agentworkshop 0.7.24 → 0.7.33

package/scripts/_audit/ndjson-partial-line-repro.mjs

@@ -0,0 +1,77 @@
+/**
+ * Audit repro (read-only w.r.t. product source).
+ *
+ * Sandbox blocks `spawn()` with piped stdio (EPERM on named pipes), so this drives the
+ * accumulation loop with a synthetic EventEmitter instead of a real child: it delivers
+ * the SAME chunk sequence the OS pipe delivers when one logical NDJSON line exceeds the
+ * pipe read size (64 KiB) — i.e. a JSON object split across two `data` events.
+ *
+ * Logic under test is copied verbatim from
+ *   server/services/workshop/agents/adapters/one-shot-cli-agent.ts:404-428
+ * and the correct reference from
+ *   server/services/workshop/agents/adapters/stdio-jsonrpc.ts:234-252
+ */
+import { EventEmitter } from 'node:events'
+
+const tryParse = (line) => { try { return JSON.parse(line) } catch { return null } }
+
+/** 2 chunks of one NDJSON stream; chunk #1 ends mid-JSON-object. */
+const CHUNKS = [
+  '{"type":"message","role":"assistant","content":"hello wor',
+  'ld"}\n{"type":"result","usage":{"input_tokens":42}}\n',
+]
+
+function feed(onData) {
+  const s = new EventEmitter()
+  s.setEncoding = () => {}
+  const p = new Promise((r) => s.on('end', r))
+  onData(s)
+  queueMicrotask(() => {
+    for (const c of CHUNKS) s.emit('data', c)
+    s.emit('end')
+  })
+  return p
+}
+
+// ---- A. verbatim copy of one-shot-cli-agent.ts:404-428 (plainTextStdout !== true) ----
+const aFrames = []
+const aDeltas = []
+const aDrops = []
+await feed((s) => {
+  s.on('data', (chunk) => {
+    for (const rawLine of chunk.split(/\r?\n/)) {
+      const line = rawLine.trim()
+      if (!line) continue
+      const json = tryParse(line)
+      if (json === null) {
+        aDrops.push(line)
+        continue
+      }
+      aFrames.push(json.type)
+      if (json.type === 'message') aDeltas.push(json.content)
+    }
+  })
+})
+
+// ---- B. verbatim copy of stdio-jsonrpc.ts:234-252 (buffered) ----
+const bFrames = []
+let buf = ''
+await feed((s) => {
+  s.on('data', (data) => {
+    buf += data
+    const lines = buf.split('\n')
+    buf = lines.pop() ?? ''
+    for (const line of lines) {
+      const trimmed = line.trim()
+      if (!trimmed) continue
+      const json = tryParse(trimmed)
+      if (json === null) continue
+      bFrames.push(json.type)
+    }
+  })
+})
+
+console.log('A one-shot-cli-agent.ts loop : frames=%d %j  drops=%d %j  assistantText=%j',
+  aFrames.length, aFrames, aDrops.length, aDrops, aDeltas.join(''))
+console.log('B stdio-jsonrpc.ts loop      : frames=%d %j', bFrames.length, bFrames)
+console.log('VERDICT: one-shot loses %d/%d frames and the entire assistant message.', 2 - aFrames.length, 2)

package/scripts/_audit/opencode-await-ternary-repro.mjs

@@ -0,0 +1,20 @@
+/**
+ * Audit repro: `await` binds tighter than `?:`, so the expression at
+ * server/services/workshop/agents/opencode-agent.ts:805-808 yields a Promise, never the
+ * resolved session object.
+ */
+const DEFAULT_PERMISSION = [{ permission: 'edit' }]
+
+const api = async (path, body) => ({ id: 'ses_real', echo: body })
+const createWith = (extra) => api('/session', { ...extra })
+
+const created = await (DEFAULT_PERMISSION) // <- `await` applies ONLY to the condition
+  ? createWith({ permission: DEFAULT_PERMISSION }).catch(() => createWith(undefined))
+  : createWith(undefined)
+
+console.log('typeof created            =', typeof created)
+console.log('created instanceof Promise=', created instanceof Promise)
+console.log('created?.id               =', created?.id)
+const sessionId = String(created?.id ?? '')
+console.log('this.sessionId            =', JSON.stringify(sessionId))
+console.log('if (!this.sessionId)      =', !sessionId, '-> enters 3x retry loop, then throws')

package/scripts/_audit/part-frag.txt

@@ -0,0 +1,84 @@
+- **Evidence**: the PATCH authenticates and then mutates by **row id** with no ownership, line, or role check 鈥?no `lineMode`, no verification that the binding belongs to a channel the caller can see:
+
+```ts
+// bindings/[id].patch.ts:9-14
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const id = getRouterParam(event, 'id')!
+  const body = await readBody<{ mode?: 'auto' | 'manual' }>(event) ?? {}
+  return { binding: getAgentNodeBindingRepo().setMode(id, body.mode ?? 'auto') }
+})
+```
+
+The DELETE is the same, and it additionally force-denies the target agent's in-flight approval:
+
+```ts
+// bindings/[id].delete.ts:10-20
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  const id = getRouterParam(event, 'id')!
+  const repo = getAgentNodeBindingRepo()
+  const all = repo.all()
+  const binding = all.find(b => b.id === id)
+  if (!binding) throw createError({ statusCode: 404, statusMessage: 'binding not found' })
+  if (!repo.unbind(id)) throw createError({ statusCode: 404, statusMessage: 'binding not found' })
+  // 瑙ｇ粦鍗冲け鏁?璇?Agent 瀵硅鑺傜偣鐨勬寕璧峰鎵规寜鎷掔粷鏀舵暃(tool result 娉ㄦ槑鍘熷洜)
+  getToolApprovals().cancelPendingFor(binding.agentId, binding.nodeId)
+  return { ok: true }
+})
+```
+
+Note the contrast with the **create** path, which *does* check the line:
+`bindings/index.post.ts:28-32` `const mode = lineMode(user, lineId); if (mode === 'none' || (needOperate && mode !== 'operate')) throw new AppError(403, 'LINE_FORBIDDEN', 鈥?`.
+
+- **Impact**: the entire manual-approval safety model is one unauthenticated-by-ownership PATCH away from being disabled.
+  Any authenticated user who learns a binding id 鈥?and ids are enumerable for free, see the next finding 鈥?can flip a
+  `dcw` binding from `manual` to `auto`, permanently removing human approval for that agent/node pair (the tool then takes
+  the `binding.mode === 'manual'` branch at `industrial-tools.ts:128` as false and writes immediately at `:157`). The
+  DELETE variant is worse in effect: it unbinds a *victim's* agent and cancels that agent's **pending approvals**
+  (`cancelPendingFor` 鈫?`tool-approvals.ts:112-127` resolves them as `denied` with `'缁戝畾宸茶В闄?瀹℃壒澶辨晥'`), so an
+  attacker can silently veto a write an operator was about to authorise, and the audit trail blames a binding change.
+
+- **Fix**: in both handlers resolve the binding first, derive its node, and enforce `requireLineMode(user, nodeLine, 'operate')`
+  (same predicate as `bindings/index.post.ts:28-32`); additionally assert the caller owns or can read the agent's channel.
+  Minimal version for PATCH: `const b = repo.all().find(x => x.id === id); requireLineMode(user, nodeLineOf(b), 'operate')`.
+
+- **Verification**: as a `role:'user'` with `readonly` (or no) grant on the target line,
+  `PATCH /api/workshop/agent-tools/bindings/<id> {"mode":"auto"}` 鈫?expect 403; today it returns 200 and
+  `GET 鈥?bindings?agentId=<victim>` shows `mode: "auto"`. Static:
+  `rg -n "lineMode|requireLineMode|requireRole" server/api/workshop/agent-tools/bindings/\[id\].patch.ts` 鈫?0 hits today.
+
+---
+
+### [P0] `GET /api/workshop/agent-tools/bindings` enumerates every agent's node grants to any user
+
+- **Where**: `server/api/workshop/agent-tools/bindings/index.get.ts:9-13`
+
+- **Evidence**:
+
+```ts
+// bindings/index.get.ts:12-13
+const agentId = typeof q.agentId === 'string' ? q.agentId : ''
+return { bindings: agentId ? getAgentNodeBindingRepo().byAgent(agentId) : getAgentNodeBindingRepo().all() }
+```
+
+`.all()` returns the entire global binding table 鈥?`agentId`, `nodeId`, `kind`, `mode`, `id`
+(`node-bindings.repo.ts:22-29,48-50`) 鈥?for every agent in every channel, to **any** authenticated user with no line or
+ownership filter. Omitting `agentId` is the leak; supplying one is a targeted lookup.
+
+- **Impact**: this is the enumeration primitive that makes the previous two findings trivially exploitable 鈥?it hands the
+  attacker the exact binding `id` (needed by the `[id].patch`/`[id].delete` endpoints) plus which agents control which
+  physical nodes. It also discloses the full plant's agent鈫攁ctuator map, which is sensitive operational topology: an
+  attacker learns which `nodeId` values are `kind:'dcw'` (writable) and which are `manual` (approval-gated) versus `auto`.
+
+- **Fix**: require `agentId`, and filter the result through `filterByLine(user, 鈥?` on the node's line (or the agent's
+  channel ownership); only `admin`/`editor` may call it without a filter 鈥?mirroring `agents/index.get.ts:11`'s
+  `listAgentsVisibleTo(user)` pattern.
+
+- **Verification**: as a `role:'user'` with no grants, `GET /api/workshop/agent-tools/bindings` (no query) 鈫?today returns
+  every binding; after the fix expect 400 or an empty/filtered list.
+  Static: `rg -n "filterByLine|lineMode|visibleLineIds" server/api/workshop/agent-tools/bindings/index.get.ts` 鈫?0 hits.
+
+---
+
+### [P1] Industrial GET handlers return cross-line data (no `filterByLine`)

package/scripts/_audit/part-head.txt

@@ -0,0 +1,45 @@
+# Audit 鈥?Agent runtime integration + node-binding access control
+
+Scope: `server/services/workshop/agents/**`, `server/services/workshop/runtime/**`, `server/services/workshop/permissions.ts`,
+`server/api/workshop/agents/**`, `server/api/workshop/agent-tools/**`, `server/api/workshop/runtime.get.ts`, related repos.
+Read-only audit. Working tree unmodified. Scratch: `scripts/_audit/`.
+
+Legend: **P0** = authz hole / unsafe mutation / leak 路 **P1** = correctness/perf 路 **P2** = duplication/hygiene.
+`鈿燯NVERIFIED` marks a claim not personally confirmed against source.
+
+---
+
+## Executive summary
+
+| # | Severity | Finding | Anchor |
+|---|---|---|---|
+| 1 | **P0** | `dcw_rollback(node_id=鈥?` writes a DCW node with **no binding check** and **no HITL approval** | `industrial-tools.ts:401-420`, `recipe-rollback-manager.ts:253-279` |
+| 2 | **P0** | Manual-mode binding promise ("姣忔鎵ц闇€鐢ㄦ埛鎵瑰噯") is bypassed by the rollback path | `dcw-controller.ts:503-517`, `recipe-rollback-manager.ts:403-410` |
+| 3 | **P0** | Any authenticated dashboard user can invoke **any tool as any `agentId`** on the tool bridge (incl. arbitrary Python via `aml_job_submit`) | `agent-tools/invoke.post.ts:16-26`, `manager.ts:2746-2752`, `industrial-tools.ts:1150-1170` |
+| 4 | **P0** | `dcw_judge`/`dcw_rollback` accept takeover of **stale records on unbound nodes** (write path) | `industrial-tools.ts:381-383,413-416` |
+| 5 | **P0** | `PATCH`/`DELETE /agent-tools/bindings/:id` let any user flip any binding to `auto` (= strip HITL) or cancel another agent's pending approvals | `bindings/[id].patch.ts:9-14`, `bindings/[id].delete.ts:10-20` |
+| 6 | **P0** | `GET /agent-tools/bindings` (no query) returns the whole global agent鈫攏ode grant table to any user 鈥?the enumeration primitive for #5 | `bindings/index.get.ts:12-13` |
+| 7 | P1 | Industrial GET handlers return cross-line recipes/runs/alarms/ledgers (no `filterByLine`) | `dcw/recipes/index.get.ts:8-11`, `daq/alarms.get.ts:10-15` |
+| 8 | P1 | `GET /api/workshop/channels/:id` boots runtimes and mutates the messages table | `channels/[id]/index.get.ts:16`, `manager.ts:694-720` |
+| 9 | P1 | `GET /api/workshop/workspaces` DELETEs rows from inside a `.filter()` callback | `manager.ts:1125-1129` |
+| 10 | P1 | `GET /api/workshop/daq` inserts node rows and starts the 250 ms acquisition timer | `daq/index.get.ts:20-22`, `daq-controller.ts:1146-1163` |
+| 11 | P1 | Scheduler tick scans the channel's entire task history, every tick | `task-engine.ts:137-139`, `task.repo.ts:80` |
+| 12 | P1 | NDJSON partial-line handling missing in the shared base used by 13 harnesses | `one-shot-cli-agent.ts:406-428` |
+| 13 | P1 | `runMemoryMaintenance` still does `limit=1_000_000` + JS-filter per agent | `runtime/memory.ts:668-674` |
+| 14 | P1 | `reflectCounts` / `lastToolInvokeAt` / `ownerNameCache` / `nameCache` / `probeCache` / `runErrorRetries` / `idleSince` are unbounded | 搂3 |
+| 15 | P1 | `limit: 1_000_000` / `10_000` to fetch one memory row by id | `manager.ts:1489`, `:1552` |
+| 16 | P1 | `pickReceiverWorker` does one task query per candidate (N+1) | `manager.ts:1744-1757` |
+| 17 | P1 | Renaming/disabling a *busy* member silently has no effect (disabled workers keep working) | `manager.ts:1571-1581`, `:745-749` |
+| 18 | P1 | No cap on concurrent agent child processes / sessions | 搂7 |
+| 19 | P2 | 12+ adapters duplicate spawn/env/parse/kill/queue logic instead of declaring a spec | 搂8 |
+| 20 | P2 | `manager.ts` (3016 lines) mixes 16 unrelated subsystems | 搂9 |
+| 21 | P2 | `harness-models.opencodeCatalog` leaks temp dirs containing copied provider credentials | `harness-models.ts:133,143` |
+
+**Q1 answer (short):** the binding **is** enforced on `dcw_control` / `dcw_read` / `daq_query` / `daq_frames` / `dcw_journal` /
+`ops_log` / `recipe_log` / `aml_*`. It is **NOT** enforced on `dcw_rollback` and is only *partially* enforced on
+`dcw_judge`. Unbound agents therefore **do not** get a default-allow on `dcw_control` (good), but they **do** get one on
+the rollback write path (P0). There is no "no bindings 鈬?allow all" fallback anywhere.
+
+---
+
+### [P0] `dcw_rollback` writes any DCW node without any node-binding check

package/scripts/_audit/probe-binding.mjs

@@ -0,0 +1,103 @@
+/**
+ * 定点探针:为什么「绑定成功后 dcw_control 仍报未绑定」?
+ * 只构造最小夹具(channel + agent + dcw 节点),逐步打印服务端状态。
+ * 只读观测 + 最小必要写入;跑完自行清理。
+ */
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3111'
+const TAG = Math.random().toString(36).slice(2, 7)
+
+async function api(method, path, { body, token } = {}) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+  const text = await res.text()
+  let data
+  try { data = JSON.parse(text) } catch { data = text }
+  // 统一拆包:{code,message,data:{...}} → payload
+  const payload = data && typeof data === 'object' && 'data' in data ? data.data : data
+  return { status: res.status, data: payload, raw: data, message: data?.message, code: data?.code, headers: res.headers }
+}
+
+const log = (...a) => console.log(...a)
+
+// 1) 账号(全新实例 → admin)
+const setup = await api('GET', '/api/users/setup-status')
+log('setup-status:', JSON.stringify(setup.data))
+const reg = await api('POST', '/api/users/register', { body: { name: `probe-${TAG}`, email: `probe-${TAG}@w.local`, password: 'ProbePass!2026' } })
+log('register 原始返回:', reg.status, JSON.stringify(reg.data)?.slice(0, 400))
+let token = reg.data?.token ?? reg.data?.data?.token
+if (!token) {
+  const lg = await api('POST', '/api/users/login', { body: { email: `probe-${TAG}@w.local`, password: 'ProbePass!2026' } })
+  log('login 回退:', lg.status, JSON.stringify(lg.data)?.slice(0, 300))
+  token = lg.data?.token ?? lg.data?.data?.token
+}
+log('token?', Boolean(token))
+if (!token) { log('无法取得 token,退出'); process.exit(1) }
+const me = await api('GET', '/api/workshop/users/me', { token })
+log('me:', JSON.stringify(me.data))
+
+// 2) 产线 + 数控模板 + 数控节点
+const line = await api('POST', '/api/workshop/dcw/lines', { body: { name: `probe-line-${TAG}` }, token })
+log('line:', line.status, JSON.stringify(line.data)?.slice(0, 200))
+const lineId = line.data?.line?.id ?? line.data?.id
+
+const tpl = await api('POST', '/api/workshop/dcw/templates', { body: { key: `cw-probe-${TAG}`, name: `probe-${TAG}`, ch: '温度', unit: '℃', min: 0, max: 300, decimals: 1 }, token })
+log('dcw template:', tpl.status, JSON.stringify(tpl.data)?.slice(0, 200))
+const tplKey = tpl.data?.template?.key
+log('  服务端分配 templateKey =', tplKey)
+
+const node = await api('POST', '/api/workshop/dcw', {
+  body: { name: `probe-node-${TAG}`, lineId, templateRef: tplKey, driver: 'mock', unit: '℃', min: 0, max: 300, decimals: 1, holdIntervalMs: 0 },
+  token,
+})
+log('dcw node:', node.status, JSON.stringify(node.data)?.slice(0, 260))
+const nodeId = node.data?.node?.id ?? node.data?.id
+if (!nodeId) { log('建节点失败,退出'); process.exit(1) }
+
+// 3) channel + agent 模板 + 入队
+const ch = await api('POST', '/api/workshop/channels', { body: { name: `probe-ch-${TAG}` }, token })
+const channelId = ch.data?.channelId ?? ch.data?.id
+log('channel:', ch.status, channelId)
+
+const agentTpl = await api('POST', '/api/workshop/agents', { body: { name: `probe-agent-${TAG}`, harness: 'opencode', config: {} }, token })
+const templateId = agentTpl.data?.id
+log('agent 模板 id (=templateId):', templateId, 'status:', agentTpl.status)
+
+const join = await api('POST', `/api/workshop/channels/${channelId}/agents`, { body: { agentId: templateId, role: 'worker' }, token })
+const instanceId = join.data?.id
+log('入队返回 id (=instanceId):', instanceId, 'status:', join.status)
+log('  ⚠ templateId !== instanceId ?', templateId !== instanceId)
+
+// 4) 用 instanceId 绑定
+const bind = await api('POST', '/api/workshop/agent-tools/bindings', { body: { agentId: instanceId, nodeId, kind: 'dcw', mode: 'auto' }, token })
+log('bind(instanceId):', bind.status, JSON.stringify(bind.data)?.slice(0, 300))
+const bindingAgentId = bind.data?.binding?.agentId
+log('  ⚠ 服务端存下的 agentId =', bindingAgentId)
+log('  ⚠ 与 instanceId 相同 ?', bindingAgentId === instanceId, '| 与 templateId 相同 ?', bindingAgentId === templateId)
+
+// 5) 直读绑定表
+const listInst = await api('GET', `/api/workshop/agent-tools/bindings?agentId=${instanceId}`, { token })
+log('GET bindings?agentId=instanceId:', listInst.status, JSON.stringify(listInst.data)?.slice(0, 300))
+const listTpl = await api('GET', `/api/workshop/agent-tools/bindings?agentId=${templateId}`, { token })
+log('GET bindings?agentId=templateId:', listTpl.status, JSON.stringify(listTpl.data)?.slice(0, 300))
+
+// 6) 关键:工具调用用哪个 id?
+const haveRec = (await api('GET', '/api/workshop/dcw/optimizations', { token })).data
+log('optimizations 原始:', JSON.stringify(haveRec)?.slice(0, 300))
+for (const [label, id] of [['instanceId', instanceId], ['templateId', templateId]]) {
+  const inv = await api('POST', '/api/workshop/agent-tools/invoke', {
+    body: { agentId: id, tool: 'my_industrial_nodes', args: {} }, token,
+  })
+  log(`invoke my_industrial_nodes @${label}:`, inv.status, String(inv.data?.result?.text ?? JSON.stringify(inv.data)).slice(0, 200))
+  const ctl = await api('POST', '/api/workshop/agent-tools/invoke', {
+    body: { agentId: id, tool: 'dcw_control', args: { node_id: nodeId, value: 100, hypothesis: 'probe' } }, token,
+  })
+  log(`invoke dcw_control @${label}:`, ctl.status, String(ctl.data?.result?.text ?? JSON.stringify(ctl.data)).slice(0, 220))
+}
+
+// 7) 清理
+await api('DELETE', `/api/workshop/agent-tools/bindings/${bind.data?.binding?.id}`, { token })
+await api('DELETE', `/api/workshop/dcw/${nodeId}`, { token })
+log('清理完成')

package/scripts/_audit/probe-child.mjs

@@ -0,0 +1,17 @@
+// audit probe: child-lifecycle signal semantics
+import { runChild, signalExitCode, SHUTDOWN_GRACE_MS } from '../../cli/core/child-lifecycle.mjs'
+
+console.log('signalExitCode(SIGINT) =', signalExitCode('SIGINT'))
+console.log('signalExitCode(SIGTERM) =', signalExitCode('SIGTERM'))
+console.log('signalExitCode(SIGKILL) =', signalExitCode('SIGKILL'))
+console.log('signalExitCode(SIGWEIRD) =', signalExitCode('SIGWEIRD'))
+console.log('SHUTDOWN_GRACE_MS =', SHUTDOWN_GRACE_MS)
+
+const normal = await runChild(process.execPath, ['-e', 'process.exit(7)'], { stdio: 'inherit' })
+console.log('normal child exit 7 ->', normal)
+
+const selfKill = await runChild(process.execPath, ['-e', 'process.kill(process.pid, "SIGTERM")'], { stdio: 'inherit' })
+console.log('self-SIGTERM child ->', selfKill, '(POSIX convention would be 143)')
+
+const missing = await runChild(process.execPath, ['-e', ''], { stdio: 'inherit' })
+console.log('clean child ->', missing)

package/scripts/_audit/probe-envelope.mjs

@@ -0,0 +1,49 @@
+// audit probe: SDK envelope handling — api.mjs vs client.mjs ctx.fetch (fixed document stub)
+import { createServer } from 'node:http'
+import { createPlatformClient } from '../../sdk/api.mjs'
+
+const srv = createServer((req, res) => {
+  res.setHeader('content-type', 'application/json')
+  if (req.url.startsWith('/api/biz-error')) {
+    res.end(JSON.stringify({ code: 'LINE_FORBIDDEN', message: '无该产线权限', data: null }))
+    return
+  }
+  if (req.url.startsWith('/api/http-500')) {
+    res.statusCode = 500
+    res.end(JSON.stringify({ code: 'INTERNAL_ERROR', message: '服务器内部错误', data: null }))
+    return
+  }
+  res.end(JSON.stringify({ code: 0, message: 'ok', data: { hello: 'world' } }))
+})
+await new Promise(r => srv.listen(0, '127.0.0.1', r))
+const base = `http://127.0.0.1:${srv.address().port}`
+
+globalThis.document = {
+  cookie: '',
+  addEventListener() {},
+  removeEventListener() {},
+  createElement: () => ({ style: {}, setAttribute() {}, append() {}, addEventListener() {} }),
+  getElementById: () => null,
+  body: { append() {} },
+  visibilityState: 'visible',
+}
+const { createClientContext } = await import('../../sdk/client.mjs')
+const cctx = createClientContext({ name: 'probe', baseUrl: base })
+console.log('ctx.fetch(/api/ok)        ->', JSON.stringify(await cctx.fetch('/api/ok')))
+try {
+  const r = await cctx.fetch('/api/biz-error')
+  console.log(`ctx.fetch(/api/biz-error) -> NO THROW, returned ${JSON.stringify(r)}  <-- business error swallowed`)
+}
+catch (err) {
+  console.log(`ctx.fetch(/api/biz-error) -> threw: status=${err.status} code=${err.code} message=${err.message}`)
+}
+try {
+  await cctx.fetch('/api/http-500')
+  console.log('ctx.fetch(/api/http-500)  -> NO THROW (bug)')
+}
+catch (err) {
+  console.log(`ctx.fetch(/api/http-500)  -> threw: status=${err.status} code=${err.code} hasBody=${'body' in err}`)
+}
+srv.closeAllConnections?.()
+await new Promise(r => srv.close(r))
+process.exit(0)

package/scripts/_audit/probe-packlist.mjs

@@ -0,0 +1,67 @@
+// audit probe: packlist-equivalent check of package.json "files" vs "exports" + transitive relative imports
+import { readFileSync, existsSync, statSync } from 'node:fs'
+import { dirname, join, resolve, relative } from 'node:path'
+
+const ROOT = resolve(process.cwd())
+const pkg = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
+const files = pkg.files ?? []
+
+const under = (rel, entry) => {
+  const e = entry.replace(/^\.\//, '').replace(/\/$/, '')
+  if (rel === e) return true
+  if (rel.startsWith(`${e}/`)) return true
+  return false
+}
+const covered = rel => files.some(f => under(rel, f))
+const cov = rel => covered(rel) ? 'COVERED' : '*** NOT-COVERED ***'
+
+console.log('== exports targets vs "files" whitelist ==')
+const targets = []
+for (const [key, val] of Object.entries(pkg.exports ?? {})) {
+  for (const [cond, p] of Object.entries(val)) {
+    if (typeof p !== 'string' || !p.startsWith('./')) continue
+    targets.push(p.slice(2))
+    console.log(`  ${codepoint(p)} ${key} (${cond}) -> ${p.slice(2)}: ${cov(p.slice(2))}`)
+  }
+}
+for (const [name, p] of Object.entries(pkg.bin ?? {})) {
+  console.log(`  bin ${name} -> ${p}: ${cov(p)}`)
+}
+
+// always included by npm regardless of "files"
+const always = ['package.json', 'README.md', 'README-zh.md', 'LICENSE', '.npmrc', '.gitignore']
+console.log('\n== named dependencies (.npmrc/.gitignore are NEVER shipped) ==')
+for (const f of always) console.log(`  ${f}: ${existsSync(join(ROOT, f)) ? (covered(f) ? 'in files' : 'not in files (npm default rules apply)') : 'absent'}`)
+
+// transitive relative-import scan from entry points
+const entries = [...new Set([...targets, ...Object.values(pkg.bin ?? {})])]
+const seen = new Set()
+const missing = []
+const specRe = /(?:from\s*|import\s*\(\s*|import\s+)['"]([^'"]+)['"]/g
+
+function scan(rel) {
+  if (seen.has(rel)) return
+  seen.add(rel)
+  const abs = join(ROOT, rel)
+  if (!existsSync(abs) || !statSync(abs).isFile()) { missing.push(`${rel} (does not exist)`); return }
+  if (!covered(rel)) missing.push(`${rel} (not covered by "files")`)
+  if (!/\.(mjs|js|cjs|d\.mts|mts)$/.test(rel)) return
+  const src = readFileSync(abs, 'utf8')
+  for (const m of src.matchAll(specRe)) {
+    const spec = m[1]
+    if (spec.startsWith('node:') || spec.startsWith('@/') || !spec.startsWith('.')) continue
+    const target = resolve(dirname(abs), spec)
+    const relTarget = relative(ROOT, target).replace(/\\/g, '/')
+    scan(relTarget)
+  }
+}
+
+for (const e of entries) scan(e.replace(/^\.\//, ''))
+console.log(`\n== transitive relative-import graph: ${seen.size} files reached from ${entries.length} entry points ==`)
+if (missing.length) {
+  console.log('PROBLEMS:')
+  for (const m of [...new Set(missing)]) console.log('  ' + m)
+}
+else { console.log('  every reached file exists and is covered by "files"') }
+
+function codepoint(s) { return s.padEnd(22) }

package/scripts/_audit/probe-routes.mjs

@@ -0,0 +1,47 @@
+// audit probe: compare SDK createPlatformClient paths against the live server (route existence only)
+// A route that exists but requires auth answers 401/UNAUTHORIZED; a missing route answers 404/NOT_FOUND.
+const BASE = process.env.AW_PROBE_BASE ?? 'http://127.0.0.1:3001'
+
+const probes = [
+  ['users.list', 'GET', '/api/users'],
+  ['users.get', 'GET', '/api/users/__nonexistent__'],
+  ['users.update(PATCH)', 'PATCH', '/api/users/__nonexistent__'],
+  ['users.update(PUT)', 'PUT', '/api/users/__nonexistent__'],
+  ['users.me', 'GET', '/api/users/me'],
+  ['lines.list', 'GET', '/api/workshop/dcw/lines'],
+  ['lines.get', 'GET', '/api/workshop/dcw/lines/__nonexistent__'],
+  ['products.list', 'GET', '/api/workshop/dcw/products'],
+  ['products.get', 'GET', '/api/workshop/dcw/products/__nonexistent__'],
+  ['recipes.list', 'GET', '/api/workshop/dcw/recipes'],
+  ['dcwNodes.list', 'GET', '/api/workshop/dcw'],
+  ['dcwNodes.get', 'GET', '/api/workshop/dcw/__nonexistent__'],
+  ['daqNodes.list', 'GET', '/api/workshop/daq'],
+  ['daqNodes.get', 'GET', '/api/workshop/daq/__nonexistent__'],
+  ['daqNodes.alarms', 'GET', '/api/workshop/daq/alarms'],
+  ['twins.list', 'GET', '/api/workshop/device-twins'],
+  ['twins.get', 'GET', '/api/workshop/device-twins/__nonexistent__'],
+  ['teams.list', 'GET', '/api/workshop/teams'],
+  ['teams.get', 'GET', '/api/workshop/teams/__nonexistent__'],
+  ['agents.list', 'GET', '/api/workshop/agents'],
+  ['channels.list', 'GET', '/api/workshop/channels'],
+  ['permissions.overview', 'GET', '/api/workshop/permissions'],
+  ['plugins.manifest', 'GET', '/api/plugins/manifest'],
+  ['ping(=manifest)', 'GET', '/api/plugins/manifest'],
+  ['templates.daq', 'GET', '/api/workshop/daq'],
+  ['templates.dcw', 'GET', '/api/workshop/dcw'],
+]
+
+for (const [name, method, path] of probes) {
+  let line
+  try {
+    const res = await fetch(`${BASE}${path}`, { method, headers: { accept: 'application/json' } })
+    const body = await res.json().catch(() => null)
+    const code = body && typeof body === 'object' ? (body.code ?? '(none)') : '(non-json)'
+    const hasTemplates = body && typeof body === 'object' && body.data && typeof body.data === 'object' && 'templates' in body.data
+    line = `${name.padEnd(22)} ${String(method).padEnd(5)} ${path.padEnd(46)} http=${res.status} code=${String(code).slice(0, 24)} templates=${hasTemplates}`
+  }
+  catch (err) {
+    line = `${name.padEnd(22)} ${String(method).padEnd(5)} ${path.padEnd(46)} FETCH-FAIL ${err.message}`
+  }
+  console.log(line)
+}

package/scripts/_audit/probe-routes2.mjs

@@ -0,0 +1,38 @@
+// audit probe v2: distinguish "route missing" (h3 bare 404) from "route exists" (envelope JSON)
+const BASE = process.env.AW_PROBE_BASE ?? 'http://127.0.0.1:3001'
+const probes = [
+  ['users.list                 ', 'GET', '/api/users'],
+  ['users.get                  ', 'GET', '/api/users/__none__'],
+  ['users.update PATCH(sdk)    ', 'PATCH', '/api/users/__none__'],
+  ['users.update PUT(server)   ', 'PUT', '/api/users/__none__'],
+  ['lines.list                 ', 'GET', '/api/workshop/dcw/lines'],
+  ['lines.get                  ', 'GET', '/api/workshop/dcw/lines/__none__'],
+  ['lines.update PATCH         ', 'PATCH', '/api/workshop/dcw/lines/__none__'],
+  ['products.list              ', 'GET', '/api/workshop/dcw/products'],
+  ['products.get               ', 'GET', '/api/workshop/dcw/products/__none__'],
+  ['products.update PATCH      ', 'PATCH', '/api/workshop/dcw/products/__none__'],
+  ['recipes.list               ', 'GET', '/api/workshop/dcw/recipes'],
+  ['recipes.get                ', 'GET', '/api/workshop/dcw/recipes/__none__'],
+  ['recipes.update PATCH       ', 'PATCH', '/api/workshop/dcw/recipes/__none__'],
+  ['dcwNodes.get               ', 'GET', '/api/workshop/dcw/__none__'],
+  ['daqNodes.get               ', 'GET', '/api/workshop/daq/__none__'],
+  ['twins.get                  ', 'GET', '/api/workshop/device-twins/__none__'],
+  ['teams.get                  ', 'GET', '/api/workshop/teams/__none__'],
+  ['agents.get                 ', 'GET', '/api/workshop/agents/__none__'],
+  ['channels.list              ', 'GET', '/api/workshop/channels'],
+  ['unknown /api/workshop/nope ', 'GET', '/api/workshop/nope'],
+  ['unknown /api/workshop/dcw/products (GET, route missing)', 'GET', '/api/workshop/dcw/products'],
+]
+
+for (const [name, method, path] of probes) {
+  try {
+    const res = await fetch(`${BASE}${path}`, { method, headers: { accept: 'application/json' } })
+    const text = await res.text()
+    const kind = text === '' ? 'EMPTY-BODY(h3 bare 404/405)'
+      : (text.trimStart().startsWith('{') ? `JSON ${text.slice(0, 72).replace(/\s+/g, ' ')}` : `RAW ${text.slice(0, 40).replace(/\s+/g, ' ')}`)
+    console.log(`${name} ${String(method).padEnd(5)} http=${String(res.status).padEnd(3)} ct=${String(res.headers.get('content-type')).padEnd(16)} ${kind}`)
+  }
+  catch (err) {
+    console.log(`${name} FETCH-FAIL ${err.message}`)
+  }
+}

package/scripts/_audit/probe.ts

@@ -0,0 +1,9 @@
+// audit probe: does the SDK type surface resolve the way docs promise?
+import { createClientContext, type ClientContext } from '@/sdk/client.mjs'
+import type { PluginContext, PluginDef, PlatformClient } from '@/sdk/index.mjs'
+
+export const a: ClientContext | null = null
+export const b: PluginContext | null = null
+export const c: PluginDef | null = null
+export const d: PlatformClient | null = null
+export const e = createClientContext

package/scripts/_audit/probe2.ts

@@ -0,0 +1,6 @@
+// audit probe 2: relative specifier (no alias), mirrors nuxt app compilerOptions
+import type { ClientContext } from '../../sdk/client.mjs'
+import type { PluginContext } from '../../sdk/index.mjs'
+
+export const a2: ClientContext | null = null
+export const b2: PluginContext | null = null

package/scripts/_audit/probe3.ts

@@ -0,0 +1,3 @@
+// audit probe 3: phantom named export `el` (declared in client.d.mts, absent at runtime)
+import { el } from '../../sdk/client.mjs'
+export const f = el

package/scripts/_audit/probe4.ts

@@ -0,0 +1,3 @@
+// audit probe 4: runtime exports missing from index.d.mts
+import { isPathInside, validatePluginSettings } from '../../sdk/index.mjs'
+export const g = [isPathInside, validatePluginSettings]

package/scripts/_audit/proj/.AgentWorkShop/commands/echoargs.mjs

@@ -0,0 +1,13 @@
+// scratch audit command: echoes the argv the CLI dispatcher produced
+export const meta = {
+  name: 'echoargs',
+  group: 'audit',
+  summary: 'echo parsed argv (audit scratch)',
+  usage: 'aw echoargs [--any]',
+  needsProject: false,
+}
+
+export async function run(argv, ctx) {
+  console.log(JSON.stringify({ argv, mode: ctx.mode, root: ctx.root, cwd: ctx.cwd }))
+  return 0
+}

package/scripts/_audit/proj/config.yml

@@ -0,0 +1 @@
+# scratch audit project (read-only audit harness; safe to delete)

package/scripts/_audit/run.mjs

@@ -0,0 +1,30 @@
+/**
+ * 审计实验运行器(只读审计专用):
+ *  1) **强制隔离运行数据目录**(AW_DATA_DIR/AW_MODE/AW_HOME → scripts/_audit/.tmp):
+ *     仓库已改为 ensureDataDir()(配置根 <repo>/.AgentWorkShop/data),单纯 chdir 不再隔离,
+ *     实验若不做这一步会把合成数据写进线上数据根(本轮审计已发生并已修复)。
+ *  2) 注册扩展名省略解析钩子(仓库源码风格 './dcw-node' 与 '@/' 别名);
+ *  3) 加载目标 TS 入口。
+ * 用法:node scripts/_audit/run.mjs scripts/_audit/<entry>.ts
+ */
+import { mkdirSync } from 'node:fs'
+import { register } from 'node:module'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const TMP = new URL('./.tmp/', import.meta.url)
+const TMP_DIR = fileURLToPath(TMP)
+mkdirSync(TMP_DIR, { recursive: true })
+
+process.env.AW_DATA_DIR = fileURLToPath(new URL('./.tmp/audit-data/', import.meta.url))
+process.env.AW_MODE = 'home'
+process.env.AW_HOME = fileURLToPath(new URL('./.tmp/awhome/', import.meta.url))
+mkdirSync(process.env.AW_DATA_DIR, { recursive: true })
+mkdirSync(process.env.AW_HOME, { recursive: true })
+
+register('./ts-resolve-hook.mjs', import.meta.url)
+const entry = process.argv[2]
+if (!entry) {
+  console.error('usage: node scripts/_audit/run.mjs <entry.ts>')
+  process.exit(2)
+}
+await import(pathToFileURL(entry).href)