agentworkshop 0.6.1 → 0.7.1

package/server/services/workshop/agents/tool-approvals.ts

@@ -1,174 +1,175 @@
-/**
- * ToolApprovals —— 手动确认模式的工具执行审批服务(进程内)。
- *
- * manual 模式绑定的数控下发:工具调用 → request() 挂起等待 →
- * 孪生侧栏审批面板 批准/拒绝(可附备注)→ 挂起 Promise 落定,
- * 结果(含用户备注)回给 Agent 作为 tool result。超时自动按拒绝收敛。
- */
-
-import { randomUUID } from 'node:crypto'
-import { getOps } from '../ops/ops'
-
-export interface ToolApproval {
-  id: string
-  agentId: string
-  nodeId: string
-  kind: 'dcw' | 'daq'
-  /** 人读摘要(节点名/物理量/目标值/窗口) */
-  detail: string
-  createdAt: string
-  /** 到期时刻(createdAt + 超时窗);UI 据此显示自动拒绝倒计时 */
-  expiresAt: string
-  status: 'pending' | 'approved' | 'denied' | 'expired'
-  comment: string
-  decidedAt: string | null
-  /** S4:裁决人留痕(空 = 超时/系统收敛) */
-  decidedBy: string
-  decidedName: string
-}
-
-/** 审批超时窗(超时默认拒绝,指令不执行);可用环境变量 HITL_TIMEOUT_MS 调整(测试/产线策略) */
-const TIMEOUT_MS = Number(process.env.HITL_TIMEOUT_MS) > 0 ? Number(process.env.HITL_TIMEOUT_MS) : 180_000
-const HISTORY_CAP = 50
-
-class ToolApprovalService {
-  private pending = new Map<string, {
-    approval: ToolApproval
-    resolve: (r: { approved: boolean, comment: string, id: string }) => void
-    timer: NodeJS.Timeout
-  }>()
-
-  private history: ToolApproval[] = []
-
-  /** 挂起一次执行审批(工具侧 await;批准/拒绝/超时三向落定) */
-  request(agentId: string, nodeId: string, kind: 'dcw' | 'daq', detail: string): Promise<{ approved: boolean, comment: string, id: string }> {
-    const approval: ToolApproval = {
-      id: `ap-${randomUUID().slice(0, 8)}`,
-      agentId,
-      nodeId,
-      kind,
-      detail,
-      createdAt: new Date().toISOString(),
-      expiresAt: new Date(Date.now() + TIMEOUT_MS).toISOString(),
-      status: 'pending',
-      comment: '',
-      decidedAt: null,
-      decidedBy: '',
-      decidedName: '',
-    }
-    return new Promise((resolve) => {
-      const timer = setTimeout(() => {
-        if (!this.pending.has(approval.id)) return
-        this.pending.delete(approval.id)
-        approval.status = 'expired'
-        approval.decidedAt = new Date().toISOString()
-        approval.comment = '审批超时未处理,默认拒绝,指令未执行'
-        this.remember(approval)
-        resolve({ approved: false, comment: approval.comment, id: approval.id })
-      }, TIMEOUT_MS)
-      timer.unref?.()
-      this.pending.set(approval.id, { approval, resolve, timer })
-    })
-  }
-
-  decide(id: string, approved: boolean, comment: string, decidedBy = '', decidedName = ''): ToolApproval {
-    const entry = this.pending.get(id)
-    if (!entry) throw new Error(`审批不存在或已处理: ${id}`)
-    clearTimeout(entry.timer)
-    this.pending.delete(id)
-    entry.approval.status = approved ? 'approved' : 'denied'
-    entry.approval.comment = String(comment ?? '').trim()
-    entry.approval.decidedAt = new Date().toISOString()
-    entry.approval.decidedBy = decidedBy
-    entry.approval.decidedName = decidedName
-    this.remember(entry.approval)
-    entry.resolve({ approved, comment: entry.approval.comment, id })
-    return entry.approval
-  }
-
-  /** 审批面板拉取(指定 Agent 的待处理;agentId 空 = 全部) */
-  listPending(agentId = ''): ToolApproval[] {
-    return [...this.pending.values()]
-      .map(e => e.approval)
-      .filter(a => !agentId || a.agentId === agentId)
-  }
-
-  /** 解绑/换线时取消挂起审批:该 Agent 对某节点的全部 pending 按拒绝收敛(备注说明原因) */
-  cancelPendingFor(agentId: string, nodeId: string): number {
-    let n = 0
-    for (const [id, entry] of [...this.pending.entries()]) {
-      if (entry.approval.agentId !== agentId || entry.approval.nodeId !== nodeId) continue
-      clearTimeout(entry.timer)
-      this.pending.delete(id)
-      entry.approval.status = 'denied'
-      entry.approval.comment = '绑定已解除,审批失效'
-      entry.approval.decidedAt = new Date().toISOString()
-      this.remember(entry.approval)
-      entry.resolve({ approved: false, comment: entry.approval.comment, id })
-      n++
-    }
-    return n
-  }
-
-  /** 同一 Agent 同一节点的挂起审批去重:已有 pending 时拒绝新挂起(防审批面板堆积) */
-  hasPendingFor(agentId: string, nodeId: string): boolean {
-    for (const entry of this.pending.values()) {
-      if (entry.approval.agentId === agentId && entry.approval.nodeId === nodeId) return true
-    }
-    return false
-  }
-
-  historyList(): ToolApproval[] {
-    // S4:优先读持久化表(重启后仍可查);未接线(测试/降级)回退内存窗口
-    const repo = getOps()?.approvalHistory
-    if (repo) {
-      return repo.list(HISTORY_CAP * 4).map(r => ({
-        id: r.id,
-        agentId: r.agentId,
-        nodeId: r.nodeId,
-        kind: r.kind as ToolApproval['kind'],
-        detail: r.detail,
-        status: r.status as ToolApproval['status'],
-        comment: r.comment,
-        decidedAt: r.decidedAt,
-        decidedBy: r.decidedBy,
-        decidedName: r.decidedName,
-        createdAt: r.createdAt,
-        // 持久化表未存到期时刻:按超时窗从 createdAt 派生(仅展示用)
-        expiresAt: new Date(Date.parse(r.createdAt) + TIMEOUT_MS).toISOString(),
-      }))
-    }
-    return this.history
-  }
-
-  private remember(a: ToolApproval): void {
-    this.history.unshift(a)
-    if (this.history.length > HISTORY_CAP) this.history.splice(HISTORY_CAP)
-    // S4:同步持久化(失败不影响审批主流程——工具侧已拿到裁决结果)
-    try {
-      getOps()?.approvalHistory.upsert({
-        id: a.id,
-        agentId: a.agentId,
-        nodeId: a.nodeId,
-        kind: a.kind,
-        detail: a.detail,
-        status: a.status,
-        comment: a.comment,
-        decidedBy: a.decidedBy,
-        decidedName: a.decidedName,
-        createdAt: a.createdAt,
-        decidedAt: a.decidedAt,
-      })
-    }
-    catch {
-      // 持久化失败降级为仅内存历史
-    }
-  }
-}
-
-const g = globalThis as typeof globalThis & { __toolApprovals?: ToolApprovalService }
-
-export function getToolApprovals(): ToolApprovalService {
-  g.__toolApprovals ??= new ToolApprovalService()
-  return g.__toolApprovals
-}
+/**
+ * ToolApprovals —— 手动确认模式的工具执行审批服务(进程内)。
+ *
+ * manual 模式绑定的数控下发:工具调用 → request() 挂起等待 →
+ * 孪生侧栏审批面板 批准/拒绝(可附备注)→ 挂起 Promise 落定,
+ * 结果(含用户备注)回给 Agent 作为 tool result。超时自动按拒绝收敛。
+ */
+
+import { randomUUID } from 'node:crypto'
+import { getOps } from '../ops/ops'
+import { securityHitlTimeoutMs } from '../settings'
+
+export interface ToolApproval {
+  id: string
+  agentId: string
+  nodeId: string
+  kind: 'dcw' | 'daq'
+  /** 人读摘要(节点名/物理量/目标值/窗口) */
+  detail: string
+  createdAt: string
+  /** 到期时刻(createdAt + 超时窗);UI 据此显示自动拒绝倒计时 */
+  expiresAt: string
+  status: 'pending' | 'approved' | 'denied' | 'expired'
+  comment: string
+  decidedAt: string | null
+  /** S4:裁决人留痕(空 = 超时/系统收敛) */
+  decidedBy: string
+  decidedName: string
+}
+
+/** 审批超时窗(超时默认拒绝,指令不执行);security.hitl_timeout_ms(env HITL_TIMEOUT_MS 兼容) */
+const TIMEOUT_MS = (): number => securityHitlTimeoutMs()
+const HISTORY_CAP = 50
+
+class ToolApprovalService {
+  private pending = new Map<string, {
+    approval: ToolApproval
+    resolve: (r: { approved: boolean, comment: string, id: string }) => void
+    timer: NodeJS.Timeout
+  }>()
+
+  private history: ToolApproval[] = []
+
+  /** 挂起一次执行审批(工具侧 await;批准/拒绝/超时三向落定) */
+  request(agentId: string, nodeId: string, kind: 'dcw' | 'daq', detail: string): Promise<{ approved: boolean, comment: string, id: string }> {
+    const approval: ToolApproval = {
+      id: `ap-${randomUUID().slice(0, 8)}`,
+      agentId,
+      nodeId,
+      kind,
+      detail,
+      createdAt: new Date().toISOString(),
+      expiresAt: new Date(Date.now() + TIMEOUT_MS()).toISOString(),
+      status: 'pending',
+      comment: '',
+      decidedAt: null,
+      decidedBy: '',
+      decidedName: '',
+    }
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        if (!this.pending.has(approval.id)) return
+        this.pending.delete(approval.id)
+        approval.status = 'expired'
+        approval.decidedAt = new Date().toISOString()
+        approval.comment = '审批超时未处理,默认拒绝,指令未执行'
+        this.remember(approval)
+        resolve({ approved: false, comment: approval.comment, id: approval.id })
+      }, TIMEOUT_MS())
+      timer.unref?.()
+      this.pending.set(approval.id, { approval, resolve, timer })
+    })
+  }
+
+  decide(id: string, approved: boolean, comment: string, decidedBy = '', decidedName = ''): ToolApproval {
+    const entry = this.pending.get(id)
+    if (!entry) throw new Error(`审批不存在或已处理: ${id}`)
+    clearTimeout(entry.timer)
+    this.pending.delete(id)
+    entry.approval.status = approved ? 'approved' : 'denied'
+    entry.approval.comment = String(comment ?? '').trim()
+    entry.approval.decidedAt = new Date().toISOString()
+    entry.approval.decidedBy = decidedBy
+    entry.approval.decidedName = decidedName
+    this.remember(entry.approval)
+    entry.resolve({ approved, comment: entry.approval.comment, id })
+    return entry.approval
+  }
+
+  /** 审批面板拉取(指定 Agent 的待处理;agentId 空 = 全部) */
+  listPending(agentId = ''): ToolApproval[] {
+    return [...this.pending.values()]
+      .map(e => e.approval)
+      .filter(a => !agentId || a.agentId === agentId)
+  }
+
+  /** 解绑/换线时取消挂起审批:该 Agent 对某节点的全部 pending 按拒绝收敛(备注说明原因) */
+  cancelPendingFor(agentId: string, nodeId: string): number {
+    let n = 0
+    for (const [id, entry] of [...this.pending.entries()]) {
+      if (entry.approval.agentId !== agentId || entry.approval.nodeId !== nodeId) continue
+      clearTimeout(entry.timer)
+      this.pending.delete(id)
+      entry.approval.status = 'denied'
+      entry.approval.comment = '绑定已解除,审批失效'
+      entry.approval.decidedAt = new Date().toISOString()
+      this.remember(entry.approval)
+      entry.resolve({ approved: false, comment: entry.approval.comment, id })
+      n++
+    }
+    return n
+  }
+
+  /** 同一 Agent 同一节点的挂起审批去重:已有 pending 时拒绝新挂起(防审批面板堆积) */
+  hasPendingFor(agentId: string, nodeId: string): boolean {
+    for (const entry of this.pending.values()) {
+      if (entry.approval.agentId === agentId && entry.approval.nodeId === nodeId) return true
+    }
+    return false
+  }
+
+  historyList(): ToolApproval[] {
+    // S4:优先读持久化表(重启后仍可查);未接线(测试/降级)回退内存窗口
+    const repo = getOps()?.approvalHistory
+    if (repo) {
+      return repo.list(HISTORY_CAP * 4).map(r => ({
+        id: r.id,
+        agentId: r.agentId,
+        nodeId: r.nodeId,
+        kind: r.kind as ToolApproval['kind'],
+        detail: r.detail,
+        status: r.status as ToolApproval['status'],
+        comment: r.comment,
+        decidedAt: r.decidedAt,
+        decidedBy: r.decidedBy,
+        decidedName: r.decidedName,
+        createdAt: r.createdAt,
+        // 持久化表未存到期时刻:按超时窗从 createdAt 派生(仅展示用)
+        expiresAt: new Date(Date.parse(r.createdAt) + TIMEOUT_MS()).toISOString(),
+      }))
+    }
+    return this.history
+  }
+
+  private remember(a: ToolApproval): void {
+    this.history.unshift(a)
+    if (this.history.length > HISTORY_CAP) this.history.splice(HISTORY_CAP)
+    // S4:同步持久化(失败不影响审批主流程——工具侧已拿到裁决结果)
+    try {
+      getOps()?.approvalHistory.upsert({
+        id: a.id,
+        agentId: a.agentId,
+        nodeId: a.nodeId,
+        kind: a.kind,
+        detail: a.detail,
+        status: a.status,
+        comment: a.comment,
+        decidedBy: a.decidedBy,
+        decidedName: a.decidedName,
+        createdAt: a.createdAt,
+        decidedAt: a.decidedAt,
+      })
+    }
+    catch {
+      // 持久化失败降级为仅内存历史
+    }
+  }
+}
+
+const g = globalThis as typeof globalThis & { __toolApprovals?: ToolApprovalService }
+
+export function getToolApprovals(): ToolApprovalService {
+  g.__toolApprovals ??= new ToolApprovalService()
+  return g.__toolApprovals
+}

package/server/services/workshop/daq/alarm-notify.ts

@@ -1,100 +1,102 @@
-/**
- * AlarmNotifier —— 报警外送 + 升级扫描(S5,production-readiness-plan)。
- *
- * - notifyAlarm():webhook 外送(env ALARM_WEBHOOK_URL;POST JSON,天然兼容
- *   钉钉/企微/飞书机器人),失败重试 3 次退避;fire-and-forget,绝不阻塞采集主链路;
- * - startAlarmEscalator():60s 扫描未确认且超 ALARM_ESCALATE_MINUTES(默认 15)的
- *   报警 → escalation+1 并重发外送(升级通知);globalThis 守卫防 HMR 重复。
- */
-import { randomUUID } from 'node:crypto'
-import { getOps } from '../ops/ops'
-
-const RETRIES = 3
-const ESCALATE_SWEEP_MS = 60_000
-
-const g = globalThis as typeof globalThis & { __awAlarmEscalator?: NodeJS.Timeout }
-
-export interface AlarmNotifyPayload {
-  id: string
-  nodeId: string
-  nodeName: string
-  metric: string
-  value: number | null
-  rule: string
-  threshold: number | null
-  escalation: number
-  createdAt: string
-}
-
-/** webhook 外送(单次;成功返回 true) */
-async function postWebhook(payload: AlarmNotifyPayload, url: string): Promise<boolean> {
-  try {
-    const res = await fetch(url, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ kind: 'alarm', text: `[报警] ${payload.nodeName} ${payload.metric} ${payload.rule} 阈值 ${payload.threshold ?? '-'} 当前 ${payload.value ?? '-'}(升级 x${payload.escalation})`, ...payload }),
-      signal: AbortSignal.timeout(5000),
-    })
-    return res.ok
-  }
-  catch {
-    return false
-  }
-}
-
-/** 外送 + 重试退避(1s/2s/4s);结果记录进 alarm_events.notified_json */
-export function notifyAlarm(payload: AlarmNotifyPayload): void {
-  const url = process.env.ALARM_WEBHOOK_URL
-  if (!url) return // 未配置外送 = 仅 WS/面板可见(合法降级)
-  const repo = getOps()?.alarmEvents
-  void (async () => {
-    let ok = false
-    for (let attempt = 1; attempt <= RETRIES && !ok; attempt++) {
-      ok = await postWebhook(payload, url)
-      if (!ok && attempt < RETRIES) await new Promise(r => setTimeout(r, 2 ** (attempt - 1) * 1000))
-    }
-    if (!repo) return
-    try {
-      const row = repo.list(500).find(a => a.id === payload.id)
-      if (!row) return
-      const log = JSON.parse(row.notifiedJson || '[]') as Array<{ url: string, ok: boolean, at: string, attempt: number }>
-      log.push({ url, ok, at: new Date().toISOString(), attempt: RETRIES })
-      repo.recordNotify(payload.id, JSON.stringify(log.slice(-10)))
-    }
-    catch {
-      // 外送记录失败不影响业务
-    }
-  })()
-}
-
-/** 升级扫描器(懒启动;进程内单例) */
-export function startAlarmEscalator(): void {
-  if (g.__awAlarmEscalator) return
-  const escalateMin = Math.max(1, Number(process.env.ALARM_ESCALATE_MINUTES) || 15)
-  const timer = setInterval(() => {
-    const repo = getOps()?.alarmEvents
-    if (!repo) return
-    try {
-      const cutoff = Date.now() - escalateMin * 60_000
-      for (const a of repo.listOpen(200)) {
-        if (Date.parse(a.createdAt) > cutoff) continue
-        repo.escalate(a.id)
-        notifyAlarm({
-          id: a.id, nodeId: a.nodeId, nodeName: a.nodeName, metric: a.metric,
-          value: a.value, rule: a.rule, threshold: a.threshold,
-          escalation: a.escalation + 1, createdAt: a.createdAt,
-        })
-      }
-    }
-    catch {
-      // 升级扫描失败不致命(下一轮再扫)
-    }
-  }, ESCALATE_SWEEP_MS)
-  timer.unref?.()
-  g.__awAlarmEscalator = timer
-}
-
-/** 生成报警事件 id(raise 侧用) */
-export function newAlarmId(): string {
-  return `al-${randomUUID().slice(0, 8)}`
-}
+/**
+ * AlarmNotifier —— 报警外送 + 升级扫描(S5,production-readiness-plan)。
+ *
+ * - notifyAlarm():webhook 外送(env ALARM_WEBHOOK_URL;POST JSON,天然兼容
+ *   钉钉/企微/飞书机器人),失败重试 3 次退避;fire-and-forget,绝不阻塞采集主链路;
+ * - startAlarmEscalator():60s 扫描未确认且超 ALARM_ESCALATE_MINUTES(默认 15)的
+ *   报警 → escalation+1 并重发外送(升级通知);globalThis 守卫防 HMR 重复。
+ */
+import { randomUUID } from 'node:crypto'
+import { getOps } from '../ops/ops'
+import { daqRuntimeSettings } from '../settings'
+
+const RETRIES = 3
+const ESCALATE_SWEEP_MS = 60_000
+
+const g = globalThis as typeof globalThis & { __awAlarmEscalator?: NodeJS.Timeout }
+
+export interface AlarmNotifyPayload {
+  id: string
+  nodeId: string
+  nodeName: string
+  metric: string
+  value: number | null
+  rule: string
+  threshold: number | null
+  escalation: number
+  createdAt: string
+}
+
+/** webhook 外送(单次;成功返回 true) */
+async function postWebhook(payload: AlarmNotifyPayload, url: string): Promise<boolean> {
+  try {
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ kind: 'alarm', text: `[报警] ${payload.nodeName} ${payload.metric} ${payload.rule} 阈值 ${payload.threshold ?? '-'} 当前 ${payload.value ?? '-'}(升级 x${payload.escalation})`, ...payload }),
+      signal: AbortSignal.timeout(5000),
+    })
+    return res.ok
+  }
+  catch {
+    return false
+  }
+}
+
+/** 外送 + 重试退避(1s/2s/4s);结果记录进 alarm_events.notified_json */
+export function notifyAlarm(payload: AlarmNotifyPayload): void {
+  // daq.alarmWebhookUrl(env ALARM_WEBHOOK_URL 兼容别名);未配置 = 仅 WS/面板可见(合法降级)
+  const url = daqRuntimeSettings().alarmWebhookUrl || undefined
+  if (!url) return
+  const repo = getOps()?.alarmEvents
+  void (async () => {
+    let ok = false
+    for (let attempt = 1; attempt <= RETRIES && !ok; attempt++) {
+      ok = await postWebhook(payload, url)
+      if (!ok && attempt < RETRIES) await new Promise(r => setTimeout(r, 2 ** (attempt - 1) * 1000))
+    }
+    if (!repo) return
+    try {
+      const row = repo.list(500).find(a => a.id === payload.id)
+      if (!row) return
+      const log = JSON.parse(row.notifiedJson || '[]') as Array<{ url: string, ok: boolean, at: string, attempt: number }>
+      log.push({ url, ok, at: new Date().toISOString(), attempt: RETRIES })
+      repo.recordNotify(payload.id, JSON.stringify(log.slice(-10)))
+    }
+    catch {
+      // 外送记录失败不影响业务
+    }
+  })()
+}
+
+/** 升级扫描器(懒启动;进程内单例) */
+export function startAlarmEscalator(): void {
+  if (g.__awAlarmEscalator) return
+  const escalateMin = Math.max(1, daqRuntimeSettings().alarmEscalateMinutes)
+  const timer = setInterval(() => {
+    const repo = getOps()?.alarmEvents
+    if (!repo) return
+    try {
+      const cutoff = Date.now() - escalateMin * 60_000
+      for (const a of repo.listOpen(200)) {
+        if (Date.parse(a.createdAt) > cutoff) continue
+        repo.escalate(a.id)
+        notifyAlarm({
+          id: a.id, nodeId: a.nodeId, nodeName: a.nodeName, metric: a.metric,
+          value: a.value, rule: a.rule, threshold: a.threshold,
+          escalation: a.escalation + 1, createdAt: a.createdAt,
+        })
+      }
+    }
+    catch {
+      // 升级扫描失败不致命(下一轮再扫)
+    }
+  }, ESCALATE_SWEEP_MS)
+  timer.unref?.()
+  g.__awAlarmEscalator = timer
+}
+
+/** 生成报警事件 id(raise 侧用) */
+export function newAlarmId(): string {
+  return `al-${randomUUID().slice(0, 8)}`
+}

package/server/services/workshop/daq/bus/mqtt.adapter.ts

@@ -6,10 +6,11 @@
  * - 消费者:通配订阅 aw/daq/+/sample,JSON 解析回 envelope;
  * - 重连由 mqtt.js 客户端内建;发布在断连期间的样本按丢弃计数(仪表可见)。
  */
-import { createLogger } from '../../logger'
+import { createLogger } from '../../logger'
 import { createRequire } from 'node:module'
-import type { MqttClient } from 'mqtt'
-
+import type { MqttClient } from 'mqtt'
+import { daqRuntimeSettings } from '../../settings'
+
 import type { DaqConsumer, DaqQueuePort, DaqSampleEnvelope } from './queue-port'
 
 const log = createLogger('daq.mqtt')
@@ -45,24 +46,22 @@ export class MqttQueueAdapter implements DaqQueuePort {
     if (this.client) return
     // mqtt 包动态导入:未安装时不影响其余链路(工厂已兜底 inproc)
     const mod = requireMqtt('mqtt') as unknown as { connect: (url: string, opts?: Record<string, unknown>) => MqttClient }
-    const qos = Number(process.env.DAQ_MQTT_QOS ?? 0)
-    // S1:凭据(env 优先)与 TLS(mqtts:// + 自签 CA;rejectUnauthorized 默认 true)
-    const username = process.env.DAQ_MQTT_USERNAME
-    const password = process.env.DAQ_MQTT_PASSWORD
-    const caFile = process.env.DAQ_MQTT_CA_FILE
+    // 凭据/QoS/TLS 配置驱动(daq.mqtt.*;legacy DAQ_MQTT_* env 别名兼容,DAQ_MQTT_URL 整串覆盖仍最高优先)
+    const mqttCfg = daqRuntimeSettings().mqtt
+    const qos = mqttCfg.qos
     const opts: Record<string, unknown> = {
       clientId: `aw-daq-${process.pid}-${Math.random().toString(36).slice(2, 6)}`,
       reconnectPeriod: 2000,
       keepalive: 20,
     }
-    if (username) opts.username = username
-    if (password) opts.password = password
-    if (caFile) {
+    if (mqttCfg.username) opts.username = mqttCfg.username
+    if (mqttCfg.password) opts.password = mqttCfg.password
+    if (mqttCfg.caFile) {
       const fs = requireMqtt('node:fs') as typeof import('node:fs')
-      opts.ca = [fs.readFileSync(caFile)]
+      opts.ca = [fs.readFileSync(mqttCfg.caFile)]
     }
-    if (process.env.DAQ_MQTT_REJECT_UNAUTHORIZED === '0') opts.rejectUnauthorized = false
-    if (this.url.startsWith('mqtts://') && !username && process.env.NODE_ENV === 'production') {
+    if (!mqttCfg.rejectUnauthorized) opts.rejectUnauthorized = false
+    if (this.url.startsWith('mqtts://') && !mqttCfg.username && process.env.NODE_ENV === 'production') {
       log.warn('[daq-mqtt] WARN:生产环境 MQTT 连接未配置凭据(mqtts 仅加密传输,建议同时启用 username/password)')
     }
     this.client = mod.connect(this.url, opts)
@@ -100,7 +99,7 @@ export class MqttQueueAdapter implements DaqQueuePort {
       return
     }
     this.published++
-    this.client.publish(TOPIC_SAMPLE(env.nodeId), JSON.stringify(env), { qos: Number(process.env.DAQ_MQTT_QOS ?? 0) })
+    this.client.publish(TOPIC_SAMPLE(env.nodeId), JSON.stringify(env), { qos: daqRuntimeSettings().mqtt.qos })
   }
 
   consume(fn: DaqConsumer): () => void {