agentworkshop 0.8.5 → 0.8.6

package/server/services/workshop/line-scope.ts

@@ -0,0 +1,80 @@
+/**
+ * REST 数据面 → 产线授权解析(2026-10-28 审计修复 S4)。
+ *
+ * 背景:工具面有 grant-guard/tool-verify 双层产线校验,但大量 REST 读数/删除端点
+ * 只有 `resolveUser` —— 任意登录用户可读全量产线配方参数、写账本、PLC 实时值,
+ * 甚至删除配方/关闭批次。本模块把"资源 → 产线"的解析收敛到一处,配合
+ * permissions.requireLineMode 让 REST 与工具面同口径。
+ *
+ * 约定:
+ *  - 资源不存在时返回 null,由路由负责 404(避免把"不存在"误报成 403)。
+ *  - 列表用 filterByLine(admin/特权返回全集)。
+ */
+import { AppError } from '../../utils/errors'
+import { filterByLine, requireLineMode } from './permissions'
+import { getDcwRecipeRepo } from './dcw/dcw-recipe.repo'
+import { getDcwController } from './dcw/dcw-controller'
+import { getDcwParamRepo } from './dcw/param-map.repo'
+import { getDaqNodeRepo } from './daq/daq-node.repo'
+import { getRecipeRollBackManager } from './dcw/recipe-rollback-manager'
+
+export interface ScopedUser {
+  id: string
+  role: string
+}
+
+/** 配方 → 产线 */
+export function recipeLineId(recipeId: string): string | null {
+  return getDcwRecipeRepo().byId(recipeId)?.lineId ?? null
+}
+
+/** 数控节点 → 产线 */
+export function dcwNodeLineId(nodeId: string): string | null {
+  return getDcwController().byId(nodeId)?.lineId ?? null
+}
+
+/** 数采节点 → 产线 */
+export function daqNodeLineId(nodeId: string): string | null {
+  return getDaqNodeRepo().byId(nodeId)?.lineId ?? null
+}
+
+/** 工艺参数 → 执行节点 → 产线 */
+export function paramLineId(paramId: string): string | null {
+  const row = getDcwParamRepo().byId(paramId)
+  if (!row) return null
+  return dcwNodeLineId(row.nodeId)
+}
+
+/** 批次 → 产线 */
+export function runLineId(runId: string): string | null {
+  return getDcwRecipeRepo().runById(runId)?.lineId ?? null
+}
+
+/** 优化记录 → 产线 */
+export function optimizationLineId(recordId: string): string | null {
+  return getRecipeRollBackManager().recordById(recordId)?.lineId ?? null
+}
+
+/**
+ * 解析并校验:资源不存在 → 404;无该线权限 → 403。
+ * need='readonly' 允许只读/操控;need='operate' 仅操控。
+ */
+export function requireLineForResource(
+  user: ScopedUser,
+  lineId: string | null | undefined,
+  resourceLabel: string,
+  need: 'readonly' | 'operate' = 'readonly',
+): void {
+  if (!lineId) {
+    // 未分配产线的资源(独立节点/遗留数据):与 permissions 的"无记录=不可见"同口径,
+    // 仅 admin 可见;否则拒绝,避免成为绕过产线隔离的旁路。
+    if (user.role === 'admin') return
+    throw new AppError(403, 'LINE_FORBIDDEN', `${resourceLabel}未归属产线,仅管理员可访问`)
+  }
+  requireLineMode(user, lineId, need)
+}
+
+/** 列表按产线过滤(admin 见全集;无授权线的条目被剔掉) */
+export function filterRowsByLine<T>(user: ScopedUser, rows: T[], lineIdOf: (row: T) => string | null | undefined): T[] {
+  return filterByLine(user, rows, lineIdOf)
+}

package/server/services/workshop/optimization/dispatch.service.ts

@@ -34,6 +34,7 @@ import { toModel } from '@/shared/units'
 import { getDcwController } from '../dcw/dcw-controller'
 import { evaluateRecipeParamLimits } from '../dcw/dcw-controller/write'
 import { getDcwLineRepo } from '../dcw/dcw-line.repo'
+import { getActiveLineRun } from '../dcw/line-run'
 import { assertRecipeOpInterval } from '../dcw/recipe-op-anchor'
 import { getToolApprovals } from '../agents/tool-approvals'
 import { amlActivityForLine } from '../agents/industrial/aml-activity'
@@ -116,7 +117,7 @@ export type DispatchGateResult = { ok: true } | { ok: false, code: string, comme
 
 /** D13 批准时刻八项重验(fail-closed)。任一失败 → {ok:false,code,comment}。
  *  overrides:建卡时刻预检用 —— 卡尚未挂出,payload 不可读,由调用方传入本地构造值。 */
-export async function assertDispatchApprovable(recId: string, overrides?: { modelFirstMove?: Record<string, number>, packages?: Array<{ params: Array<{ nodeId: string, to: number }> }> }): Promise<DispatchGateResult> {
+export async function assertDispatchApprovable(recId: string, overrides?: { modelFirstMove?: Record<string, number>, packages?: Array<{ params: Array<{ nodeId: string, to: number }> }> }, opts: { requireRunning?: boolean } = {}): Promise<DispatchGateResult> {
   try {
     const { rec, run, binding, profile, spec, candidate, recipe } = loadRec(recId)
     // ① 建议:未过期(显式持久失效)+ 最新 crosscheck 行 pass 且读时 stale=false
@@ -154,6 +155,21 @@ export async function assertDispatchApprovable(recId: string, overrides?: { mode
     // ⑥ 当前操作点:MV 步限(模型单位)+ CV 新鲜度
     const line = getDcwLineRepo().byId(spec.lineId)
     if (!line) return { ok: false, code: 'DISPATCH_GATE_LINE_GONE', comment: `产线 ${spec.lineId} 不存在` }
+    // 运行门(2026-10-28):D13 八项重验此前不含"产线在跑" —— 停线检修中的设备仍会收到
+    // 首步下发(applyRecipe 自身也无运行门)。批准时刻再查一次(decide 会重跑本函数)。
+    // 建卡时刻不做运行门(允许先备好方案,开线后再批准),由调用方传 requireRunning:false。
+    if (opts.requireRunning !== false) {
+      const activeLine = getActiveLineRun(spec.lineId)
+      if (!activeLine) {
+        return { ok: false, code: 'DISPATCH_GATE_LINE_NOT_RUNNING', comment: '产线当前未运行(无活动批次):真实下发已拒绝。请先开线并确认参数写入完成后再批准。' }
+      }
+      if (activeLine.recipeId !== recipe.id) {
+        return { ok: false, code: 'DISPATCH_GATE_RECIPE_NOT_ACTIVE', comment: `活动批次正在执行配方 ${activeLine.recipeId},与本建议配方 ${recipe.id} 不一致;请重新 solve 或切换产线配方。` }
+      }
+      if (recipe.productId && activeLine.productId !== recipe.productId) {
+        return { ok: false, code: 'DISPATCH_GATE_PRODUCT_MISMATCH', comment: `活动批次产品 ${activeLine.productId} 与配方产品 ${recipe.productId} 不一致;按拒收敛。` }
+      }
+    }
     const modelFirstMove = overrides?.modelFirstMove
       ?? (getToolApprovals().listPending().map(a => a.payload).find(p => (p as { recommendationId?: string } | null)?.recommendationId === recId) as (RecipeProposePayload & { modelFirstMove?: Record<string, number> }) | undefined)?.modelFirstMove
       ?? {}
@@ -359,7 +375,7 @@ export async function createDispatchCard(initiator: ResolvedUser, recommendation
     if (dispatchProfileRow) assertOntologyUnchanged(parseProfileRow(dispatchProfileRow).ontologyRefs)
   }
   // 闸序预检(建卡时刻;批准时刻 D13 全量重验)
-  const gate = await assertDispatchApprovable(recommendationId, { modelFirstMove, packages: [{ params: paramRows }] })
+  const gate = await assertDispatchApprovable(recommendationId, { modelFirstMove, packages: [{ params: paramRows }] }, { requireRunning: false })
   if (!gate.ok) throw new AppError(gate.code.startsWith('DISPATCH_GATE') || gate.code === 'DISPATCH_STEP_EXCEEDED' ? 403 : 409, gate.code, gate.comment)
   // 在飞去重(三前缀;建卡时无自身卡可排除)
   const inflight = recipeWriteInFlight(recipe.id)

package/server/services/workshop/permissions.ts

@@ -67,6 +67,8 @@ export function notifyGrantsChanged(userId: string): void {
     // 延迟动态导入避免与 scene-events 循环依赖
     void import('@/server/services/workshop/scene-events').then((m) => {
       m.broadcastSceneEvent('permissions.changed', { userId, at: new Date().toISOString() })
+      // S14:已连接的 peer 就地重算可见集(撤权后不必等重连)
+      void m.refreshPeerVisibility(userId)
     }).catch(() => {})
   }
   catch { /* 广播失败不影响授权写入 */ }

package/server/services/workshop/runtime/agent-runtime/message.ts

@@ -44,6 +44,8 @@ export abstract class AgentRuntimeMessage extends AgentRuntimeSupervise {
     this.deps.bus.notifyAgent({ agentId: this.agentId, state: 'busy', ...this.queueContext() })
     // 回合失败标记(须在 try 外声明,finally 依据它决定重投还是消费)
     let sawRunError = false
+    /** C-P1-2:本回合是否产生过平台回执(决定人类调用作用域是否还需由 settle 兜底收口) */
+    let repliedToRequester = false
     /** 失败原因(事件 error / 生成器抛错):写入任务 history,供事后诊断 */
     let runErrorMessage = ''
     try {
@@ -205,6 +207,7 @@ export abstract class AgentRuntimeMessage extends AgentRuntimeSupervise {
           replyToId: typeof msg.metadata['x-aw-reply-to'] === 'string' ? msg.metadata['x-aw-reply-to'] : undefined,
           deliveryId: typeof msg.metadata['x-aw-delivery-id'] === 'string' ? msg.metadata['x-aw-delivery-id'] : undefined,
         })
+        repliedToRequester = true
       }
       // 交付兜底(harness 回合结束 ≠ 任务完成):
       //  - 回合产出过实质 artifact(LLM 完成了工作但跳过 complete_task 工具)→ 隐式完成,
@@ -318,6 +321,20 @@ export abstract class AgentRuntimeMessage extends AgentRuntimeSupervise {
     finally {
       this.abortController = null
       this.currentTaskId = null
+      // C-P1-2:回合落定即通知 manager。回执成功时 manager 已在 platformReply 里按
+      // invocationId 精确清除;失败/无回执路径必须由这里兜底清除,否则 scope 永久驻留。
+      if (this.deps.onInvocationSettled) {
+        try {
+          this.deps.onInvocationSettled({
+            agentId: this.agentId,
+            deliveryId: typeof msg.metadata?.['x-aw-delivery-id'] === 'string' ? msg.metadata['x-aw-delivery-id'] : null,
+            replied: repliedToRequester,
+          })
+        }
+        catch (err) {
+          log.error(`[AgentRuntime:${this.agentId}] 调用作用域收口回调失败:`, err)
+        }
+      }
       if (this.state === 'busy') {
         this.state = 'idle'
         this.deps.bus.notifyAgent({ agentId: this.agentId, state: 'idle', ...this.queueContext() })

package/server/services/workshop/runtime/agent-runtime/state.ts

@@ -94,6 +94,12 @@ export abstract class AgentRuntimeState extends AgentRuntimeContracts {
         /** 投递台账 id(闭环留痕) */
         deliveryId?: string
       }) => void
+      /**
+       * C-P1-2(2026-10-28 审查):回合落定回调 —— **无论是否产生回执**都触发。
+       * manager 据此收口"人类发起者作用域":失败回合(只调工具/报错/被停)不会再走
+       * platformReply,旧实现让 scope 永久驻留并封锁该 Agent 的管理面/写面。
+       */
+      onInvocationSettled?: (e: { agentId: string, deliveryId: string | null, replied: boolean }) => void
       /**
        * 监督信号回调(§7.1 supervise.watchdog):watchdog 触发时把结构化信号交给
        * manager 落 Channel 共享记忆。平台侧回调,不改变 watchdog 的非破坏语义。
@@ -134,9 +140,9 @@ export abstract class AgentRuntimeState extends AgentRuntimeContracts {
     if (typeof attach === 'function') attach.call(this.impl, deps.workspace)
   }
 
-  /** 投递消息;idle 时立即唤醒消费 */
-  enqueue(message: A2AMessage): void {
-    this.deps.mailbox.enqueue(message)
+  /** 投递消息;idle 时立即唤醒消费。返回 false = 信箱已关闭(停机窗口),消息未落地。 */
+  enqueue(message: A2AMessage): boolean {
+    return this.deps.mailbox.enqueue(message)
   }
 
   getState(): 'idle' | 'busy' | 'stopped' {

package/server/services/workshop/runtime/agent-runtime/types.ts

@@ -164,7 +164,8 @@ export interface AgentRuntimeLike {
   readonly role: 'lead' | 'worker'
   readonly channelId: string
   readonly name: string
-  enqueue(message: A2AMessage): void
+  /** 投递消息;返回 false = 信箱已关闭(停机窗口),调用方必须如实上报未送达 */
+  enqueue(message: A2AMessage): boolean
   getState(): 'idle' | 'busy' | 'stopped'
   /** 实时状态视图(idle/busy/stopped + 当前任务 + 队列长度) */
   getStatus(): AgentStatusView

package/server/services/workshop/runtime/channel-runtime.ts

@@ -79,7 +79,9 @@ export class ChannelRuntime {
     for (const agentId of this.resolveRecipients(message)) {
       const agent = this.ensureAgent(agentId)
       if (!agent) continue
-      agent.enqueue(message)
+      // 闭箱(停机窗口)不算送达:如实返回未投递,发送方据此可重试/报错,
+      // 绝不出现"success + 消息永久丢失"(2026-10-28 审查 C-P1-1)。
+      if (!agent.enqueue(message)) continue
       delivered.push(agentId)
       // 空闲收件人即时唤醒消费循环
       if (agent.getState() === 'idle') agent.wakeMailbox()

package/server/services/workshop/runtime/mailbox.ts

@@ -56,9 +56,11 @@ export class Mailbox {
     this.onWake = wake
   }
 
-  /** 投递:落库 pending + 唤醒 dequeue 门闩 + 到信回调 + 通知外部 */
-  enqueue(message: A2AMessage): void {
-    if (this.closed) return
+  /** 投递:落库 pending + 唤醒 dequeue 门闩 + 到信回调 + 通知外部。
+   *  返回 false = 信箱已关闭(停机窗口):消息**未落库**,调用方不得上报"已送达"
+   *  (2026-10-28 审查 C-P1-1:闭箱静默吞消息 + route 照常计入 delivered = 假送达)。 */
+  enqueue(message: A2AMessage): boolean {
+    if (this.closed) return false
     this.messageRepo.create({
       // 保留发送方 messageId 作为落库 id:API 返回的 messageId 才能与历史/状态一致关联
       id: message.messageId,
@@ -78,6 +80,7 @@ export class Mailbox {
       catch { /* 回调异常不阻断投递 */ }
     }
     this.onWake()
+    return true
   }
 
   /** 到信回调注册(即时唤醒阻塞等待方);返回注销函数 */

package/server/services/workshop/runtime/manager/a2a.ts

@@ -23,7 +23,7 @@ export abstract class ManagerA2A extends ManagerTasks {
     // 调用者若正在服务一次人类发起的调用,其委派必须继承**同一个**(并只收紧)作用域:
     // 否则普通成员 @Agent 后,该 Agent 再委派给兄弟 Agent,被委派者就变回"无人类上下文",
     // 等于用一次委派把成员权限洗成系统权限。
-    const callerScope = this.activeInvocationScopes.get(callerAgentId) ?? null
+    const callerScope = this.activeScopeOf(callerAgentId)
     const inbound = parseWorkshopPermissionScope(input.metadata?.[WORKSHOP_PERMISSION_SCOPE_HEADER])
     const delegatedScope = callerScope
       ? intersectWorkshopPermissionScope(callerScope, inbound)
@@ -36,11 +36,13 @@ export abstract class ManagerA2A extends ManagerTasks {
       'x-aw-target-agent': target.id,
       'x-aw-from-agent': callerAgentId,
     })
-    if (delegatedScope) this.activeInvocationScopes.set(target.id, delegatedScope)
+    if (delegatedScope) this.setInvocationScope(target.id, delegatedScope)
     // 真送达契约:route 回执必须包含目标(落库 enqueue 同步完成),否则向上抛错 ——
     // 消息绝不允许"报告已发送"却没进对方信箱
     const delivered = this.route(channelId, message)
     if (!delivered.includes(target.id)) {
+      // C-P1-2:未送达 → 被委派者身上的作用域必须撤销(否则一次失败委派永久收紧其权限)
+      this.clearInvocationScope(target.id, delegatedScope?.invocationId ?? null)
       throw new AppError(502, 'DELIVERY_FAILED', `消息未能投递到 ${target.name} 的信箱(成员装配失败),请重试或改投其他成员`)
     }
     return message

package/server/services/workshop/runtime/manager/admin-channel.ts

@@ -221,7 +221,7 @@ export abstract class ManagerAdminChannel extends ManagerNotifications {
    * 此前只有 REST/MCP 路径生效,群成员 @Agent 时的高危工具限制被绕过。
    */
   invocationScopeOf(agentId: string) {
-    return this.activeInvocationScopes.get(agentId) ?? null
+    return this.activeScopeOf(agentId)
   }
 
   /** v18:Agent 实例 → 其频道绑定的产线 id(只读扩权依据;未绑/找不到 = null) */

package/server/services/workshop/runtime/manager/chat.ts

@@ -364,11 +364,13 @@ export abstract class ManagerChat extends ManagerAccess {
         }),
       })
       // 记为该 Agent 当前人类调用作用域:工具调用与 Agent 间委派都要按它收紧(§13.3)。
-      this.activeInvocationScopes.set(targetAgentId, parseWorkshopPermissionScope(
+      this.setInvocationScope(targetAgentId, parseWorkshopPermissionScope(
         message.metadata?.[WORKSHOP_PERMISSION_SCOPE_HEADER],
       ) as WorkshopPermissionScope)
       const delivered = this.route(channelId, message)
       if (!delivered.includes(targetAgentId)) {
+        // C-P1-2:投递失败 → 作用域立即撤销(否则一次失败投递会永久封锁该 Agent)
+        this.clearInvocationScope(targetAgentId, deliveryId)
         return finish('failed', {
           mailboxMessageId: message.messageId,
           error: `未投递到 ${targetAgentId} 的 mailbox`,

package/server/services/workshop/runtime/manager/host-tools.ts

@@ -106,7 +106,7 @@ export abstract class ManagerHostTools extends ManagerA2A {
     // @Agent 不等于把 owner 权限委托给成员,发起者权限不得因 Agent 身份更高而放大。
     // 无作用域(系统/agent 自发调用)→ 放行,沿用既有授权(MCP token / REST 用户鉴权)。
     {
-      const scope = this.activeInvocationScopes.get(input.agentId)
+      const scope = this.activeScopeOf(input.agentId)
       const verdict = checkToolAgainstScope(scope, input.tool)
       if (!verdict.allowed) throw new AppError(403, verdict.reason, verdict.message)
     }

package/server/services/workshop/runtime/manager/runtime-wiring.ts

@@ -113,13 +113,12 @@ export abstract class ManagerRuntimeWiring extends ManagerBus {
         // 人类调用已收口:解除该 Agent 的发起者作用域限制(§13.3)。
         // 仅当这次回复对应的正是当前记录的那次人类调用时清除(invocationId 比对),
         // 避免把随后到达的另一次调用的作用域误删;老路径无 deliveryId 时按"收口即清除"。
-        {
-          const active = this.activeInvocationScopes.get(agent.id)
-          if (active && (!reply.deliveryId || active.invocationId === reply.deliveryId)) {
-            this.activeInvocationScopes.delete(agent.id)
-          }
-        }
+        this.clearInvocationScope(agent.id, reply.deliveryId ?? null)
       },
+      // C-P1-2(2026-10-28 审查):回合结束(无论是否产生回执)都收口人类调用作用域。
+      // 无回执的回合(模型只调工具/报错/被停)不会再触发 platformReply,旧实现在这条
+      // 失败路径上让 scope 永久驻留 → lead 管理面/worker 写面被陈旧限制封锁。
+      onInvocationSettled: e => this.clearInvocationScope(e.agentId, e.deliveryId ?? null),
       // 监督信号(§7.1 supervise.watchdog)与 Harness 重建(§7.1 harness.restarted)
       // 必须落 Channel 共享记忆 —— watchdog 只在内存态可见等于"零观测"。
       onSupervisionSignal: e => this.recordSupervisionSignal(e),
@@ -136,9 +135,11 @@ export abstract class ManagerRuntimeWiring extends ManagerBus {
     return runtime
   }
 
-  /** 按需装配实例运行时(幂等):已装配返回缓存,否则从实例行 wire;禁用/不存在返回 undefined */
+  /** 按需装配实例运行时(幂等):已装配返回缓存,否则从实例行 wire;禁用/不存在/停机中返回 undefined */
   protected ensureAgentRuntime(channelId: string, agentId: string): AgentRuntime | undefined {
     const key = runtimeKey(channelId, agentId)
+    // 停机窗口墓碑:既不返回半关闭的旧运行时,也不重建新运行时(否则消息进闭箱)
+    if (this.stoppingAgents.has(key)) return undefined
     const existing = this.agentIndex.get(key)
     if (existing) return existing
     const m = this.deps.repos.channelAgents.findByChannelAgent(channelId, agentId)
@@ -216,8 +217,9 @@ export abstract class ManagerRuntimeWiring extends ManagerBus {
       // 以前写死在 SchedulerLoop 构造默认值里,mock/规则引擎路径上最长要 10 分钟才可见。
       ...(Number.isFinite(workshopSettings().stall_ms) ? { stallMs: workshopSettings().stall_ms } : {}),
       ...options,
-      // 停滞看门狗活性源:agent 最近一次工具 invoke 时刻(工具调用即健康推进)
-      toolActivityOf: (agentId: string) => this.lastToolInvokeAt.get(agentId) ?? null,
+      // 停滞看门狗活性源:agent 最近一次工具 invoke 时刻(工具调用即健康推进)。
+      // C-P1-3:取 REST/MCP 回程与全引擎分发入口打点的并集 —— omp 原生/pi 从不过 REST。
+      toolActivityOf: (agentId: string) => this.toolActivityOf(agentId),
       // 调度快照的邮件上下文(lead 观察 worker 间通信的唯一来源;DB 为事实源)
       supervisionMail: limit => this.deps.repos.messages
         .listRecentByChannel(channelId, limit)
@@ -242,18 +244,28 @@ export abstract class ManagerRuntimeWiring extends ManagerBus {
     const key = runtimeKey(channelId, agentId)
     const runtime = this.agentIndex.get(key)
     if (!runtime) return
+    // C-P1-1(2026-10-28 审查):所有"摘除"动作在第一个 await 之前同步完成。
+    // 旧实现把 agentIndex.delete 放在 await stop() 之后,停机窗口内:
+    //   route → ensureAgentRuntime 命中旧索引 → enqueue 进正在关闭的信箱 → 假送达 + 永久丢失;
+    //   即便先 detach,loader 也能按 agentIndex 缓存把旧运行时装回去。
+    // 现在的顺序 = 立墓碑 → 摘索引 → 摘频道成员 → 清人类调用作用域 → 后台停机。
+    this.stoppingAgents.add(key)
+    this.agentIndex.delete(key)
     const cr = this.channels.get(channelId)
-    const scheduler = runtime.role === 'lead' ? cr?.scheduler : null
-    if (scheduler) {
-      await scheduler.stopAndWait()
-      cr!.scheduler = null
-    }
-    // 先摘除再停机:runtime.stop() 会关闭 mailbox,若成员仍在 route 视野内,
-    // 停机窗口内到达的消息会被 closed mailbox 静默吞掉但 delivered 照常上报
-    // (发送方收到成功假象);先 detach 让 route 立即按"成员不存在"如实失败
     cr?.detachAgent(agentId)
-    await runtime.stop()
-    this.agentIndex.delete(key)
+    this.clearInvocationScope(agentId)
+    try {
+      const scheduler = runtime.role === 'lead' ? cr?.scheduler : null
+      if (scheduler) {
+        await scheduler.stopAndWait()
+        if (cr) cr.scheduler = null
+      }
+      await runtime.stop()
+    }
+    finally {
+      // 停机完成即允许惰性复活(新消息触发 wireMember 重建)
+      this.stoppingAgents.delete(key)
+    }
     if (cr && cr.getAgents().length === 0 && !cr.scheduler) {
       this.channels.delete(channelId)
       this.buses.delete(channelId)

package/server/services/workshop/runtime/manager/state.ts

@@ -20,6 +20,8 @@ import { TERMINAL_TASK_STATES } from '../../types/task'
 import { TaskEngine as TaskEngineImpl } from '../task-engine'
 import { createEnvEmbeddingProvider } from '../embedding-provider'
 import { log, buildMessage } from './helpers'
+import { toolActivityAt } from '../../agents/host-tool-bridge'
+import { settleInvocationScope } from '../permission-scope'
 
 import { rowToMessage } from '../mailbox'
 import { platformNoticeKey, newPlatformNoticeId, setPlatformNoticeSink, type PlatformNotice, type PlatformNoticeSink } from '../platform-notice'
@@ -75,6 +77,12 @@ export abstract class ManagerState extends ManagerContracts {
   protected channels = new Map<string, ChannelRuntime>()
   /** 键 = runtimeKey(channelId, 实例 id);每个实例一个独立运行时 */
   protected agentIndex = new Map<string, AgentRuntime>()
+  /**
+   * 正在停机卸载的实例(runtimeKey)。C-P1-1:stopAndDetach 必须在第一个 await 之前
+   * 同步摘除索引并立墓碑,否则 route 的按需装载会在停机窗口命中原运行时/重建新运行时,
+   * 把消息投进正在关闭的信箱(假送达 + 永久丢失)。
+   */
+  protected readonly stoppingAgents = new Set<string>()
   protected buses = new Map<string, ChannelBus>()
   protected taskEngine: TaskEngine | null = null
   protected idleSweeperTimer: NodeJS.Timeout | null = null
@@ -87,8 +95,21 @@ export abstract class ManagerState extends ManagerContracts {
   protected readonly reflectCounts = new Map<string, number>()
   /** shared task digest 节流：channel/task/event bucket -> last write time */
   protected readonly teamMemoryCheckpointAt = new Map<string, number>()
-  /** agent 最近一次工具 invoke 时刻(调度器停滞看门狗的活性源;工具调用即健康推进) */
+  /**
+   * agent 最近一次工具 invoke 时刻(REST/MCP 回程路径)。
+   * C-P1-3:omp 原生/pi 扩展不经此处,必须与 host-tool-bridge 的统一活性注册表取并集
+   * (见 toolActivityOf;否则默认引擎下信号恒空)。
+   */
   protected readonly lastToolInvokeAt = new Map<string, number>()
+
+  /** 调度器活性信号:两条来源取最新(REST/MCP 回程 + 全引擎分发入口打点) */
+  protected toolActivityOf(agentId: string): number | null {
+    const a = this.lastToolInvokeAt.get(agentId) ?? 0
+    const b = toolActivityAt(agentId) ?? 0
+    const at = Math.max(a, b)
+    return at > 0 ? at : null
+  }
+
   /**
    * 每个 Agent 当前正在服务的**人类发起者作用域**(§13.3)。
    * 由群聊投递(deliverChatToAgent)写入,Agent 回复(platformReply)后清除。
@@ -97,6 +118,27 @@ export abstract class ManagerState extends ManagerContracts {
    * 而工具调用是由 harness 侧发起的往返,逐次透传需要改协议,取本表更保守(宁可收紧)。
    */
   protected readonly activeInvocationScopes = new Map<string, WorkshopPermissionScope>()
+
+  /** 读作用域(统一入口;所有读点经此,便于集中加失效语义) */
+  protected activeScopeOf(agentId: string): WorkshopPermissionScope | null {
+    return this.activeInvocationScopes.get(agentId) ?? null
+  }
+
+  /** 写作用域(人类调用投递时登记) */
+  protected setInvocationScope(agentId: string, scope: WorkshopPermissionScope): void {
+    this.activeInvocationScopes.set(agentId, scope)
+  }
+
+  /**
+   * 清作用域。C-P1-2(2026-10-28 审查):除"回复收口"外,回合结束未产生回执
+   * (模型只调工具/报错/被停)也必须清除 —— 旧实现只在 platformReply 里清,
+   * 失败回合会让陈旧 scope 永久封锁该 Agent 的管理面/写面(自增强卡死)。
+   * invocationId 给出时只清对应那次调用(不误删随后到达的新调用)。
+   */
+  protected clearInvocationScope(agentId: string, invocationId?: string | null): void {
+    settleInvocationScope(this.activeInvocationScopes, agentId, invocationId)
+  }
+
   /** v16 定时任务执行器(timer 唯一持有者;startScheduleRuntime 装配,shutdown 停止) */
   protected scheduleRuntime: ScheduleRuntime | null = null
   /**

package/server/services/workshop/runtime/permission-scope.ts

@@ -81,3 +81,24 @@ export function scopeFromMetadata(
   if (!metadata) return null
   return parse(metadata[header])
 }
+
+/**
+ * 人类调用作用域收口(C-P1-2,2026-10-28 审查)。
+ *
+ * 作用域必须随"该次人类调用收口"而失效:正常回执时按 invocationId 精确清除;
+ * 回合失败/无回执时由回合落定回调兜底清除 —— 否则陈旧 scope 永久封锁该 Agent 的
+ * 管理面/写面,且后续系统调用无从解开。invocationId 为空 = 无条件清除(老路径)。
+ *
+ * @returns true = 确实清除了一条作用域
+ */
+export function settleInvocationScope(
+  map: Map<string, { invocationId?: string | null }>,
+  agentId: string,
+  invocationId?: string | null,
+): boolean {
+  const active = map.get(agentId)
+  if (!active) return false
+  if (invocationId && active.invocationId && active.invocationId !== invocationId) return false
+  map.delete(agentId)
+  return true
+}

package/server/services/workshop/runtime/scheduler-loop/tick.ts

@@ -13,6 +13,8 @@ import { workshopSettings } from '../../settings'
 export abstract class SchedulerLoopTick extends SchedulerLoopState {
   /** HITL 等待豁免登记:同一根任务只发一次顺延日志(落定后清理) */
   protected hitlDeferred = new Set<string>()
+  /** 每个根被 HITL 顺延的次数(上限后恢复 ROOT_TIMEOUT,避免 hold 模式永久挂起) */
+  protected hitlDeferrals = new Map<string, number>()
   protected async runRound(): Promise<void> {
     this.running = true
     try {
@@ -65,19 +67,28 @@ export abstract class SchedulerLoopTick extends SchedulerLoopState {
       // 执行预算顺延一个 root_timeout,不做 ROOT_TIMEOUT 收口 —— 审批自身有 fail-closed
       // 超时(security.recipe_dispatch_timeout_ms),人类思考期不应处决整棵任务树。
       // 豁免仅在「有待批」时生效;审批落定(批准执行/超时关闭)后预算仍耗尽则照常收口。
+      // 2026-10-28:此前的 listPending() 无任何过滤 —— 任意 channel 的一张待批单都会让
+      // 本 channel 的每个超期根每 tick 顺延并提前 return(不派发/不判超时);hold 模式下
+      // 一张无人处理的单可让全平台调度永久停摆。现在只统计本 channel 成员的待批。
       const hitlPending = await (async () => {
         try {
           const { getToolApprovals } = await import('../../agents/tool-approvals')
-          return getToolApprovals().listPending().length > 0
+          const memberIds = new Set(snapshot.members.map(m => m.agentId))
+          return getToolApprovals().listPending().some(a => memberIds.has(a.agentId))
         }
         catch { return false }
       })()
-      if (hitlPending) {
+      const MAX_HITL_DEFERRALS = 3
+      const deferrable = hitlPending
+        ? expiredRoots.filter(r => (this.hitlDeferrals.get(r.id) ?? 0) < MAX_HITL_DEFERRALS)
+        : []
+      if (deferrable.length > 0 && deferrable.length === expiredRoots.length) {
         const budget = new Date(Date.now() + (Number(workshopSettings().root_timeout_ms) || 900_000)).toISOString()
-        for (const root of expiredRoots) {
+        for (const root of deferrable) {
+          this.hitlDeferrals.set(root.id, (this.hitlDeferrals.get(root.id) ?? 0) + 1)
           if (!this.hitlDeferred.has(root.id)) {
             this.hitlDeferred.add(root.id)
-            log.warn(`[SchedulerLoop:${this.lead.agentId}] 根任务 ${root.id.slice(0, 8)} 预算耗尽,但频道有 HITL 待批 —— 执行预算顺延至 ${budget}`)
+            log.warn(`[SchedulerLoop:${this.lead.agentId}] 根任务 ${root.id.slice(0, 8)} 预算耗尽,但本频道有 HITL 待批 —— 执行预算顺延至 ${budget}(第 ${this.hitlDeferrals.get(root.id)}/${MAX_HITL_DEFERRALS} 次)`)
           }
           try {
             // 能力探测(mirror execute.ts):极简 TaskEngine 替身可能缺 refreshDeadline,缺失时跳过
@@ -90,6 +101,7 @@ export abstract class SchedulerLoopTick extends SchedulerLoopState {
         return
       }
       this.hitlDeferred.clear()
+      this.hitlDeferrals.clear()
       for (const root of expiredRoots) {
         const closed = this.lead.taskEngine.timeoutTree(root.id, this.lead.agentId)
         for (const task of closed) {

package/server/services/workshop/scene-events.ts

@@ -35,6 +35,25 @@ export function setPeerVisibleLines(peer: WsPeer, visible: Set<string> | null):
   (peer as WsPeer & { __awVisibleLines?: Set<string> | null }).__awVisibleLines = visible
 }
 
+/** S14:记录 peer 的用户身份,便于授权变更时就地刷新可见集(无需客户端重连) */
+export function setPeerIdentity(peer: WsPeer, user: { id: string, role: string }): void {
+  (peer as WsPeer & { __awPeerUser?: { id: string, role: string } }).__awPeerUser = user
+}
+
+/** S14:授权变更后重算该用户所有在线 peer 的产线可见集(撤权立即生效) */
+export async function refreshPeerVisibility(userId: string): Promise<void> {
+  const targets = [...peers()].filter(p => (p as WsPeer & { __awPeerUser?: { id: string } }).__awPeerUser?.id === userId)
+  if (targets.length === 0) return
+  try {
+    const { visibleLineIds } = await import('./permissions')
+    for (const peer of targets) {
+      const u = (peer as WsPeer & { __awPeerUser?: { id: string, role: string } }).__awPeerUser
+      if (u) setPeerVisibleLines(peer, visibleLineIds(u))
+    }
+  }
+  catch { /* 权限服务未就绪:保留旧可见集,下次重连刷新 */ }
+}
+
 function peerSeesLine(peer: WsPeer, lineId: string): boolean {
   const visible = (peer as WsPeer & { __awVisibleLines?: Set<string> | null }).__awVisibleLines
   if (visible == null) return true

package/shared/daq-protocol.ts

@@ -298,8 +298,8 @@ export const DAQ_DRIVERS: DaqDriverMeta[] = [
       { key: 'scale', label: '缩放系数', type: 'number', default: 1, hint: '原始值 × scale = 工程量(如 0.1)' },
       { key: 'byteOrder', label: '字节序', type: 'select', default: 'big', options: [
         { value: 'big', label: '大端(AB CD)' },
-        { value: 'little', label: '小端(CD AB)' },
-        { value: 'wordSwap', label: '字交换(CD AB / 交换单字)' },
+        { value: 'little', label: '小端(DC BA / 全字节反转)' },
+        { value: 'wordSwap', label: '字交换(CD AB / 仅换字序)' },
       ] },
     ],
   },
@@ -344,8 +344,8 @@ export const DAQ_DRIVERS: DaqDriverMeta[] = [
       { key: 'scale', label: '缩放系数', type: 'number', default: 1, hint: '原始值 × scale = 工程量(如 0.1)' },
       { key: 'byteOrder', label: '字节序', type: 'select', default: 'big', options: [
         { value: 'big', label: '大端(AB CD)' },
-        { value: 'little', label: '小端(CD AB)' },
-        { value: 'wordSwap', label: '字交换(CD AB / 交换单字)' },
+        { value: 'little', label: '小端(DC BA / 全字节反转)' },
+        { value: 'wordSwap', label: '字交换(CD AB / 仅换字序)' },
       ] },
     ],
   },
@@ -539,11 +539,30 @@ export interface AepDaqControllerState {
 }
 
 /** driverConfig 出口脱敏:键名含 password/secret/token/passwd/api_key 的值置换为 '******'(REST/AEP 投影用;持久化与驱动内部不经过此函数) */
+export const MASKED_SECRET = '******'
+const SECRET_KEY_RE = /pass(word)?|secret|token|passwd|api[-_]?key/i
 export function maskDriverConfigSecrets<T extends Record<string, unknown>>(cfg: T | undefined | null): T {
   if (!cfg || typeof cfg !== 'object') return {} as T
   const out: Record<string, unknown> = { ...cfg }
   for (const k of Object.keys(out)) {
-    if (/pass(word)?|secret|token|passwd|api[-_]?key/i.test(k)) out[k] = '******'
+    if (SECRET_KEY_RE.test(k)) out[k] = MASKED_SECRET
+  }
+  return out as T
+}
+
+/**
+ * driverConfig 入口过滤(2026-10-28 审查 P0-2):剔除"回显回来的掩码值"键。
+ *
+ * 前端参数页把 GET 投影(含 `******`)整包 PATCH 回来时,若直接 merge,真实口令
+ * 会被字面量 `******` 覆盖 → 节点永久 offline 且无法从视图发现。掩码哨兵只允许
+ * 出现在出口方向;入口在 merge 之前单点剔除,新明文照常写入(掩码键给新值 = 修改)。
+ */
+export function stripMaskedSecrets<T extends Record<string, unknown>>(cfg: T | undefined | null): T {
+  if (!cfg || typeof cfg !== 'object') return {} as T
+  const out: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(cfg)) {
+    if (v === MASKED_SECRET && SECRET_KEY_RE.test(k)) continue
+    out[k] = v
   }
   return out as T
 }