agentworkshop 0.7.23 → 0.7.27

package/server/api/plugins/[name]/[...path].ts

@@ -1,31 +1,46 @@
-/**
- * /api/plugins/:name/** —— 插件自注册 API 的转发层(exact-match)。
- * 插件经 ctx.route(method, path, handler) 注册;handler(event) 返回值由 nitro 序列化。
- * 鉴权由插件自行处理(v1 不强制;可经 resolveUser 复用业务鉴权)。
- * 错误隔离:插件 handler 抛错 → 结构化日志(带插件归属)+ 干净 500 信封,不裸传堆栈。
- */
-import { defineEventHandler, createError, readBody } from 'h3'
-import { getPluginHost } from '@/server/services/workshop/plugins/host.mjs'
-
-export default defineEventHandler(async (event) => {
-  const host = getPluginHost()
-  if (!host) throw createError({ statusCode: 503, statusMessage: 'plugin host not ready' })
-  const name = String(event.context.params?.name ?? '')
-  const path = '/' + (event.context.params?.path ?? '').replace(/^\/+/, '')
-  const handler = host.routes.resolve(name, event.method, path)
-  if (!handler) {
-    throw createError({ statusCode: 404, statusMessage: `plugin route not found: ${event.method} /api/plugins/${name}${path}` })
-  }
-  // 预读 body 挂到 event(插件 handler 无 h3 导入能力,经 event.awBody 消费)
-  const awBody = await readBody(event).catch(() => undefined)
-  ;(event as Record<string, unknown>).awBody = awBody
-  try {
-    return await handler(event)
-  }
-  catch (err) {
-    // 问题日志:插件归属 + 路由 + 原始原因(运维按 name 即可定位到具体插件目录)
-    const reason = err instanceof Error ? err.message : String(err)
-    host.logger?.error?.(`插件路由处理失败 [${name}] ${event.method} /api/plugins/${name}${path}: ${reason}`)
-    throw createError({ statusCode: 500, statusMessage: `插件路由处理失败(${name}): ${reason}` })
-  }
-})
+/**
+ * /api/plugins/:name/** —— 插件自注册 API 的转发层(exact-match)。
+ * 插件经 ctx.route(method, path, handler) 注册;handler(event) 返回值由 nitro 序列化。
+ * 鉴权:插件在入口声明 auth:'user' | 'admin' | 'agent-or-user' 时由转发层统一校验
+ *   (缺省 'none' 保持开放,兼容既有插件/浏览器面板)。
+ * 错误隔离:插件 handler 抛错 → 结构化日志(带插件归属)+ 干净 500 信封,不裸传堆栈。
+ */
+import { defineEventHandler, createError, readBody } from 'h3'
+import { getPluginHost } from '@/server/services/workshop/plugins/host.mjs'
+import { resolveUser, resolveAgentOrUser, requireAdmin } from '../../workshop/caller'
+
+export default defineEventHandler(async (event) => {
+  const host = getPluginHost()
+  if (!host) throw createError({ statusCode: 503, statusMessage: 'plugin host not ready' })
+  const name = String(event.context.params?.name ?? '')
+  const path = '/' + (event.context.params?.path ?? '').replace(/^\/+/, '')
+  const rec = host.plugins.get(name)
+  // 声明式鉴权门:在进入插件 handler 前统一校验(禁用插件的路由表已不含其路由,天然 404)
+  const authMode = String(rec?.auth ?? 'none')
+  if (authMode !== 'none') {
+    try {
+      if (authMode === 'admin') await requireAdmin(event)
+      else if (authMode === 'agent-or-user') await resolveAgentOrUser(event)
+      else await resolveUser(event)
+    }
+    catch {
+      throw createError({ statusCode: 401, statusMessage: '需要有效的用户 token(Authorization: Bearer <用户token>)' })
+    }
+  }
+  const handler = host.routes.resolve(name, event.method, path)
+  if (!handler) {
+    throw createError({ statusCode: 404, statusMessage: `plugin route not found: ${event.method} /api/plugins/${name}${path}` })
+  }
+  // 预读 body 挂到 event(插件 handler 无 h3 导入能力,经 event.awBody 消费)
+  const awBody = await readBody(event).catch(() => undefined)
+  ;(event as unknown as Record<string, unknown>).awBody = awBody
+  try {
+    return await handler(event)
+  }
+  catch (err) {
+    // 问题日志:插件归属 + 路由 + 原始原因(运维按 name 即可定位到具体插件目录)
+    const reason = err instanceof Error ? err.message : String(err)
+    host.logger?.error?.(`插件路由处理失败 [${name}] ${event.method} /api/plugins/${name}${path}: ${reason}`)
+    throw createError({ statusCode: 500, statusMessage: `插件路由处理失败(${name}): ${reason}` })
+  }
+})

package/server/api/workshop/channels/[id]/plugins/index.get.ts

@@ -0,0 +1,35 @@
+/**
+ * GET /api/workshop/channels/:id/plugins —— 该团队的插件开关视图。
+ * 返回全部已注册插件的团队级 enabled(显式配置/默认全启用)+ source 标记。
+ * 鉴权:channel 归属者(遗留公共 channel 需 admin)。
+ */
+import { resolveUser, requireAdmin, isAdmin } from '../../../../workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { getChannelPluginsRepo } from '@/server/services/workshop/db/channel-plugins.repo'
+import { getPluginHost, pluginManifest } from '@/server/services/workshop/plugins/host.mjs'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const id = String(event.context.params?.id ?? '')
+  const manager = getWorkshopManager()
+  // 归属校验:遗留公共(owner null)仅 admin;否则本人(getChannelForUser 同语义)
+  const channel = manager.getChannelForUser(id, user.id)
+  if (!channel && channel !== null) throw new AppError(404, ErrorCodes.NOT_FOUND, `channel 不存在: ${id}`)
+  if (channel?.ownerUserId === null) requireAdmin(event)
+
+  const host = getPluginHost()
+  const manifest = host ? pluginManifest().filter(p => p.enabled) : []
+  const explicit = getChannelPluginsRepo().explicitFor(id)
+  return {
+    plugins: manifest.map(p => ({
+      name: p.name,
+      description: p.description,
+      builtin: p.builtin,
+      enabled: explicit ? explicit.get(p.name) !== false : true,
+    })),
+    source: explicit ? 'explicit' : 'default',
+    isAdmin: isAdmin(user),
+  }
+})

package/server/api/workshop/channels/[id]/plugins/index.put.ts

@@ -0,0 +1,39 @@
+/**
+ * PUT /api/workshop/channels/:id/plugins —— 写入该团队的插件开关(团队级独立控制)。
+ * body: { plugins: [{ name, enabled }] }(未知插件名忽略;全量替换语义)
+ * 生效:切换即写入 channel_plugins;该团队在跑 Agent 经工具热通知刷新清单(关闭的
+ * 插件工具从清单消失,dispatch 同源拒绝),防不需要插件的 channel 上下文被污染。
+ * 鉴权:channel 归属者(遗留公共 channel 需 admin)。
+ */
+import { readBody } from 'h3'
+import { resolveUser, requireAdmin } from '../../../../workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { getChannelPluginsRepo, type ChannelPluginToggle } from '@/server/services/workshop/db/channel-plugins.repo'
+import { getPluginHost, pluginManifest } from '@/server/services/workshop/plugins/host.mjs'
+import { notifyToolChange } from '@/server/services/workshop/agents/plugin-tools'
+import { AppError } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const id = String(event.context.params?.id ?? '')
+  const manager = getWorkshopManager()
+  const channel = manager.getChannelForUser(id, user.id)
+  if (channel?.ownerUserId === null) requireAdmin(event)
+
+  const body = (await readBody<{ plugins?: Array<{ name?: string, enabled?: boolean }> }>(event)) ?? {}
+  const entries = Array.isArray(body?.plugins) ? body.plugins : null
+  if (!entries) throw new AppError(400, 'VALIDATION_ERROR', 'body 应为 { plugins: [{ name, enabled }] }')
+
+  // 只接受已注册且启用的插件名(停用插件无工具可注入,写入无意义)
+  const host = getPluginHost()
+  const registered = new Set(host ? pluginManifest().filter(p => p.enabled).map(p => p.name) : [])
+  const clean: ChannelPluginToggle[] = entries
+    .filter((e): e is { name: string, enabled?: boolean } => Boolean(e) && typeof e.name === 'string' && registered.has(e.name as string))
+    .map(e => ({ name: e.name as string, enabled: e.enabled !== false }))
+
+  getChannelPluginsRepo().setMany(id, clean)
+  // 热通知:该团队(全部团队,轻量)在跑 agent 重发工具清单,关闭插件的工具即消失
+  notifyToolChange()
+  return { saved: clean.length, plugins: clean }
+})

package/server/api/workshop/channels.post.ts

@@ -17,6 +17,13 @@ const createChannelSchema = z.object({
   scenarioPrompt: z.string().optional(),
   /** channel 独立工作目录(omp 子进程 cwd);缺省 data/workspaces/<channelId> */
   workspace: z.string().optional(),
+  /** 团队级插件开关(创建时即写入;未选中的插件其工具不注入该团队 Agent) */
+  plugins: z
+    .array(z.object({
+      name: z.string().min(1),
+      enabled: z.boolean(),
+    }))
+    .optional(),
   leadAgent: z
     .object({
       name: z.string().min(1, 'leadAgent.name 必填'),
@@ -38,6 +45,16 @@ export default defineApiHandler(async (event) => {
     leadAgent: body.leadAgent,
     ownerUserId: user.id,
   })
+  // 团队级插件开关:创建时即写入(未选中的插件其工具不注入该团队 Agent)
+  if (Array.isArray(body.plugins) && body.plugins.length) {
+    const { getPluginHost, pluginManifest } = await import('@/server/services/workshop/plugins/host.mjs')
+    const registered = new Set(getPluginHost() ? pluginManifest().filter(p => p.enabled).map(p => p.name) : [])
+    const { getChannelPluginsRepo } = await import('@/server/services/workshop/db/channel-plugins.repo')
+    getChannelPluginsRepo().setMany(
+      result.channelId,
+      body.plugins.filter(p => p && typeof p.name === 'string' && registered.has(p.name)),
+    )
+  }
   // 全时事件录制:新 channel 即时建立常驻流(server 驱动落库,与订阅者无关)
   const { ensureStream } = await import('./ws')
   ensureStream(manager, result.channelId)

package/server/data/dcw-lines.json

@@ -1468,5 +1468,19 @@
     "color": "#ff8a5c",
     "description": "",
     "createdAt": "2026-09-07T10:18:16.098+08:00"
+  },
+  {
+    "id": "ln-34dedb0b",
+    "name": "opsline-oltcvd",
+    "color": "#3aa0ff",
+    "description": "",
+    "createdAt": "2026-09-07T12:04:05.866+08:00"
+  },
+  {
+    "id": "ln-84a78cd4",
+    "name": "daq-cadence 线",
+    "color": "#f4c542",
+    "description": "",
+    "createdAt": "2026-09-09T01:03:37.529+08:00"
   }
 ]

package/server/data/dcw-products.json

@@ -1468,5 +1468,19 @@
     "name": "mh-prod-mhqc88",
     "description": "",
     "createdAt": "2026-09-07T01:17:49.528+08:00"
+  },
+  {
+    "id": "pd-7daab995",
+    "lineId": "ln-34dedb0b",
+    "name": "opsproduct-oltcvd",
+    "description": "",
+    "createdAt": "2026-09-07T12:04:05.905+08:00"
+  },
+  {
+    "id": "pd-3e31ae00",
+    "lineId": "ln-84a78cd4",
+    "name": "节拍审计产品",
+    "description": "",
+    "createdAt": "2026-09-09T01:03:37.537+08:00"
   }
 ]

package/server/data/dcw-recipes.json

@@ -23,7 +23,7 @@
     ],
     "createdAt": "2026-08-29T03:30:57.544Z",
     "updatedAt": "2026-08-29T03:30:57.544Z",
-    "lastGoodRunId": "rr-9cd5076e"
+    "lastGoodRunId": "rr-6da3f412"
   },
   {
     "id": "rc-7efd4042",
@@ -3756,5 +3756,27 @@
     "lastGoodRunId": "rr-38d2742c",
     "createdAt": "2026-09-07T01:17:49.548+08:00",
     "updatedAt": "2026-09-07T01:19:07.844+08:00"
+  },
+  {
+    "id": "rc-74bc88da",
+    "productId": "pd-7daab995",
+    "lineId": "ln-34dedb0b",
+    "name": "opsrecipe-oltcvd",
+    "description": "",
+    "params": [
+      {
+        "nodeId": "dw-7110d946",
+        "templateRef": "temp-sp",
+        "value": 42,
+        "min": 0,
+        "max": 100
+      }
+    ],
+    "daqWindows": [],
+    "version": 1,
+    "paramsHistory": [],
+    "lastGoodRunId": null,
+    "createdAt": "2026-09-07T12:04:05.938+08:00",
+    "updatedAt": "2026-09-07T12:04:05.938+08:00"
   }
 ]