agentworkshop 0.7.70 → 0.8.0

package/sdk/context.mjs

@@ -395,18 +395,46 @@ export function createPluginContext(opts) {
     }
   })()
   let kvFlushTimer = null
-  const flushKvNow = () => {
+  // 多实例共享同一配置根时(不支持也不推荐的部署形态),kv.json 的 tmp+rename 会与另一
+  // 实例互斥(Windows EPERM/EBUSY)。对这两类瞬态冲突做有限退避重试;仍失败则**聚合限频**
+  // 告警 —— 逐条 warn 在共享根场景每分钟可刷上百条(2026-10-22-eda-ui-fix-plan F4b)。
+  const KV_RETRY_DELAYS_MS = [50, 200, 800]
+  let kvWarnCount = 0
+  let kvLastWarnAt = 0
+  const kvWarnRateLimited = (message) => {
+    kvWarnCount += 1
+    const now = Date.now()
+    if (now - kvLastWarnAt < 300_000) return
+    kvLastWarnAt = now
+    const aggregated = kvWarnCount
+    kvWarnCount = 0
+    console.warn(`[sdk] kv 落盘持续失败(聚合窗口内 ${aggregated} 次,含重试):`, message)
+  }
+  // 'done' = 成功或已终局告警;'retry' = 瞬态冲突,可退避重试
+  const flushKvAttempt = (attempt) => {
     try {
       mkdirSync(kvDir, { recursive: true })
-      const tmp = `${kvFile}.${process.pid}.tmp`
+      // tmp 名带时间戳:防抖重试与新一轮 flush 并发时不再互相覆盖同名 tmp
+      const tmp = `${kvFile}.${process.pid}.${Date.now()}.tmp`
       writeFileSync(tmp, `${JSON.stringify(kvState, null, 2)}\n`, 'utf8')
       renameSync(tmp, kvFile)
+      return 'done'
     }
     catch (err) {
-      // 磁盘异常不阻断插件,但不再静默:持久化失败至少要可见
-      console.warn('[sdk] kv 落盘失败:', err?.message ?? err)
+      const transient = err?.code === 'EPERM' || err?.code === 'EBUSY'
+      if (transient && attempt < KV_RETRY_DELAYS_MS.length - 1) return 'retry'
+      kvWarnRateLimited(err?.message ?? err)
+      return 'done'
     }
   }
+  const scheduleKvRetry = (attempt) => {
+    setTimeout(() => {
+      if (flushKvAttempt(attempt) === 'retry') scheduleKvRetry(attempt + 1)
+    }, KV_RETRY_DELAYS_MS[attempt])
+  }
+  const flushKvNow = () => {
+    if (flushKvAttempt(0) === 'retry') scheduleKvRetry(1)
+  }
   const kvFlush = () => {
     clearTimeout(kvFlushTimer)
     kvFlushTimer = setTimeout(flushKvNow, 200)

package/server/api/mcp/workshop.ts

@@ -23,7 +23,30 @@ import { getWorkshopManager } from '../../plugins/workshop'
 
 /** 会话注册表:sessionId → transport(stateful 会话状态保留);上限防匿名刷爆内存 */
 const MAX_MCP_SESSIONS = 64
-const sessions = new Map<string, WebStandardStreamableHTTPServerTransport>()
+/** WP9:空闲会话 TTL(缺省 30min;env AW_MCP_SESSION_TTL_MIN=0 关闭回收 = 原行为) */
+function sessionTtlMs(): number {
+  const min = Number(process.env.AW_MCP_SESSION_TTL_MIN ?? 30)
+  if (!Number.isFinite(min) || min <= 0) return 0
+  return Math.min(min, 24 * 60) * 60_000
+}
+interface McpSession {
+  transport: WebStandardStreamableHTTPServerTransport
+  lastSeen: number
+}
+const sessions = new Map<string, McpSession>()
+
+/** 惰性清扫:任一请求进来时回收过期会话(避免定时器在无流量时仍持有 transport) */
+function sweepIdleSessions(): void {
+  const ttl = sessionTtlMs()
+  if (ttl <= 0) return
+  const now = Date.now()
+  for (const [sid, s] of sessions) {
+    if (now - s.lastSeen > ttl) {
+      sessions.delete(sid)
+      void s.transport.close?.().catch(() => {})
+    }
+  }
+}
 
 /** h3 event → web Request(跨 h3 1.x/2.x 兼容:不用版本互异的转换助手) */
 async function toFetchRequest(event: H3Event): Promise<Request> {
@@ -43,15 +66,17 @@ function sessionIdOf(event: H3Event): string | null {
 }
 
 export default defineEventHandler(async (event) => {
+  // WP9:先回收空闲会话(TTL 内无请求即释放;token 轮换后旧会话下一请求由工具级鉴权兜底)
+  sweepIdleSessions()
   const request = await toFetchRequest(event)
   const sessionId = sessionIdOf(event)
 
   // DELETE:关闭会话
   if (event.method === 'DELETE' && sessionId) {
-    const transport = sessions.get(sessionId)
-    if (transport) {
+    const session = sessions.get(sessionId)
+    if (session) {
       try {
-        await transport.handleRequest(request)
+        await session.transport.handleRequest(request)
       }
       finally {
         sessions.delete(sessionId)
@@ -61,11 +86,12 @@ export default defineEventHandler(async (event) => {
     return new Response(null, { status: 404 })
   }
 
-  // 复用已有会话
-  let transport = sessionId ? sessions.get(sessionId) : undefined
+  // 复用已有会话(刷新活跃时间)
+  let session = sessionId ? sessions.get(sessionId) : undefined
+  if (session) session.lastSeen = Date.now()
 
   // 新会话:预生成 sessionId,transport 在 initialize 时把它写入响应头
-  if (!transport) {
+  if (!session) {
     if (sessions.size >= MAX_MCP_SESSIONS) {
       return new Response(JSON.stringify({ error: 'TOO_MANY_SESSIONS', message: `MCP 会话数已达上限 ${MAX_MCP_SESSIONS}` }), {
         status: 429,
@@ -73,13 +99,14 @@ export default defineEventHandler(async (event) => {
       })
     }
     const newSessionId = randomUUID()
-    transport = new WebStandardStreamableHTTPServerTransport({
+    const transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: () => newSessionId,
     })
     const server = createWorkshopMcpServer(getWorkshopManager())
     await server.connect(transport)
-    sessions.set(newSessionId, transport)
+    session = { transport, lastSeen: Date.now() }
+    sessions.set(newSessionId, session)
   }
 
-  return transport.handleRequest(request)
+  return session.transport.handleRequest(request)
 })

package/server/api/workshop/agent-tools/approvals/[id]/decide.post.ts

@@ -1,90 +1,140 @@
-/**
- * POST /api/workshop/agent-tools/approvals/:id/decide —— 批准/拒绝一次工具执行。
- * body: { approved: boolean, comment?: string }(备注随 tool result 返回给 Agent)
- *
- * v17 安全修复(主计划 §13.2):
- *  ① `approved` 必须是**显式布尔值**:旧实现 `body.approved !== false` 让字段缺失
- *     (=客户端漏传/构造请求)自动变成"批准" —— 高危数控下发的静默放行,现已 400 拒绝;
- *  ② 决策前先做 Channel 归属 + 可见性 + 审批资格校验(与列表端点同口径),
- *     越权/跨 Channel 一律 403;
- *  ③ decide() 的"审批不存在或已处理"从裸 Error(→500)映射为 **409 ALREADY_RESOLVED**,
- *     与 hitl/respond 的并发语义一致。
- */
-import { readBody, getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { AppError } from '@/server/utils/errors'
-import { getWorkshopManager } from '@/server/plugins/workshop'
-import { getToolApprovals, normalizeRecipeProposeDecision } from '@/server/services/workshop/agents/tool-approvals'
-import { assertCanDecideHitlChannel, snapshotOfRow } from '@/server/services/workshop/agents/hitl-decision'
-import { audit } from '@/server/services/workshop/ops/ops'
-
-export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
-  const id = getRouterParam(event, 'id')!
-  const body = await readBody<{ approved?: unknown, comment?: string, choice?: unknown }>(event) ?? {}
-
-  // ① 显式布尔:禁止"缺省即批准"
-  if (typeof body.approved !== 'boolean') {
-    throw new AppError(400, 'BAD_REQUEST', 'body.approved 必须是显式布尔值(true=批准 / false=拒绝);字段缺失不再默认为批准')
-  }
-  const approved = body.approved
-  const comment = String(body.comment ?? '')
-  // ④ 多方案裁决序号(产线 Co-Pilot P2):仅接受整数(结构化审批单「批准此方案」);
-  //    其余输入一律按未携带处理,由 fail-closed 归一收敛为拒绝(不做静默取整/默认包)
-  const choice = Number.isInteger(body.choice) ? (body.choice as number) : undefined
-
-  const manager = getWorkshopManager()
-  const acting = { id: user.id, name: user.name, role: user.role }
-  const row = manager.groupChat.hitl.findById(id)
-  const pending = getToolApprovals().listPending().find(a => a.id === id)
-  const agentId = row?.agentId || pending?.agentId || ''
-
-  if (agentId) {
-    const channelId = manager.findChannelAgentById(agentId)?.channelId
-    if (channelId) {
-      // ② 与列表端点同口径:可见性 + 审批策略 + 创建时资格快照
-      assertCanDecideHitlChannel(channelId, acting, row ? { policy: row.policy, snapshot: snapshotOfRow(row) } : {})
-    }
-    else if (user.role !== 'admin') {
-      // 归属无法解析(Agent 已删除/未落库):非管理员不放行
-      throw new AppError(403, 'SCOPE_VIOLATION', '该审批的 Agent 已不属于任何 Channel,仅管理员可处理')
-    }
-  }
-  else if (pending && user.role !== 'admin') {
-    throw new AppError(403, 'SCOPE_VIOLATION', '无法确定审批归属的 Channel,仅管理员可处理')
-  }
-
-  // 产线 Co-Pilot P2:结构化审批单(recipe-propose,payload.schemaVersion=1)先经 fail-closed
-  // 归一 —— 无有效 choice 的「批准」一律按拒绝收敛;legacy 审批单(无 payload)完全不干预。
-  // (pending 即上方归属判定用的同一条 listPending 查询)
-  const normalized = normalizeRecipeProposeDecision(pending, { approved, choice })
-
-  let approval
-  try {
-    approval = getToolApprovals().decide(id, normalized.approved, comment, user.id, user.name, normalized.choice)
-  }
-  catch (err) {
-    // ③ 非 pending(已被他人处理/超时/被取消)→ 409(不再 500)
-    throw new AppError(409, 'ALREADY_RESOLVED', err instanceof Error ? err.message : String(err))
-  }
-
-  // R1:HITL 裁决审计(闭环中的人为决策留痕;choice 与 fail-closed 收敛随行落审计)
-  audit({
-    actor: user.id,
-    actorName: user.name,
-    actorKind: 'user',
-    action: normalized.approved ? 'approval.approve' : 'approval.reject',
-    targetKind: 'tool-approval',
-    targetId: id,
-    detail: {
-      comment,
-      choice: normalized.choice,
-      ...(normalized.rejectedReason ? { failClosedReason: normalized.rejectedReason } : {}),
-      via: 'agent-tools/decide',
-      agentId,
-      channelId: manager.findChannelAgentById(agentId)?.channelId ?? '',
-    },
-  })
-  return { approval }
-})
+/**
+ * POST /api/workshop/agent-tools/approvals/:id/decide —— 批准/拒绝一次工具执行。
+ * body: { approved: boolean, comment?: string }(备注随 tool result 返回给 Agent)
+ *
+ * v17 安全修复(主计划 §13.2):
+ *  ① `approved` 必须是**显式布尔值**:旧实现 `body.approved !== false` 让字段缺失
+ *     (=客户端漏传/构造请求)自动变成"批准" —— 高危数控下发的静默放行,现已 400 拒绝;
+ *  ② 决策前先做 Channel 归属 + 可见性 + 审批资格校验(与列表端点同口径),
+ *     越权/跨 Channel 一律 403;
+ *  ③ decide() 的"审批不存在或已处理"从裸 Error(→500)映射为 **409 ALREADY_RESOLVED**,
+ *     与 hitl/respond 的并发语义一致。
+ */
+import { readBody, getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { AppError } from '@/server/utils/errors'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { getToolApprovals, normalizeRecipeProposeDecision } from '@/server/services/workshop/agents/tool-approvals'
+import { assertCanDecideHitlChannel, snapshotOfRow } from '@/server/services/workshop/agents/hitl-decision'
+import { audit } from '@/server/services/workshop/ops/ops'
+import { decideOptimizerDispatch, isOptimizerDispatchCard } from '@/server/services/workshop/optimization/dispatch.service'
+import { isProfileAdoptCard, decideProfileAdoption } from '@/server/services/workshop/optimization/profile-adopt.service'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const id = getRouterParam(event, 'id')!
+  const body = await readBody<{ approved?: unknown, comment?: string, choice?: unknown }>(event) ?? {}
+
+  // ① 显式布尔:禁止"缺省即批准"
+  if (typeof body.approved !== 'boolean') {
+    throw new AppError(400, 'BAD_REQUEST', 'body.approved 必须是显式布尔值(true=批准 / false=拒绝);字段缺失不再默认为批准')
+  }
+  const approved = body.approved
+  const comment = String(body.comment ?? '')
+  // ④ 多方案裁决序号(产线 Co-Pilot P2):仅接受整数(结构化审批单「批准此方案」);
+  //    其余输入一律按未携带处理,由 fail-closed 归一收敛为拒绝(不做静默取整/默认包)
+  const choice = Number.isInteger(body.choice) ? (body.choice as number) : undefined
+
+  const manager = getWorkshopManager()
+  const acting = { id: user.id, name: user.name, role: user.role }
+  const row = manager.groupChat.hitl.findById(id)
+  const pending = getToolApprovals().listPending().find(a => a.id === id)
+  const agentId = row?.agentId || pending?.agentId || ''
+
+  if (agentId) {
+    const channelId = manager.findChannelAgentById(agentId)?.channelId
+    if (channelId) {
+      // ② 与列表端点同口径:可见性 + 审批策略 + 创建时资格快照
+      assertCanDecideHitlChannel(channelId, acting, row ? { policy: row.policy, snapshot: snapshotOfRow(row) } : {})
+    }
+    else if (user.role !== 'admin') {
+      // 归属无法解析(Agent 已删除/未落库):非管理员不放行
+      throw new AppError(403, 'SCOPE_VIOLATION', '该审批的 Agent 已不属于任何 Channel,仅管理员可处理')
+    }
+  }
+  else if (pending && user.role !== 'admin') {
+    throw new AppError(403, 'SCOPE_VIOLATION', '无法确定审批归属的 Channel,仅管理员可处理')
+  }
+
+  // 产线 Co-Pilot P2:结构化审批单(recipe-propose,payload.schemaVersion=1)先经 fail-closed
+  // 归一 —— 无有效 choice 的「批准」一律按拒绝收敛;legacy 审批单(无 payload)完全不干预。
+  // (pending 即上方归属判定用的同一条 listPending 查询)
+  const normalized = normalizeRecipeProposeDecision(pending, { approved, choice })
+
+  // SW5/D13 单一咽喉:optimizer-recipe:* 卡一律走 dispatch 链(八项重验→抢占→写→回读→审计)。
+  // 业务拒绝 {approved:false,code,comment} 在咽喉内已 decide() 落定;此处不再走通用 decide。
+  // OW-adopt 单一咽喉:optimizer-profile:* 卡 → 采纳裁决(批准=发布+重绑)
+  if (pending && isProfileAdoptCard(pending.nodeId)) {
+    const result = await decideProfileAdoption({
+      cardId: id,
+      nodeId: pending.nodeId,
+      approved: normalized.approved,
+      comment,
+      actingUser: user ? { id: user.id, name: user.name ?? user.id } : { id: 'system' },
+      via: 'decide-endpoint',
+    })
+    if (result.handled) {
+      return { via: 'profile-adopt', result: { approved: result.approved, comment: result.comment, code: result.code, published: result.published } }
+    }
+  }
+
+  if (pending && isOptimizerDispatchCard(pending.nodeId)) {
+    const result = await decideOptimizerDispatch({
+      cardId: id,
+      approved: normalized.approved,
+      comment,
+      choice: normalized.choice,
+      actingUser: { id: user.id, name: user.name },
+      via: 'agent-tools/decide',
+    })
+    if (result.handled) {
+      audit({
+        actor: user.id,
+        actorName: user.name,
+        actorKind: 'user',
+        action: result.approved ? 'approval.approve' : 'approval.reject',
+        targetKind: 'tool-approval',
+        targetId: id,
+        detail: {
+          comment,
+          choice: normalized.choice,
+          dispatchCode: result.code,
+          execution: result.execution,
+          via: 'agent-tools/decide:optimizer-dispatch',
+          agentId,
+          channelId: manager.findChannelAgentById(agentId)?.channelId ?? '',
+        },
+      })
+      return { dispatch: { approved: result.approved, comment: result.comment, code: result.code, execution: result.execution } }
+    }
+  }
+
+  let approval
+  try {
+    approval = getToolApprovals().decide(id, normalized.approved, comment, user.id, user.name, normalized.choice)
+  }
+  catch (err) {
+    // ③ 非 pending(已被他人处理/超时/被取消)→ 409(不再 500)
+    throw new AppError(409, 'ALREADY_RESOLVED', err instanceof Error ? err.message : String(err))
+  }
+
+  // R1:HITL 裁决审计(闭环中的人为决策留痕;choice 与 fail-closed 收敛随行落审计)
+  audit({
+    actor: user.id,
+    actorName: user.name,
+    actorKind: 'user',
+    action: normalized.approved ? 'approval.approve' : 'approval.reject',
+    targetKind: 'tool-approval',
+    targetId: id,
+    detail: {
+      comment,
+      choice: normalized.choice,
+      ...(normalized.rejectedReason ? { failClosedReason: normalized.rejectedReason } : {}),
+      via: 'agent-tools/decide',
+      agentId,
+      channelId: manager.findChannelAgentById(agentId)?.channelId ?? '',
+    },
+  })
+  return { approval }
+})

package/server/api/workshop/agent-tools/list.get.ts

@@ -1,25 +1,70 @@
 /**
  * GET /api/workshop/agent-tools/list?agentId= —— 工具面 schema(stdio MCP 桥 tools/list 源)。
  * 按 agent 角色装配(host-tools.json + 插件工具),与 omp set_host_tools 注入面同源。
- * 鉴权:agent token(x-aw-agent-token)或仪表盘用户。
+ * 鉴权:agent token(x-aw-agent-token)自证;仪表盘用户路径必须可读该 Agent 所属 Channel
+ * (admin / owner / 成员),与 invoke 的授权口径对齐 —— 登录不等于可读取任意 Agent 的
+ * 绑定节点/配方描述(C15 提权泄漏修复)。
+ *
+ * WP6:响应带 ETag(工具面签名)。桥轮询带 If-None-Match 时命中 → 304 空体,
+ * 无变更时不再传输整张工具面(含 per-agent 绑定描述)。
  */
-import { getQuery, getHeader } from 'h3'
+import { createHash } from 'node:crypto'
+import { getQuery, getHeader, setHeader, setResponseStatus, defineEventHandler } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
+import { AppError } from '@/server/utils/errors'
 import { getWorkshopManager } from '@/server/plugins/workshop'
 
-export default defineApiHandler(async (event) => {
-  const agentToken = getHeader(event, 'x-aw-agent-token')
-  if (!agentToken) resolveUser(event)
-  const q = getQuery(event)
-  const agentId = String(q.agentId ?? '')
-  if (!agentId) throw createError({ statusCode: 400, statusMessage: 'agentId required' })
-  if (agentToken) {
-    const resolved = getWorkshopManager().resolveAgentByToken(String(agentToken))
-    if (!resolved || resolved.agentId !== agentId) {
-      throw createError({ statusCode: 401, statusMessage: 'agent token 校验失败' })
+/** 稳定序列化(键排序;数组保序)+ 弱 ETag */
+function weakEtagOf(tools: unknown): string {
+  const stable = JSON.stringify(tools, (_k, v) => {
+    if (v && typeof v === 'object' && !Array.isArray(v)) {
+      return Object.fromEntries(Object.keys(v as Record<string, unknown>).sort().map(k => [k, (v as Record<string, unknown>)[k]]))
     }
+    return v
+  })
+  return `W/"${createHash('sha256').update(stable).digest('hex').slice(0, 32)}"`
+}
+
+export default defineEventHandler(async (event) => {
+  try {
+    const agentToken = getHeader(event, 'x-aw-agent-token')
+    const user = agentToken ? null : resolveUser(event)
+    const q = getQuery(event)
+    const agentId = String(q.agentId ?? '')
+    if (!agentId) throw new AppError(400, 'BAD_REQUEST', 'agentId required')
+    const manager = getWorkshopManager()
+    if (agentToken) {
+      const resolved = manager.resolveAgentByToken(String(agentToken))
+      if (!resolved || resolved.agentId !== agentId) {
+        throw new AppError(401, 'UNAUTHORIZED', 'agent token 校验失败')
+      }
+    }
+    else if (user) {
+      const row = manager.deps.repos.channelAgents.findById(agentId)
+      if (!row) throw new AppError(404, 'NOT_FOUND', `agent 不存在: ${agentId}`)
+      const permissions = manager.channelPermissionsOf(row.channelId, user)
+      if (!permissions.isAdmin && !permissions.isMember) {
+        throw new AppError(403, 'SCOPE_VIOLATION', '该 Agent 所属 Channel 对你不可见,无权读取其工具面')
+      }
+    }
+    const tools = manager.hostToolDefsFor(agentId)
+    const etag = weakEtagOf(tools)
+    setHeader(event, 'ETag', etag)
+    setHeader(event, 'Cache-Control', 'no-cache')
+    const inm = String(getHeader(event, 'if-none-match') ?? '')
+    if (inm && inm.split(',').map(s => s.trim()).includes(etag)) {
+      setResponseStatus(event, 304)
+      return null
+    }
+    return { code: 0, message: 'ok', data: { tools } }
+  }
+  catch (error) {
+    if (error instanceof AppError) {
+      setResponseStatus(event, error.status)
+      return { code: error.code, message: error.message, data: null }
+    }
+    const status = Number((error as { statusCode?: number })?.statusCode ?? 500)
+    setResponseStatus(event, status)
+    return { code: status === 401 ? 'UNAUTHORIZED' : 'REQUEST_ERROR', message: (error as Error)?.message ?? '请求失败', data: null }
   }
-  const tools = getWorkshopManager().hostToolDefsFor(agentId)
-  return { tools }
 })

package/server/api/workshop/aml/models/[id].delete.ts

@@ -1,35 +1,38 @@
-/**
- * DELETE /api/workshop/aml/models/:id —— 删除模型(元数据行 + 实体目录)。
- * 保护:production 阶段的模型拒绝直接删除(在线预测依赖它),须先退役为 retired。
- * 权限:admin/editor + 产线 operate。
- */
-import { getRouterParam } from 'h3'
-import { defineApiHandler } from '@/server/utils/response'
-import { requireRole } from '@/server/api/workshop/caller'
-import { requireLineMode } from '@/server/services/workshop/permissions'
-import { AppError } from '@/server/utils/errors'
-import { getAmlRuntime } from '@/server/services/workshop/aml/runtime'
-import { removeEntityDir } from '@/server/services/workshop/aml/entity'
-import { recordOps } from '@/server/services/workshop/ops/ops'
-
-export default defineApiHandler(async (event) => {
-  const user = requireRole(event, ['admin', 'editor'])
-  const id = getRouterParam(event, 'id') ?? ''
-  const rt = getAmlRuntime()
-  const model = rt.repo.model.get(id)
-  if (!model) throw new AppError(404, 'AML_MODEL_MISSING', `模型 ${id} 不存在`)
-  requireLineMode(user, rt.repo.dataset.get(model.datasetId)?.lineId, 'operate')
-  if (model.stage === 'production') {
-    throw new AppError(409, 'AML_MODEL_IN_PRODUCTION',
-      `模型 ${id} 处于 production 阶段,在线预测依赖它,拒绝删除。请先晋升同组新模型或将其退役(retired)后再删。`)
-  }
-  const ent = removeEntityDir(rt, 'model', id)
-  rt.repo.model.remove(id)
-  recordOps({
-    actor: user.id, actorName: user.name, actorKind: 'user',
-    action: 'aml.model.delete', kind: 'system',
-    summary: `删除模型 ${id}(阶段 ${model.stage})${ent.removed ? ',含实体目录' : ''}`,
-    targetKind: 'aml_model', targetId: id,
-  })
-  return { deleted: true, entityRemoved: ent.removed, dir: ent.dir }
-})
+/**
+ * DELETE /api/workshop/aml/models/:id —— 删除模型(元数据行 + 实体目录)。
+ * 保护:production 阶段的模型拒绝直接删除(在线预测依赖它),须先退役为 retired。
+ * 权限:admin/editor + 产线 operate。
+ */
+import { getRouterParam } from 'h3'
+import { defineApiHandler } from '@/server/utils/response'
+import { requireRole } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
+import { AppError } from '@/server/utils/errors'
+import { getAmlRuntime } from '@/server/services/workshop/aml/runtime'
+import { removeEntityDir } from '@/server/services/workshop/aml/entity'
+import { assertModelNotReferenced } from '@/server/services/workshop/aml/model-references'
+import { recordOps } from '@/server/services/workshop/ops/ops'
+
+export default defineApiHandler(async (event) => {
+  const user = requireRole(event, ['admin', 'editor'])
+  const id = getRouterParam(event, 'id') ?? ''
+  const rt = getAmlRuntime()
+  const model = rt.repo.model.get(id)
+  if (!model) throw new AppError(404, 'AML_MODEL_MISSING', `模型 ${id} 不存在`)
+  requireLineMode(user, rt.repo.dataset.get(model.datasetId)?.lineId, 'operate')
+  if (model.stage === 'production') {
+    throw new AppError(409, 'AML_MODEL_IN_PRODUCTION',
+      `模型 ${id} 处于 production 阶段,在线预测依赖它,拒绝删除。请先晋升同组新模型或将其退役(retired)后再删。`)
+  }
+  // C13/A19:被 Channel profile / 训练计划 / Optimizer Profile / 在途租约引用时拒绝删除
+  assertModelNotReferenced(rt.db, id)
+  const ent = removeEntityDir(rt, 'model', id)
+  rt.repo.model.remove(id)
+  recordOps({
+    actor: user.id, actorName: user.name, actorKind: 'user',
+    action: 'aml.model.delete', kind: 'system',
+    summary: `删除模型 ${id}(阶段 ${model.stage})${ent.removed ? ',含实体目录' : ''}`,
+    targetKind: 'aml_model', targetId: id,
+  })
+  return { deleted: true, entityRemoved: ent.removed, dir: ent.dir }
+})

package/server/api/workshop/channels/[id]/agents/[agentId]/rotate-token.post.ts

@@ -0,0 +1,45 @@
+/**
+ * POST /api/workshop/channels/:id/agents/:agentId/rotate-token —— 轮换 Agent 实例 token(WP3)。
+ *
+ * 权限:channel 属主或 admin(requireWritable,与 Agent 实例管理面同口径)。
+ * 语义:新 token 立即生效;旧 token 进入宽限窗(缺省 60s,env AW_TOKEN_GRACE_MS 可调),
+ *      窗内四路调用点(桥 invoke / 桥 list / 面A Bearer / manager)双接受,桥进程自动重连过渡。
+ * 响应:仅本次一次性返回全量新 token(与仪表盘 tokenTail 策略配套;全量不在列表/详情回显)。
+ * 审计:agent.token.rotate(targetId=agentId,detail 不含 token 明文)。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { AppError } from '@/server/utils/errors'
+import { getWorkshopManager } from '@/server/plugins/workshop'
+import { recordOps } from '@/server/services/workshop/ops/ops'
+
+export default defineApiHandler(async (event) => {
+  const channelId = getRouterParam(event, 'id')!
+  const agentId = getRouterParam(event, 'agentId')!
+  const user = resolveUser(event)
+  const manager = getWorkshopManager()
+  const ch = manager.getChannelForUser(channelId, user.id)
+  manager.requireWritable(ch.ownerUserId, user, 'channel')
+  if (!agentId) throw new AppError(400, 'BAD_REQUEST', 'agentId 必填')
+  const rotated = manager.rotateChannelAgentToken(channelId, agentId)
+  recordOps({
+    actor: user.id,
+    actorName: user.name ?? '',
+    actorKind: 'user',
+    action: 'agent.token.rotate',
+    kind: 'system',
+    level: 'warn',
+    targetKind: 'agent',
+    targetId: agentId,
+    summary: `轮换 Agent token(宽限至 ${rotated.prevTokenUntil})`,
+    detail: { channelId, agentId, prevTokenUntil: rotated.prevTokenUntil },
+  })
+  return {
+    agentId: rotated.agentId,
+    channelId: rotated.channelId,
+    token: rotated.token,
+    prevTokenUntil: rotated.prevTokenUntil,
+    note: '全量 token 仅此一次返回;旧 token 在 prevTokenUntil 前仍可用(桥进程重连过渡),之后彻底失效。',
+  }
+})