agentworkshop 0.2.1

package/server/api/workshop/a2a/[agentId]/rpc/index.post.ts

@@ -0,0 +1,429 @@
+/**
+ * POST /api/workshop/a2a/:agentId.rpc —— A2A JSON-RPC 2.0 端点(设计文档 §6.3,规范 §7)。
+ *
+ * 方法:
+ *  - tasks/send        外部消息转为 task(submitChannelTask / 直接任务消息投递)→ 阻塞等待终态(30s 超时)
+ *  - tasks/sendSubscribe 同 tasks/send,但以 SSE(Content-Type: text/event-stream)流式输出
+ *                       task/status-update/artifact-update/message 事件直到终态
+ *  - tasks/get         按 taskId 查任务(作用域 = URL agent 所在 channel)
+ *  - tasks/list        列 URL agent 所在 channel 的任务
+ *  - tasks/cancel      取消任务(优先以 Authorization Bearer token 关联的 agent 身份,
+ *                       无 token 时以任务所在 channel 的 lead 作为系统身份)
+ *  - message/send      点对点发消息给 URL agent(需要有效 token 确定发送方,防冒用)
+ *  - agent/getCard     返回 AgentCard
+ *
+ * 错误按 JSON-RPC 规范返回 error 对象:
+ *  -32700 Parse error / -32600 Invalid Request / -32601 Method not found / -32602 Invalid params
+ *  -32001 Agent not found / -32002 Task not found / -32003 Task not cancelable
+ *  -32004 Unsupported operation / -32005 Agent not authorized / -32603 Internal error
+ */
+import { randomUUID } from 'node:crypto'
+import { defineEventHandler, getRouterParam, readBody, createEventStream, type H3Event } from 'h3'
+import { z } from 'zod'
+import { AppError } from '../../../../../utils/errors'
+import { getWorkshopManager } from '../../../../../plugins/workshop'
+import { findAgent, buildAgentCard } from '../card/index.get'
+import type { AgentChannelManager } from '../../../../../services/workshop/runtime/manager'
+import type { TaskEngine } from '../../../../../services/workshop/runtime/agent-runtime'
+import type { AgentInfo } from '../../../../../services/workshop/agents/agent-interface'
+import type { A2AMessage, Part } from '../../../../../services/workshop/types/a2a'
+import type { TaskState, WorkspaceTask } from '../../../../../services/workshop/types/task'
+
+// ===== JSON-RPC 信封与错误 =====
+
+interface JsonRpcError {
+  code: number
+  message: string
+  data?: unknown
+}
+interface JsonRpcResponse {
+  jsonrpc: '2.0'
+  id: unknown
+  result?: unknown
+  error?: JsonRpcError
+}
+
+/** 业务内可控的 JSON-RPC 错误(抛出后由外层转成 error 响应) */
+class RpcMethodError extends Error {
+  constructor(readonly error: JsonRpcError) {
+    super(error.message)
+    this.name = 'RpcMethodError'
+  }
+}
+
+function fail(code: number, message: string): never {
+  throw new RpcMethodError({ code, message })
+}
+
+function ok(id: unknown, result: unknown): JsonRpcResponse {
+  return { jsonrpc: '2.0', id, result }
+}
+
+function err(id: unknown, error: JsonRpcError): JsonRpcResponse {
+  return { jsonrpc: '2.0', id, error }
+}
+
+/** AppError(平台业务错误)→ A2A 规范错误码(规范 §3.3.2) */
+function appErrorToRpc(error: AppError): JsonRpcError {
+  switch (error.code) {
+    case 'NOT_FOUND':
+      return { code: -32002, message: error.message }
+    case 'SCOPE_VIOLATION':
+      return { code: -32005, message: error.message }
+    case 'INVALID_TRANSITION':
+      return { code: -32003, message: error.message }
+    case 'NO_LEAD_AGENT':
+      return { code: -32004, message: error.message }
+    default:
+      return { code: -32603, message: error.message, data: { appCode: error.code } }
+  }
+}
+
+// ===== zod 参数校验(与 MCP 层同构) =====
+
+/** 运行时校验与契约 Part 一致;zod union 推断形状与契约存在无害差异,as 收窄类型 */
+const partSchema = z.union([
+  z.object({
+    text: z.string(),
+    mediaType: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+  }),
+  z.object({
+    data: z.unknown(),
+    mediaType: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+  }),
+  z.object({
+    url: z.string(),
+    mediaType: z.string().optional(),
+    filename: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+  }),
+  z.object({
+    raw: z.string(),
+    mediaType: z.string().optional(),
+    filename: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+  }),
+]) as z.ZodType<Part>
+
+const messageSchema = z.object({
+  role: z.enum(['ROLE_USER', 'ROLE_AGENT']),
+  parts: z.array(partSchema).min(1, 'parts 至少 1 个'),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+})
+const sendParamsSchema = z.object({
+  taskId: z.string().optional(),
+  message: messageSchema,
+  historyLength: z.number().int().nonnegative().optional(),
+})
+const taskIdParamsSchema = z.object({
+  taskId: z.string().min(1, 'taskId 必填'),
+})
+const noopParamsSchema = z.record(z.string(), z.unknown()).optional()
+const sendMessageParamsSchema = z.object({
+  message: messageSchema,
+})
+
+function parseParams<S extends z.ZodTypeAny>(schema: S, params: unknown): z.infer<S> {
+  const result = schema.safeParse(params ?? {})
+  if (!result.success) {
+    const issue = result.error.issues[0]
+    const detail = issue ? `${issue.path.join('.') || 'params'}: ${issue.message}` : '参数校验失败'
+    fail(-32602, `Invalid params: ${detail}`)
+  }
+  return result.data
+}
+
+// ===== manager 内部访问(类型收窄) =====
+
+/** manager 未公开 TaskEngine / 路由访问;经内部方法只读获取(与运行时同一实例) */
+function internalsOf(manager: AgentChannelManager): { getTaskEngine(): TaskEngine, route(channelId: string, message: A2AMessage): void } {
+  return manager as unknown as { getTaskEngine(): TaskEngine, route(channelId: string, message: A2AMessage): void }
+}
+
+// ===== A2A 语义映射 =====
+
+const TERMINAL_STATES: Record<TaskState, boolean> = {
+  SUBMITTED: false,
+  ASSIGNED: false,
+  WORKING: false,
+  WAITING: false,
+  COMPLETED: true,
+  FAILED: true,
+  CANCELED: true,
+}
+
+function isTerminal(state: TaskState): boolean {
+  return TERMINAL_STATES[state] === true
+}
+
+function sleep(ms: number): Promise<void> {
+  const { promise, resolve } = Promise.withResolvers<undefined>()
+  setTimeout(resolve, ms)
+  return promise
+}
+
+/** WorkspaceTask → A2A Task(规范 §7 字段子集) */
+function toA2ATask(task: WorkspaceTask) {
+  return {
+    id: task.id,
+    contextId: task.channelId,
+    status: { state: task.state, timestamp: task.updatedAt },
+    artifacts: task.artifacts,
+    history: task.history,
+    metadata: {
+      assigneeId: task.assigneeId,
+      creatorId: task.creatorId,
+      title: task.title,
+      progress: task.progress,
+    },
+  }
+}
+
+/** 从 parts 提取任务标题(拼接 text 片段) */
+function extractTitle(parts: Part[]): string {
+  const text = parts
+    .map(p => (p as { text?: unknown }).text)
+    .filter((t): t is string => typeof t === 'string')
+    .join(' ')
+    .trim()
+  return text || 'A2A 任务'
+}
+
+/**
+ * 外部消息转为 task:
+ *  - lead:channel 级任务(submitChannelTask,SUBMITTED → 调度循环 dispatch 分发)
+ *  - worker:直接任务消息投递(create + ASSIGNED + assign 消息 → 其 mailbox 自动接取)
+ */
+async function submitTask(manager: AgentChannelManager, agent: AgentInfo, params: z.infer<typeof sendParamsSchema>): Promise<WorkspaceTask> {
+  const parts = params.message.parts as Part[]
+  const title = extractTitle(parts)
+  const description
+    = typeof params.message.metadata?.description === 'string' ? params.message.metadata.description : undefined
+  if (agent.role === 'lead') {
+    return manager.submitChannelTask({ channelId: agent.channelId, title, description, parts })
+  }
+  const engine = internalsOf(manager).getTaskEngine()
+  const task = engine.create({
+    channelId: agent.channelId,
+    creatorId: '',
+    assigneeId: agent.id,
+    title,
+    description,
+    parts,
+  })
+  engine.transition(task.id, 'ASSIGNED', agent.id)
+  const message: A2AMessage = {
+    messageId: randomUUID(),
+    contextId: agent.channelId,
+    taskId: task.id,
+    role: 'ROLE_USER',
+    parts,
+    metadata: { 'x-aw-task-kind': 'assign', 'x-aw-task-id': task.id },
+  }
+  internalsOf(manager).route(agent.channelId, message)
+  return engine.get(task.id)!
+}
+
+/** 阻塞轮询任务终态(默认 30s 超时 → -32603) */
+async function waitTerminal(manager: AgentChannelManager, taskId: string, timeoutMs = 30_000): Promise<WorkspaceTask> {
+  const engine = internalsOf(manager).getTaskEngine()
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    const task = engine.get(taskId)
+    if (task && isTerminal(task.state)) return task
+    if (Date.now() >= deadline) fail(-32603, `任务执行超时: ${taskId}`)
+    await sleep(50)
+  }
+}
+
+/** 从 Authorization: Bearer 头解析 caller token */
+function bearerTokenOf(event: H3Event): string | undefined {
+  const header = event.headers.get('authorization') ?? event.headers.get('Authorization')
+  if (!header) return undefined
+  const match = /^Bearer\s+(.+)$/i.exec(header)
+  return match?.[1]?.trim()
+}
+
+/** 取消任务:优先 token 关联 agent;无 caller 时以任务所在 channel 的 lead 作为系统身份 */
+async function cancelTaskWithCaller(
+  manager: AgentChannelManager,
+  event: H3Event,
+  taskId: string,
+): Promise<WorkspaceTask> {
+  const token = bearerTokenOf(event)
+  const caller = token ? manager.findByToken(token) : undefined
+  if (caller) return manager.cancelTask(caller.channelId, caller.id, { taskId })
+  const task = internalsOf(manager).getTaskEngine().get(taskId)
+  if (!task) throw new AppError(404, 'NOT_FOUND', `任务不存在: ${taskId}`)
+  const agents = await manager.listChannelAgents(task.channelId)
+  const lead = agents.find(a => a.role === 'lead')
+  if (!lead) throw new AppError(400, 'NO_LEAD_AGENT', `channel ${task.channelId} 无 lead,无法以系统身份取消`)
+  return manager.cancelTask(lead.channelId, lead.id, { taskId })
+}
+
+// ===== SSE(tasks/sendSubscribe) =====
+
+/** 推送安全包装:客户端断开后 push 抛错 → 返回 false,调用方结束循环 */
+async function safePush(stream: ReturnType<typeof createEventStream>, message: { event?: string, data: string }): Promise<boolean> {
+  try {
+    await stream.push(message)
+    return true
+  }
+  catch {
+    return false
+  }
+}
+
+/** 流式输出 task/status-update/artifact-update/message 直到终态(50ms 轮询观测) */
+async function runSubscribe(
+  stream: ReturnType<typeof createEventStream>,
+  manager: AgentChannelManager,
+  agent: AgentInfo,
+  params: z.infer<typeof sendParamsSchema>,
+): Promise<void> {
+  try {
+    const task = await submitTask(manager, agent, params)
+    const engine = internalsOf(manager).getTaskEngine()
+    let lastState: TaskState | undefined
+    let lastArtifacts = 0
+    let lastHistory = 0
+    const deadline = Date.now() + 30_000
+    // 初始 Task 对象(规范 §9:task 事件)
+    if (!(await safePush(stream, { event: 'task', data: JSON.stringify(toA2ATask(task)) }))) return
+    for (;;) {
+      const current = engine.get(task.id)
+      if (!current) break
+      for (const artifact of current.artifacts.slice(lastArtifacts)) {
+        if (!(await safePush(stream, { event: 'artifact-update', data: JSON.stringify({ taskId: current.id, artifact }) }))) return
+      }
+      lastArtifacts = current.artifacts.length
+      for (const message of current.history.slice(lastHistory)) {
+        if (!(await safePush(stream, { event: 'message', data: JSON.stringify({ taskId: current.id, message }) }))) return
+      }
+      lastHistory = current.history.length
+      if (current.state !== lastState) {
+        lastState = current.state
+        if (!(await safePush(stream, { event: 'status-update', data: JSON.stringify({ taskId: current.id, status: { state: current.state, timestamp: current.updatedAt } }) }))) return
+      }
+      if (isTerminal(current.state)) {
+        // 终态:末尾补发最终 Task 对象
+        await safePush(stream, { event: 'task', data: JSON.stringify(toA2ATask(current)) })
+        break
+      }
+      if (Date.now() >= deadline) break
+      await sleep(50)
+    }
+  }
+  catch (error) {
+    const rpcError = error instanceof RpcMethodError ? error.error : { code: -32603, message: error instanceof Error ? error.message : String(error) }
+    await safePush(stream, { event: 'error', data: JSON.stringify(rpcError) })
+  }
+  finally {
+    try {
+      await stream.close()
+    }
+    catch {
+      // 连接已断开
+    }
+  }
+}
+
+// ===== 方法分发 =====
+
+async function dispatch(
+  event: H3Event,
+  manager: AgentChannelManager,
+  agentId: string,
+  id: unknown,
+  method: string,
+  params: unknown,
+): Promise<unknown> {
+  switch (method) {
+    case 'tasks/send': {
+      const p = parseParams(sendParamsSchema, params)
+      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
+      const task = await submitTask(manager, agent, p)
+      const final = await waitTerminal(manager, task.id)
+      return ok(id, toA2ATask(final))
+    }
+    case 'tasks/sendSubscribe': {
+      const p = parseParams(sendParamsSchema, params)
+      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
+      const stream = createEventStream(event)
+      void runSubscribe(stream, manager, agent, p)
+      // h3 EventStream 必须经 send() 激活(否则被当普通对象 JSON 序列化,SSE 从未生效)
+      return stream.send()
+    }
+    case 'tasks/get': {
+      const p = parseParams(taskIdParamsSchema, params)
+      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
+      const task = await manager.getTask(agent.channelId, agent.id, p.taskId)
+      return ok(id, toA2ATask(task))
+    }
+    case 'tasks/list': {
+      parseParams(noopParamsSchema, params)
+      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
+      const tasks = await manager.listTasks(agent.channelId, agent.id)
+      return ok(id, tasks.map(toA2ATask))
+    }
+    case 'tasks/cancel': {
+      const p = parseParams(taskIdParamsSchema, params)
+      if (!findAgent(manager, agentId)) fail(-32001, `Agent not found: ${agentId}`)
+      const canceled = await cancelTaskWithCaller(manager, event, p.taskId)
+      return ok(id, toA2ATask(canceled))
+    }
+    case 'message/send': {
+      const p = parseParams(sendMessageParamsSchema, params)
+      if (!findAgent(manager, agentId)) fail(-32001, `Agent not found: ${agentId}`)
+      const token = bearerTokenOf(event)
+      const caller = token ? manager.findByToken(token) : undefined
+      if (!caller) fail(-32005, 'Agent not authorized: message/send 需要有效 token 确定发送方')
+      const message = await manager.sendA2A(caller.channelId, caller.id, {
+        toAgentId: agentId,
+        parts: p.message.parts,
+        metadata: p.message.metadata,
+      })
+      return ok(id, message)
+    }
+    case 'agent/getCard': {
+      parseParams(noopParamsSchema, params)
+      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
+      return ok(id, buildAgentCard(agent))
+    }
+    default:
+      fail(-32601, `Method not found: ${method}`)
+  }
+}
+
+/** POST /api/workshop/a2a/:agentId.rpc —— JSON-RPC 2.0 请求入口 */
+export default defineEventHandler(async (event) => {
+  const agentId = getRouterParam(event, 'agentId')!
+  const manager = getWorkshopManager()
+
+  let raw: unknown
+  try {
+    raw = await readBody(event)
+  }
+  catch {
+    return err(null, { code: -32700, message: 'Parse error' })
+  }
+  if (typeof raw !== 'object' || raw === null) {
+    return err(null, { code: -32600, message: 'Invalid Request' })
+  }
+  const req = raw as { jsonrpc?: unknown, id?: unknown, method?: unknown, params?: unknown }
+  if (req.jsonrpc !== '2.0' || typeof req.method !== 'string') {
+    return err(req.id ?? null, { code: -32600, message: 'Invalid Request' })
+  }
+  const id = req.id ?? null
+  try {
+    return await dispatch(event, manager, agentId, id, req.method, req.params)
+  }
+  catch (error) {
+    if (error instanceof RpcMethodError) return err(id, error.error)
+    if (error instanceof AppError) return err(id, appErrorToRpc(error))
+    console.error('[workshop-a2a-rpc] 未处理异常:', error)
+    return err(id, { code: -32603, message: 'Internal error' })
+  }
+})

package/server/api/workshop/a2a/send.post.ts

@@ -0,0 +1,28 @@
+/**
+ * POST /api/workshop/a2a/send —— Agent 点对点发消息给同事(REST 作业面,与 MCP workshop.a2a.send 同语义)。
+ * - 需要 Bearer token(caller 由 token 决定,不接受请求体自报)
+ * - 跨 channel 目标 → 403 SCOPE_VIOLATION(manager 校验)
+ */
+import { z } from 'zod'
+import { readValidatedBody } from 'h3'
+import { zValidator } from '../../../utils/validate'
+import { defineApiHandler } from '../../../utils/response'
+import { getWorkshopManager } from '../../../plugins/workshop'
+import { resolveCaller } from '../caller'
+import type { Part } from '../../../services/workshop/types/a2a'
+
+const sendSchema = z.object({
+  toAgentId: z.string().min(1, 'toAgentId 必填'),
+  parts: z.array(z.unknown()).min(1, 'parts 至少 1 个') as z.ZodType<Part[]>,
+  metadata: z.record(z.string(), z.unknown()).optional(),
+})
+
+export default defineApiHandler(async (event) => {
+  const caller = resolveCaller(event)
+  const body = await readValidatedBody(event, zValidator(sendSchema))
+  return getWorkshopManager().sendA2A(caller.channelId, caller.id, {
+    toAgentId: body.toAgentId,
+    parts: body.parts,
+    metadata: body.metadata,
+  })
+})

package/server/api/workshop/agent-tools/approvals/[id]/decide.post.ts

@@ -0,0 +1,21 @@
+/**
+ * POST /api/workshop/agent-tools/approvals/:id/decide —— 批准/拒绝一次工具执行。
+ * body: { approved: boolean, comment?: string }(备注随 tool result 返回给 Agent)
+ */
+import { readBody, getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getToolApprovals } from '@/server/services/workshop/agents/tool-approvals'
+import { audit } from '@/server/services/workshop/ops/ops'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const id = getRouterParam(event, 'id')!
+  const body = await readBody<{ approved?: boolean, comment?: string }>(event) ?? {}
+  // S4:裁决人留痕(谁批准/拒绝了这次 HITL 下发)
+  const approved = body.approved !== false
+  const approval = getToolApprovals().decide(id, approved, String(body.comment ?? ''), user.id, user.name)
+  // R1:HITL 裁决审计(闭环中的人为决策留痕)
+  audit({ actor: user.id, actorName: user.name, actorKind: 'user', action: approved ? 'approval.approve' : 'approval.reject', targetKind: 'tool-approval', targetId: id, detail: { comment: String(body.comment ?? '') } })
+  return { approval }
+})

package/server/api/workshop/agent-tools/approvals/index.get.ts

@@ -0,0 +1,18 @@
+/**
+ * GET /api/workshop/agent-tools/approvals?agentId=&scope=pending|history
+ * —— 手动确认模式的执行审批列表(孪生侧栏审批面板轮询)。
+ */
+import { getQuery } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getToolApprovals } from '@/server/services/workshop/agents/tool-approvals'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const q = getQuery(event)
+  const agentId = typeof q.agentId === 'string' ? q.agentId : ''
+  const scope = q.scope === 'history' ? 'history' : 'pending'
+  return {
+    approvals: scope === 'history' ? getToolApprovals().historyList() : getToolApprovals().listPending(agentId),
+  }
+})

package/server/api/workshop/agent-tools/bindings/[id].delete.ts

@@ -0,0 +1,21 @@
+/**
+ * DELETE /api/workshop/agent-tools/bindings/:id —— 解除绑定。
+ */
+import { createError, getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getAgentNodeBindingRepo } from '@/server/services/workshop/agents/node-bindings.repo'
+import { getToolApprovals } from '@/server/services/workshop/agents/tool-approvals'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const id = getRouterParam(event, 'id')!
+  const repo = getAgentNodeBindingRepo()
+  const all = repo.all()
+  const binding = all.find(b => b.id === id)
+  if (!binding) throw createError({ statusCode: 404, statusMessage: 'binding not found' })
+  if (!repo.unbind(id)) throw createError({ statusCode: 404, statusMessage: 'binding not found' })
+  // 解绑即失效:该 Agent 对该节点的挂起审批按拒绝收敛(tool result 注明原因)
+  getToolApprovals().cancelPendingFor(binding.agentId, binding.nodeId)
+  return { ok: true }
+})

package/server/api/workshop/agent-tools/bindings/[id].patch.ts

@@ -0,0 +1,14 @@
+/**
+ * PATCH /api/workshop/agent-tools/bindings/:id —— 切换控制模式(auto/manual)。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getAgentNodeBindingRepo } from '@/server/services/workshop/agents/node-bindings.repo'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const id = getRouterParam(event, 'id')!
+  const body = await readBody<{ mode?: 'auto' | 'manual' }>(event) ?? {}
+  return { binding: getAgentNodeBindingRepo().setMode(id, body.mode ?? 'auto') }
+})

package/server/api/workshop/agent-tools/bindings/index.get.ts

@@ -0,0 +1,14 @@
+/**
+ * GET /api/workshop/agent-tools/bindings?agentId= —— Agent 工业节点绑定列表。
+ */
+import { getQuery } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getAgentNodeBindingRepo } from '@/server/services/workshop/agents/node-bindings.repo'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const q = getQuery(event)
+  const agentId = typeof q.agentId === 'string' ? q.agentId : ''
+  return { bindings: agentId ? getAgentNodeBindingRepo().byAgent(agentId) : getAgentNodeBindingRepo().all() }
+})

package/server/api/workshop/agent-tools/bindings/index.post.ts

@@ -0,0 +1,20 @@
+/**
+ * POST /api/workshop/agent-tools/bindings —— 绑定 Agent ↔ 工业节点。
+ * body: { agentId, nodeId, kind: 'dcw'|'daq', mode: 'auto'|'manual' }
+ */
+import { readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getAgentNodeBindingRepo } from '@/server/services/workshop/agents/node-bindings.repo'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const body = await readBody<{ agentId?: string, nodeId?: string, kind?: 'dcw' | 'daq', mode?: 'auto' | 'manual' }>(event) ?? {}
+  const binding = getAgentNodeBindingRepo().bind(
+    String(body.agentId ?? ''),
+    String(body.nodeId ?? ''),
+    body.kind ?? 'dcw',
+    body.mode ?? 'auto',
+  )
+  return { binding }
+})

package/server/api/workshop/agent-tools/invoke.post.ts

@@ -0,0 +1,34 @@
+/**
+ * POST /api/workshop/agent-tools/invoke —— 工具调用 HTTP 桥。
+ * 与 omp host tools(工业工具族)同一服务层:鉴权(节点绑定)→ 手动审批 → 安全联锁 → 物理语义结果。
+ * body: { agentId, tool, args }
+ */
+import { readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import {
+  toolDaqQuery,
+  toolDcwControl,
+  toolDcwJournal,
+  toolDcwJudge,
+  toolDcwRollback,
+  toolMyIndustrialNodes,
+} from '@/server/services/workshop/agents/industrial-tools'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const body = await readBody<{ agentId?: string, tool?: string, args?: Record<string, unknown> }>(event) ?? {}
+  const agentId = String(body.agentId ?? '')
+  const tool = String(body.tool ?? '')
+  const args = body.args ?? {}
+  if (!agentId) throw createError({ statusCode: 400, statusMessage: 'agentId required' })
+  let result: { text: string, isError?: boolean }
+  if (tool === 'my_industrial_nodes') result = await toolMyIndustrialNodes(agentId)
+  else if (tool === 'dcw_control') result = await toolDcwControl(agentId, args as { node_id?: string, value?: number, hypothesis?: string, task_id?: string })
+  else if (tool === 'daq_query') result = await toolDaqQuery(agentId, args as Parameters<typeof toolDaqQuery>[1])
+  else if (tool === 'dcw_judge') result = await toolDcwJudge(agentId, args as { record_id?: string, verdict?: string, reason?: string })
+  else if (tool === 'dcw_rollback') result = await toolDcwRollback(agentId, args as { record_id?: string, node_id?: string, to?: string })
+  else if (tool === 'dcw_journal') result = await toolDcwJournal(agentId, args as { node_id?: string, recipe_id?: string, limit?: number | string })
+  else throw createError({ statusCode: 400, statusMessage: `unknown tool: ${tool}` })
+  return { result }
+})

package/server/api/workshop/agents/[id].delete.ts

@@ -0,0 +1,20 @@
+/**
+ * DELETE /api/workshop/agents/:id —— 删除 Agent 定义(级联移除其全部成员关系与订阅)。
+ * 权限:属主或 admin;内置模板任何人不可删除(TEMPLATE_BUILTIN)。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '../caller'
+import { AppError } from '../../../utils/errors'
+import { defineApiHandler } from '../../../utils/response'
+import { getWorkshopManager } from '../../../plugins/workshop'
+
+export default defineApiHandler(async (event) => {
+  const agentId = getRouterParam(event, 'id')!
+  const manager = getWorkshopManager()
+  const agent = manager.getAgent(agentId)
+  if (!agent) throw new AppError(404, 'NOT_FOUND', `Agent 不存在: ${agentId}`)
+  const user = resolveUser(event)
+  manager.requireWritable(agent.ownerUserId, user, 'Agent 模板')
+  await manager.removeAgent(agentId)
+  return { ok: true }
+})

package/server/api/workshop/agents/[id].get.ts

@@ -0,0 +1,19 @@
+/**
+ * GET /api/workshop/agents/:id —— agent 详情(DB 行 + 运行时装配状态)。
+ * 可见性:属主 / public(含内置)/ admin;他人 private → 403。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '../caller'
+import { AppError } from '../../../utils/errors'
+import { defineApiHandler } from '../../../utils/response'
+import { getWorkshopManager } from '../../../plugins/workshop'
+
+export default defineApiHandler(async (event) => {
+  const agentId = getRouterParam(event, 'id')!
+  const manager = getWorkshopManager()
+  const agent = manager.getAgent(agentId)
+  if (!agent) throw new AppError(404, 'NOT_FOUND', `Agent 不存在: ${agentId}`)
+  const user = resolveUser(event)
+  manager.requireTemplateReadable(agent, user, 'Agent 模板')
+  return agent
+})