agentworkshop 0.8.5 → 0.8.6

package/server/services/workshop/agents/harness-spawn-policy.ts

@@ -0,0 +1,114 @@
+/**
+ * harness 启动面策略 —— 谁能指定"拉起什么可执行文件/在哪个目录/带什么环境"。
+ *
+ * 背景(2026-10-28 审计):Channel/Agent 创建接受任意 `config`，manager 原样落库，
+ * 各 harness impl 直接拿 `config.command/args/cwd` 去 spawn；`assertHarnessUsable`
+ * 只判断"文件存在"。任何登录账号因此可以把 lead 的 command 设成 cmd.exe/sh，
+ * 在首个调度回合获得服务账号的命令执行能力。
+ *
+ * 本模块把判定收敛为纯函数（便于单测）：
+ *  - 非 admin 不得覆盖 command/args/cwd/env（一律 403，文案给出下一步）；
+ *  - admin 覆盖 command 时，basename 必须与引擎自身命令一致（omp/omp.exe…），
+ *    拒绝 cmd/sh/node 等通用解释器；
+ *  - cwd 必须落在 process.cwd() 或 configRoot 之下（admin 可用
+ *    AW_ALLOW_ARBITRARY_HARNESS_CWD=1 显式豁免，仅限受控部署）。
+ *
+ * 真正的执行层防御仍在 adapters/line-spawn（不走 shell、参数逐个校验、
+ * 敏感 env 剥离），本层负责"授权谁可以改这些参数"。
+ */
+import { basename, resolve } from 'node:path'
+import { AppError } from '../../../utils/errors'
+
+/** 引擎自身允许的命令 basename（不含扩展名比较；.cmd/.bat shim 也算同族） */
+const ALLOWED_COMMANDS: Record<string, string[]> = {
+  omp: ['omp'],
+  claude: ['claude'],
+  codex: ['codex'],
+  opencode: ['opencode'],
+  dsh: ['dsh'],
+  gemini: ['gemini'],
+  copilot: ['copilot'],
+  cursor: ['cursor-agent', 'cursor'],
+  crush: ['crush'],
+  goose: ['goose'],
+  qwen: ['qwen'],
+  pi: ['pi'],
+  hermes: ['hermes'],
+  mock: [],
+}
+
+/** 允许被 config 覆盖的启动键（出现即需要 admin） */
+export const SPAWN_CONFIG_KEYS = ['command', 'args', 'cwd', 'env'] as const
+
+export interface SpawnActor {
+  id?: string
+  role: string
+}
+
+/** 覆盖了哪些启动键（空数组 = 使用平台默认，任何角色都允许） */
+export function spawnOverridesOf(config: Record<string, unknown> | undefined | null): string[] {
+  if (!config || typeof config !== 'object') return []
+  return SPAWN_CONFIG_KEYS.filter((k) => {
+    const v = config[k]
+    if (v === undefined || v === null) return false
+    if (typeof v === 'string') return v.trim() !== ''
+    if (Array.isArray(v)) return v.length > 0
+    return true
+  })
+}
+
+function baseNameOf(command: string): string {
+  const base = basename(command.trim()).toLowerCase()
+  return base.replace(/\.(exe|cmd|bat|com|sh)$/i, '')
+}
+
+function cwdAllowed(cwd: string): boolean {
+  if (process.env.AW_ALLOW_ARBITRARY_HARNESS_CWD === '1') return true
+  const target = resolve(cwd)
+  const roots = [resolve(process.cwd())]
+  const configRoot = process.env.AW_HOME
+  if (configRoot) roots.push(resolve(configRoot))
+  return roots.some(root => target === root || target.startsWith(root + '\\') || target.startsWith(root + '/'))
+}
+
+/**
+ * 校验一次 harness 启动配置。通过返回 void；拒绝抛 403（message 可直接给用户）。
+ * @param harness 引擎 id（用于取命令白名单）
+ * @param config  即将落库的 agent/channel config
+ * @param actor   调用者（角色决定是否允许覆盖）
+ */
+export function assertSpawnConfigAllowed(
+  harness: string,
+  config: Record<string, unknown> | undefined | null,
+  actor: SpawnActor,
+): void {
+  const overrides = spawnOverridesOf(config)
+  if (overrides.length === 0) return
+  if (actor.role !== 'admin') {
+    throw new AppError(
+      403,
+      'HARNESS_SPAWN_FORBIDDEN',
+      `自定义 harness 启动参数（${overrides.join('/')}）仅管理员可配置。请使用平台提供的引擎默认安装路径，或联系管理员在受控部署中设置。`,
+    )
+  }
+  const command = typeof config?.command === 'string' ? config.command.trim() : ''
+  if (command) {
+    const base = baseNameOf(command)
+    const allowed = ALLOWED_COMMANDS[harness] ?? []
+    if (!allowed.includes(base)) {
+      throw new AppError(
+        403,
+        'HARNESS_COMMAND_DENIED',
+        `harness「${harness}」不允许以「${base}」启动：命令必须与该引擎自身一致（允许 ${allowed.join('/') || '(无)'}）。通用解释器（cmd/sh/node/powershell）一律拒绝。`,
+      )
+    }
+  }
+  const cwd = typeof config?.cwd === 'string' ? config.cwd.trim() : ''
+  if (cwd && !cwdAllowed(cwd)) {
+    throw new AppError(
+      403,
+      'HARNESS_CWD_DENIED',
+      `harness 工作目录「${cwd}」不在允许范围内（需位于平台工作根或配置根之下）。受控部署可显式设置 AW_ALLOW_ARBITRARY_HARNESS_CWD=1。`,
+    )
+  }
+}

package/server/services/workshop/agents/host-tool-bridge/dispatch.ts

@@ -38,8 +38,30 @@ import { handleCreateTeamAgent, handleGetQueueOverview, handleListTeamAgents, ha
  * 分发一次 host tool 调用(全引擎唯一入口):
  * 插件工具优先 → workspace 面 → 工业工具族 → 插件兜底 → 未知工具。
  */
+/**
+ * 工具活性注册表(2026-10-28 审查 C-P1-3)。
+ *
+ * 调度停滞看门狗以「最近一次工具调用」为健康信号,但旧实现只在 manager.invokeHostTool
+ * (REST/MCP 回程)打点 —— 默认引擎 omp 的原生 host_tool_call 与 pi 扩展完全不经那里,
+ * 信号恒空:biz 忙碌 5min 误 notify、回合间隙被误判 stall 而 COMPLETED/CANCELED。
+ * 打点必须放在**全引擎唯一分发入口**;这里只存 epoch ms,零业务耦合。
+ */
+const toolActivity = new Map<string, number>()
+export function noteToolActivity(agentId: string): void {
+  if (agentId) toolActivity.set(agentId, Date.now())
+}
+export function toolActivityAt(agentId: string): number | null {
+  return toolActivity.get(agentId) ?? null
+}
+/** 仅供测试:清空活性注册表 */
+export function resetToolActivity(): void {
+  toolActivity.clear()
+}
+
 /** 统一出口:所有工具结果经截断收口(单点修改,全族生效) */
 export async function dispatchHostTool(ctx: HostToolBridgeContext, req: HostToolCall): Promise<HostToolResult> {
+  // 活性打点先于一切校验:被拒的工具调用同样证明 agent 在推进(不是死锁)
+  noteToolActivity(ctx.identity.agentId)
   return truncateToolResult(await dispatchHostToolInner(ctx, req), req.toolName)
 }
 

package/server/services/workshop/agents/host-tool-bridge/index.ts

@@ -13,4 +13,4 @@ export { HOST_TOOLS, LEAD_ONLY_TOOL_NAMES, hostToolsForRole } from './catalog'
 export { hostToolsForAgent, agentToolResources } from './per-agent'
 export type { HostToolBridgeContext, HostToolCall, HostToolResult, HostToolSessionState } from './types'
 export { createSessionState, partsToText } from './session'
-export { dispatchHostTool } from './dispatch'
+export { dispatchHostTool, noteToolActivity, toolActivityAt, resetToolActivity } from './dispatch'

package/server/services/workshop/agents/host-tool-bridge/per-agent.ts

@@ -27,6 +27,8 @@ export interface AgentToolResourceView {
   daqNodes: Array<{ id: string, name: string, unit: string }>
   /** 频道绑线带来的只读数采节点(v28;执行面 daqTargetsOf 同样并入) */
   daqLineNodes: Array<{ id: string, name: string, unit: string }>
+  /** Agent 显式绑定的数控节点(kind=dcw)= 点位写授权面(2026-10-28 双轨授权) */
+  writeNodes: Array<{ id: string, name: string, unit: string }>
   recipes: Array<{ id: string, name: string, version: number, params: Array<{ nodeId: string, name: string, unit: string }> }>
   mesNodes: Array<{ id: string, name: string, unit: string }>
 }
@@ -46,7 +48,7 @@ function channelLineOf(agentId: string): string {
 
 /** 读取 Agent 的绑定面(只读;异常降级为空,绝不影响工具注入) */
 export function agentToolResources(agentId: string): AgentToolResourceView {
-  const out: AgentToolResourceView = { daqNodes: [], daqLineNodes: [], recipes: [], mesNodes: [] }
+  const out: AgentToolResourceView = { daqNodes: [], daqLineNodes: [], writeNodes: [], recipes: [], mesNodes: [] }
   if (!agentId) return out
   try {
     const bindings = getAgentNodeBindingRepo().byAgent(agentId)
@@ -63,6 +65,11 @@ export function agentToolResources(agentId: string): AgentToolResourceView {
         const n = daq.byId(b.nodeId)
         if (n) out.daqNodes.push({ id: n.id, name: n.name, unit: n.unit ?? '' })
       }
+      else if (b.kind === 'dcw') {
+        // 点位写授权面:让模型不必先探测就知道自己能对哪些节点 trial/apply
+        const n = dcw.byId(b.nodeId)
+        if (n) out.writeNodes.push({ id: n.id, name: n.name, unit: n.unit ?? '' })
+      }
       else if (b.kind === 'recipe') {
         const r = dcw.listRecipes().find(x => x.id === b.nodeId)
         if (!r) continue
@@ -109,15 +116,22 @@ export function hostToolsForAgent(agentId: string, role: 'lead' | 'worker', chan
   const res = agentToolResources(agentId)
   // WP6:排序保证同一绑定面确定性输出(折叠/不折叠都稳定)
   const sortedDaq = sortedById(res.daqNodes)
+  const sortedWrite = sortedById(res.writeNodes)
   const sortedRecipes = sortedById(res.recipes)
   const sortedMes = sortedById(res.mesNodes)
   const lineOnlyDaq = sortedById(res.daqLineNodes.filter(n => !sortedDaq.some(x => x.id === n.id)))
-  if (sortedDaq.length === 0 && lineOnlyDaq.length === 0 && sortedRecipes.length === 0 && !bindings.length) return filtered
+  if (sortedDaq.length === 0 && lineOnlyDaq.length === 0 && sortedWrite.length === 0 && sortedRecipes.length === 0 && !bindings.length) return filtered
   const daqParts = [
     sortedDaq.length > 0 ? foldList(tr(locale, `本 Agent 直接绑定的数采节点(仅这些可查):`, `DAQ nodes bound directly to this agent (queryable):`), sortedDaq.map(x => `${x.name}(${x.id}${x.unit ? `,${x.unit}` : ''})`)) : '',
     lineOnlyDaq.length > 0 ? foldList(tr(locale, `频道绑线只读数采节点(可查):`, `Read-only DAQ nodes from the channel line binding:`), lineOnlyDaq.map(x => `${x.name}(${x.id}${x.unit ? `,${x.unit}` : ''})`)) : '',
   ].filter(Boolean)
   const daqLine = daqParts.length > 0 ? `\n\n${daqParts.join('\n')}` : ''
+  const writeLine = sortedWrite.length > 0
+    ? foldList(
+        tr(locale, `\n\n本 Agent 的数控节点写授权面(点位写授权;可在这些节点上 trial/apply,换配方仍有效):`, `\n\nDCW node write-authorization face of this agent (point-level; trial/apply allowed on these nodes, survives recipe switches):`),
+        sortedWrite.map(x => `${x.name}(${x.id}${x.unit ? `,${x.unit}` : ''})`),
+      )
+    : ''
   const recipeLine = sortedRecipes.length > 0
     ? foldList(
         tr(locale, `\n\n本 Agent 已绑定的配方(仅这些可写/下发):`, `\n\nRecipes bound to this agent (writable/dispatchable):`),
@@ -130,7 +144,7 @@ export function hostToolsForAgent(agentId: string, role: 'lead' | 'worker', chan
   return filtered.map((t) => {
     let suffix = ''
     if (DAQ_TOOLS.has(t.name)) suffix = daqLine
-    else if (RECIPE_TOOLS.has(t.name)) suffix = recipeLine
+    else if (RECIPE_TOOLS.has(t.name)) suffix = `${recipeLine}${writeLine}`
     else if (MES_TOOLS.has(t.name)) suffix = mesLine
     else if (OPTIMIZER_TOOL_NAMES.has(t.name)) suffix = optimizerLine
     if (!suffix) return t

package/server/services/workshop/agents/host-tool-bridge/tools/tasks.ts

@@ -42,7 +42,7 @@ export async function handleDispatchTask(args: Record<string, unknown>, ws: Agen
     const grantNodeIds = (Array.isArray(rawGrant) ? rawGrant : String(rawGrant).split(',')).map(x => String(x ?? '').trim()).filter(Boolean)
     if (!grantNodeIds.length) return { text: 'grant_node_ids 为空:要么不传,要么给出至少一个节点 id。', isError: true }
     const grantMode = args.grant_mode === 'manual' || args.grant_mode === 'auto' ? (args.grant_mode as 'auto' | 'manual') : undefined
-    const grant = await grantNodesForDispatch(identity, assigneeId, grantNodeIds, grantMode, ws)
+    const grant = await grantNodesForDispatch(identity, assigneeId, grantNodeIds, grantMode, ws, args.grant_confirm)
     if (!grant.ok) return { text: `未派发:${grant.text}\n请先用 team_grant_nodes 确认你持有这些节点,或修正 node id 后重试。`, isError: true }
     grantNote = `\n${grant.text}`
   }

package/server/services/workshop/agents/host-tool-bridge/tools/team-delegation.ts

@@ -42,6 +42,8 @@ export async function handleGrantNodes(identity: HostToolBridgeContext['identity
       nodeIds,
       members: await membersOf(ws),
       mode,
+      // B-P1-3:mode=auto 摘除逐次人工审批,须显式风险确认(与 REST 同语义)
+      confirm: args.confirm,
     })
     const bindings = applyDelegation(plan, identity.agentId)
     return {
@@ -84,7 +86,7 @@ export interface DispatchGrantResult {
  * 派发时随任务授予节点(dispatch_task 的 grant_node_ids;lead 专属)。
  * fail-closed:任一节点不在 lead 绑定面 → 整单失败,任务不创建。
  */
-export async function grantNodesForDispatch(identity: HostToolBridgeContext['identity'], assigneeId: string, nodeIds: string[], mode: 'auto' | 'manual' | undefined, ws: MembersView): Promise<DispatchGrantResult> {
+export async function grantNodesForDispatch(identity: HostToolBridgeContext['identity'], assigneeId: string, nodeIds: string[], mode: 'auto' | 'manual' | undefined, ws: MembersView, confirm?: unknown): Promise<DispatchGrantResult> {
   try {
     const plan = planDelegation({
       leaderAgentId: identity.agentId,
@@ -93,6 +95,8 @@ export async function grantNodesForDispatch(identity: HostToolBridgeContext['ide
       nodeIds,
       members: await membersOf(ws),
       mode,
+      // B-P1-3:随任务授予同样不得绕过 auto 的显式确认(dispatch_task.grant_confirm)
+      confirm,
     })
     const bindings = applyDelegation(plan, identity.agentId)
     return { ok: true, text: `随任务授予 ${bindings.length} 条节点授权 → ${assigneeId}${summaryText(bindings)}` }

package/server/services/workshop/agents/industrial/dcw-tools.ts

@@ -263,8 +263,12 @@ async function dcwControlGovernedLegacy(agentId: string, args: { node_id?: strin
         text: `下发受理:${node.name}(${tpl?.ch ?? node.templateKey})设定 ${value}${node.unit} → PLC 原始值 ${outcome.raw ?? '-'};${ackTxt}。${winTxt}。${outcome.message}\n[调控闭环] ${loopTxt}${manualFeedback ? `\n[人工反馈] ${manualFeedback}` : ''}`,
       }
     }
-    // 失败文案带自我纠正线索:当前保持原值 + 建议动作(缩小步进/稍后重试)
-    const keptHint = `当前设定值保持 ${node.value ?? '原值'}${node.unit} 未被改动`
+    // 失败文案带自我纠正线索:区分「确定未写」与「可能已写但未证实」
+    // S15:回读不一致/无确认通道时,PLC 可能已经被改,不能再宣称"值未被改动"。
+    const uncertain = outcome.raw != null || outcome.ack === 'unverified'
+    const keptHint = uncertain
+      ? `写入未获证实,PLC 值可能已变更(原始值 ${outcome.raw ?? '-'})，请先读取核对后再决定是否重试`
+      : `当前设定值保持 ${node.value ?? '原值'}${node.unit} 未被改动`
     const retryHint = /忙|busy/i.test(outcome.message) ? '链路忙属瞬时状态,可稍后重试' : '可缩小步进幅度后重试'
     return { text: `下发失败:${outcome.message}(节点 ${node.name},物理量 ${tpl?.ch ?? node.templateKey},安全量程 ${node.min}~${node.max}${node.unit};${keptHint};${retryHint})`, isError: true }
   }

package/server/services/workshop/agents/industrial/ops-tools.ts

@@ -750,8 +750,8 @@ export async function toolRecipeUpdate(agentId: string, args: {
   if (!target.ok) return { text: target.text, isError: true }
   const recipe = target.recipe
   const recipeId = recipe.id
-  // 权限模型 v2:绑定 → 二级认证 → 运行门(未在执行的配方不可操作)
-  const gate = assertRecipeOperation(agentId, recipe, 'update')
+  // 权限模型 v2 + 2026-10-28 双轨:版本操作只认 recipe 绑定(节点绑定不授予版本权)
+  const gate = assertRecipeOperation(agentId, recipe, 'update', list.map(p => String(p.node_id).trim()))
   if (!gate.ok) return { text: gate.text, isError: true }
   for (const p of list) {
     const nodeId = String(p.node_id).trim()
@@ -761,6 +761,13 @@ export async function toolRecipeUpdate(agentId: string, args: {
     if (!node.enabled) return { text: `节点「${node.name}」已停用,参数保存被拒。请先让用户恢复节点控制,或保存到其他节点。`, isError: true }
   }
   // HITL:manual 绑定(或全局下发审批开关)→ 保存前挂人工审批,理由随审批卡展示
+  // B-P1-4(2026-10-28 审查):审批卡展示的是"此刻的"配方定义;审批窗口内若有人并发
+  // 编辑同一配方,旧实现会把批准结果静默并进**已变的**定义(本次只改列出的参数,其余
+  // 取最新值),人工批准的语义被偷换。进入审批前记录定义指纹,批准后逐字比对。
+  const approvedDefinitionSnapshot = JSON.stringify({
+    version: recipe.version ?? 1,
+    params: recipe.params.map(p => ({ nodeId: p.nodeId, value: p.value, min: p.min ?? null, max: p.max ?? null })),
+  })
   let hitlNote = ''
   if (gate.hitlRequired) {
     const gateDecision = await hitlDispatchGate(
@@ -788,8 +795,24 @@ export async function toolRecipeUpdate(agentId: string, args: {
       }
     }
     if (gateDecision.comment) hitlNote = `\n人工附言:${gateDecision.comment}`
-    const stale = await revalidateApprovedAction(agentId, recipe, 'update', 'recipe_update', { recipe_id: recipeId }, gate.activeContext)
+    const stale = await revalidateApprovedAction(agentId, recipe, 'update', 'recipe_update', { recipe_id: recipeId, params: list.map(p => ({ node_id: p.node_id })) }, gate.activeContext)
     if (stale) return stale
+    // B-P1-4:批准后复核配方定义 —— 审批窗口内的并发编辑不得被静默并入已批版本。
+    const latestRecipe = getDcwRecipeRepo().byId(recipeId)
+    const latestSnapshot = latestRecipe
+      ? JSON.stringify({
+          version: latestRecipe.version ?? 1,
+          params: latestRecipe.params.map(p => ({ nodeId: p.nodeId, value: p.value, min: p.min ?? null, max: p.max ?? null })),
+        })
+      : ''
+    if (!latestRecipe || latestSnapshot !== approvedDefinitionSnapshot) {
+      return {
+        text: `人工已批准,但审批期间配方「${recipe.name}」的定义已被其他操作修改(v${recipe.version ?? 1} → v${latestRecipe?.version ?? '已删除'});`
+          + `为避免把本次批准静默并入已变更的定义,本次未执行、配方未改动。`
+          + `请调用 recipe_catalog/recipe_versions 重新读取最新参数与理由后,基于最新定义重新提交 recipe_update。`,
+        isError: true,
+      }
+    }
   }
   // 旧值快照(repo.update 原地改写 recipe.params,事后再取会把 before 读成新值)
   const beforeOf = new Map(recipe.params.map(p => [p.nodeId, p.value]))
@@ -992,11 +1015,12 @@ async function hitlDispatchGate(agentId: string, recipeId: string, detail: strin
  */
 function approvedContextError(
   agentId: string,
-  recipe: { id: string, name: string, lineId?: string, access?: { requireAuth?: boolean, authorizedAgentIds?: string[] } },
+  recipe: { id: string, name: string, lineId?: string, params?: Array<{ nodeId: string }>, access?: { requireAuth?: boolean, authorizedAgentIds?: string[] } },
   op: 'update' | 'dispatch' | 'trial' | 'rollback',
   expectedContext: ActiveRecipeContext,
+  targetNodeIds?: string[],
 ): { text: string, isError: true } | null {
-  const currentGate = assertRecipeOperation(agentId, recipe, op)
+  const currentGate = assertRecipeOperation(agentId, recipe, op, targetNodeIds)
   if (!currentGate.ok) {
     return { text: `人工已批准,但审批期间授权已失效,本次未执行:${currentGate.text}`, isError: true }
   }
@@ -1013,15 +1037,26 @@ function approvedContextError(
   return null
 }
 
+/** 从审批时的工具参数还原「本次覆盖的节点集」(trial/update 只写声明节点;其余=整批)。 */
+function targetNodesFromArgs(op: 'update' | 'dispatch' | 'trial' | 'rollback', args: Record<string, unknown>): string[] | undefined {
+  if (op !== 'trial' && op !== 'update') return undefined
+  const params = Array.isArray(args.params) ? args.params : []
+  const ids = params
+    .map(p => String((p as { node_id?: unknown } | null)?.node_id ?? '').trim())
+    .filter(Boolean)
+  return ids.length > 0 ? ids : undefined
+}
+
 export async function revalidateApprovedAction(
   agentId: string,
-  recipe: { id: string, name: string, lineId?: string, access?: { requireAuth?: boolean, authorizedAgentIds?: string[] } },
+  recipe: { id: string, name: string, lineId?: string, params?: Array<{ nodeId: string }>, access?: { requireAuth?: boolean, authorizedAgentIds?: string[] } },
   op: 'update' | 'dispatch' | 'trial' | 'rollback',
   toolName: string,
   args: Record<string, unknown>,
   expectedContext: ActiveRecipeContext,
 ): Promise<{ text: string, isError: true } | null> {
-  const initialContextError = approvedContextError(agentId, recipe, op, expectedContext)
+  const targetNodeIds = targetNodesFromArgs(op, args)
+  const initialContextError = approvedContextError(agentId, recipe, op, expectedContext, targetNodeIds)
   if (initialContextError) return initialContextError
   try {
     // manager 未装配(单测/嵌入)→ 只做绑定与运行门复核;装配后叠加产线 grant 复核
@@ -1041,7 +1076,7 @@ export async function revalidateApprovedAction(
   // Grant lookup is asynchronous. Re-read the active tuple after that await so
   // queued line/run changes cannot pass between the initial comparison and the
   // caller's dispatch continuation.
-  const changedAfterGrantCheck = approvedContextError(agentId, recipe, op, expectedContext)
+  const changedAfterGrantCheck = approvedContextError(agentId, recipe, op, expectedContext, targetNodeIds)
   if (changedAfterGrantCheck) return changedAfterGrantCheck
   return null
 }
@@ -1082,8 +1117,8 @@ export async function toolRecipeTrial(agentId: string, args: {
   if (!target.ok) return { text: target.text, isError: true }
   const recipe = target.recipe
   const recipeId = recipe.id
-  // 权限模型 v2:绑定 → 二级认证 → 运行门(未在执行的配方不可试验)
-  const gate = assertRecipeOperation(agentId, recipe, 'trial')
+  // 权限模型 v2 + 2026-10-28 双轨:recipe 绑定 ∨ 本次候选覆盖集 ⊆ dcw 节点绑定面
+  const gate = assertRecipeOperation(agentId, recipe, 'trial', list.map(p => p.nodeId))
   if (!gate.ok) return { text: gate.text, isError: true }
   for (const p of list) {
     const node = getDcwController().byId(p.nodeId)
@@ -1129,11 +1164,15 @@ export async function toolRecipeTrial(agentId: string, args: {
       }
       // 人工附言随批准回执回流(Agent 与审计都能看到放行时人的原话)
       if (gateDecision.comment) hitlNote = `\n人工附言:${gateDecision.comment}`
-      const stale = await revalidateApprovedAction(agentId, recipe, 'trial', 'recipe_trial', { recipe_id: recipeId }, gate.activeContext)
+      const stale = await revalidateApprovedAction(agentId, recipe, 'trial', 'recipe_trial', { recipe_id: recipeId, params: list.map(p => ({ node_id: p.nodeId })) }, gate.activeContext)
       if (stale) return stale
-      const staleAtDispatch = approvedContextError(agentId, recipe, 'trial', gate.activeContext)
+      const staleAtDispatch = approvedContextError(agentId, recipe, 'trial', gate.activeContext, list.map(p => p.nodeId))
       if (staleAtDispatch) return staleAtDispatch
     }
+    // 2026-10-28 执行点复核(双轨授权,D13 同款):审批/节拍等待期间绑定可能被撤销,
+    // 下发前最后一次同步重算覆盖集 —— 收回即失活,不把授权变更带进写入。
+    const execGate = assertRecipeOperation(agentId, recipe, 'trial', list.map(p => p.nodeId))
+    if (!execGate.ok) return { text: `下发前授权复核未通过,本次未执行:${execGate.text}`, isError: true }
     const run = await getDcwController().applyRecipe(recipeId, { overrides: list, trial: true, agentDispatch: true, agentApprovalId: gateApprovalId, emergency })
     // ACK 鉴定三段口径(2026-10-08):ok 只是命令受理,未证实/失败必须如实回给 Agent
     const acks = run.ackSummary ?? { verified: run.results.filter(r => r.ok).length, unverified: 0, failed: run.results.filter(r => !r.ok).length, total: run.results.length }
@@ -1244,6 +1283,9 @@ export async function toolRecipeApply(agentId: string, args: {
       const staleAtDispatch = approvedContextError(agentId, recipe, 'dispatch', gate.activeContext)
       if (staleAtDispatch) return staleAtDispatch
     }
+    // 2026-10-28 执行点复核(双轨授权):recipe 绑定或节点覆盖集在下发前再算一次
+    const execGate = assertRecipeOperation(agentId, recipe, 'dispatch')
+    if (!execGate.ok) return { text: `下发前授权复核未通过,本次未执行:${execGate.text}`, isError: true }
     // 完整覆盖集让控制器复制每个已批准值,逐参数异步写期间也不再共享可变配方参数。
     const run = await getDcwController().applyRecipe(recipeId, { overrides: dispatch.params, agentDispatch: true, agentApprovalId: gateApprovalId, emergency })
     // ACK 鉴定三段口径(2026-10-08):ok 只是命令受理,未证实/失败必须如实回给 Agent

package/server/services/workshop/agents/industrial/recipe-gate.ts

@@ -1,15 +1,24 @@
 /**
- * Recipe 操作统一鉴权门(权限模型 v2)。
+ * Recipe 操作统一鉴权门(权限模型 v2 + 2026-10-28 节点级写授权双轨)。
  *
- * Agent 不再直碰数控节点 —— 对产线的全部写动作收敛到「绑定的 recipe」上:
- *   ① 绑定门:必须持有该 recipe 的绑定(kind='recipe';可绑定多个配方);
+ * 对产线的全部写动作仍收敛在配方管道上;授权面有两条轨(取并集):
+ *   ① 绑定门:
+ *      - recipe 绑定(kind='recipe',nodeId 字段=配方 id)= **配方操作权**
+ *        (update/apply/trial/rollback 全部放行,维持权限模型 v2 语义);
+ *      - dcw 节点绑定(kind='dcw')= **点位写授权**(2026-10-28 恢复,非直写入口):
+ *        对「当前活动配方」的 trial/apply,只要本次覆盖的节点 ⊆ 自己的 dcw 绑定面
+ *        即放行 —— 授权跟设备节点走(稳定),管控跟活动配方走(动态),换配方不停摆。
+ *        版本操作(update/rollback)不授予:配方级操作权仍须 recipe 绑定。
+ *      - 目标节点集缺省 = 配方全部参数(apply / 无 overrides 的 trial);
+ *        trial 传本次 overrides 的节点集(只写声明节点,部分覆盖即拒)。
  *   ② 认证门:recipe.access.requireAuth=true 时,只有 authorizedAgentIds 清单内的
  *      Agent 可操作(fail-closed:开认证但清单为空 = 无人可操作);
  *   ③ 运行门:配方必须**正在执行**(该产线存在本配方的活动批次)—— 未运行的配方
  *      一律不可操作(参数写入/下发/试验/回退同样受限);
  *   ④ HITL 判定:绑定 mode='manual' → 每次动作挂起等人工批准(必带 Agent 理由);
  *      mode='auto'(显式确认切换)→ 免批直执行。全局开关 security.recipeDispatchApproval
- *      保持兼容:开启时即便 auto 绑定也挂审批。
+ *      保持兼容:开启时即便 auto 绑定也挂审批。节点级轨的 manual 语义跟随覆盖该批
+ *      节点的 dcw 绑定(任一 manual 即挂审批)。
  *      线级总闸(2026-10-08):line.controlMode='manual'(缺省,fail-safe)时 auto 绑定
  *      也强制人工审批 —— 手动模式下人类必须过目每一次写动作。
  */
@@ -50,22 +59,59 @@ export function activeRunOfRecipe(recipeId: string): ActiveRecipeContext | null
   }
 }
 
-/** 统一鉴权门:绑定 → 二级认证 → 运行门;返回绑定与 HITL 判定(不做挂起,挂起由调用方执行) */
+/** 节点展示名(拒绝文案用;节点已删除时退回 id) */
+function nodeLabel(nodeId: string): string {
+  const n = getDcwController().byId(nodeId)
+  return n ? `${n.name}(${nodeId})` : nodeId
+}
+
+function listNodes(ids: string[]): string {
+  return ids.length > 0 ? ids.map(nodeLabel).join('、') : '(无)'
+}
+
+/** 统一鉴权门:绑定(配方级 ∪ 节点级)→ 二级认证 → 运行门;返回绑定与 HITL 判定(不做挂起,挂起由调用方执行)
+ *  targetNodeIds:本次动作实际覆盖的节点集;缺省 = 配方全部参数(整批 apply)。 */
 export function assertRecipeOperation(
   agentId: string,
-  recipe: { id: string, name: string, lineId?: string, access?: { requireAuth?: boolean, authorizedAgentIds?: string[] } },
+  recipe: { id: string, name: string, lineId?: string, params?: Array<{ nodeId: string }>, access?: { requireAuth?: boolean, authorizedAgentIds?: string[] } },
   op: RecipeOp,
+  targetNodeIds?: string[],
 ): RecipeGateResult {
   const opLabel = op === 'update' ? '参数写入' : op === 'dispatch' ? '下发' : op === 'trial' ? '试验下发' : '回退'
-  // ① 绑定门(kind='recipe';nodeId 字段 = recipeId)
-  const binding = getAgentNodeBindingRepo().find(agentId, recipe.id, 'recipe')
-  if (!binding) {
-    return {
-      ok: false,
-      text: `无权${opLabel}配方「${recipe.name}」(${recipe.id}):你未绑定该配方。权限模型 v2 下 Agent 不直接操作数控节点 —— 通过绑定 recipe 获得参数写入与下发能力(可绑定多个配方);请让用户或 lead 为你绑定(recipe 绑定首绑默认 manual,每次动作需人工批准)。`,
+  // ① 绑定门(双轨):recipe 绑定 = 配方操作权;dcw 绑定 = 点位写授权(仅 trial/apply)
+  const bindings = getAgentNodeBindingRepo().byAgent(agentId)
+  const recipeBinding = bindings.find(b => b.kind === 'recipe' && b.nodeId === recipe.id)
+  const dcwBindings = bindings.filter(b => b.kind === 'dcw')
+  const dcwBound = new Set(dcwBindings.map(b => b.nodeId))
+  const recipeNodes = (recipe.params ?? []).map(p => p.nodeId).filter(Boolean)
+  const targets = (targetNodeIds && targetNodeIds.length > 0 ? targetNodeIds : recipeNodes)
+    .map(id => String(id ?? '').trim())
+    .filter(Boolean)
+  const versionOp = op === 'update' || op === 'rollback'
+  let coveringBindings: AgentNodeBinding[] = []
+  if (!recipeBinding) {
+    if (versionOp) {
+      return {
+        ok: false,
+        text: `无权${opLabel}配方「${recipe.name}」(${recipe.id}):节点绑定(dcw)只授予参数下发/试验权(点位授权),配方版本操作(参数保存/回退)需要绑定该配方(kind='recipe',配方级操作权)。请让用户或 lead 为你绑定该配方(recipe 绑定首绑默认 manual,每次动作需人工批准)。`,
+      }
+    }
+    if (targets.length === 0) {
+      return {
+        ok: false,
+        text: `无权${opLabel}配方「${recipe.name}」:配方没有参数节点,无法确认授权覆盖集。请先为配方配置参数节点,或让用户/lead 绑定该配方(kind='recipe')。`,
+      }
     }
+    const missing = targets.filter(id => !dcwBound.has(id))
+    if (missing.length > 0) {
+      return {
+        ok: false,
+        text: `无权${opLabel}配方「${recipe.name}」:本次覆盖的节点中有 ${missing.length} 个不在你的数控节点绑定面内 —— ${listNodes(missing)}。你已绑定的可写节点:${listNodes([...dcwBound])}。请让用户或 lead 为你补绑这些节点(节点绑定 = 点位写授权),或改用已授权节点重试;若要对整批配方操作,也可改为绑定配方(kind='recipe')。`,
+      }
+    }
+    coveringBindings = dcwBindings.filter(b => targets.includes(b.nodeId))
   }
-  // ② 二级认证(用户在配方编辑里开启并勾选授权 Agent)
+  // ② 二级认证(用户在配方编辑里开启并勾选授权 Agent;双轨共用)
   if (recipe.access?.requireAuth && !(recipe.access.authorizedAgentIds ?? []).includes(agentId)) {
     return {
       ok: false,
@@ -82,7 +128,7 @@ export function assertRecipeOperation(
   }
   // ④ HITL 判定:manual 绑定 → 逐动作人工批准;auto → 免批。
   //    线级总闸(2026-10-08 生产化):line.controlMode='manual'(缺省)时,即便绑定为
-  //    auto 也强制人工审批 —— 手动模式下人类必须过目每一次写动作(fail-safe)。
+  //    auto 也强制人工审批 —— 手动模式下人类必须过目每一次写动作。
   //    频道层钳位(2026-10-28 三模式):Agent 所属频道 executionMode='manual' 时同理强制;
   //    'auto'(中性缺省)/'observe'(分发层已拒写,不可达)不改变本判定。
   const lineManual = recipe.lineId ? getDcwLineRepo().controlModeOf(recipe.lineId) === 'manual' : false
@@ -90,7 +136,14 @@ export function assertRecipeOperation(
   // ⑤ 全局开关兼容位:security.recipeDispatchApproval 开启时即便 auto 也挂审批(保留语义)
   const globalGate = false // 由调用方按 settingOf('security.recipeDispatchApproval') 叠加(本模块不依赖设置服务)
   void globalGate
-  return { ok: true, binding, hitlRequired: binding.mode === 'manual' || lineManual || channelManual, activeContext: run }
+  // 节点级轨的 manual 语义:覆盖本次批次的 dcw 绑定任一 manual 即挂审批(fail-safe)
+  const nodeManual = coveringBindings.some(b => b.mode === 'manual')
+  const binding = recipeBinding ?? coveringBindings[0]
+  if (!binding) {
+    // 理论上不可达(targets 非空且全部已覆盖);fail-closed 防实现漂移
+    return { ok: false, text: `无权${opLabel}配方「${recipe.name}」:未找到有效授权绑定。` }
+  }
+  return { ok: true, binding, hitlRequired: binding.mode === 'manual' || nodeManual || lineManual || channelManual, activeContext: run }
 }
 
 /** 新建配方的授权门(尚无 recipe 可绑定):要求 Agent 在该线至少有一个写向绑定

package/server/services/workshop/agents/industrial/tool-verify-legacy-specs.ts

@@ -34,9 +34,9 @@ export const LEGACY_VERIFY_SPECS: Record<string, ToolVerifySpec> = {
   line_status: { refs: [{ param: 'line_id', kind: 'line', mode: 'read' }] },
   line_start: { refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'write' }] },
   recipe_versions: { refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'read' }] },
-  recipe_update: { atLeastOne: [{ params: ['recipe_id', 'line_id'], hint: 'recipe_id 或 line_id 至少提供一个:只给 line_id 时按该线当前活动批次解析配方。' }], refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'write' }, { param: 'line_id', kind: 'line', mode: 'read' }], deepNodeRefs: ['params[].node_id'] },
+  recipe_update: { atLeastOne: [{ params: ['recipe_id', 'line_id'], hint: 'recipe_id 或 line_id 至少提供一个:只给 line_id 时按该线当前活动批次解析配方。' }], refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'write' }, { param: 'line_id', kind: 'line', mode: 'read' }], deepNodeRefs: ['params[].node_id'], writeNodeRefs: ['params[].node_id'] },
   recipe_rollback: { refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'write' }] },
-  recipe_trial: { atLeastOne: [{ params: ['recipe_id', 'line_id'], hint: 'recipe_id 或 line_id 至少提供一个:只给 line_id 时按该线当前活动批次解析配方。' }], refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'write' }, { param: 'line_id', kind: 'line', mode: 'read' }], deepNodeRefs: ['params[].node_id'] },
+  recipe_trial: { atLeastOne: [{ params: ['recipe_id', 'line_id'], hint: 'recipe_id 或 line_id 至少提供一个:只给 line_id 时按该线当前活动批次解析配方。' }], refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'write' }, { param: 'line_id', kind: 'line', mode: 'read' }], deepNodeRefs: ['params[].node_id'], writeNodeRefs: ['params[].node_id'] },
   recipe_apply: { atLeastOne: [{ params: ['recipe_id', 'line_id'], hint: 'recipe_id 或 line_id 至少提供一个:只给 line_id 时按该线当前活动批次解析配方。' }], refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'write' }, { param: 'line_id', kind: 'line', mode: 'read' }] },
   recipe_propose: { refs: [{ param: 'recipe_id', kind: 'recipe', mode: 'read' }], deepNodeRefs: ['packages[].params[].node_id'] },
   // 分析与经验面

package/server/services/workshop/agents/industrial/tool-verify.ts

@@ -42,6 +42,9 @@ export interface ToolRefFaces {
   agentId: string
   /** 绑定面节点:dcw+daq 绑定节点 ∪ 绑定配方参数节点 */
   boundNodes: Set<string>
+  /** 写授权面 W(a):dcw 绑定节点 ∪ 绑定配方参数节点(节点级写授权,与 recipe-gate 同口径;
+   *  daq 只读绑定与频道绑线只读扩权不进写面) */
+  writeFace: Set<string>
   /** 仅数采绑定(dcw 工具只认 dcw 绑定,读取面只认 daq 绑定——分面保留) */
   daqBoundNodes: Set<string>
   /** 绑定的配方(kind='recipe' 的绑定,nodeId 字段存 recipeId) */
@@ -60,6 +63,7 @@ export interface ToolRefFaces {
 export function resolveRefFaces(agentId: string): ToolRefFaces {
   const bindings = getAgentNodeBindingRepo().byAgent(agentId)
   const boundNodes = new Set<string>()
+  const writeFace = new Set<string>()
   const daqBoundNodes = new Set<string>()
   const boundRecipes = new Set<string>()
   const recipeLines = new Set<string>()
@@ -72,11 +76,15 @@ export function resolveRefFaces(agentId: string): ToolRefFaces {
         recipeLines.add(r.lineId)
         readableLines.add(r.lineId)
       }
-      for (const p of (r?.params ?? [])) boundNodes.add(p.nodeId)
+      for (const p of (r?.params ?? [])) {
+        boundNodes.add(p.nodeId)
+        writeFace.add(p.nodeId)
+      }
       continue
     }
     boundNodes.add(b.nodeId)
     if (b.kind === 'daq') daqBoundNodes.add(b.nodeId)
+    else writeFace.add(b.nodeId)
     const n = b.kind === 'dcw' ? getDcwController().byId(b.nodeId) : getDaqNodeRepo().byId(b.nodeId)
     if (n?.lineId) readableLines.add(n.lineId)
   }
@@ -86,7 +94,7 @@ export function resolveRefFaces(agentId: string): ToolRefFaces {
   if (channelLineId) {
     for (const n of getDaqNodeRepo().all()) if (n.lineId === channelLineId) channelLineNodes.add(n.id)
   }
-  return { agentId, boundNodes, daqBoundNodes, boundRecipes, recipeLines, readableLines, channelLineId, channelLineNodes }
+  return { agentId, boundNodes, writeFace, daqBoundNodes, boundRecipes, recipeLines, readableLines, channelLineId, channelLineNodes }
 }
 
 // ===== 归属判定 =====
@@ -143,6 +151,17 @@ function denyNode(faces: ToolRefFaces, toolName: string, args: Record<string, un
   ], faces, hint, { param, value: id, lineId: row?.lineId })
 }
 
+/** 写面拒绝(2026-10-28):参数要写到的节点必须落在 W(a)=dcw 绑定 ∪ 绑定配方参数节点。
+ *  比 denyNode 更明确:读得到 ≠ 写得到(频道绑线只读扩权/他配方节点都不构成写授权)。 */
+function denyWriteNode(faces: ToolRefFaces, toolName: string, args: Record<string, unknown>, param: string, id: string, exists: boolean): HostToolResult {
+  const row = exists ? nodeRow(id) : null
+  const where = row ? `(节点「${row.name}」${row.lineId ? `,归属产线 ${row.lineId}` : ''})` : '(节点不存在或已删除)'
+  const hint = `该节点不在你的写授权面(节点绑定=点位写授权;配方绑定=配方操作权)。你的可写节点:${listOf(faces.writeFace)};你已绑定的配方参数节点也在此列。如需写入,请让用户或 lead 为你绑定该数控节点(dcw),或改用上述已授权节点;若要对整批配方操作,可请求绑定配方(kind='recipe')。`
+  return deny(toolName, args, [
+    `工具调用被拒(写授权校验,${toolName}):参数节点「${id}」不在你的写授权面内${where}。`,
+  ], faces, hint, { param, value: id, lineId: row?.lineId })
+}
+
 function denyLine(faces: ToolRefFaces, toolName: string, args: Record<string, unknown>, param: string, id: string): HostToolResult {
   const exists = getDcwController().listLines().some(l => l.id === id)
   const hint = `你的可读产线:${listOf(faces.readableLines)}${faces.channelLineId ? `(其中「${faces.channelLineId}」来自频道绑线,只读)` : ''}。如需访问该产线,请让用户授予对应产线权限(权限管理),或把当前频道绑定到该产线;也可以改用上述可读产线重试。`
@@ -370,6 +389,16 @@ export function verifyToolReferences(agentId: string, toolName: string, args: Re
         if (!exists || !nodeAllowed(faces, id)) return denyNode(faces, toolName, args, key, id, exists)
       }
     }
+    // 写入型参数节点:必须落在写授权面 W(a)(只读面/频道绑线/他配方节点不构成写授权)。
+    // 先于 deepNodeRefs 检查:nodeAllowed 允许"绑定配方所在产线的任意节点",对写入过宽,
+    // 写面判定才是本工具真正的授权边界(拒绝文案也更能行动)。
+    for (const path of spec.writeNodeRefs ?? []) {
+      const leaf = path.split('.').pop() ?? path
+      for (const id of collectDeep(args, path)) {
+        const exists = nodeRow(id) !== null
+        if (!exists || !faces.writeFace.has(id)) return denyWriteNode(faces, toolName, args, leaf, id, exists)
+      }
+    }
     for (const path of spec.deepNodeRefs ?? []) {
       // 深路径的 param 名用于文案:取最后一段
       const leaf = path.split('.').pop() ?? path