agentworkshop 0.7.65 → 0.7.70

package/scripts/hitl-reject-e2e.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+/**
+ * hitl-reject-e2e.mjs —— manual 写控 HITL 的**拒绝路径**验收。
+ *
+ * 场景:copilot lead 绑定配方(manual),任务要求 recipe_update 把线速改为 46;
+ * 人工在审批卡上拒绝并附指导。断言:
+ *   1) 出现 dcw-approval 待办(未批准前不落版本/不下发);
+ *   2) 拒绝后 Agent 收到人工指导(交付物含 REJECT-OBSERVED 或指导文本);
+ *   3) 配方版本不变、PLC 当前值不变(fail-closed)。
+ *
+ * 用法:AW_E2E_TOKEN=<admin token> node scripts/hitl-reject-e2e.mjs [--base ...] [--line ...] [--recipe ...]
+ */
+const args = process.argv.slice(2)
+const argOf = (k, d = '') => {
+  const i = args.indexOf(k)
+  return i >= 0 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : d
+}
+const BASE = argOf('--base', process.env.AW_BASE ?? 'http://127.0.0.1:3001')
+const TOKEN = process.env.AW_E2E_TOKEN ?? process.env.AW_TOKEN ?? ''
+const LINE_ID = argOf('--line', 'ln-dd6c9135')
+const RECIPE_ID = argOf('--recipe', 'rc-2be5c50c')
+const SPEED_NODE = argOf('--speed-node', 'dw-d0b66f73')
+const TAG = Date.now().toString(36)
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const checks = []
+const ok = (name, cond, detail = '') => {
+  console.log(`${cond ? 'PASS' : 'FAIL'} | ${name} | ${String(detail).slice(0, 240)}`)
+  checks.push({ name, ok: !!cond, detail: String(detail).slice(0, 500) })
+  return !!cond
+}
+if (!TOKEN) {
+  console.error('缺少 AW_E2E_TOKEN / AW_TOKEN')
+  process.exit(1)
+}
+async function api(method, path, body) {
+  const res = await fetch(BASE + path, {
+    method,
+    headers: { 'content-type': 'application/json', 'authorization': `Bearer ${TOKEN}` },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(120_000),
+  })
+  return { status: res.status, ...(await res.json().catch(() => ({}))) }
+}
+async function waitTask(id, timeoutMs) {
+  const end = Date.now() + timeoutMs
+  let last = null
+  while (Date.now() < end) {
+    await sleep(3000)
+    const r = await api('GET', `/api/workshop/tasks/${id}`)
+    last = r.data ?? last
+    if (['COMPLETED', 'FAILED', 'CANCELED'].includes(last?.state)) return last
+  }
+  return last
+}
+const textOf = t => (t?.artifacts ?? []).flatMap(a => a.parts ?? []).map(p => String(p.text ?? '')).join('\n')
+async function current() {
+  const dcw = await api('GET', '/api/workshop/dcw')
+  const rec = (dcw.data?.recipes ?? []).find(r => r.id === RECIPE_ID)
+  const read = await api('POST', `/api/workshop/dcw/${SPEED_NODE}/read`, {})
+  return { version: Number(rec?.version ?? 0), value: read.data?.read?.value ?? null }
+}
+
+async function main() {
+  console.log(`━━━ HITL 拒绝路径 @ ${BASE} (tag=${TAG}) ━━━`)
+  const before = await current()
+  ok('基线读取(配方版本/PLC 当前值)', before.value !== null, `v${before.version} value=${before.value}`)
+
+  const ch = await api('POST', '/api/workshop/channels', {
+    name: `rej-${TAG}`,
+    description: `hitl-reject-e2e ${TAG}`,
+    leadAgent: { name: 'reject-operator', harness: 'copilot' },
+  })
+  const channelId = ch.data?.channelId
+  const leadId = ch.data?.leadAgentId
+  ok('频道创建(copilot lead)', Boolean(channelId && leadId), channelId ?? ch.message)
+  await api('PUT', `/api/workshop/channels/${channelId}/line`, { lineId: LINE_ID })
+  const bind = await api('POST', '/api/workshop/agent-tools/bindings', { agentId: leadId, nodeId: RECIPE_ID, kind: 'recipe', mode: 'manual' })
+  ok('配方绑定 manual', Boolean(bind.data?.binding), bind.data?.binding?.mode ?? bind.message)
+
+  const task = await api('POST', `/api/workshop/channels/${channelId}/tasks`, {
+    title: `reject-${TAG}`,
+    description: `Use recipe_update with recipe_id="${RECIPE_ID}" and params=[{node_id:"${SPEED_NODE}", value:46}] `
+      + `and reason="REJECT-ACCEPTANCE ${TAG}: deliberately request a change that the human will reject". `
+      + `Wait for the platform's human approval result. If the human rejects, DO NOT retry and DO NOT call recipe_apply. `
+      + `Call complete_task with summary "REJECT-OBSERVED" and include the human comment in your deliverable.`,
+  })
+  const taskId = task.data?.id
+  ok('任务提交', Boolean(taskId), taskId ?? task.message)
+
+  // 轮询审批卡并拒绝(最多 2 次,防止模型重试)
+  let rejected = 0
+  let pendingSnapshot = null
+  const end = Date.now() + 240000
+  while (Date.now() < end && rejected < 2) {
+    const p = await api('GET', `/api/workshop/hitl/pending?channelId=${channelId}`)
+    const items = (p.data?.items ?? []).filter(i => i.kind === 'dcw-approval')
+    // 待批准窗口内快照:证明“未批准前不落版本/不下发”(而不是只靠批准后的结果推断)
+    if (items.length > 0 && !pendingSnapshot) pendingSnapshot = await current()
+    for (const it of items) {
+      const r = await api('POST', '/api/workshop/hitl/respond', {
+        kind: it.kind, id: it.id, confirmed: false, comment: `REJECT-ACCEPTANCE ${TAG}: keep the current value`,
+      })
+      if (r.code === 0) rejected++
+      console.log(`  · HITL 拒绝 ${it.id.slice(0, 8)} ${String(it.title ?? '').slice(0, 80)}`)
+    }
+    if (rejected > 0 && items.length === 0) break
+    await sleep(2000)
+  }
+  ok('出现 manual 审批卡并拒绝', rejected >= 1, `rejected=${rejected}`)
+  ok('待批准期间配方/PLC 未变化(未批准不下发)',
+    Boolean(pendingSnapshot) && pendingSnapshot.version === before.version && Number(pendingSnapshot.value) === Number(before.value),
+    pendingSnapshot ? `pending=v${pendingSnapshot.version}/value=${pendingSnapshot.value}` : '未抓到 pending 窗口快照')
+
+  const done = await waitTask(taskId, 180000)
+  const text = textOf(done)
+  ok('Agent 收到拒绝结果并完成', done?.state === 'COMPLETED' && /REJECT|拒绝|keep the current|未批准/i.test(text), `state=${done?.state} ${text.slice(0, 180)}`)
+
+  const after = await current()
+  ok('拒绝后配方版本不变', after.version === before.version, `before=v${before.version} after=v${after.version}`)
+  ok('拒绝后 PLC 值不变(fail-closed)', Number(after.value) === Number(before.value), `before=${before.value} after=${after.value}`)
+
+  const pass = checks.filter(c => c.ok).length
+  console.log(`\n=== HITL 拒绝路径: ${pass} PASS / ${checks.length - pass} FAIL ===`)
+  const { writeFileSync } = await import('node:fs')
+  writeFileSync('docs/audit/2026-10-20-harness-acceptance-evidence/us004-hitl-reject.json', JSON.stringify({ at: new Date().toISOString(), channelId, taskId, before, pendingSnapshot, after, checks }, null, 2))
+  process.exit(pass === checks.length ? 0 : 1)
+}
+main().catch((err) => {
+  console.error(err)
+  process.exit(1)
+})

package/scripts/hitl-ui-two-harness-demo.mjs

@@ -0,0 +1,243 @@
+#!/usr/bin/env node
+/**
+ * hitl-ui-two-harness-demo.mjs —— omp ask + dsh 权限 HITL 的群聊界面演示。
+ *
+ * omp: 原生 ask 提问 Proceed? yes/no → 群聊页铃标下拉 → 点 yes → 提交答案
+ *      → 断言该待办清空、任务交付物含 yes。
+ * dsh: shell 操作触发 dsh-permission(Allow once/Reject)→ 群聊页铃标下拉
+ *      → 点“批准” → 断言该待办清空、任务不再停留在 SUBMITTED。
+ *
+ * 运行:AW_E2E_TOKEN=<admin token> node scripts/hitl-ui-two-harness-demo.mjs [--base ...]
+ * 产物:docs/audit/2026-10-20-harness-acceptance-evidence/hitl-ui-{omp,dsh}.png
+ */
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const args = process.argv.slice(2)
+const argOf = (k, d = '') => {
+  const i = args.indexOf(k)
+  return i >= 0 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : d
+}
+const BASE = argOf('--base', process.env.AW_BASE ?? 'http://127.0.0.1:3001')
+const TOKEN = process.env.AW_E2E_TOKEN ?? process.env.AW_TOKEN ?? ''
+const SHOT_DIR = 'docs/audit/2026-10-20-harness-acceptance-evidence'
+const TAG = Date.now().toString(36)
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const checks = []
+const ok = (name, cond, detail = '') => {
+  console.log(`${cond ? 'PASS' : 'FAIL'} | ${name} | ${String(detail).slice(0, 220)}`)
+  checks.push({ name, ok: !!cond, detail: String(detail).slice(0, 500) })
+  return !!cond
+}
+if (!TOKEN) {
+  console.error('缺少 AW_E2E_TOKEN / AW_TOKEN')
+  process.exit(1)
+}
+async function api(method, path, body) {
+  const res = await fetch(BASE + path, {
+    method,
+    headers: { 'content-type': 'application/json', 'authorization': `Bearer ${TOKEN}` },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(120_000),
+  })
+  return { status: res.status, ...(await res.json().catch(() => ({}))) }
+}
+async function pendingItem(channelId, kind) {
+  const p = await api('GET', `/api/workshop/hitl/pending?channelId=${channelId}`)
+  return (p.data?.items ?? []).find(i => i.kind === kind) ?? null
+}
+async function waitPending(channelId, kind, timeoutMs) {
+  const end = Date.now() + timeoutMs
+  while (Date.now() < end) {
+    const it = await pendingItem(channelId, kind)
+    if (it) return it
+    await sleep(2500)
+  }
+  return null
+}
+async function waitCleared(channelId, kind, id, timeoutMs = 30_000) {
+  const end = Date.now() + timeoutMs
+  while (Date.now() < end) {
+    const it = (await (async () => {
+      const p = await api('GET', `/api/workshop/hitl/pending?channelId=${channelId}`)
+      return (p.data?.items ?? []).find(i => i.kind === kind && i.id === id) ?? null
+    })())
+    if (!it) return true
+    await sleep(1000)
+  }
+  return false
+}
+async function taskOf(id) {
+  return (await api('GET', `/api/workshop/tasks/${id}`)).data
+}
+
+async function openChannelPage(browser, me, workspaceId, channelName) {
+  const page = await browser.newPage()
+  await page.evaluateOnNewDocument((inject) => {
+    localStorage.setItem('workshop.user', JSON.stringify({ user: { ...inject.me, token: inject.token } }))
+    document.cookie = `token=${inject.token}; path=/; max-age=31536000`
+  }, { me, token: TOKEN })
+  // /workshop/w/<wsId> 是 workspace 控制台;先点左栏 Channel 进入群聊,再开 HITL 铃标。
+  await page.goto(`${BASE}/workshop/w/${workspaceId}`, { waitUntil: 'networkidle2', timeout: 60_000 })
+  await page.waitForSelector('.channel-item', { timeout: 60_000 })
+  await page.evaluate((name) => {
+    const item = [...document.querySelectorAll('.channel-item')]
+      .find(el => el.textContent.includes(name))
+    item?.click()
+  }, channelName)
+  await sleep(2000)
+  await page.waitForSelector('.channel-item.active', { timeout: 30_000 })
+  await page.waitForSelector('.hitl-bell', { timeout: 60_000 })
+  await page.click('.hitl-bell')
+  await page.waitForSelector('.hitl-menu .hitl-item', { timeout: 10_000 })
+  return page
+}
+
+async function itemInfo(page, needle) {
+  return await page.evaluate((n) => {
+    const el = [...document.querySelectorAll('.hitl-menu .hitl-item')]
+      .find(x => x.textContent.includes(n)) ?? null
+    if (!el) return null
+    return {
+      text: el.textContent.replace(/\s+/g, ' ').trim().slice(0, 240),
+      options: [...el.querySelectorAll('.hitl-opt')].map(x => x.textContent.trim()),
+      buttons: [...el.querySelectorAll('.hitl-btns .ant-btn, .hitl-btns button')].map(x => x.textContent.trim()),
+    }
+  }, needle)
+}
+
+async function clickOption(page, needle, optionText) {
+  return await page.evaluate(({ n, t }) => {
+    const el = [...document.querySelectorAll('.hitl-menu .hitl-item')]
+      .find(x => x.textContent.includes(n)) ?? null
+    if (!el) return false
+    const opt = [...el.querySelectorAll('.hitl-opt')]
+      .find(x => x.textContent.trim().toLowerCase() === t.toLowerCase())
+    opt?.click()
+    return Boolean(opt)
+  }, { n: needle, t: optionText })
+}
+
+async function clickPrimary(page, needle) {
+  return await page.evaluate((n) => {
+    const el = [...document.querySelectorAll('.hitl-menu .hitl-item')]
+      .find(x => x.textContent.includes(n)) ?? null
+    if (!el) return false
+    const btn = [...el.querySelectorAll('.hitl-btns .ant-btn-primary, .hitl-btns button')]
+      .find(x => !x.disabled)
+    btn?.click()
+    return Boolean(btn)
+  }, needle)
+}
+
+async function clickApprove(page, needle) {
+  return await page.evaluate((n) => {
+    const el = [...document.querySelectorAll('.hitl-menu .hitl-item')]
+      .find(x => x.textContent.includes(n)) ?? null
+    if (!el) return false
+    // Ant Design 两字按钮会渲染成“批 准”
+    const btn = [...el.querySelectorAll('.hitl-btns .ant-btn')]
+      .find(x => /批\s*准|approve/i.test(x.textContent) && !x.disabled)
+    btn?.click()
+    return Boolean(btn)
+  }, needle)
+}
+
+async function main() {
+  console.log(`━━━ HITL 群聊 UI 双 harness 演示 @ ${BASE} (tag=${TAG}) ━━━`)
+  const me = (await api('GET', '/api/users/me')).data ?? {}
+  mkdirSync(SHOT_DIR, { recursive: true })
+  const browser = await puppeteer.launch({
+    executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+    headless: true,
+    protocolTimeout: 300_000,
+    args: ['--no-sandbox', '--disable-gpu', '--disable-dev-shm-usage', '--window-size=1440,900'],
+    defaultViewport: { width: 1440, height: 900 },
+  })
+
+  // 专用 workspace:把演示 Channel 挂进去,群聊页才能显示该 Channel
+  const ws = await api('POST', '/api/workshop/workspaces', { name: `hitl-ui-${TAG}` })
+  const wsId = ws.data?.workspace?.id ?? ws.data?.id
+  ok('演示 workspace 创建', Boolean(wsId), wsId ?? ws.message)
+
+  // ── omp ask ──
+  const och = await api('POST', '/api/workshop/channels', {
+    name: `ui-omp-${TAG}`,
+    leadAgent: { name: `ui-omp-${TAG}`, harness: 'omp' },
+  })
+  const oChannel = och.data?.channelId
+  await api('POST', `/api/workshop/workspaces/${wsId}/channels/${oChannel}`)
+  const oAgentName = `ui-omp-${TAG}`
+  const oTask = (await api('POST', `/api/workshop/channels/${oChannel}/tasks`, {
+    title: `ui-omp-${TAG}`,
+    description: 'Use the ask tool NOW to ask me exactly one question: "Proceed?" with options yes and no. '
+      + 'Do not do anything else. After I answer, call complete_task with summary set to my exact answer.',
+  })).data?.id
+  const oItem = await waitPending(oChannel, 'omp-dialog', 180_000)
+  ok('omp ask 待办出现', Boolean(oItem), oItem ? `options=${JSON.stringify(oItem.options)} requestType=${oItem.requestType}` : '超时')
+  if (oItem) {
+    const page = await openChannelPage(browser, me, wsId, `ui-omp-${TAG}`)
+    const info = await itemInfo(page, oAgentName)
+    ok('omp 群聊页渲染 ask 选项', Boolean(info?.options?.some(x => x.toLowerCase() === 'yes')), JSON.stringify(info?.options ?? []))
+    await page.screenshot({ path: `${SHOT_DIR}/hitl-ui-omp.png` })
+    const picked = await clickOption(page, oAgentName, 'yes')
+    await sleep(700)
+    const submitted = await clickPrimary(page, oAgentName)
+    ok('omp 群聊页点击 yes 并提交', picked && submitted, `picked=${picked} submitted=${submitted}`)
+    const cleared = await waitCleared(oChannel, 'omp-dialog', oItem.id, 30_000)
+    ok('omp 提交后该待办清空', cleared, `id=${oItem.id}`)
+    let oDone = null
+    for (let i = 0; i < 20; i++) {
+      await sleep(3000)
+      oDone = await taskOf(oTask)
+      if (['COMPLETED', 'FAILED', 'CANCELED'].includes(oDone?.state)) break
+    }
+    const text = (oDone?.artifacts ?? []).flatMap(a => a.parts ?? []).map(p => String(p.text ?? '')).join('')
+    ok('omp agent 收到 yes', oDone?.state === 'COMPLETED' && /\byes\b/i.test(text), `state=${oDone?.state} deliverable=${text.slice(0, 120)}`)
+    await page.close()
+  }
+
+  // ── dsh 权限 ──
+  const dch = await api('POST', '/api/workshop/channels', {
+    name: `ui-dsh-${TAG}`,
+    leadAgent: { name: `ui-dsh-${TAG}`, harness: 'dsh', config: { approvalPolicy: 'ask' } },
+  })
+  const dChannel = dch.data?.channelId
+  await api('POST', `/api/workshop/workspaces/${wsId}/channels/${dChannel}`)
+  const dAgentName = `ui-dsh-${TAG}`
+  const dTask = (await api('POST', `/api/workshop/channels/${dChannel}/tasks`, {
+    title: `ui-dsh-${TAG}`,
+    description: 'Run the shell command "echo DSH-UI-HITL" to verify the environment. This action requires human approval; wait for the approval result.',
+  })).data?.id
+  const dItem = await waitPending(dChannel, 'dsh-permission', 180_000)
+  ok('dsh 权限待办出现', Boolean(dItem), dItem ? `options=${JSON.stringify(dItem.options)} method=${dItem.method}` : '超时')
+  if (dItem) {
+    const page = await openChannelPage(browser, me, wsId, `ui-dsh-${TAG}`)
+    const info = await itemInfo(page, dAgentName)
+    ok('dsh 群聊页渲染批准/拒绝', Boolean(info?.buttons?.some(x => /批\s*准/.test(x))), JSON.stringify(info?.buttons ?? []))
+    await page.screenshot({ path: `${SHOT_DIR}/hitl-ui-dsh.png` })
+    const clicked = await clickApprove(page, dAgentName)
+    ok('dsh 群聊页点击批准', clicked)
+    const cleared = await waitCleared(dChannel, 'dsh-permission', dItem.id, 30_000)
+    ok('dsh 批准后该待办清空', cleared, `id=${dItem.id}`)
+    let dDone = null
+    for (let i = 0; i < 15; i++) {
+      await sleep(3000)
+      dDone = await taskOf(dTask)
+      if (['WORKING', 'COMPLETED', 'FAILED', 'CANCELED'].includes(dDone?.state)) break
+    }
+    ok('dsh 任务批准后继续(非 SUBMITTED)', dDone?.state !== 'SUBMITTED', `state=${dDone?.state}`)
+    await page.close()
+  }
+
+  await browser.close()
+  const pass = checks.filter(c => c.ok).length
+  console.log(`\n=== HITL 群聊 UI 演示: ${pass} PASS / ${checks.length - pass} FAIL ===`)
+  const { writeFileSync } = await import('node:fs')
+  writeFileSync(`${SHOT_DIR}/hitl-ui-two-harness.json`, JSON.stringify({ at: new Date().toISOString(), checks }, null, 2))
+  process.exit(pass === checks.length ? 0 : 1)
+}
+main().catch((err) => {
+  console.error(err)
+  process.exit(1)
+})

package/scripts/line-log-smoke.mjs

@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+/**
+ * 产线日志验收(2026-10-19;隔离实例,真实 HTTP + Agent 工具桥):
+ *  G1 隔离实例 + admin 注册
+ *  G2 建线/节点/产品/配方/频道(lead)+ 绑线 + 节点绑定
+ *  G3 生成真实产线操作:dcw.create / line.update / recipe.create / recipe.apply /
+ *     recipe.dispatch.ack / line.start / line.stop / 人工记录
+ *  G4 生成全局污染事件:user.create + auth.login(必须被产线日志排除)
+ *  G5 API:默认 line 域 / 按 line / 按 recipe / 按时间 / 非法时间区间 / scope=all
+ *  G6 Agent 工具:ops_log(line+recipe+时间)、recipe_log、越权产线、非法时间、node_id
+ *
+ * 运行:node scripts/line-log-smoke.mjs
+ */
+import { spawn, spawnSync } from 'node:child_process'
+import { mkdirSync, openSync, rmSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { tmpdir } from 'node:os'
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const ROOT = join(tmpdir(), 'aw-line-log-smoke')
+rmSync(ROOT, { recursive: true, force: true })
+mkdirSync(join(ROOT, 'home'), { recursive: true })
+const TAG = `ll${Date.now().toString(36).slice(-4)}`
+const results = []
+const ok = (id, name, cond, detail = '') => {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 320) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 320)}`}`)
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+let port = 0
+for (const p of [3993, 3992, 3991, 3990]) {
+  try {
+    const r = await fetch(`http://127.0.0.1:${p}/api/health`, { signal: AbortSignal.timeout(1200) })
+    if (r.ok) continue
+  }
+  catch { /* 空闲 */ }
+  port = p
+  break
+}
+if (!port) {
+  console.error('无空闲端口')
+  process.exit(1)
+}
+const BASE = `http://127.0.0.1:${port}`
+process.env.NO_PROXY = '127.0.0.1,localhost'
+const logFd = openSync(join(ROOT, 'dev.log'), 'a')
+const child = spawn(process.execPath, [join(REPO, 'bin', 'aw.mjs'), 'dev', '--port', String(port)], {
+  cwd: REPO,
+  env: {
+    ...process.env,
+    AW_MODE: 'home',
+    AW_HOME: join(ROOT, 'home'),
+    AW_RATE_LIMIT_OFF: '1',
+    NUXT_SESSION_PASSWORD: 'LineLog#2026-e2e-session-key',
+    NO_PROXY: '127.0.0.1,localhost',
+  },
+  stdio: ['ignore', logFd, logFd],
+  windowsHide: true,
+})
+
+async function api(method, path, body, token, timeoutMs = 120_000) {
+  const res = await fetch(BASE + path, {
+    method,
+    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs),
+  })
+  let json = null
+  try {
+    json = await res.json()
+  }
+  catch { /* 非 JSON */ }
+  return { status: res.status, ...json }
+}
+const data = r => r?.data ?? null
+const invText = r => String(r?.data?.result?.text ?? r?.data?.text ?? '')
+const invErr = r => Boolean(r?.data?.result?.isError ?? r?.data?.isError)
+const invoke = (agentId, tool, args, token) => api('POST', '/api/workshop/agent-tools/invoke', { agentId, tool, args }, token)
+
+try {
+  let healthy = false
+  for (let i = 0; i < 90; i++) {
+    await sleep(2000)
+    try {
+      const h = await api('GET', '/api/health', undefined, undefined, 3000)
+      if (h?.data?.status === 'ok' && h?.data?.workshop === 'ready') {
+        healthy = true
+        break
+      }
+    }
+    catch { /* 未就绪 */ }
+  }
+  ok('G1a', '隔离实例启动 + workshop ready', healthy, `port=${port}`)
+  if (!healthy) throw new Error('实例未就绪')
+
+  const email = `ll-${TAG}@awshop.local`
+  const token = data(await api('POST', '/api/users/register', { name: `ll-admin-${TAG}`, email, password: 'LineLog#2026' }))?.token
+  ok('G1b', 'admin 注册/登录', Boolean(token))
+  const H = () => token
+
+  // ── G2 场景 ──
+  const lineA = data(await api('POST', '/api/workshop/dcw/lines', { name: `日志线A-${TAG}` }, H()))?.line?.id
+  const lineB = data(await api('POST', '/api/workshop/dcw/lines', { name: `日志线B-${TAG}` }, H()))?.line?.id
+  const tpl = data(await api('POST', '/api/workshop/dcw/templates', { name: `日志参数-${TAG}`, ch: '温度', unit: '℃', min: 0, max: 200, decimals: 1 }, H()))?.template?.key
+  const node = data(await api('POST', '/api/workshop/dcw', { templateRef: tpl, name: `日志数控-${TAG}`, driver: 'mock', lineId: lineA, stepLimit: 20, driverConfig: { key: `ll-${TAG}` } }, H()))?.node?.id
+  const product = data(await api('POST', '/api/workshop/dcw/products', { lineId: lineA, name: `日志产品-${TAG}` }, H()))?.product?.id
+  const recipe = data(await api('POST', '/api/workshop/dcw/recipes', { productId: product, name: `日志配方-${TAG}`, params: [{ nodeId: node, value: 100, min: 0, max: 200 }] }, H()))?.recipe?.id
+  const ch = data(await api('POST', '/api/workshop/channels', { name: `日志频道-${TAG}`, leadAgent: { name: `日志lead-${TAG}`, harness: 'omp' } }, H()))
+  const channelId = ch?.channelId
+  const lead = ch?.leadAgentId
+  const bindLine = await api('PUT', `/api/workshop/channels/${channelId}/line`, { lineId: lineA }, H())
+  // 不额外做节点/配方绑定:只靠频道绑线的只读扩权,验证 ops_log/recipe_log 的读面口径
+  ok('G2', '建线/节点/产品/配方/频道(lead)/绑线',
+    Boolean(lineA && lineB && tpl && node && product && recipe && channelId && lead) && bindLine.status === 200,
+    JSON.stringify({ lineA, lineB, node, recipe, channelId, lead, bindLine: bindLine.status }).slice(0, 300))
+
+  // ── G3 真实产线操作 ──
+  await api('POST', '/api/workshop/dcw/controller', { action: 'start' }, H())
+  const apply = await api('POST', `/api/workshop/dcw/recipes/${recipe}/apply`, {}, H())
+  const start = await api('POST', `/api/workshop/dcw/lines/${lineA}/start`, { recipeId: recipe }, H())
+  const stop = await api('POST', `/api/workshop/dcw/lines/${lineA}/stop`, {}, H())
+  const patch = await api('PATCH', `/api/workshop/dcw/lines/${lineA}`, { description: `line-log-${TAG}` }, H())
+  const manualSummary = `人工值班记录-${TAG}`
+  const manual = await api('POST', '/api/workshop/ops-logs', { summary: manualSummary, lineId: lineA, recipeId: recipe, detail: { tag: TAG } }, H())
+  ok('G3', '真实产线操作已生成(recipe.apply/line.start/stop/line.update/manual)',
+    apply.status === 200 && start.status === 200 && stop.status === 200 && patch.status === 200 && manual.status === 200,
+    JSON.stringify({ apply: apply.status, start: start.status, stop: stop.status, patch: patch.status, manual: manual.status, msg: apply.message ?? start.message ?? manual.message }).slice(0, 300))
+
+  // ── G4 全局污染事件(必须不出现在产线日志)──
+  const tempEmail = `ll-temp-${TAG}@awshop.local`
+  const tempUser = data(await api('POST', '/api/users', { name: `ll-temp-${TAG}`, email: tempEmail, password: 'LineLog#2026', role: 'user' }, H()))
+  const login = await api('POST', '/api/users/login', { email: tempEmail, password: 'LineLog#2026' })
+  ok('G4', '全局事件已生成(user.create + auth.login)', Boolean(tempUser?.id) && login.status === 200,
+    JSON.stringify({ userId: tempUser?.id, login: login.status }).slice(0, 200))
+
+  await sleep(1200)
+  const all = await api('GET', '/api/workshop/ops-logs?limit=500', undefined, H())
+  const allRows = data(all)?.logs ?? []
+  ok('G5a', '产线日志默认只返回 scope=line 且 line_id 非空的记录',
+    all.status === 200 && allRows.length > 0 && allRows.every(r => r.scope === 'line' && String(r.lineId ?? '') !== ''),
+    `status=${all.status} n=${allRows.length} badScope=${allRows.filter(r => r.scope !== 'line').length} noLine=${allRows.filter(r => !r.lineId).length}`)
+  ok('G5b', '登录/用户创建/系统设置/备份不进入产线日志',
+    !allRows.some(r => r.action === 'auth.login' || r.action === 'user.create' || String(r.action).startsWith('system.')),
+    `actions=${[...new Set(allRows.map(r => r.action))].slice(0, 16).join(',')}`)
+
+  const byLine = data(await api('GET', `/api/workshop/ops-logs?lineId=${encodeURIComponent(lineA)}&limit=500`, undefined, H()))?.logs ?? []
+  const lineActions = new Set(byLine.map(r => r.action))
+  ok('G5c', '按产线过滤:全部命中该线,含无 recipe 的产线事件与开线/配方/人工事件',
+    byLine.length > 0 && byLine.every(r => r.lineId === lineA && r.scope === 'line')
+    && ['line.start', 'line.stop', 'line.update', 'recipe.apply', 'recipe.dispatch.ack', 'dcw.create', 'ops.manual'].every(a => lineActions.has(a))
+    && byLine.some(r => !r.recipeId),
+    `n=${byLine.length} noRecipe=${byLine.filter(r => !r.recipeId).length} actions=${[...lineActions].join(',')}`)
+  ok('G5d', '按产线查询不含其他产线记录', !byLine.some(r => r.lineId === lineB), `lineB=${lineB}`)
+
+  const byRecipe = data(await api('GET', `/api/workshop/ops-logs?lineId=${encodeURIComponent(lineA)}&recipeId=${encodeURIComponent(recipe)}&limit=500`, undefined, H()))?.logs ?? []
+  ok('G5e', '按产线+配方过滤:全部命中该配方,含下发/回执/开停线/人工记录,排除无 recipe 事件',
+    byRecipe.length > 0 && byRecipe.every(r => r.recipeId === recipe && r.scope === 'line')
+    && ['recipe.apply', 'recipe.dispatch.ack', 'line.start', 'line.stop', 'ops.manual'].every(a => byRecipe.some(r => r.action === a))
+    && !byRecipe.some(r => r.action === 'dcw.create' || r.action === 'line.update'),
+    `n=${byRecipe.length} actions=${[...new Set(byRecipe.map(r => r.action))].join(',')}`)
+
+  const from = new Date(Date.now() - 10 * 60_000).toISOString()
+  const to = new Date(Date.now() + 10 * 60_000).toISOString()
+  const byTime = data(await api('GET', `/api/workshop/ops-logs?lineId=${encodeURIComponent(lineA)}&from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}&limit=500`, undefined, H()))?.logs ?? []
+  const inRange = byTime.every((r) => {
+    const t = Date.parse(String(r.at))
+    return Number.isFinite(t) && t >= Date.parse(from) && t <= Date.parse(to)
+  })
+  ok('G5f', '按时间区间过滤:结果全部落在 from~to 内且包含人工记录',
+    byTime.length > 0 && inRange && byTime.some(r => r.action === 'ops.manual' && r.summary === manualSummary),
+    `n=${byTime.length} inRange=${inRange}`)
+
+  const badRange = await api('GET', `/api/workshop/ops-logs?from=${encodeURIComponent(to)}&to=${encodeURIComponent(from)}`, undefined, H())
+  ok('G5g', '非法时间区间返回 400 且可行动', badRange.status === 400 && badRange.code === 'VALIDATION_ERROR' && /时间区间无效/.test(String(badRange.message)),
+    `status=${badRange.status} code=${badRange.code} msg=${badRange.message}`)
+
+  const allScope = data(await api('GET', '/api/workshop/ops-logs?scope=all&limit=500', undefined, H()))?.logs ?? []
+  ok('G5h', 'scope=all 保留全局安全审计(登录/用户创建可见)',
+    allScope.some(r => r.action === 'auth.login') && allScope.some(r => r.action === 'user.create'),
+    `n=${allScope.length} authLogin=${allScope.filter(r => r.action === 'auth.login').length}`)
+
+  const systemScope = data(await api('GET', '/api/workshop/ops-logs?scope=system&limit=500', undefined, H()))?.logs ?? []
+  ok('G5i', 'scope=system 只返回系统域记录(登录/用户创建可见,产线事件不可见)',
+    systemScope.length > 0 && systemScope.every(r => r.scope === 'system')
+    && systemScope.some(r => r.action === 'auth.login') && !systemScope.some(r => r.action === 'line.start'),
+    `n=${systemScope.length} actions=${[...new Set(systemScope.map(r => r.action))].slice(0, 10).join(',')}`)
+
+  // ── G6 Agent 工具 ──
+  const opsLineRecipe = await invoke(lead, 'ops_log', { line_id: lineA, recipe_id: recipe, minutes: 60, limit: 100 }, H())
+  const opsText = invText(opsLineRecipe)
+  ok('G6a', 'Agent ops_log(line+recipe) 回包带 scope/产线/配方归属与人工记录',
+    !invErr(opsLineRecipe) && opsText.includes('scope=line') && opsText.includes(lineA) && opsText.includes(recipe) && opsText.includes(`日志线A-${TAG}`) && opsText.includes(manualSummary),
+    `err=${invErr(opsLineRecipe)} text=${opsText.slice(0, 260)}`)
+  console.log(`  ops_log sample:\n${opsText.split('\n').slice(0, 6).map(l => `    ${l}`).join('\n')}`)
+
+  const opsRecipeTime = await invoke(lead, 'ops_log', { recipe_id: recipe, from, to, limit: 100 }, H())
+  const opsRecipeTimeText = invText(opsRecipeTime)
+  ok('G6b', 'Agent ops_log(只传 recipe_id + from/to) 自动收窄产线并命中',
+    !invErr(opsRecipeTime) && opsRecipeTimeText.includes(lineA) && opsRecipeTimeText.includes(manualSummary) && /时间窗/.test(opsRecipeTimeText),
+    `err=${invErr(opsRecipeTime)} text=${opsRecipeTimeText.slice(0, 260)}`)
+
+  const recipeLog = await invoke(lead, 'recipe_log', { recipe_id: recipe, minutes: 60, limit: 100 }, H())
+  const recipeLogText = invText(recipeLog)
+  ok('G6c', 'Agent recipe_log(recipe_id) 命中创建/下发/回执且带 scope=line',
+    !invErr(recipeLog) && /配方创建|配方下发|下发回执/.test(recipeLogText) && recipeLogText.includes(`日志配方-${TAG}`) && recipeLogText.includes('scope=line'),
+    `err=${invErr(recipeLog)} text=${recipeLogText.slice(0, 260)}`)
+  console.log(`  recipe_log sample:\n${recipeLogText.split('\n').slice(0, 5).map(l => `    ${l}`).join('\n')}`)
+
+  const opsNode = await invoke(lead, 'ops_log', { line_id: lineA, node_id: node, minutes: 60, limit: 100 }, H())
+  ok('G6d', 'Agent ops_log(node_id) 绑定面内可查',
+    !invErr(opsNode) && invText(opsNode).includes(node.slice(0, 8)),
+    `err=${invErr(opsNode)} text=${invText(opsNode).slice(0, 220)}`)
+
+  const denied = await invoke(lead, 'ops_log', { line_id: lineB, minutes: 60 }, H())
+  ok('G6e', '越权产线被拒且列出可读产线', invErr(denied) && /无权查询产线|不在你的可读范围/.test(invText(denied)),
+    `err=${invErr(denied)} text=${invText(denied).slice(0, 220)}`)
+
+  const badTime = await invoke(lead, 'ops_log', { line_id: lineA, from: to, to: from }, H())
+  ok('G6f', 'Agent 非法时间区间被拒', invErr(badTime) && /时间区间无效/.test(invText(badTime)),
+    `err=${invErr(badTime)} text=${invText(badTime).slice(0, 220)}`)
+
+  const noLine = await invoke(lead, 'ops_log', { minutes: 60, limit: 100 }, H())
+  ok('G6g', 'Agent 不传 line_id 时默认频道绑定产线', !invErr(noLine) && invText(noLine).includes(lineA) && invText(noLine).includes(manualSummary),
+    `err=${invErr(noLine)} text=${invText(noLine).slice(0, 220)}`)
+
+  const alias = await invoke(lead, 'line_log', { line_id: lineA, minutes: 60, limit: 100 }, H())
+  const aliasText = invText(alias)
+  ok('G6h', 'line_log 显式别名可用且回包与 ops_log 同口径', !invErr(alias) && aliasText.includes('scope=line') && aliasText.includes(lineA) && aliasText.includes(manualSummary),
+    `err=${invErr(alias)} text=${aliasText.slice(0, 240)}`)
+
+  const opsLineOnly = await invoke(lead, 'line_log', { line_id: lineA, minutes: 60, limit: 100 }, H())
+  const opsLineOnlyText = invText(opsLineOnly)
+  ok('G6i', 'Agent 按线查询包含无 recipe 的产线事件(dcw.create/line.update)',
+    !invErr(opsLineOnly) && opsLineOnlyText.includes('dcw.create') && opsLineOnlyText.includes('line.update') && opsLineOnlyText.includes('配方=-'),
+    `err=${invErr(opsLineOnly)} text=${opsLineOnlyText.slice(0, 320)}`)
+
+  const opsByRecipe = await invoke(lead, 'line_log', { recipe_id: recipe, minutes: 60, limit: 100 }, H())
+  const opsByRecipeText = invText(opsByRecipe)
+  ok('G6j', 'Agent 按 recipe 查询排除无 recipe 事件', !invErr(opsByRecipe) && !opsByRecipeText.includes('dcw.create') && !opsByRecipeText.includes('line.update'),
+    `err=${invErr(opsByRecipe)} text=${opsByRecipeText.slice(0, 280)}`)
+}
+catch (err) {
+  ok('GX', '执行异常', false, err instanceof Error ? err.stack ?? err.message : String(err))
+}
+finally {
+  try {
+    spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], { windowsHide: true })
+  }
+  catch { /* 已退出 */ }
+  const passed = results.filter(r => r.pass).length
+  const failed = results.filter(r => !r.pass)
+  console.log(`\n═══ 结论:${failed.length === 0 ? 'PASS' : 'FAIL'}(${passed}/${results.length})═══`)
+  if (failed.length) {
+    console.log('失败项:')
+    for (const f of failed) console.log(`  ✖ [${f.id}] ${f.name} — ${f.detail}`)
+  }
+  process.exit(failed.length === 0 ? 0 : 1)
+}