agentworkshop 0.7.52 → 0.7.53

package/i18n/locales/en.ts

@@ -17,6 +17,8 @@ export default {
     delete: 'Delete',
     status: 'Status',
     all: 'All',
+    copy: 'Copy',
+    copied: 'Copied',
   },
   menu: {
     system: 'AgentWorkShop',
@@ -296,6 +298,8 @@ export default {
       security: {
         hitlTimeoutMs: 'HITL approval timeout (ms)',
         approvalGate: 'Dual approval for high-risk ops',
+        allowRegistration: 'Open self-service registration',
+        hstsEnabled: 'Send HSTS header',
       },
       server: {
         host: 'Listen address',
@@ -1159,6 +1163,16 @@ export default {
     k13awowo134: 'Process range (min/max) is required',
     k1b6qe0r135: 'A recipe is required before starting: pick a product and a recipe (the recipe must contain process parameters)',
     kszv5sq136: 'No matching data in the window (check product/recipe/time range; only samples from running lines carry the line identity)',
+    stepLimitLabel: 'Exploration per-step limit',
+    stepLimitUnit: 'engineering units',
+    stepLimitPlaceholder: 'Leave empty for the node default (2% of range)',
+    stepLimitHint: 'Maximum change per agent write; exploration writes are rejected when no finite value is set.',
+    thStepLimit: 'Step limit',
+    stepInputTitle: 'Live control of the per-step max change; leave empty to disable exploration writes',
+    stepCurrent: 'Current Δ≤{p0}',
+    stepUnset: 'unset',
+    recipeStepLimitLabel: 'Recipe per-step limit Δ≤',
+    recipeStepLimitPlaceholder: 'Follow node default',
   },
   teams: {
     selectChannel: 'Select a target channel',
@@ -1448,6 +1462,10 @@ export default {
     kfvflle033: 'user edits member info / scenario prompt',
     k13xo8sz034: 'Select an agent template to clone',
     k1tjd5ab035: 'Select an AgentTeam to deploy',
+    supervisionWatchdogTitle: 'Watchdog observation threshold triggered ({p0}); this is an observation signal, not a cancel',
+    supervisionRunningTitle: 'Supervision round in progress (attempt={p0}, tick={p1})',
+    supervisionDecisionText: 'Decision {p0}',
+    supervisionDecisionTitle: 'Last lead decision: {p0} ({p1})',
   },
   artifactCard: {
     empty: '(empty)',
@@ -1510,6 +1528,9 @@ export default {
     k1098zie005: 'The working-scenario spec shared by all agents of this channel, injected into every harness together with the system design handbook… e.g. all deliverables must include a Chinese summary; code changes need a plan first; end replies with a [DONE] marker',
     kmgv4h5006: 'Working directory (team workspace mount point)',
     k1i8q46x007: 'Scenario prompt (after editing, member runtimes are recycled and re-assembled with the new scenario)',
+    bindLineLabel: 'Bind line (read-only grant)',
+    bindLinePlaceholder: 'Pick a line to bind (clear to unbind)',
+    bindLineHint: 'Bound members can read the line ops logs, recipe history and live status without node bindings; writes still require node authorization.',
     ku3ugac008: 'The working-scenario spec shared by all agents of this channel…',
     k67dzev009: 'Working directory (agents\' cwd; omp subprocesses restart with the new directory after editing)',
     k6kpql010: 'Save as Channel Template',
@@ -1545,6 +1566,112 @@ export default {
     kyh87lw001: 'Deliverable body matches the reply above',
     k49les002: 'Hide',
   },
+  chat: {
+    title: 'Group chat',
+    messageCount: '{p0} msgs',
+    refreshTitle: 'Refresh members and settings',
+    refresh: 'Refresh',
+    join: 'Join channel',
+    notMemberHint: 'Not a member — owner invitation required or the channel is private',
+    privateHint: 'This channel is private or group chat is disabled — owner invitation required',
+    pendingHint: 'Join request pending owner approval',
+    leave: 'Leave channel',
+    leaveConfirm: 'Leaving immediately revokes read, post, approval and notification catch-up access. Leave?',
+    ownerHint: 'You are the owner (cannot leave; transfer ownership or delete the channel instead)',
+    approve: 'Approve',
+    removeConfirm: 'Removing this member immediately revokes their chat and approval access. Remove?',
+    rosterHidden: 'Roster not visible (non-member)',
+    settingsTitle: 'Chat settings',
+    visibilityLabel: 'Visibility',
+    visibilityPrivate: 'Private (members only)',
+    visibilityPublic: 'Public (discoverable by signed-in users)',
+    joinPolicyLabel: 'Join policy',
+    joinPolicyOwnerApprove: 'Owner approval required',
+    joinPolicyOpen: 'Open to join',
+    approvalPolicyLabel: 'Approval policy',
+    approvalOwnerOnly: 'Only the owner decides',
+    approvalAnyMember: 'Any member decides',
+    chatEnabledLabel: 'Enable group chat',
+    saveSettings: 'Save settings',
+    statusActive: 'Active',
+    statusPending: 'Pending',
+    statusLeft: 'Left',
+    statusRemoved: 'Removed',
+    joinedPending: 'Join request submitted — waiting for owner approval',
+    joinedOk: 'Joined the channel',
+    errChatDisabled: 'Group chat is disabled for this channel',
+    errChannelPrivate: 'This channel is private — an owner invitation is required',
+    leftOk: 'You have left the channel',
+    errOwnerCannotLeave: 'The owner cannot leave — transfer ownership first',
+    approvedOk: 'Join request approved',
+    removedOk: 'Member removed',
+    settingsSaved: 'Chat settings saved',
+    settingsConflict: 'Channel settings were changed by someone else — refresh and retry',
+    avatarHuman: 'U',
+    earlierMessage: 'Earlier message',
+    backToLatest: 'Back to latest',
+    latest: 'Latest',
+    loading: 'Loading…',
+    loadEarlier: 'Load earlier messages',
+    emptyTitle: 'No group chat messages yet',
+    emptyHint: 'Plain messages only go to the group (0 agent runs); {\'@\'} mention an agent to trigger a run, or {\'@\'} a member for a direct notification.',
+    roleUser: 'User',
+    roleSystem: 'System',
+    replyTitle: 'Reply quoting this message',
+    reply: 'Reply',
+    mentionAgentTitle: 'Click to open this agent',
+    mentionMemberTitle: 'Mentioned member (does not trigger an agent)',
+    answeredFrom: 'Answering {p0}',
+    askedBy: '· asked by {p0}',
+    deliveryPending: 'Pending',
+    deliveryDelivered: 'Delivered',
+    deliveryConsumed: 'Consumed',
+    deliveryFailed: 'Delivery failed',
+    deliveryCancelled: 'Cancelled',
+    toolbarChatTitle: 'Group chat: only explicit {\'@\'}agent mentions trigger a run',
+    reachAgentsTitle: 'Only explicit {\'@\'}agent mentions trigger a run',
+    reachAgentsText: '{\'@\'}{p0} · will trigger {p1} agent run(s)',
+    reachNoAgentTitle: 'No {\'@\'}agent: the message only goes to the group, no agent runs',
+    reachNoAgentText: 'Group only · 0 agent runs',
+    notifyMembersSuffix: ' will receive a direct notification',
+    mentionHint: 'Type {\'@\'} to mention members · Enter to send',
+    cancelReply: 'Cancel reply',
+    unresolvedMentions: 'Unrecognized {\'@\'}: {p0} (not in this channel, not delivered)',
+    sentToChat: 'Sent to the group · {p0} agent(s) received it',
+    sentToChatNoAgent: 'Sent to the group (no {\'@\'}agent, no agent run)',
+    composerChatDisabled: 'Group chat is disabled for this channel — ask the owner to enable it in the members panel and retry',
+    composerNotMember: 'You are not a member of this channel yet — join via the members panel',
+    composerPlaceholder: 'Send to group chat…  {\'@\'} mention an agent (triggers a run) or a member (notification only)',
+    blockChatDisabled: 'Group chat is disabled for this channel (the owner can enable it in the members panel)',
+    blockNotMember: 'You are not a member yet — join via the members panel to post',
+  },
+  notifications: {
+    bellTitle: 'My notifications (mentions / agent replies / approvals)',
+    title: 'My notifications',
+    unreadCount: '{p0} unread',
+    markAllRead: 'Mark all read',
+    markReadFailed: 'Failed to mark as read',
+    empty: 'No notifications yet — mentions, agent replies and approval requests will show up here',
+    typeMention: 'Mention',
+    typeAgentReply: 'Agent reply',
+    typeHitlRequest: 'Approval needed',
+    typeHitlResolved: 'Approval result',
+    typeMember: 'Membership change',
+  },
+  lineOps: {
+    panelAria: 'Line operations panel',
+    title: 'Line Operations',
+    statDcw: 'Write control',
+    statDaq: 'Acquisition',
+    statAml: 'Training',
+    statSafe: 'Blocked',
+    filterAria: 'Operations filter',
+    filterDaq: 'Fetch',
+    filterTwin: 'Twin',
+    filterSafety: 'Safety',
+    empty: 'Waiting for line operations events',
+    systemName: 'System',
+  },
   clusterError: {
     showAll: 'All {p0}',
     k40p82001: 'Collapse',
@@ -1608,6 +1735,7 @@ export default {
   clusterTool: {
     expandAll: 'Expand all {p0} calls',
     k40p82001: 'Collapse',
+    kindIndustrial: 'Industrial',
   },
   commandPalette: {
     gotoTeams: 'Go to: AgentTeam groups',
@@ -1631,14 +1759,14 @@ export default {
   },
   composer: {
     loopIntervalRange: 'Loop interval must be between 1 and 86400 seconds',
-    defaultLeadTitle: 'No {\'@\'} target: tasks route through lead scheduling; {\'@\'} a member to send directly',
-    chipHint: 'Type {\'@\'} to mention members · ⌘/Ctrl+Enter to send',
+    defaultLeadTitle: 'No {\'{\'@\'}\'} target: tasks route through lead scheduling; {\'{\'@\'}\'} a member to send directly',
+    chipHint: 'Type {\'{\'@\'}\'} to mention members · ⌘/Ctrl+Enter to send',
     seconds: 's',
     sendTitle: 'Send (⌘/Ctrl+Enter)',
-    kl3604i033: 'Direct to {\'@\'}{p0}',
+    kl3604i033: 'Direct to {\'{\'@\'}\'}{p0}',
     k1cxjc4m034: 'Live Injection',
-    k1d2idgj035: 'Task dispatched → {\'@\'}{p0} ({p1})',
-    k1wk4bf036: 'Message sent to {\'@\'}{p0} ({p1})',
+    k1d2idgj035: 'Task dispatched → {\'{\'@\'}\'}{p0} ({p1})',
+    k1wk4bf036: 'Message sent to {\'{\'@\'}\'}{p0} ({p1})',
     k2z0fsx032: ' · direct',
     k1b38y2b001: 'Unlimited',
     k1jqqvhe002: 'HITL live injection: when the target is running, inject into its current turn directly (visible in the same turn)',
@@ -1655,7 +1783,7 @@ export default {
     k1bosqfv013: 'Live inject',
     kqdhdlq014: 'Task title is required',
     k1l36qf9015: 'Max runs must be 1–10000; empty means unlimited',
-    k1bw65is016: 'Select a target agent ({\'@\'} mention available)',
+    k1bw65is016: 'Select a target agent ({\'{\'@\'}\'} mention available)',
     k1ww0ftm017: 'Running · the task joins its mailbox queue',
     k9eq10w018: 'Target busy: the new task is delivered to its mailbox and handled FIFO after the current turn',
     kbhz1rp019: 'Stopped · the task is queued and runs after wake-up',
@@ -1669,8 +1797,8 @@ export default {
     kmf7lcc027: 'Target runtime stopped: the message is safely queued and processed after re-enabling',
     k1tet5df028: 'Idle · a turn starts immediately to handle it',
     kn600in029: 'Target idle: processing starts right after delivery',
-    k2h5jwc030: 'Type a task (first line = title, {\'@\'} to target a member, defaults to lead)…  ⌘/Ctrl+Enter to submit',
-    k15mwzt7031: 'Type a message/notice ({\'@\'} to target a member, defaults to lead)…  ⌘/Ctrl+Enter to send',
+    k2h5jwc030: 'Type a task (first line = title, {\'{\'@\'}\'} to target a member, defaults to lead)…  ⌘/Ctrl+Enter to submit',
+    k15mwzt7031: 'Type a message/notice ({\'{\'@\'}\'} to target a member, defaults to lead)…  ⌘/Ctrl+Enter to send',
   },
   deviceTwinPanel: {
     armDelete: 'Click again to confirm deleting this device instance',
@@ -1839,6 +1967,12 @@ export default {
     k401n2012: 'none)',
     k1xj595a013: 'Cancellation requested',
     ke7bh8u014: 'Re-dispatched for execution',
+    timedOut: 'Timed out',
+    remainingMinutes: 'About {p0} min left',
+    deadlineAt: 'Due {p0}',
+    cancelWithChildren: 'This also stops {p0} active descendant tasks; completed results are kept. Continue?',
+    cancelConfirm: 'Cancel this task?',
+    childrenStats: 'Descendants {p0} · active {p1} · cancelled {p2}',
   },
   townView: {
     saveLayoutTip: 'Write all devices\' position/rotation/scale to the database',
@@ -2220,6 +2354,16 @@ export default {
     hitlKindDsh: 'dsh permission',
     hitlApprove: 'Approve',
     hitlReject: 'Reject',
+    hitlReqQuestion: 'Question',
+    hitlReqApproval: 'Approval',
+    hitlPolicy: 'Policy: {p0}',
+    hitlEngineNote: 'This item must be handled in its engine UI',
+    hitlPermsLoading: 'Loading approval permissions…',
+    hitlNoPerm: 'No approval permission',
+    hitlAnswerPlaceholder: 'Type your answer',
+    hitlSupplementPlaceholder: 'Additional notes (optional)',
+    hitlSubmitAnswer: 'Submit answer',
+    hitlCancelRequest: 'Cancel request',
   },
   ompTerminalPanel: {
     switchTarget: '── Switch target · {p0} ──',

package/i18n/locales/zh-CN.ts

@@ -17,6 +17,8 @@ export default {
     delete: '删除',
     status: '状态',
     all: '全部',
+    copy: '复制',
+    copied: '已复制',
   },
   menu: {
     system: 'AgentWorkShop',
@@ -296,6 +298,8 @@ export default {
       security: {
         hitlTimeoutMs: 'HITL 审批超时(ms)',
         approvalGate: '高危操作双人复核',
+        allowRegistration: '开放自助注册',
+        hstsEnabled: '下发 HSTS 头',
       },
       server: {
         host: '监听地址',
@@ -1159,6 +1163,16 @@ export default {
     k13awowo134: '工艺量程(min/max)必填',
     k1b6qe0r135: '开跑前必须先设定配方:请选择产品与配方(配方需含工艺参数)',
     kszv5sq136: '窗口内无匹配数据(检查产品/配方/时间范围;仅产线运行中的样本带产线标识)',
+    stepLimitLabel: '探索阶段单步上限',
+    stepLimitUnit: '工程量',
+    stepLimitPlaceholder: '留空：按节点量程 2% 默认值',
+    stepLimitHint: 'Agent 每次写入的最大变化量；无有限值时探索写入会被拒绝。',
+    thStepLimit: '探索步长',
+    stepInputTitle: '在线控制单步最大变化量；留空将关闭探索写入',
+    stepCurrent: '当前 Δ≤{p0}',
+    stepUnset: '未配置',
+    recipeStepLimitLabel: 'Recipe 单步上限 Δ≤',
+    recipeStepLimitPlaceholder: '跟随节点默认',
   },
   teams: {
     selectChannel: '选择目标 Channel',
@@ -1448,6 +1462,10 @@ export default {
     kfvflle033: 'user 编辑成员信息/场景提示词',
     k13xo8sz034: '请选择要克隆的 Agent 模板',
     k1tjd5ab035: '请选择要部署的 AgentTeam',
+    supervisionWatchdogTitle: '监督观察阈值已触发({p0});这是观察信号,不是取消',
+    supervisionRunningTitle: '监督回合进行中(attempt={p0},tick={p1})',
+    supervisionDecisionText: '决策 {p0}',
+    supervisionDecisionTitle: 'Lead 最后决策:{p0}({p1})',
   },
   artifactCard: {
     empty: '(空)',
@@ -1510,6 +1528,9 @@ export default {
     k1098zie005: '该 channel 全部 Agent 共享的作业场景规范,与系统设计手册组合注入每个 harness……例如:所有产出必须附中文摘要;代码修改需先列计划再动手;回复末尾附 [DONE] 标记',
     kmgv4h5006: '工作目录(团队作业挂载点)',
     k1i8q46x007: '作业场景 Prompt(修改后成员运行时自动回收,按新场景重装配)',
+    bindLineLabel: '绑定产线(只读授权)',
+    bindLinePlaceholder: '选择要绑定的产线(可清除=解绑)',
+    bindLineHint: '绑定后频道成员无需节点绑定即可读取该产线的运维日志、配方历史与实时状态;参数下发等写操作仍需节点授权。',
     ku3ugac008: '该 channel 全部 Agent 共享的作业场景规范……',
     k67dzev009: '工作目录(Agent 作业 cwd;修改后 omp 子进程按新目录重启)',
     k6kpql010: '保存为 Channel 模板',
@@ -1545,6 +1566,112 @@ export default {
     kyh87lw001: '交付物正文与上方回复一致',
     k49les002: '隐藏',
   },
+  chat: {
+    title: '群聊',
+    messageCount: '{p0} 条',
+    refreshTitle: '刷新成员与设置',
+    refresh: '刷新',
+    join: '加入群聊',
+    notMemberHint: '未加入群聊 —— 需 owner 邀请或 Channel 未公开',
+    privateHint: '该 Channel 未公开或未开启群聊 —— 需 owner 邀请',
+    pendingHint: '加入申请待 owner 批准',
+    leave: '退出群聊',
+    leaveConfirm: '退出群聊后将立即失去读、发言、审批与通知补拉权限,确认退出?',
+    ownerHint: '你是 owner(不可退出,可转移 owner 或删除 Channel)',
+    approve: '批准',
+    removeConfirm: '移除该成员后其立即失去群聊与审批权限,确认?',
+    rosterHidden: '名册不可见(非成员)',
+    settingsTitle: '群聊设置',
+    visibilityLabel: '可见性',
+    visibilityPrivate: '私有(仅成员可见)',
+    visibilityPublic: '公开(登录用户可发现)',
+    joinPolicyLabel: '加入策略',
+    joinPolicyOwnerApprove: '需 owner 批准',
+    joinPolicyOpen: '开放加入',
+    approvalPolicyLabel: '审批策略',
+    approvalOwnerOnly: '仅 owner 可决策',
+    approvalAnyMember: '任一成员可决策',
+    chatEnabledLabel: '开启群聊',
+    saveSettings: '保存设置',
+    statusActive: '在群',
+    statusPending: '待批准',
+    statusLeft: '已退出',
+    statusRemoved: '已移除',
+    joinedPending: '已提交加入申请,等待 owner 批准',
+    joinedOk: '已加入群聊',
+    errChatDisabled: '该 Channel 未开启群聊',
+    errChannelPrivate: '该 Channel 未公开,需 owner 邀请',
+    leftOk: '已退出群聊',
+    errOwnerCannotLeave: 'owner 不能退出群聊,请先转移 owner',
+    approvedOk: '已批准加入',
+    removedOk: '已移除成员',
+    settingsSaved: '群聊设置已保存',
+    settingsConflict: 'Channel 设置已被他人修改,请刷新后重试',
+    avatarHuman: '人',
+    earlierMessage: '更早的消息',
+    backToLatest: '回到最新',
+    latest: '最新',
+    loading: '加载中…',
+    loadEarlier: '加载更早的消息',
+    emptyTitle: '还没有群聊消息',
+    emptyHint: '直接发言只进群聊(0 次 Agent 执行);输入 {\'@\'} 提及 Agent 才会触发执行,{\'@\'} 成员只发定向通知。',
+    roleUser: '用户',
+    roleSystem: '系统',
+    replyTitle: '引用这条消息回复',
+    reply: '回复',
+    mentionAgentTitle: '点击查看该 Agent',
+    mentionMemberTitle: '被 {\'@\'} 的成员(不触发 Agent)',
+    answeredFrom: '回答自 {p0}',
+    askedBy: '· 提问者 {p0}',
+    deliveryPending: '待投递',
+    deliveryDelivered: '已入信箱',
+    deliveryConsumed: '已被消费',
+    deliveryFailed: '投递失败',
+    deliveryCancelled: '已取消',
+    toolbarChatTitle: '群聊:仅显式 {\'@\'}Agent 才触发执行',
+    reachAgentsTitle: '仅显式 {\'@\'}Agent 触发执行',
+    reachAgentsText: '{\'@\'}{p0} · 将触发 {p1} 次 Agent 执行',
+    reachNoAgentTitle: '未 {\'@\'}Agent:消息只进群聊,不触发任何 Agent',
+    reachNoAgentText: '仅群聊 · 0 次 Agent 执行',
+    notifyMembersSuffix: ' 将收到定向通知',
+    mentionHint: '输入 {\'@\'} 提及成员 · Enter 发送',
+    cancelReply: '取消回复',
+    unresolvedMentions: '未识别的 {\'@\'}: {p0}(不在本群成员内,未投递)',
+    sentToChat: '已发到群聊 · {p0} 个 Agent 已收到投递',
+    sentToChatNoAgent: '已发到群聊(未 {\'@\'}Agent,无 Agent 执行)',
+    composerChatDisabled: '该 Channel 未开启群聊 —— 请 owner 在右侧成员面板开启后重试',
+    composerNotMember: '你还不是该 Channel 的群成员 —— 请在右侧成员面板加入群聊',
+    composerPlaceholder: '发送到群聊…  {\'@\'} 提及 Agent(触发执行)或成员(仅通知)',
+    blockChatDisabled: '该 Channel 未开启群聊(owner 可在右侧成员面板开启)',
+    blockNotMember: '你还不是群成员 —— 请在右侧成员面板加入群聊后发言',
+  },
+  notifications: {
+    bellTitle: '我的通知({\'@\'} 提及 / Agent 回复 / 审批)',
+    title: '我的通知',
+    unreadCount: '{p0} 未读',
+    markAllRead: '全部已读',
+    markReadFailed: '标记已读失败',
+    empty: '暂无通知 —— 被 {\'@\'} 、收到 Agent 回复或审批请求时会出现在这里',
+    typeMention: '{\'@\'} 提及',
+    typeAgentReply: 'Agent 回复',
+    typeHitlRequest: '待审批',
+    typeHitlResolved: '审批结果',
+    typeMember: '成员变更',
+  },
+  lineOps: {
+    panelAria: '产线作业面板',
+    title: '产线作业',
+    statDcw: '写控',
+    statDaq: '采集',
+    statAml: '训练',
+    statSafe: '拦截',
+    filterAria: '作业筛选',
+    filterDaq: '取数',
+    filterTwin: '孪生',
+    filterSafety: '安全',
+    empty: '等待产线作业事件',
+    systemName: '系统',
+  },
   clusterError: {
     showAll: '全部 {p0} 条',
     k40p82001: '收起',
@@ -1608,6 +1735,7 @@ export default {
   clusterTool: {
     expandAll: '展开全部 {p0} 个调用',
     k40p82001: '收起',
+    kindIndustrial: '工业',
   },
   commandPalette: {
     gotoTeams: '前往:AgentTeam 编组库',
@@ -1631,14 +1759,14 @@ export default {
   },
   composer: {
     loopIntervalRange: 'loop 间隔需设置为 1 到 86400 秒',
-    defaultLeadTitle: '未 {\'@\'} 指定:任务自动路由 lead 调度;{\'@\'} 某成员可直发',
-    chipHint: '输入 {\'@\'} 提及成员 · ⌘/Ctrl+Enter 发送',
+    defaultLeadTitle: '未 {\'{\'@\'}\'} 指定:任务自动路由 lead 调度;{\'{\'@\'}\'} 某成员可直发',
+    chipHint: '输入 {\'{\'@\'}\'} 提及成员 · ⌘/Ctrl+Enter 发送',
     seconds: '秒',
     sendTitle: '发送(⌘/Ctrl+Enter)',
-    kl3604i033: '直发 {\'@\'}{p0}',
+    kl3604i033: '直发 {\'{\'@\'}\'}{p0}',
     k1cxjc4m034: '实时注入',
-    k1d2idgj035: '任务已下发 → {\'@\'}{p0}({p1})',
-    k1wk4bf036: '消息已发送给 {\'@\'}{p0}({p1})',
+    k1d2idgj035: '任务已下发 → {\'{\'@\'}\'}{p0}({p1})',
+    k1wk4bf036: '消息已发送给 {\'{\'@\'}\'}{p0}({p1})',
     k2z0fsx032: ' · 直发',
     k1b38y2b001: '不限次数',
     k1jqqvhe002: 'HITL 实时注入:目标运行中时直接注入其当前回合(同轮可见)',
@@ -1655,7 +1783,7 @@ export default {
     k1bosqfv013: '即时注入',
     kqdhdlq014: '任务标题不能为空',
     k1l36qf9015: '最大次数需设置为 1 到 10000 次，留空表示不限次数',
-    k1bw65is016: '请选择目标 Agent(可用 {\'@\'} 提及)',
+    k1bw65is016: '请选择目标 Agent(可用 {\'{\'@\'}\'} 提及)',
     k1ww0ftm017: '运行中 · 任务进入其信箱排队',
     k9eq10w018: '目标正在执行:新任务投递到信箱,当前回合结束后按 FIFO 处理',
     kbhz1rp019: '已停止 · 任务将入队,唤醒后执行',
@@ -1669,8 +1797,8 @@ export default {
     kmf7lcc027: '目标运行时已停止:消息安全入队,重新启用后自动处理',
     k1tet5df028: '空闲 · 将立即起回合处理',
     kn600in029: '目标空闲:消息投递后立即开始处理',
-    k2h5jwc030: '输入任务下发(首行标题,{\'@\'} 成员直发,缺省 lead)…  ⌘/Ctrl+Enter 提交',
-    k15mwzt7031: '输入消息/通知({\'@\'} 成员指定目标,缺省 lead)…  ⌘/Ctrl+Enter 发送',
+    k2h5jwc030: '输入任务下发(首行标题,{\'{\'@\'}\'} 成员直发,缺省 lead)…  ⌘/Ctrl+Enter 提交',
+    k15mwzt7031: '输入消息/通知({\'{\'@\'}\'} 成员指定目标,缺省 lead)…  ⌘/Ctrl+Enter 发送',
   },
   deviceTwinPanel: {
     armDelete: '再次点击确认删除该设备实例',
@@ -1839,6 +1967,12 @@ export default {
     k401n2012: '无)',
     k1xj595a013: '已请求取消',
     ke7bh8u014: '已重新投递执行',
+    timedOut: '已超时',
+    remainingMinutes: '剩余约 {p0} 分钟',
+    deadlineAt: '截止 {p0}',
+    cancelWithChildren: '这会同时停止 {p0} 个活动后代任务，已完成结果会保留。确定继续？',
+    cancelConfirm: '确定取消这个任务吗？',
+    childrenStats: '后代 {p0} · 活动 {p1} · 已取消 {p2}',
   },
   townView: {
     saveLayoutTip: '把全部设备的位置/朝向/缩放写入数据库',
@@ -2220,6 +2354,16 @@ export default {
     hitlKindDsh: 'dsh 权限',
     hitlApprove: '批准',
     hitlReject: '拒绝',
+    hitlReqQuestion: '提问',
+    hitlReqApproval: '审批',
+    hitlPolicy: '策略:{p0}',
+    hitlEngineNote: '该类型待办需在对应引擎界面处理',
+    hitlPermsLoading: '读取审批权限…',
+    hitlNoPerm: '无审批权限',
+    hitlAnswerPlaceholder: '输入答案',
+    hitlSupplementPlaceholder: '补充说明(可选)',
+    hitlSubmitAnswer: '提交答案',
+    hitlCancelRequest: '取消请求',
   },
   ompTerminalPanel: {
     switchTarget: '── 切换目标 · {p0} ──',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentworkshop",
-  "version": "0.7.52",
+  "version": "0.7.53",
   "type": "module",
   "description": "AgentWorkShop \u8f6f\u4ef6\u5f00\u53d1\u7cfb\u7edf - \u57fa\u4e8e Nuxt 4 \u7684\u914d\u7f6e\u9a71\u52a8\u8fd0\u884c\u8303\u5f0f",
   "license": "PolyForm-Noncommercial-1.0.0",

package/public/robots.txt

@@ -0,0 +1,3 @@
+# AgentWorkShop 是登录制工业平台,无公开内容,谢绝一切爬虫抓取
+User-agent: *
+Disallow: /

package/server/api/mcp/workshop.ts

@@ -21,7 +21,8 @@ import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/
 import { createWorkshopMcpServer } from '../../mcp/workshop-server'
 import { getWorkshopManager } from '../../plugins/workshop'
 
-/** 会话注册表:sessionId → transport(stateful 会话状态保留) */
+/** 会话注册表:sessionId → transport(stateful 会话状态保留);上限防匿名刷爆内存 */
+const MAX_MCP_SESSIONS = 64
 const sessions = new Map<string, WebStandardStreamableHTTPServerTransport>()
 
 /** h3 event → web Request(跨 h3 1.x/2.x 兼容:不用版本互异的转换助手) */
@@ -65,6 +66,12 @@ export default defineEventHandler(async (event) => {
 
   // 新会话:预生成 sessionId,transport 在 initialize 时把它写入响应头
   if (!transport) {
+    if (sessions.size >= MAX_MCP_SESSIONS) {
+      return new Response(JSON.stringify({ error: 'TOO_MANY_SESSIONS', message: `MCP 会话数已达上限 ${MAX_MCP_SESSIONS}` }), {
+        status: 429,
+        headers: { 'content-type': 'application/json' },
+      })
+    }
     const newSessionId = randomUUID()
     transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: () => newSessionId,

package/server/api/metrics.ts

@@ -2,11 +2,13 @@
  * GET /api/metrics —— 运维指标端点(R4,production-readiness-plan)。
  *
  * text/plain 简易指标格式(键值行,Prometheus 可用 textfile/自定义采集器接入)。
- * 无鉴权:仅暴露聚合计数与时间戳,不含业务数据;内网部署语义。
+ * 鉴权:任意有效用户 token(Bearer)——聚合计数与时间戳不含业务数据,
+ * 但公网部署下不向匿名暴露运行面信息;采集器配 Token 头即可接入。
  * 只读 globalThis 单例(不主动实例化),服务未装配时输出 0 —— 首次抓取即合法。
  */
 import { defineEventHandler, setResponseHeader } from 'h3'
 import { getOps } from '../services/workshop/ops/ops'
+import { resolveUser } from './workshop/caller'
 
 interface MetricLine { name: string, help: string, value: number | string }
 
@@ -15,6 +17,7 @@ function fmt(lines: MetricLine[]): string {
 }
 
 export default defineEventHandler(async (event) => {
+  resolveUser(event)
   const g = globalThis as typeof globalThis & {
     __daqController?: { controllerState(): Record<string, number | boolean>, running?: boolean }
     __daqQueue?: { lost?: number }

package/server/api/plugins/[name]/[...path].ts

@@ -1,8 +1,9 @@
 /**
  * /api/plugins/:name/** —— 插件自注册 API 的转发层(exact-match)。
  * 插件经 ctx.route(method, path, handler) 注册;handler(event) 返回值由 nitro 序列化。
- * 鉴权:插件在入口声明 auth:'user' | 'admin' | 'agent-or-user' 时由转发层统一校验
- *   (缺省 'none' 保持开放,兼容既有插件/浏览器面板)。
+ * 鉴权:插件在入口声明 auth:'user' | 'admin' | 'agent-or-user' | 'none' 时由转发层统一校验。
+ *   安全默认 = 'user'(default-deny):未声明的插件不再匿名暴露,须显式声明 'none' 才开放
+ *   (公网部署基线;确需匿名的只读面由插件作者显式声明并承担暴露责任)。
  * 错误隔离:插件 handler 抛错 → 结构化日志(带插件归属)+ 干净 500 信封,不裸传堆栈。
  */
 import { defineEventHandler, createError, readBody } from 'h3'
@@ -16,7 +17,7 @@ export default defineEventHandler(async (event) => {
   const path = '/' + (event.context.params?.path ?? '').replace(/^\/+/, '')
   const rec = host.plugins.get(name)
   // 声明式鉴权门:在进入插件 handler 前统一校验(禁用插件的路由表已不含其路由,天然 404)
-  const authMode = String(rec?.auth ?? 'none')
+  const authMode = String(rec?.auth ?? 'user')
   if (authMode !== 'none') {
     try {
       if (authMode === 'admin') await requireAdmin(event)

package/server/api/system/backup/list.get.ts

@@ -0,0 +1,32 @@
+/**
+ * GET /api/system/backup/list —— 备份清单(admin):库快照文件 + JSON/配置束目录。
+ * 只列文件名与大小/时间,不回传内容;恢复操作 = 停实例后由运维手工替换(安全优先不给在线恢复 API)。
+ */
+import { readdirSync, statSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { defineApiHandler } from '../../../utils/response'
+import { requireAdmin } from '../../workshop/caller'
+import { ensureDataDir } from '@/shared/config/home.mjs'
+
+export default defineApiHandler(async (event) => {
+  requireAdmin(event)
+  const backupDir = resolve(ensureDataDir(), 'backups')
+  let entries: Array<{ name: string, kind: 'db' | 'files', bytes: number, mtime: string }> = []
+  try {
+    entries = readdirSync(backupDir, { withFileTypes: true }).flatMap((e) => {
+      const full = resolve(backupDir, e.name)
+      try {
+        const st = statSync(full)
+        return [{
+          name: e.name,
+          kind: (e.isDirectory() ? 'files' : 'db') as 'db' | 'files',
+          bytes: st.size,
+          mtime: st.mtime.toISOString(),
+        }]
+      }
+      catch { return [] }
+    }).sort((a, b) => b.mtime.localeCompare(a.mtime))
+  }
+  catch { /* 备份目录尚不存在 = 还没备过 */ }
+  return { backupDir, count: entries.length, entries: entries.slice(0, 200) }
+})

package/server/api/system/backup/run.post.ts

@@ -0,0 +1,21 @@
+/**
+ * POST /api/system/backup/run —— 手动触发一次全量备份(admin)。
+ * 复用 server/plugins/backup.ts 的 backupOnce(三库在线快照 + JSON/配置面 + 保留轮转),
+ * 成败均落 audit_log(system.backup.*)。
+ */
+import { defineApiHandler } from '../../../utils/response'
+import { requireAdmin } from '../../workshop/caller'
+import { AppError } from '../../../utils/errors'
+
+export default defineApiHandler(async (event) => {
+  requireAdmin(event)
+  const { backupOnce } = await import('../../../plugins/backup')
+  const { ensureDataDir } = await import('@/shared/config/home.mjs')
+  try {
+    await backupOnce(ensureDataDir())
+  }
+  catch (err) {
+    throw new AppError(500, 'BACKUP_FAILED', `备份失败: ${err instanceof Error ? err.message : String(err)}`)
+  }
+  return { ok: true, at: new Date().toISOString() }
+})

package/server/api/system/settings/index.patch.ts

@@ -10,13 +10,23 @@ import { readBody } from 'h3'
 import { defineApiHandler } from '../../../utils/response'
 import { requireRole } from '../../workshop/caller'
 import { getSystemConfigService } from '../../../services/system-config'
+import { recordOps } from '../../../services/workshop/ops/ops'
 
 export default defineApiHandler(async (event) => {
-  requireRole(event, ['admin'])
+  const user = requireRole(event, ['admin'])
   const body = (await readBody<Record<string, unknown>>(event)) ?? {}
   const overrides = body.override ?? body.overrides ?? body
   if (!overrides || typeof overrides !== 'object' || Array.isArray(overrides)) {
     return { ok: false, message: '请求体应为 { "override": { key: value } }' }
   }
-  return { ok: true, ...getSystemConfigService().patch(overrides as Record<string, unknown>) }
+  const res = getSystemConfigService().patch(overrides as Record<string, unknown>)
+  // 高危管理面留痕:改了哪些键(值不落审计——可能含凭据),谁改的
+  if (res.changed?.length) {
+    recordOps({
+      actor: user.id, actorName: user.name, actorKind: 'user',
+      action: 'system.settings.update', kind: 'system',
+      summary: `运行时设置变更:${res.changed.join(', ')}`,
+    })
+  }
+  return { ok: true, ...res }
 })