agentworkshop 0.7.37 → 0.7.39

package/scripts/.mimosa/hook-state/sess_aeaecb58-8833-4b83-b93c-050467d21e03.mtxwtxme-61028-1f4519fbc4.baseline/ffb4e3aa548cfdadabaa44ab599f9b6a3ca6288176a2cc7a4b2fc2a12b5fb848.source

@@ -0,0 +1,101 @@
+/**
+ * 动态记忆感知测试:按需抓取(recallRows scope 过滤/原文还原/touch)、
+ * 主动沉淀(save 私有/共享分流 + 共享域 dedupKey 命名空间)、
+ * 记忆引子(小预算 primer + 工具提示行)。
+ * 运行: npx tsx scripts/test-memory-dynamic.ts
+ */
+import type { DatabaseSync } from 'node:sqlite'
+import { openWorkshopDb } from '../server/services/workshop/db/database'
+import { createMemoryRepo, TEAM_AGENT_ID } from '../server/services/workshop/db/memory.repo'
+import { AgentMemory } from '../server/services/workshop/runtime/memory'
+
+let failures = 0
+function check(name: string, ok: boolean, detail = ''): void {
+  console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!ok) failures += 1
+}
+
+const db: DatabaseSync = openWorkshopDb(':memory:')
+const repo = createMemoryRepo(db)
+const seg = (s: string): string => s.replace(/([\u4e00-\u9fff])/g, ' $1 ')
+
+// 播种:a1 私有 × 2、a2 私有 × 1、team 公共 × 1、他 channel 的 team 行 × 1(隔离守卫)
+repo.upsert({ channelId: 'ch1', agentId: 'a1', kind: 'episodic-task', title: '网关限流方案', titleFts: seg('网关限流方案'), content: seg('最终采用令牌桶算法限流,阈值100qps'), importance: 0.8, taskId: 't1', dedupKey: 'task:t1' })
+repo.upsert({ channelId: 'ch1', agentId: 'a1', kind: 'episodic-task', title: '部署脚本草稿', titleFts: seg('部署脚本草稿'), content: seg('deploy.sh 需要先source env'), importance: 0.4, taskId: 't2', dedupKey: 'task:t2' })
+repo.upsert({ channelId: 'ch1', agentId: 'a2', kind: 'episodic-task', title: '他人限流笔记', titleFts: seg('他人限流笔记'), content: seg('a2自己的限流杂记'), importance: 0.8, taskId: 't3', dedupKey: 'task:t3' })
+repo.upsert({ channelId: 'ch1', agentId: TEAM_AGENT_ID, kind: 'semantic', title: 'channel 限流约定', titleFts: seg('channel 限流约定'), content: seg('全channel统一用令牌桶,禁用计数器'), importance: 0.9, taskId: null, dedupKey: 'conv:ratelimit' })
+repo.upsert({ channelId: 'ch2', agentId: TEAM_AGENT_ID, kind: 'semantic', title: '他channel限流约定', titleFts: seg('他channel限流约定'), content: seg('ch2专属公共记忆不应被ch1看到'), importance: 0.9, taskId: null, dedupKey: 'conv:other' })
+
+const memA1 = new AgentMemory(repo, { channelId: 'ch1', agentId: 'a1' })
+
+console.log('--- 按需抓取 recallRows ---')
+{
+  const auto = await memA1.recallRows('限流 令牌桶')
+  check('auto 域命中本人 + 公共记忆', auto.some(s => s.title === '网关限流方案') && auto.some(s => s.title === 'channel 限流约定'), JSON.stringify(auto.map(s => s.title)))
+  check('auto 域不含他人私有记忆', auto.every(s => s.title !== '他人限流笔记'))
+  check('auto 域不含他 channel 公共记忆', auto.every(s => s.title !== '他channel限流约定'))
+  check('source 标注 private/shared', auto.some(s => s.source === 'private') && auto.some(s => s.source === 'shared'))
+  const own = auto.find(s => s.title === '网关限流方案')
+  check('content 还原为未切分原文', own !== undefined && !/\s/.test(own.content.slice(0, 4)) && own.content.includes('令牌桶'), own?.content.slice(0, 20))
+  check('返回综合分 score', auto.every(s => typeof s.score === 'number' && s.score > 0))
+
+  const sharedOnly = await memA1.recallRows('限流', { scope: 'shared' })
+  check('shared 域仅公共记忆', sharedOnly.length > 0 && sharedOnly.every(s => s.source === 'shared'), JSON.stringify(sharedOnly.map(s => s.title)))
+  check('shared 域严格本 channel', sharedOnly.every(s => s.title !== '他channel限流约定'))
+
+  const privOnly = await memA1.recallRows('限流', { scope: 'private' })
+  check('private 域仅本人记忆', privOnly.length > 0 && privOnly.every(s => s.source === 'private'), JSON.stringify(privOnly.map(s => s.title)))
+
+  const before = repo.listByAgent('a1', 10).find(r => r.title === '网关限流方案')!.accessCount
+  await memA1.recallRows('网关 限流')
+  const after = repo.listByAgent('a1', 10).find(r => r.title === '网关限流方案')!.accessCount
+  check('recallRows 触发 touch(强化后续排序)', after === before + 1, `before=${before} after=${after}`)
+
+  // scope 域内完全无记忆才真正返回空(全新 channel;有记忆时弱命中/时近兜底会返回行,by design)
+  const none = await new AgentMemory(repo, { channelId: 'ch-empty', agentId: 'nobody' }).recallRows('完全不存在的关键词xyzq')
+  check('无命中返回空数组(无记忆 agent)', Array.isArray(none) && none.length === 0)
+  const fallback = await memA1.recallRows('完全不存在的关键词xyzq')
+  check('FTS 无命中走时近兜底(有记忆 agent 返回最近行)', fallback.length > 0, JSON.stringify(fallback.map(s => s.title)))
+}
+
+console.log('\n--- 主动沉淀 save(私有/共享分流)---')
+{
+  const priv = await memA1.save({ title: 'SQLite 并发写坑', content: '并发写会 SQLITE_BUSY,须串行化写入', scope: 'private', dedupKey: 'note:sqlite' })
+  check('私有沉淀落入本人域', repo.findByAgentDedup('ch1', 'a1', 'note:sqlite') !== null && priv.scope === 'private')
+
+  const shared = await memA1.save({ title: '限流阈值结论', content: '全队统一令牌桶阈值100qps', scope: 'shared', dedupKey: 'conv:threshold' })
+  const teamRow = repo.findByAgentDedup('ch1', TEAM_AGENT_ID, `agent:a1:conv:threshold`)
+  check('共享沉淀落入 team 公共域(来源命名空间 dedupKey)', teamRow !== null && shared.dedupKey === 'agent:a1:conv:threshold')
+
+  // 同 raw key 不同 agent:命名空间隔离互不覆盖
+  const memA2 = new AgentMemory(repo, { channelId: 'ch1', agentId: 'a2' })
+  await memA2.save({ title: 'a2 的阈值结论', content: 'a2认为阈值应按服务分级', scope: 'shared', dedupKey: 'conv:threshold' })
+  const teamRows = repo.listByAgentChannel('ch1', TEAM_AGENT_ID, 100).filter(r => r.content.includes('阈值') || r.title.includes('阈值'))
+  check('多 agent 同 raw key 共享沉淀互不覆盖', repo.findByAgentDedup('ch1', TEAM_AGENT_ID, 'agent:a1:conv:threshold') !== null && repo.findByAgentDedup('ch1', TEAM_AGENT_ID, 'agent:a2:conv:threshold') !== null, `rows=${teamRows.length}`)
+
+  // 共享沉淀即时对全员可检索
+  const a2sees = await memA2.recallRows('阈值 令牌桶', { scope: 'shared' })
+  check('共享沉淀对其他 agent 即时可检索', a2sees.some(s => s.title === '限流阈值结论'), JSON.stringify(a2sees.map(s => s.title)))
+
+  // 稳定 dedupKey 幂等刷新不重复
+  await memA1.save({ title: '限流阈值结论', content: '修订:阈值升到200qps', scope: 'shared', dedupKey: 'conv:threshold' })
+  const count = repo.listByAgentChannel('ch1', TEAM_AGENT_ID, 100).filter(r => r.dedupKey === undefined && r.title === '限流阈值结论').length
+  const refreshed = repo.listByAgentChannel('ch1', TEAM_AGENT_ID, 100).some(r => r.title === '限流阈值结论')
+  check('稳定 dedupKey 幂等刷新', refreshed && count <= 1)
+}
+
+console.log('\n--- 记忆引子 primer(小预算注入)---')
+{
+  const block = await memA1.recall('限流 令牌桶 部署', { touch: false })
+  check('primer 返回记忆块', block !== null)
+  check('primer 含按需抓取工具提示', block !== null && block.includes('search_memory'), block?.slice(-80))
+  // v2 三层注入:L0 简报(save(shared) 后自动存在)+ L1 引子 + 提示,同在 300 tok 引子预算 + 500 tok 总预算内
+  check('primer 含 L0 会话简报', block !== null && block.includes('会话简报'))
+  check('primer 小预算(行数受限)', block !== null && block.split('\n').length < 16, `lines=${block?.split('\n').length}`)
+
+  const memTiny = new AgentMemory(repo, { channelId: 'ch1', agentId: 'a1', budgetTokens: 5 })
+  check('极小预算 primer 无行则 null', (await memTiny.recall('限流')) === null)
+}
+
+console.log(failures === 0 ? '\nALL PASS' : `\n${failures} FAILED`)
+process.exit(failures === 0 ? 0 : 1)

package/scripts/_audit/detached-start.mjs

@@ -0,0 +1,103 @@
+/**
+ * 把 `aw start` 以**真分离**方式拉起(脱离 agent 作业的进程组),日志落文件。
+ *
+ * 为什么需要它:agent 工具的后台作业在回合结束/被回收时会连子进程一起终止,
+ * 而 `aw start` 的 stdout 缓冲区随之丢失 —— 表现为「日志停在半路、无 fatal 行、
+ * 端口释放、退出码 1」,极易误判成服务自己崩了(实测踩过两次)。
+ *
+ * 做法:node 的 spawn + detached + stdio 重定向到文件。
+ * Windows 上还要 unref 并用 windowsHide,否则父进程退出时子进程一起走。
+ *
+ * 用法:
+ *   node scripts/_audit/detached-start.mjs [--log <path>] [--cwd <dir>] [--port 3001] [--wait 45]
+ *   node scripts/_audit/detached-start.mjs --status     # 只看健康门与日志尾
+ *   node scripts/_audit/detached-start.mjs --stop       # 停掉分离实例
+ */
+import { spawn, spawnSync } from 'node:child_process'
+import { closeSync, existsSync, openSync, readFileSync, statSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const arg = (k, d) => {
+  const i = process.argv.indexOf(k)
+  return i >= 0 ? process.argv[i + 1] : d
+}
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..')
+const CWD = resolve(arg('--cwd', repo))
+const PORT = Number(arg('--port', '3001'))
+const LOG = resolve(arg('--log', join(CWD, '..', 'aw-detached.log')))
+const PIDFILE = LOG + '.pid'
+const BASE = `http://127.0.0.1:${PORT}`
+
+const health = async () => {
+  try {
+    const r = await fetch(`${BASE}/api/health`, { signal: AbortSignal.timeout(6000) })
+    const j = await r.json()
+    return j?.data?.status === 'ok' ? { ok: true, version: j.data.version, uptimeMs: j.data.uptimeMs } : { ok: false }
+  }
+  catch { return { ok: false } }
+}
+
+if (process.argv.includes('--status')) {
+  const h = await health()
+  console.log(h.ok ? `✔ 健康 version=${h.version} uptime=${Math.round(h.uptimeMs / 1000)}s` : '✖ 不可达')
+  const pid = existsSync(PIDFILE) ? readFileSync(PIDFILE, 'utf8').trim() : '(无 pid 文件)'
+  console.log(`  分离 pid 文件: ${pid}`)
+  if (existsSync(LOG)) {
+    const size = statSync(LOG).size
+    const tail = readFileSync(LOG, 'utf8').split(/\r?\n/).slice(-6)
+    console.log(`  日志 ${LOG} (${(size / 1024).toFixed(1)} KB) 尾部:`)
+    for (const l of tail) if (l.trim()) console.log('    ' + l.slice(0, 150))
+  }
+  process.exitCode = h.ok ? 0 : 1
+}
+
+else if (process.argv.includes('--stop')) {
+  const pid = existsSync(PIDFILE) ? Number(readFileSync(PIDFILE, 'utf8').trim()) : NaN
+  if (Number.isInteger(pid)) {
+    const r = spawnSync('taskkill', ['/PID', String(pid), '/T', '/F'], { stdio: 'ignore' })
+    console.log(r.status === 0 ? `✔ 已终止分离实例 pid=${pid}` : `· taskkill 退出码 ${r.status}(进程可能已退出)`)
+  }
+  else console.log('· 无 pid 文件,改用 aw stop')
+  if (!Number.isInteger(pid)) spawnSync('aw', ['stop'], { cwd: CWD, stdio: 'inherit', shell: true })
+}
+
+else {
+  const pre = await health()
+  if (pre.ok) {
+    console.log(`· ${BASE} 已有健康实例(version=${pre.version}),不重复启动`)
+    process.exitCode = 0
+  }
+  else {
+    const out = openSync(LOG, 'a')
+    // 只清大小写重复的代理变量:7890 会拦 localhost
+    const env = { ...process.env, NO_PROXY: '127.0.0.1,localhost', HTTP_PROXY: '', HTTPS_PROXY: '' }
+    const child = spawn(process.execPath, [join(repo, 'bin', 'aw.mjs'), 'start', '--port', String(PORT)], {
+      cwd: CWD,
+      env,
+      detached: true,
+      windowsHide: true,
+      stdio: ['ignore', out, out],
+    })
+    closeSync(out)
+    child.unref()
+    const { writeFileSync } = await import('node:fs')
+    writeFileSync(PIDFILE, String(child.pid), 'utf8')
+    console.log(`✔ 已分离启动 pid=${child.pid} → ${BASE},日志 ${LOG}`)
+
+    const waitS = Number(arg('--wait', '45'))
+    for (let i = 0; i < waitS; i += 3) {
+      await new Promise(r => setTimeout(r, 3000))
+      const h = await health()
+      if (h.ok) {
+        console.log(`✔ 健康门通过 version=${h.version}(${(i + 3)}s)`)
+        process.exitCode = 0
+        break
+      }
+    }
+    if (process.exitCode === undefined) {
+      console.error(`✖ ${waitS}s 内未通过健康门,看日志:${LOG}`)
+      process.exitCode = 1
+    }
+  }
+}

package/scripts/_audit/guard-upstream-liveness.mjs

@@ -0,0 +1,104 @@
+/**
+ * 稳定性护栏端到端验证:外部设备不可达时,服务端**必须存活**。
+ *
+ * 复现的真实事故:一台 Modbus TCP 设备未启动(connect ECONNREFUSED 127.0.0.1:1502)
+ * 触发 unhandledRejection 走到 fatal 分支 → 整个生产实例 exit 1 →
+ * 数采/数控/数字孪生全平台被一台设备带走。
+ *
+ * 做法:
+ *  1. 建立指向**必然拒绝连接**的端口的 Modbus TCP 数采节点(默认 1502,可 --port 覆盖)
+ *  2. 等采集轮询真正发起连接(默认 25s)
+ *  3. 断言:健康门仍 200、进程未死、日志出现 upstream 分级记录
+ *
+ * 用法:node scripts/_audit/guard-upstream-liveness.mjs [--base http://127.0.0.1:3001] [--port 1502] [--wait 25] [--keep]
+ */
+const arg = (k, d) => {
+  const i = process.argv.indexOf(k)
+  return i >= 0 ? process.argv[i + 1] : d
+}
+const BASE = arg('--base', 'http://127.0.0.1:3001')
+const DEAD_PORT = Number(arg('--port', '1502'))
+const WAIT_S = Number(arg('--wait', '25'))
+const KEEP = process.argv.includes('--keep')
+const TOKEN = process.env.AW_E2E_TOKEN
+  ?? (await (await fetch(`${BASE}/api/users/login`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }),
+  })).json()).data.token
+
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const api = async (method, path, body) => {
+  const r = await fetch(BASE + path, {
+    method,
+    headers: { 'content-type': 'application/json', 'authorization': `Bearer ${TOKEN}` },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+  return r.json().catch(() => ({}))
+}
+
+let pass = 0
+let fail = 0
+const check = (name, ok, detail = '') => {
+  console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? ` — ${detail}` : ''}`)
+  ok ? pass++ : fail++
+}
+
+const health = async () => {
+  try {
+    const r = await fetch(`${BASE}/api/health`, { signal: AbortSignal.timeout(5000) })
+    const j = await r.json()
+    return { ok: r.ok && j?.data?.status === 'ok', version: j?.data?.version }
+  }
+  catch (e) {
+    return { ok: false, error: String(e?.message ?? e) }
+  }
+}
+
+console.log(`\n━━━ 稳定性护栏:外部设备不可达不应带走服务(设备端口 :${DEAD_PORT}) ━━━`)
+const before = await health()
+check('前置:服务健康', before.ok, `version=${before.version}`)
+
+// 1) 建一条指向死端口的 Modbus TCP 节点。字段形状对齐既有节点:
+//    templateRef 必填(信号模板)、地址走 driverConfig.register。
+const ts = Date.now()
+const line = await api('POST', '/api/workshop/dcw/lines', { name: `护栏验证线-${ts}`, productId: null })
+const lineId = line?.data?.line?.id ?? line?.data?.id
+check('创建验证产线', !!lineId, lineId ?? JSON.stringify(line).slice(0, 120))
+
+const node = await api('POST', '/api/workshop/daq', {
+  lineId,
+  name: `死端口节点-${ts}`,
+  templateRef: arg('--template', 'daq-temp-tc'),
+  driver: 'modbus-tcp',
+  unit: '℃',
+  intervalMs: 500,
+  enabled: true,
+  driverConfig: { host: '127.0.0.1', port: DEAD_PORT, unitId: 1, register: 40001, dataType: 'float32', byteOrder: 'big' },
+})
+const nodeId = node?.data?.node?.id ?? node?.data?.id
+check('创建指向必然拒绝连接端口的数采节点', !!nodeId, nodeId ?? JSON.stringify(node).slice(0, 200))
+
+// 2) 开跑,让轮询真正去连那个端口
+if (lineId) await api('POST', `/api/workshop/dcw/lines/${lineId}/start`, {})
+console.log(`  · 等待 ${WAIT_S}s 让采集轮询发起连接 ...`)
+await sleep(WAIT_S * 1000)
+
+// 3) 核心断言:服务还活着
+const after = await health()
+check('设备不可达后服务仍健康(修复前此处 exit 1)', after.ok, after.ok ? `version=${after.version}` : `unreachable: ${after.error}`)
+
+const opened = await api('GET', `/api/workshop/daq/${nodeId}/samples?from=${Date.now() - WAIT_S * 1000}&bucketMs=1000&limit=5`).catch(() => null)
+check('节点面仍可查询(平台未被带走)', opened !== null)
+
+// 4) 清理
+if (!KEEP && lineId) {
+  await api('POST', `/api/workshop/dcw/lines/${lineId}/stop`, {}).catch(() => null)
+  await api('DELETE', `/api/workshop/daq/${nodeId}`).catch(() => null)
+  await api('DELETE', `/api/workshop/dcw/lines/${lineId}`).catch(() => null)
+  console.log('  · 验证用产线/节点已清理')
+}
+else if (KEEP) console.log(`  · KEEP=1,保留现场:line=${lineId} node=${nodeId}`)
+
+console.log(`\n━━━ 结果:${pass} PASS / ${fail} FAIL ━━━\n`)
+process.exitCode = fail === 0 ? 0 : 1

package/scripts/_dbg-perms-e2e.mjs

@@ -70,13 +70,20 @@ const wr2 = await api(`/api/workshop/dcw/${w2.id}/write`, { method: 'POST', body
 ok('operate 产线写控放行', wr2.status === 200 && wr2.body?.data?.outcome != null, `ack=${JSON.stringify(wr2.body?.data?.outcome)?.slice(0, 60)}`)
 
 // ---- 绑定校验(daq 需 readonly+,dcw 需 operate) ----
+// 绑定主体是频道成员实例 id(0.7.37 绑定主体校验):plain 用户自建频道+成员,取实例 id
+const bindCh = await api('/api/workshop/channels', { method: 'POST', body: JSON.stringify({ name: `e2e-perms-ch-${Date.now()}`, leadAgent: { name: 'e2e-perms-lead', harness: 'mock' } }) }, plainTok)
+const bindTpl = await api('/api/workshop/agents', { method: 'POST', body: JSON.stringify({ name: 'e2e-perms-worker', harness: 'mock' }) }, plainTok)
+const bindJoin = await api(`/api/workshop/channels/${bindCh.body?.data?.channelId}/agents`, { method: 'POST', body: JSON.stringify({ agentId: bindTpl.body?.data?.id, role: 'worker' }) }, plainTok)
+const bindAgentId = bindJoin.body?.data?.id
+ok('plain 自建频道成员(绑定主体)', Boolean(bindAgentId), bindJoin.body?.message ?? '')
+
 const daqNodes = q1.body.data.nodes
 const dq1 = daqNodes.find(n => n.lineId === LINE1)
-const bindD = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: dq1.id, kind: 'daq' }) }, plainTok)
+const bindD = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: bindAgentId, nodeId: dq1.id, kind: 'daq' }) }, plainTok)
 ok('绑定 daq 节点(readonly 线)放行', bindD.status === 200, JSON.stringify(bindD.body?.message ?? ''))
-const bindW1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w1.id, kind: 'dcw' }) }, plainTok)
+const bindW1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: bindAgentId, nodeId: w1.id, kind: 'dcw' }) }, plainTok)
 ok('绑定 dcw 节点(readonly 线)被拒', bindW1.status === 403, bindW1.body?.message)
-const bindW2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w2.id, kind: 'dcw' }) }, plainTok)
+const bindW2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: bindAgentId, nodeId: w2.id, kind: 'dcw' }) }, plainTok)
 ok('绑定 dcw 节点(operate 线)放行', bindW2.status === 200)
 
 // ---- 越权访问无权产线节点(直接按 id 打,数据面不因列表隐藏而放行) ----