agentworkshop 0.2.1

package/scripts/test-town-world.mjs

@@ -0,0 +1,76 @@
+/**
+ * 小镇·大世界(P1)走查截图 —— 新 3200×2400 世界 + 环形布点 + 2.5D 挤出。
+ * 依赖:dev server(127.0.0.1:3000)+ Edge + puppeteer-core。
+ */
+import puppeteer from 'puppeteer-core'
+import fs from 'node:fs'
+
+const EDGE = 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'
+const BASE = 'http://127.0.0.1:3000'
+const OUT = 'gui-test-screenshots/wuwa-world'
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const api = async (m, ep, { body, token } = {}) => {
+  const h = { 'content-type': 'application/json' }
+  if (token) h.authorization = `Bearer ${token}`
+  const r = await fetch(`${BASE}${ep}`, { method: m, headers: h, body: body ? JSON.stringify(body) : undefined })
+  return r.json()
+}
+
+async function main() {
+  fs.mkdirSync(OUT, { recursive: true })
+  const email = `world-${Date.now().toString(36)}@test.local`
+  const reg = await api('POST', '/api/users/register', { body: { name: `w-${Date.now().toString(36)}`, email, password: 'Passw0rd!123' } })
+  const { token } = reg.data
+  // 4 频道(各 lead+worker) → 环形布点
+  const mkCh = async (name) => {
+    const ch = await api('POST', '/api/workshop/channels', { body: { name, scenarioPrompt: 't', leadAgent: { name: `${name}-lead`, harness: 'mock' } }, token })
+    await api('POST', `/api/workshop/channels/${ch.data.channelId}/agents`, { body: { name: `${name}-w`, harness: 'mock', role: 'worker' }, token })
+    return ch.data.channelId
+  }
+  const cids = []
+  for (const n of ['海港', '苔原', '工坊', '实验室']) cids.push(await mkCh(n))
+  const ws = await api('POST', '/api/workshop/workspaces', { body: { name: 'world-ws' }, token })
+  for (const c of cids) await api('POST', `/api/workshop/workspaces/${ws.data.id}/channels/${c}`, { token })
+
+  const browser = await puppeteer.launch({ executablePath: EDGE, headless: 'new', args: ['--no-sandbox'], defaultViewport: { width: 1400, height: 900 } })
+  const page = await browser.newPage()
+  page.on('pageerror', e => console.log('  [pageerror]', e.message.slice(0, 160)))
+  await page.goto(`${BASE}/workshop`, { waitUntil: 'domcontentloaded' })
+  await sleep(2500)
+  const si = (s, v) => page.$eval(s, (el, val) => {
+    const pr = el.tagName === 'TEXTAREA' ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype
+    Object.getOwnPropertyDescriptor(pr, 'value').set.call(el, val)
+    el.dispatchEvent(new Event('input', { bubbles: true }))
+  }, v)
+  await si('input[type=email]', email)
+  await si('input[type=password]', 'Passw0rd!123')
+  await sleep(200)
+  for (const bt of await page.$$('button')) {
+    if (((await bt.evaluate(el => el.textContent)) || '').trim().replace(/\s/g, '') === '登录') {
+      await bt.click()
+      break
+    }
+  }
+  await sleep(4500)
+  await page.goto(`${BASE}/workshop/w/${ws.data.id}?view=town`, { waitUntil: 'domcontentloaded' })
+  await sleep(5500)
+  let ready = false
+  for (let i = 0; i < 30 && !ready; i++) {
+    ready = await page.evaluate(() => window.__town?.scene?.getDebugState?.()?.blocks > 0)
+    if (!ready) await sleep(500)
+  }
+  await page.screenshot({ path: `${OUT}/01-world.png` })
+  const st = await page.evaluate(() => window.__town.scene.getDebugState())
+  console.log('blocks:', st.blocks, 'agents:', st.agents.length, 'player:', st.player)
+  console.log('agents:', st.agents.map(a => `${a.name}@${a.channelId.slice(0, 4)} (${a.x},${a.y})`).join(' | '))
+  await browser.close()
+  if (!ready) {
+    console.error('NOT READY')
+    process.exit(2)
+  }
+  console.log('DONE')
+}
+main().catch((e) => {
+  console.error(e)
+  process.exit(2)
+})

package/scripts/test-town-wuwa.mjs

@@ -0,0 +1,198 @@
+/**
+ * 小镇·共鸣黄昏 改版验证(E2E via puppeteer):
+ *  - 场景地图渲染(不再是白色方块);
+ *  - 同一 Channel 的 Agent 共享同色共鸣灵光(同频道 auraColor 一致,跨频道不同);
+ *  - 所有 Agent 可被手动拖动到地图任意位置(拖后 home 更新,draggable=true);
+ *  - 头顶气泡/状态环仍驱动。
+ * 依赖:dev server(127.0.0.1:3000)+ Edge + puppeteer-core。
+ */
+import puppeteer from 'puppeteer-core'
+import fs from 'node:fs'
+
+const EDGE = 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'
+const BASE = 'http://127.0.0.1:3000'
+const OUT = 'gui-test-screenshots/wuwa-town'
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+const api = async (method, ep, { body, token } = {}) => {
+  const headers = { 'content-type': 'application/json' }
+  if (token) headers.authorization = `Bearer ${token}`
+  const res = await fetch(`${BASE}${ep}`, { method, headers, body: body ? JSON.stringify(body) : undefined })
+  return res.json()
+}
+
+async function main() {
+  fs.mkdirSync(OUT, { recursive: true })
+  const email = `wu-${Date.now().toString(36)}@test.local`
+  const reg = await api('POST', '/api/users/register', {
+    body: { name: `wu-${Date.now().toString(36)}`, email, password: 'Passw0rd!123' },
+  })
+  const { token } = reg.data
+
+  // 两个频道,各自 lead + 2 worker → 验证跨频道不同色、同频道同色
+  const chA = await api('POST', '/api/workshop/channels', {
+    body: { name: '共鸣海港', scenarioPrompt: 'test', leadAgent: { name: 'a-lead', harness: 'mock' } }, token,
+  })
+  await api('POST', `/api/workshop/channels/${chA.data.channelId}/agents`, {
+    body: { name: 'a-w1', harness: 'mock', role: 'worker' }, token,
+  })
+  await api('POST', `/api/workshop/channels/${chA.data.channelId}/agents`, {
+    body: { name: 'a-w2', harness: 'mock', role: 'worker' }, token,
+  })
+  const chB = await api('POST', '/api/workshop/channels', {
+    body: { name: '苍山苔原', scenarioPrompt: 'test', leadAgent: { name: 'b-lead', harness: 'mock' } }, token,
+  })
+  await api('POST', `/api/workshop/channels/${chB.data.channelId}/agents`, {
+    body: { name: 'b-w1', harness: 'mock', role: 'worker' }, token,
+  })
+  const ws = await api('POST', '/api/workshop/workspaces', { body: { name: 'wu-ws' }, token })
+  await api('POST', `/api/workshop/workspaces/${ws.data.id}/channels/${chA.data.channelId}`, { token })
+  await api('POST', `/api/workshop/workspaces/${ws.data.id}/channels/${chB.data.channelId}`, { token })
+
+  const browser = await puppeteer.launch({
+    executablePath: EDGE, headless: 'new', args: ['--no-sandbox'],
+    defaultViewport: { width: 1400, height: 900 },
+  })
+  const page = await browser.newPage()
+  page.on('pageerror', e => console.log('  [pageerror]', e.message.slice(0, 200)))
+
+  await page.goto(`${BASE}/workshop`, { waitUntil: 'domcontentloaded' })
+  await sleep(2500)
+  const setInput = (sel, v) => page.$eval(sel, (el, val) => {
+    const proto = el.tagName === 'TEXTAREA' ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype
+    Object.getOwnPropertyDescriptor(proto, 'value').set.call(el, val)
+    el.dispatchEvent(new Event('input', { bubbles: true }))
+  }, v)
+  await setInput('input[type="email"]', email)
+  await setInput('input[type="password"]', 'Passw0rd!123')
+  await sleep(200)
+  for (const b of await page.$$('button')) {
+    if ((await b.evaluate(el => el.textContent) || '').replace(/\s/g, '') === '登录') {
+      await b.click()
+      break
+    }
+  }
+  await sleep(4500)
+
+  // 直接进入目标 workspace 的小镇视图(深链 ?view=town)
+  const wsUrl = `${BASE}/workshop/w/${ws.data.id}?view=town`
+  await page.goto(wsUrl, { waitUntil: 'domcontentloaded' })
+  await sleep(5500)
+  console.log('URL:', page.url())
+
+  // 等待场景 ready
+  let ready = false
+  for (let i = 0; i < 30 && !ready; i++) {
+    ready = await page.evaluate(() => window.__town?.scene && window.__town.scene.getDebugState?.()?.blocks > 0)
+    if (!ready) await sleep(500)
+  }
+  if (!ready) throw new Error('小镇场景未 ready')
+
+  await page.screenshot({ path: `${OUT}/01-town-map.png` })
+
+  // 断言 1:渲染态
+  const state = await page.evaluate(() => window.__town.scene.getDebugState())
+  console.log('blocks:', state.blocks, 'agents:', state.agents.length, 'player:', state.player)
+  console.log('agents:', state.agents.map(a => `${a.name}(${a.role})@ch=${a.channelId.slice(0, 4)} aura=#${a.auraColor.toString(16)} drag=${a.draggable}`).join(' | '))
+
+  // 断言 2:同频道发光同色、跨频道不同色
+  const byCh = {}
+  for (const a of state.agents) (byCh[a.channelId] ??= []).push(a.auraColor)
+  const chIds = Object.keys(byCh)
+  if (chIds.length < 2) throw new Error(`需要至少 2 个频道,实际 ${chIds.length}`)
+  let sameWithin = true
+  for (const id of chIds) {
+    const colors = [...new Set(byCh[id])]
+    if (colors.length !== 1) sameWithin = false
+  }
+  const diffAcross = new Set(chIds.map(id => byCh[id][0])).size === chIds.length
+  console.log(`同频道同色: ${sameWithin ? 'PASS' : 'FAIL'} | 跨频道异色: ${diffAcross ? 'PASS' : 'FAIL'}`)
+
+  // 断言 3:所有 agent 可拖动
+  const allDraggable = state.agents.every(a => a.draggable)
+  console.log(`全部可拖动: ${allDraggable ? 'PASS' : 'FAIL'}`)
+
+  // 断言 4:手动拖动第 1 个 agent → sprite 位置变化 + home 更新
+  const target = state.agents[0]
+  // 世界坐标 → 页面坐标:cam.worldView(已含 zoom)映射到 canvas DOM 尺寸
+  const tr = await page.evaluate(({ target }) => {
+    const s = window.__town.scene
+    const cam = s.cameras.main
+    const cv = s.sys.game.canvas
+    const rect = cv.getBoundingClientRect()
+    const wv = cam.worldView
+    const gsx = (target.x - wv.x) / wv.width * cam.width
+    const gsy = (target.y - wv.y) / wv.height * cam.height
+    const px = rect.left + gsx * (rect.width / cam.width)
+    const py = rect.top + gsy * (rect.height / cam.height)
+    return { px, py, rect: { l: rect.left, t: rect.top, w: rect.width, h: rect.height }, wv: { x: wv.x, y: wv.y, w: wv.width, h: wv.height }, zoom: cam.zoom, camW: cam.width, camH: cam.height }
+  }, { target })
+  console.log('DRAGINFO', JSON.stringify({ px: Math.round(tr.px), py: Math.round(tr.py), rect: tr.rect, wv: tr.wv, zoom: tr.zoom, camW: tr.camW, camH: tr.camH }))
+
+  // 该 agent 拖动前位置
+  const before = await page.evaluate((id) => {
+    const a = window.__town.scene.getDebugState().agents.find(x => x.agentId === id)
+    return { x: a.x, y: a.y, homeX: a.homeX, homeY: a.homeY }
+  }, target.agentId)
+  console.log('before:', before)
+
+  // 抓取:精灵可拖拽命中区为整帧(48x88, 中心为原点),在中心 ±20px 内小范围试抓直至 dragging=true
+  const dx = 120, dy = 90
+  const startCx = tr.px, startCy = tr.py
+  let grabbed = false
+  for (const ox of [0, 20, -20, 40, -40, 0]) {
+    for (const oy of [0, -18, 18, -34, 34]) {
+      if (startCy + oy < tr.rect.t || startCy + oy > tr.rect.t + tr.rect.h) continue
+      await page.mouse.move(startCx + ox, startCy + oy)
+      await page.mouse.down()
+      await sleep(60)
+      grabbed = await page.evaluate(id => window.__town.scene.agents.get(id)?.dragging === true, target.agentId)
+      if (grabbed) break
+      await page.mouse.up()
+      await sleep(30)
+    }
+    if (grabbed) break
+  }
+  if (!grabbed) throw new Error('未抓取到 agent(拖动未激活)')
+  console.log('抓取成功')
+
+  await page.mouse.move(startCx + dx, startCy + dy, { steps: 14 })
+  await sleep(250)
+  await page.mouse.up()
+  // 读取落点:home 应等于释放点(世界坐标);agent 随后恢复 roam,故仅比对 home 与 releasedPos
+  const after = await page.evaluate(({ target, dx, dy, tr }) => {
+    const s = window.__town.scene
+    const a = s.getDebugState().agents.find(x => x.agentId === target)
+    // 释放点世界坐标(从最终页面点反推)
+    const wv = s.cameras.main.worldView
+    const camW = s.cameras.main.width
+    const gsx = (tr.px + dx - tr.rect.l) / (tr.rect.w / camW)
+    const gsy = (tr.py + dy - tr.rect.t) / (tr.rect.h / s.cameras.main.height)
+    const wx = wv.x + (gsx / camW) * wv.width
+    const wy = wv.y + (gsy / s.cameras.main.height) * wv.height
+    return { x: a.x, y: a.y, homeX: a.homeX, homeY: a.homeY, wx, wy }
+  }, { target: target.agentId, dx, dy, tr })
+  console.log('after :', after)
+  const moved = Math.abs(after.x - after.wx) < 40 || Math.abs(after.x - before.x) > 5
+  // home 应接近释放点世界坐标(120,90 页面位移 → 世界位移)
+  const homeAtDrop = Math.abs(after.homeX - after.wx) < 60 && Math.abs(after.homeY - after.wy) < 60
+  console.log(`拖动移动: ${moved ? 'PASS' : 'FAIL'} | 落点即新 home: ${homeAtDrop ? 'PASS' : 'FAIL'}`)
+
+  await page.screenshot({ path: `${OUT}/02-dragged.png` })
+
+  const summary = {
+    sameWithin, diffAcross, allDraggable, moved, homeAtDrop,
+    blocks: state.blocks, agents: state.agents.length,
+  }
+  console.log('\nSUMMARY:', JSON.stringify(summary))
+  const allPass = sameWithin && diffAcross && allDraggable && moved && homeAtDrop
+  console.log(allPass ? '\n==> ALL PASS' : '\n==> SOME FAIL')
+  await browser.close()
+  process.exit(allPass ? 0 : 1)
+}
+
+main()
+  .catch((e) => {
+    console.error(e)
+    process.exit(2)
+  })

package/scripts/test-user-isolation.mjs

@@ -0,0 +1,193 @@
+/**
+ * 用户级隔离验证(对运行中的 dev server):
+ * ① 注册/登录:register 生成 token;me 验证;重名 409;伪 token 401
+ * ② 无 token 管理面全部 401(channels/agents/teams/tasks/messages/queue/runtime/workspaces)
+ * ③ 用户A创建 Channel/模板/编组/workspace → 用户B不可见(列表过滤)、不可改(403)
+ * ④ 跨用户资源操作:提交任务/删除/挂载/部署 → 403 SCOPE_VIOLATION
+ * ⑤ 遗留公共资源(NULL owner):对 A/B 均只读可见,写操作 403 FORBIDDEN_LEGACY
+ * ⑥ 用户A自己的资源:全流程正常(建 channel→worker→任务闭环)
+ * ⑦ WS sub 鉴权:无 token → error;A 的 token 订阅 B 的 channel → error;自己 channel → 正常推送
+ * ⑧ Workspace 持久化:list/create/mount/unmount/delete + channel 删除后 workspace 视角
+ * 运行: node scripts/test-user-isolation.mjs
+ */
+const BASE = process.env.AW_E2E_BASE ?? 'http://localhost:3000'
+
+let failures = 0
+function check(name, ok, detail = '') {
+  console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!ok) failures += 1
+}
+
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+async function api(method, path, { token, body } = {}) {
+  const res = await fetch(`${BASE}/api/workshop${path}`, {
+    method,
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+    },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  })
+  const json = await res.json().catch(() => null)
+  return { status: res.status, code: json?.code, data: json?.data }
+}
+
+const register = async name => (await api('POST', '/users/register', { body: { name } })).data
+
+async function main() {
+  console.log('=== ① 注册/登录 ===')
+  const ts = Date.now().toString(36)
+  const a = await register(`alice-${ts}`)
+  const b = await register(`bob-${ts}`)
+  check('注册 A/B 返回 token', !!a?.token && !!b?.token && a.token !== b.token)
+  const me = await api('GET', '/users/me', { token: a.token })
+  check('me 验证 token', me.status === 200 && me.data?.name === a.name)
+  const dup = await api('POST', '/users/register', { body: { name: a.name } })
+  check('重名注册 → 409 USER_EXISTS', dup.status === 409 && dup.code === 'USER_EXISTS')
+  const fake = await api('GET', '/users/me', { token: 'u-not-a-token' })
+  check('伪 token → 401 USER_UNAUTHORIZED', fake.status === 401 && fake.code === 'USER_UNAUTHORIZED')
+
+  console.log('\n=== ② 无 token 管理面全 401 ===')
+  const noTokenProbes = [
+    ['GET', '/channels'],
+    ['POST', '/channels', { name: 'x' }],
+    ['GET', '/agents'],
+    ['GET', '/teams'],
+    ['GET', '/workspaces'],
+    ['GET', '/runtime'],
+  ]
+  for (const [m, p, body] of noTokenProbes) {
+    const r = await api(m, p, { body })
+    check(`无 token ${m} ${p} → 401`, r.status === 401 && r.code === 'USER_UNAUTHORIZED', `status=${r.status}`)
+  }
+
+  console.log('\n=== ③ A 创建资源,B 视角隔离 ===')
+  const chA = await api('POST', '/channels', { token: a.token, body: { name: `alice-ch-${ts}` } })
+  check('A 创建 channel', chA.status === 200 && !!chA.data?.channelId)
+  const cidA = chA.data.channelId
+  await api('POST', `/channels/${cidA}/agents`, { token: a.token, body: { name: 'a-lead', harness: 'mock', role: 'lead' } })
+  await api('POST', `/channels/${cidA}/agents`, { token: a.token, body: { name: 'a-w1', harness: 'mock' } })
+  const tplA = await api('POST', '/agents', { token: a.token, body: { name: `alice-tpl-${ts}`, harness: 'mock' } })
+  const teamA = await api('POST', '/teams', { token: a.token, body: { name: `alice-team-${ts}` } })
+  check('A 创建模板/编组', tplA.status === 200 && teamA.status === 200)
+
+  const bChannels = await api('GET', '/channels', { token: b.token })
+  check('B 看不到 A 的 channel', !(bChannels.data ?? []).some(c => c.id === cidA), `n=${(bChannels.data ?? []).length}`)
+  const bAgents = await api('GET', '/agents', { token: b.token })
+  check('B 看不到 A 的模板', !(bAgents.data ?? []).some(t => t.id === tplA.data?.id))
+  const bTeams = await api('GET', '/teams', { token: b.token })
+  check('B 看不到 A 的编组', !(bTeams.data ?? []).some(t => t.id === teamA.data?.id))
+  const bDirect = await api('GET', `/channels/${cidA}`, { token: b.token })
+  check('B 直取 A 的 channel → 403', bDirect.status === 403 && bDirect.code === 'SCOPE_VIOLATION')
+
+  console.log('\n=== ④ 跨用户写操作 → 403 ===')
+  const bSubmit = await api('POST', `/channels/${cidA}/tasks`, { token: b.token, body: { title: 'hack' } })
+  check('B 向 A 的 channel 提交任务 → 403', bSubmit.status === 403)
+  const bDelete = await api('DELETE', `/channels/${cidA}`, { token: b.token })
+  check('B 删 A 的 channel → 403', bDelete.status === 403)
+  const bTplDel = await api('DELETE', `/agents/${tplA.data?.id}`, { token: b.token })
+  check('B 删 A 的模板 → 403', bTplDel.status === 403)
+
+  console.log('\n=== ⑤ 遗留公共资源只读 ===')
+  const legacyList = await api('GET', '/channels', { token: a.token })
+  const legacy = (legacyList.data ?? []).find(c => c.ownerUserId === null)
+  if (legacy) {
+    const lRead = await api('GET', `/channels/${legacy.id}`, { token: a.token })
+    check('遗留 channel 对 A 可读', lRead.status === 200)
+    const lWrite = await api('POST', `/channels/${legacy.id}/tasks`, { token: a.token, body: { title: 'x' } })
+    check('遗留 channel 写 → 403 FORBIDDEN_LEGACY', lWrite.status === 403 && lWrite.code === 'FORBIDDEN_LEGACY', lWrite.code)
+  }
+  else {
+    check('遗留 channel 只读(本库无遗留行,跳过)', true)
+  }
+
+  console.log('\n=== ⑥ A 自有资源全流程 ===')
+  const task = await api('POST', `/channels/${cidA}/tasks`, { token: a.token, body: { title: 'A 的任务', description: '闭环' } })
+  check('A 提交任务', task.status === 200)
+  const done = await (async () => {
+    const deadline = Date.now() + 25_000
+    while (Date.now() < deadline) {
+      const r = await api('GET', `/channels/${cidA}/tasks`, { token: a.token })
+      const t = (r.data ?? []).find(x => x.id === task.data?.id)
+      if (t?.state === 'COMPLETED') return true
+      await sleep(200)
+    }
+    return false
+  })()
+  check('A 的任务闭环 COMPLETED', done)
+
+  console.log('\n=== ⑦ WS sub 鉴权 ===')
+  const wsNoToken = await new Promise((resolve) => {
+    const ws = new WebSocket(`ws://localhost:3000/api/workshop/ws`)
+    ws.onopen = () => ws.send(JSON.stringify({ type: 'sub', channelId: cidA }))
+    ws.onmessage = (ev) => {
+      const f = JSON.parse(ev.data)
+      ws.close()
+      resolve(f)
+    }
+    setTimeout(() => resolve(null), 4000)
+  })
+  check('WS sub 无 token → USER_UNAUTHORIZED', wsNoToken?.payload?.code === 'USER_UNAUTHORIZED', wsNoToken?.payload?.code)
+  const wsCross = await new Promise((resolve) => {
+    const ws = new WebSocket(`ws://localhost:3000/api/workshop/ws`)
+    ws.onopen = () => ws.send(JSON.stringify({ type: 'sub', channelId: cidA, token: b.token }))
+    ws.onmessage = (ev) => {
+      const f = JSON.parse(ev.data)
+      ws.close()
+      resolve(f)
+    }
+    setTimeout(() => resolve(null), 4000)
+  })
+  check('WS B 订阅 A 的 channel → SCOPE_VIOLATION', wsCross?.payload?.code === 'SCOPE_VIOLATION', wsCross?.payload?.code)
+  const wsOwn = await new Promise((resolve) => {
+    const ws = new WebSocket(`ws://localhost:3000/api/workshop/ws`)
+    let gotSnapshot = false
+    ws.onopen = () => ws.send(JSON.stringify({ type: 'sub', channelId: cidA, token: a.token }))
+    ws.onmessage = (ev) => {
+      const f = JSON.parse(ev.data)
+      if (f.type === 'channel.snapshot') {
+        gotSnapshot = true
+        // 触发一个事件验证直推
+        api('POST', `/channels/${cidA}/tasks`, { token: a.token, body: { title: 'ws-push' } }).catch(() => {})
+      }
+      if (gotSnapshot && f.type === 'task.status') {
+        ws.close()
+        resolve(true)
+      }
+    }
+    setTimeout(() => resolve(gotSnapshot), 25_000)
+  })
+  check('WS A 订阅自己 channel:快照 + 直推', wsOwn === true)
+
+  console.log('\n=== ⑧ Workspace 持久化 ===')
+  const wsA = await api('POST', '/workspaces', { token: a.token, body: { name: `alice-ws-${ts}` } })
+  check('A 创建 workspace', wsA.status === 200 && !!wsA.data?.id)
+  const wsId = wsA.data?.id
+  const mount = await api('POST', `/workspaces/${wsId}/channels/${cidA}`, { token: a.token })
+  check('A 挂载自己 channel', mount.status === 200)
+  const bMount = await api('POST', `/workspaces/${wsId}/channels/${cidA}`, { token: b.token })
+  check('B 挂载 A 的 workspace → 403', bMount.status === 403)
+  const wsList = await api('GET', '/workspaces', { token: a.token })
+  const found = (wsList.data ?? []).find(w => w.id === wsId)
+  check('workspace 列表含挂载关系', found?.channelIds?.includes(cidA) === true)
+  const bWsList = await api('GET', '/workspaces', { token: b.token })
+  check('B 的 workspace 列表不含 A 的', !(bWsList.data ?? []).some(w => w.id === wsId))
+  const unmount = await api('DELETE', `/workspaces/${wsId}/channels/${cidA}`, { token: a.token })
+  check('A 移出 channel', unmount.status === 200)
+  const delWs = await api('DELETE', `/workspaces/${wsId}`, { token: a.token })
+  check('A 删除 workspace', delWs.status === 200)
+
+  // 清理
+  await api('DELETE', `/channels/${cidA}`, { token: a.token })
+  await api('DELETE', `/agents/${tplA.data?.id}`, { token: a.token })
+  await api('DELETE', `/teams/${teamA.data?.id}`, { token: a.token })
+
+  console.log(`\n${failures === 0 ? 'ALL PASS' : `${failures} FAILED`}`)
+  process.exit(failures === 0 ? 0 : 1)
+}
+
+main().catch((e) => {
+  console.error('隔离测试异常:', e)
+  process.exit(1)
+})