agentworkshop 0.7.51 → 0.7.53

package/server/api/users/register.post.ts

@@ -1,11 +1,21 @@
 import { readValidatedBody } from 'h3'
 import { userRegisterSchema, type UserRegister } from '../../schemas/user.schema'
 import { userService } from '../../services/user.service'
+import { userRepository } from '../../repositories/user.repository'
+import { settingOf } from '../../services/workshop/settings'
+import { AppError } from '../../utils/errors'
 import { defineApiHandler } from '../../utils/response'
 import { zValidator } from '../../utils/validate'
 
-/** POST /api/users/register —— 公开注册（name + email + password），签发首个 token */
+/**
+ * POST /api/users/register —— 公开注册（name + email + password），签发首个 token。
+ * 公网部署闸门:security.allowRegistration=false 且首管理员已就位时关闭自助注册
+ * (首 admin 引导不受此门限制;默认 true 保持"用户可自助注册"的产品语义)。
+ */
 export default defineApiHandler(async (event) => {
+  if (settingOf('security.allowRegistration') === false && userRepository.hasActiveAdmin()) {
+    throw new AppError(403, 'REGISTRATION_CLOSED', '自助注册已关闭(security.allowRegistration=false),请联系管理员开通账号')
+  }
   const body = await readValidatedBody(event, zValidator(userRegisterSchema)) as UserRegister
   return userService.register(body)
 })

package/server/api/workshop/a2a/[agentId]/rpc/index.post.ts

@@ -246,7 +246,7 @@ function bearerTokenOf(event: H3Event): string | undefined {
   return match?.[1]?.trim()
 }
 
-/** 取消任务:优先 token 关联 agent;无 caller 时以任务所在 channel 的 lead 作为系统身份 */
+/** 取消任务:一律以 Bearer token 关联的 agent 身份(无 token 一律 401,不再以 lead 系统身份回退) */
 async function cancelTaskWithCaller(
   manager: AgentChannelManager,
   event: H3Event,
@@ -254,13 +254,23 @@ async function cancelTaskWithCaller(
 ): Promise<WorkspaceTask> {
   const token = bearerTokenOf(event)
   const caller = token ? manager.findByToken(token) : undefined
-  if (caller) return manager.cancelTask(caller.channelId, caller.id, { taskId })
-  const task = internalsOf(manager).getTaskEngine().get(taskId)
-  if (!task) throw new AppError(404, 'NOT_FOUND', `任务不存在: ${taskId}`)
-  const agents = await manager.listChannelAgents(task.channelId)
-  const lead = agents.find(a => a.role === 'lead')
-  if (!lead) throw new AppError(400, 'NO_LEAD_AGENT', `channel ${task.channelId} 无 lead,无法以系统身份取消`)
-  return manager.cancelTask(lead.channelId, lead.id, { taskId })
+  if (!caller) throw new AppError(401, 'UNAUTHORIZED', 'tasks/cancel 需要有效 Agent token(Authorization: Bearer)')
+  return manager.cancelTask(caller.channelId, caller.id, { taskId })
+}
+
+/**
+ * A2A 统一身份门:Bearer token 必须有效,且 URL agent 与 caller 同 channel
+ * (编排器以自己 token 调同 channel 其他 agent 的端点是合法流;跨 channel/匿名一律拒绝)。
+ * 返回 URL 指向的目标 agent(作用域身份)。
+ */
+function requireA2ACaller(manager: AgentChannelManager, event: H3Event, agentId: string): AgentInfo {
+  const token = bearerTokenOf(event)
+  const caller = token ? manager.findByToken(token) : undefined
+  if (!caller) throw new AppError(401, 'UNAUTHORIZED', 'A2A 调用需要有效 Agent token(Authorization: Bearer)')
+  const target = findAgent(manager, agentId)
+  if (!target) throw new AppError(404, 'NOT_FOUND', `Agent not found: ${agentId}`)
+  if (target.channelId !== caller.channelId) throw new AppError(403, 'FORBIDDEN', 'A2A 目标 agent 与 token 身份不在同一 channel')
+  return target
 }
 
 // ===== SSE(tasks/sendSubscribe) =====
@@ -342,35 +352,35 @@ async function dispatch(
 ): Promise<unknown> {
   switch (method) {
     case 'tasks/send': {
+      const agent = requireA2ACaller(manager, event, agentId)
       const p = parseParams(sendParamsSchema, params)
-      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
       const task = await submitTask(manager, agent, p)
       const final = await waitTerminal(manager, task.id)
       return ok(id, toA2ATask(final))
     }
     case 'tasks/sendSubscribe': {
+      const agent = requireA2ACaller(manager, event, agentId)
       const p = parseParams(sendParamsSchema, params)
-      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
       const stream = createEventStream(event)
       void runSubscribe(stream, manager, agent, p)
       // h3 EventStream 必须经 send() 激活(否则被当普通对象 JSON 序列化,SSE 从未生效)
       return stream.send()
     }
     case 'tasks/get': {
+      const agent = requireA2ACaller(manager, event, agentId)
       const p = parseParams(taskIdParamsSchema, params)
-      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
       const task = await manager.getTask(agent.channelId, agent.id, p.taskId)
       return ok(id, toA2ATask(task))
     }
     case 'tasks/list': {
+      const agent = requireA2ACaller(manager, event, agentId)
       parseParams(noopParamsSchema, params)
-      const agent = findAgent(manager, agentId) ?? fail(-32001, `Agent not found: ${agentId}`)
       const tasks = await manager.listTasks(agent.channelId, agent.id)
       return ok(id, tasks.map(toA2ATask))
     }
     case 'tasks/cancel': {
       const p = parseParams(taskIdParamsSchema, params)
-      if (!findAgent(manager, agentId)) fail(-32001, `Agent not found: ${agentId}`)
+      requireA2ACaller(manager, event, agentId)
       const canceled = await cancelTaskWithCaller(manager, event, p.taskId)
       return ok(id, toA2ATask(canceled))
     }

package/server/api/workshop/agent-tools/bindings/grant.post.ts

@@ -0,0 +1,45 @@
+/**
+ * POST /api/workshop/agent-tools/bindings/grant —— lead 把自己绑定的节点授权给同频道 worker。
+ * body: { channelId, agentId(worker 成员实例), nodeIds: string[], mode?: 'auto'|'manual' }
+ * 硬约束:nodeIds 每一个都必须在频道 lead 的绑定面内(权限不可超越授予者);全成全败。
+ * 产线权限随绑定继承(lead 绑定建立时已校验);绑定带 grantedByAgentId/grantedAt 溯源。
+ * 鉴权:channel 归属者(遗留公共 channel 需 admin)。
+ */
+import { readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { applyDelegation, planDelegation } from '@/server/services/workshop/agents/node-delegation'
+import type { DelegationMember } from '@/server/services/workshop/agents/node-delegation'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const body = await readBody<{ channelId?: string, agentId?: string, nodeIds?: string[], mode?: 'auto' | 'manual' }>(event) ?? {}
+  const channelId = String(body.channelId ?? '')
+  const agentId = String(body.agentId ?? '')
+  const nodeIds = Array.isArray(body.nodeIds) ? body.nodeIds.map(x => String(x ?? '').trim()).filter(Boolean) : []
+  if (!channelId || !agentId || !nodeIds.length) {
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, 'channelId / agentId / nodeIds 必填')
+  }
+  const manager = getWorkshopManager()
+  const channel = manager.getChannelForUser(channelId, user.id)
+  if (channel?.ownerUserId === null) {
+    const { requireAdmin } = await import('@/server/api/workshop/caller')
+    requireAdmin(event)
+  }
+  const row = (await manager.listChannels()).find(c => c.id === channelId)
+  if (!row?.leadAgentId) throw new AppError(404, ErrorCodes.NOT_FOUND, `频道不存在或没有 lead: ${channelId}`)
+
+  const members = await manager.listChannelAgents(channelId) as unknown as DelegationMember[]
+  const plan = planDelegation({
+    leaderAgentId: row.leadAgentId,
+    channelId,
+    targetAgentId: agentId,
+    nodeIds,
+    members,
+    mode: body.mode,
+  })
+  const bindings = applyDelegation(plan, row.leadAgentId)
+  return { granted: bindings }
+})

package/server/api/workshop/agent-tools/bindings/revoke.post.ts

@@ -0,0 +1,42 @@
+/**
+ * POST /api/workshop/agent-tools/bindings/revoke —— lead 收回授予给 worker 的节点授权。
+ * body: { channelId, agentId(worker 成员实例), nodeIds: string[] }
+ * 可收回:lead 自己授予的(grantedByAgentId=lead)或 lead 也持有的节点绑定;
+ * 其余绑定原样保留并在结果中标注 revoked=false。
+ * 鉴权:channel 归属者(遗留公共 channel 需 admin)。
+ */
+import { readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { revokeDelegation } from '@/server/services/workshop/agents/node-delegation'
+import type { DelegationMember } from '@/server/services/workshop/agents/node-delegation'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const body = await readBody<{ channelId?: string, agentId?: string, nodeIds?: string[] }>(event) ?? {}
+  const channelId = String(body.channelId ?? '')
+  const agentId = String(body.agentId ?? '')
+  const nodeIds = Array.isArray(body.nodeIds) ? body.nodeIds.map(x => String(x ?? '').trim()).filter(Boolean) : []
+  if (!channelId || !agentId || !nodeIds.length) {
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, 'channelId / agentId / nodeIds 必填')
+  }
+  const manager = getWorkshopManager()
+  const channel = manager.getChannelForUser(channelId, user.id)
+  if (channel?.ownerUserId === null) {
+    const { requireAdmin } = await import('@/server/api/workshop/caller')
+    requireAdmin(event)
+  }
+  const row = (await manager.listChannels()).find(c => c.id === channelId)
+  if (!row?.leadAgentId) throw new AppError(404, ErrorCodes.NOT_FOUND, `频道不存在或没有 lead: ${channelId}`)
+
+  const members = await manager.listChannelAgents(channelId) as unknown as DelegationMember[]
+  const results = revokeDelegation({
+    leaderAgentId: row.leadAgentId,
+    targetAgentId: agentId,
+    nodeIds,
+    members,
+  })
+  return { results }
+})

package/server/api/workshop/channel-templates/[id]/instantiate.post.ts

@@ -23,6 +23,9 @@ const instantiateSchema = z.object({
   scenePackId: z.string().min(1).optional(),
   optimizationMode: z.enum(['exploration', 'aml']).optional(),
   boundModelId: z.string().min(1).optional(),
+  enableKnowledgeBase: z.boolean().optional(),
+  /** v18:实例化即绑定产线(只读扩权:成员可读该线日志/配方/历史/状态;写仍走节点授权) */
+  bindLineId: z.string().min(1).optional(),
 })
 
 export default defineApiHandler(async (event) => {
@@ -30,11 +33,15 @@ export default defineApiHandler(async (event) => {
   const user = resolveUser(event)
   const body = await readValidatedBody(event, zValidator(instantiateSchema))
   const manager = getWorkshopManager()
-  const result = await manager.instantiateChannelTemplate(templateId, user, body.name, { scene: body.scene, promptVariables: body.promptVariables, objective: body.objective, toolProfile: body.toolProfile, controlPolicy: body.controlPolicy, providerId: body.providerId, providerVersion: body.providerVersion, providerHash: body.providerHash, scenePackId: body.scenePackId, optimizationMode: body.optimizationMode, boundModelId: body.boundModelId })
+  const result = await manager.instantiateChannelTemplate(templateId, user, body.name, { scene: body.scene, promptVariables: body.promptVariables, objective: body.objective, toolProfile: body.toolProfile, controlPolicy: body.controlPolicy, providerId: body.providerId, providerVersion: body.providerVersion, providerHash: body.providerHash, scenePackId: body.scenePackId, optimizationMode: body.optimizationMode, boundModelId: body.boundModelId, enableKnowledgeBase: body.enableKnowledgeBase })
   // 模板含 lead 时直接启动调度循环(可提交任务)
   if (result.leadAgentId) {
     ensureLeadSchedulerLoop(manager, result.channelId)
   }
+  // v18:实例化即绑定产线(新频道 owner = 实例化者;产线存在性在 bindChannelLine 内校验)
+  if (body.bindLineId) {
+    await manager.bindChannelLine(result.channelId, body.bindLineId)
+  }
   // 常驻事件录制器(与 channels.post 同口径):确保无人 WS 订阅前事件也已持久化
   const { ensureStream } = await import('../../ws')
   ensureStream(manager, result.channelId)

package/server/api/workshop/channels/[id]/line.put.ts

@@ -0,0 +1,30 @@
+/**
+ * PUT /api/workshop/channels/:id/line —— 绑定/解绑产线(v18)。
+ * body: { "lineId": "<产线id>" | null }  (null/缺省 = 解绑)
+ *
+ * 只读扩权语义:绑定后频道成员无需节点绑定即可读取该产线的运维日志(ops_log)、
+ * 配方变更史(recipe_log/recipe_versions)与实时全景(line_context:运行状态/活动
+ * 批次/当前配方);参数下发等写操作仍必须走节点授权,不受绑定影响。
+ * 权限:channel owner / admin(与 PATCH channel 同一守卫)。
+ * 绑定变更回收成员运行时,下次装配注入产线简报(与场景 prompt 变更同链路)。
+ */
+import { z } from 'zod'
+import { getRouterParam, readValidatedBody } from 'h3'
+import { resolveUser } from '../../caller'
+import { zValidator } from '../../../../utils/validate'
+import { defineApiHandler } from '../../../../utils/response'
+import { getWorkshopManager } from '../../../../plugins/workshop'
+
+const bindLineSchema = z.object({
+  lineId: z.string().trim().nullable().optional(),
+})
+
+export default defineApiHandler(async (event) => {
+  const channelId = getRouterParam(event, 'id')!
+  const user = resolveUser(event)
+  const body = await readValidatedBody(event, zValidator(bindLineSchema))
+  const manager = getWorkshopManager()
+  manager.requireChannelOwner(channelId, user, 'channel')
+  const channel = await manager.bindChannelLine(channelId, body.lineId ?? '')
+  return { ok: true, lineId: channel.lineId, channel }
+})

package/server/api/workshop/dcw/line/query.get.ts

@@ -23,6 +23,12 @@ export default defineApiHandler(async (event) => {
     const n = Number(v)
     return v != null && v !== '' && Number.isFinite(n) ? n : undefined
   }
+  // 边界健壮性:超大有限数/负数会打穿下游(SQLite OFFSET/负 LIMIT 等)→ 500;在门口校验成 400
+  for (const [k, v] of [['from', num(q.from)], ['to', num(q.to)], ['bucketMs', num(q.bucketMs)], ['limit', num(q.limit)]] as const) {
+    if (v !== undefined && (!Number.isSafeInteger(v) || v < 0)) {
+      throw new AppError(400, 'VALIDATION_ERROR', `查询参数 ${k} 必须为非负安全整数`)
+    }
+  }
   const result = await getDcwController().lineQuery({
     lineId: q.lineId ? String(q.lineId) : undefined,
     productId: q.productId ? String(q.productId) : undefined,

package/server/api/workshop/dcw/recipes/[id]/revert.post.ts

@@ -3,13 +3,14 @@
  * 生成新版本(非破坏;历史完整保留)。body: { version?: number, toLastGood?: boolean, reason: string }。
  */
 import { getRouterParam, readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
+import { requireRole } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { AppError, ErrorCodes } from '@/server/utils/errors'
 
 export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
+  // 与 apply/rollback-good 同一角色门:配方回退是产线写操作,admin/editor 专属
+  const user = requireRole(event)
   const id = getRouterParam(event, 'id') ?? ''
   const body = await readBody<{ version?: number, toLastGood?: boolean, reason?: string }> (event) ?? {}
   if (!body.toLastGood && body.version == null) {

package/server/api/workshop/fs/dirs.get.ts

@@ -10,12 +10,25 @@ import { getQuery } from 'h3'
 import { resolveUser } from '../caller'
 import { AppError } from '../../../utils/errors'
 import { defineApiHandler } from '../../../utils/response'
+import { resolveRunMode } from '@/shared/config/home.mjs'
+import { isPathInside } from '@/sdk/index.mjs'
+
+/** 允许浏览的根:项目检出根 + 生效配置根 + 数据目录(文件选择器只服务这些工作区) */
+function allowedRoots(): string[] {
+  const rm = resolveRunMode({ cwd: process.cwd(), env: process.env })
+  return [...new Set([process.cwd(), rm.configRoot, rm.dataDir].map(r => resolve(r)))]
+}
 
 export default defineApiHandler(async (event) => {
   resolveUser(event)
   const q = getQuery(event)
   const raw = typeof q.path === 'string' ? q.path.trim() : ''
   const cwd = raw ? resolve(raw) : process.cwd()
+  const roots = allowedRoots()
+  // 越权防护:任意绝对路径列举整盘目录是公网部署下的信息泄露面,锁定到工作区白名单根内
+  if (!roots.some(r => cwd === r || isPathInside(r, cwd))) {
+    throw new AppError(403, 'FS_OUT_OF_ROOT', 'path 必须位于项目根或配置根内')
+  }
   let entries: import('node:fs').Dirent[]
   try {
     entries = readdirSync(cwd, { withFileTypes: true })
@@ -35,6 +48,11 @@ export default defineApiHandler(async (event) => {
       return { name: e.name, path: full, hasChildren }
     })
     .sort((a, b) => a.name.localeCompare(b.name))
-  const parent = dirname(cwd) !== cwd ? dirname(cwd) : null
+  // parent 链同样不许逃出白名单根(到根即断,防止逐级上探)
+  const parent = (() => {
+    const up = dirname(cwd)
+    if (up === cwd) return null
+    return roots.some(r => up === r || isPathInside(r, up)) ? up : null
+  })()
   return { cwd, parent, isAbsoluteRoot: !isAbsolute(cwd), dirs }
 })

package/server/api/workshop/ops-logs/index.get.ts

@@ -4,13 +4,14 @@
  * 返回 { logs: [...], count }。行结构 = audit_log 投影(id/actor/actorKind/kind/summary/detailJson…)。
  */
 import { getQuery } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
+import { requireRole } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { getOps } from '../../../services/workshop/ops/ops'
 import { AppError } from '../../../utils/errors'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  // 全局审计台账含跨产线运维信息,收权到 admin/editor(普通用户走产线维度自己的记录)
+  requireRole(event)
   const repo = getOps()?.audit
   if (!repo)
     throw new AppError(503, 'UNAVAILABLE', '运维日志仓储未就绪')

package/server/api/workshop/users/register.post.ts

@@ -10,12 +10,19 @@ import { readValidatedBody } from 'h3'
 import { zValidator } from '../../../utils/validate'
 import { defineApiHandler } from '../../../utils/response'
 import { userService } from '../../../services/user.service'
+import { userRepository } from '../../../repositories/user.repository'
+import { settingOf } from '../../../services/workshop/settings'
+import { AppError } from '../../../utils/errors'
 
 const schema = z.object({
   name: z.string().trim().min(1, 'name 必填').max(64, 'name 过长'),
 })
 
 export default defineApiHandler(async (event) => {
+  // 公网部署闸门:与 /api/users/register 同一开关(首 admin 未就位时不受限)
+  if (settingOf('security.allowRegistration') === false && userRepository.hasActiveAdmin()) {
+    throw new AppError(403, 'REGISTRATION_CLOSED', '自助注册已关闭(security.allowRegistration=false),请联系管理员开通账号')
+  }
   const body = await readValidatedBody(event, zValidator(schema))
   const name = body.name.trim()
   const email = `${name.toLowerCase().replace(/[^a-z0-9]+/g, '-')}-${Date.now()}@workshop.local`

package/server/mcp/workshop-server.ts

@@ -112,7 +112,8 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
           .optional(),
       },
     },
-    async (args) => {
+    async (args, extra) => {
+      requireCaller(manager, extra)
       const result = await manager.createChannel({
         name: args.name,
         description: args.description,
@@ -128,8 +129,11 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
       description: '全部 channel',
       inputSchema: {},
     },
-    async () => {
-      return jsonResult(await manager.listChannels())
+    async (_args, extra) => {
+      const caller = requireCaller(manager, extra)
+      // 隔离:Agent 只能看到自己所在 channel(与 workshop.agent.list 同哲学)
+      const all = await manager.listChannels()
+      return jsonResult(all.filter(c => c.id === caller.channelId))
     },
   )
 
@@ -139,7 +143,9 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
       description: '删除(级联)',
       inputSchema: { channelId: z.string() },
     },
-    async (args) => {
+    async (args, extra) => {
+      const caller = requireCaller(manager, extra)
+      if (args.channelId !== caller.channelId) throw new Error('FORBIDDEN: 只能删除自己所在 channel')
       await manager.removeChannel(args.channelId)
       return jsonResult({ ok: true })
     },
@@ -157,7 +163,8 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
         config: z.record(z.string(), z.unknown()).optional(),
       },
     },
-    async (args) => {
+    async (args, extra) => {
+      requireCaller(manager, extra)
       const result = await manager.createAgent({
         name: args.name,
         harness: args.harness,
@@ -177,7 +184,9 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
         role: z.enum(['lead', 'worker']),
       },
     },
-    async (args) => {
+    async (args, extra) => {
+      const caller = requireCaller(manager, extra)
+      if (args.channelId !== caller.channelId) throw new Error('FORBIDDEN: 只能向自己所在 channel 添加 Agent')
       const result = await manager.addAgentToChannel({
         channelId: args.channelId,
         agentId: args.agentId,
@@ -193,7 +202,8 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
       description: '列出全部 Agent 模板(全局可复用)',
       inputSchema: {},
     },
-    async () => {
+    async (_args, extra) => {
+      requireCaller(manager, extra)
       return jsonResult(await manager.listAgents())
     },
   )
@@ -216,7 +226,8 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
       description: '删除 Agent 模板(已克隆实例保留)',
       inputSchema: { agentId: z.string() },
     },
-    async (args) => {
+    async (args, extra) => {
+      requireCaller(manager, extra)
       await manager.removeAgent(args.agentId)
       return jsonResult({ ok: true })
     },
@@ -235,7 +246,9 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
         parts: z.array(partSchema).optional(),
       },
     },
-    async (args) => {
+    async (args, extra) => {
+      const caller = requireCaller(manager, extra)
+      if (args.channelId !== caller.channelId) throw new Error('FORBIDDEN: 只能向自己所在 channel 提交任务')
       const result = await manager.submitChannelTask({
         channelId: args.channelId,
         title: args.title,
@@ -441,7 +454,8 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
       description: '列出数字孪生设备(含 telemetry/state/desired)。Agent 据此判断哪些设备可控、当前状态如何。',
       inputSchema: { workspaceId: z.string().optional() },
     },
-    async (args) => {
+    async (args, extra) => {
+      requireCaller(manager, extra)
       return jsonResult(getDeviceTwinRepo().listAll(args.workspaceId))
     },
   )
@@ -452,7 +466,8 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
       description: '读取单个设备实时遥测 + 运行状态 + 可用指令集。数字人作业前先 read 感知设备当前情况。',
       inputSchema: { deviceId: z.string() },
     },
-    async (args) => {
+    async (args, extra) => {
+      requireCaller(manager, extra)
       const twin = getDeviceTwinRepo().findById(args.deviceId)
       if (!twin) throw new Error(`NOT_FOUND: 设备不存在 ${args.deviceId}`)
       return jsonResult(twin)
@@ -469,7 +484,11 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
         args: z.record(z.string(), z.unknown()).optional(),
       },
     },
-    async (args) => {
+    async (args, extra) => {
+      const caller = requireCaller(manager, extra)
+      const bound = getDeviceTwinRepo().findById(args.deviceId)
+      if (!bound) throw new Error(`NOT_FOUND: 设备不存在 ${args.deviceId}`)
+      if (bound.boundAgentId && bound.boundAgentId !== caller.id) throw new Error('FORBIDDEN: 设备已被其他 Agent 绑定')
       const twin = getDeviceTwinRepo().applyControl(args.deviceId, args.command, args.args ?? {})
       if (!twin) throw new Error(`NOT_FOUND: 设备不存在 ${args.deviceId}`)
       return jsonResult(twin)
@@ -485,7 +504,11 @@ export function createWorkshopMcpServer(manager: AgentChannelManager): McpServer
         telemetry: z.record(z.string(), z.union([z.number(), z.string(), z.boolean()])),
       },
     },
-    async (args) => {
+    async (args, extra) => {
+      const caller = requireCaller(manager, extra)
+      const bound = getDeviceTwinRepo().findById(args.deviceId)
+      if (!bound) throw new Error(`NOT_FOUND: 设备不存在 ${args.deviceId}`)
+      if (bound.boundAgentId && bound.boundAgentId !== caller.id) throw new Error('FORBIDDEN: 设备已被其他 Agent 绑定')
       const twin = getDeviceTwinRepo().applyTelemetry(args.deviceId, args.telemetry)
       if (!twin) throw new Error(`NOT_FOUND: 设备不存在 ${args.deviceId}`)
       return jsonResult({ state: twin.state, telemetry: twin.telemetry })

package/server/middleware/00-security-headers.ts

@@ -0,0 +1,38 @@
+/**
+ * 安全响应头(公网部署基线)—— 全站统一附加:
+ * - X-Content-Type-Options / X-Frame-Options / Referrer-Policy / Permissions-Policy
+ * - CSP:自托管 SPA 语义('self' + inline 样式/脚本;Nuxt 水合与 antd cssinjs 需要 inline)
+ * - HSTS:security.hstsEnabled 设置开启才下发(前提=已上 TLS,反代/隧道终结亦可)
+ * 纯 setHeader,不读 body、不阻塞;设置读取走 3s TTL 缓存(settingOf)。
+ */
+import { defineEventHandler, getRequestURL, setResponseHeader } from 'h3'
+import { settingOf } from '../services/workshop/settings'
+
+const CSP = [
+  'default-src \'self\'',
+  'script-src \'self\' \'unsafe-inline\' \'unsafe-eval\'',
+  'style-src \'self\' \'unsafe-inline\'',
+  'img-src \'self\' data: blob: https:',
+  'font-src \'self\' data:',
+  'connect-src \'self\' ws: wss:',
+  'media-src \'self\' blob:',
+  'object-src \'none\'',
+  'base-uri \'self\'',
+  'frame-ancestors \'none\'',
+  'form-action \'self\'',
+].join('; ')
+
+export default defineEventHandler((event) => {
+  if (!event.node?.res) return
+  setResponseHeader(event, 'X-Content-Type-Options', 'nosniff')
+  setResponseHeader(event, 'X-Frame-Options', 'DENY')
+  setResponseHeader(event, 'Referrer-Policy', 'strict-origin-when-cross-origin')
+  setResponseHeader(event, 'Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()')
+  setResponseHeader(event, 'Content-Security-Policy', CSP)
+  const url = getRequestURL(event)
+  if (url.pathname.startsWith('/api/')) setResponseHeader(event, 'Cache-Control', 'no-store')
+  // HSTS 只在设置开启时下发(未上 TLS 时下发会锁死 http 访问)
+  if (settingOf('security.hstsEnabled') === true) {
+    setResponseHeader(event, 'Strict-Transport-Security', 'max-age=31536000; includeSubDomains')
+  }
+})

package/server/middleware/01-rate-guard.ts

@@ -0,0 +1,101 @@
+/**
+ * HTTP 防护门(公网部署基线)——单中间件四件事,内存滑窗,无外部依赖:
+ * 1. User-Agent 黑名单:默认拦常见扫描器(sqlmap/nikto/nuclei…),AW_UA_BLOCKLIST 可追加(正则段,| 分隔)
+ * 2. 请求体上限:Content-Length 超限 413(AW_BODY_LIMIT_MB,默认 64MB)
+ * 3. 频率限流:/api 认证面(login/register/mcp/a2a)严限,A其余 API 宽限(AW_RATE_LIMIT_API_PER_MIN,默认 600)
+ * 4. 404 扫描封锁:1 分钟内 /api/* 404 超过阈值(AW_SCAN_404_LIMIT,默认 60)→ 封 IP 10 分钟(反爬/反目录爆破)
+ * 旁路:AW_RATE_LIMIT_OFF=1 或 AW_BENCH_MODE=1(基准隔离实例)整体停用;
+ *      全部状态内存态(重启即清),多实例部署时反代层应另配限流。
+ */
+import { defineEventHandler, createError, getRequestIP, getRequestHeaders, getRequestURL } from 'h3'
+
+const g = globalThis as typeof globalThis & {
+  __awRateBuckets?: Map<string, { count: number, reset: number }>
+  __awScanHits?: Map<string, { count: number, reset: number }>
+  __awScanBlocked?: Map<string, number>
+}
+
+const envNum = (v: string | undefined, dflt: number) => {
+  const n = Number(v)
+  return Number.isFinite(n) && n > 0 ? n : dflt
+}
+
+const OFF = process.env.AW_RATE_LIMIT_OFF === '1' || process.env.AW_BENCH_MODE === '1'
+const AUTH_LIMIT = envNum(process.env.AW_RATE_LIMIT_AUTH_PER_MIN, 20)
+const API_LIMIT = envNum(process.env.AW_RATE_LIMIT_API_PER_MIN, 600)
+const SCAN_LIMIT = envNum(process.env.AW_SCAN_404_LIMIT, 60)
+const BODY_LIMIT_MB = envNum(process.env.AW_BODY_LIMIT_MB, 64)
+const BLOCK_MS = 10 * 60_000
+const WINDOW_MS = 60_000
+// 默认 UA 黑名单:公认攻击工具,不含任何浏览器/爬虫正常名(正常搜索引擎爬虫由 robots.txt 约束)
+const UA_RE = new RegExp(process.env.AW_UA_BLOCKLIST
+  || 'sqlmap|nikto|nuclei|masscan|zgrab|dirbuster|gobuster|wfuzz|ffuf|hydra|acunetix|nessus|arachni', 'i')
+
+/** 认证/敏感面(严限):登录、注册、MCP、A2A */
+function isAuthFace(pathname: string): boolean {
+  return pathname.startsWith('/api/users/login')
+    || pathname.startsWith('/api/users/register')
+    || pathname.startsWith('/api/workshop/users/register')
+    || pathname.startsWith('/api/mcp/')
+    || pathname.includes('/a2a/')
+}
+
+function bucketOf(map: Map<string, { count: number, reset: number }>, key: string, limit: number, now: number): number {
+  const b = map.get(key)
+  if (!b || b.reset <= now) {
+    map.set(key, { count: 1, reset: now + WINDOW_MS })
+    return limit - 1
+  }
+  b.count += 1
+  // 可为负:第 N+1 发起 remaining < 0,由调用方判 429(勿钳 0,否则永不触发)
+  return limit - b.count
+}
+
+export default defineEventHandler((event) => {
+  if (OFF) return
+  const url = getRequestURL(event)
+  const path = url.pathname
+  const ip = getRequestIP(event, { xForwardedFor: true }) ?? 'local'
+  const now = Date.now()
+
+  // 已封锁 IP(404 扫描触发):直接 403,不看别的
+  const blockedUntil = g.__awScanBlocked?.get(ip)
+  if (blockedUntil && blockedUntil > now) {
+    throw createError({ statusCode: 403, statusMessage: `IP temporarily blocked (scanning): retry after ${Math.ceil((blockedUntil - now) / 1000)}s` })
+  }
+  if (blockedUntil && g.__awScanBlocked) g.__awScanBlocked.delete(ip)
+
+  // UA 黑名单(全路径,扫描器对静态面也探)
+  const ua = getRequestHeaders(event)['user-agent'] ?? ''
+  if (ua && UA_RE.test(ua)) {
+    throw createError({ statusCode: 403, statusMessage: 'User agent not allowed' })
+  }
+
+  // 请求体上限(带 Content-Length 才拦;chunked 走 nitro 默认)
+  const len = Number(getRequestHeaders(event)['content-length'] ?? 0)
+  if (len > BODY_LIMIT_MB * 1024 * 1024) {
+    throw createError({ statusCode: 413, statusMessage: `Request body too large (limit ${BODY_LIMIT_MB}MB)` })
+  }
+
+  // 只对 /api/* 限流(静态/页面不做)
+  if (path.startsWith('/api/')) {
+    if (!g.__awRateBuckets) g.__awRateBuckets = new Map()
+    const limit = isAuthFace(path) ? AUTH_LIMIT : API_LIMIT
+    const remaining = bucketOf(g.__awRateBuckets, `${ip}|${limit}`, limit, now)
+    if (remaining < 0) {
+      throw createError({ statusCode: 429, statusMessage: 'Too many requests: slow down' })
+    }
+    // 404 扫描计数(res finish 时回填;blocked 判定在下轮请求入口生效)
+    if (!g.__awScanHits) g.__awScanHits = new Map()
+    const res = event.node?.res
+    if (!res) return
+    res.once('finish', () => {
+      if (res.statusCode !== 404) return
+      const hits = bucketOf(g.__awScanHits!, `${ip}`, SCAN_LIMIT, Date.now())
+      if (hits <= 0) {
+        if (!g.__awScanBlocked) g.__awScanBlocked = new Map()
+        g.__awScanBlocked.set(ip, Date.now() + BLOCK_MS)
+      }
+    })
+  }
+})