agentworkshop 0.8.2 → 0.8.4

package/server/middleware/01-rate-guard.ts

@@ -1,101 +1,101 @@
-/**
- * HTTP 防护门(公网部署基线)——单中间件四件事,内存滑窗,无外部依赖:
- * 1. User-Agent 黑名单:默认拦常见扫描器(sqlmap/nikto/nuclei…),AW_UA_BLOCKLIST 可追加(正则段,| 分隔)
- * 2. 请求体上限:Content-Length 超限 413(AW_BODY_LIMIT_MB,默认 64MB)
- * 3. 频率限流:/api 认证面(login/register/mcp/a2a)严限,A其余 API 宽限(AW_RATE_LIMIT_API_PER_MIN,默认 600)
- * 4. 404 扫描封锁:1 分钟内 /api/* 404 超过阈值(AW_SCAN_404_LIMIT,默认 60)→ 封 IP 10 分钟(反爬/反目录爆破)
- * 旁路:AW_RATE_LIMIT_OFF=1 或 AW_BENCH_MODE=1(基准隔离实例)整体停用;
- *      全部状态内存态(重启即清),多实例部署时反代层应另配限流。
- */
-import { defineEventHandler, createError, getRequestIP, getRequestHeaders, getRequestURL } from 'h3'
-
-const g = globalThis as typeof globalThis & {
-  __awRateBuckets?: Map<string, { count: number, reset: number }>
-  __awScanHits?: Map<string, { count: number, reset: number }>
-  __awScanBlocked?: Map<string, number>
-}
-
-const envNum = (v: string | undefined, dflt: number) => {
-  const n = Number(v)
-  return Number.isFinite(n) && n > 0 ? n : dflt
-}
-
-const OFF = process.env.AW_RATE_LIMIT_OFF === '1' || process.env.AW_BENCH_MODE === '1'
-const AUTH_LIMIT = envNum(process.env.AW_RATE_LIMIT_AUTH_PER_MIN, 20)
-const API_LIMIT = envNum(process.env.AW_RATE_LIMIT_API_PER_MIN, 600)
-const SCAN_LIMIT = envNum(process.env.AW_SCAN_404_LIMIT, 60)
-const BODY_LIMIT_MB = envNum(process.env.AW_BODY_LIMIT_MB, 64)
-const BLOCK_MS = 10 * 60_000
-const WINDOW_MS = 60_000
-// 默认 UA 黑名单:公认攻击工具,不含任何浏览器/爬虫正常名(正常搜索引擎爬虫由 robots.txt 约束)
-const UA_RE = new RegExp(process.env.AW_UA_BLOCKLIST
-  || 'sqlmap|nikto|nuclei|masscan|zgrab|dirbuster|gobuster|wfuzz|ffuf|hydra|acunetix|nessus|arachni', 'i')
-
-/** 认证/敏感面(严限):登录、注册、MCP、A2A */
-function isAuthFace(pathname: string): boolean {
-  return pathname.startsWith('/api/users/login')
-    || pathname.startsWith('/api/users/register')
-    || pathname.startsWith('/api/workshop/users/register')
-    || pathname.startsWith('/api/mcp/')
-    || pathname.includes('/a2a/')
-}
-
-function bucketOf(map: Map<string, { count: number, reset: number }>, key: string, limit: number, now: number): number {
-  const b = map.get(key)
-  if (!b || b.reset <= now) {
-    map.set(key, { count: 1, reset: now + WINDOW_MS })
-    return limit - 1
-  }
-  b.count += 1
-  // 可为负:第 N+1 发起 remaining < 0,由调用方判 429(勿钳 0,否则永不触发)
-  return limit - b.count
-}
-
-export default defineEventHandler((event) => {
-  if (OFF) return
-  const url = getRequestURL(event)
-  const path = url.pathname
-  const ip = getRequestIP(event, { xForwardedFor: true }) ?? 'local'
-  const now = Date.now()
-
-  // 已封锁 IP(404 扫描触发):直接 403,不看别的
-  const blockedUntil = g.__awScanBlocked?.get(ip)
-  if (blockedUntil && blockedUntil > now) {
-    throw createError({ statusCode: 403, statusMessage: `IP temporarily blocked (scanning): retry after ${Math.ceil((blockedUntil - now) / 1000)}s` })
-  }
-  if (blockedUntil && g.__awScanBlocked) g.__awScanBlocked.delete(ip)
-
-  // UA 黑名单(全路径,扫描器对静态面也探)
-  const ua = getRequestHeaders(event)['user-agent'] ?? ''
-  if (ua && UA_RE.test(ua)) {
-    throw createError({ statusCode: 403, statusMessage: 'User agent not allowed' })
-  }
-
-  // 请求体上限(带 Content-Length 才拦;chunked 走 nitro 默认)
-  const len = Number(getRequestHeaders(event)['content-length'] ?? 0)
-  if (len > BODY_LIMIT_MB * 1024 * 1024) {
-    throw createError({ statusCode: 413, statusMessage: `Request body too large (limit ${BODY_LIMIT_MB}MB)` })
-  }
-
-  // 只对 /api/* 限流(静态/页面不做)
-  if (path.startsWith('/api/')) {
-    if (!g.__awRateBuckets) g.__awRateBuckets = new Map()
-    const limit = isAuthFace(path) ? AUTH_LIMIT : API_LIMIT
-    const remaining = bucketOf(g.__awRateBuckets, `${ip}|${limit}`, limit, now)
-    if (remaining < 0) {
-      throw createError({ statusCode: 429, statusMessage: 'Too many requests: slow down' })
-    }
-    // 404 扫描计数(res finish 时回填;blocked 判定在下轮请求入口生效)
-    if (!g.__awScanHits) g.__awScanHits = new Map()
-    const res = event.node?.res
-    if (!res) return
-    res.once('finish', () => {
-      if (res.statusCode !== 404) return
-      const hits = bucketOf(g.__awScanHits!, `${ip}`, SCAN_LIMIT, Date.now())
-      if (hits <= 0) {
-        if (!g.__awScanBlocked) g.__awScanBlocked = new Map()
-        g.__awScanBlocked.set(ip, Date.now() + BLOCK_MS)
-      }
-    })
-  }
-})
+/**
+ * HTTP 防护门(公网部署基线)——单中间件四件事,内存滑窗,无外部依赖:
+ * 1. User-Agent 黑名单:默认拦常见扫描器(sqlmap/nikto/nuclei…),AW_UA_BLOCKLIST 可追加(正则段,| 分隔)
+ * 2. 请求体上限:Content-Length 超限 413(AW_BODY_LIMIT_MB,默认 64MB)
+ * 3. 频率限流:/api 认证面(login/register/mcp/a2a)严限,A其余 API 宽限(AW_RATE_LIMIT_API_PER_MIN,默认 600)
+ * 4. 404 扫描封锁:1 分钟内 /api/* 404 超过阈值(AW_SCAN_404_LIMIT,默认 60)→ 封 IP 10 分钟(反爬/反目录爆破)
+ * 旁路:AW_RATE_LIMIT_OFF=1 或 AW_BENCH_MODE=1(基准隔离实例)整体停用;
+ *      全部状态内存态(重启即清),多实例部署时反代层应另配限流。
+ */
+import { defineEventHandler, createError, getRequestIP, getRequestHeaders, getRequestURL } from 'h3'
+
+const g = globalThis as typeof globalThis & {
+  __awRateBuckets?: Map<string, { count: number, reset: number }>
+  __awScanHits?: Map<string, { count: number, reset: number }>
+  __awScanBlocked?: Map<string, number>
+}
+
+const envNum = (v: string | undefined, dflt: number) => {
+  const n = Number(v)
+  return Number.isFinite(n) && n > 0 ? n : dflt
+}
+
+const OFF = process.env.AW_RATE_LIMIT_OFF === '1' || process.env.AW_BENCH_MODE === '1'
+const AUTH_LIMIT = envNum(process.env.AW_RATE_LIMIT_AUTH_PER_MIN, 20)
+const API_LIMIT = envNum(process.env.AW_RATE_LIMIT_API_PER_MIN, 600)
+const SCAN_LIMIT = envNum(process.env.AW_SCAN_404_LIMIT, 60)
+const BODY_LIMIT_MB = envNum(process.env.AW_BODY_LIMIT_MB, 64)
+const BLOCK_MS = 10 * 60_000
+const WINDOW_MS = 60_000
+// 默认 UA 黑名单:公认攻击工具,不含任何浏览器/爬虫正常名(正常搜索引擎爬虫由 robots.txt 约束)
+const UA_RE = new RegExp(process.env.AW_UA_BLOCKLIST
+  || 'sqlmap|nikto|nuclei|masscan|zgrab|dirbuster|gobuster|wfuzz|ffuf|hydra|acunetix|nessus|arachni', 'i')
+
+/** 认证/敏感面(严限):登录、注册、MCP、A2A */
+function isAuthFace(pathname: string): boolean {
+  return pathname.startsWith('/api/users/login')
+    || pathname.startsWith('/api/users/register')
+    || pathname.startsWith('/api/workshop/users/register')
+    || pathname.startsWith('/api/mcp/')
+    || pathname.includes('/a2a/')
+}
+
+function bucketOf(map: Map<string, { count: number, reset: number }>, key: string, limit: number, now: number): number {
+  const b = map.get(key)
+  if (!b || b.reset <= now) {
+    map.set(key, { count: 1, reset: now + WINDOW_MS })
+    return limit - 1
+  }
+  b.count += 1
+  // 可为负:第 N+1 发起 remaining < 0,由调用方判 429(勿钳 0,否则永不触发)
+  return limit - b.count
+}
+
+export default defineEventHandler((event) => {
+  if (OFF) return
+  const url = getRequestURL(event)
+  const path = url.pathname
+  const ip = getRequestIP(event, { xForwardedFor: true }) ?? 'local'
+  const now = Date.now()
+
+  // 已封锁 IP(404 扫描触发):直接 403,不看别的
+  const blockedUntil = g.__awScanBlocked?.get(ip)
+  if (blockedUntil && blockedUntil > now) {
+    throw createError({ statusCode: 403, statusMessage: `IP temporarily blocked (scanning): retry after ${Math.ceil((blockedUntil - now) / 1000)}s` })
+  }
+  if (blockedUntil && g.__awScanBlocked) g.__awScanBlocked.delete(ip)
+
+  // UA 黑名单(全路径,扫描器对静态面也探)
+  const ua = getRequestHeaders(event)['user-agent'] ?? ''
+  if (ua && UA_RE.test(ua)) {
+    throw createError({ statusCode: 403, statusMessage: 'User agent not allowed' })
+  }
+
+  // 请求体上限(带 Content-Length 才拦;chunked 走 nitro 默认)
+  const len = Number(getRequestHeaders(event)['content-length'] ?? 0)
+  if (len > BODY_LIMIT_MB * 1024 * 1024) {
+    throw createError({ statusCode: 413, statusMessage: `Request body too large (limit ${BODY_LIMIT_MB}MB)` })
+  }
+
+  // 只对 /api/* 限流(静态/页面不做)
+  if (path.startsWith('/api/')) {
+    if (!g.__awRateBuckets) g.__awRateBuckets = new Map()
+    const limit = isAuthFace(path) ? AUTH_LIMIT : API_LIMIT
+    const remaining = bucketOf(g.__awRateBuckets, `${ip}|${limit}`, limit, now)
+    if (remaining < 0) {
+      throw createError({ statusCode: 429, statusMessage: 'Too many requests: slow down' })
+    }
+    // 404 扫描计数(res finish 时回填;blocked 判定在下轮请求入口生效)
+    if (!g.__awScanHits) g.__awScanHits = new Map()
+    const res = event.node?.res
+    if (!res) return
+    res.once('finish', () => {
+      if (res.statusCode !== 404) return
+      const hits = bucketOf(g.__awScanHits!, `${ip}`, SCAN_LIMIT, Date.now())
+      if (hits <= 0) {
+        if (!g.__awScanBlocked) g.__awScanBlocked = new Map()
+        g.__awScanBlocked.set(ip, Date.now() + BLOCK_MS)
+      }
+    })
+  }
+})

package/server/plugins/aml-twin-worker.ts

@@ -1,32 +1,32 @@
-/**
- * AML Twin 持续校准 worker 定时插件。
- *
- * 每 60s 消费 twin_update_runs 的 queued 信号 → 自动提交 hybrid_residual 重训候选
- * (冻结场景 + 最新编译 PhysicsSpec + 该配方最新数据集);只产 candidate,晋升仍走
- * HITL + Twin Gate。调度模式同 retention/backup:setInterval + globalThis key 防
- * HMR 重复 + unref();AML_TWIN_WORKER_DISABLED=1 可整体关闭。
- */
-import { processQueuedTwinUpdates } from '@/server/services/workshop/aml/twin/calibration-worker'
-import { processTrainingPlans } from '@/server/services/workshop/aml/twin/training-plans'
-import { amlTwinFeatureFlags } from '@/server/services/workshop/aml/twin/feature-flags'
-
-const g = globalThis as typeof globalThis & { __awAmlTwinWorkerTimer?: NodeJS.Timeout }
-
-function tick(): void {
-  try {
-    const flags = amlTwinFeatureFlags()
-    if (!flags.channelEnabled || !flags.trainingEnabled) return
-    processQueuedTwinUpdates()
-    // 建模任务编排(解耦计划):auto 策略的 plan 检测新批次 → 修正训练
-    processTrainingPlans()
-  }
-  catch { // AML runtime 未就绪(极早启动)或单测环境:静默跳过,下一拍重试
-  }
-}
-
-export default defineNitroPlugin(() => {
-  if (process.env.AML_TWIN_WORKER_DISABLED === '1') return
-  if (g.__awAmlTwinWorkerTimer) return
-  g.__awAmlTwinWorkerTimer = setInterval(tick, 60_000)
-  g.__awAmlTwinWorkerTimer.unref()
-})
+/**
+ * AML Twin 持续校准 worker 定时插件。
+ *
+ * 每 60s 消费 twin_update_runs 的 queued 信号 → 自动提交 hybrid_residual 重训候选
+ * (冻结场景 + 最新编译 PhysicsSpec + 该配方最新数据集);只产 candidate,晋升仍走
+ * HITL + Twin Gate。调度模式同 retention/backup:setInterval + globalThis key 防
+ * HMR 重复 + unref();AML_TWIN_WORKER_DISABLED=1 可整体关闭。
+ */
+import { processQueuedTwinUpdates } from '@/server/services/workshop/aml/twin/calibration-worker'
+import { processTrainingPlans } from '@/server/services/workshop/aml/twin/training-plans'
+import { amlTwinFeatureFlags } from '@/server/services/workshop/aml/twin/feature-flags'
+
+const g = globalThis as typeof globalThis & { __awAmlTwinWorkerTimer?: NodeJS.Timeout }
+
+function tick(): void {
+  try {
+    const flags = amlTwinFeatureFlags()
+    if (!flags.channelEnabled || !flags.trainingEnabled) return
+    processQueuedTwinUpdates()
+    // 建模任务编排(解耦计划):auto 策略的 plan 检测新批次 → 修正训练
+    processTrainingPlans()
+  }
+  catch { // AML runtime 未就绪(极早启动)或单测环境:静默跳过,下一拍重试
+  }
+}
+
+export default defineNitroPlugin(() => {
+  if (process.env.AML_TWIN_WORKER_DISABLED === '1') return
+  if (g.__awAmlTwinWorkerTimer) return
+  g.__awAmlTwinWorkerTimer = setInterval(tick, 60_000)
+  g.__awAmlTwinWorkerTimer.unref()
+})

package/server/plugins/dev-stability-guard.ts

@@ -1,42 +1,42 @@
-/**
- * Server 稳定性护栏:浏览器断开(WS/keep-alive socket 硬断)产生 ECONNRESET/EPIPE
- * 类异步异常 —— Node 默认策略直接击穿进程,拖垮所有并发调试/运行会话。
- *
- * 严重性判定集中在 `server/utils/stability-severity.ts`(可被纯 node 回归测试直接断言):
- * socket 断连 / SQLite 瞬态忙 / 外部设备不可达 / Agent 引擎边界 → 记录并继续;
- * 其余判为 fatal,记日志后按非零码退出 —— 安全插件的 fail-fast(如生产密钥校验
- * 失败拒绝启动)依赖异常中止进程,绝不能被护栏吞掉。
- *
- * "外部设备不可达"是**运维常态**(设备下电、模拟器未启、容器重启):
- * 曾实测到一台 Modbus TCP 设备未启动(`connect ECONNREFUSED 127.0.0.1:1502`)
- * 使 unhandledRejection 走到 fatal 分支,整个生产实例 exit 1 ——
- * 数采/数控/数字孪生全平台被一台设备带走,属可用性事故。
- */
-import { classifyFatalCandidate, describeReason } from '../utils/stability-severity'
-
-export default defineNitroPlugin(() => {
-  // 'db-busy' 必须引号 → 按 @stylistic/quote-props 的 consistent 口径,同对象内全部加引号
-  const counts: Record<string, number> = { 'socket': 0, 'db-busy': 0, 'upstream': 0, 'engine': 0 }
-  const onFatalCandidate = (kind: string, reason: unknown): void => {
-    const severity = classifyFatalCandidate(reason)
-    if (severity === 'fatal') {
-      console.error(`[stability-guard] fatal ${kind}, exiting:\n${describeReason(reason)}`)
-      process.exit(1)
-    }
-    // counts 的四个 key 装配时已全部初始化为 0,且 'fatal' 已在上面提前 return;
-    // `?? 0` 只是 noUncheckedIndexedAccess 下的写法,取值口径与 `+= 1` 完全一致
-    counts[severity] = (counts[severity] ?? 0) + 1
-    const line = `[stability-guard] ${severity}(累计 ${counts[severity]},不退出): ${describeReason(reason).slice(0, 200).replace(/\n/g, ' ')}`
-    // 外部设备不可达与引擎边界属"要有人知道"的信号 → error;其余瞬态噪声 → warn
-    if (severity === 'upstream' || severity === 'engine') console.error(line)
-    else console.warn(line)
-  }
-
-  process.on('unhandledRejection', (reason) => {
-    onFatalCandidate('unhandledRejection', reason)
-  })
-  process.on('uncaughtException', (err) => {
-    onFatalCandidate('uncaughtException', err)
-  })
-  console.warn('[stability-guard] armed (socket 断连/sqlite 瞬态忙/外部设备不可达/引擎边界错误 → 记录继续;其余真实错误 → exit 1)')
-})
+/**
+ * Server 稳定性护栏:浏览器断开(WS/keep-alive socket 硬断)产生 ECONNRESET/EPIPE
+ * 类异步异常 —— Node 默认策略直接击穿进程,拖垮所有并发调试/运行会话。
+ *
+ * 严重性判定集中在 `server/utils/stability-severity.ts`(可被纯 node 回归测试直接断言):
+ * socket 断连 / SQLite 瞬态忙 / 外部设备不可达 / Agent 引擎边界 → 记录并继续;
+ * 其余判为 fatal,记日志后按非零码退出 —— 安全插件的 fail-fast(如生产密钥校验
+ * 失败拒绝启动)依赖异常中止进程,绝不能被护栏吞掉。
+ *
+ * "外部设备不可达"是**运维常态**(设备下电、模拟器未启、容器重启):
+ * 曾实测到一台 Modbus TCP 设备未启动(`connect ECONNREFUSED 127.0.0.1:1502`)
+ * 使 unhandledRejection 走到 fatal 分支,整个生产实例 exit 1 ——
+ * 数采/数控/数字孪生全平台被一台设备带走,属可用性事故。
+ */
+import { classifyFatalCandidate, describeReason } from '../utils/stability-severity'
+
+export default defineNitroPlugin(() => {
+  // 'db-busy' 必须引号 → 按 @stylistic/quote-props 的 consistent 口径,同对象内全部加引号
+  const counts: Record<string, number> = { 'socket': 0, 'db-busy': 0, 'upstream': 0, 'engine': 0 }
+  const onFatalCandidate = (kind: string, reason: unknown): void => {
+    const severity = classifyFatalCandidate(reason)
+    if (severity === 'fatal') {
+      console.error(`[stability-guard] fatal ${kind}, exiting:\n${describeReason(reason)}`)
+      process.exit(1)
+    }
+    // counts 的四个 key 装配时已全部初始化为 0,且 'fatal' 已在上面提前 return;
+    // `?? 0` 只是 noUncheckedIndexedAccess 下的写法,取值口径与 `+= 1` 完全一致
+    counts[severity] = (counts[severity] ?? 0) + 1
+    const line = `[stability-guard] ${severity}(累计 ${counts[severity]},不退出): ${describeReason(reason).slice(0, 200).replace(/\n/g, ' ')}`
+    // 外部设备不可达与引擎边界属"要有人知道"的信号 → error;其余瞬态噪声 → warn
+    if (severity === 'upstream' || severity === 'engine') console.error(line)
+    else console.warn(line)
+  }
+
+  process.on('unhandledRejection', (reason) => {
+    onFatalCandidate('unhandledRejection', reason)
+  })
+  process.on('uncaughtException', (err) => {
+    onFatalCandidate('uncaughtException', err)
+  })
+  console.warn('[stability-guard] armed (socket 断连/sqlite 瞬态忙/外部设备不可达/引擎边界错误 → 记录继续;其余真实错误 → exit 1)')
+})

package/server/plugins-builtin/diag-bridge/host/constants.mjs

@@ -1,25 +1,25 @@
-/**
- * 模块头与常量(超时 / 快照桶 / 冷却 / 进行中产线集合)
- * (由 server/plugins-builtin/diag-bridge/index.mjs 按职责拆出;内容逐行原文搬运)
- */
-
-/**
- * diag-bridge —— industrial-deep-diagnostic 深度诊断服务桥接插件。
- *
- * 把诊断服务(http://127.0.0.1:3210)接入 AgentWorkShop:导出 DAQ 时序快照 CSV →
- * 上传并发起深度诊断 → 轮询状态 → 完成后报告自动入知识库(文档/索引/经验三步)。
- * 工具对 lead/worker 全体 agent 生效;3210 不可达时一律 isError 文本,绝不抛异常。
- */
-export const MIN = 60 * 1000
-export const DEFAULT_BASE = 'http://127.0.0.1:3210'
-export const SNAPSHOT_BUCKET_MS = 5000 // 快照降采样桶宽
-export const SNAPSHOT_LIMIT = 10000 // 与 ctx.daq.query limit 一致(截断断言阈值)
-export const UPLOAD_FOLDER = 'aw-snapshots'
-export const AUTO_COOLDOWN_MS = 30 * MIN // 自动诊断同产线冷却
-
-/** 每产线「启动中」互斥(进程内同步集合,堵住 kv 检查与远端落库之间的并发窗口) */
-export const startingLines = new Set()
-
-// ── 基础工具 ──────────────────────────────────────────────────────────────
-
-/** 诊断服务 base(kv diag.base_url;只允许 http/https 且 host 为 127.0.0.1/localhost) */
+/**
+ * 模块头与常量(超时 / 快照桶 / 冷却 / 进行中产线集合)
+ * (由 server/plugins-builtin/diag-bridge/index.mjs 按职责拆出;内容逐行原文搬运)
+ */
+
+/**
+ * diag-bridge —— industrial-deep-diagnostic 深度诊断服务桥接插件。
+ *
+ * 把诊断服务(http://127.0.0.1:3210)接入 AgentWorkShop:导出 DAQ 时序快照 CSV →
+ * 上传并发起深度诊断 → 轮询状态 → 完成后报告自动入知识库(文档/索引/经验三步)。
+ * 工具对 lead/worker 全体 agent 生效;3210 不可达时一律 isError 文本,绝不抛异常。
+ */
+export const MIN = 60 * 1000
+export const DEFAULT_BASE = 'http://127.0.0.1:3210'
+export const SNAPSHOT_BUCKET_MS = 5000 // 快照降采样桶宽
+export const SNAPSHOT_LIMIT = 10000 // 与 ctx.daq.query limit 一致(截断断言阈值)
+export const UPLOAD_FOLDER = 'aw-snapshots'
+export const AUTO_COOLDOWN_MS = 30 * MIN // 自动诊断同产线冷却
+
+/** 每产线「启动中」互斥(进程内同步集合,堵住 kv 检查与远端落库之间的并发窗口) */
+export const startingLines = new Set()
+
+// ── 基础工具 ──────────────────────────────────────────────────────────────
+
+/** 诊断服务 base(kv diag.base_url;只允许 http/https 且 host 为 127.0.0.1/localhost) */

package/server/plugins-builtin/diag-bridge/host/exports.mjs

@@ -1,104 +1,104 @@
-/**
- * 数据集上传(da_pin daq-export 数据集 → IDD 多文件分析)
- *
- * 平台宿主工具 daq_export 把全量时序落盘到 <dataDir>/daq-exports/<exportId>/
- * (manifest.json + nodes/<nodeId>.csv)。本模块负责把整份数据集上传到诊断服务
- * (folder=aw-snapshots/exp-<exportId>),并按 manifest 的节点顺序拼出 dataPaths
- * (manifest 在首位,IDD 诊断 agent 先读映射与上下文,再逐节点读 CSV)。
- */
-import { readFile, readdir } from 'node:fs/promises'
-import { join } from 'node:path'
-import { authHeadersOf, baseOf, short } from './helpers.mjs'
-
-/** export_id 白名单(路径穿越防护;宿主 daqexp-<ts>-<hex> 格式,兼容旧手填) */
-export function validExportId(id) {
-  return /^[A-Za-z0-9_-]{4,80}$/.test(String(id ?? '').trim())
-}
-
-/** 数据集目录(<dataDir>/daq-exports/<id>;ctx.paths.dataDir 由 SDK 注入) */
-export function exportsRootOf(ctx) {
-  const dataDir = ctx?.paths?.dataDir
-  if (!dataDir) return null
-  return join(dataDir, 'daq-exports')
-}
-
-/** 读取数据集:{ ok, manifest, files:[{ name, abs }] };失败返回 { ok:false, error } */
-export async function readExportDataset(ctx, exportId) {
-  if (!validExportId(exportId)) return { ok: false, error: `export_id 非法(仅允许字母数字_-):${short(exportId)}` }
-  const root = exportsRootOf(ctx)
-  if (!root) return { ok: false, error: '平台数据目录未注入(ctx.paths.dataDir 缺失),无法读取 daq-export 数据集。' }
-  const dir = join(root, String(exportId).trim())
-  let manifest
-  try {
-    manifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'))
-  }
-  catch (err) {
-    return { ok: false, error: `数据集 ${exportId} 不存在或 manifest.json 不可读(${err?.message ?? err});先用宿主工具 daq_export 导出。` }
-  }
-  // 收集 CSV:以 manifest.nodes[].file 为准,缺失时回退扫 nodes/ 目录
-  let names = (Array.isArray(manifest?.nodes) ? manifest.nodes : [])
-    .map(n => String(n?.file ?? '')).filter(Boolean)
-  if (names.length === 0) {
-    try {
-      names = (await readdir(join(dir, 'nodes'))).filter(f => f.endsWith('.csv')).map(f => `nodes/${f}`)
-    }
-    catch { names = [] }
-  }
-  const files = [{ name: 'manifest.json', abs: join(dir, 'manifest.json') }]
-  for (const rel of names) files.push({ name: rel.split('/').pop(), abs: join(dir, rel) })
-  return { ok: true, dir, manifest, files }
-}
-
-/** 单次 multipart 最多文件数(IDD /api/files/data/upload max_files=50) */
-const UPLOAD_BATCH = 50
-
-/**
- * 上传数据集到诊断服务:manifest + 全部节点 CSV → folder aw-snapshots/exp-<id>。
- * 返回 { ok, dataPaths(manifest 首位), files, manifest };失败 { ok:false, error }。
- */
-export async function uploadExportDataset(ctx, exportId) {
-  const ds = await readExportDataset(ctx, exportId)
-  if (!ds.ok) return ds
-  const base = baseOf(ctx)
-  if (!base) return { ok: false, error: 'diag.base_url 非法(仅允许 http/https 且 host 为 127.0.0.1/localhost)。' }
-  const folder = `aw-snapshots/exp-${String(exportId).trim()}`
-  const byName = new Map()
-  try {
-    for (let i = 0; i < ds.files.length; i += UPLOAD_BATCH) {
-      const batch = ds.files.slice(i, i + UPLOAD_BATCH)
-      const fd = new FormData()
-      fd.append('folder', folder)
-      for (const f of batch) {
-        const buf = await readFile(f.abs)
-        fd.append('files', new Blob([buf], { type: 'text/plain' }), f.name)
-      }
-      const ac = new AbortController()
-      const timer = setTimeout(() => ac.abort(), 120_000)
-      let body
-      try {
-        const res = await fetch(`${base}/api/files/data/upload`, { method: 'POST', body: fd, signal: ac.signal, headers: authHeadersOf(ctx) })
-        body = await res.json().catch(() => null)
-        if (!res.ok) throw new Error(`HTTP ${res.status} ${short(body)}`)
-        if (!body || body.success !== true) throw new Error(`success!=true ${short(body)}`)
-      }
-      finally {
-        clearTimeout(timer)
-      }
-      for (const entry of (Array.isArray(body?.data) ? body.data : [])) {
-        if (entry?.name && entry?.path) byName.set(String(entry.name), String(entry.path))
-      }
-    }
-  }
-  catch (err) {
-    return { ok: false, error: `数据集上传失败: ${err?.message ?? err}` }
-  }
-  if (!byName.has('manifest.json')) return { ok: false, error: '上传响应缺少 manifest.json 的路径映射。' }
-  // dataPaths:manifest 首位,节点 CSV 按 manifest.nodes 顺序(逐文件名映射,顺序无关上传)
-  const dataPaths = [byName.get('manifest.json')]
-  for (const rel of (Array.isArray(ds.manifest?.nodes) ? ds.manifest.nodes : [])) {
-    const name = String(rel?.file ?? '').split('/').pop()
-    const p = byName.get(name)
-    if (p) dataPaths.push(p)
-  }
-  return { ok: true, dataPaths, files: dataPaths.length, manifest: ds.manifest, folder }
-}
+/**
+ * 数据集上传(da_pin daq-export 数据集 → IDD 多文件分析)
+ *
+ * 平台宿主工具 daq_export 把全量时序落盘到 <dataDir>/daq-exports/<exportId>/
+ * (manifest.json + nodes/<nodeId>.csv)。本模块负责把整份数据集上传到诊断服务
+ * (folder=aw-snapshots/exp-<exportId>),并按 manifest 的节点顺序拼出 dataPaths
+ * (manifest 在首位,IDD 诊断 agent 先读映射与上下文,再逐节点读 CSV)。
+ */
+import { readFile, readdir } from 'node:fs/promises'
+import { join } from 'node:path'
+import { authHeadersOf, baseOf, short } from './helpers.mjs'
+
+/** export_id 白名单(路径穿越防护;宿主 daqexp-<ts>-<hex> 格式,兼容旧手填) */
+export function validExportId(id) {
+  return /^[A-Za-z0-9_-]{4,80}$/.test(String(id ?? '').trim())
+}
+
+/** 数据集目录(<dataDir>/daq-exports/<id>;ctx.paths.dataDir 由 SDK 注入) */
+export function exportsRootOf(ctx) {
+  const dataDir = ctx?.paths?.dataDir
+  if (!dataDir) return null
+  return join(dataDir, 'daq-exports')
+}
+
+/** 读取数据集:{ ok, manifest, files:[{ name, abs }] };失败返回 { ok:false, error } */
+export async function readExportDataset(ctx, exportId) {
+  if (!validExportId(exportId)) return { ok: false, error: `export_id 非法(仅允许字母数字_-):${short(exportId)}` }
+  const root = exportsRootOf(ctx)
+  if (!root) return { ok: false, error: '平台数据目录未注入(ctx.paths.dataDir 缺失),无法读取 daq-export 数据集。' }
+  const dir = join(root, String(exportId).trim())
+  let manifest
+  try {
+    manifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'))
+  }
+  catch (err) {
+    return { ok: false, error: `数据集 ${exportId} 不存在或 manifest.json 不可读(${err?.message ?? err});先用宿主工具 daq_export 导出。` }
+  }
+  // 收集 CSV:以 manifest.nodes[].file 为准,缺失时回退扫 nodes/ 目录
+  let names = (Array.isArray(manifest?.nodes) ? manifest.nodes : [])
+    .map(n => String(n?.file ?? '')).filter(Boolean)
+  if (names.length === 0) {
+    try {
+      names = (await readdir(join(dir, 'nodes'))).filter(f => f.endsWith('.csv')).map(f => `nodes/${f}`)
+    }
+    catch { names = [] }
+  }
+  const files = [{ name: 'manifest.json', abs: join(dir, 'manifest.json') }]
+  for (const rel of names) files.push({ name: rel.split('/').pop(), abs: join(dir, rel) })
+  return { ok: true, dir, manifest, files }
+}
+
+/** 单次 multipart 最多文件数(IDD /api/files/data/upload max_files=50) */
+const UPLOAD_BATCH = 50
+
+/**
+ * 上传数据集到诊断服务:manifest + 全部节点 CSV → folder aw-snapshots/exp-<id>。
+ * 返回 { ok, dataPaths(manifest 首位), files, manifest };失败 { ok:false, error }。
+ */
+export async function uploadExportDataset(ctx, exportId) {
+  const ds = await readExportDataset(ctx, exportId)
+  if (!ds.ok) return ds
+  const base = baseOf(ctx)
+  if (!base) return { ok: false, error: 'diag.base_url 非法(仅允许 http/https 且 host 为 127.0.0.1/localhost)。' }
+  const folder = `aw-snapshots/exp-${String(exportId).trim()}`
+  const byName = new Map()
+  try {
+    for (let i = 0; i < ds.files.length; i += UPLOAD_BATCH) {
+      const batch = ds.files.slice(i, i + UPLOAD_BATCH)
+      const fd = new FormData()
+      fd.append('folder', folder)
+      for (const f of batch) {
+        const buf = await readFile(f.abs)
+        fd.append('files', new Blob([buf], { type: 'text/plain' }), f.name)
+      }
+      const ac = new AbortController()
+      const timer = setTimeout(() => ac.abort(), 120_000)
+      let body
+      try {
+        const res = await fetch(`${base}/api/files/data/upload`, { method: 'POST', body: fd, signal: ac.signal, headers: authHeadersOf(ctx) })
+        body = await res.json().catch(() => null)
+        if (!res.ok) throw new Error(`HTTP ${res.status} ${short(body)}`)
+        if (!body || body.success !== true) throw new Error(`success!=true ${short(body)}`)
+      }
+      finally {
+        clearTimeout(timer)
+      }
+      for (const entry of (Array.isArray(body?.data) ? body.data : [])) {
+        if (entry?.name && entry?.path) byName.set(String(entry.name), String(entry.path))
+      }
+    }
+  }
+  catch (err) {
+    return { ok: false, error: `数据集上传失败: ${err?.message ?? err}` }
+  }
+  if (!byName.has('manifest.json')) return { ok: false, error: '上传响应缺少 manifest.json 的路径映射。' }
+  // dataPaths:manifest 首位,节点 CSV 按 manifest.nodes 顺序(逐文件名映射,顺序无关上传)
+  const dataPaths = [byName.get('manifest.json')]
+  for (const rel of (Array.isArray(ds.manifest?.nodes) ? ds.manifest.nodes : [])) {
+    const name = String(rel?.file ?? '').split('/').pop()
+    const p = byName.get(name)
+    if (p) dataPaths.push(p)
+  }
+  return { ok: true, dataPaths, files: dataPaths.length, manifest: ds.manifest, folder }
+}

package/server/plugins-builtin/diag-bridge/host/helpers.mjs

@@ -183,8 +183,8 @@ export async function probeResults(ctx) {
   let verdict
   try {
     const res = await ctx.http.get(`${base}/api/external/v1/results?limit=1&brief=true`, { timeoutMs: 6000, headers: authHeadersOf(ctx) })
-    if (res.status === 404) {
-      verdict = { ok: false, reason: '当前 IDD 版本不含分析结果库(§16);请升级 IDD 后再启用 results_enabled。' }
+    if (res.status === 404 || res.status === 400) {
+      verdict = { ok: false, reason: '当前 IDD 版本不含分析结果库(§16)或接口不兼容;请升级 IDD 后再启用 results_enabled。' }
     }
     else if (res.status === 401) {
       verdict = { ok: false, reason: 'IDD Token 无效或过期;请到 系统设置→运行配置→插件 更新「诊断 API Token」(idd_ 前缀的持久 API Token)。' }