agentworkshop 0.7.44 → 0.7.46

package/scripts/test-task-lease-fencing.ts

@@ -0,0 +1,154 @@
+/**
+ * 确定性验证:任务执行租约与运行中重分配栅栏(设计文档 §5.1/§5.2)+
+ * 根任务 FIFO 完整性(§2.1)与 Channel 过程记忆事件契约(§7.1/§7.2)。
+ *
+ * 覆盖的验收项:
+ *  - §2.1 root 一律获得 root_queue_seq(含人类直发 worker 的 root);
+ *  - §5.1 每次新分配/重分配产生新的 assignmentGeneration + executionLeaseId;
+ *  - §5.2 运行中 reassign:旧 lease 撤销、generation+1、旧 worker 迟到事件被丢弃、
+ *    新 worker 收到新 assign;终态任务租约撤销;
+ *  - §7.1 事件名契约(root.created/root.queued/child.dispatched/...)可由状态机派生。
+ */
+import { openWorkshopDb } from '../server/services/workshop/db/database'
+import { createChannelRepo } from '../server/services/workshop/db/channel.repo'
+import { createAgentRepo } from '../server/services/workshop/db/agent.repo'
+import { createTaskRepo } from '../server/services/workshop/db/task.repo'
+import { createMessageRepo } from '../server/services/workshop/db/message.repo'
+import { TaskEngine } from '../server/services/workshop/runtime/task-engine'
+import { fenceFromMetadata, fenceMatches } from '../server/services/workshop/runtime/task-engine/lease'
+import { AppError } from '../server/utils/errors'
+
+let failures = 0
+const check = (name: string, ok: boolean, detail = '') => {
+  console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!ok) failures += 1
+}
+
+const db = openWorkshopDb(':memory:')
+const channels = createChannelRepo(db)
+const agents = createAgentRepo(db)
+const tasks = createTaskRepo(db)
+const messages = createMessageRepo(db)
+const changes: Array<{ taskId: string, state?: string, reassignFrom?: string }> = []
+const engine = new TaskEngine({ tasks, messages }, { onTaskChange: e => changes.push({ taskId: e.taskId, state: e.state, reassignFrom: e.reassignFrom }) })
+
+const channel = channels.create({ name: 'lease' })
+const lead = agents.create({ name: 'lead', harness: 'mock' })
+const alice = agents.create({ name: 'alice', harness: 'mock' })
+const bob = agents.create({ name: 'bob', harness: 'mock' })
+
+// ===== §2.1 root 队列序号:即使调用方显式传 null 也必须发号 =====
+const explicitNullRoot = engine.create({
+  channelId: channel.id,
+  creatorId: lead.id,
+  assigneeId: alice.id,
+  title: '直发 worker 的 root',
+  rootQueueSeq: null,
+})
+check('§2.1 显式 null 的 root 仍获得 root_queue_seq', typeof explicitNullRoot.rootQueueSeq === 'number', `seq=${explicitNullRoot.rootQueueSeq}`)
+const queueAfterNull = engine.rootQueue(channel.id)
+check('§2.1 该 root 出现在 rootQueue 中(不被 IS NOT NULL 过滤)',
+  queueAfterNull.activeRoot?.id === explicitNullRoot.id || queueAfterNull.queuedRoots.some(t => t.id === explicitNullRoot.id))
+
+// ===== §5.1 创建即持有租约 =====
+check('§5.1 创建任务即产生 generation/lease',
+  explicitNullRoot.assignmentGeneration === 0 && !!explicitNullRoot.executionLeaseId
+  && explicitNullRoot.executionLeaseAgentId === alice.id && !explicitNullRoot.executionLeaseRevokedAt,
+  `gen=${explicitNullRoot.assignmentGeneration} lease=${explicitNullRoot.executionLeaseId?.slice(0, 8)}`)
+
+// ===== §5.2 运行中重分配 =====
+engine.transition(explicitNullRoot.id, 'WORKING', alice.id)
+const before = engine.get(explicitNullRoot.id)!
+const moved = engine.reassignRunning(explicitNullRoot.id, bob.id, lead.id, 'WORKER_STALLED')
+check('§5.2 运行中重分配改变执行者', moved.task.assigneeId === bob.id && moved.previousAssigneeId === alice.id)
+check('§5.2 generation +1', (moved.task.assignmentGeneration ?? 0) === (before.assignmentGeneration ?? 0) + 1)
+check('§5.2 lease 换新且持有者=新 worker',
+  !!moved.task.executionLeaseId && moved.task.executionLeaseId !== before.executionLeaseId
+  && moved.task.executionLeaseAgentId === bob.id && !moved.task.executionLeaseRevokedAt)
+check('§5.2 任务状态不变(仅执行权转移)', moved.task.state === 'WORKING')
+check('§7.1 重分配发出事件(旧/新 assignee 可追溯)', changes.some(c => c.taskId === explicitNullRoot.id && c.reassignFrom === alice.id))
+
+// ===== §5.2 旧 worker 迟到事件被丢弃 =====
+const staleFence = { generation: before.assignmentGeneration ?? 0, leaseId: before.executionLeaseId }
+const currentFence = { generation: moved.task.assignmentGeneration ?? 0, leaseId: moved.task.executionLeaseId }
+check('§5.2 旧 worker 栅栏被判定过期', !engine.assertAssignmentFence(explicitNullRoot.id, staleFence))
+check('§5.2 新 worker 栅栏被接受', engine.assertAssignmentFence(explicitNullRoot.id, currentFence))
+
+const artifactsBefore = engine.get(explicitNullRoot.id)!.artifacts.length
+engine.applyEvent(explicitNullRoot.id, {
+  kind: 'artifact',
+  artifact: { artifactId: 'late-artifact', name: 'deliverable', parts: [{ text: '旧 worker 的迟到交付' }] },
+  lastChunk: true,
+  totalChunks: 1,
+}, staleFence)
+check('§5.2 旧 worker 迟到 artifact 不写入任务', engine.get(explicitNullRoot.id)!.artifacts.length === artifactsBefore)
+
+engine.applyEvent(explicitNullRoot.id, {
+  kind: 'artifact',
+  artifact: { artifactId: 'new-artifact', name: 'deliverable', parts: [{ text: '新 worker 的交付' }] },
+  lastChunk: true,
+  totalChunks: 1,
+}, currentFence)
+check('§5.2 新 worker artifact 正常写入', engine.get(explicitNullRoot.id)!.artifacts.some(a => a.artifactId === 'new-artifact'))
+
+// ===== 无栅栏的历史任务放行(升级兼容) =====
+const legacy = engine.create({ channelId: channel.id, creatorId: lead.id, assigneeId: alice.id, title: '历史无租约任务' })
+tasks.update(legacy.id, { executionLeaseId: null, assignmentGeneration: 0 })
+check('升级兼容:无 lease 任务对任意栅栏放行', engine.assertAssignmentFence(legacy.id, { generation: 99, leaseId: 'ghost' }))
+
+// ===== 分配消息携带栅栏 =====
+const deliverChannel = channels.create({ name: 'lease-delivery' })
+const parent = engine.create({ channelId: deliverChannel.id, creatorId: lead.id, assigneeId: lead.id, title: '父任务' })
+engine.transition(parent.id, 'WORKING', lead.id)
+const child = engine.dispatch(parent, { assigneeId: alice.id, title: '子任务' })
+const pending = messages.listPendingByChannelAgent(deliverChannel.id, alice.id)
+const assignMsg = pending.find(m => m.taskId === child.id)
+const assignMeta = JSON.parse(assignMsg?.metadataJson ?? '{}') as Record<string, unknown>
+const fence = fenceFromMetadata(assignMeta)
+check('§5.1 assign 投递携带 generation/lease',
+  !!fence && fence.leaseId === engine.get(child.id)!.executionLeaseId && fence.generation === 0,
+  `lease=${fence?.leaseId?.slice(0, 8)}`)
+check('§5.1 栅栏与当前任务匹配', !!fence && fenceMatches(engine.get(child.id)!, fence))
+
+// ===== §5.1 终态撤销租约 =====
+engine.transition(child.id, 'WORKING', alice.id)
+engine.applyEvent(child.id, {
+  kind: 'artifact',
+  artifact: { artifactId: 'child-deliverable', name: 'deliverable', parts: [{ text: 'done' }] },
+  lastChunk: true,
+  totalChunks: 1,
+}, fence)
+engine.complete(child.id)
+const done = engine.get(child.id)!
+check('§5.1 终态任务租约被撤销', done.state === 'COMPLETED' && !!done.executionLeaseRevokedAt)
+
+// ===== §10 Root identity:并发/重复提交仍只有一个 canonical root =====
+const rootA = engine.createOrGetRoot({ channelId: channel.id, creatorId: lead.id, assigneeId: lead.id, title: 'A', sourceChatMessageId: 'm-1' })
+const rootB = engine.createOrGetRoot({ channelId: channel.id, creatorId: lead.id, assigneeId: lead.id, title: 'A-改名', sourceChatMessageId: 'm-1' })
+check('同 source 不同标题 → 同一 canonical root', rootA.task.id === rootB.task.id && rootB.created === false)
+
+// ===== §5.2 队列中(非运行中)重分配仍走原路径 =====
+const queued = engine.createOrGetRoot({ channelId: channel.id, creatorId: lead.id, assigneeId: lead.id, title: 'B', sourceChatMessageId: 'm-2' })
+const queuedBefore = engine.get(queued.task.id)!
+const queuedMoved = engine.reassign(queued.task.id, alice.id, 'QUEUED_REASSIGN')
+check('排队态按 §5.1 也换发新 lease',
+  queuedMoved.assigneeId === alice.id
+  && queuedMoved.executionLeaseId !== queuedBefore.executionLeaseId
+  && (queuedMoved.assignmentGeneration ?? 0) === (queuedBefore.assignmentGeneration ?? 0) + 1)
+
+// ===== 运行中重分配对同一目标幂等(不反复作废自己的 lease) =====
+const again = engine.reassignRunning(explicitNullRoot.id, bob.id, lead.id, 'LEAD_REASSIGN')
+check('§5.2 同目标重复决策幂等', again.task.executionLeaseId === moved.task.executionLeaseId)
+
+// ===== 非运行中任务不得走 reassignRunning =====
+try {
+  engine.reassignRunning(queued.task.id, bob.id, lead.id, 'X')
+  check('§5.2 非运行中任务拒绝 reassignRunning', false)
+}
+catch (err) {
+  check('§5.2 非运行中任务拒绝 reassignRunning', err instanceof AppError && (err as AppError).code === 'INVALID_STATE')
+}
+
+db.close()
+if (failures > 0) process.exitCode = 1
+else console.log('ALL PASS')

package/scripts/test-terminal-e2e.mjs

@@ -8,7 +8,7 @@
  *  A4. /api/system/monitor:mock agent process=null(in-proc),无 omp 进程行
  *
  * Phase B — omp 环境(简单任务全链路,rpc-ui HITL):
- *  B1. WS 鉴权负例(无 token → USER_UNAUTHORIZED;不存在 pid → NO_SESSION)
+ *  B1. WS 鉴权负例(无 token → USER_UNAUTHORIZED;不存在 pid → NO_SESSION / FORBIDDEN_TERMINAL)
  *  B2. omp lead channel + 任务 → 进程 spawn;monitor 进程行 terminal:true
  *  B3. terminals 端点返回该成员会话(agentId 寻址数据源)
  *  B4. WS agentId 连接:term.init(meta 归属)+ 帧流回放(会话事件)
@@ -82,8 +82,10 @@ const api = async (method, path, { body, token } = {}) => {
 }
 
 async function registerUser(label) {
+  // name 与 email 都带唯一后缀:固定名字在复用同一实例重跑时会 409 USER_EXISTS
+  const suffix = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`
   const user = await api('POST', '/api/users/register', {
-    body: { email: `${label}-${Date.now().toString(36)}@test.local`, password: 'Passw0rd!123', name: label },
+    body: { email: `${label}-${suffix}@test.local`, password: 'Passw0rd!123', name: `${label}-${suffix}` },
   })
   const token = user.data?.token
   if (!token) throw new Error(`用户注册失败: ${JSON.stringify(user).slice(0, 160)}`)
@@ -165,7 +167,11 @@ async function phaseOmp() {
   {
     const t = openTerminalWs(`pid=999999&token=${token}`)
     const closed = await t.waitClose()
-    check('B1 有效 token + 不存在 pid → NO_SESSION', closed && t.messages.some(m => m.type === 'term.error' && m.code === 'NO_SESSION'))
+    // v17 §13.2:授权核对先于会话存在性 —— 非 admin 对无法归属 Channel 的 pid 只能拿到 FORBIDDEN_TERMINAL(不泄露进程是否存在);
+    // 二者皆为"优雅拒绝",不建立会话。
+    check('B1 有效 token + 不存在 pid → NO_SESSION / FORBIDDEN_TERMINAL',
+      closed && t.messages.some(m => m.type === 'term.error' && (m.code === 'NO_SESSION' || m.code === 'FORBIDDEN_TERMINAL')),
+      t.messages.map(m => m.code ?? m.type).join(','))
   }
   {
     const t = openTerminalWs(`token=${token}`)

package/scripts/three-system-e2e/lib.mjs

@@ -0,0 +1,79 @@
+/**
+ * 配置(BASE/KB/KBWEB/DIAG/FULL/ROOT/DCW_NODE/通道名)/ 断言与计数 / HTTP 辅助
+ * (由 scripts/three-system-e2e.mjs 按职责拆出;内容逐行原文搬运)
+ */
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+// 本文件位于 scripts/three-system-e2e/(比原入口 scripts/ 深一层)→ 上溯两级仍为仓库根
+export const ROOT = resolve(__dirname, '..', '..')
+export const FULL = process.argv.includes('--full')
+
+export const BASE = process.env.AW_BASE ?? 'http://localhost:3021'
+export const KB = process.env.KB_BASE ?? 'http://127.0.0.1:8770'
+export const KBWEB = process.env.KB_WEB ?? 'http://127.0.0.1:6789'
+export const DIAG = process.env.DIAG_BASE ?? 'http://127.0.0.1:3210'
+export const DCW_NODE = process.env.E2E_DCW_NODE ?? 'dw-e92bb0e7' // 压力设定器(mock 驱动)
+export const CH_A = '产线数据分析组'
+export const CH_B = '闭环控制组'
+
+// 计数器保持模块内可变:跨模块 `export let` 会被 import/no-mutable-exports 拒绝,
+// 且可变绑定被多个模块直接改容易失控。外部读快照用 counters(),记一次失败用 countFail()。
+let pass = 0
+let fail = 0
+const failures = []
+
+export function counters() {
+  return { pass, fail, failures }
+}
+
+/** 记一次失败而不打印断言行(阶段级兜底用) */
+export function countFail(label) {
+  fail += 1
+  failures.push(label)
+}
+
+export function ok(cond, label, detail = '') {
+  if (cond) {
+    pass++
+    console.log(`  ✔ ${label}${detail ? ` —— ${detail}` : ''}`)
+  }
+  else {
+    fail++
+    failures.push(label)
+    console.error(`  ✘ ${label}${detail ? ` —— ${detail}` : ''}`)
+  }
+}
+export const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+export async function raw(method, url, { body, token, agent, timeoutMs = 20000 } = {}, retried = 0) {
+  const headers = {}
+  if (body !== undefined) headers['content-type'] = 'application/json'
+  if (token) headers.authorization = `Bearer ${token}`
+  if (agent) headers['x-aw-agent-token'] = agent.token
+  let res
+  try {
+    res = await fetch(url, {
+      method, headers,
+      body: body !== undefined ? JSON.stringify(body) : undefined,
+      signal: AbortSignal.timeout(timeoutMs),
+    })
+  }
+  catch (e) {
+    // 瞬时网络抖动(代理/服务重启窗口)重试一次,避免整场 e2e 因单点超时中止
+    if (retried < 1) {
+      await sleep(1500)
+      return raw(method, url, { body, token, agent, timeoutMs }, retried + 1)
+    }
+    throw e
+  }
+  const json = await res.json().catch(() => null)
+  return { status: res.status, json }
+}
+export const api = (method, path, opts = {}) => raw(method, `${BASE}${path}`, opts)
+export const envelopeData = r => r?.json?.data
+export const resultText = r => String(r?.json?.data?.result?.text ?? '')
+export const invoke = (agent, tool, args, timeoutMs = 60000) => api('POST', '/api/workshop/agent-tools/invoke', {
+  agent, timeoutMs, body: { agentId: agent.id, tool, args },
+})

package/scripts/three-system-e2e/main.mjs

@@ -0,0 +1,40 @@
+/**
+ * 主流程:按序执行各阶段(0 → 0a2 → 0b → 0c → Stage 1 → 2 → 2.5 → 3 → 4)并汇总
+ * (由 scripts/three-system-e2e.mjs 按职责拆出;语句逐行原文搬运,仅跨模块引用/状态访问机械改写)
+ *
+ * 阶段顺序、断言调用顺序与退出码语义与原脚本一致;阶段内异常**不吞**(不设阶段级 try/catch),
+ * 与原顶层线性脚本「异常即终止」的语义一致 —— 由入口薄壳统一兜底打印并 exit(1)。
+ */
+import { FULL, counters } from './lib.mjs'
+import { getRunId } from './state.mjs'
+import { run as phase0UserToken } from './phases/phase-0-user-token.mjs'
+import { run as phase0a2LineAutoselect } from './phases/phase-0a2-line-autoselect.mjs'
+import { run as phase0bFixtureGrants } from './phases/phase-0b-fixture-grants.mjs'
+import { run as phase0cPluginOutboundAuth } from './phases/phase-0c-plugin-outbound-auth.mjs'
+import { run as stage1Health } from './phases/stage-1-health.mjs'
+import { run as stage2TeamsToolsHitl } from './phases/stage-2-teams-tools-hitl.mjs'
+import { run as stage2_5TeamPlugins } from './phases/stage-2-5-team-plugins.mjs'
+import { run as stage3Diag } from './phases/stage-3-diag.mjs'
+import { run as stage4PluginToggle } from './phases/stage-4-plugin-toggle.mjs'
+
+export async function main() {
+  await phase0UserToken()
+  await phase0a2LineAutoselect()
+  await phase0bFixtureGrants()
+  await phase0cPluginOutboundAuth()
+  await stage1Health()
+  await stage2TeamsToolsHitl()
+  await stage2_5TeamPlugins()
+  await stage3Diag()
+  await stage4PluginToggle()
+
+  // ══ 汇总 ══════════════════════════════════════════════════════════════════
+  const { pass, fail, failures } = counters()
+  console.log(`\n══ 结果:${pass} 通过 / ${fail} 失败 ══`)
+  if (failures.length) {
+    console.error('失败项:')
+    for (const f of failures) console.error(`  - ${f}`)
+  }
+  if (!FULL && getRunId()) console.log(`\n提示:本次发起的诊断 runId=${getRunId()},完成可加 --full 重跑或调 diag_status 观察。`)
+  process.exit(fail > 0 ? 1 : 0)
+}

package/scripts/three-system-e2e/phases/phase-0-user-token.mjs

@@ -0,0 +1,42 @@
+/**
+ * 0. 用户 token(持久化演示账号 → env → 现场注册)—— 原 L83–116
+ * (由 scripts/three-system-e2e.mjs 按职责拆出;语句逐行原文搬运,仅跨模块引用/状态访问机械改写)
+ */
+import { readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { ROOT, api, ok } from '../lib.mjs'
+import { getUserId, getUserToken, setUserId, setUserToken } from '../state.mjs'
+
+export async function run() {
+  console.log('\n══ 三系统集成 e2e ══')
+  const TOKEN_FILE = join(ROOT, '.AgentWorkShop', 'data', '.three-system-e2e-token.json')
+  try {
+    const saved = JSON.parse(readFileSync(TOKEN_FILE, 'utf8'))
+    setUserToken(saved.token ?? '')
+    setUserId(saved.uid ?? '')
+  }
+  catch { /* 首跑 */ }
+  if (getUserToken()) {
+    // 持久化 token 可能已随 users.sqlite 重建失效 → 先验证,失效则现场重新注册
+    const me = await api('GET', '/api/workshop/users/me', { token: getUserToken() })
+    if (me.status !== 200) {
+      console.log('  · 持久化 token 已失效,重新注册 e2e 用户')
+      setUserToken('')
+      setUserId('')
+    }
+  }
+  if (!getUserToken() && process.env.AW_E2E_TOKEN) setUserToken(process.env.AW_E2E_TOKEN)
+  if (!getUserToken()) {
+    const name = `e2e3sys-${Date.now().toString(36)}`
+    const reg = await api('POST', '/api/workshop/users/register', { body: { name } })
+    setUserToken(reg?.json?.data?.token ?? '')
+    setUserId(reg?.json?.data?.id ?? '')
+    try {
+      writeFileSync(TOKEN_FILE, JSON.stringify({ token: getUserToken(), uid: getUserId(), name }))
+    }
+    catch { /* 忽略 */ }
+    ok(Boolean(getUserToken()), '注册 e2e 用户拿 token', getUserToken() ? 'ok' : `resp=${JSON.stringify(reg.json).slice(0, 120)}`)
+    if (!getUserToken()) process.exit(1)
+  }
+  else { console.log('  · 复用持久化演示账号 token') }
+}

package/scripts/three-system-e2e/phases/phase-0a2-line-autoselect.mjs

@@ -0,0 +1,35 @@
+/**
+ * 0a2. 目标产线自适应 —— 原 L118–142
+ * (由 scripts/three-system-e2e.mjs 按职责拆出;语句逐行原文搬运,仅跨模块引用/状态访问机械改写)
+ *
+ * 未显式指定 E2E_LINE 时,自动选「最近 10 分钟有采样」且节点最多的产线:
+ * 数采按产线批次门控:无活动批次的产线没有样本,写死的默认线会随环境漂移而误报
+ * (快照导出 rows=0 / diag_run「该时窗内无数采样本」)。
+ */
+import { api } from '../lib.mjs'
+import { getLINE, getUserToken, setLINE } from '../state.mjs'
+
+export async function run() {
+  if (!process.env.E2E_LINE) {
+    try {
+      const daq = await api('GET', '/api/workshop/daq', { token: getUserToken() })
+      const nodes = daq?.json?.data?.nodes ?? []
+      const now = Date.now()
+      const byLine = new Map()
+      for (const n of nodes) {
+        if (!n.lineId || n.lastAt == null) continue
+        if (now - Date.parse(n.lastAt) > 10 * 60_000) continue
+        byLine.set(n.lineId, (byLine.get(n.lineId) ?? 0) + 1)
+      }
+      const best = [...byLine.entries()].sort((a, b) => b[1] - a[1])[0]
+      if (best) {
+        setLINE(best[0])
+        console.log(`  · 自动选定采样中的产线 ${getLINE()}(新鲜节点 ${best[1]} 个)`)
+      }
+      else {
+        console.log('  ! 未发现采样中的产线,沿用默认线(相关采样断言可能失败)')
+      }
+    }
+    catch { /* 探测失败保持默认线 */ }
+  }
+}

package/scripts/three-system-e2e/phases/phase-0b-fixture-grants.mjs

@@ -0,0 +1,39 @@
+/**
+ * 0b. 夹具种子:e2e 用户对目标产线 operate 授权(users.sqlite 直插,测试专用)—— 原 L144–171
+ * (由 scripts/three-system-e2e.mjs 按职责拆出;语句逐行原文搬运,仅跨模块引用/状态访问机械改写)
+ */
+import { DatabaseSync } from 'node:sqlite'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { ROOT } from '../lib.mjs'
+import { getLINE, getUserId } from '../state.mjs'
+
+export async function run() {
+  try {
+    const dbPath = join(ROOT, '.AgentWorkShop', 'data', 'users.sqlite')
+    if (!existsSync(dbPath)) throw new Error(`users.sqlite 不存在: ${dbPath}`)
+    let uid = getUserId()
+    if (!uid) {
+      const db = new DatabaseSync(dbPath)
+      db.exec('PRAGMA busy_timeout=4000')
+      const cand = db.prepare('SELECT id FROM users ORDER BY created_at DESC LIMIT 200').all()
+        .find(() => true) // 兜底:下面按 token 哈希反查不可行,直接用最新 e2e 用户
+      uid = cand?.id ?? ''
+      db.close()
+    }
+    if (uid) {
+      const db2 = new DatabaseSync(dbPath)
+      db2.exec('PRAGMA busy_timeout=4000')
+      db2.prepare(`INSERT OR REPLACE INTO user_line_grants (user_id, line_id, mode, granted_by, granted_at) VALUES (?, ?, 'operate', 'three-system-e2e', ?)`)
+        .run(uid, getLINE(), new Date().toISOString())
+      db2.close()
+      console.log(`  · 已为用户 ${uid} 种入产线 ${getLINE()} operate 授权(测试夹具)`)
+    }
+    else {
+      console.log('  ! 未能取得 user id,产线授权未种(相关断言可能失败)')
+    }
+  }
+  catch (err) {
+    console.log(`  ! 授权夹具异常(继续): ${err?.message ?? err}`)
+  }
+}

package/scripts/three-system-e2e/phases/phase-0c-plugin-outbound-auth.mjs

@@ -0,0 +1,95 @@
+/**
+ * 0c. 插件出站鉴权夹具:rag-knowledge(MCP token)+ 诊断服务(API token)→ 写入系统配置 —— 原 L173–254
+ * (由 scripts/three-system-e2e.mjs 按职责拆出;语句逐行原文搬运,仅跨模块引用/状态访问机械改写)
+ *
+ * rag-knowledge(MCP token)+ 诊断服务(API token)→ 写入系统配置:
+ * 两外部服务默认开启鉴权(rag-knowledge server.auth / IDD AUTH_ENABLED!==0),
+ * rag-bridge/diag-bridge 的出站 token 走前端全局配置(plugins.kb.token / plugins.diag.token),
+ * 此处拿真实 token 后经 PATCH /api/system/settings 配置 —— 同时验证「配置界面 → 插件热生效」链路。
+ */
+import { DatabaseSync } from 'node:sqlite'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { BASE, DIAG, ROOT, api, ok, raw, sleep } from '../lib.mjs'
+import { getUserToken, setKbTokenG } from '../state.mjs'
+
+export async function run() {
+  try {
+    // admin 夹具:注册临时用户 → users.sqlite 直改 role=admin(resolveUser 按请求查库,即时生效)
+    let adminToken = process.env.AW_E2E_ADMIN_TOKEN ?? ''
+    if (!adminToken) {
+      const adminName = `e2e3sys-admin-${Date.now().toString(36)}`
+      const reg = await api('POST', '/api/workshop/users/register', { body: { name: adminName } })
+      adminToken = reg?.json?.data?.token ?? ''
+      const adminId = reg?.json?.data?.id ?? ''
+      if (adminToken && adminId) {
+        const dbPath = join(ROOT, '.AgentWorkShop', 'data', 'users.sqlite')
+        const db = new DatabaseSync(dbPath)
+        db.exec('PRAGMA busy_timeout=4000')
+        db.prepare('UPDATE users SET role = \'admin\' WHERE id = ?').run(adminId)
+        db.close()
+        console.log(`  · admin 夹具就绪(${adminName} → role=admin)`)
+      }
+      else {
+        console.log('  ! admin 夹具注册失败,系统配置断言将跳过')
+      }
+    }
+    if (adminToken) {
+      // ① rag-knowledge MCP token:优先 env,否则读 rag-knowledge .env
+      let kbToken = process.env.KB_MCP_TOKEN ?? ''
+      if (!kbToken) {
+        const kbRoot = process.env.KB_ROOT ?? 'D:/codes/ClaudeGPT/rag_project/rag-knowledge'
+        try {
+          const envText = readFileSync(join(kbRoot, '.env'), 'utf8')
+          kbToken = (envText.match(/^MCP_AUTH_TOKEN=(.+)$/m) ?? [])[1]?.trim() ?? ''
+        }
+        catch { /* .env 不可读 */ }
+      }
+      setKbTokenG(kbToken)
+      // ② 诊断服务 token:优先 env,否则在 IDD 上注册 e2e 账号换会话 JWT
+      let diagToken = process.env.IDD_API_TOKEN ?? ''
+      if (!diagToken) {
+        const iu = `e2e3sys_${Date.now().toString(36)}`
+        const ipw = `E2e3sys${Date.now().toString(36)}a1`
+        const reg = await raw('POST', `${DIAG}/api/auth/register`, { body: { username: iu, password: ipw, email: `${iu}@e2e.local` } })
+        if (!reg.json?.data?.user) console.log(`  ! 诊断服务注册失败:${JSON.stringify(reg.json).slice(0, 120)}`)
+        const login = await raw('POST', `${DIAG}/api/auth/login`, { body: { username: iu, password: ipw } })
+        diagToken = login.json?.data?.session_token ?? login.json?.session_token ?? ''
+        if (!diagToken) console.log('  ! 诊断服务注册/登录未取得 token(3210 鉴权断言可能失败)')
+        else console.log('  · 诊断服务 e2e 账号 + 会话 token 就绪')
+      }
+      const patch = {}
+      if (kbToken) patch['plugins.rag-bridge.token'] = kbToken
+      if (diagToken) patch['plugins.diag-bridge.token'] = diagToken
+      if (Object.keys(patch).length) {
+        const set = await api('PATCH', '/api/system/settings', { token: adminToken, body: { override: patch } })
+        ok(set.status === 200 && set.json?.data?.ok !== false, '插件出站 token 写入系统配置(PATCH /api/system/settings)', `keys=${Object.keys(patch).join(',')}`)
+        if (set.status === 200) {
+          // 配置即时查询回读 + 插件侧热生效(diag-bridge health.auth 应变 bearer)
+          let hot = false
+          for (let i = 0; i < 10 && !hot; i++) {
+            await sleep(1000)
+            const h = await raw('GET', `${BASE}/api/plugins/diag-bridge/health`, { token: getUserToken() })
+            if (h.json?.auth === 'bearer') hot = true
+          }
+          ok(hot, 'diag-bridge 热读取新 token(配置保存 → 插件即时生效,免重启)')
+        }
+      }
+      if (kbToken) {
+        // rag-bridge 出站鉴权链路:带 token 后 catalog/建库应成功(kb.id 就绪)
+        let kbReady = false
+        let kbDetail = ''
+        for (let i = 0; i < 12 && !kbReady; i++) {
+          await sleep(2500)
+          const h = await raw('GET', `${BASE}/api/plugins/rag-bridge/health`, { token: getUserToken() })
+          kbDetail = `kb.id=${h.json?.kb?.id} auth=${h.json?.auth}`
+          if (h.json?.kb?.id) kbReady = true
+        }
+        ok(kbReady, 'rag-bridge 带 token 打通 rag-knowledge(ensureKB 自愈 → kb.id 就绪)', kbDetail)
+      }
+    }
+  }
+  catch (err) {
+    console.log(`  ! 插件出站鉴权夹具异常(继续): ${err?.message ?? err}`)
+  }
+}

package/scripts/three-system-e2e/phases/stage-1-health.mjs

@@ -0,0 +1,47 @@
+/**
+ * Stage 1:四服务健康 + 插件装载 + 鉴权门 —— 原 L256–293
+ * (由 scripts/three-system-e2e.mjs 按职责拆出;语句逐行原文搬运,仅跨模块引用/状态访问机械改写)
+ *
+ * 原阶段的裸块 `{ ... }` 已由本 run() 的函数体取代(其作用只是给阶段划作用域)。
+ */
+import { BASE, DIAG, KB, KBWEB, api, envelopeData, ok, raw } from '../lib.mjs'
+import { getKbTokenG, getUserToken } from '../state.mjs'
+
+export async function run() {
+  console.log('\n── Stage 1 系统与插件健康 ──')
+
+  const awsGate = await api('GET', '/api/workshop/plugins')
+  ok(awsGate.status === 401, 'AWS 3021 活着(无 token 401 信封)', `status=${awsGate.status}`)
+
+  const kbH = await raw('GET', `${KB}/api/v1/health`)
+  ok(kbH.json?.status === 'healthy', 'rag-knowledge 后端 8770 healthy', JSON.stringify(kbH.json))
+  // web catalog:服务端开启鉴权时无 token 401,带 MCP token 应 success(两种部署形态都接受)
+  const kbWebNoAuth = await raw('GET', `${KBWEB}/api/kb/catalog`)
+  const kbWeb = await raw('GET', `${KBWEB}/api/kb/catalog`, { token: getKbTokenG() || undefined })
+  ok(kbWeb.json?.success === true || (kbWebNoAuth.status === 401 && kbWebNoAuth.json?.error),
+    'rag-knowledge web 6789 catalog 可用(鉴权形态:无 token 401 / 带 token success)',
+    `noAuth=${kbWebNoAuth.status} withToken=${kbWeb.status} count=${kbWeb.json?.count}`)
+  const dgH = await raw('GET', `${DIAG}/api/health`)
+  ok(dgH.json?.status === 'ok', '诊断服务 3210 healthy', `activeRuns=${dgH.json?.checks?.activeRuns}`)
+  const rgH = await raw('GET', 'http://127.0.0.1:8764/health', { timeoutMs: 5000 }).catch(e => ({ json: { status: String(e) } }))
+  ok(rgH.json?.status === 'healthy', '诊断 RAG 引擎 8764 healthy(降级容忍)', JSON.stringify(rgH.json ?? {}))
+
+  const plugs = await api('GET', '/api/workshop/plugins', { token: getUserToken() })
+  // 兼容两种形状:顶层 {plugins:[...]}(插件清单端点未包信封)/ 信封 data.plugins
+  const list = plugs.json?.plugins ?? envelopeData(plugs)?.plugins ?? []
+  const names = list.map(p => p?.name)
+  const enabled = n => list.find(p => p?.name === n)?.enabled === true
+  ok(Array.isArray(list) && list.length > 0, '插件清单可读', list.length ? `count=${list.length}` : `resp=${JSON.stringify(plugs.json).slice(0, 160)}`)
+  ok(names.includes('rag-bridge'), 'rag-bridge 已装载')
+  ok(names.includes('diag-bridge'), 'diag-bridge 已装载')
+  ok(enabled('rag-bridge') && enabled('diag-bridge'), '两桥接插件均为启用态')
+
+  const noAuthRag = await raw('GET', `${BASE}/api/plugins/rag-bridge/health`)
+  const noAuthDiag = await raw('GET', `${BASE}/api/plugins/diag-bridge/health`)
+  ok(noAuthRag.status === 401 && noAuthDiag.status === 401, '插件路由鉴权门生效(auth:user → 无 token 401)', `rag=${noAuthRag.status} diag=${noAuthDiag.status}`)
+
+  const ragH = await raw('GET', `${BASE}/api/plugins/rag-bridge/health`, { token: getUserToken() })
+  ok(ragH.status === 200 && ragH.json?.outbound === true && ragH.json?.kb?.id, 'rag-bridge 健康(kb.id 就绪)', `kb=${ragH.json?.kb?.id}`)
+  const diagH = await raw('GET', `${BASE}/api/plugins/diag-bridge/health`, { token: getUserToken() })
+  ok(diagH.status === 200 && diagH.json?.remote?.status === 'ok', 'diag-bridge 健康(3210 可达)', `activeRuns=${diagH.json?.remote?.activeRuns}`)
+}