshot([]);
+}
+
+function subscribe(listener: () => void): () => void {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+/** React-safe access to the Account's selectable Workspaces. */
+export function useWorkspaceBootstrap(): WorkspaceBootstrapEntry[] {
+  return useSyncExternalStore(
+    subscribe,
+    getWorkspaceBootstrapSnapshot,
+    getWorkspaceBootstrapSnapshot,
+  );
+}

web/src/app/infra/http/workspaceContext.ts

@@ -0,0 +1,54 @@
+export const ACTIVE_WORKSPACE_STORAGE_KEY = 'langbot_active_workspace_uuid';
+export const PENDING_INVITATION_TOKEN_KEY = 'langbot_pending_invitation_token';
+
+let activeWorkspaceUuid: string | null = null;
+
+function readStoredWorkspaceUuid(): string | null {
+  if (typeof window === 'undefined') return null;
+  const value = localStorage.getItem(ACTIVE_WORKSPACE_STORAGE_KEY)?.trim();
+  return value || null;
+}
+
+export function getActiveWorkspaceUuid(): string | null {
+  if (activeWorkspaceUuid) return activeWorkspaceUuid;
+  activeWorkspaceUuid = readStoredWorkspaceUuid();
+  return activeWorkspaceUuid;
+}
+
+export function setActiveWorkspaceUuid(workspaceUuid: string): void {
+  const normalized = workspaceUuid.trim();
+  if (!normalized) {
+    throw new Error('Workspace UUID cannot be empty');
+  }
+  activeWorkspaceUuid = normalized;
+  if (typeof window !== 'undefined') {
+    localStorage.setItem(ACTIVE_WORKSPACE_STORAGE_KEY, normalized);
+  }
+}
+
+export function clearActiveWorkspaceUuid(): void {
+  activeWorkspaceUuid = null;
+  if (typeof window !== 'undefined') {
+    localStorage.removeItem(ACTIVE_WORKSPACE_STORAGE_KEY);
+  }
+}
+
+export function getPendingInvitationToken(): string | null {
+  if (typeof window === 'undefined') return null;
+  const token = sessionStorage.getItem(PENDING_INVITATION_TOKEN_KEY)?.trim();
+  return token || null;
+}
+
+export function setPendingInvitationToken(token: string): void {
+  const normalized = token.trim();
+  if (!normalized) throw new Error('Invitation token cannot be empty');
+  if (typeof window !== 'undefined') {
+    sessionStorage.setItem(PENDING_INVITATION_TOKEN_KEY, normalized);
+  }
+}
+
+export function clearPendingInvitationToken(): void {
+  if (typeof window !== 'undefined') {
+    sessionStorage.removeItem(PENDING_INVITATION_TOKEN_KEY);
+  }
+}

web/src/app/infra/websocket/WebSocketClient.ts

@@ -2,6 +2,8 @@
  * WebSocket客户端类
  * 用于管理WebSocket连接和消息处理
  */
+import { getActiveWorkspaceUuid } from '@/app/infra/http/workspaceContext';
+
 export interface WebSocketMessage {
   id: number;
   role: 'user' | 'assistant';
@@ -91,7 +93,22 @@ export class WebSocketClient {
         this.ws.onopen = () => {
           this.reconnectAttempts = 0;
           this.isConnecting = false;
-          this.startHeartbeat();
+          const token = this.token || localStorage.getItem('token');
+          const workspaceUuid = getActiveWorkspaceUuid();
+          if (!token || !workspaceUuid) {
+            const error = new Error('WebSocket认证信息缺失');
+            this.onErrorCallback?.(error);
+            this.ws?.close();
+            reject(error);
+            return;
+          }
+          this.ws?.send(
+            JSON.stringify({
+              type: 'authenticate',
+              token,
+              workspace_uuid: workspaceUuid,
+            }),
+          );
         };
 
         // 接收消息
@@ -103,6 +120,7 @@ export class WebSocketClient {
             // 第一次连接成功
             if (data.type === 'connected' && data.connection_id) {
               this.connectionId = data.connection_id;
+              this.startHeartbeat();
               resolve(data.connection_id);
             }
           } catch (error) {

web/src/app/invitations/accept/page.tsx

@@ -0,0 +1,404 @@
+import { useEffect, useState } from 'react';
+import { AlertCircle, CheckCircle2, Loader2, Lock, Mail } from 'lucide-react';
+import { useNavigate } from 'react-router-dom';
+import { useTranslation } from 'react-i18next';
+import { toast } from 'sonner';
+
+import langbotIcon from '@/app/assets/langbot-logo.webp';
+import { Button } from '@/components/ui/button';
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card';
+import { Input } from '@/components/ui/input';
+import { LanguageSelector } from '@/components/ui/language-selector';
+import { ThemeToggle } from '@/components/ui/theme-toggle';
+import type {
+  Workspace,
+  WorkspaceInvitation,
+} from '@/app/infra/entities/workspace';
+import {
+  backendClient,
+  bootstrapWorkspaceSession,
+  clearPendingInvitationToken,
+  clearUserInfo,
+  getPendingInvitationToken,
+  setPendingInvitationToken,
+} from '@/app/infra/http';
+
+type InvitationView = {
+  invitation: WorkspaceInvitation;
+  workspace: Workspace;
+};
+
+const TERMINAL_INVITATION_ERROR_CODES = new Set([
+  'invitation_invalid',
+  'invitation_expired',
+  'invitation_revoked',
+  'invitation_used',
+  'invitation_email_mismatch',
+]);
+
+function invitationErrorKey(
+  code: string | null | undefined,
+  fallback: 'workspace.invitationInvalid' | 'workspace.invitationAcceptFailed',
+) {
+  switch (code) {
+    case 'invitation_invalid':
+      return 'workspace.invitationInvalid';
+    case 'invitation_expired':
+      return 'workspace.invitationExpired';
+    case 'invitation_revoked':
+      return 'workspace.invitationAlreadyRevoked';
+    case 'invitation_used':
+      return 'workspace.invitationAlreadyUsed';
+    case 'invitation_email_mismatch':
+      return 'workspace.invitationEmailMismatch';
+    default:
+      return fallback;
+  }
+}
+
+function captureInvitationTokenFromFragment(): string | null {
+  if (typeof window === 'undefined') return null;
+  const fragment = new URLSearchParams(window.location.hash.slice(1));
+  const token = fragment.get('token')?.trim();
+  if (!token) return getPendingInvitationToken();
+
+  setPendingInvitationToken(token);
+  window.history.replaceState(
+    null,
+    document.title,
+    `${window.location.pathname}${window.location.search}`,
+  );
+  return token;
+}
+
+export default function AcceptInvitationPage() {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const [invitationHash, setInvitationHash] = useState(() =>
+    typeof window === 'undefined' ? '' : window.location.hash,
+  );
+  const [token, setToken] = useState<string | null>(null);
+  const [view, setView] = useState<InvitationView | null>(null);
+  const [status, setStatus] = useState<
+    'loading' | 'ready' | 'submitting' | 'success' | 'error'
+  >('loading');
+  const [errorMessage, setErrorMessage] = useState('');
+  const [password, setPassword] = useState('');
+  const [confirmPassword, setConfirmPassword] = useState('');
+  const [passwordRegistrationEnabled, setPasswordRegistrationEnabled] =
+    useState(false);
+
+  useEffect(() => {
+    const handleHashChange = () => setInvitationHash(window.location.hash);
+    window.addEventListener('hashchange', handleHashChange);
+    return () => window.removeEventListener('hashchange', handleHashChange);
+  }, []);
+
+  useEffect(() => {
+    setStatus('loading');
+    setView(null);
+    setErrorMessage('');
+    const invitationToken = captureInvitationTokenFromFragment();
+    const deferredErrorCode = new URLSearchParams(window.location.search).get(
+      'error',
+    );
+    setToken(invitationToken);
+    backendClient
+      .getAccountInfo()
+      .then((info) => {
+        setPasswordRegistrationEnabled(info.password_login_enabled !== false);
+      })
+      .catch(() => setPasswordRegistrationEnabled(false));
+    if (!invitationToken) {
+      setErrorMessage(t('workspace.invitationMissing'));
+      setStatus('error');
+      return;
+    }
+
+    let cancelled = false;
+    backendClient
+      .inspectWorkspaceInvitation(invitationToken)
+      .then((response) => {
+        if (cancelled) return;
+        setView(response);
+        if (deferredErrorCode) {
+          setErrorMessage(
+            t(
+              invitationErrorKey(
+                deferredErrorCode,
+                'workspace.invitationAcceptFailed',
+              ),
+            ),
+          );
+          setStatus('error');
+        } else {
+          setStatus('ready');
+        }
+      })
+      .catch((error: { code?: string; msg?: string }) => {
+        if (cancelled) return;
+        clearPendingInvitationToken();
+        setErrorMessage(
+          t(invitationErrorKey(error.code, 'workspace.invitationInvalid')),
+        );
+        setStatus('error');
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [invitationHash, t]);
+
+  async function finishAcceptance(registration?: {
+    email: string;
+    password: string;
+  }) {
+    if (!token) return;
+    setStatus('submitting');
+    setErrorMessage('');
+    try {
+      const response = await backendClient.acceptWorkspaceInvitation(
+        token,
+        registration,
+      );
+      if (registration) {
+        clearPendingInvitationToken();
+        toast.success(t('workspace.invitationAccepted'));
+        navigate('/login?invitation=1', { replace: true });
+        return;
+      }
+      clearPendingInvitationToken();
+      const workspaceResult = await bootstrapWorkspaceSession({
+        preferredWorkspaceUuid: response.workspace_uuid,
+      });
+      if (workspaceResult.status !== 'ready') {
+        throw new Error('Accepted Workspace could not be initialized');
+      }
+      setStatus('success');
+      toast.success(t('workspace.invitationAccepted'));
+      window.setTimeout(() => navigate('/home', { replace: true }), 600);
+    } catch (error) {
+      const apiError = error as { code?: string; msg?: string };
+      if (apiError.code === 'account_exists_login_required') {
+        setStatus('ready');
+        setErrorMessage(t('workspace.existingAccountLoginRequired'));
+        return;
+      }
+      setErrorMessage(
+        t(
+          invitationErrorKey(apiError.code, 'workspace.invitationAcceptFailed'),
+        ),
+      );
+      setStatus(
+        apiError.code && TERMINAL_INVITATION_ERROR_CODES.has(apiError.code)
+          ? 'error'
+          : 'ready',
+      );
+    }
+  }
+
+  function registerAndAccept() {
+    if (!view) return;
+    if (password.length < 8) {
+      setErrorMessage(t('workspace.passwordMinimum'));
+      return;
+    }
+    if (password !== confirmPassword) {
+      setErrorMessage(t('workspace.passwordMismatch'));
+      return;
+    }
+    void finishAcceptance({
+      email: view.invitation.normalized_email,
+      password,
+    });
+  }
+
+  function logoutAndReturn() {
+    if (token) setPendingInvitationToken(token);
+    clearUserInfo();
+    if (typeof window !== 'undefined') {
+      localStorage.removeItem('token');
+      localStorage.removeItem('userEmail');
+    }
+    navigate('/login?invitation=1', { replace: true });
+  }
+
+  function returnToLogin() {
+    clearUserInfo();
+    if (typeof window !== 'undefined') {
+      localStorage.removeItem('token');
+      localStorage.removeItem('userEmail');
+    }
+    navigate('/login', { replace: true });
+  }
+
+  const hasLoginToken =
+    typeof window !== 'undefined' && Boolean(localStorage.getItem('token'));
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-gray-50 p-4 dark:bg-neutral-900">
+      <Card className="w-full max-w-md shadow-lg dark:shadow-white/10">
+        <CardHeader>
+          <div className="mb-4 flex items-center justify-between">
+            <ThemeToggle />
+            <LanguageSelector />
+          </div>
+          <img
+            src={langbotIcon}
+            alt="LangBot"
+            className="mx-auto mb-3 size-14"
+          />
+          <CardTitle className="text-center">
+            {t('workspace.acceptInvitation')}
+          </CardTitle>
+          <CardDescription className="text-center">
+            {view
+              ? t('workspace.invitedToWorkspace', {
+                  workspace: view.workspace.name,
+                })
+              : t('workspace.checkingInvitation')}
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          {status === 'loading' && (
+            <div className="flex justify-center py-8">
+              <Loader2 className="size-6 animate-spin" />
+            </div>
+          )}
+
+          {status === 'success' && (
+            <div className="flex flex-col items-center gap-3 py-8 text-center">
+              <CheckCircle2 className="size-9 text-green-600" />
+              <p>{t('workspace.invitationAccepted')}</p>
+            </div>
+          )}
+
+          {status === 'error' && (
+            <div className="space-y-4">
+              <div className="flex items-start gap-2 rounded-lg border border-destructive/20 bg-destructive/5 p-3 text-sm text-destructive">
+                <AlertCircle className="mt-0.5 size-4 shrink-0" />
+                <span>{errorMessage}</span>
+              </div>
+              <Button
+                variant="outline"
+                className="w-full"
+                onClick={returnToLogin}
+              >
+                {t('workspace.backToLogin')}
+              </Button>
+            </div>
+          )}
+
+          {(status === 'ready' || status === 'submitting') && view && (
+            <div className="space-y-4">
+              {errorMessage && (
+                <div className="flex items-start gap-2 rounded-lg border border-destructive/20 bg-destructive/5 p-3 text-sm text-destructive">
+                  <AlertCircle className="mt-0.5 size-4 shrink-0" />
+                  <span>{errorMessage}</span>
+                </div>
+              )}
+
+              {hasLoginToken ? (
+                <div className="space-y-3">
+                  <div className="rounded-lg border border-amber-300 bg-amber-50 p-3 text-sm text-amber-900 dark:bg-amber-950/30 dark:text-amber-100">
+                    {t('workspace.authenticatedInvitationNotice')}
+                  </div>
+                  <Button className="w-full" onClick={logoutAndReturn}>
+                    {t('workspace.logoutAndReturn')}
+                  </Button>
+                </div>
+              ) : passwordRegistrationEnabled ? (
+                <>
+                  <div className="space-y-2">
+                    <label
+                      className="text-sm font-medium"
+                      htmlFor="invite-email"
+                    >
+                      {t('common.email')}
+                    </label>
+                    <div className="relative">
+                      <Mail className="absolute left-3 top-3 size-4 text-muted-foreground" />
+                      <Input
+                        id="invite-email"
+                        value={view.invitation.normalized_email}
+                        readOnly
+                        className="pl-10"
+                      />
+                    </div>
+                  </div>
+                  <div className="space-y-2">
+                    <label
+                      className="text-sm font-medium"
+                      htmlFor="invite-password"
+                    >
+                      {t('common.password')}
+                    </label>
+                    <div className="relative">
+                      <Lock className="absolute left-3 top-3 size-4 text-muted-foreground" />
+                      <Input
+                        id="invite-password"
+                        type="password"
+                        value={password}
+                        onChange={(event) => setPassword(event.target.value)}
+                        className="pl-10"
+                        autoComplete="new-password"
+                      />
+                    </div>
+                  </div>
+                  <div className="space-y-2">
+                    <label
+                      className="text-sm font-medium"
+                      htmlFor="invite-password-confirm"
+                    >
+                      {t('workspace.confirmPassword')}
+                    </label>
+                    <Input
+                      id="invite-password-confirm"
+                      type="password"
+                      value={confirmPassword}
+                      onChange={(event) =>
+                        setConfirmPassword(event.target.value)
+                      }
+                      autoComplete="new-password"
+                    />
+                  </div>
+                  <Button
+                    className="w-full"
+                    disabled={status === 'submitting'}
+                    onClick={registerAndAccept}
+                  >
+                    {status === 'submitting' && (
+                      <Loader2 className="size-4 animate-spin" />
+                    )}
+                    {t('workspace.registerAndAccept')}
+                  </Button>
+                  <Button
+                    variant="ghost"
+                    className="w-full"
+                    disabled={status === 'submitting'}
+                    onClick={() => navigate('/login?invitation=1')}
+                  >
+                    {t('workspace.alreadyHaveAccount')}
+                  </Button>
+                </>
+              ) : (
+                <Button
+                  className="w-full"
+                  onClick={() => navigate('/login?invitation=1&auto=space')}
+                >
+                  {t('common.loginWithSpace')}
+                </Button>
+              )}
+            </div>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

web/src/app/login/page.tsx

@@ -19,8 +19,14 @@ import {
   FormLabel,
   FormMessage,
 } from '@/components/ui/form';
-import { useEffect, useState } from 'react';
-import { httpClient, initializeUserInfo } from '@/app/infra/http';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import {
+  beginAuthenticatedSession,
+  bootstrapWorkspaceSession,
+  clearPendingInvitationToken,
+  getPendingInvitationToken,
+  httpClient,
+} from '@/app/infra/http';
 import { useNavigate } from 'react-router-dom';
 import {
   Mail,
@@ -43,17 +49,24 @@ const formSchema = (t: (key: string) => string) =>
     password: z.string().min(1, t('common.emptyPassword')),
   });
 
-type AccountType = 'local' | 'space';
+const TERMINAL_INVITATION_ERROR_CODES = new Set([
+  'invitation_invalid',
+  'invitation_expired',
+  'invitation_revoked',
+  'invitation_used',
+  'invitation_email_mismatch',
+]);
 
 export default function Login() {
   const navigate = useNavigate();
   const { t } = useTranslation();
   const [spaceLoading, setSpaceLoading] = useState(false);
-  const [accountType, setAccountType] = useState<AccountType | null>(null);
-  const [hasPassword, setHasPassword] = useState(false);
+  const [showLocalLogin, setShowLocalLogin] = useState(false);
+  const [showSpaceLogin, setShowSpaceLogin] = useState(false);
   const [loading, setLoading] = useState(true);
   const [loadError, setLoadError] = useState<string | null>(null);
   const [retrying, setRetrying] = useState(false);
+  const autoSpaceLoginStarted = useRef(false);
 
   const form = useForm<z.infer<ReturnType<typeof formSchema>>>({
     resolver: zodResolver(formSchema(t)),
@@ -75,8 +88,8 @@ export default function Login() {
         navigate('/register');
         return;
       }
-      setAccountType(res.account_type || 'local');
-      setHasPassword(res.has_password || false);
+      setShowLocalLogin(res.password_login_enabled !== false);
+      setShowSpaceLogin(res.space_login_enabled !== false);
       setLoading(false);
 
       // Also check if already logged in
@@ -109,15 +122,64 @@ export default function Login() {
   function checkIfAlreadyLoggedIn() {
     httpClient
       .checkUserToken()
-      .then((res) => {
+      .then(async (res) => {
         if (res.token) {
-          localStorage.setItem('token', res.token);
-          navigate('/home');
+          await finishLogin(res.token);
         }
       })
       .catch(() => {});
   }
 
+  async function finishLogin(
+    token: string,
+    username?: string,
+  ): Promise<boolean> {
+    beginAuthenticatedSession(token, username);
+
+    const invitationToken = getPendingInvitationToken();
+    let preferredWorkspaceUuid: string | undefined;
+    if (invitationToken) {
+      try {
+        const response =
+          await httpClient.acceptWorkspaceInvitation(invitationToken);
+        beginAuthenticatedSession(response.token, username);
+        preferredWorkspaceUuid = response.workspace_uuid;
+        clearPendingInvitationToken();
+      } catch (error) {
+        const apiError = error as { code?: string };
+        const errorCode =
+          typeof apiError.code === 'string'
+            ? apiError.code
+            : 'invitation_accept_failed';
+        const invitationPath = TERMINAL_INVITATION_ERROR_CODES.has(errorCode)
+          ? `/invitations/accept?error=${encodeURIComponent(errorCode)}`
+          : '/invitations/accept';
+        navigate(invitationPath, { replace: true });
+        toast.error(
+          t(
+            errorCode === 'invitation_email_mismatch'
+              ? 'workspace.invitationEmailMismatch'
+              : 'workspace.invitationAcceptFailed',
+          ),
+        );
+        return false;
+      }
+    }
+
+    const result = await bootstrapWorkspaceSession({
+      preferredWorkspaceUuid,
+    });
+    if (result.status === 'selection-required') {
+      navigate('/workspaces/select?returnTo=%2Fhome', { replace: true });
+      return true;
+    }
+    if (result.status === 'unavailable') {
+      throw new Error('No Workspace is available for this Account');
+    }
+    navigate('/home');
+    return true;
+  }
+
   function onSubmit(values: z.infer<ReturnType<typeof formSchema>>) {
     handleLogin(values.email, values.password);
   }
@@ -126,18 +188,16 @@ export default function Login() {
     httpClient
       .authUser(username, password)
       .then(async (res) => {
-        localStorage.setItem('token', res.token);
-        localStorage.setItem('userEmail', username);
-        await initializeUserInfo();
-        navigate('/home');
-        toast.success(t('common.loginSuccess'));
+        if (await finishLogin(res.token, username)) {
+          toast.success(t('common.loginSuccess'));
+        }
       })
       .catch(() => {
         toast.error(t('common.loginFailed'));
       });
   }
 
-  const handleSpaceLoginClick = async () => {
+  const handleSpaceLoginClick = useCallback(async () => {
     setSpaceLoading(true);
     try {
       const currentOrigin = window.location.origin;
@@ -148,7 +208,20 @@ export default function Login() {
       toast.error(t('common.spaceLoginFailed'));
       setSpaceLoading(false);
     }
-  };
+  }, [t]);
+
+  useEffect(() => {
+    if (
+      loading ||
+      !showSpaceLogin ||
+      autoSpaceLoginStarted.current ||
+      new URLSearchParams(window.location.search).get('auto') !== 'space'
+    ) {
+      return;
+    }
+    autoSpaceLoginStarted.current = true;
+    void handleSpaceLoginClick();
+  }, [handleSpaceLoginClick, loading, showSpaceLogin]);
 
   if (loading) {
     return (
@@ -211,11 +284,6 @@ export default function Login() {
     );
   }
 
-  // Determine what to show based on account type
-  const showLocalLogin =
-    accountType === 'local' || (accountType === 'space' && hasPassword);
-  const showSpaceLogin = accountType === 'space';
-
   return (
     <div className="min-h-screen flex items-center justify-center bg-gray-50 dark:dark:bg-neutral-900">
       <Card className="w-[375px] shadow-lg dark:shadow-white/10">
@@ -237,7 +305,7 @@ export default function Login() {
           </CardDescription>
         </CardHeader>
         <CardContent className="space-y-6">
-          {/* Space Login - only show for space accounts */}
+          {/* Space and password login are per-account capabilities. */}
           {showSpaceLogin && (
             <div className="space-y-3">
               <Button
@@ -270,7 +338,7 @@ export default function Login() {
             </div>
           )}
 
-          {/* Local Account Login - show for local accounts or space accounts with password */}
+          {/* Password login remains available to every account with a password. */}
           {showLocalLogin && (
             <Form {...form}>
               <form

web/src/app/register/page.tsx

@@ -44,6 +44,8 @@ export default function Register() {
   const navigate = useNavigate();
   const { t } = useTranslation();
   const [spaceLoading, setSpaceLoading] = useState(false);
+  const [passwordRegistrationEnabled, setPasswordRegistrationEnabled] =
+    useState(true);
 
   const form = useForm<z.infer<ReturnType<typeof formSchema>>>({
     resolver: zodResolver(formSchema(t)),
@@ -55,6 +57,12 @@ export default function Register() {
 
   useEffect(() => {
     getIsInitialized();
+    httpClient
+      .getAccountInfo()
+      .then((info) =>
+        setPasswordRegistrationEnabled(info.password_login_enabled !== false),
+      )
+      .catch(() => setPasswordRegistrationEnabled(true));
   }, []);
 
   function getIsInitialized() {
@@ -159,72 +167,79 @@ export default function Register() {
             </p>
           </div>
 
-          <div className="relative">
-            <div className="absolute inset-0 flex items-center">
-              <span className="w-full border-t" />
-            </div>
-            <div className="relative flex justify-center text-xs uppercase">
-              <span className="bg-white dark:bg-card px-2 text-muted-foreground">
-                {t('common.or')}
-              </span>
-            </div>
-          </div>
+          {passwordRegistrationEnabled && (
+            <>
+              <div className="relative">
+                <div className="absolute inset-0 flex items-center">
+                  <span className="w-full border-t" />
+                </div>
+                <div className="relative flex justify-center text-xs uppercase">
+                  <span className="bg-white dark:bg-card px-2 text-muted-foreground">
+                    {t('common.or')}
+                  </span>
+                </div>
+              </div>
 
-          {/* Local Account Registration */}
-          <Form {...form}>
-            <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6">
-              <FormField
-                control={form.control}
-                name="email"
-                render={({ field }) => (
-                  <FormItem>
-                    <FormLabel>{t('common.email')}</FormLabel>
-                    <FormControl>
-                      <div className="relative">
-                        <Mail className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
-                        <Input
-                          placeholder={t('common.enterEmail')}
-                          className="pl-10"
-                          {...field}
-                        />
-                      </div>
-                    </FormControl>
-                    <FormMessage />
-                  </FormItem>
-                )}
-              />
+              {/* Local Account Registration */}
+              <Form {...form}>
+                <form
+                  onSubmit={form.handleSubmit(onSubmit)}
+                  className="space-y-6"
+                >
+                  <FormField
+                    control={form.control}
+                    name="email"
+                    render={({ field }) => (
+                      <FormItem>
+                        <FormLabel>{t('common.email')}</FormLabel>
+                        <FormControl>
+                          <div className="relative">
+                            <Mail className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
+                            <Input
+                              placeholder={t('common.enterEmail')}
+                              className="pl-10"
+                              {...field}
+                            />
+                          </div>
+                        </FormControl>
+                        <FormMessage />
+                      </FormItem>
+                    )}
+                  />
 
-              <FormField
-                control={form.control}
-                name="password"
-                render={({ field }) => (
-                  <FormItem>
-                    <FormLabel>{t('common.password')}</FormLabel>
-                    <FormControl>
-                      <div className="relative">
-                        <Lock className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
-                        <Input
-                          type="password"
-                          placeholder={t('common.enterPassword')}
-                          className="pl-10"
-                          {...field}
-                        />
-                      </div>
-                    </FormControl>
-                    <FormMessage />
-                  </FormItem>
-                )}
-              />
+                  <FormField
+                    control={form.control}
+                    name="password"
+                    render={({ field }) => (
+                      <FormItem>
+                        <FormLabel>{t('common.password')}</FormLabel>
+                        <FormControl>
+                          <div className="relative">
+                            <Lock className="absolute left-3 top-3 h-4 w-4 text-gray-400" />
+                            <Input
+                              type="password"
+                              placeholder={t('common.enterPassword')}
+                              className="pl-10"
+                              {...field}
+                            />
+                          </div>
+                        </FormControl>
+                        <FormMessage />
+                      </FormItem>
+                    )}
+                  />
 
-              <Button
-                type="submit"
-                variant="outline"
-                className="w-full cursor-pointer"
-              >
-                {t('register.registerWithPassword')}
-              </Button>
-            </form>
-          </Form>
+                  <Button
+                    type="submit"
+                    variant="outline"
+                    className="w-full cursor-pointer"
+                  >
+                    {t('register.registerWithPassword')}
+                  </Button>
+                </form>
+              </Form>
+            </>
+          )}
 
           <p className="text-xs text-center text-muted-foreground">
             {t('common.agreementNotice')}{' '}

web/src/app/wizard/page.tsx

@@ -26,7 +26,7 @@ import {
 import { httpClient } from '@/app/infra/http/HttpClient';
 import {
   systemInfo,
-  initializeUserInfo,
+  bootstrapWorkspaceSession,
   initializeSystemInfo,
   getCloudServiceClient,
   getCloudServiceClientSync,
@@ -347,8 +347,16 @@ export default function WizardPage() {
     let cancelled = false;
     (async () => {
       try {
-        // Initialize user/system info (wizard is outside /home layout)
-        await Promise.all([initializeUserInfo(), initializeSystemInfo()]);
+        // Resolve the Account's Workspace before loading scoped wizard data.
+        const workspaceResult = await bootstrapWorkspaceSession();
+        if (workspaceResult.status === 'selection-required') {
+          navigate('/workspaces/select?returnTo=%2Fwizard', { replace: true });
+          return;
+        }
+        if (workspaceResult.status === 'unavailable') {
+          throw new Error('No Workspace is available for this Account');
+        }
+        await initializeSystemInfo({ throwOnError: true });
 
         const [adaptersResp, metadataResp] = await Promise.all([
           httpClient.getAdapters(),
@@ -414,7 +422,7 @@ export default function WizardPage() {
     return () => {
       cancelled = true;
     };
-  }, [t]);
+  }, [navigate, t]);
 
   // ---- Derived data ----
 

web/src/app/workspaces/select/page.tsx

@@ -0,0 +1,191 @@
+import { useCallback, useEffect, useState } from 'react';
+import { useNavigate, useSearchParams } from 'react-router-dom';
+import { AlertCircle, ArrowRight, Building2, Loader2 } from 'lucide-react';
+import { useTranslation } from 'react-i18next';
+
+import langbotIcon from '@/app/assets/langbot-logo.webp';
+import {
+  bootstrapWorkspaceSession,
+  clearUserInfo,
+  selectWorkspace,
+  useWorkspaceBootstrap,
+} from '@/app/infra/http';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card';
+import { LanguageSelector } from '@/components/ui/language-selector';
+import { ThemeToggle } from '@/components/ui/theme-toggle';
+
+function safeReturnPath(value: string | null): string {
+  if (
+    value &&
+    value.startsWith('/') &&
+    !value.startsWith('//') &&
+    (value === '/wizard' || value.startsWith('/home'))
+  ) {
+    return value;
+  }
+  return '/home';
+}
+
+export default function WorkspaceSelectPage() {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const [searchParams] = useSearchParams();
+  const workspaces = useWorkspaceBootstrap();
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(false);
+  const [selectingUuid, setSelectingUuid] = useState<string | null>(null);
+  const returnTo = safeReturnPath(searchParams.get('returnTo'));
+
+  const loadWorkspaces = useCallback(async () => {
+    setLoading(true);
+    setError(false);
+    try {
+      const result = await bootstrapWorkspaceSession({
+        requireExplicitSelection: true,
+      });
+      if (result.status === 'ready') {
+        navigate(returnTo, { replace: true });
+      } else if (result.status === 'unavailable') {
+        setError(true);
+      }
+    } catch {
+      setError(true);
+    } finally {
+      setLoading(false);
+    }
+  }, [navigate, returnTo]);
+
+  useEffect(() => {
+    void loadWorkspaces();
+  }, [loadWorkspaces]);
+
+  async function handleSelect(workspaceUuid: string) {
+    setSelectingUuid(workspaceUuid);
+    setError(false);
+    try {
+      const result = await selectWorkspace(workspaceUuid);
+      if (result.status === 'ready') {
+        navigate(returnTo, { replace: true });
+        return;
+      }
+      setError(true);
+    } catch {
+      setError(true);
+    } finally {
+      setSelectingUuid(null);
+    }
+  }
+
+  function handleLogout() {
+    clearUserInfo();
+    localStorage.removeItem('token');
+    localStorage.removeItem('userEmail');
+    navigate('/login', { replace: true });
+  }
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-gray-50 p-4 dark:bg-neutral-900">
+      <Card className="w-full max-w-xl shadow-lg dark:shadow-white/10">
+        <CardHeader>
+          <div className="mb-5 flex items-center justify-between">
+            <ThemeToggle />
+            <LanguageSelector />
+          </div>
+          <img
+            src={langbotIcon}
+            alt="LangBot"
+            className="mx-auto mb-4 size-16"
+          />
+          <CardTitle
+            className="text-center text-2xl"
+            role="heading"
+            aria-level={1}
+          >
+            {t('workspace.selectTitle')}
+          </CardTitle>
+          <CardDescription className="text-center">
+            {t('workspace.selectDescription')}
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          {loading ? (
+            <div className="flex justify-center py-12">
+              <Loader2 className="size-6 animate-spin" />
+            </div>
+          ) : (
+            <div className="space-y-3">
+              {error && (
+                <div className="flex items-center gap-3 rounded-lg border border-destructive/20 bg-destructive/5 p-3 text-sm text-destructive">
+                  <AlertCircle className="size-4 shrink-0" />
+                  <span>{t('workspace.selectionLoadFailed')}</span>
+                  <Button
+                    type="button"
+                    variant="outline"
+                    size="sm"
+                    className="ml-auto"
+                    onClick={() => void loadWorkspaces()}
+                  >
+                    {t('common.retry')}
+                  </Button>
+                </div>
+              )}
+
+              {workspaces.map((entry) => {
+                const selecting = selectingUuid === entry.workspace.uuid;
+                return (
+                  <button
+                    key={entry.workspace.uuid}
+                    type="button"
+                    className="flex w-full items-center gap-3 rounded-xl border bg-card p-4 text-left transition-colors hover:border-primary/40 hover:bg-accent disabled:cursor-wait disabled:opacity-70"
+                    onClick={() => void handleSelect(entry.workspace.uuid)}
+                    disabled={selectingUuid !== null}
+                  >
+                    <span className="flex size-10 shrink-0 items-center justify-center rounded-lg bg-primary/10 text-primary">
+                      <Building2 className="size-5" />
+                    </span>
+                    <span className="min-w-0 flex-1">
+                      <span className="block truncate font-medium">
+                        {entry.workspace.name}
+                      </span>
+                      <span className="mt-1 flex items-center gap-2 text-xs text-muted-foreground">
+                        <Badge variant="secondary">
+                          {t(`workspace.roles.${entry.membership.role}`)}
+                        </Badge>
+                        <span>
+                          {entry.workspace.type === 'personal'
+                            ? t('workspace.types.personal')
+                            : t('workspace.types.team')}
+                        </span>
+                      </span>
+                    </span>
+                    {selecting ? (
+                      <Loader2 className="size-4 animate-spin" />
+                    ) : (
+                      <ArrowRight className="size-4 text-muted-foreground" />
+                    )}
+                  </button>
+                );
+              })}
+              <Button
+                type="button"
+                variant="ghost"
+                className="w-full"
+                onClick={handleLogout}
+              >
+                {t('common.logout')}
+              </Button>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

web/src/i18n/locales/en-US.ts

@@ -82,7 +82,7 @@ const enUS = {
     loading: 'Loading...',
     fieldRequired: 'This field is required',
     or: 'or',
-    loginWithSpace: 'Login with Space',
+    loginWithSpace: 'Login with LangBot Account',
     spaceLoginRecommended:
       'Recommended: Use official stable model APIs and cloud services',
     loginLocal: 'Login with local account',
@@ -169,6 +169,7 @@ const enUS = {
     actions: 'Actions',
     apiKeyCreatedMessage:
       'Please copy this API key, if the button is invalid, please copy manually.',
+    apiKeyStoredSecurely: 'Secret shown only when created',
     none: 'None',
     more: 'More ({{count}})',
     less: 'Less',
@@ -278,8 +279,12 @@ const enUS = {
     searchProviders: 'Search providers...',
     langbotModelsDescription: 'Cloud models powered by LangBot Space',
     credits: 'Credits',
-    loginWithSpace: 'Login with Space',
+    loginWithSpace: 'Login with LangBot Account',
     loginToUseModels: 'Login with Space to use cloud models',
+    ownerMustBindSpace:
+      'The Workspace owner must connect Space for LangBot Models.',
+    usesOwnerSpaceBilling:
+      "Uses the Workspace owner's Space billing and credits.",
     noModels: 'No models configured',
     langbotModels: 'LangBot Models',
     spaceTrialTooltip:
@@ -949,6 +954,7 @@ const enUS = {
     notFound: 'Plugin information not found',
     sortBy: 'Sort by',
     sort: {
+      hottest: 'Most Popular',
       recentlyAdded: 'Recently Added',
       recentlyUpdated: 'Recently Updated',
       mostDownloads: 'Most Downloads',
@@ -956,6 +962,9 @@ const enUS = {
     },
     downloads: 'downloads',
     download: 'Download',
+    like: 'Like',
+    unlike: 'Unlike',
+    likeFailed: 'Failed to update like. Please try again.',
     repository: 'Repository',
     downloadFailed: 'Download failed',
     noReadme: 'This plugin does not provide README documentation',
@@ -1047,6 +1056,9 @@ const enUS = {
     url: 'URL',
     headers: 'Headers',
     timeout: 'Timeout',
+    toolCallTimeout: 'Tool call timeout (seconds)',
+    toolCallTimeoutDescription:
+      'Maximum wait for one tool call. Set to 0 for no timeout. Defaults to 300 seconds.',
     addArgument: 'Add Argument',
     addEnvVar: 'Add Environment Variable',
     addHeader: 'Add Header',
@@ -1069,6 +1081,9 @@ const enUS = {
     boxStdioRefusedSuggestion:
       'Enable Box (box.enabled = true) and ensure the runtime is healthy, or switch this server to http/sse mode.',
     boxRequired: 'requires Box',
+    disabledByPolicy: 'disabled by policy',
+    stdioDisabledByPolicy:
+      'Stdio MCP is disabled for this deployment. Use a remote MCP server instead.',
     stdioBlockedByBoxToast:
       'Stdio MCP cannot be saved while the Box sandbox is disabled or unreachable. Enable Box or pick http/sse.',
     toolsFound: 'tools',
@@ -1522,7 +1537,96 @@ const enUS = {
       'Invalid bind request. Please try again from account settings.',
     setPasswordHint: 'Set a password to login with email and password',
     spaceEmailMismatch:
-      'Space login email does not match the local account email',
+      'The Space login email does not match the local account email.',
+    space_account_not_registeredTitle: 'Account not registered',
+    space_account_not_registered:
+      'No local account is registered for this Space email. Ask the Workspace owner for an invitation.',
+    space_account_binding_requiredTitle: 'Space connection required',
+    space_account_binding_required:
+      'This local account must connect Space from Account settings before using Space login.',
+  },
+  workspace: {
+    title: 'Workspace',
+    description: 'Manage members, roles, and invitation links',
+    selectTitle: 'Choose a Workspace',
+    selectDescription: 'Select where you want to continue in LangBot.',
+    selectionLoadFailed:
+      'Your Workspaces could not be loaded. Please try again.',
+    switchWorkspace: 'Switch Workspace',
+    settings: 'Workspace Settings',
+    currentPlan: 'Current plan',
+    planUnavailable: 'Unavailable',
+    upgradePlan: 'Change or upgrade plan',
+    ossSingletonDescription:
+      'This self-hosted instance has one Workspace and can include multiple users.',
+    cloudManagedDescription:
+      'This Workspace is hosted by LangBot Cloud. Manage members here; billing opens in Cloud.',
+    loadFailed: 'Failed to load Workspace information',
+    members: 'Members',
+    you: 'You',
+    inviteMember: 'Invite a member',
+    inviteDescription:
+      'Create a one-time link to add another user to this Workspace.',
+    emailPlaceholder: 'member@example.com',
+    createInvitation: 'Create invitation',
+    invitationCreated: 'Invitation created',
+    delivery: {
+      sent: 'Invitation sent',
+      link_only: 'Invitation link created',
+      failed: 'Invitation link created, but email could not be sent',
+    },
+    invitationCreateFailed: 'Failed to create invitation',
+    oneTimeLinkWarning: 'Copy this link now. It is shown only once.',
+    copyInvitation: 'Copy invitation link',
+    invitationCopied: 'Invitation link copied',
+    pendingInvitations: 'Pending invitations',
+    expiresAt: 'Expires {{date}}',
+    revokeInvitation: 'Revoke invitation',
+    invitationRevoked: 'Invitation revoked',
+    invitationRevokeFailed: 'Failed to revoke invitation',
+    acceptInvitation: 'Accept invitation',
+    invitedToWorkspace: 'You were invited to {{workspace}}',
+    checkingInvitation: 'Checking this invitation...',
+    invitationMissing: 'This invitation link is missing required information.',
+    invitationExpired: 'This invitation has expired.',
+    invitationAlreadyRevoked: 'This invitation was revoked.',
+    invitationAlreadyUsed: 'This invitation was already used.',
+    invitationInvalid: 'This invitation is invalid or no longer available.',
+    invitationAccepted: 'Invitation accepted',
+    invitationAcceptFailed: 'Failed to accept invitation',
+    invitationEmailMismatch:
+      'This invitation belongs to a different email address.',
+    existingAccountLoginRequired:
+      'An account already exists for this email. Sign in to continue.',
+    acceptAsCurrentAccount: 'Accept with current account',
+    authenticatedInvitationNotice:
+      'Sign out first, then sign in with the invited account. Your invitation will be preserved.',
+    logoutAndReturn: 'Sign out and return to this invitation',
+    switchAccount: 'Switch account',
+    registerAndAccept: 'Create account and accept',
+    alreadyHaveAccount: 'I already have an account',
+    confirmPassword: 'Confirm password',
+    passwordMinimum: 'Password must contain at least 8 characters.',
+    passwordMismatch: 'The passwords do not match.',
+    backToLogin: 'Back to sign in',
+    memberUpdated: 'Member role updated',
+    memberUpdateFailed: 'Failed to update member role',
+    removeMember: 'Remove member',
+    removeMemberConfirm: 'Remove this member from the Workspace?',
+    memberRemoved: 'Member removed',
+    memberRemoveFailed: 'Failed to remove member',
+    transferOwnership: 'Transfer ownership',
+    types: {
+      personal: 'Personal',
+      team: 'Team',
+    },
+    roles: {
+      owner: 'Owner',
+      admin: 'Admin',
+      developer: 'Developer',
+      operator: 'Operator',
+      viewer: 'Viewer',
+    },
   },
   monitoring: {
     title: 'Dashboard',
@@ -1775,6 +1879,7 @@ const enUS = {
   settingsDialog: {
     title: 'Settings',
     nav: {
+      workspace: 'Workspace',
       models: 'Models',
       api: 'API',
       storage: 'Storage',

web/src/i18n/locales/es-ES.ts

@@ -83,7 +83,7 @@ const esES = {
     loading: 'Cargando...',
     fieldRequired: 'Este campo es obligatorio',
     or: 'o',
-    loginWithSpace: 'Iniciar sesión con Space',
+    loginWithSpace: 'Iniciar sesión con una cuenta de LangBot',
     spaceLoginRecommended:
       'Recomendado: Usa API de modelos oficiales estables y servicios en la nube',
     loginLocal: 'Iniciar sesión con cuenta local',
@@ -286,7 +286,7 @@ const esES = {
     searchProviders: 'Buscar proveedores...',
     langbotModelsDescription: 'Modelos en la nube impulsados por LangBot Space',
     credits: 'Créditos',
-    loginWithSpace: 'Iniciar sesión con Space',
+    loginWithSpace: 'Iniciar sesión con una cuenta de LangBot',
     loginToUseModels: 'Inicia sesión con Space para usar modelos en la nube',
     noModels: 'No hay modelos configurados',
     langbotModels: 'Modelos LangBot',
@@ -771,6 +771,7 @@ const esES = {
     notFound: 'No se encontró la información del plugin',
     sortBy: 'Ordenar por',
     sort: {
+      hottest: 'Más populares',
       recentlyAdded: 'Añadidos recientemente',
       recentlyUpdated: 'Actualizados recientemente',
       mostDownloads: 'Más descargas',
@@ -778,6 +779,9 @@ const esES = {
     },
     downloads: 'descargas',
     download: 'Descargar',
+    like: 'Me gusta',
+    unlike: 'Ya no me gusta',
+    likeFailed: 'No se pudo actualizar el Me gusta. Inténtalo de nuevo.',
     repository: 'Repositorio',
     downloadFailed: 'Error en la descarga',
     noReadme: 'Este plugin no proporciona documentación README',
@@ -870,6 +874,9 @@ const esES = {
     url: 'URL',
     headers: 'Encabezados',
     timeout: 'Tiempo de espera',
+    toolCallTimeout: 'Tiempo de espera de herramienta (segundos)',
+    toolCallTimeoutDescription:
+      'Espera máxima para una llamada de herramienta. Use 0 para no limitar. El valor predeterminado es 300 segundos.',
     addArgument: 'Añadir argumento',
     addEnvVar: 'Añadir variable de entorno',
     addHeader: 'Añadir encabezado',
@@ -892,6 +899,9 @@ const esES = {
     boxStdioRefusedSuggestion:
       'Active Box (box.enabled = true) y asegúrese de que el runtime está conectado, o cambie este servidor a modo http/sse.',
     boxRequired: 'requiere Box',
+    disabledByPolicy: 'desactivado por la política',
+    stdioDisabledByPolicy:
+      'Stdio MCP está deshabilitado en este despliegue. Use un servidor MCP remoto.',
     stdioBlockedByBoxToast:
       'No se puede guardar el MCP en modo stdio mientras el sandbox de Box está desactivado o no disponible. Active Box o seleccione modo http/sse.',
     toolsFound: 'herramientas',

web/src/i18n/locales/ja-JP.ts

@@ -83,7 +83,7 @@ const jaJP = {
     loading: '読み込み中...',
     fieldRequired: 'この項目は必須です',
     or: 'または',
-    loginWithSpace: 'Space でログイン',
+    loginWithSpace: 'LangBot アカウントでログイン',
     spaceLoginRecommended:
       'おすすめ：公式の安定したモデル API とクラウドサービスを利用',
     loginLocal: 'ローカルアカウントでログイン',
@@ -171,6 +171,7 @@ const jaJP = {
     actions: 'アクション',
     apiKeyCreatedMessage:
       'この API キーをコピーしてください。もしボタンが無効な場合は手動でコピーしてください。',
+    apiKeyStoredSecurely: 'シークレットは作成時のみ表示されます',
     none: 'なし',
     more: 'もっと見る ({{count}})',
     less: '折りたたむ',
@@ -283,8 +284,12 @@ const jaJP = {
     searchProviders: 'プロバイダーを検索...',
     langbotModelsDescription: 'LangBot Space が提供するクラウドモデル',
     credits: 'クレジット',
-    loginWithSpace: 'Space でログイン',
+    loginWithSpace: 'LangBot アカウントでログイン',
     loginToUseModels: 'Space でログインしてクラウドモデルを使用',
+    ownerMustBindSpace:
+      'LangBot モデルを使うにはワークスペース所有者が Space を連携する必要があります。',
+    usesOwnerSpaceBilling:
+      'ワークスペース所有者の Space 課金とクレジットを使用します。',
     noModels: 'モデルがありません',
     langbotModels: 'LangBot モデル',
     spaceTrialTooltip:
@@ -963,6 +968,7 @@ const jaJP = {
     notFound: 'プラグイン情報が見つかりません',
     sortBy: '並び順',
     sort: {
+      hottest: '人気順',
       recentlyAdded: '最近追加',
       recentlyUpdated: '最近更新',
       mostDownloads: 'ダウンロード数多',
@@ -970,6 +976,9 @@ const jaJP = {
     },
     downloads: '回ダウンロード',
     download: 'ダウンロード',
+    like: 'いいね',
+    unlike: 'いいねを解除',
+    likeFailed: 'いいねを更新できませんでした。もう一度お試しください。',
     repository: 'リポジトリ',
     downloadFailed: 'ダウンロード失敗',
     noReadme: 'このプラグインはREADMEドキュメントを提供していません',
@@ -1061,6 +1070,9 @@ const jaJP = {
     url: 'URL',
     headers: 'ヘッダー',
     timeout: 'タイムアウト',
+    toolCallTimeout: 'ツール呼び出しタイムアウト（秒）',
+    toolCallTimeoutDescription:
+      '1 回のツール呼び出しの最大待機時間です。0 で無制限、既定値は 300 秒です。',
     addArgument: '引数を追加',
     addEnvVar: '環境変数を追加',
     addHeader: 'ヘッダーを追加',
@@ -1083,6 +1095,9 @@ const jaJP = {
     boxStdioRefusedSuggestion:
       'Box を有効化（box.enabled = true）してランタイムの接続を確認するか、このサーバーを http/sse モードに切り替えてください。',
     boxRequired: 'Box が必要',
+    disabledByPolicy: 'ポリシーにより無効',
+    stdioDisabledByPolicy:
+      'このデプロイでは Stdio MCP が無効です。リモート MCP サーバーを使用してください。',
     stdioBlockedByBoxToast:
       'Box サンドボックスが無効または利用できないため、stdio モードの MCP は保存できません。Box を有効化するか、http/sse モードに切り替えてください。',
     toolsFound: '個のツール',
@@ -1536,6 +1551,91 @@ const jaJP = {
       'パスワードを設定するとメールとパスワードでログインできます',
     spaceEmailMismatch:
       'Spaceログインのメールアドレスがローカルアカウントのメールアドレスと一致しません',
+    space_account_not_registeredTitle: 'アカウントが登録されていません',
+    space_account_not_registered:
+      'この Space メールアドレスのローカルアカウントはありません。ワークスペース所有者に招待を依頼してください。',
+    space_account_binding_requiredTitle: 'Space の連携が必要です',
+    space_account_binding_required:
+      'Space ログインを使用する前に、アカウント設定でこのローカルアカウントを Space に連携してください。',
+  },
+  workspace: {
+    title: 'ワークスペース',
+    description: 'メンバー、ロール、招待リンクを管理します',
+    selectTitle: 'ワークスペースを選択',
+    selectDescription: 'LangBot で使用するワークスペースを選択してください。',
+    selectionLoadFailed:
+      'ワークスペースを読み込めませんでした。もう一度お試しください。',
+    switchWorkspace: 'ワークスペースを切り替え',
+    ossSingletonDescription:
+      'このセルフホストインスタンスには1つのワークスペースがあり、複数のユーザーを追加できます。',
+    cloudManagedDescription:
+      'このワークスペースは LangBot Cloud でホストされています。メンバーはここで管理し、請求は Cloud で開きます。',
+    loadFailed: 'ワークスペース情報の読み込みに失敗しました',
+    members: 'メンバー',
+    you: 'あなた',
+    inviteMember: 'メンバーを招待',
+    inviteDescription:
+      '現在のワークスペースにユーザーを追加する一度限りのリンクを作成します。',
+    emailPlaceholder: 'member@example.com',
+    createInvitation: '招待を作成',
+    invitationCreated: '招待を作成しました',
+    delivery: {
+      sent: '招待メールを送信しました',
+      link_only: '招待リンクを作成しました',
+      failed: '招待リンクを作成しましたが、メールを送信できませんでした',
+    },
+    invitationCreateFailed: '招待の作成に失敗しました',
+    oneTimeLinkWarning:
+      'このリンクを今すぐコピーしてください。一度だけ表示されます。',
+    copyInvitation: '招待リンクをコピー',
+    invitationCopied: '招待リンクをコピーしました',
+    pendingInvitations: '保留中の招待',
+    expiresAt: '{{date}} に期限切れ',
+    revokeInvitation: '招待を取り消す',
+    invitationRevoked: '招待を取り消しました',
+    invitationRevokeFailed: '招待の取り消しに失敗しました',
+    acceptInvitation: '招待を承認',
+    invitedToWorkspace: '{{workspace}} に招待されました',
+    checkingInvitation: '招待を確認しています...',
+    invitationMissing: 'この招待リンクには必要な情報がありません。',
+    invitationExpired: 'この招待は期限切れです。',
+    invitationAlreadyRevoked: 'この招待は取り消されました。',
+    invitationAlreadyUsed: 'この招待はすでに使用されています。',
+    invitationInvalid: 'この招待は無効か、利用できなくなっています。',
+    invitationAccepted: '招待を承認しました',
+    invitationAcceptFailed: '招待の承認に失敗しました',
+    invitationEmailMismatch: 'この招待は別のメールアドレスに送られたものです。',
+    existingAccountLoginRequired:
+      'このメールアドレスのアカウントは既に存在します。ログインしてください。',
+    acceptAsCurrentAccount: '現在のアカウントで承認',
+    authenticatedInvitationNotice:
+      '一度ログアウトし、招待されたアカウントでログインしてください。招待は保持されます。',
+    logoutAndReturn: 'ログアウトしてこの招待に戻る',
+    switchAccount: 'アカウントを切り替える',
+    registerAndAccept: 'アカウントを作成して承認',
+    alreadyHaveAccount: 'アカウントを持っています',
+    confirmPassword: 'パスワードを確認',
+    passwordMinimum: 'パスワードは8文字以上にしてください。',
+    passwordMismatch: 'パスワードが一致しません。',
+    backToLogin: 'ログインに戻る',
+    memberUpdated: 'メンバーのロールを更新しました',
+    memberUpdateFailed: 'メンバーのロール更新に失敗しました',
+    removeMember: 'メンバーを削除',
+    removeMemberConfirm: 'このメンバーをワークスペースから削除しますか？',
+    memberRemoved: 'メンバーを削除しました',
+    memberRemoveFailed: 'メンバーの削除に失敗しました',
+    transferOwnership: '所有権を移譲',
+    types: {
+      personal: '個人',
+      team: 'チーム',
+    },
+    roles: {
+      owner: '所有者',
+      admin: '管理者',
+      developer: '開発者',
+      operator: 'オペレーター',
+      viewer: '閲覧者',
+    },
   },
   monitoring: {
     title: 'ダッシュボード',
@@ -1789,6 +1889,7 @@ const jaJP = {
   settingsDialog: {
     title: '設定',
     nav: {
+      workspace: 'ワークスペース',
       models: 'モデル',
       api: 'API',
       storage: 'ストレージ',

web/src/i18n/locales/ru-RU.ts

@@ -80,7 +80,7 @@ const ruRU = {
     loading: 'Загрузка...',
     fieldRequired: 'Это поле обязательно для заполнения',
     or: 'или',
-    loginWithSpace: 'Войти через Space',
+    loginWithSpace: 'Войти с аккаунтом LangBot',
     spaceLoginRecommended:
       'Рекомендуется: Используйте официальные стабильные API моделей и облачные сервисы',
     loginLocal: 'Войти с локальной учётной записью',
@@ -284,7 +284,7 @@ const ruRU = {
     searchProviders: 'Поиск провайдеров...',
     langbotModelsDescription: 'Облачные модели на базе LangBot Space',
     credits: 'Кредиты',
-    loginWithSpace: 'Войти через Space',
+    loginWithSpace: 'Войти с аккаунтом LangBot',
     loginToUseModels: 'Войдите через Space, чтобы использовать облачные модели',
     noModels: 'Модели не настроены',
     langbotModels: 'Модели LangBot',
@@ -767,6 +767,7 @@ const ruRU = {
     notFound: 'Информация о плагине не найдена',
     sortBy: 'Сортировать по',
     sort: {
+      hottest: 'По популярности',
       recentlyAdded: 'Недавно добавленные',
       recentlyUpdated: 'Недавно обновлённые',
       mostDownloads: 'Больше всего загрузок',
@@ -774,6 +775,9 @@ const ruRU = {
     },
     downloads: 'загрузок',
     download: 'Скачать',
+    like: 'Нравится',
+    unlike: 'Убрать отметку',
+    likeFailed: 'Не удалось обновить отметку. Повторите попытку.',
     repository: 'Репозиторий',
     downloadFailed: 'Ошибка загрузки',
     noReadme: 'Этот плагин не предоставляет документацию README',
@@ -865,6 +869,9 @@ const ruRU = {
     url: 'URL',
     headers: 'Заголовки',
     timeout: 'Таймаут',
+    toolCallTimeout: 'Таймаут вызова инструмента (секунды)',
+    toolCallTimeoutDescription:
+      'Максимальное ожидание одного вызова. 0 отключает ограничение. По умолчанию 300 секунд.',
     addArgument: 'Добавить аргумент',
     addEnvVar: 'Добавить переменную окружения',
     addHeader: 'Добавить заголовок',
@@ -887,6 +894,9 @@ const ruRU = {
     boxStdioRefusedSuggestion:
       'Включите Box (box.enabled = true) и убедитесь, что среда работает, либо переключите этот сервер в режим http/sse.',
     boxRequired: 'требуется Box',
+    disabledByPolicy: 'отключено политикой',
+    stdioDisabledByPolicy:
+      'Stdio MCP отключён в этом развёртывании. Используйте удалённый MCP-сервер.',
     stdioBlockedByBoxToast:
       'Сохранить MCP в режиме stdio нельзя: песочница Box отключена или недоступна. Включите Box либо выберите режим http/sse.',
     toolsFound: 'инструментов',

web/src/i18n/locales/th-TH.ts

@@ -80,7 +80,7 @@ const thTH = {
     loading: 'กำลังโหลด...',
     fieldRequired: 'ช่องนี้จำเป็นต้องกรอก',
     or: 'หรือ',
-    loginWithSpace: 'เข้าสู่ระบบด้วย Space',
+    loginWithSpace: 'เข้าสู่ระบบด้วยบัญชี LangBot',
     spaceLoginRecommended:
       'แนะนำ: ใช้ API โมเดลที่เสถียรอย่างเป็นทางการและบริการคลาวด์',
     loginLocal: 'เข้าสู่ระบบด้วยบัญชีท้องถิ่น',
@@ -273,7 +273,7 @@ const thTH = {
     searchProviders: 'ค้นหาผู้ให้บริการ...',
     langbotModelsDescription: 'โมเดลคลาวด์ขับเคลื่อนโดย LangBot Space',
     credits: 'เครดิต',
-    loginWithSpace: 'เข้าสู่ระบบด้วย Space',
+    loginWithSpace: 'เข้าสู่ระบบด้วยบัญชี LangBot',
     loginToUseModels: 'เข้าสู่ระบบด้วย Space เพื่อใช้โมเดลคลาวด์',
     noModels: 'ยังไม่มีโมเดลที่กำหนดค่า',
     langbotModels: 'โมเดล LangBot',
@@ -746,6 +746,7 @@ const thTH = {
     notFound: 'ไม่พบข้อมูลปลั๊กอิน',
     sortBy: 'เรียงตาม',
     sort: {
+      hottest: 'ยอดนิยมที่สุด',
       recentlyAdded: 'เพิ่มล่าสุด',
       recentlyUpdated: 'อัปเดตล่าสุด',
       mostDownloads: 'ดาวน์โหลดมากที่สุด',
@@ -753,6 +754,9 @@ const thTH = {
     },
     downloads: 'ดาวน์โหลด',
     download: 'ดาวน์โหลด',
+    like: 'ถูกใจ',
+    unlike: 'เลิกถูกใจ',
+    likeFailed: 'อัปเดตการถูกใจไม่สำเร็จ โปรดลองอีกครั้ง',
     repository: 'Repository',
     downloadFailed: 'ดาวน์โหลดล้มเหลว',
     noReadme: 'ปลั๊กอินนี้ไม่มีเอกสาร README',
@@ -843,6 +847,9 @@ const thTH = {
     url: 'URL',
     headers: 'ส่วนหัว',
     timeout: 'หมดเวลา',
+    toolCallTimeout: 'หมดเวลาการเรียกเครื่องมือ (วินาที)',
+    toolCallTimeoutDescription:
+      'เวลารอสูงสุดต่อการเรียกเครื่องมือหนึ่งครั้ง ตั้งเป็น 0 เพื่อไม่จำกัด ค่าเริ่มต้นคือ 300 วินาที',
     addArgument: 'เพิ่มอาร์กิวเมนต์',
     addEnvVar: 'เพิ่มตัวแปรสภาพแวดล้อม',
     addHeader: 'เพิ่มส่วนหัว',
@@ -865,6 +872,9 @@ const thTH = {
     boxStdioRefusedSuggestion:
       'กรุณาเปิดใช้งาน Box (box.enabled = true) และตรวจสอบว่ารันไทม์ทำงานปกติ หรือเปลี่ยน MCP server เป็นโหมด http/sse',
     boxRequired: 'ต้องใช้ Box',
+    disabledByPolicy: 'ถูกปิดใช้งานโดยนโยบาย',
+    stdioDisabledByPolicy:
+      'การติดตั้งใช้งานนี้ปิด Stdio MCP อยู่ โปรดใช้เซิร์ฟเวอร์ MCP แบบระยะไกล',
     stdioBlockedByBoxToast:
       'ไม่สามารถบันทึก MCP โหมด stdio เนื่องจาก Sandbox Box ถูกปิดใช้งานหรือไม่พร้อมใช้งาน กรุณาเปิดใช้งาน Box หรือเลือกโหมด http/sse',
     toolsFound: 'เครื่องมือ',

web/src/i18n/locales/vi-VN.ts

@@ -81,7 +81,7 @@ const viVN = {
     loading: 'Đang tải...',
     fieldRequired: 'Trường này là bắt buộc',
     or: 'hoặc',
-    loginWithSpace: 'Đăng nhập với Space',
+    loginWithSpace: 'Đăng nhập bằng tài khoản LangBot',
     spaceLoginRecommended:
       'Khuyến nghị: Sử dụng API mô hình ổn định chính thức và dịch vụ đám mây',
     loginLocal: 'Đăng nhập với tài khoản cục bộ',
@@ -281,7 +281,7 @@ const viVN = {
     searchProviders: 'Tìm kiếm nhà cung cấp...',
     langbotModelsDescription: 'Mô hình đám mây được cung cấp bởi LangBot Space',
     credits: 'Tín dụng',
-    loginWithSpace: 'Đăng nhập với Space',
+    loginWithSpace: 'Đăng nhập bằng tài khoản LangBot',
     loginToUseModels: 'Đăng nhập với Space để sử dụng mô hình đám mây',
     noModels: 'Chưa cấu hình mô hình nào',
     langbotModels: 'Mô hình LangBot',
@@ -761,6 +761,7 @@ const viVN = {
     notFound: 'Không tìm thấy thông tin plugin',
     sortBy: 'Sắp xếp theo',
     sort: {
+      hottest: 'Phổ biến nhất',
       recentlyAdded: 'Mới thêm gần đây',
       recentlyUpdated: 'Mới cập nhật gần đây',
       mostDownloads: 'Tải nhiều nhất',
@@ -768,6 +769,9 @@ const viVN = {
     },
     downloads: 'lượt tải',
     download: 'Tải xuống',
+    like: 'Thích',
+    unlike: 'Bỏ thích',
+    likeFailed: 'Không thể cập nhật lượt thích. Vui lòng thử lại.',
     repository: 'Kho lưu trữ',
     downloadFailed: 'Tải xuống thất bại',
     noReadme: 'Plugin này không cung cấp tài liệu README',
@@ -858,6 +862,9 @@ const viVN = {
     url: 'URL',
     headers: 'Tiêu đề',
     timeout: 'Thời gian chờ',
+    toolCallTimeout: 'Thời gian chờ gọi công cụ (giây)',
+    toolCallTimeoutDescription:
+      'Thời gian chờ tối đa cho một lần gọi công cụ. Đặt 0 để không giới hạn. Mặc định là 300 giây.',
     addArgument: 'Thêm tham số',
     addEnvVar: 'Thêm biến môi trường',
     addHeader: 'Thêm tiêu đề',
@@ -880,6 +887,9 @@ const viVN = {
     boxStdioRefusedSuggestion:
       'Hãy bật Box (box.enabled = true) và đảm bảo runtime hoạt động, hoặc chuyển server này sang chế độ http/sse.',
     boxRequired: 'cần Box',
+    disabledByPolicy: 'bị tắt theo chính sách',
+    stdioDisabledByPolicy:
+      'Stdio MCP đã bị tắt trong bản triển khai này. Hãy dùng máy chủ MCP từ xa.',
     stdioBlockedByBoxToast:
       'Không thể lưu MCP ở chế độ stdio khi Sandbox Box bị tắt hoặc không khả dụng. Hãy bật Box hoặc chọn chế độ http/sse.',
     toolsFound: 'công cụ',

web/src/i18n/locales/zh-Hans.ts

@@ -81,7 +81,7 @@ const zhHans = {
     loading: '加载中...',
     fieldRequired: '此字段为必填项',
     or: '或',
-    loginWithSpace: '通过 Space 登录',
+    loginWithSpace: '使用 LangBot 账号登录',
     spaceLoginRecommended: '推荐：使用官方提供的稳定模型 API 和云服务',
     loginLocal: '使用本地账号登录',
     loginWithPassword: '通过密码登录',
@@ -158,6 +158,7 @@ const zhHans = {
     webhookHint: 'Webhook 允许 LangBot 将个人消息和群消息事件推送到外部系统',
     actions: '操作',
     apiKeyCreatedMessage: '请复制此 API 密钥，若按钮无效，请手动复制。',
+    apiKeyStoredSecurely: '密钥仅在创建时显示',
     none: '无',
     more: '更多 ({{count}})',
     less: '收起',
@@ -266,8 +267,10 @@ const zhHans = {
     searchProviders: '搜索供应商...',
     langbotModelsDescription: 'LangBot Space 提供的云端模型',
     credits: '积分',
-    loginWithSpace: '通过 Space 登录',
+    loginWithSpace: '使用 LangBot 账号登录',
     loginToUseModels: '通过 Space 登录以使用云端模型',
+    ownerMustBindSpace: '工作区所有者需要绑定 Space 才能使用 LangBot 模型。',
+    usesOwnerSpaceBilling: '使用工作区所有者的 Space 计费与积分。',
     noModels: '暂无模型',
     langbotModels: 'LangBot 模型',
     spaceTrialTooltip:
@@ -906,6 +909,7 @@ const zhHans = {
     notFound: '插件信息未找到',
     sortBy: '排序方式',
     sort: {
+      hottest: '热度最高',
       recentlyAdded: '最近新增',
       recentlyUpdated: '最近更新',
       mostDownloads: '最多下载',
@@ -913,6 +917,9 @@ const zhHans = {
     },
     downloads: '次下载',
     download: '下载',
+    like: '点赞',
+    unlike: '取消点赞',
+    likeFailed: '点赞失败，请稍后重试',
     repository: '代码仓库',
     downloadFailed: '下载失败',
     noReadme: '该插件没有提供 README 文档',
@@ -1002,6 +1009,9 @@ const zhHans = {
     url: 'URL地址',
     headers: '请求头',
     timeout: '超时时间',
+    toolCallTimeout: '工具调用超时（秒）',
+    toolCallTimeoutDescription:
+      '单次工具调用的最长等待时间。设为 0 表示不限制，默认 300 秒。',
     addArgument: '添加参数',
     addEnvVar: '添加环境变量',
     addHeader: '添加请求头',
@@ -1024,6 +1034,8 @@ const zhHans = {
     boxStdioRefusedSuggestion:
       '请启用 Box（box.enabled = true）并确认运行时连接正常，或将此服务器切换到 http/sse 模式。',
     boxRequired: '需要 Box',
+    disabledByPolicy: '已被策略禁用',
+    stdioDisabledByPolicy: '此部署已禁用 Stdio MCP，请改用远程 MCP 服务器。',
     stdioBlockedByBoxToast:
       'Box 沙箱已禁用或不可用，无法保存 stdio 模式的 MCP。请启用 Box 或改为 http/sse 模式。',
     toolsFound: '个工具',
@@ -1449,6 +1461,91 @@ const zhHans = {
     bindSpaceInvalidState: '无效的绑定请求，请从账户设置重新发起',
     setPasswordHint: '设置密码后可使用邮箱密码登录',
     spaceEmailMismatch: 'Space登录账号邮箱与本实例账号邮箱不匹配',
+    space_account_not_registeredTitle: '账户尚未注册',
+    space_account_not_registered:
+      '此 Space 邮箱尚无本地账户，请联系工作区所有者获取邀请。',
+    space_account_binding_requiredTitle: '需要绑定 Space',
+    space_account_binding_required:
+      '此本地账户必须先在账户设置中绑定 Space，才能使用 Space 登录。',
+  },
+  workspace: {
+    title: '工作区',
+    description: '管理成员、角色与邀请链接',
+    selectTitle: '选择工作区',
+    selectDescription: '选择你要进入的 LangBot 工作区。',
+    selectionLoadFailed: '无法加载你的工作区，请重试。',
+    switchWorkspace: '切换工作区',
+    settings: '工作区设置',
+    currentPlan: '当前计划',
+    planUnavailable: '暂不可用',
+    upgradePlan: '切换或升级计划',
+    ossSingletonDescription:
+      '当前自托管实例只有一个工作区，但可以包含多个用户。',
+    cloudManagedDescription:
+      '此工作区托管于 LangBot Cloud。成员在此管理，计费在 Cloud 中打开。',
+    loadFailed: '加载工作区信息失败',
+    members: '成员',
+    you: '你',
+    inviteMember: '邀请成员',
+    inviteDescription: '创建一次性链接，将其他用户加入当前工作区。',
+    emailPlaceholder: 'member@example.com',
+    createInvitation: '创建邀请',
+    invitationCreated: '邀请已创建',
+    delivery: {
+      sent: '邀请邮件已发送',
+      link_only: '邀请链接已创建',
+      failed: '邀请链接已创建，但邮件发送失败',
+    },
+    invitationCreateFailed: '创建邀请失败',
+    oneTimeLinkWarning: '请立即复制此链接。它只显示一次。',
+    copyInvitation: '复制邀请链接',
+    invitationCopied: '邀请链接已复制',
+    pendingInvitations: '待接受邀请',
+    expiresAt: '{{date}} 过期',
+    revokeInvitation: '撤销邀请',
+    invitationRevoked: '邀请已撤销',
+    invitationRevokeFailed: '撤销邀请失败',
+    acceptInvitation: '接受邀请',
+    invitedToWorkspace: '你已受邀加入 {{workspace}}',
+    checkingInvitation: '正在验证邀请…',
+    invitationMissing: '此邀请链接缺少必要信息。',
+    invitationExpired: '此邀请已过期。',
+    invitationAlreadyRevoked: '此邀请已被撤销。',
+    invitationAlreadyUsed: '此邀请已被使用。',
+    invitationInvalid: '此邀请无效或已不可用。',
+    invitationAccepted: '已接受邀请',
+    invitationAcceptFailed: '接受邀请失败',
+    invitationEmailMismatch: '此邀请属于另一个邮箱地址。',
+    existingAccountLoginRequired: '此邮箱已有账户，请登录后继续。',
+    acceptAsCurrentAccount: '使用当前账户接受',
+    authenticatedInvitationNotice:
+      '请先退出，再使用受邀账户登录。邀请令牌会被保留。',
+    logoutAndReturn: '退出并返回此邀请',
+    switchAccount: '切换账号',
+    registerAndAccept: '创建账户并接受',
+    alreadyHaveAccount: '我已有账户',
+    confirmPassword: '确认密码',
+    passwordMinimum: '密码至少需要 8 个字符。',
+    passwordMismatch: '两次输入的密码不一致。',
+    backToLogin: '返回登录',
+    memberUpdated: '成员角色已更新',
+    memberUpdateFailed: '更新成员角色失败',
+    removeMember: '移除成员',
+    removeMemberConfirm: '确定将此成员移出工作区吗？',
+    memberRemoved: '成员已移除',
+    memberRemoveFailed: '移除成员失败',
+    transferOwnership: '转让所有权',
+    types: {
+      personal: '个人',
+      team: '团队',
+    },
+    roles: {
+      owner: '所有者',
+      admin: '管理员',
+      developer: '开发者',
+      operator: '运维人员',
+      viewer: '查看者',
+    },
   },
   monitoring: {
     title: '仪表盘',
@@ -1700,6 +1797,7 @@ const zhHans = {
   settingsDialog: {
     title: '设置',
     nav: {
+      workspace: '工作区',
       models: '模型',
       api: 'API',
       storage: '存储',

web/src/i18n/locales/zh-Hant.ts

@@ -79,7 +79,7 @@ const zhHant = {
     loading: '載入中...',
     fieldRequired: '此欄位為必填',
     or: '或',
-    loginWithSpace: '透過 Space 登入',
+    loginWithSpace: '使用 LangBot 帳號登入',
     spaceLoginRecommended: '推薦：使用官方提供的穩定模型 API 和雲服務',
     loginLocal: '使用本地帳號登入',
     loginWithPassword: '透過密碼登入',
@@ -263,7 +263,7 @@ const zhHant = {
     searchProviders: '搜尋供應商...',
     langbotModelsDescription: '由 LangBot Space 提供的雲端模型',
     credits: '積分',
-    loginWithSpace: '使用 Space 登入',
+    loginWithSpace: '使用 LangBot 帳號登入',
     loginToUseModels: '使用 Space 登入以使用雲端模型',
     noModels: '暫無模型',
     langbotModels: 'LangBot 模型',
@@ -721,6 +721,7 @@ const zhHant = {
     notFound: '插件資訊未找到',
     sortBy: '排序方式',
     sort: {
+      hottest: '熱度最高',
       recentlyAdded: '最近新增',
       recentlyUpdated: '最近更新',
       mostDownloads: '最多下載',
@@ -728,6 +729,9 @@ const zhHant = {
     },
     downloads: '次下載',
     download: '下載',
+    like: '按讚',
+    unlike: '取消按讚',
+    likeFailed: '按讚失敗，請稍後重試',
     repository: '代碼倉庫',
     downloadFailed: '下載失敗',
     noReadme: '該插件沒有提供 README 文件',
@@ -816,6 +820,9 @@ const zhHant = {
     url: 'URL位址',
     headers: '請求標頭',
     timeout: '逾時時間',
+    toolCallTimeout: '工具呼叫逾時（秒）',
+    toolCallTimeoutDescription:
+      '單次工具呼叫的最長等待時間。設為 0 表示不限制，預設 300 秒。',
     addArgument: '新增參數',
     addEnvVar: '新增環境變數',
     addHeader: '新增請求標頭',
@@ -838,6 +845,8 @@ const zhHant = {
     boxStdioRefusedSuggestion:
       '請啟用 Box（box.enabled = true）並確認執行時連線正常，或將此伺服器切換到 http/sse 模式。',
     boxRequired: '需要 Box',
+    disabledByPolicy: '已被策略停用',
+    stdioDisabledByPolicy: '此部署已停用 Stdio MCP，請改用遠端 MCP 伺服器。',
     stdioBlockedByBoxToast:
       'Box 沙箱已停用或無法使用，無法儲存 stdio 模式的 MCP。請啟用 Box 或改為 http/sse 模式。',
     toolsFound: '個工具',

web/src/router.tsx

@@ -27,6 +27,8 @@ import ErrorPage from '@/components/ErrorPage';
 import BackendUnavailablePage from '@/components/BackendUnavailablePage';
 import PluginPagesPage from '@/app/home/plugin-pages/page';
 import RootLayout from '@/app/RootLayout';
+import AcceptInvitationPage from '@/app/invitations/accept/page';
+import WorkspaceSelectPage from '@/app/workspaces/select/page';
 
 const Loading = () => <div>Loading...</div>;
 
@@ -63,6 +65,14 @@ export const router = createBrowserRouter([
           </ResetPasswordLayout>
         ),
       },
+      {
+        path: '/invitations/accept',
+        element: <AcceptInvitationPage />,
+      },
+      {
+        path: '/workspaces/select',
+        element: <WorkspaceSelectPage />,
+      },
       {
         path: '/wizard',
         element: <WizardPage />,

web/tests/e2e/crud-smoke.spec.ts

@@ -1,6 +1,9 @@
 import { expect, Page, test } from '@playwright/test';
 
-import { installLangBotApiMocks } from './fixtures/langbot-api';
+import {
+  installLangBotApiMocks,
+  makeWorkspaceEntry,
+} from './fixtures/langbot-api';
 
 async function save(page: Page) {
   const button = page.getByRole('button', { name: /^Save$/ });
@@ -66,6 +69,61 @@ async function forceFormSubmit(page: Page, formSelector: string) {
 }
 
 test.describe('frontend CRUD smoke flows', () => {
+  test('viewer keeps ordinary bot and pipeline monitoring access', async ({
+    page,
+  }) => {
+    const workspace = makeWorkspaceEntry(
+      'workspace-viewer',
+      'Viewer Workspace',
+      'local',
+    );
+    await installLangBotApiMocks(page, {
+      authenticated: true,
+      workspaces: [workspace],
+    });
+
+    await page.goto('/home/bots?id=new');
+    await page.locator('input[name="name"]').fill('Viewer Test Bot');
+    await page
+      .locator('input[name="description"]')
+      .fill('Proves monitoring is ordinary resource visibility.');
+    await page.getByRole('combobox').click();
+    await page.getByRole('option', { name: 'Playwright Adapter' }).click();
+    await submit(page);
+    await expect(page).toHaveURL(/\/home\/bots\?id=bot-1$/);
+
+    await page.goto('/home/pipelines?id=new');
+    await page.locator('input[name="basic.name"]').fill('Viewer Pipeline');
+    await page
+      .locator('input[name="basic.description"]')
+      .fill('Viewer monitoring permission regression.');
+    await submit(page);
+    await expect(page).toHaveURL(/\/home\/pipelines\?id=pipeline-1$/);
+
+    workspace.membership.role = 'viewer';
+    workspace.permissions = ['member.view', 'resource.view', 'workspace.view'];
+
+    await page.goto('/home/bots?id=bot-1');
+    await expect(page.getByRole('tab', { name: 'Logs' })).toBeVisible();
+    await expect(page.getByRole('tab', { name: 'Sessions' })).toBeVisible();
+    await expect(page.getByRole('button', { name: /^Save$/ })).toHaveCount(0);
+    await page.getByRole('tab', { name: 'Logs' }).click();
+    await expect(page.getByText('No logs yet')).toBeVisible();
+
+    await page.goto('/home/pipelines?id=pipeline-1');
+    await expect(page.getByRole('tab', { name: 'Dashboard' })).toBeVisible();
+    await expect(page.getByRole('tab', { name: 'Debug Chat' })).toHaveCount(0);
+    await expect(page.getByRole('button', { name: /^Save$/ })).toHaveCount(0);
+
+    await page.goto('/home/monitoring');
+    await expect(
+      page.getByRole('button', { name: 'Refresh Data' }),
+    ).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Export Data' })).toHaveCount(
+      0,
+    );
+  });
+
   test('creates, edits, and deletes a bot', async ({ page }) => {
     await installLangBotApiMocks(page, { authenticated: true });
 

web/tests/e2e/fixtures/langbot-api.ts

@@ -21,29 +21,6 @@ interface PipelineMock {
   updated_at: string;
 }
 
-interface AgentMock {
-  uuid: string;
-  name: string;
-  description: string;
-  emoji: string;
-  kind: 'agent';
-  component_ref: string;
-  config: JsonRecord;
-  enabled: boolean;
-  supported_event_patterns: string[];
-  updated_at: string;
-}
-
-interface ToolMock {
-  name: string;
-  description: string;
-  human_desc: string;
-  parameters: JsonRecord;
-  source: 'builtin' | 'plugin' | 'mcp' | 'skill';
-  source_name?: string;
-  source_id?: string;
-}
-
 interface KnowledgeBaseMock {
   uuid: string;
   name: string;
@@ -87,12 +64,35 @@ interface BotMock {
   use_pipeline_uuid?: string;
   pipeline_routing_rules: unknown[];
   adapter_runtime_values: JsonRecord;
-  event_bindings: unknown[];
   updated_at: string;
 }
 
+export interface WorkspaceEntryMock {
+  workspace: {
+    uuid: string;
+    instance_uuid: string;
+    name: string;
+    slug: string;
+    type: 'personal' | 'team';
+    status: 'active';
+    source: 'local' | 'cloud_projection';
+  };
+  membership: {
+    uuid: string;
+    workspace_uuid: string;
+    account_uuid: string;
+    email: string;
+    role: 'owner' | 'admin' | 'developer' | 'operator' | 'viewer';
+    status: 'active';
+    joined_at: string;
+    created_at: string;
+  };
+  permissions: string[];
+  placement_generation: number;
+}
+
 interface LangBotApiMockState {
-  agents: AgentMock[];
+  authenticated: boolean;
   bots: BotMock[];
   counters: Record<string, number>;
   knowledgeBases: KnowledgeBaseMock[];
@@ -103,8 +103,8 @@ interface LangBotApiMockState {
   sessionAnalyses: Record<string, unknown>;
   sessionMessages: Record<string, unknown[]>;
   skills: SkillMock[];
-  tools: ToolMock[];
   withRunnerToolSelector: boolean;
+  workspaces: WorkspaceEntryMock[];
 }
 
 function ok(data: unknown) {
@@ -136,6 +136,59 @@ function now() {
   return new Date().toISOString();
 }
 
+export function makeWorkspaceEntry(
+  uuid: string,
+  name: string,
+  source: 'local' | 'cloud_projection' = 'cloud_projection',
+): WorkspaceEntryMock {
+  const createdAt = now();
+  return {
+    workspace: {
+      uuid,
+      instance_uuid: 'instance-playwright',
+      name,
+      slug: uuid,
+      type: 'team',
+      status: 'active',
+      source,
+    },
+    membership: {
+      uuid: `membership-${uuid}`,
+      workspace_uuid: uuid,
+      account_uuid: 'account-playwright',
+      email: 'admin@example.com',
+      role: 'owner',
+      status: 'active',
+      joined_at: createdAt,
+      created_at: createdAt,
+    },
+    permissions: [
+      'api_key.manage',
+      'audit.view',
+      'data.export',
+      'member.invite',
+      'member.remove',
+      'member.update_role',
+      'member.view',
+      'owner.transfer',
+      'provider_secret.manage',
+      'resource.manage',
+      'resource.view',
+      'runtime.operate',
+      'workspace.view',
+    ],
+    placement_generation: 1,
+  };
+}
+
+function defaultWorkspaceEntry(): WorkspaceEntryMock {
+  return makeWorkspaceEntry(
+    'workspace-playwright',
+    'Playwright Workspace',
+    'local',
+  );
+}
+
 function nextId(state: LangBotApiMockState, prefix: string) {
   state.counters[prefix] = (state.counters[prefix] || 0) + 1;
   return `${prefix}-${state.counters[prefix]}`;
@@ -210,20 +263,7 @@ function makePipeline(
     name: String(data.name || ''),
     description: String(data.description || ''),
     config: (data.config as JsonRecord | undefined) || {
-      ai: {
-        runner: {
-          id: 'plugin:langbot-team/LocalAgent/default',
-          'expire-time': 0,
-        },
-        runner_config: {
-          'plugin:langbot-team/LocalAgent/default': {
-            model: {
-              primary: 'llm-valid',
-              fallbacks: [],
-            },
-          },
-        },
-      },
+      ai: {},
       trigger: {},
       safety: {},
       output: {},
@@ -234,40 +274,6 @@ function makePipeline(
   };
 }
 
-function makeAgent(data: JsonRecord, uuid: string): AgentMock {
-  return {
-    uuid,
-    name: String(data.name || uuid),
-    description: String(data.description || ''),
-    emoji: String(data.emoji || '🤖'),
-    kind: 'agent',
-    component_ref: String(
-      data.component_ref || 'plugin:langbot-team/LocalAgent/default',
-    ),
-    config: (data.config as JsonRecord | undefined) || {
-      runner: {
-        id: 'plugin:langbot-team/LocalAgent/default',
-        'expire-time': 0,
-      },
-      runner_config: {
-        'plugin:langbot-team/LocalAgent/default': {
-          model: {
-            primary: 'llm-valid',
-            fallbacks: [],
-          },
-          'enable-all-tools': false,
-          tools: ['unavailable_plugin_tool'],
-        },
-      },
-    },
-    enabled: data.enabled !== false,
-    supported_event_patterns: (data.supported_event_patterns as
-      | string[]
-      | undefined) || ['*'],
-    updated_at: now(),
-  };
-}
-
 function pipelineMetadata(withRunnerToolSelector = false) {
   return {
     configs: [
@@ -286,21 +292,21 @@ function pipelineMetadata(withRunnerToolSelector = false) {
             },
             config: [
               {
-                id: 'runner.id',
-                name: 'id',
+                id: 'runner',
+                name: 'runner',
                 label: {
                   en_US: 'Runner',
                   zh_Hans: '运行器',
                 },
                 type: 'select',
                 required: true,
-                default: 'plugin:langbot-team/LocalAgent/default',
+                default: 'local-agent',
                 options: [
                   {
-                    name: 'plugin:langbot-team/LocalAgent/default',
+                    name: 'local-agent',
                     label: {
-                      en_US: 'Local Agent',
-                      zh_Hans: '本地 Agent',
+                      en_US: 'Built-in Agent',
+                      zh_Hans: '内置 Agent',
                     },
                   },
                 ],
@@ -308,14 +314,14 @@ function pipelineMetadata(withRunnerToolSelector = false) {
             ],
           },
           {
-            name: 'plugin:langbot-team/LocalAgent/default',
+            name: 'local-agent',
             label: {
-              en_US: 'Local Agent',
-              zh_Hans: '本地 Agent',
+              en_US: 'Built-in Agent',
+              zh_Hans: '内置 Agent',
             },
             config: [
               {
-                id: 'plugin:langbot-team/LocalAgent/default.model',
+                id: 'model',
                 name: 'model',
                 label: {
                   en_US: 'Model',
@@ -351,19 +357,6 @@ function pipelineMetadata(withRunnerToolSelector = false) {
   };
 }
 
-function agentMetadata() {
-  return {
-    runner_config: pipelineMetadata(true).configs[0],
-    kinds: [
-      {
-        name: 'agent',
-        supported_event_patterns: ['*'],
-        message_only: false,
-      },
-    ],
-  };
-}
-
 function providerModelList() {
   return {
     models: [
@@ -468,7 +461,6 @@ function makeBot(
       : undefined,
     pipeline_routing_rules:
       (data.pipeline_routing_rules as unknown[] | undefined) || [],
-    event_bindings: (data.event_bindings as unknown[] | undefined) || [],
     adapter_runtime_values: {
       webhook_full_url: `https://playwright.test/bots/${uuid}/webhook`,
       extra_webhook_full_url: '',
@@ -526,21 +518,33 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
   if (path === '/api/v1/user/account-info') {
     return fulfillJson(route, {
       initialized: true,
-      account_type: 'local',
-      has_password: true,
+      password_login_enabled: true,
+      space_login_enabled: false,
     });
   }
 
   if (path === '/api/v1/user/check-token') {
-    return fulfillJson(route, { token: '' });
+    return fulfillJson(route, {
+      token: state.authenticated ? 'playwright-token' : '',
+    });
   }
 
   if (path === '/api/v1/user/auth') {
+    state.authenticated = true;
     return fulfillJson(route, { token: 'playwright-token' });
   }
 
+  if (path === '/api/v1/user/space/callback') {
+    state.authenticated = true;
+    return fulfillJson(route, {
+      token: 'playwright-space-token',
+      user: 'admin@example.com',
+    });
+  }
+
   if (path === '/api/v1/user/info') {
     return fulfillJson(route, {
+      account_uuid: 'account-playwright',
       user: 'admin@example.com',
       account_type: 'local',
       has_password: true,
@@ -551,6 +555,24 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
     return fulfillJson(route, { credits: null });
   }
 
+  if (path === '/api/v1/workspaces/bootstrap') {
+    return fulfillJson(route, { workspaces: state.workspaces });
+  }
+
+  if (path === '/api/v1/workspaces/current') {
+    const selectedWorkspaceUuid = request.headers()['x-workspace-id'];
+    const entry = state.workspaces.find(
+      (item) => item.workspace.uuid === selectedWorkspaceUuid,
+    );
+    return fulfillJson(route, entry || state.workspaces[0]);
+  }
+
+  if (path === '/api/v1/workspaces') {
+    return fulfillJson(route, {
+      workspaces: state.workspaces.map((entry) => entry.workspace),
+    });
+  }
+
   if (path === '/api/v1/platform/adapters') {
     return fulfillJson(route, { adapters: mockAdapters() });
   }
@@ -570,7 +592,7 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
 
   const botLogsMatch = path.match(/^\/api\/v1\/platform\/bots\/([^/]+)\/logs$/);
   if (botLogsMatch) {
-    return fulfillJson(route, { logs: [], total: 0 });
+    return fulfillJson(route, { logs: [], total_count: 0 });
   }
 
   const botMatch = path.match(/^\/api\/v1\/platform\/bots\/([^/]+)$/);
@@ -606,88 +628,6 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
     return fulfillJson(route, { models: [] });
   }
 
-  if (path === '/api/v1/agents/_/metadata') {
-    return fulfillJson(route, agentMetadata());
-  }
-
-  if (path === '/api/v1/agents') {
-    if (method === 'POST') {
-      const data = parseJsonBody(route);
-      if (data.kind === 'pipeline') {
-        const pipeline = makePipeline(state, data);
-        state.pipelines = [
-          ...state.pipelines.filter((item) => item.uuid !== pipeline.uuid),
-          pipeline,
-        ];
-        return fulfillJson(route, { uuid: pipeline.uuid, kind: 'pipeline' });
-      }
-
-      const agentId = nextId(state, 'agent');
-      const agent = makeAgent(data, agentId);
-      state.agents = [
-        ...state.agents.filter((item) => item.uuid !== agentId),
-        agent,
-      ];
-      return fulfillJson(route, { uuid: agentId, kind: 'agent' });
-    }
-
-    return fulfillJson(route, {
-      agents: [
-        ...state.agents,
-        ...state.pipelines.map((pipeline) => ({
-          ...pipeline,
-          kind: 'pipeline',
-          component_ref: 'pipeline',
-          enabled: true,
-          supported_event_patterns: ['message.*'],
-        })),
-      ],
-    });
-  }
-
-  const agentMatch = path.match(/^\/api\/v1\/agents\/([^/]+)$/);
-  if (agentMatch) {
-    const agentId = decodeURIComponent(agentMatch[1]);
-
-    if (method === 'PUT') {
-      const agent = makeAgent(parseJsonBody(route), agentId);
-      state.agents = [
-        ...state.agents.filter((item) => item.uuid !== agentId),
-        agent,
-      ];
-      return fulfillJson(route, {});
-    }
-
-    if (method === 'DELETE') {
-      state.agents = state.agents.filter((item) => item.uuid !== agentId);
-      return fulfillJson(route, {});
-    }
-
-    if (agentId.startsWith('pipeline-')) {
-      let pipeline = state.pipelines.find((item) => item.uuid === agentId);
-      if (!pipeline) {
-        pipeline = makePipeline(state, { name: agentId }, agentId);
-        state.pipelines = [...state.pipelines, pipeline];
-      }
-      return fulfillJson(route, {
-        agent: {
-          ...pipeline,
-          kind: 'pipeline',
-          component_ref: 'pipeline',
-          enabled: true,
-          supported_event_patterns: ['message.*'],
-        },
-      });
-    }
-
-    let agent = state.agents.find((item) => item.uuid === agentId);
-    if (!agent) {
-      agent = makeAgent({ name: agentId }, agentId);
-      state.agents = [...state.agents, agent];
-    }
-    return fulfillJson(route, { agent });
-  }
-
   if (path === '/api/v1/pipelines/_/metadata') {
     return fulfillJson(route, pipelineMetadata(state.withRunnerToolSelector));
   }
@@ -744,8 +684,6 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
       available_plugins: [],
       bound_mcp_servers: [],
       available_mcp_servers: state.mcpServers,
-      bound_mcp_resources: [],
-      mcp_resource_agent_read_enabled: true,
       bound_skills: [],
       available_skills: state.skills,
     });
@@ -811,10 +749,6 @@ async function handleBackendApi(route: Route, state: LangBotApiMockState) {
     });
   }
 
-  if (path === '/api/v1/tools') {
-    return fulfillJson(route, { tools: state.tools });
-  }
-
   if (path === '/api/v1/plugins') {
     return fulfillJson(route, { plugins: [] });
   }
@@ -1143,6 +1077,7 @@ export async function installLangBotApiMocks(
     sessionMessages?: Record<string, unknown[]>;
     storage?: JsonRecord;
     withRunnerToolSelector?: boolean;
+    workspaces?: WorkspaceEntryMock[];
   } = {},
 ) {
   const {
@@ -1153,9 +1088,10 @@ export async function installLangBotApiMocks(
     sessionMessages,
     storage = {},
     withRunnerToolSelector = false,
+    workspaces = [defaultWorkspaceEntry()],
   } = options;
   const state: LangBotApiMockState = {
-    agents: [],
+    authenticated,
     bots: [],
     counters: {},
     knowledgeBases: [],
@@ -1166,18 +1102,8 @@ export async function installLangBotApiMocks(
     sessionAnalyses: sessionAnalyses || {},
     sessionMessages: sessionMessages || {},
     skills: [],
-    tools: [
-      {
-        name: 'available_plugin_tool',
-        description: 'Available plugin tool',
-        human_desc: 'Available plugin tool',
-        parameters: {},
-        source: 'plugin',
-        source_name: 'langbot-app/TestTools',
-        source_id: 'langbot-app/TestTools',
-      },
-    ],
     withRunnerToolSelector,
+    workspaces,
   };
 
   await page.addInitScript(

web/tests/e2e/invitations.spec.ts

@@ -0,0 +1,167 @@
+import { expect, test } from '@playwright/test';
+
+import { installLangBotApiMocks } from './fixtures/langbot-api';
+
+test('terminal invitation errors refresh on a new fragment and allow account switching', async ({
+  page,
+}) => {
+  await installLangBotApiMocks(page, {
+    storage: {
+      token: 'playwright-token',
+      userEmail: 'another-account@example.com',
+    },
+  });
+  await page.route('**/api/v1/invitations/inspect', async (route) => {
+    const body = JSON.parse(route.request().postData() || '{}') as {
+      token?: string;
+    };
+    const code =
+      body.token === 'revoked-invitation'
+        ? 'invitation_revoked'
+        : 'invitation_used';
+    await route.fulfill({
+      status: 410,
+      contentType: 'application/json',
+      body: JSON.stringify({ code, msg: code }),
+    });
+  });
+
+  await page.goto('/invitations/accept#token=used-invitation');
+  await expect(
+    page.getByText('This invitation was already used.'),
+  ).toBeVisible();
+  await expect
+    .poll(() =>
+      page.evaluate(() =>
+        sessionStorage.getItem('langbot_pending_invitation_token'),
+      ),
+    )
+    .toBeNull();
+
+  await page.evaluate(() => {
+    window.location.hash = 'token=revoked-invitation';
+  });
+  await expect(page.getByText('This invitation was revoked.')).toBeVisible();
+
+  await page.getByRole('button', { name: 'Back to sign in' }).click();
+  await expect(page).toHaveURL(/\/login$/);
+  await expect(page.getByText('Welcome')).toBeVisible();
+  expect(
+    await page.evaluate(() => ({
+      token: localStorage.getItem('token'),
+      userEmail: localStorage.getItem('userEmail'),
+    })),
+  ).toEqual({ token: null, userEmail: null });
+});
+
+test('login preserves an explicit invitation email mismatch error', async ({
+  page,
+}) => {
+  await installLangBotApiMocks(page, { authenticated: false });
+  await page.route('**/api/v1/invitations/inspect', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          invitation: {
+            uuid: 'mismatch-invitation',
+            workspace_uuid: 'workspace-playwright',
+            normalized_email: 'invited@example.com',
+            role: 'viewer',
+            status: 'pending',
+          },
+          workspace: {
+            uuid: 'workspace-playwright',
+            name: 'Playwright Workspace',
+          },
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+  await page.route('**/api/v1/invitations/accept', async (route) => {
+    await route.fulfill({
+      status: 400,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 'invitation_email_mismatch',
+        msg: 'Invitation email does not match the Account',
+      }),
+    });
+  });
+
+  await page.goto('/invitations/accept#token=mismatch-invitation');
+  await page.getByRole('button', { name: 'I already have an account' }).click();
+  await page.getByPlaceholder('Enter email address').fill('other@example.com');
+  await page.getByPlaceholder('Enter password').fill('password');
+  await page.getByRole('button', { name: 'Login with password' }).click();
+
+  await expect(page).toHaveURL(
+    /\/invitations\/accept\?error=invitation_email_mismatch$/,
+  );
+  await expect(
+    page.getByText('This invitation belongs to a different email address.'),
+  ).toBeVisible();
+  await expect(page.getByText('Login successful')).toHaveCount(0);
+});
+
+test('an authenticated OSS invitation requires logout before registration', async ({
+  page,
+}) => {
+  await installLangBotApiMocks(page, {
+    storage: {
+      token: 'playwright-token',
+      userEmail: 'invited@example.com',
+    },
+  });
+  await page.route('**/api/v1/invitations/inspect', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          invitation: {
+            uuid: 'logout-invitation',
+            workspace_uuid: 'workspace-playwright',
+            normalized_email: 'invited@example.com',
+            role: 'viewer',
+            status: 'pending',
+          },
+          workspace: {
+            uuid: 'workspace-playwright',
+            name: 'Playwright Workspace',
+          },
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+
+  await page.goto('/invitations/accept#token=logout-invitation');
+  await expect(
+    page.getByText(
+      'Sign out first, then sign in with the invited account. Your invitation will be preserved.',
+    ),
+  ).toBeVisible();
+  await page
+    .getByRole('button', {
+      name: 'Sign out and return to this invitation',
+    })
+    .click();
+
+  await expect(page).toHaveURL(/\/login\?invitation=1$/);
+  expect(
+    await page.evaluate(() => ({
+      token: localStorage.getItem('token'),
+      userEmail: localStorage.getItem('userEmail'),
+      invitation: sessionStorage.getItem('langbot_pending_invitation_token'),
+    })),
+  ).toEqual({
+    token: null,
+    userEmail: null,
+    invitation: 'logout-invitation',
+  });
+});

web/tests/e2e/login.spec.ts

@@ -1,6 +1,9 @@
 import { expect, test } from '@playwright/test';
 
-import { installLangBotApiMocks } from './fixtures/langbot-api';
+import {
+  installLangBotApiMocks,
+  makeWorkspaceEntry,
+} from './fixtures/langbot-api';
 
 test('local account login reaches the authenticated home shell', async ({
   page,
@@ -14,9 +17,136 @@ test('local account login reaches the authenticated home shell', async ({
   await page.getByPlaceholder('Enter password').fill('password');
   await page.getByRole('button', { name: 'Login with password' }).click();
 
-  await expect(page).toHaveURL(/\/home$/);
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/);
   await expect(page.getByText('Home').first()).toBeVisible();
   await expect(page.getByRole('button', { name: 'Dashboard' })).toBeVisible();
   await expect(page.getByText('Total Messages').first()).toBeVisible();
   await expect(page.getByText('Unable to connect to server')).toHaveCount(0);
 });
+
+test('an existing Account token bootstraps the singleton without a selector loop', async ({
+  page,
+}) => {
+  const bootstrapWorkspaceHeaders: Array<string | undefined> = [];
+  page.on('request', (request) => {
+    if (new URL(request.url()).pathname === '/api/v1/workspaces/bootstrap') {
+      bootstrapWorkspaceHeaders.push(request.headers()['x-workspace-id']);
+    }
+  });
+
+  await installLangBotApiMocks(page, { authenticated: true });
+  await page.goto('/login');
+
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/);
+  await expect(page.getByRole('button', { name: 'Dashboard' })).toBeVisible();
+  expect(bootstrapWorkspaceHeaders.length).toBeGreaterThan(0);
+  expect(bootstrapWorkspaceHeaders.every((header) => !header)).toBe(true);
+});
+
+test('multi-Workspace login waits for an explicit selection', async ({
+  page,
+}) => {
+  const accountScopedRequests: { path: string; workspace?: string }[] = [];
+  const selectedWorkspaceHeaders: string[] = [];
+  page.on('request', (request) => {
+    const path = new URL(request.url()).pathname;
+    const workspace = request.headers()['x-workspace-id'];
+    if (
+      path === '/api/v1/user/auth' ||
+      path === '/api/v1/user/check-token' ||
+      path === '/api/v1/workspaces/bootstrap'
+    ) {
+      accountScopedRequests.push({ path, workspace });
+    }
+    if (path === '/api/v1/workspaces/current' && workspace) {
+      selectedWorkspaceHeaders.push(workspace);
+    }
+  });
+
+  await installLangBotApiMocks(page, {
+    storage: {
+      langbot_active_workspace_uuid: 'workspace-from-another-account',
+    },
+    workspaces: [
+      makeWorkspaceEntry('workspace-alpha', 'Alpha Workspace'),
+      makeWorkspaceEntry('workspace-beta', 'Beta Workspace'),
+    ],
+  });
+
+  await page.goto('/login');
+  await page.getByPlaceholder('Enter email address').fill('admin@example.com');
+  await page.getByPlaceholder('Enter password').fill('password');
+  await page.getByRole('button', { name: 'Login with password' }).click();
+
+  await expect(page).toHaveURL(/\/workspaces\/select/);
+  await expect(
+    page.getByRole('heading', { name: 'Choose a Workspace' }),
+  ).toBeVisible();
+  await expect(page.getByText('Alpha Workspace')).toBeVisible();
+  await expect(page.getByText('Beta Workspace')).toBeVisible();
+
+  await page.getByRole('button', { name: /Beta Workspace/ }).click();
+
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/);
+  const workspaceSwitcher = page
+    .getByRole('button', {
+      name: /Switch Workspace/,
+    })
+    .first();
+  await expect(workspaceSwitcher).toBeVisible();
+  await workspaceSwitcher.click();
+  await expect(
+    page.getByRole('menuitem', { name: 'Workspace Settings' }),
+  ).toBeVisible();
+  expect(selectedWorkspaceHeaders).toContain('workspace-beta');
+  expect(accountScopedRequests.length).toBeGreaterThan(0);
+  expect(accountScopedRequests.every((request) => !request.workspace)).toBe(
+    true,
+  );
+});
+
+test('Space OAuth bootstraps a singleton before entering home', async ({
+  page,
+}) => {
+  const selectedWorkspaceHeaders: string[] = [];
+  page.on('request', (request) => {
+    const path = new URL(request.url()).pathname;
+    const workspace = request.headers()['x-workspace-id'];
+    if (path === '/api/v1/workspaces/current' && workspace) {
+      selectedWorkspaceHeaders.push(workspace);
+    }
+  });
+
+  await installLangBotApiMocks(page);
+  await page.goto('/auth/space/callback?code=oauth-code&state=oauth-state');
+
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/, {
+    timeout: 5_000,
+  });
+  expect(selectedWorkspaceHeaders).toContain('workspace-playwright');
+});
+
+test('Space OAuth sends a multi-Workspace Account to the chooser', async ({
+  page,
+}) => {
+  const bootstrapWorkspaceHeaders: Array<string | undefined> = [];
+  page.on('request', (request) => {
+    if (new URL(request.url()).pathname === '/api/v1/workspaces/bootstrap') {
+      bootstrapWorkspaceHeaders.push(request.headers()['x-workspace-id']);
+    }
+  });
+
+  await installLangBotApiMocks(page, {
+    workspaces: [
+      makeWorkspaceEntry('workspace-alpha', 'Alpha Workspace'),
+      makeWorkspaceEntry('workspace-beta', 'Beta Workspace'),
+    ],
+  });
+  await page.goto('/auth/space/callback?code=oauth-code&state=oauth-state');
+
+  await expect(page).toHaveURL(/\/workspaces\/select/, { timeout: 5_000 });
+  await expect(page.getByText('Alpha Workspace')).toBeVisible();
+  await expect(page.getByText('Beta Workspace')).toBeVisible();
+  expect(bootstrapWorkspaceHeaders.length).toBeGreaterThan(0);
+  expect(bootstrapWorkspaceHeaders.every((header) => !header)).toBe(true);
+});

web/tests/unit/dynamic-form-save-values.test.mjs

@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import ts from 'typescript';
+import { fileURLToPath } from 'node:url';
+
+const currentDirectory = path.dirname(fileURLToPath(import.meta.url));
+const sourcePath = path.resolve(
+  currentDirectory,
+  '../../src/app/home/components/dynamic-form/DynamicFormSaveValues.ts',
+);
+
+function loadNormalizer() {
+  const source = fs.readFileSync(sourcePath, 'utf8');
+  const compiled = ts.transpileModule(source, {
+    compilerOptions: { module: ts.ModuleKind.CommonJS },
+  }).outputText;
+  const loadedModule = { exports: {} };
+  new Function('require', 'module', 'exports', compiled)(
+    () => {
+      throw new Error('DynamicFormSaveValues must not have runtime imports');
+    },
+    loadedModule,
+    loadedModule.exports,
+  );
+  return loadedModule.exports.normalizeDynamicFormValuesForSave;
+}
+
+test('normalizes only single-line text fields in a dynamic form save snapshot', () => {
+  const normalizeDynamicFormValuesForSave = loadNormalizer();
+  const specs = [
+    { name: 'single-line', type: 'string', default: '' },
+    { name: 'multiline', type: 'text', default: '' },
+    { name: 'string-list', type: 'array[string]', default: [] },
+    { name: 'count', type: 'integer', default: 0 },
+  ];
+  const values = {
+    'single-line': '\t  hello  world \n',
+    multiline: '  keep multiline whitespace  \n',
+    'string-list': ['  first  ', ' second '],
+    count: 3,
+  };
+
+  assert.deepEqual(normalizeDynamicFormValuesForSave(specs, values), {
+    'single-line': 'hello  world',
+    multiline: '  keep multiline whitespace  \n',
+    'string-list': ['  first  ', ' second '],
+    count: 3,
+  });
+});

web/tests/unit/marketplace-likes.test.mjs

@@ -0,0 +1,86 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const webRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../..',
+);
+const read = (relativePath) =>
+  fs.readFileSync(path.join(webRoot, relativePath), 'utf8');
+
+test('marketplace defaults to shared hot sorting and cards support fingerprint likes', () => {
+  const market = read(
+    'src/app/home/plugins/components/plugin-market/PluginMarketComponent.tsx',
+  );
+  const card = read(
+    'src/app/home/plugins/components/plugin-market/plugin-market-card/PluginMarketCardComponent.tsx',
+  );
+  const cardVO = read(
+    'src/app/home/plugins/components/plugin-market/plugin-market-card/PluginMarketCardVO.ts',
+  );
+  const entity = read('src/app/infra/entities/plugin/index.ts');
+  const client = read('src/app/infra/http/CloudServiceClient.ts');
+  const likes = read(
+    'src/app/home/plugins/components/plugin-market/marketplace-likes.ts',
+  );
+
+  assert.match(
+    market,
+    /hot_score_desc/,
+    'market must expose and default to hot-score sorting',
+  );
+  assert.match(
+    market,
+    /sortBy:\s*['"]hot_score['"]/,
+    'hot option must use the shared API field',
+  );
+  assert.match(
+    entity,
+    /like_count\??:\s*number/,
+    'marketplace extension responses must carry like counts',
+  );
+  assert.match(
+    cardVO,
+    /likeCount:\s*number/,
+    'market cards must carry like counts',
+  );
+  assert.match(card, /\bHeart\b/, 'market cards must render a like affordance');
+  assert.match(
+    card,
+    /toggleMarketplaceExtensionLike/,
+    'market cards must support liking and unliking',
+  );
+  assert.match(
+    client,
+    /marketplace\/extensions\/likes/,
+    'client must load browser likes',
+  );
+  assert.match(
+    client,
+    /setMarketplaceExtensionLike\(/,
+    'client must update likes through the shared API',
+  );
+  assert.match(
+    client,
+    /data\.sort_by === ['"]hot_score['"] \? ['"]install_count['"] : data\.sort_by/,
+    'older Space servers must fall back from hot score to install sorting',
+  );
+  assert.match(
+    likes,
+    /@fingerprintjs\/fingerprintjs/,
+    'anonymous likes must use browser fingerprinting',
+  );
+  assert.match(
+    likes,
+    /FingerprintJS\.load\(\{/,
+    'fingerprint agent must be initialized with options',
+  );
+  assert.match(
+    likes,
+    /monitoring:\s*false/,
+    'fingerprinting must not send vendor monitoring requests',
+  );
+});

web/tests/unit/oss-account-space-billing.test.mjs

@@ -0,0 +1,49 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../..',
+);
+const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');
+
+test('invited local registration returns to login instead of authenticating', () => {
+  const source = read('src/app/invitations/accept/page.tsx');
+  assert.doesNotMatch(
+    source,
+    /beginAuthenticatedSession\([\s\S]{0,120}response\.token/,
+  );
+  assert.match(source, /navigate\('\/login\?invitation=1'/);
+});
+
+test('authenticated invitation page offers logout while retaining invitation', () => {
+  const source = read('src/app/invitations/accept/page.tsx');
+  assert.match(source, /workspace\.logoutAndReturn/);
+  assert.match(source, /setPendingInvitationToken\(token\)/);
+});
+
+test('Space OAuth callback distinguishes unknown and unbound accounts by stable codes', () => {
+  const source = read('src/app/auth/space/callback/page.tsx');
+  assert.match(source, /space_account_not_registered/);
+  assert.match(source, /space_account_binding_required/);
+});
+
+test('models panel derives LangBot Models billing state from workspace owner', () => {
+  const source = read('src/app/home/components/models-dialog/ModelsPanel.tsx');
+  assert.match(source, /getWorkspaceSpaceBilling/);
+  assert.doesNotMatch(source, /getSpaceCredits\(\)/);
+  assert.match(source, /membership\.role === 'owner'/);
+});
+
+test('provider card represents owner and member owner-bound states explicitly', () => {
+  const source = read(
+    'src/app/home/components/models-dialog/components/ProviderCard.tsx',
+  );
+  assert.match(source, /isWorkspaceOwner/);
+  assert.match(source, /ownerSpaceBound/);
+  assert.match(source, /models\.ownerMustBindSpace/);
+  assert.match(source, /models\.usesOwnerSpaceBilling/);
+});

web/tests/unit/workspace-switcher-layout.test.mjs

@@ -0,0 +1,114 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const currentDirectory = path.dirname(fileURLToPath(import.meta.url));
+const webRoot = path.resolve(currentDirectory, '../..');
+
+function readSource(relativePath) {
+  return fs.readFileSync(path.join(webRoot, relativePath), 'utf8');
+}
+
+const homeLayoutSource = readSource('src/app/home/layout.tsx');
+const homeSidebarSource = readSource(
+  'src/app/home/components/home-sidebar/HomeSidebar.tsx',
+);
+const workspaceSettingsPanelSource = readSource(
+  'src/app/home/components/workspace-settings/WorkspaceSettingsPanel.tsx',
+);
+const workspaceSwitcherSource = readSource(
+  'src/app/home/components/workspace-settings/WorkspaceSwitcher.tsx',
+);
+
+test('renders WorkspaceSwitcher only from HomeSidebar', () => {
+  assert.doesNotMatch(homeLayoutSource, /<WorkspaceSwitcher\b/);
+  assert.doesNotMatch(workspaceSettingsPanelSource, /<WorkspaceSwitcher\b/);
+  assert.equal(homeSidebarSource.match(/<WorkspaceSwitcher\b/g)?.length, 1);
+});
+
+test('places WorkspaceSwitcher between the sidebar header and Home navigation', () => {
+  const headerEnd = homeSidebarSource.indexOf('</SidebarHeader>');
+  const switcher = homeSidebarSource.indexOf('<WorkspaceSwitcher');
+  const contentStart = homeSidebarSource.indexOf('<SidebarContent');
+  const homeGroup = homeSidebarSource.indexOf(
+    "<SidebarGroupLabel>{t('sidebar.home')}</SidebarGroupLabel>",
+  );
+
+  assert.notEqual(headerEnd, -1);
+  assert.notEqual(switcher, -1);
+  assert.notEqual(contentStart, -1);
+  assert.notEqual(homeGroup, -1);
+  assert.ok(
+    headerEnd < switcher,
+    'WorkspaceSwitcher must follow SidebarHeader',
+  );
+  assert.ok(
+    switcher < contentStart && switcher < homeGroup,
+    'WorkspaceSwitcher must precede SidebarContent and the Home group',
+  );
+});
+
+test('shows WorkspaceSwitcher for a current Cloud or OSS workspace even when it is the only workspace', () => {
+  assert.match(
+    workspaceSwitcherSource,
+    /if \(!currentWorkspace\) return null;/,
+  );
+  assert.doesNotMatch(workspaceSwitcherSource, /workspaces\.length\s*<=\s*1/);
+  assert.doesNotMatch(
+    homeSidebarSource,
+    /currentWorkspace\?\.workspace\.source\s*===\s*'cloud_projection'[\s\S]{0,200}<WorkspaceSwitcher/,
+  );
+});
+
+test('keeps Cloud workspace member management in Workspace Settings', () => {
+  assert.match(workspaceSettingsPanelSource, /workspace\.inviteMember/);
+  assert.doesNotMatch(workspaceSettingsPanelSource, /#workspace-members/);
+  assert.doesNotMatch(workspaceSettingsPanelSource, /cloudMembersURL/);
+  assert.doesNotMatch(workspaceSettingsPanelSource, /canManageCloudMembers/);
+});
+
+test('keeps workspace plan and settings controls on the workspace row', () => {
+  assert.match(workspaceSwitcherSource, /entry\.plan_name/);
+  assert.match(
+    workspaceSwitcherSource,
+    /aria-label=\{t\('workspace\.settings'\)\}/,
+  );
+  assert.match(workspaceSwitcherSource, /className="size-8"/);
+  assert.doesNotMatch(workspaceSwitcherSource, /workspace\.currentPlan/);
+  assert.doesNotMatch(workspaceSwitcherSource, /workspace\.upgradePlan/);
+  assert.doesNotMatch(workspaceSwitcherSource, /workspace\.roles/);
+  assert.doesNotMatch(workspaceSwitcherSource, /entry\.membership\.role/);
+});
+
+test('moves Cloud plan upgrades into Workspace Settings', () => {
+  assert.match(workspaceSettingsPanelSource, /workspace\.upgradePlan/);
+  assert.match(workspaceSettingsPanelSource, /cloudPortalURL/);
+  assert.match(workspaceSettingsPanelSource, /step=plan/);
+  assert.match(workspaceSettingsPanelSource, /systemInfo\.cloud_service_url/);
+});
+
+test('aligns the workspace trigger with navigation entries on both sides and truncates long names', () => {
+  assert.match(
+    homeSidebarSource,
+    /<div className="px-2[^>]*>[\s\S]*<WorkspaceSwitcher className="w-full/,
+  );
+  assert.doesNotMatch(
+    homeSidebarSource,
+    /WorkspaceSwitcher className="[^"]*w-4\/5/,
+  );
+  assert.match(workspaceSwitcherSource, /h-9/);
+  assert.match(workspaceSwitcherSource, /w-64/);
+  assert.doesNotMatch(workspaceSwitcherSource, /min-w-80/);
+  assert.match(workspaceSwitcherSource, /max-w-\[7rem\][^>]*truncate/);
+});
+
+test('uses an infrastructure-level Box health endpoint in monitoring', () => {
+  const statusCardSource = readSource(
+    'src/app/home/monitoring/components/overview-cards/SystemStatusCards.tsx',
+  );
+  const backendClientSource = readSource('src/app/infra/http/BackendClient.ts');
+  assert.match(backendClientSource, /getBoxRuntimeStatus/);
+  assert.match(statusCardSource, /getBoxRuntimeStatus/);
+});