✨ feat(vscode): 多人协作二期:状态分层/写校验/签名/团队视图

- 本机状态(会话id/worktree/profile/prDiffFile)迁 workspaceState,
  共享 state JSON 只留团队字段;读侧本地记录叠加,旧数据兜底
- mergeStateJsonComment 写后读回校验,并发覆盖时在最新状态上重放一次
- webhook 支持 Gitea secret,校验 X-Gitea-Signature(HMAC-SHA256),
  不匹配 401;设置面板新增 Webhook Secret 字段
- 看板新增 我的/全部 范围切换(团队视图),按工作区持久化

vscode/webview-ui/src/components/PanelHeader.tsx

@@ -1,49 +1,72 @@
-import { GitCommit, GitMerge, ListPlus, Loader2, Lock, RefreshCw, Settings, Unlock } from 'lucide-react'
+import { GitCommit, GitMerge, ListPlus, Loader2, Lock, RefreshCw, Settings, Unlock, User, Users } from 'lucide-react'
 
 interface Props {
   onRefresh: () => void
+  /** 看板范围:'mine' 只看我的(assigned/created),'all' 团队全部工单。 */
+  scope: 'mine' | 'all'
+  onToggleScope: () => void
   onEditAuth: () => void
   commitRunning: boolean
-  /** Whether the workspace git working tree has uncommitted changes. The
+  /**
+   * Whether the workspace git working tree has uncommitted changes. The
    * commit button is only rendered when this is true (or `commitRunning` is
    * true — we keep it visible mid-run so the spinner stays on screen even
-   * if `cc` clears the tree before finishing). */
+   * if `cc` clears the tree before finishing).
+   */
   hasChanges: boolean
   onCommit: () => void
-  /** Commits the remote auto-build branch is behind the remote dev branch.
+  /**
+   * Commits the remote auto-build branch is behind the remote dev branch.
    * Combined with `branchSyncDisabled` to compute the button's disabled
-   * state. */
+   * state.
+   */
   branchSyncBehind: number
   branchSyncRunning: boolean
-  /** True when sync is structurally unavailable (same-branch / fetch fail
-   * / not a repo / …). Disables the button regardless of `branchSyncBehind`. */
+  /**
+   * True when sync is structurally unavailable (same-branch / fetch fail
+   * / not a repo / …). Disables the button regardless of `branchSyncBehind`.
+   */
   branchSyncDisabled: boolean
-  /** Hover tooltip, already includes branch names + behind count or the
-   * unavailable reason. */
+  /**
+   * Hover tooltip, already includes branch names + behind count or the
+   * unavailable reason.
+   */
   branchSyncTitle: string
   onSyncBranch: () => void
-  /** Whether the workspace's `.env*` files are currently chmod-locked (444).
-   * Icon flips between Lock and Unlock based on this. */
+  /**
+   * Whether the workspace's `.env*` files are currently chmod-locked (444).
+   * Icon flips between Lock and Unlock based on this.
+   */
   envLocked: boolean
-  /** Number of `.env*` files discovered in the workspace at the last scan.
-   * The button is disabled when 0 — nothing to lock. */
+  /**
+   * Number of `.env*` files discovered in the workspace at the last scan.
+   * The button is disabled when 0 — nothing to lock.
+   */
   envFileCount: number
-  /** True while a chmod batch is in flight; disables the button to avoid
-   * duplicate toggles. */
+  /**
+   * True while a chmod batch is in flight; disables the button to avoid
+   * duplicate toggles.
+   */
   envLockRunning: boolean
   /** Hover tooltip, already includes file count + current lock state. */
   envLockTitle: string
   onToggleEnvLock: () => void
-  /** Whether YouTrack is configured. The「导入 YouTrack 工单」button is only
-   * rendered when true. */
+  /**
+   * Whether YouTrack is configured. The「导入 YouTrack 工单」button is only
+   * rendered when true.
+   */
   youtrackConfigured: boolean
-  /** Open the native multi-select dialog to pick which YouTrack issues to
-   * mirror onto the board. */
+  /**
+   * Open the native multi-select dialog to pick which YouTrack issues to
+   * mirror onto the board.
+   */
   onImportYouTrack: () => void
 }
 
 export function PanelHeader({
   onRefresh,
+  scope,
+  onToggleScope,
   onEditAuth,
   commitRunning,
   hasChanges,
@@ -122,6 +145,15 @@ export function PanelHeader({
           <ListPlus size={14} />
         </button>
       )}
+      <button
+        type="button"
+        onClick={onToggleScope}
+        title={scope === 'mine' ? '当前:只看我的工单,点击切换为全部' : '当前:团队全部工单,点击切换为只看我的'}
+        aria-label={scope === 'mine' ? '切换为全部工单' : '切换为只看我的'}
+        className="flex h-6 w-6 items-center justify-center rounded hover:bg-[var(--vscode-toolbar-hoverBackground)]"
+      >
+        {scope === 'mine' ? <User size={14} /> : <Users size={14} />}
+      </button>
       <button
         type="button"
         onClick={onRefresh}

vscode/webview-ui/src/components/SettingsModal.tsx

@@ -8,9 +8,9 @@
  */
 
 import type { ReactElement } from 'react'
-import { useEffect, useState } from 'react'
-import { X } from 'lucide-react'
 import type { ClaudeProfile } from '../hooks/useIssues'
+import { X } from 'lucide-react'
+import { useEffect, useState } from 'react'
 
 type GroupKey = 'auth' | 'network' | 'youtrack' | 'prompts' | 'hooks'
 
@@ -18,6 +18,7 @@ interface SubmitValues {
   host: string
   token: string
   webhookPort: number
+  webhookSecret: string
   brainstormPrompt: string
   brainstormContinuePrompt: string
   implementPlanPrompt: string
@@ -63,6 +64,7 @@ export interface SettingsModalProps {
   canCancel?: boolean
   initialTokenSaved: boolean
   initialWebhookPort: number
+  initialWebhookSecret: string
   initialBrainstormPrompt: string
   initialBrainstormContinuePrompt: string
   initialImplementPlanPrompt: string
@@ -127,8 +129,10 @@ const GROUPS: Array<{ key: GroupKey, label: string }> = [
 
 type ErrorKey = 'host' | 'token' | 'webhookPort'
 
-/** Map a field name to the group it lives in, so we can auto-switch to the
- * first invalid field's group on save. */
+/**
+ * Map a field name to the group it lives in, so we can auto-switch to the
+ * first invalid field's group on save.
+ */
 const FIELD_TO_GROUP: Record<ErrorKey, GroupKey> = {
   host: 'auth',
   token: 'auth',
@@ -142,6 +146,7 @@ export function SettingsModal({
   canCancel,
   initialTokenSaved,
   initialWebhookPort,
+  initialWebhookSecret,
   initialBrainstormPrompt,
   initialBrainstormContinuePrompt,
   initialImplementPlanPrompt,
@@ -175,6 +180,7 @@ export function SettingsModal({
   const [host, setHost] = useState(initialHost)
   const [token, setToken] = useState('')
   const [webhookPort, setWebhookPort] = useState<string>(String(initialWebhookPort))
+  const [webhookSecret, setWebhookSecret] = useState(initialWebhookSecret)
   const [brainstormPrompt, setBrainstormPrompt] = useState(initialBrainstormPrompt)
   const [brainstormContinuePrompt, setBrainstormContinuePrompt] = useState(initialBrainstormContinuePrompt)
   const [implementPlanPrompt, setImplementPlanPrompt] = useState(initialImplementPlanPrompt)
@@ -210,6 +216,7 @@ export function SettingsModal({
     setHost(initialHost)
     setToken('')
     setWebhookPort(String(initialWebhookPort))
+    setWebhookSecret(initialWebhookSecret)
     setBrainstormPrompt(initialBrainstormPrompt)
     setBrainstormContinuePrompt(initialBrainstormContinuePrompt)
     setImplementPlanPrompt(initialImplementPlanPrompt)
@@ -294,6 +301,7 @@ export function SettingsModal({
       // extension side detects empty + existing-saved as "preserve".
       token: trimmedToken,
       webhookPort: portNum,
+      webhookSecret: webhookSecret.trim(),
       brainstormPrompt,
       brainstormContinuePrompt,
       implementPlanPrompt,
@@ -578,7 +586,13 @@ export function SettingsModal({
                       扩展 HTTP server 绑定的端口。在 gitea 仓库 Webhooks 配置里把目标 URL 指向
                       {' '}
                       <code>{'http://<你的本机/公网域名>:<此端口>/webhook'}</code>
-                      ，事件需勾选：<b>工单</b>（issue opened/edited）、<b>合并请求</b>（PR opened/synchronize/closed）、<b>工单评论</b>（codex 审查回流）。
+                      ，事件需勾选：
+                      <b>工单</b>
+                      （issue opened/edited）、
+                      <b>合并请求</b>
+                      （PR opened/synchronize/closed）、
+                      <b>工单评论</b>
+                      （codex 审查回流）。
                     </>
                   )}
                 >
@@ -592,6 +606,30 @@ export function SettingsModal({
                   />
                 </Field>
 
+                <Field
+                  label="Webhook Secret"
+                  hint={(
+                    <>
+                      与 gitea Webhooks 配置里的
+                      {' '}
+                      <b>密钥文本</b>
+                      {' '}
+                      保持一致，用于校验
+                      {' '}
+                      <code>X-Gitea-Signature</code>
+                      。webhook 走公网隧道时必填，否则任何人都能伪造事件；留空 = 不校验。
+                    </>
+                  )}
+                >
+                  <input
+                    type="text"
+                    value={webhookSecret}
+                    onChange={e => setWebhookSecret(e.target.value)}
+                    placeholder="留空表示不校验签名"
+                    className={inputClass}
+                  />
+                </Field>
+
                 <Field
                   label="开启自动审查"
                   hint="PR 创建后自动用 codex exec review 跑审查并把结果灌到实施会话终端"
@@ -791,7 +829,12 @@ export function SettingsModal({
 
                 <Field
                   label="审查提示词"
-                  hint={<>可用占位符：<code>{'{prNumber}'}</code></>}
+                  hint={(
+                    <>
+                      可用占位符：
+                      <code>{'{prNumber}'}</code>
+                    </>
+                  )}
                 >
                   <textarea
                     rows={4}