agentworkshop 0.7.8 → 0.7.11

package/scripts/_dbg-acc-5-visual.mjs

@@ -0,0 +1,63 @@
+// 验收阶段5:前端可视化巡检(workshop 会话/产线/监控/数字孪生)
+// 用法:node scripts/_dbg-acc-5-visual.mjs <base> <user> <pass> <channelId>
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const [USER, PASS, CHANNEL_ID] = [process.argv[3], process.argv[4], process.argv[5]]
+mkdirSync('.e2e-shots', { recursive: true })
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: `${USER}@awshop.local`, password: PASS }) })
+const TOKEN = login.body?.data?.token
+
+const browser = await puppeteer.launch({
+  executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  headless: 'new',
+  args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'],
+})
+const shots = []
+const snap = async (page, name, wait = 2500) => {
+  await new Promise(r => setTimeout(r, wait))
+  const path = `.e2e-shots/acc-5-${name}.png`
+  await page.screenshot({ path })
+  shots.push(path)
+  console.log('📷', path)
+}
+try {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.setCookie({ name: 'token', value: TOKEN, domain: new URL(BASE).hostname, path: '/' })
+
+  // 1) workshop 总览(实时状态徽标)
+  await page.goto(`${BASE}/workshop`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await snap(page, 'workshop-overview')
+
+  // 2) channel 会话页(找 workspace 链接直达)
+  const wsHref = await page.evaluate(() => [...document.querySelectorAll('a')].map(a => a.getAttribute('href')).find(h => h?.startsWith('/workshop/w/')))
+  if (wsHref) {
+    await page.goto(`${BASE}${wsHref}`, { waitUntil: 'networkidle2', timeout: 60000 })
+    await snap(page, 'workshop-channel', 4000)
+  }
+  else {
+    console.log('(未找到 workspace 链接,跳过会话页)')
+  }
+
+  // 3) 产线运营
+  await page.goto(`${BASE}/dcw`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await snap(page, 'dcw-lines', 3000)
+
+  // 4) 运行时监控
+  await page.goto(`${BASE}/monitor`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await snap(page, 'monitor', 3000)
+
+  // 5) 数字孪生(等 WS 快照与 3D/趋势渲染)
+  await page.goto(`${BASE}/town`, { waitUntil: 'networkidle2', timeout: 90000 })
+  await snap(page, 'town', 8000)
+}
+finally {
+  await browser.close()
+}
+console.log('DONE', shots.length, 'screenshots')

package/scripts/_dbg-acc-5b-ws-town.mjs

@@ -0,0 +1,18 @@
+// 验收阶段5b:workspace 会话页 + 数字孪生(挂载后)
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3021'
+const WS = process.argv[2] ?? 'c99321bd-3352-4362-88e2-4141dcdd9331'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto(`${BASE}/workshop/w/${WS}`, { waitUntil: 'networkidle2', timeout: 90000 })
+await new Promise(r => setTimeout(r, 6000))
+await page.screenshot({ path: '.e2e-shots/acc-5-workshop-channel.png' })
+console.log('📷 workshop-channel')
+await page.goto(`${BASE}/town`, { waitUntil: 'networkidle2', timeout: 90000 })
+await new Promise(r => setTimeout(r, 10000))
+await page.screenshot({ path: '.e2e-shots/acc-5-town-2.png' })
+console.log('📷 town-2')
+await browser.close()

package/scripts/_dbg-acc-5c-town.mjs

@@ -0,0 +1,12 @@
+// town 截图(WS 常驻连接下不能等 networkidle)
+import puppeteer from 'puppeteer-core'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch('http://127.0.0.1:3021/api/users/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto('http://127.0.0.1:3021/town', { waitUntil: 'domcontentloaded', timeout: 60000 })
+await new Promise(r => setTimeout(r, 14000))
+await page.screenshot({ path: '.e2e-shots/acc-5-town-2.png' })
+console.log('📷 town-2')
+await browser.close()

package/scripts/_dbg-acc-6-i18n.mjs

@@ -0,0 +1,19 @@
+// i18n 分组标题修复目视验证
+import puppeteer from 'puppeteer-core'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch('http://127.0.0.1:3021/api/users/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto('http://127.0.0.1:3021/settings', { waitUntil: 'networkidle2', timeout: 60000 })
+await new Promise(r => setTimeout(r, 1500))
+await page.evaluate(() => {
+  const tab = [...document.querySelectorAll('.ant-tabs-tab,[role=tab],button,.section-title')].find(e => (e.textContent ?? '').trim() === '运行配置')
+  tab?.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+})
+await new Promise(r => setTimeout(r, 1500))
+const text = await page.evaluate(() => document.body.innerText)
+console.log('缺键残留(settings.runtime.groupXxx):', /settings\.runtime\.group/.test(text) ? '仍有 ✖' : '已清零 ✔')
+console.log('分组标题样例:', ['记忆系统', 'Agent Harness', '数控写控', '数据备份', 'Harness 接入'].filter(t => text.includes(t)).join(' / '))
+await page.screenshot({ path: '.e2e-shots/acc-6-i18n-groups.png' })
+await browser.close()

package/scripts/_dbg-audit-neg-e2e.mjs

@@ -0,0 +1,64 @@
+// 审计修复负向断言:越权 start/stop/samples/WS 无鉴权
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let step = 0
+const ok = (name, cond, detail = '') => {
+  step++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!cond) process.exitCode = 1
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+ok('admin 登录', Boolean(adminTok))
+
+// 拿 admin 视角的有线 dcw 节点 + 有线节点 samples
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data ?? {}
+const lineNode = dcw.nodes?.find(n => n.lineId)
+ok('admin 可见有产线节点', Boolean(lineNode), lineNode?.id)
+
+// plain(复用权限 E2E 建的账号或新注册,默认零授权)
+const stamp = Date.now().toString(36)
+const reg = await api('/api/users/register', { method: 'POST', body: JSON.stringify({ name: `a-${stamp}`, email: `a-${stamp}@awshop.local`, password: 'Plain2026' }) })
+const plainTok = reg.body?.data?.token
+ok('plain 注册', Boolean(plainTok))
+
+// 越权断言
+const r1 = await api(`/api/workshop/dcw/lines/${lineNode.lineId}/start`, { method: 'POST', body: '{}' }, plainTok)
+ok('零授权 start 产线被拒(403)', r1.status === 403, r1.body?.message)
+const r2 = await api(`/api/workshop/dcw/lines/${lineNode.lineId}/stop`, { method: 'POST', body: '{}' }, plainTok)
+ok('零授权 stop 产线被拒(403)', r2.status === 403, r2.body?.message)
+const daq = (await api('/api/workshop/daq', {}, adminTok)).body?.data ?? {}
+const daqNode = daq.nodes?.find(n => n.lineId)
+const r3 = await api(`/api/workshop/daq/${daqNode.id}/samples?limit=5`, {}, plainTok)
+ok('零授权读历史采样被拒(403)', r3.status === 403, r3.body?.message)
+const r4 = await api(`/api/workshop/daq/${daqNode.id}/frames?limit=5`, {}, plainTok)
+ok('零授权读帧列表被拒(403)', r4.status === 403, r4.body?.message)
+
+// ws 未鉴权:裸连(无 token)应收不到 scene 帧(10s 无 daq.reading)
+const wsUrl = `${BASE.replace('http', 'ws')}/api/workshop/ws`
+const ws = new WebSocket(wsUrl)
+let frames = 0
+ws.onmessage = () => frames++
+await new Promise(r => setTimeout(r, 10000))
+ws.close()
+ok('无 token WS 连接收不到遥测帧(10s)', frames === 0, `frames=${frames}`)
+
+// 带 token 的 WS:admin 能收到遥测(存活验证)
+const ws2 = new WebSocket(`${wsUrl}?token=${adminTok}`)
+let frames2 = 0
+ws2.onmessage = (ev) => {
+  const d = JSON.parse(ev.data)
+  if (d.type === 'daq.reading' || d.type === 'dcw.read') frames2++
+}
+await new Promise(r => setTimeout(r, 12000))
+ws2.close()
+ok('带 token WS 收到遥测帧', frames2 > 0, `frames=${frames2}`)
+
+console.log(`\n===== audit negative E2E: ${step} 项 =====`)

package/scripts/_dbg-final-features.mjs

@@ -0,0 +1,155 @@
+// ============================================================
+// 最终验收·全功能测试(home 生产实例):Channel/Team/产线/数采/写控/绑定/权限
+// 用法:node scripts/_dbg-final-features.mjs <base> <adminPass>
+// ============================================================
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3001'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let pass = 0, fail = 0
+const sections = []
+let section = 'START'
+const sec = (name) => { section = name; console.log(`\n── ${name} ──`) }
+const ok = (name, cond, detail = '') => {
+  cond ? pass++ : fail++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  sections.push({ section, name, ok: cond, detail })
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const stamp = Date.now().toString(36)
+
+// ===== 1. 基础面 =====
+sec('基础面')
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+ok('admin 登录', Boolean(adminTok))
+const me = await api('/api/users/me', {}, adminTok)
+ok('/me 返回 admin', me.body?.data?.role === 'admin')
+const health = await api('/api/health')
+ok('/api/health 存活', health.status === 200)
+const ss = await api('/api/users/setup-status')
+ok('setup 已收敛(false)', ss.body?.data?.needsSetup === false)
+
+// ===== 2. 产线管理与写控 =====
+sec('产线管理与写控(DCW)')
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data
+ok('dcw 网关运行', dcw?.controller?.running === true)
+ok(`写控节点在线 ${dcw?.controller?.nodesOnline}/${dcw?.controller?.nodesTotal}`, dcw?.controller?.nodesOnline > 0)
+ok(`产线 ${dcw?.lines?.length} 条可见`, dcw?.lines?.length > 0)
+const line1 = dcw.lines[0]
+const line2 = dcw.lines[1]
+ok('目标产线定位(前两条)', Boolean(line1 && line2), `${line1?.id} ${line2?.id}`)
+// 写控:对 1 号产线的一个 mock 写控节点下发设定值并回读
+const wNode = dcw.nodes.find(n => n.lineId === line1?.id && n.driver === 'mock')
+ok('1号产线 mock 写控节点', Boolean(wNode), wNode?.id)
+if (wNode) {
+  const target = Math.round(((wNode.min ?? 150) + (wNode.max ?? 200)) / 2)
+  const wr = await api(`/api/workshop/dcw/${wNode.id}/write`, { method: 'POST', body: JSON.stringify({ value: target }) }, adminTok)
+  ok(`写控下发 ${target} 并 ACK 回读一致`, wr.status === 200 && wr.body?.data?.outcome?.ok === true, String(wr.body?.data?.outcome?.message ?? '').slice(0, 60))
+}
+// 产线开跑/停止(2号产线,含配方下发闭环)
+const rStart = await api(`/api/workshop/dcw/lines/${line2.id}/start`, { method: 'POST', body: JSON.stringify({}) }, adminTok)
+ok('2号产线开跑(lineStart)', rStart.status === 200 && rStart.body?.data?.run != null, `run=${rStart.body?.data?.run?.id?.slice(0, 8)}`)
+await new Promise(r => setTimeout(r, 3000))
+const rStop = await api(`/api/workshop/dcw/lines/${line2.id}/stop`, { method: 'POST', body: '{}' }, adminTok)
+ok('2号产线停止', rStop.status === 200)
+
+// ===== 3. 数据采集(DAQ) =====
+sec('数据采集(DAQ)')
+const daq = (await api('/api/workshop/daq', {}, adminTok)).body?.data
+ok(`数采节点在线 ${daq?.controller?.nodesOnline}/${daq?.controller?.nodesTotal}`, daq?.controller?.nodesOnline > 0)
+ok(`采样管道 produced=${daq?.controller?.produced} consumed=${daq?.controller?.consumed} dropped=${daq?.controller?.dropped}`, daq?.controller?.produced > 0 && daq?.controller?.dropped === 0)
+const liveDaq = daq.nodes.find(n => n.state === 'ok' && n.lineId)
+ok('活采样节点定位', Boolean(liveDaq), `${liveDaq?.id} v=${liveDaq?.value}`)
+if (liveDaq) {
+  const a0 = liveDaq.lastAt
+  await new Promise(r => setTimeout(r, 5000))
+  const daq2 = (await api('/api/workshop/daq', {}, adminTok)).body?.data
+  const n2 = daq2.nodes.find(n => n.id === liveDaq.id)
+  ok('采样节拍推进(lastAt 前进+值变化)', n2.lastAt > a0 || n2.value !== liveDaq.value, `v ${liveDaq.value}→${n2.value}`)
+  const sp = await api(`/api/workshop/daq/${liveDaq.id}/samples?limit=10`, {}, adminTok)
+  ok('时序历史查询(>0 数据点)', sp.status === 200 && (sp.body?.data?.points?.length ?? 0) > 0, `points=${sp.body?.data?.points?.length}`)
+}
+const alarms = await api('/api/workshop/daq/alarms', {}, adminTok)
+ok('告警查询可用', alarms.status === 200)
+
+// ===== 4. Channel + AgentTeamWork + 绑定 + 团队闭环 =====
+sec('Channel / AgentTeam / 绑定 / 团队作业闭环')
+const mk = async (name, harness) => (await api('/api/workshop/agents', { method: 'POST', body: JSON.stringify({ name, harness, visibility: 'private' }) }, adminTok)).body?.data
+const leadTpl = await mk(`fin-lead-${stamp}`, 'omp')
+const wMock = await mk(`fin-w-mock-${stamp}`, 'mock')
+const wCodex = await mk(`fin-w-codex-${stamp}`, 'codex')
+ok('3 个 Agent 模板(omp/mock/codex)', Boolean(leadTpl && wMock && wCodex))
+const team = (await api('/api/workshop/teams', { method: 'POST', body: JSON.stringify({ name: `验收团队-${stamp}` }) }, adminTok)).body?.data
+ok('AgentTeam 创建', Boolean(team?.id))
+for (const [tpl, role] of [[leadTpl, 'lead'], [wMock, 'worker'], [wCodex, 'worker']]) {
+  const r = await api(`/api/workshop/teams/${team.id}/members`, { method: 'POST', body: JSON.stringify({ agentId: tpl.id, role }) }, adminTok)
+  ok(`成员入队 ${role}`, r.body?.code === 0)
+}
+const ch = (await api('/api/workshop/channels', { method: 'POST', body: JSON.stringify({ name: `验收频道-${stamp}` }) }, adminTok)).body?.data
+const channelId = ch?.channelId
+ok('Channel 创建', Boolean(channelId))
+const dep = (await api(`/api/workshop/teams/${team.id}/deploy`, { method: 'POST', body: JSON.stringify({ channelId }) }, adminTok)).body?.data
+ok('Team 部署到 Channel(3 实例)', dep?.agents?.length === 3, JSON.stringify(dep?.agents?.map(a => a.harness)))
+const ags = (await api(`/api/workshop/channels/${channelId}/agents`, {}, adminTok)).body?.data
+const leadInst = ags.find(a => a.harness === 'omp')
+ok('lead 实例(omp)就位', Boolean(leadInst))
+
+// 绑定:mock worker↔daq 节点,codex worker↔写控节点
+const dq1 = daq.nodes.find(n => n.lineId === line1?.id)
+const b1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: ags.find(a => a.harness === 'mock').id, nodeId: dq1.id, kind: 'daq', mode: 'auto' }) }, adminTok)
+ok('绑定 Agent↔数采节点', b1.body?.code === 0)
+const b2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: ags.find(a => a.harness === 'codex').id, nodeId: wNode.id, kind: 'dcw', mode: 'auto' }) }, adminTok)
+ok('绑定 Agent↔写控节点', b2.body?.code === 0)
+const bl = (await api('/api/workshop/agent-tools/bindings', {}, adminTok)).body?.data?.bindings ?? []
+ok(`绑定清单落盘(${bl.length} 条)`, bl.length >= 2)
+
+// 团队作业闭环:human → lead 派发 → workers 回复
+const msg = await api(`/api/workshop/channels/${channelId}/messages`, { method: 'POST', body: JSON.stringify({
+  toAgentId: leadInst.id,
+  text: '团队闭环自检:请把这句话转交每个 worker 执行——「用一句不超过 15 字的话报告你的引擎名并说 ok,不要调用任何工具」。收齐后向人类汇总。',
+  fromLabel: 'admin', priority: 'task',
+}) }, adminTok)
+ok('任务下发 lead', msg.body?.code === 0)
+console.log('等待团队闭环(lead 派发→worker 回复→lead 汇总,轮询 150s)...')
+let leadReplied = false, mockReplied = false, codexReplied = false
+let summarySeen = false
+for (let i = 0; i < 50; i++) {
+  await new Promise(r => setTimeout(r, 3000))
+  const ms = (await api(`/api/workshop/channels/${channelId}/messages?limit=60`, {}, adminTok)).body?.data ?? []
+  const timeline = (await api(`/api/workshop/channels/${channelId}/events?limit=100`, {}, adminTok)).body?.data ?? []
+  const all = []
+  for (const m of (Array.isArray(ms) ? ms : [])) {
+    all.push({ from: m.fromAgentId, to: m.toAgentId, text: (m.parts ?? []).map(p => p.text ?? '').join(' ') })
+  }
+  for (const ev of (Array.isArray(timeline) ? timeline : [])) {
+    const t = JSON.stringify(ev)
+    if (t.includes('codex') && t.includes('ok')) codexReplied = codexReplied || /引擎.*ok|ok/i.test(t)
+  }
+  for (const a of all) {
+    if (a.from === ags.find(x => x.harness === 'mock').id) mockReplied = true
+    if (a.from === ags.find(x => x.harness === 'codex').id) codexReplied = true
+    if (a.from === leadInst.id && /汇总|汇总完成|报告|ok/i.test(a.text)) leadReplied = true
+    if (/汇总/.test(a.text) && a.from === leadInst.id) summarySeen = true
+  }
+  process.stdout.write(`  t=${(i + 1) * 3}s mock=${mockReplied ? 'Y' : 'n'} codex=${codexReplied ? 'Y' : 'n'} lead汇总=${summarySeen ? 'Y' : 'n'}\r`)
+  if (mockReplied && codexReplied && summarySeen) break
+}
+console.log('')
+ok('worker(mock) 回复', mockReplied)
+ok('worker(codex) 回复', codexReplied)
+ok('lead 汇总闭环', summarySeen || leadReplied)
+
+// ===== 5. 权限回归 =====
+sec('权限(回归)')
+const ov = (await api('/api/workshop/permissions', {}, adminTok)).body?.data
+ok('权限总览(权限管理页数据源)', ov?.lines?.length > 0 && ov?.users?.length > 0, `lines=${ov?.lines?.length} users=${ov?.users?.length}`)
+const adminRow = ov.users.find(u => u.role === 'admin')
+ok(`admin 用户 channels 数(${adminRow?.channels?.length})在总览可见`, (adminRow?.channels?.length ?? 0) >= 1)
+
+console.log(`\n===== 全功能测试: ${pass} 通过 / ${fail} 失败 =====`)
+console.log('CHANNEL_ID=' + channelId)
+process.exit(fail > 0 ? 1 : 0)

package/scripts/_dbg-final-fixups.mjs

@@ -0,0 +1,62 @@
+// 最终验收·补测:产线开跑完整链路(产品→配方→start→stop)+ 团队 events 断言 + 计数器核对
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3001'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+const CHANNEL_ID = process.argv[4]
+let pass = 0, fail = 0
+const ok = (name, cond, detail = '') => { cond ? pass++ : fail++; console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`) }
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data
+const line2 = dcw.lines[1]
+ok('目标产线(第2条)', Boolean(line2), line2?.id)
+
+// 1) 产品挂产线2
+const prod = (await api('/api/workshop/dcw/products', { method: 'POST', body: JSON.stringify({ name: '验收产品', lineId: line2.id }) }, adminTok)).body?.data?.product
+ok('产品创建并挂产线', Boolean(prod?.id) && prod?.lineId === line2.id, prod?.id)
+
+// 2) 配方挂产品,参数指向该线写控节点(mock)
+const wNode = dcw.nodes.find(n => n.lineId === line2.id && n.driver === 'mock')
+ok('产线2 mock 写控节点', Boolean(wNode), wNode?.id)
+const target = Math.round(((wNode.min ?? 150) + (wNode.max ?? 200)) / 2)
+const recipe = (await api('/api/workshop/dcw/recipes', { method: 'POST', body: JSON.stringify({
+  name: '验收配方', productId: prod.id,
+  params: [{ nodeId: wNode.id, name: wNode.name, value: target, ch: wNode.templateKey }],
+}) }, adminTok)).body?.data?.recipe
+ok('配方创建(含工艺参数)', Boolean(recipe?.id), recipe?.id)
+
+// 3) 开跑(配方参数 → 真实写 PLC 闭环)
+const rStart = await api(`/api/workshop/dcw/lines/${line2.id}/start`, { method: 'POST', body: JSON.stringify({ recipeId: recipe.id }) }, adminTok)
+ok('产线开跑(配方参数下发写控)', rStart.status === 200 && rStart.body?.data?.run != null, JSON.stringify(rStart.body?.data?.run ?? rStart.body?.message).slice(0, 80))
+const activeRun = rStart.body?.data?.run?.id
+// 采样打标窗口生效验证:数采样本应携带 run 标记(tsdb/历史入口)
+await new Promise(r => setTimeout(r, 4000))
+// 4) 停止
+const rStop = await api(`/api/workshop/dcw/lines/${line2.id}/stop`, { method: 'POST', body: '{}' }, adminTok)
+ok('产线停止', rStop.status === 200)
+// 5) 批次数据视图(窗口内写历史+数采汇总)
+const rd = await api(`/api/workshop/dcw/runs/${activeRun}/data`, {}, adminTok)
+ok('批次数据视图(开跑→停止 闭环产物)', rd.status === 200 && rd.body?.data?.run?.id === activeRun, `writes=${rd.body?.data?.writes?.length} daq=${rd.body?.data?.daq?.length}`)
+
+// 6) 团队闭环 events 断言(codex 回复落 artifact/delta)
+if (CHANNEL_ID) {
+  const evs = (await api(`/api/workshop/channels/${CHANNEL_ID}/events?limit=200`, {}, adminTok)).body?.data ?? []
+  const list = Array.isArray(evs) ? evs : (evs.items ?? [])
+  const kinds = {}
+  for (const e of list) kinds[e.type ?? '?'] = (kinds[e.type ?? '?'] ?? 0) + 1
+  const codexOk = list.some(e => e.type === 'agent.delta' && /codex ok/i.test(JSON.stringify(e.delta ?? e)))
+    || list.some(e => e.type === 'a2a.artifact' && /codex ok/i.test(JSON.stringify(e)))
+  ok('worker(codex) 回复(agent.delta/a2a.artifact)', codexOk, JSON.stringify(kinds))
+  const mockOk = list.some(e => (e.type === 'a2a.message' || e.type === 'agent.delta') && /mock/i.test(JSON.stringify(e)))
+  ok('worker(mock) 回复可见', mockOk)
+}
+
+// 7) controller 计数字段核对(信息性)
+const ctrl = (await api('/api/workshop/daq', {}, adminTok)).body?.data?.controller
+console.log('controller 全量计数:', JSON.stringify(ctrl))
+
+console.log(`\n===== 补测: ${pass} 通过 / ${fail} 失败 =====`)
+process.exit(fail > 0 ? 1 : 0)

package/scripts/_dbg-final-visual.mjs

@@ -0,0 +1,29 @@
+// home 生产实例:workspace 会话页 + permissions + town 截图
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3001'
+const CHANNEL_ID = process.argv[2] ?? '8515751a-e250-4d53-9f5b-97ed8c48e7a9'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+const api = async (p, opts) => fetch(`${BASE}${p}`, { ...opts, headers: { authorization: `Bearer ${login.data.token}`, ...(opts?.headers ?? {}) } }).then(r => r.json())
+let wsId = (await api('/api/workshop/workspaces')).data?.[0]?.id
+if (!wsId) {
+  const created = await api('/api/workshop/workspaces', { method: 'POST', body: JSON.stringify({ name: '验收空间' }) })
+  wsId = created.data.id
+  await api(`/api/workshop/workspaces/${wsId}/channels/${CHANNEL_ID}`, { method: 'POST' })
+}
+await page.goto(`${BASE}/workshop/w/${wsId}`, { waitUntil: 'networkidle2', timeout: 90000 })
+await new Promise(r => setTimeout(r, 6000))
+await page.screenshot({ path: '.e2e-shots/final-workshop-channel.png' })
+console.log('📷 workshop-channel')
+await page.goto(`${BASE}/permissions`, { waitUntil: 'networkidle2', timeout: 60000 })
+await new Promise(r => setTimeout(r, 2500))
+await page.screenshot({ path: '.e2e-shots/final-permissions.png' })
+console.log('📷 permissions')
+await page.goto(`${BASE}/town`, { waitUntil: 'domcontentloaded', timeout: 60000 })
+await new Promise(r => setTimeout(r, 14000))
+await page.screenshot({ path: '.e2e-shots/final-town.png' })
+console.log('📷 town')
+await browser.close()

package/scripts/_dbg-interval-config.mjs

@@ -37,15 +37,19 @@ async function main() {
   const reg = await api('POST', '/api/users/register', { body: { email: `cfg-${Date.now().toString(36)}@test.local`, password: 'Passw0rd!123', name: `cfg-${Date.now().toString(36)}` } })
   const token = reg.data?.token
   if (!token) throw new Error('注册失败')
-  // 设置修改需 admin:读取种子凭据存档(.AgentWorkShop/data/seed-credentials.txt)
+  // 设置修改需 admin:凭据存档支持两种格式 —— 旧版「password: <pw>」(zhangwei@awshop.io)
+  // 与新版「admin@awshop.local / <pw>」(首注册自注册制);env AW_ADMIN_PW 可直接覆盖
   const fs = await import('node:fs')
   let adminToken = token
   try {
     const cred = fs.readFileSync('.AgentWorkShop/data/seed-credentials.txt', 'utf-8')
-    const pw = cred.match(/password:\s*(\S+)/)?.[1]
-    const lg = await api('POST', '/api/users/login', { body: { email: 'zhangwei@awshop.io', password: pw } })
+    const legacyPw = cred.match(/password:\s*(\S+)/)?.[1]
+    const newFmt = cred.match(/admin@awshop\.local\s*\/\s*(\S+)/)
+    const email = legacyPw && !newFmt ? 'zhangwei@awshop.io' : 'admin@awshop.local'
+    const pw = process.env.AW_ADMIN_PW ?? (legacyPw && !newFmt ? legacyPw : newFmt?.[1])
+    const lg = await api('POST', '/api/users/login', { body: { email, password: pw } })
     adminToken = lg.data?.token ?? token
-    console.log(`  [setup] admin 登录: ${lg.data?.token ? 'ok' : '失败(回退 user token)'}`)
+    console.log(`  [setup] admin 登录(${email}): ${lg.data?.token ? 'ok' : '失败(回退 user token)'}`)
   }
   catch {
     console.log('  [setup] 无种子凭据存档,回退 user token')
@@ -92,8 +96,15 @@ async function main() {
   check('C4.2', 'samples 传 500 → 钳到 minBucketMs=800', q2.data?.bucketMs === 800, `bucketMs=${q2.data?.bucketMs}`)
   const lq = await api('GET', `/api/workshop/dcw/line/query?lineId=${line.id}`, { token })
   const lpts = lq.data?.channels?.[0]?.points ?? []
-  const gaps = lpts.slice(1).map((p, i) => p.at - lpts[i].at)
-  check('C4.3', '产线查询桶距 ≈3000ms(3000±400)', gaps.length > 0 && gaps.every(g => Math.abs(g - 3000) <= 400), `gaps=${gaps.slice(0, 4).join(',')}`)
+  // 桶宽生效的数学证据:同一 time_bucket 调用产出的桶必然落在同一网格,
+  // 任意两点差 = 桶宽整数倍(±2ms 浮点尾差);跨网格点会破坏该性质
+  const B = 3000
+  let mult = true
+  for (let i = 1; i < lpts.length && mult; i++) {
+    const d = lpts[i].at - lpts[0].at
+    if (Math.abs(d / B - Math.round(d / B)) * B > 2) mult = false
+  }
+  check('C4.3', `产线查询桶间距均为 ${B}ms 整数倍(同网格)`, lpts.length > 1 && mult, `pts=${lpts.length} firstDiff=${lpts.length > 1 ? (lpts[1].at - lpts[0].at).toFixed(1) : '-'}`)
 
   // ── C5 CLI 同源(直接写 runtime-settings.json + reload API 模拟 aw config set 的收敛点) ──
   const rl = await api('POST', '/api/system/settings/reload', { body: {}, token })

package/scripts/_dbg-perms-e2e.mjs

@@ -0,0 +1,102 @@
+// ============================================================
+// 产线权限 E2E:_dbg-perms-e2e.mjs <base> <adminPass>
+// 链路:admin 总览 → 建 plain 用户 → 默认全无权 → admin 授
+// 产线1=readonly / 产线2=operate → 可见性/写控/绑定逐项断言。
+// ============================================================
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let step = 0
+const ok = (name, cond, detail = '') => {
+  step++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!cond) process.exitCode = 1
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = async (email, password) => (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email, password }) })).body?.data?.token
+
+// ---- admin 登录 + 总览 ----
+const adminTok = await login('admin@awshop.local', ADMIN_PASS)
+ok('admin 登录', Boolean(adminTok))
+const ov = await api('/api/workshop/permissions', {}, adminTok)
+ok('admin 权限总览(lines+users)', ov.status === 200 && ov.body?.data?.lines?.length > 0 && ov.body?.data?.users?.length > 0, `lines=${ov.body?.data?.lines?.length} users=${ov.body?.data?.users?.length}`)
+const LINE1 = ov.body.data.lines.find(l => l.name.includes('1号'))?.id
+const LINE2 = ov.body.data.lines.find(l => l.name.includes('2号'))?.id
+ok('找到 1号/2号产线', Boolean(LINE1 && LINE2), `${LINE1} / ${LINE2}`)
+
+// ---- plain 用户(注册即 user 角色) ----
+const stamp = Date.now().toString(36)
+const plain = { name: `p-${stamp}`, email: `p-${stamp}@awshop.local`, password: 'Plain2026' }
+const reg = await api('/api/users/register', { method: 'POST', body: JSON.stringify(plain) })
+const plainTok = reg.body?.data?.token
+ok('plain 用户注册(user 角色)', reg.body?.data?.user?.role === 'user')
+
+// ---- 授权前:全无权 ----
+const d0 = await api('/api/workshop/dcw', {}, plainTok)
+const q0 = await api('/api/workshop/daq', {}, plainTok)
+ok('默认 dcw 产线不可见', d0.body?.data?.lines?.length === 0, `lines=${d0.body?.data?.lines?.length}`)
+ok('默认 dcw 节点不可见', d0.body?.data?.nodes?.length === 0, `nodes=${d0.body?.data?.nodes?.length}`)
+ok('默认 daq 节点不可见', q0.body?.data?.nodes?.length === 0, `nodes=${q0.body?.data?.nodes?.length}`)
+
+// ---- admin 授权:产线1=readonly, 产线2=operate ----
+const ov2 = await api('/api/workshop/permissions', {}, adminTok)
+const plainId = ov2.body.data.users.find(u => u.email === plain.email)?.id
+ok('总览含 plain 用户及其空 channels', Boolean(plainId))
+const put = await api('/api/workshop/permissions', { method: 'PUT', body: JSON.stringify({ userId: plainId, grants: [{ lineId: LINE1, mode: 'readonly' }, { lineId: LINE2, mode: 'operate' }] }) }, adminTok)
+ok('admin 批量授权(readonly+operate)', put.body?.data?.grants?.length === 2, JSON.stringify(put.body?.data?.grants?.map(g => `${g.lineId.slice(0, 6)}:${g.mode}`)))
+
+// ---- 授权后:仅授权产线可见 ----
+const d1 = await api('/api/workshop/dcw', {}, plainTok)
+const q1 = await api('/api/workshop/daq', {}, plainTok)
+const visLines = (d1.body?.data?.lines ?? []).map(l => l.id)
+ok('dcw 仅见 2 条授权产线', visLines.length === 2 && visLines.includes(LINE1) && visLines.includes(LINE2), visLines.join(','))
+ok('daq 仅含授权产线节点', (q1.body?.data?.nodes ?? []).length > 0 && (q1.body?.data?.nodes ?? []).every(n => [LINE1, LINE2].includes(n.lineId)), `nodes=${q1.body?.data?.nodes?.length}`)
+
+// 找两线的写控节点
+const dcwNodes = d1.body.data.nodes
+const w1 = dcwNodes.find(n => n.lineId === LINE1)
+const w2 = dcwNodes.find(n => n.lineId === LINE2) ?? dcwNodes.find(n => n.lineId === LINE2)
+ok('两线均有可见写控节点', Boolean(w1 && w2), `${w1?.id} / ${w2?.id}`)
+
+// ---- 写控校验 ----
+const wr1 = await api(`/api/workshop/dcw/${w1.id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+ok('readonly 产线写控被拒(403 人话)', wr1.status === 403 && /仅查看/.test(wr1.body?.message ?? ''), wr1.body?.message)
+const wr2 = await api(`/api/workshop/dcw/${w2.id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+ok('operate 产线写控放行', wr2.status === 200 && wr2.body?.data?.outcome != null, `ack=${JSON.stringify(wr2.body?.data?.outcome)?.slice(0, 60)}`)
+
+// ---- 绑定校验(daq 需 readonly+,dcw 需 operate) ----
+const daqNodes = q1.body.data.nodes
+const dq1 = daqNodes.find(n => n.lineId === LINE1)
+const bindD = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: dq1.id, kind: 'daq' }) }, plainTok)
+ok('绑定 daq 节点(readonly 线)放行', bindD.status === 200, JSON.stringify(bindD.body?.message ?? ''))
+const bindW1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w1.id, kind: 'dcw' }) }, plainTok)
+ok('绑定 dcw 节点(readonly 线)被拒', bindW1.status === 403, bindW1.body?.message)
+const bindW2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w2.id, kind: 'dcw' }) }, plainTok)
+ok('绑定 dcw 节点(operate 线)放行', bindW2.status === 200)
+
+// ---- 越权访问无权产线节点(直接按 id 打,数据面不因列表隐藏而放行) ----
+const other = ov.body.data.lines.find(l => l.id !== LINE1 && l.id !== LINE2)
+if (other) {
+  const otherNodes = (await api('/api/workshop/dcw', {}, adminTok)).body.data.nodes.filter(n => n.lineId === other.id)
+  if (otherNodes.length) {
+    const wOther = await api(`/api/workshop/dcw/${otherNodes[0].id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+    ok('直接写无权产线节点被拒(403)', wOther.status === 403, wOther.body?.message)
+  }
+}
+
+// ---- 撤销产线1 → 立即不可见 ----
+const revoke = await api('/api/workshop/permissions', { method: 'PUT', body: JSON.stringify({ userId: plainId, grants: [{ lineId: LINE1, mode: null }] }) }, adminTok)
+ok('撤销产线1授权', revoke.status === 200 && revoke.body.data.grants.length === 1)
+const d2 = await api('/api/workshop/dcw', {}, plainTok)
+ok('撤销后产线1不可见', !(d2.body?.data?.lines ?? []).some(l => l.id === LINE1), `lines=${(d2.body?.data?.lines ?? []).map(l => l.id.slice(0, 6))}`)
+
+// ---- 非 admin 不能用管理面 ----
+const forbidden = await api('/api/workshop/permissions', {}, plainTok)
+ok('plain 访问权限管理面被拒(403)', forbidden.status === 403)
+
+console.log(`\n===== permissions E2E: ${step} 项 =====`)

package/scripts/_dbg-perms-visual.mjs

@@ -0,0 +1,36 @@
+// 权限页浏览器目视:admin 管理矩阵 + plain 用户受限视图
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3021'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+
+const loginTok = async (email, password) => (await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email, password }) }).then(r => r.json())).data?.token
+
+const shoot = async (path, name, token, wait = 3500) => {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.setCookie({ name: 'token', value: token, domain: '127.0.0.1', path: '/' })
+  await page.goto(`${BASE}${path}`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await new Promise(r => setTimeout(r, wait))
+  await page.screenshot({ path: `.e2e-shots/perm-${name}.png` })
+  console.log(`📷 perm-${name}`)
+  await page.close()
+}
+
+// 1) admin:权限管理页
+const adminTok = await loginTok('admin@awshop.local', 'admin123')
+await shoot('/permissions', 'admin-page', adminTok)
+
+// 2) plain 用户(产线2=operate 授权还在):侧栏无权限管理入口 + /dcw 仅见授权产线
+// 取 E2E 里那个 plain(重新注册一个新的拿授权?简化:直接注册 per-shot 用户并经 API 给产线2 operate)
+const ov = await fetch(`${BASE}/api/workshop/permissions`, { headers: { authorization: `Bearer ${adminTok}` } }).then(r => r.json())
+const stamp = Date.now().toString(36)
+const pu = { name: `v-${stamp}`, email: `v-${stamp}@awshop.local`, password: 'Plain2026' }
+const reg = await fetch(`${BASE}/api/users/register`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(pu) }).then(r => r.json())
+const plainTok = reg.data.token
+const uid = (await fetch(`${BASE}/api/workshop/permissions`, { headers: { authorization: `Bearer ${plainTok}` } }).then(r => r.json())).status // 403 expected
+console.log('plain 拉管理面:', uid === 403 ? '403 ✔' : `异常 ${uid}`)
+const pid = ov.data.users.find(u => u.email === pu.email)?.id
+await fetch(`${BASE}/api/workshop/permissions`, { method: 'PUT', headers: { authorization: `Bearer ${adminTok}`, 'content-type': 'application/json' }, body: JSON.stringify({ userId: pid, grants: [{ lineId: ov.data.lines.find(l => l.name.includes('2号')).id, mode: 'operate' }] }) })
+await shoot('/dcw', 'plain-dcw', plainTok)
+await shoot('/daq', 'plain-daq', plainTok)
+await browser.close()