agentworkshop 0.7.9 → 0.7.11

package/app/pages/permissions/index.vue

@@ -0,0 +1,327 @@
+<script setup lang="ts">
+/**
+ * 权限管理(admin 专属)—— 用户 × 产线授权矩阵。
+ * 三态:无权(none,后端不返回该产线数据)/ 仅查看(readonly,数采只读)/ 可操控(operate,数采+数控全量)。
+ * 用户详情抽屉含:基本信息、该用户创建的 Channel、产线授权矩阵(逐线三态选择,批量保存)。
+ */
+import { computed, onMounted, reactive, ref } from 'vue'
+import { message } from 'ant-design-vue'
+import { useUserStore } from '~/stores/workshop/user'
+
+const { t } = useI18n()
+const userStore = useUserStore()
+
+interface LineView { id: string, name: string }
+interface GrantRow { lineId: string, mode: string, grantedBy: string | null, grantedAt: string }
+interface UserRow {
+  id: string
+  name: string
+  email: string
+  role: string
+  status: string
+  createdAt: string
+  channels: Array<{ id: string, name: string, createdAt: string }>
+  grants: GrantRow[]
+}
+
+const lines = ref<LineView[]>([])
+const users = ref<UserRow[]>([])
+const loading = ref(false)
+const keyword = ref('')
+const drawerOpen = ref(false)
+const current = ref<UserRow | null>(null)
+// lineId → 'none' | 'readonly' | 'operate'
+const draft = reactive<Record<string, string>>({})
+const saving = ref(false)
+
+function authHeaders(): Record<string, string> {
+  const token = (userStore as { token?: string }).token
+  return token ? { authorization: `Bearer ${token}` } : {}
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const d = await $fetch<{ code: number, data?: { lines: LineView[], users: UserRow[] } }>('/api/workshop/permissions', { headers: authHeaders() })
+    if (d.code !== 0 || !d.data) throw new Error('load fail')
+    lines.value = d.data.lines ?? []
+    users.value = d.data.users ?? []
+  }
+  catch (err) {
+    message.error(apiErrorMessage(err, t('permissions.loadFail')))
+  }
+  finally {
+    loading.value = false
+  }
+}
+
+const filteredUsers = computed(() => {
+  const kw = keyword.value.trim().toLowerCase()
+  if (!kw) return users.value
+  return users.value.filter(u => `${u.name} ${u.email}`.toLowerCase().includes(kw))
+})
+
+function openDetail(u: UserRow) {
+  current.value = u
+  draftClear(u)
+  drawerOpen.value = true
+}
+
+function draftClear(u: UserRow) {
+  for (const k of Object.keys(draft)) Reflect.deleteProperty(draft, k)
+  for (const l of lines.value) {
+    const g = u.grants.find(x => x.lineId === l.id)
+    draft[l.id] = (g?.mode === 'readonly' || g?.mode === 'operate') ? g.mode : 'none'
+  }
+}
+
+const dirtyCount = computed(() => {
+  if (!current.value) return 0
+  let n = 0
+  for (const l of lines.value) {
+    const g = current.value.grants.find(x => x.lineId === l.id)
+    const cur = (g?.mode === 'readonly' || g?.mode === 'operate') ? g.mode : 'none'
+    if ((draft[l.id] ?? 'none') !== cur) n++
+  }
+  return n
+})
+
+async function save() {
+  if (!current.value) return
+  saving.value = true
+  try {
+    const grants = lines.value
+      .filter(l => (draft[l.id] ?? 'none') !== 'none')
+      .map(l => ({ lineId: l.id, mode: draft[l.id] }))
+    const revoked = lines.value
+      .filter(l => (draft[l.id] ?? 'none') === 'none' && current.value!.grants.some(g => g.lineId === l.id))
+      .map(l => ({ lineId: l.id, mode: null }))
+    const d = await $fetch<{ code: number, data?: { grants: GrantRow[] } }>('/api/workshop/permissions', {
+      method: 'PUT',
+      headers: authHeaders(),
+      body: { userId: current.value.id, grants: [...grants, ...revoked] },
+    })
+    if (d.code !== 0 || !d.data) throw new Error('save fail')
+    current.value.grants = d.data.grants
+    const u = users.value.find(x => x.id === current.value?.id)
+    if (u) u.grants = d.data.grants
+    message.success(t('permissions.saved', { n: grants.length + revoked.length }))
+  }
+  catch (err) {
+    message.error(apiErrorMessage(err, t('permissions.saveFail')))
+  }
+  finally {
+    saving.value = false
+  }
+}
+
+function modeTag(mode: string): string {
+  return mode === 'operate' ? t('permissions.operate') : mode === 'readonly' ? t('permissions.readonly') : t('permissions.none')
+}
+
+// admin 专属页:非 admin 直接回仪表盘(后端 API 亦有 admin 拦截)
+watch(() => userStore.isLoggedIn, (ok) => {
+  if (ok && !userStore.isAdmin) navigateTo('/')
+}, { immediate: true })
+
+onMounted(load)
+</script>
+
+<template>
+  <div class="perm-page">
+    <header class="pg-head">
+      <div>
+        <h1 class="pg-title">
+          {{ $t('permissions.title') }}
+        </h1>
+        <p class="pg-sub">
+          {{ $t('permissions.subtitle') }}
+        </p>
+      </div>
+      <a-input-search
+        v-model:value="keyword"
+        :placeholder="$t('permissions.search')"
+        style="max-width: 260px"
+        allow-clear
+      />
+    </header>
+
+    <a-table
+      :data-source="filteredUsers"
+      :loading="loading"
+      row-key="id"
+      size="middle"
+      :pagination="{ pageSize: 12, showSizeChanger: false }"
+    >
+      <a-table-column
+        :title="$t('permissions.colUser')"
+        data-index="name"
+      >
+        <template #default="{ record }">
+          <a @click.prevent="openDetail(record)">{{ record.name }}</a>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colEmail')"
+        data-index="email"
+      />
+      <a-table-column
+        :title="$t('permissions.colRole')"
+        data-index="role"
+      >
+        <template #default="{ record }">
+          <a-tag :color="record.role === 'admin' ? 'green' : record.role === 'editor' ? 'blue' : 'default'">
+            {{ record.role }}
+          </a-tag>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colStatus')"
+        data-index="status"
+      >
+        <template #default="{ record }">
+          <a-tag :color="record.status === 'active' ? 'cyan' : 'red'">
+            {{ record.status === 'active' ? $t('permissions.active') : record.status }}
+          </a-tag>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colChannels')"
+        data-index="channels"
+      >
+        <template #default="{ record }">
+          {{ record.channels.length }}
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colGrants')"
+        data-index="grants"
+      >
+        <template #default="{ record }">
+          <a-tag
+            v-for="g in record.grants"
+            :key="g.lineId"
+            style="margin-bottom: 2px"
+          >
+            {{ (lines.find(l => l.id === g.lineId)?.name ?? g.lineId).slice(0, 14) }} · {{ modeTag(g.mode) }}
+          </a-tag>
+          <span
+            v-if="!record.grants.length"
+            class="dim"
+          >—</span>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colOps')"
+        :width="90"
+      >
+        <template #default="{ record }">
+          <a-button
+            size="small"
+            @click="openDetail(record)"
+          >
+            {{ $t('permissions.manage') }}
+          </a-button>
+        </template>
+      </a-table-column>
+    </a-table>
+
+    <a-drawer
+      v-model:open="drawerOpen"
+      :title="current ? `${current.name} · ${$t('permissions.detail')}` : ''"
+      width="560"
+    >
+      <template v-if="current">
+        <h4 class="sec">
+          {{ $t('permissions.secProfile') }}
+        </h4>
+        <dl class="detail">
+          <dt>email</dt><dd>{{ current.email }}</dd>
+          <dt>role</dt><dd>{{ current.role }}</dd>
+          <dt>status</dt><dd>{{ current.status }}</dd>
+          <dt>created</dt><dd>{{ current.createdAt }}</dd>
+        </dl>
+
+        <h4 class="sec">
+          {{ $t('permissions.secChannels') }}({{ current.channels.length }})
+        </h4>
+        <div
+          v-if="current.channels.length"
+          class="ch-list"
+        >
+          <code
+            v-for="c in current.channels"
+            :key="c.id"
+          >{{ c.name || c.id.slice(0, 8) }}</code>
+        </div>
+        <p
+          v-else
+          class="dim"
+        >
+          {{ $t('permissions.noChannels') }}
+        </p>
+
+        <h4 class="sec">
+          {{ $t('permissions.secMatrix') }}
+          <a-button
+            type="primary"
+            size="small"
+            :loading="saving"
+            :disabled="dirtyCount === 0"
+            style="margin-left: 12px"
+            @click="save"
+          >
+            {{ $t('permissions.save', { n: dirtyCount }) }}
+          </a-button>
+        </h4>
+        <p class="hint">
+          {{ $t('permissions.matrixHint') }}
+        </p>
+        <div class="matrix">
+          <div
+            v-for="l in lines"
+            :key="l.id"
+            class="row"
+          >
+            <span
+              class="line-name"
+              :title="l.id"
+            >{{ l.name }}</span>
+            <a-radio-group
+              v-model:value="draft[l.id]"
+              size="small"
+            >
+              <a-radio-button value="none">
+                {{ $t('permissions.none') }}
+              </a-radio-button>
+              <a-radio-button value="readonly">
+                {{ $t('permissions.readonly') }}
+              </a-radio-button>
+              <a-radio-button value="operate">
+                {{ $t('permissions.operate') }}
+              </a-radio-button>
+            </a-radio-group>
+          </div>
+        </div>
+      </template>
+    </a-drawer>
+  </div>
+</template>
+
+<style scoped lang="css">
+.perm-page { max-width: 1180px; margin: 0 auto; padding: 24px 20px 48px; }
+.pg-head { display: flex; align-items: flex-end; justify-content: space-between; gap: 16px; margin-bottom: 18px; }
+.pg-title { margin: 0; font-size: 22px; font-weight: 700; letter-spacing: .5px; }
+.pg-sub { margin: 4px 0 0; opacity: .6; font-size: 12px; }
+.dim { opacity: .45; }
+.sec { margin: 20px 0 8px; font-size: 13px; font-weight: 700; }
+.detail dt { margin-top: 8px; font-size: 11px; opacity: .5; }
+.detail dd { margin: 2px 0 0; font-family: ui-monospace, monospace; font-size: 12px; }
+.ch-list { display: flex; flex-wrap: wrap; gap: 6px; }
+.ch-list code { padding: 2px 8px; border: 1px solid rgba(128, 152, 199, .3); border-radius: 6px; font-size: 11px; }
+.hint { font-size: 11px; opacity: .55; margin: 4px 0 10px; }
+.matrix { display: flex; flex-direction: column; gap: 8px; }
+.matrix .row { display: flex; align-items: center; justify-content: space-between; gap: 12px;
+  padding: 8px 12px; border: 1px solid var(--aw-border, rgba(128, 152, 199, .25)); border-radius: 10px; }
+.line-name { font-size: 13px; font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+</style>

package/app/pages/settings.vue

@@ -60,7 +60,9 @@ async function saveRuntime() {
 async function resetRuntimeKey(key: string) {
   try {
     await rcStore.patch({ [key]: null })
-    syncRuntimeDraft()
+    // 只收敛被重置的键:整表 sync 会静默丢弃用户其他未保存编辑
+    dirtyKeys.value.delete(key)
+    draft.value[key] = rcStore.effective[key]
     runtimeNotice.value = { type: 'success', text: t('settings.runtime.keyReset', { key }) }
   }
   catch (e) {
@@ -80,7 +82,7 @@ async function resetAllRuntime() {
 }
 
 function groupLabel(group: string): string {
-  const known: Record<string, string> = { server: t('settings.runtime.groupServer'), app: t('settings.runtime.groupApp'), api: 'API', theme: t('settings.runtime.groupTheme'), i18n: t('settings.runtime.groupI18n'), security: t('settings.runtime.groupSecurity'), daq: t('settings.runtime.groupDaq'), memory: t('settings.runtime.groupMemory'), omp: t('settings.runtime.groupOmp'), dcw: t('settings.runtime.groupDcw'), workshop: t('settings.runtime.groupWorkshop'), backup: t('settings.runtime.groupBackup'), retention: t('settings.runtime.groupRetention'), log: t('settings.runtime.groupLog') }
+  const known: Record<string, string> = { server: t('settings.runtime.groupServer'), app: t('settings.runtime.groupApp'), api: t('settings.runtime.groupApi'), theme: t('settings.runtime.groupTheme'), i18n: t('settings.runtime.groupI18n'), security: t('settings.runtime.groupSecurity'), daq: t('settings.runtime.groupDaq'), memory: t('settings.runtime.groupMemory'), omp: t('settings.runtime.groupOmp'), harness: t('settings.runtime.groupHarness'), dcw: t('settings.runtime.groupDcw'), workshop: t('settings.runtime.groupWorkshop'), backup: t('settings.runtime.groupBackup'), retention: t('settings.runtime.groupRetention'), log: t('settings.runtime.groupLog') }
   return known[group] ?? group
 }
 function sourceClass(s: string): string {

package/app/plugins/http.ts

@@ -5,6 +5,9 @@ import axios, {
   type InternalAxiosRequestConfig,
 } from 'axios'
 import { message } from 'ant-design-vue'
+import { useUserStore } from '~/stores/workshop/user'
+
+const g = globalThis as typeof globalThis & { __awShown401?: boolean }
 
 /**
  * HTTP 请求层（基于 axios 封装）
@@ -12,7 +15,7 @@ import { message } from 'ant-design-vue'
  * - 统一请求/响应拦截：注入 token、统一错误提示
  * - 通过 nuxt provide 暴露 $http，并提供 useHttp 组合式入口
  */
-export default defineNuxtPlugin(() => {
+export default defineNuxtPlugin((nuxtApp) => {
   const config = useRuntimeConfig().public
 
   const instance: AxiosInstance = axios.create({
@@ -40,7 +43,20 @@ export default defineNuxtPlugin(() => {
       const msg = error?.response?.data?.message || error.message || '请求失败'
 
       if (status === 401) {
-        message.error('登录已过期，请重新登录')
+        // 死 token 收尾:清登录态(cookie+pinia)防 401 toast 风暴;toast 3s 去重
+        try {
+          const cookie = useCookie<string | null>('token')
+          cookie.value = null
+          useUserStore(nuxtApp.$pinia).$reset()
+        }
+        catch { /* 无 pinia 上下文(极端时序) */ }
+        if (!g.__awShown401) {
+          g.__awShown401 = true
+          message.error('登录已过期,请重新登录')
+          setTimeout(() => {
+            g.__awShown401 = false
+          }, 3000)
+        }
       }
       else if (status >= 500) {
         message.error('服务器异常，请稍后重试')

package/app/plugins/session-restore.client.ts

@@ -16,9 +16,14 @@ export default defineNuxtPlugin(async () => {
   const token = cookie.value
   if (!token) return
   try {
-    await store.loginWithToken(token)
+    // 超时竞速:慢 auth API 不应阻塞整站首绘
+    await Promise.race([
+      store.loginWithToken(token),
+      new Promise(r => setTimeout(r, 5000)),
+    ])
   }
   catch {
-    /* token 已失效(吊销/用户删除):静默停留未登录态 */
+    // token 已失效(吊销/用户删除/过期):清死 cookie,避免每次刷新重复必然失败的校验
+    useCookie<string | null>('token').value = null
   }
 })

package/app/stores/workshop/user.ts

@@ -55,7 +55,8 @@ export const useUserStore = defineStore('workshop.user', {
       // 请求上下文已丢失,useCookie 会抛 NUXT_E1001(useNuxtApp outside context);
       // 请求期写 Set-Cookie 在响应完成后也无实效。客户端 useCookie 不依赖请求上下文。
       if (import.meta.server) return
-      const cookie = useCookie<string | null>('token', { maxAge: 60 * 60 * 24 * 365 })
+      // maxAge 与服务端 token TTL(30 天)对齐:365 天会让浏览器带着必死 token 往返
+      const cookie = useCookie<string | null>('token', { maxAge: 60 * 60 * 24 * 30 })
       cookie.value = this.user?.token ?? null
     },
     /** 以 me 响应补全 tokenId（注册/登录签发的新 token 尚未绑定 id） */
@@ -171,6 +172,18 @@ export const useUserStore = defineStore('workshop.user', {
     },
   },
   persist: {
+    // localStorage 不持久化 token(长命明文凭据,XSS 可读且跨标签页漂移):
+    // token 真源是 30 天 cookie;hydration 后从 cookie 回填,无 cookie 即回登出态
     pick: ['user'],
+    afterHydrate: (ctx) => {
+      const store = ctx.store as { user?: { token?: string } | null, user?: CurrentUser | null, applyCookie?: () => void }
+      if (!store.user) return
+      try {
+        const cookie = useCookie<string | null>('token')
+        if (cookie.value) store.user.token = cookie.value
+        else (store as { user?: CurrentUser | null }).user = null
+      }
+      catch { /* SSR 上下文:跳过(session-restore.client 负责) */ }
+    },
   },
 })

package/i18n/locales/en.ts

@@ -25,6 +25,7 @@ export default {
     monitor: 'Runtime Monitor',
     plugins: 'Plugins',
     settings: 'Settings',
+    permissions: 'Permissions',
   },
   header: {
     collapse: 'Collapse menu',
@@ -225,6 +226,15 @@ export default {
       groupI18n: 'i18n',
       groupSecurity: 'Security',
       groupDaq: 'DAQ',
+      groupApi: 'API',
+      groupMemory: 'Memory',
+      groupOmp: 'Agent Harness',
+      groupHarness: 'Harness Adapters',
+      groupDcw: 'Write Control',
+      groupWorkshop: 'Workshop',
+      groupBackup: 'Backup',
+      groupRetention: 'Retention',
+      groupLog: 'Logs',
       server: {
         host: 'Listen address',
         devPort: 'Dev port',
@@ -1899,6 +1909,33 @@ export default {
     network: 'Cannot reach the server, check network and service status',
     fallback: 'Action failed, please retry later',
   },
+  permissions: {
+    title: 'Permissions',
+    subtitle: 'User × line three-state grants: none / read-only (DAQ) / operate (DAQ+DCW); users default to none',
+    search: 'Search name or email',
+    loadFail: 'Failed to load permission data',
+    saveFail: 'Failed to save grants',
+    saved: 'Saved {n} grant change(s)',
+    colUser: 'User',
+    colEmail: 'Email',
+    colRole: 'Role',
+    colStatus: 'Status',
+    colChannels: 'Channels',
+    colGrants: 'Line grants',
+    colOps: 'Actions',
+    active: 'Active',
+    manage: 'Manage',
+    detail: 'Permission detail',
+    secProfile: 'Profile',
+    secChannels: 'Created channels',
+    noChannels: 'No channels created by this user',
+    secMatrix: 'Line grant matrix',
+    save: 'Save ({n})',
+    matrixHint: 'none = line data is withheld server-side (invisible in UI & digital twin); read-only = DAQ read; operate = full DAQ read + DCW write.',
+    none: 'None',
+    readonly: 'Read-only',
+    operate: 'Operate',
+  },
   error: {
     backHome: 'Back to Home',
     lost: 'Page lost',

package/i18n/locales/zh-CN.ts

@@ -25,6 +25,7 @@ export default {
     monitor: '运行时监控',
     plugins: '插件管理',
     settings: '系统设置',
+    permissions: '权限管理',
   },
   header: {
     collapse: '折叠菜单',
@@ -225,6 +226,15 @@ export default {
       groupI18n: '国际化',
       groupSecurity: '安全',
       groupDaq: '数采',
+      groupApi: 'API',
+      groupMemory: '记忆系统',
+      groupOmp: 'Agent Harness',
+      groupHarness: 'Harness 接入',
+      groupDcw: '数控写控',
+      groupWorkshop: '车间运行',
+      groupBackup: '数据备份',
+      groupRetention: '数据保留',
+      groupLog: '日志',
       server: {
         host: '监听地址',
         devPort: '开发端口',
@@ -1898,6 +1908,33 @@ export default {
     network: '无法连接服务器,请检查网络与服务状态',
     fallback: '操作失败,请稍后重试',
   },
+  permissions: {
+    title: '权限管理',
+    subtitle: '用户 × 产线三态授权:无权 / 仅查看(数采只读) / 可操控(数采+数控全量);普通用户默认无权',
+    search: '搜索用户名或邮箱',
+    loadFail: '权限数据加载失败',
+    saveFail: '保存授权失败',
+    saved: '已保存 {n} 项授权变更',
+    colUser: '用户',
+    colEmail: '邮箱',
+    colRole: '角色',
+    colStatus: '状态',
+    colChannels: 'Channel 数',
+    colGrants: '产线授权',
+    colOps: '操作',
+    active: '正常',
+    manage: '授权管理',
+    detail: '权限详情',
+    secProfile: '基本信息',
+    secChannels: '创建的 Channel',
+    noChannels: '该用户尚未创建 Channel',
+    secMatrix: '产线授权矩阵',
+    save: '保存变更({n})',
+    matrixHint: '无权=后端不返回该产线数据(前端/数字孪生不可见);仅查看=数采节点只读;可操控=数采读取+数控写控全量。',
+    none: '无权',
+    readonly: '仅查看',
+    operate: '可操控',
+  },
   error: {
     backHome: '返回首页',
     lost: '页面走失了',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentworkshop",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "type": "module",
   "description": "AgentWorkShop 软件开发系统 - 基于 Nuxt 4 的配置驱动运行范式",
   "license": "PolyForm-Noncommercial-1.0.0",

package/scripts/_dbg-acc-1-setup.mjs

@@ -0,0 +1,57 @@
+// 验收阶段1:setup 门注册 admin 账户(凭据经 argv 传入,不落源码)
+// 用法:node scripts/_dbg-acc-1-setup.mjs <base> <adminUser> <adminPass>
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const [USER, PASS] = [process.argv[3], process.argv[4]]
+const EMAIL = `${USER}@awshop.local`
+mkdirSync('.e2e-shots', { recursive: true })
+
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+
+const s0 = await api('/api/users/setup-status')
+console.log(s0.body?.data?.needsSetup === true ? '✔ setup 状态:true(零用户)' : `✖ setup 状态异常: ${JSON.stringify(s0.body)}`)
+
+const browser = await puppeteer.launch({
+  executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  headless: 'new',
+  args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'],
+})
+try {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.goto(`${BASE}/workshop`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await page.waitForFunction(() => document.body.innerText.includes('创建管理员账号'), { timeout: 30000 })
+  console.log('✔ setup 登录门呈现')
+
+  await page.waitForSelector('.auth-card input')
+  const nameInput = (await page.$$('.auth-card input'))[0]
+  await nameInput.click({ clickCount: 3 })
+  await nameInput.type(USER)
+  const emailInput = await page.$('.auth-card input[type="email"]')
+  await emailInput.click({ clickCount: 3 })
+  await emailInput.type(EMAIL)
+  const pwInput = await page.$('.auth-card input[type="password"]')
+  await pwInput.click({ clickCount: 3 })
+  await pwInput.type(PASS)
+  await page.keyboard.press('Enter')
+  await page.waitForFunction(() => document.body.innerText.includes('Workshop'), { timeout: 30000 })
+  console.log('✔ 注册并自动进入项目')
+
+  // 登录态确认:me 返回 admin
+  const cookie = await page.cookies()
+  const token = cookie.find(c => c.name === 'token')?.value
+  const me = await api('/api/users/me', { headers: { authorization: `Bearer ${token}` } })
+  console.log(me.body?.data?.role === 'admin' ? `✔ me=${me.body.data.name} role=admin` : `✖ me 异常: ${JSON.stringify(me.body)}`)
+  await page.screenshot({ path: '.e2e-shots/acc-1-admin-entered.png' })
+
+  const s1 = await api('/api/users/setup-status')
+  console.log(s1.body?.data?.needsSetup === false ? '✔ setup 状态收敛:false' : '✖ setup 未收敛')
+}
+finally {
+  await browser.close()
+}

package/scripts/_dbg-acc-2-diag.mjs

@@ -0,0 +1,14 @@
+// 诊断:settings 页文本结构
+import puppeteer from 'puppeteer-core'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--no-proxy-server'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000 })
+const login = await fetch('http://127.0.0.1:3021/api/users/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto('http://127.0.0.1:3021/settings', { waitUntil: 'networkidle2', timeout: 60000 })
+await new Promise(r => setTimeout(r, 2500))
+console.log('BODY-HEAD:', await page.evaluate(() => document.body.innerText.slice(0, 400).replace(/\n/g, ' / ')))
+console.log('TITLES:', await page.evaluate(() => [...document.querySelectorAll('.section-title,h3,h4,.ant-tabs-tab')].map(e => e.textContent?.trim()).filter(Boolean).slice(0, 30).join(' | ')))
+console.log('HAS-DAQ-LABEL:', await page.evaluate(() => document.body.innerText.includes('节点采样默认间隔')))
+console.log('RT-ROWS:', await page.evaluate(() => document.querySelectorAll('.rt-row').length))
+await browser.close()