新增每 bot 回覆規範（promptRules）、可讀寫成員（writeUsers，其他人唯讀）、PDF/文字附件；cluemarket-tg-bot 搬入控制台

src/web/public/index.html

@@ -66,6 +66,11 @@
   .field { margin-bottom: 13px; }
   .field label { display: block; font-size: 12px; color: #94a3b8; margin-bottom: 5px; }
   .field label b { color: #ed4245; }
+  .field textarea {
+    width: 100%; background: #12141c; border: 1px solid #2e3345; border-radius: 8px;
+    color: #e2e8f0; padding: 9px 11px; font-size: 12.5px; font-family: inherit; line-height: 1.5; resize: vertical; min-height: 84px;
+  }
+  .field textarea:focus { outline: none; border-color: #5865f2; }
   .field input, .field select {
     width: 100%; background: #12141c; border: 1px solid #2e3345; border-radius: 8px;
     color: #e2e8f0; padding: 9px 11px; font-size: 13px; font-family: inherit;
@@ -249,6 +254,16 @@
       <label class="check"><input type="checkbox" id="f-network"> 允許 AI 連網</label>
       <div class="hint">workspace-write 沙盒預設禁網；要呼叫外部 API（例如生圖服務）才需要打開。目前只有 Codex 引擎有此選項</div>
     </div>
+    <div class="field">
+      <label>可讀寫成員（Telegram username）</label>
+      <input id="f-writeusers" placeholder="例：JianMiau, someone（留空 = 所有人都依沙盒設定）" autocomplete="off">
+      <div class="hint">有填時，清單外的人一律以 read-only 沙盒執行（只能查詢、不能改檔或跑指令），由 CLI 層硬擋</div>
+    </div>
+    <div class="field">
+      <label>回覆規範（每則訊息開頭附加）</label>
+      <textarea id="f-rules" placeholder="例：只回答與本專案相關的問題；@xxx 是後端工程師，回覆用 API 契約視角…"></textarea>
+      <div class="hint">選填。適合放「專案守門」「成員身分」這類每輪都要提醒的規則；專案本身的規範請放工作目錄的 AGENTS.md / CLAUDE.md</div>
+    </div>
     <div class="field">
       <label>逾時（分鐘）</label>
       <input id="f-timeout" type="number" value="30" min="1">
@@ -460,7 +475,7 @@ function renderBots(bots) {
       '<td><span class="mono" title="' + esc(b.workDir) + '">' + esc(shortPath(b.workDir)) + '</span></td>' +
       '<td class="mono">' + esc(b.sandbox || '-') +
         ((b.model || b.reasoningEffort || b.sessionMode !== 'per-chat' || b.networkAccess)
-          ? '<br><span class="script-name">' + esc([b.model, b.reasoningEffort, b.sessionMode === 'shared' ? '共用會話' : b.sessionMode === 'stateless' ? '無記憶' : '', b.networkAccess ? '可連網' : ''].filter(Boolean).join(' / ')) + '</span>'
+          ? '<br><span class="script-name">' + esc([b.model, b.reasoningEffort, b.sessionMode === 'shared' ? '共用會話' : b.sessionMode === 'stateless' ? '無記憶' : '', b.networkAccess ? '可連網' : '', (b.writeUsers && b.writeUsers.length) ? '限 @' + b.writeUsers.join(' @') + ' 可寫' : '', b.promptRules ? '有回覆規範' : ''].filter(Boolean).join(' / ')) + '</span>'
           : '') + '</td>' +
       '<td class="mono">' + esc(b.tokenMasked || '-') + '</td>' +
       '<td>' + fmtBytes(b.memory) + '</td>' +
@@ -532,6 +547,8 @@ function openCreate() {
   onEngineChange('', '');
   document.getElementById('f-session').value = 'per-chat';
   document.getElementById('f-network').checked = false;
+  document.getElementById('f-writeusers').value = '';
+  document.getElementById('f-rules').value = '';
   document.getElementById('f-timeout').value = '30';
   document.getElementById('f-autostart-wrap').style.display = '';
   document.getElementById('f-autostart').checked = true;
@@ -556,6 +573,8 @@ function openEdit(name) {
   onEngineChange(b.model || '', b.reasoningEffort || '');
   document.getElementById('f-session').value = b.sessionMode || 'per-chat';
   document.getElementById('f-network').checked = !!b.networkAccess;
+  document.getElementById('f-writeusers').value = (b.writeUsers || []).join(', ');
+  document.getElementById('f-rules').value = b.promptRules || '';
   document.getElementById('f-timeout').value = b.timeoutMinutes || 30;
   document.getElementById('f-autostart-wrap').style.display = 'none';
   document.getElementById('bot-modal').classList.add('show');
@@ -579,6 +598,8 @@ async function saveBot() {
     reasoningEffort: document.getElementById('f-effort').value,
     sessionMode: document.getElementById('f-session').value,
     networkAccess: document.getElementById('f-network').checked,
+    writeUsers: document.getElementById('f-writeusers').value,
+    promptRules: document.getElementById('f-rules').value,
     timeoutMinutes: document.getElementById('f-timeout').value,
   };
   try {