agentworkshop 0.7.9 → 0.7.11

package/scripts/_dbg-acc-2-intervals.mjs

@@ -0,0 +1,81 @@
+// 验收阶段2:前端设置页修改数采采样间隔 + 时序查询默认间隔,验证生效
+// 用法:node scripts/_dbg-acc-2-intervals.mjs <base> <user> <pass> <samplingMs> <bucketMs>
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const [USER, PASS, SAMPLE_MS, BUCKET_MS] = [process.argv[3], process.argv[4], Number(process.argv[5]), Number(process.argv[6])]
+const TAG = process.argv[7] ?? 'change'
+mkdirSync('.e2e-shots', { recursive: true })
+
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: `${USER}@awshop.local`, password: PASS }) })
+const TOKEN = login.body?.data?.token
+if (!TOKEN) { console.error('✖ admin 登录失败'); process.exit(1) }
+
+const browser = await puppeteer.launch({
+  executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  headless: 'new',
+  args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'],
+})
+try {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.setCookie({ name: 'token', value: TOKEN, domain: new URL(BASE).hostname, path: '/' })
+  await page.goto(`${BASE}/settings`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await new Promise(r => setTimeout(r, 1200))
+  // 切到「运行配置」tab(runtime 设置区)
+  await page.evaluate(() => {
+    const tab = [...document.querySelectorAll('.ant-tabs-tab,[role=tab],button,.section-title')].find(e => (e.textContent ?? '').trim() === '运行配置')
+    tab?.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+  })
+  await page.waitForFunction(() => document.body.innerText.includes('节点采样默认间隔'), { timeout: 30000 })
+  console.log('✔ 设置页呈现数采间隔项')
+
+  // 定位行:rt-row 内 rt-title 含目标文本 → 行内 .ant-input-number input
+  const setNumber = async (titleText, value) => {
+    const ok = await page.evaluate((t, v) => {
+      const rows = [...document.querySelectorAll('.rt-row')]
+      const row = rows.find(r => r.querySelector('.rt-title')?.textContent?.includes(t))
+      if (!row) return false
+      const input = row.querySelector('.ant-input-number input')
+      if (!input) return false
+      input.focus()
+      document.execCommand('selectAll', false, null)
+      document.execCommand('insertText', false, String(v))
+      input.dispatchEvent(new Event('input', { bubbles: true }))
+      input.blur()
+      input.dispatchEvent(new Event('change', { bubbles: true }))
+      return true
+    }, titleText, value)
+    if (!ok) throw new Error(`未找到输入框: ${titleText}`)
+    await new Promise(r => setTimeout(r, 400))
+  }
+  await setNumber('节点采样默认间隔', SAMPLE_MS)
+  console.log(`✔ 采样默认间隔 → ${SAMPLE_MS}ms`)
+  await setNumber('时序查询默认间隔', BUCKET_MS)
+  console.log(`✔ 时序查询默认间隔 → ${BUCKET_MS}ms`)
+
+  // 全局保存
+  await page.evaluate(() => {
+    const btn = [...document.querySelectorAll('button')].find(b => /保\s*存|Save/.test(b.textContent ?? ''))
+    btn?.click()
+  })
+  await new Promise(r => setTimeout(r, 1500))
+  await page.screenshot({ path: `.e2e-shots/acc-2-intervals-${TAG}.png` })
+}
+finally {
+  await browser.close()
+}
+
+// API 确认 effective 生效
+const cfg = await api('/api/system/config', { headers: { authorization: `Bearer ${await (async () => TOKEN)()}` } })
+const eff = cfg.body?.data?.effective ?? {}
+const sampleOk = eff['daq.sampling.defaultIntervalMs'] === SAMPLE_MS
+const bucketOk = eff['daq.query.defaultBucketMs'] === BUCKET_MS
+console.log(sampleOk ? `✔ effective daq.sampling.defaultIntervalMs=${SAMPLE_MS}` : `✖ sampling=${JSON.stringify(eff['daq.sampling.defaultIntervalMs'])}`)
+console.log(bucketOk ? `✔ effective daq.query.defaultBucketMs=${BUCKET_MS}` : `✖ bucket=${JSON.stringify(eff['daq.query.defaultBucketMs'])}`)
+process.exit(sampleOk && bucketOk ? 0 : 1)

package/scripts/_dbg-acc-3-daq.mjs

@@ -0,0 +1,48 @@
+// 验收阶段3:数采中心可视化(列表状态 + 节点详情图表渲染)
+// 用法:node scripts/_dbg-acc-3-daq.mjs <base> <user> <pass> <liveNodeId>
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const [USER, PASS, NODE_ID] = [process.argv[3], process.argv[4], process.argv[5]]
+mkdirSync('.e2e-shots', { recursive: true })
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: `${USER}@awshop.local`, password: PASS }) })
+const TOKEN = login.body?.data?.token
+
+const browser = await puppeteer.launch({
+  executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  headless: 'new',
+  args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'],
+})
+try {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.setCookie({ name: 'token', value: TOKEN, domain: new URL(BASE).hostname, path: '/' })
+
+  // 1) 数采中心列表
+  await page.goto(`${BASE}/daq`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await new Promise(r => setTimeout(r, 2500))
+  const listText = await page.evaluate(() => document.body.innerText)
+  const hasStats = /在线|online|节点/i.test(listText)
+  console.log(hasStats ? '✔ 数采中心列表渲染' : '✖ 数采中心列表空')
+  await page.screenshot({ path: '.e2e-shots/acc-3-daq-list.png' })
+
+  // 2) 节点详情 + 图表
+  await page.goto(`${BASE}/daq/${NODE_ID}`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await new Promise(r => setTimeout(r, 6000)) // 等实时数据+图表渲染
+  const chart = await page.evaluate(() => ({
+    canvases: document.querySelectorAll('canvas').length,
+    svgs: document.querySelectorAll('svg').length,
+    text: document.body.innerText.slice(0, 200).replace(/\n/g, ' '),
+  }))
+  console.log(`图表渲染: canvas=${chart.canvases} svg=${chart.svgs}`)
+  console.log(chart.canvases + chart.svgs > 0 ? '✔ 图表已渲染' : '✖ 未见图表')
+  await page.screenshot({ path: '.e2e-shots/acc-3-daq-detail.png' })
+}
+finally {
+  await browser.close()
+}

package/scripts/_dbg-acc-4-team.mjs

@@ -0,0 +1,92 @@
+// 验收阶段4:多 Harness 团队 + 设备绑定 + 极简任务
+// 用法:node scripts/_dbg-acc-4-team.mjs <base> <user> <pass>
+import { mkdirSync } from 'node:fs'
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const [USER, PASS] = [process.argv[3], process.argv[4]]
+mkdirSync('.e2e-shots', { recursive: true })
+const stamp = Date.now().toString(36)
+
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: `${USER}@awshop.local`, password: PASS }) })
+const H = { authorization: `Bearer ${login.body.data.token}`, 'content-type': 'application/json' }
+const post = (p, b) => api(p, { method: 'POST', headers: H, body: JSON.stringify(b) })
+
+// 1) 三个不同 harness 的 agent 模板
+const mk = async (name, harness) => {
+  const r = await post('/api/workshop/agents', { name, harness, visibility: 'private' })
+  if (r.status !== 0 && r.body?.code !== 0) throw new Error(`建 agent ${name}: ${JSON.stringify(r.body)}`)
+  console.log(`✔ agent 模板 ${name} harness=${harness} id=${r.body.data.id.slice(0, 10)}`)
+  return r.body.data
+}
+const leadTpl = await mk(`acc-lead-${stamp}`, 'omp')
+const wMock = await mk(`acc-w-mock-${stamp}`, 'mock')
+const wCodex = await mk(`acc-w-codex-${stamp}`, 'codex')
+
+// 2) team + 成员
+const team = await post('/api/workshop/teams', { name: `验收团队-${stamp}`, description: '多 harness 验收' })
+const teamId = team.body.data.id
+console.log('✔ team 创建', teamId.slice(0, 10))
+for (const [tpl, role] of [[leadTpl, 'lead'], [wMock, 'worker'], [wCodex, 'worker']]) {
+  const r = await post(`/api/workshop/teams/${teamId}/members`, { agentId: tpl.id, role })
+  console.log(`${r.body?.code === 0 ? '✔' : '✖'} member ${tpl.name} role=${role}`, r.body?.code === 0 ? '' : JSON.stringify(r.body))
+}
+
+// 3) channel(不带 lead,由 deploy 带入) + deploy
+const ch = await post('/api/workshop/channels', { name: `验收频道-${stamp}`, description: '多 harness 团队验收' })
+const channelId = ch.body.data.channelId ?? ch.body.data.id
+console.log('✔ channel 创建', channelId.slice(0, 10))
+const dep = await post(`/api/workshop/teams/${teamId}/deploy`, { channelId })
+if (dep.body?.code !== 0) { console.error('✖ deploy 失败:', JSON.stringify(dep.body)); process.exit(1) }
+const deployed = dep.body.data
+console.log('✔ team 部署到 channel:', JSON.stringify(deployed).slice(0, 200))
+
+// 部署后实例 id(克隆体):channel agents 列表
+const ags = await api(`/api/workshop/channels/${channelId}/agents`, { headers: H })
+const chanAgents = ags.body?.data ?? []
+const find = (harness) => chanAgents.find(a => a.harness === harness)
+const leadInst = find('omp')
+const mockInst = find('mock')
+const codexInst = find('codex')
+console.log('实例:', [leadInst, mockInst, codexInst].map(a => a ? `${a.name}(${a.harness})=${a.id.slice(0, 10)}` : '(缺)').join(' '))
+
+// 4) 设备绑定:worker ↔ daq 节点 / worker ↔ dcw 写控节点
+for (const [inst, nodeId, kind] of [[mockInst, 'dn-43f55a32', 'daq'], [codexInst, 'dw-322b1978', 'dcw']]) {
+  if (!inst) { console.log(`✖ 绑定跳过:实例缺失 kind=${kind}`); continue }
+  const r = await post('/api/workshop/agent-tools/bindings', { agentId: inst.id, nodeId, kind, mode: 'auto' })
+  console.log(`${r.body?.code === 0 ? '✔' : '✖'} 绑定 ${inst.name}(${kind}) ↔ ${nodeId}`, r.body?.code === 0 ? '' : JSON.stringify(r.body))
+}
+const bl = await api('/api/workshop/agent-tools/bindings', { headers: H })
+const mine = (bl.body?.data?.bindings ?? []).filter(b => [mockInst?.id, codexInst?.id].includes(b.agentId))
+console.log(`✔ 绑定清单(${mine.length} 条新建):`, mine.map(b => `${b.kind}:${b.nodeId}`).join(', '))
+
+// 5) 极简任务(省 token):发消息给 lead,要求派发给各 worker 单句回复
+const msg = await post(`/api/workshop/channels/${channelId}/messages`, {
+  toAgentId: leadInst?.id,
+  text: '团队自检任务:请把下面这句话原样转交给每个 worker 执行——「用一句不超过 15 字的话报告你的引擎名并说 ok,不要调用任何工具」。收齐后向人类汇总。',
+  fromLabel: 'admin',
+  priority: 'task',
+})
+console.log(`${msg.body?.code === 0 ? '✔' : '✖'} 任务消息下发`, msg.body?.code === 0 ? '' : JSON.stringify(msg.body))
+
+// 6) 轮询 channel 消息(最多 90s),统计各 harness 回复
+console.log('等待 worker 回复(轮询 90s)...')
+const seen = new Map()
+for (let i = 0; i < 30; i++) {
+  await new Promise(r => setTimeout(r, 3000))
+  const ms = await api(`/api/workshop/channels/${channelId}/messages?limit=50`, { headers: H })
+  const items = ms.body?.data?.items ?? ms.body?.data ?? []
+  for (const m of (Array.isArray(items) ? items : [])) {
+    if (i === 0 && seen.size === 0) console.log('  [msg 样例]', JSON.stringify(m).slice(0, 220))
+    const from = m.fromAgentName ?? m.fromAgentId ?? m.from ?? '?'
+    if (!seen.has(from)) seen.set(from, String(m.text ?? '').slice(0, 60))
+  }
+  const harnessHits = ['mock', 'omp', 'codex'].filter(h => [...seen.keys()].some(k => String(k).toLowerCase().includes(h)) || [...seen.values()].some(v => v.toLowerCase().includes(h)))
+  process.stdout.write(`  t=${(i + 1) * 3}s 发言者=${seen.size} 命中=${harnessHits.join(',')}\r`)
+  if (harnessHits.length >= 2 && seen.size >= 3) break
+}
+console.log('')
+for (const [k, v] of seen) console.log(`  [${k}] ${v}`)
+console.log('CHANNEL_ID=' + channelId)

package/scripts/_dbg-acc-5-visual.mjs

@@ -0,0 +1,63 @@
+// 验收阶段5:前端可视化巡检(workshop 会话/产线/监控/数字孪生)
+// 用法:node scripts/_dbg-acc-5-visual.mjs <base> <user> <pass> <channelId>
+import puppeteer from 'puppeteer-core'
+import { mkdirSync } from 'node:fs'
+
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const [USER, PASS, CHANNEL_ID] = [process.argv[3], process.argv[4], process.argv[5]]
+mkdirSync('.e2e-shots', { recursive: true })
+const api = async (path, opts = {}) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: `${USER}@awshop.local`, password: PASS }) })
+const TOKEN = login.body?.data?.token
+
+const browser = await puppeteer.launch({
+  executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  headless: 'new',
+  args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'],
+})
+const shots = []
+const snap = async (page, name, wait = 2500) => {
+  await new Promise(r => setTimeout(r, wait))
+  const path = `.e2e-shots/acc-5-${name}.png`
+  await page.screenshot({ path })
+  shots.push(path)
+  console.log('📷', path)
+}
+try {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.setCookie({ name: 'token', value: TOKEN, domain: new URL(BASE).hostname, path: '/' })
+
+  // 1) workshop 总览(实时状态徽标)
+  await page.goto(`${BASE}/workshop`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await snap(page, 'workshop-overview')
+
+  // 2) channel 会话页(找 workspace 链接直达)
+  const wsHref = await page.evaluate(() => [...document.querySelectorAll('a')].map(a => a.getAttribute('href')).find(h => h?.startsWith('/workshop/w/')))
+  if (wsHref) {
+    await page.goto(`${BASE}${wsHref}`, { waitUntil: 'networkidle2', timeout: 60000 })
+    await snap(page, 'workshop-channel', 4000)
+  }
+  else {
+    console.log('(未找到 workspace 链接,跳过会话页)')
+  }
+
+  // 3) 产线运营
+  await page.goto(`${BASE}/dcw`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await snap(page, 'dcw-lines', 3000)
+
+  // 4) 运行时监控
+  await page.goto(`${BASE}/monitor`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await snap(page, 'monitor', 3000)
+
+  // 5) 数字孪生(等 WS 快照与 3D/趋势渲染)
+  await page.goto(`${BASE}/town`, { waitUntil: 'networkidle2', timeout: 90000 })
+  await snap(page, 'town', 8000)
+}
+finally {
+  await browser.close()
+}
+console.log('DONE', shots.length, 'screenshots')

package/scripts/_dbg-acc-5b-ws-town.mjs

@@ -0,0 +1,18 @@
+// 验收阶段5b:workspace 会话页 + 数字孪生(挂载后)
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3021'
+const WS = process.argv[2] ?? 'c99321bd-3352-4362-88e2-4141dcdd9331'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto(`${BASE}/workshop/w/${WS}`, { waitUntil: 'networkidle2', timeout: 90000 })
+await new Promise(r => setTimeout(r, 6000))
+await page.screenshot({ path: '.e2e-shots/acc-5-workshop-channel.png' })
+console.log('📷 workshop-channel')
+await page.goto(`${BASE}/town`, { waitUntil: 'networkidle2', timeout: 90000 })
+await new Promise(r => setTimeout(r, 10000))
+await page.screenshot({ path: '.e2e-shots/acc-5-town-2.png' })
+console.log('📷 town-2')
+await browser.close()

package/scripts/_dbg-acc-5c-town.mjs

@@ -0,0 +1,12 @@
+// town 截图(WS 常驻连接下不能等 networkidle)
+import puppeteer from 'puppeteer-core'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch('http://127.0.0.1:3021/api/users/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto('http://127.0.0.1:3021/town', { waitUntil: 'domcontentloaded', timeout: 60000 })
+await new Promise(r => setTimeout(r, 14000))
+await page.screenshot({ path: '.e2e-shots/acc-5-town-2.png' })
+console.log('📷 town-2')
+await browser.close()

package/scripts/_dbg-acc-6-i18n.mjs

@@ -0,0 +1,19 @@
+// i18n 分组标题修复目视验证
+import puppeteer from 'puppeteer-core'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch('http://127.0.0.1:3021/api/users/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto('http://127.0.0.1:3021/settings', { waitUntil: 'networkidle2', timeout: 60000 })
+await new Promise(r => setTimeout(r, 1500))
+await page.evaluate(() => {
+  const tab = [...document.querySelectorAll('.ant-tabs-tab,[role=tab],button,.section-title')].find(e => (e.textContent ?? '').trim() === '运行配置')
+  tab?.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+})
+await new Promise(r => setTimeout(r, 1500))
+const text = await page.evaluate(() => document.body.innerText)
+console.log('缺键残留(settings.runtime.groupXxx):', /settings\.runtime\.group/.test(text) ? '仍有 ✖' : '已清零 ✔')
+console.log('分组标题样例:', ['记忆系统', 'Agent Harness', '数控写控', '数据备份', 'Harness 接入'].filter(t => text.includes(t)).join(' / '))
+await page.screenshot({ path: '.e2e-shots/acc-6-i18n-groups.png' })
+await browser.close()

package/scripts/_dbg-audit-neg-e2e.mjs

@@ -0,0 +1,64 @@
+// 审计修复负向断言:越权 start/stop/samples/WS 无鉴权
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let step = 0
+const ok = (name, cond, detail = '') => {
+  step++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!cond) process.exitCode = 1
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+ok('admin 登录', Boolean(adminTok))
+
+// 拿 admin 视角的有线 dcw 节点 + 有线节点 samples
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data ?? {}
+const lineNode = dcw.nodes?.find(n => n.lineId)
+ok('admin 可见有产线节点', Boolean(lineNode), lineNode?.id)
+
+// plain(复用权限 E2E 建的账号或新注册,默认零授权)
+const stamp = Date.now().toString(36)
+const reg = await api('/api/users/register', { method: 'POST', body: JSON.stringify({ name: `a-${stamp}`, email: `a-${stamp}@awshop.local`, password: 'Plain2026' }) })
+const plainTok = reg.body?.data?.token
+ok('plain 注册', Boolean(plainTok))
+
+// 越权断言
+const r1 = await api(`/api/workshop/dcw/lines/${lineNode.lineId}/start`, { method: 'POST', body: '{}' }, plainTok)
+ok('零授权 start 产线被拒(403)', r1.status === 403, r1.body?.message)
+const r2 = await api(`/api/workshop/dcw/lines/${lineNode.lineId}/stop`, { method: 'POST', body: '{}' }, plainTok)
+ok('零授权 stop 产线被拒(403)', r2.status === 403, r2.body?.message)
+const daq = (await api('/api/workshop/daq', {}, adminTok)).body?.data ?? {}
+const daqNode = daq.nodes?.find(n => n.lineId)
+const r3 = await api(`/api/workshop/daq/${daqNode.id}/samples?limit=5`, {}, plainTok)
+ok('零授权读历史采样被拒(403)', r3.status === 403, r3.body?.message)
+const r4 = await api(`/api/workshop/daq/${daqNode.id}/frames?limit=5`, {}, plainTok)
+ok('零授权读帧列表被拒(403)', r4.status === 403, r4.body?.message)
+
+// ws 未鉴权:裸连(无 token)应收不到 scene 帧(10s 无 daq.reading)
+const wsUrl = `${BASE.replace('http', 'ws')}/api/workshop/ws`
+const ws = new WebSocket(wsUrl)
+let frames = 0
+ws.onmessage = () => frames++
+await new Promise(r => setTimeout(r, 10000))
+ws.close()
+ok('无 token WS 连接收不到遥测帧(10s)', frames === 0, `frames=${frames}`)
+
+// 带 token 的 WS:admin 能收到遥测(存活验证)
+const ws2 = new WebSocket(`${wsUrl}?token=${adminTok}`)
+let frames2 = 0
+ws2.onmessage = (ev) => {
+  const d = JSON.parse(ev.data)
+  if (d.type === 'daq.reading' || d.type === 'dcw.read') frames2++
+}
+await new Promise(r => setTimeout(r, 12000))
+ws2.close()
+ok('带 token WS 收到遥测帧', frames2 > 0, `frames=${frames2}`)
+
+console.log(`\n===== audit negative E2E: ${step} 项 =====`)

package/scripts/_dbg-final-features.mjs

@@ -0,0 +1,155 @@
+// ============================================================
+// 最终验收·全功能测试(home 生产实例):Channel/Team/产线/数采/写控/绑定/权限
+// 用法:node scripts/_dbg-final-features.mjs <base> <adminPass>
+// ============================================================
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3001'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let pass = 0, fail = 0
+const sections = []
+let section = 'START'
+const sec = (name) => { section = name; console.log(`\n── ${name} ──`) }
+const ok = (name, cond, detail = '') => {
+  cond ? pass++ : fail++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  sections.push({ section, name, ok: cond, detail })
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const stamp = Date.now().toString(36)
+
+// ===== 1. 基础面 =====
+sec('基础面')
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+ok('admin 登录', Boolean(adminTok))
+const me = await api('/api/users/me', {}, adminTok)
+ok('/me 返回 admin', me.body?.data?.role === 'admin')
+const health = await api('/api/health')
+ok('/api/health 存活', health.status === 200)
+const ss = await api('/api/users/setup-status')
+ok('setup 已收敛(false)', ss.body?.data?.needsSetup === false)
+
+// ===== 2. 产线管理与写控 =====
+sec('产线管理与写控(DCW)')
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data
+ok('dcw 网关运行', dcw?.controller?.running === true)
+ok(`写控节点在线 ${dcw?.controller?.nodesOnline}/${dcw?.controller?.nodesTotal}`, dcw?.controller?.nodesOnline > 0)
+ok(`产线 ${dcw?.lines?.length} 条可见`, dcw?.lines?.length > 0)
+const line1 = dcw.lines[0]
+const line2 = dcw.lines[1]
+ok('目标产线定位(前两条)', Boolean(line1 && line2), `${line1?.id} ${line2?.id}`)
+// 写控:对 1 号产线的一个 mock 写控节点下发设定值并回读
+const wNode = dcw.nodes.find(n => n.lineId === line1?.id && n.driver === 'mock')
+ok('1号产线 mock 写控节点', Boolean(wNode), wNode?.id)
+if (wNode) {
+  const target = Math.round(((wNode.min ?? 150) + (wNode.max ?? 200)) / 2)
+  const wr = await api(`/api/workshop/dcw/${wNode.id}/write`, { method: 'POST', body: JSON.stringify({ value: target }) }, adminTok)
+  ok(`写控下发 ${target} 并 ACK 回读一致`, wr.status === 200 && wr.body?.data?.outcome?.ok === true, String(wr.body?.data?.outcome?.message ?? '').slice(0, 60))
+}
+// 产线开跑/停止(2号产线,含配方下发闭环)
+const rStart = await api(`/api/workshop/dcw/lines/${line2.id}/start`, { method: 'POST', body: JSON.stringify({}) }, adminTok)
+ok('2号产线开跑(lineStart)', rStart.status === 200 && rStart.body?.data?.run != null, `run=${rStart.body?.data?.run?.id?.slice(0, 8)}`)
+await new Promise(r => setTimeout(r, 3000))
+const rStop = await api(`/api/workshop/dcw/lines/${line2.id}/stop`, { method: 'POST', body: '{}' }, adminTok)
+ok('2号产线停止', rStop.status === 200)
+
+// ===== 3. 数据采集(DAQ) =====
+sec('数据采集(DAQ)')
+const daq = (await api('/api/workshop/daq', {}, adminTok)).body?.data
+ok(`数采节点在线 ${daq?.controller?.nodesOnline}/${daq?.controller?.nodesTotal}`, daq?.controller?.nodesOnline > 0)
+ok(`采样管道 produced=${daq?.controller?.produced} consumed=${daq?.controller?.consumed} dropped=${daq?.controller?.dropped}`, daq?.controller?.produced > 0 && daq?.controller?.dropped === 0)
+const liveDaq = daq.nodes.find(n => n.state === 'ok' && n.lineId)
+ok('活采样节点定位', Boolean(liveDaq), `${liveDaq?.id} v=${liveDaq?.value}`)
+if (liveDaq) {
+  const a0 = liveDaq.lastAt
+  await new Promise(r => setTimeout(r, 5000))
+  const daq2 = (await api('/api/workshop/daq', {}, adminTok)).body?.data
+  const n2 = daq2.nodes.find(n => n.id === liveDaq.id)
+  ok('采样节拍推进(lastAt 前进+值变化)', n2.lastAt > a0 || n2.value !== liveDaq.value, `v ${liveDaq.value}→${n2.value}`)
+  const sp = await api(`/api/workshop/daq/${liveDaq.id}/samples?limit=10`, {}, adminTok)
+  ok('时序历史查询(>0 数据点)', sp.status === 200 && (sp.body?.data?.points?.length ?? 0) > 0, `points=${sp.body?.data?.points?.length}`)
+}
+const alarms = await api('/api/workshop/daq/alarms', {}, adminTok)
+ok('告警查询可用', alarms.status === 200)
+
+// ===== 4. Channel + AgentTeamWork + 绑定 + 团队闭环 =====
+sec('Channel / AgentTeam / 绑定 / 团队作业闭环')
+const mk = async (name, harness) => (await api('/api/workshop/agents', { method: 'POST', body: JSON.stringify({ name, harness, visibility: 'private' }) }, adminTok)).body?.data
+const leadTpl = await mk(`fin-lead-${stamp}`, 'omp')
+const wMock = await mk(`fin-w-mock-${stamp}`, 'mock')
+const wCodex = await mk(`fin-w-codex-${stamp}`, 'codex')
+ok('3 个 Agent 模板(omp/mock/codex)', Boolean(leadTpl && wMock && wCodex))
+const team = (await api('/api/workshop/teams', { method: 'POST', body: JSON.stringify({ name: `验收团队-${stamp}` }) }, adminTok)).body?.data
+ok('AgentTeam 创建', Boolean(team?.id))
+for (const [tpl, role] of [[leadTpl, 'lead'], [wMock, 'worker'], [wCodex, 'worker']]) {
+  const r = await api(`/api/workshop/teams/${team.id}/members`, { method: 'POST', body: JSON.stringify({ agentId: tpl.id, role }) }, adminTok)
+  ok(`成员入队 ${role}`, r.body?.code === 0)
+}
+const ch = (await api('/api/workshop/channels', { method: 'POST', body: JSON.stringify({ name: `验收频道-${stamp}` }) }, adminTok)).body?.data
+const channelId = ch?.channelId
+ok('Channel 创建', Boolean(channelId))
+const dep = (await api(`/api/workshop/teams/${team.id}/deploy`, { method: 'POST', body: JSON.stringify({ channelId }) }, adminTok)).body?.data
+ok('Team 部署到 Channel(3 实例)', dep?.agents?.length === 3, JSON.stringify(dep?.agents?.map(a => a.harness)))
+const ags = (await api(`/api/workshop/channels/${channelId}/agents`, {}, adminTok)).body?.data
+const leadInst = ags.find(a => a.harness === 'omp')
+ok('lead 实例(omp)就位', Boolean(leadInst))
+
+// 绑定:mock worker↔daq 节点,codex worker↔写控节点
+const dq1 = daq.nodes.find(n => n.lineId === line1?.id)
+const b1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: ags.find(a => a.harness === 'mock').id, nodeId: dq1.id, kind: 'daq', mode: 'auto' }) }, adminTok)
+ok('绑定 Agent↔数采节点', b1.body?.code === 0)
+const b2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: ags.find(a => a.harness === 'codex').id, nodeId: wNode.id, kind: 'dcw', mode: 'auto' }) }, adminTok)
+ok('绑定 Agent↔写控节点', b2.body?.code === 0)
+const bl = (await api('/api/workshop/agent-tools/bindings', {}, adminTok)).body?.data?.bindings ?? []
+ok(`绑定清单落盘(${bl.length} 条)`, bl.length >= 2)
+
+// 团队作业闭环:human → lead 派发 → workers 回复
+const msg = await api(`/api/workshop/channels/${channelId}/messages`, { method: 'POST', body: JSON.stringify({
+  toAgentId: leadInst.id,
+  text: '团队闭环自检:请把这句话转交每个 worker 执行——「用一句不超过 15 字的话报告你的引擎名并说 ok,不要调用任何工具」。收齐后向人类汇总。',
+  fromLabel: 'admin', priority: 'task',
+}) }, adminTok)
+ok('任务下发 lead', msg.body?.code === 0)
+console.log('等待团队闭环(lead 派发→worker 回复→lead 汇总,轮询 150s)...')
+let leadReplied = false, mockReplied = false, codexReplied = false
+let summarySeen = false
+for (let i = 0; i < 50; i++) {
+  await new Promise(r => setTimeout(r, 3000))
+  const ms = (await api(`/api/workshop/channels/${channelId}/messages?limit=60`, {}, adminTok)).body?.data ?? []
+  const timeline = (await api(`/api/workshop/channels/${channelId}/events?limit=100`, {}, adminTok)).body?.data ?? []
+  const all = []
+  for (const m of (Array.isArray(ms) ? ms : [])) {
+    all.push({ from: m.fromAgentId, to: m.toAgentId, text: (m.parts ?? []).map(p => p.text ?? '').join(' ') })
+  }
+  for (const ev of (Array.isArray(timeline) ? timeline : [])) {
+    const t = JSON.stringify(ev)
+    if (t.includes('codex') && t.includes('ok')) codexReplied = codexReplied || /引擎.*ok|ok/i.test(t)
+  }
+  for (const a of all) {
+    if (a.from === ags.find(x => x.harness === 'mock').id) mockReplied = true
+    if (a.from === ags.find(x => x.harness === 'codex').id) codexReplied = true
+    if (a.from === leadInst.id && /汇总|汇总完成|报告|ok/i.test(a.text)) leadReplied = true
+    if (/汇总/.test(a.text) && a.from === leadInst.id) summarySeen = true
+  }
+  process.stdout.write(`  t=${(i + 1) * 3}s mock=${mockReplied ? 'Y' : 'n'} codex=${codexReplied ? 'Y' : 'n'} lead汇总=${summarySeen ? 'Y' : 'n'}\r`)
+  if (mockReplied && codexReplied && summarySeen) break
+}
+console.log('')
+ok('worker(mock) 回复', mockReplied)
+ok('worker(codex) 回复', codexReplied)
+ok('lead 汇总闭环', summarySeen || leadReplied)
+
+// ===== 5. 权限回归 =====
+sec('权限(回归)')
+const ov = (await api('/api/workshop/permissions', {}, adminTok)).body?.data
+ok('权限总览(权限管理页数据源)', ov?.lines?.length > 0 && ov?.users?.length > 0, `lines=${ov?.lines?.length} users=${ov?.users?.length}`)
+const adminRow = ov.users.find(u => u.role === 'admin')
+ok(`admin 用户 channels 数(${adminRow?.channels?.length})在总览可见`, (adminRow?.channels?.length ?? 0) >= 1)
+
+console.log(`\n===== 全功能测试: ${pass} 通过 / ${fail} 失败 =====`)
+console.log('CHANNEL_ID=' + channelId)
+process.exit(fail > 0 ? 1 : 0)

package/scripts/_dbg-final-fixups.mjs

@@ -0,0 +1,62 @@
+// 最终验收·补测:产线开跑完整链路(产品→配方→start→stop)+ 团队 events 断言 + 计数器核对
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3001'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+const CHANNEL_ID = process.argv[4]
+let pass = 0, fail = 0
+const ok = (name, cond, detail = '') => { cond ? pass++ : fail++; console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`) }
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data
+const line2 = dcw.lines[1]
+ok('目标产线(第2条)', Boolean(line2), line2?.id)
+
+// 1) 产品挂产线2
+const prod = (await api('/api/workshop/dcw/products', { method: 'POST', body: JSON.stringify({ name: '验收产品', lineId: line2.id }) }, adminTok)).body?.data?.product
+ok('产品创建并挂产线', Boolean(prod?.id) && prod?.lineId === line2.id, prod?.id)
+
+// 2) 配方挂产品,参数指向该线写控节点(mock)
+const wNode = dcw.nodes.find(n => n.lineId === line2.id && n.driver === 'mock')
+ok('产线2 mock 写控节点', Boolean(wNode), wNode?.id)
+const target = Math.round(((wNode.min ?? 150) + (wNode.max ?? 200)) / 2)
+const recipe = (await api('/api/workshop/dcw/recipes', { method: 'POST', body: JSON.stringify({
+  name: '验收配方', productId: prod.id,
+  params: [{ nodeId: wNode.id, name: wNode.name, value: target, ch: wNode.templateKey }],
+}) }, adminTok)).body?.data?.recipe
+ok('配方创建(含工艺参数)', Boolean(recipe?.id), recipe?.id)
+
+// 3) 开跑(配方参数 → 真实写 PLC 闭环)
+const rStart = await api(`/api/workshop/dcw/lines/${line2.id}/start`, { method: 'POST', body: JSON.stringify({ recipeId: recipe.id }) }, adminTok)
+ok('产线开跑(配方参数下发写控)', rStart.status === 200 && rStart.body?.data?.run != null, JSON.stringify(rStart.body?.data?.run ?? rStart.body?.message).slice(0, 80))
+const activeRun = rStart.body?.data?.run?.id
+// 采样打标窗口生效验证:数采样本应携带 run 标记(tsdb/历史入口)
+await new Promise(r => setTimeout(r, 4000))
+// 4) 停止
+const rStop = await api(`/api/workshop/dcw/lines/${line2.id}/stop`, { method: 'POST', body: '{}' }, adminTok)
+ok('产线停止', rStop.status === 200)
+// 5) 批次数据视图(窗口内写历史+数采汇总)
+const rd = await api(`/api/workshop/dcw/runs/${activeRun}/data`, {}, adminTok)
+ok('批次数据视图(开跑→停止 闭环产物)', rd.status === 200 && rd.body?.data?.run?.id === activeRun, `writes=${rd.body?.data?.writes?.length} daq=${rd.body?.data?.daq?.length}`)
+
+// 6) 团队闭环 events 断言(codex 回复落 artifact/delta)
+if (CHANNEL_ID) {
+  const evs = (await api(`/api/workshop/channels/${CHANNEL_ID}/events?limit=200`, {}, adminTok)).body?.data ?? []
+  const list = Array.isArray(evs) ? evs : (evs.items ?? [])
+  const kinds = {}
+  for (const e of list) kinds[e.type ?? '?'] = (kinds[e.type ?? '?'] ?? 0) + 1
+  const codexOk = list.some(e => e.type === 'agent.delta' && /codex ok/i.test(JSON.stringify(e.delta ?? e)))
+    || list.some(e => e.type === 'a2a.artifact' && /codex ok/i.test(JSON.stringify(e)))
+  ok('worker(codex) 回复(agent.delta/a2a.artifact)', codexOk, JSON.stringify(kinds))
+  const mockOk = list.some(e => (e.type === 'a2a.message' || e.type === 'agent.delta') && /mock/i.test(JSON.stringify(e)))
+  ok('worker(mock) 回复可见', mockOk)
+}
+
+// 7) controller 计数字段核对(信息性)
+const ctrl = (await api('/api/workshop/daq', {}, adminTok)).body?.data?.controller
+console.log('controller 全量计数:', JSON.stringify(ctrl))
+
+console.log(`\n===== 补测: ${pass} 通过 / ${fail} 失败 =====`)
+process.exit(fail > 0 ? 1 : 0)