feat: 项目总群自动建群+任务负责人后台视角+客户群活码进群+任务编辑

- 项目总群：≥3 人 appchat/create 自动建群（chatid=pgc+projectId），成员 diff 增删同步；DROP project_group_chats；推送改 appchat/send 群发、无群降级逐人
- 任务负责人：tasks.owner_userid（新建/编辑任务通讯录选人），task_set_owner 分配即预建 tgc 任务群发介绍，群主链接只归属负责人
- 任务编辑 task_update：基础字段+截图任务数量/关键词/说明，contents 调平只删 available 尾行
- 删除「一键推送」：task-one-click-push-service 整体移除（recordCardAck 移入 wecom-callback-events）
- 负责人后台视角：users.wecom_userid 绑定，lib/owner-scope 行级过滤（undefined=全量/""=空范围/非空=过滤），~30 action 补 managerGate/taskOwnerGate，owner 登录仅见工作台/任务中心/数据回收/复盘报表
- 任务绑定客户群+进群活码：tasks 增 customer_chat_id/name、join_config_id、join_qr_code 4 列，join_way add/update/get/del（换绑走 update 保 config_id 活码不变），后台「客户群」弹窗，portal 认领后扫码自助进群（满员自动开新群）
- 迁移 0013/0014/0015；催办支持按任务；企微可信域名 IP 验证文件
- 288 测试全绿；真机全链路验收通过（列群/活码四端点/portal 渲染/解绑清空）

app/api/action/route.ts

@@ -33,6 +33,7 @@ import {
 import {
   createDistributionTask,
   createScreenshotTask,
+  updateTask,
 } from "../../../lib/task-service";
 import {
   DistributionReleaseError,
@@ -58,7 +59,19 @@ import {
   pushTaskToGroupChats,
   syncGroupChats,
 } from "../../../lib/wecom-group-push-service";
-import { isManagerRequest } from "../../../lib/user-auth";
+import {
+  bindTaskCustomerChat,
+  listOwnerCustomerChats,
+  unbindTaskCustomerChat,
+} from "../../../lib/task-customer-chat-service";
+import { isManagerRequest, managerForbidden } from "../../../lib/user-auth";
+import {
+  getOwnerScope,
+  isDistributionOwner,
+  isTaskOwner,
+  ownerForbidden,
+  ownerScopeUserid,
+} from "../../../lib/owner-scope";
 import { extractPublishUrl } from "../../../lib/publish-url";
 import {
   getAccountFieldRefreshStatus,
@@ -66,22 +79,17 @@ import {
 } from "../../../lib/account-field-refresh-service";
 import {
   deleteProject,
+  ensureProjectMainChat,
+  findOrCreateGroupOwnerPartner,
   getProjectDetail,
   listGroupOwnerPartners,
   listProjects,
   ProjectError,
   saveGroupOwnerPartner,
   saveProject,
-  setProjectGroupChats,
 } from "../../../lib/project-service";
+import { assignTaskOwner } from "../../../lib/task-group-service";
 import { pushProjectTask } from "../../../lib/project-push-service";
-import {
-  findTodayTaskPushLog,
-  listBoundWecomPartners,
-  listTaskPushLogs,
-  OneClickPushError,
-  oneClickPushTask,
-} from "../../../lib/task-one-click-push-service";
 
 type ActionBody = {
   action?: string;
@@ -93,14 +101,49 @@ function numberValue(value: unknown, fallback = 0) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 
+async function assignOwnerQuietly(taskId: string, ownerUserid: unknown) {
+  const owner = String(ownerUserid ?? "").trim();
+  if (!owner) return "";
+  try {
+    const assignment = await assignTaskOwner(
+      getRawDb(),
+      { taskId, ownerUserid: owner },
+      resolveWecomConfig(env as unknown as WecomBindings),
+    );
+    return assignment.warning ?? "";
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+
 export async function POST(request: Request) {
   if (!(await isAdminRequest(request))) return adminForbidden();
   try {
     await ensureSchema();
     const body = (await request.json()) as ActionBody;
     const db = getRawDb();
+    let ownerWarning = "";
+    const scope = await getOwnerScope(request);
+    const managerGate = () =>
+      scope.kind === "owner" ? managerForbidden() : null;
+    const taskOwnerGate = async (taskId: unknown) => {
+      if (scope.kind === "full") return null;
+      const id = String(taskId ?? "").trim();
+      return id && (await isTaskOwner(db, id, scope.wecomUserId))
+        ? null
+        : ownerForbidden();
+    };
+    const distributionOwnerGate = async (distributionId: unknown) => {
+      if (scope.kind === "full") return null;
+      const id = String(distributionId ?? "").trim();
+      return id && (await isDistributionOwner(db, id, scope.wecomUserId))
+        ? null
+        : ownerForbidden();
+    };
 
     if (body.action === "inspect_feishu") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const source = await readFeishuSource(
         String(body.feishuUrl ?? "").trim(),
         env as unknown as FeishuBindings,
@@ -124,6 +167,8 @@ export async function POST(request: Request) {
     }
 
     if (body.action === "create_task") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const name = String(body.name ?? "").trim();
       const brand = String(body.brand ?? "").trim();
       const dueAt = String(body.dueAt ?? "").trim();
@@ -135,7 +180,7 @@ export async function POST(request: Request) {
           { status: 400 },
         );
       }
-      await createDistributionTask(
+      const creation = await createDistributionTask(
         {
           feishuUrl: String(body.feishuUrl ?? "").trim(),
           name,
@@ -144,11 +189,15 @@ export async function POST(request: Request) {
           platform,
           contentFormat,
           projectId: String(body.projectId ?? "").trim(),
+          ownerUserid: String(body.ownerUserid ?? "").trim(),
         },
         env as unknown as FeishuBindings,
       );
+      ownerWarning = await assignOwnerQuietly(creation.taskId, body.ownerUserid);
     } else if (body.action === "create_screenshot_task") {
-      await createScreenshotTask({
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
+      const creation = await createScreenshotTask({
         name: String(body.name ?? "").trim(),
         brand: String(body.brand ?? "").trim(),
         dueAt: String(body.dueAt ?? "").trim(),
@@ -157,8 +206,12 @@ export async function POST(request: Request) {
         quantity: numberValue(body.quantity),
         exampleImageKey: String(body.exampleImageKey ?? "").trim(),
         projectId: String(body.projectId ?? "").trim(),
+        ownerUserid: String(body.ownerUserid ?? "").trim(),
       });
+      ownerWarning = await assignOwnerQuietly(creation.taskId, body.ownerUserid);
     } else if (body.action === "claim") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const partnerId = String(body.partnerId ?? "");
       const taskId = String(body.taskId ?? "");
       const quantity = Math.max(1, Math.min(50, numberValue(body.quantity, 1)));
@@ -361,6 +414,8 @@ export async function POST(request: Request) {
         "account enrichment after publish URL update",
       );
     } else if (body.action === "save_collection_schedule") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const taskId = String(body.taskId ?? "").trim();
       const startDate = String(body.startDate ?? "").trim();
       const days = Array.isArray(body.days)
@@ -439,6 +494,8 @@ export async function POST(request: Request) {
       ).catch(() => undefined);
       runInBackground(catchup, "collection catchup");
     } else if (body.action === "run_due_collections") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       await runDueScheduledCollections(
         db,
         Date.now(),
@@ -451,6 +508,8 @@ export async function POST(request: Request) {
       body.action === "collect_now" ||
       body.action === "collect"
     ) {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const distributionId = String(body.distributionId ?? "");
       const rawDay =
         body.day === null || body.day === undefined
@@ -492,6 +551,8 @@ export async function POST(request: Request) {
         ),
       );
     } else if (body.action === "retry_failed_collections") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const taskId = String(body.taskId ?? "").trim();
       if (!taskId) {
         return Response.json({ error: "请选择需要补采的任务" }, { status: 400 });
@@ -517,6 +578,8 @@ export async function POST(request: Request) {
         ),
       );
     } else if (body.action === "backfill_account_profiles") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const backfill = backfillAccountProfiles(
         db,
         resolveCollectionMcpConfig(
@@ -526,6 +589,8 @@ export async function POST(request: Request) {
       ).catch(() => undefined);
       runInBackground(backfill, "account profile backfill");
     } else if (body.action === "set_public_account_ids") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const items = Array.isArray(body.items) ? body.items.slice(0, 50) : [];
       const normalized = items
         .map((item) => {
@@ -564,6 +629,8 @@ export async function POST(request: Request) {
         ),
       );
     } else if (body.action === "manual_metrics") {
+      const forbidden = await distributionOwnerGate(body.distributionId);
+      if (forbidden) return forbidden;
       const distributionId = String(body.distributionId ?? "");
       const exposure = Math.max(0, numberValue(body.exposure));
       const views = Math.max(0, numberValue(body.views));
@@ -580,6 +647,8 @@ export async function POST(request: Request) {
         .bind(exposure, views, distributionId)
         .run();
     } else if (body.action === "bind_wecom_external_id") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const partnerId = String(body.partnerId ?? "").trim().slice(0, 80);
       const externalId = String(body.wecomExternalUserId ?? "")
         .trim()
@@ -612,6 +681,8 @@ export async function POST(request: Request) {
         wecomName,
       });
     } else if (body.action === "send_test_wecom") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(
         env as unknown as WecomBindings,
       );
@@ -662,16 +733,23 @@ export async function POST(request: Request) {
         dueDays: wecomConfig.dueDays,
       });
     } else if (body.action === "trigger_wecom_due_soon") {
+      const taskId = String(body.taskId ?? "").trim();
+      const forbidden = await taskOwnerGate(taskId || undefined);
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(
         env as unknown as WecomBindings,
       );
       const summary = await runDueSoonWecomNotifications(
         db,
         wecomConfig,
+        undefined,
+        undefined,
+        taskId || undefined,
       );
       return Response.json(summary);
     } else if (body.action === "trigger_wecom_overdue_escalation") {
-      if (!isManagerRequest(request)) return adminForbidden();
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(
         env as unknown as WecomBindings,
       );
@@ -679,24 +757,32 @@ export async function POST(request: Request) {
       const autoRelease = await runOverdueAutoRelease(db, wecomConfig);
       return Response.json({ escalation, autoRelease });
     } else if (body.action === "wecom_list_external_contacts") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(
         env as unknown as WecomBindings,
       );
       const contacts = await listExternalContacts(wecomConfig);
       return Response.json({ contacts });
     } else if (body.action === "wecom_list_internal_contacts") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(
         env as unknown as WecomBindings,
       );
       const contacts = await listInternalContacts(wecomConfig);
       return Response.json({ contacts });
     } else if (body.action === "wecom_sync_group_chats") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(
         env as unknown as WecomBindings,
       );
       const groups = await syncGroupChats(db, wecomConfig);
       return Response.json({ groups, syncedCount: groups.length });
     } else if (body.action === "wecom_push_task_to_groups") {
+      const forbidden = await taskOwnerGate(body.taskId);
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(
         env as unknown as WecomBindings,
       );
@@ -725,34 +811,102 @@ export async function POST(request: Request) {
       });
     } else if (body.action === "wecom_task_group_pushes") {
       const taskId = String(body.taskId ?? "").trim();
+      const forbidden = await taskOwnerGate(taskId || undefined);
+      if (forbidden) return forbidden;
       const pushes = await listGroupPushes(db, taskId || undefined);
       return Response.json({ pushes });
     } else if (body.action === "project_list") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       return Response.json({ projects: await listProjects(db) });
     } else if (body.action === "project_detail") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       return Response.json(await getProjectDetail(db, String(body.projectId ?? "")));
     } else if (body.action === "project_save") {
-      return Response.json({
-        project: await saveProject(db, {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
+      const saved = await saveProject(
+        db,
+        {
           id: body.id,
           name: body.name,
           brand: body.brand,
           mainGroupMemberIds: body.mainGroupMemberIds,
           ownerUserid: body.ownerUserid,
           note: body.note,
-        }),
-      });
+        },
+        resolveWecomConfig(env as unknown as WecomBindings),
+      );
+      return Response.json(saved);
     } else if (body.action === "project_delete") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       await deleteProject(db, String(body.projectId ?? ""));
       return Response.json({ ok: true });
-    } else if (body.action === "project_set_group_chats") {
-      const detail = await setProjectGroupChats(
+    } else if (body.action === "project_ensure_main_chat") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
+      const result = await ensureProjectMainChat(
         db,
         String(body.projectId ?? ""),
-        Array.isArray(body.items) ? body.items : [],
+        resolveWecomConfig(env as unknown as WecomBindings),
       );
-      return Response.json(detail);
+      return Response.json(result);
+    } else if (body.action === "task_set_owner") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
+      const taskId = String(body.taskId ?? "").trim();
+      const ownerUserid = String(body.ownerUserid ?? "").trim();
+      if (!taskId) {
+        return Response.json({ error: "缺少 taskId" }, { status: 400 });
+      }
+      if (!ownerUserid) {
+        return Response.json({ error: "请选择任务负责人" }, { status: 400 });
+      }
+      const existing = await db
+        .prepare("SELECT id FROM tasks WHERE id = ?")
+        .bind(taskId)
+        .first<{ id: string }>();
+      if (!existing) {
+        return Response.json({ error: "任务不存在" }, { status: 404 });
+      }
+      const assignment = await assignTaskOwner(
+        db,
+        { taskId, ownerUserid },
+        resolveWecomConfig(env as unknown as WecomBindings),
+      );
+      const task = await db
+        .prepare("SELECT owner_userid, task_chat_id FROM tasks WHERE id = ?")
+        .bind(taskId)
+        .first<{ owner_userid: string; task_chat_id: string }>();
+      return Response.json({ ok: true, assignment, task });
+    } else if (body.action === "task_update") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
+      const platform = body.platform === "抖音" || body.platform === "小红书"
+        ? (body.platform as "小红书" | "抖音")
+        : undefined;
+      const contentFormat = body.contentFormat === "video" || body.contentFormat === "image_text"
+        ? (body.contentFormat as "image_text" | "video")
+        : undefined;
+      const update = await updateTask({
+        taskId: String(body.taskId ?? ""),
+        name: String(body.name ?? ""),
+        brand: String(body.brand ?? ""),
+        dueAt: String(body.dueAt ?? ""),
+        projectId: String(body.projectId ?? ""),
+        platform,
+        contentFormat,
+        quantity: numberValue(body.quantity),
+        keyword: String(body.keyword ?? ""),
+        instructions: String(body.instructions ?? ""),
+        exampleImageKey: String(body.exampleImageKey ?? ""),
+      });
+      ownerWarning = await assignOwnerQuietly(update.taskId, body.ownerUserid);
     } else if (body.action === "partner_save") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       return Response.json({
         partner: await saveGroupOwnerPartner(db, {
           id: body.id,
@@ -761,8 +915,12 @@ export async function POST(request: Request) {
         }),
       });
     } else if (body.action === "partner_group_owners") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       return Response.json({ partners: await listGroupOwnerPartners(db) });
     } else if (body.action === "project_push_task") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const wecomConfig = resolveWecomConfig(env as unknown as WecomBindings);
       const outcome = await pushProjectTask(
         db,
@@ -779,41 +937,15 @@ export async function POST(request: Request) {
         ...outcome,
         appSent: outcome.appResults.length - appFailed.length,
         appFailedCount: appFailed.length,
-        hint: "任务群走企业群发，群主需在企微客户端「群发助手」点击发送后，消息才会送达客户群",
+        hint: "任务群消息已直接发送至任务内部群（负责人与领取人即时可见）",
       });
-    } else if (body.action === "wecom_bound_partners") {
-      const partners = await listBoundWecomPartners(db);
-      const taskId = String(body.taskId ?? "").trim();
-      const pushedToday = taskId
-        ? await findTodayTaskPushLog(db, taskId, "task_open")
-        : null;
-      return Response.json({ partners, pushedToday });
-    } else if (body.action === "task_one_click_push") {
-      const wecomConfig = resolveWecomConfig(env as unknown as WecomBindings);
-      const outcome = await oneClickPushTask(
-        db,
-        {
-          taskId: body.taskId,
-          sendMainGroup: body.sendMainGroup,
-          sendKoc: body.sendKoc,
-          createGroupTemplate: body.createGroupTemplate,
-          selectedKocPartnerIds: body.selectedKocPartnerIds,
-          force: body.force,
-          text: body.text,
-        },
-        wecomConfig,
-      );
-      return Response.json({
-        ...outcome,
-        hint: "KOC 直达消息已即时送达；任务群走企业群发，群主需在企微客户端「群发助手」点击发送后才会送达客户群",
-      });
-    } else if (body.action === "task_push_logs") {
-      const logs = await listTaskPushLogs(db, String(body.taskId ?? "").trim());
-      return Response.json({ logs });
     } else if (body.action === "task_report_list") {
-      if (!isManagerRequest(request)) return adminForbidden();
-      return Response.json({ reports: await getTaskReportData(db) });
+      return Response.json({
+        reports: await getTaskReportData(db, ownerScopeUserid(scope)),
+      });
     } else if (body.action === "refresh_account_fields") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       const status = startAccountFieldRefresh(
         db,
         resolveCollectionMcpConfig(env as unknown as CollectionMcpBindings),
@@ -821,12 +953,16 @@ export async function POST(request: Request) {
       );
       return Response.json({ refresh: status });
     } else if (body.action === "account_field_refresh_status") {
+      const forbidden = managerGate();
+      if (forbidden) return forbidden;
       return Response.json({ refresh: getAccountFieldRefreshStatus() });
     } else if (body.action === "task_group_links") {
       const taskId = String(body.taskId ?? "").trim();
+      const forbidden = await taskOwnerGate(taskId);
+      if (forbidden) return forbidden;
       const task = await db
         .prepare(
-          "SELECT id, name, share_token, task_chat_id FROM tasks WHERE id = ?",
+          "SELECT id, name, share_token, task_chat_id, owner_userid FROM tasks WHERE id = ?",
         )
         .bind(taskId)
         .first<{
@@ -834,71 +970,162 @@ export async function POST(request: Request) {
           name: string;
           share_token: string | null;
           task_chat_id: string;
+          owner_userid: string;
         }>();
       if (!task) return Response.json({ error: "任务不存在" }, { status: 404 });
       const portalUrl = String(env.KOC_PORTAL_URL ?? "").replace(/\/$/, "");
-      const owners = await listGroupOwnerPartners(db);
+      const ownerUserid = String(task.owner_userid ?? "").trim();
+      let owners: {
+        partnerId: string;
+        name: string;
+        wecomUserid: string;
+        isInternal: boolean;
+        link: string;
+      }[] = [];
+      if (task.share_token && ownerUserid) {
+        try {
+          const partner = await findOrCreateGroupOwnerPartner(db, ownerUserid);
+          owners = [
+            {
+              partnerId: partner.id,
+              name: partner.name,
+              wecomUserid: partner.wecom_userid,
+              isInternal: Boolean(partner.wecom_userid),
+              link: `${portalUrl}/?task=${task.share_token}&owner=${partner.id}`,
+            },
+          ];
+        } catch {
+          owners = [];
+        }
+      }
       return Response.json({
         taskName: task.name,
         taskChatId: task.task_chat_id ?? "",
         claimUrl: task.share_token
           ? `${portalUrl}/?task=${task.share_token}`
           : "",
-        owners: task.share_token
-          ? owners.map((owner) => ({
-              partnerId: owner.id,
-              name: owner.name,
-              wecomUserid: owner.wecom_userid,
-              isInternal: Boolean(owner.wecom_userid),
-              link: `${portalUrl}/?task=${task.share_token}&owner=${owner.id}`,
-            }))
-          : [],
+        owners,
+      });
+    } else if (body.action === "task_customer_chats") {
+      const taskId = String(body.taskId ?? "").trim();
+      const forbidden = await taskOwnerGate(taskId);
+      if (forbidden) return forbidden;
+      const task = await db
+        .prepare(
+          "SELECT id, owner_userid, customer_chat_id FROM tasks WHERE id = ?",
+        )
+        .bind(taskId)
+        .first<{ id: string; owner_userid: string; customer_chat_id: string }>();
+      if (!task) return Response.json({ error: "任务不存在" }, { status: 404 });
+      const ownerUserid = (
+        scope.kind === "full"
+          ? String(task.owner_userid ?? "")
+          : scope.wecomUserId
+      ).trim();
+      if (!ownerUserid) {
+        return Response.json(
+          { error: "请先设置任务负责人，再绑定客户群" },
+          { status: 400 },
+        );
+      }
+      const wecomConfig = resolveWecomConfig(env as unknown as WecomBindings);
+      const chats = await listOwnerCustomerChats(wecomConfig, ownerUserid);
+      return Response.json({
+        ownerUserid,
+        chats,
+        boundChatId: String(task.customer_chat_id ?? ""),
+      });
+    } else if (body.action === "task_bind_customer_chat") {
+      const taskId = String(body.taskId ?? "").trim();
+      const forbidden = await taskOwnerGate(taskId);
+      if (forbidden) return forbidden;
+      const task = await db
+        .prepare(
+          "SELECT id, owner_userid, customer_chat_id FROM tasks WHERE id = ?",
+        )
+        .bind(taskId)
+        .first<{ id: string; owner_userid: string; customer_chat_id: string }>();
+      if (!task) return Response.json({ error: "任务不存在" }, { status: 404 });
+      const ownerUserid = (
+        scope.kind === "full"
+          ? String(task.owner_userid ?? "")
+          : scope.wecomUserId
+      ).trim();
+      const chatId = String(body.chatId ?? "").trim();
+      if (chatId && !ownerUserid) {
+        return Response.json(
+          { error: "请先设置任务负责人，再绑定客户群" },
+          { status: 400 },
+        );
+      }
+      const wecomConfig = resolveWecomConfig(env as unknown as WecomBindings);
+      if (chatId) {
+        const chatName = String(body.chatName ?? "").trim();
+        const result = await bindTaskCustomerChat(
+          db,
+          { taskId, chatId, chatName },
+          wecomConfig,
+        );
+        return Response.json({ task: result });
+      }
+      await unbindTaskCustomerChat(db, taskId, wecomConfig);
+      return Response.json({
+        task: {
+          customerChatId: "",
+          customerChatName: "",
+          joinConfigId: "",
+          joinQrCode: "",
+        },
       });
     } else if (body.action === "task_group_push") {
       const taskId = String(body.taskId ?? "").trim();
       const task = await db
         .prepare(
-          "SELECT id, name, share_token FROM tasks WHERE id = ?",
+          "SELECT id, name, share_token, owner_userid FROM tasks WHERE id = ?",
         )
         .bind(taskId)
-        .first<{ id: string; name: string; share_token: string | null }>();
+        .first<{
+          id: string;
+          name: string;
+          share_token: string | null;
+          owner_userid: string;
+        }>();
       if (!task) return Response.json({ error: "任务不存在" }, { status: 404 });
+      const forbidden = await taskOwnerGate(taskId);
+      if (forbidden) return forbidden;
       if (!task.share_token) {
         return Response.json({ error: "任务缺少领取链接" }, { status: 400 });
       }
-      const owners = (await listGroupOwnerPartners(db)).filter(
-        (owner) => owner.wecom_userid,
-      );
-      if (owners.length === 0) {
+      const ownerUserid = String(task.owner_userid ?? "").trim();
+      if (!ownerUserid) {
         return Response.json(
-          { error: "没有可推送的内部群主，请先在后台登记群主 userid" },
+          { error: "该任务未分配负责人，请先在任务中心分配" },
           { status: 400 },
         );
       }
+      const owner = await findOrCreateGroupOwnerPartner(db, ownerUserid);
       const portalUrl = String(env.KOC_PORTAL_URL ?? "").replace(/\/$/, "");
       const wecomConfig = resolveWecomConfig(env as unknown as WecomBindings);
       let sent = 0;
       let failed = 0;
       const failList: string[] = [];
-      for (const owner of owners) {
-        const link = `${portalUrl}/?task=${task.share_token}&owner=${owner.id}`;
-        try {
-          const result = await sendWecomAppMessage(
-            [owner.wecom_userid],
-            `【任务派发】${task.name}\n请把领取链接转发给你的 KOC（链接已绑定你的群主身份）：\n${link}`,
-            wecomConfig,
-          );
-          if (result.skipped) {
-            failed += 1;
-            failList.push(owner.name);
-          } else {
-            sent += result.sent;
-            failed += result.failed;
-          }
-        } catch {
+      const link = `${portalUrl}/?task=${task.share_token}&owner=${owner.id}`;
+      try {
+        const result = await sendWecomAppMessage(
+          [owner.wecom_userid],
+          `【任务派发】${task.name}\n请把领取链接转发给你的 KOC（链接已绑定你的群主身份）：\n${link}`,
+          wecomConfig,
+        );
+        if (result.skipped) {
           failed += 1;
           failList.push(owner.name);
+        } else {
+          sent += result.sent;
+          failed += result.failed;
         }
+      } catch {
+        failed += 1;
+        failList.push(owner.name);
       }
       return Response.json({ sent, failed, failList });
     } else if (body.action === "wecom_group_chats") {
@@ -908,7 +1135,10 @@ export async function POST(request: Request) {
       return Response.json({ error: "不支持的操作" }, { status: 400 });
     }
 
-    return Response.json(await getDashboardData());
+    const dashboard = await getDashboardData(ownerScopeUserid(scope));
+    return Response.json(
+      ownerWarning ? { ...dashboard, ownerWarning } : dashboard,
+    );
   } catch (error) {
     return Response.json(
       { error: error instanceof Error ? error.message : "操作失败" },
@@ -917,8 +1147,7 @@ export async function POST(request: Request) {
           error instanceof FeishuSourceError ||
           error instanceof DistributionReleaseError ||
           error instanceof WecomClientError ||
-          error instanceof ProjectError ||
-          error instanceof OneClickPushError
+          error instanceof ProjectError
             ? error.status
             : 500,
       },

app/api/auth/login/route.ts

@@ -16,7 +16,7 @@ export async function POST(request: Request) {
     const password = String(body.password ?? "");
     const user = await getRawDb()
       .prepare(
-        `SELECT id, username, role, password_hash, password_salt, password_iterations
+        `SELECT id, username, role, wecom_userid, password_hash, password_salt, password_iterations
          FROM users WHERE username = ? LIMIT 1`,
       )
       .bind(username)
@@ -24,6 +24,7 @@ export async function POST(request: Request) {
         id: string;
         username: string;
         role: string;
+        wecom_userid: string | null;
         password_hash: string;
         password_salt: string;
         password_iterations: number;
@@ -34,7 +35,14 @@ export async function POST(request: Request) {
     const token = await createSession(user.id);
     const secure = requestUsesHttps(request);
     return Response.json(
-      { user: { id: user.id, username: user.username, role: user.role } },
+      {
+        user: {
+          id: user.id,
+          username: user.username,
+          role: user.role,
+          wecom_userid: String(user.wecom_userid ?? ""),
+        },
+      },
       { headers: { "Set-Cookie": createSessionCookie(token, secure) } },
     );
   } catch (error) {

app/api/bootstrap/route.ts

@@ -15,6 +15,7 @@ import {
   seedIfEmpty,
 } from "../../../lib/mvp-db";
 import { authForbidden, getRequestPrincipal } from "../../../lib/user-auth";
+import { getOwnerScope, ownerScopeUserid } from "../../../lib/owner-scope";
 
 export async function GET(request: Request) {
   const principal = await getRequestPrincipal(request);
@@ -56,12 +57,9 @@ export async function GET(request: Request) {
       accountBackfill,
     ]);
     runInBackground(catchup, "bootstrap catchup");
-    const dashboard = await getDashboardData();
-    return Response.json(
-      principal.kind === "user" && principal.user.role === "user"
-        ? { ...dashboard, accounts: [] }
-        : dashboard,
-    );
+    const scope = await getOwnerScope(request);
+    const dashboard = await getDashboardData(ownerScopeUserid(scope));
+    return Response.json(dashboard);
   } catch (error) {
     return Response.json(
       { error: error instanceof Error ? error.message : "加载失败" },

app/api/partner/route.ts

@@ -346,6 +346,11 @@ async function handleGet(request: Request) {
         )
         .bind(claimRow.id)
         .all();
+      const joinQrRow = await getRawDb()
+        .prepare("SELECT join_qr_code FROM tasks WHERE id = ?")
+        .bind(task.id)
+        .first<{ join_qr_code: string | null }>();
+      const joinQrCode = String(joinQrRow?.join_qr_code ?? "").trim();
       claim = {
         id: claimRow.id,
         claimantName: claimRow.claimant_name,
@@ -359,6 +364,7 @@ async function handleGet(request: Request) {
           video_assets: undefined,
         })),
         delegations: delegations.results,
+        joinQrCode,
       };
     } else if (delegationAccess) {
       const assignments = await getRawDb()

app/api/recovery-export/route.ts

@@ -1,6 +1,7 @@
 import { getRuntimeEnv } from "../../../lib/runtime-env";
 import type { StoredObjectBody } from "../../../lib/object-store";
 import { adminForbidden, isAdminRequest } from "../../../lib/admin-auth";
+import { getOwnerScope, isTaskOwner, ownerForbidden } from "../../../lib/owner-scope";
 import { parseStoredDate } from "../../../lib/date-utils";
 import {
   downloadFeishuMedia,
@@ -241,6 +242,15 @@ export async function GET(request: Request) {
       return Response.json({ error: "缺少导出任务" }, { status: 400 });
     }
     const db = getRawDb();
+    if (!tokenPayload) {
+      const scope = await getOwnerScope(request);
+      if (
+        scope.kind === "owner" &&
+        !(await isTaskOwner(db, taskId, scope.wecomUserId))
+      ) {
+        return ownerForbidden();
+      }
+    }
     const task = await db
       .prepare("SELECT id, name, brand, platform FROM tasks WHERE id = ?")
       .bind(taskId)

app/api/screenshot-task-export/route.ts

@@ -2,6 +2,7 @@ import { zipSync, strToU8 } from "fflate";
 import { adminForbidden, isAdminRequest } from "../../../lib/admin-auth";
 import { ensureSchema, getRawDb, getUploadBucket } from "../../../lib/mvp-db";
 import { parseResultScreenshotKeys } from "../../../lib/result-screenshots";
+import { getOwnerScope, isTaskOwner, ownerForbidden } from "../../../lib/owner-scope";
 
 function safeName(value: string) {
   return value.replace(/[\\/:*?"<>|\r\n]/g, "_").trim().slice(0, 60) || "KOC";
@@ -20,6 +21,13 @@ export async function GET(request: Request) {
     if (!taskId) {
       return Response.json({ error: "缺少任务参数" }, { status: 400 });
     }
+    const scope = await getOwnerScope(request);
+    if (
+      scope.kind === "owner" &&
+      !(await isTaskOwner(getRawDb(), taskId, scope.wecomUserId))
+    ) {
+      return ownerForbidden();
+    }
     const task = await getRawDb()
       .prepare("SELECT name, task_type FROM tasks WHERE id = ?")
       .bind(taskId)

app/api/task-report-export/route.ts

@@ -5,12 +5,16 @@ import {
   getRawDb,
   getTaskReportData,
 } from "../../../lib/mvp-db";
+import { getOwnerScope, ownerScopeUserid } from "../../../lib/owner-scope";
 
 export async function GET(request: Request) {
   try {
     if (!(await isAdminRequest(request))) return adminForbidden();
     await ensureSchema();
-    const rows = await getTaskReportData(getRawDb());
+    const rows = await getTaskReportData(
+      getRawDb(),
+      ownerScopeUserid(await getOwnerScope(request)),
+    );
     const fileName = `任务复盘报表.csv`;
     return new Response(buildTaskReportCsv(rows), {
       headers: {

app/api/task-result-image/route.ts

@@ -1,6 +1,7 @@
 import { adminForbidden, isAdminRequest } from "../../../lib/admin-auth";
 import { ensureSchema, getRawDb, getUploadBucket } from "../../../lib/mvp-db";
 import { parseResultScreenshotKeys } from "../../../lib/result-screenshots";
+import { getOwnerScope, isDistributionOwner, ownerForbidden } from "../../../lib/owner-scope";
 
 export async function GET(request: Request) {
   if (!(await isAdminRequest(request))) return adminForbidden();
@@ -9,6 +10,13 @@ export async function GET(request: Request) {
     const distributionId = new URL(request.url).searchParams
       .get("distribution")
       ?.trim();
+    const scope = await getOwnerScope(request);
+    if (
+      scope.kind === "owner" &&
+      !(await isDistributionOwner(getRawDb(), distributionId ?? "", scope.wecomUserId))
+    ) {
+      return ownerForbidden();
+    }
     const imageIndex = Math.max(
       1,
       Number(new URL(request.url).searchParams.get("index") || 1),

app/api/users/route.ts

@@ -13,6 +13,7 @@ type UserRow = {
   id: string;
   username: string;
   role: UserRole;
+  wecom_userid: string | null;
   created_at: string;
   updated_at: string;
 };
@@ -28,7 +29,7 @@ async function manager(request: Request) {
 async function listUsers() {
   const result = await getRawDb()
     .prepare(
-      `SELECT id, username, role, created_at, updated_at
+      `SELECT id, username, role, wecom_userid, created_at, updated_at
        FROM users
        ORDER BY CASE role WHEN 'super_admin' THEN 1 WHEN 'admin' THEN 2 ELSE 3 END,
                 created_at ASC`,
@@ -54,6 +55,7 @@ export async function POST(request: Request) {
       password?: string;
       role?: UserRole;
       userId?: string;
+      wecomUserid?: string;
     };
     const db = getRawDb();
 
@@ -65,6 +67,9 @@ export async function POST(request: Request) {
       const passwordRecord = await createPasswordRecord(password);
       const username = normalizeUsername(body.username);
       const role = body.role === "admin" ? "admin" : "user";
+      const wecomUserid = String(body.wecomUserid ?? "")
+        .trim()
+        .slice(0, 128);
       if (!validateUsername(username)) {
         return Response.json(
           { error: "账号需为2—32位中文、字母、数字或 _ . @ + -" },
@@ -77,8 +82,8 @@ export async function POST(request: Request) {
       await db
         .prepare(
           `INSERT INTO users
-            (id, username, password_hash, password_salt, password_iterations, role)
-           VALUES (?, ?, ?, ?, ?, ?)`,
+            (id, username, password_hash, password_salt, password_iterations, role, wecom_userid)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`,
         )
         .bind(
           crypto.randomUUID(),
@@ -87,8 +92,36 @@ export async function POST(request: Request) {
           passwordRecord.passwordSalt,
           passwordRecord.passwordIterations,
           role,
+          wecomUserid,
         )
         .run();
+    } else if (body.action === "set_wecom") {
+      const wecomUserid = String(body.wecomUserid ?? "")
+        .trim()
+        .slice(0, 128);
+      const target = await db
+        .prepare("SELECT id, role FROM users WHERE id = ?")
+        .bind(String(body.userId ?? ""))
+        .first<{ id: string; role: UserRole }>();
+      if (!target) {
+        return Response.json({ error: "没有找到这个账号" }, { status: 404 });
+      }
+      if (target.role === "super_admin") {
+        return Response.json(
+          { error: "不能修改超级管理员账号" },
+          { status: 403 },
+        );
+      }
+      if (currentUser.role !== "super_admin" && target.role !== "user") {
+        return managerForbidden();
+      }
+      await db
+        .prepare(
+          `UPDATE users SET wecom_userid = ?, updated_at = CURRENT_TIMESTAMP
+           WHERE id = ?`,
+        )
+        .bind(wecomUserid, target.id)
+        .run();
     } else if (body.action === "reset_password") {
       const password = String(body.password ?? "");
       if (!validatePassword(password)) {

app/globals.css

@@ -1550,6 +1550,30 @@ a {
   border-radius: 12px;
 }
 
+.join-qr-preview {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 6px;
+  margin-top: 12px;
+  padding: 12px;
+  border: 1px solid rgb(20 40 34 / 0.12);
+  border-radius: 12px;
+  background: white;
+}
+
+.join-qr-preview img {
+  width: 180px;
+  height: 180px;
+  object-fit: contain;
+  border-radius: 8px;
+}
+
+.join-qr-preview span {
+  color: rgb(20 40 34 / 0.55);
+  font-size: 11px;
+}
+
 .wecom-picker-row {
   display: grid;
   grid-template-columns: 40px 1fr auto;
@@ -4397,12 +4421,27 @@ label small {
 .user-table-head,
 .user-table-row {
   display: grid;
-  grid-template-columns: minmax(160px, 1.4fr) minmax(100px, 0.7fr) minmax(110px, 0.75fr) minmax(180px, auto);
+  grid-template-columns: minmax(140px, 1.2fr) minmax(90px, 0.6fr) minmax(150px, 1.2fr) minmax(100px, 0.7fr) minmax(170px, auto);
   gap: 12px;
   align-items: center;
   padding: 14px 16px;
 }
 
+.user-wecom-cell {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 6px;
+}
+
+.user-wecom-cell code {
+  font-size: 10px;
+  color: #3f6f5f;
+  background: #eef4f0;
+  border-radius: 6px;
+  padding: 3px 6px;
+}
+
 .user-table-head {
   color: #899490;
   background: #f5f7f5;

app/task-customer-chat-modal.tsx

@@ -0,0 +1,218 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { readApiResponse } from "./wecom-user-picker";
+
+type CustomerChat = {
+  chatId: string;
+  name: string;
+  ownerUserId: string;
+  memberCount: number;
+  status: number;
+};
+
+type BindResult = {
+  customerChatId: string;
+  customerChatName: string;
+  joinConfigId: string;
+  joinQrCode: string;
+  qrError?: string;
+};
+
+export function TaskCustomerChatModal({
+  task,
+  onClose,
+  onBound,
+}: {
+  task: { id: string; name: string; customerChatId: string; customerChatName: string };
+  onClose: () => void;
+  onBound: () => void;
+}) {
+  const [chats, setChats] = useState<CustomerChat[]>([]);
+  const [boundChatId, setBoundChatId] = useState(task.customerChatId);
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState("");
+  const [notice, setNotice] = useState("");
+  const [selectedChatId, setSelectedChatId] = useState(task.customerChatId);
+  const [bindResult, setBindResult] = useState<BindResult | null>(null);
+
+  const loadChats = useCallback(async () => {
+    setLoading(true);
+    setError("");
+    try {
+      const response = await fetch("/api/action", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ action: "task_customer_chats", taskId: task.id }),
+      });
+      const parsed = await readApiResponse<{
+        chats?: CustomerChat[];
+        boundChatId?: string;
+        error?: string;
+      }>(response, "获取客户群列表失败");
+      if (!response.ok) {
+        throw new Error(parsed.error || "获取客户群列表失败");
+      }
+      setChats(Array.isArray(parsed.chats) ? parsed.chats : []);
+      const bound = String(parsed.boundChatId ?? "");
+      setBoundChatId(bound);
+      setSelectedChatId(bound);
+    } catch (reason) {
+      setError(reason instanceof Error ? reason.message : "获取客户群列表失败");
+    } finally {
+      setLoading(false);
+    }
+  }, [task.id]);
+
+  useEffect(() => {
+    const timer = window.setTimeout(() => {
+      void loadChats();
+    }, 0);
+    return () => window.clearTimeout(timer);
+  }, [loadChats]);
+
+  const submitBind = async (chatId: string) => {
+    const chat = chats.find((item) => item.chatId === chatId);
+    setSaving(true);
+    setError("");
+    setNotice("");
+    try {
+      const response = await fetch("/api/action", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          action: "task_bind_customer_chat",
+          taskId: task.id,
+          chatId,
+          chatName: chat?.name ?? "",
+        }),
+      });
+      const parsed = await readApiResponse<{ task?: BindResult; error?: string }>(
+        response,
+        "绑定客户群失败",
+      );
+      if (!response.ok) {
+        throw new Error(parsed.error || "绑定客户群失败");
+      }
+      const result = parsed.task ?? null;
+      setBindResult(result);
+      setBoundChatId(chatId);
+      setSelectedChatId(chatId);
+      setNotice(
+        chatId
+          ? result?.qrError
+            ? `已绑定，但${result.qrError}，可重新保存刷新`
+            : `已绑定「${result?.customerChatName || chat?.name || chatId}」，认领人扫码即可进群`
+          : "已解绑，认领页不再展示进群二维码",
+      );
+      onBound();
+    } catch (reason) {
+      setError(reason instanceof Error ? reason.message : "绑定客户群失败");
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const unbind = async () => {
+    if (!window.confirm("解绑后认领页将不再展示进群二维码，确定解绑？")) return;
+    await submitBind("");
+  };
+
+  return (
+    <div className="modal-backdrop" role="presentation" onMouseDown={onClose}>
+      <div
+        className="modal-card wecom-picker-modal"
+        onMouseDown={(event) => event.stopPropagation()}
+      >
+        <div className="modal-heading">
+          <div>
+            <h2>绑定客户群</h2>
+            <p>
+              列出任务负责人名下的企业微信客户群，绑定后生成进群活码，认领人在领取页扫码进群。
+            </p>
+          </div>
+          <button type="button" onClick={onClose} aria-label="关闭">×</button>
+        </div>
+        <div className="import-guide-strip">
+          <span className="wecom-picker-cache-hint">
+            任务：{task.name}
+            {boundChatId ? ` · 当前绑定：${task.customerChatName || boundChatId}` : " · 未绑定"}
+          </span>
+          <button
+            type="button"
+            className="ghost-button"
+            onClick={() => void loadChats()}
+            disabled={loading || saving}
+          >
+            {loading ? "拉取中…" : "刷新列表"}
+          </button>
+        </div>
+        {error && <p className="form-error">{error}</p>}
+        {notice && <p className="wecom-picker-cache-hint">{notice}</p>}
+        {bindResult?.joinQrCode && (
+          <div className="join-qr-preview">
+            <img src={bindResult.joinQrCode} alt="进群活码" />
+            <span>进群活码（已同步展示在认领页）</span>
+          </div>
+        )}
+        <div className="wecom-picker-list">
+          {loading ? (
+            <div className="wecom-picker-empty">正在拉取负责人名下客户群…</div>
+          ) : chats.length === 0 ? (
+            <div className="wecom-picker-empty">
+              未拉取到客户群——请任务负责人先在企微客户端创建客户群（内外部成员都可拉入），
+              再点击「刷新列表」。
+            </div>
+          ) : (
+            chats.map((chat) => {
+              const isBound = chat.chatId === boundChatId;
+              return (
+                <label key={chat.chatId} className="wecom-picker-row">
+                  <span className="wecom-picker-avatar placeholder" aria-hidden="true">
+                    {(chat.name || chat.chatId).slice(0, 1)}
+                  </span>
+                  <span className="wecom-picker-meta">
+                    <span className="wecom-picker-name">{chat.name || chat.chatId}</span>
+                    <span className="wecom-picker-sub">{chat.memberCount} 人</span>
+                    <code className="wecom-picker-id">{chat.chatId}</code>
+                  </span>
+                  <input
+                    type="radio"
+                    name="customer-chat"
+                    checked={selectedChatId === chat.chatId}
+                    onChange={() => setSelectedChatId(chat.chatId)}
+                  />
+                  {isBound ? <span className="wecom-picker-current">已绑定</span> : null}
+                </label>
+              );
+            })
+          )}
+        </div>
+        <div className="modal-actions">
+          {boundChatId ? (
+            <button
+              type="button"
+              className="ghost-button"
+              onClick={() => void unbind()}
+              disabled={saving}
+            >
+              解绑当前群
+            </button>
+          ) : null}
+          <button type="button" className="ghost-button" onClick={onClose} disabled={saving}>
+            关闭
+          </button>
+          <button
+            type="button"
+            className="primary-button"
+            onClick={() => void submitBind(selectedChatId)}
+            disabled={saving || loading || !selectedChatId || selectedChatId === boundChatId}
+          >
+            {saving ? "保存中…" : selectedChatId === boundChatId ? "已绑定" : "绑定所选群"}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}

app/users-page.tsx

@@ -2,11 +2,13 @@
 
 import { FormEvent, useCallback, useEffect, useState } from "react";
 import type { AuthUser, UserRole } from "../lib/user-auth";
+import { WecomUserPickerModal } from "./wecom-user-picker";
 
 type ManagedUser = {
   id: string;
   username: string;
   role: UserRole;
+  wecom_userid: string | null;
   created_at: string;
   updated_at: string;
 };
@@ -31,6 +33,9 @@ export default function UsersPage({ currentUser }: { currentUser: AuthUser }) {
   const [resetTarget, setResetTarget] = useState<ManagedUser | null>(null);
   const [resetPassword, setResetPassword] = useState("");
   const [deleteTarget, setDeleteTarget] = useState<ManagedUser | null>(null);
+  const [createWecom, setCreateWecom] = useState("");
+  const [createPickerOpen, setCreatePickerOpen] = useState(false);
+  const [bindTarget, setBindTarget] = useState<ManagedUser | null>(null);
   const [message, setMessage] = useState("");
   const [working, setWorking] = useState(false);
 
@@ -58,13 +63,20 @@ export default function UsersPage({ currentUser }: { currentUser: AuthUser }) {
         await fetch("/api/users", {
           method: "POST",
           headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ action: "create", username, password, role }),
+          body: JSON.stringify({
+            action: "create",
+            username,
+            password,
+            role,
+            wecomUserid: createWecom,
+          }),
         }),
       );
       setUsers(next);
       setUsername("");
       setPassword("");
       setRole("user");
+      setCreateWecom("");
       setMessage("账号已创建，可以把账号和密码交给用户登录");
     } catch (reason) {
       setMessage(reason instanceof Error ? reason.message : "创建失败");
@@ -126,6 +138,27 @@ export default function UsersPage({ currentUser }: { currentUser: AuthUser }) {
     }
   };
 
+  const bindWecom = async (userId: string, wecomUserid: string) => {
+    setWorking(true);
+    setMessage("");
+    try {
+      const next = await userApi(
+        await fetch("/api/users", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ action: "set_wecom", userId, wecomUserid }),
+        }),
+      );
+      setUsers(next);
+      setBindTarget(null);
+      setMessage(wecomUserid ? "企微绑定已更新，立即生效" : "已解除企微绑定");
+    } catch (reason) {
+      setMessage(reason instanceof Error ? reason.message : "绑定失败");
+    } finally {
+      setWorking(false);
+    }
+  };
+
   const canReset = (item: ManagedUser) => {
     if (currentUser.role === "super_admin") {
       return item.role !== "super_admin" || item.id === currentUser.id;
@@ -133,6 +166,11 @@ export default function UsersPage({ currentUser }: { currentUser: AuthUser }) {
     return item.role === "user";
   };
 
+  const canBind = (item: ManagedUser) => {
+    if (item.role === "super_admin") return false;
+    return currentUser.role === "super_admin" || item.role === "user";
+  };
+
   const canDelete = (item: ManagedUser) => {
     if (item.id === currentUser.id || item.role === "super_admin") return false;
     return currentUser.role === "super_admin" || item.role === "user";
@@ -182,6 +220,22 @@ export default function UsersPage({ currentUser }: { currentUser: AuthUser }) {
               </select>
             </label>
           )}
+          <label className="user-role-field">
+            <span>企微 userid（任务负责人，可选）</span>
+            <input
+              value={createWecom}
+              onChange={(event) => setCreateWecom(event.target.value)}
+              placeholder="绑定后该账号只看自己负责的任务"
+              autoComplete="off"
+            />
+            <button
+              type="button"
+              className="ghost-button"
+              onClick={() => setCreatePickerOpen(true)}
+            >
+              从企微选择
+            </button>
+          </label>
           <button className="primary-button" disabled={working}>
             {working ? "处理中…" : "创建账号"}
           </button>
@@ -198,12 +252,45 @@ export default function UsersPage({ currentUser }: { currentUser: AuthUser }) {
         </div>
         <div className="user-table">
           <div className="user-table-head">
-            <span>登录账号</span><span>角色</span><span>更新时间</span><span>操作</span>
+            <span>登录账号</span><span>角色</span><span>企微绑定</span><span>更新时间</span><span>操作</span>
           </div>
           {users.map((item) => (
             <div className="user-table-row" key={item.id}>
               <strong>{item.username}</strong>
               <span className={`role-pill ${item.role}`}>{ROLE_LABEL[item.role]}</span>
+              <span className="user-wecom-cell">
+                {item.wecom_userid ? (
+                  <code>{item.wecom_userid}</code>
+                ) : (
+                  <span>—</span>
+                )}
+                {canBind(item) && (
+                  item.wecom_userid ? (
+                    <>
+                    <button
+                      className="user-action-button"
+                      onClick={() => setBindTarget(item)}
+                    >
+                      换绑
+                    </button>
+                    <button
+                      className="user-action-button danger"
+                      disabled={working}
+                      onClick={() => void bindWecom(item.id, "")}
+                    >
+                      解绑
+                    </button>
+                    </>
+                  ) : (
+                    <button
+                      className="user-action-button"
+                      onClick={() => setBindTarget(item)}
+                    >
+                      绑定
+                    </button>
+                  )
+                )}
+              </span>
               <span>{new Date(item.updated_at).toLocaleDateString("zh-CN", { timeZone: "Asia/Shanghai" })}</span>
               <div className="user-row-actions">
                 {canReset(item) && (
@@ -307,6 +394,28 @@ export default function UsersPage({ currentUser }: { currentUser: AuthUser }) {
           </div>
         </div>
       )}
+      {createPickerOpen && (
+        <WecomUserPickerModal
+          mode="single"
+          selected={createWecom ? [createWecom] : []}
+          onClose={() => setCreatePickerOpen(false)}
+          onConfirm={(userids) => {
+            setCreateWecom(userids[0] ?? "");
+            setCreatePickerOpen(false);
+          }}
+        />
+      )}
+
+      {bindTarget && (
+        <WecomUserPickerModal
+          mode="single"
+          selected={bindTarget.wecom_userid ? [bindTarget.wecom_userid] : []}
+          onClose={() => setBindTarget(null)}
+          onConfirm={(userids) => {
+            void bindWecom(bindTarget.id, userids[0] ?? "");
+          }}
+        />
+      )}
     </div>
   );
 }

app/wecom-user-picker.tsx

@@ -0,0 +1,239 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+
+export async function readApiResponse<T>(
+  response: Response,
+  fallback: string,
+) {
+  const text = await response.text();
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) {
+    if (response.status === 403) {
+      throw new Error("请求被安全网关拦截，请刷新页面后重试");
+    }
+    throw new Error(`${fallback}（服务返回异常，HTTP ${response.status}）`);
+  }
+  try {
+    return JSON.parse(text) as T & { error?: string };
+  } catch {
+    throw new Error(`${fallback}（服务返回的数据无法解析）`);
+  }
+}
+
+export type InternalWecomContact = {
+  userid: string;
+  name: string;
+  departmentNames: string[];
+};
+
+let internalWecomContactsCache: {
+  contacts: InternalWecomContact[];
+  fetchedAt: number;
+} | null = null;
+
+const INTERNAL_WECOM_CONTACTS_TTL_MS = 5 * 60 * 1000;
+
+export function WecomUserPickerModal({
+  mode,
+  selected,
+  onClose,
+  onConfirm,
+}: {
+  mode: "single" | "multi";
+  selected: string[];
+  onClose: () => void;
+  onConfirm: (userids: string[]) => void;
+}) {
+  const [contacts, setContacts] = useState<InternalWecomContact[]>(
+    internalWecomContactsCache?.contacts ?? [],
+  );
+  const [fetchedAt, setFetchedAt] = useState(0);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState("");
+  const [search, setSearch] = useState("");
+  const [checked, setChecked] = useState<string[]>(selected.filter(Boolean));
+
+  const loadContacts = useCallback(async (force = false) => {
+    const snapshot = internalWecomContactsCache;
+    if (
+      !force &&
+      snapshot &&
+      Date.now() - snapshot.fetchedAt <= INTERNAL_WECOM_CONTACTS_TTL_MS
+    ) {
+      setContacts(snapshot.contacts);
+      setFetchedAt(snapshot.fetchedAt);
+      setLoading(false);
+      return;
+    }
+    setLoading(true);
+    setError("");
+    try {
+      const response = await fetch("/api/action", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ action: "wecom_list_internal_contacts" }),
+      });
+      const parsed = await readApiResponse<{
+        contacts?: InternalWecomContact[];
+        error?: string;
+      }>(response, "获取企业微信通讯录失败");
+      if (!response.ok) {
+        throw new Error(parsed.error || "获取企业微信通讯录失败");
+      }
+      const list = Array.isArray(parsed.contacts) ? parsed.contacts : [];
+      internalWecomContactsCache = { contacts: list, fetchedAt: Date.now() };
+      setContacts(list);
+      setFetchedAt(internalWecomContactsCache.fetchedAt);
+    } catch (reason) {
+      setError(
+        reason instanceof Error ? reason.message : "获取企业微信通讯录失败",
+      );
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    const timer = window.setTimeout(() => {
+      void loadContacts();
+    }, 0);
+    return () => window.clearTimeout(timer);
+  }, [loadContacts]);
+
+  const keyword = search.trim().toLowerCase();
+  const filteredContacts =
+    keyword.length === 0
+      ? contacts
+      : contacts.filter((contact) =>
+          `${contact.name} ${contact.userid}`.toLowerCase().includes(keyword),
+        );
+
+  const toggleChecked = (userid: string) => {
+    setChecked((previous) =>
+      previous.includes(userid)
+        ? previous.filter((item) => item !== userid)
+        : [...previous, userid],
+    );
+  };
+
+  return (
+    <div className="modal-backdrop" role="presentation" onMouseDown={onClose}>
+      <div
+        className="modal-card wecom-picker-modal"
+        onMouseDown={(event) => event.stopPropagation()}
+      >
+        <div className="modal-heading">
+          <div>
+            <h2>选择企业微信成员</h2>
+            <p>
+              从企业微信通讯录（自建应用可见范围）中挑选，
+              {mode === "multi" ? "勾选后点击确定" : "点击成员即填入"}。
+            </p>
+          </div>
+          <button type="button" onClick={onClose} aria-label="关闭">×</button>
+        </div>
+        <div className="import-guide-strip">
+          <input
+            type="search"
+            className="wecom-picker-search"
+            placeholder="按姓名 / userid 搜索"
+            value={search}
+            onChange={(event) => setSearch(event.target.value)}
+            disabled={loading}
+          />
+          <button
+            type="button"
+            className="ghost-button"
+            onClick={() => void loadContacts(true)}
+            disabled={loading}
+          >
+            {loading ? "拉取中…" : "刷新列表"}
+          </button>
+          {fetchedAt > 0 && !loading && (
+            <span className="wecom-picker-cache-hint">
+              缓存于 {new Date(fetchedAt).toLocaleTimeString()}（5 分钟内复用）
+            </span>
+          )}
+        </div>
+        {error && (
+          <p className="form-error">
+            {error} 可关闭此弹窗，直接在输入框手动填写 userid。
+          </p>
+        )}
+        <div className="wecom-picker-list">
+          {loading && contacts.length === 0 ? (
+            <div className="wecom-picker-empty">正在拉取企业微信通讯录…</div>
+          ) : contacts.length === 0 ? (
+            <div className="wecom-picker-empty">
+              {error
+                ? "拉取失败，请检查应用配置（通讯录权限 / 可信 IP）后重试"
+                : "未拉取到通讯录成员——仅显示自建应用可见范围内的成员，也可手动填写 userid"}
+            </div>
+          ) : filteredContacts.length === 0 ? (
+            <div className="wecom-picker-empty">没有匹配的成员</div>
+          ) : (
+            filteredContacts.map((contact) => {
+              const isSelected =
+                mode === "multi"
+                  ? checked.includes(contact.userid)
+                  : selected.includes(contact.userid);
+              const rowBody = (
+                <>
+                  <span className="wecom-picker-avatar placeholder" aria-hidden="true">
+                    {(contact.name || contact.userid).slice(0, 1)}
+                  </span>
+                  <span className="wecom-picker-meta">
+                    <span className="wecom-picker-name">
+                      {contact.name || contact.userid}
+                    </span>
+                    <span className="wecom-picker-sub">
+                      {contact.departmentNames.join(" / ") || "—"}
+                    </span>
+                    <code className="wecom-picker-id">{contact.userid}</code>
+                  </span>
+                </>
+              );
+              return mode === "multi" ? (
+                <label key={contact.userid} className="wecom-picker-row">
+                  {rowBody}
+                  <input
+                    type="checkbox"
+                    checked={isSelected}
+                    onChange={() => toggleChecked(contact.userid)}
+                  />
+                </label>
+              ) : (
+                <button
+                  key={contact.userid}
+                  type="button"
+                  className="wecom-picker-row"
+                  onClick={() => onConfirm([contact.userid])}
+                >
+                  {rowBody}
+                  {isSelected ? (
+                    <span className="wecom-picker-current">当前</span>
+                  ) : null}
+                </button>
+              );
+            })
+          )}
+        </div>
+        {mode === "multi" && (
+          <div className="modal-actions">
+            <button type="button" className="ghost-button" onClick={onClose}>
+              取消
+            </button>
+            <button
+              type="button"
+              className="primary-button"
+              onClick={() => onConfirm(checked)}
+            >
+              {checked.length > 0 ? `确定（${checked.length} 人）` : "确定"}
+            </button>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}