agentworkshop 0.7.8 → 0.7.11

package/.output/server/index.mjs

@@ -17,6 +17,7 @@ import 'node:buffer';
 import 'node:fs';
 import 'node:path';
 import 'node:url';
+import 'node:fs/promises';
 import 'node:os';
 import 'js-yaml';
 import 'node:child_process';
@@ -24,7 +25,6 @@ import 'node:net';
 import 'node:util';
 import 'node:sqlite';
 import 'node:module';
-import 'node:fs/promises';
 import 'node:zlib';
 
 const kNodeInspect = /* @__PURE__ */ Symbol.for(

package/.output/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentworkshop-prod",
-  "version": "0.7.8",
+  "version": "0.7.11",
   "type": "module",
   "private": true,
   "dependencies": {

package/README-zh.md

@@ -309,6 +309,21 @@ curl http://localhost:3000/api/workshop/channels \
   -H 'authorization: Bearer <token>'
 ```
 
+### 产线级权限
+
+工业数据按**产线**三态管控，由管理员在内置「权限管理」页（`/permissions`，仅 admin 侧栏可见）维护：
+
+| 状态 | 数采节点 | 数控(写控)节点 | 可见性 |
+|---|---|---|---|
+| **无权**（普通用户默认） | 隐藏 | 隐藏 | 后端不返回该产线数据——产线运营/数采中心/数字孪生均不可见 |
+| **仅查看** | 只读 | ✕ | 产线可见、实时值可看，但不可写/不可下发/不可绑定设备 |
+| **可操控** | 读取 | 读取+写入 | 全量能力：设定值下发、参数下发、设备绑定 |
+
+- `admin` / `editor` 为运营角色，不受授权约束（全量全权）。
+- 普通用户**默认无权**——未授权前看不到任何产线数据。
+- 强制点在数据面：列表接口按授权过滤，写控/下发接口返回人话 403，Agent↔节点绑定校验产线授权（数采需仅查看+，写控需可操控）。
+- 插件经 `ctx.permissions`（`lineMode` / `visibleLineIds` / `listGrants` / `setGrants`）获得同一能力面，并有 `permissions:changed` 生命周期钩子；SDK REST 客户端提供 `client.permissions.overview()` / `client.permissions.set(...)`。
+
 ### 执行模式
 
 在任务描述中使用模式前缀（或在 composer UI 中选择）：

package/README.md

@@ -310,6 +310,26 @@ curl http://localhost:3000/api/workshop/channels \
   -H 'authorization: Bearer <token>'
 ```
 
+### Line-level permissions
+
+Industrial data is gated **per production line** with three states, managed by an admin
+in the built-in **Permissions** page (`/permissions`, admin-only in the sidebar):
+
+| State | DAQ nodes | DCW (write) nodes | Visibility |
+| --- | --- | --- | --- |
+| **none** (default for regular users) | hidden | hidden | line data withheld server-side — invisible in Line Ops, DAQ center and the digital twin |
+| **read-only** | read | ✕ | line visible, values stream, no writes / dispatch / device binding |
+| **operate** | read | read + write | full access incl. setpoint writes, dispatch, binding |
+
+- `admin` / `editor` roles are unrestricted (operations roles).
+- Regular users **default to none** — they see no line data until granted.
+- Enforcement lives in the data plane: list endpoints filter by grant, write/dispatch
+  endpoints return a human-readable 403, and Agent↔node bindings validate the line grant
+  (DAQ needs read-only+, DCW needs operate).
+- Plugins get the same surface via `ctx.permissions` (`lineMode` / `visibleLineIds` /
+  `listGrants` / `setGrants`) plus a `permissions:changed` lifecycle hook; the SDK REST
+  client exposes `client.permissions.overview()` / `client.permissions.set(...)`.
+
 ### Execution modes
 
 Prefix the task description (or pick in the composer UI):

package/app/components/AppHeader.vue

@@ -53,7 +53,7 @@ const hitlAnswer = async (item: AepHitlItem, confirmed: boolean): Promise<void>
     await hitl.loadSnapshot()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     hitlAnswering.value = null

package/app/components/AppSidebar.vue

@@ -1,4 +1,7 @@
 <script setup lang="ts">
+import { useUserStore } from '~/stores/workshop/user'
+
+const userStore = useUserStore()
 const { t } = useI18n()
 const route = useRoute()
 const site = useSiteConfig()
@@ -10,6 +13,8 @@ interface MenuItem {
   label: string
   /** 图标微动效类(im-*) */
   motion?: string
+  /** 仅 admin 可见(权限管理) */
+  adminOnly?: boolean
 }
 
 const menuItems = computed<MenuItem[]>(() => [
@@ -21,10 +26,11 @@ const menuItems = computed<MenuItem[]>(() => [
   { key: '/dcw', icon: 'i-tabler-settings-automation', label: t('menu.dcw'), motion: 'im-pop' },
   { key: '/logs', icon: 'i-tabler-list-details', label: t('menu.logs'), motion: 'im-pop' },
   { key: '/users', icon: 'i-tabler-users-group', label: t('menu.users'), motion: 'im-pop' },
+  { key: '/permissions', icon: 'i-tabler-shield-lock', label: t('menu.permissions'), motion: 'im-pop', adminOnly: true },
   { key: '/monitor', icon: 'i-tabler-cpu', label: t('menu.monitor'), motion: 'im-pulse' },
   { key: '/plugins', icon: 'i-tabler-puzzle', label: t('menu.plugins'), motion: 'im-pop' },
   { key: '/settings', icon: 'i-tabler-settings', label: t('menu.settings'), motion: 'im-rotate' },
-])
+].filter(m => !m.adminOnly || userStore.isAdmin))
 
 const isActive = (key: string): boolean =>
   key === '/' ? route.path === '/' : route.path.startsWith(key)

package/app/components/workshop/A2aRpcDebugger.vue

@@ -131,7 +131,7 @@ const run = async (): Promise<void> => {
     }
   }
   catch (e) {
-    append(`✖ ${e instanceof Error ? e.message : String(e)}`)
+    append(`✖ ${apiErrorMessage(e)}`)
   }
   finally {
     running.value = false

package/app/components/workshop/AgentInspectorDrawer.vue

@@ -54,7 +54,7 @@ const toggleEnabled = async (checked: string | number | boolean): Promise<void>
     message.success(checked === true ? t('agentInspectorDrawer.k3n5z7y016') : t('agentInspectorDrawer.k1dst50d017'))
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     toggling.value = false
@@ -73,7 +73,7 @@ const removeMember = async (): Promise<void> => {
     emit('removed', props.agentId)
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     removing.value = false
@@ -129,7 +129,7 @@ const send = async (): Promise<void> => {
     sendText.value = ''
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     sending.value = false

package/app/components/workshop/AgentLanesView.vue

@@ -115,7 +115,7 @@ const submitEditMember = async (): Promise<void> => {
     editModalOpen.value = false
   }
   catch (err) {
-    message.error(t('agentLanesView.k3jmrw1045', { p0: err instanceof Error ? err.message : String(err) }))
+    message.error(t('agentLanesView.k3jmrw1045', { p0: apiErrorMessage(err) }))
   }
   finally {
     editSubmitting.value = false
@@ -155,7 +155,7 @@ const submitMember = async (): Promise<void> => {
       memberModalOpen.value = false
     }
     catch (err) {
-      message.error(t('agentLanesView.k1j97j74047', { p0: err instanceof Error ? err.message : String(err) }))
+      message.error(t('agentLanesView.k1j97j74047', { p0: apiErrorMessage(err) }))
     }
     finally {
       memberSubmitting.value = false
@@ -181,7 +181,7 @@ const submitMember = async (): Promise<void> => {
       memberModalOpen.value = false
     }
     catch (err) {
-      const text = err instanceof Error ? err.message : String(err)
+      const text = apiErrorMessage(err)
       message.error(`模板克隆失败${text.includes('LEAD_EXISTS') ? '(已有 lead,不能再添加 lead)' : `: ${text}`}`)
     }
     finally {
@@ -202,7 +202,7 @@ const submitMember = async (): Promise<void> => {
     memberModalOpen.value = false
   }
   catch (err) {
-    const text = err instanceof Error ? err.message : String(err)
+    const text = apiErrorMessage(err)
     message.error(`编组部署失败${text.includes('LEAD_EXISTS') ? '(channel 已有 lead,编组内 lead 成员冲突;请先移除现有 lead 或选用无 lead 编组)' : `: ${text}`}`)
   }
   finally {
@@ -218,7 +218,7 @@ const removeMember = async (agentId: string, name: string): Promise<void> => {
     message.success(t('agentLanesView.k1n3o03a052', { p0: name }))
   }
   catch (err) {
-    message.error(t('agentLanesView.k13dsp10053', { p0: err instanceof Error ? err.message : String(err) }))
+    message.error(t('agentLanesView.k13dsp10053', { p0: apiErrorMessage(err) }))
   }
   finally {
     removing.value = null
@@ -234,7 +234,7 @@ const stopMember = async (agentId: string, name: string): Promise<void> => {
     message.success(t('agentLanesView.kcpbv47054', { p0: name }))
   }
   catch (err) {
-    message.error(t('agentLanesView.k139ec5j055', { p0: err instanceof Error ? err.message : String(err) }))
+    message.error(t('agentLanesView.k139ec5j055', { p0: apiErrorMessage(err) }))
   }
   finally {
     stopping.value = null

package/app/components/workshop/AssetLibrary.vue

@@ -71,7 +71,7 @@ async function doUpload(): Promise<void> {
     uploadError.value = t('assetLibrary.k8nv3or016', { p0: model.name })
   }
   catch (err) {
-    uploadError.value = err instanceof Error ? err.message : String(err)
+    uploadError.value = apiErrorMessage(err)
   }
   finally {
     uploading.value = false
@@ -89,7 +89,7 @@ async function doRemove(id: string): Promise<void> {
     deleteMsg.value = t('assetLibrary.k8n918k013')
   }
   catch (err) {
-    deleteMsg.value = err instanceof Error ? err.message : String(err)
+    deleteMsg.value = apiErrorMessage(err)
   }
   finally {
     deletingId.value = ''

package/app/components/workshop/ChannelSessionList.vue

@@ -105,7 +105,7 @@ const createAndMount = async (): Promise<void> => {
     message.success(t('channelSessionList.kn89jvs028'))
   }
   catch (e) {
-    message.error(t('channelSessionList.k1x2th9e041', { p0: e instanceof Error ? e.message : String(e) }))
+    message.error(t('channelSessionList.k1x2th9e041', { p0: apiErrorMessage(e) }))
   }
   finally {
     mountSubmitting.value = false
@@ -127,7 +127,7 @@ const mountFromTemplate = async (): Promise<void> => {
   }
   catch (e) {
     const err = e as { data?: { message?: string }, message?: string }
-    message.error(err?.data?.message ?? err?.message ?? t('channelSessionList.k97xi7u029'))
+    message.error(apiErrorMessage(err, t('channelSessionList.k97xi7u029')))
   }
   finally {
     templateMounting.value = false
@@ -136,7 +136,7 @@ const mountFromTemplate = async (): Promise<void> => {
 
 const unmount = (channelId: string): void => {
   wsStore.unmountChannel(props.wsId, channelId)
-    .catch((e: { data?: { message?: string }, message?: string }) => { message.error(e?.data?.message ?? e?.message ?? t('channelSessionList.k1hgfvdc030')) })
+    .catch((e: { data?: { message?: string }, message?: string }) => { message.error(apiErrorMessage(e, t('channelSessionList.k1hgfvdc030'))) })
 }
 
 // ===== Channel 实例设置(场景/工作目录热更新)+ 保存为模板 =====
@@ -224,7 +224,7 @@ const saveSettings = async (): Promise<void> => {
     void refreshChannels()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     settingsSaving.value = false
@@ -259,7 +259,7 @@ const saveAsTemplate = async (): Promise<void> => {
     void refreshChannels()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     saveTplSubmitting.value = false

package/app/components/workshop/Composer.vue

@@ -216,7 +216,7 @@ const send = async (): Promise<void> => {
     emit('submitted')
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     sendLoading.value = false

package/app/components/workshop/DeviceTwinPanel.vue

@@ -77,7 +77,7 @@ async function removeTwin(t: { id: string, name: string }): Promise<void> {
     await twins.remove(t.id)
   }
   catch (err) {
-    ctrlMsg.value = err instanceof Error ? err.message : String(err)
+    ctrlMsg.value = apiErrorMessage(err)
   }
   finally {
     busyId.value = ''
@@ -118,7 +118,7 @@ function doDcwWrite(r: DcwLiveRow): void {
   void dcw.write(r.id, v).then((out) => {
     if (!out.ok) dcwErrs[r.id] = out.message
   }).catch((err: unknown) => {
-    dcwErrs[r.id] = err instanceof Error ? err.message : String(err)
+    dcwErrs[r.id] = apiErrorMessage(err)
   }).finally(() => {
     dcwBusy.value = ''
   })

package/app/components/workshop/TaskBoardView.vue

@@ -150,7 +150,7 @@ const applyMove = async (taskId: string, action: 'cancel' | 'retry'): Promise<vo
     revert.set(taskId, prev)
     optimistic.value = revert
     const err = e as { data?: { message?: string }, message?: string }
-    message.error(err?.data?.message ?? err?.message ?? t('taskBoardView.k1e7zwuc015'))
+    message.error(apiErrorMessage(err, t('taskBoardView.k1e7zwuc015')))
   }
   finally {
     acting.value.delete(taskId)

package/app/components/workshop/TaskInspectorDrawer.vue

@@ -72,7 +72,7 @@ const cancel = async (): Promise<void> => {
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     cancelling.value = false
@@ -90,7 +90,7 @@ const retry = async (): Promise<void> => {
     void load()
   }
   catch (e) {
-    message.error(e instanceof Error ? e.message : String(e))
+    message.error(apiErrorMessage(e))
   }
   finally {
     retrying.value = false

package/app/components/workshop/town/TownView.vue

@@ -190,7 +190,7 @@ async function saveChannelLayout(): Promise<void> {
   }
   catch (err) {
     saveState.value = { state: 'error', at: Date.now() }
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   }
 }
 /** 从场景移除频道(其 Agent 一并撤出) */
@@ -202,7 +202,7 @@ async function removeChannelFromScene(): Promise<void> {
     onSelectChannel(null)
   }
   catch (err) {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   }
 }
 /** 边界编辑输入 → 场景即时生效(草稿) */
@@ -332,7 +332,7 @@ function onObjNameCommit(): void {
   if (!name) return
   scene3dRef.value?.renameDevice(id, name)
   void deviceTwins.update(id, { name }).catch((err) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
 }
 /** 角色独立换模型(选中角色 → character 模型下拉即时换装 + 持久化) */
@@ -353,7 +353,7 @@ async function bindAgentModel(modelRef: string): Promise<void> {
     scene3dRef.value?.swapAgentModel(agentId, modelRef)
   }
   catch (err) {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   }
 }
 /** 设备独立换模型(下拉选择设备模型 → 重挂 + 落库,广播后其他客户端同步) */
@@ -365,7 +365,7 @@ async function bindDeviceModel(modelRef: string): Promise<void> {
     await deviceTwins.update(sel.id, { modelRef })
   }
   catch (err) {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   }
 }
 /** 删除选中设备实例(移除孪生 + 场景节点);两步确认:首击布防 3s,再击执行 */
@@ -384,7 +384,7 @@ function removeSelectedDevice(): void {
   void scene3dRef.value?.removeDevice(sel.id)
     .then(() => closeScale())
     .catch((err: unknown) => {
-      errorText.value = err instanceof Error ? err.message : String(err)
+      errorText.value = apiErrorMessage(err)
     })
 }
 
@@ -403,7 +403,7 @@ async function bindMemberModel(agentId: string, modelRef: string): Promise<void>
     scene3dRef.value?.swapAgentModel(agentId, modelRef)
   }
   catch (err) {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   }
 }
 /** 频道管理面板 tab 切换 */
@@ -620,7 +620,7 @@ async function boot3D(): Promise<void> {
     scene.hydrate(buildTownInput(), Object.values(sceneLayouts.layouts), sceneTwinPool.value)
     syncChannelDock()
   }).catch((err) => {
-    errorText.value = t('townView.k1hmf2ut192', { p0: err instanceof Error ? err.message : String(err) })
+    errorText.value = t('townView.k1hmf2ut192', { p0: apiErrorMessage(err) })
     window.setTimeout(() => {
       void sceneLayouts.load()
     }, 2500)
@@ -734,7 +734,7 @@ function wireCommon(scene: CommonTownScene): void {
       scene.handleTownEvent(e)
     }
     catch (err) {
-      errorText.value = err instanceof Error ? err.message : String(err)
+      errorText.value = apiErrorMessage(err)
     }
   })
   ;(sceneRef as unknown as { _off?: () => void })._off = off
@@ -945,7 +945,7 @@ function bindSceneInput3D(scene: TownScene3D): void {
             if (near) bindDaq(daqNodeId, near.id)
           }
         }).catch((err: unknown) => {
-          errorText.value = err instanceof Error ? err.message : String(err)
+          errorText.value = apiErrorMessage(err)
         })
       }
       return
@@ -961,13 +961,13 @@ function bindSceneInput3D(scene: TownScene3D): void {
             const near = nearestDeviceTwin(world.x, world.z, 95)
             if (near) {
               void dcw.bindNode(dcwNodeId, near.id).catch((err: unknown) => {
-                errorText.value = err instanceof Error ? err.message : String(err)
+                errorText.value = apiErrorMessage(err)
               })
             }
           }
           if (sceneRef.value) syncSceneDevices(sceneRef.value)
         }).catch((err: unknown) => {
-          errorText.value = err instanceof Error ? err.message : String(err)
+          errorText.value = apiErrorMessage(err)
         })
       }
       return
@@ -1439,7 +1439,7 @@ async function createDaqFromTemplate(tpl: DaqTemplate): Promise<void> {
     treeOpen.value[`daq:${tpl.id}`] = true
   }
   catch (err: unknown) {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   }
 }
 async function createDcwFromTemplate(tpl: { id: string }): Promise<void> {
@@ -1448,7 +1448,7 @@ async function createDcwFromTemplate(tpl: { id: string }): Promise<void> {
     treeOpen.value[`dcw:${tpl.id}`] = true
   }
   catch (err: unknown) {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   }
 }
 /** 节点叶子拖拽(编辑模式):载荷 = server 节点 id,投放走 PATCH 落位。
@@ -1765,12 +1765,12 @@ const daqOfDevice = (deviceId: string): string[] =>
   deviceId ? daq.nodes.filter(n => n.deviceBindingId === deviceId).map(n => n.id) : []
 function bindDaq(daqId: string, deviceId: string): void {
   void daq.bindNode(daqId, deviceId).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
 }
 function unbindDaq(daqId: string): void {
   void daq.bindNode(daqId, null).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
 }
 
@@ -2031,7 +2031,7 @@ function doDcwWrite(node: DcwNodeView): void {
   void dcw.write(node.id, Number(raw)).then((out) => {
     if (!out.ok) dcwWriteErrs[node.id] = out.message
   }).catch((err: unknown) => {
-    dcwWriteErrs[node.id] = err instanceof Error ? err.message : String(err)
+    dcwWriteErrs[node.id] = apiErrorMessage(err)
   })
 }
 
@@ -2063,14 +2063,14 @@ function bindDcwChoice(nodeId: string): void {
   const devId = selected.value?.kind === 'device' ? selected.value.id : ''
   if (!devId) return
   void dcw.bindNode(nodeId, devId).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
   dcwBindPopOpen.value = false
 }
 
 function unbindDcw(dcwId: string): void {
   void dcw.bindNode(dcwId, null).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
 }
 
@@ -2096,7 +2096,7 @@ function bindSelectedDcw(): void {
   const n = selectedDcwNode.value
   if (!n || !dcwBindPick.value) return
   void dcw.bindNode(n.id, dcwBindPick.value).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
   dcwBindPick.value = ''
 }
@@ -2104,7 +2104,7 @@ function unbindSelectedDcw(): void {
   const n = selectedDcwNode.value
   if (!n) return
   void dcw.bindNode(n.id, null).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
 }
 function doWriteSelectedDcw(): void {
@@ -2140,14 +2140,14 @@ function onDaqIntervalCommit(): void {
   const n = selectedDaqNode.value
   if (!n || daqIntervalDraft.value == null) return
   void daq.patchNode(n.id, { intervalMs: Math.max(120, Math.min(60_000, Math.round(daqIntervalDraft.value))) }).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
 }
 function onDaqThresholdCommit(key: 'min' | 'max' | 'warnLow' | 'warnHigh', raw: string): void {
   const v = Number(raw)
   if (!Number.isFinite(v)) return
   void daq.patchNode(selectedDaqNode.value!.id, { [key]: key.startsWith('warn') ? v : v }).catch((err: unknown) => {
-    errorText.value = err instanceof Error ? err.message : String(err)
+    errorText.value = apiErrorMessage(err)
   })
 }