agentworkshop 0.8.5 → 0.8.6

package/server/api/workshop/dcw/mes-artifacts/index.get.ts

@@ -8,13 +8,19 @@ import { statSync } from 'node:fs'
 import { resolveUser } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { listMesArtifacts } from '@/server/services/workshop/mes/mes-hook'
+import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { requireLineForResource } from '@/server/services/workshop/line-scope'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const q = getQuery(event)
   const nodeId = String(q.node_id ?? '').trim()
   const limit = Math.max(1, Math.min(Number(q.limit) || 50, 200))
   if (!nodeId) return { artifacts: [], message: '缺少 node_id' }
+  const node = getDcwController().byId(nodeId)
+  if (!node) throw new AppError(404, ErrorCodes.NOT_FOUND, `控制节点不存在: ${nodeId}`)
+  requireLineForResource(user, node.lineId, 'MES 点位', 'readonly')
   const artifacts = listMesArtifacts(nodeId, limit).map((a) => {
     let mtime: string | null = null
     try {

package/server/api/workshop/dcw/optimizations/[id]/series.get.ts

@@ -7,10 +7,15 @@ import { getQuery, getRouterParam } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { getRecipeRollBackManager } from '@/server/services/workshop/dcw/recipe-rollback-manager'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { requireLineForResource } from '@/server/services/workshop/line-scope'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const id = getRouterParam(event, 'id') ?? ''
+  const record = getRecipeRollBackManager().recordById(id)
+  if (!record) throw new AppError(404, ErrorCodes.NOT_FOUND, `优化记录不存在: ${id}`)
+  requireLineForResource(user, record.lineId, '优化记录', 'readonly')
   const q = getQuery(event)
   const windowMs = q.windowMs ? Number(q.windowMs) : undefined
   const result = await getRecipeRollBackManager().series(id, Number.isFinite(windowMs) ? windowMs : undefined)

package/server/api/workshop/dcw/optimizations/[id].get.ts

@@ -6,12 +6,14 @@ import { resolveUser } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { AppError, ErrorCodes } from '@/server/utils/errors'
 import { getRecipeRollBackManager } from '@/server/services/workshop/dcw/recipe-rollback-manager'
+import { requireLineForResource } from '@/server/services/workshop/line-scope'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const id = getRouterParam(event, 'id') ?? ''
   const record = getRecipeRollBackManager().recordById(id)
   if (!record)
     throw new AppError(404, ErrorCodes.NOT_FOUND, `优化记录不存在: ${id}`)
+  requireLineForResource(user, record.lineId, '优化记录', 'readonly')
   return { record }
 })

package/server/api/workshop/dcw/optimizations/index.get.ts

@@ -6,18 +6,21 @@ import { getQuery } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
 import { defineApiHandler } from '@/server/utils/response'
 import { getRecipeRollBackManager } from '@/server/services/workshop/dcw/recipe-rollback-manager'
+import { filterRowsByLine, requireLineForResource } from '@/server/services/workshop/line-scope'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const q = getQuery(event)
   const limit = Number(q.limit ?? 100)
+  const lineId = q.lineId ? String(q.lineId) : undefined
+  if (lineId) requireLineForResource(user, lineId, '产线', 'readonly')
   const records = getRecipeRollBackManager().records({
-    lineId: q.lineId ? String(q.lineId) : undefined,
+    lineId,
     recipeId: q.recipeId ? String(q.recipeId) : undefined,
     nodeId: q.nodeId ? String(q.nodeId) : undefined,
     status: q.status ? String(q.status) : undefined,
     agentId: q.agentId ? String(q.agentId) : undefined,
     limit: Number.isFinite(limit) ? Math.min(limit, 500) : 100,
   })
-  return { records }
+  return { records: filterRowsByLine(user, records, r => r.lineId) }
 })

package/server/api/workshop/dcw/params/[id]/read.post.ts

@@ -1,17 +1,22 @@
-/**
- * POST /api/workshop/dcw/params/:id/read —— 工艺参数读取(读执行节点 PLC 值,物理量纲)。
- * 被动观测免审批;返回 PLC 实时读数 + 当前设定值。
- */
-import { getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const id = getRouterParam(event, 'id') ?? ''
-  const read = await getDcwController().readParam(id)
-  return { read }
-})
+/**
+ * POST /api/workshop/dcw/params/:id/read —— 工艺参数读取(读执行节点 PLC 值,物理量纲)。
+ * 被动观测免审批;返回 PLC 实时读数 + 当前设定值。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+import { getDcwParamRepo } from '@/server/services/workshop/dcw/param-map.repo'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { paramLineId, requireLineForResource } from '@/server/services/workshop/line-scope'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  bindDcwBroadcast(broadcastSceneEvent)
+  const id = getRouterParam(event, 'id') ?? ''
+  if (!getDcwParamRepo().byId(id)) throw new AppError(404, ErrorCodes.NOT_FOUND, `工艺参数不存在: ${id}`)
+  requireLineForResource(user, paramLineId(id), '工艺参数', 'readonly')
+  const read = await getDcwController().readParam(id)
+  return { read }
+})

package/server/api/workshop/dcw/recipes/[id]/versions.get.ts

@@ -1,14 +1,20 @@
-/**
- * GET /api/workshop/dcw/recipes/:id/versions —— 配方参数版本历史(旧→新,尾行=当前版)。
- * 每条:version/at/by(来源)/actorName(人话操作者)/description(变更原因)/params。
- */
-import { getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  const id = getRouterParam(event, 'id') ?? ''
-  return { versions: getDcwController().recipeVersions(id) }
-})
+/**
+ * GET /api/workshop/dcw/recipes/:id/versions —— 配方参数版本历史(旧→新,尾行=当前版)。
+ * 每条:version/at/by(来源)/actorName(人话操作者)/description(变更原因)/params。
+ * 2026-10-28:按配方所属产线校验只读授权。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { recipeLineId, requireLineForResource } from '@/server/services/workshop/line-scope'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const id = getRouterParam(event, 'id') ?? ''
+  const recipe = getDcwController().listRecipes().find(r => r.id === id)
+  if (!recipe) throw new AppError(404, ErrorCodes.NOT_FOUND, `Recipe 不存在: ${id}`)
+  requireLineForResource(user, recipeLineId(id) ?? recipe.lineId, '配方', 'readonly')
+  return { versions: getDcwController().recipeVersions(id) }
+})

package/server/api/workshop/dcw/recipes/[id].delete.ts

@@ -1,25 +1,33 @@
-/**
- * DELETE /api/workshop/dcw/recipes/:id —— 删除配方。
- */
-import { getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
-import { recordOps } from '@/server/services/workshop/ops/ops'
-
-export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
-  const id = getRouterParam(event, 'id') ?? ''
-  // 删除前取归属维度(remove 后不可读),产线日志按线/配方归档
-  const recipe = getDcwRecipeRepo().byId(id)
-  getDcwRecipeRepo().remove(id)
-  recordOps({
-    actor: user.id, actorName: user.name, actorKind: 'user',
-    action: 'recipe.delete', kind: 'recipe', targetKind: 'recipe', targetId: id,
-    lineId: recipe?.lineId ?? '',
-    productId: recipe?.productId ?? '',
-    recipeId: id,
-    summary: `删除配方「${recipe?.name ?? id}」${recipe?.lineId ? `(产线 ${recipe.lineId})` : ''}`,
-  })
-  return { deleted: true }
-})
+/**
+ * DELETE /api/workshop/dcw/recipes/:id —— 删除配方。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
+import { recordOps } from '@/server/services/workshop/ops/ops'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { requireLineForResource } from '@/server/services/workshop/line-scope'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const id = getRouterParam(event, 'id') ?? ''
+  // 删除前取归属维度(remove 后不可读),产线日志按线/配方归档
+  const recipe = getDcwRecipeRepo().byId(id)
+  if (!recipe) throw new AppError(404, ErrorCodes.NOT_FOUND, `Recipe 不存在: ${id}`)
+  requireLineForResource(user, recipe.lineId, '配方', 'operate')
+  const activeRun = getDcwRecipeRepo().listRuns().find(r => r.recipeId === id && !r.endedAt)
+  if (activeRun) {
+    throw new AppError(409, ErrorCodes.CONFLICT, `配方「${recipe.name}」仍在批次 ${activeRun.id.slice(0, 8)} 中执行，请先停线/关批次后再删除`)
+  }
+  getDcwRecipeRepo().remove(id)
+  recordOps({
+    actor: user.id, actorName: user.name, actorKind: 'user',
+    action: 'recipe.delete', kind: 'recipe', targetKind: 'recipe', targetId: id,
+    lineId: recipe?.lineId ?? '',
+    productId: recipe?.productId ?? '',
+    recipeId: id,
+    summary: `删除配方「${recipe?.name ?? id}」${recipe?.lineId ? `(产线 ${recipe.lineId})` : ''}`,
+  })
+  return { deleted: true }
+})

package/server/api/workshop/dcw/recipes/index.get.ts

@@ -1,12 +1,17 @@
-/**
- * GET /api/workshop/dcw/recipes —— 配方 + 批次列表。
- */
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  const repo = getDcwRecipeRepo()
-  return { recipes: repo.list(), runs: repo.listRuns() }
-})
+/**
+ * GET /api/workshop/dcw/recipes —— 配方 + 批次列表。
+ * 2026-10-28:按调用者产线授权过滤(admin/特权见全集)。
+ */
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
+import { filterRowsByLine } from '@/server/services/workshop/line-scope'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const repo = getDcwRecipeRepo()
+  return {
+    recipes: filterRowsByLine(user, repo.list(), r => r.lineId),
+    runs: filterRowsByLine(user, repo.listRuns(), r => r.lineId),
+  }
+})

package/server/api/workshop/dcw/runs/[id]/close.post.ts

@@ -1,15 +1,21 @@
-/**
- * POST /api/workshop/dcw/runs/:id/close —— 关闭批次(结束数据隔离窗口)。
- */
-import { getRouterParam } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const id = getRouterParam(event, 'id') ?? ''
-  return { run: getDcwController().closeRun(id) }
-})
+/**
+ * POST /api/workshop/dcw/runs/:id/close —— 关闭批次(结束数据隔离窗口)。
+ */
+import { getRouterParam } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+import { getDcwRecipeRepo } from '@/server/services/workshop/dcw/dcw-recipe.repo'
+import { AppError, ErrorCodes } from '@/server/utils/errors'
+import { requireLineForResource } from '@/server/services/workshop/line-scope'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  bindDcwBroadcast(broadcastSceneEvent)
+  const id = getRouterParam(event, 'id') ?? ''
+  const run = getDcwRecipeRepo().runById(id)
+  if (!run) throw new AppError(404, ErrorCodes.NOT_FOUND, `批次不存在: ${id}`)
+  requireLineForResource(user, run.lineId, '批次', 'operate')
+  return { run: getDcwController().closeRun(id) }
+})

package/server/api/workshop/dcw/test-driver.post.ts

@@ -1,16 +1,21 @@
-/**
- * POST /api/workshop/dcw/test-driver —— 连接测试(body: { driver, driverConfig })。
- */
-import { readBody } from 'h3'
-import type { DcwDriverKind } from '#shared/dcw-protocol'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const body = await readBody<{ driver?: DcwDriverKind, driverConfig?: Record<string, unknown> }>(event) ?? {}
-  return { test: await getDcwController().testDriver(body.driver ?? 'mock', body.driverConfig ?? {}) }
-})
+/**
+ * POST /api/workshop/dcw/test-driver —— 连接测试(body: { driver, driverConfig })。
+ *
+ * 2026-10-28 安全修复:仅 admin/editor 可调用;allowPrivateHost 只认服务端开关。
+ */
+import { readBody } from 'h3'
+import type { DcwDriverKind } from '#shared/dcw-protocol'
+import { requireRole } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+
+export default defineApiHandler(async (event) => {
+  requireRole(event, ['admin', 'editor'])
+  bindDcwBroadcast(broadcastSceneEvent)
+  const body = await readBody<{ driver?: DcwDriverKind, driverConfig?: Record<string, unknown> }>(event) ?? {}
+  const cfg: Record<string, unknown> = { ...(body.driverConfig ?? {}) }
+  delete cfg.allowPrivateHost
+  if (process.env.AW_TEST_DRIVER_ALLOW_PRIVATE === '1') cfg.allowPrivateHost = 'true'
+  return { test: await getDcwController().testDriver(body.driver ?? 'mock', cfg) }
+})

package/server/api/workshop/ws/hub.ts

@@ -9,7 +9,7 @@ import { PEER_SEND_BUDGET_BYTES, hub, streams } from './shared'
 import { ensureStream } from './streams'
 import { flushDbBuffer } from './db-buffer'
 import { getWorkshopManager } from '../../../plugins/workshop'
-import { registerScenePeer, setPeerVisibleLines } from '../../../services/workshop/scene-events'
+import { registerScenePeer, setPeerIdentity, setPeerVisibleLines } from '../../../services/workshop/scene-events'
 import { visibleLineIds } from '../../../services/workshop/permissions'
 
 export function ensureHubBound(manager: AgentChannelManager): void {
@@ -87,6 +87,7 @@ export function resolveChannelIdFromUrl(peer: WsPeer): string | undefined {
 /** 场景事件注册(鉴权后):按用户产线可见集挂 per-peer 过滤,未经鉴权的 peer 不注册 */
 export function attachScenePeer(peer: WsPeer, user: { id: string, role: string }): void {
   setPeerVisibleLines(peer, visibleLineIds(user))
+  setPeerIdentity(peer, user)
   registerScenePeer(peer)
 }
 

package/server/plugins/01-instance-guard.ts

@@ -0,0 +1,82 @@
+/**
+ * 数据目录单实例守卫(S16,2026-10-28)。
+ *
+ * `scripts/start.mjs`/`dev-guard.mjs` 已有 <configRoot>/.runtime/aw.lock,但直接
+ * `node .output/server/index.mjs` 的启动路径绕过它 —— 两个进程共享同一份 JSON 仓储/
+ * writeLocks 时会互相覆盖、绕过 60s/保持窗。本插件在配置根再取一把数据锁
+ * (<configRoot>/.runtime/data.lock),覆盖所有启动方式:
+ *   - 已存在且 PID 存活 → fail-fast(退出码 1);
+ *   - PID 已死(崩溃残留) → 接管重写;
+ *   - 进程退出/信号 → 释放。
+ * 显式豁免:AW_SKIP_DATA_LOCK=1(仅测试/受控多实例编排,默认禁止)。
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+const SKIP = process.env.AW_SKIP_DATA_LOCK === '1'
+const ROOT = resolve(process.env.AW_HOME ?? process.cwd())
+const DIR = join(ROOT, '.runtime')
+const LOCK = join(DIR, 'data.lock')
+
+interface LockFile { pid?: number, at?: string }
+
+function pidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  }
+  catch (err) {
+    return (err as NodeJS.ErrnoException)?.code === 'EPERM'
+  }
+}
+
+function readLock(): LockFile | null {
+  try {
+    return JSON.parse(readFileSync(LOCK, 'utf8')) as LockFile
+  }
+  catch {
+    return null
+  }
+}
+
+function release(): void {
+  try {
+    const cur = readLock()
+    if (cur?.pid === process.pid && existsSync(LOCK)) rmSync(LOCK, { force: true })
+  }
+  catch { /* 退出路径尽力而为 */ }
+}
+
+export default async function instanceGuardPlugin(): Promise<void> {
+  if (SKIP) {
+    console.warn('[instance-guard] AW_SKIP_DATA_LOCK=1:已跳过数据目录单实例锁(仅限测试/受控编排)')
+    return
+  }
+  try {
+    mkdirSync(DIR, { recursive: true })
+  }
+  catch (err) {
+    console.error('[instance-guard] 无法创建 .runtime 目录:', err instanceof Error ? err.message : err)
+    process.exit(1)
+  }
+  const existing = readLock()
+  if (existing?.pid && existing.pid !== process.pid && pidAlive(existing.pid)) {
+    console.error(`[instance-guard] 数据目录已被进程 ${existing.pid} 占用:${ROOT}。同一数据目录只允许一个写者;请先停止该实例,或设置 AW_HOME 指向独立目录。`)
+    process.exit(1)
+  }
+  try {
+    writeFileSync(LOCK, JSON.stringify({ pid: process.pid, at: new Date().toISOString() }), { flag: 'w' })
+  }
+  catch (err) {
+    console.error('[instance-guard] 无法写入数据锁:', err instanceof Error ? err.message : err)
+    process.exit(1)
+  }
+  process.once('exit', release)
+  for (const sig of ['SIGINT', 'SIGTERM'] as const) {
+    process.once(sig, () => {
+      release()
+      process.exit(0)
+    })
+  }
+}

package/server/plugins/daq.ts

@@ -4,25 +4,43 @@
  * 启动时:探测配置地址(MQTT/Timescale)→ 不通且策略允许则 docker compose 自动拉起
  * → 依判定结果装配真实/降级后端 → 降级则停采并警告;后台 30s 自动重连,
  * 恢复后重建真实后端 + 重挂消费者 + 恢复采集。
+ *
+ * 2026-10-28(S10):启动屏障 —— 后端装配完成前不 resolve `__daqInfraReady`,
+ * workshop 插件的 resumeAll 必须等待它,避免采样先落到占位 SQLite/进程内队列;
+ * 后端初始化失败时显式置 degraded 并停采(不再"端口通=健康")。
  */
 import { useRuntimeConfig } from '#imports'
-import { daqUrls, ensureDaqInfrastructure, scheduleAutoReconnect, type DaqInfraConfig } from '../services/workshop/daq/infra'
+import { daqInfraStatus, daqUrls, ensureDaqInfrastructure, markDaqInfraFailure, scheduleAutoReconnect, type DaqInfraConfig } from '../services/workshop/daq/infra'
 import { rebuildTsdb } from '../services/workshop/daq/storage'
 import { rebuildObjectStore } from '../services/workshop/daq/objectstore'
 import { startDaqObjectGc } from '../services/workshop/daq/objectstore/gc'
 import { rebuildDaqQueue } from '../services/workshop/daq/bus'
 import { getDaqController } from '../services/workshop/daq/daq-controller'
 
+interface DaqBootState {
+  __daqInfraReady?: Promise<void>
+  __daqInfraStatus?: () => ReturnType<typeof daqInfraStatus>
+}
+
 /** 按最新 infra 状态装配后端 + 控制器(启动/重连共用) */
 async function applyInfra(cfg: DaqInfraConfig): Promise<void> {
   const status = await ensureDaqInfrastructure(cfg, process.cwd())
   const urls = daqUrls(cfg)
-  await rebuildTsdb(status.tsdbOnline, urls.tsdbUrl)
-  await rebuildObjectStore(status.objectStoreOnline, urls.objectStoreUrl)
-  await rebuildDaqQueue(status.mqttOnline, urls.mqttUrl)
+  try {
+    await rebuildTsdb(status.tsdbOnline, urls.tsdbUrl)
+    await rebuildObjectStore(status.objectStoreOnline, urls.objectStoreUrl)
+    await rebuildDaqQueue(status.mqttOnline, urls.mqttUrl)
+  }
+  catch (err) {
+    // 端口可达 ≠ 后端可用(密码错/库缺失/扩展未装)。装配失败一律降级并停采,
+    // 由 30s 重连继续尝试;绝不让采样写进占位后端后"看起来正常"。
+    markDaqInfraFailure(err)
+    getDaqController().stopAll()
+    return
+  }
   const ctrl = getDaqController()
   await ctrl.reattachQueue()
-  if (status.degraded) {
+  if (daqInfraStatus().degraded) {
     ctrl.stopAll() // 在线数采停用(降级可见)
   }
   else {
@@ -55,22 +73,36 @@ export default async function daqPlugin() {
     objectstore: raw?.objectstore
       ? {
           host: raw.objectstore.host ?? '127.0.0.1',
-          port: Number(raw.objectstore.port ?? 9000),
+          port: raw.objectstore.port ?? 9000,
           accessKey: raw.objectstore.accessKey ?? 'awshop',
           secretKey: raw.objectstore.secretKey ?? 'awshop-secret',
           bucket: raw.objectstore.bucket ?? 'daq',
         }
       : undefined,
   }
+  // 启动屏障:先挂 promise,再执行装配;失败也 resolve(状态里 degraded=true),由消费方决定是否停采
+  const g = globalThis as unknown as DaqBootState
+  let resolveReady!: () => void
+  g.__daqInfraReady = new Promise<void>((resolve) => {
+    resolveReady = resolve
+  })
+  g.__daqInfraStatus = daqInfraStatus
   try {
     await applyInfra(cfg)
   }
   catch (err) {
-    console.error('[daq-infra] 启动装配失败(保持降级,重连可恢复):', err instanceof Error ? err.message : err)
+    markDaqInfraFailure(err)
+    try {
+      getDaqController().stopAll()
+    }
+    catch { /* 控制器未就绪 */ }
+  }
+  finally {
+    resolveReady()
   }
   // 后台自动重连:恢复后重走装配路径
   scheduleAutoReconnect(() => {
-    void applyInfra(cfg).catch(() => {})
+    void applyInfra(cfg).catch(markDaqInfraFailure)
   })
   // P0-2 对象存储 GC:帧行出清后像素文件孤儿回收(90s 首轮 + 24h 周期;disk 后端)
   startDaqObjectGc()

package/server/plugins/workshop.ts

@@ -232,6 +232,18 @@ export default function workshopPlugin(nitroApp: {
       ])
       const { broadcastSceneEvent } = await import('../services/workshop/scene-events')
       bindDaqHost(broadcastSceneEvent)
+      // S10 启动屏障:等 daq 插件把后端装配完(成功或明确降级),再决定是否开采。
+      // 此前直接 resumeAll 会让采样先写进占位 SQLite/进程内队列,切库后不迁移。
+      const g = globalThis as unknown as {
+        __daqInfraReady?: Promise<void>
+        __daqInfraStatus?: () => { degraded: boolean, warning?: string }
+      }
+      if (g.__daqInfraReady) await g.__daqInfraReady
+      const infra = g.__daqInfraStatus?.()
+      if (infra?.degraded) {
+        console.warn(`[workshop] DAQ 基础设施降级,跳过 resumeAll:${infra.warning ?? '后端不可用'}`)
+        return
+      }
       const st = getDaqController().resumeAll()
       console.log(`[workshop] DAQ 采集补挂完成(running=${st.running},宿主端口已装配)`)
     }

package/server/services/workshop/agents/adapters/line-spawn.ts

@@ -16,6 +16,29 @@ import { join } from 'node:path'
 
 const SHELL_META = /[\r\n;&|`<>$]/
 
+/**
+ * 平台自身凭据:不得随 process.env 继承给 harness 子进程。
+ * 引擎需要的 provider key 与 AW_ 身份变量由各 impl 的显式 env 传入(cleanEnv 或 bridgeEnv),
+ * 这里只剥离"平台会话/管理员口令/隧道令牌"这类与引擎无关的秘密。
+ */
+const PLATFORM_SECRET_ENV = [
+  'NUXT_SESSION_PASSWORD',
+  'AW_ADMIN_PASSWORD',
+  'AW_E2E_ADMIN_PASSWORD',
+  'AW_E2E_PASSWORD',
+  'AW_E2E_TOKEN',
+  'AW_E2E_ADMIN_TOKEN',
+  'SCHED_E2E_PASSWORD',
+  'AW_TUI_PASSWORD',
+  'ADMIN_TOKEN',
+  'CLOUDFLARE_TUNNEL_TOKEN',
+] as const
+
+function scrubPlatformSecrets(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const deny = new Set<string>(PLATFORM_SECRET_ENV)
+  return Object.fromEntries(Object.entries(env).filter(([k]) => !deny.has(k)))
+}
+
 /** 拒绝 shell 元字符(命令只能是纯可执行路径) */
 export function assertPlainExecutable(command: string): string {
   if (!command || SHELL_META.test(command)) {
@@ -87,7 +110,7 @@ export function spawnLineProcess(command: string, args: string[], options: LineS
   const { file, needsCmd } = resolveExecutable(command)
   const env = options.cleanEnv
     ? { ...options.env }
-    : { ...process.env, ...options.env }
+    : scrubPlatformSecrets({ ...process.env, ...options.env })
   if (needsCmd) {
     // Windows .cmd shim:固定包装器 'cmd.exe' + /d /s /c。
     // 可执行文件路径无条件引号包裹:无空格路径裸奔时,/s 模式的 cmd 会吞掉

package/server/services/workshop/agents/agent-dto.ts

@@ -0,0 +1,54 @@
+/**
+ * Agent 对外 DTO —— HTTP 响应不得回显 token 与敏感 config。
+ *
+ * 背景(2026-10-28 审计):`instanceToAgentInfo` 直出 `token` 与完整 `config`，
+ * `/channels/:id/agents` 对"本 channel 任意成员(含 agent token)"放行 →
+ * worker Agent 可读取 lead 的 token，再以 lead 身份调用 agent-tools/invoke，
+ * 完整继承 lead 的工业绑定与 lead 专属权限。
+ *
+ * 约定:
+ *  - token 永不进列表/详情；只在 rotate-token 一次性返回。
+ *  - config 仅 channel 属主/admin 可见（UI 的成员编辑/专长展示需要），
+ *    且剔除启动类敏感键（command/args/cwd/env）。
+ *  - 其余调用方只拿 summary（id/name/role/harness/enabled/templateId）。
+ */
+import type { AgentInfo } from './agent-interface'
+
+const SENSITIVE_CONFIG_KEYS = ['command', 'args', 'cwd', 'env'] as const
+
+export interface ChannelAgentSummary {
+  id: string
+  channelId: string
+  name: string
+  harness: string
+  role: string
+  enabled: number
+  templateId: string | null
+  config?: Record<string, unknown>
+}
+
+function safeConfig(config: Record<string, unknown> | undefined | null): Record<string, unknown> {
+  if (!config || typeof config !== 'object') return {}
+  const deny = new Set<string>(SENSITIVE_CONFIG_KEYS)
+  return Object.fromEntries(Object.entries(config).filter(([k]) => !deny.has(k)))
+}
+
+/** 名册投影（token 永远不出现） */
+export function channelAgentSummary(agent: AgentInfo, opts: { includeConfig?: boolean } = {}): ChannelAgentSummary {
+  const summary: ChannelAgentSummary = {
+    id: agent.id,
+    channelId: agent.channelId,
+    name: agent.name,
+    harness: agent.harness,
+    role: agent.role,
+    enabled: agent.enabled ?? 1,
+    templateId: agent.templateId ?? null,
+  }
+  if (opts.includeConfig) summary.config = safeConfig(agent.config)
+  return summary
+}
+
+/** 批量投影 */
+export function channelAgentSummaries(agents: AgentInfo[], opts: { includeConfig?: boolean } = {}): ChannelAgentSummary[] {
+  return agents.map(a => channelAgentSummary(a, opts))
+}