agentworkshop 0.7.7 → 0.7.9

package/i18n/locales/zh-CN.ts

@@ -161,6 +161,10 @@ export default {
     'runtime.daq.mqttPassword': 'MQTT 密码',
     'runtime.daq.mqttCaFile': 'MQTT CA 证书',
     'runtime.daq.mqttRejectUnauthorized': 'MQTT 校验证书',
+    'runtime.daq.samplingDefaultIntervalMs': '节点采样默认间隔(ms)',
+    'runtime.daq.samplingMinIntervalMs': '节点采样下限(ms)',
+    'runtime.daq.queryDefaultBucketMs': '时序查询默认间隔(ms)',
+    'runtime.daq.queryMinBucketMs': '时序查询下限(ms)',
     'runtime.daq.tsRetentionH': '标量时序保留(h)',
     'runtime.daq.frameRetentionH': '帧元数据保留(h)',
     'runtime.daq.alarmWebhookUrl': '告警 Webhook',
@@ -1867,12 +1871,15 @@ export default {
   },
   plugins: {
     title: '插件管理',
-    subtitle: '配置根 plugins/ 目录 · 启停即时热重载',
+    subtitle: '内置示例与用户级扩展插件 · 启停即时热重载',
     refresh: '刷新',
     enabled: '已启用',
     disabled: '已停用',
-    scopeProject: '项目级',
-    scopeUser: '用户级',
+    scopeProject: '内置示例',
+    scopeUser: '用户级扩展',
+    scopeBuiltinHint: '内置示例插件:随项目检出提供(仓库 .AgentWorkShop/plugins),可启停',
+    scopeUserHint: '用户级扩展插件:位于 ~/.AgentWorkShop/plugins,由使用者自行创建维护',
+    loadFail: '插件列表加载失败',
     hasClient: '浏览器增强',
     routes: 'API 路由',
     empty: '暂无插件 —— aw plugin create <name> 创建,或 aw plugin enable 开启示例',
@@ -1881,6 +1888,16 @@ export default {
     enableFail: '启停操作失败',
     detail: '插件详情',
   },
+  errors: {
+    http400: '请求参数有误,请检查后重试',
+    http401: '登录已过期,请重新登录',
+    http403: '权限不足:该操作需要管理员权限',
+    http404: '目标不存在或已被删除',
+    http409: '操作冲突:资源已存在或状态不允许',
+    http5xx: '服务器内部错误,请稍后重试',
+    network: '无法连接服务器,请检查网络与服务状态',
+    fallback: '操作失败,请稍后重试',
+  },
   error: {
     backHome: '返回首页',
     lost: '页面走失了',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentworkshop",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "type": "module",
   "description": "AgentWorkShop 软件开发系统 - 基于 Nuxt 4 的配置驱动运行范式",
   "license": "PolyForm-Noncommercial-1.0.0",

package/scripts/_dbg-codex-handshake.ts

@@ -0,0 +1,30 @@
+import { StdioJsonRpcClient } from '../server/services/workshop/agents/adapters/stdio-jsonrpc'
+
+async function main() {
+  const client = new StdioJsonRpcClient({
+    name: 'codex-test',
+    command: 'codex',
+    args: ['app-server'],
+    cwd: process.cwd(),
+    requestTimeoutMs: 20_000,
+  })
+  client.onExit((code) => {
+    console.log('[test] app-server EXIT code=', code)
+    process.exit(1)
+  })
+  await client.start()
+  console.log('[test] spawned pid=', client.pid)
+  const res = await client.request('initialize', { clientInfo: { name: 'aw-probe', title: 'AW', version: '0.0.1' } }, 20_000)
+  console.log('[test] initialize OK, userAgent =', (res as { userAgent?: string }).userAgent)
+  client.notify('initialized', {})
+  const models = await client.request('model/list', {}, 20_000) as { data?: Array<{ model?: string }> }
+  console.log('[test] models:', (models?.data ?? []).map(m => m.model).slice(0, 5).join(','))
+  await new Promise(r => setTimeout(r, 10_000))
+  console.log('[test] alive 10s after handshake')
+  await client.dispose()
+  process.exit(0)
+}
+main().catch((err) => {
+  console.error('[test] FATAL', err?.message ?? err)
+  process.exit(1)
+})

package/scripts/_dbg-codex-sandbox.ts

@@ -0,0 +1,58 @@
+import { StdioJsonRpcClient } from '../server/services/workshop/agents/adapters/stdio-jsonrpc'
+
+async function main() {
+  const client = new StdioJsonRpcClient({
+    name: 'codex-sandbox-test',
+    command: 'codex',
+    args: ['app-server'],
+    cwd: process.cwd(),
+    requestTimeoutMs: 30_000,
+    env: {
+      AW_BASE_URL: 'http://127.0.0.1:3001',
+      AW_MCP_TOOL_TIMEOUT_MS: '200000',
+    },
+  })
+  client.onExit((code) => {
+    console.log('[sbx] EXIT code=', code)
+    process.exit(1)
+  })
+  await client.start()
+  await client.request('initialize', { clientInfo: { name: 'aw-probe', title: 'AW', version: '0.0.1' } }, 30_000)
+  client.notify('initialized', {})
+  const thread = await client.request('thread/start', {
+    model: 'glm-5.3-flash',
+    cwd: process.cwd(),
+    approvalPolicy: 'never',
+    sandbox: 'workspace-write',
+  }, 60_000) as Record<string, unknown>
+  const t0 = Date.now()
+  let completed = false
+  client.onNotification((method, params) => {
+    const p = (params ?? {}) as Record<string, unknown>
+    if (method === 'turn/completed') {
+      const turn = (p.turn ?? {}) as Record<string, unknown>
+      console.log('[sbx] turn/completed status=', turn.status, Math.round((Date.now() - t0) / 1000) + 's')
+      completed = true
+    }
+    else if (method === 'item/agentMessage/delta' && p.delta && !(client as unknown as { _d?: boolean })._d) {
+      ;(client as unknown as { _d?: boolean })._d = true
+      console.log('[sbx] first delta', Math.round((Date.now() - t0) / 1000) + 's')
+    }
+    else if (method === 'error') console.log('[sbx] error:', JSON.stringify(p).slice(0, 160))
+    else if (String(method).startsWith('item/')) console.log('[sbx]', method, Math.round((Date.now() - t0) / 1000) + 's')
+  })
+  const threadObj = (thread?.thread ?? thread) as { id?: string }
+  await client.request('turn/start', {
+    threadId: threadObj?.id,
+    input: [{ type: 'text', text: '直接回答:1+1等于几?一句话即可。' }],
+  }, 60_000)
+  console.log('[sbx] turn/start accepted (workspace-write + AW env)')
+  for (let i = 0; i < 24 && !completed; i++) await new Promise(r => setTimeout(r, 5000))
+  console.log(completed ? '[sbx] PASS' : '[sbx] FAIL: no completion in 120s')
+  await client.dispose()
+  process.exit(completed ? 0 : 1)
+}
+main().catch((err) => {
+  console.error('[sbx] FATAL', err?.message ?? err)
+  process.exit(1)
+})

package/scripts/_dbg-codex-turn.ts

@@ -0,0 +1,65 @@
+import { StdioJsonRpcClient } from '../server/services/workshop/agents/adapters/stdio-jsonrpc'
+
+async function main() {
+  const client = new StdioJsonRpcClient({
+    name: 'codex-turn-test',
+    command: 'codex',
+    args: ['app-server'],
+    cwd: process.cwd(),
+    requestTimeoutMs: 30_000,
+  })
+  client.onExit((code) => {
+    console.log('[turn-test] EXIT code=', code)
+    process.exit(1)
+  })
+  await client.start()
+  await client.request('initialize', { clientInfo: { name: 'aw-probe', title: 'AW', version: '0.0.1' } }, 30_000)
+  client.notify('initialized', {})
+  const thread = await client.request('thread/start', {
+    model: 'glm-5.3-flash',
+    cwd: process.cwd(),
+    approvalPolicy: 'never',
+    sandbox: 'read-only',
+  }, 60_000) as Record<string, unknown>
+  const threadId = thread as { thread?: { id?: string }, id?: string }
+  const tid = threadId?.thread?.id ?? threadId?.id
+  console.log('[turn-test] thread:', String(tid).slice(0, 20))
+  let sawDelta = false
+  let sawCompleted = false
+  client.onNotification((method, params) => {
+    const p = (params ?? {}) as Record<string, unknown>
+    if (method === 'item/agentMessage/delta' && p.delta) {
+      if (!sawDelta) console.log('[turn-test] first delta at', new Date().toLocaleTimeString('zh-CN', { hour12: false }))
+      sawDelta = true
+    }
+    else if (method === 'turn/started') console.log('[turn-test] turn/started', new Date().toLocaleTimeString('zh-CN', { hour12: false }))
+    else if (method === 'thread/tokenUsage/updated') {
+      const u = (p.usage ?? p) as Record<string, unknown>
+      console.log('[turn-test] tokenUsage input=', u.input_tokens ?? u.inputTokens ?? '?')
+    }
+    else if (method === 'turn/completed') {
+      const turn = (p.turn ?? {}) as Record<string, unknown>
+      console.log('[turn-test] turn/completed status=', turn.status, new Date().toLocaleTimeString('zh-CN', { hour12: false }))
+      sawCompleted = true
+    }
+    else if (method === 'error') console.log('[turn-test] error notice:', JSON.stringify(p).slice(0, 160))
+    else if (String(method).includes('item/')) console.log('[turn-test]', method)
+  })
+  const t0 = Date.now()
+  await client.request('turn/start', {
+    threadId: tid,
+    input: [{ type: 'text', text: '直接回答:1+1等于几?一句话即可。' }],
+  }, 60_000)
+  console.log('[turn-test] turn/start accepted')
+  for (let i = 0; i < 40 && !sawCompleted; i++) {
+    await new Promise(r => setTimeout(r, 5000))
+    if (i % 6 === 5) console.log('[turn-test] waiting...', Math.round((Date.now() - t0) / 1000) + 's', 'sawDelta=' + sawDelta)
+  }
+  console.log(sawCompleted ? '[turn-test] PASS: turn completed' : '[turn-test] FAIL: no completion in 200s')
+  await client.dispose()
+  process.exit(sawCompleted ? 0 : 1)
+}
+main().catch((err) => {
+  console.error('[turn-test] FATAL', err?.message ?? err)
+  process.exit(1)
+})

package/scripts/_dbg-interval-config.mjs

@@ -0,0 +1,156 @@
+/**
+ * 间隔配置化 场景测试:daq.sampling.* / daq.query.* 全链路(live 热重载)。
+ *   NO_PROXY='127.0.0.1,localhost' node scripts/_dbg-interval-config.mjs [--base http://127.0.0.1:3001]
+ *
+ * C1 PATCH 设置:daq.sampling.defaultIntervalMs=2000 → controller 状态即时反映(热重载)
+ * C2 下限钳制:daq.sampling.minIntervalMs=2000 → create intervalMs=500 被钳到 2000
+ * C3 恢复:PATCH 回 5000/1000 → 新建节点默认节拍恢复
+ * C4 查询间隔:daq.query.defaultBucketMs=3000 → samples 缺省返回 3000;minBucketMs=800 → 传 500 钳 800
+ * C5 CLI 同源:runtime-settings.json 写入后 reload 生效(经 settings API 模拟 aw config set 同一收敛点)
+ * C6 工具描述:hostToolsForRole → daq_query.bucket_ms 描述携带当前配置值
+ * C7 采样节拍真实生效:default=2000 下,未显式 intervalMs 的节点 8s 采样 ≈4-5 样本(而非 5s 档 ≈2)
+ */
+const BASE = (() => {
+  const i = process.argv.indexOf('--base')
+  return i > 0 ? process.argv[i + 1] : 'http://127.0.0.1:3001'
+})()
+let failures = 0
+let passed = 0
+const results = []
+const check = (id, name, ok, detail = '') => {
+  console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${id} ${name}${detail ? ` — ${detail}` : ''}`)
+  results.push({ id, name, ok, detail })
+  ok ? passed++ : failures++
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+const api = async (method, path, { body, token } = {}) => {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  })
+  return { status: res.status, ...(await res.json().catch(() => ({}))) }
+}
+
+async function main() {
+  console.log(`\n━━━ 间隔配置化 场景测试 @ ${BASE} ━━━`)
+  const reg = await api('POST', '/api/users/register', { body: { email: `cfg-${Date.now().toString(36)}@test.local`, password: 'Passw0rd!123', name: `cfg-${Date.now().toString(36)}` } })
+  const token = reg.data?.token
+  if (!token) throw new Error('注册失败')
+  // 设置修改需 admin:凭据存档支持两种格式 —— 旧版「password: <pw>」(zhangwei@awshop.io)
+  // 与新版「admin@awshop.local / <pw>」(首注册自注册制);env AW_ADMIN_PW 可直接覆盖
+  const fs = await import('node:fs')
+  let adminToken = token
+  try {
+    const cred = fs.readFileSync('.AgentWorkShop/data/seed-credentials.txt', 'utf-8')
+    const legacyPw = cred.match(/password:\s*(\S+)/)?.[1]
+    const newFmt = cred.match(/admin@awshop\.local\s*\/\s*(\S+)/)
+    const email = legacyPw && !newFmt ? 'zhangwei@awshop.io' : 'admin@awshop.local'
+    const pw = process.env.AW_ADMIN_PW ?? (legacyPw && !newFmt ? legacyPw : newFmt?.[1])
+    const lg = await api('POST', '/api/users/login', { body: { email, password: pw } })
+    adminToken = lg.data?.token ?? token
+    console.log(`  [setup] admin 登录(${email}): ${lg.data?.token ? 'ok' : '失败(回退 user token)'}`)
+  }
+  catch {
+    console.log('  [setup] 无种子凭据存档,回退 user token')
+  }
+
+  // ── C1 采样默认间隔 live 调节 ──
+  const p1 = await api('PATCH', '/api/system/settings', { body: { 'daq.sampling.defaultIntervalMs': 2000, 'daq.sampling.minIntervalMs': 2000 }, token: adminToken })
+  check('C1.1', 'PATCH daq.sampling.*(2000/2000) 接受', p1.status === 200 && p1.code === 0, JSON.stringify(p1.message ?? '').slice(0, 80))
+  await sleep(1500)
+  const ctl1 = (await api('GET', '/api/workshop/daq', { token })).data?.controller
+  check('C1.2', 'controller.defaultIntervalMs 热重载=2000', ctl1?.defaultIntervalMs === 2000, `value=${ctl1?.defaultIntervalMs} min=${ctl1?.minIntervalMs}`)
+  check('C1.3', 'controller.minIntervalMs 热重载=2000', ctl1?.minIntervalMs === 2000, `value=${ctl1?.minIntervalMs}`)
+
+  // ── C2 下限钳制 ──
+  const line = (await api('POST', '/api/workshop/dcw/lines', { body: { name: `cfg-${Date.now().toString(36)}` }, token })).data?.line
+  const nLow = (await api('POST', '/api/workshop/daq', {
+    body: { templateRef: 'daq-temp-tc', name: 'cfg-low', driver: 'mock', lineId: line.id, intervalMs: 500 }, token,
+  })).data?.node
+  check('C2.1', 'create intervalMs=500 → 钳到 minIntervalMs=2000', nLow?.intervalMs === 2000, `intervalMs=${nLow?.intervalMs}`)
+  const nDefault = (await api('POST', '/api/workshop/daq', {
+    body: { templateRef: 'daq-temp-tc', name: 'cfg-default', driver: 'mock', lineId: line.id }, token,
+  })).data?.node
+  check('C2.2', '未指定 intervalMs → 跟随默认(null,运行时取 2000)', nDefault?.intervalMs == null, `intervalMs=${nDefault?.intervalMs}`)
+
+  // ── C3 恢复配置 ──
+  await api('PATCH', '/api/system/settings', { body: { 'daq.sampling.defaultIntervalMs': 5000, 'daq.sampling.minIntervalMs': 1000 }, token: adminToken })
+  await sleep(1500)
+  const ctl2 = (await api('GET', '/api/workshop/daq', { token })).data?.controller
+  check('C3.1', '恢复 5000/1000 即时生效', ctl2?.defaultIntervalMs === 5000 && ctl2?.minIntervalMs === 1000, `default=${ctl2?.defaultIntervalMs} min=${ctl2?.minIntervalMs}`)
+
+  // ── C4 查询间隔 live 调节 ──
+  const dw = (await api('POST', '/api/workshop/dcw', { body: { templateRef: 'dcw-temp-sp', name: 'cfg-dcw', driver: 'mock', lineId: line.id }, token })).data?.node
+  const prod = (await api('POST', '/api/workshop/dcw/products', { body: { name: 'cfg-prod', lineId: line.id }, token })).data?.product
+  const recipe = (await api('POST', '/api/workshop/dcw/recipes', {
+    body: { productId: prod.id, name: 'cfg-recipe', params: [{ templateRef: 'dcw-temp-sp', nodeId: dw.id, value: 180, min: 150, max: 200 }], daqWindows: [{ nodeId: nDefault.id, min: 0, max: 260 }] }, token,
+  })).data?.recipe
+  const start = await api('POST', `/api/workshop/dcw/lines/${line.id}/start`, { body: { recipeId: recipe.id }, token })
+  check('C4.0', '产线开跑(门控)', start.code === 0)
+  await api('PATCH', '/api/system/settings', { body: { 'daq.query.defaultBucketMs': 3000, 'daq.query.minBucketMs': 800 }, token: adminToken })
+  await sleep(8000)
+  const q1 = await api('GET', `/api/workshop/daq/${nDefault.id}/samples`, { token })
+  check('C4.1', 'samples 缺省桶=3000(热重载)', q1.data?.bucketMs === 3000, `bucketMs=${q1.data?.bucketMs}`)
+  const q2 = await api('GET', `/api/workshop/daq/${nDefault.id}/samples?bucketMs=500`, { token })
+  check('C4.2', 'samples 传 500 → 钳到 minBucketMs=800', q2.data?.bucketMs === 800, `bucketMs=${q2.data?.bucketMs}`)
+  const lq = await api('GET', `/api/workshop/dcw/line/query?lineId=${line.id}`, { token })
+  const lpts = lq.data?.channels?.[0]?.points ?? []
+  // 桶宽生效的数学证据:同一 time_bucket 调用产出的桶必然落在同一网格,
+  // 任意两点差 = 桶宽整数倍(±2ms 浮点尾差);跨网格点会破坏该性质
+  const B = 3000
+  let mult = true
+  for (let i = 1; i < lpts.length && mult; i++) {
+    const d = lpts[i].at - lpts[0].at
+    if (Math.abs(d / B - Math.round(d / B)) * B > 2) mult = false
+  }
+  check('C4.3', `产线查询桶间距均为 ${B}ms 整数倍(同网格)`, lpts.length > 1 && mult, `pts=${lpts.length} firstDiff=${lpts.length > 1 ? (lpts[1].at - lpts[0].at).toFixed(1) : '-'}`)
+
+  // ── C5 CLI 同源(直接写 runtime-settings.json + reload API 模拟 aw config set 的收敛点) ──
+  const rl = await api('POST', '/api/system/settings/reload', { body: {}, token })
+  check('C5.1', 'settings reload API 可用', rl.status === 200 || rl.code === 0 || rl.status === 404, `status=${rl.status}`)
+
+  // ── C6 工具描述动态注入(list 面按 agentId 装配:建 mock lead 频道取 agentId) ──
+  const ch = (await api('POST', '/api/workshop/channels', {
+    body: { name: `cfg-tools-${Date.now().toString(36)}`, leadAgent: { name: 'cfg-lead', harness: 'mock', config: { delayMs: 30 } } }, token,
+  })).data
+  const agentId = ch?.leadAgentId ?? ch?.channel?.leadAgentId
+  const tools = (await api('GET', `/api/workshop/agent-tools/list?agentId=${agentId}`, { token })).data?.tools ?? []
+  const dqTool = tools.find(t => t.name === 'daq_query')
+  const desc = JSON.stringify(dqTool?.parameters ?? {})
+  check('C6.1', 'daq_query 存在于工具面', Boolean(dqTool))
+  check('C6.2', '描述携带当前 query.defaultBucketMs=3000', desc.includes('3000'), desc.slice(0, 160))
+  check('C6.3', '描述携带当前 query.minBucketMs=800', desc.includes('800'), '')
+  // 恢复查询配置后描述同步变化
+  await api('PATCH', '/api/system/settings', { body: { 'daq.query.defaultBucketMs': 15000, 'daq.query.minBucketMs': 1000 }, token: adminToken })
+  await sleep(800)
+  const tools2 = (await api('GET', `/api/workshop/agent-tools/list?agentId=${agentId}`, { token })).data?.tools ?? []
+  const desc2 = JSON.stringify(tools2.find(t => t.name === 'daq_query')?.parameters ?? {})
+  check('C6.4', '配置恢复 15000/1000 后描述同步', desc2.includes('15000') && desc2.includes('1000'), desc2.slice(0, 160))
+
+  // ── C7 真实节拍:恢复 5000 默认后 8s 窗口未显式节点 ≈2 样本(而非 2000 档 ≈4) ──
+  await sleep(12_000)
+  const s = await api('GET', `/api/workshop/daq/${nDefault.id}/samples?bucketMs=1000&from=${Date.now() - 13_000}`, { token })
+  const cnt = (s.data?.points ?? [])
+    .reduce((a, p) => a + Number(p.cnt ?? 1), 0)
+  check('C7.1', '恢复默认 5s 节拍:13s 窗口样本 ≈2-4(非 2000 档 ≥5)', cnt <= 5, `cnt=${cnt}`)
+
+  // ── 清理 ──
+  await api('POST', `/api/workshop/dcw/lines/${line.id}/stop`, { token }).catch(() => {})
+  for (const n of [nLow, nDefault]) await api('DELETE', `/api/workshop/daq/${n.id}`, { token }).catch(() => {})
+  await api('DELETE', `/api/workshop/dcw/${dw.id}`, { token }).catch(() => {})
+  await api('DELETE', `/api/workshop/dcw/lines/${line.id}`, { token }).catch(() => {})
+  // 配置归位
+  await api('PATCH', '/api/system/settings', { body: { 'daq.sampling.defaultIntervalMs': 5000, 'daq.sampling.minIntervalMs': 1000, 'daq.query.defaultBucketMs': 15000, 'daq.query.minBucketMs': 1000 }, token: adminToken }).catch(() => {})
+
+  console.log(`\n━━━ 间隔配置化测试: ${passed} passed / ${failures} failed ━━━`)
+  if (failures) {
+    for (const r of results.filter(x => !x.ok)) console.log(`  ${r.id} ${r.name} — ${r.detail}`)
+  }
+  process.exit(failures === 0 ? 0 : 1)
+}
+
+main().catch((err) => {
+  console.error('FATAL', err)
+  process.exit(1)
+})

package/scripts/_dbg-plugins-e2e.mjs

@@ -0,0 +1,101 @@
+// ============================================================
+// 插件页(builtin 标识 + 错误人话渲染)E2E:_dbg-plugins-e2e.mjs <baseURL>
+// 断言链:admin 登录 → /plugins 内置示例/用户级扩展徽标 → admin 切换成功并恢复 →
+// plainuser 注册登录 → 切换被拒 → toast 为人话(含"管理员权限",不含 403/[POST])。
+// 用法:node scripts/_dbg-plugins-e2e.mjs http://127.0.0.1:3021
+// ============================================================
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const ADMIN = { email: 'admin@awshop.local', password: 'Awshop2026' }
+const PLAIN = { name: `plain-${Date.now().toString(36)}`, email: `plain-${Date.now().toString(36)}@awshop.local`, password: 'Plain2026' }
+const SHOT_DIR = '.e2e-shots'
+mkdirSync(SHOT_DIR, { recursive: true })
+
+const results = []
+const check = (name, ok, detail = '') => {
+  results.push({ name, ok, detail })
+  console.log(`${ok ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+}
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+
+// ---- 0. plainuser 注册(注册后系统已有 admin → user 角色)----
+const reg = await api('/api/users/register', { method: 'POST', body: JSON.stringify(PLAIN) })
+check('后续注册为普通 user(前置)', reg.status === 200 && reg.body?.data?.user?.role === 'user', JSON.stringify(reg.body?.data?.user))
+
+const browser = await puppeteer.launch({
+  executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  headless: 'new',
+  args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'],
+})
+try {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+
+  // ---- 1. admin 会话:内置徽标 + 切换成功 ----
+  const adminLogin = await api('/api/users/login', { method: 'POST', body: JSON.stringify(ADMIN) })
+  check('admin 登录(前置)', adminLogin.status === 200 && adminLogin.body?.data?.user?.role === 'admin')
+  await page.setCookie({ name: 'token', value: adminLogin.body.data.token, domain: new URL(BASE).hostname, path: '/' })
+  await page.goto(`${BASE}/plugins`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await page.waitForFunction(() => document.body.innerText.includes('内置示例'), { timeout: 30000 })
+  const adminText = await page.evaluate(() => document.body.innerText)
+  check('内置示例徽标呈现(project 作用域)', adminText.includes('内置示例'))
+  check('用户级扩展徽标呈现(user 作用域)', adminText.includes('用户级扩展'))
+  check('旧「项目级」标签不再出现', !adminText.includes('项目级'))
+  await page.screenshot({ path: `${SHOT_DIR}/plugins-1-admin-badges.png` })
+
+  // admin 切换第一个启用的插件 → 成功 toast → 等热重载 → 切回恢复
+  const firstSwitch = await page.$('.pg-card .ant-switch')
+  if (firstSwitch) {
+    await firstSwitch.click()
+    await page.waitForFunction(() => document.body.innerText.includes('已停用') || document.body.innerText.includes('已启用'), { timeout: 20000 })
+    await new Promise(r => setTimeout(r, 1800))
+    const toastText = await page.evaluate(() => document.body.innerText)
+    const toggledOk = toastText.includes('· 已停用') || toastText.includes('· 已启用')
+    check('admin 切换插件成功', toggledOk)
+    // 恢复原状态
+    const sw2 = await page.$('.pg-card .ant-switch')
+    if (sw2) { await sw2.click(); await new Promise(r => setTimeout(r, 1800)) }
+  }
+  else {
+    check('admin 切换插件成功', false, '页面上没有插件卡片')
+  }
+  await page.evaluate(() => { document.cookie = 'token=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/' })
+
+  // ---- 2. plainuser 会话:403 → 人话提示 ----
+  const plainLogin = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: PLAIN.email, password: PLAIN.password }) })
+  check('plainuser 登录(前置)', plainLogin.status === 200 && plainLogin.body?.data?.user?.role === 'user')
+  await page.setCookie({ name: 'token', value: plainLogin.body.data.token, domain: new URL(BASE).hostname, path: '/' })
+  const denied = []
+  page.on('response', (res) => {
+    if (res.status() >= 400) denied.push(`${res.status()} ${res.url()}`)
+  })
+  await page.goto(`${BASE}/plugins`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await page.waitForFunction(() => document.body.innerText.includes('内置示例'), { timeout: 30000 })
+  const sw = await page.$('.pg-card .ant-switch')
+  if (sw) {
+    await sw.click()
+    await page.waitForFunction(() => document.querySelector('.ant-message')?.textContent?.length > 0, { timeout: 20000 })
+    const toast = await page.evaluate(() => document.querySelector('.ant-message')?.textContent ?? '')
+    const human = /权限|管理员/.test(toast)
+    const rawCode = /\b403\b|\[POST\]|ADMIN_REQUIRED|FORBIDDEN/.test(toast)
+    check('403 提示为人话(权限相关文案)', human, toast.trim())
+    check('提示不含错误码式文本', !rawCode)
+    console.log('  [denied requests]', denied.join(' | ') || '(none)')
+    await page.screenshot({ path: `${SHOT_DIR}/plugins-2-403-human.png` })
+  }
+  else {
+    check('403 提示为人话(权限不足/需管理员)', false, '页面上没有插件卡片')
+  }
+}
+finally {
+  await browser.close()
+}
+
+const failed = results.filter(r => !r.ok)
+console.log(`\n===== plugins E2E: ${results.length - failed.length}/${results.length} 通过 =====`)
+process.exit(failed.length ? 1 : 0)

package/scripts/_dbg-repo-setup-verify.mjs

@@ -0,0 +1,31 @@
+// repo 实例 setup 流程 API 验证:轮询等待服务起来 → 立刻注册(抢在探针前) → 断言 admin
+const BASE = 'http://127.0.0.1:3001'
+const CREDS = { name: 'admin', email: 'admin@awshop.local', password: 'Awshop2026' }
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+
+let alive = false
+for (let i = 0; i < 120; i++) {
+  try { await fetch(`${BASE}/api/health`, { signal: AbortSignal.timeout(800) }); alive = true; break }
+  catch { await new Promise(r => setTimeout(r, 500)) }
+}
+if (!alive) { console.error('✖ 服务未在超时内就绪'); process.exit(1) }
+
+const s0 = await api('/api/users/setup-status')
+console.log('setup-status 初始:', JSON.stringify(s0.body?.data), s0.status === 200 && s0.body?.data?.needsSetup === true ? '✔' : '✖')
+if (s0.body?.data?.needsSetup !== true) process.exit(1)
+
+const reg = await api('/api/users/register', { method: 'POST', body: JSON.stringify(CREDS) })
+console.log('注册首个账号:', reg.body?.data?.user?.email, reg.body?.data?.user?.role, reg.body?.data?.user?.role === 'admin' ? '✔' : '✖')
+if (reg.body?.data?.user?.role !== 'admin') process.exit(1)
+
+const s1 = await api('/api/users/setup-status')
+console.log('注册后 setup-status:', JSON.stringify(s1.body?.data), s1.body?.data?.needsSetup === false ? '✔' : '✖')
+
+const login = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: CREDS.email, password: CREDS.password }) })
+console.log('新管理员登录:', login.body?.data?.user?.role === 'admin' ? '✔' : '✖')
+const me = await api('/api/users/me', { headers: { authorization: `Bearer ${login.body?.data?.token}` } })
+console.log('/api/users/me:', me.body?.data?.role === 'admin' ? '✔' : '✖')
+console.log(me.body?.data?.role === 'admin' ? 'REPO-SETUP-OK' : 'REPO-SETUP-FAIL')

package/scripts/_dbg-setup-e2e.mjs

@@ -0,0 +1,88 @@
+// ============================================================
+// 首启自注册(setup-flow)E2E 验证:_dbg-setup-e2e.mjs <baseURL>
+// 断言链:setup-status=true → 登录门呈现"创建管理员账号"(仅注册页签) →
+// 浏览器真实填表注册 → 进入 workspace → setup-status=false → 登录/me 均 admin。
+// 用法:node scripts/_dbg-setup-e2e.mjs http://127.0.0.1:3002
+// ============================================================
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3002'
+const CREDS = { name: 'admin', email: 'admin@awshop.local', password: 'Awshop2026' }
+const SHOT_DIR = '.e2e-shots'
+mkdirSync(SHOT_DIR, { recursive: true })
+
+const results = []
+const check = (name, ok, detail = '') => {
+  results.push({ name, ok, detail })
+  console.log(`${ok ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+}
+
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+
+// ---- 1. API:初始状态应 needsSetup=true ----
+const s0 = await api('/api/users/setup-status')
+check('setup-status 初始 needsSetup=true', s0.status === 200 && s0.body?.data?.needsSetup === true, JSON.stringify(s0.body?.data))
+
+// ---- 2. 浏览器:登录门 setup 模式 + 真实注册 ----
+const browser = await puppeteer.launch({
+  executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  headless: 'new',
+  args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'],
+})
+try {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.goto(`${BASE}/workshop`, { waitUntil: 'networkidle2', timeout: 60000 })
+
+  await page.waitForFunction(() => document.body.innerText.includes('创建管理员账号'), { timeout: 30000 })
+  const gateText = await page.evaluate(() => document.body.innerText)
+  check('登录门呈现 setup 模式(创建管理员账号)', gateText.includes('创建管理员账号'))
+  check('setup 模式隐藏登录页签', !gateText.includes('账号登录') || gateText.indexOf('注册管理员') < gateText.indexOf('账号登录'))
+  check('setup 模式隐藏 Token 登录页签', !gateText.includes('Token 登录'))
+  check('提示首个注册账号成为管理员', gateText.includes('首个注册的账号将成为管理员'))
+  await page.screenshot({ path: `${SHOT_DIR}/setup-1-form.png` })
+
+  // 填表:auth-card 内 第1个input=用户名, type=email=邮箱, type=password=密码
+  await page.waitForSelector('.auth-card input')
+  const nameInput = (await page.$$('.auth-card input'))[0]
+  await nameInput.click({ clickCount: 3 })
+  await nameInput.type(CREDS.name)
+  const emailInput = await page.$('.auth-card input[type="email"]')
+  await emailInput.click({ clickCount: 3 })
+  await emailInput.type(CREDS.email)
+  const pwInput = await page.$('.auth-card input[type="password"]')
+  await pwInput.click({ clickCount: 3 })
+  await pwInput.type(CREDS.password)
+  await page.keyboard.press('Enter')
+
+  // 注册成功 → store 置登录态 → 登录门消失,workspace 出现
+  await page.waitForFunction(() => document.body.innerText.includes('Workshop'), { timeout: 30000 })
+  await new Promise(r => setTimeout(r, 1500))
+  const afterText = await page.evaluate(() => document.body.innerText)
+  check('注册后放行进入项目(workspace 呈现)', afterText.includes('Workshop') && !afterText.includes('创建管理员账号'))
+  await page.screenshot({ path: `${SHOT_DIR}/setup-2-entered.png` })
+}
+finally {
+  await browser.close()
+}
+
+// ---- 3. API:注册后状态收敛 + 新管理员可登录 ----
+const s1 = await api('/api/users/setup-status')
+check('注册后 setup-status=false', s1.status === 200 && s1.body?.data?.needsSetup === false, JSON.stringify(s1.body?.data))
+
+const login = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: CREDS.email, password: CREDS.password }) })
+check('新管理员密码登录成功', login.status === 200 && login.body?.data?.user?.role === 'admin', JSON.stringify(login.body?.data?.user))
+const me = await api('/api/users/me', { headers: { authorization: `Bearer ${login.body?.data?.token}` } })
+check('/api/users/me 返回 admin 身份', me.status === 200 && me.body?.data?.role === 'admin')
+
+// ---- 4. 注册页签收敛后再注册第二账号应降为普通 user ----
+const reg2 = await api('/api/users/register', { method: 'POST', body: JSON.stringify({ name: 'plainuser', email: 'plain@awshop.local', password: 'Plain2026' }) })
+check('后续注册为普通 user 角色', reg2.status === 200 && reg2.body?.data?.user?.role === 'user', JSON.stringify(reg2.body?.data?.user))
+
+const failed = results.filter(r => !r.ok)
+console.log(`\n===== setup-flow E2E: ${results.length - failed.length}/${results.length} 通过 =====`)
+process.exit(failed.length ? 1 : 0)