更新

server/app/mcp/service/GrantService.php

@@ -136,6 +136,9 @@ class GrantService
         } catch (McpException $e) {
             if ($e->reason === 'disabled') {
                 self::close((int) $grant['id'], self::STATUS_REVOKED, 'admin_disabled');
+            } else {
+                // 授权保留（补上权限或绑定企微后可继续用），但它换来的 AI 浏览器后台会话立即作废
+                self::endConsole((int) $grant['admin_id']);
             }
             throw new McpException($e->getMessage(), $e->reason, 401);
         }
@@ -154,13 +157,34 @@ class GrantService
     public static function close(int $grantId, int $status, string $reason, int $by = 0): void
     {
         $now = time();
-        Db::name('ai_grant')->where(['id' => $grantId, 'status' => self::STATUS_ACTIVE])->update([
+        $closed = Db::name('ai_grant')->where(['id' => $grantId, 'status' => self::STATUS_ACTIVE])->update([
             'status' => $status,
             'revoke_time' => $now,
             'revoke_by' => $by,
             'revoke_reason' => substr($reason, 0, 64),
             'update_time' => $now,
         ]);
+        // 授权失效时，用它换来的 AI 浏览器后台会话一并作废
+        if ($closed) {
+            self::endConsole((int) Db::name('ai_grant')->where('id', $grantId)->value('admin_id'));
+        }
+    }
+
+    /** 按令牌找授权记录，不论是否仍有效；只用于注销 AI 浏览器会话这类“收回”操作 */
+    public static function findByToken(Request $request): array
+    {
+        $token = TokenService::fromRequest($request);
+        return $token === '' ? [] : (Db::name('ai_grant')->where('token_hash', TokenService::hash($token))->find() ?: []);
+    }
+
+    /** 作废该账号的 AI 浏览器后台会话；失败只记日志，不影响调用方 */
+    private static function endConsole(int $adminId): void
+    {
+        try {
+            ConsoleService::closeForAdmin($adminId);
+        } catch (\Throwable $e) {
+            \think\facade\Log::error('[ai_mcp] 作废 AI 浏览器会话失败: ' . $e->getMessage());
+        }
     }
 
     public static function publicGrant(array $grant): array