agentworkshop 0.7.54 → 0.7.59

package/server/api/workshop/hitl/pending.get.ts

@@ -1,48 +1,57 @@
-/**
- * GET /api/workshop/hitl/pending?channelId= —— 全局待人工处理快照。
- *
- * 统一视图:omp ask 对话框 + dcw 工具审批 + 各 harness 原生审批/提问
- * (hitl-registry 内存缓存门面)。WebUI 全局徽标与 TUI /hitl 命令共用;
- * 实时增量走 AEP hitl.request/hitl.resolved 帧,本端点为快照对齐/恢复入口。
- *
- * 鉴权(v17,§13.2):
- *  ① 用户 token;
- *  ② Channel 可见性 = listChannelsVisibleTo ∪ listChannelsForUser(遗留公共行只读兼容);
- *  ③ 逐条按**创建时冻结的策略快照**判定可裁决性(requireCanApprove:成员 + owner_only/
- *     any_member + 创建时资格 ∩ 当前资格)—— owner_only 的 Channel 只对 owner/admin 返回,
- *     普通成员看不到也办不了(与 respond 端点的裁决口径完全一致)。
- * 响应形状保持 `{ items }` 不变。
- */
-import { getQuery } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getWorkshopManager } from '@/server/plugins/workshop'
-import { getHitlRegistry } from '@/server/services/workshop/agents/hitl-registry'
-import { canDecideHitlChannel, ensureHitlReconciled, snapshotOfRow } from '@/server/services/workshop/agents/hitl-decision'
-import type { AepHitlItem } from '../../../../shared/workshop-protocol'
-
-export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
-  const q = getQuery(event)
-  const channelId = typeof q.channelId === 'string' ? q.channelId : ''
-
-  // 重启后第一次触碰 HITL 面:先把上一进程遗留的非终态待办收敛为 failed(绝不自动批准),
-  // 避免"死待办"在快照里复活(惰性对账,幂等;插件显式调用等价)。
-  ensureHitlReconciled()
-
-  const manager = getWorkshopManager()
-  const repo = manager.groupChat.hitl
-  const acting = { id: user.id, name: user.name, role: user.role }
-  const items = getHitlRegistry()
-    .snapshot(channelId || undefined)
-    .filter((i: AepHitlItem) => {
-      if (!i.channelId) return false
-      // 策略/资格以持久化行为准(创建时冻结);无行(降级登记)按当前 Channel 策略判定
-      const row = repo.find(i.kind, i.id)
-      const opts = row
-        ? { policy: row.policy, snapshot: snapshotOfRow(row) }
-        : { policy: i.policy }
-      return canDecideHitlChannel(i.channelId, acting, opts)
-    })
-  return { items }
-})
+/**
+ * GET /api/workshop/hitl/pending?channelId= —— 全局待人工处理快照。
+ *
+ * 统一视图:omp ask 对话框 + dcw 工具审批 + 各 harness 原生审批/提问
+ * (hitl-registry 内存缓存门面)。WebUI 全局徽标与 TUI /hitl 命令共用;
+ * 实时增量走 AEP hitl.request/hitl.resolved 帧,本端点为快照对齐/恢复入口。
+ *
+ * 鉴权(v17,§13.2):
+ *  ① 用户 token;
+ *  ② Channel 可见性 = listChannelsVisibleTo ∪ listChannelsForUser(遗留公共行只读兼容);
+ *  ③ 逐条按**创建时冻结的策略快照**判定可裁决性(requireCanApprove:成员 + owner_only/
+ *     any_member + 创建时资格 ∩ 当前资格)—— owner_only 的 Channel 只对 owner/admin 返回,
+ *     普通成员看不到也办不了(与 respond 端点的裁决口径完全一致)。
+ * 响应形状保持 `{ items }` 不变。
+ */
+import { getQuery } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { getHitlRegistry } from '@/server/services/workshop/agents/hitl-registry'
+import { canDecideHitlChannel, ensureHitlReconciled, snapshotOfRow, sweepPhantomHitl } from '@/server/services/workshop/agents/hitl-decision'
+import { lineOfHitlItem } from '@/server/services/workshop/agents/hitl-decision/line-of'
+import { lineMode } from '@/server/services/workshop/permissions'
+import type { AepHitlItem } from '../../../../shared/workshop-protocol'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const q = getQuery(event)
+  const channelId = typeof q.channelId === 'string' ? q.channelId : ''
+
+  // 重启后第一次触碰 HITL 面:先把上一进程遗留的非终态待办收敛为 failed(绝不自动批准),
+  // 避免"死待办"在快照里复活(惰性对账,幂等;插件显式调用等价)。
+  ensureHitlReconciled()
+  // 幻影清账:DB 残留非终态待办(内存面无对应)置 failed,不再永世悬挂(2026-10-04 实测 9 行)
+  sweepPhantomHitl()
+
+  const manager = getWorkshopManager()
+  const repo = manager.groupChat.hitl
+  const acting = { id: user.id, name: user.name, role: user.role }
+  const items = getHitlRegistry()
+    .snapshot(channelId || undefined)
+    .filter((i: AepHitlItem) => {
+      if (!i.channelId) return false
+      // 权限模型 v3:按条目产线锚点过滤 —— 对该产线无 grant 的用户不在快照中
+      // (admin 恒全量;锚点缺失 = 纯协作频道的通用待办,不过滤)
+      const chLine = manager.deps.repos.channels.findById(i.channelId)?.lineId
+      const itemLine = lineOfHitlItem(i, chLine)
+      if (itemLine && user.role !== 'admin' && lineMode(user, itemLine) === 'none') return false
+      // 策略/资格以持久化行为准(创建时冻结);无行(降级登记)按当前 Channel 策略判定
+      const row = repo.find(i.kind, i.id)
+      const opts = row
+        ? { policy: row.policy, snapshot: snapshotOfRow(row) }
+        : { policy: i.policy }
+      return canDecideHitlChannel(i.channelId, acting, opts)
+    })
+  return { items }
+})

package/server/api/workshop/hitl/respond.post.ts

@@ -1,9 +1,10 @@
 /**
  * POST /api/workshop/hitl/respond —— 统一 HITL 应答路由(WebUI/TUI 共用)。
  *
- * body: { kind, id, value?, answers?, confirmed?, cancelled?, response?, comment? }
+ * body: { kind, id, value?, answers?, confirmed?, cancelled?, response?, comment?, choice? }
  *  - omp-dialog          → respondTerminalUi(pid, …):extension_ui_response 直写 omp stdin
- *  - dcw-approval        → toolApprovals.decide(id, approved=confirmed===true, comment)(audit 留痕)
+ *  - dcw-approval        → toolApprovals.decide(id, approved=confirmed===true, comment[, choice])
+ *                          (结构化审批单先经 fail-closed 归一:无有效 choice 的批准按拒绝收敛;audit 留痕)
  *  - codex-approval      → impl.respondHitl:审批 JSON-RPC accept/decline/cancel;
  *                          提问 tool/requestUserInput → `{answers:[…]}`(与审批载荷不同)
  *  - opencode-permission → impl.respondHitl:POST permissions {once|always|reject} / question 逐题 reply|reject
@@ -40,6 +41,8 @@ interface RespondBody {
   /** 引擎原生选项(opencode permission:once|always|reject;未知枚举一律 400) */
   response?: string
   comment?: string
+  /** 多方案裁决序号(dcw-approval 结构化审批单:批准时选定的包下标;缺省由 fail-closed 归一收敛为拒绝) */
+  choice?: number
 }
 
 export default defineApiHandler(async (event) => {
@@ -58,6 +61,10 @@ export default defineApiHandler(async (event) => {
         .map(a => ({ id: a.id !== undefined ? String(a.id) : '', answer: String(a.answer ?? '') }))
     : undefined
 
+  // 多方案裁决序号:仅接受整数(结构化审批单的「批准此方案」;其余输入一律按未携带处理,
+  // 由 fail-closed 归一收敛为拒绝 —— 不做静默取整/默认包)
+  const choice = Number.isInteger(body.choice) ? (body.choice as number) : undefined
+
   const result = await decideHitlRequest({
     kind,
     id,
@@ -69,6 +76,7 @@ export default defineApiHandler(async (event) => {
       cancelled: body.cancelled === true,
       response: typeof body.response === 'string' ? body.response : undefined,
       comment: typeof body.comment === 'string' ? body.comment : undefined,
+      choice,
     },
   })
 

package/server/api/workshop/ops-logs/index.get.ts

@@ -22,6 +22,7 @@ export default defineApiHandler(async (event) => {
     recipeId: q.recipeId || undefined,
     actorKind: q.actorKind || undefined,
     kind: q.kind || undefined,
+    level: q.level || undefined,
     q: q.q || undefined,
     from: q.from || undefined,
     to: q.to || undefined,

package/server/api/workshop/tasks/[id]/reopen.post.ts

@@ -0,0 +1,35 @@
+/**
+ * POST /api/workshop/tasks/:id/reopen —— 重开终态根任务(mirror retry.post.ts 鉴权模式)。
+ * 仅 FAILED/CANCELED 根;创建承接新根(FIFO 排队尾+全新预算),description 带 [reopen:<id8>] 溯源;
+ * 同源在途重开单 → 409 ROOT_REOPEN_IN_FLIGHT。无 caller 身份时以频道 lead 身份提交。
+ */
+import { getRouterParam, readValidatedBody } from 'h3'
+import { z } from 'zod'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { defineApiHandler } from '@/server/utils/response'
+import { zValidator } from '@/server/utils/validate'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+
+const reopenSchema = z.object({
+  title: z.string().min(1).optional(),
+  description: z.string().optional(),
+})
+
+export default defineApiHandler(async (event) => {
+  const taskId = getRouterParam(event, 'id')!
+  const body = await readValidatedBody(event, zValidator(reopenSchema)).catch(() => ({}) as z.infer<typeof reopenSchema>)
+  const manager = getWorkshopManager()
+  const task = (manager as unknown as { getTaskEngine?: () => { get: (id: string) => { channelId: string } | undefined } }).getTaskEngine?.().get(taskId)
+  if (!task) throw new AppError(404, 'NOT_FOUND', `任务不存在: ${taskId}`)
+  const user = resolveUser(event)
+  const ch = manager.getChannelForUser(task.channelId, user.id)
+  manager.requireOwned(ch.ownerUserId, user.id, 'channel')
+  return manager.reopenTask({
+    channelId: task.channelId,
+    taskId,
+    title: body.title,
+    description: body.description,
+    fromLabel: user.name,
+  })
+})

package/server/api/workshop/ws/peer-sub.ts

@@ -1,128 +1,135 @@
-/**
- * peer 订阅/退订与聊天快照投影
- * (由 server/api/workshop/ws.ts 按职责拆出;内容逐行原文搬运)
- */
-import type { AgentChannelManager } from '../../../services/workshop/runtime/manager'
-import type { WsPeer } from './shared'
-import { AEP_VERSION, peerChannels, streams } from './shared'
-import { attachScenePeer, sendControl, sendFrame } from './hub'
-import { bindUserPeer } from '../../../services/workshop/runtime/user-notification-hub'
-import { buildSnapshot } from './publish'
-import { ensureStream } from './streams'
-import { resolveUserByToken } from '../../../services/user.service'
-// 非管理者快照白名单投影(拆段时生成器漏了这一条:标识符只出现在三元表达式的对象展开里)
-import { projectManagementSnapshotForMember } from '../../../services/workshop/runtime/chat-projection'
-
-export function subscribePeer(manager: AgentChannelManager, peer: WsPeer, channelId: string, lastSeq?: number, userToken?: string): void { // v17:群成员鉴权(requireChannelMember);管理面字段按 canManage 投影(§13.1)
-  if (!userToken) {
-    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: 'USER_UNAUTHORIZED', message: 'WS 订阅需要用户 token(sub 帧携带 token 字段或连接 ?token= 查询参数)' } })
-    return
-  }
-  const user = resolveUserByToken(userToken)
-  if (!user) {
-    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: 'USER_UNAUTHORIZED', message: '用户 token 无效' } })
-    return
-  }
-  // v17:token 认证成功后绑定 peer→userId(用户级通知 hub 的 recipient 隔离基础)
-  bindUserPeer(peer, user.id)
-  let canManage: boolean
-  try {
-    // 成员守卫:owner 或 active 群成员可订阅(群聊读取/发言/WS/HITL 可见性同口径);
-    // 管理能力另行判定,仅用于快照投影深度。
-    manager.requireChannelMember(channelId, user)
-    canManage = manager.channelPermissionsOf(channelId, user).canManage
-  }
-  catch (err) {
-    const e = err as { code?: string, message?: string }
-    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: e.code ?? 'FORBIDDEN', message: e.message ?? 'channel 不可见' } })
-    return
-  }
-  const stream = ensureStream(manager, channelId)
-  if (!stream) {
-    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: 'NOT_FOUND', message: `channel 不存在: ${channelId}` } })
-    return
-  }
-  stream.peers.add(peer)
-  // 共享场景事件注册表:daq 等无频道归属广播由此直达该 peer(sub 鉴权成功后补挂)
-  attachScenePeer(peer, user)
-  let channels = peerChannels.get(peer)
-  if (!channels) {
-    channels = new Set()
-    peerChannels.set(peer, channels)
-  }
-  channels.add(channelId)
-  // 对齐策略:无游标(lastSeq 缺省/为 0)/ seq 倒退(服务重启)/ 缓冲窗外 →
-  // channel.snapshot 全量(agents/tasks/queue/messages 基线,客户端事件即实体);
-  // 否则重放缺失段。lastSeq=0 视为"新订阅者"(游标未建立),同样走快照路径——
-  // 仅重放事件会让客户端丢失实体基线(空闲成员/历史任务永远不出现)。
-  const cursor: number | undefined = (lastSeq !== undefined && lastSeq > 0) ? lastSeq : undefined
-  const oldest = stream.ring[0]?.e.seq ?? stream.seq + 1
-  if (cursor === undefined || cursor >= stream.seq || cursor + 1 < oldest) {
-    const snapshot = buildSnapshot(manager, channelId)
-    if (snapshot) {
-      // v17 §13.1:非管理者只拿白名单投影(剔除 config/token/workspace/内部 mailbox/task payload);
-      // 同时附带群聊侧基线(成员/群聊历史/能力/通知游标),成员无需额外 REST 即可渲染群聊。
-      const payload = canManage
-        ? { ...snapshot, chat: safeChatSnapshot(manager, channelId, user), permissions: safePermissions(manager, channelId, user) }
-        : { ...projectManagementSnapshotForMember(snapshot), chat: safeChatSnapshot(manager, channelId, user), permissions: safePermissions(manager, channelId, user) }
-      sendControl(peer, {
-        v: AEP_VERSION,
-        type: 'channel.snapshot',
-        seq: stream.seq,
-        at: new Date().toISOString(),
-        channelId,
-        payload,
-      })
-    }
-  }
-  else {
-    // 已建立游标且缺口在缓冲窗内 → 重放缺失段(快照无需重发)
-    for (const { e } of stream.ring) {
-      if (e.seq > cursor) sendFrame(stream, peer, JSON.stringify(e))
-    }
-  }
-}
-
-/** 群聊快照(容错:群聊层不可用时返回 null,不阻断管理面快照) */
-export function safeChatSnapshot(manager: AgentChannelManager, channelId: string, user: { id: string }): unknown {
-  try {
-    return manager.chatSnapshotOf(channelId, user)
-  }
-  catch {
-    return null
-  }
-}
-
-/** 能力视图(容错同上) */
-export function safePermissions(manager: AgentChannelManager, channelId: string, user: { id: string, role?: string }): unknown {
-  try {
-    return manager.channelPermissionsOf(channelId, user)
-  }
-  catch {
-    return null
-  }
-}
-
-/** 退订 peer(仅移除 peer;流与订阅常驻——全时录制,无订阅者事件仍落库) */
-export function unsubscribePeer(peer: WsPeer, channelId?: string): void {
-  const channels = peerChannels.get(peer)
-  if (!channels) return
-  const targets = channelId ? [channelId] : [...channels]
-  for (const id of targets) {
-    channels.delete(id)
-    streams.get(id)?.peers.delete(peer)
-  }
-  if (channels.size === 0) peerChannels.delete(peer)
-}
-
-/**
- * 场景事件广播(设备孪生 REST 变更 → 全部已连 peer)。
- * 设备实例属 workspace 而非 channel,信封 channelId='' 不进 channel 流/不落事件库;
- * 客户端经 townBus 旁路消费(scene.syncDevices 即时收敛),轮询兜底不变。
- */
-export { broadcastSceneEvent } from '../../../services/workshop/scene-events'
-
-/**
- * 频道领地布局事件(scene.layout.saved/removed):经该频道频道流广播(仅订阅该频道的
- * peer 收到;小镇页订阅全部挂载频道 → 实时同步布局)。走既有 publish 计入 seq/环形缓冲。
- */
+/**
+ * peer 订阅/退订与聊天快照投影
+ * (由 server/api/workshop/ws.ts 按职责拆出;内容逐行原文搬运)
+ */
+import type { AgentChannelManager } from '../../../services/workshop/runtime/manager'
+import type { WsPeer } from './shared'
+import { AEP_VERSION, peerChannels, streams } from './shared'
+import { attachScenePeer, sendControl, sendFrame } from './hub'
+import { bindUserPeer } from '../../../services/workshop/runtime/user-notification-hub'
+import { buildSnapshot } from './publish'
+import { ensureStream } from './streams'
+import { resolveUserByToken } from '../../../services/user.service'
+import { lineMode } from '../../../services/workshop/permissions'
+// 非管理者快照白名单投影(拆段时生成器漏了这一条:标识符只出现在三元表达式的对象展开里)
+import { projectManagementSnapshotForMember } from '../../../services/workshop/runtime/chat-projection'
+
+export function subscribePeer(manager: AgentChannelManager, peer: WsPeer, channelId: string, lastSeq?: number, userToken?: string): void { // v17:群成员鉴权(requireChannelMember);管理面字段按 canManage 投影(§13.1)
+  if (!userToken) {
+    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: 'USER_UNAUTHORIZED', message: 'WS 订阅需要用户 token(sub 帧携带 token 字段或连接 ?token= 查询参数)' } })
+    return
+  }
+  const user = resolveUserByToken(userToken)
+  if (!user) {
+    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: 'USER_UNAUTHORIZED', message: '用户 token 无效' } })
+    return
+  }
+  // v17:token 认证成功后绑定 peer→userId(用户级通知 hub 的 recipient 隔离基础)
+  bindUserPeer(peer, user.id)
+  let canManage: boolean
+  try {
+    // 成员守卫:owner 或 active 群成员可订阅(群聊读取/发言/WS/HITL 可见性同口径);
+    // 管理能力另行判定,仅用于快照投影深度。
+    manager.requireChannelMember(channelId, user)
+    // 权限模型 v3:绑线 channel 的产线隔离 —— 对该线无 grant 的用户不可订阅
+    // (与 listChannelsVisibleTo 同口径;撤权后既有订阅者下次 sub 起被拒,事件不再直达)
+    const ch = manager.deps.repos.channels.findById(channelId)
+    if (ch?.lineId && lineMode(user, ch.lineId) === 'none') {
+      throw Object.assign(new Error(`无产线「${ch.lineId}」授权,频道事件不可订阅`), { code: 'LINE_FORBIDDEN' })
+    }
+    canManage = manager.channelPermissionsOf(channelId, user).canManage
+  }
+  catch (err) {
+    const e = err as { code?: string, message?: string }
+    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: e.code ?? 'FORBIDDEN', message: e.message ?? 'channel 不可见' } })
+    return
+  }
+  const stream = ensureStream(manager, channelId)
+  if (!stream) {
+    sendControl(peer, { v: AEP_VERSION, type: 'error', seq: 0, at: new Date().toISOString(), channelId, payload: { code: 'NOT_FOUND', message: `channel 不存在: ${channelId}` } })
+    return
+  }
+  stream.peers.add(peer)
+  // 共享场景事件注册表:daq 等无频道归属广播由此直达该 peer(sub 鉴权成功后补挂)
+  attachScenePeer(peer, user)
+  let channels = peerChannels.get(peer)
+  if (!channels) {
+    channels = new Set()
+    peerChannels.set(peer, channels)
+  }
+  channels.add(channelId)
+  // 对齐策略:无游标(lastSeq 缺省/为 0)/ seq 倒退(服务重启)/ 缓冲窗外 →
+  // channel.snapshot 全量(agents/tasks/queue/messages 基线,客户端事件即实体);
+  // 否则重放缺失段。lastSeq=0 视为"新订阅者"(游标未建立),同样走快照路径——
+  // 仅重放事件会让客户端丢失实体基线(空闲成员/历史任务永远不出现)。
+  const cursor: number | undefined = (lastSeq !== undefined && lastSeq > 0) ? lastSeq : undefined
+  const oldest = stream.ring[0]?.e.seq ?? stream.seq + 1
+  if (cursor === undefined || cursor >= stream.seq || cursor + 1 < oldest) {
+    const snapshot = buildSnapshot(manager, channelId)
+    if (snapshot) {
+      // v17 §13.1:非管理者只拿白名单投影(剔除 config/token/workspace/内部 mailbox/task payload);
+      // 同时附带群聊侧基线(成员/群聊历史/能力/通知游标),成员无需额外 REST 即可渲染群聊。
+      const payload = canManage
+        ? { ...snapshot, chat: safeChatSnapshot(manager, channelId, user), permissions: safePermissions(manager, channelId, user) }
+        : { ...projectManagementSnapshotForMember(snapshot), chat: safeChatSnapshot(manager, channelId, user), permissions: safePermissions(manager, channelId, user) }
+      sendControl(peer, {
+        v: AEP_VERSION,
+        type: 'channel.snapshot',
+        seq: stream.seq,
+        at: new Date().toISOString(),
+        channelId,
+        payload,
+      })
+    }
+  }
+  else {
+    // 已建立游标且缺口在缓冲窗内 → 重放缺失段(快照无需重发)
+    for (const { e } of stream.ring) {
+      if (e.seq > cursor) sendFrame(stream, peer, JSON.stringify(e))
+    }
+  }
+}
+
+/** 群聊快照(容错:群聊层不可用时返回 null,不阻断管理面快照) */
+export function safeChatSnapshot(manager: AgentChannelManager, channelId: string, user: { id: string }): unknown {
+  try {
+    return manager.chatSnapshotOf(channelId, user)
+  }
+  catch {
+    return null
+  }
+}
+
+/** 能力视图(容错同上) */
+export function safePermissions(manager: AgentChannelManager, channelId: string, user: { id: string, role?: string }): unknown {
+  try {
+    return manager.channelPermissionsOf(channelId, user)
+  }
+  catch {
+    return null
+  }
+}
+
+/** 退订 peer(仅移除 peer;流与订阅常驻——全时录制,无订阅者事件仍落库) */
+export function unsubscribePeer(peer: WsPeer, channelId?: string): void {
+  const channels = peerChannels.get(peer)
+  if (!channels) return
+  const targets = channelId ? [channelId] : [...channels]
+  for (const id of targets) {
+    channels.delete(id)
+    streams.get(id)?.peers.delete(peer)
+  }
+  if (channels.size === 0) peerChannels.delete(peer)
+}
+
+/**
+ * 场景事件广播(设备孪生 REST 变更 → 全部已连 peer)。
+ * 设备实例属 workspace 而非 channel,信封 channelId='' 不进 channel 流/不落事件库;
+ * 客户端经 townBus 旁路消费(scene.syncDevices 即时收敛),轮询兜底不变。
+ */
+export { broadcastSceneEvent } from '../../../services/workshop/scene-events'
+
+/**
+ * 频道领地布局事件(scene.layout.saved/removed):经该频道频道流广播(仅订阅该频道的
+ * peer 收到;小镇页订阅全部挂载频道 → 实时同步布局)。走既有 publish 计入 seq/环形缓冲。
+ */

package/server/api/workshop/ws/subscriptions.ts

@@ -4,7 +4,11 @@
  */
 import type { AgentChannelManager } from '../../../services/workshop/runtime/manager'
 import type { ChannelStream } from './shared'
-import { hitlAudience } from './audience'
+import { hitlAudience, adminUserIds } from './audience'
+
+import { lineOfHitlItem } from '../../../services/workshop/agents/hitl-decision/line-of'
+import { lineMode } from '../../../services/workshop/permissions'
+import { userRepository } from '../../../repositories/user.repository'
 import { internalsOf } from './hub'
 import { mapAgentEvent } from './event-mapping'
 import { publish, rootQueueViewOf } from './publish'
@@ -105,6 +109,9 @@ export function bindStreamSubscriptions(manager: AgentChannelManager, stream: Ch
  *  **不再**调用 broadcastPeerEvent。 */
 export function bindHitlSubscription(manager: AgentChannelManager, stream: ChannelStream): void {
   stream.hitlUnsub?.()
+  // 权限模型 v3:条目产线锚点的受众过滤依赖(每次事件现算 admin 集,量级个位数)
+  const adminIds = new Set(adminUserIds())
+  const channel = manager.deps.repos.channels.findById(stream.channelId)
   stream.hitlUnsub = subscribeHitlEvents(stream.channelId, (e) => {
     // ① 频道流(seq/环形缓冲/落库/回放)—— 这是**审计与回放**轨迹,不是可操作通道。
     //    审批动作本身另受两道闸门约束:REST pending 快照按可裁决性过滤、
@@ -113,7 +120,14 @@ export function bindHitlSubscription(manager: AgentChannelManager, stream: Chann
     publish(manager, stream, e.type, e.payload, { agentId: e.agentId })
     // ② 定向通知(用户级 hub):**按审批资格**扇出,而不是按频道成员资格 ——
     //    owner_only 频道里普通成员不该收到"需要你处理"的定向提示。
+    //    权限模型 v3:再按条目产线锚点过滤 —— 对该产线无 grant 的用户不推送
+    //    (锚点从载荷推导,回退 channel.line_id;admin 恒收,锚点缺失不过滤)。
+    const itemLine = lineOfHitlItem((e.payload ?? {}) as { nodeId?: string, kind?: string }, channel?.lineId)
     for (const userId of hitlAudience(manager, stream.channelId)) {
+      if (itemLine && !adminIds.has(userId)) {
+        const u = userRepository.findById(userId)
+        if (!u || lineMode(u, itemLine) === 'none') continue
+      }
       publishToUser(userId, e.type, e.payload, { eventId: `${e.type}:${(e.payload as { kind?: string, id?: string }).kind}:${(e.payload as { id?: string }).id}` })
     }
   })