agentworkshop 0.7.66 → 0.7.71

package/scripts/line-log-smoke.mjs

@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+/**
+ * 产线日志验收(2026-10-19;隔离实例,真实 HTTP + Agent 工具桥):
+ *  G1 隔离实例 + admin 注册
+ *  G2 建线/节点/产品/配方/频道(lead)+ 绑线 + 节点绑定
+ *  G3 生成真实产线操作:dcw.create / line.update / recipe.create / recipe.apply /
+ *     recipe.dispatch.ack / line.start / line.stop / 人工记录
+ *  G4 生成全局污染事件:user.create + auth.login(必须被产线日志排除)
+ *  G5 API:默认 line 域 / 按 line / 按 recipe / 按时间 / 非法时间区间 / scope=all
+ *  G6 Agent 工具:ops_log(line+recipe+时间)、recipe_log、越权产线、非法时间、node_id
+ *
+ * 运行:node scripts/line-log-smoke.mjs
+ */
+import { spawn, spawnSync } from 'node:child_process'
+import { mkdirSync, openSync, rmSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { tmpdir } from 'node:os'
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const ROOT = join(tmpdir(), 'aw-line-log-smoke')
+rmSync(ROOT, { recursive: true, force: true })
+mkdirSync(join(ROOT, 'home'), { recursive: true })
+const TAG = `ll${Date.now().toString(36).slice(-4)}`
+const results = []
+const ok = (id, name, cond, detail = '') => {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 320) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 320)}`}`)
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+let port = 0
+for (const p of [3993, 3992, 3991, 3990]) {
+  try {
+    const r = await fetch(`http://127.0.0.1:${p}/api/health`, { signal: AbortSignal.timeout(1200) })
+    if (r.ok) continue
+  }
+  catch { /* 空闲 */ }
+  port = p
+  break
+}
+if (!port) {
+  console.error('无空闲端口')
+  process.exit(1)
+}
+const BASE = `http://127.0.0.1:${port}`
+process.env.NO_PROXY = '127.0.0.1,localhost'
+const logFd = openSync(join(ROOT, 'dev.log'), 'a')
+const child = spawn(process.execPath, [join(REPO, 'bin', 'aw.mjs'), 'dev', '--port', String(port)], {
+  cwd: REPO,
+  env: {
+    ...process.env,
+    AW_MODE: 'home',
+    AW_HOME: join(ROOT, 'home'),
+    AW_RATE_LIMIT_OFF: '1',
+    NUXT_SESSION_PASSWORD: 'LineLog#2026-e2e-session-key',
+    NO_PROXY: '127.0.0.1,localhost',
+  },
+  stdio: ['ignore', logFd, logFd],
+  windowsHide: true,
+})
+
+async function api(method, path, body, token, timeoutMs = 120_000) {
+  const res = await fetch(BASE + path, {
+    method,
+    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs),
+  })
+  let json = null
+  try {
+    json = await res.json()
+  }
+  catch { /* 非 JSON */ }
+  return { status: res.status, ...json }
+}
+const data = r => r?.data ?? null
+const invText = r => String(r?.data?.result?.text ?? r?.data?.text ?? '')
+const invErr = r => Boolean(r?.data?.result?.isError ?? r?.data?.isError)
+const invoke = (agentId, tool, args, token) => api('POST', '/api/workshop/agent-tools/invoke', { agentId, tool, args }, token)
+
+try {
+  let healthy = false
+  for (let i = 0; i < 90; i++) {
+    await sleep(2000)
+    try {
+      const h = await api('GET', '/api/health', undefined, undefined, 3000)
+      if (h?.data?.status === 'ok' && h?.data?.workshop === 'ready') {
+        healthy = true
+        break
+      }
+    }
+    catch { /* 未就绪 */ }
+  }
+  ok('G1a', '隔离实例启动 + workshop ready', healthy, `port=${port}`)
+  if (!healthy) throw new Error('实例未就绪')
+
+  const email = `ll-${TAG}@awshop.local`
+  const token = data(await api('POST', '/api/users/register', { name: `ll-admin-${TAG}`, email, password: 'LineLog#2026' }))?.token
+  ok('G1b', 'admin 注册/登录', Boolean(token))
+  const H = () => token
+
+  // ── G2 场景 ──
+  const lineA = data(await api('POST', '/api/workshop/dcw/lines', { name: `日志线A-${TAG}` }, H()))?.line?.id
+  const lineB = data(await api('POST', '/api/workshop/dcw/lines', { name: `日志线B-${TAG}` }, H()))?.line?.id
+  const tpl = data(await api('POST', '/api/workshop/dcw/templates', { name: `日志参数-${TAG}`, ch: '温度', unit: '℃', min: 0, max: 200, decimals: 1 }, H()))?.template?.key
+  const node = data(await api('POST', '/api/workshop/dcw', { templateRef: tpl, name: `日志数控-${TAG}`, driver: 'mock', lineId: lineA, stepLimit: 20, driverConfig: { key: `ll-${TAG}` } }, H()))?.node?.id
+  const product = data(await api('POST', '/api/workshop/dcw/products', { lineId: lineA, name: `日志产品-${TAG}` }, H()))?.product?.id
+  const recipe = data(await api('POST', '/api/workshop/dcw/recipes', { productId: product, name: `日志配方-${TAG}`, params: [{ nodeId: node, value: 100, min: 0, max: 200 }] }, H()))?.recipe?.id
+  const ch = data(await api('POST', '/api/workshop/channels', { name: `日志频道-${TAG}`, leadAgent: { name: `日志lead-${TAG}`, harness: 'omp' } }, H()))
+  const channelId = ch?.channelId
+  const lead = ch?.leadAgentId
+  const bindLine = await api('PUT', `/api/workshop/channels/${channelId}/line`, { lineId: lineA }, H())
+  // 不额外做节点/配方绑定:只靠频道绑线的只读扩权,验证 ops_log/recipe_log 的读面口径
+  ok('G2', '建线/节点/产品/配方/频道(lead)/绑线',
+    Boolean(lineA && lineB && tpl && node && product && recipe && channelId && lead) && bindLine.status === 200,
+    JSON.stringify({ lineA, lineB, node, recipe, channelId, lead, bindLine: bindLine.status }).slice(0, 300))
+
+  // ── G3 真实产线操作 ──
+  await api('POST', '/api/workshop/dcw/controller', { action: 'start' }, H())
+  const apply = await api('POST', `/api/workshop/dcw/recipes/${recipe}/apply`, {}, H())
+  const start = await api('POST', `/api/workshop/dcw/lines/${lineA}/start`, { recipeId: recipe }, H())
+  const stop = await api('POST', `/api/workshop/dcw/lines/${lineA}/stop`, {}, H())
+  const patch = await api('PATCH', `/api/workshop/dcw/lines/${lineA}`, { description: `line-log-${TAG}` }, H())
+  const manualSummary = `人工值班记录-${TAG}`
+  const manual = await api('POST', '/api/workshop/ops-logs', { summary: manualSummary, lineId: lineA, recipeId: recipe, detail: { tag: TAG } }, H())
+  ok('G3', '真实产线操作已生成(recipe.apply/line.start/stop/line.update/manual)',
+    apply.status === 200 && start.status === 200 && stop.status === 200 && patch.status === 200 && manual.status === 200,
+    JSON.stringify({ apply: apply.status, start: start.status, stop: stop.status, patch: patch.status, manual: manual.status, msg: apply.message ?? start.message ?? manual.message }).slice(0, 300))
+
+  // ── G4 全局污染事件(必须不出现在产线日志)──
+  const tempEmail = `ll-temp-${TAG}@awshop.local`
+  const tempUser = data(await api('POST', '/api/users', { name: `ll-temp-${TAG}`, email: tempEmail, password: 'LineLog#2026', role: 'user' }, H()))
+  const login = await api('POST', '/api/users/login', { email: tempEmail, password: 'LineLog#2026' })
+  ok('G4', '全局事件已生成(user.create + auth.login)', Boolean(tempUser?.id) && login.status === 200,
+    JSON.stringify({ userId: tempUser?.id, login: login.status }).slice(0, 200))
+
+  await sleep(1200)
+  const all = await api('GET', '/api/workshop/ops-logs?limit=500', undefined, H())
+  const allRows = data(all)?.logs ?? []
+  ok('G5a', '产线日志默认只返回 scope=line 且 line_id 非空的记录',
+    all.status === 200 && allRows.length > 0 && allRows.every(r => r.scope === 'line' && String(r.lineId ?? '') !== ''),
+    `status=${all.status} n=${allRows.length} badScope=${allRows.filter(r => r.scope !== 'line').length} noLine=${allRows.filter(r => !r.lineId).length}`)
+  ok('G5b', '登录/用户创建/系统设置/备份不进入产线日志',
+    !allRows.some(r => r.action === 'auth.login' || r.action === 'user.create' || String(r.action).startsWith('system.')),
+    `actions=${[...new Set(allRows.map(r => r.action))].slice(0, 16).join(',')}`)
+
+  const byLine = data(await api('GET', `/api/workshop/ops-logs?lineId=${encodeURIComponent(lineA)}&limit=500`, undefined, H()))?.logs ?? []
+  const lineActions = new Set(byLine.map(r => r.action))
+  ok('G5c', '按产线过滤:全部命中该线,含无 recipe 的产线事件与开线/配方/人工事件',
+    byLine.length > 0 && byLine.every(r => r.lineId === lineA && r.scope === 'line')
+    && ['line.start', 'line.stop', 'line.update', 'recipe.apply', 'recipe.dispatch.ack', 'dcw.create', 'ops.manual'].every(a => lineActions.has(a))
+    && byLine.some(r => !r.recipeId),
+    `n=${byLine.length} noRecipe=${byLine.filter(r => !r.recipeId).length} actions=${[...lineActions].join(',')}`)
+  ok('G5d', '按产线查询不含其他产线记录', !byLine.some(r => r.lineId === lineB), `lineB=${lineB}`)
+
+  const byRecipe = data(await api('GET', `/api/workshop/ops-logs?lineId=${encodeURIComponent(lineA)}&recipeId=${encodeURIComponent(recipe)}&limit=500`, undefined, H()))?.logs ?? []
+  ok('G5e', '按产线+配方过滤:全部命中该配方,含下发/回执/开停线/人工记录,排除无 recipe 事件',
+    byRecipe.length > 0 && byRecipe.every(r => r.recipeId === recipe && r.scope === 'line')
+    && ['recipe.apply', 'recipe.dispatch.ack', 'line.start', 'line.stop', 'ops.manual'].every(a => byRecipe.some(r => r.action === a))
+    && !byRecipe.some(r => r.action === 'dcw.create' || r.action === 'line.update'),
+    `n=${byRecipe.length} actions=${[...new Set(byRecipe.map(r => r.action))].join(',')}`)
+
+  const from = new Date(Date.now() - 10 * 60_000).toISOString()
+  const to = new Date(Date.now() + 10 * 60_000).toISOString()
+  const byTime = data(await api('GET', `/api/workshop/ops-logs?lineId=${encodeURIComponent(lineA)}&from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}&limit=500`, undefined, H()))?.logs ?? []
+  const inRange = byTime.every((r) => {
+    const t = Date.parse(String(r.at))
+    return Number.isFinite(t) && t >= Date.parse(from) && t <= Date.parse(to)
+  })
+  ok('G5f', '按时间区间过滤:结果全部落在 from~to 内且包含人工记录',
+    byTime.length > 0 && inRange && byTime.some(r => r.action === 'ops.manual' && r.summary === manualSummary),
+    `n=${byTime.length} inRange=${inRange}`)
+
+  const badRange = await api('GET', `/api/workshop/ops-logs?from=${encodeURIComponent(to)}&to=${encodeURIComponent(from)}`, undefined, H())
+  ok('G5g', '非法时间区间返回 400 且可行动', badRange.status === 400 && badRange.code === 'VALIDATION_ERROR' && /时间区间无效/.test(String(badRange.message)),
+    `status=${badRange.status} code=${badRange.code} msg=${badRange.message}`)
+
+  const allScope = data(await api('GET', '/api/workshop/ops-logs?scope=all&limit=500', undefined, H()))?.logs ?? []
+  ok('G5h', 'scope=all 保留全局安全审计(登录/用户创建可见)',
+    allScope.some(r => r.action === 'auth.login') && allScope.some(r => r.action === 'user.create'),
+    `n=${allScope.length} authLogin=${allScope.filter(r => r.action === 'auth.login').length}`)
+
+  const systemScope = data(await api('GET', '/api/workshop/ops-logs?scope=system&limit=500', undefined, H()))?.logs ?? []
+  ok('G5i', 'scope=system 只返回系统域记录(登录/用户创建可见,产线事件不可见)',
+    systemScope.length > 0 && systemScope.every(r => r.scope === 'system')
+    && systemScope.some(r => r.action === 'auth.login') && !systemScope.some(r => r.action === 'line.start'),
+    `n=${systemScope.length} actions=${[...new Set(systemScope.map(r => r.action))].slice(0, 10).join(',')}`)
+
+  // ── G6 Agent 工具 ──
+  const opsLineRecipe = await invoke(lead, 'ops_log', { line_id: lineA, recipe_id: recipe, minutes: 60, limit: 100 }, H())
+  const opsText = invText(opsLineRecipe)
+  ok('G6a', 'Agent ops_log(line+recipe) 回包带 scope/产线/配方归属与人工记录',
+    !invErr(opsLineRecipe) && opsText.includes('scope=line') && opsText.includes(lineA) && opsText.includes(recipe) && opsText.includes(`日志线A-${TAG}`) && opsText.includes(manualSummary),
+    `err=${invErr(opsLineRecipe)} text=${opsText.slice(0, 260)}`)
+  console.log(`  ops_log sample:\n${opsText.split('\n').slice(0, 6).map(l => `    ${l}`).join('\n')}`)
+
+  const opsRecipeTime = await invoke(lead, 'ops_log', { recipe_id: recipe, from, to, limit: 100 }, H())
+  const opsRecipeTimeText = invText(opsRecipeTime)
+  ok('G6b', 'Agent ops_log(只传 recipe_id + from/to) 自动收窄产线并命中',
+    !invErr(opsRecipeTime) && opsRecipeTimeText.includes(lineA) && opsRecipeTimeText.includes(manualSummary) && /时间窗/.test(opsRecipeTimeText),
+    `err=${invErr(opsRecipeTime)} text=${opsRecipeTimeText.slice(0, 260)}`)
+
+  const recipeLog = await invoke(lead, 'recipe_log', { recipe_id: recipe, minutes: 60, limit: 100 }, H())
+  const recipeLogText = invText(recipeLog)
+  ok('G6c', 'Agent recipe_log(recipe_id) 命中创建/下发/回执且带 scope=line',
+    !invErr(recipeLog) && /配方创建|配方下发|下发回执/.test(recipeLogText) && recipeLogText.includes(`日志配方-${TAG}`) && recipeLogText.includes('scope=line'),
+    `err=${invErr(recipeLog)} text=${recipeLogText.slice(0, 260)}`)
+  console.log(`  recipe_log sample:\n${recipeLogText.split('\n').slice(0, 5).map(l => `    ${l}`).join('\n')}`)
+
+  const opsNode = await invoke(lead, 'ops_log', { line_id: lineA, node_id: node, minutes: 60, limit: 100 }, H())
+  ok('G6d', 'Agent ops_log(node_id) 绑定面内可查',
+    !invErr(opsNode) && invText(opsNode).includes(node.slice(0, 8)),
+    `err=${invErr(opsNode)} text=${invText(opsNode).slice(0, 220)}`)
+
+  const denied = await invoke(lead, 'ops_log', { line_id: lineB, minutes: 60 }, H())
+  ok('G6e', '越权产线被拒且列出可读产线', invErr(denied) && /无权查询产线|不在你的可读范围/.test(invText(denied)),
+    `err=${invErr(denied)} text=${invText(denied).slice(0, 220)}`)
+
+  const badTime = await invoke(lead, 'ops_log', { line_id: lineA, from: to, to: from }, H())
+  ok('G6f', 'Agent 非法时间区间被拒', invErr(badTime) && /时间区间无效/.test(invText(badTime)),
+    `err=${invErr(badTime)} text=${invText(badTime).slice(0, 220)}`)
+
+  const noLine = await invoke(lead, 'ops_log', { minutes: 60, limit: 100 }, H())
+  ok('G6g', 'Agent 不传 line_id 时默认频道绑定产线', !invErr(noLine) && invText(noLine).includes(lineA) && invText(noLine).includes(manualSummary),
+    `err=${invErr(noLine)} text=${invText(noLine).slice(0, 220)}`)
+
+  const alias = await invoke(lead, 'line_log', { line_id: lineA, minutes: 60, limit: 100 }, H())
+  const aliasText = invText(alias)
+  ok('G6h', 'line_log 显式别名可用且回包与 ops_log 同口径', !invErr(alias) && aliasText.includes('scope=line') && aliasText.includes(lineA) && aliasText.includes(manualSummary),
+    `err=${invErr(alias)} text=${aliasText.slice(0, 240)}`)
+
+  const opsLineOnly = await invoke(lead, 'line_log', { line_id: lineA, minutes: 60, limit: 100 }, H())
+  const opsLineOnlyText = invText(opsLineOnly)
+  ok('G6i', 'Agent 按线查询包含无 recipe 的产线事件(dcw.create/line.update)',
+    !invErr(opsLineOnly) && opsLineOnlyText.includes('dcw.create') && opsLineOnlyText.includes('line.update') && opsLineOnlyText.includes('配方=-'),
+    `err=${invErr(opsLineOnly)} text=${opsLineOnlyText.slice(0, 320)}`)
+
+  const opsByRecipe = await invoke(lead, 'line_log', { recipe_id: recipe, minutes: 60, limit: 100 }, H())
+  const opsByRecipeText = invText(opsByRecipe)
+  ok('G6j', 'Agent 按 recipe 查询排除无 recipe 事件', !invErr(opsByRecipe) && !opsByRecipeText.includes('dcw.create') && !opsByRecipeText.includes('line.update'),
+    `err=${invErr(opsByRecipe)} text=${opsByRecipeText.slice(0, 280)}`)
+}
+catch (err) {
+  ok('GX', '执行异常', false, err instanceof Error ? err.stack ?? err.message : String(err))
+}
+finally {
+  try {
+    spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], { windowsHide: true })
+  }
+  catch { /* 已退出 */ }
+  const passed = results.filter(r => r.pass).length
+  const failed = results.filter(r => !r.pass)
+  console.log(`\n═══ 结论:${failed.length === 0 ? 'PASS' : 'FAIL'}(${passed}/${results.length})═══`)
+  if (failed.length) {
+    console.log('失败项:')
+    for (const f of failed) console.log(`  ✖ [${f.id}] ${f.name} — ${f.detail}`)
+  }
+  process.exit(failed.length === 0 ? 0 : 1)
+}

package/scripts/live-aml-optloop.mjs

@@ -116,132 +116,175 @@ log(`✔ cast-film 预设应用,设备 ${simDevices.length} 台: ${simDevices.ma
 
 /* ════════ Stage 1 · admin 注册 ════════ */
 section('Stage 1 · 用户注册 + 提权(repo 库既有用户体系,新注册=user;本链路需 admin 建 DCW/产线)')
-const reg = await api('POST', '/api/workshop/users/register', { name: `aml-live-${RUN_ID}` })
-const token = reg.json?.data?.token
-if (!token) throw new Error(`注册失败: ${JSON.stringify(reg.json).slice(0, 200)}`)
-log('✔ token 就绪')
-// 提升 role → admin(直改全局 users.sqlite;resolveUserByToken 每请求读库,即时生效)。
-// 这是对本隔离测试账号的一次性授权,等价于管理员在用户管理页手工提权。
-{
-  const { DatabaseSync } = await import('node:sqlite')
-  const usersDb = new DatabaseSync(join(REPO, '.AgentWorkShop', 'data', 'users.sqlite'))
-  const r = usersDb.prepare(`UPDATE users SET role = 'admin' WHERE email LIKE 'aml-live-${RUN_ID}%' AND role = 'user'`).run()
-  usersDb.close()
-  log(`✔ 提权 admin: ${Number(r.changes)} 行`)
+let token = String(process.env.AW_TOKEN ?? '').trim()
+if (token) {
+  log('✔ 复用调用方 admin token（隔离实例已初始化，不再注册新账号）')
+}
+else {
+  const reg = await api('POST', '/api/workshop/users/register', { name: `aml-live-${RUN_ID}` })
+  token = reg.json?.data?.token
+  if (!token) throw new Error(`注册失败: ${JSON.stringify(reg.json).slice(0, 200)}`)
+  log('✔ token 就绪')
+  // 提升 role → admin（repo 库首次注册为 user 时的一次性测试授权）
+  {
+    const { DatabaseSync } = await import('node:sqlite')
+    const usersDb = new DatabaseSync(join(REPO, '.AgentWorkShop', 'data', 'users.sqlite'))
+    const r = usersDb.prepare(`UPDATE users SET role = 'admin' WHERE email LIKE 'aml-live-${RUN_ID}%' AND role = 'user'`).run()
+    usersDb.close()
+    log(`✔ 提权 admin: ${Number(r.changes)} 行`)
+  }
 }
 
-/* ════════ Stage 2 · 产线 provision + 开跑 ════════ */
+/* ════════ Stage 2 · 产线 provision + 开跑（或复用已完成采样的线/数据集）════════ */
 section('Stage 2 · 产线 provisioning(6 DCW 执行器 + 5 DAQ 传感器,驱动配置取自模拟器 /export)')
 const sfx = RUN_ID.slice(5, 16).replace(/-/g, '')
-const twin = await provisionTwinLine({ call: async (m, p, b) => { const r = await api(m, p, b, token); return { status: r.status, ...(r.json ?? {}) } } }, { simDevices, sfx })
-for (const e of twin.ev) log('  ' + e)
-if (!twin.ok) throw new Error(`provision 失败: ${(twin.errors ?? []).join('; ')} | ev=${(twin.ev ?? []).join(' ; ')}`)
-log(`✔ lineId=${twin.lineId} productId=${twin.productId}`)
-log(`  DCW: ${JSON.stringify(twin.dcw)}`)
-log(`  DAQ: ${JSON.stringify(twin.daq)}`)
+const REUSE_LINE = String(process.env.AML_REUSE_LINE ?? '').trim()
+let twin
+let batch1
+let dataset
+let spReadback
+if (REUSE_LINE) {
+  twin = {
+    lineId: REUSE_LINE,
+    productId: String(process.env.AML_REUSE_PRODUCT ?? ''),
+    dcw: JSON.parse(String(process.env.AML_REUSE_DCW ?? '{}')),
+    daq: JSON.parse(String(process.env.AML_REUSE_DAQ ?? '{}')),
+  }
+  batch1 = { recipeId: String(process.env.AML_REUSE_RECIPE ?? '') }
+  dataset = {
+    id: String(process.env.AML_REUSE_DATASET ?? ''),
+    rowCount: Number(process.env.AML_REUSE_ROWS ?? 0),
+    runIds: [1, 2, 3],
+    sha256: String(process.env.AML_REUSE_SHA ?? ''),
+  }
+  spReadback = JSON.parse(String(process.env.AML_REUSE_SP ?? '{}'))
+  log(`✔ 复用采样结果 line=${twin.lineId} recipe=${batch1.recipeId} dataset=${dataset.id} (${dataset.rowCount} 窗)`)
+}
+else {
+  twin = await provisionTwinLine({ call: async (m, p, b) => { const r = await api(m, p, b, token); return { status: r.status, ...(r.json ?? {}) } } }, { simDevices, sfx })
+  for (const e of twin.ev) log('  ' + e)
+  if (!twin.ok) throw new Error(`provision 失败: ${(twin.errors ?? []).join('; ')} | ev=${(twin.ev ?? []).join(' ; ')}`)
+  log(`✔ lineId=${twin.lineId} productId=${twin.productId}`)
+  log(`  DCW: ${JSON.stringify(twin.dcw)}`)
+  log(`  DAQ: ${JSON.stringify(twin.daq)}`)
 
-const batch1 = await startTwinBatch({ call: async (m, p, b) => { const r = await api(m, p, b, token); return { status: r.status, ...(r.json ?? {}) } } }, { lineId: twin.lineId, productId: twin.productId, dcw: twin.dcw, sfx })
-if (!batch1.ok) throw new Error(`开跑失败: ${batch1.errors?.join('; ')}`)
-log(`✔ 批次开跑 recipeId=${batch1.recipeId}`)
+  batch1 = await startTwinBatch({ call: async (m, p, b) => { const r = await api(m, p, b, token); return { status: r.status, ...(r.json ?? {}) } } }, { lineId: twin.lineId, productId: twin.productId, dcw: twin.dcw, sfx })
+  if (!batch1.ok) throw new Error(`开跑失败: ${batch1.errors?.join('; ')}`)
+  log(`✔ 批次开跑 recipeId=${batch1.recipeId}`)
 
-// ── SP 设定点回读 DAQ 节点:AML 数据集的 control 输入取自数采时序库,
-//    执行器设定点必须有 DAQ 回读节点(同一信号,只读)才能进入训练。──
-const { simExport } = await import('../bench/lib/sim.mjs')
-const spReadback = {}
-const spSignalIds = Object.keys(twin.dcw) // zone1-sp / screw-sp / linespeed-sp / diegap-sp …
-for (const dev of simDevices) {
-  const exp = await simExport(dev.id)
-  const items = exp?.items ?? []
-  for (const spId of spSignalIds) {
-    if (spReadback[spId]) continue
-    const sig = (dev.signals ?? []).find(s => s.id === spId)
-    if (!sig) continue
-    // export 的 item.signal = 信号【名】(如「加热区1SP」),按名对齐
-    const item = items.find(i => i.signal === sig.name)
-    if (!item?.driverConfig) continue
-    // 写配置 → 读配置转换:mqtt 写用 jsonKey(发布字段),DAQ 读订阅同主题用 jsonPath 取值
-    let cfg = { ...item.driverConfig }
-    if (cfg.jsonKey !== undefined && cfg.jsonPath === undefined) {
-      cfg.jsonPath = cfg.jsonKey
-      delete cfg.jsonKey
+  // ── SP 设定点回读 DAQ 节点:AML 数据集的 control 输入取自数采时序库,
+  //    执行器设定点必须有 DAQ 回读节点(同一信号,只读)才能进入训练。──
+  const { simExport } = await import('../bench/lib/sim.mjs')
+  spReadback = {}
+  const spSignalIds = Object.keys(twin.dcw) // zone1-sp / screw-sp / linespeed-sp / diegap-sp …
+  for (const dev of simDevices) {
+    const exp = await simExport(dev.id)
+    const items = exp?.items ?? []
+    for (const spId of spSignalIds) {
+      if (spReadback[spId]) continue
+      const sig = (dev.signals ?? []).find(s => s.id === spId)
+      if (!sig) continue
+      // export 的 item.signal = 信号【名】(如「加热区1SP」),按名对齐
+      const item = items.find(i => i.signal === sig.name)
+      if (!item?.driverConfig) continue
+      // 写配置 → 读配置转换:mqtt 写用 jsonKey(发布字段),DAQ 读订阅同主题用 jsonPath 取值
+      let cfg = { ...item.driverConfig }
+      if (cfg.jsonKey !== undefined && cfg.jsonPath === undefined) {
+        cfg.jsonPath = cfg.jsonKey
+        delete cfg.jsonKey
+      }
+      const r = await api('POST', '/api/workshop/daq', {
+        name: `${sig.name} 回读 ${sfx}`, templateRef: 'daq-temp-tc', driver: dev.protocol, driverConfig: cfg,
+        unit: sig.unit, min: sig.min, max: sig.max, lineId: twin.lineId, intervalMs: 1000, publishIntervalMs: 0,
+        semantics: `执行器设定点回读(AML control 输入) ${item.signal}`,
+      }, token)
+      if (r.json?.data?.node?.id) spReadback[spId] = r.json.data.node.id
     }
-    const r = await api('POST', '/api/workshop/daq', {
-      name: `${sig.name} 回读 ${sfx}`, templateRef: 'daq-temp-tc', driver: dev.protocol, driverConfig: cfg,
-      unit: sig.unit, min: sig.min, max: sig.max, lineId: twin.lineId, intervalMs: 1000, publishIntervalMs: 0,
-      semantics: `执行器设定点回读(AML control 输入) ${item.signal}`,
-    }, token)
-    if (r.json?.data?.node?.id) spReadback[spId] = r.json.data.node.id
   }
-}
-log(`✔ SP 回读 DAQ 节点 ${Object.keys(spReadback).length}/6: ${JSON.stringify(spReadback)}`)
+  log(`✔ SP 回读 DAQ 节点 ${Object.keys(spReadback).length}/6: ${JSON.stringify(spReadback)}`)
 
-/* ════════ Stage 3 · 3 批次采样(每批 500s;批内两段安全阶跃激励) ════════ */
-section('Stage 3 · 真实采样:3 批次 × 500s(批内阶跃激励:每个切分都覆盖 3 个设定点水平)')
-// 实验设计:设定点只在批次间变化会导致 train/test 分布割裂(外推爆炸,G1/G3 必挂)。
-// 批内阶跃:每个 run 依次经历 base → +Δ1 → +Δ2 三个水平,train/val/test 同分布;
-// 各 run 的 Δ 略作变化增加丰富度,全部在配方窗口与安全上限内。
-const BASE_SP = { 'linespeed-sp': 95, 'diegap-sp': 1.0 }
-const EXCITE_RUNS = [
-  [{ ls: 2.0, dg: 0.03 }, { ls: -1.5, dg: 0.06 }],
-  [{ ls: -1.0, dg: 0.05 }, { ls: 2.5, dg: 0.02 }],
-  [{ ls: 1.5, dg: 0.04 }, { ls: -2.0, dg: 0.05 }],
-]
-for (let run = 1; run <= 3; run++) {
-  if (run > 1) {
-    await api('POST', `/api/workshop/dcw/lines/${twin.lineId}/stop`, {}, token)
-    log('  上一批次停止')
-    // 复用同一配方 stop/start → 新 runId(数据集按 recipeId 取批次,须同配方)
-    const st = await api('POST', `/api/workshop/dcw/lines/${twin.lineId}/start`, { recipeId: batch1.recipeId }, token)
-    if (st.status !== 200) throw new Error(`批次 ${run} 开跑失败: ${JSON.stringify(st.json).slice(0, 200)}`)
-    log(`  批次 ${run} 开跑(同配方 ${batch1.recipeId})`)
+  /* ════════ Stage 3 · 3 批次采样(每批 500s;批内两段安全阶跃激励) ════════ */
+  section('Stage 3 · 真实采样:3 批次 × 500s(批内阶跃激励:每个切分都覆盖 3 个设定点水平)')
+  // 实验设计:设定点只在批次间变化会导致 train/test 分布割裂(外推爆炸,G1/G3 必挂)。
+  // 批内阶跃:每个 run 依次经历 base → +Δ1 → +Δ2 三个水平,train/val/test 同分布;
+  // 各 run 的 Δ 略作变化增加丰富度,全部在配方窗口与安全上限内。
+  const BASE_SP = { 'linespeed-sp': 95, 'diegap-sp': 1.0 }
+  const EXCITE_RUNS = [
+    [{ ls: 2.0, dg: 0.03 }, { ls: -1.5, dg: 0.06 }],
+    [{ ls: -1.0, dg: 0.05 }, { ls: 2.5, dg: 0.02 }],
+    [{ ls: 1.5, dg: 0.04 }, { ls: -2.0, dg: 0.05 }],
+  ]
+  for (let run = 1; run <= 3; run++) {
+    if (run > 1) {
+    // stop 是异步收窗：立即 start 会撞「已在运行」。必须轮询到 active=false 再开。
+      for (let attempt = 0; attempt < 12; attempt++) {
+        await api('POST', `/api/workshop/dcw/lines/${twin.lineId}/stop`, {}, token)
+        await sleep(1000)
+        const snap = await api('GET', '/api/workshop/dcw', undefined, token)
+        const state = (snap.json?.data?.lineStates ?? []).find(x => x.lineId === twin.lineId)
+        if (!state?.active) break
+        if (attempt === 11) throw new Error(`批次 ${run} 前停线超时: ${JSON.stringify(state)}`)
+      }
+      log('  上一批次停止(active=false)')
+      // 复用同一配方 stop/start → 新 runId(数据集按 recipeId 取批次,须同配方)
+      let started = null
+      for (let attempt = 0; attempt < 8; attempt++) {
+        started = await api('POST', `/api/workshop/dcw/lines/${twin.lineId}/start`, { recipeId: batch1.recipeId }, token)
+        if (started.status === 200) break
+        if (!/已在运行/.test(String(started.json?.message ?? ''))) break
+        await sleep(1000)
+      }
+      if (started?.status !== 200) throw new Error(`批次 ${run} 开跑失败: ${JSON.stringify(started?.json).slice(0, 200)}`)
+      log(`  批次 ${run} 开跑(同配方 ${batch1.recipeId})`)
+    }
+    await sleep(20_000) // base 水平稳定（基准压缩：3×240s，仍≥720 行 1s 样本）
+    const [e1, e2] = EXCITE_RUNS[run - 1]
+    await api('POST', `/api/workshop/dcw/${twin.dcw['linespeed-sp']}/write`, { value: BASE_SP['linespeed-sp'] + e1.ls }, token)
+    await api('POST', `/api/workshop/dcw/${twin.dcw['diegap-sp']}/write`, { value: BASE_SP['diegap-sp'] + e1.dg }, token)
+    log(`  批次${run} 阶跃1: linespeed=${BASE_SP['linespeed-sp'] + e1.ls} diegap=${(BASE_SP['diegap-sp'] + e1.dg).toFixed(2)}`)
+    await sleep(80_000)
+    await api('POST', `/api/workshop/dcw/${twin.dcw['linespeed-sp']}/write`, { value: BASE_SP['linespeed-sp'] + e2.ls }, token)
+    await api('POST', `/api/workshop/dcw/${twin.dcw['diegap-sp']}/write`, { value: BASE_SP['diegap-sp'] + e2.dg }, token)
+    log(`  批次${run} 阶跃2: linespeed=${BASE_SP['linespeed-sp'] + e2.ls} diegap=${(BASE_SP['diegap-sp'] + e2.dg).toFixed(2)}`)
+    await sleep(140_000) // 第三水平保持至 240s
+    const pv = twin.daq['film-thickness']
+    const r = await api('GET', `/api/workshop/daq/${pv}/samples?bucketMs=1000&limit=3`, undefined, token)
+    const latest = r.json?.data?.points?.[0]?.avg ?? '?'
+    log(`  批次${run} 完成(500s) · 膜厚当前≈${typeof latest === 'number' ? latest.toFixed(2) : latest} μm`)
   }
-  await sleep(60_000) // base 水平稳定 60s
-  const [e1, e2] = EXCITE_RUNS[run - 1]
-  await api('POST', `/api/workshop/dcw/${twin.dcw['linespeed-sp']}/write`, { value: BASE_SP['linespeed-sp'] + e1.ls }, token)
-  await api('POST', `/api/workshop/dcw/${twin.dcw['diegap-sp']}/write`, { value: BASE_SP['diegap-sp'] + e1.dg }, token)
-  log(`  批次${run} 阶跃1: linespeed=${BASE_SP['linespeed-sp'] + e1.ls} diegap=${(BASE_SP['diegap-sp'] + e1.dg).toFixed(2)}`)
-  await sleep(170_000)
-  await api('POST', `/api/workshop/dcw/${twin.dcw['linespeed-sp']}/write`, { value: BASE_SP['linespeed-sp'] + e2.ls }, token)
-  await api('POST', `/api/workshop/dcw/${twin.dcw['diegap-sp']}/write`, { value: BASE_SP['diegap-sp'] + e2.dg }, token)
-  log(`  批次${run} 阶跃2: linespeed=${BASE_SP['linespeed-sp'] + e2.ls} diegap=${(BASE_SP['diegap-sp'] + e2.dg).toFixed(2)}`)
-  await sleep(270_000) // 第三水平保持至 500s
-  const pv = twin.daq['film-thickness']
-  const r = await api('GET', `/api/workshop/daq/${pv}/samples?bucketMs=1000&limit=3`, undefined, token)
-  const latest = r.json?.data?.points?.[0]?.avg ?? '?'
-  log(`  批次${run} 完成(500s) · 膜厚当前≈${typeof latest === 'number' ? latest.toFixed(2) : latest} μm`)
-}
-await api('POST', `/api/workshop/dcw/lines/${twin.lineId}/stop`, {}, token)
-log('✔ 采样完成(3 批次 × 330s),产线停止')
+  await api('POST', `/api/workshop/dcw/lines/${twin.lineId}/stop`, {}, token)
+  log('✔ 采样完成(3 批次 × 330s),产线停止')
 
-/* ════════ Stage 4 · 构建数据集(输入=SP 回读 DAQ,目标=膜厚) ════════ */
-section('Stage 4 · AML 数据集构建(输入=6 个 SP 回读 DAQ;输出目标=膜厚 goal;特征=熔温/熔压)')
-if (Object.keys(spReadback).length < 6) throw new Error(`SP 回读节点不足: ${JSON.stringify(spReadback)}`)
-// 采样预检:逐节点确认批次期间有样本(无样本的回读剔除并记录,防 0 窗数据集)
-const sampledControls = []
-for (const [sig, nodeId] of Object.entries(spReadback)) {
-  const r = await api('GET', `/api/workshop/daq/${nodeId}/samples?bucketMs=60000&limit=1`, undefined, token)
-  const has = (r.json?.data?.points ?? []).length > 0
-  log(`  回读采样检查 ${sig}(${nodeId}): ${has ? '✓ 有样本' : '✘ 无样本,剔除'}`)
-  if (has) sampledControls.push({ nodeId, role: 'control' })
-}
-if (sampledControls.length < 4) throw new Error(`可用 control 回读不足: ${sampledControls.length}`)
-const dsBody = {
-  lineId: twin.lineId, productId: twin.productId, recipeId: batch1.recipeId,
-  nodes: [
-    ...sampledControls,
-    { nodeId: twin.daq['film-thickness'], role: 'target' },
-    { nodeId: twin.daq['melt-temp'], role: 'feature' },
-    { nodeId: twin.daq['melt-pressure'], role: 'feature' },
-  ],
-  beatMs: 1000, window: { historySteps: 8, horizonSteps: 4 },
-  split: { valRatio: 0.34, testRatio: 0.33, seed: 42 },
-  purpose: 'mpc_surrogate',
-  note: `live 闭环优化数据集 ${RUN_ID}`,
+  /* ════════ Stage 4 · 构建数据集(输入=SP 回读 DAQ,目标=膜厚) ════════ */
+  section('Stage 4 · AML 数据集构建(输入=6 个 SP 回读 DAQ;输出目标=膜厚 goal;特征=熔温/熔压)')
+  if (Object.keys(spReadback).length < 6) throw new Error(`SP 回读节点不足: ${JSON.stringify(spReadback)}`)
+  // 采样预检:逐节点确认批次期间有样本(无样本的回读剔除并记录,防 0 窗数据集)
+  const sampledControls = []
+  for (const [sig, nodeId] of Object.entries(spReadback)) {
+    const r = await api('GET', `/api/workshop/daq/${nodeId}/samples?bucketMs=60000&limit=1`, undefined, token)
+    const has = (r.json?.data?.points ?? []).length > 0
+    log(`  回读采样检查 ${sig}(${nodeId}): ${has ? '✓ 有样本' : '✘ 无样本,剔除'}`)
+    if (has) sampledControls.push({ nodeId, role: 'control' })
+  }
+  if (sampledControls.length < 4) throw new Error(`可用 control 回读不足: ${sampledControls.length}`)
+  const dsBody = {
+    lineId: twin.lineId, productId: twin.productId, recipeId: batch1.recipeId,
+    nodes: [
+      ...sampledControls,
+      { nodeId: twin.daq['film-thickness'], role: 'target' },
+      { nodeId: twin.daq['melt-temp'], role: 'feature' },
+      { nodeId: twin.daq['melt-pressure'], role: 'feature' },
+    ],
+    beatMs: 1000, window: { historySteps: 8, horizonSteps: 4 },
+    split: { valRatio: 0.34, testRatio: 0.33, seed: 42 },
+    purpose: 'mpc_surrogate',
+    note: `live 闭环优化数据集 ${RUN_ID}`,
+  }
+  const ds = await api('POST', '/api/workshop/aml/datasets', dsBody, token)
+  dataset = ds.json?.data?.dataset
+  if (!dataset) throw new Error(`数据集构建失败: ${JSON.stringify(ds.json).slice(0, 300)}`)
+  log(`✔ 数据集 ${dataset.id}: ${dataset.rowCount} 窗 / ${dataset.runIds.length} 批 / sha=${String(dataset.sha256).slice(0, 12)}`)
 }
-const ds = await api('POST', '/api/workshop/aml/datasets', dsBody, token)
-const dataset = ds.json?.data?.dataset
-if (!dataset) throw new Error(`数据集构建失败: ${JSON.stringify(ds.json).slice(0, 300)}`)
-log(`✔ 数据集 ${dataset.id}: ${dataset.rowCount} 窗 / ${dataset.runIds.length} 批 / sha=${String(dataset.sha256).slice(0, 12)}`)
 
 /* ════════ Stage 5 · hybrid_twin Channel 实例化 + worker 绑定 ════════ */
 section('Stage 5 · Hybrid Twin Channel(模板实例化 + worker 节点绑定)')
@@ -260,13 +303,13 @@ const channelId = inst.json?.data?.channelId
 const worker = inst.json?.data?.agents?.find(x => x.role === 'worker')
 if (!channelId || !worker) throw new Error(`实例化失败: ${JSON.stringify(inst.json).slice(0, 300)}`)
 log(`✔ channelId=${channelId} worker=${worker.id}`)
-for (const nodeId of Object.values(twin.dcw)) {
-  await api('POST', '/api/workshop/agent-tools/bindings', { agentId: worker.id, nodeId, kind: 'dcw', mode: 'auto' }, token)
-}
+// 权限模型 v2：dcw 节点直绑已废弃；hybrid 场景的控制面 = 绑定 recipe（参数节点展开为 DCW）。
+const recipeBind = await api('POST', '/api/workshop/agent-tools/bindings', { agentId: worker.id, nodeId: batch1.recipeId, kind: 'recipe', mode: 'auto' }, token)
+if (recipeBind.status !== 200) throw new Error(`配方绑定失败: ${JSON.stringify(recipeBind.json).slice(0, 200)}`)
 for (const nodeId of Object.values(twin.daq)) {
   await api('POST', '/api/workshop/agent-tools/bindings', { agentId: worker.id, nodeId, kind: 'daq', mode: 'auto' }, token)
 }
-log(`✔ worker 绑定 ${Object.keys(twin.dcw).length} DCW + ${Object.keys(twin.daq).length} DAQ`)
+log(`✔ worker 绑定 recipe(${Object.keys(twin.dcw).length} 参数) + ${Object.keys(twin.daq).length} DAQ`)
 
 /* ════════ Stage 6 · 场景发现→编译→冻结;骨架 PhysicsSpec ════════ */
 section('Stage 6 · 场景发现→编译→冻结;骨架 PhysicsSpec(twin_physics_spec_draft)')