@oj-module/cli 0.2.43 → 0.2.46

package/templates/src/system/web/locales/zh-CN.json

@@ -6,7 +6,8 @@
 		"roles": "角色权限",
 		"oplog": "操作日志",
 		"settings": "站点设置",
-		"loginMethods": "登录方式"
+		"loginMethods": "登录方式",
+		"wecom": "企业微信代开发"
 	},
 	"common": {
 		"confirm": "确认",
@@ -73,7 +74,36 @@
 		"title": "当前启用的登录方式",
 		"methodLocal": "本地口令",
 		"methodLdap": "LDAP",
-		"methodSso": "SSO 单点登录"
+		"methodSso": "SSO 单点登录",
+		"methodWecom": "企业微信"
+	},
+	"wecom": {
+		"title": "开通企业",
+		"hint": "点「生成开通链接」后把链接或二维码发给企业管理员，由其确认授权；确认后企业侧的回调会写入本表。链接 10 分钟内有效且只能用一次，过期后二维码会置灰，需重新生成。",
+		"appsTitle": "已开通企业",
+		"genInstall": "生成开通链接",
+		"installOk": "已生成，请把链接发给企业管理员",
+		"installUrl": "开通链接",
+		"callbackUrl": "回调地址",
+		"expiresIn": "有效期",
+		"expiresValue": "{{count}} 分钟",
+		"col": {
+			"corp": "企业",
+			"agent": "应用",
+			"env": "环境",
+			"status": "状态",
+			"installedAt": "开通时间",
+			"action": "操作"
+		},
+		"statusActive": "启用",
+		"statusDisabled": "停用",
+		"statusOk": "状态已更新",
+		"statusOkRevoked": "状态已更新，并吊销了该企业 {{count}} 个登录会话",
+		"disable": "停用",
+		"enable": "启用",
+		"disableConfirm": "停用该应用？企业成员将无法用它登录。",
+		"enableConfirm": "启用该应用？",
+		"empty": "暂无已开通企业"
 	},
 	"err": {
 		"forbidden": "无权限",
@@ -91,6 +121,7 @@
 		"site_title": "站点标题",
 		"ldap_enabled": "启用 LDAP 登录",
 		"sso_enabled": "启用 SSO 登录",
+		"wecom_enabled": "启用企业微信登录",
 		"ldap_base_dn": "LDAP Base DN",
 		"ldap_uid_attr": "LDAP UID 属性",
 		"ldap_email_attr": "LDAP 邮箱属性"

package/templates/src/system/web/pages/login-methods/index.tsx

@@ -8,9 +8,10 @@ const METHOD_KEY: Record<string, string> = {
 	local: "system:loginMethodsPage.methodLocal",
 	ldap: "system:loginMethodsPage.methodLdap",
 	sso: "system:loginMethodsPage.methodSso",
+	wecom: "system:loginMethodsPage.methodWecom",
 };
 
-/** 登录方式发现（C5/D2，只读）：local 恒在，ldap/sso 由设置项开关。 */
+/** 登录方式发现（C5/D2，只读）：local 恒在，ldap/sso/wecom 由设置项开关。 */
 export default function LoginMethodsPage() {
 	const { t } = useTranslation();
 	const query = useQuery({ queryKey: ["system", "login-methods"], queryFn: systemLoginMethodsGet });

package/templates/src/system/web/pages/users/index.tsx

@@ -135,7 +135,7 @@ export default function UsersPage() {
 				onOk={() => createForm.submit()}
 			>
 				<Form form={createForm} layout="vertical" onFinish={values => createMut.mutate(values)}>
-					<Form.Item name="username" label={t("system:users.columns.username")} rules={[{ required: true }]} extra="ldap:/ sso: 为外部身份源保留">
+					<Form.Item name="username" label={t("system:users.columns.username")} rules={[{ required: true }]} extra="ldap:/ sso:/ wecom: 为外部身份源保留">
 						<Input />
 					</Form.Item>
 					<Form.Item name="password" label="Password" rules={[{ required: true }, { min: 6 }]} extra={t("system:users.pwdPlaceholder")}>

package/templates/src/system/web/pages/wecom/index.tsx

@@ -0,0 +1,205 @@
+import { request, useUserStore } from "@oj-module/runtime";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { App, Button, Card, Descriptions, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+
+import { explainError } from "../errors";
+import { ForbiddenPanel } from "../forbidden";
+
+/** GET /auth/wecom/admin/apps 的行（后端不返回 permanent_code，secret 不出库） */
+interface AppRow {
+	suite_id: string
+	corp_id: string
+	agent_id: string
+	auth_corp_id: string
+	env: string
+	corp_name: string | null
+	status: "active" | "disabled"
+	installed_at: number
+	update_time: number
+}
+
+interface InstallInfo {
+	installUrl: string
+	callbackUrl: string
+	expiresIn: number
+}
+
+/**
+ * 端点不在本模块的生成 client 里（`__client` 按模块切分），故直接用 runtime 的 ky 出口。
+ * 路径不带前导 `/`：与 request 的 baseURL 拼接口径一致（fetchLogin 同款）。
+ */
+async function fetchApps(): Promise<AppRow[]> {
+	const env = await request.get("auth/wecom/admin/apps").json<{ code: number, data?: AppRow[] }>();
+	return env.data ?? [];
+}
+
+async function setStatus(input: { corpId: string, agentId: string, status: "active" | "disabled" }): Promise<{ updated: number, revokedSessions: number }> {
+	const env = await request.post("auth/wecom/admin/status", { json: input }).json<{ code: number, data?: { updated: number, revokedSessions: number } }>();
+	return env.data ?? { updated: 0, revokedSessions: 0 };
+}
+
+async function createInstall(): Promise<InstallInfo> {
+	const env = await request.get("auth/wecom/admin/install").json<{ code: number, data?: InstallInfo }>();
+	if (!env.data)
+		throw new Error("企业微信未返回开通链接");
+	return env.data;
+}
+
+/**
+ * 企微代开发后台（服务商运营面，superadmin 独占）：
+ *   · 已授权企业 × 应用清单（同一企业测试/正式两个应用各一行）；
+ *   · 启停（停用企业最后一个应用时后端同时吊销该企业会话）；
+ *   · 开通入口（预授权码 10 分钟有效，每次点都重新换）。
+ */
+export default function WecomAdminPage() {
+	const { t } = useTranslation();
+	const { message } = App.useApp();
+	const queryClient = useQueryClient();
+	const roles = useUserStore(s => s.roles);
+	const isSuper = roles.includes("superadmin");
+
+	const [install, setInstall] = useState<InstallInfo | null>(null);
+	const [expired, setExpired] = useState(false);
+
+	// 预授权码只有 10 分钟：到点把码置灰（antd QRCode 的 expired 态自带「刷新」入口），
+	// 免得操作员把一张已失效的码发出去、企业管理员点开只看到企微的「链接无效」。
+	// 计时器只负责「置灰」，复位放在生成成功那一刻（effect 里同步 setState 会多一次渲染）。
+	useEffect(() => {
+		if (!install)
+			return undefined;
+		const timer = setTimeout(setExpired, install.expiresIn * 1000, true);
+		return () => clearTimeout(timer);
+	}, [install]);
+
+	const appsQuery = useQuery({
+		queryKey: ["system", "wecom-apps"],
+		queryFn: fetchApps,
+		enabled: isSuper,
+		retry: false,
+	});
+
+	const statusMut = useMutation({
+		mutationFn: setStatus,
+		onSuccess: (r) => {
+			// 吊销了会话就明确说出来：这是「有人被踢下线」的事实，不该只显示「已保存」
+			message.success(r.revokedSessions > 0
+				? t("system:wecom.statusOkRevoked", { count: r.revokedSessions })
+				: t("system:wecom.statusOk"));
+			queryClient.invalidateQueries({ queryKey: ["system", "wecom-apps"] });
+		},
+		onError: e => message.error(explainError(e, t)),
+	});
+
+	const installMut = useMutation({
+		mutationFn: createInstall,
+		onSuccess: (r) => {
+			setInstall(r);
+			setExpired(false);
+			// 预授权码一次有效：链接只在该页面的内存里，不写 localStorage
+			message.success(t("system:wecom.installOk"));
+		},
+		onError: e => message.error(explainError(e, t)),
+	});
+
+	if (!isSuper)
+		return <ForbiddenPanel t={t} />;
+
+	const columns = [
+		{
+			title: t("system:wecom.col.corp"),
+			dataIndex: "corp_id",
+			render: (_: string, row: AppRow) => (
+				<div>
+					<div>{row.corp_id}</div>
+					{row.corp_name && <Typography.Text type="secondary">{row.corp_name}</Typography.Text>}
+				</div>
+			),
+		},
+		{ title: t("system:wecom.col.agent"), dataIndex: "agent_id" },
+		{ title: t("system:wecom.col.env"), dataIndex: "env", render: (v: string) => <Tag>{v}</Tag> },
+		{
+			title: t("system:wecom.col.status"),
+			dataIndex: "status",
+			render: (v: string) => (
+				<Tag color={v === "active" ? "green" : "red"}>
+					{t(v === "active" ? "system:wecom.statusActive" : "system:wecom.statusDisabled")}
+				</Tag>
+			),
+		},
+		{
+			title: t("system:wecom.col.installedAt"),
+			dataIndex: "installed_at",
+			render: (v: number) => (v ? new Date(v * 1000).toLocaleString() : "-"),
+		},
+		{
+			title: t("system:wecom.col.action"),
+			key: "action",
+			render: (_: unknown, row: AppRow) => {
+				const next = row.status === "active" ? "disabled" : "active";
+				return (
+					<Popconfirm
+						title={t(next === "disabled" ? "system:wecom.disableConfirm" : "system:wecom.enableConfirm")}
+						onConfirm={() => statusMut.mutate({ corpId: row.corp_id, agentId: row.agent_id, status: next })}
+					>
+						<Button danger={next === "disabled"} size="small" loading={statusMut.isPending}>
+							{t(next === "disabled" ? "system:wecom.disable" : "system:wecom.enable")}
+						</Button>
+					</Popconfirm>
+				);
+			},
+		},
+	];
+
+	return (
+		<Space direction="vertical" size="middle" style={{ width: "100%" }}>
+			<Card
+				title={t("system:wecom.title")}
+				extra={(
+					<Button type="primary" loading={installMut.isPending} onClick={() => installMut.mutate()}>
+						{t("system:wecom.genInstall")}
+					</Button>
+				)}
+			>
+				<Typography.Paragraph type="secondary">{t("system:wecom.hint")}</Typography.Paragraph>
+				{install && (
+					<div style={{ display: "flex", gap: 24, alignItems: "flex-start", flexWrap: "wrap" }}>
+						{/* 二维码用 antd 内置 QRCode（同一份共享 antd，不额外引二维码依赖）：
+						    企业管理员多半在手机上收通知，扫码比复制链接快 */}
+						<QRCode
+							value={install.installUrl}
+							size={160}
+							type="svg"
+							bordered
+							status={expired ? "expired" : "active"}
+							onRefresh={() => installMut.mutate()}
+						/>
+						<Descriptions column={1} size="small" bordered style={{ flex: 1, minWidth: 320 }}>
+							<Descriptions.Item label={t("system:wecom.installUrl")}>
+								<Typography.Text copyable={{ text: install.installUrl }}>{install.installUrl}</Typography.Text>
+							</Descriptions.Item>
+							<Descriptions.Item label={t("system:wecom.callbackUrl")}>
+								<Typography.Text copyable={{ text: install.callbackUrl }}>{install.callbackUrl}</Typography.Text>
+							</Descriptions.Item>
+							<Descriptions.Item label={t("system:wecom.expiresIn")}>
+								{t("system:wecom.expiresValue", { count: Math.round(install.expiresIn / 60) })}
+							</Descriptions.Item>
+						</Descriptions>
+					</div>
+				)}
+			</Card>
+			<Card title={t("system:wecom.appsTitle")}>
+				<Table<AppRow>
+					rowKey={row => `${row.suite_id}:${row.corp_id}:${row.agent_id}`}
+					size="small"
+					loading={appsQuery.isLoading}
+					dataSource={appsQuery.data ?? []}
+					columns={columns}
+					pagination={false}
+					locale={{ emptyText: t("system:wecom.empty") }}
+				/>
+			</Card>
+		</Space>
+	);
+}

package/templates/tests/fixture.ts

@@ -9,8 +9,15 @@
 // delete / truncate / all / run / listTables。子集外的调用**直接报「未实现」**，不静默返回空结果
 // （静默空值会把「垫片缺能力」伪装成「业务没数据」，是最难查的一类假绿）。
 //
-// 已知边界（模板当前用不到，不模拟）：租户/归属守卫（`tenant_id` 注入、`owner_of`）——模板是单租户，
-// 开启多租户后本夹具必先补这两条，否则守卫失效也会绿。
+// 已知边界（模板当前用不到，不模拟）：归属守卫（`owner_of`）——**租户已模拟**，见下。
+// 租户模拟（2026-10-30 补，多租户上线后必须有，否则守卫失效也会绿）：
+//   · 哪些表按租户隔离不硬编码，建库后按 PRAGMA 找带 `tenant_id` 列的表（与 0015__tenant.sql 同源，
+//     迁移改了这里自动跟随，不会漂移）；
+//   · 当前租户取 `globalThis.http.tenantId`（与 oj 同源：请求头进来就是它），缺省 `default`；
+//     用例里改 `g.http.tenantId` 即可模拟「伪造 X-TENANT-ID」；
+//   · 三条语义与 oj 对齐：insert 自动补 `tenant_id`、select/update/delete/truncate 自动加
+//     `tenant_id = ?` 谓词、裸 SQL（db.query/db.exec）触碰租户表却无 `tenant_id` 直接拒
+//     （近似 `sql_guard: deny`，是文本级判断，不是解析器）。
 //
 // 分工不变：
 //   · L2（本目录 *.spec.ts）：构造器渲染出**语义等价**的 SQL 后在真 sqlite 上跑——服务层行为、
@@ -29,6 +36,45 @@ const SRC = join(dirname(fileURLToPath(import.meta.url)), "..", "src");
 
 export const ADMIN = 1;
 
+/** 部署默认租户（与运行时 store/tenant.ts 的 DEFAULT_TENANT 同值） */
+export const DEFAULT_TENANT = "default";
+
+/**
+ * 带 `tenant_id` 列的表 = 租户化表（A 组）。建库时按 PRAGMA 自省后填充，
+ * 不在代码里抄一份清单——迁移口径变了这里跟着变。
+ */
+const TENANT_TABLES = new Set<string>();
+
+/** 当前请求的租户：与 oj 同源（`http.tenantId`），无请求上下文时落部署默认 */
+function currentTenant(): string {
+	const t = (globalThis as any).http?.tenantId;
+	return typeof t === "string" && t.trim() ? t.trim() : DEFAULT_TENANT;
+}
+
+function isTenantScoped(table: string): boolean {
+	return TENANT_TABLES.has(table.toLowerCase());
+}
+
+/**
+ * 裸 SQL 的租户红线段落（近似 `sql_guard: deny`）：SQL 里出现租户表却整条没有 `tenant_id`
+ * 就拒。文本级判断，只挡「整条忘了带租户」这一类，挡不住精心构造的绕过——真判据在 oj 侧。
+ */
+const TENANT_SQL_TABLE_RE = /\b(?:from|into|update|join)\s+"?([a-z_]\w*)"?/gi;
+
+function guardTenantSql(sql: string): void {
+	if (TENANT_TABLES.size === 0)
+		return;
+	const touched = [...sql.matchAll(TENANT_SQL_TABLE_RE)]
+		.map(m => m[1]!.toLowerCase())
+		.filter(t => isTenantScoped(t));
+	if (touched.length === 0 || /\btenant_id\b/i.test(sql))
+		return;
+	throw new Error(
+		`[fixture] 裸 SQL 触碰租户表 ${[...new Set(touched)].join(", ")} 但未写 tenant_id：`
+		+ "tenant.enable + sql_guard: deny 下真 oj 会拒（租户值须走参数，不拼字符串）",
+	);
+}
+
 /** 标识符加引号（保留字列名如 `order` / `group` / `count` 全按字面量处理；`表.列` 逐段加） */
 function quoteIdent(name: string): string {
 	return name.split(".").map(p => `"${p.replace(/"/g, "\"\"")}"`).join(".");
@@ -268,15 +314,25 @@ class FakeQuery {
 			return this.compileUpdate();
 		if (s.verb === "delete")
 			return this.compileDelete();
-		if (s.verb === "truncate")
-			return { sql: `DELETE FROM ${quoteIdent(s.table)}`, params: [] };
+		if (s.verb === "truncate") {
+			const tenant = this.tenantPredicate();
+			return {
+				sql: `DELETE FROM ${quoteIdent(s.table)}${tenant ? ` WHERE ${tenant.sql}` : ""}`,
+				params: tenant ? tenant.params : [],
+			};
+		}
 		return this.compileSelect(inner);
 	}
 
 	private compileInsert(): Compiled {
-		const rows = (Array.isArray(this.s.values) ? this.s.values : [this.s.values]) as Array<Record<string, unknown>>;
-		if (rows.length === 0)
+		const raw = (Array.isArray(this.s.values) ? this.s.values : [this.s.values]) as Array<Record<string, unknown>>;
+		if (raw.length === 0)
 			throw new Error("[fixture] insert 至少需要一行");
+		// 租户化表：调用方不写 tenant_id 时自动补当前租户（oj 构造器同语义——
+		// 业务代码不该自己写 tenant_id，注入失效才是最危险的失败模式）
+		const rows = isTenantScoped(this.s.table)
+			? raw.map(r => ("tenant_id" in r ? r : { ...r, tenant_id: currentTenant() }))
+			: raw;
 		const cols = Object.keys(rows[0]!);
 		for (const r of rows) {
 			if (Object.keys(r).length !== cols.length)
@@ -309,11 +365,21 @@ class FakeQuery {
 		return { sql: `DELETE FROM ${quoteIdent(this.s.table)}${where.sql}`, params: where.params };
 	}
 
-	/** where 子句（追加进既有 params，返回拼接后的片段） */
+	/** 基表租户谓词（表名/别名限定，与 oj 渲染的 `"users"."tenant_id"` 同形）；共享表返回 null */
+	private tenantPredicate(): Compiled | null {
+		if (!isTenantScoped(this.s.table))
+			return null;
+		return { sql: `${quoteIdent(this.s.alias ?? this.s.table)}.tenant_id = ?`, params: [currentTenant()] };
+	}
+
+	/** where 子句（追加进既有 params，返回拼接后的片段）；租户谓词始终参与 AND */
 	private compileWhereClause(params: unknown[]): Compiled {
-		if (this.s.wheres.length === 0)
-			return { sql: "", params };
 		const parts = this.s.wheres.map(compileWhere);
+		const tenant = this.tenantPredicate();
+		if (tenant)
+			parts.push(tenant);
+		if (parts.length === 0)
+			return { sql: "", params };
 		return {
 			sql: ` WHERE ${parts.map(p => `(${p.sql})`).join(" AND ")}`,
 			params: [...params, ...parts.flatMap(p => p.params)],
@@ -408,10 +474,24 @@ export function installDb(): any {
 			dbo.exec(readFileSync(join(dir, f), "utf8"));
 	}
 
+	// 租户化表自省：有 `tenant_id` 列即按租户隔离（迁移是唯一真相，不在夹具里抄清单）
+	TENANT_TABLES.clear();
+	for (const { name } of dbo.prepare(SQL_LIST_TABLES).all() as Array<{ name: string }>) {
+		const cols = dbo.prepare(`PRAGMA table_info(${quoteIdent(name)})`).all() as Array<{ name: string }>;
+		if (cols.some(c => c.name.toLowerCase() === "tenant_id"))
+			TENANT_TABLES.add(name.toLowerCase());
+	}
+
 	dbo.prepare("INSERT INTO users (id, username, password_hash) VALUES (?, ?, 'x')").run(ADMIN, "admin");
 
-	const query = async (sql: string, params: unknown[] = []) => dbo.prepare(sql).all(...(params as never[]));
-	const exec = async (sql: string, params: unknown[] = []) => Number(dbo.prepare(sql).run(...(params as never[])).changes);
+	const query = async (sql: string, params: unknown[] = []) => {
+		guardTenantSql(sql);
+		return dbo.prepare(sql).all(...(params as never[]));
+	};
+	const exec = async (sql: string, params: unknown[] = []) => {
+		guardTenantSql(sql);
+		return Number(dbo.prepare(sql).run(...(params as never[])).changes);
+	};
 	const table = (name: string) => new FakeQuery(dbo, name);
 	const txInstance = { query, exec, table, listTables: (prefix?: string) => listTables(dbo, prefix), isTx: true };
 	// db.tx 镜像运行时面：BEGIN/COMMIT/ROLLBACK 包裹回调（versions.ts 注释同语义）

package/templates/tests/guard.spec.ts

@@ -43,17 +43,23 @@ describe("spike 夹具冒烟：真实迁移 + 运行时全局面 + 事务", () =
 		expect(row.username).toBe("admin");
 	});
 	it("全局 db.query/exec 与运行时同面可用", async () => {
-		const rows = await db.query("SELECT id, username FROM users");
+		const rows = await db.query("SELECT id, username FROM users WHERE tenant_id = ?", ["default"]);
 		expect(rows.length).toBeGreaterThan(0);
 	});
+	it("裸 SQL 漏写 tenant_id 一律拒（sql_guard: deny 的夹具替身）", async () => {
+		await expect(db.query("SELECT id FROM users")).rejects.toThrow(/未写 tenant_id/);
+		await expect(db.exec("DELETE FROM users")).rejects.toThrow(/未写 tenant_id/);
+		// B 组共享表无 tenant_id，照旧放行
+		await expect(db.query("SELECT key FROM sys_setting")).resolves.toBeDefined();
+	});
 	it("db.tx 事务往返：提交持久化 / 回滚不留痕", async () => {
 		await db.tx(async (t) => {
-			await t.exec("INSERT INTO users (username, password_hash) VALUES ('tx-ok', 'x')");
+			await t.exec("INSERT INTO users (tenant_id, username, password_hash) VALUES ('default', 'tx-ok', 'x')");
 		});
 		const ok = dbo.prepare("SELECT COUNT(*) AS n FROM users WHERE username = 'tx-ok'").get() as { n: number };
 		expect(Number(ok.n)).toBe(1);
 		await expect(db.tx(async (t) => {
-			await t.exec("INSERT INTO users (username, password_hash) VALUES ('tx-bad', 'x')");
+			await t.exec("INSERT INTO users (tenant_id, username, password_hash) VALUES ('default', 'tx-bad', 'x')");
 			throw new Error("rollback");
 		})).rejects.toThrow("rollback");
 		const bad = dbo.prepare("SELECT COUNT(*) AS n FROM users WHERE username = 'tx-bad'").get() as { n: number };

package/templates/tests/lifecycle/deploy-smoke.spec.ts

@@ -326,27 +326,29 @@ describe("smoke 探活（D14/Q-A：health 不强制）", () => {
 		expect(r.ok).toBe(true);
 	});
 
-	it("health 401 且路径属本次新增 anonymous（restart_pending）→ 判通过 + 落待重启提示", async () => {
+	it("health 401（无凭证探针，restart_pending 常态）→ 一律判通过 + 落待重启提示", async () => {
 		await seedDeployed();
 		const r = await smoke(smCtx({
 			manifest: solManifest({ health: "/demo-solution/ping" }),
 			fetch: async () => ({ ok: false, status: 401 }),
-			deferredAnonymous: ["/demo-solution/ping"],
 		}));
 		expect(r.ok).toBe(true);
 		expect(r.message).toContain("restart_pending");
-		expect(r.message).toContain("重启宿主后生效");
+		expect(r.message).toContain("不计入失败");
 	});
 
-	it("health 401 但路径不是本次新增（已在配置里）→ 仍判失败（不放宽真失败）", async () => {
+	it("health 401 与否声明 anonymous 无关（统一 deferred，不放宽真失败靠非 401）", async () => {
+		// 旧语义按 deferredAnonymous 白名单区分是否 deferred；该字段从未被调用方赋值（死代码），
+		// 且设计明确「health 不强制、无凭证预期 401」，故改为 health 401 一律 deferred。
+		// 真失败仍由非 401（如 500，见下条）兜底，不靠 anonymous 白名单。
 		await seedDeployed();
 		const r = await smoke(smCtx({
 			manifest: solManifest({ health: "/demo-solution/ping" }),
 			fetch: async () => ({ ok: false, status: 401 }),
 			deferredAnonymous: ["/demo-solution/other"],
 		}));
-		expect(r.ok).toBe(false);
-		expect(r.message).toContain("401");
+		expect(r.ok).toBe(true);
+		expect(r.message).toContain("restart_pending");
 	});
 
 	it("health 非 2xx → 探活失败", async () => {

package/templates/tests/lifecycle/installer.spec.ts

@@ -1237,3 +1237,79 @@ describe("P1-16 接线：reconcile 不一致自动修复（重跑 setEnabled）+
 		expect(mig?.opts).toEqual({ timeoutMs: 600000 });
 	});
 });
+
+describe("冒烟探活必须自报租户头（企微代开发多租户 v3 Phase 0）", () => {
+	it("probe fetch 带 X-TENANT-ID: default —— 宿主 tenant.enable 时匿名健康端点也强制要租户头，缺即 400", async () => {
+		const seen: Array<{ url: string, headers?: Record<string, string> }> = [];
+		const t = await runInstall(makeReq({
+			fetch: async (url: string, init?: { headers?: Record<string, string> }) => {
+				seen.push({ url, headers: init?.headers });
+				return { ok: true, status: 200, arrayBuffer: async () => ARCHIVE.slice().buffer };
+			},
+		}));
+		expect(t.status).toBe("done");
+		// 探活命中的是首个非匿名路由 /demo-solution（anonymous 仅 demo-solution/ping）
+		const probe = seen.find(c => c.url === "/api/demo-solution/demo-solution");
+		expect(probe, "smoke 应对首个非匿名路由发起探活").toBeDefined();
+		expect(probe!.headers?.["X-TENANT-ID"]).toBe("default");
+	});
+
+	it("遇「缺租户头即 400」的宿主时因已自报 default 而通过（属性测试，非假绿）", async () => {
+		// 模拟宿主 tenant.enable 的硬 fail-closed：探针缺 X-TENANT-ID 即 400、带 default 即 200。
+		// 本例用 health 端点（smoke 对 health 断言 2xx）——若 smoke 没带租户头，探针必 400 → smoke 失败。
+		// 安装成功(done) 即反向证明租户头确已注入，而非靠「非 health 探活忽略 2xx」蒙混。
+		const seen: Array<{ url: string, headers?: Record<string, string> }> = [];
+		const t = await runInstall(makeReq({
+			manifest: { ...manifestFixture("0.1.0"), health: "/demo-solution/ping" },
+			fetch: async (url: string, init?: { headers?: Record<string, string> }) => {
+				seen.push({ url, headers: init?.headers });
+				// 仅对探活 URL 模拟「缺租户头即 400」；下载 CDN 等一律 200，避免误伤其他阶段。
+				if (url === "/api/demo-solution/demo-solution/ping" && init?.headers?.["X-TENANT-ID"] !== "default") {
+					return { ok: false, status: 400, arrayBuffer: async () => new ArrayBuffer(0) };
+				}
+				return { ok: true, status: 200, arrayBuffer: async () => ARCHIVE.slice().buffer };
+			},
+		}));
+		expect(t.status).toBe("done");
+		const probe = seen.find(c => c.url === "/api/demo-solution/demo-solution/ping");
+		expect(probe, "health 优先被探活").toBeDefined();
+		expect(probe!.headers?.["X-TENANT-ID"]).toBe("default");
+	});
+
+	it("health 端点声明为匿名：探针 401（restart_pending）应判 deferred 而非失败", async () => {
+		// 租户化站点上「本次新增的匿名端点要重启才生效」，探活收 401 是预期，不计入失败（设计 §4.1）。
+		// 复现 reinstall/upgrade 在隔离站点的 401 误判失败：修复前 deferredAnonymous 从未被赋值 → 误失败。
+		const t = await runInstall(makeReq({
+			manifest: {
+				...manifestFixture("0.1.0"),
+				health: "/demo-solution/ping",
+				api: { prefix: "/api/demo-solution", anonymous: ["demo-solution/ping"] },
+			},
+			fetch: async (url: string) => {
+				if (url === "/api/demo-solution/demo-solution/ping") {
+					return { ok: false, status: 401, arrayBuffer: async () => new ArrayBuffer(0) };
+				}
+				return { ok: true, status: 200, arrayBuffer: async () => ARCHIVE.slice().buffer };
+			},
+		}));
+		expect(t.status).toBe("done");
+	});
+
+	it("health 端点收非 401（如 500）：仍判失败（仅 401 转 deferred）", async () => {
+		const t = await runInstall(makeReq({
+			manifest: {
+				...manifestFixture("0.1.0"),
+				health: "/demo-solution/ping",
+				api: { prefix: "/api/demo-solution", anonymous: ["demo-solution/ping"] },
+			},
+			fetch: async (url: string) => {
+				if (url === "/api/demo-solution/demo-solution/ping") {
+					return { ok: false, status: 500, arrayBuffer: async () => new ArrayBuffer(0) };
+				}
+				return { ok: true, status: 200, arrayBuffer: async () => ARCHIVE.slice().buffer };
+			},
+		}));
+		expect(t.status).toBe("partial");
+		expect(t.stage).toBe("smoke");
+	});
+});

package/templates/tests/lifecycle/trust.spec.ts

@@ -280,7 +280,7 @@ describe("信任库运维端点（superadmin，R9）", () => {
 		await api.trust.key.del();
 		expect(last).toMatchObject({ status: 400 });
 
-		const rows = await (g.db.query as (sql: string, p?: unknown[]) => Promise<Array<Record<string, unknown>>>)("select action, target, detail from sys_oplog where action like 'solution.trust.%' order by id");
+		const rows = await (g.db.query as (sql: string, p?: unknown[]) => Promise<Array<Record<string, unknown>>>)("select action, target, detail from sys_oplog where tenant_id = ? and action like 'solution.trust.%' order by id", ["default"]);
 		expect(rows.map(r => r.action)).toEqual(["solution.trust.add", "solution.trust.revoke"]);
 		expect(rows[0]).toMatchObject({ target: "ojm.test" });
 		expect(JSON.parse(String(rows[0].detail))).toMatchObject({ key_id: "ojm.test", operator: "admin" });

package/templates/tests/query-utils.spec.ts

@@ -14,12 +14,15 @@ beforeAll(() => {
 		dbo.prepare("INSERT INTO users (username, password_hash) VALUES (?, 'x')").run(`u${String(i).padStart(3, "0")}`);
 });
 
-const LIST = "select id, username from users where 1=1";
-const COUNT = "select count(*) as c from users where 1=1";
+// 裸 SQL（paged 直通）：租户化表必须显式写 tenant_id 且走参数——tenant.enable + sql_guard: deny
+// 下缺它会被真 oj 拒（夹具的 guardTenantSql 同样拒，见 tests/fixture.ts 头注释）
+const TENANT = "default";
+const LIST = "select id, username from users where tenant_id = ?";
+const COUNT = "select count(*) as c from users where tenant_id = ?";
 
 describe("AC1-24：limit 钳制与截断标记", () => {
 	it("size 静默钳 200，truncated=true（库 301 人=夹具 admin+300）", async () => {
-		const r = await paged<any>(LIST, COUNT, [], { page: 1, size: 500 });
+		const r = await paged<any>(LIST, COUNT, [TENANT], { page: 1, size: 500 });
 		expect(r.size).toBe(200);
 		expect(r.list.length).toBe(200);
 		expect(r.total).toBe(301);
@@ -27,16 +30,16 @@ describe("AC1-24：limit 钳制与截断标记", () => {
 	});
 
 	it("末页 truncated=false", async () => {
-		const r = await paged<any>(LIST, COUNT, [], { page: 2, size: 200 });
+		const r = await paged<any>(LIST, COUNT, [TENANT], { page: 2, size: 200 });
 		expect(r.list.length).toBe(101);
 		expect(r.truncated).toBe(false);
 	});
 
 	it("缺省 page=1 / size=20；页码/尺寸非法值回落（0/负数/非数）", async () => {
-		const d = await paged<any>(LIST, COUNT, [], {});
+		const d = await paged<any>(LIST, COUNT, [TENANT], {});
 		expect(d.page).toBe(1);
 		expect(d.size).toBe(20);
-		const bad = await paged<any>(LIST, COUNT, [], { page: 0, size: -3 });
+		const bad = await paged<any>(LIST, COUNT, [TENANT], { page: 0, size: -3 });
 		expect(bad.page).toBe(1);
 		expect(bad.size).toBe(20);
 	});
@@ -54,9 +57,9 @@ describe("AC1-22：LIKE 模式与 keyword 长度红线", () => {
 	it("LIKE 元字符转义：% _ ! 原样匹配不泛化", async () => {
 		dbo.prepare("INSERT INTO users (username, password_hash) VALUES ('a%b_c!d', 'x')").run();
 		const r = await paged<any>(
-			"select id, username from users where username like ? escape '!'",
-			"select count(*) as c from users where username like ? escape '!'",
-			[likePattern("a%b_c!d")],
+			"select id, username from users where tenant_id = ? and username like ? escape '!'",
+			"select count(*) as c from users where tenant_id = ? and username like ? escape '!'",
+			[TENANT, likePattern("a%b_c!d")],
 			{ size: 10 },
 		);
 		expect(r.list.map((x: any) => x.username)).toEqual(["a%b_c!d"]);