agentworkshop 0.7.9 → 0.7.12

package/scripts/_dbg-final-features.mjs

@@ -0,0 +1,155 @@
+// ============================================================
+// 最终验收·全功能测试(home 生产实例):Channel/Team/产线/数采/写控/绑定/权限
+// 用法:node scripts/_dbg-final-features.mjs <base> <adminPass>
+// ============================================================
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3001'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let pass = 0, fail = 0
+const sections = []
+let section = 'START'
+const sec = (name) => { section = name; console.log(`\n── ${name} ──`) }
+const ok = (name, cond, detail = '') => {
+  cond ? pass++ : fail++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  sections.push({ section, name, ok: cond, detail })
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const stamp = Date.now().toString(36)
+
+// ===== 1. 基础面 =====
+sec('基础面')
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+ok('admin 登录', Boolean(adminTok))
+const me = await api('/api/users/me', {}, adminTok)
+ok('/me 返回 admin', me.body?.data?.role === 'admin')
+const health = await api('/api/health')
+ok('/api/health 存活', health.status === 200)
+const ss = await api('/api/users/setup-status')
+ok('setup 已收敛(false)', ss.body?.data?.needsSetup === false)
+
+// ===== 2. 产线管理与写控 =====
+sec('产线管理与写控(DCW)')
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data
+ok('dcw 网关运行', dcw?.controller?.running === true)
+ok(`写控节点在线 ${dcw?.controller?.nodesOnline}/${dcw?.controller?.nodesTotal}`, dcw?.controller?.nodesOnline > 0)
+ok(`产线 ${dcw?.lines?.length} 条可见`, dcw?.lines?.length > 0)
+const line1 = dcw.lines[0]
+const line2 = dcw.lines[1]
+ok('目标产线定位(前两条)', Boolean(line1 && line2), `${line1?.id} ${line2?.id}`)
+// 写控:对 1 号产线的一个 mock 写控节点下发设定值并回读
+const wNode = dcw.nodes.find(n => n.lineId === line1?.id && n.driver === 'mock')
+ok('1号产线 mock 写控节点', Boolean(wNode), wNode?.id)
+if (wNode) {
+  const target = Math.round(((wNode.min ?? 150) + (wNode.max ?? 200)) / 2)
+  const wr = await api(`/api/workshop/dcw/${wNode.id}/write`, { method: 'POST', body: JSON.stringify({ value: target }) }, adminTok)
+  ok(`写控下发 ${target} 并 ACK 回读一致`, wr.status === 200 && wr.body?.data?.outcome?.ok === true, String(wr.body?.data?.outcome?.message ?? '').slice(0, 60))
+}
+// 产线开跑/停止(2号产线,含配方下发闭环)
+const rStart = await api(`/api/workshop/dcw/lines/${line2.id}/start`, { method: 'POST', body: JSON.stringify({}) }, adminTok)
+ok('2号产线开跑(lineStart)', rStart.status === 200 && rStart.body?.data?.run != null, `run=${rStart.body?.data?.run?.id?.slice(0, 8)}`)
+await new Promise(r => setTimeout(r, 3000))
+const rStop = await api(`/api/workshop/dcw/lines/${line2.id}/stop`, { method: 'POST', body: '{}' }, adminTok)
+ok('2号产线停止', rStop.status === 200)
+
+// ===== 3. 数据采集(DAQ) =====
+sec('数据采集(DAQ)')
+const daq = (await api('/api/workshop/daq', {}, adminTok)).body?.data
+ok(`数采节点在线 ${daq?.controller?.nodesOnline}/${daq?.controller?.nodesTotal}`, daq?.controller?.nodesOnline > 0)
+ok(`采样管道 produced=${daq?.controller?.produced} consumed=${daq?.controller?.consumed} dropped=${daq?.controller?.dropped}`, daq?.controller?.produced > 0 && daq?.controller?.dropped === 0)
+const liveDaq = daq.nodes.find(n => n.state === 'ok' && n.lineId)
+ok('活采样节点定位', Boolean(liveDaq), `${liveDaq?.id} v=${liveDaq?.value}`)
+if (liveDaq) {
+  const a0 = liveDaq.lastAt
+  await new Promise(r => setTimeout(r, 5000))
+  const daq2 = (await api('/api/workshop/daq', {}, adminTok)).body?.data
+  const n2 = daq2.nodes.find(n => n.id === liveDaq.id)
+  ok('采样节拍推进(lastAt 前进+值变化)', n2.lastAt > a0 || n2.value !== liveDaq.value, `v ${liveDaq.value}→${n2.value}`)
+  const sp = await api(`/api/workshop/daq/${liveDaq.id}/samples?limit=10`, {}, adminTok)
+  ok('时序历史查询(>0 数据点)', sp.status === 200 && (sp.body?.data?.points?.length ?? 0) > 0, `points=${sp.body?.data?.points?.length}`)
+}
+const alarms = await api('/api/workshop/daq/alarms', {}, adminTok)
+ok('告警查询可用', alarms.status === 200)
+
+// ===== 4. Channel + AgentTeamWork + 绑定 + 团队闭环 =====
+sec('Channel / AgentTeam / 绑定 / 团队作业闭环')
+const mk = async (name, harness) => (await api('/api/workshop/agents', { method: 'POST', body: JSON.stringify({ name, harness, visibility: 'private' }) }, adminTok)).body?.data
+const leadTpl = await mk(`fin-lead-${stamp}`, 'omp')
+const wMock = await mk(`fin-w-mock-${stamp}`, 'mock')
+const wCodex = await mk(`fin-w-codex-${stamp}`, 'codex')
+ok('3 个 Agent 模板(omp/mock/codex)', Boolean(leadTpl && wMock && wCodex))
+const team = (await api('/api/workshop/teams', { method: 'POST', body: JSON.stringify({ name: `验收团队-${stamp}` }) }, adminTok)).body?.data
+ok('AgentTeam 创建', Boolean(team?.id))
+for (const [tpl, role] of [[leadTpl, 'lead'], [wMock, 'worker'], [wCodex, 'worker']]) {
+  const r = await api(`/api/workshop/teams/${team.id}/members`, { method: 'POST', body: JSON.stringify({ agentId: tpl.id, role }) }, adminTok)
+  ok(`成员入队 ${role}`, r.body?.code === 0)
+}
+const ch = (await api('/api/workshop/channels', { method: 'POST', body: JSON.stringify({ name: `验收频道-${stamp}` }) }, adminTok)).body?.data
+const channelId = ch?.channelId
+ok('Channel 创建', Boolean(channelId))
+const dep = (await api(`/api/workshop/teams/${team.id}/deploy`, { method: 'POST', body: JSON.stringify({ channelId }) }, adminTok)).body?.data
+ok('Team 部署到 Channel(3 实例)', dep?.agents?.length === 3, JSON.stringify(dep?.agents?.map(a => a.harness)))
+const ags = (await api(`/api/workshop/channels/${channelId}/agents`, {}, adminTok)).body?.data
+const leadInst = ags.find(a => a.harness === 'omp')
+ok('lead 实例(omp)就位', Boolean(leadInst))
+
+// 绑定:mock worker↔daq 节点,codex worker↔写控节点
+const dq1 = daq.nodes.find(n => n.lineId === line1?.id)
+const b1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: ags.find(a => a.harness === 'mock').id, nodeId: dq1.id, kind: 'daq', mode: 'auto' }) }, adminTok)
+ok('绑定 Agent↔数采节点', b1.body?.code === 0)
+const b2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: ags.find(a => a.harness === 'codex').id, nodeId: wNode.id, kind: 'dcw', mode: 'auto' }) }, adminTok)
+ok('绑定 Agent↔写控节点', b2.body?.code === 0)
+const bl = (await api('/api/workshop/agent-tools/bindings', {}, adminTok)).body?.data?.bindings ?? []
+ok(`绑定清单落盘(${bl.length} 条)`, bl.length >= 2)
+
+// 团队作业闭环:human → lead 派发 → workers 回复
+const msg = await api(`/api/workshop/channels/${channelId}/messages`, { method: 'POST', body: JSON.stringify({
+  toAgentId: leadInst.id,
+  text: '团队闭环自检:请把这句话转交每个 worker 执行——「用一句不超过 15 字的话报告你的引擎名并说 ok,不要调用任何工具」。收齐后向人类汇总。',
+  fromLabel: 'admin', priority: 'task',
+}) }, adminTok)
+ok('任务下发 lead', msg.body?.code === 0)
+console.log('等待团队闭环(lead 派发→worker 回复→lead 汇总,轮询 150s)...')
+let leadReplied = false, mockReplied = false, codexReplied = false
+let summarySeen = false
+for (let i = 0; i < 50; i++) {
+  await new Promise(r => setTimeout(r, 3000))
+  const ms = (await api(`/api/workshop/channels/${channelId}/messages?limit=60`, {}, adminTok)).body?.data ?? []
+  const timeline = (await api(`/api/workshop/channels/${channelId}/events?limit=100`, {}, adminTok)).body?.data ?? []
+  const all = []
+  for (const m of (Array.isArray(ms) ? ms : [])) {
+    all.push({ from: m.fromAgentId, to: m.toAgentId, text: (m.parts ?? []).map(p => p.text ?? '').join(' ') })
+  }
+  for (const ev of (Array.isArray(timeline) ? timeline : [])) {
+    const t = JSON.stringify(ev)
+    if (t.includes('codex') && t.includes('ok')) codexReplied = codexReplied || /引擎.*ok|ok/i.test(t)
+  }
+  for (const a of all) {
+    if (a.from === ags.find(x => x.harness === 'mock').id) mockReplied = true
+    if (a.from === ags.find(x => x.harness === 'codex').id) codexReplied = true
+    if (a.from === leadInst.id && /汇总|汇总完成|报告|ok/i.test(a.text)) leadReplied = true
+    if (/汇总/.test(a.text) && a.from === leadInst.id) summarySeen = true
+  }
+  process.stdout.write(`  t=${(i + 1) * 3}s mock=${mockReplied ? 'Y' : 'n'} codex=${codexReplied ? 'Y' : 'n'} lead汇总=${summarySeen ? 'Y' : 'n'}\r`)
+  if (mockReplied && codexReplied && summarySeen) break
+}
+console.log('')
+ok('worker(mock) 回复', mockReplied)
+ok('worker(codex) 回复', codexReplied)
+ok('lead 汇总闭环', summarySeen || leadReplied)
+
+// ===== 5. 权限回归 =====
+sec('权限(回归)')
+const ov = (await api('/api/workshop/permissions', {}, adminTok)).body?.data
+ok('权限总览(权限管理页数据源)', ov?.lines?.length > 0 && ov?.users?.length > 0, `lines=${ov?.lines?.length} users=${ov?.users?.length}`)
+const adminRow = ov.users.find(u => u.role === 'admin')
+ok(`admin 用户 channels 数(${adminRow?.channels?.length})在总览可见`, (adminRow?.channels?.length ?? 0) >= 1)
+
+console.log(`\n===== 全功能测试: ${pass} 通过 / ${fail} 失败 =====`)
+console.log('CHANNEL_ID=' + channelId)
+process.exit(fail > 0 ? 1 : 0)

package/scripts/_dbg-final-fixups.mjs

@@ -0,0 +1,62 @@
+// 最终验收·补测:产线开跑完整链路(产品→配方→start→stop)+ 团队 events 断言 + 计数器核对
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3001'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+const CHANNEL_ID = process.argv[4]
+let pass = 0, fail = 0
+const ok = (name, cond, detail = '') => { cond ? pass++ : fail++; console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`) }
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, { ...opts, headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers } })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const adminTok = (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email: 'admin@awshop.local', password: ADMIN_PASS }) })).body?.data?.token
+
+const dcw = (await api('/api/workshop/dcw', {}, adminTok)).body?.data
+const line2 = dcw.lines[1]
+ok('目标产线(第2条)', Boolean(line2), line2?.id)
+
+// 1) 产品挂产线2
+const prod = (await api('/api/workshop/dcw/products', { method: 'POST', body: JSON.stringify({ name: '验收产品', lineId: line2.id }) }, adminTok)).body?.data?.product
+ok('产品创建并挂产线', Boolean(prod?.id) && prod?.lineId === line2.id, prod?.id)
+
+// 2) 配方挂产品,参数指向该线写控节点(mock)
+const wNode = dcw.nodes.find(n => n.lineId === line2.id && n.driver === 'mock')
+ok('产线2 mock 写控节点', Boolean(wNode), wNode?.id)
+const target = Math.round(((wNode.min ?? 150) + (wNode.max ?? 200)) / 2)
+const recipe = (await api('/api/workshop/dcw/recipes', { method: 'POST', body: JSON.stringify({
+  name: '验收配方', productId: prod.id,
+  params: [{ nodeId: wNode.id, name: wNode.name, value: target, ch: wNode.templateKey }],
+}) }, adminTok)).body?.data?.recipe
+ok('配方创建(含工艺参数)', Boolean(recipe?.id), recipe?.id)
+
+// 3) 开跑(配方参数 → 真实写 PLC 闭环)
+const rStart = await api(`/api/workshop/dcw/lines/${line2.id}/start`, { method: 'POST', body: JSON.stringify({ recipeId: recipe.id }) }, adminTok)
+ok('产线开跑(配方参数下发写控)', rStart.status === 200 && rStart.body?.data?.run != null, JSON.stringify(rStart.body?.data?.run ?? rStart.body?.message).slice(0, 80))
+const activeRun = rStart.body?.data?.run?.id
+// 采样打标窗口生效验证:数采样本应携带 run 标记(tsdb/历史入口)
+await new Promise(r => setTimeout(r, 4000))
+// 4) 停止
+const rStop = await api(`/api/workshop/dcw/lines/${line2.id}/stop`, { method: 'POST', body: '{}' }, adminTok)
+ok('产线停止', rStop.status === 200)
+// 5) 批次数据视图(窗口内写历史+数采汇总)
+const rd = await api(`/api/workshop/dcw/runs/${activeRun}/data`, {}, adminTok)
+ok('批次数据视图(开跑→停止 闭环产物)', rd.status === 200 && rd.body?.data?.run?.id === activeRun, `writes=${rd.body?.data?.writes?.length} daq=${rd.body?.data?.daq?.length}`)
+
+// 6) 团队闭环 events 断言(codex 回复落 artifact/delta)
+if (CHANNEL_ID) {
+  const evs = (await api(`/api/workshop/channels/${CHANNEL_ID}/events?limit=200`, {}, adminTok)).body?.data ?? []
+  const list = Array.isArray(evs) ? evs : (evs.items ?? [])
+  const kinds = {}
+  for (const e of list) kinds[e.type ?? '?'] = (kinds[e.type ?? '?'] ?? 0) + 1
+  const codexOk = list.some(e => e.type === 'agent.delta' && /codex ok/i.test(JSON.stringify(e.delta ?? e)))
+    || list.some(e => e.type === 'a2a.artifact' && /codex ok/i.test(JSON.stringify(e)))
+  ok('worker(codex) 回复(agent.delta/a2a.artifact)', codexOk, JSON.stringify(kinds))
+  const mockOk = list.some(e => (e.type === 'a2a.message' || e.type === 'agent.delta') && /mock/i.test(JSON.stringify(e)))
+  ok('worker(mock) 回复可见', mockOk)
+}
+
+// 7) controller 计数字段核对(信息性)
+const ctrl = (await api('/api/workshop/daq', {}, adminTok)).body?.data?.controller
+console.log('controller 全量计数:', JSON.stringify(ctrl))
+
+console.log(`\n===== 补测: ${pass} 通过 / ${fail} 失败 =====`)
+process.exit(fail > 0 ? 1 : 0)

package/scripts/_dbg-final-visual.mjs

@@ -0,0 +1,29 @@
+// home 生产实例:workspace 会话页 + permissions + town 截图
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3001'
+const CHANNEL_ID = process.argv[2] ?? '8515751a-e250-4d53-9f5b-97ed8c48e7a9'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+const api = async (p, opts) => fetch(`${BASE}${p}`, { ...opts, headers: { authorization: `Bearer ${login.data.token}`, ...(opts?.headers ?? {}) } }).then(r => r.json())
+let wsId = (await api('/api/workshop/workspaces')).data?.[0]?.id
+if (!wsId) {
+  const created = await api('/api/workshop/workspaces', { method: 'POST', body: JSON.stringify({ name: '验收空间' }) })
+  wsId = created.data.id
+  await api(`/api/workshop/workspaces/${wsId}/channels/${CHANNEL_ID}`, { method: 'POST' })
+}
+await page.goto(`${BASE}/workshop/w/${wsId}`, { waitUntil: 'networkidle2', timeout: 90000 })
+await new Promise(r => setTimeout(r, 6000))
+await page.screenshot({ path: '.e2e-shots/final-workshop-channel.png' })
+console.log('📷 workshop-channel')
+await page.goto(`${BASE}/permissions`, { waitUntil: 'networkidle2', timeout: 60000 })
+await new Promise(r => setTimeout(r, 2500))
+await page.screenshot({ path: '.e2e-shots/final-permissions.png' })
+console.log('📷 permissions')
+await page.goto(`${BASE}/town`, { waitUntil: 'domcontentloaded', timeout: 60000 })
+await new Promise(r => setTimeout(r, 14000))
+await page.screenshot({ path: '.e2e-shots/final-town.png' })
+console.log('📷 town')
+await browser.close()

package/scripts/_dbg-kicker-check.mjs

@@ -0,0 +1,11 @@
+import puppeteer from 'puppeteer-core'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--no-proxy-server'] })
+const page = await browser.newPage()
+const login = await fetch('http://127.0.0.1:3001/api/users/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto('http://127.0.0.1:3001/tokens', { waitUntil: 'networkidle2' })
+await new Promise(r => setTimeout(r, 2000))
+console.log('kicker count:', await page.evaluate(() => document.querySelectorAll('.aw-kicker').length))
+console.log('kicker texts:', await page.evaluate(() => [...document.querySelectorAll('.aw-kicker')].map(e => e.textContent.trim()).join(' | ')))
+console.log('tokens h2:', await page.evaluate(() => [...document.querySelectorAll('h2')].map(e => e.textContent.trim()).join(' | ')))
+await browser.close()

package/scripts/_dbg-perms-e2e.mjs

@@ -0,0 +1,102 @@
+// ============================================================
+// 产线权限 E2E:_dbg-perms-e2e.mjs <base> <adminPass>
+// 链路:admin 总览 → 建 plain 用户 → 默认全无权 → admin 授
+// 产线1=readonly / 产线2=operate → 可见性/写控/绑定逐项断言。
+// ============================================================
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let step = 0
+const ok = (name, cond, detail = '') => {
+  step++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!cond) process.exitCode = 1
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = async (email, password) => (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email, password }) })).body?.data?.token
+
+// ---- admin 登录 + 总览 ----
+const adminTok = await login('admin@awshop.local', ADMIN_PASS)
+ok('admin 登录', Boolean(adminTok))
+const ov = await api('/api/workshop/permissions', {}, adminTok)
+ok('admin 权限总览(lines+users)', ov.status === 200 && ov.body?.data?.lines?.length > 0 && ov.body?.data?.users?.length > 0, `lines=${ov.body?.data?.lines?.length} users=${ov.body?.data?.users?.length}`)
+const LINE1 = ov.body.data.lines[0]?.id
+const LINE2 = ov.body.data.lines[1]?.id
+ok('找到两条目标产线', Boolean(LINE1 && LINE2), `${LINE1} / ${LINE2}`)
+
+// ---- plain 用户(注册即 user 角色) ----
+const stamp = Date.now().toString(36)
+const plain = { name: `p-${stamp}`, email: `p-${stamp}@awshop.local`, password: 'Plain2026' }
+const reg = await api('/api/users/register', { method: 'POST', body: JSON.stringify(plain) })
+const plainTok = reg.body?.data?.token
+ok('plain 用户注册(user 角色)', reg.body?.data?.user?.role === 'user')
+
+// ---- 授权前:全无权 ----
+const d0 = await api('/api/workshop/dcw', {}, plainTok)
+const q0 = await api('/api/workshop/daq', {}, plainTok)
+ok('默认 dcw 产线不可见', d0.body?.data?.lines?.length === 0, `lines=${d0.body?.data?.lines?.length}`)
+ok('默认 dcw 节点不可见', d0.body?.data?.nodes?.length === 0, `nodes=${d0.body?.data?.nodes?.length}`)
+ok('默认 daq 节点不可见', q0.body?.data?.nodes?.length === 0, `nodes=${q0.body?.data?.nodes?.length}`)
+
+// ---- admin 授权:产线1=readonly, 产线2=operate ----
+const ov2 = await api('/api/workshop/permissions', {}, adminTok)
+const plainId = ov2.body.data.users.find(u => u.email === plain.email)?.id
+ok('总览含 plain 用户及其空 channels', Boolean(plainId))
+const put = await api('/api/workshop/permissions', { method: 'PUT', body: JSON.stringify({ userId: plainId, grants: [{ lineId: LINE1, mode: 'readonly' }, { lineId: LINE2, mode: 'operate' }] }) }, adminTok)
+ok('admin 批量授权(readonly+operate)', put.body?.data?.grants?.length === 2, JSON.stringify(put.body?.data?.grants?.map(g => `${g.lineId.slice(0, 6)}:${g.mode}`)))
+
+// ---- 授权后:仅授权产线可见 ----
+const d1 = await api('/api/workshop/dcw', {}, plainTok)
+const q1 = await api('/api/workshop/daq', {}, plainTok)
+const visLines = (d1.body?.data?.lines ?? []).map(l => l.id)
+ok('dcw 仅见 2 条授权产线', visLines.length === 2 && visLines.includes(LINE1) && visLines.includes(LINE2), visLines.join(','))
+ok('daq 仅含授权产线节点', (q1.body?.data?.nodes ?? []).length > 0 && (q1.body?.data?.nodes ?? []).every(n => [LINE1, LINE2].includes(n.lineId)), `nodes=${q1.body?.data?.nodes?.length}`)
+
+// 找两线的写控节点
+const dcwNodes = d1.body.data.nodes
+const w1 = dcwNodes.find(n => n.lineId === LINE1)
+const w2 = dcwNodes.find(n => n.lineId === LINE2) ?? dcwNodes.find(n => n.lineId === LINE2)
+ok('两线均有可见写控节点', Boolean(w1 && w2), `${w1?.id} / ${w2?.id}`)
+
+// ---- 写控校验 ----
+const wr1 = await api(`/api/workshop/dcw/${w1.id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+ok('readonly 产线写控被拒(403 人话)', wr1.status === 403 && /仅查看/.test(wr1.body?.message ?? ''), wr1.body?.message)
+const wr2 = await api(`/api/workshop/dcw/${w2.id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+ok('operate 产线写控放行', wr2.status === 200 && wr2.body?.data?.outcome != null, `ack=${JSON.stringify(wr2.body?.data?.outcome)?.slice(0, 60)}`)
+
+// ---- 绑定校验(daq 需 readonly+,dcw 需 operate) ----
+const daqNodes = q1.body.data.nodes
+const dq1 = daqNodes.find(n => n.lineId === LINE1)
+const bindD = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: dq1.id, kind: 'daq' }) }, plainTok)
+ok('绑定 daq 节点(readonly 线)放行', bindD.status === 200, JSON.stringify(bindD.body?.message ?? ''))
+const bindW1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w1.id, kind: 'dcw' }) }, plainTok)
+ok('绑定 dcw 节点(readonly 线)被拒', bindW1.status === 403, bindW1.body?.message)
+const bindW2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w2.id, kind: 'dcw' }) }, plainTok)
+ok('绑定 dcw 节点(operate 线)放行', bindW2.status === 200)
+
+// ---- 越权访问无权产线节点(直接按 id 打,数据面不因列表隐藏而放行) ----
+const other = ov.body.data.lines.find(l => l.id !== LINE1 && l.id !== LINE2)
+if (other) {
+  const otherNodes = (await api('/api/workshop/dcw', {}, adminTok)).body.data.nodes.filter(n => n.lineId === other.id)
+  if (otherNodes.length) {
+    const wOther = await api(`/api/workshop/dcw/${otherNodes[0].id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+    ok('直接写无权产线节点被拒(403)', wOther.status === 403, wOther.body?.message)
+  }
+}
+
+// ---- 撤销产线1 → 立即不可见 ----
+const revoke = await api('/api/workshop/permissions', { method: 'PUT', body: JSON.stringify({ userId: plainId, grants: [{ lineId: LINE1, mode: null }] }) }, adminTok)
+ok('撤销产线1授权', revoke.status === 200 && revoke.body.data.grants.length === 1)
+const d2 = await api('/api/workshop/dcw', {}, plainTok)
+ok('撤销后产线1不可见', !(d2.body?.data?.lines ?? []).some(l => l.id === LINE1), `lines=${(d2.body?.data?.lines ?? []).map(l => l.id.slice(0, 6))}`)
+
+// ---- 非 admin 不能用管理面 ----
+const forbidden = await api('/api/workshop/permissions', {}, plainTok)
+ok('plain 访问权限管理面被拒(403)', forbidden.status === 403)
+
+console.log(`\n===== permissions E2E: ${step} 项 =====`)

package/scripts/_dbg-perms-visual.mjs

@@ -0,0 +1,36 @@
+// 权限页浏览器目视:admin 管理矩阵 + plain 用户受限视图
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3021'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+
+const loginTok = async (email, password) => (await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email, password }) }).then(r => r.json())).data?.token
+
+const shoot = async (path, name, token, wait = 3500) => {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.setCookie({ name: 'token', value: token, domain: '127.0.0.1', path: '/' })
+  await page.goto(`${BASE}${path}`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await new Promise(r => setTimeout(r, wait))
+  await page.screenshot({ path: `.e2e-shots/perm-${name}.png` })
+  console.log(`📷 perm-${name}`)
+  await page.close()
+}
+
+// 1) admin:权限管理页
+const adminTok = await loginTok('admin@awshop.local', 'admin123')
+await shoot('/permissions', 'admin-page', adminTok)
+
+// 2) plain 用户(产线2=operate 授权还在):侧栏无权限管理入口 + /dcw 仅见授权产线
+// 取 E2E 里那个 plain(重新注册一个新的拿授权?简化:直接注册 per-shot 用户并经 API 给产线2 operate)
+const ov = await fetch(`${BASE}/api/workshop/permissions`, { headers: { authorization: `Bearer ${adminTok}` } }).then(r => r.json())
+const stamp = Date.now().toString(36)
+const pu = { name: `v-${stamp}`, email: `v-${stamp}@awshop.local`, password: 'Plain2026' }
+const reg = await fetch(`${BASE}/api/users/register`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(pu) }).then(r => r.json())
+const plainTok = reg.data.token
+const uid = (await fetch(`${BASE}/api/workshop/permissions`, { headers: { authorization: `Bearer ${plainTok}` } }).then(r => r.json())).status // 403 expected
+console.log('plain 拉管理面:', uid === 403 ? '403 ✔' : `异常 ${uid}`)
+const pid = ov.data.users.find(u => u.email === pu.email)?.id
+await fetch(`${BASE}/api/workshop/permissions`, { method: 'PUT', headers: { authorization: `Bearer ${adminTok}`, 'content-type': 'application/json' }, body: JSON.stringify({ userId: pid, grants: [{ lineId: ov.data.lines.find(l => l.name.includes('2号')).id, mode: 'operate' }] }) })
+await shoot('/dcw', 'plain-dcw', plainTok)
+await shoot('/daq', 'plain-daq', plainTok)
+await browser.close()

package/scripts/_dbg-plugins-e2e.mjs

@@ -8,7 +8,7 @@ import puppeteer from 'puppeteer-core'
 import { mkdirSync } from 'node:fs'
 
 const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
-const ADMIN = { email: 'admin@awshop.local', password: 'Awshop2026' }
+const ADMIN = { email: 'admin@awshop.local', password: process.argv[3] ?? 'admin123' }
 const PLAIN = { name: `plain-${Date.now().toString(36)}`, email: `plain-${Date.now().toString(36)}@awshop.local`, password: 'Plain2026' }
 const SHOT_DIR = '.e2e-shots'
 mkdirSync(SHOT_DIR, { recursive: true })

package/scripts/_dbg-protocol-matrix.mjs

@@ -161,6 +161,22 @@ async function main() {
   const line = (await api('POST', '/api/workshop/dcw/lines', { body: { name: `全协议产线-${TAG}` }, token })).data?.line
   check('0.1', '建产线', Boolean(line?.id))
 
+  // ── 0.2 产线级权限(新版权限模型:普通用户默认无权,admin 逐线授 operate) ──
+  const ADMIN_PASS = process.env.AW_ADMIN_PASS ?? 'admin123'
+  const adminLogin = await api('POST', '/api/users/login', {
+    body: { email: 'admin@awshop.local', password: ADMIN_PASS },
+  }).catch(() => null)
+  const adminTok = adminLogin?.data?.token
+  if (adminTok) {
+    const granted = await api('PUT', '/api/workshop/permissions', {
+      body: { userId: reg.data?.user?.id, grants: [{ lineId: line.id, mode: 'operate' }] }, token: adminTok,
+    }).catch(() => null)
+    check('0.2', 'admin 授予测试用户产线 operate 权限', Boolean(granted?.data?.userId), granted?.message ?? '')
+  }
+  else {
+    console.log('  [skip] admin 登录失败(可设 AW_ADMIN_PASS),以普通用户无权态继续(写入段将按权限模型拒绝)')
+  }
+
   // ── 1. DAQ 五协议节点(配置连接 + 连接测试) ──
   const daqDefs = [
     { id: 'mqtt', driver: 'mqtt', templateRef: 'daq-temp-tc', name: `MQTT温度-${TAG}`, expect: [30, 75],

package/scripts/_dbg-swatch-check.mjs

@@ -0,0 +1,10 @@
+import puppeteer from 'puppeteer-core'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--no-proxy-server'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch('http://127.0.0.1:3001/api/users/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+await page.goto('http://127.0.0.1:3001/settings', { waitUntil: 'networkidle2' })
+await new Promise(r => setTimeout(r, 2000))
+console.log('swatch labels:', await page.evaluate(() => [...document.querySelectorAll('.swatch-label')].map(e => e.textContent.trim()).join(' | ')))
+await browser.close()

package/scripts/_dbg-ui-shots.mjs

@@ -0,0 +1,28 @@
+// 全页面基线/对比截图
+import puppeteer from 'puppeteer-core'
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3001'
+const TAG = process.argv[3] ?? 'base'
+const PAGES = [
+  ['dashboard', '/'],
+  ['workshop', '/workshop'],
+  ['daq', '/daq'],
+  ['dcw', '/dcw'],
+  ['tokens', '/tokens'],
+  ['permissions', '/permissions'],
+  ['plugins', '/plugins'],
+  ['logs', '/logs'],
+  ['monitor', '/monitor'],
+  ['settings', '/settings'],
+]
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: new URL(BASE).hostname, path: '/' })
+for (const [name, path] of PAGES) {
+  await page.goto(`${BASE}${path}`, { waitUntil: 'networkidle2', timeout: 60000 }).catch(() => {})
+  await new Promise(r => setTimeout(r, 2500))
+  await page.screenshot({ path: `.e2e-shots/ui-${TAG}-${name}.png` })
+  console.log(`📷 ${TAG}-${name}`)
+}
+await browser.close()