feat(web): W2 网页端——认领页、我的 Agent、公会看板与发任务

- /api/voko：guilds、agents（钱包、重置 api_key、停用 / 恢复、单日支出上限）、以 Agent 身份看板与发布 - 单日支出上限在发布时由平台强制（UTC 日） - 发布重放改为锁发布方后先查已有任务 - ui：Textarea 补 box-sizing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(web): W2 网页端——认领页、我的 Agent、公会看板与发任务
- /api/voko：guilds、agents（钱包、重置 api_key、停用 / 恢复、单日支出上限）、以 Agent 身份看板与发布 - 单日支出上限在发布时由平台强制（UTC 日） - 发布重放改为锁发布方后先查已有任务 - ui：Textarea 补 box-sizing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
yibo
1 parent 14da0ada
Showing 20 changed files with 548 additions and 20 deletions
.claude/launch.json
apps/voko-server/src/app.js
apps/voko-server/src/routes/owner.js
apps/voko-server/src/routes/v1.js
apps/voko-web/src/api.js
apps/voko-web/src/i18n/messages.js
apps/voko-web/src/main.js
apps/voko-web/src/pages/AgentsPage.vue
apps/voko-web/src/pages/BoardPage.vue
apps/voko-web/src/pages/ClaimPage.vue
apps/voko-web/src/pages/HomePage.vue
apps/voko-web/src/pages/LoginPage.vue
docs/runbooks/verify-alpha.md
docs/voko/upstream.md
packages/ui/src/components/Textarea.vue
packages/voko-access/src/agent-access.js
packages/voko-clearing/src/escrow.js
packages/voko-exchange/src/agents.js
packages/voko-exchange/src/guilds.js
packages/voko-exchange/src/tasks.js
+{
+  "version": "0.0.1",
+  "configurations": [
+    { "name": "voko-server", "runtimeExecutable": "pnpm", "runtimeArgs": ["--filter", "@voko/server", "start"], "port": 9201 },
+    { "name": "voko-web", "runtimeExecutable": "pnpm", "runtimeArgs": ["--filter", "@voko/web", "dev"], "port": 5201 }
+  ]
+}
@@ -3,6 +3,7 @@ import { registerErrorHandler, registerTrace } from &#39;@drama/server-kit&#39;
  
 import { registerAccessRoutes } from './routes/access.js'
 import { registerAuthRoutes } from './routes/auth.js'
+import { registerOwnerRoutes } from './routes/owner.js'
 import { registerV1Routes } from './routes/v1.js'
  
 /**
@@ -23,6 +24,7 @@ export function buildApp({ services, logger }) {
  
   registerAuthRoutes(app, services)
   registerAccessRoutes(app, services)
+  registerOwnerRoutes(app, services)
   registerV1Routes(app, services)
   return app
 }
+import * as v from 'valibot'
+
+import { codedError, requireUser } from './auth.js'
+import { agentView, IdempotencyKey, PublishBody, REFUSAL_STATUS, taskView } from './v1.js'
+
+const AgentParams = v.object({ id: v.pipe(v.string(), v.minLength(1), v.maxLength(64)) })
+const LimitBody = v.object({ daily_spend_limit: v.nullable(v.pipe(v.number(), v.safeInteger(), v.minValue(0))) })
+const StatusBody = v.object({ status: v.picklist(['active', 'suspended']) })
+
+/**
+ * 主人在网页上管理自己的 Agent，并以其中一个 Agent 的身份看公会看板、发任务（扣该 Agent 的钱包）。
+ * 与公开 API 调用同一套 service。
+ * @param {import('fastify').FastifyInstance} app
+ * @param {Record<string, any>} services
+ */
+export function registerOwnerRoutes(app, services) {
+  const { agents, agentAccess, guilds, escrow, tasks, db } = services
+
+  /**
+   * 取当前用户名下的一个 Agent；不是自己的按不存在处理。
+   * @param {import('fastify').FastifyRequest} request
+   */
+  async function ownAgent(request) {
+    const user = await requireUser(request, services)
+    const params = v.parse(AgentParams, request.params)
+    const mine = await agents.listByOwner(request.ctx, db, { owner_user_id: user.id })
+    const agent = mine.find((item) => item.id === params.id)
+    if (agent === undefined) throw codedError(`Agent not found: ${params.id}`, 'NOT_FOUND')
+    return { user, agent }
+  }
+
+  app.get('/api/voko/guilds', async (request) => {
+    await requireUser(request, services)
+    return { guilds: await guilds.list(request.ctx) }
+  })
+
+  app.get('/api/voko/agents', async (request) => {
+    const user = await requireUser(request, services)
+    const mine = await agents.listByOwner(request.ctx, db, { owner_user_id: user.id })
+    return {
+      agents: await Promise.all(mine.map(async (agent) => ({
+        ...agentView(agent),
+        daily_spend_limit: agent.daily_spend_limit,
+        wallet: await escrow.walletOf(request.ctx, { wallet_user_id: agent.wallet_user_id }),
+      }))),
+    }
+  })
+
+  app.post('/api/voko/agents/:id/api-key/reset', async (request) => {
+    const { agent } = await ownAgent(request)
+    return agentAccess.resetApiKey(request.ctx, { agent_id: agent.id })
+  })
+
+  app.post('/api/voko/agents/:id/status', async (request) => {
+    const { user, agent } = await ownAgent(request)
+    const body = v.parse(StatusBody, request.body)
+    const changed = await agents.setStatus(request.ctx, db, { agent_id: agent.id, owner_user_id: user.id, to: body.status })
+    if (!changed) throw codedError(`Agent is already ${body.status}: ${agent.id}`, 'CONFLICT')
+    return { ok: true }
+  })
+
+  app.post('/api/voko/agents/:id/daily-spend-limit', async (request) => {
+    const { user, agent } = await ownAgent(request)
+    const body = v.parse(LimitBody, request.body)
+    await agents.setDailySpendLimit(request.ctx, db, { agent_id: agent.id, owner_user_id: user.id, daily_spend_limit: body.daily_spend_limit })
+    return { ok: true }
+  })
+
+  app.get('/api/voko/agents/:id/tasks', async (request) => {
+    const { agent } = await ownAgent(request)
+    const page = await tasks.list(request.ctx, { agent, limit: 100 })
+    return { tasks: page.tasks.map(taskView) }
+  })
+
+  app.post('/api/voko/agents/:id/tasks', async (request, reply) => {
+    const { agent } = await ownAgent(request)
+    if (agent.status !== 'active') throw codedError(`Agent is ${agent.status}: ${agent.id}`, 'CONFLICT')
+    const body = v.parse(PublishBody, request.body)
+    const result = await tasks.publish(request.ctx, { agent, title: body.title, spec: body.spec, template: body.template, reward: body.reward, deadline_at: body.deadline, acceptance: body.acceptance, client_request_key: v.parse(IdempotencyKey, request.headers['idempotency-key']) })
+    if (!result.ok) return reply.code(REFUSAL_STATUS[result.code]).send({ error: { code: result.code, message: result.hint, retryable: false } })
+    return { task: taskView(result.task) }
+  })
+}
@@ -12,7 +12,7 @@ const RegisterBody = v.object({
 const TaskParams = v.object({ id: v.pipe(v.string(), v.minLength(1), v.maxLength(64)) })
 const IsoDate = v.pipe(v.string(), v.isoTimestamp(), v.transform((value) => new Date(value)))
 const Reward = v.pipe(v.number(), v.safeInteger(), v.minValue(1), v.maxValue(1_000_000_000))
-const PublishBody = v.object({
+export const PublishBody = v.object({
   title: v.pipe(v.string(), v.minLength(1), v.maxLength(200)),
   spec: v.pipe(v.string(), v.minLength(1), v.maxLength(20000)),
   template: v.picklist(['piecework', 'contest']),
@@ -35,10 +35,10 @@ const ListQuery = v.object({
 })
 const CommentBody = v.object({ body: v.pipe(v.string(), v.minLength(1), v.maxLength(4000)) })
 const EventsQuery = v.object({ since: v.optional(v.pipe(v.string(), v.transform(Number), v.integer(), v.minValue(0)), '0') })
-const IdempotencyKey = v.pipe(v.string('Idempotency-Key header is required'), v.minLength(1), v.maxLength(100))
+export const IdempotencyKey = v.pipe(v.string('Idempotency-Key header is required'), v.minLength(1), v.maxLength(100))
  
 /** 业务拒绝 → HTTP 状态与公开错误码（接入说明「错误码」）。 */
-const REFUSAL_STATUS = Object.freeze({ not_found: 404, forbidden: 403, state_conflict: 409, rule_violation: 422 })
+export const REFUSAL_STATUS = Object.freeze({ not_found: 404, forbidden: 403, state_conflict: 409, rule_violation: 422 })
 const SKILL_VERSION = '0.1.0'
  
 const UpdateMeBody = v.object({ description: v.optional(Description), skills: v.optional(Skills) })
@@ -18,14 +18,16 @@ export function setToken(token) {
  * @param {string} method
  * @param {string} path
  * @param {unknown} [body]
+ * @param {string} [idempotencyKey] 写接口的幂等键：同一次提交重试不会重复扣积分
  */
-export async function api(method, path, body) {
+export async function api(method, path, body, idempotencyKey) {
   const token = getToken()
   const response = await fetch(path, {
     method,
     headers: {
       ...(body === undefined ? {} : { 'content-type': 'application/json' }),
       ...(token === null ? {} : { authorization: `Bearer ${token}` }),
+      ...(idempotencyKey === undefined ? {} : { 'idempotency-key': idempotencyKey }),
     },
     body: body === undefined ? undefined : JSON.stringify(body),
   })
@@ -22,6 +22,7 @@ export const messages = {
       note: 'Anything we should know (optional)',
       apply: 'Apply to join',
       admin: 'Review access requests',
+      agents: 'My agents',
       status: {
         pending: 'Your request is in the queue.',
         approved: 'Approved. You can claim your agents.',
@@ -34,6 +35,54 @@ export const messages = {
       approve: 'Approve',
       reject: 'Reject',
     },
+    claim: {
+      title: 'Claim your agent',
+      intro: 'Enter the verification code your agent gave you and pick the guild it joins.',
+      code: 'Verification code',
+      guild: 'Guild',
+      pickGuild: 'Choose a guild',
+      submit: 'Claim agent',
+      done: 'Claimed. {name} is now active and received 100 starter points.',
+      toAgents: 'Go to my agents',
+    },
+    agents: {
+      title: 'My agents',
+      empty: 'You have not claimed an agent yet. Ask your agent for its claim link.',
+      level: 'Level {level}',
+      wallet: 'Available {available} · Held {held}',
+      board: 'Guild board',
+      resetKey: 'Reset API key',
+      newKey: 'New API key (shown once, give it to your agent):',
+      suspend: 'Suspend',
+      resume: 'Resume',
+      dailyLimit: 'Daily spend limit (empty = no limit)',
+      saveLimit: 'Save limit',
+      saved: 'Saved.',
+      status: { pending_claim: 'Pending claim', active: 'Active', suspended: 'Suspended' },
+    },
+    board: {
+      title: 'Guild board',
+      back: 'Back to my agents',
+      empty: 'No tasks on the board yet.',
+      reward: '{reward} pts',
+      rarity: 'Rarity {rarity}',
+      deadline: 'Due {deadline}',
+      publishTitle: 'Publish a task',
+      publishHint: 'The reward is held in escrow from this agent\'s wallet until the work is accepted.',
+      taskTitle: 'Title',
+      spec: 'What needs to be done',
+      template: 'Template',
+      reward_label: 'Reward (points)',
+      deadline_label: 'Deadline',
+      acceptance: 'Acceptance checklist (1–5 lines, one per line)',
+      publish: 'Publish',
+      published: 'Published.',
+      templates: { piecework: 'Piecework', contest: 'Contest' },
+      status: {
+        pending_approval: 'Pending approval', open: 'Open', claimed: 'Claimed', in_contest: 'In contest', submitted: 'Submitted', reviewing: 'Reviewing',
+        rework: 'Rework', disputed: 'Disputed', settled: 'Settled', cancelled: 'Cancelled', refunded: 'Refunded',
+      },
+    },
   },
   zh: {
     login: {
@@ -55,6 +104,7 @@ export const messages = {
       note: '补充说明（选填）',
       apply: '申请加入',
       admin: '审核加入申请',
+      agents: '我的 Agent',
       status: {
         pending: '你的申请正在排队。',
         approved: '已通过，可以认领 Agent 了。',
@@ -67,5 +117,53 @@ export const messages = {
       approve: '通过',
       reject: '拒绝',
     },
+    claim: {
+      title: '认领你的 Agent',
+      intro: '输入 Agent 给你的验证码，并选择它要加入的公会。',
+      code: '验证码',
+      guild: '公会',
+      pickGuild: '选择公会',
+      submit: '认领',
+      done: '认领成功。{name} 已激活，并收到 100 启动积分。',
+      toAgents: '去我的 Agent',
+    },
+    agents: {
+      title: '我的 Agent',
+      empty: '你还没有认领 Agent。让你的 Agent 把认领链接发给你。',
+      level: '等级 {level}',
+      wallet: '可用 {available} · 托管中 {held}',
+      board: '公会看板',
+      resetKey: '重置 API key',
+      newKey: '新的 API key（只显示一次，请交给你的 Agent）：',
+      suspend: '停用',
+      resume: '恢复',
+      dailyLimit: '单日支出上限（留空 = 不限）',
+      saveLimit: '保存上限',
+      saved: '已保存。',
+      status: { pending_claim: '待认领', active: '运行中', suspended: '已停用' },
+    },
+    board: {
+      title: '公会看板',
+      back: '返回我的 Agent',
+      empty: '看板上还没有任务。',
+      reward: '{reward} 积分',
+      rarity: '稀有度 {rarity}',
+      deadline: '截止 {deadline}',
+      publishTitle: '发布任务',
+      publishHint: '赏金会先从这个 Agent 的钱包冻结托管，验收通过后才发给接单方。',
+      taskTitle: '标题',
+      spec: '要做什么',
+      template: '模板',
+      reward_label: '赏金（积分）',
+      deadline_label: '截止时间',
+      acceptance: '验收清单（1–5 条，每行一条）',
+      publish: '发布',
+      published: '已发布。',
+      templates: { piecework: '计件活', contest: '擂台赛' },
+      status: {
+        pending_approval: '待审核', open: '待接单', claimed: '进行中', in_contest: '擂台赛中', submitted: '待验收', reviewing: '评审中',
+        rework: '返工', disputed: '仲裁中', settled: '已结算', cancelled: '已撤回', refunded: '已退款',
+      },
+    },
   },
 }
@@ -6,6 +6,9 @@ import &#39;@drama/ui/theme.css&#39;
 import App from './App.vue'
 import { messages } from './i18n/messages.js'
 import AdminPage from './pages/AdminPage.vue'
+import AgentsPage from './pages/AgentsPage.vue'
+import BoardPage from './pages/BoardPage.vue'
+import ClaimPage from './pages/ClaimPage.vue'
 import HomePage from './pages/HomePage.vue'
 import LoginPage from './pages/LoginPage.vue'
  
@@ -15,6 +18,9 @@ const router = createRouter({
     { path: '/', component: HomePage },
     { path: '/login', component: LoginPage },
     { path: '/admin', component: AdminPage },
+    { path: '/claim/:token', component: ClaimPage },
+    { path: '/agents', component: AgentsPage },
+    { path: '/agents/:id/board', component: BoardPage },
   ],
 })
  
+<script setup>
+import { onMounted, reactive, ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRouter } from 'vue-router'
+import { Badge, Button, Card, Input } from '@drama/ui'
+
+import { api, getToken } from '../api.js'
+
+const { t } = useI18n()
+const router = useRouter()
+const agents = ref(null)
+/** 每个 Agent 的页面状态：刚重置出的 key、上限输入框、提示。 */
+const local = reactive({})
+
+const BADGE = { pending_claim: 'neutral', active: 'success', suspended: 'warning' }
+
+async function load() {
+  agents.value = (await api('GET', '/api/voko/agents')).agents
+  for (const agent of agents.value) {
+    if (local[agent.id] === undefined) local[agent.id] = { key: '', limit: agent.daily_spend_limit === null ? '' : String(agent.daily_spend_limit), message: '' }
+  }
+}
+
+/**
+ * @param {string} id
+ * @param {() => Promise<void>} action
+ */
+async function run(id, action) {
+  local[id].message = ''
+  try {
+    await action()
+    await load()
+  } catch (err) {
+    local[id].message = err instanceof Error ? err.message : String(err)
+  }
+}
+
+/** @param {string} id */
+const resetKey = (id) => run(id, async () => {
+  local[id].key = (await api('POST', `/api/voko/agents/${id}/api-key/reset`)).api_key
+})
+
+/**
+ * @param {string} id
+ * @param {'active'|'suspended'} status
+ */
+const setStatus = (id, status) => run(id, async () => {
+  await api('POST', `/api/voko/agents/${id}/status`, { status })
+})
+
+/** @param {string} id */
+const saveLimit = (id) => run(id, async () => {
+  const raw = String(local[id].limit).trim()
+  await api('POST', `/api/voko/agents/${id}/daily-spend-limit`, { daily_spend_limit: raw === '' ? null : Number(raw) })
+  local[id].message = t('agents.saved')
+})
+
+onMounted(async () => {
+  if (getToken() === null) {
+    await router.push({ path: '/login', query: { next: '/agents' } })
+    return
+  }
+  await load()
+})
+</script>
+
+<template>
+  <h1>{{ t('agents.title') }}</h1>
+  <template v-if="agents">
+    <p v-if="agents.length === 0">{{ t('agents.empty') }}</p>
+    <Card v-for="agent in agents" :key="agent.id" class="voko-agent">
+      <h2>{{ agent.name }} <Badge :variant="BADGE[agent.status]">{{ t(`agents.status.${agent.status}`) }}</Badge></h2>
+      <p>{{ t('agents.level', { level: agent.level }) }} · {{ t('agents.wallet', agent.wallet) }}</p>
+      <p><router-link :to="`/agents/${agent.id}/board`">{{ t('agents.board') }}</router-link></p>
+      <label class="voko-field">{{ t('agents.dailyLimit') }}<Input v-model="local[agent.id].limit" type="number" /></label>
+      <div class="voko-actions">
+        <Button variant="secondary" @click="saveLimit(agent.id)">{{ t('agents.saveLimit') }}</Button>
+        <Button variant="secondary" @click="resetKey(agent.id)">{{ t('agents.resetKey') }}</Button>
+        <Button v-if="agent.status === 'active'" variant="ghost" @click="setStatus(agent.id, 'suspended')">{{ t('agents.suspend') }}</Button>
+        <Button v-else-if="agent.status === 'suspended'" variant="ghost" @click="setStatus(agent.id, 'active')">{{ t('agents.resume') }}</Button>
+      </div>
+      <p v-if="local[agent.id].key">{{ t('agents.newKey') }} <code class="voko-key">{{ local[agent.id].key }}</code></p>
+      <p v-if="local[agent.id].message" role="status">{{ local[agent.id].message }}</p>
+    </Card>
+  </template>
+</template>
+
+<style scoped>
+.voko-agent {
+  margin-bottom: var(--drama-space-md);
+}
+.voko-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--drama-space-sm);
+}
+.voko-key {
+  overflow-wrap: anywhere;
+}
+</style>
+<script setup>
+import { onMounted, reactive, ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRoute, useRouter } from 'vue-router'
+import { Badge, Button, Card, Input, Select, Textarea } from '@drama/ui'
+
+import { api, getToken } from '../api.js'
+
+const { t } = useI18n()
+const route = useRoute()
+const router = useRouter()
+const tasks = ref(null)
+const message = ref('')
+const form = reactive({ title: '', spec: '', template: 'piecework', reward: '', deadline: '', acceptance: '' })
+// 一次填写对应一个幂等键：提交失败后重试不会重复扣积分，成功后换新键。
+let idempotencyKey = crypto.randomUUID()
+
+const BADGE = { open: 'info', claimed: 'warning', in_contest: 'warning', submitted: 'warning', reviewing: 'warning', rework: 'warning', disputed: 'danger', settled: 'success', pending_approval: 'neutral', cancelled: 'neutral', refunded: 'neutral' }
+const tasksPath = `/api/voko/agents/${route.params.id}/tasks`
+
+async function load() {
+  tasks.value = (await api('GET', tasksPath)).tasks
+}
+
+async function publish() {
+  message.value = ''
+  try {
+    await api('POST', tasksPath, {
+      title: form.title,
+      spec: form.spec,
+      template: form.template,
+      reward: Number(form.reward),
+      deadline: new Date(form.deadline).toISOString(),
+      acceptance: form.acceptance.split('\n').map((line) => line.trim()).filter((line) => line !== '').map((text, index) => ({ id: `c${index + 1}`, text })),
+    }, idempotencyKey)
+    idempotencyKey = crypto.randomUUID()
+    Object.assign(form, { title: '', spec: '', reward: '', deadline: '', acceptance: '' })
+    message.value = t('board.published')
+    await load()
+  } catch (err) {
+    message.value = err instanceof Error ? err.message : String(err)
+  }
+}
+
+onMounted(async () => {
+  if (getToken() === null) {
+    await router.push({ path: '/login', query: { next: route.fullPath } })
+    return
+  }
+  await load()
+})
+</script>
+
+<template>
+  <h1>{{ t('board.title') }}</h1>
+  <p><router-link to="/agents">{{ t('board.back') }}</router-link></p>
+
+  <Card class="voko-board-card">
+    <h2>{{ t('board.publishTitle') }}</h2>
+    <p>{{ t('board.publishHint') }}</p>
+    <label class="voko-field">{{ t('board.taskTitle') }}<Input v-model="form.title" /></label>
+    <label class="voko-field">{{ t('board.spec') }}<Textarea v-model="form.spec" /></label>
+    <div class="voko-field">
+      <span>{{ t('board.template') }}</span>
+      <Select v-model="form.template" :aria-label="t('board.template')" :options="[{ value: 'piecework', label: t('board.templates.piecework') }, { value: 'contest', label: t('board.templates.contest') }]" />
+    </div>
+    <label class="voko-field">{{ t('board.reward_label') }}<Input v-model="form.reward" type="number" /></label>
+    <label class="voko-field">{{ t('board.deadline_label') }}<Input v-model="form.deadline" type="datetime-local" /></label>
+    <label class="voko-field">{{ t('board.acceptance') }}<Textarea v-model="form.acceptance" :rows="3" /></label>
+    <p v-if="message" role="status">{{ message }}</p>
+    <Button :disabled="form.title === '' || form.spec === '' || form.reward === '' || form.deadline === '' || form.acceptance.trim() === ''" @click="publish">{{ t('board.publish') }}</Button>
+  </Card>
+
+  <template v-if="tasks">
+    <p v-if="tasks.length === 0">{{ t('board.empty') }}</p>
+    <Card v-for="task in tasks" :key="task.id" class="voko-board-card">
+      <h3>{{ task.title }} <Badge :variant="BADGE[task.status]">{{ t(`board.status.${task.status}`) }}</Badge></h3>
+      <p>{{ t(`board.templates.${task.template}`) }} · {{ t('board.reward', { reward: task.reward }) }} · {{ t('board.rarity', { rarity: task.rarity }) }} · {{ t('board.deadline', { deadline: new Date(task.deadline).toLocaleString() }) }}</p>
+      <p class="voko-spec">{{ task.spec }}</p>
+    </Card>
+  </template>
+</template>
+
+<style scoped>
+.voko-board-card {
+  margin-bottom: var(--drama-space-md);
+}
+.voko-spec {
+  white-space: pre-wrap;
+}
+</style>
+<script setup>
+import { onMounted, ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRoute, useRouter } from 'vue-router'
+import { Button, Card, Input, Select } from '@drama/ui'
+
+import { api, getToken } from '../api.js'
+
+const { t } = useI18n()
+const route = useRoute()
+const router = useRouter()
+const guilds = ref([])
+const guildId = ref('')
+const code = ref('')
+const error = ref('')
+const claimed = ref(null)
+
+async function claim() {
+  error.value = ''
+  try {
+    claimed.value = (await api('POST', `/api/voko/claims/${route.params.token}`, { verification_code: code.value.trim(), guild_id: guildId.value })).agent
+  } catch (err) {
+    error.value = err instanceof Error ? err.message : String(err)
+  }
+}
+
+onMounted(async () => {
+  if (getToken() === null) {
+    await router.push({ path: '/login', query: { next: route.fullPath } })
+    return
+  }
+  guilds.value = (await api('GET', '/api/voko/guilds')).guilds.map((guild) => ({ value: guild.id, label: guild.name }))
+})
+</script>
+
+<template>
+  <Card>
+    <h1>{{ t('claim.title') }}</h1>
+    <template v-if="claimed">
+      <p>{{ t('claim.done', { name: claimed.name }) }}</p>
+      <router-link to="/agents">{{ t('claim.toAgents') }}</router-link>
+    </template>
+    <template v-else>
+      <p>{{ t('claim.intro') }}</p>
+      <label class="voko-field">{{ t('claim.code') }}<Input v-model="code" /></label>
+      <div class="voko-field">
+        <span>{{ t('claim.guild') }}</span>
+        <Select v-model="guildId" :options="guilds" :placeholder="t('claim.pickGuild')" :aria-label="t('claim.guild')" block />
+      </div>
+      <p v-if="error" role="alert">{{ error }}</p>
+      <Button :disabled="code.trim() === '' || guildId === ''" @click="claim">{{ t('claim.submit') }}</Button>
+    </template>
+  </Card>
+</template>
@@ -39,6 +39,7 @@ onMounted(async () =&gt; {
       <Button @click="apply">{{ t('home.apply') }}</Button>
     </template>
     <p v-else>{{ t(`home.status.${me.access_request.status}`) }}</p>
+    <p v-if="me.access_request !== null && me.access_request.status === 'approved'"><router-link to="/agents">{{ t('home.agents') }}</router-link></p>
     <router-link v-if="me.user.role === 'admin'" to="/admin">{{ t('home.admin') }}</router-link>
   </Card>
 </template>
 <script setup>
 import { ref } from 'vue'
 import { useI18n } from 'vue-i18n'
-import { useRouter } from 'vue-router'
+import { useRoute, useRouter } from 'vue-router'
 import { Button, Card, Input } from '@drama/ui'
  
 import { api, setToken } from '../api.js'
  
 const { t, locale } = useI18n()
 const router = useRouter()
+const route = useRoute()
 const mode = ref('login')
 const email = ref('')
 const password = ref('')
@@ -25,7 +26,9 @@ async function submit() {
       ? await api('POST', '/api/voko/auth/login', { method: 'password', email: email.value, password: password.value })
       : await api('POST', '/api/voko/auth/register', { email: email.value, password: password.value, verification_code: code.value, locale: locale.value })
     setToken(session.access_token)
-    await router.push('/')
+    // 只接受站内路径（认领链接登录后回到认领页）。
+    const next = typeof route.query.next === 'string' && route.query.next.startsWith('/') && !route.query.next.startsWith('//') ? route.query.next : '/'
+    await router.push(next)
   } catch (err) {
     message.value = err instanceof Error ? err.message : String(err)
   }
@@ -28,6 +28,10 @@ pnpm --filter @voko/server verify:conservation  # 只跑对账
 - 缺少环境变量输出 `BLOCKED` 并以 2 退出，不算通过。
 - 失败时 `detail` 里带接口响应或数据 id；服务端错误看 `tmp-voko-server.log`、`tmp-voko-worker.log`。
  
+## 网页端
+
+认领页 `/claim/:token`、我的 Agent `/agents`、公会看板 `/agents/:id/board` 没有自动化脚本：`pnpm dev` 后用本地管理员登录，按「认领 → 设单日上限 → 重置 key → 超上限发布被拒 → 发布成功」手工走一遍。
+
 ## 尚未覆盖
  
 F1-04（发布前审核）、F2-03–07、F3、TM-01–04 在 W3；F0-06、TM-06、CC-03、WH、E2E 在 W4。CC-01 用 6 个 Agent 发 20 个并发请求（每个主人最多认领 3 个 Agent）。
@@ -18,6 +18,7 @@
 | `packages/llm-router/package.json` | 测试脚本加 `--passWithNoTests`（上游该包目前没有测试文件，`vitest run` 会以 1 退出） |
 | `pnpm-workspace.yaml` | 只保留 `apps/*`、`packages/*` |
 | `packages/email/src/templates/waitlist-invite.js` | `inviteUrl` 允许 `http://localhost`（本地验收用），其余仍须 https（2026-10-10） |
+| `packages/ui/src/components/Textarea.vue` | 加 `box-sizing: border-box`，否则 `width: 100%` 加内边距会撑出容器（2026-10-10；上游同样有此问题） |
 | `apps/voko-server/src/assembly/security.js`、`google-oauth.js`、`email-delivery-log.js` | 从 visual-game-server 原样复制（security.js 只改了一条报错文案） |
  
 ## 待裁剪（原样搬入，后续处理）
@@ -43,6 +43,7 @@ function onInput(e) {
  
 <style scoped>
 .drama-textarea {
+  box-sizing: border-box;
   width: 100%;
   padding: var(--drama-space-md);
   border: 1px solid var(--drama-color-border);
@@ -107,7 +107,23 @@ export function createAgentAccess({ db, agents, grantStarter, public_url }) {
     })
   }
  
-  return { register, authenticate, claim }
+  /**
+   * 重置 api_key：吊销旧 key 并发一个新的，明文只在这里返回一次。调用方须已确认 Agent 属于该主人。
+   * @param {object} _ctx
+   * @param {{ agent_id: string }} input
+   * @returns {Promise<{ api_key: string }>}
+   */
+  async function resetApiKey(_ctx, { agent_id }) {
+    const now = new Date()
+    const api_key = `${API_KEY_PREFIX}${randomBytes(32).toString('base64url')}`
+    await db.transaction(async (trx) => {
+      await trx('vk_api_keys').where({ agent_id }).whereNull('revoked_at').update({ revoked_at: now })
+      await trx('vk_api_keys').insert({ id: `ak_${randomUUID()}`, agent_id, key_hash: sha256(api_key), key_prefix: api_key.slice(0, 12), created_at: now })
+    })
+    return { api_key }
+  }
+
+  return { register, authenticate, claim, resetApiKey }
 }
  
 /**
@@ -87,7 +87,20 @@ export function createEscrow({ db }) {
     return { available, held: Number(heldRow.held) }
   }
  
-  return { hold, topupExists, topup, refund, walletOf }
+  /**
+   * 该钱包今天（UTC 日）已冻结进托管的积分，用于单日支出上限。
+   * @param {object} _ctx
+   * @param {import('knex').Knex} trx
+   * @param {{ wallet_user_id: string, now: Date }} input
+   * @returns {Promise<number>}
+   */
+  async function spentToday(_ctx, trx, { wallet_user_id, now }) {
+    const dayStart = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()))
+    const row = await trx('billing_ledger').where({ user_id: wallet_user_id, source: SOURCE, reason: 'vk_escrow_hold' }).where('created_at', '>=', dayStart).sum({ spent: 'amount' }).first()
+    return -Number(row.spent)
+  }
+
+  return { hold, topupExists, topup, refund, walletOf, spentToday }
 }
  
 /**
@@ -17,6 +17,7 @@ export const AGENT_ROLES = Object.freeze([&#39;company&#39;, &#39;member&#39;])
  *   skills: string[],
  *   level: number,
  *   xp: number,
+ *   daily_spend_limit: number|null,
  *   claimed_at: Date|null,
  *   created_at: Date,
  * }} Agent pending_claim 时 owner_user_id / guild_id / claimed_at 为 null，其余状态三者必有。
@@ -47,6 +48,7 @@ export function agentFromRow(row) {
   if (!Array.isArray(row.skills) || row.skills.some((skill) => typeof skill !== 'string')) throw new Error(`vk_agents.skills invalid, id: ${id}`)
   if (!Number.isSafeInteger(row.level) || row.level < 1) throw new Error(`vk_agents.level invalid, id: ${id}`)
   if (!Number.isSafeInteger(row.xp) || row.xp < 0) throw new Error(`vk_agents.xp invalid, id: ${id}`)
+  if (row.daily_spend_limit !== null && (!Number.isSafeInteger(row.daily_spend_limit) || row.daily_spend_limit < 0)) throw new Error(`vk_agents.daily_spend_limit invalid, id: ${id}`)
   return {
     id,
     wallet_user_id: requiredString(row.wallet_user_id, 'wallet_user_id', id),
@@ -59,6 +61,7 @@ export function agentFromRow(row) {
     skills: row.skills,
     level: row.level,
     xp: row.xp,
+    daily_spend_limit: row.daily_spend_limit,
     claimed_at: row.claimed_at,
     created_at: row.created_at,
   }
@@ -127,7 +130,40 @@ export function createAgents() {
     })
   }
  
-  return { insertPending, getById, activate, updateProfile }
+  /**
+   * @param {object} _ctx
+   * @param {import('knex').Knex} runner
+   * @param {{ owner_user_id: string }} input
+   * @returns {Promise<Agent[]>}
+   */
+  async function listByOwner(_ctx, runner, { owner_user_id }) {
+    return (await runner(TABLE).where({ owner_user_id }).orderBy('created_at', 'asc')).map(agentFromRow)
+  }
+
+  /**
+   * 主人停用 / 恢复自己的 Agent。只在 active 与 suspended 之间切换；当前状态不符返回 false。
+   * @param {object} _ctx
+   * @param {import('knex').Knex} runner
+   * @param {{ agent_id: string, owner_user_id: string, to: 'active'|'suspended' }} input
+   * @returns {Promise<boolean>}
+   */
+  async function setStatus(_ctx, runner, { agent_id, owner_user_id, to }) {
+    const from = to === 'active' ? 'suspended' : 'active'
+    return (await runner(TABLE).where({ id: agent_id, owner_user_id, status: from }).update({ status: to, updated_at: new Date() })) === 1
+  }
+
+  /**
+   * 单日支出上限；null 表示不限。
+   * @param {object} _ctx
+   * @param {import('knex').Knex} runner
+   * @param {{ agent_id: string, owner_user_id: string, daily_spend_limit: number|null }} input
+   * @returns {Promise<boolean>}
+   */
+  async function setDailySpendLimit(_ctx, runner, { agent_id, owner_user_id, daily_spend_limit }) {
+    return (await runner(TABLE).where({ id: agent_id, owner_user_id }).update({ daily_spend_limit, updated_at: new Date() })) === 1
+  }
+
+  return { insertPending, getById, activate, updateProfile, listByOwner, setStatus, setDailySpendLimit }
 }
  
 /**
@@ -29,5 +29,14 @@ export function createGuilds({ db }) {
     })
   }
  
-  return { create }
+  /**
+   * 全部公会（认领 Agent 时选择）。
+   * @param {object} _ctx
+   * @returns {Promise<Array<{ id: string, name: string, slug: string }>>}
+   */
+  async function list(_ctx) {
+    return db(TABLE).orderBy('name', 'asc').select('id', 'name', 'slug')
+  }
+
+  return { create, list }
 }
@@ -30,6 +30,7 @@ const JOBS = &#39;vk_jobs&#39;
  *     topupExists(ctx: object, trx: import('knex').Knex, input: { task_id: string, idempotency_key: string }): Promise<boolean>,
  *     topup(ctx: object, trx: import('knex').Knex, input: { task_id: string, amount: number, idempotency_key: string }): Promise<void>,
  *     refund(ctx: object, trx: import('knex').Knex, input: { task_id: string }): Promise<void>,
+ *     spentToday(ctx: object, trx: import('knex').Knex, input: { wallet_user_id: string, now: Date }): Promise<number>,
  *   },
  * }} deps
  */
@@ -49,19 +50,19 @@ export function createTasks({ db, agents, escrow }) {
     const guildId = /** @type {string} */ (agent.guild_id)
     const id = `t_${randomUUID()}`
     return db.transaction(async (trx) => {
-      // 先锁发布方的 Agent 行：同一发布方的发布串行，并发重放在首个事务提交之后才建立快照，能读到已建的任务；
-      // 不这样做，重放的 INSERT 在唯一键上互等会死锁。
+      // 先锁发布方的 Agent 行：同一发布方的发布串行，重放在首个事务提交之后才读到已建的任务并直接返回；
+      // 不串行的话，并发重放的 INSERT 在唯一键上互等会死锁。UNIQUE(publisher_agent_id, client_request_key) 仍是最终裁决。
       await trx('vk_agents').where({ id: agent.id }).forUpdate().first('id')
+      const replayed = await trx(TASKS).where({ publisher_agent_id: agent.id, client_request_key }).first()
+      if (replayed !== undefined) return { ok: true, task: taskFromRow(replayed), acceptance: await acceptanceOf(trx, replayed.id), replayed: true }
+      // 主人设的单日支出上限（UTC 日），在平台侧强制。
+      if (agent.daily_spend_limit !== null && (await escrow.spentToday(ctx, trx, { wallet_user_id: agent.wallet_user_id, now })) + reward > agent.daily_spend_limit) {
+        return refuse('rule_violation', `This would exceed the daily spend limit of ${agent.daily_spend_limit} set by your human.`)
+      }
       const guild = await guildRow(trx, guildId)
       const status = publishStatus({ require_lead_approval: guild.require_lead_approval === 1, publisher_role: agent.role })
-      await trx(TASKS)
-        .insert({ id, guild_id: guildId, publisher_agent_id: agent.id, template, title, spec, reward, rarity: rarityForReward(reward), deadline_at, status, client_request_key, missed_checkpoints: 0, rework_count: 0, created_at: now })
-        .onConflict(['publisher_agent_id', 'client_request_key'])
-        .ignore()
-      const stored = await trx(TASKS).where({ publisher_agent_id: agent.id, client_request_key }).first()
-      if (stored === undefined) throw new Error(`vk_tasks insert was ignored without a conflicting row, publisher: ${agent.id}, key: ${client_request_key}`)
-      const task = taskFromRow(stored)
-      if (task.id !== id) return { ok: true, task, acceptance: await acceptanceOf(trx, task.id), replayed: true }
+      await trx(TASKS).insert({ id, guild_id: guildId, publisher_agent_id: agent.id, template, title, spec, reward, rarity: rarityForReward(reward), deadline_at, status, client_request_key, missed_checkpoints: 0, rework_count: 0, created_at: now })
+      const task = taskFromRow(await trx(TASKS).where({ id }).first())
  
       await trx(ITEMS).insert(acceptance.map((item, index) => ({ task_id: id, item_key: item.id, ordinal: index + 1, text: item.text })))
       await escrow.hold(ctx, trx, { task_id: id, payer_wallet: agent.wallet_user_id, amount: reward })