agentworkshop 0.2.1

package/scripts/e2e-template-isolation.mjs

@@ -0,0 +1,267 @@
+/**
+ * 模板用户隔离 + 权限系统 端到端验证(v10)
+ * ============================================================
+ * 前置:dev server 运行于 BASE(默认 :3001);内置 admin 账号 zhangwei@awshop.io / Awshop@123。
+ *
+ * 验证矩阵:
+ *  A. Agent 模板:私有不可见 → 公开可见可用(仅属主可改删)→ 回私;内置不可改删(user+admin)
+ *  B. AgentTeam:同上 + 公开编组含私有成员时他人部署被拒
+ *  C. Channel 模板:内置 2 个;从 channel 捕获(私有→公开);他人实例化+挂载;权限拒改删
+ *  D. Channel 实例:scenarioPrompt/workspace 热更新
+ *  E. 监控隔离:user 只见本人;admin 全量 + ownerName;用户管理接口 admin 门
+ */
+const BASE = process.env.BASE_URL ?? 'http://localhost:3001'
+const ADMIN_EMAIL = 'zhangwei@awshop.io'
+const ADMIN_PASSWORD = 'Awshop@123'
+
+let pass = 0
+let fail = 0
+function check(name, ok, detail = '') {
+  console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? ` — ${detail}` : ''}`)
+  if (ok) {
+    pass++
+  }
+  else {
+    fail++
+  }
+}
+
+const api = async (method, path, { body, token } = {}) => {
+  const headers = { 'content-type': 'application/json' }
+  if (token) headers.authorization = `Bearer ${token}`
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers,
+    body: body ? JSON.stringify(body) : undefined,
+  })
+  let json
+  try {
+    json = await res.json()
+  }
+  catch {
+    json = { code: 'BAD_JSON', message: `HTTP ${res.status}` }
+  }
+  return { status: res.status, code: json.code, message: json.message, data: json.data }
+}
+const ok = r => r.status === 200 && r.code === 0
+const failsWith = (r, code) => r.status >= 400 && r.code === code
+
+async function main() {
+  // ===== 0. 账号就绪 =====
+  const stamp = Date.now().toString(36)
+  const mkUser = async (name) => {
+    const email = `${name}-${stamp}@tpl-e2e.test`
+    const reg = await api('POST', '/api/users/register', { body: { name: `${name}-${stamp}`, email, password: 'Passw0rd!123' } })
+    if (!ok(reg)) throw new Error(`注册 ${name} 失败: ${reg.message}`)
+    return { email, token: reg.data.token, id: reg.data.user.id, name: reg.data.user.name }
+  }
+  const alice = await mkUser('alice')
+  const bob = await mkUser('bob')
+  const adminLogin = await api('POST', '/api/users/login', { body: { email: ADMIN_EMAIL, password: ADMIN_PASSWORD } })
+  if (!ok(adminLogin)) {
+    throw new Error(`admin 登录失败(${ADMIN_EMAIL}): ${adminLogin.message};请确认 data/users.sqlite 已种子 admin 账号`)
+  }
+  const admin = { token: adminLogin.data.token, id: adminLogin.data.user.id }
+  console.log(`  账号就绪: alice=${alice.id.slice(0, 8)} bob=${bob.id.slice(0, 8)} admin=${admin.id.slice(0, 8)}`)
+  const createdChannels = []
+  const createdTemplates = []
+  const createdTeams = []
+  const createdChannelTemplates = []
+
+  // ===== A. Agent 模板隔离 =====
+  console.log('\n=== A. Agent 模板用户隔离 ===')
+  const a1 = await api('POST', '/api/workshop/agents', {
+    token: alice.token,
+    body: { name: `alice-私有-${stamp}`, harness: 'mock', config: { role: 'worker' } },
+  })
+  check('A1 alice 创建私有模板', ok(a1) && a1.data.visibility === 'private' && a1.data.isBuiltin === false)
+  const aliceTpl = a1.data
+
+  const bobList1 = await api('GET', '/api/workshop/agents', { token: bob.token })
+  check('A2 bob 列表不见 alice 私有模板', ok(bobList1) && !bobList1.data.some(t => t.id === aliceTpl.id))
+
+  const bobGet = await api('GET', `/api/workshop/agents/${aliceTpl.id}`, { token: bob.token })
+  check('A3 bob 直接读取 → 403 SCOPE_VIOLATION', failsWith(bobGet, 'SCOPE_VIOLATION'), bobGet.message)
+
+  const bobPatch = await api('PATCH', `/api/workshop/agents/${aliceTpl.id}`, { token: bob.token, body: { name: 'hijack' } })
+  const bobDel = await api('DELETE', `/api/workshop/agents/${aliceTpl.id}`, { token: bob.token })
+  check('A4 bob 改/删他人模板 → 403', failsWith(bobPatch, 'SCOPE_VIOLATION') && bobDel.status === 403)
+
+  const aPub = await api('PATCH', `/api/workshop/agents/${aliceTpl.id}`, { token: alice.token, body: { visibility: 'public' } })
+  check('A5 alice 设为公开', ok(aPub) && aPub.data.visibility === 'public')
+  const bobList2 = await api('GET', '/api/workshop/agents', { token: bob.token })
+  const bobSees = bobList2.data.find(t => t.id === aliceTpl.id)
+  check('A6 bob 可见公开模板(含属主名)', !!bobSees && bobSees.ownerName === alice.name, `ownerName=${bobSees?.ownerName}`)
+
+  // bob 使用 alice 公开模板:建 channel + addAgentToChannel
+  const bobCh = await api('POST', '/api/workshop/channels', { token: bob.token, body: { name: `bob-ch-${stamp}` } })
+  check('A7 bob 建 channel', ok(bobCh))
+  createdChannels.push(bobCh.data.channelId)
+  const bobUse = await api('POST', `/api/workshop/channels/${bobCh.data.channelId}/agents`, {
+    token: bob.token, body: { agentId: aliceTpl.id, role: 'worker' },
+  })
+  check('A8 bob 可使用他人公开模板克隆实例', ok(bobUse))
+
+  const bobPatchPub = await api('PATCH', `/api/workshop/agents/${aliceTpl.id}`, { token: bob.token, body: { visibility: 'private' } })
+  check('A9 bob 不能修改公开模板可见性', bobPatchPub.status === 403)
+
+  // 内置模板:任何人都不可改删
+  const builtinPatch = await api('PATCH', '/api/workshop/agents/tpl-default-lead', { token: alice.token, body: { name: 'x' } })
+  const builtinDel = await api('DELETE', '/api/workshop/agents/tpl-default-lead', { token: alice.token })
+  const builtinPatchAdmin = await api('PATCH', '/api/workshop/agents/tpl-default-lead', { token: admin.token, body: { name: 'x' } })
+  check('A10 内置模板 user/admin 均不可改删(TEMPLATE_BUILTIN)',
+    failsWith(builtinPatch, 'TEMPLATE_BUILTIN') && failsWith(builtinDel, 'TEMPLATE_BUILTIN') && failsWith(builtinPatchAdmin, 'TEMPLATE_BUILTIN'))
+
+  const aliceList = await api('GET', '/api/workshop/agents', { token: alice.token })
+  check('A11 alice 可见内置模板(公开)', ok(aliceList) && aliceList.data.some(t => t.id === 'tpl-default-lead' && t.isBuiltin))
+
+  // ===== B. AgentTeam 隔离 =====
+  console.log('\n=== B. AgentTeam 用户隔离 ===')
+  const alicePrivTpl2 = await api('POST', '/api/workshop/agents', {
+    token: alice.token, body: { name: `alice-成员-${stamp}`, harness: 'mock', config: { role: 'worker' } },
+  })
+  createdTemplates.push(alicePrivTpl2.data?.id)
+  const b1 = await api('POST', '/api/workshop/teams', {
+    token: alice.token, body: { name: `alice-组-${stamp}`, description: 'e2e' } })
+  check('B1 alice 创建私有编组', ok(b1) && b1.data.visibility === 'private')
+  const aliceTeam = b1.data
+  createdTeams.push(aliceTeam.id)
+  await api('POST', `/api/workshop/teams/${aliceTeam.id}/members`, {
+    token: alice.token, body: { agentId: aliceTpl.id, role: 'lead' },
+  })
+  await api('POST', `/api/workshop/teams/${aliceTeam.id}/members`, {
+    token: alice.token, body: { agentId: alicePrivTpl2.data.id, role: 'worker' },
+  })
+
+  const bobTeams1 = await api('GET', '/api/workshop/teams', { token: bob.token })
+  check('B2 bob 不见 alice 私有编组', ok(bobTeams1) && !bobTeams1.data.some(t => t.id === aliceTeam.id))
+
+  await api('PATCH', `/api/workshop/teams/${aliceTeam.id}`, { token: alice.token, body: { visibility: 'public' } })
+  const bobTeams2 = await api('GET', '/api/workshop/teams', { token: bob.token })
+  check('B3 公开后 bob 可见', bobTeams2.data.some(t => t.id === aliceTeam.id))
+
+  // 公开编组含 bob 不可读的私有成员(alicePrivTpl2)→ bob 部署被拒
+  const bobDeploy = await api('POST', `/api/workshop/teams/${aliceTeam.id}/deploy`, {
+    token: bob.token, body: { channelId: bobCh.data.channelId } })
+  check('B4 公开编组含他人私有成员 → 部署 403', bobDeploy.status === 403, bobDeploy.message)
+
+  const teamBuiltinPatch = await api('PATCH', '/api/workshop/teams/team-default-fullstack', { token: admin.token, body: { name: 'x' } })
+  check('B5 内置编组 admin 也不可改', failsWith(teamBuiltinPatch, 'TEMPLATE_BUILTIN'))
+
+  // ===== C. Channel 模板 =====
+  console.log('\n=== C. Channel 模板 ===')
+  const tplListAlice = await api('GET', '/api/workshop/channel-templates', { token: alice.token })
+  check('C1 内置 Channel 模板 2 个全员可见', ok(tplListAlice) && tplListAlice.data.filter(t => t.isBuiltin).length === 2)
+  const tplListBob = await api('GET', '/api/workshop/channel-templates', { token: bob.token })
+  check('C2 bob 同样可见内置', tplListBob.data.filter(t => t.isBuiltin).length === 2)
+
+  // alice 建 channel(mock lead+worker)→ 捕获为模板
+  const aliceCh = await api('POST', '/api/workshop/channels', {
+    token: alice.token,
+    body: {
+      name: `alice-捕获源-${stamp}`,
+      scenarioPrompt: `e2e 场景 ${stamp}`,
+      leadAgent: { name: 'captain', harness: 'mock', config: { delayMs: 200 } },
+    },
+  })
+  createdChannels.push(aliceCh.data.channelId)
+  await api('POST', `/api/workshop/channels/${aliceCh.data.channelId}/agents`, {
+    token: alice.token, body: { agentId: 'tpl-default-qa', role: 'worker' },
+  })
+  const cap = await api('POST', '/api/workshop/channel-templates/from-channel', {
+    token: alice.token,
+    body: { channelId: aliceCh.data.channelId, name: `alice-ch-tpl-${stamp}`, visibility: 'private' },
+  })
+  check('C3 从 channel 捕获模板(场景/lead/成员)', ok(cap) && cap.data.scenarioPrompt.includes('e2e 场景') && cap.data.lead?.name === 'captain' && cap.data.members.length === 1)
+  const aliceChTpl = cap.data
+  createdChannelTemplates.push(aliceChTpl.id)
+
+  const bobTplList1 = await api('GET', '/api/workshop/channel-templates', { token: bob.token })
+  check('C4 bob 不见 alice 私有 Channel 模板', !bobTplList1.data.some(t => t.id === aliceChTpl.id))
+  const bobTplGet = await api('GET', `/api/workshop/channel-templates/${aliceChTpl.id}`, { token: bob.token })
+  check('C5 bob 直接读取 → 403', bobTplGet.status === 403)
+
+  const pubChTpl = await api('PATCH', `/api/workshop/channel-templates/${aliceChTpl.id}`, { token: alice.token, body: { visibility: 'public' } })
+  check('C6a alice 将 Channel 模板设为公开', ok(pubChTpl) && pubChTpl.data.visibility === 'public', pubChTpl.message)
+  const bobWs = await api('POST', '/api/workshop/workspaces', { token: bob.token, body: { name: `bob-ws-${stamp}` } })
+  const bobMount = await api('POST', `/api/workshop/workspaces/${bobWs.data.id}/channel-templates/${aliceChTpl.id}`, { token: bob.token, body: {} })
+  check('C6 bob 从公开模板实例化并挂载 workspace', ok(bobMount) && bobMount.data.agentCount === 2,
+    ok(bobMount) ? JSON.stringify(bobMount.data).slice(0, 140) : `${bobMount.status}/${bobMount.code}: ${bobMount.message}`)
+  createdChannels.push(bobMount.data.channelId)
+  const bobMounted = await api('GET', '/api/workshop/workspaces', { token: bob.token })
+  check('C7 挂载反映在 workspace channelIds', bobMounted.data.some(w => w.id === bobWs.data.id && w.channelIds.includes(bobMount.data.channelId)))
+  const bobInstCh = await api('GET', `/api/workshop/channels/${bobMount.data.channelId}`, { token: bob.token })
+  check('C8 实例继承场景 prompt + 属主为 bob', bobInstCh.data.scenarioPrompt.includes('e2e 场景') && bobInstCh.data.ownerUserId === bob.id)
+
+  const bobTplPatch = await api('PATCH', `/api/workshop/channel-templates/${aliceChTpl.id}`, { token: bob.token, body: { name: 'hijack' } })
+  const bobTplDel = await api('DELETE', `/api/workshop/channel-templates/${aliceChTpl.id}`, { token: bob.token })
+  check('C9 bob 不可改/删他人公开模板', bobTplPatch.status === 403 && bobTplDel.status === 403)
+
+  const chBuiltinPatch = await api('PATCH', '/api/workshop/channel-templates/chtpl-default-fullstack', { token: admin.token, body: { name: 'x' } })
+  check('C10 内置 Channel 模板 admin 不可改', failsWith(chBuiltinPatch, 'TEMPLATE_BUILTIN'))
+
+  // ===== D. Channel 实例热更新 =====
+  console.log('\n=== D. Channel 实例设置热更新 ===')
+  const newScenario = `更新后的场景 ${stamp}`
+  const patchCh = await api('PATCH', `/api/workshop/channels/${bobMount.data.channelId}`, {
+    token: bob.token, body: { scenarioPrompt: newScenario },
+  })
+  const getCh = await api('GET', `/api/workshop/channels/${bobMount.data.channelId}`, { token: bob.token })
+  check('D1 scenarioPrompt 热更新生效', ok(patchCh) && getCh.data.scenarioPrompt === newScenario)
+
+  // ===== E. 监控隔离 + admin 权限 =====
+  console.log('\n=== E. 监控用户级隔离与 admin ===')
+  const bobMon = await api('GET', '/api/system/monitor', { token: bob.token })
+  check('E1 bob 视图 scope=user 且只见本人 channel',
+    ok(bobMon) && bobMon.data.scope === 'user'
+    && !bobMon.data.channels.some(c => c.channelId === aliceCh.data.channelId)
+    && bobMon.data.channels.some(bc => bc.channelId === bobMount.data.channelId),
+    `channels=${bobMon.data?.channels?.length}`)
+
+  const aliceMon = await api('GET', '/api/system/monitor', { token: alice.token })
+  check('E2 alice 不见 bob 的 channel', ok(aliceMon) && !aliceMon.data.channels.some(c => c.channelId === bobMount.data.channelId))
+
+  const adminMon = await api('GET', '/api/system/monitor', { token: admin.token })
+  const adminSeesBoth = adminMon.data?.channels?.some(c => c.channelId === aliceCh.data.channelId)
+    && adminMon.data?.channels?.some(c => c.channelId === bobMount.data.channelId)
+  check('E3 admin 全量视图(scope=admin)含双方 channel', ok(adminMon) && adminMon.data.scope === 'admin' && adminSeesBoth)
+  const adminOwnName = adminMon.data.channels.find(c => c.channelId === aliceCh.data.channelId)?.ownerName
+  check('E4 admin 视图附创建者名', adminOwnName === alice.name, `ownerName=${adminOwnName}`)
+
+  const aliceUsers = await api('GET', '/api/users', { token: alice.token })
+  check('E5 非 admin 访问用户管理 → 403', failsWith(aliceUsers, 'ADMIN_REQUIRED'))
+  const adminUsers = await api('GET', '/api/users', { token: admin.token })
+  check('E6 admin 用户列表可用', ok(adminUsers) && Array.isArray(adminUsers.data.items) && adminUsers.data.items.length >= 3)
+
+  // admin 全量模板视图(含他人私有 + 创建者)
+  const adminTpls = await api('GET', '/api/workshop/agents', { token: admin.token })
+  const adminSeesAlicePrivate = adminTpls.data.some(t => t.id === alicePrivTpl2.data.id && t.ownerName === alice.name)
+  check('E7 admin 可见他人私有模板 + 创建者', adminSeesAlicePrivate)
+  const adminTeams = await api('GET', '/api/workshop/teams', { token: admin.token })
+  check('E8 admin 可见全部编组', adminTeams.data.some(t => t.id === aliceTeam.id))
+  const adminChTpls = await api('GET', '/api/workshop/channel-templates', { token: admin.token })
+  check('E9 admin 可见全部 Channel 模板 + 创建者', adminChTpls.data.some(t => t.id === aliceChTpl.id && t.ownerName === alice.name))
+
+  // admin 越权改删(非内置)
+  const adminRename = await api('PATCH', `/api/workshop/agents/${alicePrivTpl2.data.id}`, { token: admin.token, body: { name: `admin改-${stamp}` } })
+  check('E10 admin 可改他人私有模板', ok(adminRename) && adminRename.data.name === `admin改-${stamp}`)
+
+  // ===== 清理 =====
+  for (const id of createdChannels) {
+    await api('DELETE', `/api/workshop/channels/${id}`, { token: bob.token }).catch(() => {})
+    await api('DELETE', `/api/workshop/channels/${id}`, { token: alice.token }).catch(() => {})
+  }
+  for (const id of createdChannelTemplates) await api('DELETE', `/api/workshop/channel-templates/${id}`, { token: alice.token }).catch(() => {})
+  for (const id of createdTeams) await api('DELETE', `/api/workshop/teams/${id}`, { token: alice.token }).catch(() => {})
+  for (const id of createdTemplates) await api('DELETE', `/api/workshop/agents/${id}`, { token: alice.token }).catch(() => {})
+  await api('DELETE', `/api/workshop/agents/${aliceTpl.id}`, { token: alice.token }).catch(() => {})
+  await api('DELETE', `/api/workshop/workspaces/${bobWs.data.id}`, { token: bob.token }).catch(() => {})
+
+  console.log(`\n${pass} pass / ${fail} fail`)
+  process.exit(fail > 0 ? 1 : 0)
+}
+
+main().catch((e) => {
+  console.error('E2E 崩溃:', e)
+  process.exit(1)
+})

package/scripts/e2e-token-ui.mjs

@@ -0,0 +1,149 @@
+/**
+ * Token 页 UI 交互验证:登录 → /tokens → 签发 token →
+ * 断言:列表可见新 token 行 / 明文默认掩码 / 眼睛按钮切换明文 / 复制按钮写剪贴板。截图留档。
+ */
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.env.BASE_URL ?? 'http://localhost:3001'
+const EDGE = 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'
+const SHOT_DIR = '.design-verify'
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+const api = async (method, path, { body } = {}) => {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { 'content-type': 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  })
+  return res.json()
+}
+
+let pass = 0
+let fail = 0
+function check(name, ok, detail = '') {
+  console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? ` — ${detail}` : ''}`)
+  if (ok) {
+    pass++
+  }
+  else {
+    fail++
+  }
+}
+
+async function main() {
+  mkdirSync(SHOT_DIR, { recursive: true })
+  const stamp = Date.now().toString(36)
+  const email = `tok-ui-${stamp}@test.local`
+  await api('POST', '/api/users/register', { body: { name: `tokui-${stamp}`, email, password: 'Passw0rd!123' } })
+
+  const browser = await puppeteer.launch({
+    executablePath: EDGE,
+    headless: 'new',
+    args: ['--no-sandbox', '--disable-gpu'],
+    defaultViewport: { width: 1440, height: 900 },
+  })
+  const page = await browser.newPage()
+  page.on('pageerror', e => console.log('  [pageerror]', e.message.slice(0, 160)))
+  // 授权剪贴板(复制按钮)+ 保持前台焦点(headless 剪贴板读写需 document focus)
+  await page.browserContext().overridePermissions(`${BASE}`, ['clipboard-read', 'clipboard-write'])
+  await page.bringToFront()
+
+  // 登录
+  await page.goto(`${BASE}/workshop`, { waitUntil: 'domcontentloaded' })
+  await sleep(2200)
+  await page.$eval('input[type="email"]', (el, v) => {
+    const set = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value').set
+    set.call(el, v)
+    el.dispatchEvent(new Event('input', { bubbles: true }))
+  }, email)
+  await page.$eval('input[type="password"]', (el, v) => {
+    const set = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value').set
+    set.call(el, v)
+    el.dispatchEvent(new Event('input', { bubbles: true }))
+  }, 'Passw0rd!123')
+  await sleep(200)
+  for (const b of await page.$$('button')) {
+    const txt = (await b.evaluate(el => el.textContent) || '').trim()
+    if (txt.replace(/\s/g, '') === '登录') {
+      await b.click()
+      break
+    }
+  }
+  await sleep(3500)
+  const dbg = await page.evaluate(() => ({
+    url: location.pathname,
+    keys: Object.keys(localStorage),
+    sample: (Object.keys(localStorage).filter(k => k.includes('user')).map(k => localStorage.getItem(k)?.slice(0, 80))),
+    cookies: document.cookie.split(';').map(c => c.trim().split('=')[0]),
+  }))
+  console.log('  [login-debug]', JSON.stringify(dbg))
+
+  // tokens 页
+  await page.goto(`${BASE}/tokens`, { waitUntil: 'domcontentloaded' })
+  await sleep(2800)
+  await page.screenshot({ path: `${SHOT_DIR}/tok-01-list.png` })
+
+  // 签发
+  const createBtn = await page.evaluateHandle(() => [...document.querySelectorAll('button')].find(b => (b.textContent || '').includes('签发 Token')))
+  await createBtn.asElement().click()
+  await sleep(600)
+  await page.$eval('.ant-modal input', (el, v) => {
+    const set = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value').set
+    set.call(el, v)
+    el.dispatchEvent(new Event('input', { bubbles: true }))
+  }, 'e2e-验证令牌')
+  await sleep(200)
+  const okBtn = await page.evaluateHandle(() => [...document.querySelectorAll('.ant-modal button')].find(b => (b.textContent || '').replace(/\s/g, '') === '创建'))
+  await okBtn.asElement().click()
+  await sleep(1600)
+
+  // 明文回显弹层:默认掩码
+  const raw1 = await page.$eval('.raw', el => el.textContent)
+  const maskedOk = /•{6,}/.test(raw1)
+  check('T1 新 token 默认掩码显示', maskedOk, raw1?.slice(0, 28))
+  await page.screenshot({ path: `${SHOT_DIR}/tok-02-masked.png` })
+
+  // 眼睛按钮 → 明文
+  const eyeBtn = await page.evaluateHandle(() => [...document.querySelectorAll('.raw-op')].find(b => b.querySelector('.i-tabler-eye')))
+  await eyeBtn.asElement().click()
+  await sleep(400)
+  const raw2 = await page.$eval('.raw', el => el.textContent)
+  const revealedOk = /^[A-Za-z0-9_-]{20,}$/.test(raw2 ?? '')
+  check('T2 眼睛按钮切换为明文', revealedOk, `${(raw2 ?? '').slice(0, 10)}…(${(raw2 ?? '').length} 字符)`)
+  const tokenValue = raw2 ?? ''
+  await page.screenshot({ path: `${SHOT_DIR}/tok-03-revealed.png` })
+
+  // 再点(眼睛变 eye-off)→ 回掩码
+  const eyeOffBtn = await page.evaluateHandle(() => [...document.querySelectorAll('.raw-op')].find(b => b.querySelector('.i-tabler-eye-off')))
+  await eyeOffBtn.asElement().click()
+  await sleep(300)
+  const raw3 = await page.$eval('.raw', el => el.textContent)
+  check('T3 再点切回掩码', /•{6,}/.test(raw3))
+
+  // 复制按钮 → 成功反馈(勾图标)+ 剪贴板回读(headless 焦点缺失时回读可能为空,仅作辅助观测)
+  const copyBtn = await page.evaluateHandle(() => [...document.querySelectorAll('.raw-op')].find(b => b.querySelector('.i-tabler-copy')))
+  await copyBtn.asElement().click()
+  await sleep(700)
+  const checkIcon = await page.$('.raw-op.ok .i-tabler-check')
+  check('T4 复制成功反馈(勾图标切换)', !!checkIcon)
+  const clip = await page.evaluate(() => navigator.clipboard.readText().catch(() => ''))
+  console.log(`  [obs] clipboard readback: ${clip === tokenValue ? 'match' : clip ? 'mismatch' : 'empty(headless focus)'}`)
+
+  // 关闭 → 列表出现新行
+  const closeBtn = await page.evaluateHandle(() => [...document.querySelectorAll('.ant-modal button')].find(b => (b.textContent || '').includes('我已保存')))
+  await closeBtn.asElement().click()
+  await sleep(1200)
+  const rowCount = await page.$$eval('.ant-table-tbody tr', rows => rows.length)
+  check('T6 列表含新 token 行', rowCount >= 2, `rows=${rowCount}`)
+  await page.screenshot({ path: `${SHOT_DIR}/tok-04-list-after.png` })
+
+  await browser.close()
+  console.log(`\n${pass} pass / ${fail} fail`)
+  process.exit(fail > 0 ? 1 : 0)
+}
+
+main().catch((e) => {
+  console.error('UI 验证崩溃:', e)
+  process.exit(1)
+})

package/scripts/final-soup-run.py

@@ -0,0 +1,192 @@
+# -*- coding: utf-8 -*-
+"""最终海龟汤链路验证:即时响应 + 信箱可查 + 状态实时流转。
+
+用法: python scripts/final-soup-run.py
+依赖: 仅标准库(urllib);环境变量 AW_BASE / AW_TOKEN 可覆盖默认值。
+输出: 三段式 —— [下发] [实时监控时间线] [终局分析(延迟矩阵/信箱状态流转/内容理解证据)]
+"""
+import json
+import os
+import sys
+import time
+import urllib.request
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+BASE = os.environ.get('AW_BASE', 'http://127.0.0.1:3001')
+TOKEN = os.environ.get('AW_TOKEN', 'ut-636e563104b844b591de8aadf6071aea')
+CID = os.environ.get('AW_CID', '4b4d742d-2e27-4f2d-a2c9-c1ce9ceb0411')
+NAME = {'b0de4cfa': '出谜者(lead)', '9e4e0b76': '猜谜者(worker)'}
+
+
+def who(agent_id):
+    if not agent_id:
+        return '?'
+    return NAME.get(agent_id[:8], agent_id[:8])
+
+
+def api(method, path, body=None):
+    req = urllib.request.Request(
+        BASE + path,
+        data=json.dumps(body).encode() if body is not None else None,
+        method=method,
+        headers={
+            'Authorization': 'Bearer ' + TOKEN,
+            'Content-Type': 'application/json',
+        },
+    )
+    with urllib.request.urlopen(req, timeout=15) as resp:
+        data = json.loads(resp.read().decode())
+    if isinstance(data, dict) and data.get('code') not in (None, 0):
+        raise RuntimeError(f'{path} -> {data}')
+    return data.get('data', data) if isinstance(data, dict) else data
+
+
+def parts_text(parts):
+    if not isinstance(parts, list):
+        return ''
+    return ' '.join(p.get('text', '') for p in parts if isinstance(p, dict))
+
+
+def ts(iso):
+    """ISO 时间 -> 相对 t0 的秒(用于延迟计算)。"""
+    from datetime import datetime, timezone
+    dt = datetime.fromisoformat(iso.replace('Z', '+00:00')).astimezone(timezone.utc)
+    return dt.timestamp()
+
+
+def main():
+    t0 = time.monotonic()
+
+    def rel():
+        return f'[{time.monotonic() - t0:7.1f}s]'
+
+    # ---- Phase 0: 前置快照 ----
+    ch = api('GET', f'/api/workshop/channels/{CID}/events?limit=1')
+    last_seq = ch['maxSeq']
+    seen_msgs = {m['id'] for m in api('GET', f'/api/workshop/channels/{CID}/messages?limit=200')}
+    print(f'{rel()} === 最终海龟汤验证 ===')
+    print(f'{rel()} 基线: maxSeq={last_seq}, 既有信箱消息 {len(seen_msgs)} 条')
+
+    # ---- Phase 1: 下发迷你对局任务(自动路由 lead=出谜者) ----
+    task = api('POST', f'/api/workshop/channels/{CID}/tasks', {
+        'title': '最终链路验证:迷你海龟汤(2轮问答)',
+        'description': (
+            '请立即主持一局快节奏迷你海龟汤(总共最多2轮问答,控制时长):\n'
+            '1. 用 send_message_to_agent 把一个原创短谜面发给成员"猜谜者"(require_reply=true)。\n'
+            '2. 发完立刻用 poll_messages(wait_seconds=60) 阻塞等待对方的问题;对方提问只答"是/否/与此无关"。\n'
+            '3. 最多2轮后,用 send_message_to_agent 主动向对方揭晓汤底,然后标记本任务完成。\n'
+            '注意:所有对白必须走 send_message_to_agent 发送(不要只写进最终报告);等回复用 poll_messages 的 wait_seconds 阻塞等待。'
+        ),
+    })
+    task_id = task['task']['id'] if isinstance(task, dict) and 'task' in task else task['id']
+    print(f'{rel()} 任务已下发: {task_id} (等待 lead 即时唤醒...)')
+
+    # ---- Phase 2: 双流实时监控 ----
+    states = {}          # msgId -> state(实时追踪状态流转)
+    msg_meta = {}        # msgId -> row(延迟分析用)
+    events_log = []      # (rel_t, type, agentId, taskId, note)
+    delta_count = 0
+    completed = False
+    last_event_at = time.monotonic()
+    deadline = time.monotonic() + 9 * 60
+
+    while time.monotonic() < deadline:
+        # 事件流
+        ev = api('GET', f'/api/workshop/channels/{CID}/events?limit=200')
+        for e in sorted(ev['items'], key=lambda x: x['seq']):
+            if e['seq'] <= last_seq:
+                continue
+            last_seq = e['seq']
+            last_event_at = time.monotonic()
+            etype, p = e['type'], e.get('payload') or {}
+            agent = e.get('agentId')
+            if etype == 'agent.delta':
+                delta_count += 1
+                continue
+            if etype == 'a2a.message':
+                meta = p.get('metadata') or {}
+                body = parts_text(p.get('parts'))[:90].replace('\n', ' ')
+                note = f"{who(meta.get('x-aw-from-agent'))} -> {who(meta.get('x-aw-target-agent')) or '频道'}: {body}"
+                events_log.append((last_event_at - t0, etype, agent, e.get('taskId'), note))
+            elif etype == 'agent.status':
+                note = f"状态 -> {p.get('status') or p}"
+                events_log.append((last_event_at - t0, etype, agent, e.get('taskId'), note))
+            elif etype == 'task.status':
+                note = f"任务 {str(e.get('taskId'))[:8]} -> {p.get('status') or p}"
+                if p.get('status') in ('completed', 'COMPLETED') and e.get('taskId') == task_id:
+                    completed = True
+                events_log.append((last_event_at - t0, etype, agent, e.get('taskId'), note))
+            else:
+                events_log.append((last_event_at - t0, etype, agent, e.get('taskId'), str(p)[:70]))
+            print(f"{rel()} seq={e['seq']:<4} {etype:<13} {who(agent):<12} {events_log[-1][4]}")
+
+        # 信箱状态流(REST 可查性 + 实时流转证据)
+        for m in api('GET', f'/api/workshop/channels/{CID}/messages?limit=100'):
+            mid, st = m['id'], m['state']
+            if mid in seen_msgs and mid not in states:
+                continue
+            msg_meta.setdefault(mid, m)
+            msg_meta[mid]['state'] = st
+            if mid not in states:
+                states[mid] = st
+                if mid not in seen_msgs:
+                    age = ''
+                    if m.get('consumedAt'):
+                        age = f" (created->consumed {ts(m['consumedAt']) - ts(m['createdAt']):.2f}s)"
+                    print(f"{rel()} 信箱+ {mid[:8]} {who(m['fromAgentId'])} -> {who(m['toAgentId'])} state={st}{age}")
+            elif st != states[mid]:
+                lag = time.monotonic() - t0
+                print(f"{rel()} 信箱~ {mid[:8]} {states[mid]} -> {st} (观测于创建后 {lag - 0:.1f}s 窗口内)")
+                states[mid] = st
+
+        if completed and time.monotonic() - last_event_at > 6:
+            break
+        if events_log and time.monotonic() - last_event_at > 150:
+            print(f'{rel()} 事件静默150s,提前收束监控')
+            break
+        if not events_log and time.monotonic() - t0 > 180:
+            print(f'{rel()} 3分钟无任何事件,异常退出监控')
+            break
+        time.sleep(1.2)
+
+    # ---- Phase 3: 终局分析 ----
+    print(f'\n{rel()} === 终局分析 ===')
+    rows = api('GET', f'/api/workshop/channels/{CID}/messages?limit=100')
+    fresh = [m for m in rows if m['id'] not in seen_msgs]
+    fresh.sort(key=lambda m: m['createdAt'])
+    print(f'\n-- A. 信箱延迟矩阵({len(fresh)} 条新消息,REST 可查) --')
+    print(f"{'id':<9} {'from->to':<22} {'created(+s)':<11} {'state':<10} {'created->consumed'}")
+    t_submit = None
+    for m in fresh:
+        if t_submit is None:
+            t_submit = ts(m['createdAt']) - 0
+        delta = f"{ts(m['consumedAt']) - ts(m['createdAt']):.2f}s" if m.get('consumedAt') else '(未消费)'
+        route = f"{who(m['fromAgentId'])}->{who(m['toAgentId'])}"
+        print(f"{m['id'][:8]:<9} {route:<22} {m['createdAt'][11:19]:<11} {m['state']:<10} {delta}")
+
+    print(f'\n-- B. a2a 消息时间线(往返延迟) --')
+    by_id = {m['id']: m for m in fresh}
+    for m in fresh:
+        meta = json.loads(m.get('metadataJson')) if isinstance(m.get('metadataJson'), str) else (m.get('metadata') or {})
+        rt = meta.get('x-aw-in-reply-to')
+        if rt and rt in by_id:
+            d = ts(m['createdAt']) - ts(by_id[rt]['createdAt'])
+            print(f"  {who(m['fromAgentId'])} 回复 {rt[:8]} 往返 {d:.2f}s")
+
+    print(f'\n-- C. 消息全文(内容理解证据) --')
+    for m in fresh:
+        body = parts_text(m.get('parts'))[:200].replace('\n', ' ')
+        st = {'pending': '未读', 'consuming': '处理中', 'consumed': '已读'}.get(m['state'], m['state'])
+        print(f"  [{m['createdAt'][11:19]}] {who(m['fromAgentId'])} -> {who(m['toAgentId'])} ({st}): {body}")
+
+    print(f'\n-- D. 事件统计 --')
+    counts = {}
+    for _, etype, *_ in events_log:
+        counts[etype] = counts.get(etype, 0) + 1
+    print(f'  {counts} | agent.delta 流片 x{delta_count} | 任务完成: {completed}')
+    print('\nDONE' if completed else '\nTIMEOUT')
+
+
+if __name__ == '__main__':
+    main()