agentworkshop 0.8.3 → 0.8.5

package/scripts/test-event-persistence.mjs

@@ -1,177 +0,0 @@
-/**
- * 事件持久化验证(server 驱动;对运行中的 dev server):
- * ① 任务事件落库:提交任务 → WS 直推 → GET /channels/:id/events 含全生命周期帧
- * ② 历史拉取与 WS 无缝衔接:断开重连(lastSeq=最新)→ 历史帧 seq ≤ 游标可拉
- * ③ 服务重启持久:重启 dev server → 事件端点仍返回全部历史(DB 是事实源)
- * ④ 用户隔离:用户 B 拉取 A 的 channel 事件 → 403;B 的 WS sub A channel → error
- * ⑤ beforeSeq 翻页:分页拉取 seq 连续不重不漏
- * ⑥ channel 删除级联:删 channel → 事件端点 404
- * 运行: node scripts/test-event-persistence.mjs [--phase=recovered]
- */
-const BASE = process.env.AW_E2E_BASE ?? 'http://localhost:3000'
-const WS_BASE = BASE.replace(/^http/, 'ws')
-
-let failures = 0
-function check(name, ok, detail = '') {
-  console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? ` — ${detail}` : ''}`)
-  if (!ok) failures += 1
-}
-
-const sleep = ms => new Promise(r => setTimeout(r, ms))
-
-let __user = null
-if (process.env.AW_EVP_TOKEN) __user = { data: { token: process.env.AW_EVP_TOKEN } }
-if (!__user?.data?.token) __user = await fetch(BASE + '/api/workshop/users/register', {
-  method: 'POST', headers: { 'content-type': 'application/json' },
-  body: JSON.stringify({ name: 'evp-' + Math.random().toString(36).slice(2, 10) }),
-}).then(r => r.json()).catch(() => null)
-const T = __user?.data?.token
-if (!T) {
-  console.error('用户注册失败')
-  process.exit(1)
-}
-
-async function api(method, path, body) {
-  const res = await fetch(`${BASE}/api/workshop${path}`, {
-    method,
-    headers: {
-      authorization: `Bearer ${T}`,
-      ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
-    },
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  })
-  const json = await res.json().catch(() => null)
-  return { status: res.status, code: json?.code, data: json?.data }
-}
-
-function openWs() {
-  const frames = []
-  const ws = new WebSocket(`${WS_BASE}/api/workshop/ws`)
-  const opened = new Promise((resolve, reject) => {
-    ws.onopen = () => resolve(true)
-    ws.onerror = e => reject(new Error(`ws error: ${e?.message ?? e}`))
-  })
-  ws.onmessage = ev => frames.push(JSON.parse(ev.data))
-  return { ws, frames, opened }
-}
-
-const RECOVERED = process.argv.includes('--phase=recovered')
-// 阶段标记文件(跨重启传递 channel id)
-const MARK = process.env.TEMP ? `${process.env.TEMP}/aw-evp.json` : '/tmp/aw-evp.json'
-
-async function main() {
-  if (RECOVERED) {
-    // ── ③ 服务重启后历史仍在(DB 事实源) ──
-    console.log('=== ③ 服务重启后事件持久 ===')
-    const fs = await import('node:fs')
-    const mark = JSON.parse(fs.readFileSync(MARK, 'utf8'))
-    const hist = await api('GET', `/channels/${mark.channelId}/events?limit=1000`)
-    check('重启后历史仍完整', hist.status === 200 && (hist.data?.items?.length ?? 0) >= mark.count,
-      `items=${hist.data?.items?.length} / before=${mark.count}`)
-    check('重启后 maxSeq 一致', hist.data?.maxSeq === mark.maxSeq, `${hist.data?.maxSeq} / ${mark.maxSeq}`)
-    // 清理
-    await api('DELETE', `/channels/${mark.channelId}`)
-    console.log(failures === 0 ? '\nALL PASS' : `\n${failures} FAILED`)
-    process.exit(failures === 0 ? 0 : 1)
-  }
-
-  // ── 前置 ──
-  const ch = await api('POST', '/channels', { name: `evp-ch-${Date.now()}` })
-  const cid = ch.data.channelId
-  await api('POST', `/channels/${cid}/agents`, { name: 'evp-lead', harness: 'mock', role: 'lead' })
-  await api('POST', `/channels/${cid}/agents`, { name: 'evp-w1', harness: 'mock' })
-
-  console.log('=== ① 任务事件落库 ===')
-  const c1 = openWs()
-  await c1.opened
-  c1.ws.send(JSON.stringify({ type: 'sub', channelId: cid, token: T }))
-  await sleep(600)
-  // 显式要求分解:简单任务会被 mock lead 直接收口,生命周期里不会出现 WAITING 帧
-  const task = await api('POST', `/channels/${cid}/tasks`, {
-    title: '[mock:complex] evp 任务',
-    description: '本任务必须分解为可并行的子任务并派发给 worker 执行,等待子任务完成后汇总收口。',
-  })
-  await (async () => {
-    const deadline = Date.now() + 25_000
-    while (Date.now() < deadline) {
-      if (c1.frames.some(f => f.type === 'task.status' && f.payload?.taskId === task.data?.id && f.payload?.state === 'COMPLETED')) return true
-      await sleep(150)
-    }
-    return false
-  })()
-  await sleep(800) // 落库同步完成余量
-  const hist = await api('GET', `/channels/${cid}/events?limit=1000`)
-  const items = hist.data?.items ?? []
-  check('事件端点 200 + items', hist.status === 200 && items.length > 0, `n=${items.length}`)
-  const hasLifecycle = ['SUBMITTED', 'WORKING', 'WAITING', 'COMPLETED'].every(st =>
-    items.some(e => e.type === 'task.status' && e.payload?.state === st))
-  check('全生命周期状态帧落库', hasLifecycle)
-  check('artifact 帧落库', items.some(e => e.type === 'a2a.artifact'))
-  // 同源比较以 sub 时刻的快照 seq 为界:快照前(建 channel/加成员)的帧已落库但
-  // 订阅者经快照对齐而非逐帧重放,不参与 WS 帧集比对
-  const subSeq = c1.frames.find(f => f.type === 'channel.snapshot')?.seq ?? 0
-  const wsSeqs = c1.frames.filter(f => f.type !== 'pong' && f.type !== 'channel.snapshot').map(f => f.seq)
-  const dbSeqs = items.filter(e => e.seq > subSeq).map(e => e.seq)
-  check('DB 帧与 WS 帧集合一致(同源)', JSON.stringify(wsSeqs) === JSON.stringify(dbSeqs),
-    `ws=${wsSeqs.length} db=${dbSeqs.length}`)
-  c1.ws.close()
-
-  console.log('\n=== ② 历史拉取与 WS 无缝衔接 ===')
-  // 模拟前端刷新:新连接 sub(无 lastSeq → snapshot)后拉历史
-  const c2 = openWs()
-  await c2.opened
-  c2.ws.send(JSON.stringify({ type: 'sub', channelId: cid, token: T }))
-  await sleep(600)
-  const hist2 = await api('GET', `/channels/${cid}/events?limit=50`)
-  const snapSeq = c2.frames.find(f => f.type === 'channel.snapshot')?.seq
-  const histMax = Math.max(...(hist2.data?.items ?? []).map(e => e.seq))
-  check('快照游标 ≥ 历史最大 seq(衔接无缝隙)', snapSeq >= histMax, `snap=${snapSeq} histMax=${histMax}`)
-  c2.ws.close()
-
-  console.log('\n=== ④ 用户隔离(事件端点 + WS) ===')
-  const other = await fetch(BASE + '/api/workshop/users/register', {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ name: 'evp-b-' + Math.random().toString(36).slice(2, 8) }),
-  }).then(r => r.json())
-  const cross = await fetch(`${BASE}/api/workshop/channels/${cid}/events`, {
-    headers: { authorization: `Bearer ${other.data.token}` },
-  }).then(r => r.json())
-  check('B 拉取 A 的事件 → 403', cross.code === 'SCOPE_VIOLATION', cross.code)
-  const wsCross = await new Promise((resolve) => {
-    const ws = new WebSocket(WS_BASE + '/api/workshop/ws')
-    ws.onopen = () => ws.send(JSON.stringify({ type: 'sub', channelId: cid, token: other.data.token }))
-    ws.onmessage = (ev) => {
-      const f = JSON.parse(ev.data)
-      ws.close()
-      resolve(f)
-    }
-    setTimeout(() => resolve(null), 4000)
-  })
-  // 非成员订阅必须被拒:实现以 NOT_CHANNEL_MEMBER 表达"不是成员"(旧版本用
-  // SCOPE_VIOLATION 表达同一拒绝)。二者都满足"拒绝且不泄露快照"的断言意图。
-  check('B WS 订阅 A 的 channel → error',
-    wsCross?.payload?.code === 'SCOPE_VIOLATION' || wsCross?.payload?.code === 'NOT_CHANNEL_MEMBER',
-    wsCross?.payload?.code)
-
-  console.log('\n=== ⑤ beforeSeq 翻页 ===')
-  const page1 = await api('GET', `/channels/${cid}/events?limit=5`)
-  const p1 = page1.data.items
-  const page2 = await api('GET', `/channels/${cid}/events?limit=5&beforeSeq=${p1[0].seq}`)
-  const p2 = page2.data.items
-  const all = [...p2, ...p1]
-  const seqs = all.map(e => e.seq)
-  const contiguous = seqs.every((s, i) => i === 0 || s === seqs[i - 1] + 1)
-  check('翻页连续不重不漏', contiguous && new Set(seqs).size === seqs.length, `${p2.at(-1)?.seq}…${p1.at(-1)?.seq}`)
-
-  console.log('\n=== ⑥ channel 删除级联 ===')
-  const fsx = await import('node:fs')
-  fsx.writeFileSync(MARK, JSON.stringify({ channelId: cid, count: items.length, maxSeq: hist.data.maxSeq, token: T }))
-  console.log(`  已标记 channel(重启后验证持久):${cid},count=${items.length}`)
-  console.log(failures === 0 ? '\nPHASE-1 ALL PASS(重启 dev server 后运行 --phase=recovered)' : `\n${failures} FAILED`)
-  process.exit(failures === 0 ? 0 : 1)
-}
-
-main().catch((e) => {
-  console.error('事件持久化测试异常:', e)
-  process.exit(1)
-})

package/scripts/test-group-chat-hardening.ts

@@ -1,265 +0,0 @@
-/**
- * 群聊层"加固"回归测试(本轮 review 修复项).
- *
- * 覆盖的是**行为契约**,不是实现细节 —— 每条都对应一个真实缺陷:
- *  1. `withTransaction` 可重入:SQLite 不支持嵌套 BEGIN(实测会抛
- *     `cannot start a transaction within a transaction` 且**外层仍开着**),
- *     而群聊写入路径会互相调用。这里断言嵌套不抛、内层回滚不伤外层、外层回滚全丢。
- *  2. `isTransactionOpen()` 在事务内外正确翻转 —— WS 落库缓冲靠它决定是否推迟刷盘
- *     (同连接的非事务写入会被并入事务,回滚会连带丢弃已推给 peer 的帧)。
- *  3. `listBefore` 遇失效/跨频道游标返回**空页**(旧实现回落最新页 → 客户端"加载更早"死循环)。
- *  4. `listAfterCursor` 游标行被删时不得返回重复行(旧实现把 rowid 退化为 0 → 同毫秒行全返)。
- *  5. 撤权只清理**该 Channel** 的通知,不波及其它频道(§13.7)。
- *  6. outbox `markPublishedIfPending` 幂等;`sweepPublished` 只回收已发布行。
- *  7. 通知保留期只回收**已读**行(未读永不删)。
- *  8. 成员投影与快照投影同源(displayName 回落 id 前缀),不再"列表与快照显示不同"。
- *
- * 运行: npx tsx --tsconfig .nuxt/tsconfig.server.json scripts/test-group-chat-hardening.ts
- */
-import type { DatabaseSync } from 'node:sqlite'
-import { mkdtempSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-// 隔离:用户仓储惰性 getDb() 会走 AW_DATA_DIR;指向临时目录,绝不触碰真实数据
-process.env.AW_DATA_DIR = mkdtempSync(join(tmpdir(), 'aw-chat-hardening-'))
-process.env.AGENTWORKSHOP_TEST = '1'
-
-const { openWorkshopDb } = await import('../server/services/workshop/db/database')
-const { withTransaction, isTransactionOpen, transactionDepth } = await import('../server/services/workshop/db/transaction')
-const { createChannelRepo } = await import('../server/services/workshop/db/channel.repo')
-const { createChannelMemberRepo } = await import('../server/services/workshop/db/channel-member.repo')
-const { createChatMessageRepo } = await import('../server/services/workshop/db/chat-message.repo')
-const { createNotificationRepo } = await import('../server/services/workshop/db/notification.repo')
-const { createOutboxRepo } = await import('../server/services/workshop/db/outbox.repo')
-const { projectChannelMember } = await import('../server/services/workshop/runtime/chat-projection')
-
-let passed = 0
-const failures: string[] = []
-function check(name: string, ok: boolean, detail = ''): void {
-  if (ok) {
-    passed++
-    console.log(`  PASS  ${name}${detail ? ` — ${detail}` : ''}`)
-  }
-  else {
-    failures.push(name)
-    console.log(`  FAIL  ${name}${detail ? ` — ${detail}` : ''}`)
-  }
-}
-function section(title: string): void {
-  console.log(`\n=== ${title} ===`)
-}
-
-const db: DatabaseSync = openWorkshopDb(':memory:')
-const channels = createChannelRepo(db)
-const members = createChannelMemberRepo(db)
-const chat = createChatMessageRepo(db)
-const notifications = createNotificationRepo(db)
-const outbox = createOutboxRepo(db)
-
-/** 建一个 channel(直接落库,不经 manager —— 本测试只关心 db/仓储层契约) */
-function makeChannel(name: string): string {
-  const row = channels.create({ name, ownerUserId: 'u-owner' })
-  members.ensureOwner(row.id, 'u-owner')
-  return row.id
-}
-
-// ============================================================================
-section('1. 事务可重入(SQLite 不支持嵌套 BEGIN)')
-// ============================================================================
-{
-  const chId = makeChannel('tx')
-  check('事务外 isTransactionOpen()=false', isTransactionOpen() === false)
-
-  // 嵌套事务不得抛错;内层写入与外层写入在同一最外层事务里
-  let innerOpened = false
-  let outerDepthSeen = 0
-  withTransaction(db, () => {
-    outerDepthSeen = transactionDepth()
-    chat.create({ channelId: chId, senderType: 'user', senderId: 'u1', text: 'outer', clientMessageId: 'tx-outer' })
-    withTransaction(db, () => {
-      innerOpened = isTransactionOpen()
-      chat.create({ channelId: chId, senderType: 'user', senderId: 'u1', text: 'inner', clientMessageId: 'tx-inner' })
-    })
-  })
-  check('嵌套事务不抛错(SQLite 嵌套 BEGIN 会抛)', outerDepthSeen >= 1, `outerDepth=${outerDepthSeen}`)
-  check('内层 isTransactionOpen()=true(WS 刷盘守卫据此推迟)', innerOpened === true)
-  check('提交后 isTransactionOpen()=false', isTransactionOpen() === false)
-  check('嵌套提交后两条写入都可见', chat.count(chId) === 2, `count=${chat.count(chId)}`)
-
-  // 内层抛错:只回滚内层(外层可选择继续并提交)
-  let innerThrew = false
-  withTransaction(db, () => {
-    chat.create({ channelId: chId, senderType: 'user', senderId: 'u1', text: 'keep-me', clientMessageId: 'tx-keep' })
-    try {
-      withTransaction(db, () => {
-        chat.create({ channelId: chId, senderType: 'user', senderId: 'u1', text: 'rollback-me', clientMessageId: 'tx-rb' })
-        throw new Error('inner-boom')
-      })
-    }
-    catch {
-      innerThrew = true
-    }
-  })
-  check('内层抛错被捕获且外层仍提交', innerThrew && chat.count(chId) === 3, `count=${chat.count(chId)}`)
-  check('内层回滚只丢弃内层写入(rollback-me 不存在)', chat.findByClientId(chId, 'tx-rb') === undefined)
-  check('内层回滚不影响外层已写行(keep-me 存在)', chat.findByClientId(chId, 'tx-keep') !== undefined)
-
-  // 外层抛错:整体回滚(含已成功的内层)
-  let outerThrew = false
-  const before = chat.count(chId)
-  try {
-    withTransaction(db, () => {
-      chat.create({ channelId: chId, senderType: 'user', senderId: 'u1', text: 'a', clientMessageId: 'tx-o1' })
-      withTransaction(db, () => {
-        chat.create({ channelId: chId, senderType: 'user', senderId: 'u1', text: 'b', clientMessageId: 'tx-o2' })
-      })
-      throw new Error('outer-boom')
-    })
-  }
-  catch {
-    outerThrew = true
-  }
-  check('外层抛错 → 全部回滚(含已提交的内层写入)', outerThrew && chat.count(chId) === before, `before=${before} after=${chat.count(chId)}`)
-  check('回滚后事务深度归零(不留悬挂事务)', transactionDepth() === 0)
-  check('回滚后 isTransactionOpen()=false', isTransactionOpen() === false)
-}
-
-// ============================================================================
-section('2. 游标正确性:失效游标不得回落到最新页')
-// ============================================================================
-{
-  const chId = makeChannel('cursor')
-  const other = makeChannel('cursor-other')
-  const ids: string[] = []
-  for (let i = 0; i < 5; i++) {
-    ids.push(chat.create({ channelId: chId, senderType: 'user', senderId: 'u1', text: `m${i}`, clientMessageId: `c${i}` }).row.id)
-  }
-  check('无游标 → 最新页(新→旧)', chat.listBefore(chId, undefined, 3)[0]!.text === 'm4')
-
-  const anchorIdx = ids[2]!
-  const before = chat.listBefore(chId, anchorIdx, 10)
-  check('有效游标 → 严格取更早的 2 条', before.length === 2 && before.every(m => ['m0', 'm1'].includes(m.text)), before.map(m => m.text).join(','))
-
-  // 旧实现:anchor 不存在时 return selectRecent(...) → 客户端"加载更早"永远拿到最新页(死循环)
-  const ghost = chat.listBefore(chId, 'no-such-message-id', 10)
-  check('失效游标 → 空页(旧实现会回落最新页,导致分页死循环)', ghost.length === 0, `len=${ghost.length}`)
-
-  // 跨频道游标同样必须空页(否则能把别的群的消息当锚点,泄漏其 createdAt 位置)
-  const foreign = chat.create({ channelId: other, senderType: 'user', senderId: 'u1', text: 'x', clientMessageId: 'cx' }).row.id
-  const cross = chat.listBefore(chId, foreign, 10)
-  check('跨频道游标 → 空页', cross.length === 0, `len=${cross.length}`)
-}
-
-// ============================================================================
-section('3. 通知游标:锚点被删不得返回重复行')
-// ============================================================================
-{
-  const me = 'user-cursor'
-  // 三条同 created_at 的通知(模拟同毫秒批量写入)
-  const stamp = '2026-01-01T00:00:00.000Z'
-  const n1 = notifications.create({ recipientUserId: me, type: 'mention', eventId: 'e1', createdAt: stamp }).row
-  notifications.create({ recipientUserId: me, type: 'mention', eventId: 'e2', createdAt: stamp })
-  notifications.create({ recipientUserId: me, type: 'mention', eventId: 'e3', createdAt: stamp })
-
-  const afterFirst = notifications.listAfterCursor(me, { createdAt: n1.createdAt, id: n1.id }, 50)
-  check('锚点存在 → 用 (created_at,rowid) 严格取其后(不含同刻更早行)', afterFirst.length === 2, `len=${afterFirst.length}`)
-
-  // 旧实现:rowidOf 缺失 → rid=0 → 返回所有 created_at 等于锚点时刻的行(重复投递)
-  const ghost = notifications.listAfterCursor(me, { createdAt: stamp, id: 'deleted-anchor' }, 50)
-  check('锚点被删 → 严格 > createdAt(不重复返回同刻行)', ghost.length === 0, `len=${ghost.length}`)
-
-  const cursor = notifications.cursorOf(n1.id)
-  check('cursorOf 返回可用游标', cursor?.id === n1.id && cursor.createdAt === stamp)
-  check('cursorOf 对不存在的 id 返回 null', notifications.cursorOf('nope') === null)
-}
-
-// ============================================================================
-section('4. 撤权只清本频道通知(§13.7)')
-// ============================================================================
-{
-  const a = makeChannel('revoke-a')
-  const b = makeChannel('revoke-b')
-  const target = 'user-target'
-  notifications.create({ recipientUserId: target, channelId: a, type: 'mention', eventId: 'ra' })
-  notifications.create({ recipientUserId: target, channelId: b, type: 'mention', eventId: 'rb' })
-  notifications.create({ recipientUserId: 'user-other', channelId: a, type: 'mention', eventId: 'ro' })
-
-  const purged = notifications.deleteForChannel(target, a)
-  check('撤权清理返回删除行数', purged === 1, `purged=${purged}`)
-  check('本频道通知已删(不再补拉)', notifications.listRecent(target, 10).every(n => n.channelId !== a))
-  check('其它频道通知保留(不误删)', notifications.listRecent(target, 10).some(n => n.channelId === b))
-  check('其它用户在同频道的通知不受影响', notifications.listRecent('user-other', 10).some(n => n.channelId === a))
-}
-
-// ============================================================================
-section('5. outbox:幂等发布 + 有界化')
-// ============================================================================
-{
-  const evId = 'chat.message:test-1'
-  outbox.enqueue({ aggregateType: 'chat_message', aggregateId: 'test-1', eventType: 'chat.message', eventId: evId })
-  check('enqueue 后为 pending', outbox.findById(evId)?.status === 'pending')
-
-  const first = outbox.markPublishedIfPending(evId)
-  const second = outbox.markPublishedIfPending(evId)
-  check('首次条件发布返回 true', first === true)
-  check('重复条件发布返回 false(幂等,attempts 不重复增长)', second === false)
-  check('attempts 只 +1', outbox.findById(evId)?.attempts === 1, `attempts=${outbox.findById(evId)?.attempts}`)
-
-  // failed 行不得被"发布成功"覆盖(失败留痕不能被抹掉)
-  const failedId = 'chat.delivery.status:test-f'
-  outbox.enqueue({ aggregateType: 'chat_delivery', aggregateId: 'test-f', eventType: 'chat.delivery.status', eventId: failedId })
-  outbox.markFailed(failedId, 'boom')
-  check('条件发布不改动 failed 行', outbox.markPublishedIfPending(failedId) === false && outbox.findById(failedId)?.status === 'failed')
-
-  // 保留期只回收已发布行
-  const pendingId = 'chat.message:test-pending'
-  outbox.enqueue({ aggregateType: 'chat_message', aggregateId: 'test-pending', eventType: 'chat.message', eventId: pendingId })
-  const removed = outbox.sweepPublished(new Date(Date.now() + 60_000).toISOString())
-  check('保留期回收已发布行', removed >= 1, `removed=${removed}`)
-  check('pending 行不被回收(欠账必须保留)', outbox.findById(pendingId)?.status === 'pending')
-  check('failed 行不被回收(失败留痕)', outbox.findById(failedId)?.status === 'failed')
-}
-
-// ============================================================================
-section('6. 通知保留期:只回收已读')
-// ============================================================================
-{
-  const me = 'user-sweep'
-  const old = '2020-01-01T00:00:00.000Z'
-  const readRow = notifications.create({ recipientUserId: me, type: 'mention', eventId: 'sw-read', createdAt: old }).row
-  notifications.create({ recipientUserId: me, type: 'mention', eventId: 'sw-unread', createdAt: old })
-  notifications.markRead(me, readRow.id)
-
-  const removed = notifications.sweepRead(new Date(Date.now() - 86_400_000).toISOString())
-  check('已读旧行被回收', removed === 1, `removed=${removed}`)
-  check('未读行**永不**回收(删掉就是丢通知)', notifications.listRecent(me, 10).some(n => n.eventId === 'sw-unread'))
-  check('未读数仍为 1', notifications.unreadCount(me) === 1, `unread=${notifications.unreadCount(me)}`)
-}
-
-// ============================================================================
-section('7. 成员投影两处同源(displayName 回落一致)')
-// ============================================================================
-{
-  const chId = makeChannel('proj')
-  members.upsert({ channelId: chId, userId: 'user-without-name', role: 'member', status: 'active' })
-  const row = members.listByChannel(chId).find(m => m.userId === 'user-without-name')!
-
-  // 用户仓储不可用时 resolveOwnerName 返回 null;投影必须回落到 id 前 8 位(而不是露出 null)
-  const projected = projectChannelMember(row, null)
-  check('projectChannelMember(null) 保留 null(投影层不做兜底,由调用方给值)', projected.displayName === null)
-  const withFallback = projectChannelMember(row, 'user-wit')
-  check('projectChannelMember 原样透传调用方给的展示名', withFallback.displayName === 'user-wit')
-  check('成员行字段完整(role/status/joinedAt)', !!row.role && !!row.status && !!row.joinedAt)
-}
-
-// ============================================================================
-console.log(`\n${'='.repeat(64)}`)
-console.log(`群聊加固回归: PASS=${passed}  FAIL=${failures.length}`)
-if (failures.length > 0) {
-  console.log('失败项:')
-  for (const f of failures) console.log(`  - ${f}`)
-}
-console.log('='.repeat(64))
-db.close()
-process.exit(failures.length > 0 ? 1 : 0)

package/scripts/test-group-chat-unit/section-a-migration.ts

@@ -1,75 +0,0 @@
-/**
- * 场景 A —— v17 迁移与不变量回填:新表/新列存在;旧结构库升级后既有 Channel 保持 private/owner_approve/owner_only/chat 关(行为零变化);owner 成员回填幂等、非法取值收敛为最保守档。
- *
- * 原文 scripts/test-group-chat-unit.ts 第 170–232 行(section 横幅 + 顶层语句块):
- * 语句逐行原文搬运,仅把顶层块包成函数、把共享状态改为 ctx 参数。
- *
- * 本段用**旧结构库**验证真实升级路径,故 node:sqlite 仍是函数内原位 dynamic import(与拆分前一致)。
- */
-import { randomUUID } from 'node:crypto'
-import { join } from 'node:path'
-import { check, initWorkshopDb, section } from './lib'
-import type { GroupChatTestContext } from './lib'
-
-export async function runSectionA(ctx: GroupChatTestContext): Promise<void> {
-  const { db, A } = ctx
-  section('A. v17 迁移与不变量回填')
-  const tables = (db.prepare('SELECT name FROM sqlite_master WHERE type=\'table\'').all() as Array<{ name: string }>).map(r => r.name)
-  for (const t of ['channel_members', 'chat_messages', 'chat_deliveries', 'user_notifications', 'outbox_events', 'hitl_requests']) {
-    check(`表 ${t} 已创建`, tables.includes(t))
-  }
-  const cols = (db.prepare('PRAGMA table_info(channels)').all() as Array<{ name: string }>).map(c => c.name)
-  for (const c of ['visibility', 'join_policy', 'approval_policy', 'chat_enabled', 'version']) {
-    check(`channels.${c} 已加列`, cols.includes(c))
-  }
-  // 迁移安全:用**旧结构库**验证真实升级路径。
-  // 关键语义:ALTER TABLE ADD COLUMN 的 DEFAULT 会填充既有行 → 升级后既有 Channel
-  // 一律 private/owner_approve/owner_only/chat_enabled=0,**行为零变化**;
-  // 且迁移**不得**在每次启动时把 owner 显式设置的 public 打回 private(否则设置无法持久)。
-  const { DatabaseSync } = await import('node:sqlite')
-  const legacyPath = join(process.env.AW_DATA_DIR!, 'legacy-upgrade.sqlite')
-  const legacyDb = new DatabaseSync(legacyPath)
-  legacyDb.exec(`CREATE TABLE channels (
-    id             TEXT PRIMARY KEY,
-    name           TEXT NOT NULL,
-    description    TEXT NOT NULL DEFAULT '',
-    scenario_prompt TEXT NOT NULL DEFAULT '',
-    llm_json       TEXT NOT NULL DEFAULT '',
-    lead_agent_id  TEXT,
-    workspace      TEXT NOT NULL DEFAULT '',
-    enabled        INTEGER NOT NULL DEFAULT 1,
-    owner_user_id  TEXT,
-    created_at     TEXT NOT NULL,
-    updated_at     TEXT NOT NULL
-  )`)
-  const now = new Date().toISOString()
-  const legacyId = randomUUID()
-  legacyDb.prepare('INSERT INTO channels (id, name, description, scenario_prompt, llm_json, lead_agent_id, workspace, enabled, owner_user_id, created_at, updated_at) VALUES (?, ?, \'\', \'\', \'\', NULL, \'\', 1, ?, ?, ?)')
-    .run(legacyId, 'legacy', A.id, now, now)
-  const orphanId = randomUUID()
-  legacyDb.prepare('INSERT INTO channels (id, name, description, scenario_prompt, llm_json, lead_agent_id, workspace, enabled, owner_user_id, created_at, updated_at) VALUES (?, ?, \'\', \'\', \'\', NULL, \'\', 1, NULL, ?, ?)')
-    .run(orphanId, 'orphan', now, now)
-  // 升级
-  initWorkshopDb(legacyDb)
-  const upg = legacyDb.prepare('SELECT id, visibility, join_policy AS joinPolicy, approval_policy AS approvalPolicy, chat_enabled AS chatEnabled FROM channels WHERE id = ?').get(legacyId) as { visibility: string, joinPolicy: string, approvalPolicy: string, chatEnabled: number }
-  check('升级后既有 Channel visibility=private', upg.visibility === 'private', upg.visibility)
-  check('升级后既有 Channel joinPolicy=owner_approve', upg.joinPolicy === 'owner_approve', upg.joinPolicy)
-  check('升级后既有 Channel approvalPolicy=owner_only', upg.approvalPolicy === 'owner_only', upg.approvalPolicy)
-  check('升级后既有 Channel chatEnabled=0(不可写公开群聊)', upg.chatEnabled === 0, String(upg.chatEnabled))
-  const upgOwnerMembers = legacyDb.prepare('SELECT user_id AS userId, role, status FROM channel_members WHERE channel_id = ?').all(legacyId) as Array<{ userId: string, role: string, status: string }>
-  check('升级回填 owner 成员且恰好一条 active owner', upgOwnerMembers.length === 1 && upgOwnerMembers[0]!.userId === A.id && upgOwnerMembers[0]!.role === 'owner' && upgOwnerMembers[0]!.status === 'active', JSON.stringify(upgOwnerMembers))
-  const upgOrphan = legacyDb.prepare('SELECT visibility, chat_enabled AS chatEnabled FROM channels WHERE id = ?').get(orphanId) as { visibility: string, chatEnabled: number }
-  check('升级后 owner=NULL 遗留 Channel 仍为 private + chat 关', upgOrphan.visibility === 'private' && upgOrphan.chatEnabled === 0)
-  check('升级后 owner=NULL 遗留 Channel 无 owner 成员行', (legacyDb.prepare('SELECT COUNT(*) AS n FROM channel_members WHERE channel_id = ?').get(orphanId) as { n: number }).n === 0)
-  // 幂等 + 不覆盖合法设置:owner 显式开启 public 后再次 init 必须保持 public(设置可持久)
-  legacyDb.exec(`UPDATE channels SET visibility = 'public', join_policy = 'open', approval_policy = 'any_member', chat_enabled = 1 WHERE id = '${legacyId}'`)
-  initWorkshopDb(legacyDb)
-  const again = legacyDb.prepare('SELECT visibility, join_policy AS joinPolicy, approval_policy AS approvalPolicy, chat_enabled AS chatEnabled FROM channels WHERE id = ?').get(legacyId) as { visibility: string, joinPolicy: string, approvalPolicy: string, chatEnabled: number }
-  check('重复 init 幂等且不覆盖 owner 显式设置', again.visibility === 'public' && again.joinPolicy === 'open' && again.approvalPolicy === 'any_member' && again.chatEnabled === 1, JSON.stringify(again))
-  // 非法值收敛:未知取值回落最保守档(不放宽权限)
-  legacyDb.exec(`UPDATE channels SET visibility = 'PUBLIC_BOGUS', join_policy = 'bogus', approval_policy = 'bogus', chat_enabled = 7 WHERE id = '${legacyId}'`)
-  initWorkshopDb(legacyDb)
-  const clamped = legacyDb.prepare('SELECT visibility, join_policy AS joinPolicy, approval_policy AS approvalPolicy, chat_enabled AS chatEnabled FROM channels WHERE id = ?').get(legacyId) as { visibility: string, joinPolicy: string, approvalPolicy: string, chatEnabled: number }
-  check('非法取值收敛为最保守档', clamped.visibility === 'private' && clamped.joinPolicy === 'owner_approve' && clamped.approvalPolicy === 'owner_only' && clamped.chatEnabled === 0, JSON.stringify(clamped))
-  legacyDb.close()
-}

package/scripts/test-group-chat-unit/section-b-permission-matrix.ts

@@ -1,88 +0,0 @@
-/**
- * 场景 B —— 权限矩阵:owner-only 管理端点对普通成员 403;成员可群聊读/写;非成员 403;遗留 owner=NULL Channel 既不可 join 也不可被成员读,HITL 审批旁路已收口。
- *
- * 原文 scripts/test-group-chat-unit.ts 第 234–310 行(section 横幅 + 顶层语句块):
- * 语句逐行原文搬运,仅把顶层块包成函数、把共享状态改为 ctx 参数。
- *
- * hitl-registry / hitl-decision 仍在原位 dynamic import(与拆分前同一时机),调用 configureHitlRuntime 的顺序不变; 仅相对路径因文件下沉一层而 +1 级(../server → ../../server),语句本身不变。
- */
-import { randomUUID } from 'node:crypto'
-import { check, checkThrows, section } from './lib'
-import type { GroupChatTestContext } from './lib'
-
-export async function runSectionB(ctx: GroupChatTestContext): Promise<void> {
-  const { manager, db, buildChannel, A, B, C, D, ADMIN } = ctx
-  section('B. 权限矩阵:owner-only 管理 vs member 群聊')
-  const { channelId, workerId } = await buildChannel('perm')
-  // 不变量(不依赖任何读路径副作用):新建 Channel 时 owner 成员行必须已落库
-  const ownerRows = manager.groupChat.members.listActiveOwners(channelId)
-  check('新建 Channel 即写入 owner 成员行(不靠读路径自愈)', ownerRows.length === 1 && ownerRows[0]!.userId === A.id, `count=${ownerRows.length}`)
-  check('owner 成员行 role=owner status=active', ownerRows[0]?.role === 'owner' && ownerRows[0]?.status === 'active')
-  const roster = manager.listChannelMembersProjected(channelId)
-  check('成员名册立即包含 owner', roster.some(m => m.userId === A.id && m.role === 'owner'), JSON.stringify(roster.map(m => m.userId.slice(0, 6))))
-  // owner 开启公开群聊
-  manager.requireChannelOwner(channelId, A, 'channel')
-  await manager.updateChannel(channelId, { visibility: 'public', joinPolicy: 'open', chatEnabled: 1 })
-
-  check('owner 可见自己 Channel', manager.channelPermissionsOf(channelId, A).isOwner === true)
-  // 普通成员加入前后
-  checkThrows('非成员读群成员列表 → 403 NOT_CHANNEL_MEMBER', () => manager.requireChannelMember(channelId, B), 'NOT_CHANNEL_MEMBER')
-  check('非成员可 join(public+open)', manager.joinChannel(channelId, B).status === 'active')
-  check('成员可读群成员列表', manager.requireChannelMember(channelId, B).id === channelId)
-  const permsB = manager.channelPermissionsOf(channelId, B)
-  check('成员 canPost/canInvokeAgent=true', permsB.canPost && permsB.canInvokeAgent)
-  check('成员 canManage=false', permsB.canManage === false)
-
-  // 越权:公开成员不得获得任何 Channel 管理权
-  checkThrows('成员改 Channel 设置 → 403', () => manager.requireChannelOwner(channelId, B, 'channel'), 'SCOPE_VIOLATION')
-  checkThrows('成员 activate → 403', () => manager.requireChannelOwner(channelId, B, 'channel'), 'SCOPE_VIOLATION')
-  checkThrows('成员移除他人成员 → 403', () => manager.removeChannelMember(channelId, B, A.id), 'SCOPE_VIOLATION')
-  // @Agent 调用资格 = 群成员 + 群聊开启
-  check('成员可 invokeAgent', manager.requireCanInvokeAgent(channelId, B).id === channelId)
-  checkThrows('非成员 @Agent → 403', () => manager.requireCanInvokeAgent(channelId, D), 'NOT_CHANNEL_MEMBER')
-  // 未开启群聊 → 409
-  const { channelId: closedId } = await buildChannel('closed')
-  manager.groupChat.members.upsert({ channelId: closedId, userId: B.id, role: 'member', status: 'active' })
-  checkThrows('群聊未开启时发言 → 409 CHAT_DISABLED', () => manager.requireChannelChatEnabled(closedId, B), 'CHAT_DISABLED')
-  checkThrows('群聊未开启时 join → 409 CHAT_DISABLED', () => manager.requireCanJoinChannel(closedId, C), 'CHAT_DISABLED')
-  // 私有 Channel 不可自行加入
-  await manager.updateChannel(channelId, { visibility: 'private' })
-  checkThrows('private Channel 自行加入 → 403 CHANNEL_PRIVATE', () => manager.requireCanJoinChannel(channelId, C), 'CHANNEL_PRIVATE')
-  await manager.updateChannel(channelId, { visibility: 'public' })
-  // owner_approve 流程
-  await manager.updateChannel(channelId, { joinPolicy: 'owner_approve' })
-  const cJoin = manager.joinChannel(channelId, C)
-  check('owner_approve 加入 → pending', cJoin.status === 'pending', cJoin.status)
-  check('pending 成员不可读群聊', !manager.groupChat.members.isActiveMember(channelId, C.id))
-  checkThrows('pending 成员 requireChannelMember → 403', () => manager.requireChannelMember(channelId, C), 'NOT_CHANNEL_MEMBER')
-  manager.approveMember(channelId, A, C.id)
-  check('owner 批准后成员 active', manager.groupChat.members.isActiveMember(channelId, C.id))
-  await manager.updateChannel(channelId, { joinPolicy: 'open' })
-  // 遗留 Channel:成员不可读、不可加入(在主导入库内直接造一条 owner=NULL 行)
-  const orphanId = randomUUID()
-  const nowIso = new Date().toISOString()
-  db.prepare(
-    `INSERT INTO channels (id, name, description, scenario_prompt, llm_json, lead_agent_id, workspace, enabled, owner_user_id, created_at, updated_at)
-     VALUES (?, 'orphan-main', '', '', '', NULL, '', 1, NULL, ?, ?)`,
-  ).run(orphanId, nowIso, nowIso)
-  checkThrows('遗留 Channel 成员读 → 403 FORBIDDEN_LEGACY', () => manager.requireChannelMember(orphanId, B), 'FORBIDDEN_LEGACY')
-  checkThrows('遗留 Channel join → 403 FORBIDDEN_LEGACY', () => manager.requireCanJoinChannel(orphanId, B), 'FORBIDDEN_LEGACY')
-  check('admin 可读遗留 Channel', manager.requireChannelMember(orphanId, ADMIN).id === orphanId)
-  check('遗留 Channel 不出现在公开可发现清单', !manager.listDiscoverableChannels().some(c => c.id === orphanId))
-  // v17 收紧:遗留无主 Channel 的 HITL 审批不得再对"任意登录用户"放行
-  // (旧 respond.post 只做 getChannelForUser,而它对 owner=NULL 放行任意登录用户 → 审批旁路)
-  {
-    const { configureHitlRuntime } = await import('../../server/services/workshop/agents/hitl-registry')
-    const { assertCanDecideHitlChannel, canDecideHitlChannel } = await import('../../server/services/workshop/agents/hitl-decision')
-    configureHitlRuntime(() => manager as never)
-    checkThrows(
-      '遗留 Channel 普通用户审批 HITL → 403 FORBIDDEN_LEGACY_APPROVAL(审批旁路已收口)',
-      () => assertCanDecideHitlChannel(orphanId, B, {}),
-      'FORBIDDEN_LEGACY_APPROVAL',
-    )
-    check('遗留 Channel 审批资格布尔判定为 false', canDecideHitlChannel(orphanId, B, {}) === false)
-    check('admin 仍可裁决遗留 Channel', canDecideHitlChannel(orphanId, ADMIN, {}) === true)
-    configureHitlRuntime(null)
-  }
-  void workerId
-}