改动

web/src/router/index.ts

@@ -154,6 +154,12 @@ const routes: RouteRecordRaw[] = [
     component: () => import('@/views/admin/MCPTokenAdminView.vue'),
     meta: { requiresAuth: true, requiresAdmin: true },
   },
+  {
+    path: '/admin/acp-sessions',
+    name: 'admin-acp-sessions',
+    component: () => import('@/views/acp/AcpAdminSessionsView.vue'),
+    meta: { requiresAdmin: true },
+  },
   {
     path: '/admin/acp/agent-kinds',
     component: () => import('@/views/admin/AgentKindAdminListView.vue'),
@@ -195,13 +201,16 @@ export default router
 // 把 auth store 注入 api client（在 router 模块顶层晚于 pinia 安装可能未就绪，所以用懒访问）
 export function bindAuthToApi() {
   const auth = useAuthStore()
+  const redirectToLogin = () => {
+    auth.clearSession()
+    const current = router.currentRoute.value
+    const query = current.name === 'login' ? undefined : { next: current.fullPath }
+    router.replace({ name: 'login', query }).catch(() => {})
+  }
   configure({
     tokenProvider: () => auth.token,
-    onUnauthorized: () => {
-      auth.clearSession()
-      const current = router.currentRoute.value
-      const query = current.name === 'login' ? undefined : { next: current.fullPath }
-      router.replace({ name: 'login', query }).catch(() => {})
-    },
+    onUnauthorized: redirectToLogin,
+    // 403：会话仍有效但权限不足（如被降级/禁用），同样登出并回登录页。
+    onForbidden: redirectToLogin,
   })
 }