feat(tenancy): add Workspace multi-tenant foundation (#2353)

* Document multi-tenant workspace architecture

* Add OSS and commercial workspace boundaries

* docs: redesign multi-tenant workspace architecture

* feat(tenancy): implement workspace isolation

* docs(tenancy): record verification evidence

* docs(tenancy): revise single-instance SaaS topology

* docs(tenancy): refine architecture options

* docs: finalize cloud v2 multi-tenant decisions

* feat(tenancy): establish cloud isolation foundations

* feat(tenancy): harden shared cloud runtime boundaries

* docs(tenancy): record final isolation verification

* fix(tenancy): close isolation and permission gaps

* docs(tenancy): record final isolation verification

* feat(tenancy): connect cloud workspace control plane

* fix(build): install git for pinned SDK

* docs(cloud): update control plane verification

* chore: update multi-tenant SDK pin

* fix(cloud): skip legacy model sync during startup

* test(cloud): preserve minimal model manager fixtures

* fix(cloud): preserve authenticated account context

* fix(cloud): reuse authenticated account for user info

* feat(cloud): complete Workspace settings navigation

* test(web): cover Workspace dropdown menu

* feat(web): place workspace controls in sidebar

* refactor(web): streamline workspace controls

* style(web): format workspace layout test

* fix(cloud): surface runtime and workspace plan status

* fix(plugin): keep runtime identity stable across restarts

* fix(ui): widen and center workspace switcher

* fix(ui): hide roles from workspace switcher

* fix(ui): align workspace switcher with sidebar entries

* feat(workspace): add in-product collaboration and direct Cloud launch

* style: format collaboration changes

* fix(workspace): bind collaboration APIs to tenant UoW

* fix(cloud): preserve Core-owned collaboration state

* test(cloud): require Space identity for invite registration

* feat(cloud): complete secure invitation experience

* style(web): format invitation flows

* fix(cloud): recover box runtime without unscoped skill reload

* feat(oss): enforce invitation account and owner billing flows

* style: format OSS account service

* test(oss): cover invitation logout handoff

* fix(oss): resolve workspace owner in scoped session

* feat(cloud): harden multi-tenant runtime resources

* fix(cloud): bound runtime restart storms

* fix(cloud): eliminate periodic runtime CPU spikes

* fix(cloud): enforce instance capacity ceilings

* fix(cloud): scope public login capability discovery

* fix(cloud): bound tenant maintenance and monitoring work

* fix(runtime): bound tenant resource amplification

* fix(deps): pin green multi-tenant plugin SDK

* fix(cloud): handle unavailable skill capability

* fix(security): require authentication for image file endpoint (H-2)

- Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY
- Added Permission.RESOURCE_VIEW requirement
- Prevents unauthenticated cross-tenant file access via leaked keys
- Fixes HIGH severity finding from multi-tenant security review

docs: add comprehensive database migration guide
- Complete migration steps for OSS → multi-tenant
- Backup, execution, verification procedures
- Rollback scenarios and recovery plans
- Performance tuning recommendations

* test: add comprehensive cross-tenant isolation tests

Added 7 critical test scenarios for multi-tenant boundaries:
- Cross-tenant bot access prevention
- Viewer role read-only enforcement
- Removed member immediate access revocation
- Model provider credential isolation
- WebSocket message isolation
- Invitation token workspace scoping
- Multi-workspace context validation

These tests address P0-2 coverage gaps for:
- workspaces.py (membership & invitation flows)
- user.py (authentication & authorization)
- websocket_chat.py (real-time isolation)
- plugins.py (resource access control)

docs: finalize database migration guide

* fix(security): resolve M-1, M-2, M-3 security findings

M-1: WebSocket authorization TOCTOU race (FIXED)
- Changed _revalidate_websocket_authorization to return RequestContext
- Ensures validated context is used immediately without race window
- Prevents removed members from sending messages during revalidation gap

M-2: Model Manager cache workspace isolation (VERIFIED)
- Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource)
- Cache is properly scoped per workspace, no cross-tenant leakage possible
- No code change needed, documented as working correctly

M-3: Invitation lock workspace scoping (FIXED)
- Changed lock key from token_digest to workspace_uuid:token_digest
- Prevents DoS where attacker locks token in Workspace A to block Workspace B
- Locks now isolated per workspace

All MEDIUM severity findings from security review now resolved.

* fix(cloud): unblock tenant CI and enforce knowledge quotas

* fix(tenancy): scope rerank model sync

---------

Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>

web/src/i18n/locales/en-US.ts

@@ -80,7 +80,7 @@ const enUS = {
     loading: 'Loading...',
     fieldRequired: 'This field is required',
     or: 'or',
-    loginWithSpace: 'Login with Space',
+    loginWithSpace: 'Login with LangBot Account',
     spaceLoginRecommended:
       'Recommended: Use official stable model APIs and cloud services',
     loginLocal: 'Login with local account',
@@ -167,6 +167,7 @@ const enUS = {
     actions: 'Actions',
     apiKeyCreatedMessage:
       'Please copy this API key, if the button is invalid, please copy manually.',
+    apiKeyStoredSecurely: 'Secret shown only when created',
     none: 'None',
     more: 'More ({{count}})',
     less: 'Less',
@@ -276,8 +277,12 @@ const enUS = {
     searchProviders: 'Search providers...',
     langbotModelsDescription: 'Cloud models powered by LangBot Space',
     credits: 'Credits',
-    loginWithSpace: 'Login with Space',
+    loginWithSpace: 'Login with LangBot Account',
     loginToUseModels: 'Login with Space to use cloud models',
+    ownerMustBindSpace:
+      'The Workspace owner must connect Space for LangBot Models.',
+    usesOwnerSpaceBilling:
+      "Uses the Workspace owner's Space billing and credits.",
     noModels: 'No models configured',
     langbotModels: 'LangBot Models',
     spaceTrialTooltip:
@@ -826,6 +831,9 @@ const enUS = {
     boxStdioRefusedSuggestion:
       'Enable Box (box.enabled = true) and ensure the runtime is healthy, or switch this server to http/sse mode.',
     boxRequired: 'requires Box',
+    disabledByPolicy: 'disabled by policy',
+    stdioDisabledByPolicy:
+      'Stdio MCP is disabled for this deployment. Use a remote MCP server instead.',
     stdioBlockedByBoxToast:
       'Stdio MCP cannot be saved while the Box sandbox is disabled or unreachable. Enable Box or pick http/sse.',
     toolsFound: 'tools',
@@ -1279,7 +1287,96 @@ const enUS = {
       'Invalid bind request. Please try again from account settings.',
     setPasswordHint: 'Set a password to login with email and password',
     spaceEmailMismatch:
-      'Space login email does not match the local account email',
+      'The Space login email does not match the local account email.',
+    space_account_not_registeredTitle: 'Account not registered',
+    space_account_not_registered:
+      'No local account is registered for this Space email. Ask the Workspace owner for an invitation.',
+    space_account_binding_requiredTitle: 'Space connection required',
+    space_account_binding_required:
+      'This local account must connect Space from Account settings before using Space login.',
+  },
+  workspace: {
+    title: 'Workspace',
+    description: 'Manage members, roles, and invitation links',
+    selectTitle: 'Choose a Workspace',
+    selectDescription: 'Select where you want to continue in LangBot.',
+    selectionLoadFailed:
+      'Your Workspaces could not be loaded. Please try again.',
+    switchWorkspace: 'Switch Workspace',
+    settings: 'Workspace Settings',
+    currentPlan: 'Current plan',
+    planUnavailable: 'Unavailable',
+    upgradePlan: 'Change or upgrade plan',
+    ossSingletonDescription:
+      'This self-hosted instance has one Workspace and can include multiple users.',
+    cloudManagedDescription:
+      'This Workspace is hosted by LangBot Cloud. Manage members here; billing opens in Cloud.',
+    loadFailed: 'Failed to load Workspace information',
+    members: 'Members',
+    you: 'You',
+    inviteMember: 'Invite a member',
+    inviteDescription:
+      'Create a one-time link to add another user to this Workspace.',
+    emailPlaceholder: 'member@example.com',
+    createInvitation: 'Create invitation',
+    invitationCreated: 'Invitation created',
+    delivery: {
+      sent: 'Invitation sent',
+      link_only: 'Invitation link created',
+      failed: 'Invitation link created, but email could not be sent',
+    },
+    invitationCreateFailed: 'Failed to create invitation',
+    oneTimeLinkWarning: 'Copy this link now. It is shown only once.',
+    copyInvitation: 'Copy invitation link',
+    invitationCopied: 'Invitation link copied',
+    pendingInvitations: 'Pending invitations',
+    expiresAt: 'Expires {{date}}',
+    revokeInvitation: 'Revoke invitation',
+    invitationRevoked: 'Invitation revoked',
+    invitationRevokeFailed: 'Failed to revoke invitation',
+    acceptInvitation: 'Accept invitation',
+    invitedToWorkspace: 'You were invited to {{workspace}}',
+    checkingInvitation: 'Checking this invitation...',
+    invitationMissing: 'This invitation link is missing required information.',
+    invitationExpired: 'This invitation has expired.',
+    invitationAlreadyRevoked: 'This invitation was revoked.',
+    invitationAlreadyUsed: 'This invitation was already used.',
+    invitationInvalid: 'This invitation is invalid or no longer available.',
+    invitationAccepted: 'Invitation accepted',
+    invitationAcceptFailed: 'Failed to accept invitation',
+    invitationEmailMismatch:
+      'This invitation belongs to a different email address.',
+    existingAccountLoginRequired:
+      'An account already exists for this email. Sign in to continue.',
+    acceptAsCurrentAccount: 'Accept with current account',
+    authenticatedInvitationNotice:
+      'Sign out first, then sign in with the invited account. Your invitation will be preserved.',
+    logoutAndReturn: 'Sign out and return to this invitation',
+    switchAccount: 'Switch account',
+    registerAndAccept: 'Create account and accept',
+    alreadyHaveAccount: 'I already have an account',
+    confirmPassword: 'Confirm password',
+    passwordMinimum: 'Password must contain at least 8 characters.',
+    passwordMismatch: 'The passwords do not match.',
+    backToLogin: 'Back to sign in',
+    memberUpdated: 'Member role updated',
+    memberUpdateFailed: 'Failed to update member role',
+    removeMember: 'Remove member',
+    removeMemberConfirm: 'Remove this member from the Workspace?',
+    memberRemoved: 'Member removed',
+    memberRemoveFailed: 'Failed to remove member',
+    transferOwnership: 'Transfer ownership',
+    types: {
+      personal: 'Personal',
+      team: 'Team',
+    },
+    roles: {
+      owner: 'Owner',
+      admin: 'Admin',
+      developer: 'Developer',
+      operator: 'Operator',
+      viewer: 'Viewer',
+    },
   },
   monitoring: {
     title: 'Dashboard',
@@ -1532,6 +1629,7 @@ const enUS = {
   settingsDialog: {
     title: 'Settings',
     nav: {
+      workspace: 'Workspace',
       models: 'Models',
       api: 'API',
       storage: 'Storage',

web/src/i18n/locales/es-ES.ts

@@ -83,7 +83,7 @@ const esES = {
     loading: 'Cargando...',
     fieldRequired: 'Este campo es obligatorio',
     or: 'o',
-    loginWithSpace: 'Iniciar sesión con Space',
+    loginWithSpace: 'Iniciar sesión con una cuenta de LangBot',
     spaceLoginRecommended:
       'Recomendado: Usa API de modelos oficiales estables y servicios en la nube',
     loginLocal: 'Iniciar sesión con cuenta local',
@@ -286,7 +286,7 @@ const esES = {
     searchProviders: 'Buscar proveedores...',
     langbotModelsDescription: 'Modelos en la nube impulsados por LangBot Space',
     credits: 'Créditos',
-    loginWithSpace: 'Iniciar sesión con Space',
+    loginWithSpace: 'Iniciar sesión con una cuenta de LangBot',
     loginToUseModels: 'Inicia sesión con Space para usar modelos en la nube',
     noModels: 'No hay modelos configurados',
     langbotModels: 'Modelos LangBot',
@@ -840,6 +840,9 @@ const esES = {
     boxStdioRefusedSuggestion:
       'Active Box (box.enabled = true) y asegúrese de que el runtime está conectado, o cambie este servidor a modo http/sse.',
     boxRequired: 'requiere Box',
+    disabledByPolicy: 'desactivado por la política',
+    stdioDisabledByPolicy:
+      'Stdio MCP está deshabilitado en este despliegue. Use un servidor MCP remoto.',
     stdioBlockedByBoxToast:
       'No se puede guardar el MCP en modo stdio mientras el sandbox de Box está desactivado o no disponible. Active Box o seleccione modo http/sse.',
     toolsFound: 'herramientas',

web/src/i18n/locales/ja-JP.ts

@@ -81,7 +81,7 @@ const jaJP = {
     loading: '読み込み中...',
     fieldRequired: 'この項目は必須です',
     or: 'または',
-    loginWithSpace: 'Space でログイン',
+    loginWithSpace: 'LangBot アカウントでログイン',
     spaceLoginRecommended:
       'おすすめ：公式の安定したモデル API とクラウドサービスを利用',
     loginLocal: 'ローカルアカウントでログイン',
@@ -169,6 +169,7 @@ const jaJP = {
     actions: 'アクション',
     apiKeyCreatedMessage:
       'この API キーをコピーしてください。もしボタンが無効な場合は手動でコピーしてください。',
+    apiKeyStoredSecurely: 'シークレットは作成時のみ表示されます',
     none: 'なし',
     more: 'もっと見る ({{count}})',
     less: '折りたたむ',
@@ -281,8 +282,12 @@ const jaJP = {
     searchProviders: 'プロバイダーを検索...',
     langbotModelsDescription: 'LangBot Space が提供するクラウドモデル',
     credits: 'クレジット',
-    loginWithSpace: 'Space でログイン',
+    loginWithSpace: 'LangBot アカウントでログイン',
     loginToUseModels: 'Space でログインしてクラウドモデルを使用',
+    ownerMustBindSpace:
+      'LangBot モデルを使うにはワークスペース所有者が Space を連携する必要があります。',
+    usesOwnerSpaceBilling:
+      'ワークスペース所有者の Space 課金とクレジットを使用します。',
     noModels: 'モデルがありません',
     langbotModels: 'LangBot モデル',
     spaceTrialTooltip:
@@ -832,6 +837,9 @@ const jaJP = {
     boxStdioRefusedSuggestion:
       'Box を有効化（box.enabled = true）してランタイムの接続を確認するか、このサーバーを http/sse モードに切り替えてください。',
     boxRequired: 'Box が必要',
+    disabledByPolicy: 'ポリシーにより無効',
+    stdioDisabledByPolicy:
+      'このデプロイでは Stdio MCP が無効です。リモート MCP サーバーを使用してください。',
     stdioBlockedByBoxToast:
       'Box サンドボックスが無効または利用できないため、stdio モードの MCP は保存できません。Box を有効化するか、http/sse モードに切り替えてください。',
     toolsFound: '個のツール',
@@ -1285,6 +1293,91 @@ const jaJP = {
       'パスワードを設定するとメールとパスワードでログインできます',
     spaceEmailMismatch:
       'Spaceログインのメールアドレスがローカルアカウントのメールアドレスと一致しません',
+    space_account_not_registeredTitle: 'アカウントが登録されていません',
+    space_account_not_registered:
+      'この Space メールアドレスのローカルアカウントはありません。ワークスペース所有者に招待を依頼してください。',
+    space_account_binding_requiredTitle: 'Space の連携が必要です',
+    space_account_binding_required:
+      'Space ログインを使用する前に、アカウント設定でこのローカルアカウントを Space に連携してください。',
+  },
+  workspace: {
+    title: 'ワークスペース',
+    description: 'メンバー、ロール、招待リンクを管理します',
+    selectTitle: 'ワークスペースを選択',
+    selectDescription: 'LangBot で使用するワークスペースを選択してください。',
+    selectionLoadFailed:
+      'ワークスペースを読み込めませんでした。もう一度お試しください。',
+    switchWorkspace: 'ワークスペースを切り替え',
+    ossSingletonDescription:
+      'このセルフホストインスタンスには1つのワークスペースがあり、複数のユーザーを追加できます。',
+    cloudManagedDescription:
+      'このワークスペースは LangBot Cloud でホストされています。メンバーはここで管理し、請求は Cloud で開きます。',
+    loadFailed: 'ワークスペース情報の読み込みに失敗しました',
+    members: 'メンバー',
+    you: 'あなた',
+    inviteMember: 'メンバーを招待',
+    inviteDescription:
+      '現在のワークスペースにユーザーを追加する一度限りのリンクを作成します。',
+    emailPlaceholder: 'member@example.com',
+    createInvitation: '招待を作成',
+    invitationCreated: '招待を作成しました',
+    delivery: {
+      sent: '招待メールを送信しました',
+      link_only: '招待リンクを作成しました',
+      failed: '招待リンクを作成しましたが、メールを送信できませんでした',
+    },
+    invitationCreateFailed: '招待の作成に失敗しました',
+    oneTimeLinkWarning:
+      'このリンクを今すぐコピーしてください。一度だけ表示されます。',
+    copyInvitation: '招待リンクをコピー',
+    invitationCopied: '招待リンクをコピーしました',
+    pendingInvitations: '保留中の招待',
+    expiresAt: '{{date}} に期限切れ',
+    revokeInvitation: '招待を取り消す',
+    invitationRevoked: '招待を取り消しました',
+    invitationRevokeFailed: '招待の取り消しに失敗しました',
+    acceptInvitation: '招待を承認',
+    invitedToWorkspace: '{{workspace}} に招待されました',
+    checkingInvitation: '招待を確認しています...',
+    invitationMissing: 'この招待リンクには必要な情報がありません。',
+    invitationExpired: 'この招待は期限切れです。',
+    invitationAlreadyRevoked: 'この招待は取り消されました。',
+    invitationAlreadyUsed: 'この招待はすでに使用されています。',
+    invitationInvalid: 'この招待は無効か、利用できなくなっています。',
+    invitationAccepted: '招待を承認しました',
+    invitationAcceptFailed: '招待の承認に失敗しました',
+    invitationEmailMismatch: 'この招待は別のメールアドレスに送られたものです。',
+    existingAccountLoginRequired:
+      'このメールアドレスのアカウントは既に存在します。ログインしてください。',
+    acceptAsCurrentAccount: '現在のアカウントで承認',
+    authenticatedInvitationNotice:
+      '一度ログアウトし、招待されたアカウントでログインしてください。招待は保持されます。',
+    logoutAndReturn: 'ログアウトしてこの招待に戻る',
+    switchAccount: 'アカウントを切り替える',
+    registerAndAccept: 'アカウントを作成して承認',
+    alreadyHaveAccount: 'アカウントを持っています',
+    confirmPassword: 'パスワードを確認',
+    passwordMinimum: 'パスワードは8文字以上にしてください。',
+    passwordMismatch: 'パスワードが一致しません。',
+    backToLogin: 'ログインに戻る',
+    memberUpdated: 'メンバーのロールを更新しました',
+    memberUpdateFailed: 'メンバーのロール更新に失敗しました',
+    removeMember: 'メンバーを削除',
+    removeMemberConfirm: 'このメンバーをワークスペースから削除しますか？',
+    memberRemoved: 'メンバーを削除しました',
+    memberRemoveFailed: 'メンバーの削除に失敗しました',
+    transferOwnership: '所有権を移譲',
+    types: {
+      personal: '個人',
+      team: 'チーム',
+    },
+    roles: {
+      owner: '所有者',
+      admin: '管理者',
+      developer: '開発者',
+      operator: 'オペレーター',
+      viewer: '閲覧者',
+    },
   },
   monitoring: {
     title: 'ダッシュボード',
@@ -1538,6 +1631,7 @@ const jaJP = {
   settingsDialog: {
     title: '設定',
     nav: {
+      workspace: 'ワークスペース',
       models: 'モデル',
       api: 'API',
       storage: 'ストレージ',

web/src/i18n/locales/ru-RU.ts

@@ -80,7 +80,7 @@ const ruRU = {
     loading: 'Загрузка...',
     fieldRequired: 'Это поле обязательно для заполнения',
     or: 'или',
-    loginWithSpace: 'Войти через Space',
+    loginWithSpace: 'Войти с аккаунтом LangBot',
     spaceLoginRecommended:
       'Рекомендуется: Используйте официальные стабильные API моделей и облачные сервисы',
     loginLocal: 'Войти с локальной учётной записью',
@@ -284,7 +284,7 @@ const ruRU = {
     searchProviders: 'Поиск провайдеров...',
     langbotModelsDescription: 'Облачные модели на базе LangBot Space',
     credits: 'Кредиты',
-    loginWithSpace: 'Войти через Space',
+    loginWithSpace: 'Войти с аккаунтом LangBot',
     loginToUseModels: 'Войдите через Space, чтобы использовать облачные модели',
     noModels: 'Модели не настроены',
     langbotModels: 'Модели LangBot',
@@ -837,6 +837,9 @@ const ruRU = {
     boxStdioRefusedSuggestion:
       'Включите Box (box.enabled = true) и убедитесь, что среда работает, либо переключите этот сервер в режим http/sse.',
     boxRequired: 'требуется Box',
+    disabledByPolicy: 'отключено политикой',
+    stdioDisabledByPolicy:
+      'Stdio MCP отключён в этом развёртывании. Используйте удалённый MCP-сервер.',
     stdioBlockedByBoxToast:
       'Сохранить MCP в режиме stdio нельзя: песочница Box отключена или недоступна. Включите Box либо выберите режим http/sse.',
     toolsFound: 'инструментов',

web/src/i18n/locales/th-TH.ts

@@ -80,7 +80,7 @@ const thTH = {
     loading: 'กำลังโหลด...',
     fieldRequired: 'ช่องนี้จำเป็นต้องกรอก',
     or: 'หรือ',
-    loginWithSpace: 'เข้าสู่ระบบด้วย Space',
+    loginWithSpace: 'เข้าสู่ระบบด้วยบัญชี LangBot',
     spaceLoginRecommended:
       'แนะนำ: ใช้ API โมเดลที่เสถียรอย่างเป็นทางการและบริการคลาวด์',
     loginLocal: 'เข้าสู่ระบบด้วยบัญชีท้องถิ่น',
@@ -273,7 +273,7 @@ const thTH = {
     searchProviders: 'ค้นหาผู้ให้บริการ...',
     langbotModelsDescription: 'โมเดลคลาวด์ขับเคลื่อนโดย LangBot Space',
     credits: 'เครดิต',
-    loginWithSpace: 'เข้าสู่ระบบด้วย Space',
+    loginWithSpace: 'เข้าสู่ระบบด้วยบัญชี LangBot',
     loginToUseModels: 'เข้าสู่ระบบด้วย Space เพื่อใช้โมเดลคลาวด์',
     noModels: 'ยังไม่มีโมเดลที่กำหนดค่า',
     langbotModels: 'โมเดล LangBot',
@@ -815,6 +815,9 @@ const thTH = {
     boxStdioRefusedSuggestion:
       'กรุณาเปิดใช้งาน Box (box.enabled = true) และตรวจสอบว่ารันไทม์ทำงานปกติ หรือเปลี่ยน MCP server เป็นโหมด http/sse',
     boxRequired: 'ต้องใช้ Box',
+    disabledByPolicy: 'ถูกปิดใช้งานโดยนโยบาย',
+    stdioDisabledByPolicy:
+      'การติดตั้งใช้งานนี้ปิด Stdio MCP อยู่ โปรดใช้เซิร์ฟเวอร์ MCP แบบระยะไกล',
     stdioBlockedByBoxToast:
       'ไม่สามารถบันทึก MCP โหมด stdio เนื่องจาก Sandbox Box ถูกปิดใช้งานหรือไม่พร้อมใช้งาน กรุณาเปิดใช้งาน Box หรือเลือกโหมด http/sse',
     toolsFound: 'เครื่องมือ',

web/src/i18n/locales/vi-VN.ts

@@ -81,7 +81,7 @@ const viVN = {
     loading: 'Đang tải...',
     fieldRequired: 'Trường này là bắt buộc',
     or: 'hoặc',
-    loginWithSpace: 'Đăng nhập với Space',
+    loginWithSpace: 'Đăng nhập bằng tài khoản LangBot',
     spaceLoginRecommended:
       'Khuyến nghị: Sử dụng API mô hình ổn định chính thức và dịch vụ đám mây',
     loginLocal: 'Đăng nhập với tài khoản cục bộ',
@@ -281,7 +281,7 @@ const viVN = {
     searchProviders: 'Tìm kiếm nhà cung cấp...',
     langbotModelsDescription: 'Mô hình đám mây được cung cấp bởi LangBot Space',
     credits: 'Tín dụng',
-    loginWithSpace: 'Đăng nhập với Space',
+    loginWithSpace: 'Đăng nhập bằng tài khoản LangBot',
     loginToUseModels: 'Đăng nhập với Space để sử dụng mô hình đám mây',
     noModels: 'Chưa cấu hình mô hình nào',
     langbotModels: 'Mô hình LangBot',
@@ -830,6 +830,9 @@ const viVN = {
     boxStdioRefusedSuggestion:
       'Hãy bật Box (box.enabled = true) và đảm bảo runtime hoạt động, hoặc chuyển server này sang chế độ http/sse.',
     boxRequired: 'cần Box',
+    disabledByPolicy: 'bị tắt theo chính sách',
+    stdioDisabledByPolicy:
+      'Stdio MCP đã bị tắt trong bản triển khai này. Hãy dùng máy chủ MCP từ xa.',
     stdioBlockedByBoxToast:
       'Không thể lưu MCP ở chế độ stdio khi Sandbox Box bị tắt hoặc không khả dụng. Hãy bật Box hoặc chọn chế độ http/sse.',
     toolsFound: 'công cụ',

web/src/i18n/locales/zh-Hans.ts

@@ -79,7 +79,7 @@ const zhHans = {
     loading: '加载中...',
     fieldRequired: '此字段为必填项',
     or: '或',
-    loginWithSpace: '通过 Space 登录',
+    loginWithSpace: '使用 LangBot 账号登录',
     spaceLoginRecommended: '推荐：使用官方提供的稳定模型 API 和云服务',
     loginLocal: '使用本地账号登录',
     loginWithPassword: '通过密码登录',
@@ -156,6 +156,7 @@ const zhHans = {
     webhookHint: 'Webhook 允许 LangBot 将个人消息和群消息事件推送到外部系统',
     actions: '操作',
     apiKeyCreatedMessage: '请复制此 API 密钥，若按钮无效，请手动复制。',
+    apiKeyStoredSecurely: '密钥仅在创建时显示',
     none: '无',
     more: '更多 ({{count}})',
     less: '收起',
@@ -264,8 +265,10 @@ const zhHans = {
     searchProviders: '搜索供应商...',
     langbotModelsDescription: 'LangBot Space 提供的云端模型',
     credits: '积分',
-    loginWithSpace: '通过 Space 登录',
+    loginWithSpace: '使用 LangBot 账号登录',
     loginToUseModels: '通过 Space 登录以使用云端模型',
+    ownerMustBindSpace: '工作区所有者需要绑定 Space 才能使用 LangBot 模型。',
+    usesOwnerSpaceBilling: '使用工作区所有者的 Space 计费与积分。',
     noModels: '暂无模型',
     langbotModels: 'LangBot 模型',
     spaceTrialTooltip:
@@ -792,6 +795,8 @@ const zhHans = {
     boxStdioRefusedSuggestion:
       '请启用 Box（box.enabled = true）并确认运行时连接正常，或将此服务器切换到 http/sse 模式。',
     boxRequired: '需要 Box',
+    disabledByPolicy: '已被策略禁用',
+    stdioDisabledByPolicy: '此部署已禁用 Stdio MCP，请改用远程 MCP 服务器。',
     stdioBlockedByBoxToast:
       'Box 沙箱已禁用或不可用，无法保存 stdio 模式的 MCP。请启用 Box 或改为 http/sse 模式。',
     toolsFound: '个工具',
@@ -1216,6 +1221,91 @@ const zhHans = {
     bindSpaceInvalidState: '无效的绑定请求，请从账户设置重新发起',
     setPasswordHint: '设置密码后可使用邮箱密码登录',
     spaceEmailMismatch: 'Space登录账号邮箱与本实例账号邮箱不匹配',
+    space_account_not_registeredTitle: '账户尚未注册',
+    space_account_not_registered:
+      '此 Space 邮箱尚无本地账户，请联系工作区所有者获取邀请。',
+    space_account_binding_requiredTitle: '需要绑定 Space',
+    space_account_binding_required:
+      '此本地账户必须先在账户设置中绑定 Space，才能使用 Space 登录。',
+  },
+  workspace: {
+    title: '工作区',
+    description: '管理成员、角色与邀请链接',
+    selectTitle: '选择工作区',
+    selectDescription: '选择你要进入的 LangBot 工作区。',
+    selectionLoadFailed: '无法加载你的工作区，请重试。',
+    switchWorkspace: '切换工作区',
+    settings: '工作区设置',
+    currentPlan: '当前计划',
+    planUnavailable: '暂不可用',
+    upgradePlan: '切换或升级计划',
+    ossSingletonDescription:
+      '当前自托管实例只有一个工作区，但可以包含多个用户。',
+    cloudManagedDescription:
+      '此工作区托管于 LangBot Cloud。成员在此管理，计费在 Cloud 中打开。',
+    loadFailed: '加载工作区信息失败',
+    members: '成员',
+    you: '你',
+    inviteMember: '邀请成员',
+    inviteDescription: '创建一次性链接，将其他用户加入当前工作区。',
+    emailPlaceholder: 'member@example.com',
+    createInvitation: '创建邀请',
+    invitationCreated: '邀请已创建',
+    delivery: {
+      sent: '邀请邮件已发送',
+      link_only: '邀请链接已创建',
+      failed: '邀请链接已创建，但邮件发送失败',
+    },
+    invitationCreateFailed: '创建邀请失败',
+    oneTimeLinkWarning: '请立即复制此链接。它只显示一次。',
+    copyInvitation: '复制邀请链接',
+    invitationCopied: '邀请链接已复制',
+    pendingInvitations: '待接受邀请',
+    expiresAt: '{{date}} 过期',
+    revokeInvitation: '撤销邀请',
+    invitationRevoked: '邀请已撤销',
+    invitationRevokeFailed: '撤销邀请失败',
+    acceptInvitation: '接受邀请',
+    invitedToWorkspace: '你已受邀加入 {{workspace}}',
+    checkingInvitation: '正在验证邀请…',
+    invitationMissing: '此邀请链接缺少必要信息。',
+    invitationExpired: '此邀请已过期。',
+    invitationAlreadyRevoked: '此邀请已被撤销。',
+    invitationAlreadyUsed: '此邀请已被使用。',
+    invitationInvalid: '此邀请无效或已不可用。',
+    invitationAccepted: '已接受邀请',
+    invitationAcceptFailed: '接受邀请失败',
+    invitationEmailMismatch: '此邀请属于另一个邮箱地址。',
+    existingAccountLoginRequired: '此邮箱已有账户，请登录后继续。',
+    acceptAsCurrentAccount: '使用当前账户接受',
+    authenticatedInvitationNotice:
+      '请先退出，再使用受邀账户登录。邀请令牌会被保留。',
+    logoutAndReturn: '退出并返回此邀请',
+    switchAccount: '切换账号',
+    registerAndAccept: '创建账户并接受',
+    alreadyHaveAccount: '我已有账户',
+    confirmPassword: '确认密码',
+    passwordMinimum: '密码至少需要 8 个字符。',
+    passwordMismatch: '两次输入的密码不一致。',
+    backToLogin: '返回登录',
+    memberUpdated: '成员角色已更新',
+    memberUpdateFailed: '更新成员角色失败',
+    removeMember: '移除成员',
+    removeMemberConfirm: '确定将此成员移出工作区吗？',
+    memberRemoved: '成员已移除',
+    memberRemoveFailed: '移除成员失败',
+    transferOwnership: '转让所有权',
+    types: {
+      personal: '个人',
+      team: '团队',
+    },
+    roles: {
+      owner: '所有者',
+      admin: '管理员',
+      developer: '开发者',
+      operator: '运维人员',
+      viewer: '查看者',
+    },
   },
   monitoring: {
     title: '仪表盘',
@@ -1467,6 +1557,7 @@ const zhHans = {
   settingsDialog: {
     title: '设置',
     nav: {
+      workspace: '工作区',
       models: '模型',
       api: 'API',
       storage: '存储',

web/src/i18n/locales/zh-Hant.ts

@@ -79,7 +79,7 @@ const zhHant = {
     loading: '載入中...',
     fieldRequired: '此欄位為必填',
     or: '或',
-    loginWithSpace: '透過 Space 登入',
+    loginWithSpace: '使用 LangBot 帳號登入',
     spaceLoginRecommended: '推薦：使用官方提供的穩定模型 API 和雲服務',
     loginLocal: '使用本地帳號登入',
     loginWithPassword: '透過密碼登入',
@@ -263,7 +263,7 @@ const zhHant = {
     searchProviders: '搜尋供應商...',
     langbotModelsDescription: '由 LangBot Space 提供的雲端模型',
     credits: '積分',
-    loginWithSpace: '使用 Space 登入',
+    loginWithSpace: '使用 LangBot 帳號登入',
     loginToUseModels: '使用 Space 登入以使用雲端模型',
     noModels: '暫無模型',
     langbotModels: 'LangBot 模型',
@@ -791,6 +791,8 @@ const zhHant = {
     boxStdioRefusedSuggestion:
       '請啟用 Box（box.enabled = true）並確認執行時連線正常，或將此伺服器切換到 http/sse 模式。',
     boxRequired: '需要 Box',
+    disabledByPolicy: '已被策略停用',
+    stdioDisabledByPolicy: '此部署已停用 Stdio MCP，請改用遠端 MCP 伺服器。',
     stdioBlockedByBoxToast:
       'Box 沙箱已停用或無法使用，無法儲存 stdio 模式的 MCP。請啟用 Box 或改為 http/sse 模式。',
     toolsFound: '個工具',