agentworkshop 0.8.5 → 0.8.6

package/scripts/e2e-node-binding-authz.mjs

@@ -0,0 +1,332 @@
+#!/usr/bin/env node
+/**
+ * 节点级写授权(双轨授权)实机 E2E —— 隔离实例 + 真实 HTTP + agent token 自证。
+ *
+ * 覆盖 docs/plans/2026-10-28-node-scoped-binding-plan.md 的 US-01..US-05:
+ *   M1 REST 恢复 kind='dcw' 绑定(operate 权限 + 首绑 manual + confirm 切 auto)
+ *   M2 双轨授权:trial 覆盖集 ⊆ 节点绑定面 / apply 全覆盖 / update 版本权仍归配方绑定
+ *   M3 换配方:line_id 解析活动配方,节点绑定 Agent 无需新绑定继续操作
+ *   M4 委派建/撤 dcw 绑定 + 在飞审批收回即失活 + 频道 manual 钳位叠加
+ *   M5 回归:越线绑定拒绝、tool-verify 写面拒绝、直写工具仍不可达
+ *
+ * 运行:node scripts/e2e-node-binding-authz.mjs
+ * 证据:docs/audit/evidence/2026-10-28-node-binding-authz/report.json(可用 AW_E2E_EVIDENCE 覆盖)
+ */
+import { spawn } from 'node:child_process'
+import { mkdirSync, openSync, writeFileSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { tmpdir } from 'node:os'
+import { DatabaseSync } from 'node:sqlite'
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const TAG = `nb${Date.now().toString(36).slice(-4)}`
+const ROOT = join(tmpdir(), `aw-node-binding-e2e-${TAG}`)
+mkdirSync(join(ROOT, 'home'), { recursive: true })
+writeFileSync(join(ROOT, 'home', 'runtime-settings.json'), JSON.stringify({
+  version: 1,
+  overrides: { 'security.hitl_timeout_ms': 20_000 },
+}))
+const results = []
+const ok = (id, name, cond, detail = '') => {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 600) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 600)}`}`)
+  return Boolean(cond)
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms))
+
+let port = 0
+for (const p of [3983, 3982, 3981, 3980]) {
+  try {
+    const r = await fetch(`http://127.0.0.1:${p}/api/health`, { signal: AbortSignal.timeout(1200) })
+    if (r.ok) continue
+  }
+  catch { /* 空闲 */ }
+  port = p
+  break
+}
+if (!port) {
+  console.error('无空闲端口')
+  process.exit(1)
+}
+const BASE = `http://127.0.0.1:${port}`
+process.env.NO_PROXY = '127.0.0.1,localhost'
+const logFd = openSync(join(ROOT, 'dev.log'), 'a')
+const child = spawn(process.execPath, [join(REPO, 'bin', 'aw.mjs'), 'dev', '--port', String(port)], {
+  cwd: REPO,
+  env: {
+    ...process.env,
+    AW_MODE: 'home',
+    AW_HOME: join(ROOT, 'home'),
+    AW_RATE_LIMIT_OFF: '1',
+    AW_TRIAL_INTERVAL_MS: '0',
+    NUXT_SESSION_PASSWORD: 'NodeBinding#2026-e2e-key',
+    NO_PROXY: '127.0.0.1,localhost',
+  },
+  stdio: ['ignore', logFd, logFd],
+  windowsHide: true,
+})
+
+async function api(method, path, body, token, extraHeaders = {}, timeoutMs = 120_000) {
+  const res = await fetch(BASE + path, {
+    method,
+    headers: {
+      ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      ...extraHeaders,
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(timeoutMs),
+  })
+  let json = null
+  try {
+    json = await res.json()
+  }
+  catch { /* 非 JSON */ }
+  return { status: res.status, ...json }
+}
+const invText = r => String(r?.data?.result?.text ?? r?.data?.text ?? '')
+const invErr = r => Boolean(r?.data?.result?.isError ?? r?.data?.isError)
+const dbPath = join(ROOT, 'home', 'data', 'workshop.sqlite')
+const agentTokenOf = (agentId) => {
+  const db = new DatabaseSync(dbPath)
+  try {
+    return String(db.prepare('SELECT token FROM channel_agents WHERE id = ?').get(agentId)?.token ?? '')
+  }
+  finally {
+    db.close()
+  }
+}
+
+async function waitPending(agentId, timeoutMs = 15_000) {
+  const started = Date.now()
+  while (Date.now() - started < timeoutMs) {
+    const r = await api('GET', `/api/workshop/agent-tools/approvals?agentId=${encodeURIComponent(agentId)}`, undefined, admin)
+    const card = (r?.data?.approvals ?? []).find(a => a.status === 'pending')
+    if (card) return card
+    await sleep(300)
+  }
+  return null
+}
+
+async function decide(cardId, approved, comment) {
+  return api('POST', `/api/workshop/agent-tools/approvals/${cardId}/decide`, { approved, comment }, admin)
+}
+
+let admin = ''
+try {
+  let healthy = false
+  for (let i = 0; i < 90; i++) {
+    await sleep(2000)
+    try {
+      const h = await api('GET', '/api/health', undefined, undefined, {}, 3000)
+      if (h?.data?.status === 'ok' && h?.data?.workshop === 'ready') {
+        healthy = true
+        break
+      }
+    }
+    catch { /* 未就绪 */ }
+  }
+  ok('T0', '隔离实例启动 + workshop ready', healthy, `port=${port}`)
+  if (!healthy) throw new Error('实例未就绪')
+
+  admin = (await api('POST', '/api/users/register', { name: `nb-admin-${TAG}`, email: `nb-${TAG}@awshop.local`, password: 'NbAdmin#2026' })).data?.token
+  ok('T0b', 'admin 注册', Boolean(admin))
+
+  // 普通用户(只读授权)用于验证 dcw 写向绑定需要 operate
+  const plainEmail = `nb-plain-${TAG}@awshop.local`
+  const created = await api('POST', '/api/users', { name: `nb-plain-${TAG}`, email: plainEmail, password: 'NbPlain#2026', role: 'user' }, admin)
+  const plainId = created?.data?.id ?? created?.data?.user?.id ?? ''
+  const plain = (await api('POST', '/api/users/login', { email: plainEmail, password: 'NbPlain#2026' })).data?.token
+  ok('T0c', '普通用户创建+登录', Boolean(plainId && plain), `create=${created.status} id=${plainId}`)
+
+  // ── 场景:产线 + 3 个数控节点 + 产品 + 配方 A,开跑 ──
+  const line = (await api('POST', '/api/workshop/dcw/lines', { name: `节点授权线-${TAG}` }, admin)).data?.line?.id
+  await api('PUT', '/api/workshop/permissions', { userId: plainId, grants: [{ lineId: line, mode: 'readonly' }] }, admin)
+  // 自定义参数模板(0~100℃):内置模板的安全量程是 150~200℃,与本场景候选值不匹配
+  const tpl = (await api('POST', '/api/workshop/dcw/templates', { name: `授权参数-${TAG}`, ch: '温度', unit: '℃', min: 0, max: 100, decimals: 1 }, admin)).data?.template?.key
+  const nodeBody = i => ({
+    templateRef: tpl,
+    name: `授权节点${i}-${TAG}`,
+    driver: 'mock',
+    lineId: line,
+    stepLimit: 20,
+    writeLockSeconds: 0,
+    readIntervalMs: 0,
+    driverConfig: { key: `nb-${TAG}-${i}` },
+  })
+  const n1 = (await api('POST', '/api/workshop/dcw', nodeBody(1), admin)).data?.node?.id
+  const n2 = (await api('POST', '/api/workshop/dcw', nodeBody(2), admin)).data?.node?.id
+  const n3 = (await api('POST', '/api/workshop/dcw', nodeBody(3), admin)).data?.node?.id
+  const product = (await api('POST', '/api/workshop/dcw/products', { lineId: line, name: `授权产品-${TAG}` }, admin)).data?.product?.id
+  const recipeA = (await api('POST', '/api/workshop/dcw/recipes', {
+    productId: product,
+    name: `配方A-${TAG}`,
+    opIntervalMs: 0,
+    params: [{ nodeId: n1, value: 50 }, { nodeId: n2, value: 50 }],
+  }, admin)).data?.recipe?.id
+  ok('T1', '产线/参数模板/3 数控节点/产品/配方A 就绪', Boolean(line && tpl && n1 && n2 && n3 && product && recipeA), JSON.stringify({ line, tpl, n1, n2, n3, recipeA }))
+  const startA = await api('POST', `/api/workshop/dcw/lines/${line}/start`, { recipeId: recipeA }, admin)
+  ok('T1b', '产线开跑(配方A 整批下发,活动批次建立)', startA.status === 200 && Boolean(startA?.data?.run?.id), `status=${startA.status} msg=${String(startA?.message ?? '').slice(0, 160)}`)
+
+  // 产线总闸切 auto(绑定 manual 仍是 manual;后续显式 PATCH 绑定)
+  const lineAuto = await api('PATCH', `/api/workshop/dcw/lines/${line}`, { controlMode: 'auto', confirm: true }, admin)
+  ok('T1c', '产线 controlMode 切 auto(confirm)', lineAuto.status === 200 && lineAuto?.data?.line?.controlMode === 'auto', `status=${lineAuto.status}`)
+
+  // ── 频道(绑线)+ lead + 3 worker ──
+  const ch = (await api('POST', '/api/workshop/channels', { name: `节点授权频道-${TAG}`, leadAgent: { name: `nb-lead-${TAG}`, harness: 'mock' } }, admin)).data
+  const channelId = ch?.channelId
+  const leadId = String(ch?.leadAgent?.id ?? ch?.leadAgentId ?? '')
+  await api('PUT', `/api/workshop/channels/${channelId}/line`, { lineId: line }, admin)
+  const w1raw = (await api('POST', `/api/workshop/channels/${channelId}/agents`, { name: `nb-w1-${TAG}`, harness: 'mock', role: 'worker' }, admin)).data
+  const w2raw = (await api('POST', `/api/workshop/channels/${channelId}/agents`, { name: `nb-w2-${TAG}`, harness: 'mock', role: 'worker' }, admin)).data
+  const w3raw = (await api('POST', `/api/workshop/channels/${channelId}/agents`, { name: `nb-w3-${TAG}`, harness: 'mock', role: 'worker' }, admin)).data
+  const w1 = String(w1raw?.id ?? w1raw?.agentId ?? '')
+  const w2 = String(w2raw?.id ?? w2raw?.agentId ?? '')
+  const w3 = String(w3raw?.id ?? w3raw?.agentId ?? '')
+  ok('T2', '频道绑线 + lead + 3 worker', Boolean(channelId && leadId && w1 && w2 && w3), JSON.stringify({ channelId, leadId, w1, w2, w3 }))
+  const tok = { lead: agentTokenOf(leadId), w1: agentTokenOf(w1), w2: agentTokenOf(w2), w3: agentTokenOf(w3) }
+  ok('T2b', 'Agent token 自证可用(4 个独立 token)', Object.values(tok).every(t => t.length > 20), JSON.stringify(Object.fromEntries(Object.entries(tok).map(([k, v]) => [k, v.length]))))
+
+  const callAs = (agentId, token, tool, args) => api('POST', '/api/workshop/agent-tools/invoke', { agentId, tool, args }, undefined, { 'x-aw-agent-token': token })
+  const bind = (agentId, nodeId, kind, mode) => api('POST', '/api/workshop/agent-tools/bindings', { agentId, nodeId, kind, ...(mode ? { mode } : {}) }, admin)
+  const setBindingMode = (id, mode, confirm = false) => api('PATCH', `/api/workshop/agent-tools/bindings/${id}`, confirm ? { mode, confirm: true } : { mode }, admin)
+
+  // ── M1:dcw 绑定恢复 + 首绑 manual + readonly 403 + confirm 切 auto ──
+  const b1 = await bind(w1, n1, 'dcw', 'auto')
+  ok('T3', 'POST kind=dcw 绑定 → 200 且首绑强制 manual(modeForced 回执)',
+    b1.status === 200 && b1?.data?.binding?.mode === 'manual' && b1?.data?.modeForced === 'manual',
+    `status=${b1.status} mode=${b1?.data?.binding?.mode} forced=${b1?.data?.modeForced} msg=${String(b1?.message ?? '').slice(0, 160)}`)
+  const b1Id = String(b1?.data?.binding?.id ?? '')
+
+  const plainBind = await api('POST', '/api/workshop/agent-tools/bindings', { agentId: w1, nodeId: n1, kind: 'dcw' }, plain)
+  ok('T3b', '只读用户建 dcw 绑定 → 403(写授权面需 operate)', plainBind.status === 403, `status=${plainBind.status} code=${String(plainBind?.code ?? '')} msg=${String(plainBind?.message ?? '').slice(0, 160)}`)
+
+  const noConfirm = await setBindingMode(b1Id, 'auto')
+  ok('T3c', '绑定 manual→auto 无 confirm → 400 MODE_CONFIRM_REQUIRED', noConfirm.status === 400 && noConfirm?.code === 'MODE_CONFIRM_REQUIRED', `status=${noConfirm.status} code=${String(noConfirm?.code ?? '')}`)
+  const withConfirm = await setBindingMode(b1Id, 'auto', true)
+  ok('T3d', '绑定 manual→auto 携 confirm:true → 200 auto', withConfirm.status === 200 && withConfirm?.data?.binding?.mode === 'auto', `status=${withConfirm.status} mode=${withConfirm?.data?.binding?.mode}`)
+  const listW1 = await api('GET', `/api/workshop/agent-tools/list?agentId=${encodeURIComponent(w1)}`, undefined, undefined, { 'x-aw-agent-token': tok.w1 })
+  const trialDesc = String((listW1?.data?.tools ?? []).find(t => t.name === 'recipe_trial')?.description ?? '')
+  ok('T3e', '工具注入面带点位写授权清单(模型无需探测绑定面)', trialDesc.includes(n1) && /写授权面/.test(trialDesc), trialDesc.slice(-240))
+
+  // ── M4:频道 manual 钳位对节点绑定 Agent 同样生效(挂 HITL,批准后执行) ──
+  const chManual = await api('PATCH', `/api/workshop/channels/${channelId}/execution-mode`, { mode: 'manual' }, admin)
+  ok('T4', '频道切 manual(降险方向免 confirm)', chManual.status === 200 && chManual?.data?.executionMode === 'manual', `status=${chManual.status} mode=${chManual?.data?.executionMode}`)
+  const trialP = callAs(w1, tok.w1, 'recipe_trial', {
+    line_id: line,
+    params: [{ node_id: n1, value: 55 }],
+    hypothesis: 'E2E:频道 manual 钳位对节点绑定 Agent 生效',
+  })
+  const cardM = await waitPending(w1, 15_000)
+  ok('T4b', '频道 manual + dcw auto 绑定 → trial 挂起人工审批', Boolean(cardM), cardM ? `card=${cardM.id}` : '未出现审批卡')
+  if (cardM) await decide(cardM.id, true, 'E2E 批准:频道 manual 钳位验证')
+  const trialM = await trialP
+  ok('T4c', '人工批准后节点绑定 trial 执行成功(ACK 证实)', !invErr(trialM) && /试验已整批下发/.test(invText(trialM)), invText(trialM).slice(0, 240))
+  const chAuto = await api('PATCH', `/api/workshop/channels/${channelId}/execution-mode`, { mode: 'auto', confirm: true }, admin)
+  ok('T4d', '频道切回 auto(confirm)', chAuto.status === 200 && chAuto?.data?.executionMode === 'auto', `status=${chAuto.status} mode=${chAuto?.data?.executionMode}`)
+
+  // ── M2:覆盖集判定 ──
+  const trialOk = await callAs(w1, tok.w1, 'recipe_trial', { line_id: line, params: [{ node_id: n1, value: 56 }], hypothesis: 'E2E:节点绑定覆盖集内' })
+  ok('T5', 'trial 覆盖集 ⊆ 节点绑定面 → 成功(line_id 解析活动配方)', !invErr(trialOk) && /试验已整批下发/.test(invText(trialOk)), invText(trialOk).slice(0, 220))
+  const trialNo = await callAs(w1, tok.w1, 'recipe_trial', { line_id: line, params: [{ node_id: n2, value: 56 }], hypothesis: 'E2E:未授权节点' })
+  ok('T5b', 'trial 含未授权节点 → 写面拒绝且点名节点', invErr(trialNo) && /写授权|绑定面/.test(invText(trialNo)) && invText(trialNo).includes(n2), invText(trialNo).slice(0, 260))
+  const applyNo = await callAs(w1, tok.w1, 'recipe_apply', { line_id: line, reason: 'E2E:部分覆盖整批下发应被拒' })
+  ok('T5c', 'apply 整批(2 参数)仅 1 节点绑定 → 拒绝并给出补绑指引', invErr(applyNo) && /补绑|绑定该配方|不在你的数控节点绑定面/.test(invText(applyNo)), invText(applyNo).slice(0, 260))
+  const updateNo = await callAs(w1, tok.w1, 'recipe_update', { line_id: line, params: [{ node_id: n1, value: 57 }], reason: 'E2E:节点绑定不应授予版本权' })
+  ok('T5d', 'recipe_update(版本操作)纯 dcw 绑定 → 拒绝', invErr(updateNo) && /版本操作|配方级操作权/.test(invText(updateNo)), invText(updateNo).slice(0, 240))
+
+  // 绑定第二节点 → apply 全覆盖放行
+  const b2 = await bind(w1, n2, 'dcw', 'auto')
+  await setBindingMode(String(b2?.data?.binding?.id ?? ''), 'auto', true)
+  ok('T6', '补齐第二节点绑定(auto)', b2.status === 200 && b2?.data?.binding?.kind === 'dcw', `status=${b2.status} id=${b2?.data?.binding?.id}`)
+  const applyOk = await callAs(w1, tok.w1, 'recipe_apply', { line_id: line, reason: 'E2E:全覆盖整批下发' })
+  ok('T6b', 'apply 全覆盖 → 成功(整批 ACK 证实)', !invErr(applyOk) && /已整批下发/.test(invText(applyOk)), invText(applyOk).slice(0, 240))
+
+  // ── US-05:收权即失活 ──
+  const revoke1 = await api('DELETE', `/api/workshop/agent-tools/bindings/${b1Id}`, undefined, admin)
+  ok('T7', '删除 n1 绑定 200', revoke1.status === 200, `status=${revoke1.status}`)
+  const afterRevoke = await callAs(w1, tok.w1, 'recipe_trial', { line_id: line, params: [{ node_id: n1, value: 58 }], hypothesis: 'E2E:收权后应拒绝' })
+  ok('T7b', '撤销 n1 绑定后 trial n1 → 拒绝(收权即失活)', invErr(afterRevoke) && /写授权|绑定面/.test(invText(afterRevoke)), invText(afterRevoke).slice(0, 220))
+
+  // ── M3:换配方(rc-A → rc-B),节点绑定 Agent 无需新绑定 ──
+  const stopA = await api('POST', `/api/workshop/dcw/lines/${line}/stop`, undefined, admin)
+  const recipeB = (await api('POST', '/api/workshop/dcw/recipes', {
+    productId: product,
+    name: `配方B-${TAG}`,
+    opIntervalMs: 0,
+    params: [{ nodeId: n1, value: 45 }, { nodeId: n3, value: 65 }],
+  }, admin)).data?.recipe?.id
+  const startB = await api('POST', `/api/workshop/dcw/lines/${line}/start`, { recipeId: recipeB }, admin)
+  ok('T8', '换配方:停 A 开 B(活动批次切换)', stopA.status === 200 && startB.status === 200 && Boolean(recipeB), `stop=${stopA.status} start=${startB.status} recipeB=${recipeB}`)
+  const b1again = await bind(w1, n1, 'dcw', 'auto')
+  await setBindingMode(String(b1again?.data?.binding?.id ?? ''), 'auto', true)
+  const b3 = await bind(w1, n3, 'dcw', 'auto')
+  await setBindingMode(String(b3?.data?.binding?.id ?? ''), 'auto', true)
+  ok('T8b', '为配方B 绑定 n1+n3 点位授权', b1again.status === 200 && b3.status === 200, `status=${b1again.status}/${b3.status}`)
+  const trialB = await callAs(w1, tok.w1, 'recipe_trial', { line_id: line, params: [{ node_id: n3, value: 66 }], hypothesis: 'E2E:换配方后节点绑定继续生效' })
+  ok('T8c', '换配方后同一 Agent 对 B 的已授权节点 trial 成功(无新配方绑定)', !invErr(trialB) && /试验已整批下发/.test(invText(trialB)), invText(trialB).slice(0, 240))
+  const bW2 = await bind(w2, recipeA, 'recipe')
+  ok('T8d', 'w2 绑定配方A(配方级操作权)', bW2.status === 200, `status=${bW2.status}`)
+  const trialW2 = await callAs(w2, tok.w2, 'recipe_trial', { line_id: line, params: [{ node_id: n1, value: 47 }], hypothesis: 'E2E:配方绑定不随换配方生效' })
+  ok('T8e', '配方绑定 Agent 对 B 仍被拒(授权是配方级,不随换配方漂移)', invErr(trialW2) && /绑定面|未绑定/.test(invText(trialW2)), invText(trialW2).slice(0, 240))
+
+  // ── M4:委派建/撤 dcw 绑定 + 在飞审批收回即失活 ──
+  const leadBind = await bind(leadId, n1, 'dcw', 'auto')
+  await setBindingMode(String(leadBind?.data?.binding?.id ?? ''), 'auto', true)
+  const grant = await callAs(leadId, tok.lead, 'team_grant_nodes', { agent_id: w3, node_ids: [n1], mode: 'auto' })
+  ok('T9', 'lead 委派 dcw 节点给 worker(team_grant_nodes)成功', !invErr(grant) && /已把\s*1\s*条节点授权授予/.test(invText(grant)), invText(grant).slice(0, 240))
+  const w3b = await api('GET', `/api/workshop/agent-tools/bindings?agentId=${encodeURIComponent(w3)}`, undefined, admin)
+  const w3has = (w3b?.data?.bindings ?? []).some(b => b.nodeId === n1 && b.kind === 'dcw')
+  ok('T9b', '委派落库:worker 绑定面出现 n1(dcw)', w3has, JSON.stringify(w3b?.data?.bindings ?? []).slice(0, 280))
+
+  const chManual2 = await api('PATCH', `/api/workshop/channels/${channelId}/execution-mode`, { mode: 'manual' }, admin)
+  ok('T9c', '频道 manual(为在飞审批收回测试)', chManual2.status === 200, `status=${chManual2.status}`)
+  const trialW3P = callAs(w3, tok.w3, 'recipe_trial', { line_id: line, params: [{ node_id: n1, value: 46 }], hypothesis: 'E2E:委派绑定在飞审批' })
+  const cardW3 = await waitPending(w3, 15_000)
+  ok('T9d', '委派绑定(auto)在频道 manual 下仍挂人工审批', Boolean(cardW3), cardW3 ? `card=${cardW3.id}` : '未出现审批卡')
+  const revoke = await callAs(leadId, tok.lead, 'team_revoke_nodes', { agent_id: w3, node_ids: [n1] })
+  ok('T9e', 'lead 收回委派(dcw 写授权)', !invErr(revoke) && /已收回\s*1\s*条授权/.test(invText(revoke)), invText(revoke).slice(0, 220))
+  const trialW3 = await trialW3P
+  ok('T9f', '收回后在飞审批按拒收敛(trial 未执行)', /未批准|失效|授权/.test(invText(trialW3)), invText(trialW3).slice(0, 220))
+  const pendW3 = await api('GET', `/api/workshop/agent-tools/approvals?agentId=${encodeURIComponent(w3)}`, undefined, admin)
+  ok('T9g', '审批面板无残留 pending(收回即失活)', (pendW3?.data?.approvals ?? []).filter(a => a.status === 'pending').length === 0, JSON.stringify((pendW3?.data?.approvals ?? []).slice(0, 3)).slice(0, 240))
+  const trialW3After = await callAs(w3, tok.w3, 'recipe_trial', { line_id: line, params: [{ node_id: n1, value: 46 }], hypothesis: 'E2E:收回后再次提交' })
+  ok('T9h', '收回后再提交 → 写面拒绝', invErr(trialW3After) && /写授权|绑定面/.test(invText(trialW3After)), invText(trialW3After).slice(0, 220))
+  await api('PATCH', `/api/workshop/channels/${channelId}/execution-mode`, { mode: 'auto', confirm: true }, admin)
+
+  // ── M5 回归:越线绑定拒绝 + 直写工具仍不可用 ──
+  const lineB = (await api('POST', '/api/workshop/dcw/lines', { name: `节点授权线B-${TAG}` }, admin)).data?.line?.id
+  const nB = (await api('POST', '/api/workshop/dcw', { ...nodeBody(9), lineId: lineB, name: `他线节点-${TAG}` }, admin)).data?.node?.id
+  const cross = await bind(w2, nB, 'dcw')
+  ok('T10', '频道绑 A 线 → 成员绑定 B 线节点被拒(403 产线隔离)', cross.status === 403, `status=${cross.status} code=${String(cross?.code ?? '')}`)
+  const direct = await callAs(w1, tok.w1, 'dcw_control', { node_id: n1, value: 50, hypothesis: 'E2E:直写工具必须仍不可达' })
+  ok('T10b', '直写工具 dcw_control 仍不可达(未注册/禁写)', invErr(direct) || /未知工具|不可用|停用|拒绝/.test(invText(direct)), invText(direct).slice(0, 200))
+}
+catch (err) {
+  ok('FATAL', 'E2E 未捕获异常', false, err instanceof Error ? `${err.message}\n${err.stack ?? ''}` : String(err))
+}
+finally {
+  try {
+    child.kill()
+  }
+  catch { /* noop */ }
+  const passed = results.filter(r => r.pass).length
+  const total = results.length
+  const evidenceDir = process.env.AW_E2E_EVIDENCE
+    ? dirname(process.env.AW_E2E_EVIDENCE)
+    : join(REPO, 'docs', 'audit', 'evidence', '2026-10-28-node-binding-authz')
+  mkdirSync(evidenceDir, { recursive: true })
+  const evidencePath = process.env.AW_E2E_EVIDENCE
+    ? process.env.AW_E2E_EVIDENCE
+    : join(evidenceDir, 'report.json')
+  writeFileSync(evidencePath, JSON.stringify({
+    at: new Date().toISOString(),
+    env: { base: BASE, home: join(ROOT, 'home'), devLog: join(ROOT, 'dev.log'), mode: 'isolated' },
+    summary: { total, passed, failed: total - passed, verdict: passed === total ? 'PASS' : 'FAIL' },
+    results,
+  }, null, 2))
+  console.log(`\n结论:${passed === total ? 'PASS' : 'FAIL'}(${passed}/${total})`)
+  console.log(`证据:${evidencePath}`)
+  process.exit(passed === total ? 0 : 1)
+}

package/scripts/security-acceptance.mjs

@@ -0,0 +1,218 @@
+/**
+ * 2026-10-28 安全加固验收脚本(可复跑)。
+ * 前置:隔离实例已由文档中的 setup 流程建立场景(scenario.json/admin.json)。
+ * 用法: AW_BASE_URL=http://127.0.0.1:3410 AW_E2E_DIR=/path/to/e2e node scripts/security-acceptance.mjs
+ * 环境: AW_BASE_URL / AW_E2E_DIR;证据默认写 docs/audit/evidence/<date>-security-hardening。
+ */
+/**
+ * 2026-10-28 安全加固验收(S1-S9 已实施项)。
+ * 前置:隔离实例运行在 127.0.0.1:3410,场景已由 setup.mjs 建立。
+ * 输出:docs/audit/evidence/2026-10-28-security-hardening/report.json
+ */
+import fs from 'node:fs'
+
+const BASE = process.env.AW_BASE_URL ?? 'http://127.0.0.1:3410'
+const ROOT = process.cwd()
+const E2E_DIR = process.env.AW_E2E_DIR ?? 'D:/tmp/aw-e2e-20261028'
+const scenario = JSON.parse(fs.readFileSync(`${E2E_DIR}/scenario.json`, 'utf8'))
+const admin = JSON.parse(fs.readFileSync(`${E2E_DIR}/admin.json`, 'utf8'))
+
+const results = []
+function record(id, name, pass, expected, actual, note = '') {
+  results.push({ id, name, pass, expected, actual, note })
+  console.log(`${pass ? 'PASS' : 'FAIL'} ${id} ${name} | expected=${expected} actual=${actual}${note ? ' | ' + note : ''}`)
+}
+
+async function call(method, path, { body, token, headers = {} } = {}) {
+  const r = await fetch(BASE + path, {
+    method,
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+      ...headers,
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+  const text = await r.text()
+  let json = null
+  try {
+    json = JSON.parse(text)
+  }
+  catch { /* non-json */ }
+  return { status: r.status, json, text }
+}
+
+const ADMIN = admin.resp.data.token
+const runId = (await call('GET', `/api/workshop/dcw/recipes`, { token: ADMIN })).json?.data?.runs?.[0]?.id
+
+// ---- 普通用户(幂等:密码存 E2E_DIR/user2.json;已存在则重置密码) ----
+const USER_FILE = `${E2E_DIR}/user2.json`
+let userFixture = null
+try {
+  userFixture = JSON.parse(fs.readFileSync(USER_FILE, 'utf8'))
+}
+catch { /* 首次运行 */ }
+const USER_PW = userFixture?.password ?? (`u2-${Math.random().toString(36).slice(2, 14)}`)
+const u2reg = await call('POST', '/api/users', { token: ADMIN, body: { name: 'Sec User2', email: 'sec-user2@aw.local', password: USER_PW, role: 'user' } })
+if (u2reg.status !== 200 && u2reg.status !== 201) {
+  const list = await call('GET', '/api/users?keyword=sec-user2&pageSize=50', { token: ADMIN })
+  const rows = list.json?.data?.items ?? list.json?.data?.users ?? list.json?.data ?? []
+  const row = Array.isArray(rows) ? rows.find(u => u.email === 'sec-user2@aw.local') : null
+  if (row?.id) await call('PUT', `/api/users/${row.id}`, { token: ADMIN, body: { password: USER_PW } })
+}
+const u2login = await call('POST', '/api/users/login', { body: { email: 'sec-user2@aw.local', password: USER_PW } })
+const USER = u2login.json?.data?.token
+const USER_ID = u2login.json?.data?.user?.id
+fs.writeFileSync(USER_FILE, JSON.stringify({ email: 'sec-user2@aw.local', password: USER_PW, id: USER_ID }, null, 2))
+record('AUTH-0', '普通用户创建/登录(幂等)', Boolean(USER), 'token', u2login.status)
+
+// 每次运行先撤销历史授权,保证"无产线授权"负例可重复
+if (USER_ID) {
+  await call('PUT', '/api/workshop/permissions', {
+    token: ADMIN,
+    body: {
+      userId: USER_ID,
+      grants: [{ lineId: scenario.A.line.id, mode: null }, { lineId: scenario.B.line.id, mode: null }],
+    },
+  })
+}
+
+// 1) 未授权/无产线授权
+const noAuth = await call('GET', '/api/workshop/dcw/recipes')
+record('S4-1', '未认证读配方 → 401', noAuth.status === 401, 401, noAuth.status)
+
+const u2Recipes = await call('GET', '/api/workshop/dcw/recipes', { token: USER })
+const empty = (u2Recipes.json?.data?.recipes ?? []).length === 0 && (u2Recipes.json?.data?.runs ?? []).length === 0
+record('S4-2', '无产线授权读配方列表 → 空集(非全量)', u2Recipes.status === 200 && empty, '200 + []', `${u2Recipes.status} + recipes=${u2Recipes.json?.data?.recipes?.length}`)
+
+const u2Journal = await call('GET', '/api/workshop/dcw/journal', { token: USER })
+record('S4-3', '无授权读写账本 → 空集', (u2Journal.json?.data?.anchors ?? []).length === 0, '[]', (u2Journal.json?.data?.anchors ?? []).length)
+
+const u2Alarms = await call('GET', '/api/workshop/daq/alarms', { token: USER })
+record('S4-4', '无授权读报警 → 空集', (u2Alarms.json?.data?.alarms ?? []).length === 0, '[]', (u2Alarms.json?.data?.alarms ?? []).length)
+
+const u2Read = await call('POST', `/api/workshop/dcw/${scenario.A.dcwTemp.id}/read`, { token: USER, body: {} })
+record('S4-5', '无授权读节点 PLC 值 → 403', u2Read.status === 403, 403, u2Read.status)
+
+const u2Del = await call('DELETE', `/api/workshop/dcw/recipes/${scenario.A.recipe.id}`, { token: USER })
+record('S4-6', '无授权删配方 → 403', u2Del.status === 403, 403, u2Del.status)
+
+const u2Close = await call('POST', `/api/workshop/dcw/runs/${runId}/close`, { token: USER, body: {} })
+record('S4-7', '无授权关批次 → 403', u2Close.status === 403, 403, u2Close.status)
+
+// 2) 控制面权限
+const u2Test = await call('POST', '/api/workshop/daq/test-driver', { token: USER, body: { driver: 'mock', driverConfig: {} } })
+record('S5-1', '普通用户 test-driver → 403', u2Test.status === 403, 403, u2Test.status)
+const u2TestDcw = await call('POST', '/api/workshop/dcw/test-driver', { token: USER, body: { driver: 'mock', driverConfig: {} } })
+record('S5-2', '普通用户 dcw test-driver → 403', u2TestDcw.status === 403, 403, u2TestDcw.status)
+const u2Reconnect = await call('POST', '/api/workshop/daq/infra/reconnect', { token: USER, body: {} })
+record('S5-3', '普通用户 infra/reconnect → 403', u2Reconnect.status === 403, 403, u2Reconnect.status)
+const adminTest = await call('POST', '/api/workshop/daq/test-driver', { token: ADMIN, body: { driver: 'mock', driverConfig: {} } })
+record('S5-4', 'admin test-driver 仍可用', adminTest.status === 200, 200, adminTest.status)
+
+// S12:ingest 时间戳方向
+const futureAt = new Date(Date.now() + 5 * 60_000).toISOString()
+const futureIngest = await call('POST', `/api/workshop/daq/${scenario.A.daqTemp.id}/ingest`, {
+  token: ADMIN,
+  body: { at: futureAt, value: 1 },
+})
+record('S12-1', '未来时间戳 ingest → 400 FUTURE_TIMESTAMP', futureIngest.status === 400 && futureIngest.json?.code === 'FUTURE_TIMESTAMP', '400 FUTURE_TIMESTAMP', `${futureIngest.status} ${futureIngest.json?.code}`)
+
+const backfillAt = new Date(Date.now() - 10 * 60_000).toISOString()
+const backfillIngest = await call('POST', `/api/workshop/daq/${scenario.A.daqTemp.id}/ingest`, {
+  token: ADMIN,
+  body: { at: backfillAt, value: 1 },
+})
+record('S12-2', '10 分钟前回填 ingest → 200', backfillIngest.status === 200, 200, backfillIngest.status)
+
+// S15:Modbus 原始量程不可表示 → 配置期拒绝
+const badRaw = await call('POST', '/api/workshop/dcw', {
+  token: ADMIN,
+  body: {
+    templateRef: 'temp-sp',
+    name: '验收-坏原始量程',
+    driver: 'modbus-tcp',
+    driverConfig: { host: '127.0.0.1', register: 1, dataType: 'int16', rawMin: 0, rawMax: 70000 },
+    lineId: scenario.A.line.id,
+  },
+})
+record('S15-1', 'int16 rawMax=70000 → 400 配置期拒绝', badRaw.status === 400 && /int16/.test(String(badRaw.text ?? '')), '400 + int16', `${badRaw.status} ${String(badRaw.text).slice(0, 120)}`)
+
+// 3) harness 启动面
+const u2Ch = await call('POST', '/api/workshop/channels', {
+  token: USER,
+  body: { name: 'u2-注入测试', leadAgent: { name: 'evil', harness: 'omp', config: { command: 'cmd.exe', args: ['/c', 'whoami'] } } },
+})
+record('S1-1', '非 admin 创建 Channel 带 command → 403', u2Ch.status === 403 && u2Ch.json?.code === 'HARNESS_SPAWN_FORBIDDEN', '403 HARNESS_SPAWN_FORBIDDEN', `${u2Ch.status} ${u2Ch.json?.code}`)
+
+const u2Agent = await call('POST', '/api/workshop/agents', {
+  token: USER,
+  body: { name: 'evil-agent', harness: 'omp', config: { command: '/bin/sh', args: ['-c', 'id'] } },
+})
+record('S1-2', '非 admin 创建 Agent 带 command → 403', u2Agent.status === 403 && u2Agent.json?.code === 'HARNESS_SPAWN_FORBIDDEN', '403 HARNESS_SPAWN_FORBIDDEN', `${u2Agent.status} ${u2Agent.json?.code}`)
+
+const adminCmd = await call('POST', '/api/workshop/agents', {
+  token: ADMIN,
+  body: { name: 'evil-admin-agent', harness: 'omp', config: { command: 'cmd.exe', args: ['/c', 'whoami'] } },
+})
+record('S1-3', 'admin 指定通用解释器 → 403 HARNESS_COMMAND_DENIED', adminCmd.status === 403 && adminCmd.json?.code === 'HARNESS_COMMAND_DENIED', '403 HARNESS_COMMAND_DENIED', `${adminCmd.status} ${adminCmd.json?.code}`)
+
+const u2ChPlain = await call('POST', '/api/workshop/channels', { token: USER, body: { name: 'u2-成员注入测试' } })
+const u2ChId = u2ChPlain.json?.data?.channelId
+const u2Member = u2ChId
+  ? await call('POST', `/api/workshop/channels/${u2ChId}/agents`, { token: USER, body: { name: 'm', harness: 'omp', config: { args: ['--no-session'] } } })
+  : { status: 0, json: null }
+record('S1-4', '非 admin 新增成员带 args → 403', u2Member.status === 403 && u2Member.json?.code === 'HARNESS_SPAWN_FORBIDDEN', '403 HARNESS_SPAWN_FORBIDDEN', `${u2Member.status} ${u2Member.json?.code}`)
+
+const u2Tpl = await call('POST', '/api/workshop/channel-templates', {
+  token: USER,
+  body: { name: 'u2-tpl', lead: { name: 'l', harness: 'omp', config: { args: ['--no-session'] } } },
+})
+record('S1-5', '非 admin 建模板内联 args → 403', u2Tpl.status === 403 && u2Tpl.json?.code === 'HARNESS_SPAWN_FORBIDDEN', '403 HARNESS_SPAWN_FORBIDDEN', `${u2Tpl.status} ${u2Tpl.json?.code}`)
+
+// 4) Agent token 不回显
+const rotate = await call('POST', `/api/workshop/channels/${scenario.manual.channelId}/agents/${scenario.manual.worker.id}/rotate-token`, { token: ADMIN, body: {} })
+const workerToken = rotate.json?.data?.token
+const roster = await call('GET', `/api/workshop/channels/${scenario.manual.channelId}/agents`, { headers: { authorization: `Bearer ${workerToken ?? ''}` } })
+const leaked = JSON.stringify(roster.json ?? {})
+record('S3-1', 'worker Agent token 拉名册 → 200', roster.status === 200, 200, roster.status)
+record('S3-2', '名册不含 token 字段', !leaked.includes('"token"'), 'no "token"', leaked.includes('"token"') ? 'LEAK' : 'clean')
+record('S3-3', '名册不含 config 字段(非属主)', !leaked.includes('"config"'), 'no "config"', leaked.includes('"config"') ? 'LEAK' : 'clean')
+
+// 5) 授权 operate 后的数据面
+if (USER_ID) {
+  await call('PUT', '/api/workshop/permissions', { token: ADMIN, body: { userId: USER_ID, grants: [{ lineId: scenario.A.line.id, mode: 'operate' }] } })
+}
+const u2Recipes2 = await call('GET', '/api/workshop/dcw/recipes', { token: USER })
+const gotOne = (u2Recipes2.json?.data?.recipes ?? []).length === 1
+record('S4-8', '仅授权线A → 只看到线A的1个配方', gotOne, 1, (u2Recipes2.json?.data?.recipes ?? []).length)
+
+const u2PatchMin = await call('PATCH', `/api/workshop/dcw/${scenario.A.dcwTemp.id}`, { token: USER, body: { min: 10 } })
+record('S2-1', 'operate 改 min(安全字段) → 403', u2PatchMin.status === 403 && u2PatchMin.json?.code === 'DCW_CONFIG_ADMIN_ONLY', '403 DCW_CONFIG_ADMIN_ONLY', `${u2PatchMin.status} ${u2PatchMin.json?.code}`)
+
+const u2PatchName = await call('PATCH', `/api/workshop/dcw/${scenario.A.dcwTemp.id}`, { token: USER, body: { name: '温度设定(手动线)' } })
+record('S2-2', 'operate 改 name(运行字段) → 200', u2PatchName.status === 200, 200, u2PatchName.status)
+
+const u2PatchDaq = await call('PATCH', `/api/workshop/daq/${scenario.A.daqTemp.id}`, { token: USER, body: { driver: 'mock' } })
+record('S2-3', 'operate 改 DAQ driver → 403', u2PatchDaq.status === 403 && u2PatchDaq.json?.code === 'DAQ_CONFIG_ADMIN_ONLY', '403 DAQ_CONFIG_ADMIN_ONLY', `${u2PatchDaq.status} ${u2PatchDaq.json?.code}`)
+
+const u2Read2 = await call('POST', `/api/workshop/dcw/${scenario.A.dcwTemp.id}/read`, { token: USER, body: {} })
+record('S4-9', '授权线A后可读节点 PLC 值 → 200', u2Read2.status === 200, 200, u2Read2.status)
+
+const u2Query = await call('GET', `/api/workshop/daq/query?line_id=${scenario.A.line.id}&last_minutes=5&limit=2`, { token: USER })
+record('S4-10', '授权线A后可查数采 → 200', u2Query.status === 200, 200, u2Query.status)
+
+// ---- 汇总 ----
+const pass = results.filter(r => r.pass).length
+const fail = results.length - pass
+const outDir = `${ROOT}/docs/audit/evidence/2026-10-28-security-hardening`
+fs.mkdirSync(outDir, { recursive: true })
+fs.writeFileSync(`${outDir}/report.json`, JSON.stringify({
+  suite: 'security-hardening',
+  at: new Date().toISOString(),
+  base: BASE,
+  totals: { total: results.length, pass, fail },
+  results,
+}, null, 2))
+console.log(`\n结论:${fail === 0 ? 'PASS' : 'FAIL'}(${pass}/${results.length}) → ${outDir}/report.json`)
+process.exit(fail === 0 ? 0 : 1)

package/server/api/workshop/agent-tools/bindings/index.post.ts

@@ -1,14 +1,20 @@
 /**
- * POST /api/workshop/agent-tools/bindings —— 绑定 Agent ↔ 工业节点。
- * body: { agentId, nodeId, kind: 'dcw'|'daq', mode?: 'auto'|'manual' }
+ * POST /api/workshop/agent-tools/bindings —— 绑定 Agent ↔ 工业对象。
+ * body: { agentId, nodeId, kind: 'dcw'|'daq'|'recipe', mode?: 'auto'|'manual' }
  * 产线权限:普通用户仅可绑定自己有权产线的节点——daq 绑定需「仅查看」及以上,
- * dcw(写控)绑定需「可操控」;admin/editor 不受限。
+ * dcw/recipe(写向)绑定需「可操控」;admin/editor 不受限。
  *
- * auto 治理(产线 Co-Pilot P2,计划 §5.4 铁律 2):**dcw 绑定首绑强制 manual**——
- * dcw 写控面挂着逐次人工审批闸,创建即 auto 等于免审上线(旧实现 body.mode 缺省
- * 还是 'auto'),故 body.mode 对 dcw 一律忽略;显式传 auto 不静默吞掉,响应附
- * modeForced + notice 提示(响应形状向后兼容,多余字段无害)。如需 auto,应在
- * 绑定创建后走 PATCH 携 confirm:true 显式切换(见 [id].patch.ts)。
+ * 双轨授权(2026-10-28 节点级写授权计划 M1):
+ *   - kind='recipe'(nodeId=配方 id)= 配方操作权(update/apply/trial/rollback);
+ *   - kind='dcw'(nodeId=数控节点 id)= **点位写授权面** —— Agent 仍不能直写节点
+ *     (param_control/dcw_control 恒拒桩不动),但持有该节点后,对"当前活动配方"的
+ *     trial/apply 只要覆盖集 ⊆ 自己的节点绑定面即放行;换配方不停摆。
+ *
+ * auto 治理(产线 Co-Pilot P2,计划 §5.4 铁律 2):**写向绑定首绑强制 manual**——
+ * dcw/recipe 写控面挂着逐次人工审批闸,创建即 auto 等于免审上线,故 body.mode 对
+ * 写向绑定一律忽略;显式传 auto 不静默吞掉,响应附 modeForced + notice 提示
+ * (响应形状向后兼容,多余字段无害)。如需 auto,应在绑定创建后走 PATCH 携
+ * confirm:true 显式切换(见 [id].patch.ts)。
  * daq 绑定仅授权 daq_query 读(工具面无写族、mode 无审批语义可摘),维持原样。
  */
 import { readBody } from 'h3'
@@ -28,13 +34,6 @@ export default defineApiHandler(async (event) => {
   const nodeId = String(body.nodeId ?? '')
   const agentId = String(body.agentId ?? '')
 
-  // 权限模型 v2:数控节点不再直接绑定 —— Agent 只对 recipe 做参数写入与下发;
-  // 节点级写控/dcw 绑定一律拒绝(存量绑定仅历史兼容,工具层已全部收敛到 recipe 面)。
-  if (kind === 'dcw') {
-    throw new AppError(400, 'BINDING_KIND_DEPRECATED',
-      `数控节点(dcw)不再支持直接绑定:Agent 通过绑定 recipe(kind='recipe',nodeId=配方id)获得该配方参数写入与下发能力;数采观察用 kind='daq'。`)
-  }
-
   // 绑定主体必须是**已部署的 Channel 成员实例**(运行时就是它持这条绑定做工具鉴权)。
   // 传 Agent 模板 id 是极易发生的误用:旧实现照单全收,绑定落在模板 id 上,
   // 成员侧 daq_query / dcw_control 一律报"尚未绑定节点" —— 一条**静默失效**的授权,
@@ -55,7 +54,7 @@ export default defineApiHandler(async (event) => {
 
   // 权限模型 v3:绑线 channel 的产线一致性 —— channel 绑了产线后,其成员 agent 只能
   // 绑定同产线的节点/配方(产线隔离的工作空间语义;未绑线的纯协作频道不受此限)。
-  const nodeLineOf = (nid: string, k: 'daq' | 'recipe'): string | null | undefined => {
+  const nodeLineOf = (nid: string, k: 'daq' | 'dcw' | 'recipe'): string | null | undefined => {
     if (k === 'recipe') return getDcwController().listRecipes().find(r => r.id === nid)?.lineId
     return k === 'daq' ? getDaqController().byId(nid)?.lineId : getDcwController().byId(nid)?.lineId
   }
@@ -96,8 +95,25 @@ export default defineApiHandler(async (event) => {
     throw new AppError(404, ErrorCodes.NOT_FOUND, `${kind === 'daq' ? '数采' : '写控'}节点不存在: ${nodeId}`)
   }
   const mode = lineMode(user, lineId)
+  // daq 只读绑定「仅查看」即可;dcw 是写授权面,需「可操控」(与 binding-authz 同口径)
+  const need = kind === 'daq' ? '仅查看' : '可操控'
   if (mode === 'none') {
-    throw new AppError(403, 'LINE_FORBIDDEN', `无该产线权限:绑定数采节点需对产线「${lineId}」拥有仅查看及以上权限`)
+    throw new AppError(403, 'LINE_FORBIDDEN', `无该产线权限:绑定${kind === 'daq' ? '数采' : '数控'}节点需对产线「${lineId}」拥有${need}及以上权限`)
+  }
+  if (kind === 'dcw' && mode !== 'operate') {
+    throw new AppError(403, 'LINE_READONLY', `该绑定涉及写控节点,需对产线「${lineId}」拥有可操控权限(当前:仅查看)`)
+  }
+  if (kind === 'dcw') {
+    // 写向绑定首绑恒 manual(每次下发/试验需人工批准);auto 须 PATCH confirm:true 显式切换
+    const binding = getAgentNodeBindingRepo().bind(agentId, nodeId, 'dcw', 'manual')
+    if (body.mode === 'auto') {
+      return {
+        binding,
+        modeForced: 'manual',
+        notice: '数控节点绑定默认 manual(点位写授权,每次下发/试验需人工批准),body.mode=auto 已被忽略;如需 auto 请对该绑定 PATCH { mode: "auto", confirm: true } 显式确认切换',
+      }
+    }
+    return { binding }
   }
   // daq 维持 body.mode ?? 'auto' 缺省
   const bindingMode = body.mode ?? 'auto'