agentworkshop 0.7.51 → 0.7.53

package/scripts/_audit/kb-team-mock-e2e.mjs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+/**
+ * scripts/_audit/kb-team-mock-e2e.mjs —— 知识库集成 Channel + lead→worker 节点委派(mock 阶段验收)。
+ *
+ * 覆盖(无 LLM 依赖):
+ *  1) 模板知识库能力面:chtpl-generic-optimize-default / chtpl-aml-optimization-default 标记 knowledgeBaseCapable;
+ *  2) 实例化 enableKnowledgeBase=true → 频道插件开关含 rag-bridge=on,场景提示词含 KB 作业段;
+ *  3) 实例化 enableKnowledgeBase=false → rag-bridge=off;缺省 → 无显式行(平台默认);
+ *  4) 委派 REST:lead 绑定面内节点授予 worker(grantedByAgentId 溯源);
+ *  5) fail-closed:越面授予 403 / 授予 lead 自己 400;
+ *  6) 执行中授予:worker 有在飞任务时仍可被授予新节点;
+ *  7) 撤销:收回授予的节点;非 lead 授予且 lead 不持有的绑定不被误撤。
+ *
+ * 用法:AW_BASE=http://127.0.0.1:3456 node scripts/_audit/kb-team-mock-e2e.mjs
+ * 前置:全新实例(首注册即 admin)。脚本自行注册 admin 账号并搭一条 mock 产线。
+ */
+const BASE = process.env.AW_BASE ?? 'http://127.0.0.1:3456'
+const ADMIN = { email: process.env.AW_ADMIN_EMAIL ?? 'admin@awshop.local', password: process.env.AW_ADMIN_PASSWORD ?? 'Awshop@123!' }
+
+let pass = 0
+const fails = []
+const ok = (name, cond, detail = '') => {
+  if (cond) { pass++; console.log(`  PASS  ${name}${detail ? ` — ${detail}` : ''}`) }
+  else { fails.push(name); console.log(`  FAIL  ${name}${detail ? ` — ${detail}` : ''}`) }
+}
+const section = t => console.log(`\n━━━ ${t} ━━━`)
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+async function api(method, path, { body, token } = {}) {
+  const res = await fetch(BASE + path, {
+    method,
+    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+    body: body != null ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(30000),
+  })
+  const json = await res.json().catch(() => null)
+  return { status: res.status, json }
+}
+
+const TAG = `kbmock-${new Date().toISOString().slice(5, 16).replace(/[-T:]/g, '')}`
+
+async function main() {
+  section('S0 管理员就绪(全新实例首注册即 admin)')
+  const reg = await api('POST', '/api/users/register', { body: { ...ADMIN, name: 'kb-mock-admin' } })
+  const token = reg.json?.data?.token ?? (await api('POST', '/api/users/login', { body: { email: ADMIN.email, password: ADMIN.password } })).json?.data?.token
+  ok('管理员 token 可用', Boolean(token))
+  const auth = { token }
+
+  section('S1 模板知识库能力面')
+  const tplList = (await api('GET', '/api/workshop/channel-templates', auth)).json?.data ?? []
+  const generic = tplList.find(t => t.id === 'chtpl-generic-optimize-default')
+  const optTpl = tplList.find(t => t.id === 'chtpl-aml-optimization-default')
+  ok('内置模板存在「通用闭环优化频道(标准)」', Boolean(generic), generic?.name)
+  ok('通用模板标记 knowledgeBaseCapable', generic?.knowledgeBaseCapable === true)
+  ok('工艺优化通道标记 knowledgeBaseCapable', optTpl?.knowledgeBaseCapable === true)
+  ok('其他模板不带该标记', tplList.find(t => t.id === 'chtpl-default-fullstack')?.knowledgeBaseCapable !== true)
+
+  section('S2 实例化:enableKnowledgeBase=true → rag-bridge 开 + KB 作业段')
+  const inst1 = (await api('POST', '/api/workshop/channel-templates/chtpl-generic-optimize-default/instantiate', { body: { name: `${TAG}-kb-on`, enableKnowledgeBase: true }, ...auth })).json?.data
+  ok('通用频道实例化成功', Boolean(inst1?.channelId), `agents=${inst1?.agentCount}`)
+  const ch1 = (await api('GET', `/api/workshop/channels/${inst1.channelId}`, auth)).json?.data
+  ok('场景提示词含知识库作业段', String(ch1?.scenarioPrompt ?? '').includes('知识库集成') && String(ch1?.scenarioPrompt ?? '').includes('kb_agent'))
+  const plug1 = (await api('GET', `/api/workshop/channels/${inst1.channelId}/plugins`, auth)).json?.data
+  const rb1 = (Array.isArray(plug1?.plugins) ? plug1.plugins : plug1 ?? []).find?.(p => p?.name === 'rag-bridge')
+    ?? (Array.isArray(plug1) ? plug1 : []).find(p => p?.name === 'rag-bridge')
+  ok('频道插件开关含 rag-bridge=on', Boolean(rb1 && rb1.enabled !== false), JSON.stringify(rb1 ?? plug1 ?? {}).slice(0, 120))
+  const members1 = (await api('GET', `/api/workshop/channels/${inst1.channelId}/agents`, auth)).json?.data ?? []
+  ok('频道含 lead + worker', members1.some(m => m.role === 'lead') && members1.filter(m => m.role === 'worker').length >= 2, `members=${members1.length}`)
+
+  section('S3 实例化:enableKnowledgeBase=false 与缺省行为')
+  const inst2 = (await api('POST', '/api/workshop/channel-templates/chtpl-aml-optimization-default/instantiate', { body: { name: `${TAG}-kb-off`, enableKnowledgeBase: false }, ...auth })).json?.data
+  const plug2 = (await api('GET', `/api/workshop/channels/${inst2.channelId}/plugins`, auth)).json?.data
+  const flat2 = Array.isArray(plug2?.plugins) ? plug2.plugins : (Array.isArray(plug2) ? plug2 : [])
+  ok('显式 false → rag-bridge=off', flat2.some(p => p?.name === 'rag-bridge' && p.enabled === false), JSON.stringify(flat2).slice(0, 120))
+  const inst3 = (await api('POST', '/api/workshop/channel-templates/chtpl-aml-optimization-default/instantiate', { body: { name: `${TAG}-kb-default` }, ...auth })).json?.data
+  const plug3 = (await api('GET', `/api/workshop/channels/${inst3.channelId}/plugins`, auth)).json?.data
+  const flat3 = Array.isArray(plug3?.plugins) ? plug3.plugins : (Array.isArray(plug3) ? plug3 : [])
+  const rb3 = flat3.find(p => p?.name === 'rag-bridge')
+  ok('缺省 → rag-bridge 保持平台默认(未被显式停用)', !rb3 || rb3.enabled !== false, JSON.stringify(flat3).slice(0, 120))
+
+  section('S4 搭 mock 产线(建线 + 模板 + 数采/数控节点)')
+  const line = (await api('POST', '/api/workshop/dcw/lines', { body: { name: `KBMock线-${TAG}`, description: 'kb-team mock e2e' }, ...auth })).json?.data
+  const lineId = line?.line?.id ?? line?.id
+  ok('建线成功', Boolean(lineId), lineId)
+  const dcwTpl = (await api('POST', '/api/workshop/dcw/templates', { body: { name: `kbmock-sp-tpl-${TAG}`, ch: '温度设定', unit: '℃', min: 150, max: 220, decimals: 1 }, ...auth })).json?.data
+  const daqTpl = (await api('POST', '/api/workshop/daq/templates', { body: { name: `kbmock-temp-tpl-${TAG}`, ch: '温度', unit: '℃', min: 0, max: 300, decimals: 1 }, ...auth })).json?.data
+  const dcwTplRef = dcwTpl?.template?.key ?? dcwTpl?.key
+  const daqTplRef = daqTpl?.template?.key ?? daqTpl?.key
+  ok('节点模板创建成功', Boolean(dcwTplRef) && Boolean(daqTplRef), `dcw=${dcwTplRef} daq=${daqTplRef}`)
+  const dcw = (await api('POST', '/api/workshop/dcw', { body: { name: `kbmock-sp-${TAG}`, templateRef: dcwTplRef, driver: 'mock', unit: '℃', min: 150, max: 220, stepLimit: 5, lineId }, ...auth })).json
+  const daq = (await api('POST', '/api/workshop/daq', { body: { name: `kbmock-temp-${TAG}`, templateRef: daqTplRef, driver: 'mock', intervalMs: 1000, publishIntervalMs: 0, lineId }, ...auth })).json
+  const dcwId = dcw?.data?.node?.id
+  const daqId = daq?.data?.node?.id
+  ok('数采/数控节点创建成功', Boolean(daqId) && Boolean(dcwId), `daq=${daqId} dcw=${dcwId}`)
+
+  section('S5 lead 绑定 + 委派核心面')
+  const lead = members1.find(m => m.role === 'lead')
+  const worker = members1.find(m => m.role === 'worker')
+  const b1 = await api('POST', '/api/workshop/agent-tools/bindings', { body: { agentId: lead.id, nodeId: dcwId, kind: 'dcw', mode: 'manual' }, ...auth })
+  const b2 = await api('POST', '/api/workshop/agent-tools/bindings', { body: { agentId: lead.id, nodeId: daqId, kind: 'daq', mode: 'auto' }, ...auth })
+  ok('lead 绑定 dcw+daq 成功', b1.status === 200 && b2.status === 200, `dcw=${b1.status} daq=${b2.status}`)
+
+  const grant = await api('POST', '/api/workshop/agent-tools/bindings/grant', { body: { channelId: inst1.channelId, agentId: worker.id, nodeIds: [dcwId, daqId] }, ...auth })
+  ok('委派授予成功(整单)', grant.status === 200, JSON.stringify(grant.json?.data ?? grant.json).slice(0, 120))
+  const granted = grant.json?.data?.granted ?? []
+  ok('授予绑定带 lead 溯源', granted.length === 2 && granted.every(g => g.grantedByAgentId === lead.id), `n=${granted.length}`)
+  ok('dcw 委派缺省随 lead 的 manual 模式', granted.find(g => g.kind === 'dcw')?.mode === 'manual')
+  const workerBindings = (await api('GET', `/api/workshop/agent-tools/bindings?agentId=${worker.id}`, auth)).json?.data
+  const wbFlat = Array.isArray(workerBindings) ? workerBindings : (workerBindings?.bindings ?? [])
+  ok('worker 绑定面已含委派节点', wbFlat.some(b => b.nodeId === dcwId) && wbFlat.some(b => b.nodeId === daqId), `n=${wbFlat.length}`)
+
+  section('S6 fail-closed:越面授予 / 授予 lead 自己')
+  const bad = await api('POST', '/api/workshop/agent-tools/bindings/grant', { body: { channelId: inst1.channelId, agentId: worker.id, nodeIds: [`ghost-${TAG}`] }, ...auth })
+  const badCode = bad.json?.code ?? bad.json?.data?.code
+  ok('越面授予被拒(403 DELEGATION_NOT_OWNED)', bad.status === 403 && badCode === 'DELEGATION_NOT_OWNED', `status=${bad.status} code=${badCode}`)
+  const self = await api('POST', '/api/workshop/agent-tools/bindings/grant', { body: { channelId: inst1.channelId, agentId: lead.id, nodeIds: [dcwId] }, ...auth })
+  ok('授予 lead 自己被拒(400)', self.status === 400, `status=${self.status}`)
+
+  section('S7 执行中授予(worker 有在飞任务时仍可授权)')
+  const task = (await api('POST', `/api/workshop/channels/${inst1.channelId}/tasks`, { body: { title: `巡检-${TAG}`, description: '读取授权节点并汇报(委派执行中授予验证)', assigneeId: worker.id }, ...auth })).json?.data
+  ok('worker 根任务已创建', Boolean(task?.id), task?.id)
+  await sleep(500)
+  const midGrant = await api('POST', '/api/workshop/agent-tools/bindings/grant', { body: { channelId: inst1.channelId, agentId: worker.id, nodeIds: [dcwId], mode: 'auto' }, ...auth })
+  ok('执行中授予成功(模式覆盖 auto)', midGrant.status === 200, JSON.stringify(midGrant.json?.data ?? {}).slice(0, 100))
+  await api('POST', `/api/workshop/channels/${inst1.channelId}/tasks/${task.id}/cancel`, { ...auth }).catch(() => {})
+
+  section('S8 撤销')
+  const revoke = await api('POST', '/api/workshop/agent-tools/bindings/revoke', { body: { channelId: inst1.channelId, agentId: worker.id, nodeIds: [daqId] }, ...auth })
+  const results = revoke.json?.data?.results ?? []
+  ok('撤销 daq 委派成功', revoke.status === 200 && results.every(r => r.revoked), JSON.stringify(results).slice(0, 100))
+  const afterRevoke = (await api('GET', `/api/workshop/agent-tools/bindings?agentId=${worker.id}`, auth)).json?.data
+  const arFlat = Array.isArray(afterRevoke) ? afterRevoke : (afterRevoke?.bindings ?? [])
+  ok('撤销后 worker 不再持有该节点', !arFlat.some(b => b.nodeId === daqId), `剩余=${arFlat.length}`)
+
+  console.log(`\n════ 结果: ${pass} PASS / ${fails.length} FAIL ════`)
+  if (fails.length) {
+    console.log('失败项:')
+    for (const f of fails) console.log(`  - ${f}`)
+    process.exit(1)
+  }
+}
+
+main().catch((err) => {
+  console.error('E2E 致命异常:', err)
+  process.exit(1)
+})

package/scripts/_audit/kb-team-omp-e2e.mjs

@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+/**
+ * scripts/_audit/kb-team-omp-e2e.mjs —— 知识库集成通用闭环优化频道 × 真实 omp × 多 PLC 模拟场景。
+ *
+ * 每个 scenario:
+ *   ① 模拟器建场(ensureScenarioLine) + 平台建线开跑(provisionScenarioLine,真实协议链路);
+ *   ② 实例化「通用闭环优化频道(标准)」模板,enableKnowledgeBase=true(频道加载 rag-bridge);
+ *   ③ lead 绑定 PV 数采节点 + 调节数控节点(auto);
+ *   ④ 提交优化 goal(要求:先查知识库 → lead 委派节点权限 → 治理小步下发复测 → 判定 → 经验沉淀);
+ *   ⑤ 期间轮询任务/消息/事件,全程转录落盘(transcript.md + 原始 JSON);
+ *   ⑥ 验收:根任务收口 + worker 确实被授予节点(grantedBy 溯源) + 发生过治理写入
+ *      + PV 回带 + 知识库经验新增(kb_agent 异步落库)。
+ *
+ * 用法:
+ *   node scripts/_audit/kb-team-omp-e2e.mjs --base http://127.0.0.1:3456 --scenarios injection,wwtp
+ * 前置:目标实例为本仓库构建(内置通用模板 + rag-bridge);rag-bridge token 已配置(启 KB 鉴权时);
+ *       omp CLI 在 PATH 且可用;模拟器可自举(bench/lib/sim.mjs ensureSimulator)。
+ */
+import { join, dirname, resolve } from 'node:path'
+import { writeFileSync, appendFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { makeApi, ensureDir, sleep } from '../../bench/lib/util.mjs'
+import { ensureSimulator, simUp } from '../../bench/lib/sim.mjs'
+import { SCENARIOS, ensureScenarioLine, provisionScenarioLine, readPvMean } from '../../bench/lib/scenarios.mjs'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = resolve(HERE, '../..')
+const args = process.argv.slice(2)
+const arg = (k, d) => { const i = args.indexOf(`--${k}`); return i >= 0 ? (args[i + 1] ?? '') : d }
+
+const BASE = arg('base', process.env.AW_BASE ?? 'http://127.0.0.1:3456')
+const list = (arg('scenarios', 'injection') || 'injection').split(',').map(s => s.trim()).filter(id => SCENARIOS[id])
+const TASK_TIMEOUT_MS = Number(arg('timeout-min', '32')) * 60_000
+const KB_WAIT_MS = Number(arg('kb-wait-min', '6')) * 60_000
+const POLL_MS = 20_000
+const sfx = arg('sfx', `kb${new Date().toISOString().slice(5, 16).replace(/[-T:]/g, '')}`)
+
+const rid = `kb-team-omp-${new Date().toISOString().slice(0, 19).replace(/[-T:]/g, '')}`
+const outDir = ensureDir(join(REPO, 'bench', 'results', rid))
+console.log(`=== kb-team × omp 闭环优化 × 多场景 ===\nbase=${BASE} scenarios=${list.join(',')} out=${outDir}\n`)
+
+// ── 自举 ──
+if (!(await simUp())) {
+  const r = await ensureSimulator({ log: console.log })
+  if (!r.started && !(await simUp())) { console.error(`✘ 模拟器自举失败: ${r.reason}`); process.exit(1) }
+}
+const api = makeApi(BASE)
+const login = await api.login(process.env.AW_ADMIN_EMAIL ?? 'admin@awshop.local', process.env.AW_ADMIN_PASSWORD ?? 'Awshop@123!')
+if (!login.ok) { console.error('✘ 平台登录失败'); process.exit(1) }
+console.log(`平台就绪(${login.how},role=${login.role});模拟器就绪\n`)
+
+const globalResult = { rid, base: BASE, scenarios: [] }
+
+for (const id of list) {
+  const scen = SCENARIOS[id]
+  const dir = ensureDir(join(outDir, id))
+  const res = { scenario: id, zh: scen.zh, checks: {}, errors: [] }
+  globalResult.scenarios.push(res)
+  const log = (line) => { console.log(`[${id}] ${line}`); appendFileSync(join(dir, 'transcript.md'), `${line}\n`) }
+  writeFileSync(join(dir, 'transcript.md'), `# ${scen.zh}(kb-team × omp)作业转录\n\n- 开始: ${new Date().toISOString()}\n- 频道模板: chtl-generic-optimize-default(enableKnowledgeBase=true)\n\n`)
+
+  try {
+    // ── ① 建场 + 建线 ──
+    log(`① 模拟器建场 ${scen.key} …`)
+    const ensure = await ensureScenarioLine(scen)
+    log(`   设备=${ensure.verified.devices}/${ensure.verified.expectDevices} SP=${ensure.verified.sp} PV=${ensure.verified.pv} 协议=${ensure.verified.protocols.join('/')}`)
+    const line = await provisionScenarioLine(api, scen, { sfx: `${sfx}-${id}` })
+    if (line.errors?.length || !line.ids?.lineId) throw new Error(`建线失败: ${line.errors?.join(';')}`)
+    res.line = { lineId: line.ids.lineId, recipeId: line.ids.recipeId, started: line.ids.started, reused: line.reused }
+    log(`① 平台建线 ${line.lineName} started=${line.ids.started} dcw=${Object.keys(line.dcw).length} daq=${Object.keys(line.daq).length}`)
+
+    // ── ② 实例化 KB 通用频道 ──
+    const inst = (await api.call('POST', '/api/workshop/channel-templates/chtpl-generic-optimize-default/instantiate', {
+      name: `KB闭环优化-${scen.zh}-${sfx}-${id}`,
+      enableKnowledgeBase: true,
+    }))
+    const channelId = inst.data?.channelId
+    if (!channelId) throw new Error(`频道实例化失败: ${inst.message}`)
+    const agents = (await api.call('GET', `/api/workshop/channels/${channelId}/agents`)).data ?? []
+    const lead = agents.find(a => a.role === 'lead')
+    res.channel = { channelId, leadId: lead?.id, leadHarness: lead?.harness }
+    log(`② 频道 ${channelId} 已实例化(lead=${lead?.name}/${lead?.harness},成员=${agents.length})`)
+
+    // ── ③ lead 绑定 PV 数采 + 调节数控(auto) ──
+    const pvNode = line.daq[scen.pv.sig]
+    const knobSigs = (scen.knobs ?? []).map(k => k.sig).slice(0, 2)
+    const knobNodes = knobSigs.map(s => line.dcw[s]).filter(Boolean)
+    if (!pvNode || !knobNodes.length) throw new Error(`关键节点缺失: pv=${pvNode} knobs=${knobNodes}`)
+    for (const [nodeId, kind] of [[pvNode, 'daq'], ...knobNodes.map(n => [n, 'dcw'])]) {
+      const r = await api.call('POST', '/api/workshop/agent-tools/bindings', { agentId: lead.id, nodeId, kind, mode: 'auto' })
+      if (r.status !== 200) throw new Error(`lead 绑定失败 ${kind} ${nodeId}: ${r.message}`)
+    }
+    res.leadBindings = { pvNode, knobNodes }
+    log(`③ lead 绑定:daq(${scen.pv.sig})=${pvNode} dcw=${knobNodes.join(',')}`)
+
+    // ── ④ 提交 goal ──
+    const knobText = (scen.knobs ?? []).slice(0, 2).map(k => `${k.sig}`).join('、')
+    const guardText = (scen.guards ?? []).map(g => `${g.label}≤${g.max}`).join('、') || '无'
+    const goal = [
+      `【产线闭环优化】${scen.zh}:${scen.story}`,
+      `目标:把「${scen.pv.label}(${scen.pv.sig})」稳定控制回 ${scen.pv.target}±${scen.pv.tol}${scen.pv.unit} 目标带;守卫约束:${guardText}。`,
+      `可调手段(数控节点,治理下发):${knobText}。`,
+      `作业要求:`,
+      `1. 开工先查知识库:lead 用 kb_agent(mode=sync) 检索「${scen.zh} 数据分析」「${scen.pv.label} 物理机理与设定影响」,把检索结论作为寻优方向与步长依据;`,
+      `2. lead 把自己已绑定的节点授权授予 worker(dispatch_task 带 grant_node_ids 随任务授予,或 team_grant_nodes),确保工艺工程师与数据分析师各自拿到所需节点权限,不要无权限空转;`,
+      `3. 工艺工程师单变量小步调整(每步 ≤ 量程 2%,尊重单步限幅与写入间隔),每次调整后等 ${Math.round(scen.settleMs / 1000)}s 再 daq_query 复测「${scen.pv.label}」;`,
+      `4. 进入目标带且复测稳定后 dcw_judge 落判定(keep),lead 用 kb_agent(mode=async) 把本次经验沉淀入知识库(含调整前后参数值与响应数据),随后完成收口汇报。`,
+    ].join('\n')
+    const task = (await api.call('POST', `/api/workshop/channels/${channelId}/tasks`, { title: `${scen.zh}(KB 闭环)`, description: goal })).data
+    if (!task?.id) throw new Error(`根任务提交失败`)
+    res.rootTaskId = task.id
+    log(`④ 根任务 ${task.id} 已提交,开始作业(超时 ${Math.round(TASK_TIMEOUT_MS / 60000)}min)…\n`)
+
+    // ── ⑤ 轮询转录 ──
+    let seenMsg = new Set()
+    let seenTaskState = new Map()
+    let lastEventSeq = 0
+    let toolEvidence = { kbAgent: 0, grant: 0 }
+    const t0 = Date.now()
+    let terminal = null
+    const dump = async () => {
+      const msgs = (await api.call('GET', `/api/workshop/channels/${channelId}/messages?limit=200`)).data ?? []
+      for (const m of [...msgs].reverse()) {
+        const key = m.id ?? `${m.createdAt}:${m.fromAgentName}`
+        if (seenMsg.has(key)) continue
+        seenMsg.add(key)
+        const who = m.fromAgentName ?? m.from ?? '?'
+        const text = String(m.text ?? m.preview ?? '').slice(0, 600)
+        if (text.trim()) appendFileSync(join(dir, 'transcript.md'), `\n> **${who}** @ ${m.createdAt ?? ''}\n>\n${text.split('\n').map(l => `> ${l}`).join('\n')}\n`)
+      }
+      const tasks = (await api.call('GET', `/api/workshop/channels/${channelId}/tasks`)).data ?? []
+      const arr = Array.isArray(tasks) ? tasks : (tasks.tasks ?? [])
+      for (const t of arr) {
+        const st = `${t.id}:${t.state}:${t.progress ?? 0}`
+        if (seenTaskState.get(t.id) !== st) {
+          seenTaskState.set(t.id, st)
+          appendFileSync(join(dir, 'transcript.md'), `\n- [任务] ${t.id} 「${t.title}」 state=${t.state} progress=${t.progress ?? 0}% assignee=${t.assigneeId ?? '-'}`)
+        }
+      }
+      // 事件流:记录工具调用证据(kb_agent / team_grant_nodes / grant_node_ids)与 lead 进度报告
+      const ev = (await api.call('GET', `/api/workshop/channels/${channelId}/events?limit=200&afterSeq=${lastEventSeq}`)).data ?? {}
+      for (const item of (ev.items ?? [])) {
+        lastEventSeq = Math.max(lastEventSeq, Number(item.seq ?? 0))
+        const text = String(item.payload?.text ?? item.payload?.summary ?? '')
+        if (!text) continue
+        const kbHits = (text.match(/kb_agent/g) ?? []).length
+        const grantHits = (text.match(/team_grant_nodes|grant_node_ids/g) ?? []).length
+        toolEvidence.kbAgent += kbHits
+        toolEvidence.grant += grantHits
+        if (kbHits || grantHits) {
+          appendFileSync(join(dir, 'transcript.md'), `\n- [工具证据] @ ${(item.at ?? item.createdAt ?? '').slice(11, 19)} ${text.replace(/\n+/g, ' ').slice(0, 220)}`)
+        }
+      }
+      return { tasks: arr, msgs }
+    }
+    while (Date.now() - t0 < TASK_TIMEOUT_MS) {
+      await sleep(POLL_MS)
+      try {
+        const { tasks } = await dump()
+        const root = tasks.find(t => t.id === task.id)
+        if (root && ['COMPLETED', 'FAILED', 'CANCELED'].includes(root.state)) { terminal = root; break }
+        log(`… 作业中(${Math.round((Date.now() - t0) / 60000)}min)root=${root?.state ?? '?'}`)
+      }
+      catch (err) {
+        log(`… 轮询抖动(忽略): ${err?.message ?? err}`)
+      }
+    }
+    await dump()
+    if (!terminal) { res.errors.push(`根任务超时(${Math.round(TASK_TIMEOUT_MS / 60000)}min)未收口`) }
+    else if (terminal.state !== 'COMPLETED') { res.errors.push(`根任务终态=${terminal.state}`) }
+    res.checks.rootTaskClosed = terminal?.state === 'COMPLETED'
+    log(`\n⑤ 根任务终态=${terminal?.state ?? 'TIMEOUT'}`)
+
+    // ── ⑥ 验收 ──
+    const workers = agents.filter(a => a.role === 'worker')
+    let delegated = 0
+    for (const w of workers) {
+      const bs = (await api.call('GET', `/api/workshop/agent-tools/bindings?agentId=${w.id}`)).data
+      const flat = Array.isArray(bs) ? bs : (bs?.bindings ?? [])
+      if (flat.some(b => b.grantedByAgentId === lead.id)) delegated++
+    }
+    res.checks.workerDelegated = delegated > 0
+    log(`⑥ 委派核验:${delegated}/${workers.length} 个 worker 持有 lead 授予的节点授权`)
+
+    const dcwNow = (await api.call('GET', '/api/workshop/dcw')).data?.nodes ?? []
+    const myDcw = dcwNow.filter(n => Object.values(line.dcw).includes(n.id))
+    const wrote = myDcw.some(n => n.lastWriteAt)
+    res.checks.governedWriteHappened = wrote
+    res.dcAfter = myDcw.map(n => ({ id: n.id, name: n.name, value: n.value, lastWriteAt: n.lastWriteAt ?? null }))
+    log(`⑥ 治理写入核验:${wrote ? '发生过 dcw 治理写入' : '无 dcw 写入痕迹'}`)
+
+    const pvMean = await readPvMean(api, pvNode, 5).catch(() => null)
+    const inBand = pvMean != null && Math.abs(Number(pvMean) - scen.pv.target) <= scen.pv.tol
+    res.checks.pvInBand = inBand
+    res.pvMean = pvMean
+    log(`⑥ PV 复测:均值=${pvMean} 目标带=${scen.pv.target}±${scen.pv.tol} → ${inBand ? '达标' : '未达标'}`)
+
+    res.toolEvidence = toolEvidence
+    res.checks.kbToolUsed = toolEvidence.kbAgent > 0
+    res.checks.grantToolUsed = toolEvidence.grant > 0 || delegated > 0
+    log(`⑥ 工具证据(事件流):kb_agent×${toolEvidence.kbAgent} 委派×${toolEvidence.grant}`)
+
+    log(`⑥ 等待知识库经验沉淀可检索(≤${Math.round(KB_WAIT_MS / 60000)}min)…`)
+    const kbQuery = encodeURIComponent(`${scen.zh.slice(0, 6)} ${scen.pv.label} 经验`)
+    const kbDeadline = Date.now() + KB_WAIT_MS
+    let kbHit = false
+    while (Date.now() < kbDeadline) {
+      await sleep(45_000)
+      const sr = (await api.call('GET', `/api/plugins/rag-bridge/search?q=${kbQuery}&top_k=5`).catch(() => null))?.data
+      if ((sr?.total_results ?? 0) > 0 || (sr?.results ?? []).length > 0) { kbHit = true; break }
+      log(`   … 检索暂未命中(累计等待 ${Math.round((kbDeadline - Date.now()) / 60000)}min)`)
+    }
+    res.checks.kbExperience = kbHit
+    log(`⑥ 知识库经验检索:${kbHit ? '已检出本场景经验内容' : '超时未检出(检索面后端索引漂移时以转录工具证据为准)'}`)
+  }
+  catch (err) {
+    res.errors.push(String(err?.message ?? err))
+    log(`✘ 异常: ${err?.message ?? err}`)
+  }
+
+  res.ok = res.errors.length === 0 && Object.values(res.checks).every(Boolean)
+  log(`\n════ [${id}] 结果: ${res.ok ? 'PASS' : 'FAIL'} checks=${JSON.stringify(res.checks)}${res.errors.length ? ` errors=${res.errors.join(';')}` : ''}`)
+  writeFileSync(join(dir, 'final.json'), JSON.stringify(res, null, 2))
+}
+
+writeFileSync(join(outDir, 'kb-team-omp-result.json'), JSON.stringify(globalResult, null, 2))
+const allOk = globalResult.scenarios.every(s => s.ok)
+console.log(`\n════ 总结果: ${allOk ? '✅ 全场景 PASS' : '❌ 存在 FAIL'}(明细: ${outDir})`)
+process.exit(allOk ? 0 : 1)

package/server/api/mcp/workshop.ts

@@ -21,7 +21,8 @@ import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/
 import { createWorkshopMcpServer } from '../../mcp/workshop-server'
 import { getWorkshopManager } from '../../plugins/workshop'
 
-/** 会话注册表:sessionId → transport(stateful 会话状态保留) */
+/** 会话注册表:sessionId → transport(stateful 会话状态保留);上限防匿名刷爆内存 */
+const MAX_MCP_SESSIONS = 64
 const sessions = new Map<string, WebStandardStreamableHTTPServerTransport>()
 
 /** h3 event → web Request(跨 h3 1.x/2.x 兼容:不用版本互异的转换助手) */
@@ -65,6 +66,12 @@ export default defineEventHandler(async (event) => {
 
   // 新会话:预生成 sessionId,transport 在 initialize 时把它写入响应头
   if (!transport) {
+    if (sessions.size >= MAX_MCP_SESSIONS) {
+      return new Response(JSON.stringify({ error: 'TOO_MANY_SESSIONS', message: `MCP 会话数已达上限 ${MAX_MCP_SESSIONS}` }), {
+        status: 429,
+        headers: { 'content-type': 'application/json' },
+      })
+    }
     const newSessionId = randomUUID()
     transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: () => newSessionId,

package/server/api/metrics.ts

@@ -2,11 +2,13 @@
  * GET /api/metrics —— 运维指标端点(R4,production-readiness-plan)。
  *
  * text/plain 简易指标格式(键值行,Prometheus 可用 textfile/自定义采集器接入)。
- * 无鉴权:仅暴露聚合计数与时间戳,不含业务数据;内网部署语义。
+ * 鉴权:任意有效用户 token(Bearer)——聚合计数与时间戳不含业务数据,
+ * 但公网部署下不向匿名暴露运行面信息;采集器配 Token 头即可接入。
  * 只读 globalThis 单例(不主动实例化),服务未装配时输出 0 —— 首次抓取即合法。
  */
 import { defineEventHandler, setResponseHeader } from 'h3'
 import { getOps } from '../services/workshop/ops/ops'
+import { resolveUser } from './workshop/caller'
 
 interface MetricLine { name: string, help: string, value: number | string }
 
@@ -15,6 +17,7 @@ function fmt(lines: MetricLine[]): string {
 }
 
 export default defineEventHandler(async (event) => {
+  resolveUser(event)
   const g = globalThis as typeof globalThis & {
     __daqController?: { controllerState(): Record<string, number | boolean>, running?: boolean }
     __daqQueue?: { lost?: number }

package/server/api/plugins/[name]/[...path].ts

@@ -1,8 +1,9 @@
 /**
  * /api/plugins/:name/** —— 插件自注册 API 的转发层(exact-match)。
  * 插件经 ctx.route(method, path, handler) 注册;handler(event) 返回值由 nitro 序列化。
- * 鉴权:插件在入口声明 auth:'user' | 'admin' | 'agent-or-user' 时由转发层统一校验
- *   (缺省 'none' 保持开放,兼容既有插件/浏览器面板)。
+ * 鉴权:插件在入口声明 auth:'user' | 'admin' | 'agent-or-user' | 'none' 时由转发层统一校验。
+ *   安全默认 = 'user'(default-deny):未声明的插件不再匿名暴露,须显式声明 'none' 才开放
+ *   (公网部署基线;确需匿名的只读面由插件作者显式声明并承担暴露责任)。
  * 错误隔离:插件 handler 抛错 → 结构化日志(带插件归属)+ 干净 500 信封,不裸传堆栈。
  */
 import { defineEventHandler, createError, readBody } from 'h3'
@@ -16,7 +17,7 @@ export default defineEventHandler(async (event) => {
   const path = '/' + (event.context.params?.path ?? '').replace(/^\/+/, '')
   const rec = host.plugins.get(name)
   // 声明式鉴权门:在进入插件 handler 前统一校验(禁用插件的路由表已不含其路由,天然 404)
-  const authMode = String(rec?.auth ?? 'none')
+  const authMode = String(rec?.auth ?? 'user')
   if (authMode !== 'none') {
     try {
       if (authMode === 'admin') await requireAdmin(event)

package/server/api/system/backup/list.get.ts

@@ -0,0 +1,32 @@
+/**
+ * GET /api/system/backup/list —— 备份清单(admin):库快照文件 + JSON/配置束目录。
+ * 只列文件名与大小/时间,不回传内容;恢复操作 = 停实例后由运维手工替换(安全优先不给在线恢复 API)。
+ */
+import { readdirSync, statSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { defineApiHandler } from '../../../utils/response'
+import { requireAdmin } from '../../workshop/caller'
+import { ensureDataDir } from '@/shared/config/home.mjs'
+
+export default defineApiHandler(async (event) => {
+  requireAdmin(event)
+  const backupDir = resolve(ensureDataDir(), 'backups')
+  let entries: Array<{ name: string, kind: 'db' | 'files', bytes: number, mtime: string }> = []
+  try {
+    entries = readdirSync(backupDir, { withFileTypes: true }).flatMap((e) => {
+      const full = resolve(backupDir, e.name)
+      try {
+        const st = statSync(full)
+        return [{
+          name: e.name,
+          kind: (e.isDirectory() ? 'files' : 'db') as 'db' | 'files',
+          bytes: st.size,
+          mtime: st.mtime.toISOString(),
+        }]
+      }
+      catch { return [] }
+    }).sort((a, b) => b.mtime.localeCompare(a.mtime))
+  }
+  catch { /* 备份目录尚不存在 = 还没备过 */ }
+  return { backupDir, count: entries.length, entries: entries.slice(0, 200) }
+})

package/server/api/system/backup/run.post.ts

@@ -0,0 +1,21 @@
+/**
+ * POST /api/system/backup/run —— 手动触发一次全量备份(admin)。
+ * 复用 server/plugins/backup.ts 的 backupOnce(三库在线快照 + JSON/配置面 + 保留轮转),
+ * 成败均落 audit_log(system.backup.*)。
+ */
+import { defineApiHandler } from '../../../utils/response'
+import { requireAdmin } from '../../workshop/caller'
+import { AppError } from '../../../utils/errors'
+
+export default defineApiHandler(async (event) => {
+  requireAdmin(event)
+  const { backupOnce } = await import('../../../plugins/backup')
+  const { ensureDataDir } = await import('@/shared/config/home.mjs')
+  try {
+    await backupOnce(ensureDataDir())
+  }
+  catch (err) {
+    throw new AppError(500, 'BACKUP_FAILED', `备份失败: ${err instanceof Error ? err.message : String(err)}`)
+  }
+  return { ok: true, at: new Date().toISOString() }
+})

package/server/api/system/settings/index.patch.ts

@@ -10,13 +10,23 @@ import { readBody } from 'h3'
 import { defineApiHandler } from '../../../utils/response'
 import { requireRole } from '../../workshop/caller'
 import { getSystemConfigService } from '../../../services/system-config'
+import { recordOps } from '../../../services/workshop/ops/ops'
 
 export default defineApiHandler(async (event) => {
-  requireRole(event, ['admin'])
+  const user = requireRole(event, ['admin'])
   const body = (await readBody<Record<string, unknown>>(event)) ?? {}
   const overrides = body.override ?? body.overrides ?? body
   if (!overrides || typeof overrides !== 'object' || Array.isArray(overrides)) {
     return { ok: false, message: '请求体应为 { "override": { key: value } }' }
   }
-  return { ok: true, ...getSystemConfigService().patch(overrides as Record<string, unknown>) }
+  const res = getSystemConfigService().patch(overrides as Record<string, unknown>)
+  // 高危管理面留痕:改了哪些键(值不落审计——可能含凭据),谁改的
+  if (res.changed?.length) {
+    recordOps({
+      actor: user.id, actorName: user.name, actorKind: 'user',
+      action: 'system.settings.update', kind: 'system',
+      summary: `运行时设置变更:${res.changed.join(', ')}`,
+    })
+  }
+  return { ok: true, ...res }
 })

package/server/api/system/settings/reset.post.ts

@@ -5,8 +5,17 @@
 import { defineApiHandler } from '../../../utils/response'
 import { requireRole } from '../../workshop/caller'
 import { getSystemConfigService } from '../../../services/system-config'
+import { recordOps } from '../../../services/workshop/ops/ops'
 
 export default defineApiHandler((event) => {
-  requireRole(event, ['admin'])
-  return { ok: true, ...getSystemConfigService().reset() }
+  const user = requireRole(event, ['admin'])
+  const res = getSystemConfigService().reset()
+  if (res.changed?.length) {
+    recordOps({
+      actor: user.id, actorName: user.name, actorKind: 'user',
+      action: 'system.settings.reset', kind: 'system',
+      summary: `清空运行时覆盖(${res.changed.length} 键回落 config.yml)`,
+    })
+  }
+  return { ok: true, ...res }
 })

package/server/api/users/[id].delete.ts

@@ -2,10 +2,17 @@ import { getRouterParam } from 'h3'
 import { userService } from '../../services/user.service'
 import { defineApiHandler } from '../../utils/response'
 import { requireAdmin } from '../workshop/caller'
+import { recordOps } from '../../services/workshop/ops/ops'
 
 /** DELETE /api/users/:id —— 删除用户(仅 admin) */
 export default defineApiHandler((event) => {
-  requireAdmin(event)
+  const admin = requireAdmin(event)
   const id = getRouterParam(event, 'id') ?? ''
-  return userService.remove(id)
+  const res = userService.remove(id)
+  recordOps({
+    actor: admin.id, actorName: admin.name, actorKind: 'user',
+    action: 'user.delete', kind: 'system', targetKind: 'user', targetId: id,
+    summary: `删除用户 ${id}`,
+  })
+  return res
 })

package/server/api/users/[id].put.ts

@@ -4,11 +4,18 @@ import { userService } from '../../services/user.service'
 import { defineApiHandler } from '../../utils/response'
 import { zValidator } from '../../utils/validate'
 import { requireAdmin } from '../workshop/caller'
+import { recordOps } from '../../services/workshop/ops/ops'
 
 /** PUT /api/users/:id —— 更新用户（部分字段） */
 export default defineApiHandler(async (event) => {
-  requireAdmin(event)
+  const admin = requireAdmin(event)
   const id = getRouterParam(event, 'id') ?? ''
   const body = await readValidatedBody(event, zValidator(userUpdateSchema)) as UserUpdate
-  return userService.update(id, body)
+  const user = userService.update(id, body)
+  recordOps({
+    actor: admin.id, actorName: admin.name, actorKind: 'user',
+    action: 'user.update', kind: 'system', targetKind: 'user', targetId: id,
+    summary: `更新用户 ${id}(字段:${Object.keys(body).join(', ')})`,
+  })
+  return user
 })

package/server/api/users/index.post.ts

@@ -4,10 +4,17 @@ import { userService } from '../../services/user.service'
 import { defineApiHandler } from '../../utils/response'
 import { zValidator } from '../../utils/validate'
 import { requireAdmin } from '../workshop/caller'
+import { recordOps } from '../../services/workshop/ops/ops'
 
 /** POST /api/users —— 创建用户 */
 export default defineApiHandler(async (event) => {
-  requireAdmin(event)
+  const admin = requireAdmin(event)
   const body = await readValidatedBody(event, zValidator(userCreateSchema)) as UserCreate
-  return userService.create(body)
+  const user = userService.create(body)
+  recordOps({
+    actor: admin.id, actorName: admin.name, actorKind: 'user',
+    action: 'user.create', kind: 'system', targetKind: 'user', targetId: user.id,
+    summary: `创建用户 ${user.name}(${user.role})`,
+  })
+  return user
 })

package/server/api/users/login.post.ts

@@ -1,11 +1,11 @@
-import { readValidatedBody } from 'h3'
+import { getRequestIP, readValidatedBody } from 'h3'
 import { userLoginSchema, type UserLogin } from '../../schemas/user.schema'
 import { userService } from '../../services/user.service'
 import { defineApiHandler } from '../../utils/response'
 import { zValidator } from '../../utils/validate'
 
-/** POST /api/users/login —— 公开登录（email + password），签发新会话 token */
+/** POST /api/users/login —— 公开登录（email + password），签发新会话 token;带 IP 供防爆破锁定 */
 export default defineApiHandler(async (event) => {
   const body = await readValidatedBody(event, zValidator(userLoginSchema)) as UserLogin
-  return userService.login(body)
+  return userService.login(body, { ip: getRequestIP(event, { xForwardedFor: true }) ?? '' })
 })