agentworkshop 0.7.8 → 0.7.11

package/sdk/hooks.mjs

@@ -1,103 +1,105 @@
-// ============================================================
-// AgentWorkShop SDK — HookBus（插件生命周期钩子总线）
-// ------------------------------------------------------------
-// 设计:
-//   · 异步串行触发(监听器按注册序 await,可返回值形成 waterfall)
-//   · 错误隔离:单监听器抛错不影响其他监听器,错误经 onError 上报
-//   · 支持通配符 '*'(接收 { type, payload })
-//   · 连续失败自动摘除(熔断):同一监听器连续失败超阈值自动停用,
-//     防止病态插件拖垮事件桥
-// ============================================================
-
-const FAILLIMIT = 8
-
-export class HookBus {
-  constructor({ name = 'hooks', onError } = {}) {
-    this.name = name
-    this.onError = onError ?? (() => {})
-    /** type → Array<{ fn, fails }> */
-    this.listeners = new Map()
-    this.count = 0
-  }
-
-  /** 注册监听器;type='*' 接收全部事件({type,payload})。返回解绑函数 */
-  on(type, fn) {
-    if (typeof type !== 'string' || typeof fn !== 'function') return () => {}
-    const list = this.listeners.get(type) ?? []
-    list.push({ fn, fails: 0 })
-    this.listeners.set(type, list)
-    this.count++
-    return () => this.off(type, fn)
-  }
-
-  /** 一次性监听(触发后自动解绑) */
-  once(type, fn) {
-    const off = this.on(type, async (arg) => {
-      off()
-      return fn(arg)
-    })
-    return off
-  }
-
-  off(type, fn) {
-    const list = this.listeners.get(type)
-    if (!list) return
-    const idx = list.findIndex(l => l.fn === fn)
-    if (idx >= 0) {
-      list.splice(idx, 1)
-      this.count--
-    }
-    if (!list.length) this.listeners.delete(type)
-  }
-
-  /**
-   * 触发事件:同名监听器按注册序串行 await;返回最后一个非 undefined 返回值。
-   * emit 永不抛错——监听器错误被隔离并计数,连续超限自动摘除(熔断)。
-   */
-  async emit(type, payload) {
-    const same = this.listeners.get(type)
-    const wild = this.listeners.get('*')
-    let result
-    if (same) {
-      for (const l of [...same]) {
-        const r = await this.#invoke(type, l, payload)
-        if (r !== undefined) result = r
-      }
-    }
-    if (wild) {
-      for (const l of [...wild]) {
-        await this.#invoke('*', l, { type, payload })
-      }
-    }
-    return result
-  }
-
-  async #invoke(type, l, payload) {
-    try {
-      return await l.fn(payload)
-    }
-    catch (err) {
-      l.fails++
-      try {
-        this.onError(err, { bus: this.name, type, fails: l.fails })
-      }
-      catch { /* 上报器自身错误忽略 */ }
-      if (l.fails >= FAILLIMIT) {
-        const list = this.listeners.get(type)
-        const idx = list?.indexOf(l) ?? -1
-        if (idx >= 0) {
-          list.splice(idx, 1)
-          this.count--
-        }
-      }
-      return undefined
-    }
-  }
-
-  /** 已注册监听器总数(诊断用) */
-  get size() {
-    return this.count
-  }
-}
-
-export default HookBus
+// ============================================================
+// AgentWorkShop SDK — HookBus（插件生命周期钩子总线）
+// ------------------------------------------------------------
+// 设计:
+//   · 异步串行触发(监听器按注册序 await,可返回值形成 waterfall)
+//   · 错误隔离:单监听器抛错不影响其他监听器,错误经 onError 上报
+//   · 支持通配符 '*'(接收 { type, payload })
+//   · 连续失败自动摘除(熔断):同一监听器连续失败超阈值自动停用,
+//     防止病态插件拖垮事件桥
+// ============================================================
+
+const FAILLIMIT = 8
+
+export class HookBus {
+  constructor({ name = 'hooks', onError } = {}) {
+    this.name = name
+    this.onError = onError ?? (() => {})
+    /** type → Array<{ fn, fails }> */
+    this.listeners = new Map()
+    this.count = 0
+  }
+
+  /** 注册监听器;type='*' 接收全部事件({type,payload})。返回解绑函数 */
+  on(type, fn) {
+    if (typeof type !== 'string' || typeof fn !== 'function') return () => {}
+    const list = this.listeners.get(type) ?? []
+    list.push({ fn, fails: 0 })
+    this.listeners.set(type, list)
+    this.count++
+    return () => this.off(type, fn)
+  }
+
+  /** 一次性监听(触发后自动解绑) */
+  once(type, fn) {
+    const off = this.on(type, async (arg) => {
+      off()
+      return fn(arg)
+    })
+    return off
+  }
+
+  off(type, fn) {
+    const list = this.listeners.get(type)
+    if (!list) return
+    const idx = list.findIndex(l => l.fn === fn)
+    if (idx >= 0) {
+      list.splice(idx, 1)
+      this.count--
+    }
+    if (!list.length) this.listeners.delete(type)
+  }
+
+  /**
+   * 触发事件:同名监听器按注册序串行 await;返回最后一个非 undefined 返回值。
+   * emit 永不抛错——监听器错误被隔离并计数,连续超限自动摘除(熔断)。
+   */
+  async emit(type, payload) {
+    const same = this.listeners.get(type)
+    const wild = this.listeners.get('*')
+    let result
+    if (same) {
+      for (const l of [...same]) {
+        const r = await this.#invoke(type, l, payload)
+        if (r !== undefined) result = r
+      }
+    }
+    if (wild) {
+      for (const l of [...wild]) {
+        await this.#invoke('*', l, { type, payload })
+      }
+    }
+    return result
+  }
+
+  async #invoke(type, l, payload) {
+    try {
+      const r = await l.fn(payload)
+      l.fails = 0 // 仅"连续失败"触发熔断:成功即清零,偶发失败不累积驱逐
+      return r
+    }
+    catch (err) {
+      l.fails++
+      try {
+        this.onError(err, { bus: this.name, type, fails: l.fails })
+      }
+      catch { /* 上报器自身错误忽略 */ }
+      if (l.fails >= FAILLIMIT) {
+        const list = this.listeners.get(type)
+        const idx = list?.indexOf(l) ?? -1
+        if (idx >= 0) {
+          list.splice(idx, 1)
+          this.count--
+        }
+      }
+      return undefined
+    }
+  }
+
+  /** 已注册监听器总数(诊断用) */
+  get size() {
+    return this.count
+  }
+}
+
+export default HookBus

package/sdk/index.d.mts

@@ -1,135 +1,142 @@
-// AgentWorkShop SDK 类型声明(agentworkshop/sdk)
-import type { HookBus } from './hooks.mjs'
-
-export declare const SDK_VERSION: string
-
-/** 生命周期钩子总线:异步串行、错误隔离、'*' 通配、连续失败自动熔断 */
-export declare class HookBus {
-  constructor(opts?: { name?: string, onError?: (err: Error, meta?: { bus?: string, type?: string, fails?: number }) => void })
-  on(type: string, fn: (payload: any) => any): () => void
-  once(type: string, fn: (payload: any) => any): () => void
-  off(type: string, fn: (payload: any) => any): void
-  emit(type: string, payload?: any): Promise<any>
-  readonly size: number
-}
-
-export interface PluginLogger {
-  debug(...args: unknown[]): void
-  info(...args: unknown[]): void
-  warn(...args: unknown[]): void
-  error(...args: unknown[]): void
-}
-
-export interface PluginKv {
-  get(key: string): any
-  set(key: string, value: any): any
-  all(): Record<string, any>
-  bump(key: string, by?: number): number
-}
-
-export interface PluginHttp {
-  get(url: string, opts?: { timeoutMs?: number, headers?: Record<string, string> }): Promise<Response>
-  post(url: string, body?: unknown, opts?: { timeoutMs?: number, headers?: Record<string, string> }): Promise<Response>
-}
-
-/** 平台 REST 客户端(SDK 作为项目服务 client 的门面) */
-export interface PlatformClient {
-  call<T = any>(method: string, path: string, body?: unknown): Promise<T>
-  get<T = any>(path: string, query?: Record<string, unknown>): Promise<T>
-  post<T = any>(path: string, body?: unknown): Promise<T>
-  patch<T = any>(path: string, body?: unknown): Promise<T>
-  delete<T = any>(path: string): Promise<T>
-  setToken(token: string | null): PlatformClient
-  ping(): Promise<any>
-  users: { list(q?: any): Promise<any>, get(id: string): Promise<any>, create(b: any): Promise<any>, login(email: string, password: string): Promise<any>, me(): Promise<any> }
-  lines: { list(q?: any): Promise<any>, get(id: string): Promise<any>, create(b: any): Promise<any>, update(id: string, p: any): Promise<any>, remove(id: string): Promise<any>, start(id: string, recipeId?: string): Promise<any>, stop(id: string): Promise<any> }
-  products: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
-  recipes: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
-  dcwNodes: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
-  daqNodes: { list(q?: any): Promise<any>, create(b: any): Promise<any>, alarms(): Promise<any> }
-  templates: { daq(): Promise<any[]>, dcw(): Promise<any[]> }
-  twins: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
-  teams: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
-  agents: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
-  channels: { list(q?: any): Promise<any> }
-  plugins: { manifest(): Promise<any> }
-}
-
-export interface PluginContext {
-  name: string
-  scope: 'project' | 'user'
-  dir: string
-  sdkVersion: string
-  hooks: HookBus
-  logger: PluginLogger
-  config: {
-    get(key: string): any
-    all(): Record<string, any>
-    onChange(fn: (payload?: { at: string }) => any): () => void
-  }
-  paths: { home: string, configRoot: string, dataDir: string }
-  dataDir: string
-  kv: PluginKv
-  timer: {
-    setInterval(fn: (...args: any[]) => void, ms: number, ...rest: any[]): NodeJS.Timeout
-    setTimeout(fn: (...args: any[]) => void, ms: number, ...rest: any[]): NodeJS.Timeout
-  }
-  onDispose(fn: () => any): () => void
-  subscriptions: { add(d: { dispose(): any } | (() => any)): any }
-  route(method: string, path: string, handler: (event: any) => any): boolean
-  api: PlatformClient
-  http: PluginHttp
-  events: { on(type: string, fn: (payload: any) => any): () => void, off(type: string, fn: (payload: any) => any): void }
-}
-
-export interface PluginRouteDef {
-  method?: string
-  path: string
-  handler: (event: any) => any
-}
-
-export interface PluginDef {
-  name: string
-  version?: string
-  description?: string
-  setup?(ctx: PluginContext): void | Promise<void>
-  client?: string
-  routes?: PluginRouteDef[]
-}
-
-/** 显式糖:类型化定义插件(宿主同样接受裸对象导出) */
-export declare function definePlugin(def: PluginDef): PluginDef
-
-export declare function createPluginContext(opts: Record<string, any>): PluginContext
-export declare function createRouteTable(): {
-  register(name: string, method: string, path: string, handler: (event: any) => any): boolean
-  resolve(name: string, method: string, path: string): ((event: any) => any) | null
-  byPlugin(name: string): Array<{ method: string, path: string }>
-  readonly size: number
-}
-export declare function validatePluginModule(mod: any, source: string): { ok: boolean, def?: PluginDef, error?: string }
-export declare function pluginKvExists(dataDir: string, name: string): boolean
-
-export declare function createPlatformClient(opts?: { baseUrl?: string, token?: string, logger?: PluginLogger, timeoutMs?: number }): PlatformClient
-
-export declare const LIFECYCLE_EVENTS: readonly ['plugin:host:init', 'config:changed', 'event:*', 'daq:sample', 'dcw:write', 'line:start', 'line:stop', 'server:close']
-export declare const CLIENT_EVENTS: readonly ['client:init', 'event:*', 'page:change', 'client:destroy']
-
-/** 客户端插件上下文(sdk/client.mjs) */
-export declare const CLIENT_SDK_VERSION: string
-export interface ClientContext {
-  name: string
-  sdkVersion: string
-  hooks: HookBus
-  on(type: string, fn: (payload: any) => any): () => void
-  fetch<T = any>(path: string, opt?: { method?: string, body?: unknown, headers?: Record<string, string> }): Promise<T>
-  el(tag: string, attrs?: Record<string, unknown>, children?: Array<Node | string>): HTMLElement
-  mount(target: string | Element, node: Node): Node
-  root(): HTMLElement
-  log: PluginLogger
-  dispose(): void
-}
-export declare function createClientContext(opts: { name: string, eventBridge?: (fn: (type: string, payload: any) => void) => (() => void), baseUrl?: string }): ClientContext
-
-declare const _default: Record<string, unknown>
-export default _default
+// AgentWorkShop SDK 类型声明(agentworkshop/sdk)
+import type { HookBus } from './hooks.mjs'
+
+export declare const SDK_VERSION: string
+
+/** 生命周期钩子总线:异步串行、错误隔离、'*' 通配、连续失败自动熔断 */
+export declare class HookBus {
+  constructor(opts?: { name?: string, onError?: (err: Error, meta?: { bus?: string, type?: string, fails?: number }) => void })
+  on(type: string, fn: (payload: any) => any): () => void
+  once(type: string, fn: (payload: any) => any): () => void
+  off(type: string, fn: (payload: any) => any): void
+  emit(type: string, payload?: any): Promise<any>
+  readonly size: number
+}
+
+export interface PluginLogger {
+  debug(...args: unknown[]): void
+  info(...args: unknown[]): void
+  warn(...args: unknown[]): void
+  error(...args: unknown[]): void
+}
+
+export interface PluginKv {
+  get(key: string): any
+  set(key: string, value: any): any
+  all(): Record<string, any>
+  bump(key: string, by?: number): number
+}
+
+export interface PluginHttp {
+  get(url: string, opts?: { timeoutMs?: number, headers?: Record<string, string> }): Promise<Response>
+  post(url: string, body?: unknown, opts?: { timeoutMs?: number, headers?: Record<string, string> }): Promise<Response>
+}
+
+/** 平台 REST 客户端(SDK 作为项目服务 client 的门面) */
+export interface PlatformClient {
+  call<T = any>(method: string, path: string, body?: unknown): Promise<T>
+  get<T = any>(path: string, query?: Record<string, unknown>): Promise<T>
+  post<T = any>(path: string, body?: unknown): Promise<T>
+  patch<T = any>(path: string, body?: unknown): Promise<T>
+  delete<T = any>(path: string): Promise<T>
+  setToken(token: string | null): PlatformClient
+  ping(): Promise<any>
+  users: { list(q?: any): Promise<any>, get(id: string): Promise<any>, create(b: any): Promise<any>, login(email: string, password: string): Promise<any>, me(): Promise<any> }
+  lines: { list(q?: any): Promise<any>, get(id: string): Promise<any>, create(b: any): Promise<any>, update(id: string, p: any): Promise<any>, remove(id: string): Promise<any>, start(id: string, recipeId?: string): Promise<any>, stop(id: string): Promise<any> }
+  products: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
+  recipes: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
+  dcwNodes: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
+  daqNodes: { list(q?: any): Promise<any>, create(b: any): Promise<any>, alarms(): Promise<any> }
+  templates: { daq(): Promise<any[]>, dcw(): Promise<any[]> }
+  twins: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
+  teams: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
+  agents: { list(q?: any): Promise<any>, create(b: any): Promise<any> }
+  channels: { list(q?: any): Promise<any> }
+  plugins: { manifest(): Promise<any> }
+}
+
+export interface PluginContext {
+  name: string
+  scope: 'project' | 'user'
+  dir: string
+  sdkVersion: string
+  hooks: HookBus
+  logger: PluginLogger
+  config: {
+    get(key: string): any
+    all(): Record<string, any>
+    onChange(fn: (payload?: { at: string }) => any): () => void
+  }
+  paths: { home: string, configRoot: string, dataDir: string }
+  dataDir: string
+  kv: PluginKv
+  timer: {
+    setInterval(fn: (...args: any[]) => void, ms: number, ...rest: any[]): NodeJS.Timeout
+    setTimeout(fn: (...args: any[]) => void, ms: number, ...rest: any[]): NodeJS.Timeout
+  }
+  onDispose(fn: () => any): () => void
+  subscriptions: { add(d: { dispose(): any } | (() => any)): any }
+  route(method: string, path: string, handler: (event: any) => any): boolean
+  /** 产线权限拓展面(用户 × 产线三态授权: none / readonly / operate) */
+  permissions: {
+    lineMode(user: { id: string, role: string }, lineId: string | null | undefined): 'none' | 'readonly' | 'operate'
+    visibleLineIds(user: { id: string, role: string }): Set<string> | null
+    listGrants(userId: string): Array<{ lineId: string, mode: string, grantedBy: string | null, grantedAt: string }>
+    setGrants(userId: string, grants: Array<{ lineId: string, mode: 'readonly' | 'operate' | null }>, grantedBy?: string): Array<{ lineId: string, mode: string }>
+  }
+  api: PlatformClient
+  http: PluginHttp
+  events: { on(type: string, fn: (payload: any) => any): () => void, off(type: string, fn: (payload: any) => any): void }
+}
+
+export interface PluginRouteDef {
+  method?: string
+  path: string
+  handler: (event: any) => any
+}
+
+export interface PluginDef {
+  name: string
+  version?: string
+  description?: string
+  setup?(ctx: PluginContext): void | Promise<void>
+  client?: string
+  routes?: PluginRouteDef[]
+}
+
+/** 显式糖:类型化定义插件(宿主同样接受裸对象导出) */
+export declare function definePlugin(def: PluginDef): PluginDef
+
+export declare function createPluginContext(opts: Record<string, any>): PluginContext
+export declare function createRouteTable(): {
+  register(name: string, method: string, path: string, handler: (event: any) => any): boolean
+  resolve(name: string, method: string, path: string): ((event: any) => any) | null
+  byPlugin(name: string): Array<{ method: string, path: string }>
+  readonly size: number
+}
+export declare function validatePluginModule(mod: any, source: string): { ok: boolean, def?: PluginDef, error?: string }
+export declare function pluginKvExists(dataDir: string, name: string): boolean
+
+export declare function createPlatformClient(opts?: { baseUrl?: string, token?: string, logger?: PluginLogger, timeoutMs?: number }): PlatformClient
+
+export declare const LIFECYCLE_EVENTS: readonly ['plugin:host:init', 'config:changed', 'event:*', 'daq:sample', 'dcw:write', 'line:start', 'line:stop', 'server:close']
+export declare const CLIENT_EVENTS: readonly ['client:init', 'event:*', 'page:change', 'client:destroy']
+
+/** 客户端插件上下文(sdk/client.mjs) */
+export declare const CLIENT_SDK_VERSION: string
+export interface ClientContext {
+  name: string
+  sdkVersion: string
+  hooks: HookBus
+  on(type: string, fn: (payload: any) => any): () => void
+  fetch<T = any>(path: string, opt?: { method?: string, body?: unknown, headers?: Record<string, string> }): Promise<T>
+  el(tag: string, attrs?: Record<string, unknown>, children?: Array<Node | string>): HTMLElement
+  mount(target: string | Element, node: Node): Node
+  root(): HTMLElement
+  log: PluginLogger
+  dispose(): void
+}
+export declare function createClientContext(opts: { name: string, eventBridge?: (fn: (type: string, payload: any) => void) => (() => void), baseUrl?: string }): ClientContext
+
+declare const _default: Record<string, unknown>
+export default _default

package/sdk/lifecycle.mjs

@@ -1,25 +1,26 @@
-// ============================================================
-// AgentWorkShop SDK — 生命周期事件清单(宿主触发;单一事实源)
-// ============================================================
-
-/** 服务端生命周期事件清单(宿主触发;文档见 docs/plugins.md) */
-export const LIFECYCLE_EVENTS = Object.freeze([
-  'plugin:host:init',
-  'config:changed',
-  'event:*',
-  'daq:sample',
-  'dcw:write',
-  'line:start',
-  'line:stop',
-  'server:close',
-])
-
-/** 客户端生命周期事件清单 */
-export const CLIENT_EVENTS = Object.freeze([
-  'client:init',
-  'event:*',
-  'page:change',
-  'client:destroy',
-])
-
-export default { LIFECYCLE_EVENTS, CLIENT_EVENTS }
+// ============================================================
+// AgentWorkShop SDK — 生命周期事件清单(宿主触发;单一事实源)
+// ============================================================
+
+/** 服务端生命周期事件清单(宿主触发;文档见 docs/plugins.md) */
+export const LIFECYCLE_EVENTS = Object.freeze([
+  'plugin:host:init',
+  'config:changed',
+  'permissions:changed',
+  'event:*',
+  'daq:sample',
+  'dcw:write',
+  'line:start',
+  'line:stop',
+  'server:close',
+])
+
+/** 客户端生命周期事件清单 */
+export const CLIENT_EVENTS = Object.freeze([
+  'client:init',
+  'event:*',
+  'page:change',
+  'client:destroy',
+])
+
+export default { LIFECYCLE_EVENTS, CLIENT_EVENTS }

package/server/api/workshop/agent-tools/bindings/index.post.ts

@@ -1,20 +1,40 @@
-/**
- * POST /api/workshop/agent-tools/bindings —— 绑定 Agent ↔ 工业节点。
- * body: { agentId, nodeId, kind: 'dcw'|'daq', mode: 'auto'|'manual' }
- */
-import { readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getAgentNodeBindingRepo } from '@/server/services/workshop/agents/node-bindings.repo'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  const body = await readBody<{ agentId?: string, nodeId?: string, kind?: 'dcw' | 'daq', mode?: 'auto' | 'manual' }>(event) ?? {}
-  const binding = getAgentNodeBindingRepo().bind(
-    String(body.agentId ?? ''),
-    String(body.nodeId ?? ''),
-    body.kind ?? 'dcw',
-    body.mode ?? 'auto',
-  )
-  return { binding }
-})
+/**
+ * POST /api/workshop/agent-tools/bindings —— 绑定 Agent ↔ 工业节点。
+ * body: { agentId, nodeId, kind: 'dcw'|'daq', mode: 'auto'|'manual' }
+ * 产线权限:普通用户仅可绑定自己有权产线的节点——daq 绑定需「仅查看」及以上,
+ * dcw(写控)绑定需「可操控」;admin/editor 不受限。
+ */
+import { readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getAgentNodeBindingRepo } from '@/server/services/workshop/agents/node-bindings.repo'
+import { lineMode } from '@/server/services/workshop/permissions'
+import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
+import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const body = await readBody<{ agentId?: string, nodeId?: string, kind?: 'dcw' | 'daq', mode?: 'auto' | 'manual' }>(event) ?? {}
+  const kind = body.kind ?? 'dcw'
+  const nodeId = String(body.nodeId ?? '')
+  // 绑定前置:节点必须存在,且用户对其所属产线有足额权限
+  const lineId = kind === 'daq'
+    ? getDaqController().byId(nodeId)?.lineId
+    : getDcwController().byId(nodeId)?.lineId
+  if (!lineId) {
+    throw new AppError(404, ErrorCodes.NOT_FOUND, `${kind === 'daq' ? '数采' : '写控'}节点不存在: ${nodeId}`)
+  }
+  const mode = lineMode(user, lineId)
+  const needOperate = kind === 'dcw'
+  if (mode === 'none' || (needOperate && mode !== 'operate')) {
+    throw new AppError(403, 'LINE_FORBIDDEN', `无该产线权限:绑定${kind === 'daq' ? '数采' : '写控'}节点需对产线「${lineId}」拥有${needOperate ? '可操控' : '仅查看'}及以上权限`)
+  }
+  const binding = getAgentNodeBindingRepo().bind(
+    String(body.agentId ?? ''),
+    nodeId,
+    kind,
+    body.mode ?? 'auto',
+  )
+  return { binding }
+})

package/server/api/workshop/daq/[id]/bind.post.ts

@@ -4,15 +4,18 @@
  */
 import { getRouterParam, readBody } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { defineApiHandler } from '@/server/utils/response'
-import { bindDaqHost } from '@/server/services/workshop/daq/host-bindings'
+import { bindDaqHost } from '@/server/services/workshop/daq/host-bindings'
 import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
 import { broadcastSceneEvent } from '../../../../services/workshop/scene-events'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   bindDaqHost(broadcastSceneEvent)
   const id = getRouterParam(event, 'id') ?? ''
+  // 产线权限:数采设备绑定=操控能力(绑定后通道值回写设备)
+  requireLineMode(user, getDaqController().byId(id)?.lineId, 'operate')
   const body = await readBody<{ deviceId?: string | null }>(event) ?? {}
   const node = getDaqController().bind(id, body.deviceId ?? null)
   return { node: node.toView() }

package/server/api/workshop/daq/[id]/frames/content.get.ts

@@ -7,11 +7,14 @@
  */
 import { createError, defineEventHandler, getQuery, getRouterParam, setResponseHeader } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
 import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
 
 export default defineEventHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const id = getRouterParam(event, 'id') ?? ''
+  // 产线权限:帧内容需「仅查看」及以上
+  requireLineMode(user, getDaqController().byId(id)?.lineId, 'readonly')
   const q = getQuery(event)
   const ts = Number(q.ts)
   if (!Number.isFinite(ts) || ts <= 0) {